@pellux/goodvibes-tui 1.16.0 → 1.17.0

package/src/runtime/ui-services.ts

@@ -77,6 +77,8 @@ export interface UiPlatformServices {
       readonly sessionSpineActive?: boolean;
       readonly sessionSpineStatus?: 'unknown' | 'online' | 'offline';
     };
+    /** Undelivered daemon receipts (update/crash/migration) for the attach-time consuming read; empty when no daemon runs. */
+    collectDaemonReceipts(): readonly { readonly id: string; readonly text: string; readonly at: number }[];
     restart(): Promise<{
       readonly daemonRunning: boolean;
       readonly daemonPortInUse?: boolean;
@@ -113,7 +115,7 @@ export interface UiRuntimeSharedServices {
     readonly distributedRuntime: RuntimeServices['distributedRuntime'];
     readonly remoteRunnerRegistry: RuntimeServices['remoteRunnerRegistry'] & RemoteRunnerRegistry;
     readonly remoteSupervisor: RuntimeServices['remoteSupervisor'] & RemoteSupervisor;
-    /** W2.2: the shared live process registry backing the Fleet panel. */
+    /** the shared live process registry backing the Fleet panel. */
     readonly processRegistry: RuntimeServices['processRegistry'];
     /** The shared runtime event bus — the Fleet panel subscribes to its 'communication' domain for the honest steer-consumed signal. */
     readonly runtimeBus: RuntimeServices['runtimeBus'];

package/src/runtime/update-check.ts

@@ -1,79 +1,25 @@
 /**
  * Pure logic for `/update`: version comparison, the latest-release-tag
- * redirect lookup, and honest install-kind detection. No filesystem or
- * process side effects here — everything takes its inputs as arguments so
- * tests exercise it without touching the network or the host, matching the
- * repo rule that tests never compare against the live build VERSION and
- * never make live network calls.
+ * redirect lookup, and honest install-kind detection.
+ *
+ * Version comparison and the release-tag lookup are re-exported from the
+ * SDK's canonical update policy module (platform/runtime/self-update), which
+ * was hoisted from this file's semantics — one mechanism everywhere.
+ * Install-kind detection stays local: it encodes how THIS package is
+ * installed (compiled binary vs bun/npm package vs source run) and what
+ * command replaces a swap for each kind.
  *
  * The self-update download/verify/swap orchestration that USES these lives
  * in src/input/commands/update-runtime.ts; this module only decides "is
  * there a newer version" and "can this install be swapped in place".
  */
-
-export function normalizeVersion(version: string): string {
-  return version.replace(/^v/i, '').trim();
-}
-
-/**
- * Compares two version strings component-wise as dotted non-negative
- * integers (a leading "v" is ignored, matching the "vX.Y.Z" release tag
- * format). Returns -1/0/1 for a<b / a==b / a>b. Non-numeric or missing
- * components are treated as 0, so "1.2" and "1.2.0" compare equal.
- */
-export function compareVersions(a: string, b: string): -1 | 0 | 1 {
-  const partsA = normalizeVersion(a).split('.');
-  const partsB = normalizeVersion(b).split('.');
-  const length = Math.max(partsA.length, partsB.length);
-  for (let i = 0; i < length; i++) {
-    const x = Number.parseInt(partsA[i] ?? '0', 10) || 0;
-    const y = Number.parseInt(partsB[i] ?? '0', 10) || 0;
-    if (x < y) return -1;
-    if (x > y) return 1;
-  }
-  return 0;
-}
-
-/**
- * Extracts the release tag from a GitHub "/releases/latest" redirect
- * Location header, e.g. "https://github.com/mgd34msu/goodvibes-tui/releases/tag/v1.13.2"
- * -> "v1.13.2". Mirrors scripts/install.sh's own redirect-URL tag parsing
- * (it takes everything after the final slash of the redirect target).
- */
-export function parseReleaseTagFromLocation(location: string | null | undefined): string | null {
-  if (!location) return null;
-  const segments = location.split('/').filter((segment) => segment.length > 0);
-  const tag = segments[segments.length - 1];
-  return tag && tag.length > 0 ? tag : null;
-}
-
-/** Minimal shape of the subset of the fetch API this module needs, so tests inject a stub instead of the real network. */
-export interface UpdateFetchLike {
-  (url: string, init?: { method?: string; redirect?: 'manual' | 'follow' | 'error' }): Promise<{
-    readonly ok: boolean;
-    readonly status: number;
-    readonly url: string;
-    readonly headers: { get(name: string): string | null };
-    text(): Promise<string>;
-    arrayBuffer(): Promise<ArrayBuffer>;
-  }>;
-}
-
-/**
- * Resolves the latest release tag the same way scripts/install.sh does:
- * a HEAD request with redirects NOT followed, reading the tag out of the
- * response's redirect Location header. Throws if no tag can be resolved —
- * callers must not silently fall back to "already current".
- */
-export async function resolveLatestReleaseTag(fetchImpl: UpdateFetchLike, releasesLatestUrl: string): Promise<string> {
-  const response = await fetchImpl(releasesLatestUrl, { method: 'HEAD', redirect: 'manual' });
-  const location = response.headers.get('location');
-  const tag = parseReleaseTagFromLocation(location) ?? (response.url !== releasesLatestUrl ? parseReleaseTagFromLocation(response.url) : null);
-  if (!tag) {
-    throw new Error(`could not resolve the latest release tag from ${releasesLatestUrl} (no redirect Location header)`);
-  }
-  return tag;
-}
+export {
+  compareVersions,
+  normalizeVersion,
+  parseReleaseTagFromLocation,
+  resolveLatestReleaseTag,
+  type UpdateFetchLike,
+} from '@pellux/goodvibes-sdk/platform/runtime/self-update';
 
 /**
  * How this running process was installed, detected honestly from

package/src/runtime/workstream-services.ts

@@ -2,7 +2,7 @@
 // workstream-services.ts — phase/work-item orchestration engine
 //
 // Constructs the TUI's OrchestrationEngine instance (@pellux/goodvibes-sdk/
-// platform/orchestration, landed on SDK main as wo701/W4.1) and a thin
+// platform/orchestration, landed on SDK main as) and a thin
 // command-facing facade around it. Extracted into its own module rather than
 // built inline in services.ts: services.ts sits at the architecture check's
 // 800-line cap (scripts/check-architecture.ts), so any new service gets its
@@ -17,7 +17,7 @@
 // (input/commands/workstream-runtime.ts) needs a create -> propose -> approve
 // -> launch flow (Pillar-3 doctrine: render the plan in the transcript before
 // spending anything, mirroring /plan's approve step). REALITY-WINS DIVERGENCE
-// from the wo703 design brief: the brief recommended an ENGINE-owned draft; the
+// from the design brief: the brief recommended an ENGINE-owned draft; the
 // real engine (verified against the linked SDK build) exposes no pre-creation
 // draft concept at all, so WorkstreamDraft below is TUI-owned state, held on
 // this module's facade instance (constructed once, threaded onto

package/src/shell/blocking-input.ts

@@ -1,5 +1,5 @@
 import type { ConversationManager } from '../core/conversation';
-import type { PermissionRequest } from '@pellux/goodvibes-sdk/platform/permissions';
+import type { PermissionRequest, RememberTier } from '@pellux/goodvibes-sdk/platform/permissions';
 import type { SessionSnapshot } from '@/runtime/index.ts';
 import type { SystemMessageRouter } from '../core/system-message-router.ts';
 import type { ConversationMessageSnapshot } from '@pellux/goodvibes-sdk/platform/core';
@@ -7,11 +7,20 @@ import { replayJournalForSession } from '../core/session-recovery.ts';
 import { applyHunkKey, buildModifiedEditArgs, type HunkSelectionState } from '../permissions/hunk-selection.ts';
 
 export type PendingPermissionState = PermissionRequest & {
-  resolve: (approved: boolean, remember?: boolean, modifiedArgs?: Record<string, unknown>) => void;
+  resolve: (approved: boolean, remember?: boolean, modifiedArgs?: Record<string, unknown>, extras?: { rememberTier?: RememberTier; reason?: string }) => void;
   /** Present only when isHunkSelectable(request) was true when the prompt was opened. */
   hunkState?: HunkSelectionState;
-  /** True once the user pressed `d` to expand a condensed low-risk card. (UX-B 2b.) */
+  /** True once the user pressed `d` to expand a condensed low-risk card. (2b.) */
   detailsExpanded?: boolean;
+  /**
+   * Active typed-reply mode: 'deny-reason' (started by typing while the card
+   * is up — Enter denies with the typed reason as feedback) or 'exec-answer'
+   * (an exec-prompt ask; Enter approves with the typed answer feeding the
+   * running command's stdin). Undefined = plain card keys.
+   */
+  replyMode?: 'deny-reason' | 'exec-answer';
+  /** The reply draft while replyMode is active. */
+  replyBuffer?: string;
   /**
    * Epoch ms when the prompt first appeared. Keystrokes that arrive within
    * APPROVAL_INPUT_DEBOUNCE_MS of this are swallowed (not interpreted as an
@@ -135,6 +144,69 @@ export function handleBlockingShellInput(
       return { handled: true, pendingPermission: { ...req, hunkState: state }, recoveryPending };
     }
 
+    // Ctrl+C is ALWAYS the hard abort: deny and kill the turn, in every mode.
+    if (data === '\x03') {
+      req.resolve(false, false);
+      abortTurn();
+      render();
+      return { handled: true, pendingPermission: null, recoveryPending };
+    }
+
+    // Typed-reply mode: deny-with-reason (started by typing on any card) or
+    // exec-answer (an exec-prompt ask opens in this mode). Every printable
+    // key is text here — nothing is a card command.
+    if (req.replyMode) {
+      const buffer = req.replyBuffer ?? '';
+      if (data === '\r' || data === '\n') {
+        if (req.replyMode === 'exec-answer') {
+          // The typed answer feeds the running command's stdin via the
+          // decision's modifiedArgs (SDK exec-prompt wiring contract).
+          req.resolve(true, false, { answer: buffer });
+        } else {
+          // Deny is feedback: the reason rides the structured "user declined"
+          // tool result so the model can adapt — the turn is NOT aborted.
+          req.resolve(false, false, undefined, { reason: buffer });
+        }
+        render();
+        return { handled: true, pendingPermission: null, recoveryPending };
+      }
+      if (data === '\x1b') {
+        if (req.replyMode === 'exec-answer') {
+          // Esc on an exec-prompt: clear a draft first; with nothing typed it
+          // declines the prompt (the run gets the honest unanswered result).
+          if (buffer.length > 0) {
+            render();
+            return { handled: true, pendingPermission: { ...req, replyBuffer: '' }, recoveryPending };
+          }
+          req.resolve(false, false);
+          render();
+          return { handled: true, pendingPermission: null, recoveryPending };
+        }
+        // Esc leaves deny-reason mode back to the plain card.
+        render();
+        return { handled: true, pendingPermission: { ...req, replyMode: undefined, replyBuffer: undefined }, recoveryPending };
+      }
+      if (data === '\x7f' || data === '\b') {
+        render();
+        return { handled: true, pendingPermission: { ...req, replyBuffer: buffer.slice(0, -1) }, recoveryPending };
+      }
+      if (data.length >= 1 && !data.startsWith('\x1b') && data >= ' ') {
+        render();
+        return { handled: true, pendingPermission: { ...req, replyBuffer: buffer + data }, recoveryPending };
+      }
+      render();
+      return { handled: true, pendingPermission, recoveryPending };
+    }
+
+    // Scroll, mouse, PageUp/Down, arrow, and panel-navigation keys — plus a
+    // bare Esc — are not card answers. Pass them through to the normal input
+    // handler so the transcript stays scrollable and Esc only drops focus. The
+    // request stays pending (answer it with y/n or a remember tier when ready);
+    // Ctrl+C above is still the hard abort, and 'n' still denies.
+    if (data.startsWith('\x1b')) {
+      return { handled: false, pendingPermission, recoveryPending };
+    }
+
     const key = data.toLowerCase().trim();
 
     if (key === 'y') {
@@ -144,14 +216,31 @@ export function handleBlockingShellInput(
     }
 
     if (key === 'a') {
-      req.resolve(true, true);
+      // Legacy always-this-session choice — the 'session' remember tier.
+      req.resolve(true, true, undefined, { rememberTier: 'session' });
       render();
       return { handled: true, pendingPermission: null, recoveryPending };
     }
 
-    if (key === 'n' || data === '\x1b' || data === '\x03') {
+    // Numbered remember tiers ([1]..[N], most specific first) from the SDK's
+    // rememberOptions: approve AND remember at that tier. A generalizing tier
+    // writes a durable user-origin rule; 'session' only caches in memory.
+    if (/^[1-9]$/.test(key) && req.rememberOptions && req.rememberOptions.length > 0) {
+      const option = req.rememberOptions[Number(key) - 1];
+      if (option) {
+        req.resolve(true, option.tier === 'session', undefined, { rememberTier: option.tier });
+        render();
+        return { handled: true, pendingPermission: null, recoveryPending };
+      }
+      render();
+      return { handled: true, pendingPermission, recoveryPending };
+    }
+
+    if (key === 'n') {
+      // Plain deny — feedback to the model (the SDK renders an honest "user
+      // declined" result), never a turn abort. Ctrl+C above is the hard stop;
+      // Esc drops focus (handled above) rather than denying.
       req.resolve(false, false);
-      abortTurn();
       render();
       return { handled: true, pendingPermission: null, recoveryPending };
     }
@@ -166,6 +255,13 @@ export function handleBlockingShellInput(
       };
     }
 
+    // Any other printable key starts deny-with-reason: what the user types
+    // becomes the denial feedback, seeded with this first character.
+    if (data.length === 1 && data >= ' ') {
+      render();
+      return { handled: true, pendingPermission: { ...req, replyMode: 'deny-reason', replyBuffer: data }, recoveryPending };
+    }
+
     render();
     return { handled: true, pendingPermission, recoveryPending };
   }

package/src/shell/ui-openers.ts

@@ -19,6 +19,8 @@ import { syncServiceSettingToPlatform } from './service-settings-sync.ts';
 import { setActiveThemeMode } from '../renderer/theme.ts';
 import { THEME_MODE_CONFIG_KEY, coerceThemeModeSetting } from '../renderer/theme-mode-config.ts';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
+import { buildFirstOpenItems, decodeFirstOpenChoice, selfRecordWorkspaceRegistration } from '../cli/tui-startup.ts';
+import type { WorkspaceTrustLevel } from '../runtime/trust/workspace-trust.ts';
 
 type WireShellUiOpenersOptions = {
   commandContext: CommandContext;
@@ -33,13 +35,15 @@ type WireShellUiOpenersOptions = {
   subscriptionManager: SubscriptionManager;
   secretsManager?: Pick<SecretsManager, 'delete' | 'get' | 'set'>;
   serviceRegistry: Pick<ServiceInspectionQuery, 'getAll'>;
-  /** B29: backs the model picker's 'embeddings' target and its own item-list mode. */
+  /** Backs the model picker's 'embeddings' target and its own item-list mode. */
   memoryEmbeddingRegistry: Pick<MemoryEmbeddingProviderRegistry, 'getDefaultProviderId' | 'setDefaultProvider' | 'status'>;
   workingDirectory: string;
   homeDirectory: string;
   getConfiguredProviderIds: () => string[];
   getPinned: () => Promise<string[]>;
   render: () => void;
+  /** Trust-at-consequence-time bridge — patched here with the real modal-driving implementation. */
+  trustPromptRef: { requestTrustDecision: () => Promise<WorkspaceTrustLevel> };
 };
 
 let commandCategoryMapCache: Map<string, string> | null = null;
@@ -123,8 +127,25 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
     getConfiguredProviderIds,
     getPinned,
     render,
+    trustPromptRef,
   } = options;
 
+  // Trust-at-consequence-time: raised by trustGatedAsk on the first non-read
+  // request in an undecided workspace; the answer persists via setLevel().
+  // Registration self-records here too when trusted (never for restricted —
+  // see selfRecordWorkspaceRegistration's doc).
+  trustPromptRef.requestTrustDecision = () =>
+    new Promise((resolve) => {
+      const { title, items } = buildFirstOpenItems();
+      if (!commandContext.openSelection) { resolve('restricted'); return; } // no selection surface (should not happen live)
+      commandContext.openSelection(title, items, { allowSearch: false, primaryVerbLabel: 'Choose' }, (result) => {
+        const level = decodeFirstOpenChoice(result?.item.id ?? null);
+        resolve(level);
+        if (level === 'trusted') void selfRecordWorkspaceRegistration(commandContext.workspace?.workspaceRegistrationManager);
+        render();
+      });
+    });
+
   /**
    * Pre-resolve which provider IDs have secrets-manager keys (async batch, SDK tier pattern).
    * Returns a set of provider IDs (not env var names) that are secrets-backed.
@@ -248,6 +269,13 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
   };
 
   commandContext.openModelPicker = () => {
+    // Picker-open re-check: re-verify each provider's live model list (TTL-
+    // respecting) so a freshly-opened picker reflects models the provider
+    // started or stopped serving. Fire-and-forget; a completed refresh re-renders
+    // so the list updates in place without blocking the open.
+    void providerRegistry.refreshLiveModelDiscovery?.().then((reports) => {
+      if (reports.some((report) => report.added.length > 0 || report.removed.length > 0)) render();
+    }).catch(() => {});
     void (async () => {
       // getSelectableModels() is catalog-driven and can list models whose
       // `provider` id (e.g. 'google', sourced from the pricing catalog) was never
@@ -358,7 +386,7 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
     input.modalOpened('settings');
     input.settingsModal.open(configManager, featureFlags, subscriptionManager, serviceRegistry, mcpRegistry, secretsManager, {
       onSettingApplied: (change) => {
-        // DEBT-2: forced dark/light applies immediately (rebuild palettes + full
+        // forced dark/light applies immediately (rebuild palettes + full
         // repaint); auto only re-probes at startup, so it takes effect next launch.
         if (String(change.key) === THEME_MODE_CONFIG_KEY) {
           const next = coerceThemeModeSetting(change.value);
@@ -379,7 +407,7 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
     render();
   };
 
-  // W6.1 (the purge): open a MIGRATE-TO-MODAL surface by name. Fed from both
+  // (the purge): open a MIGRATE-TO-MODAL surface by name. Fed from both
   // ctx.openModal(name) (migrated command front-doors) and PanelManager's
   // open()-time modal-redirect callback (a legacy panel id resolving to a modal
   // name). Surfaces are registered in builtin-modals.ts; a name with no
@@ -445,7 +473,7 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
       return;
     }
     if (panelManager.getAllOpen().length === 0) {
-      // W6.1 (the purge): 'panel-list' (a browse-all-panels picker PANEL)
+      // (the purge): 'panel-list' (a browse-all-panels picker PANEL)
       // was DELETE-disposition — a picker over a handful of panels is dead
       // weight now. Its replacement is this selection MODAL, built from the
       // live registry (PanelManager.getRegisteredTypes()) rather than a
@@ -475,6 +503,10 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
     render();
   };
 
+  // Registry-driven surfaces built inside command handlers (/help) group by
+  // the same categories as the palette and the generated reference.
+  commandContext.getCommandCategories = () => getCommandCategoryMap();
+
   commandContext.openCommandPalette = () => {
     // The palette is built live from the command registry — never a hardcoded
     // list — so it can never drift from the real command set. Category labels
@@ -534,11 +566,11 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
   };
 
   commandContext.showPanel = (panelId, pane, target, opts) => {
-    // DEBT-5: forward the deep-link target so a jumped-to panel lands on the
+    // forward the deep-link target so a jumped-to panel lands on the
     // right row (fleet --target); undefined for ordinary opens.
     panelManager.open(panelId, pane, target);
     panelManager.show();
-    // UX-C focus rule 1a: every registered caller of showPanel is a slash
+    // focus rule 1a: every registered caller of showPanel is a slash
     // command (/panel open, /routes, /approval, /tasks, /ops-control, ...) —
     // the command path leaves focus in the composer ("the user is
     // mid-command-flow") unless the caller explicitly asks to grab it.

package/src/utils/format-duration.ts

@@ -6,7 +6,7 @@
  * formatElapsed floors to integer seconds and lacks the null/'?ms' guards
  * that the latency panels require.
  *
- * W6.1 (the purge): formatShortDuration (used only by incident-review-panel
+ * (the purge): formatShortDuration (used only by incident-review-panel
  * and eval-panel, both removed — RETIRE-INTO-FLEET and DELETE respectively)
  * was removed as a genuinely orphaned export — no remaining caller anywhere
  * in src/.

package/src/verification/verification-ledger.ts

@@ -1,7 +1,8 @@
 import { readFileSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { CONFIG_SCHEMA } from '@pellux/goodvibes-sdk/platform/config';
-import { FEATURE_FLAG_MAP } from '@pellux/goodvibes-sdk/platform/runtime/state';
+import { FEATURE_SETTINGS } from '@pellux/goodvibes-sdk/platform/runtime/state';
+import { featureEnablementWrite } from '../runtime/feature-settings.ts';
 import { CommandRegistry } from '../input/command-registry.ts';
 import { registerBuiltinCommands } from '../input/commands.ts';
 
@@ -78,8 +79,24 @@ export const FEATURE_KNOB_LOCAL_SETTINGS = [
   'runtime.toolBudget.maxCostUsd',
 ] as const;
 
-/** Settings with real local behavior verification: the authored baseline plus the newly persistence-tested feature-knob keys. */
-const SETTINGS_BEHAVIOR_VERIFIED = SETTINGS_BEHAVIOR_BASELINE + FEATURE_KNOB_LOCAL_SETTINGS.length;
+/**
+ * Every feature's enablement settings key whose on/off writes round-trip
+ * through a REAL on-disk ConfigManager in
+ * `src/test/verification/../input/settings-modal-flag-persistence.test.ts`
+ * ("every feature with an off position round-trips both directions"). These
+ * are first-class schema keys under the dissolved feature model, so they are
+ * genuinely behavior-verified locally. Keys already counted in the
+ * feature-knob list are excluded to keep the sum honest.
+ */
+const ENABLEMENT_KEYS_BEHAVIOR_VERIFIED = new Set(
+  FEATURE_SETTINGS
+    .filter((feature) => featureEnablementWrite(feature.id, true) !== null && featureEnablementWrite(feature.id, false) !== null)
+    .map((feature) => feature.enablement.key)
+    .filter((key) => !(FEATURE_KNOB_LOCAL_SETTINGS as readonly string[]).includes(key)),
+).size;
+
+/** Settings with real local behavior verification: the authored baseline plus the persistence-tested feature-knob and enablement keys. */
+const SETTINGS_BEHAVIOR_VERIFIED = SETTINGS_BEHAVIOR_BASELINE + FEATURE_KNOB_LOCAL_SETTINGS.length + ENABLEMENT_KEYS_BEHAVIOR_VERIFIED;
 
 const EXTERNAL_SLASH_COMMANDS = new Set([
   'auth',
@@ -181,7 +198,7 @@ export function buildVerificationLedger(root: string): VerificationLedger {
   const slashCommands = slashCommandNames.length;
   const panels = countBuiltinPanels(root);
   const cliCommands = cliCommandNames.length;
-  const featureFlags = FEATURE_FLAG_MAP.size;
+  const featureFlags = FEATURE_SETTINGS.length;
   const settings = CONFIG_SCHEMA.length;
   const externalSlashCommands = slashCommandNames.filter((command) => EXTERNAL_SLASH_COMMANDS.has(command)).length;
   const externalCliCommands = cliCommandNames.filter((command) => EXTERNAL_CLI_COMMANDS.has(command)).length;

package/src/version.ts

@@ -6,7 +6,7 @@ import { join } from 'node:path';
 // The prebuild script updates the fallback value before compilation.
 // Uses import.meta.dir (Bun) to locate package.json relative to this file,
 // which is correct regardless of the process working directory.
-let _version = '1.16.0';
+let _version = '1.17.0';
 try {
   const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', 'package.json'), 'utf-8'));
   _version = pkg.version ?? _version;