@pellux/goodvibes-tui 1.17.0 → 1.19.0

package/src/core/pairing-tailscale-gateway.ts

@@ -0,0 +1,56 @@
+// ---------------------------------------------------------------------------
+// pairing-tailscale-gateway.ts
+//
+// The two tailscale verbs the pairing surfaces drive — a read-only detection
+// (tailscale.get) and the one-action serve (tailscale.serve.run) — over the
+// same generic operator invoke path the fleet acts use (resolveOperatorRpc ->
+// sdk.operator.invoke), reaching the SAME daemon the command layer does.
+//
+// Both thunks degrade QUIETLY: when no daemon is reachable, the probe resolves
+// to null (the pairing surface renders no tailscale affordance at all) rather
+// than throwing into a render path. Absence is never a nag.
+// ---------------------------------------------------------------------------
+
+import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
+import { resolveOperatorRpc } from '../input/commands/operator-rpc.ts';
+import type {
+  PairingTailscaleServeReceipt,
+  PairingTailscaleStatus,
+} from '../panels/modals/pairing-modal.ts';
+
+export interface PairingTailscaleGatewayDeps {
+  readonly configManager: ConfigManager;
+  readonly homeDirectory: string | (() => string);
+}
+
+/**
+ * Probe tailscale (tailscale.get). Returns the honest status, or null when the
+ * daemon is unreachable / the call fails — the pairing surface then stays quiet.
+ */
+export async function probePairingTailscale(
+  deps: PairingTailscaleGatewayDeps,
+): Promise<PairingTailscaleStatus | null> {
+  const rpc = resolveOperatorRpc(deps);
+  if (!rpc.available) return null;
+  try {
+    return (await rpc.sdk.operator.invoke('tailscale.get', {})) as PairingTailscaleStatus;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Run tailscale.serve.run and return its receipt. Null when the daemon is
+ * unreachable; a failed serve returns a receipt with `ok:false` and an honest
+ * detail (never a throw the surface has to guess about).
+ */
+export async function runPairingTailscaleServe(
+  deps: PairingTailscaleGatewayDeps,
+): Promise<PairingTailscaleServeReceipt | null> {
+  const rpc = resolveOperatorRpc(deps);
+  if (!rpc.available) return null;
+  const result = (await rpc.sdk.operator.invoke('tailscale.serve.run', {})) as {
+    readonly receipt: PairingTailscaleServeReceipt;
+  };
+  return result.receipt;
+}

package/src/core/power-chip-source.ts

@@ -0,0 +1,91 @@
+// ---------------------------------------------------------------------------
+// power-chip-source.ts — the topology-aware source of truth behind the
+// always-visible "sleep disabled" chip.
+//
+// Embedded topology: the in-process PowerManager IS the daemon's, so reading
+// getState() per render is already the whole truth; the local runtime bus's
+// OPS_POWER_STATE_CHANGED just triggers an immediate repaint so a
+// webui-originated toggle (which lands on the same in-process manager) lights
+// the chip without waiting for the next natural render.
+//
+// External/adopted topology: the local manager is NOT the daemon's, and the
+// adopted-daemon wire is plain HTTP (no realtime event bridge), so the chip
+// POLLS power.status.get on an unref'd interval and renders the DAEMON's
+// state — a webui-originated toggle on the daemon lights the TUI chip within
+// one poll, and a TUI toggle (forwarded over power.keepAwake.set by
+// power-keepawake-remote.ts) lights the webui's the same way. While the
+// daemon's state is unknown (fetch pending/unreachable) the local projection
+// is served rather than a fabricated one.
+// ---------------------------------------------------------------------------
+
+import type { PowerState } from '@pellux/goodvibes-sdk/platform/power';
+import { IDLE_POWER_STATE, powerSurfaceFromEvent, powerSurfaceFromState, type PowerStateChangedPayload, type PowerSurfaceState } from './power-status.ts';
+
+export interface PowerChipSourceDeps {
+  /** The in-process manager (the whole truth in embedded topology). */
+  readonly powerManager: { getState(): PowerState };
+  /** Subscribe to the LOCAL bus's OPS_POWER_STATE_CHANGED envelopes; returns unsubscribe. */
+  readonly onPowerEvent: (cb: (payload: PowerStateChangedPayload) => void) => () => void;
+  /** True only in the external/adopted-daemon topology. */
+  readonly isExternalDaemon: () => boolean;
+  /** Fetch the DAEMON's power.status.get (null when unreachable). */
+  readonly fetchDaemonPowerState: () => Promise<PowerState | null>;
+  /** Repaint request when the chip's source state changes. */
+  readonly render: () => void;
+  /** External-topology poll cadence (default 5000ms; unref'd). */
+  readonly pollIntervalMs?: number | undefined;
+  readonly timers?: { setInterval: typeof setInterval; clearInterval: typeof clearInterval } | undefined;
+}
+
+export interface PowerChipSource {
+  /** The current chip projection — daemon-synced in external topology, local otherwise. */
+  get(): PowerSurfaceState;
+  /** Stop the poll + event subscription. */
+  stop(): void;
+}
+
+export function createPowerChipSource(deps: PowerChipSourceDeps): PowerChipSource {
+  const timers = deps.timers ?? { setInterval, clearInterval };
+  let daemonState: PowerSurfaceState | null = null;
+  let lastLocal: PowerSurfaceState = IDLE_POWER_STATE;
+  let polling = false;
+
+  // Local bus events: immediate repaint (embedded truth changes live).
+  const unsubscribe = deps.onPowerEvent((payload) => {
+    lastLocal = powerSurfaceFromEvent(payload);
+    deps.render();
+  });
+
+  const poll = async (): Promise<void> => {
+    if (!deps.isExternalDaemon()) {
+      if (daemonState !== null) { daemonState = null; deps.render(); }
+      return;
+    }
+    if (polling) return;
+    polling = true;
+    try {
+      const state = await deps.fetchDaemonPowerState();
+      const next = state ? powerSurfaceFromState(state) : null;
+      const changed = JSON.stringify(next) !== JSON.stringify(daemonState);
+      daemonState = next;
+      if (changed) deps.render();
+    } finally {
+      polling = false;
+    }
+  };
+  const interval = timers.setInterval(() => { void poll(); }, deps.pollIntervalMs ?? 5000);
+  (interval as { unref?: () => void }).unref?.();
+  void poll(); // initial sync so an adopted daemon's held keep-awake shows immediately
+
+  return {
+    get(): PowerSurfaceState {
+      if (deps.isExternalDaemon() && daemonState !== null) return daemonState;
+      // Local truth: prefer a live event projection when one arrived, else read the manager.
+      try { return powerSurfaceFromState(deps.powerManager.getState()); } catch { return lastLocal; }
+    },
+    stop(): void {
+      unsubscribe();
+      timers.clearInterval(interval);
+    },
+  };
+}

package/src/core/power-status.ts

@@ -0,0 +1,95 @@
+// ---------------------------------------------------------------------------
+// power-status.ts — the surface-facing view of host sleep ownership (power.*).
+//
+// The SDK's PowerManager owns the policy: a keep-awake toggle (daemon-held,
+// persisted), automatic work-signal inhibition ("held because X"), and the
+// honest lid-split note when idle-sleep can be blocked but lid-close suspend
+// can't. This module is the read-only projection every surface renders from —
+// the always-visible "sleep disabled" chip, and the ops/status detail lines —
+// seeded from powerManager.getState() and kept live by OPS_POWER_STATE_CHANGED.
+//
+// Owner ruling: the chip IS the safety mechanism. No timers, no AC-only
+// options — the keep-awake toggle is exactly one boolean.
+// ---------------------------------------------------------------------------
+
+import { LID_SWITCH_HONEST_SPLIT, type PowerState } from '@pellux/goodvibes-sdk/platform/power';
+
+/** The always-visible chip text shown while keep-awake holds (danger-mode idiom). */
+export const SLEEP_DISABLED_CHIP = 'sleep disabled';
+
+/** The flattened power state a surface renders from. */
+export interface PowerSurfaceState {
+  /** The owner keep-awake toggle — the "sleep disabled" chip source. */
+  readonly keepAwake: boolean;
+  /** True while any sleep inhibitor (work or keep-awake) is held. */
+  readonly inhibited: boolean;
+  /** Live reasons the WORK inhibitor is held ("held because X"). */
+  readonly workReasons: readonly string[];
+  /** The honest-split note when part of the requested coverage was refused (verbatim). */
+  readonly note: string | null;
+}
+
+/** The neutral state (no inhibition, nothing held) — the pre-event seed default. */
+export const IDLE_POWER_STATE: PowerSurfaceState = {
+  keepAwake: false,
+  inhibited: false,
+  workReasons: [],
+  note: null,
+};
+
+/** Flatten the full PowerState (power.status.get) into the surface projection. */
+export function powerSurfaceFromState(state: PowerState): PowerSurfaceState {
+  return {
+    keepAwake: state.keepAwake.enabled,
+    inhibited: state.keepAwake.held || state.work.held,
+    workReasons: state.work.reasons,
+    note: state.keepAwake.note,
+  };
+}
+
+/** The OPS_POWER_STATE_CHANGED payload shape the surface consumes. */
+export interface PowerStateChangedPayload {
+  readonly inhibited: boolean;
+  readonly keepAwake: boolean;
+  readonly workReasons: readonly string[];
+  readonly note?: string | undefined;
+}
+
+/** Flatten an OPS_POWER_STATE_CHANGED event payload into the surface projection. */
+export function powerSurfaceFromEvent(ev: PowerStateChangedPayload): PowerSurfaceState {
+  return {
+    keepAwake: ev.keepAwake,
+    inhibited: ev.inhibited,
+    workReasons: ev.workReasons,
+    note: ev.note ?? null,
+  };
+}
+
+/**
+ * The ops/status detail lines — the honest, plain-language account of sleep
+ * ownership. Order: the chip's meaning, then each "held because X" work reason,
+ * then the lid-split note VERBATIM when the SDK served it. Empty when nothing
+ * is held and no note applies.
+ */
+export function powerStatusLines(state: PowerSurfaceState): string[] {
+  const lines: string[] = [];
+  if (state.keepAwake) {
+    lines.push(`${SLEEP_DISABLED_CHIP} — keep-awake is on (this host will not idle-sleep)`);
+  }
+  for (const reason of state.workReasons) {
+    lines.push(`held because ${reason}`);
+  }
+  if (state.note) {
+    // The SDK's honest lid-split line, rendered exactly as served.
+    lines.push(state.note);
+  }
+  if (lines.length === 0) {
+    lines.push('sleep is not being held; the host sleeps on its own schedule');
+  }
+  return lines;
+}
+
+/** True when the SDK served the honest lid-split note (idle blocked, lid-close is the OS's). */
+export function hasLidSplitNote(state: PowerSurfaceState): boolean {
+  return state.note === LID_SWITCH_HONEST_SPLIT;
+}

package/src/core/stable-host.ts

@@ -0,0 +1,171 @@
+/**
+ * stable-host.ts — a stable name for printed/QR pairing links.
+ *
+ * The legacy resolution used the first non-internal IPv4 in enumeration order
+ * (see getLocalNetworkIp in management-utils.ts). That address is bound to the
+ * current DHCP lease: when the lease changes, every printed link and every QR
+ * that encoded it stops resolving. This module resolves a name that survives a
+ * lease change where one exists, and only falls back to a routable address when
+ * no stable name is available.
+ *
+ * Resolution ladder (highest preference first):
+ *   1. Tailscale MagicDNS name — preferred when tailscale is up. It resolves on
+ *      and off the LAN and is never bound to a DHCP lease.
+ *   2. mDNS `<hostname>.local` — a LAN name a DHCP change does not break.
+ *   3. Gateway-routed interface address — the IPv4 on the default-route
+ *      interface (not merely the first non-internal one, which can land on a
+ *      bridge/VPN). The last resort; DHCP-bound.
+ *   4. Loopback — nothing routable enumerated.
+ *
+ * The resolver (resolveStableHost) is a pure function of injected inputs so the
+ * ladder is testable under mocked interface / tailscale states; the probes that
+ * gather those inputs are impure and bounded, and degrade to undefined rather
+ * than throw when a tool is missing or slow.
+ */
+import { execFileSync } from 'node:child_process';
+import { hostname as osHostname, networkInterfaces } from 'node:os';
+
+export type StableHostKind = 'tailscale-magicdns' | 'mdns-local' | 'gateway-interface' | 'loopback';
+
+export interface TailscaleState {
+  /** BackendState === 'Running'. */
+  readonly up: boolean;
+  /** Self.DNSName from `tailscale status --json`, trailing dot stripped. */
+  readonly magicDnsName?: string | undefined;
+}
+
+export interface StableHostInputs {
+  /** os.hostname(), possibly an FQDN — the `.local` name derives from its first label. */
+  readonly hostname: string;
+  /** The routable IPv4 on the default-route interface, when known. */
+  readonly gatewayInterfaceIp?: string | undefined;
+  /** First non-internal IPv4 in enumeration order — the legacy fallback address. */
+  readonly firstNonInternalIp?: string | undefined;
+  /** Tailscale state, when the CLI is present and answered in time. */
+  readonly tailscale?: TailscaleState | undefined;
+}
+
+export interface ResolvedStableHost {
+  readonly host: string;
+  readonly kind: StableHostKind;
+  /** True when `host` is a name that survives a DHCP lease change. */
+  readonly stable: boolean;
+}
+
+function stripTrailingDot(name: string): string {
+  return name.replace(/\.+$/, '');
+}
+
+/** `<hostname>.local` from the first label of a hostname, or null when there is no usable label. */
+export function mdnsLocalName(host: string): string | null {
+  const label = (host ?? '').trim().split('.')[0]?.trim();
+  if (!label || label.toLowerCase() === 'localhost') return null;
+  // Already a `.local` name (hostname was set to the mDNS form): keep it as-is.
+  if (host.trim().toLowerCase().endsWith('.local')) return stripTrailingDot(host.trim());
+  return `${label}.local`;
+}
+
+/**
+ * Resolve the stable host from injected inputs. Pure — no I/O — so the ladder is
+ * exercised directly under mocked interface / tailscale states.
+ */
+export function resolveStableHost(inputs: StableHostInputs): ResolvedStableHost {
+  const magic = inputs.tailscale?.up ? inputs.tailscale.magicDnsName?.trim() : undefined;
+  if (magic) return { host: stripTrailingDot(magic), kind: 'tailscale-magicdns', stable: true };
+
+  const local = mdnsLocalName(inputs.hostname);
+  if (local) return { host: local, kind: 'mdns-local', stable: true };
+
+  const routed = inputs.gatewayInterfaceIp?.trim() || inputs.firstNonInternalIp?.trim();
+  if (routed) return { host: routed, kind: 'gateway-interface', stable: false };
+
+  return { host: '127.0.0.1', kind: 'loopback', stable: false };
+}
+
+/** First non-internal IPv4 in enumeration order (the legacy fallback address). */
+export function firstNonInternalIpv4(nets: ReturnType<typeof networkInterfaces>): string | undefined {
+  for (const name of Object.keys(nets)) {
+    for (const netInfo of nets[name] ?? []) {
+      if (netInfo.family === 'IPv4' && !netInfo.internal) return netInfo.address;
+    }
+  }
+  return undefined;
+}
+
+/** Parse the `src <ip>` field out of a Linux `ip route get` line. */
+export function parseIpRouteSrc(output: string): string | undefined {
+  const match = /\bsrc\s+(\d+\.\d+\.\d+\.\d+)/.exec(output);
+  return match?.[1];
+}
+
+/** Parse `Self.DNSName` + running state out of `tailscale status --json` output. */
+export function parseTailscaleStatus(json: string): TailscaleState | undefined {
+  try {
+    const parsed = JSON.parse(json) as { BackendState?: unknown; Self?: { DNSName?: unknown } };
+    const up = parsed.BackendState === 'Running';
+    const dnsName = typeof parsed.Self?.DNSName === 'string' ? stripTrailingDot(parsed.Self.DNSName) : undefined;
+    return { up, ...(dnsName ? { magicDnsName: dnsName } : {}) };
+  } catch {
+    return undefined;
+  }
+}
+
+function probeGatewayInterfaceIp(): string | undefined {
+  try {
+    const out = execFileSync('ip', ['route', 'get', '1.1.1.1'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 1500 });
+    return parseIpRouteSrc(out);
+  } catch {
+    return undefined;
+  }
+}
+
+function probeTailscaleState(): TailscaleState | undefined {
+  try {
+    const out = execFileSync('tailscale', ['status', '--json'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 1500 });
+    return parseTailscaleStatus(out);
+  } catch {
+    return undefined;
+  }
+}
+
+/** Gather the impure inputs the resolver needs, each bounded and failure-tolerant. */
+export function probeStableHostInputs(): StableHostInputs {
+  let nets: ReturnType<typeof networkInterfaces> = {};
+  try {
+    nets = networkInterfaces();
+  } catch {
+    nets = {};
+  }
+  const first = firstNonInternalIpv4(nets);
+  const gateway = probeGatewayInterfaceIp();
+  const tailscale = probeTailscaleState();
+  return {
+    hostname: safeHostname(),
+    ...(gateway ? { gatewayInterfaceIp: gateway } : {}),
+    ...(first ? { firstNonInternalIp: first } : {}),
+    ...(tailscale ? { tailscale } : {}),
+  };
+}
+
+function safeHostname(): string {
+  try {
+    return osHostname();
+  } catch {
+    return '';
+  }
+}
+
+/**
+ * The stable host for a printed/QR link given the endpoint's bind host. A
+ * wildcard bind (0.0.0.0 / ::) resolves through the ladder; an explicit bind
+ * host is honored as-is (loopback stays loopback). `probe` is injectable for
+ * tests.
+ */
+export function stableUrlHostForBindHost(
+  host: string,
+  probe: () => StableHostInputs = probeStableHostInputs,
+): ResolvedStableHost {
+  if (host === '0.0.0.0' || host === '::') return resolveStableHost(probe());
+  const bound = host || '127.0.0.1';
+  return { host: bound, kind: bound === '127.0.0.1' ? 'loopback' : 'gateway-interface', stable: false };
+}

package/src/core/stream-event-wiring.ts

@@ -24,6 +24,13 @@ export interface StreamMetrics {
   activeToolStartedAtMs: number | undefined;
   /** Name of the currently executing tool; cleared when execution completes. */
   activeToolName: string | undefined;
+  /**
+   * callId of the currently executing tool call; cleared when execution
+   * completes. This is the real orchestrator callId (from TOOL_EXECUTING),
+   * so a per-tool cancel affordance targets exactly the running call — never
+   * the synthetic 'live' render id.
+   */
+  activeToolCallId: string | undefined;
   /**
    * Epoch ms of the most recent STREAM_START or STREAM_DELTA; undefined when
    * idle (no turn in flight). Read every render frame — not just on the
@@ -49,6 +56,16 @@ export interface StreamMetrics {
   reconnectMaxAttempts: number | undefined;
 }
 
+/** The idle initial StreamMetrics — mutated in place by wireStreamEventMetrics handlers. */
+export function createStreamMetrics(): StreamMetrics {
+  return {
+    startTime: 0, deltaCount: 0, tokenSpeed: 0, ttftMs: undefined, ttftRecorded: false,
+    activeToolStartedAtMs: undefined, activeToolName: undefined, activeToolCallId: undefined,
+    lastDeltaAtMs: undefined, stallEpisode: 0,
+    reconnectAttempt: undefined, reconnectMaxAttempts: undefined,
+  };
+}
+
 /** Minimal orchestrator surface required for stream token-speed calculation. */
 interface StreamOrchestrator {
   readonly streamingOutputTokens: number;
@@ -443,6 +460,7 @@ export function wireStreamEventMetrics(
   unsubs.push(events.tools.on('TOOL_EXECUTING', (ev) => {
     metrics.activeToolStartedAtMs = ev.startedAt;
     metrics.activeToolName = ev.tool;
+    metrics.activeToolCallId = ev.callId;
     render();
   }));
   // On every tool-completion path, reset lastDeltaAtMs to "now" so the
@@ -456,16 +474,19 @@ export function wireStreamEventMetrics(
   unsubs.push(events.tools.on('TOOL_SUCCEEDED', () => {
     metrics.activeToolStartedAtMs = undefined;
     metrics.activeToolName = undefined;
+    metrics.activeToolCallId = undefined;
     metrics.lastDeltaAtMs = Date.now();
   }));
   unsubs.push(events.tools.on('TOOL_FAILED', () => {
     metrics.activeToolStartedAtMs = undefined;
     metrics.activeToolName = undefined;
+    metrics.activeToolCallId = undefined;
     metrics.lastDeltaAtMs = Date.now();
   }));
   unsubs.push(events.tools.on('TOOL_CANCELLED', () => {
     metrics.activeToolStartedAtMs = undefined;
     metrics.activeToolName = undefined;
+    metrics.activeToolCallId = undefined;
     metrics.lastDeltaAtMs = Date.now();
   }));
 

package/src/core/turn-budget-outcome.ts

@@ -0,0 +1,60 @@
+/**
+ * turn-budget-outcome.ts — render a turn-budget exhaustion as an honest budget
+ * line, distinct from an infrastructure failure.
+ *
+ * When a member agent spends its whole turn budget the SDK stamps a typed
+ * outcome — failureKind 'max_turns' with the ceiling that applied and which
+ * input set it — instead of leaving consumers to regex a prose message. This
+ * renders that typed outcome in plain language: a budget was reached (not a
+ * crash), with the number and where the number came from.
+ */
+export type TurnBudgetSource = 'default' | 'spawn-override' | 'policy-bound';
+
+/** Plain-language provenance for a turn ceiling. */
+export function describeTurnBudgetSource(source: TurnBudgetSource | undefined): string {
+  switch (source) {
+    case 'spawn-override':
+      return 'a per-spawn override';
+    case 'policy-bound':
+      return 'the policy cap (agents.maxTurnsCap)';
+    case 'default':
+      return 'the default limit (agents.maxTurns)';
+    default:
+      return 'the configured turn limit';
+  }
+}
+
+export interface TurnBudgetOutcome {
+  readonly limit?: number | undefined;
+  readonly source?: TurnBudgetSource | undefined;
+}
+
+/**
+ * A short budget line: "reached its turn budget — 50 turns (the default limit
+ * (agents.maxTurns))". Honest about the fact that the run stopped because it hit
+ * a ceiling, not because something broke.
+ */
+export function formatTurnBudgetOutcome(outcome: TurnBudgetOutcome): string {
+  const source = describeTurnBudgetSource(outcome.source);
+  return outcome.limit !== undefined
+    ? `reached its turn budget — ${outcome.limit} turn${outcome.limit === 1 ? '' : 's'} (${source})`
+    : `reached its turn budget (${source})`;
+}
+
+/** The machine-readable failure reason the SDK stamps on a turn-budget exhaustion. */
+export const TURN_BUDGET_FAILURE_REASON = 'max_turns';
+
+export function isTurnBudgetReason(reason: string | null | undefined): boolean {
+  return reason === TURN_BUDGET_FAILURE_REASON;
+}
+
+/**
+ * Render a failure-reason string for a surface that only has the reason (not the
+ * typed limit/source event fields), mapping the machine-readable 'max_turns' to
+ * a plain budget phrase distinct from an infrastructure failure. Any other
+ * reason passes through unchanged.
+ */
+export function describeFailureReason(reason: string | null | undefined): string {
+  if (!reason) return '';
+  return isTurnBudgetReason(reason) ? 'reached its turn budget' : reason;
+}

package/src/core/turn-cancellation.ts

@@ -23,3 +23,42 @@ export function createCancelGeneration(
     return stoppedSpeech;
   };
 }
+
+/** The narrow orchestrator surface the per-tool cancel needs. */
+export interface ToolCancelOrchestrator {
+  /** Cancel ONE in-flight tool call; false when no such call is running. */
+  cancelToolCall(callId: string): boolean;
+  /** The callIds of tool calls currently in flight. */
+  listRunningToolCalls(): readonly string[];
+}
+
+/**
+ * Builds the "cancel the running tool call" action: stops JUST the currently-
+ * running tool call, leaving the turn to continue. The in-process orchestrator
+ * holds the per-call AbortController — this is the local-session equivalent of
+ * the sessions.toolCalls.cancel wire verb. The cancelled call settles as a
+ * structured "cancelled by user" result (partial output preserved) the model
+ * adapts to in the same turn.
+ *
+ * Target selection is honest: the tracked active callId (the live transcript
+ * row) when known, else the sole in-flight call when exactly one is running,
+ * else nothing (returns false — never guesses which of several to stop).
+ * `onCancelled` fires only on a real cancellation, with the callId stopped.
+ */
+export function createCancelToolCall(
+  orchestrator: ToolCancelOrchestrator,
+  getActiveToolCallId: () => string | undefined,
+  onCancelled: (callId: string) => void,
+): () => boolean {
+  return () => {
+    let target = getActiveToolCallId();
+    if (target === undefined) {
+      const running = orchestrator.listRunningToolCalls();
+      if (running.length === 1) target = running[0];
+    }
+    if (target === undefined) return false;
+    const cancelled = orchestrator.cancelToolCall(target);
+    if (cancelled) onCancelled(target);
+    return cancelled;
+  };
+}

package/src/core/turn-event-wiring.ts

@@ -1,6 +1,7 @@
 import type { UiRuntimeEvents, RuntimeEventBus } from '@/runtime/index.ts';
 import { buildPersistedSessionContext, persistConversation } from '@/runtime/index.ts';
 import { buildCompactionReceiptBlock } from './compaction-receipt.ts';
+import { formatTurnBudgetOutcome } from './turn-budget-outcome.ts';
 import { persistTurnAnchors, recordTurnAnchor, summarizeTurnLabel } from './rewind-turn-anchors.ts';
 import { logger } from '@pellux/goodvibes-sdk/platform/utils';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
@@ -290,6 +291,11 @@ export function wireTurnEventHandlers(
         // chain/owner/cohort surfaces.
         if (payload.failureKind === 'cancelled') {
           notifyCompletion('GoodVibes — WRFC chain cancelled', `chain ${payload.chainId.slice(0, 12)} cancelled: ${payload.reason}`, FORCE_NOTIFY_DURATION_MS);
+        } else if (payload.failureKind === 'max_turns') {
+          // A turn-budget exhaustion is a spent ceiling, not an infrastructure
+          // failure — narrate the limit and where it came from, from the typed
+          // event fields, never a regex of the prose reason.
+          notifyCompletion('GoodVibes — WRFC chain hit its turn budget', `chain ${payload.chainId.slice(0, 12)} ${formatTurnBudgetOutcome({ limit: payload.turnLimit, source: payload.turnLimitSource })}`, FORCE_NOTIFY_DURATION_MS);
         } else {
           const kindLabel = payload.failureKind === 'transport' ? 'transient transport error' : payload.reason;
           notifyCompletion('GoodVibes — WRFC chain failed', `chain ${payload.chainId.slice(0, 12)} failed: ${kindLabel}`, FORCE_NOTIFY_DURATION_MS);