@pellux/goodvibes-tui 1.16.1 → 1.18.0

package/src/runtime/trust/workspace-trust.ts

@@ -2,18 +2,24 @@
  * workspace-trust.ts — per-workspace trust gate.
  *
  * The first time GoodVibes opens a workspace (a cwd / project root it has no
- * prior state for), that workspace is "restricted": only read-category tools
- * run; write, execute, and delegate tools are denied until the user marks the
- * workspace trusted. This is NOT a parallel permission checker — the decision
- * is consulted by the real permission machinery at its final ask layer (the
- * requestPermission callback wired in bootstrap-core.ts), so it composes with,
- * and cannot drift from, the existing PermissionManager layer chain.
+ * prior decision for), that workspace is "undecided": only read-category
+ * tools run; the first write, execute, or delegate tool request raises the
+ * trust question AT THAT MOMENT — the exact point it has a real consequence —
+ * instead of silently failing or being decided by a side effect of the
+ * product's own droppings. This is NOT a parallel permission checker — the
+ * decision is consulted by the real permission machinery at its final ask
+ * layer (the requestPermission callback wired in bootstrap-core.ts), so it
+ * composes with, and cannot drift from, the existing PermissionManager layer
+ * chain.
  *
- * Trust is persisted per-workspace in <cwd>/.goodvibes/tui/trust.json. A
- * workspace that already carries GoodVibes runtime state (prior sessions,
- * checkpoints, state, memory, or a project onboarding marker) is grandfathered
- * as trusted on first load, so the gate only ever prompts for genuinely new
- * places.
+ * Trust is persisted per-workspace in <cwd>/.goodvibes/tui/trust.json. There
+ * is no more grandfathering: a workspace that already carries prior GoodVibes
+ * runtime state gets no special treatment (that side-effect-based shortcut
+ * used to paper over the fact that the first session's write attempts were
+ * silently denied without ever recording a real decision — now that the first
+ * attempt properly raises the question and persists the answer, the shortcut
+ * is unnecessary and would only hide a decision the user should actually see
+ * once, even on an upgrade).
  */
 import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
 import { join } from 'node:path';
@@ -25,13 +31,41 @@ type AskCallback = (request: PermissionPromptRequest) => Promise<PermissionPromp
 
 /**
  * Wrap the permission machinery's final ask callback with the workspace trust
- * gate: in an untrusted workspace, deny any non-read tool outright instead of
- * asking. This runs inside PermissionManager's own layer chain (it IS the ask
+ * gate. This runs inside PermissionManager's own layer chain (it IS the ask
  * layer), so it composes with — and cannot drift from — the real machinery.
+ *
+ * - Trusted workspace: every category passes through to `ask` unchanged.
+ * - Restricted workspace with an EXPLICIT prior decision: non-read categories
+ *   are denied outright, same as before — that IS what "restricted" means
+ *   once the user has actually chosen it.
+ * - Undecided workspace (no decision yet, ever): the first non-read request
+ *   raises `requestTrustDecision()` — one modal, persisted via `setLevel` —
+ *   and, if the answer is 'trusted', the ORIGINAL request is forwarded to
+ *   `ask` so the very thing the user just approved actually happens instead
+ *   of failing anyway. Concurrent requests that arrive before the first
+ *   decision resolves await the same in-flight prompt rather than opening a
+ *   second one.
  */
-export function trustGatedAsk(manager: Pick<WorkspaceTrustManager, 'isCategoryAllowed'>, ask: AskCallback): AskCallback {
-  return (request) =>
-    manager.isCategoryAllowed(request.category) ? ask(request) : Promise.resolve({ approved: false });
+export function trustGatedAsk(
+  manager: Pick<WorkspaceTrustManager, 'isCategoryAllowed' | 'isDecided' | 'setLevel'>,
+  ask: AskCallback,
+  requestTrustDecision: () => Promise<WorkspaceTrustLevel>,
+): AskCallback {
+  let pendingDecision: Promise<WorkspaceTrustLevel> | null = null;
+  return async (request) => {
+    if (manager.isCategoryAllowed(request.category)) return ask(request);
+    if (!manager.isDecided()) {
+      if (!pendingDecision) {
+        pendingDecision = requestTrustDecision().finally(() => {
+          pendingDecision = null;
+        });
+      }
+      const level = await pendingDecision;
+      await manager.setLevel(level);
+      if (manager.isCategoryAllowed(request.category)) return ask(request);
+    }
+    return { approved: false };
+  };
 }
 
 export type WorkspaceTrustLevel = 'trusted' | 'restricted';
@@ -115,8 +149,6 @@ export function readPersistedWorkspaceTrust(paths: WorkspaceTrustPaths): Persist
 
 export interface WorkspaceTrustManagerOptions {
   readonly shellPaths: WorkspaceTrustPaths;
-  /** Whether the workspace already had prior GoodVibes runtime state at startup. */
-  readonly hadPriorState: boolean;
 }
 
 export class WorkspaceTrustManager {
@@ -124,20 +156,22 @@ export class WorkspaceTrustManager {
   private grandfathered = false;
   private loaded = false;
   private readonly store: JsonFileStore<PersistedWorkspaceTrust>;
-  private readonly hadPriorState: boolean;
 
   constructor(options: WorkspaceTrustManagerOptions) {
     this.store = new JsonFileStore<PersistedWorkspaceTrust>(
       options.shellPaths.resolveProjectPath('tui', TRUST_FILE),
     );
-    this.hadPriorState = options.hadPriorState;
   }
 
   /**
-   * Load the persisted decision. If none exists, grandfather a workspace that
-   * already had prior GoodVibes state (persisting the decision so it is never
-   * re-evaluated); otherwise the workspace stays undecided and the gate treats
-   * it as restricted until the user chooses.
+   * Load the persisted decision, if one exists. No grandfathering: a
+   * workspace with no persisted decision stays undecided (the gate treats it
+   * as restricted, and the first non-read tool request raises the trust
+   * question via `trustGatedAsk`'s `requestTrustDecision` callback) — even
+   * one that already carries prior GoodVibes runtime state. `grandfathered`
+   * on an already-persisted decision is read-only history from before this
+   * fix (status/doctor still report it honestly); nothing new is ever
+   * grandfathered.
    */
   async load(): Promise<void> {
     if (this.loaded) return;
@@ -145,13 +179,6 @@ export class WorkspaceTrustManager {
     if (persisted && (persisted.level === 'trusted' || persisted.level === 'restricted')) {
       this.level = persisted.level;
       this.grandfathered = persisted.grandfathered ?? false;
-      this.loaded = true;
-      return;
-    }
-    if (this.hadPriorState) {
-      this.level = 'trusted';
-      this.grandfathered = true;
-      await this.persist();
     }
     this.loaded = true;
   }

package/src/runtime/ui-services.ts

@@ -59,6 +59,8 @@ export interface UiPlatformServices {
   readonly surfaceRegistry: RuntimeServices['surfaceRegistry'];
   readonly subscriptionManager: RuntimeServices['subscriptionManager'];
   readonly secretsManager: SecretsManager;
+  /** Per-device pairing tokens — backs the pairing modal QR and the settings device surface. */
+  readonly pairingTokens: RuntimeServices['pairingTokens'];
   readonly tokenAuditor: RuntimeServices['tokenAuditor'];
   readonly replayEngine: RuntimeServices['replayEngine'];
   readonly webhookNotifier: RuntimeServices['webhookNotifier'];
@@ -77,6 +79,8 @@ export interface UiPlatformServices {
       readonly sessionSpineActive?: boolean;
       readonly sessionSpineStatus?: 'unknown' | 'online' | 'offline';
     };
+    /** Undelivered daemon receipts (update/crash/migration) for the attach-time consuming read; empty when no daemon runs. */
+    collectDaemonReceipts(): readonly { readonly id: string; readonly text: string; readonly at: number }[];
     restart(): Promise<{
       readonly daemonRunning: boolean;
       readonly daemonPortInUse?: boolean;
@@ -113,7 +117,7 @@ export interface UiRuntimeSharedServices {
     readonly distributedRuntime: RuntimeServices['distributedRuntime'];
     readonly remoteRunnerRegistry: RuntimeServices['remoteRunnerRegistry'] & RemoteRunnerRegistry;
     readonly remoteSupervisor: RuntimeServices['remoteSupervisor'] & RemoteSupervisor;
-    /** W2.2: the shared live process registry backing the Fleet panel. */
+    /** the shared live process registry backing the Fleet panel. */
     readonly processRegistry: RuntimeServices['processRegistry'];
     /** The shared runtime event bus — the Fleet panel subscribes to its 'communication' domain for the honest steer-consumed signal. */
     readonly runtimeBus: RuntimeServices['runtimeBus'];
@@ -186,6 +190,7 @@ export function createUiRuntimeServices(
       surfaceRegistry: runtimeServices.surfaceRegistry,
       subscriptionManager: runtimeServices.subscriptionManager,
       secretsManager: runtimeServices.secretsManager,
+      pairingTokens: runtimeServices.pairingTokens,
       tokenAuditor: runtimeServices.tokenAuditor,
       replayEngine: runtimeServices.replayEngine,
       webhookNotifier: runtimeServices.webhookNotifier,

package/src/runtime/update-check.ts

@@ -1,79 +1,25 @@
 /**
  * Pure logic for `/update`: version comparison, the latest-release-tag
- * redirect lookup, and honest install-kind detection. No filesystem or
- * process side effects here — everything takes its inputs as arguments so
- * tests exercise it without touching the network or the host, matching the
- * repo rule that tests never compare against the live build VERSION and
- * never make live network calls.
+ * redirect lookup, and honest install-kind detection.
+ *
+ * Version comparison and the release-tag lookup are re-exported from the
+ * SDK's canonical update policy module (platform/runtime/self-update), which
+ * was hoisted from this file's semantics — one mechanism everywhere.
+ * Install-kind detection stays local: it encodes how THIS package is
+ * installed (compiled binary vs bun/npm package vs source run) and what
+ * command replaces a swap for each kind.
  *
  * The self-update download/verify/swap orchestration that USES these lives
  * in src/input/commands/update-runtime.ts; this module only decides "is
  * there a newer version" and "can this install be swapped in place".
  */
-
-export function normalizeVersion(version: string): string {
-  return version.replace(/^v/i, '').trim();
-}
-
-/**
- * Compares two version strings component-wise as dotted non-negative
- * integers (a leading "v" is ignored, matching the "vX.Y.Z" release tag
- * format). Returns -1/0/1 for a<b / a==b / a>b. Non-numeric or missing
- * components are treated as 0, so "1.2" and "1.2.0" compare equal.
- */
-export function compareVersions(a: string, b: string): -1 | 0 | 1 {
-  const partsA = normalizeVersion(a).split('.');
-  const partsB = normalizeVersion(b).split('.');
-  const length = Math.max(partsA.length, partsB.length);
-  for (let i = 0; i < length; i++) {
-    const x = Number.parseInt(partsA[i] ?? '0', 10) || 0;
-    const y = Number.parseInt(partsB[i] ?? '0', 10) || 0;
-    if (x < y) return -1;
-    if (x > y) return 1;
-  }
-  return 0;
-}
-
-/**
- * Extracts the release tag from a GitHub "/releases/latest" redirect
- * Location header, e.g. "https://github.com/mgd34msu/goodvibes-tui/releases/tag/v1.13.2"
- * -> "v1.13.2". Mirrors scripts/install.sh's own redirect-URL tag parsing
- * (it takes everything after the final slash of the redirect target).
- */
-export function parseReleaseTagFromLocation(location: string | null | undefined): string | null {
-  if (!location) return null;
-  const segments = location.split('/').filter((segment) => segment.length > 0);
-  const tag = segments[segments.length - 1];
-  return tag && tag.length > 0 ? tag : null;
-}
-
-/** Minimal shape of the subset of the fetch API this module needs, so tests inject a stub instead of the real network. */
-export interface UpdateFetchLike {
-  (url: string, init?: { method?: string; redirect?: 'manual' | 'follow' | 'error' }): Promise<{
-    readonly ok: boolean;
-    readonly status: number;
-    readonly url: string;
-    readonly headers: { get(name: string): string | null };
-    text(): Promise<string>;
-    arrayBuffer(): Promise<ArrayBuffer>;
-  }>;
-}
-
-/**
- * Resolves the latest release tag the same way scripts/install.sh does:
- * a HEAD request with redirects NOT followed, reading the tag out of the
- * response's redirect Location header. Throws if no tag can be resolved —
- * callers must not silently fall back to "already current".
- */
-export async function resolveLatestReleaseTag(fetchImpl: UpdateFetchLike, releasesLatestUrl: string): Promise<string> {
-  const response = await fetchImpl(releasesLatestUrl, { method: 'HEAD', redirect: 'manual' });
-  const location = response.headers.get('location');
-  const tag = parseReleaseTagFromLocation(location) ?? (response.url !== releasesLatestUrl ? parseReleaseTagFromLocation(response.url) : null);
-  if (!tag) {
-    throw new Error(`could not resolve the latest release tag from ${releasesLatestUrl} (no redirect Location header)`);
-  }
-  return tag;
-}
+export {
+  compareVersions,
+  normalizeVersion,
+  parseReleaseTagFromLocation,
+  resolveLatestReleaseTag,
+  type UpdateFetchLike,
+} from '@pellux/goodvibes-sdk/platform/runtime/self-update';
 
 /**
  * How this running process was installed, detected honestly from

package/src/runtime/workstream-services.ts

@@ -2,7 +2,7 @@
 // workstream-services.ts — phase/work-item orchestration engine
 //
 // Constructs the TUI's OrchestrationEngine instance (@pellux/goodvibes-sdk/
-// platform/orchestration, landed on SDK main as wo701/W4.1) and a thin
+// platform/orchestration, landed on SDK main as) and a thin
 // command-facing facade around it. Extracted into its own module rather than
 // built inline in services.ts: services.ts sits at the architecture check's
 // 800-line cap (scripts/check-architecture.ts), so any new service gets its
@@ -17,7 +17,7 @@
 // (input/commands/workstream-runtime.ts) needs a create -> propose -> approve
 // -> launch flow (Pillar-3 doctrine: render the plan in the transcript before
 // spending anything, mirroring /plan's approve step). REALITY-WINS DIVERGENCE
-// from the wo703 design brief: the brief recommended an ENGINE-owned draft; the
+// from the design brief: the brief recommended an ENGINE-owned draft; the
 // real engine (verified against the linked SDK build) exposes no pre-creation
 // draft concept at all, so WorkstreamDraft below is TUI-owned state, held on
 // this module's facade instance (constructed once, threaded onto

package/src/shell/blocking-input.ts

@@ -1,17 +1,21 @@
-import type { ConversationManager } from '../core/conversation';
-import type { PermissionRequest } from '@pellux/goodvibes-sdk/platform/permissions';
-import type { SessionSnapshot } from '@/runtime/index.ts';
-import type { SystemMessageRouter } from '../core/system-message-router.ts';
-import type { ConversationMessageSnapshot } from '@pellux/goodvibes-sdk/platform/core';
-import { replayJournalForSession } from '../core/session-recovery.ts';
+import type { PermissionRequest, RememberTier } from '@pellux/goodvibes-sdk/platform/permissions';
 import { applyHunkKey, buildModifiedEditArgs, type HunkSelectionState } from '../permissions/hunk-selection.ts';
 
 export type PendingPermissionState = PermissionRequest & {
-  resolve: (approved: boolean, remember?: boolean, modifiedArgs?: Record<string, unknown>) => void;
+  resolve: (approved: boolean, remember?: boolean, modifiedArgs?: Record<string, unknown>, extras?: { rememberTier?: RememberTier; reason?: string }) => void;
   /** Present only when isHunkSelectable(request) was true when the prompt was opened. */
   hunkState?: HunkSelectionState;
-  /** True once the user pressed `d` to expand a condensed low-risk card. (UX-B 2b.) */
+  /** True once the user pressed `d` to expand a condensed low-risk card. (2b.) */
   detailsExpanded?: boolean;
+  /**
+   * Active typed-reply mode: 'deny-reason' (started by typing while the card
+   * is up — Enter denies with the typed reason as feedback) or 'exec-answer'
+   * (an exec-prompt ask; Enter approves with the typed answer feeding the
+   * running command's stdin). Undefined = plain card keys.
+   */
+  replyMode?: 'deny-reason' | 'exec-answer';
+  /** The reply draft while replyMode is active. */
+  replyBuffer?: string;
   /**
    * Epoch ms when the prompt first appeared. Keystrokes that arrive within
    * APPROVAL_INPUT_DEBOUNCE_MS of this are swallowed (not interpreted as an
@@ -34,47 +38,8 @@ export const APPROVAL_INPUT_DEBOUNCE_MS = 350;
 export type BlockingInputHandlerOptions = {
   data: string;
   pendingPermission: PendingPermissionState | null;
-  recoveryPending: boolean;
   abortTurn: () => void;
-  conversation: ConversationManager;
-  systemMessageRouter: SystemMessageRouter;
   render: () => void;
-  loadRecoveryConversation: () => SessionSnapshot | null;
-  deleteRecoveryFile: () => void;
-  /**
-   * Copy the live recovery.jsonl aside to a preserved sibling so the dismiss
-   * message's promise ("still on disk") survives this session's later 60s
-   * autosaves, which would otherwise overwrite the shared recovery file with
-   * the CURRENT (post-dismiss) session's state (W3 Finding 3). Optional so
-   * every pre-existing test/caller that doesn't care about preservation is
-   * unaffected; when omitted, dismiss behaves exactly as before.
-   */
-  preserveRecoveryFile?: () => { readonly preserved: boolean; readonly replacedPrevious: boolean };
-  /**
-   * Absolute home directory used to locate the transcript journal for this
-   * recovery session. Required for journal replay on Ctrl+R restore.
-   */
-  homeDirectory: string;
-  /**
-   * The session ID that the recovery file belongs to. Required for journal
-   * replay so the correct journal path can be resolved.
-   */
-  sessionId: string;
-  /**
-   * Persist the post-replay snapshot so the WAL gap is durably closed.
-   * Called with the replayed message list. Best-effort — failures are swallowed
-   * inside replayJournalForSession.
-   */
-  persistSnapshot: (messages: ConversationMessageSnapshot[]) => void;
-  /**
-   * Optional callback invoked after Ctrl+R restore to reopen panels captured in
-   * the recovery snapshot's returnContext. When provided (as wired in main.ts),
-   * the callback iterates snapshot.returnContext.openPanels and calls
-   * panelManager.open() for each entry, then panelManager.show() + render() to
-   * restore the panel posture from the recovered session. When omitted, panel
-   * posture is not restored.
-   */
-  reopenPanels?: (snapshot: SessionSnapshot) => void;
   /** Injectable clock for the approval-input debounce; defaults to Date.now(). Tests only. */
   now?: number;
 };
@@ -82,7 +47,6 @@ export type BlockingInputHandlerOptions = {
 export type BlockingInputHandlerResult = {
   handled: boolean;
   pendingPermission: PendingPermissionState | null;
-  recoveryPending: boolean;
 };
 
 export function handleBlockingShellInput(
@@ -91,18 +55,8 @@ export function handleBlockingShellInput(
   const {
     data,
     pendingPermission,
-    recoveryPending,
     abortTurn,
-    conversation,
-    systemMessageRouter,
     render,
-    loadRecoveryConversation,
-    deleteRecoveryFile,
-    preserveRecoveryFile,
-    homeDirectory,
-    sessionId,
-    persistSnapshot,
-    reopenPanels,
   } = options;
 
   if (pendingPermission) {
@@ -115,7 +69,7 @@ export function handleBlockingShellInput(
     const now = options.now ?? Date.now();
     if (req.openedAt !== undefined && now - req.openedAt < APPROVAL_INPUT_DEBOUNCE_MS) {
       render();
-      return { handled: true, pendingPermission, recoveryPending };
+      return { handled: true, pendingPermission };
     }
 
     if (req.hunkState) {
@@ -123,16 +77,79 @@ export function handleBlockingShellInput(
       if (commit === 'apply') {
         req.resolve(true, false, buildModifiedEditArgs(req, state));
         render();
-        return { handled: true, pendingPermission: null, recoveryPending };
+        return { handled: true, pendingPermission: null };
       }
       if (commit === 'cancel') {
         req.resolve(false, false);
         abortTurn();
         render();
-        return { handled: true, pendingPermission: null, recoveryPending };
+        return { handled: true, pendingPermission: null };
+      }
+      render();
+      return { handled: true, pendingPermission: { ...req, hunkState: state } };
+    }
+
+    // Ctrl+C is ALWAYS the hard abort: deny and kill the turn, in every mode.
+    if (data === '\x03') {
+      req.resolve(false, false);
+      abortTurn();
+      render();
+      return { handled: true, pendingPermission: null };
+    }
+
+    // Typed-reply mode: deny-with-reason (started by typing on any card) or
+    // exec-answer (an exec-prompt ask opens in this mode). Every printable
+    // key is text here — nothing is a card command.
+    if (req.replyMode) {
+      const buffer = req.replyBuffer ?? '';
+      if (data === '\r' || data === '\n') {
+        if (req.replyMode === 'exec-answer') {
+          // The typed answer feeds the running command's stdin via the
+          // decision's modifiedArgs (SDK exec-prompt wiring contract).
+          req.resolve(true, false, { answer: buffer });
+        } else {
+          // Deny is feedback: the reason rides the structured "user declined"
+          // tool result so the model can adapt — the turn is NOT aborted.
+          req.resolve(false, false, undefined, { reason: buffer });
+        }
+        render();
+        return { handled: true, pendingPermission: null };
+      }
+      if (data === '\x1b') {
+        if (req.replyMode === 'exec-answer') {
+          // Esc on an exec-prompt: clear a draft first; with nothing typed it
+          // declines the prompt (the run gets the honest unanswered result).
+          if (buffer.length > 0) {
+            render();
+            return { handled: true, pendingPermission: { ...req, replyBuffer: '' } };
+          }
+          req.resolve(false, false);
+          render();
+          return { handled: true, pendingPermission: null };
+        }
+        // Esc leaves deny-reason mode back to the plain card.
+        render();
+        return { handled: true, pendingPermission: { ...req, replyMode: undefined, replyBuffer: undefined } };
+      }
+      if (data === '\x7f' || data === '\b') {
+        render();
+        return { handled: true, pendingPermission: { ...req, replyBuffer: buffer.slice(0, -1) } };
+      }
+      if (data.length >= 1 && !data.startsWith('\x1b') && data >= ' ') {
+        render();
+        return { handled: true, pendingPermission: { ...req, replyBuffer: buffer + data } };
       }
       render();
-      return { handled: true, pendingPermission: { ...req, hunkState: state }, recoveryPending };
+      return { handled: true, pendingPermission };
+    }
+
+    // Scroll, mouse, PageUp/Down, arrow, and panel-navigation keys — plus a
+    // bare Esc — are not card answers. Pass them through to the normal input
+    // handler so the transcript stays scrollable and Esc only drops focus. The
+    // request stays pending (answer it with y/n or a remember tier when ready);
+    // Ctrl+C above is still the hard abort, and 'n' still denies.
+    if (data.startsWith('\x1b')) {
+      return { handled: false, pendingPermission };
     }
 
     const key = data.toLowerCase().trim();
@@ -140,20 +157,37 @@ export function handleBlockingShellInput(
     if (key === 'y') {
       req.resolve(true, false);
       render();
-      return { handled: true, pendingPermission: null, recoveryPending };
+      return { handled: true, pendingPermission: null };
     }
 
     if (key === 'a') {
-      req.resolve(true, true);
+      // Legacy always-this-session choice — the 'session' remember tier.
+      req.resolve(true, true, undefined, { rememberTier: 'session' });
+      render();
+      return { handled: true, pendingPermission: null };
+    }
+
+    // Numbered remember tiers ([1]..[N], most specific first) from the SDK's
+    // rememberOptions: approve AND remember at that tier. A generalizing tier
+    // writes a durable user-origin rule; 'session' only caches in memory.
+    if (/^[1-9]$/.test(key) && req.rememberOptions && req.rememberOptions.length > 0) {
+      const option = req.rememberOptions[Number(key) - 1];
+      if (option) {
+        req.resolve(true, option.tier === 'session', undefined, { rememberTier: option.tier });
+        render();
+        return { handled: true, pendingPermission: null };
+      }
       render();
-      return { handled: true, pendingPermission: null, recoveryPending };
+      return { handled: true, pendingPermission };
     }
 
-    if (key === 'n' || data === '\x1b' || data === '\x03') {
+    if (key === 'n') {
+      // Plain deny — feedback to the model (the SDK renders an honest "user
+      // declined" result), never a turn abort. Ctrl+C above is the hard stop;
+      // Esc drops focus (handled above) rather than denying.
       req.resolve(false, false);
-      abortTurn();
       render();
-      return { handled: true, pendingPermission: null, recoveryPending };
+      return { handled: true, pendingPermission: null };
     }
 
     if (key === 'd') {
@@ -162,77 +196,19 @@ export function handleBlockingShellInput(
       return {
         handled: true,
         pendingPermission: { ...req, detailsExpanded: !req.detailsExpanded },
-        recoveryPending,
       };
     }
 
-    render();
-    return { handled: true, pendingPermission, recoveryPending };
-  }
-
-  if (recoveryPending) {
-    if (data === '\x12') {
-      const recovery = loadRecoveryConversation();
-      if (recovery) {
-        conversation.fromJSON({
-          messages: recovery.messages as Parameters<typeof conversation.fromJSON>[0]['messages'],
-          title: recovery.title,
-          titleSource: recovery.titleSource,
-        });
-        // Replay journal records that post-date the recovery snapshot so turns
-        // written after the last recovery-file write (but before SIGKILL) are
-        // not silently dropped. snapshotTimestamp=0 when timestamp is absent so
-        // all journal records are replayed — safer than dropping.
-        replayJournalForSession({
-          homeDirectory,
-          sessionId,
-          snapshotTimestamp: recovery.timestamp ?? 0,
-          conversation,
-          persistSnapshot,
-        });
-        reopenPanels?.(recovery);
-        systemMessageRouter.high('[Recovery] Session restored.');
-        deleteRecoveryFile();
-      } else {
-        systemMessageRouter.high('[Recovery] Failed to restore saved data.');
-      }
+    // Any other printable key starts deny-with-reason: what the user types
+    // becomes the denial feedback, seeded with this first character.
+    if (data.length === 1 && data >= ' ') {
       render();
-      return { handled: true, pendingPermission: null, recoveryPending: false };
+      return { handled: true, pendingPermission: { ...req, replyMode: 'deny-reason', replyBuffer: data } };
     }
 
-    if (data === '\x1b' || data === '\x03') {
-      systemMessageRouter.high('[Recovery] Discarded recovery data.');
-      deleteRecoveryFile();
-      render();
-      return { handled: true, pendingPermission: null, recoveryPending: false };
-    }
-
-    // Any other key demonstrates the user's intent to ignore the banner and
-    // keep working — the prompt's own text invites exactly this ("start
-    // typing to ignore it"). Previously this branch re-posted the same
-    // '[Recovery] Ctrl+R to restore...' line on EVERY such key and never
-    // cleared recoveryPending, so a user who took that invitation got a
-    // fresh [Recovery] line injected into the transcript around every
-    // character they typed, forever. Dismiss ONCE instead: clear
-    // recoveryPending so it stops re-asserting, but do NOT delete the
-    // recovery file — dismiss is not discard, and the file remains
-    // restorable by the automatic recovery check on the next launch.
-    //
-    // W3 Finding 3: the promise below ("still on disk; you will be asked
-    // again") used to go false silently — main.ts's 60s autosave overwrites
-    // the single shared recovery.jsonl with the CURRENT session's state
-    // within a minute. preserveRecoveryFile (when wired) copies it aside
-    // NOW, while it still holds the dismissed session's data, so the
-    // promise stays true. If an earlier dismiss's preserved snapshot gets
-    // replaced by this one, say so honestly instead of silently discarding it.
-    const preserveResult = preserveRecoveryFile?.();
-    if (preserveResult?.replacedPrevious) {
-      systemMessageRouter.low('[Recovery] Replacing the previously preserved (unrestored) snapshot with this one.');
-    }
-    systemMessageRouter.high('[Recovery] Dismissed — the unsaved session is still on disk; you will be asked again next time GoodVibes starts here.');
     render();
-    return { handled: false, pendingPermission, recoveryPending: false };
+    return { handled: true, pendingPermission };
   }
 
-  return { handled: false, pendingPermission, recoveryPending };
+  return { handled: false, pendingPermission };
 }