@pellux/goodvibes-tui 1.1.0 → 1.9.0

package/src/shell/blocking-input.ts

@@ -4,9 +4,14 @@ import type { SessionSnapshot } from '@/runtime/index.ts';
 import type { SystemMessageRouter } from '../core/system-message-router.ts';
 import type { ConversationMessageSnapshot } from '@pellux/goodvibes-sdk/platform/core';
 import { replayJournalForSession } from '../core/session-recovery.ts';
+import { applyHunkKey, buildModifiedEditArgs, type HunkSelectionState } from '../permissions/hunk-selection.ts';
 
 export type PendingPermissionState = PermissionRequest & {
-  resolve: (approved: boolean, remember?: boolean) => void;
+  resolve: (approved: boolean, remember?: boolean, modifiedArgs?: Record<string, unknown>) => void;
+  /** Present only when isHunkSelectable(request) was true when the prompt was opened. */
+  hunkState?: HunkSelectionState;
+  /** True once the user pressed `d` to expand a condensed low-risk card. (UX-B 2b.) */
+  detailsExpanded?: boolean;
 };
 
 export type BlockingInputHandlerOptions = {
@@ -19,6 +24,15 @@ export type BlockingInputHandlerOptions = {
   render: () => void;
   loadRecoveryConversation: () => SessionSnapshot | null;
   deleteRecoveryFile: () => void;
+  /**
+   * Copy the live recovery.jsonl aside to a preserved sibling so the dismiss
+   * message's promise ("still on disk") survives this session's later 60s
+   * autosaves, which would otherwise overwrite the shared recovery file with
+   * the CURRENT (post-dismiss) session's state (W3 Finding 3). Optional so
+   * every pre-existing test/caller that doesn't care about preservation is
+   * unaffected; when omitted, dismiss behaves exactly as before.
+   */
+  preserveRecoveryFile?: () => { readonly preserved: boolean; readonly replacedPrevious: boolean };
   /**
    * Absolute home directory used to locate the transcript journal for this
    * recovery session. Required for journal replay on Ctrl+R restore.
@@ -65,6 +79,7 @@ export function handleBlockingShellInput(
     render,
     loadRecoveryConversation,
     deleteRecoveryFile,
+    preserveRecoveryFile,
     homeDirectory,
     sessionId,
     persistSnapshot,
@@ -73,6 +88,24 @@ export function handleBlockingShellInput(
 
   if (pendingPermission) {
     const req = pendingPermission;
+
+    if (req.hunkState) {
+      const { state, commit } = applyHunkKey(req.hunkState, data);
+      if (commit === 'apply') {
+        req.resolve(true, false, buildModifiedEditArgs(req, state));
+        render();
+        return { handled: true, pendingPermission: null, recoveryPending };
+      }
+      if (commit === 'cancel') {
+        req.resolve(false, false);
+        abortTurn();
+        render();
+        return { handled: true, pendingPermission: null, recoveryPending };
+      }
+      render();
+      return { handled: true, pendingPermission: { ...req, hunkState: state }, recoveryPending };
+    }
+
     const key = data.toLowerCase().trim();
 
     if (key === 'y') {
@@ -94,6 +127,16 @@ export function handleBlockingShellInput(
       return { handled: true, pendingPermission: null, recoveryPending };
     }
 
+    if (key === 'd') {
+      // Toggle the condensed↔full detail view without resolving the request.
+      render();
+      return {
+        handled: true,
+        pendingPermission: { ...req, detailsExpanded: !req.detailsExpanded },
+        recoveryPending,
+      };
+    }
+
     render();
     return { handled: true, pendingPermission, recoveryPending };
   }
@@ -135,10 +178,31 @@ export function handleBlockingShellInput(
       return { handled: true, pendingPermission: null, recoveryPending: false };
     }
 
-    // Stray key: leave the recovery prompt active so the user can still Ctrl+R or Esc.
-    systemMessageRouter.high('[Recovery] Ctrl+R to restore · Esc to discard');
+    // Any other key demonstrates the user's intent to ignore the banner and
+    // keep working — the prompt's own text invites exactly this ("start
+    // typing to ignore it"). Previously this branch re-posted the same
+    // '[Recovery] Ctrl+R to restore...' line on EVERY such key and never
+    // cleared recoveryPending, so a user who took that invitation got a
+    // fresh [Recovery] line injected into the transcript around every
+    // character they typed, forever. Dismiss ONCE instead: clear
+    // recoveryPending so it stops re-asserting, but do NOT delete the
+    // recovery file — dismiss is not discard, and the file remains
+    // restorable by the automatic recovery check on the next launch.
+    //
+    // W3 Finding 3: the promise below ("still on disk; you will be asked
+    // again") used to go false silently — main.ts's 60s autosave overwrites
+    // the single shared recovery.jsonl with the CURRENT session's state
+    // within a minute. preserveRecoveryFile (when wired) copies it aside
+    // NOW, while it still holds the dismissed session's data, so the
+    // promise stays true. If an earlier dismiss's preserved snapshot gets
+    // replaced by this one, say so honestly instead of silently discarding it.
+    const preserveResult = preserveRecoveryFile?.();
+    if (preserveResult?.replacedPrevious) {
+      systemMessageRouter.low('[Recovery] Replacing the previously preserved (unrestored) snapshot with this one.');
+    }
+    systemMessageRouter.high('[Recovery] Dismissed — the unsaved session is still on disk; you will be asked again next time GoodVibes starts here.');
     render();
-    return { handled: false, pendingPermission, recoveryPending: true };
+    return { handled: false, pendingPermission, recoveryPending: false };
   }
 
   return { handled: false, pendingPermission, recoveryPending };

package/src/shell/recovery-input-helpers.ts

@@ -5,8 +5,15 @@
  * architecture line ceiling; main() wires these with its live services.
  */
 
+import { copyFileSync, existsSync, readFileSync, unlinkSync } from 'node:fs';
 import type { ConversationMessageSnapshot } from '../core/conversation.ts';
-import type { SessionSnapshot } from '@/runtime/index.ts';
+import type { SessionReturnContextSummary, SessionSnapshot } from '@/runtime/index.ts';
+import {
+  checkRecoveryFile,
+  deleteRecoveryFile as deleteLiveRecoveryFile,
+  getRecoveryFilePath,
+  loadRecoveryConversation as loadLiveRecoveryConversation,
+} from '@/runtime/index.ts';
 
 export interface PersistRecoveryDeps {
   readonly sessionManager: {
@@ -41,6 +48,168 @@ export function createReopenRecoveryPanels(deps: ReopenPanelsDeps): (snapshot: S
   };
 }
 
+// ---------------------------------------------------------------------------
+// W3 Finding 3: preserve the dismissed recovery snapshot.
+//
+// main.ts's 60s autosave (writeRecoveryFile) overwrites the single shared
+// recovery.jsonl with the CURRENT session's live state within a minute — so
+// the dismiss banner's promise ("still on disk; you will be asked again next
+// time") went false silently well before the next launch. Fix: the moment
+// the user dismisses (blocking-input.ts), copy recovery.jsonl aside to a
+// preserved sibling file (recovery.jsonl.preserved) so it survives this
+// session's later autosaves. Startup then checks BOTH the live file and the
+// preserved sibling and offers whichever is newer (pickNewestRecoveryInfo),
+// bounded to exactly one preserved file — a later dismiss replaces it, and
+// that replacement is reported honestly (PreserveRecoveryResult.replacedPrevious)
+// rather than silently dropping the older snapshot.
+// ---------------------------------------------------------------------------
+
+export interface RecoveryFileDeps {
+  readonly homeDirectory: string;
+  readonly surfaceRoot?: string | undefined;
+}
+
+export interface PreservedRecoveryInfo {
+  readonly title: string;
+  readonly timestamp: number;
+  readonly sessionId: string;
+  readonly returnContext?: SessionReturnContextSummary | undefined;
+}
+
+export interface PreserveRecoveryResult {
+  /** True if a live recovery.jsonl existed and was copied to the preserved sibling. */
+  readonly preserved: boolean;
+  /** True if an existing preserved sibling (from an earlier dismiss) was overwritten. */
+  readonly replacedPrevious: boolean;
+}
+
+function preservedRecoveryPath(deps: RecoveryFileDeps): string {
+  return `${getRecoveryFilePath(deps.homeDirectory, deps.surfaceRoot)}.preserved`;
+}
+
+function readRecoveryMetaLine(path: string): { title?: string; timestamp?: number; sessionId?: string; returnContext?: SessionReturnContextSummary } | null {
+  try {
+    if (!existsSync(path)) return null;
+    const firstLine = readFileSync(path, 'utf-8').split('\n')[0];
+    if (!firstLine) return null;
+    return JSON.parse(firstLine) as { title?: string; timestamp?: number; sessionId?: string; returnContext?: SessionReturnContextSummary };
+  } catch {
+    return null;
+  }
+}
+
+/** Copy the live recovery.jsonl aside to the preserved sibling. Called once, at dismiss. */
+export function createPreserveRecoveryFile(deps: RecoveryFileDeps): () => PreserveRecoveryResult {
+  return () => {
+    const live = getRecoveryFilePath(deps.homeDirectory, deps.surfaceRoot);
+    const preserved = preservedRecoveryPath(deps);
+    if (!existsSync(live)) return { preserved: false, replacedPrevious: false };
+    const replacedPrevious = existsSync(preserved);
+    try {
+      copyFileSync(live, preserved);
+      return { preserved: true, replacedPrevious };
+    } catch {
+      return { preserved: false, replacedPrevious: false };
+    }
+  };
+}
+
+/**
+ * Startup check for the preserved sibling — mirrors the SDK's
+ * checkRecoveryFile meta read, but for the fixed preserved path. No
+ * mtime-vs-last-clean-save gate: the preserved file is inert (never
+ * autosaved-over) until explicitly replaced or cleared, so its mere
+ * existence is actionable.
+ */
+export function checkPreservedRecoveryFile(deps: RecoveryFileDeps): PreservedRecoveryInfo | null {
+  const meta = readRecoveryMetaLine(preservedRecoveryPath(deps));
+  if (!meta) return null;
+  return { title: meta.title ?? '', timestamp: meta.timestamp ?? 0, sessionId: meta.sessionId ?? '', returnContext: meta.returnContext };
+}
+
+/** Load the preserved sibling's full snapshot — same JSONL shape as recovery.jsonl since it's a byte-identical copy. */
+export function loadPreservedRecoveryConversation(deps: RecoveryFileDeps): SessionSnapshot | null {
+  const path = preservedRecoveryPath(deps);
+  try {
+    if (!existsSync(path)) return null;
+    const lines = readFileSync(path, 'utf-8').split('\n').filter(Boolean);
+    if (lines.length < 2) return { messages: [] };
+    const metaLine = JSON.parse(lines[0]!) as { title?: string; titleSource?: SessionSnapshot['titleSource']; returnContext?: SessionSnapshot['returnContext'] };
+    return {
+      title: metaLine.title,
+      titleSource: metaLine.titleSource,
+      returnContext: metaLine.returnContext,
+      messages: lines.slice(1).map((line) => {
+        const { type: _type, ...rest } = JSON.parse(line) as { type: string } & Record<string, unknown>;
+        return rest;
+      }),
+    };
+  } catch {
+    return null;
+  }
+}
+
+/** Remove the preserved sibling — called after it has been restored or discarded. */
+export function deletePreservedRecoveryFile(deps: RecoveryFileDeps): void {
+  try {
+    unlinkSync(preservedRecoveryPath(deps));
+  } catch {
+    // missing file is fine
+  }
+}
+
+/**
+ * Pick the newer of the live vs. preserved recovery info for the startup
+ * prompt, tagging which source it came from so the caller knows which
+ * load/delete pair to use. Null when neither exists.
+ */
+export function pickNewestRecoveryInfo<T extends { readonly timestamp: number }>(
+  live: T | null,
+  preserved: T | null,
+): (T & { readonly source: 'live' | 'preserved' }) | null {
+  if (!live && !preserved) return null;
+  if (!live) return { ...(preserved as T), source: 'preserved' };
+  if (!preserved) return { ...live, source: 'live' };
+  return preserved.timestamp > live.timestamp
+    ? { ...(preserved as T), source: 'preserved' }
+    : { ...live, source: 'live' };
+}
+
+/**
+ * Startup entry point: resolve which recovery prompt (if any) main.ts should
+ * show — the live recovery.jsonl, or an earlier dismiss's preserved sibling,
+ * whichever is newer. Bundles checkRecoveryFile + checkPreservedRecoveryFile
+ * + pickNewestRecoveryInfo so main.ts's entrypoint stays a one-liner.
+ */
+export function resolveStartupRecoveryInfo(
+  deps: RecoveryFileDeps & { readonly workingDirectory: string },
+): (PreservedRecoveryInfo & { readonly source: 'live' | 'preserved' }) | null {
+  const live = checkRecoveryFile({ workingDirectory: deps.workingDirectory, homeDirectory: deps.homeDirectory });
+  const preserved = checkPreservedRecoveryFile(deps);
+  return pickNewestRecoveryInfo(live, preserved);
+}
+
+export interface RecoveryFileOps {
+  readonly loadRecoveryConversation: () => SessionSnapshot | null;
+  readonly deleteRecoveryFile: () => void;
+  readonly preserveRecoveryFile?: () => PreserveRecoveryResult;
+}
+
+/**
+ * Build the three source-aware recovery callbacks main.ts's stdin handler
+ * wires into handleBlockingShellInput. `getSource` is read fresh by
+ * load/delete on every call (main.ts's recoverySource can change between
+ * events); preserveRecoveryFile is only ever wired when the CURRENT prompt
+ * came from the live file (see createPreserveRecoveryFile's doc comment).
+ */
+export function createRecoveryFileOps(getSource: () => 'live' | 'preserved', deps: RecoveryFileDeps): RecoveryFileOps {
+  return {
+    loadRecoveryConversation: () => (getSource() === 'preserved' ? loadPreservedRecoveryConversation(deps) : loadLiveRecoveryConversation(deps)),
+    deleteRecoveryFile: () => (getSource() === 'preserved' ? deletePreservedRecoveryFile(deps) : deleteLiveRecoveryFile(deps)),
+    preserveRecoveryFile: getSource() === 'live' ? createPreserveRecoveryFile(deps) : undefined,
+  };
+}
+
 export interface ErrorAffordanceDeps {
   /** True when the failover retry context is armed (a retry is actually possible). */
   readonly retryArmed: boolean;

package/src/shell/ui-openers.ts

@@ -10,9 +10,13 @@ import type { FeatureFlagManager } from '@/runtime/index.ts';
 import type { McpRegistry } from '@pellux/goodvibes-sdk/platform/mcp';
 import type { SubscriptionManager } from '@pellux/goodvibes-sdk/platform/config';
 import type { SecretsManager } from '@pellux/goodvibes-sdk/platform/config';
+import type { MemoryEmbeddingProviderRegistry } from '@pellux/goodvibes-sdk/platform/state';
 import type { ServiceInspectionQuery } from '../runtime/ui-service-queries.ts';
-import type { ModelPickerTargetInfo } from '../input/model-picker.ts';
+import type { EmbeddingProviderPickerEntry, ModelPickerTargetInfo } from '../input/model-picker.ts';
+import type { SelectionItem } from '../input/selection-modal.ts';
 import { syncServiceSettingToPlatform } from './service-settings-sync.ts';
+import { setActiveThemeMode } from '../renderer/theme.ts';
+import { THEME_MODE_CONFIG_KEY, coerceThemeModeSetting } from '../renderer/theme-mode-config.ts';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 
 type WireShellUiOpenersOptions = {
@@ -28,6 +32,8 @@ type WireShellUiOpenersOptions = {
   subscriptionManager: SubscriptionManager;
   secretsManager?: Pick<SecretsManager, 'delete' | 'get' | 'set'>;
   serviceRegistry: Pick<ServiceInspectionQuery, 'getAll'>;
+  /** B29: backs the model picker's 'embeddings' target and its own item-list mode. */
+  memoryEmbeddingRegistry: Pick<MemoryEmbeddingProviderRegistry, 'getDefaultProviderId' | 'setDefaultProvider' | 'status'>;
   workingDirectory: string;
   homeDirectory: string;
   getConfiguredProviderIds: () => string[];
@@ -93,6 +99,7 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
     subscriptionManager,
     secretsManager,
     serviceRegistry,
+    memoryEmbeddingRegistry,
     workingDirectory,
     homeDirectory,
     getConfiguredProviderIds,
@@ -125,6 +132,7 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
     if (target === 'helper') return String(configManager.get('helper.globalModel') || runtime.model);
     if (target === 'tool') return String(configManager.get('tools.llmModel') || runtime.model);
     if (target === 'tts') return String(configManager.get('tts.llmModel') || runtime.model);
+    if (target === 'embeddings') return memoryEmbeddingRegistry.getDefaultProviderId();
     return runtime.model;
   };
 
@@ -134,10 +142,29 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
     if (target === 'helper') return String(configManager.get('helper.globalProvider') || runtime.provider);
     if (target === 'tool') return String(configManager.get('tools.llmProvider') || runtime.provider);
     if (target === 'tts') return String(configManager.get('tts.llmProvider') || runtime.provider);
+    if (target === 'embeddings') return memoryEmbeddingRegistry.getDefaultProviderId();
     return runtime.provider;
   };
 
-  const buildModelPickerTargets = (): ModelPickerTargetInfo[] => {
+  /**
+   * Fetch the embedding-provider status list once per picker-open and shape
+   * it into the picker's own tiny item type. Uses the registry's async
+   * `.status()` (not the sync `.list()`) specifically because `.list()` does
+   * not carry `configured` — and unconfigured providers must be shown
+   * honestly, not hidden.
+   */
+  async function resolveEmbeddingProviderEntries(): Promise<EmbeddingProviderPickerEntry[]> {
+    const statuses = await memoryEmbeddingRegistry.status();
+    return statuses.map((status) => ({
+      id: status.id,
+      label: status.label,
+      dimensions: status.dimensions,
+      configured: status.configured,
+      ...(status.detail ? { detail: status.detail } : {}),
+    }));
+  }
+
+  const buildModelPickerTargets = (embeddingEntries: EmbeddingProviderPickerEntry[]): ModelPickerTargetInfo[] => {
     const mainProvider = getProviderIdFromModel(configManager.get('provider.model') || runtime.provider).trim();
     const mainModel = String(configManager.get('provider.model') || runtime.model || '').trim();
     const helperProvider = String(configManager.get('helper.globalProvider') ?? '').trim();
@@ -146,6 +173,11 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
     const toolModel = String(configManager.get('tools.llmModel') ?? '').trim();
     const ttsProvider = String(configManager.get('tts.llmProvider') ?? '').trim();
     const ttsModel = String(configManager.get('tts.llmModel') ?? '').trim();
+    const embeddingProviderId = memoryEmbeddingRegistry.getDefaultProviderId();
+    const embeddingEntry = embeddingEntries.find((entry) => entry.id === embeddingProviderId);
+    const embeddingNote = embeddingEntry
+      ? `${embeddingEntry.id} · ${embeddingEntry.dimensions}d${embeddingEntry.configured ? '' : ' · unconfigured'}`
+      : `${embeddingProviderId} · unregistered`;
 
     return [
       {
@@ -184,12 +216,28 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
         enabled: true,
         inherited: ttsProvider.length === 0 && ttsModel.length === 0,
       },
+      {
+        target: 'embeddings',
+        label: 'Embeddings',
+        description: 'Embedding provider used for memory search and the code index. Not an LLM route — no model concept.',
+        provider: embeddingProviderId,
+        model: '',
+        enabled: true,
+        inherited: false,
+        configuredNote: embeddingNote,
+      },
     ];
   };
 
   commandContext.openModelPicker = () => {
     void (async () => {
-      const models = providerRegistry.getSelectableModels();
+      // D5: getSelectableModels() is catalog-driven and can list models whose
+      // `provider` id (e.g. 'google', sourced from the pricing catalog) was never
+      // handed to providerRegistry.register()/registerRuntimeProvider(). Selecting
+      // such a model fails hard at turn time with ProviderNotFoundError
+      // ("Provider 'X' is not registered."). Filter to runtime-registered
+      // providers only, so the picker never offers a model that cannot work.
+      const models = providerRegistry.getSelectableModels().filter((m) => providerRegistry.has(m.provider));
       const configuredIds = new Set(getConfiguredProviderIds());
       input.modelPicker.configuredProviders = configuredIds;
       const providerIds = [...new Set(models.map((m) => m.provider))];
@@ -199,8 +247,10 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
         input.modelPicker.pinnedIds = new Set(pinned);
       });
       void input.modelPicker.loadRecentModels().catch(() => {}); // best-effort: prefetch for UI, failure is non-visible
+      const embeddingEntries = await resolveEmbeddingProviderEntries();
+      input.modelPicker.embeddingProviders = embeddingEntries;
       input.modalOpened('modelPicker');
-      input.modelPicker.setTargetInfos(buildModelPickerTargets());
+      input.modelPicker.setTargetInfos(buildModelPickerTargets(embeddingEntries));
       input.modelPicker.openAllModels(models, getCurrentModelForPickerTarget());
       render();
     })().catch((error: unknown) => {
@@ -214,13 +264,21 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
 
   commandContext.openProviderPicker = () => {
     void (async () => {
-      const providers = [...new Set(providerRegistry.listModels().map((model) => model.provider))];
+      // D5: listModels() surfaces every catalog provider id, not just the ones
+      // actually registered on this runtime (see openModelPicker above for the
+      // same class of bug). Intersect against providerRegistry.has() so the
+      // provider picker never offers a provider that will fail with
+      // "Provider not registered" once a model under it is selected.
+      const providers = [...new Set(providerRegistry.listModels().map((model) => model.provider))]
+        .filter((providerId) => providerRegistry.has(providerId));
       const configuredIds = new Set(getConfiguredProviderIds());
       input.modelPicker.configuredProviders = configuredIds;
       const secretProviderIds = await resolveSecretProviderIds();
       input.modelPicker.configuredViaMap = buildConfiguredViaMap(providers, configuredIds, subscriptionManager, secretProviderIds);
+      const embeddingEntries = await resolveEmbeddingProviderEntries();
+      input.modelPicker.embeddingProviders = embeddingEntries;
       input.modalOpened('modelPicker');
-      input.modelPicker.setTargetInfos(buildModelPickerTargets());
+      input.modelPicker.setTargetInfos(buildModelPickerTargets(embeddingEntries));
       input.modelPicker.openProviders(providers, getCurrentProviderForPickerTarget());
       render();
     })().catch((error: unknown) => {
@@ -229,6 +287,15 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
     });
   };
 
+  commandContext.completeEmbeddingProviderSelection = (providerId: string) => {
+    try {
+      memoryEmbeddingRegistry.setDefaultProvider(providerId);
+    } catch (error: unknown) {
+      commandContext.print?.(`Failed to set embedding provider: ${summarizeError(error)}`);
+    }
+    render();
+  };
+
   commandContext.openSelection = (title, items, opts, callback) => {
     input.openSelection(title, items, opts, callback);
   };
@@ -272,15 +339,69 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
   commandContext.openSettingsModal = (target?: string) => {
     input.modalOpened('settings');
     input.settingsModal.open(configManager, featureFlags, subscriptionManager, serviceRegistry, mcpRegistry, secretsManager, {
-      onSettingApplied: (change) => syncServiceSettingToPlatform(
-        { configManager, workingDirectory, homeDirectory },
-        change,
-      ),
+      onSettingApplied: (change) => {
+        // DEBT-2: forced dark/light applies immediately (rebuild palettes + full
+        // repaint); auto only re-probes at startup, so it takes effect next launch.
+        if (String(change.key) === THEME_MODE_CONFIG_KEY) {
+          const next = coerceThemeModeSetting(change.value);
+          if (next === 'dark' || next === 'light') {
+            setActiveThemeMode(next);
+            commandContext.requestFullRepaint?.();
+            return { message: `Theme mode: ${next} (applied now)` };
+          }
+          return { message: 'Theme mode: auto (probes terminal on next startup)' };
+        }
+        return syncServiceSettingToPlatform(
+          { configManager, workingDirectory, homeDirectory },
+          change,
+        );
+      },
     });
     input.settingsModal.selectTarget(target);
     render();
   };
 
+  // W6.1 (the purge): open a MIGRATE-TO-MODAL surface by name. Fed from both
+  // ctx.openModal(name) (migrated command front-doors) and PanelManager's
+  // open()-time modal-redirect callback (a legacy panel id resolving to a modal
+  // name). Surfaces are registered in builtin-modals.ts; a name with no
+  // registered surface degrades honestly to a print rather than a blank modal.
+  // The stack name is the stable 'config' slot (one config modal at a time —
+  // opening another swaps the surface), so Esc close/return and the modal-stack
+  // machinery need only the single 'config' case (handler-ui-state.ts).
+  // Some panel-id redirects (and migrated front-doors) resolve to a NATIVE
+  // modal that is not a ConfigModalSurface — e.g. `sessions` -> `sessionPicker`,
+  // where 'sessionPicker' is the real session-picker modal opened by
+  // commandContext.openSessionPicker below, NOT a registered config surface.
+  // getModalSurface can never find these, so consult this small name->opener
+  // dispatch FIRST. Each entry reuses the same opener the front-door command
+  // uses (no duplicated open logic); resolved lazily so wiring order does not
+  // matter. Any name that is neither a native modal nor a registered surface
+  // still falls through to the honest "not available" print below.
+  const nativeModalOpeners: Record<string, () => void> = {
+    // openSessionPicker is wired below in this same function; call it lazily
+    // (optional-chained for the type, always present at invoke time).
+    sessionPicker: () => commandContext.openSessionPicker?.(),
+  };
+
+  commandContext.openModal = (name: string) => {
+    const openNative = nativeModalOpeners[name];
+    if (openNative) {
+      openNative();
+      return;
+    }
+    const surface = panelManager.getModalSurface(name);
+    if (!surface) {
+      commandContext.print(`'${name}' is not available yet in this build.`);
+      render();
+      return;
+    }
+    input.modalOpened('config');
+    input.configModal.open(surface, render);
+    render();
+  };
+  panelManager.setOpenModalCallback(commandContext.openModal);
+
   commandContext.openMcpWorkspace = () => {
     input.openMcpWorkspace(commandContext);
     render();
@@ -296,25 +417,43 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
     // Focus ownership lives in PanelManager (focusTarget); read it there rather
     // than tracking a parallel input.panelFocused flag. Toggle semantics: if the
     // workspace is visible AND already focused, hide it; otherwise reveal and
-    // focus it (opening the panel list when nothing is open yet).
+    // focus it (opening a picker when nothing is open yet).
     if (panelManager.isVisible() && panelManager.getFocusTarget() === 'panel') {
       panelManager.hide();
       panelManager.focusPrompt();
       conversation.setSplashSuppressed(false);
       conversation.rebuildHistory();
-    } else {
-      if (panelManager.getAllOpen().length === 0) {
-        try {
-          panelManager.open('panel-list');
-        } catch {
-          // non-fatal
-        }
-      }
-      panelManager.show();
-      panelManager.focusPanels();
-      conversation.setSplashSuppressed(true);
-      conversation.rebuildHistory();
+      render();
+      return;
+    }
+    if (panelManager.getAllOpen().length === 0) {
+      // W6.1 (the purge): 'panel-list' (a browse-all-panels picker PANEL)
+      // was DELETE-disposition — a picker over a handful of panels is dead
+      // weight now. Its replacement is this selection MODAL, built from the
+      // live registry (PanelManager.getRegisteredTypes()) rather than a
+      // hardcoded list, so it can never list a retired/deleted id.
+      const items: SelectionItem[] = panelManager.getRegisteredTypes().map((entry) => ({
+        id: entry.id,
+        label: `${entry.icon} ${entry.name}`,
+        detail: entry.description,
+        category: entry.category,
+        primaryAction: 'select',
+      }));
+      commandContext.openSelection?.('Open Panel', items, { allowSearch: true }, (result) => {
+        if (!result) return;
+        panelManager.open(result.item.id);
+        panelManager.show();
+        panelManager.focusPanels();
+        conversation.setSplashSuppressed(true);
+        conversation.rebuildHistory();
+        render();
+      });
+      return;
     }
+    panelManager.show();
+    panelManager.focusPanels();
+    conversation.setSplashSuppressed(true);
+    conversation.rebuildHistory();
     render();
   };
 
@@ -329,10 +468,16 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
     render();
   };
 
-  commandContext.showPanel = (panelId, pane) => {
-    panelManager.open(panelId, pane);
+  commandContext.showPanel = (panelId, pane, target, opts) => {
+    // DEBT-5: forward the deep-link target so a jumped-to panel lands on the
+    // right row (fleet --target); undefined for ordinary opens.
+    panelManager.open(panelId, pane, target);
     panelManager.show();
-    panelManager.focusPanels();
+    // UX-C focus rule 1a: every registered caller of showPanel is a slash
+    // command (/panel open, /routes, /approval, /tasks, /ops-control, ...) —
+    // the command path leaves focus in the composer ("the user is
+    // mid-command-flow") unless the caller explicitly asks to grab it.
+    if (opts?.focus) panelManager.focusPanels();
     conversation.setSplashSuppressed(true);
     conversation.rebuildHistory();
     render();

package/src/utils/format-duration.ts

@@ -1,16 +1,21 @@
 /**
  * Shared ms-duration formatters for the panel layer.
  *
- * Three families are exported, each matching a distinct behavior cluster.
+ * Two families are exported, each matching a distinct behavior cluster.
  * DO NOT replace these with formatElapsed from utils/format-elapsed.ts —
  * formatElapsed floors to integer seconds and lacks the null/'?ms' guards
  * that the latency panels require.
+ *
+ * W6.1 (the purge): formatShortDuration (used only by incident-review-panel
+ * and eval-panel, both removed — RETIRE-INTO-FLEET and DELETE respectively)
+ * was removed as a genuinely orphaned export — no remaining caller anywhere
+ * in src/.
  */
 
 /**
  * Format a latency value in milliseconds with sub-second precision.
  *
- * Used by: debug-panel, provider-health-panel
+ * Used by: provider-health-panel
  *
  *   ms <= 0     → 'n/a'
  *   ms >= 10000 → '12.3s'    (one decimal)
@@ -27,7 +32,7 @@ export function formatLatencyMs(ms: number): string {
 /**
  * Format a task/agent duration with minute-rolling notation.
  *
- * Used by: tool-inspector-panel, agent-inspector-shared
+ * Used by: agent-inspector-shared
  *
  *   ms < 1000   → '500ms'
  *   ms < 60000  → '3.5s'
@@ -38,18 +43,3 @@ export function formatDuration(ms: number): string {
   if (ms < 60000) return `${(ms / 1000).toFixed(1)}s`;
   return `${Math.floor(ms / 60000)}m${Math.floor((ms % 60000) / 1000)}s`;
 }
-
-/**
- * Format a short eval/forensics duration; treats undefined as '?ms'.
- *
- * Used by: incident-review-panel, eval-panel
- *
- *   undefined → '?ms'
- *   ms < 1000 → '500ms'
- *   else      → '1.5s'
- */
-export function formatShortDuration(ms: number | undefined): string {
-  if (ms === undefined) return '?ms';
-  if (ms < 1000)        return `${ms}ms`;
-  return `${(ms / 1000).toFixed(1)}s`;
-}