@pellux/goodvibes-tui 1.16.1 → 1.18.0

package/src/cli/parser.ts

@@ -87,6 +87,7 @@ function createDefaultFlags(): GoodVibesCliFlags {
     fork: undefined,
     yes: false,
     nonInteractive: false,
+    strict: false,
   };
 }
 
@@ -260,6 +261,10 @@ export function parseGoodVibesCli(
       flags = withFlag(withFlag(flags, 'nonInteractive', true), 'yes', true);
       continue;
     }
+    if (name === '--strict') {
+      flags = withFlag(flags, 'strict', true);
+      continue;
+    }
 
     if (name === '--provider') {
       const consumed = getValue(argv, index, inlineValue, name, errors);

package/src/cli/status.ts

@@ -502,6 +502,19 @@ export function buildCliDoctorFindings(options: CliStatusOptions): readonly CliD
   return findings;
 }
 
+/**
+ * The doctor command's exit code. Advisory findings (`severity: 'warning'`)
+ * are notes on an otherwise-usable install and must never make a healthy
+ * install report failure — only a must-fix (`severity: 'risk'`) finding
+ * exits non-zero. `strict` (for CI) flips warnings to failures too, so a
+ * pipeline can require a fully clean report instead of just "usable".
+ */
+export function resolveDoctorExitCode(findings: readonly CliDoctorFinding[], strict = false): number {
+  if (findings.some((finding) => finding.severity === 'risk')) return 1;
+  if (strict && findings.length > 0) return 1;
+  return 0;
+}
+
 export function buildCliStatusSnapshot(options: CliStatusOptions): CliStatusSnapshot {
   const config = options.configManager;
   const controlPlaneBinding = resolveRuntimeEndpointBinding(config, 'controlPlane');

package/src/cli/surface-command.ts

@@ -5,7 +5,7 @@ import {
   GOODVIBES_NTFY_REMOTE_TOPIC,
   resolveGoodVibesNtfyTopics,
 } from '@pellux/goodvibes-sdk/platform/integrations';
-import { enableFeatureFlags, getMissingSurfaceFeatureFlags, getServerSurfaceFeatureFlags } from '../runtime/surface-feature-flags.ts';
+import { enableFeatureFlags, getMissingSurfaceFeatureFlags, getServerSurfaceFeatureFlags, surfaceFeatureGateSettingsKeys } from '../runtime/surface-feature-flags.ts';
 import { resolveRuntimeEndpointBinding } from './endpoints.ts';
 import { classifyBindPosture, isNetworkFacing } from './network-posture.ts';
 import type { CliCommandRuntime } from './types.ts';
@@ -147,7 +147,7 @@ export async function handleSurfacesCommand(runtime: CliCommandRuntime): Promise
       readinessIssues.push(`${surface.label} is enabled but missing ${surface.missing.join(', ')}.`);
     }
     if (surface.missingFeatureFlags.length > 0) {
-      readinessIssues.push(`${surface.label} is enabled but feature gates are disabled: ${surface.missingFeatureFlags.join(', ')}.`);
+      readinessIssues.push(`${surface.label} is enabled but these settings are off: ${surfaceFeatureGateSettingsKeys(surface.missingFeatureFlags).join(', ')}.`);
     }
   }
   const value = {
@@ -185,7 +185,7 @@ export async function handleSurfacesCommand(runtime: CliCommandRuntime): Promise
     `  http-listener: ${yesNo(value.httpListener.enabled)} (${value.httpListener.hostMode} ${value.httpListener.host}:${value.httpListener.port})${includeProbe ? ` reachable=${yesNo(value.httpListener.reachable)}` : ''}`,
     '',
     'External surfaces:',
-    ...value.surfaces.map((surface) => `  ${surface.label.padEnd(16)} enabled=${yesNo(surface.enabled)} ready=${yesNo(surface.ready)}${surface.enabled && surface.missing.length > 0 ? ` missing=${surface.missing.join(',')}` : ''}${surface.enabled && surface.missingFeatureFlags.length > 0 ? ` featureGates=${surface.missingFeatureFlags.join(',')}` : ''}`),
+    ...value.surfaces.map((surface) => `  ${surface.label.padEnd(16)} enabled=${yesNo(surface.enabled)} ready=${yesNo(surface.ready)}${surface.enabled && surface.missing.length > 0 ? ` missing=${surface.missing.join(',')}` : ''}${surface.enabled && surface.missingFeatureFlags.length > 0 ? ` settingsOff=${surfaceFeatureGateSettingsKeys(surface.missingFeatureFlags).join(',')}` : ''}`),
     ...(filteredSurfaces.some((surface) => surface.id === 'ntfy') ? [
       '',
       'ntfy inbound topics:',
@@ -260,7 +260,7 @@ export async function buildListenerTestResult(runtime: CliCommandRuntime): Promi
   if (isNetworkFacing(enabled, binding) && auth.bootstrapCredentialPresent) issues.push('Network-facing listener still has a bootstrap credential file.');
   for (const surface of surfaces) {
     if (surface.missing.length > 0) issues.push(`${surface.label} is enabled but missing ${surface.missing.join(', ')}.`);
-    if (surface.missingFeatureFlags.length > 0) issues.push(`${surface.label} is enabled but feature gates are disabled: ${surface.missingFeatureFlags.join(', ')}.`);
+    if (surface.missingFeatureFlags.length > 0) issues.push(`${surface.label} is enabled but these settings are off: ${surfaceFeatureGateSettingsKeys(surface.missingFeatureFlags).join(', ')}.`);
   }
   return { enabled, ...binding, posture, reachable, service, auth, surfaces, issues };
 }
@@ -276,7 +276,7 @@ export function formatListenerTestResult(runtime: CliCommandRuntime, value: List
     `  local auth users: ${value.auth.userStorePresent ? 'present' : 'missing'}`,
     `  bootstrap credential: ${value.auth.bootstrapCredentialPresent ? 'present' : 'missing'}`,
     value.surfaces.length === 0 ? '  enabled webhook surfaces: none' : '  enabled webhook surfaces:',
-    ...value.surfaces.map((surface) => `    ${surface.label}: ready=${yesNo(surface.ready)}${surface.missing.length > 0 ? ` missing=${surface.missing.join(',')}` : ''}${surface.missingFeatureFlags.length > 0 ? ` featureGates=${surface.missingFeatureFlags.join(',')}` : ''}`),
+    ...value.surfaces.map((surface) => `    ${surface.label}: ready=${yesNo(surface.ready)}${surface.missing.length > 0 ? ` missing=${surface.missing.join(',')}` : ''}${surface.missingFeatureFlags.length > 0 ? ` settingsOff=${surfaceFeatureGateSettingsKeys(surface.missingFeatureFlags).join(',')}` : ''}`),
     value.issues.length === 0 ? '  readiness: ready' : '  readiness: needs attention',
     ...value.issues.map((issue) => `    - ${issue}`),
   ].join('\n'));

package/src/cli/tui-startup.ts

@@ -1,6 +1,7 @@
 import type { CommandContext, CommandRegistry } from '../input/command-registry.ts';
 import type { InputHandler } from '../input/handler.ts';
 import type { SelectionItem } from '../input/selection-modal.ts';
+import type { WorkspaceRegistrationManager } from '../runtime/trust/workspace-registration.ts';
 import { hasResumableWizardProgress, readOnboardingCheckMarker, readWizardProgress } from '../runtime/onboarding/index.ts';
 import { startOnboardingFastPath } from '../runtime/onboarding/fast-path.ts';
 import { readLastSessionPointer } from '@/runtime/index.ts';
@@ -13,111 +14,62 @@ export type TuiStartupShellPaths = Parameters<typeof readOnboardingCheckMarker>[
 
 export type FirstOpenTrustLevel = 'trusted' | 'restricted';
 
-/** The decisions a first-open prompt choice resolves to. Absent halves were not asked. */
-export interface FirstOpenDecision {
-  readonly trust?: FirstOpenTrustLevel;
-  readonly register?: 'yes' | 'no';
-}
-
 /**
- * decodeFirstOpenChoice — pure mapping from a chosen selection-item id (or null
- * on Escape/enter-through) to the trust + registration decisions, given which
- * halves the prompt actually offered. Kept pure so the combined-prompt semantics
- * are unit-testable without a live modal.
- *
- * Escape/enter-through (id === null) is the safe default: an offered trust half
- * settles to 'restricted' (matching the standalone trust prompt), and an offered
- * register half defaults to NO — recorded as a subtree-scoped decline so the
- * directory is not re-asked every startup.
+ * decodeFirstOpenChoice — pure mapping from a chosen selection-item id (or
+ * null on Escape/enter-through) to the trust decision. Kept pure so the
+ * consequence-time trust prompt's semantics (raised by trustGatedAsk, wired
+ * in main.ts's trustPromptRef.requestTrustDecision) are unit-testable
+ * without a live modal. Escape/enter-through (id === null) is the safe
+ * default: 'restricted'.
  */
-export function decodeFirstOpenChoice(
-  id: string | null,
-  offered: { readonly trustNeeded: boolean; readonly registerNeeded: boolean },
-): FirstOpenDecision {
-  const decision: { trust?: FirstOpenTrustLevel; register?: 'yes' | 'no' } = {};
-  if (offered.trustNeeded && offered.registerNeeded) {
-    // Combined 2x2 choice.
-    const trust: FirstOpenTrustLevel = id === 'trust-register' || id === 'trust-only' ? 'trusted' : 'restricted';
-    const register: 'yes' | 'no' = id === 'trust-register' || id === 'restrict-register' ? 'yes' : 'no';
-    decision.trust = trust;
-    decision.register = register;
-  } else if (offered.trustNeeded) {
-    decision.trust = id === 'trusted' ? 'trusted' : 'restricted';
-  } else if (offered.registerNeeded) {
-    decision.register = id === 'register' ? 'yes' : 'no';
-  }
-  return decision;
+export function decodeFirstOpenChoice(id: string | null): FirstOpenTrustLevel {
+  return id === 'trusted' ? 'trusted' : 'restricted';
 }
 
-/** Build the selection rows for a first-open prompt given which halves apply. */
-export function buildFirstOpenItems(offered: {
-  readonly trustNeeded: boolean;
-  readonly registerNeeded: boolean;
-}): { readonly title: string; readonly items: SelectionItem[] } {
-  if (offered.trustNeeded && offered.registerNeeded) {
-    return {
-      title: 'New workspace — trust level and registration',
-      items: [
-        { id: 'trust-register', label: 'Trust & register this workspace', detail: 'Full capability, and track it in your workspace registry', primaryAction: 'select' },
-        { id: 'trust-only', label: 'Trust, don\'t register', detail: 'Full capability; leave it out of the registry', primaryAction: 'select' },
-        { id: 'restrict-register', label: 'Keep restricted, register', detail: 'Read-only for now; still track it in the registry', primaryAction: 'select' },
-        { id: 'restrict-only', label: 'Keep restricted, don\'t register', detail: 'Read-only exploration; nothing recorded (default)', primaryAction: 'select' },
-      ],
-    };
-  }
-  if (offered.trustNeeded) {
-    return {
-      title: 'New workspace — choose a trust level',
-      items: [
-        { id: 'trusted', label: 'Trust this workspace', detail: 'Full capability — all tools may run', primaryAction: 'select' },
-        { id: 'restricted', label: 'Keep restricted (read-only)', detail: 'Explore safely; writes and commands are denied until trusted', primaryAction: 'select' },
-      ],
-    };
-  }
+/**
+ * Build the selection rows for the trust prompt. This used to also offer a
+ * "register this directory?" half (a combined 2x2 when both were needed) —
+ * that half is gone: registration self-records (see
+ * selfRecordWorkspaceRegistration below) rather than ever asking a question
+ * about a registry the user hasn't met yet.
+ */
+export function buildFirstOpenItems(): { readonly title: string; readonly items: SelectionItem[] } {
   return {
-    title: 'Register this directory as a workspace?',
+    title: 'New workspace — choose a trust level',
     items: [
-      { id: 'register', label: 'Register this workspace', detail: 'Track this project root in your workspace registry', primaryAction: 'select' },
-      { id: 'skip', label: 'Don\'t register', detail: 'Leave it out; not asked again for this directory (default)', primaryAction: 'select' },
+      { id: 'trusted', label: 'Trust this workspace', detail: 'Full capability — all tools may run', primaryAction: 'select' },
+      { id: 'restricted', label: 'Keep restricted (read-only)', detail: 'Explore safely; writes and commands are denied until trusted', primaryAction: 'select' },
     ],
   };
 }
 
 /**
- * First-open workspace prompt — one surface folding the TUI-local trust gate and
- * the platform-wide registration half. When GoodVibes opens a workspace it has
- * no trust decision for, and/or one whose registration resolves UNKNOWN, ask
- * once (never two stacked modals): trust level AND "register this directory?".
+ * Registration self-records: a workspace the user actually works in becomes
+ * its own registry entry with no question ever asked (the former "Register
+ * this directory as a workspace?" prompt — sometimes a four-option 2x2 when
+ * trust was undecided too — is gone entirely).
+ *
+ * "Actually works in" is anchored to TRUST, not mere directory-open: this is
+ * only ever called for a workspace that is (or has just become) trusted,
+ * never for one that's merely been glanced at read-only. Labeled 'via TUI'
+ * in the shared registry so its provenance is honest.
  *
- * The two records are independent: a grandfathered-trusted workspace skips the
- * trust half but may still see the register half once; a covered/declined/broad
- * directory skips the register half. Escape/enter-through takes the safe default
- * (restricted, and a recorded decline for the register half).
+ * OWNER-BOUNDARY RIDER (binding): self-recording must not widen the
+ * checkpoint-owning consumer's boundary. That boundary now reads the SAME
+ * shared registration store this writes to, gated by each record's
+ * `checkpointEligible` flag (absent means false). So the separation is no
+ * longer "a separate list the agent owns" — it is one store, and this self
+ * record stays out of scope by stamping its `origin` ('tui') for honest
+ * provenance while NEVER setting `checkpointEligible`. Only the consumer that
+ * owns checkpointing re-stamps its own roots eligible on boot.
  */
-async function promptWorkspaceFirstOpen(commandContext: CommandContext, render: () => void): Promise<void> {
-  const trustManager = commandContext.workspace?.workspaceTrustManager;
-  const registrationManager = commandContext.workspace?.workspaceRegistrationManager;
-  const trustNeeded = Boolean(trustManager && !trustManager.isDecided());
-  const evaluation = registrationManager ? await registrationManager.evaluate() : null;
-  const registerNeeded = Boolean(evaluation?.offerRegister);
-  if (!trustNeeded && !registerNeeded) return;
-
-  const offered = { trustNeeded, registerNeeded };
-  const { title, items } = buildFirstOpenItems(offered);
-  commandContext.openSelection?.(
-    title,
-    items,
-    { allowSearch: false, primaryVerbLabel: 'Choose' },
-    (result) => {
-      const decision = decodeFirstOpenChoice(result?.item.id ?? null, offered);
-      const apply = async () => {
-        if (decision.trust && trustManager) await trustManager.setLevel(decision.trust);
-        if (decision.register === 'yes' && registrationManager) await registrationManager.register();
-        else if (decision.register === 'no' && registrationManager) await registrationManager.decline();
-      };
-      void apply().finally(render);
-    },
-  );
+export async function selfRecordWorkspaceRegistration(
+  registrationManager: Pick<WorkspaceRegistrationManager, 'evaluate' | 'register'> | undefined,
+): Promise<void> {
+  if (!registrationManager) return;
+  const evaluation = await registrationManager.evaluate();
+  if (!evaluation.offerRegister) return;
+  await registrationManager.register('via TUI', 'tui');
 }
 
 export function applyInitialTuiCliState(options: {
@@ -131,6 +83,16 @@ export function applyInitialTuiCliState(options: {
   const { cli, input, commandRegistry, commandContext, shellPaths, render } = options;
   const globalOnboardingMarker = readOnboardingCheckMarker(shellPaths, 'user');
 
+  // Registration self-records on every launch of an already-trusted
+  // workspace (fire-and-forget — never blocks or gates startup, never a
+  // modal). A workspace that is undecided or restricted is never
+  // self-registered here; for one that becomes trusted just now (via the
+  // consequence-time trust prompt), main.ts's trustPromptRef wiring calls
+  // this same helper right after the decision.
+  if (commandContext.workspace?.workspaceTrustManager?.isTrusted()) {
+    void selfRecordWorkspaceRegistration(commandContext.workspace.workspaceRegistrationManager);
+  }
+
   // Seeded prompt is always applied synchronously, regardless of session branch.
   const seededPrompt = cli.flags.prompt ?? (cli.rawCommand === undefined && cli.positionals.length > 0 ? cli.positionals.join(' ') : undefined);
   if (seededPrompt) {
@@ -183,6 +145,9 @@ export function applyInitialTuiCliState(options: {
   } else if (!globalOnboardingMarker.exists) {
     // Fast path: get a brand-new user to a working session in the fewest steps.
     // Falls back to the full wizard when the surface can't detect providers.
+    // Trust stays undecided here on purpose — the first non-read tool
+    // request is what raises the trust question now (see main.ts's
+    // trustPromptRef), not this startup branch.
     startOnboardingFastPath({ input, commandContext, shellPaths, render });
   } else {
     // User has completed onboarding before but left a wizard session in progress.
@@ -202,11 +167,9 @@ export function applyInitialTuiCliState(options: {
           },
         });
       }
-    } else {
-      // Returning user, no wizard to resume: this is the moment to ask, in one
-      // surface, about a genuinely new workspace's trust level and whether to
-      // register it — before they run anything here.
-      void promptWorkspaceFirstOpen(commandContext, render);
     }
+    // Returning user, no wizard to resume, nothing else to do at startup:
+    // trust (if still undecided) is asked at the first non-read tool
+    // request, not here — see main.ts's trustPromptRef wiring.
   }
 }

package/src/cli/types.ts

@@ -60,6 +60,8 @@ export interface GoodVibesCliFlags {
   readonly fork: string | true | undefined;
   readonly yes: boolean;
   readonly nonInteractive: boolean;
+  /** `doctor --strict`: advisory findings also fail (exit 1), for CI. Ignored by every other command. */
+  readonly strict: boolean;
 }
 
 export interface GoodVibesCliParseResult {

package/src/config/index.ts

@@ -8,7 +8,7 @@
 
 export { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
 export type { DeepReadonly } from '@pellux/goodvibes-sdk/platform/config';
-export type { GoodVibesConfig, ConfigKey, ConfigValue, ConfigSetting, PermissionMode, PermissionAction, PermissionsToolConfig, NotificationsConfig, PersistedFlagState } from '@pellux/goodvibes-sdk/platform/config';
+export type { GoodVibesConfig, ConfigKey, ConfigValue, ConfigSetting, PermissionMode, PermissionAction, PermissionsToolConfig, NotificationsConfig } from '@pellux/goodvibes-sdk/platform/config';
 export { DEFAULT_CONFIG, CONFIG_SCHEMA } from '@pellux/goodvibes-sdk/platform/config';
 export { ConfigError } from '@pellux/goodvibes-sdk/platform/types';
 

package/src/config/tui-extension-settings.ts

@@ -99,6 +99,39 @@ export function readStatuslineSettings(configManager: Pick<ConfigManager, 'getRa
   return out;
 }
 
+// ─── update.* — launch-time self-update behavior ─────────────────────────────
+
+/**
+ * User-settable launch-time self-update behavior. The feature itself (check at
+ * launch, install via the checksum-verified download/verify/swap path, restart
+ * onto the new binary) defaults ON for binary installs; the defaults live in
+ * the consumer (src/cli/launch-auto-update.ts), matching this file's rule that
+ * readers return only what the user actually set.
+ */
+export interface UpdateSettings {
+  /** Check for a newer release at TUI launch and install it before starting. Default: true. */
+  readonly autoUpdateAtLaunch?: boolean;
+  /** How long the launch-time version check may take before it is skipped. Defaults to 2500; clamped to [250, 30000]. */
+  readonly launchCheckTimeoutMs?: number;
+}
+
+const LAUNCH_CHECK_MIN_TIMEOUT_MS = 250;
+const LAUNCH_CHECK_MAX_TIMEOUT_MS = 30_000;
+
+/** Read `update.*` from settings.json, validating and clamping the timeout. */
+export function readUpdateSettings(configManager: Pick<ConfigManager, 'getRaw'>): UpdateSettings {
+  const src = readNamespace(configManager, 'update');
+  if (!src) return {};
+  const out: { autoUpdateAtLaunch?: boolean; launchCheckTimeoutMs?: number } = {};
+  const autoUpdateAtLaunch = readBoolean(src, 'autoUpdateAtLaunch');
+  if (autoUpdateAtLaunch !== undefined) out.autoUpdateAtLaunch = autoUpdateAtLaunch;
+  const launchCheckTimeoutMs = readPositiveInt(src, 'launchCheckTimeoutMs');
+  if (launchCheckTimeoutMs !== undefined) {
+    out.launchCheckTimeoutMs = Math.min(LAUNCH_CHECK_MAX_TIMEOUT_MS, Math.max(LAUNCH_CHECK_MIN_TIMEOUT_MS, launchCheckTimeoutMs));
+  }
+  return out;
+}
+
 // ─── checkpoints.* — workspace checkpoint root-guard options ─────────────────
 
 /**

package/src/core/composer-state.ts

@@ -24,7 +24,7 @@ export function deriveComposerState(input: ComposerStateInput): ComposerState {
   // status tag: `risk:approval-wait`. It is therefore NOT also duplicated as a
   // `approval` flag, and (below) it suppresses the competing `state:` turn tag —
   // the turn is blocked on the user, not really streaming. Precedence:
-  // approval-wait > live turn state. (UX-B item 4.)
+  // approval-wait > live turn state. (item 4.)
   const approvalWait = input.pendingApproval === true;
   if (approvalWait) {
     pendingRisk = 'approval-wait';

package/src/core/consolidation-receipt.ts

@@ -0,0 +1,41 @@
+// ---------------------------------------------------------------------------
+// consolidation-receipt.ts — the one-line notice for an idle-time memory
+// consolidation run.
+//
+// The SDK's MemoryConsolidationScheduler runs at idle and produces a
+// MemoryConsolidationRunReceipt (merged / archived / decayed / proposed). This
+// formats it into the same one-line shape every other attach-time receipt
+// uses, so a run that changed something surfaces on the next attach like a
+// crash/update/migration receipt. A pure no-op run yields null — no noise.
+//
+// A run that PROPOSED something (a contradiction or cross-scope-duplicate
+// awaiting human judgment — never auto-applied) names where to actually look:
+// the Memory modal's Proposals tab (`/memory`, then the Proposals tab —
+// memory-modal.ts's proposalsTab()), which lists each proposal's kind,
+// reason, and affected record ids and jumps to them in the Review Queue.
+// Without this pointer the receipt line was the only trace a proposal ever
+// existed — a count with nowhere to go.
+// ---------------------------------------------------------------------------
+
+import type { MemoryConsolidationRunReceipt } from '@pellux/goodvibes-sdk/platform/state';
+
+/**
+ * A one-line receipt for a consolidation run that changed something, or null
+ * when the run merged/archived/decayed/proposed nothing (a quiet idle pass —
+ * no notice, matching the check-in "stayed quiet" discipline).
+ */
+export function formatConsolidationReceipt(receipt: MemoryConsolidationRunReceipt): string | null {
+  const merged = receipt.merged.length;
+  const archived = receipt.archived.length;
+  const decayed = receipt.decayed.length;
+  const proposed = receipt.proposed.length;
+  if (merged + archived + decayed + proposed === 0) return null;
+  const parts: string[] = [];
+  if (merged) parts.push(`${merged} merged`);
+  if (archived) parts.push(`${archived} archived`);
+  if (decayed) parts.push(`${decayed} decayed`);
+  if (proposed) parts.push(`${proposed} proposed`);
+  const base = `Memory consolidation: ${parts.join(', ')} (scanned ${receipt.scanned}).`;
+  if (proposed === 0) return base;
+  return `${base} Review the ${proposed} proposed change${proposed === 1 ? '' : 's'} with /memory (Proposals tab).`;
+}

package/src/core/conversation-line-cache.ts

@@ -1,5 +1,5 @@
 /**
- * conversation-line-cache.ts — per-message Line[] production cache (WO-209).
+ * conversation-line-cache.ts — per-message Line[] production cache.
  *
  * The measured defect (perf baseline 2026-07-03, transcript.build_1k): appending
  * ONE message to an N-message conversation re-rendered all N messages
@@ -98,7 +98,7 @@ interface KeyMeta {
   /**
    * True when this (assistant) message has a tool call with no result yet — it
    * renders as pending rather than done. Keyed so the entry invalidates and
-   * re-renders ✓ once the tool result arrives. (UX-B item 2c.)
+   * re-renders ✓ once the tool result arrives. (item 2c.)
    */
   readonly hasPendingTool: boolean;
 }
@@ -286,7 +286,7 @@ export class MessageLineCache {
     };
 
     // Tool calls with no matching tool-result message are still pending; the
-    // render context and the cache key both depend on this. (UX-B item 2c.)
+    // render context and the cache key both depend on this. (item 2c.)
     const completedToolCallIds = collectCompletedToolCallIds(messages);
     const renderContext: ConversationRenderContext = { ...context, completedToolCallIds };
 

package/src/core/conversation-rendering.ts

@@ -1,7 +1,7 @@
 import { UIFactory } from '../renderer/ui-factory.ts';
 import { renderMarkdownTracked } from '../renderer/markdown.ts';
 import { renderDiffView } from '../renderer/diff-view.ts';
-import { activeTheme } from '../renderer/theme.ts';
+import { activeTheme, activeUiTones } from '../renderer/theme.ts';
 import { renderToolCallBlock } from '../renderer/tool-call.ts';
 import { summarizeToolResult } from '../renderer/tool-result-summary.ts';
 import type { ToolCall } from '@pellux/goodvibes-sdk/platform/types';
@@ -46,7 +46,7 @@ type Message = ConversationMessageSnapshot;
  * Collect the ids of tool calls that have a matching tool-result message in the
  * given slice — i.e. the tools that actually ran. Used to decide whether an
  * assistant tool call still shows as pending (awaiting approval) or done.
- * (UX-B item 2c.)
+ * (item 2c.)
  */
 export function collectCompletedToolCallIds(messages: readonly Message[]): Set<string> {
   const ids = new Set<string>();
@@ -79,7 +79,7 @@ export interface ConversationRenderContext {
    * awaiting a decision (e.g. an approval prompt) and renders with a pending
    * glyph instead of the completed ✓. When undefined (single-message callers
    * without sibling context), every tool call renders as done — the prior
-   * behaviour. (UX-B item 2c.)
+   * behaviour. (item 2c.)
    */
   readonly completedToolCallIds?: ReadonlySet<string>;
 }
@@ -273,7 +273,7 @@ export function renderConversationToolMessage(
   // Human one-line summary for tool results (write/read/exec/edit): shown as the
   // collapsed line so the transcript reads "wrote foo.txt (532 B)" instead of a
   // raw JSON blob; the full payload stays behind the expand toggle. Only for
-  // 'tool' blocks (diffs render their own view). (UX-B item 3.)
+  // 'tool' blocks (diffs render their own view). (item 3.)
   const resultSummary = blockType === 'tool'
     ? summarizeToolResult(message.toolName, message.content)
     : null;
@@ -291,11 +291,20 @@ export function renderConversationToolMessage(
     context.collapseState.set(collapseKey, isShort ? false : true);
   }
 
+  // A per-call user cancellation settles as a tool result whose content leads
+  // with "Error: cancelled by user" (the SDK's structured cancelled shape; any
+  // partial output the tool produced before it stopped follows on later lines).
+  // Render it structurally as a distinct "cancelled" block in the warn tone —
+  // not a generic tool result, and not a hard error — so the transcript reads
+  // the user's decision honestly while the partial output stays visible below.
+  const isCancelled = blockType === 'tool' && /^Error: cancelled by user\b/.test(contentLines[0] ?? '');
+  const warnTone = activeUiTones().chrome.warn;
+
   context.history.addLine(renderConversationEventLine(width, {
-    marker: blockType === 'diff' ? GLYPHS.status.dualPane : GLYPHS.status.active,
-    markerFg: blockType === 'diff' ? T.diffAccent : T.toolAccent,
-    label: blockType === 'diff' ? 'diff' : 'tool result',
-    labelFg: blockType === 'diff' ? T.diffAccent : T.toolAccent,
+    marker: isCancelled ? GLYPHS.status.blocked : (blockType === 'diff' ? GLYPHS.status.dualPane : GLYPHS.status.active),
+    markerFg: isCancelled ? warnTone : (blockType === 'diff' ? T.diffAccent : T.toolAccent),
+    label: isCancelled ? 'cancelled' : (blockType === 'diff' ? 'diff' : 'tool result'),
+    labelFg: isCancelled ? warnTone : (blockType === 'diff' ? T.diffAccent : T.toolAccent),
     detailFg: '244',
   }, [
     ...(message.toolName
@@ -379,7 +388,7 @@ export function appendConversationMessages(
   const lineNumberMode = context.configManager?.get('display.lineNumbers') ?? 'off';
   const collapseThreshold = context.configManager?.get('display.collapseThreshold') ?? 30;
   // Derive pending vs done for tool calls from sibling tool-result messages,
-  // unless the caller already supplied the set. (UX-B item 2c.)
+  // unless the caller already supplied the set. (item 2c.)
   const renderContext: ConversationRenderContext = context.completedToolCallIds !== undefined
     ? context
     : { ...context, completedToolCallIds: collectCompletedToolCallIds(messages) };

package/src/core/conversation.ts

@@ -67,7 +67,7 @@ export interface OrchestratorUsageTotals {
  * TUI-side counterpart to SDK Orchestrator.usage: after a session resume
  * replays historical messages into a freshly-constructed Orchestrator (whose
  * `usage` starts at all zeros — bootstrap.ts always constructs a fresh
- * instance, see W0.9), this lets the caller hydrate the footer's token
+ * instance, see), this lets the caller hydrate the footer's token
  * counters from messages that already carry real usage data instead of
  * waiting for the first new turn to populate them.
  */
@@ -98,7 +98,7 @@ export class ConversationManager extends SdkConversationManager {
   /** When true the buffer needs to be rebuilt before the next display. */
   private dirty = true;
   /**
-   * Per-message Line[] cache (WO-209). rebuildHistory() reuses cached lines for
+   * Per-message Line[] cache. rebuildHistory() reuses cached lines for
    * messages whose complete render inputs are unchanged, so appending one message
    * to an N-message conversation no longer re-renders all N. A cache-served
    * rebuild is byte-identical to a cold one (pure memoisation).

package/src/core/long-task-notifier.ts

@@ -18,12 +18,12 @@
  * When neither target is available the function is an honest no-op (debug log
  * only; no user-facing error spam).
  *
- * Focus tracking (W2.3): when `focusTracker` is supplied, notifications are
+ * Focus tracking: when `focusTracker` is supplied, notifications are
  * gated the same way as the other unfocused-user alert classes (see
  * alert-gating.ts) — they fire when the terminal is unfocused or focus state
  * was never observed, and are suppressed when it's known to be focused,
  * unless `behavior.notifyOnlyWhenUnfocused` is turned off. `focusTracker` is
- * optional and defaults to "always fire" (the pre-W2.3 behavior) when
+ * optional and defaults to "always fire" (the behavior before focus gating existed) when
  * omitted, so existing callers that don't have a FocusTracker in scope are
  * unaffected.
  */
@@ -82,11 +82,11 @@ export interface MaybeNotifyLongTaskOptions {
   readonly webhookNotifier?: WebhookNotifier | null;
 
   /**
-   * Terminal focus tracker (W2.3). When supplied together with `configGet`,
+   * Terminal focus tracker. When supplied together with `configGet`,
    * the notification additionally respects behavior.notifyOnlyWhenUnfocused
    * (default on): suppressed when the terminal is known to be focused, fires
    * when unfocused or when focus was never observed. Omit both to preserve
-   * pre-W2.3 behavior (always fire once the threshold is met).
+   * the behavior before focus gating existed (always fire once the threshold is met).
    */
   readonly focusTracker?: Pick<FocusTracker, 'shouldAlertWhenUnfocused'> | null;
 
@@ -121,9 +121,9 @@ export function maybeNotifyLongTask(opts: MaybeNotifyLongTaskOptions): boolean {
     return false;
   }
 
-  // Focus gate (W2.3): only applied when both a tracker and a config reader
-  // are supplied. Absent either one, behavior is unchanged from pre-W2.3
-  // (always fire once the threshold is met).
+  // Focus gate: only applied when both a tracker and a config reader
+  // are supplied. Absent either one, behavior is unchanged from before focus
+  // gating existed (always fire once the threshold is met).
   if (focusTracker && configGet && readNotifyOnlyWhenUnfocused(configGet) && !focusTracker.shouldAlertWhenUnfocused()) {
     logger.debug('long-task-notifier: suppressed — terminal focused');
     return false;

package/src/core/memory-provenance.ts

@@ -0,0 +1,67 @@
+// ---------------------------------------------------------------------------
+// memory-provenance.ts — the optional "used N memories" turn chip (owner-ruled
+// 2026-07-13, default OFF).
+//
+// The SDK tags each turn payload with the memory-sourced injection ids it drew
+// on: `metadata.memory.recordIds: string[]` (absent when none) — the SAME
+// convention the webui's chip reads, so both surfaces name the same records.
+// When the memory-provenance setting is ON, a turn that used memories shows a
+// small chip naming how many, with a drill-in listing them. When OFF (default),
+// NOTHING is rendered and the metadata is never even read.
+// ---------------------------------------------------------------------------
+
+import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
+
+/** TUI-local setting key: show the per-turn memory-provenance chip. Default OFF. */
+export const MEMORY_SHOW_PROVENANCE_CONFIG_KEY = 'memory.showProvenance';
+export const MEMORY_SHOW_PROVENANCE_DEFAULT = false;
+export const MEMORY_SHOW_PROVENANCE_DESCRIPTION =
+  'Show a "used N memories" chip on turns that drew on your standing memories, with a drill-in ' +
+  'listing them (Alt+M to expand). Off by default; when off, nothing is rendered and no metadata is read.';
+
+/**
+ * Read the memory-provenance toggle defensively. `memory.*` is a TUI-local
+ * section with no SDK DEFAULT_CONFIG entry, so ConfigManager.get() throws for
+ * it until something has been written — an unset key means the default (OFF),
+ * not an error (same pattern as memory.projection.dir).
+ */
+export function readMemoryShowProvenance(configManager: Pick<ConfigManager, 'get'>): boolean {
+  try {
+    return configManager.get(MEMORY_SHOW_PROVENANCE_CONFIG_KEY as Parameters<ConfigManager['get']>[0]) === true;
+  } catch {
+    return MEMORY_SHOW_PROVENANCE_DEFAULT;
+  }
+}
+
+/**
+ * Extract the memory-sourced record ids a turn drew on, from the SDK's
+ * `metadata.memory.recordIds` convention. Structural (not a named import) so it
+ * reads the field whether or not the pinned SDK's TurnEvent type surfaces it
+ * yet, and yields an empty list for any turn without the field — never a guess,
+ * never a throw.
+ */
+export function memoryRecordIdsFromTurn(turn: unknown): readonly string[] {
+  const metadata = (turn as { metadata?: unknown } | null | undefined)?.metadata;
+  const memory = (metadata as { memory?: unknown } | null | undefined)?.memory;
+  const recordIds = (memory as { recordIds?: unknown } | null | undefined)?.recordIds;
+  if (!Array.isArray(recordIds)) return [];
+  return recordIds.filter((id): id is string => typeof id === 'string');
+}
+
+/**
+ * Build the settings-modal synthetic entry for memory.showProvenance (TUI-local,
+ * default OFF). Read defensively — memory.* has no SDK DEFAULT_CONFIG entry, so
+ * an unset key means the OFF default, not an error.
+ */
+export function buildMemoryProvenanceSyntheticEntry(configManager: Pick<ConfigManager, 'get'>): {
+  setting: { key: string; type: 'boolean'; default: boolean; description: string };
+  currentValue: boolean;
+  isDefault: boolean;
+} {
+  const currentValue = readMemoryShowProvenance(configManager);
+  return {
+    setting: { key: MEMORY_SHOW_PROVENANCE_CONFIG_KEY, type: 'boolean', default: MEMORY_SHOW_PROVENANCE_DEFAULT, description: MEMORY_SHOW_PROVENANCE_DESCRIPTION },
+    currentValue,
+    isDefault: currentValue === MEMORY_SHOW_PROVENANCE_DEFAULT,
+  };
+}