@pellux/goodvibes-tui 1.16.1 → 1.18.0

package/src/shell/recovery-input-helpers.ts

@@ -1,19 +1,22 @@
 /**
- * Helper factories for main()'s stdin fast-path: the Ctrl+R recovery
- * persistence/panel-reopen callbacks and the one-key error-retry
- * affordance. Extracted from main.ts so the entrypoint stays under the
- * architecture line ceiling; main() wires these with its live services.
+ * Helper factories for main()'s stdin fast-path and startup: the crash-recovery
+ * snapshot persistence + panel-reopen callbacks, the SILENT auto-restore, and
+ * the one-key error-retry affordance. Extracted from main.ts so the entrypoint
+ * stays under the architecture line ceiling; main() wires these with its live
+ * services.
+ *
+ * Recovery is silent (owner ruling): there is no Ctrl+R prompt/banner and no
+ * dismiss/preserve dance. At startup autoRestoreRecoverySession restores the
+ * newest crash snapshot in place and emits a single one-line receipt. The old
+ * `.preserved` sibling machinery is gone — a session's exit deletes only its
+ * OWN snapshot (scoped by sessionId), so a concurrent session's snapshot is
+ * never touched.
  */
 
-import { copyFileSync, existsSync, readFileSync, unlinkSync } from 'node:fs';
 import type { ConversationMessageSnapshot } from '../core/conversation.ts';
-import type { SessionReturnContextSummary, SessionSnapshot } from '@/runtime/index.ts';
-import {
-  checkRecoveryFile,
-  deleteRecoveryFile as deleteLiveRecoveryFile,
-  getRecoveryFilePath,
-  loadRecoveryConversation as loadLiveRecoveryConversation,
-} from '@/runtime/index.ts';
+import type { SessionSnapshot } from '@/runtime/index.ts';
+import { autoRestoreRecovery } from '@/runtime/index.ts';
+import { replayJournalForSession } from '../core/session-recovery.ts';
 
 export interface PersistRecoveryDeps {
   readonly sessionManager: {
@@ -48,166 +51,50 @@ export function createReopenRecoveryPanels(deps: ReopenPanelsDeps): (snapshot: S
   };
 }
 
-// ---------------------------------------------------------------------------
-// W3 Finding 3: preserve the dismissed recovery snapshot.
-//
-// main.ts's 60s autosave (writeRecoveryFile) overwrites the single shared
-// recovery.jsonl with the CURRENT session's live state within a minute — so
-// the dismiss banner's promise ("still on disk; you will be asked again next
-// time") went false silently well before the next launch. Fix: the moment
-// the user dismisses (blocking-input.ts), copy recovery.jsonl aside to a
-// preserved sibling file (recovery.jsonl.preserved) so it survives this
-// session's later autosaves. Startup then checks BOTH the live file and the
-// preserved sibling and offers whichever is newer (pickNewestRecoveryInfo),
-// bounded to exactly one preserved file — a later dismiss replaces it, and
-// that replacement is reported honestly (PreserveRecoveryResult.replacedPrevious)
-// rather than silently dropping the older snapshot.
-// ---------------------------------------------------------------------------
-
-export interface RecoveryFileDeps {
+export interface AutoRestoreRecoveryDeps {
+  readonly workingDirectory: string;
   readonly homeDirectory: string;
-  readonly surfaceRoot?: string | undefined;
-}
-
-export interface PreservedRecoveryInfo {
-  readonly title: string;
-  readonly timestamp: number;
-  readonly sessionId: string;
-  readonly returnContext?: SessionReturnContextSummary | undefined;
-}
-
-export interface PreserveRecoveryResult {
-  /** True if a live recovery.jsonl existed and was copied to the preserved sibling. */
-  readonly preserved: boolean;
-  /** True if an existing preserved sibling (from an earlier dismiss) was overwritten. */
-  readonly replacedPrevious: boolean;
-}
-
-function preservedRecoveryPath(deps: RecoveryFileDeps): string {
-  return `${getRecoveryFilePath(deps.homeDirectory, deps.surfaceRoot)}.preserved`;
-}
-
-function readRecoveryMetaLine(path: string): { title?: string; timestamp?: number; sessionId?: string; returnContext?: SessionReturnContextSummary } | null {
-  try {
-    if (!existsSync(path)) return null;
-    const firstLine = readFileSync(path, 'utf-8').split('\n')[0];
-    if (!firstLine) return null;
-    return JSON.parse(firstLine) as { title?: string; timestamp?: number; sessionId?: string; returnContext?: SessionReturnContextSummary };
-  } catch {
-    return null;
-  }
-}
-
-/** Copy the live recovery.jsonl aside to the preserved sibling. Called once, at dismiss. */
-export function createPreserveRecoveryFile(deps: RecoveryFileDeps): () => PreserveRecoveryResult {
-  return () => {
-    const live = getRecoveryFilePath(deps.homeDirectory, deps.surfaceRoot);
-    const preserved = preservedRecoveryPath(deps);
-    if (!existsSync(live)) return { preserved: false, replacedPrevious: false };
-    const replacedPrevious = existsSync(preserved);
-    try {
-      copyFileSync(live, preserved);
-      return { preserved: true, replacedPrevious };
-    } catch {
-      return { preserved: false, replacedPrevious: false };
-    }
+  /** The live conversation to restore INTO (fromJSON applies the snapshot). */
+  readonly conversation: {
+    fromJSON(input: { messages: ConversationMessageSnapshot[]; title?: string; titleSource?: SessionSnapshot['titleSource'] }): void;
   };
+  /** Persist the post-replay snapshot so the WAL gap is durably closed. */
+  readonly persistSnapshot: (msgs: ConversationMessageSnapshot[]) => void;
+  /** Reopen the restored session's panels. */
+  readonly reopenPanels: (snapshot: SessionSnapshot) => void;
+  /** Surface the one-line receipt (the only user-visible sign of a restore). */
+  readonly systemMessageRouter: { high(message: string): void };
 }
 
 /**
- * Startup check for the preserved sibling — mirrors the SDK's
- * checkRecoveryFile meta read, but for the fixed preserved path. No
- * mtime-vs-last-clean-save gate: the preserved file is inert (never
- * autosaved-over) until explicitly replaced or cleared, so its mere
- * existence is actionable.
- */
-export function checkPreservedRecoveryFile(deps: RecoveryFileDeps): PreservedRecoveryInfo | null {
-  const meta = readRecoveryMetaLine(preservedRecoveryPath(deps));
-  if (!meta) return null;
-  return { title: meta.title ?? '', timestamp: meta.timestamp ?? 0, sessionId: meta.sessionId ?? '', returnContext: meta.returnContext };
-}
-
-/** Load the preserved sibling's full snapshot — same JSONL shape as recovery.jsonl since it's a byte-identical copy. */
-export function loadPreservedRecoveryConversation(deps: RecoveryFileDeps): SessionSnapshot | null {
-  const path = preservedRecoveryPath(deps);
-  try {
-    if (!existsSync(path)) return null;
-    const lines = readFileSync(path, 'utf-8').split('\n').filter(Boolean);
-    if (lines.length < 2) return { messages: [] };
-    const metaLine = JSON.parse(lines[0]!) as { title?: string; titleSource?: SessionSnapshot['titleSource']; returnContext?: SessionSnapshot['returnContext'] };
-    return {
-      title: metaLine.title,
-      titleSource: metaLine.titleSource,
-      returnContext: metaLine.returnContext,
-      messages: lines.slice(1).map((line) => {
-        const { type: _type, ...rest } = JSON.parse(line) as { type: string } & Record<string, unknown>;
-        return rest;
-      }),
-    };
-  } catch {
-    return null;
-  }
-}
-
-/** Remove the preserved sibling — called after it has been restored or discarded. */
-export function deletePreservedRecoveryFile(deps: RecoveryFileDeps): void {
-  try {
-    unlinkSync(preservedRecoveryPath(deps));
-  } catch {
-    // missing file is fine
-  }
-}
-
-/**
- * Pick the newer of the live vs. preserved recovery info for the startup
- * prompt, tagging which source it came from so the caller knows which
- * load/delete pair to use. Null when neither exists.
- */
-export function pickNewestRecoveryInfo<T extends { readonly timestamp: number }>(
-  live: T | null,
-  preserved: T | null,
-): (T & { readonly source: 'live' | 'preserved' }) | null {
-  if (!live && !preserved) return null;
-  if (!live) return { ...(preserved as T), source: 'preserved' };
-  if (!preserved) return { ...live, source: 'live' };
-  return preserved.timestamp > live.timestamp
-    ? { ...(preserved as T), source: 'preserved' }
-    : { ...live, source: 'live' };
-}
-
-/**
- * Startup entry point: resolve which recovery prompt (if any) main.ts should
- * show — the live recovery.jsonl, or an earlier dismiss's preserved sibling,
- * whichever is newer. Bundles checkRecoveryFile + checkPreservedRecoveryFile
- * + pickNewestRecoveryInfo so main.ts's entrypoint stays a one-liner.
+ * Silent crash-recovery restore at startup — no prompt, no banner. Loads the
+ * newest crash snapshot (the SDK scopes the load AND the follow-up delete to
+ * that snapshot's own session id), applies it to the live conversation, replays
+ * any journal turns written after the snapshot, reopens its panels, and emits
+ * the SDK's one-line receipt. Returns true when a session was restored, false
+ * when there was nothing to restore.
  */
-export function resolveStartupRecoveryInfo(
-  deps: RecoveryFileDeps & { readonly workingDirectory: string },
-): (PreservedRecoveryInfo & { readonly source: 'live' | 'preserved' }) | null {
-  const live = checkRecoveryFile({ workingDirectory: deps.workingDirectory, homeDirectory: deps.homeDirectory });
-  const preserved = checkPreservedRecoveryFile(deps);
-  return pickNewestRecoveryInfo(live, preserved);
-}
-
-export interface RecoveryFileOps {
-  readonly loadRecoveryConversation: () => SessionSnapshot | null;
-  readonly deleteRecoveryFile: () => void;
-  readonly preserveRecoveryFile?: () => PreserveRecoveryResult;
-}
-
-/**
- * Build the three source-aware recovery callbacks main.ts's stdin handler
- * wires into handleBlockingShellInput. `getSource` is read fresh by
- * load/delete on every call (main.ts's recoverySource can change between
- * events); preserveRecoveryFile is only ever wired when the CURRENT prompt
- * came from the live file (see createPreserveRecoveryFile's doc comment).
- */
-export function createRecoveryFileOps(getSource: () => 'live' | 'preserved', deps: RecoveryFileDeps): RecoveryFileOps {
-  return {
-    loadRecoveryConversation: () => (getSource() === 'preserved' ? loadPreservedRecoveryConversation(deps) : loadLiveRecoveryConversation(deps)),
-    deleteRecoveryFile: () => (getSource() === 'preserved' ? deletePreservedRecoveryFile(deps) : deleteLiveRecoveryFile(deps)),
-    preserveRecoveryFile: getSource() === 'live' ? createPreserveRecoveryFile(deps) : undefined,
-  };
+export function autoRestoreRecoverySession(deps: AutoRestoreRecoveryDeps): boolean {
+  const result = autoRestoreRecovery({ workingDirectory: deps.workingDirectory, homeDirectory: deps.homeDirectory });
+  if (!result) return false;
+  const { snapshot, info, receipt } = result;
+  deps.conversation.fromJSON({
+    messages: snapshot.messages as ConversationMessageSnapshot[],
+    title: snapshot.title,
+    titleSource: snapshot.titleSource,
+  });
+  // Replay journal records that post-date the snapshot so turns written after
+  // the last recovery-file write (but before the crash) are not dropped.
+  replayJournalForSession({
+    homeDirectory: deps.homeDirectory,
+    sessionId: info.sessionId,
+    snapshotTimestamp: info.timestamp ?? 0,
+    conversation: deps.conversation as never,
+    persistSnapshot: deps.persistSnapshot,
+  });
+  deps.reopenPanels(snapshot);
+  deps.systemMessageRouter.high(`[Recovery] ${receipt}`);
+  return true;
 }
 
 export interface ErrorAffordanceDeps {

package/src/shell/ui-openers.ts

@@ -19,6 +19,8 @@ import { syncServiceSettingToPlatform } from './service-settings-sync.ts';
 import { setActiveThemeMode } from '../renderer/theme.ts';
 import { THEME_MODE_CONFIG_KEY, coerceThemeModeSetting } from '../renderer/theme-mode-config.ts';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
+import { buildFirstOpenItems, decodeFirstOpenChoice, selfRecordWorkspaceRegistration } from '../cli/tui-startup.ts';
+import type { WorkspaceTrustLevel } from '../runtime/trust/workspace-trust.ts';
 
 type WireShellUiOpenersOptions = {
   commandContext: CommandContext;
@@ -33,13 +35,15 @@ type WireShellUiOpenersOptions = {
   subscriptionManager: SubscriptionManager;
   secretsManager?: Pick<SecretsManager, 'delete' | 'get' | 'set'>;
   serviceRegistry: Pick<ServiceInspectionQuery, 'getAll'>;
-  /** B29: backs the model picker's 'embeddings' target and its own item-list mode. */
+  /** Backs the model picker's 'embeddings' target and its own item-list mode. */
   memoryEmbeddingRegistry: Pick<MemoryEmbeddingProviderRegistry, 'getDefaultProviderId' | 'setDefaultProvider' | 'status'>;
   workingDirectory: string;
   homeDirectory: string;
   getConfiguredProviderIds: () => string[];
   getPinned: () => Promise<string[]>;
   render: () => void;
+  /** Trust-at-consequence-time bridge — patched here with the real modal-driving implementation. */
+  trustPromptRef: { requestTrustDecision: () => Promise<WorkspaceTrustLevel> };
 };
 
 let commandCategoryMapCache: Map<string, string> | null = null;
@@ -123,8 +127,25 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
     getConfiguredProviderIds,
     getPinned,
     render,
+    trustPromptRef,
   } = options;
 
+  // Trust-at-consequence-time: raised by trustGatedAsk on the first non-read
+  // request in an undecided workspace; the answer persists via setLevel().
+  // Registration self-records here too when trusted (never for restricted —
+  // see selfRecordWorkspaceRegistration's doc).
+  trustPromptRef.requestTrustDecision = () =>
+    new Promise((resolve) => {
+      const { title, items } = buildFirstOpenItems();
+      if (!commandContext.openSelection) { resolve('restricted'); return; } // no selection surface (should not happen live)
+      commandContext.openSelection(title, items, { allowSearch: false, primaryVerbLabel: 'Choose' }, (result) => {
+        const level = decodeFirstOpenChoice(result?.item.id ?? null);
+        resolve(level);
+        if (level === 'trusted') void selfRecordWorkspaceRegistration(commandContext.workspace?.workspaceRegistrationManager);
+        render();
+      });
+    });
+
   /**
    * Pre-resolve which provider IDs have secrets-manager keys (async batch, SDK tier pattern).
    * Returns a set of provider IDs (not env var names) that are secrets-backed.
@@ -248,6 +269,13 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
   };
 
   commandContext.openModelPicker = () => {
+    // Picker-open re-check: re-verify each provider's live model list (TTL-
+    // respecting) so a freshly-opened picker reflects models the provider
+    // started or stopped serving. Fire-and-forget; a completed refresh re-renders
+    // so the list updates in place without blocking the open.
+    void providerRegistry.refreshLiveModelDiscovery?.().then((reports) => {
+      if (reports.some((report) => report.added.length > 0 || report.removed.length > 0)) render();
+    }).catch(() => {});
     void (async () => {
       // getSelectableModels() is catalog-driven and can list models whose
       // `provider` id (e.g. 'google', sourced from the pricing catalog) was never
@@ -358,7 +386,7 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
     input.modalOpened('settings');
     input.settingsModal.open(configManager, featureFlags, subscriptionManager, serviceRegistry, mcpRegistry, secretsManager, {
       onSettingApplied: (change) => {
-        // DEBT-2: forced dark/light applies immediately (rebuild palettes + full
+        // forced dark/light applies immediately (rebuild palettes + full
         // repaint); auto only re-probes at startup, so it takes effect next launch.
         if (String(change.key) === THEME_MODE_CONFIG_KEY) {
           const next = coerceThemeModeSetting(change.value);
@@ -379,7 +407,7 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
     render();
   };
 
-  // W6.1 (the purge): open a MIGRATE-TO-MODAL surface by name. Fed from both
+  // (the purge): open a MIGRATE-TO-MODAL surface by name. Fed from both
   // ctx.openModal(name) (migrated command front-doors) and PanelManager's
   // open()-time modal-redirect callback (a legacy panel id resolving to a modal
   // name). Surfaces are registered in builtin-modals.ts; a name with no
@@ -445,7 +473,7 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
       return;
     }
     if (panelManager.getAllOpen().length === 0) {
-      // W6.1 (the purge): 'panel-list' (a browse-all-panels picker PANEL)
+      // (the purge): 'panel-list' (a browse-all-panels picker PANEL)
       // was DELETE-disposition — a picker over a handful of panels is dead
       // weight now. Its replacement is this selection MODAL, built from the
       // live registry (PanelManager.getRegisteredTypes()) rather than a
@@ -475,6 +503,10 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
     render();
   };
 
+  // Registry-driven surfaces built inside command handlers (/help) group by
+  // the same categories as the palette and the generated reference.
+  commandContext.getCommandCategories = () => getCommandCategoryMap();
+
   commandContext.openCommandPalette = () => {
     // The palette is built live from the command registry — never a hardcoded
     // list — so it can never drift from the real command set. Category labels
@@ -534,11 +566,11 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
   };
 
   commandContext.showPanel = (panelId, pane, target, opts) => {
-    // DEBT-5: forward the deep-link target so a jumped-to panel lands on the
+    // forward the deep-link target so a jumped-to panel lands on the
     // right row (fleet --target); undefined for ordinary opens.
     panelManager.open(panelId, pane, target);
     panelManager.show();
-    // UX-C focus rule 1a: every registered caller of showPanel is a slash
+    // focus rule 1a: every registered caller of showPanel is a slash
     // command (/panel open, /routes, /approval, /tasks, /ops-control, ...) —
     // the command path leaves focus in the composer ("the user is
     // mid-command-flow") unless the caller explicitly asks to grab it.

package/src/utils/format-duration.ts

@@ -6,7 +6,7 @@
  * formatElapsed floors to integer seconds and lacks the null/'?ms' guards
  * that the latency panels require.
  *
- * W6.1 (the purge): formatShortDuration (used only by incident-review-panel
+ * (the purge): formatShortDuration (used only by incident-review-panel
  * and eval-panel, both removed — RETIRE-INTO-FLEET and DELETE respectively)
  * was removed as a genuinely orphaned export — no remaining caller anywhere
  * in src/.

package/src/verification/verification-ledger.ts

@@ -1,7 +1,8 @@
 import { readFileSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { CONFIG_SCHEMA } from '@pellux/goodvibes-sdk/platform/config';
-import { FEATURE_FLAG_MAP } from '@pellux/goodvibes-sdk/platform/runtime/state';
+import { FEATURE_SETTINGS } from '@pellux/goodvibes-sdk/platform/runtime/state';
+import { featureEnablementWrite } from '../runtime/feature-settings.ts';
 import { CommandRegistry } from '../input/command-registry.ts';
 import { registerBuiltinCommands } from '../input/commands.ts';
 
@@ -78,8 +79,24 @@ export const FEATURE_KNOB_LOCAL_SETTINGS = [
   'runtime.toolBudget.maxCostUsd',
 ] as const;
 
-/** Settings with real local behavior verification: the authored baseline plus the newly persistence-tested feature-knob keys. */
-const SETTINGS_BEHAVIOR_VERIFIED = SETTINGS_BEHAVIOR_BASELINE + FEATURE_KNOB_LOCAL_SETTINGS.length;
+/**
+ * Every feature's enablement settings key whose on/off writes round-trip
+ * through a REAL on-disk ConfigManager in
+ * `src/test/verification/../input/settings-modal-flag-persistence.test.ts`
+ * ("every feature with an off position round-trips both directions"). These
+ * are first-class schema keys under the dissolved feature model, so they are
+ * genuinely behavior-verified locally. Keys already counted in the
+ * feature-knob list are excluded to keep the sum honest.
+ */
+const ENABLEMENT_KEYS_BEHAVIOR_VERIFIED = new Set(
+  FEATURE_SETTINGS
+    .filter((feature) => featureEnablementWrite(feature.id, true) !== null && featureEnablementWrite(feature.id, false) !== null)
+    .map((feature) => feature.enablement.key)
+    .filter((key) => !(FEATURE_KNOB_LOCAL_SETTINGS as readonly string[]).includes(key)),
+).size;
+
+/** Settings with real local behavior verification: the authored baseline plus the persistence-tested feature-knob and enablement keys. */
+const SETTINGS_BEHAVIOR_VERIFIED = SETTINGS_BEHAVIOR_BASELINE + FEATURE_KNOB_LOCAL_SETTINGS.length + ENABLEMENT_KEYS_BEHAVIOR_VERIFIED;
 
 const EXTERNAL_SLASH_COMMANDS = new Set([
   'auth',
@@ -181,7 +198,7 @@ export function buildVerificationLedger(root: string): VerificationLedger {
   const slashCommands = slashCommandNames.length;
   const panels = countBuiltinPanels(root);
   const cliCommands = cliCommandNames.length;
-  const featureFlags = FEATURE_FLAG_MAP.size;
+  const featureFlags = FEATURE_SETTINGS.length;
   const settings = CONFIG_SCHEMA.length;
   const externalSlashCommands = slashCommandNames.filter((command) => EXTERNAL_SLASH_COMMANDS.has(command)).length;
   const externalCliCommands = cliCommandNames.filter((command) => EXTERNAL_CLI_COMMANDS.has(command)).length;

package/src/version.ts

@@ -6,7 +6,7 @@ import { join } from 'node:path';
 // The prebuild script updates the fallback value before compilation.
 // Uses import.meta.dir (Bun) to locate package.json relative to this file,
 // which is correct regardless of the process working directory.
-let _version = '1.16.1';
+let _version = '1.18.0';
 try {
   const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', 'package.json'), 'utf-8'));
   _version = pkg.version ?? _version;