@pellux/goodvibes-tui 1.17.0 → 1.19.0

package/src/shell/blocking-input.ts

@@ -1,9 +1,4 @@
-import type { ConversationManager } from '../core/conversation';
 import type { PermissionRequest, RememberTier } from '@pellux/goodvibes-sdk/platform/permissions';
-import type { SessionSnapshot } from '@/runtime/index.ts';
-import type { SystemMessageRouter } from '../core/system-message-router.ts';
-import type { ConversationMessageSnapshot } from '@pellux/goodvibes-sdk/platform/core';
-import { replayJournalForSession } from '../core/session-recovery.ts';
 import { applyHunkKey, buildModifiedEditArgs, type HunkSelectionState } from '../permissions/hunk-selection.ts';
 
 export type PendingPermissionState = PermissionRequest & {
@@ -43,47 +38,8 @@ export const APPROVAL_INPUT_DEBOUNCE_MS = 350;
 export type BlockingInputHandlerOptions = {
   data: string;
   pendingPermission: PendingPermissionState | null;
-  recoveryPending: boolean;
   abortTurn: () => void;
-  conversation: ConversationManager;
-  systemMessageRouter: SystemMessageRouter;
   render: () => void;
-  loadRecoveryConversation: () => SessionSnapshot | null;
-  deleteRecoveryFile: () => void;
-  /**
-   * Copy the live recovery.jsonl aside to a preserved sibling so the dismiss
-   * message's promise ("still on disk") survives this session's later 60s
-   * autosaves, which would otherwise overwrite the shared recovery file with
-   * the CURRENT (post-dismiss) session's state (W3 Finding 3). Optional so
-   * every pre-existing test/caller that doesn't care about preservation is
-   * unaffected; when omitted, dismiss behaves exactly as before.
-   */
-  preserveRecoveryFile?: () => { readonly preserved: boolean; readonly replacedPrevious: boolean };
-  /**
-   * Absolute home directory used to locate the transcript journal for this
-   * recovery session. Required for journal replay on Ctrl+R restore.
-   */
-  homeDirectory: string;
-  /**
-   * The session ID that the recovery file belongs to. Required for journal
-   * replay so the correct journal path can be resolved.
-   */
-  sessionId: string;
-  /**
-   * Persist the post-replay snapshot so the WAL gap is durably closed.
-   * Called with the replayed message list. Best-effort — failures are swallowed
-   * inside replayJournalForSession.
-   */
-  persistSnapshot: (messages: ConversationMessageSnapshot[]) => void;
-  /**
-   * Optional callback invoked after Ctrl+R restore to reopen panels captured in
-   * the recovery snapshot's returnContext. When provided (as wired in main.ts),
-   * the callback iterates snapshot.returnContext.openPanels and calls
-   * panelManager.open() for each entry, then panelManager.show() + render() to
-   * restore the panel posture from the recovered session. When omitted, panel
-   * posture is not restored.
-   */
-  reopenPanels?: (snapshot: SessionSnapshot) => void;
   /** Injectable clock for the approval-input debounce; defaults to Date.now(). Tests only. */
   now?: number;
 };
@@ -91,7 +47,6 @@ export type BlockingInputHandlerOptions = {
 export type BlockingInputHandlerResult = {
   handled: boolean;
   pendingPermission: PendingPermissionState | null;
-  recoveryPending: boolean;
 };
 
 export function handleBlockingShellInput(
@@ -100,18 +55,8 @@ export function handleBlockingShellInput(
   const {
     data,
     pendingPermission,
-    recoveryPending,
     abortTurn,
-    conversation,
-    systemMessageRouter,
     render,
-    loadRecoveryConversation,
-    deleteRecoveryFile,
-    preserveRecoveryFile,
-    homeDirectory,
-    sessionId,
-    persistSnapshot,
-    reopenPanels,
   } = options;
 
   if (pendingPermission) {
@@ -124,7 +69,7 @@ export function handleBlockingShellInput(
     const now = options.now ?? Date.now();
     if (req.openedAt !== undefined && now - req.openedAt < APPROVAL_INPUT_DEBOUNCE_MS) {
       render();
-      return { handled: true, pendingPermission, recoveryPending };
+      return { handled: true, pendingPermission };
     }
 
     if (req.hunkState) {
@@ -132,16 +77,16 @@ export function handleBlockingShellInput(
       if (commit === 'apply') {
         req.resolve(true, false, buildModifiedEditArgs(req, state));
         render();
-        return { handled: true, pendingPermission: null, recoveryPending };
+        return { handled: true, pendingPermission: null };
       }
       if (commit === 'cancel') {
         req.resolve(false, false);
         abortTurn();
         render();
-        return { handled: true, pendingPermission: null, recoveryPending };
+        return { handled: true, pendingPermission: null };
       }
       render();
-      return { handled: true, pendingPermission: { ...req, hunkState: state }, recoveryPending };
+      return { handled: true, pendingPermission: { ...req, hunkState: state } };
     }
 
     // Ctrl+C is ALWAYS the hard abort: deny and kill the turn, in every mode.
@@ -149,7 +94,7 @@ export function handleBlockingShellInput(
       req.resolve(false, false);
       abortTurn();
       render();
-      return { handled: true, pendingPermission: null, recoveryPending };
+      return { handled: true, pendingPermission: null };
     }
 
     // Typed-reply mode: deny-with-reason (started by typing on any card) or
@@ -168,7 +113,7 @@ export function handleBlockingShellInput(
           req.resolve(false, false, undefined, { reason: buffer });
         }
         render();
-        return { handled: true, pendingPermission: null, recoveryPending };
+        return { handled: true, pendingPermission: null };
       }
       if (data === '\x1b') {
         if (req.replyMode === 'exec-answer') {
@@ -176,26 +121,26 @@ export function handleBlockingShellInput(
           // declines the prompt (the run gets the honest unanswered result).
           if (buffer.length > 0) {
             render();
-            return { handled: true, pendingPermission: { ...req, replyBuffer: '' }, recoveryPending };
+            return { handled: true, pendingPermission: { ...req, replyBuffer: '' } };
           }
           req.resolve(false, false);
           render();
-          return { handled: true, pendingPermission: null, recoveryPending };
+          return { handled: true, pendingPermission: null };
         }
         // Esc leaves deny-reason mode back to the plain card.
         render();
-        return { handled: true, pendingPermission: { ...req, replyMode: undefined, replyBuffer: undefined }, recoveryPending };
+        return { handled: true, pendingPermission: { ...req, replyMode: undefined, replyBuffer: undefined } };
       }
       if (data === '\x7f' || data === '\b') {
         render();
-        return { handled: true, pendingPermission: { ...req, replyBuffer: buffer.slice(0, -1) }, recoveryPending };
+        return { handled: true, pendingPermission: { ...req, replyBuffer: buffer.slice(0, -1) } };
       }
       if (data.length >= 1 && !data.startsWith('\x1b') && data >= ' ') {
         render();
-        return { handled: true, pendingPermission: { ...req, replyBuffer: buffer + data }, recoveryPending };
+        return { handled: true, pendingPermission: { ...req, replyBuffer: buffer + data } };
       }
       render();
-      return { handled: true, pendingPermission, recoveryPending };
+      return { handled: true, pendingPermission };
     }
 
     // Scroll, mouse, PageUp/Down, arrow, and panel-navigation keys — plus a
@@ -204,7 +149,7 @@ export function handleBlockingShellInput(
     // request stays pending (answer it with y/n or a remember tier when ready);
     // Ctrl+C above is still the hard abort, and 'n' still denies.
     if (data.startsWith('\x1b')) {
-      return { handled: false, pendingPermission, recoveryPending };
+      return { handled: false, pendingPermission };
     }
 
     const key = data.toLowerCase().trim();
@@ -212,14 +157,14 @@ export function handleBlockingShellInput(
     if (key === 'y') {
       req.resolve(true, false);
       render();
-      return { handled: true, pendingPermission: null, recoveryPending };
+      return { handled: true, pendingPermission: null };
     }
 
     if (key === 'a') {
       // Legacy always-this-session choice — the 'session' remember tier.
       req.resolve(true, true, undefined, { rememberTier: 'session' });
       render();
-      return { handled: true, pendingPermission: null, recoveryPending };
+      return { handled: true, pendingPermission: null };
     }
 
     // Numbered remember tiers ([1]..[N], most specific first) from the SDK's
@@ -230,10 +175,10 @@ export function handleBlockingShellInput(
       if (option) {
         req.resolve(true, option.tier === 'session', undefined, { rememberTier: option.tier });
         render();
-        return { handled: true, pendingPermission: null, recoveryPending };
+        return { handled: true, pendingPermission: null };
       }
       render();
-      return { handled: true, pendingPermission, recoveryPending };
+      return { handled: true, pendingPermission };
     }
 
     if (key === 'n') {
@@ -242,7 +187,7 @@ export function handleBlockingShellInput(
       // Esc drops focus (handled above) rather than denying.
       req.resolve(false, false);
       render();
-      return { handled: true, pendingPermission: null, recoveryPending };
+      return { handled: true, pendingPermission: null };
     }
 
     if (key === 'd') {
@@ -251,7 +196,6 @@ export function handleBlockingShellInput(
       return {
         handled: true,
         pendingPermission: { ...req, detailsExpanded: !req.detailsExpanded },
-        recoveryPending,
       };
     }
 
@@ -259,76 +203,12 @@ export function handleBlockingShellInput(
     // becomes the denial feedback, seeded with this first character.
     if (data.length === 1 && data >= ' ') {
       render();
-      return { handled: true, pendingPermission: { ...req, replyMode: 'deny-reason', replyBuffer: data }, recoveryPending };
+      return { handled: true, pendingPermission: { ...req, replyMode: 'deny-reason', replyBuffer: data } };
     }
 
     render();
-    return { handled: true, pendingPermission, recoveryPending };
-  }
-
-  if (recoveryPending) {
-    if (data === '\x12') {
-      const recovery = loadRecoveryConversation();
-      if (recovery) {
-        conversation.fromJSON({
-          messages: recovery.messages as Parameters<typeof conversation.fromJSON>[0]['messages'],
-          title: recovery.title,
-          titleSource: recovery.titleSource,
-        });
-        // Replay journal records that post-date the recovery snapshot so turns
-        // written after the last recovery-file write (but before SIGKILL) are
-        // not silently dropped. snapshotTimestamp=0 when timestamp is absent so
-        // all journal records are replayed — safer than dropping.
-        replayJournalForSession({
-          homeDirectory,
-          sessionId,
-          snapshotTimestamp: recovery.timestamp ?? 0,
-          conversation,
-          persistSnapshot,
-        });
-        reopenPanels?.(recovery);
-        systemMessageRouter.high('[Recovery] Session restored.');
-        deleteRecoveryFile();
-      } else {
-        systemMessageRouter.high('[Recovery] Failed to restore saved data.');
-      }
-      render();
-      return { handled: true, pendingPermission: null, recoveryPending: false };
-    }
-
-    if (data === '\x1b' || data === '\x03') {
-      systemMessageRouter.high('[Recovery] Discarded recovery data.');
-      deleteRecoveryFile();
-      render();
-      return { handled: true, pendingPermission: null, recoveryPending: false };
-    }
-
-    // Any other key demonstrates the user's intent to ignore the banner and
-    // keep working — the prompt's own text invites exactly this ("start
-    // typing to ignore it"). Previously this branch re-posted the same
-    // '[Recovery] Ctrl+R to restore...' line on EVERY such key and never
-    // cleared recoveryPending, so a user who took that invitation got a
-    // fresh [Recovery] line injected into the transcript around every
-    // character they typed, forever. Dismiss ONCE instead: clear
-    // recoveryPending so it stops re-asserting, but do NOT delete the
-    // recovery file — dismiss is not discard, and the file remains
-    // restorable by the automatic recovery check on the next launch.
-    //
-    // W3 Finding 3: the promise below ("still on disk; you will be asked
-    // again") used to go false silently — main.ts's 60s autosave overwrites
-    // the single shared recovery.jsonl with the CURRENT session's state
-    // within a minute. preserveRecoveryFile (when wired) copies it aside
-    // NOW, while it still holds the dismissed session's data, so the
-    // promise stays true. If an earlier dismiss's preserved snapshot gets
-    // replaced by this one, say so honestly instead of silently discarding it.
-    const preserveResult = preserveRecoveryFile?.();
-    if (preserveResult?.replacedPrevious) {
-      systemMessageRouter.low('[Recovery] Replacing the previously preserved (unrestored) snapshot with this one.');
-    }
-    systemMessageRouter.high('[Recovery] Dismissed — the unsaved session is still on disk; you will be asked again next time GoodVibes starts here.');
-    render();
-    return { handled: false, pendingPermission, recoveryPending: false };
+    return { handled: true, pendingPermission };
   }
 
-  return { handled: false, pendingPermission, recoveryPending };
+  return { handled: false, pendingPermission };
 }

package/src/shell/recovery-input-helpers.ts

@@ -1,19 +1,22 @@
 /**
- * Helper factories for main()'s stdin fast-path: the Ctrl+R recovery
- * persistence/panel-reopen callbacks and the one-key error-retry
- * affordance. Extracted from main.ts so the entrypoint stays under the
- * architecture line ceiling; main() wires these with its live services.
+ * Helper factories for main()'s stdin fast-path and startup: the crash-recovery
+ * snapshot persistence + panel-reopen callbacks, the SILENT auto-restore, and
+ * the one-key error-retry affordance. Extracted from main.ts so the entrypoint
+ * stays under the architecture line ceiling; main() wires these with its live
+ * services.
+ *
+ * Recovery is silent (owner ruling): there is no Ctrl+R prompt/banner and no
+ * dismiss/preserve dance. At startup autoRestoreRecoverySession restores the
+ * newest crash snapshot in place and emits a single one-line receipt. The old
+ * `.preserved` sibling machinery is gone — a session's exit deletes only its
+ * OWN snapshot (scoped by sessionId), so a concurrent session's snapshot is
+ * never touched.
  */
 
-import { copyFileSync, existsSync, readFileSync, unlinkSync } from 'node:fs';
 import type { ConversationMessageSnapshot } from '../core/conversation.ts';
-import type { SessionReturnContextSummary, SessionSnapshot } from '@/runtime/index.ts';
-import {
-  checkRecoveryFile,
-  deleteRecoveryFile as deleteLiveRecoveryFile,
-  getRecoveryFilePath,
-  loadRecoveryConversation as loadLiveRecoveryConversation,
-} from '@/runtime/index.ts';
+import type { SessionSnapshot } from '@/runtime/index.ts';
+import { autoRestoreRecovery } from '@/runtime/index.ts';
+import { replayJournalForSession } from '../core/session-recovery.ts';
 
 export interface PersistRecoveryDeps {
   readonly sessionManager: {
@@ -48,166 +51,50 @@ export function createReopenRecoveryPanels(deps: ReopenPanelsDeps): (snapshot: S
   };
 }
 
-// ---------------------------------------------------------------------------
-// W3 Finding 3: preserve the dismissed recovery snapshot.
-//
-// main.ts's 60s autosave (writeRecoveryFile) overwrites the single shared
-// recovery.jsonl with the CURRENT session's live state within a minute — so
-// the dismiss banner's promise ("still on disk; you will be asked again next
-// time") went false silently well before the next launch. Fix: the moment
-// the user dismisses (blocking-input.ts), copy recovery.jsonl aside to a
-// preserved sibling file (recovery.jsonl.preserved) so it survives this
-// session's later autosaves. Startup then checks BOTH the live file and the
-// preserved sibling and offers whichever is newer (pickNewestRecoveryInfo),
-// bounded to exactly one preserved file — a later dismiss replaces it, and
-// that replacement is reported honestly (PreserveRecoveryResult.replacedPrevious)
-// rather than silently dropping the older snapshot.
-// ---------------------------------------------------------------------------
-
-export interface RecoveryFileDeps {
+export interface AutoRestoreRecoveryDeps {
+  readonly workingDirectory: string;
   readonly homeDirectory: string;
-  readonly surfaceRoot?: string | undefined;
-}
-
-export interface PreservedRecoveryInfo {
-  readonly title: string;
-  readonly timestamp: number;
-  readonly sessionId: string;
-  readonly returnContext?: SessionReturnContextSummary | undefined;
-}
-
-export interface PreserveRecoveryResult {
-  /** True if a live recovery.jsonl existed and was copied to the preserved sibling. */
-  readonly preserved: boolean;
-  /** True if an existing preserved sibling (from an earlier dismiss) was overwritten. */
-  readonly replacedPrevious: boolean;
-}
-
-function preservedRecoveryPath(deps: RecoveryFileDeps): string {
-  return `${getRecoveryFilePath(deps.homeDirectory, deps.surfaceRoot)}.preserved`;
-}
-
-function readRecoveryMetaLine(path: string): { title?: string; timestamp?: number; sessionId?: string; returnContext?: SessionReturnContextSummary } | null {
-  try {
-    if (!existsSync(path)) return null;
-    const firstLine = readFileSync(path, 'utf-8').split('\n')[0];
-    if (!firstLine) return null;
-    return JSON.parse(firstLine) as { title?: string; timestamp?: number; sessionId?: string; returnContext?: SessionReturnContextSummary };
-  } catch {
-    return null;
-  }
-}
-
-/** Copy the live recovery.jsonl aside to the preserved sibling. Called once, at dismiss. */
-export function createPreserveRecoveryFile(deps: RecoveryFileDeps): () => PreserveRecoveryResult {
-  return () => {
-    const live = getRecoveryFilePath(deps.homeDirectory, deps.surfaceRoot);
-    const preserved = preservedRecoveryPath(deps);
-    if (!existsSync(live)) return { preserved: false, replacedPrevious: false };
-    const replacedPrevious = existsSync(preserved);
-    try {
-      copyFileSync(live, preserved);
-      return { preserved: true, replacedPrevious };
-    } catch {
-      return { preserved: false, replacedPrevious: false };
-    }
+  /** The live conversation to restore INTO (fromJSON applies the snapshot). */
+  readonly conversation: {
+    fromJSON(input: { messages: ConversationMessageSnapshot[]; title?: string; titleSource?: SessionSnapshot['titleSource'] }): void;
   };
+  /** Persist the post-replay snapshot so the WAL gap is durably closed. */
+  readonly persistSnapshot: (msgs: ConversationMessageSnapshot[]) => void;
+  /** Reopen the restored session's panels. */
+  readonly reopenPanels: (snapshot: SessionSnapshot) => void;
+  /** Surface the one-line receipt (the only user-visible sign of a restore). */
+  readonly systemMessageRouter: { high(message: string): void };
 }
 
 /**
- * Startup check for the preserved sibling — mirrors the SDK's
- * checkRecoveryFile meta read, but for the fixed preserved path. No
- * mtime-vs-last-clean-save gate: the preserved file is inert (never
- * autosaved-over) until explicitly replaced or cleared, so its mere
- * existence is actionable.
- */
-export function checkPreservedRecoveryFile(deps: RecoveryFileDeps): PreservedRecoveryInfo | null {
-  const meta = readRecoveryMetaLine(preservedRecoveryPath(deps));
-  if (!meta) return null;
-  return { title: meta.title ?? '', timestamp: meta.timestamp ?? 0, sessionId: meta.sessionId ?? '', returnContext: meta.returnContext };
-}
-
-/** Load the preserved sibling's full snapshot — same JSONL shape as recovery.jsonl since it's a byte-identical copy. */
-export function loadPreservedRecoveryConversation(deps: RecoveryFileDeps): SessionSnapshot | null {
-  const path = preservedRecoveryPath(deps);
-  try {
-    if (!existsSync(path)) return null;
-    const lines = readFileSync(path, 'utf-8').split('\n').filter(Boolean);
-    if (lines.length < 2) return { messages: [] };
-    const metaLine = JSON.parse(lines[0]!) as { title?: string; titleSource?: SessionSnapshot['titleSource']; returnContext?: SessionSnapshot['returnContext'] };
-    return {
-      title: metaLine.title,
-      titleSource: metaLine.titleSource,
-      returnContext: metaLine.returnContext,
-      messages: lines.slice(1).map((line) => {
-        const { type: _type, ...rest } = JSON.parse(line) as { type: string } & Record<string, unknown>;
-        return rest;
-      }),
-    };
-  } catch {
-    return null;
-  }
-}
-
-/** Remove the preserved sibling — called after it has been restored or discarded. */
-export function deletePreservedRecoveryFile(deps: RecoveryFileDeps): void {
-  try {
-    unlinkSync(preservedRecoveryPath(deps));
-  } catch {
-    // missing file is fine
-  }
-}
-
-/**
- * Pick the newer of the live vs. preserved recovery info for the startup
- * prompt, tagging which source it came from so the caller knows which
- * load/delete pair to use. Null when neither exists.
- */
-export function pickNewestRecoveryInfo<T extends { readonly timestamp: number }>(
-  live: T | null,
-  preserved: T | null,
-): (T & { readonly source: 'live' | 'preserved' }) | null {
-  if (!live && !preserved) return null;
-  if (!live) return { ...(preserved as T), source: 'preserved' };
-  if (!preserved) return { ...live, source: 'live' };
-  return preserved.timestamp > live.timestamp
-    ? { ...(preserved as T), source: 'preserved' }
-    : { ...live, source: 'live' };
-}
-
-/**
- * Startup entry point: resolve which recovery prompt (if any) main.ts should
- * show — the live recovery.jsonl, or an earlier dismiss's preserved sibling,
- * whichever is newer. Bundles checkRecoveryFile + checkPreservedRecoveryFile
- * + pickNewestRecoveryInfo so main.ts's entrypoint stays a one-liner.
+ * Silent crash-recovery restore at startup — no prompt, no banner. Loads the
+ * newest crash snapshot (the SDK scopes the load AND the follow-up delete to
+ * that snapshot's own session id), applies it to the live conversation, replays
+ * any journal turns written after the snapshot, reopens its panels, and emits
+ * the SDK's one-line receipt. Returns true when a session was restored, false
+ * when there was nothing to restore.
  */
-export function resolveStartupRecoveryInfo(
-  deps: RecoveryFileDeps & { readonly workingDirectory: string },
-): (PreservedRecoveryInfo & { readonly source: 'live' | 'preserved' }) | null {
-  const live = checkRecoveryFile({ workingDirectory: deps.workingDirectory, homeDirectory: deps.homeDirectory });
-  const preserved = checkPreservedRecoveryFile(deps);
-  return pickNewestRecoveryInfo(live, preserved);
-}
-
-export interface RecoveryFileOps {
-  readonly loadRecoveryConversation: () => SessionSnapshot | null;
-  readonly deleteRecoveryFile: () => void;
-  readonly preserveRecoveryFile?: () => PreserveRecoveryResult;
-}
-
-/**
- * Build the three source-aware recovery callbacks main.ts's stdin handler
- * wires into handleBlockingShellInput. `getSource` is read fresh by
- * load/delete on every call (main.ts's recoverySource can change between
- * events); preserveRecoveryFile is only ever wired when the CURRENT prompt
- * came from the live file (see createPreserveRecoveryFile's doc comment).
- */
-export function createRecoveryFileOps(getSource: () => 'live' | 'preserved', deps: RecoveryFileDeps): RecoveryFileOps {
-  return {
-    loadRecoveryConversation: () => (getSource() === 'preserved' ? loadPreservedRecoveryConversation(deps) : loadLiveRecoveryConversation(deps)),
-    deleteRecoveryFile: () => (getSource() === 'preserved' ? deletePreservedRecoveryFile(deps) : deleteLiveRecoveryFile(deps)),
-    preserveRecoveryFile: getSource() === 'live' ? createPreserveRecoveryFile(deps) : undefined,
-  };
+export function autoRestoreRecoverySession(deps: AutoRestoreRecoveryDeps): boolean {
+  const result = autoRestoreRecovery({ workingDirectory: deps.workingDirectory, homeDirectory: deps.homeDirectory });
+  if (!result) return false;
+  const { snapshot, info, receipt } = result;
+  deps.conversation.fromJSON({
+    messages: snapshot.messages as ConversationMessageSnapshot[],
+    title: snapshot.title,
+    titleSource: snapshot.titleSource,
+  });
+  // Replay journal records that post-date the snapshot so turns written after
+  // the last recovery-file write (but before the crash) are not dropped.
+  replayJournalForSession({
+    homeDirectory: deps.homeDirectory,
+    sessionId: info.sessionId,
+    snapshotTimestamp: info.timestamp ?? 0,
+    conversation: deps.conversation as never,
+    persistSnapshot: deps.persistSnapshot,
+  });
+  deps.reopenPanels(snapshot);
+  deps.systemMessageRouter.high(`[Recovery] ${receipt}`);
+  return true;
 }
 
 export interface ErrorAffordanceDeps {

package/src/version.ts

@@ -6,10 +6,19 @@ import { join } from 'node:path';
 // The prebuild script updates the fallback value before compilation.
 // Uses import.meta.dir (Bun) to locate package.json relative to this file,
 // which is correct regardless of the process working directory.
-let _version = '1.17.0';
+let _version = '1.19.0';
 try {
   const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', 'package.json'), 'utf-8'));
-  _version = pkg.version ?? _version;
+  // Only trust a version read from OUR OWN package.json. A Bun single-file
+  // compiled binary resolves import.meta.dir to a virtual root where the
+  // `../package.json` path can land on a DIFFERENT package.json (a bundled
+  // dependency's, or the embedded runtime's) that reports a placeholder like
+  // "0.0.0" — exactly the wrong-version banner a bare daemon launch showed in
+  // the field. Guarding on the package name means the prebuild-baked fallback
+  // above wins in that case instead of a stray version.
+  if (pkg?.name === '@pellux/goodvibes-tui' && typeof pkg.version === 'string' && pkg.version.length > 0) {
+    _version = pkg.version;
+  }
 } catch {
   // Compiled binary or missing package.json — use fallback
 }