@pellux/goodvibes-tui 1.19.4 → 1.19.6

package/CHANGELOG.md

@@ -4,6 +4,20 @@ All notable changes to GoodVibes TUI.
 
 ---
 
+## [1.19.6] - 2026-07-24
+
+### Changes
+
+- 4e5bbca7 fix: explicit-only session restore at launch; fold tool results into collapsible groups
+
+## [1.19.5] - 2026-07-18
+
+### Changes
+
+Fixed: command results no longer print the credential-scrub env-var name list ("withheld: ...") on every collapsed line — the dominant transcript noise for anyone with several API keys exported. The full detail remains in the expanded result payload.
+Fixed: the encrypted secrets store can no longer be silently orphaned by key changes — key generation is race-safe, writes refuse a stale cached key (and restore a missing keyfile), and a mismatched store now reports exactly which key wrote it.
+Updated: bundled platform runtime to 1.11.4.
+
 ## [1.19.4] - 2026-07-17
 
 ### Changes

package/README.md

@@ -2,7 +2,7 @@
 
 [![CI](https://github.com/mgd34msu/goodvibes-tui/actions/workflows/ci.yml/badge.svg)](https://github.com/mgd34msu/goodvibes-tui/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
-[![Version](https://img.shields.io/badge/version-1.19.4-blue.svg)](https://github.com/mgd34msu/goodvibes-tui)
+[![Version](https://img.shields.io/badge/version-1.19.6-blue.svg)](https://github.com/mgd34msu/goodvibes-tui)
 
 A terminal-native AI coding, operations, automation, knowledge, and integration console with a typed runtime, omnichannel surfaces, structured memory/knowledge, and a raw ANSI renderer.
 

package/docs/foundation-artifacts/operator-contract.json

@@ -3,7 +3,7 @@
   "product": {
     "id": "goodvibes",
     "surface": "operator",
-    "version": "1.11.3"
+    "version": "1.11.4"
   },
   "auth": {
     "modes": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pellux/goodvibes-tui",
-  "version": "1.19.4",
+  "version": "1.19.6",
   "description": "Terminal-native GoodVibes product for coding, operations, automation, knowledge, channels, and daemon-backed control-plane workflows.",
   "type": "module",
   "main": "src/main.ts",
@@ -104,8 +104,8 @@
     "@anthropic-ai/vertex-sdk": "^0.16.0",
     "@ast-grep/napi": "^0.42.0",
     "@aws/bedrock-token-generator": "^1.1.0",
-    "@pellux/goodvibes-sdk": "1.11.3",
-    "@pellux/goodvibes-terminal-shell": "1.11.3",
+    "@pellux/goodvibes-sdk": "1.11.4",
+    "@pellux/goodvibes-terminal-shell": "1.11.4",
     "bash-language-server": "^5.6.0",
     "fuse.js": "^7.1.0",
     "graphql": "^16.13.2",
@@ -131,10 +131,10 @@
     "typescript": "^5.9.3"
   },
   "optionalDependencies": {
-    "@pellux/goodvibes-tui-linux-x64": "1.19.4",
-    "@pellux/goodvibes-tui-linux-arm64": "1.19.4",
-    "@pellux/goodvibes-tui-darwin-x64": "1.19.4",
-    "@pellux/goodvibes-tui-darwin-arm64": "1.19.4"
+    "@pellux/goodvibes-tui-linux-x64": "1.19.6",
+    "@pellux/goodvibes-tui-linux-arm64": "1.19.6",
+    "@pellux/goodvibes-tui-darwin-x64": "1.19.6",
+    "@pellux/goodvibes-tui-darwin-arm64": "1.19.6"
   },
   "trustedDependencies": [],
   "overrides": {

package/src/core/bookmark-navigation.ts

@@ -0,0 +1,44 @@
+/**
+ * bookmark-navigation.ts — fallback resolution for a bookmark whose direct
+ * BlockMeta lookup misses.
+ *
+ * A bookmark stores a block's collapseKey at the time it was set (see
+ * handler-content-actions.ts's handleBookmark). A tool-result message that is
+ * a non-owning member of a folded tool-result group (see
+ * conversation-tool-groups.ts) pushes no BlockMeta of its own while the group
+ * stays collapsed — its own collapseKey (`msg_<absoluteIdx>`) never appears
+ * in getBlockRegistry() until the group is expanded. A direct
+ * find(entry => entry.collapseKey === key) then reports "not found", even
+ * though the message is still present in the transcript, just folded under
+ * its group's header.
+ *
+ * Resolution: parse the message's absolute index out of the `msg_<idx>` key
+ * and resolve it through ConversationManager.getMessageLine(idx) instead of
+ * the block registry. That registry is keyed by absolute message index and,
+ * for a folded group member, already resolves to the group's own header line
+ * rather than the position of whatever renders next (see getMessageLine's
+ * doc and conversation-rendering.ts / conversation-line-cache.ts, which
+ * anchor a folded member's registered line at its group's header) — landing
+ * on the header is an honest, reachable result rather than a false
+ * "not found".
+ */
+
+import type { ConversationManager } from './conversation.ts';
+
+const MESSAGE_BOOKMARK_KEY = /^msg_(\d+)$/;
+
+/**
+ * Resolve a bookmark key that missed a direct BlockMeta lookup. Returns the
+ * line to scroll to, or null when the key isn't a message-scoped bookmark
+ * (`msg_<idx>`) or that message index has never been rendered.
+ */
+export function resolveFoldedBookmarkLine(
+  conversation: Pick<ConversationManager, 'getMessageLine'>,
+  key: string,
+): number | null {
+  const match = MESSAGE_BOOKMARK_KEY.exec(key);
+  if (!match) return null;
+  const absoluteIdx = Number(match[1]);
+  const line = conversation.getMessageLine(absoluteIdx);
+  return line === undefined ? null : line;
+}

package/src/core/conversation-line-cache.ts

@@ -25,6 +25,10 @@
  *   - the absolute message index (embedded in every collapseKey and used for the
  *     system-message kind lookup)
  *   - the system-message kind (drives the error-navigation registry side effect)
+ *   - this message's tool-group membership (see conversation-tool-groups.ts):
+ *     whether it's folded under a group header, which member owns that header,
+ *     and the group's honest tool/line counts — a group growing as new tool
+ *     results stream in changes these for every existing member
  *   - the live values of every collapseState key the render READS (recorded via a
  *     proxy during a miss; a collapse toggle flips a recorded value and
  *     invalidates exactly the owning message)
@@ -50,7 +54,9 @@ import {
   renderConversationToolMessage,
   renderConversationUserMessage,
   collectCompletedToolCallIds,
+  isFoldedGroupMember,
 } from './conversation-rendering.ts';
+import { computeToolGroupMembership, type ToolGroupMembership } from './conversation-tool-groups.ts';
 import type { ConversationMessageSnapshot } from '@pellux/goodvibes-sdk/platform/core';
 // SystemMessageKind imported from runtime directly to avoid a cycle, mirroring
 // conversation-rendering.ts's own import.
@@ -96,17 +102,42 @@ interface KeyMeta {
   readonly blockBase: number;
   readonly kind: SystemMessageKind | undefined;
   /**
-   * True when this (assistant) message has a tool call with no result yet — it
-   * renders as pending rather than done. Keyed so the entry invalidates and
-   * re-renders ✓ once the tool result arrives. (item 2c.)
+   * Per-call completion signature for an assistant message's tool calls (see
+   * pendingToolKeyOf) — undefined when the message has none. Each call's id
+   * is paired with whether it has a matching result yet, in call order, so a
+   * SINGLE call finishing invalidates and re-renders that call's glyph from
+   * ◌ to ✓ immediately. A prior aggregate boolean only flipped once EVERY
+   * call in the message had completed, so in a multi-call turn the earlier
+   * calls kept showing ◌ until the last result arrived.
    */
-  readonly hasPendingTool: boolean;
+  readonly pendingToolKey: string | undefined;
+  /**
+   * Tool-group membership fields (see conversation-tool-groups.ts), flattened
+   * so a change invalidates the cache like any other structural input — e.g.
+   * a group growing from 2 to 3 members as tool results stream in changes
+   * groupToolCount/groupTotalLines for every existing member, and must
+   * re-render all of them with the updated header counts. `groupKey` is
+   * undefined when the message isn't part of a folded group.
+   */
+  readonly groupKey: string | undefined;
+  readonly groupIsFirst: boolean;
+  readonly groupToolCount: number;
+  readonly groupTotalLines: number;
 }
 
-/** Whether an assistant message has any tool call still awaiting a result. */
-function hasPendingToolCall(m: Message, completed: ReadonlySet<string>): boolean {
-  if (m.role !== 'assistant' || !m.toolCalls) return false;
-  return m.toolCalls.some((tc) => tc.id === undefined || !completed.has(tc.id));
+/**
+ * Per-call completion signature for an assistant message's tool calls, in
+ * call order — `id:0` or `id:1` per call, joined. Undefined for a message
+ * with no tool calls at all (nothing to key). Comparing this instead of an
+ * aggregate boolean lets exactly the calls whose completion status changed
+ * invalidate the entry, rather than waiting for every call in the message to
+ * complete before any of them re-renders as done.
+ */
+function pendingToolKeyOf(m: Message, completed: ReadonlySet<string>): string | undefined {
+  if (m.role !== 'assistant' || !m.toolCalls || m.toolCalls.length === 0) return undefined;
+  return m.toolCalls
+    .map((tc) => `${tc.id ?? ''}:${tc.id !== undefined && completed.has(tc.id) ? 1 : 0}`)
+    .join('|');
 }
 
 interface CacheEntry {
@@ -288,31 +319,51 @@ export class MessageLineCache {
     // Tool calls with no matching tool-result message are still pending; the
     // render context and the cache key both depend on this. (item 2c.)
     const completedToolCallIds = collectCompletedToolCallIds(messages);
-    const renderContext: ConversationRenderContext = { ...context, completedToolCallIds };
+    // Fold runs of >=2 consecutive tool-result messages sharing one assistant
+    // turn under a single collapsible header (see conversation-tool-groups.ts).
+    // Computed once per pass, over the same slice+offset appendConversationMessages
+    // would see, so both entry points fold identically.
+    const toolGroupMembership = computeToolGroupMembership(messages, msgIndexOffset);
+    const renderContext: ConversationRenderContext = { ...context, completedToolCallIds, toolGroupMembership };
 
     const touched = new Set<number>();
+    // Header line of each currently-open tool-group, keyed by groupKey — the
+    // first member's own registered line, recorded as that member is reached
+    // below so later (non-first) members of the SAME group can resolve to it.
+    const groupHeaderLines = new Map<string, number>();
 
     for (let i = 0; i < messages.length; i++) {
       const message = messages[i]!;
       const absoluteIdx = msgIndexOffset + i;
       const base = context.history.getLineCount();
       const blockBase = context.blockRegistry.length;
-      messageLineRegistry[absoluteIdx] = base;
 
       const uncacheable = absoluteIdx === streamingPlaceholderAbsIdx;
       const kind = context.messageKindRegistry.get(absoluteIdx);
-      const hasPendingTool = hasPendingToolCall(message, completedToolCallIds);
+      const pendingToolKey = pendingToolKeyOf(message, completedToolCallIds);
+      const groupMembership = toolGroupMembership.get(absoluteIdx);
+
+      if (groupMembership?.isFirst) groupHeaderLines.set(groupMembership.groupKey, base);
+      // A folded (non-first, currently collapsed) group member renders zero
+      // lines of its own — `base` here is just wherever the buffer happens to
+      // sit after the last member that DID render, which is the position the
+      // NEXT real content starts at, not this message's own position. Anchor
+      // it at the group's header line instead, so transcript-event
+      // navigation lands on the group rather than skipping past it.
+      messageLineRegistry[absoluteIdx] = isFoldedGroupMember(groupMembership, context.collapseState)
+        ? (groupHeaderLines.get(groupMembership!.groupKey) ?? base)
+        : base;
 
       if (!uncacheable) {
         const existing = this.entries.get(absoluteIdx);
-        if (existing && this.isValid(existing, message, width, cfg, blockBase, kind, hasPendingTool, context.collapseState)) {
+        if (existing && this.isValid(existing, message, width, cfg, blockBase, kind, pendingToolKey, groupMembership, context.collapseState)) {
           this.applyEntry(context, existing, base);
           touched.add(absoluteIdx);
           continue;
         }
       }
 
-      const entry = this.renderScratch(renderContext, message, width, absoluteIdx, cfg, blockBase, kind, hasPendingTool);
+      const entry = this.renderScratch(renderContext, message, width, absoluteIdx, cfg, blockBase, kind, pendingToolKey, groupMembership);
       this.applyEntry(context, entry, base);
       if (!uncacheable) {
         this.entries.set(absoluteIdx, entry);
@@ -338,7 +389,8 @@ export class MessageLineCache {
     cfg: RenderConfig,
     blockBase: number,
     kind: SystemMessageKind | undefined,
-    hasPendingTool: boolean,
+    pendingToolKey: string | undefined,
+    groupMembership: ToolGroupMembership | undefined,
     collapseState: Map<string, boolean>,
   ): boolean {
     const k = entry.keyMeta;
@@ -351,7 +403,11 @@ export class MessageLineCache {
       k.showReasoningSummary !== cfg.showReasoningSummary ||
       k.blockBase !== blockBase ||
       k.kind !== kind ||
-      k.hasPendingTool !== hasPendingTool
+      k.pendingToolKey !== pendingToolKey ||
+      k.groupKey !== groupMembership?.groupKey ||
+      k.groupIsFirst !== (groupMembership?.isFirst ?? false) ||
+      k.groupToolCount !== (groupMembership?.toolCount ?? 0) ||
+      k.groupTotalLines !== (groupMembership?.totalLines ?? 0)
     ) {
       return false;
     }
@@ -376,7 +432,8 @@ export class MessageLineCache {
     cfg: RenderConfig,
     blockBase: number,
     kind: SystemMessageKind | undefined,
-    hasPendingTool: boolean,
+    pendingToolKey: string | undefined,
+    groupMembership: ToolGroupMembership | undefined,
   ): CacheEntry {
     const scratchLines: Line[] = [];
     const scratchHistory = {
@@ -401,11 +458,18 @@ export class MessageLineCache {
       configManager: context.configManager,
       splashOptions: context.splashOptions,
       completedToolCallIds: context.completedToolCallIds,
+      toolGroupMembership: context.toolGroupMembership,
     };
 
     renderOne(scratchCtx, message, width, absoluteIdx, cfg);
-    // Trailing blank line, exactly as appendConversationMessages appends per message.
-    scratchLines.push(createEmptyLine(width));
+    // Trailing blank line, exactly as appendConversationMessages appends per
+    // message — except a non-owning member of a currently-collapsed
+    // tool-result group (see conversation-tool-groups.ts) rendered nothing
+    // above and gets no filler line either; every other message keeps the
+    // unconditional separator.
+    if (!isFoldedGroupMember(groupMembership, context.collapseState)) {
+      scratchLines.push(createEmptyLine(width));
+    }
 
     const collapseDeps: Array<[string, boolean | undefined]> = [];
     for (const key of readKeys) collapseDeps.push([key, context.collapseState.get(key)]);
@@ -420,7 +484,11 @@ export class MessageLineCache {
         showReasoningSummary: cfg.showReasoningSummary,
         blockBase,
         kind,
-        hasPendingTool,
+        pendingToolKey,
+        groupKey: groupMembership?.groupKey,
+        groupIsFirst: groupMembership?.isFirst ?? false,
+        groupToolCount: groupMembership?.toolCount ?? 0,
+        groupTotalLines: groupMembership?.totalLines ?? 0,
       },
       contentSig: contentSigOf(message),
       lines: scratchLines,

package/src/core/conversation-rendering.ts

@@ -15,6 +15,7 @@ import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
 import { renderConversationCollapsedFragment, renderConversationEventLine } from '../renderer/conversation-surface.ts';
 import { GLYPHS } from '../renderer/ui-primitives.ts';
 import type { BlockMeta } from './conversation-types.ts';
+import { computeToolGroupMembership, type ToolGroupMembership } from './conversation-tool-groups.ts';
 import type { ConversationMessageSnapshot } from '@pellux/goodvibes-sdk/platform/core';
 import { parseDiffForApply } from '@pellux/goodvibes-sdk/platform/core';
 import { extractUserDisplayText, COMPACTION_HANDOFF_HEADER } from '@pellux/goodvibes-sdk/platform/core';
@@ -82,6 +83,13 @@ export interface ConversationRenderContext {
    * behaviour. (item 2c.)
    */
   readonly completedToolCallIds?: ReadonlySet<string>;
+  /**
+   * Per-tool-message group membership for the currently rendered slice (see
+   * conversation-tool-groups.ts). A message index absent from this map (or an
+   * undefined map itself) isn't part of a folded run of tool results and
+   * renders exactly as it always has.
+   */
+  readonly toolGroupMembership?: ReadonlyMap<number, ToolGroupMembership>;
 }
 
 export function renderConversationUserMessage(
@@ -316,6 +324,69 @@ export function renderConversationSystemMessage(
   }
 }
 
+/**
+ * True when `message` is a non-owning member of a folded tool-result group
+ * (see conversation-tool-groups.ts) that is currently collapsed — it rendered
+ * nothing (renderConversationToolMessage returns right after the header-owning
+ * member's header line), so the per-message trailing blank-line separator is
+ * skipped for it too. The header-owning ("first") member always gets its
+ * separator since it always renders at least the header line; any member of
+ * an EXPANDED group renders in full and keeps its separator as well.
+ */
+export function isFoldedGroupMember(
+  membership: ToolGroupMembership | undefined,
+  collapseState: ReadonlyMap<string, boolean>,
+): boolean {
+  return membership !== undefined && !membership.isFirst && (collapseState.get(membership.groupKey) ?? true);
+}
+
+/**
+ * Render the synthetic header line for a folded run of >=2 tool-result
+ * messages: one line + one BlockMeta (type 'tool_group'), shared by every
+ * member under `membership.groupKey`. Returns whether the group is currently
+ * collapsed, establishing the collapsed-by-default state on first render —
+ * mirrors the has/set default-establishment idiom used by every other
+ * collapsible block in this file.
+ */
+function renderToolGroupHeader(
+  context: ConversationRenderContext,
+  width: number,
+  membership: ToolGroupMembership,
+): boolean {
+  const T = activeTheme();
+  const isCollapsed = context.collapseState.has(membership.groupKey)
+    ? context.collapseState.get(membership.groupKey)!
+    : true;
+  if (!context.collapseState.has(membership.groupKey)) {
+    context.collapseState.set(membership.groupKey, true);
+  }
+
+  const blockIdx = context.blockRegistry.length;
+  const startLine = context.history.getLineCount();
+  context.history.addLine(renderConversationEventLine(width, {
+    marker: GLYPHS.surface.altCursor,
+    markerFg: T.toolAccent,
+    label: 'tool results',
+    labelFg: T.toolAccent,
+    detailFg: '244',
+  }, [
+    { text: ` ${membership.toolCount} tool${membership.toolCount === 1 ? '' : 's'} `, fg: T.toolAccent },
+    { text: ` ${isCollapsed ? GLYPHS.navigation.collapsed : GLYPHS.navigation.expanded} ${membership.totalLines} line${membership.totalLines === 1 ? '' : 's'} `, fg: '244', dim: true },
+  ]));
+
+  context.blockRegistry.push({
+    blockIndex: blockIdx,
+    collapseKey: membership.groupKey,
+    type: 'tool_group',
+    startLine,
+    lineCount: 1,
+    rawContent: `${membership.toolCount} tool result${membership.toolCount === 1 ? '' : 's'} folded (${membership.totalLines} line${membership.totalLines === 1 ? '' : 's'} total)`,
+    groupMemberIndexes: membership.memberIndexes,
+  });
+
+  return isCollapsed;
+}
+
 export function renderConversationToolMessage(
   context: ConversationRenderContext,
   message: Extract<Message, { role: 'tool' }>,
@@ -323,6 +394,17 @@ export function renderConversationToolMessage(
   msgIdx: number,
 ): void {
   const T = activeTheme();
+  const groupMembership = context.toolGroupMembership?.get(msgIdx);
+  if (groupMembership) {
+    const collapsed = groupMembership.isFirst
+      ? renderToolGroupHeader(context, width, groupMembership)
+      : (context.collapseState.get(groupMembership.groupKey) ?? true);
+    // Folded: the header (rendered above, once, by the first member) is the
+    // group's entire visible representation while collapsed — no member,
+    // first or not, renders its own header/body/BlockMeta.
+    if (collapsed) return;
+  }
+
   const collapseKey = `msg_${msgIdx}`;
   const blockIdx = context.blockRegistry.length;
   const startLine = context.history.getLineCount();
@@ -458,23 +540,53 @@ export function appendConversationMessages(
   const renderContext: ConversationRenderContext = context.completedToolCallIds !== undefined
     ? context
     : { ...context, completedToolCallIds: collectCompletedToolCallIds(messages) };
+  // Fold runs of >=2 consecutive tool-result messages sharing one assistant
+  // turn under a single collapsible header (see conversation-tool-groups.ts),
+  // unless the caller already supplied membership (the line-cache path
+  // computes it once per renderInto call and threads it through).
+  const toolGroupMembership = renderContext.toolGroupMembership
+    ?? computeToolGroupMembership(messages, msgIndexOffset);
+  const groupedContext: ConversationRenderContext = renderContext.toolGroupMembership !== undefined
+    ? renderContext
+    : { ...renderContext, toolGroupMembership };
+
+  // Header line of each currently-open tool-group, keyed by groupKey — the
+  // first member's own registered line, recorded as that member is reached
+  // below so later (non-first) members of the SAME group can resolve to it
+  // instead of whatever position the buffer happens to be at when a folded
+  // (zero-line) member is processed. See isFoldedGroupMember's doc.
+  const groupHeaderLines = new Map<string, number>();
 
   for (let msgIdx = 0; msgIdx < messages.length; msgIdx++) {
     const message = messages[msgIdx];
     // absoluteIdx aligns the slice-relative loop counter with the absolute
     // message index used as the key in messageKindRegistry and messageLineRegistry.
     const absoluteIdx = msgIndexOffset + msgIdx;
-    messageLineRegistry[absoluteIdx] = renderContext.history.getLineCount();
+    const membership = toolGroupMembership.get(absoluteIdx);
+    const currentLine = groupedContext.history.getLineCount();
+    if (membership?.isFirst) groupHeaderLines.set(membership.groupKey, currentLine);
+    // A folded (non-first, currently collapsed) group member renders zero
+    // lines of its own — `currentLine` here is just wherever the buffer
+    // happens to sit after the last member that DID render, which is the
+    // position the NEXT real content starts at, not this message's own
+    // position. Anchor it at the group's header line instead, so
+    // transcript-event navigation lands on the group rather than skipping
+    // past it to the following message.
+    messageLineRegistry[absoluteIdx] = isFoldedGroupMember(membership, groupedContext.collapseState)
+      ? (groupHeaderLines.get(membership!.groupKey) ?? currentLine)
+      : currentLine;
     if (message.role === 'user') {
-      renderConversationUserMessage(renderContext, message, width, absoluteIdx);
+      renderConversationUserMessage(groupedContext, message, width, absoluteIdx);
     } else if (message.role === 'assistant') {
-      renderConversationAssistantMessage(renderContext, message, width, lineNumberMode, collapseThreshold, absoluteIdx);
+      renderConversationAssistantMessage(groupedContext, message, width, lineNumberMode, collapseThreshold, absoluteIdx);
     } else if (message.role === 'system') {
-      renderConversationSystemMessage(renderContext, message, width, absoluteIdx);
+      renderConversationSystemMessage(groupedContext, message, width, absoluteIdx);
     } else if (message.role === 'tool') {
-      renderConversationToolMessage(renderContext, message, width, absoluteIdx);
+      renderConversationToolMessage(groupedContext, message, width, absoluteIdx);
+    }
+    if (!isFoldedGroupMember(membership, groupedContext.collapseState)) {
+      groupedContext.history.addLine(createEmptyLine(width));
     }
-    renderContext.history.addLine(createEmptyLine(width));
   }
 }
 

package/src/core/conversation-tool-groups.ts

@@ -0,0 +1,139 @@
+/**
+ * conversation-tool-groups.ts — detects runs of consecutive tool-result
+ * messages that belong to one assistant turn, so the transcript can fold them
+ * under a single collapsible group header instead of rendering one
+ * "tool result" header per call. Before this module, an assistant turn with
+ * N tool calls produced N independent header+body blocks in a row — visual
+ * spam once N is more than one or two.
+ *
+ * A run only counts as a group when it has >= 2 matched tool-result messages:
+ * a single result renders exactly as it always has (see
+ * renderConversationToolMessage in conversation-rendering.ts, which only
+ * consults this module's output when a membership entry exists).
+ *
+ * Pure function of the message slice — no rendering, no width, no side
+ * effects. Called once per render pass (appendConversationMessages /
+ * MessageLineCache.renderInto) over the currently-visible message slice, with
+ * the absolute index of the slice's first message so group keys and member
+ * indexes line up with the same collapseKey / blockRegistry indices a cold
+ * render would produce (messages may be a post-clearDisplay slice, not the
+ * full snapshot — see appendConversationMessages's msgIndexOffset doc).
+ */
+
+import type { ConversationMessageSnapshot } from '@pellux/goodvibes-sdk/platform/core';
+
+type Message = ConversationMessageSnapshot;
+
+/** One consolidated run of tool-result messages sharing one assistant turn. */
+export interface ToolGroup {
+  /** Absolute index of the assistant message that owns this group. */
+  readonly assistantIdx: number;
+  /** Absolute indexes of the matched tool-result messages, in order. */
+  readonly toolMessageIndexes: readonly number[];
+}
+
+/**
+ * Per-tool-message membership, keyed by the ABSOLUTE index of the tool-result
+ * message (the owning assistant message is never a key — only its tool-result
+ * children are). `isFirst` marks the member whose render site owns the
+ * group's header line and BlockMeta; every other member renders nothing while
+ * the group is collapsed (see renderConversationToolMessage).
+ */
+export interface ToolGroupMembership {
+  readonly groupKey: string;
+  readonly isFirst: boolean;
+  /** Matched tool-result messages in the group (the header's "N tools"). */
+  readonly toolCount: number;
+  /** Sum of each member's raw content line count (the header's "N lines") —
+   *  the same count each member already shows on its own "N lines" badge, so
+   *  the group total is honest by construction, not an estimate. */
+  readonly totalLines: number;
+  /**
+   * Absolute indexes of every tool-result message in the group, in order —
+   * the same list for every member. Carried onto the group's BlockMeta so a
+   * single expand pass can also open each member's own collapse key
+   * (`msg_<idx>`), since a folded member pushes no BlockMeta of its own to
+   * toggle individually (see local-runtime.ts's toggleBlocks).
+   */
+  readonly memberIndexes: readonly number[];
+}
+
+function rawLineCount(content: string): number {
+  return content.split('\n').length;
+}
+
+/**
+ * Scan `messages` for assistant-message runs of >=2 consecutive matching
+ * tool-result messages. A run breaks on the first message that isn't a
+ * matching tool result: any non-tool message (interleaved user/system/
+ * assistant content), or a tool message whose callId isn't one of the
+ * assistant's own toolCalls ids (a result belonging to a different turn never
+ * gets folded into a group it doesn't belong to).
+ */
+export function detectToolGroups(
+  messages: readonly Message[],
+  indexOffset = 0,
+): ToolGroup[] {
+  const groups: ToolGroup[] = [];
+
+  for (let i = 0; i < messages.length; i++) {
+    const message = messages[i];
+    if (message.role !== 'assistant' || !message.toolCalls || message.toolCalls.length === 0) continue;
+    const callIds = new Set(
+      message.toolCalls
+        .map((tc) => tc.id)
+        .filter((id): id is string => id !== undefined),
+    );
+    if (callIds.size === 0) continue;
+
+    const toolMessageIndexes: number[] = [];
+    let j = i + 1;
+    while (j < messages.length) {
+      const next = messages[j];
+      if (next.role !== 'tool' || !next.callId || !callIds.has(next.callId)) break;
+      toolMessageIndexes.push(indexOffset + j);
+      j++;
+    }
+
+    if (toolMessageIndexes.length >= 2) {
+      groups.push({ assistantIdx: indexOffset + i, toolMessageIndexes });
+    }
+  }
+
+  return groups;
+}
+
+/** Build the per-tool-message membership lookup used by the renderer/cache. */
+export function buildToolGroupMembership(
+  groups: readonly ToolGroup[],
+  messages: readonly Message[],
+  indexOffset: number,
+): ReadonlyMap<number, ToolGroupMembership> {
+  const membership = new Map<number, ToolGroupMembership>();
+  for (const group of groups) {
+    const groupKey = `group_${group.assistantIdx}`;
+    let totalLines = 0;
+    for (const absIdx of group.toolMessageIndexes) {
+      const message = messages[absIdx - indexOffset];
+      if (message && message.role === 'tool') totalLines += rawLineCount(message.content);
+    }
+    group.toolMessageIndexes.forEach((absIdx, idx) => {
+      membership.set(absIdx, {
+        groupKey,
+        isFirst: idx === 0,
+        toolCount: group.toolMessageIndexes.length,
+        totalLines,
+        memberIndexes: group.toolMessageIndexes,
+      });
+    });
+  }
+  return membership;
+}
+
+/** Convenience wrapper: detect groups, then build the membership map in one call. */
+export function computeToolGroupMembership(
+  messages: readonly Message[],
+  indexOffset = 0,
+): ReadonlyMap<number, ToolGroupMembership> {
+  return buildToolGroupMembership(detectToolGroups(messages, indexOffset), messages, indexOffset);
+}

package/src/core/conversation-types.ts

@@ -11,8 +11,18 @@
 
 import type { BlockMeta as SdkBlockMeta } from '@pellux/goodvibes-sdk/platform/core';
 
-/** TUI extends the SDK BlockMeta with rendering position fields. */
-export interface BlockMeta extends SdkBlockMeta {
+/**
+ * TUI extends the SDK BlockMeta with rendering position fields, plus a
+ * TUI-only block type: 'tool_group' is the synthetic header block that folds
+ * a run of >=2 consecutive tool-result messages under one collapsible header
+ * (see conversation-tool-groups.ts). Defined as an intersection rather than
+ * `interface X extends SdkBlockMeta` because TypeScript requires an extending
+ * interface's members to be subtypes of the base interface's — widening the
+ * `type` union that way is a compile error. Omit + intersection adds the new
+ * variant without touching the SDK's published type.
+ */
+export type BlockMeta = Omit<SdkBlockMeta, 'type'> & {
+  type: SdkBlockMeta['type'] | 'tool_group';
   /** Index of this block (increments per renderable block). */
   blockIndex: number;
   /** First rendered line index in the history buffer. */
@@ -21,4 +31,12 @@ export interface BlockMeta extends SdkBlockMeta {
   lineCount: number;
   /** Stable key for collapse state persistence across rebuilds (e.g. msg_N). */
   collapseKey: string;
-}
+  /**
+   * Absolute message indexes of every member of a folded tool-result group
+   * (see conversation-tool-groups.ts). Present only on 'tool_group' blocks —
+   * lets /expand also open each member's own collapse key in the same pass,
+   * since a folded member pushes no BlockMeta of its own to toggle
+   * individually while the group stays collapsed.
+   */
+  groupMemberIndexes?: readonly number[];
+};

package/src/core/conversation.ts

@@ -644,6 +644,23 @@ export class ConversationManager extends SdkConversationManager {
     return nearest.blockIndex;
   }
 
+  /** First rendered line for message `absoluteIdx` (undefined if never
+   *  rendered). For a folded tool-group member this is the group's own
+   *  header line, not the following message's position — see
+   *  messageLineRegistry's doc. Flushes history if dirty. */
+  public getMessageLine(absoluteIdx: number): number | undefined {
+    this.flushHistory();
+    return this.messageLineRegistry[absoluteIdx];
+  }
+
+  /** Set a collapseKey's state directly, bypassing block lookup — needed for
+   *  a key with no BlockMeta yet (a folded tool-group member's own
+   *  `msg_<idx>` key only becomes a real block once its group expands). */
+  public setCollapsed(collapseKey: string, collapsed: boolean): void {
+    this.collapseState.set(collapseKey, collapsed);
+    this.markDirty();
+  }
+
   /** Returns a read-only view of the block registry for external consumers. */
   public getBlockRegistry(): readonly BlockMeta[] {
     return this.blockRegistry;

package/src/core/session-recovery.ts

@@ -8,14 +8,12 @@
  * it replays those records onto the live conversation and writes a fresh
  * snapshot so the gap is permanently closed.
  *
- * Seams (all three must call replayJournalForSession)
- * ────────────────────────────────────────────────────
+ * Seams (both must call replayJournalForSession)
+ * ───────────────────────────────────────────────
  * 1. CLI / command resume — session-workflow.ts, after `fromJSON` +
  *    `rebuildHistory` complete. Handles --continue, --resume, /session resume,
  *    and --fork.
- * 2. Ctrl+R crash recovery — blocking-input.ts, after `conversation.fromJSON`
- *    in the Ctrl+R branch. Handles SIGKILL-era recovery files.
- * 3. In-TUI panel resume — bootstrap-hook-bridge.ts
+ * 2. In-TUI panel resume — bootstrap-hook-bridge.ts
  *    `createResumeSessionHandler`, after `options.runtime.sessionId` is
  *    assigned. Handles the session browser / panel-driven resume.
  *

package/src/input/commands/local-runtime.ts

@@ -34,14 +34,31 @@ function toggleBlocks(typeFilter: string, collapsed: boolean, ctx: CommandContex
   let count = 0;
   for (let i = 0; i < blockRegistry.length; i++) {
     const block = blockRegistry[i];
+    // A folded tool-result group (type 'tool_group', see conversation-tool-groups.ts)
+    // is a run of tool results under one header, so '/expand tool'/'collapse tool'
+    // treats it the same as a plain 'tool' block — toggling the header's collapse
+    // key expands/collapses every member underneath it.
     const matchesType = typeFilter === 'all'
-      || (typeFilter === 'tool' && block.type === 'tool')
+      || (typeFilter === 'tool' && (block.type === 'tool' || block.type === 'tool_group'))
       || (typeFilter === 'code' && block.type === 'code')
       || (typeFilter === 'thinking' && block.type === 'thinking');
     if (!matchesType) continue;
     const isCurrentlyCollapsed = ctx.session.conversationManager.isCollapsed(i);
     if (collapsed ? !isCurrentlyCollapsed : isCurrentlyCollapsed) {
       ctx.session.conversationManager.toggleCollapseAtLine(block.startLine);
+      // Expanding a folded tool-result group also expands every member's own
+      // collapse key in the same pass. A folded member pushes no BlockMeta of
+      // its own while the group is collapsed, so it never surfaces from this
+      // loop to be toggled individually — without this, '/expand tool' only
+      // opens the group header and each member still renders at whatever its
+      // own default collapse state is, needing a second '/expand tool' pass.
+      // '/collapse tool' needs no matching step: collapsing the group hides
+      // every member regardless of its own key.
+      if (!collapsed && block.type === 'tool_group' && block.groupMemberIndexes) {
+        for (const memberIdx of block.groupMemberIndexes) {
+          ctx.session.conversationManager.setCollapsed(`msg_${memberIdx}`, false);
+        }
+      }
       count++;
     }
   }

package/src/main.ts

@@ -39,9 +39,10 @@ import { createSessionContinuityHintsBuilder } from './runtime/session-continuit
 import { resolveWebSurfaceUrl } from '@pellux/goodvibes-sdk/platform/runtime/feature-announcements';
 import { readLastSessionPointer, writeRecoveryFile } from '@/runtime/index.ts';
 import { handleBlockingShellInput, type PendingPermissionState } from './shell/blocking-input.ts';
-import { autoRestoreRecoverySession, createPersistRecoverySnapshot, createReopenRecoveryPanels, handleErrorAffordanceKey } from './shell/recovery-input-helpers.ts';
+import { handleErrorAffordanceKey } from './shell/recovery-input-helpers.ts';
 import { wireShellUiOpeners } from './shell/ui-openers.ts';
 import { deriveComposerState } from './core/composer-state.ts';
+import { resolveFoldedBookmarkLine } from './core/bookmark-navigation.ts';
 import { buildPersistedSessionContext, getReturnContextMode, maybeAssistReturnContextSummary } from '@/runtime/index.ts';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 import { prepareShellCliRuntime } from './cli/entrypoint.ts';
@@ -301,13 +302,14 @@ async function main() {
   const jumpToBookmark = (key: string) => {
     conversation.getDisplayBlocks();
     const block = conversation.getBlockRegistry().find((entry) => entry.collapseKey === key);
-    if (!block) {
+    const line = block?.startLine ?? resolveFoldedBookmarkLine(conversation, key);
+    if (line === null) {
       systemMessageRouter.high(`[Bookmark] Not found: ${key}`);
       render();
       return;
     }
     scrollLocked = false;
-    scrollTop = Math.max(0, block.startLine);
+    scrollTop = Math.max(0, line);
     render();
   };
 
@@ -764,20 +766,13 @@ async function main() {
   process.on('unhandledRejection', unhandledRejectionHandler);
   stdout.on('resize', resizeHandler);
 
-  // --- Silent crash-recovery restore (no prompt/banner) ---
-  // Restore the newest crash snapshot in place, replay any post-snapshot
-  // journal turns, reopen its panels, and emit a single one-line receipt. The
-  // SDK scopes both the load and the follow-up delete to that snapshot's own
-  // session id, so a concurrent session's snapshot is never touched. Runs
-  // before the initial render so the restored content shows immediately.
-  autoRestoreRecoverySession({
-    workingDirectory: workingDir,
-    homeDirectory,
-    conversation,
-    persistSnapshot: createPersistRecoverySnapshot({ sessionManager: ctx.services.sessionManager, runtime, conversation }),
-    reopenPanels: createReopenRecoveryPanels({ panelManager, render }),
-    systemMessageRouter,
-  });
+  // State restores happen ONLY when the user explicitly asks — a CLI flag
+  // (--continue/--resume/--fork), a slash command (/session resume,
+  // /checkpoints, /rewind), or the boot resume notice's advertised command.
+  // There is deliberately no unconditional auto-restore here: a bare launch
+  // never loads a saved conversation on its own (owner ruling). Any live
+  // recovery snapshot is surfaced (never applied) by the boot resume
+  // notice — see announceResumeState in runtime/resume-notice.ts.
 
   // Initial render
   conversation.rebuildHistory();

package/src/renderer/tool-result-summary.ts

@@ -93,21 +93,12 @@ function summarizeEdit(obj: Record<string, unknown>): string | null {
   return `${verb} ${applied} edit${applied === 1 ? '' : 's'}${target}${failText}`;
 }
 
-/** Credential-bearing env-var names withheld from the spawn (never values). Empty when the field is absent/empty. */
-function withheldEnvNames(obj: Record<string, unknown>): string[] {
-  const raw = obj.withheld_env;
-  if (!Array.isArray(raw)) return [];
-  return raw.filter((n): n is string => typeof n === 'string' && n.length > 0);
-}
-
-/** Compact "withheld: NAME, NAME, …" suffix, capped so a long scrub list doesn't dominate the collapsed line. */
-function withheldEnvSuffix(names: readonly string[]): string {
-  if (names.length === 0) return '';
-  const MAX_SHOWN = 3;
-  const shown = names.slice(0, MAX_SHOWN).join(', ');
-  const more = names.length > MAX_SHOWN ? `, +${names.length - MAX_SHOWN} more` : '';
-  return ` · withheld: ${shown}${more}`;
-}
+// The credential scrub's withheld_env report stays OUT of the collapsed line
+// entirely. It withholds the same standing set of names on every spawn, so any
+// per-result rendering repeats identical env-var noise all session long — the
+// dominant transcript spam for anyone with several keys exported. The report
+// only matters when a command fails because a needed credential was scrubbed,
+// and for that case the full name list is one expand away in the raw payload.
 
 /**
  * Compact per-command exec-sandbox suffix: `sandboxed` fields are present
@@ -141,17 +132,16 @@ function summarizeExecOne(obj: Record<string, unknown>): string | null {
   const exit = obj.exit_code;
   const dur = asNumber(obj.duration_ms);
   const durText = dur !== undefined ? ` · ${formatDuration(dur)}` : '';
-  const withheldText = withheldEnvSuffix(withheldEnvNames(obj));
   const sandboxText = sandboxSuffix(obj);
-  if (obj.timed_out === true) return `timed out${durText}${withheldText}${sandboxText}`;
-  if (obj.cancelled === true) return `cancelled${durText}${withheldText}${sandboxText}`;
+  if (obj.timed_out === true) return `timed out${durText}${sandboxText}`;
+  if (obj.cancelled === true) return `cancelled${durText}${sandboxText}`;
   const stdout = typeof obj.stdout === 'string' ? obj.stdout : '';
   const lineCount = stdout.length === 0
     ? 0
     : stdout.replace(/\n$/, '').split('\n').length;
   const lineText = lineCount > 0 ? ` · ${lineCount} line${lineCount === 1 ? '' : 's'}` : '';
   const code = typeof exit === 'number' ? String(exit) : '?';
-  return `exit ${code}${durText}${lineText}${withheldText}${sandboxText}`;
+  return `exit ${code}${durText}${lineText}${sandboxText}`;
 }
 
 /** exec: single { cmd, exit_code, ... } or multi { commands: [...], total }. */
@@ -161,15 +151,6 @@ function summarizeExec(obj: Record<string, unknown>): string | null {
     const failed = obj.commands.filter(
       (c) => c && typeof c === 'object' && (c as Record<string, unknown>).success === false,
     ).length;
-    // Union of withheld names across every command in the batch — the scrub
-    // runs per-spawn, so different commands can withhold different names.
-    const withheldAcrossCommands = new Set<string>();
-    for (const c of obj.commands) {
-      if (c && typeof c === 'object') {
-        for (const name of withheldEnvNames(c as Record<string, unknown>)) withheldAcrossCommands.add(name);
-      }
-    }
-    const withheldText = withheldEnvSuffix([...withheldAcrossCommands]);
     // Count sandboxed commands across the batch — a compact "N sandboxed" beats
     // repeating each command's full boundary detail on the collapsed line.
     const sandboxedCount = obj.commands.filter(
@@ -177,8 +158,8 @@ function summarizeExec(obj: Record<string, unknown>): string | null {
     ).length;
     const sandboxText = sandboxedCount > 0 ? ` · ${sandboxedCount} sandboxed` : '';
     return failed > 0
-      ? `${total} commands · ${failed} failed${withheldText}${sandboxText}`
-      : `${total} commands · all ok${withheldText}${sandboxText}`;
+      ? `${total} commands · ${failed} failed${sandboxText}`
+      : `${total} commands · all ok${sandboxText}`;
   }
   if ('exit_code' in obj || 'timed_out' in obj || 'cancelled' in obj) {
     return summarizeExecOne(obj);

package/src/runtime/index.ts

@@ -279,7 +279,6 @@ export const loadLastConversation = operations.loadLastConversation;
 export const loadRecoveryConversation = operations.loadRecoveryConversation;
 export const writeRecoveryFile = operations.writeRecoveryFile;
 export const deleteRecoveryFile = operations.deleteRecoveryFile;
-export const autoRestoreRecovery = operations.autoRestoreRecovery;
 export const checkRecoveryFile = operations.checkRecoveryFile;
 export const getRecoveryFilePath = operations.getRecoveryFilePath;
 export const getRecoveryDir = operations.getRecoveryDir;

package/src/runtime/resume-notice.ts

@@ -27,9 +27,19 @@
  *   - Every clause is independently gated on real data: a claim about
  *     checkpoints/chain history is only made when that data is known; "no
  *     chain history" means no chain clause is printed, not a fabricated one.
+ *   - A live recovery snapshot (the SDK's checkRecoveryFile — a separate
+ *     on-disk file from the session store, written every 60s while a session
+ *     runs) is reported whenever one exists, but the specific
+ *     `/session resume <id>` restore command is only advertised when that
+ *     exact session id is ALSO loadable through the session manager
+ *     (verified with a real load attempt, not assumed). A snapshot whose
+ *     session never completed a full turn has no working command that
+ *     reaches it yet — reported honestly without one, rather than
+ *     advertising a command that would fail. This module never auto-applies
+ *     the snapshot itself; restoring it is always the user's explicit call.
  */
 
-import { readLastSessionPointer } from '@/runtime/index.ts';
+import { checkRecoveryFile, readLastSessionPointer } from '@/runtime/index.ts';
 import type { WrfcChain } from '@pellux/goodvibes-sdk/platform/agents';
 import type { SessionManager } from '@pellux/goodvibes-sdk/platform/sessions';
 import type { WorkspaceCheckpointManager } from '@pellux/goodvibes-sdk/platform/workspace';
@@ -90,6 +100,19 @@ export interface ResumeNoticeFacts {
   readonly lastChainOutcome: ChainOutcome | null;
   /** Whether /recall (memory) is wired up in this session. */
   readonly memoryAvailable: boolean;
+  /**
+   * A live recovery snapshot on disk (newer than the last clean save), if
+   * any — the SDK's checkRecoveryFile, written periodically while a session
+   * runs and left behind by one that never reached a clean save (a crash is
+   * one cause; a second TUI still running in the same workspace is another —
+   * this module has no liveness check, so it never claims a crash happened,
+   * only that a snapshot exists). `resumable` is true only when that exact
+   * session id is also loadable through the session manager, i.e.
+   * `/session resume <id>` genuinely reaches it; false means the snapshot
+   * exists but nothing reaches it yet (e.g. a crash during its very first
+   * turn, before any full save). Null when there is no live snapshot at all.
+   */
+  readonly recoverySnapshot: { readonly sessionId: string; readonly resumable: boolean } | null;
 }
 
 function plural(n: number, word: string): string {
@@ -107,8 +130,10 @@ export function buildResumeNotice(facts: ResumeNoticeFacts): string | null {
   const checkpointCount = facts.checkpointCount ?? 0;
   const hasCheckpoints = checkpointsKnown && checkpointCount > 0;
   const hasChainHistory = facts.lastChainOutcome !== null;
+  const recovery = facts.recoverySnapshot;
+  const hasRecovery = recovery !== null;
 
-  if (!hasSession && !hasCheckpoints && !hasChainHistory) return null;
+  if (!hasSession && !hasCheckpoints && !hasChainHistory && !hasRecovery) return null;
 
   const summary: string[] = [];
   if (hasSession) summary.push(plural(facts.turnCount!, 'turn'));
@@ -117,6 +142,9 @@ export function buildResumeNotice(facts: ResumeNoticeFacts): string | null {
   // without one) — never guessed when the manager is unavailable.
   if (checkpointsKnown && (hasSession || hasCheckpoints)) summary.push(plural(checkpointCount, 'checkpoint'));
   if (hasChainHistory) summary.push(`last chain: ${facts.lastChainOutcome}`);
+  // Reported whenever a live snapshot exists, independent of whether a
+  // restore command can be advertised for it (see the hint below).
+  if (hasRecovery) summary.push('recovery snapshot found');
 
   const lead = hasSession ? 'Previous session found' : 'Workspace history found';
   let notice = `${lead}: ${summary.join(', ')}`;
@@ -126,6 +154,12 @@ export function buildResumeNotice(facts: ResumeNoticeFacts): string | null {
   if (hasSession) hints.push(`/session resume ${facts.lastSessionId} to continue`);
   if (hasCheckpoints) hints.push('/checkpoints to browse');
   if (facts.memoryAvailable) hints.push('/recall for memory');
+  // Only advertise the recovery snapshot's restore command when it is
+  // verified-resumable AND names a session other than the one already
+  // hinted above — otherwise this would just repeat the same command.
+  if (hasRecovery && recovery!.resumable && recovery!.sessionId !== facts.lastSessionId) {
+    hints.push(`/session resume ${recovery!.sessionId} to restore it`);
+  }
   if (hints.length > 0) notice += ` — ${hints.join(' · ')}`;
 
   return notice;
@@ -175,6 +209,36 @@ function readLastSessionTurns(deps: Pick<ResumeNoticeDeps, 'workingDirectory' |
   }
 }
 
+/**
+ * Whether a live recovery snapshot exists, and whether its exact
+ * session id is also resumable through the real `/session resume <id>` path.
+ * A real load attempt (not a guess) decides resumability: `sessionManager`
+ * and `checkRecoveryFile`'s recovery directory are genuinely separate
+ * on-disk stores (see resume-notice.ts's header doc), so a snapshot whose
+ * session never completed a full turn will not be in the session store yet.
+ * Returns null when there is no live snapshot at all.
+ */
+function readRecoverySnapshot(
+  deps: Pick<ResumeNoticeDeps, 'workingDirectory' | 'homeDirectory' | 'sessionManager'>,
+): { sessionId: string; resumable: boolean } | null {
+  // No surfaceRoot: the recovery file lives in the SHARED .goodvibes/recovery
+  // directory, the same way main.ts's writeRecoveryFile call and the SDK's
+  // own getContinuitySnapshot() read it — unlike the session store /
+  // last-session pointer above, which IS scoped to surfaceRoot 'tui'.
+  const info = checkRecoveryFile({
+    workingDirectory: deps.workingDirectory,
+    homeDirectory: deps.homeDirectory,
+  });
+  if (!info) return null;
+  let resumable = true;
+  try {
+    deps.sessionManager.load(info.sessionId);
+  } catch {
+    resumable = false;
+  }
+  return { sessionId: info.sessionId, resumable };
+}
+
 async function readCheckpointCount(mgr: ResumeNoticeDeps['checkpointManager']): Promise<number | null> {
   if (!mgr) return null;
   try {
@@ -189,13 +253,18 @@ async function readCheckpointCount(mgr: ResumeNoticeDeps['checkpointManager']):
 /**
  * Gather real facts from disk/services and, if there is anything to report,
  * print ONE compact system message via `deps.router.high`. No-op (and no
- * message) when there is no prior session, no checkpoints, and no chain
- * history — a fresh working directory stays quiet.
+ * message) when there is no prior session, no checkpoints, no chain history,
+ * and no live recovery snapshot — a fresh working directory stays
+ * quiet. This is the ONLY thing a live recovery snapshot does at
+ * startup: it never mutates the conversation, never touches the journal, and
+ * never deletes the snapshot file — restoring it is always the user's
+ * explicit call (via the advertised /session resume <id>, when one exists).
  */
 export async function announceResumeState(deps: ResumeNoticeDeps): Promise<void> {
   const session = readLastSessionTurns(deps);
   const checkpointCount = await readCheckpointCount(deps.checkpointManager);
   const lastChain = mostRecentChain(deps.chainHistory);
+  const recoverySnapshot = readRecoverySnapshot(deps);
 
   const notice = buildResumeNotice({
     turnCount: session?.turnCount ?? null,
@@ -203,6 +272,7 @@ export async function announceResumeState(deps: ResumeNoticeDeps): Promise<void>
     checkpointCount,
     lastChainOutcome: lastChain ? describeChainOutcome(lastChain) : null,
     memoryAvailable: deps.memoryAvailable,
+    recoverySnapshot,
   });
 
   if (notice) deps.router.high(notice);

package/src/shell/recovery-input-helpers.ts

@@ -1,102 +1,17 @@
 /**
- * Helper factories for main()'s stdin fast-path and startup: the crash-recovery
- * snapshot persistence + panel-reopen callbacks, the SILENT auto-restore, and
- * the one-key error-retry affordance. Extracted from main.ts so the entrypoint
- * stays under the architecture line ceiling; main() wires these with its live
- * services.
+ * Helper factory for main()'s stdin fast-path: the one-key error-retry
+ * affordance. Extracted from main.ts so the entrypoint stays under the
+ * architecture line ceiling; main() wires this with its live services.
  *
- * Recovery is silent (owner ruling): there is no Ctrl+R prompt/banner and no
- * dismiss/preserve dance. At startup autoRestoreRecoverySession restores the
- * newest crash snapshot in place and emits a single one-line receipt. The old
- * `.preserved` sibling machinery is gone — a session's exit deletes only its
- * OWN snapshot (scoped by sessionId), so a concurrent session's snapshot is
- * never touched.
+ * The silent startup auto-restore that used to live here
+ * (autoRestoreRecoverySession, plus its createPersistRecoverySnapshot /
+ * createReopenRecoveryPanels factories) has been removed: state restores
+ * happen ONLY when the user explicitly asks (a CLI flag, a slash command, or
+ * a prompt), never automatically at bare launch (owner ruling). A live
+ * recovery snapshot is now surfaced, never applied, by the boot resume
+ * notice — see announceResumeState in runtime/resume-notice.ts.
  */
 
-import type { ConversationMessageSnapshot } from '../core/conversation.ts';
-import type { SessionSnapshot } from '@/runtime/index.ts';
-import { autoRestoreRecovery } from '@/runtime/index.ts';
-import { replayJournalForSession } from '../core/session-recovery.ts';
-
-export interface PersistRecoveryDeps {
-  readonly sessionManager: {
-    save(id: string, msgs: never[], meta: { title: string; model: string; provider: string; timestamp: number }): unknown;
-  };
-  readonly runtime: { readonly sessionId: string; readonly model: string; readonly provider: string };
-  readonly conversation: { readonly title?: string | null };
-}
-
-/** Persist a replayed/restored snapshot through the session manager. */
-export function createPersistRecoverySnapshot(deps: PersistRecoveryDeps): (msgs: ConversationMessageSnapshot[]) => void {
-  return (msgs) => void deps.sessionManager.save(deps.runtime.sessionId, msgs as never[], {
-    title: deps.conversation.title ?? '',
-    model: deps.runtime.model,
-    provider: deps.runtime.provider,
-    timestamp: Date.now(),
-  });
-}
-
-export interface ReopenPanelsDeps {
-  readonly panelManager: { open(id: string): void; show(): void };
-  readonly render: () => void;
-}
-
-/** Reopen the panels recorded in a restored session's return context (capped at 4). */
-export function createReopenRecoveryPanels(deps: ReopenPanelsDeps): (snapshot: SessionSnapshot) => void {
-  return (snapshot) => {
-    for (const panelId of (snapshot.returnContext?.openPanels ?? []).slice(0, 4)) {
-      try { deps.panelManager.open(panelId); } catch { /* unknown panel id */ }
-    }
-    if ((snapshot.returnContext?.openPanels?.length ?? 0) > 0) { deps.panelManager.show(); deps.render(); }
-  };
-}
-
-export interface AutoRestoreRecoveryDeps {
-  readonly workingDirectory: string;
-  readonly homeDirectory: string;
-  /** The live conversation to restore INTO (fromJSON applies the snapshot). */
-  readonly conversation: {
-    fromJSON(input: { messages: ConversationMessageSnapshot[]; title?: string; titleSource?: SessionSnapshot['titleSource'] }): void;
-  };
-  /** Persist the post-replay snapshot so the WAL gap is durably closed. */
-  readonly persistSnapshot: (msgs: ConversationMessageSnapshot[]) => void;
-  /** Reopen the restored session's panels. */
-  readonly reopenPanels: (snapshot: SessionSnapshot) => void;
-  /** Surface the one-line receipt (the only user-visible sign of a restore). */
-  readonly systemMessageRouter: { high(message: string): void };
-}
-
-/**
- * Silent crash-recovery restore at startup — no prompt, no banner. Loads the
- * newest crash snapshot (the SDK scopes the load AND the follow-up delete to
- * that snapshot's own session id), applies it to the live conversation, replays
- * any journal turns written after the snapshot, reopens its panels, and emits
- * the SDK's one-line receipt. Returns true when a session was restored, false
- * when there was nothing to restore.
- */
-export function autoRestoreRecoverySession(deps: AutoRestoreRecoveryDeps): boolean {
-  const result = autoRestoreRecovery({ workingDirectory: deps.workingDirectory, homeDirectory: deps.homeDirectory });
-  if (!result) return false;
-  const { snapshot, info, receipt } = result;
-  deps.conversation.fromJSON({
-    messages: snapshot.messages as ConversationMessageSnapshot[],
-    title: snapshot.title,
-    titleSource: snapshot.titleSource,
-  });
-  // Replay journal records that post-date the snapshot so turns written after
-  // the last recovery-file write (but before the crash) are not dropped.
-  replayJournalForSession({
-    homeDirectory: deps.homeDirectory,
-    sessionId: info.sessionId,
-    snapshotTimestamp: info.timestamp ?? 0,
-    conversation: deps.conversation as never,
-    persistSnapshot: deps.persistSnapshot,
-  });
-  deps.reopenPanels(snapshot);
-  deps.systemMessageRouter.high(`[Recovery] ${receipt}`);
-  return true;
-}
-
 export interface ErrorAffordanceDeps {
   /** True when the failover retry context is armed (a retry is actually possible). */
   readonly retryArmed: boolean;

package/src/version.ts

@@ -6,7 +6,7 @@ import { join } from 'node:path';
 // The prebuild script updates the fallback value before compilation.
 // Uses import.meta.dir (Bun) to locate package.json relative to this file,
 // which is correct regardless of the process working directory.
-let _version = '1.19.4';
+let _version = '1.19.6';
 try {
   const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', 'package.json'), 'utf-8'));
   // Only trust a version read from OUR OWN package.json. A Bun single-file