@pellux/goodvibes-tui 1.19.5 → 1.20.0

package/src/input/command-registry.ts

@@ -23,6 +23,7 @@ import type { FeatureFlagManager } from '@/runtime/index.ts';
 import type { OperatorClient } from '@/runtime/index.ts';
 import type { PeerClient } from '@/runtime/index.ts';
 import type { DirectTransport } from '@/runtime/index.ts';
+import type { SessionSurface } from '@/runtime/index.ts';
 import type { VoiceProviderRegistry, VoiceService } from '@pellux/goodvibes-sdk/platform/voice';
 import type { UiPlatformServices } from '../runtime/ui-services.ts';
 import type {
@@ -80,6 +81,14 @@ export interface CommandUiActions {
     kind: 'image' | 'text' | 'none';
     marker?: string;
   };
+  /**
+   * Read-only view of pending `[TEXT: pN, M lines]` fold markers currently
+   * sitting in the composer (registerPaste in handler-content-actions.ts) —
+   * backs /pastes, which previews a folded paste's actual content before the
+   * user submits it. A paste over the fold threshold is otherwise invisible
+   * until the LLM sees it.
+   */
+  getPendingPastes?: () => ReadonlyMap<string, string>;
   executeCommand?: (name: string, args: string[]) => Promise<boolean>;
   /** Arm the one-key jump to a spawned CI fix-session (the surface attaches on the jump key; the user never retypes an id). */
   armFixSessionAttach?: (fixSessionId: string) => void;
@@ -152,6 +161,8 @@ export interface CommandShellUiOpeners {
   jumpToBookmark?: (key: string) => void;
   scrollToLine?: (line: number) => void;
   openHelpOverlay?: () => void;
+  /** Toggle the transcript search overlay (same action as Ctrl+F) — backs /find. */
+  openTranscriptSearch?: () => void;
   openSelection?: (
     title: string,
     items: SelectionItem[],
@@ -270,6 +281,14 @@ export interface CommandProviderServices {
  * runtime surfaces exported from runtime/shell-command-services.ts.
  */
 export interface CommandWorkspaceUiServices {
+  /**
+   * The app's declare-once session-storage handle (runtime/services.ts). Every
+   * command that reads or writes session state — resume, save, the liveness
+   * markers, the rewind anchor sidecar — takes its paths from here instead of
+   * re-deriving a scope from shellPaths, so a command can never land on a
+   * different directory than the runtime that wrote the file.
+   */
+  surface?: SessionSurface;
   keybindingsManager?: KeybindingsManager;
   fileUndoManager?: FileUndoManager;
   workspaceCheckpointManager?: WorkspaceCheckpointManager;

package/src/input/commands/checkpoint-runtime.ts

@@ -19,8 +19,8 @@ import type { CommandContext, CommandRegistry } from '../command-registry.ts';
 // Formatting helpers
 // ---------------------------------------------------------------------------
 
-/** Drop the redundant 'wcp_' prefix and cap length for compact listing. Full ids (and any unambiguous prefix of one) are still accepted by /rewind. */
-function shortId(id: string): string {
+/** Drop the redundant 'wcp_' prefix and cap length for compact listing. Full ids (and any unambiguous prefix of one) are still accepted by /rewind. Exported: /rewind's no-anchors checkpoint fallback (rewind-runtime.ts) reuses this same formatting. */
+export function shortId(id: string): string {
   const stripped = id.startsWith('wcp_') ? id.slice(4) : id;
   return stripped.length > 12 ? stripped.slice(0, 12) : stripped;
 }
@@ -77,7 +77,7 @@ export function registerCheckpointRuntimeCommands(registry: CommandRegistry): vo
       // them would cost one diff spawn per checkpoint (O(checkpoints)), which
       // stops being cheap once there are more than a handful. /rewind <id>
       // loads exactly one diff, so the exact file list is available there.
-      ctx.print('Use /rewind to preview and restore a completed turn (files and/or conversation) — it reuses these checkpoints for the files half.');
+      ctx.print('Use /rewind to preview and restore a completed turn (files and/or conversation) — it reuses these checkpoints for the files half. With no completed turns recorded this run (e.g. right after a restart), /rewind falls back to restoring one of these checkpoints directly, by number or id — files only, no conversation state.');
     },
   });
 

package/src/input/commands/health-runtime.ts

@@ -1,4 +1,3 @@
-import { ServiceRegistry } from '@pellux/goodvibes-sdk/platform/config';
 import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
 import { probeTermCaps } from '../../renderer/term-caps.ts';
 import { evaluateSessionMaintenance, formatSessionMaintenanceLines } from '@/runtime/index.ts';
@@ -8,7 +7,6 @@ import { buildSetupReviewSnapshot } from './local-setup-review.ts';
 import { buildProviderAccountSnapshot } from '@/runtime/index.ts';
 import { getSettingsControlPlaneSnapshot } from '@/runtime/index.ts';
 import { listPersistedWorktreeMeta, summarizeWorktreeOwnership } from '@/runtime/index.ts';
-import { checkRecoveryFile, readLastSessionPointer } from '@/runtime/index.ts';
 import {
   openCommandPanel,
   requireLocalUserAuthManager,
@@ -425,7 +423,7 @@ export function registerHealthRuntimeCommands(registry: CommandRegistry): void {
         } else if (domain === 'continuity') {
           lines.push('  domain: continuity');
           lines.push('  /session list');
-          lines.push('  /session resume <id>');
+          lines.push('  /resume <id>');
           lines.push('  /session hotspots');
           lines.push('  verify: /health continuity');
         } else if (domain === 'maintenance') {

package/src/input/commands/local-runtime.ts

@@ -34,14 +34,31 @@ function toggleBlocks(typeFilter: string, collapsed: boolean, ctx: CommandContex
   let count = 0;
   for (let i = 0; i < blockRegistry.length; i++) {
     const block = blockRegistry[i];
+    // A folded tool-result group (type 'tool_group', see conversation-tool-groups.ts)
+    // is a run of tool results under one header, so '/expand tool'/'collapse tool'
+    // treats it the same as a plain 'tool' block — toggling the header's collapse
+    // key expands/collapses every member underneath it.
     const matchesType = typeFilter === 'all'
-      || (typeFilter === 'tool' && block.type === 'tool')
+      || (typeFilter === 'tool' && (block.type === 'tool' || block.type === 'tool_group'))
       || (typeFilter === 'code' && block.type === 'code')
       || (typeFilter === 'thinking' && block.type === 'thinking');
     if (!matchesType) continue;
     const isCurrentlyCollapsed = ctx.session.conversationManager.isCollapsed(i);
     if (collapsed ? !isCurrentlyCollapsed : isCurrentlyCollapsed) {
       ctx.session.conversationManager.toggleCollapseAtLine(block.startLine);
+      // Expanding a folded tool-result group also expands every member's own
+      // collapse key in the same pass. A folded member pushes no BlockMeta of
+      // its own while the group is collapsed, so it never surfaces from this
+      // loop to be toggled individually — without this, '/expand tool' only
+      // opens the group header and each member still renders at whatever its
+      // own default collapse state is, needing a second '/expand tool' pass.
+      // '/collapse tool' needs no matching step: collapsing the group hides
+      // every member regardless of its own key.
+      if (!collapsed && block.type === 'tool_group' && block.groupMemberIndexes) {
+        for (const memberIdx of block.groupMemberIndexes) {
+          ctx.session.conversationManager.setCollapsed(`msg_${memberIdx}`, false);
+        }
+      }
       count++;
     }
   }
@@ -148,7 +165,7 @@ export function registerLocalRuntimeCommands(registry: CommandRegistry): void {
 
   registry.register({
     name: 'secrets',
-    description: 'Manage hierarchy-aware secrets, external secret refs, and secure/plaintext storage policy controls',
+    description: 'Persistent secret storage: hierarchy-aware, external secret refs, providers (a quick one-off masked value instead: /secret)',
     usage: 'set <KEY> <value> [--user|--project] [--secure|--plaintext] | link <KEY> <secret-ref> [--user|--project] [--secure|--plaintext] | get <KEY> | test <secret-ref> | providers | list | delete <KEY> [--user|--project] [--secure|--plaintext]',
     argsHint: '<set|link|get|test|providers|list|delete> [KEY]',
     async handler(args, ctx) {

package/src/input/commands/rewind-runtime.ts

@@ -39,12 +39,13 @@ import {
   type RewindWorkspacePort,
 } from '@pellux/goodvibes-sdk/platform/rewind';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
-import type { WorkspaceCheckpointManager } from '@pellux/goodvibes-sdk/platform/workspace';
+import type { WorkspaceCheckpoint, WorkspaceCheckpointManager } from '@pellux/goodvibes-sdk/platform/workspace';
 import type { CommandContext, CommandRegistry } from '../command-registry.ts';
 import { buildRewindReceiptBlock } from '../../core/rewind-receipt.ts';
 import { getTurnAnchors, type TurnAnchor } from '../../core/rewind-turn-anchors.ts';
 import { createConversationRewindPort, type ConversationRewindPort } from '../../runtime/conversation-rewind-port.ts';
 import { requirePanelManager } from './runtime-services.ts';
+import { shortId } from './checkpoint-runtime.ts';
 
 export type RewindScope = SdkRewindScope;
 const REWIND_SCOPES: readonly RewindScope[] = ['files', 'conversation', 'both'];
@@ -231,6 +232,127 @@ function parseScope(token: string | undefined): RewindScope | null {
   return (REWIND_SCOPES as readonly string[]).includes(lower) ? (lower as RewindScope) : null;
 }
 
+// ---------------------------------------------------------------------------
+// Checkpoint-only fallback — no completed turns recorded THIS run (e.g. right
+// after a restart) means the message-anchored picker above has nothing to
+// list, even though real workspace checkpoints exist on disk. Rather than
+// dead-ending on "no completed turns" while /checkpoints and the boot notice
+// both point back here, /rewind falls back to listing and restoring
+// checkpoints directly — a FILES-ONLY restore (there is no turn anchor to
+// join a conversation boundary against), reusing the same diff-panel
+// preview/confirm idiom as the turn-anchored path above.
+// ---------------------------------------------------------------------------
+
+const CHECKPOINT_FALLBACK_NO_ANCHORS_MESSAGE = 'No completed turns recorded this run yet. /rewind targets turns completed in the current session run.';
+
+function renderCheckpointFallbackList(checkpoints: readonly WorkspaceCheckpoint[]): string {
+  const lines = [
+    'No completed turns recorded this run yet — falling back to workspace checkpoints (FILES ONLY, no conversation state):',
+    ...checkpoints.slice(0, 20).map((cp, i) => `  ${String(i + 1).padStart(2)}. ${shortId(cp.id).padEnd(12)} ${cp.kind.padEnd(9)} ${cp.label}  (${formatAge(cp.createdAt)})`),
+    'Restore one: /rewind <n|id> — files only; conversation history is untouched.',
+  ];
+  return lines.join('\n');
+}
+
+/** Resolve a user ref ('1'..'N' newest-first, or a checkpoint id / id prefix) to a checkpoint. */
+function resolveCheckpointRef(checkpoints: readonly WorkspaceCheckpoint[], ref: string): WorkspaceCheckpoint | { error: string } {
+  if (/^\d+$/.test(ref)) {
+    const idx = Number(ref) - 1;
+    const cp = checkpoints[idx];
+    return cp ? cp : { error: `No checkpoint #${ref}. Run /rewind to list checkpoints (1–${checkpoints.length}).` };
+  }
+  const exact = checkpoints.find((cp) => cp.id === ref);
+  if (exact) return exact;
+  const prefix = checkpoints.filter((cp) => cp.id.startsWith(ref) || shortId(cp.id).startsWith(ref));
+  if (prefix.length === 1) return prefix[0]!;
+  if (prefix.length > 1) return { error: `Checkpoint ref "${ref}" is ambiguous (${prefix.length} matches). Use the list number instead.` };
+  return { error: `Unknown checkpoint ref "${ref}". Run /rewind to list checkpoints.` };
+}
+
+/**
+ * Handles bare `/rewind` and `/rewind <ref>` when this run has recorded no
+ * turn anchors at all. Returns true if it handled the invocation (always,
+ * once called), false is never returned — kept boolean-shaped only to mirror
+ * the calling convention at the call site.
+ */
+async function handleCheckpointOnlyRewind(args: string[], ctx: CommandContext): Promise<void> {
+  const mgr = ctx.workspace.workspaceCheckpointManager;
+  if (!mgr) {
+    ctx.print(CHECKPOINT_FALLBACK_NO_ANCHORS_MESSAGE);
+    return;
+  }
+  let checkpoints: WorkspaceCheckpoint[];
+  try {
+    checkpoints = await mgr.list();
+  } catch {
+    checkpoints = [];
+  }
+  if (checkpoints.length === 0) {
+    ctx.print(CHECKPOINT_FALLBACK_NO_ANCHORS_MESSAGE);
+    return;
+  }
+
+  if (args.length === 0) {
+    ctx.print(renderCheckpointFallbackList(checkpoints));
+    return;
+  }
+
+  const resolved = resolveCheckpointRef(checkpoints, args[0]!);
+  if ('error' in resolved) {
+    ctx.print(resolved.error);
+    return;
+  }
+  const checkpoint = resolved;
+
+  const { DiffPanel } = await import('../../panels/diff-panel.ts');
+  const pm = requirePanelManager(ctx);
+  let panel = pm.getAllOpen().find((p) => p.id === 'diff');
+  if (!panel) {
+    try { panel = pm.open('diff'); } catch { ctx.print('Could not open diff panel.'); return; }
+  }
+  pm.activateById('diff');
+  if (!pm.isVisible()) pm.show();
+  ctx.focusPanels?.();
+  const diffPanel = panel as InstanceType<typeof DiffPanel>;
+
+  try {
+    const diff = await mgr.diff(checkpoint.id);
+    if (diff.unifiedDiff.trim()) diffPanel.loadRawDiff(diff.unifiedDiff);
+    else diffPanel.showDiff('(no file changes)', '@@ -0,0 +0,0 @@\n Working tree already matches this checkpoint.');
+  } catch {
+    diffPanel.showDiff('(preview unavailable)', '@@ -0,0 +0,0 @@\n Could not load the checkpoint diff.');
+  }
+
+  diffPanel.confirmOverlay.arm({
+    id: checkpoint.id,
+    label: `${checkpoint.label} — restore FILES ONLY (no conversation state this run)`,
+    verb: 'Restore',
+    onConfirm: async () => {
+      try {
+        await mgr.restore(checkpoint.id, { safetyCheckpoint: true });
+        ctx.session.conversationManager.addTypedSystemMessage(
+          `[Rewind] Restored files from checkpoint ${shortId(checkpoint.id)} ("${checkpoint.label}"). Files only — no turn anchors exist this run, so conversation state is unchanged.`,
+          'operational',
+        );
+        pm.close('diff');
+        ctx.focusPrompt?.();
+        ctx.renderRequest();
+      } catch (err) {
+        ctx.print(`Checkpoint restore failed: ${summarizeError(err)}`);
+      }
+    },
+    onCancel: () => {
+      ctx.print('Restore cancelled — nothing changed.');
+      pm.close('diff');
+      ctx.focusPrompt?.();
+      ctx.renderRequest();
+    },
+  });
+
+  ctx.print(`Previewing checkpoint restore: "${checkpoint.label}" (FILES ONLY — no conversation state this run). Confirm in the diff panel: Enter/y to restore, n/Esc to cancel.`);
+  ctx.renderRequest();
+}
+
 // ---------------------------------------------------------------------------
 // Command registration
 // ---------------------------------------------------------------------------
@@ -244,6 +366,15 @@ export function registerRewindRuntimeCommands(registry: CommandRegistry): void {
     handler: async (args, ctx: CommandContext) => {
       const sessionId = ctx.session.runtime.sessionId;
 
+      // No turn anchors recorded this run (most commonly: right after a
+      // restart, before /session resume has restored any) — fall back to a
+      // files-only restore over the real workspace checkpoints instead of a
+      // dead end (see handleCheckpointOnlyRewind's header doc).
+      if (recentTurnsNewestFirst(sessionId).length === 0) {
+        await handleCheckpointOnlyRewind(args, ctx);
+        return;
+      }
+
       if (args.length === 0) {
         ctx.print(renderTurnList(sessionId));
         return;

package/src/input/commands/runtime-services.ts

@@ -12,7 +12,7 @@ import type { CompactionContext, CompactionEvent } from '@pellux/goodvibes-sdk/p
 import { recordCompactionQualityScore, scoreCompactionRun } from '../../renderer/compaction-quality.ts';
 import type { CompactionQualityScore } from '../../renderer/compaction-quality.ts';
 import type { UiReadModels } from '../../runtime/ui-read-models.ts';
-import type { ShellPathService } from '@/runtime/index.ts';
+import type { ShellPathService, SessionSurface } from '@/runtime/index.ts';
 import type { EcosystemCatalogPathOptions } from '@/runtime/index.ts';
 import type { PluginPathOptions } from '../../plugins/loader';
 import type { DirectTransport } from '@/runtime/index.ts';
@@ -72,6 +72,16 @@ export function requireShellPaths(context: Pick<CommandContext, 'workspace'>): S
   return requireContextValue(context.workspace.shellPaths, 'workspace.shellPaths');
 }
 
+/**
+ * The runtime's declare-once session-storage handle. Commands that touch
+ * session state take their paths from here rather than rebuilding a scope out
+ * of shellPaths, so a command and the runtime that wrote the file always agree
+ * on where it lives.
+ */
+export function requireSurface(context: Pick<CommandContext, 'workspace'>): SessionSurface {
+  return requireContextValue(context.workspace.surface, 'workspace.surface');
+}
+
 export function requireEcosystemCatalogPaths(
   context: CommandContext,
 ): EcosystemCatalogPathOptions {

package/src/input/commands/secret-runtime.ts

@@ -21,7 +21,7 @@ function toEnvVarName(raw: string): string {
 export function registerSecretRuntimeCommands(registry: CommandRegistry): void {
   registry.register({
     name: 'secret',
-    description: 'Enter a secret with concealed (masked) input and store it as an environment variable — plaintext never enters the transcript',
+    description: 'Quick one-off: type a value with masked input, stored as an env var for THIS session only (persistent storage + providers: /secrets)',
     usage: '/secret <NAME>',
     argsHint: '<NAME>',
     handler(args, ctx) {

package/src/input/commands/session-content.ts

@@ -9,6 +9,7 @@ import { requireSessionManager, requireSessionMemoryStore, requireShellPaths } f
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 import { sessionCommand } from './session.ts';
 import { undoLastRewind, redoLastRewind } from './rewind-runtime.ts';
+import { filterUserFacingSessions } from './session-picker-filter.ts';
 
 export function registerSessionContentCommands(registry: CommandRegistry): void {
   registry.register({
@@ -113,6 +114,10 @@ export function registerSessionContentCommands(registry: CommandRegistry): void
         model: ctx.session.runtime.model,
         provider: ctx.session.runtime.provider,
         timestamp: Date.now(),
+        // `/save` is the user asking to keep this conversation. Stamped so
+        // the session-conversations retention sweep never expires it, unlike
+        // the automatic per-turn snapshot (turn-event-wiring.ts, 'auto').
+        saveSource: 'user' as const,
       };
       try {
         const agentManager = ctx.ops.agentManager;
@@ -263,7 +268,10 @@ export function registerSessionContentCommands(registry: CommandRegistry): void
         return;
       }
       const sessionManager = requireSessionManager(ctx);
-      const sessions = sessionManager.list();
+      // Excludes subagent-shaped transcripts (see session-picker-filter.ts) —
+      // an unfiltered list here drowns real user sessions in spawned-agent
+      // noise. A direct `/sessions resume agent-xxxxxxxx` still reaches them.
+      const sessions = filterUserFacingSessions(sessionManager.list());
       if (ctx.openSelection) {
         const deleteAction = new Map([['d', 'delete' as const]]);
         const items: SelectionItem[] = sessions.length === 0

package/src/input/commands/session-picker-filter.ts

@@ -0,0 +1,28 @@
+/**
+ * session-picker-filter.ts — keep subagent transcripts out of user-facing
+ * session pickers.
+ *
+ * Subagents spawned during a session get their own SessionManager-persisted
+ * transcript, named `agent-<id>` (see the SDK's agent manager, which mints
+ * ids as `agent-${uuid.slice(0, 8)}`). Those files are real, loadable
+ * sessions — useful for forensic/debugging access — but they are not
+ * sessions a user ever started, and in a workspace with many spawned agents
+ * they drown the handful of sessions the user actually wants to pick from
+ * in `/resume` and `/sessions`.
+ *
+ * Both pickers filter agent-shaped entries out of the LIST/BROWSE view only.
+ * Direct resume by exact id/name (`/resume agent-xxxxxxxx`, `/session resume
+ * agent-xxxxxxxx`) is untouched and still reaches them — this only affects
+ * what shows up when the id isn't already known.
+ */
+import type { SessionInfo } from '@pellux/goodvibes-sdk/platform/sessions';
+
+/** Whether a saved session's name follows the subagent-transcript naming convention. */
+export function isAgentSessionName(name: string): boolean {
+  return name.startsWith('agent-');
+}
+
+/** Filter a session list down to user-facing (non-subagent) entries. */
+export function filterUserFacingSessions<T extends Pick<SessionInfo, 'name'>>(sessions: readonly T[]): T[] {
+  return sessions.filter((s) => !isAgentSessionName(s.name));
+}

package/src/input/commands/session-workflow.ts

@@ -6,9 +6,9 @@ import type { TranscriptEventKind } from '@pellux/goodvibes-sdk/platform/core';
 import type { ConversationTitleSource } from '../../core/conversation';
 import type { SessionReturnContextSummary } from '@/runtime/index.ts';
 import { formatReturnContextForDisplay, getReturnContextMode, maybeAssistReturnContextSummary } from '@/runtime/index.ts';
-import { requirePanelManager, requireProviderApi, requireSessionManager, requireShellPaths } from './runtime-services.ts';
-import { replayJournalForSession } from '../../core/session-recovery.ts';
-import { restoreTurnAnchors } from '../../core/rewind-turn-anchors.ts';
+import { requirePanelManager, requireProviderApi, requireSessionManager, requireSurface } from './runtime-services.ts';
+import { resumeSessionCore, reopenPanelsWithModalSkip, DEFAULT_PANEL_REOPEN_LIMIT } from '../../core/session-resume-core.ts';
+import { checkSessionLiveness } from '../../runtime/session-liveness-marker.ts';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 
 function parseTranscriptKind(raw: string | undefined): TranscriptEventKind | 'all' {
@@ -83,32 +83,20 @@ function buildTranscriptReviewLines(
 // Exported (test-only concern) so the MIGRATE-TO-MODAL redirect-skip honesty
 // (W6 review, finding 3: saved-layout restore with 'sessions' must not lie)
 // can be unit-tested directly instead of through a full /resume harness.
+// Delegates to the shared reopenPanelsWithModalSkip (core/session-resume-core.ts)
+// — the same routine resumeSessionCore uses — so this standalone entry point
+// and the canonical resume sequence can never diverge on panel-reopen behavior.
 export function reopenPanelsFromReturnContext(ctx: CommandContext, summary: SessionReturnContextSummary | undefined): string[] {
   if (!summary?.openPanels || summary.openPanels.length === 0) return [];
   const panelManager = requirePanelManager(ctx);
-  const reopened: string[] = [];
-  const movedToModal: string[] = [];
-  for (const panelId of summary.openPanels.slice(0, 4)) {
-    // (the purge): a MIGRATE-TO-MODAL id has no panel to restore — a modal
-    // is not part of the saved panel layout. Skip it (don't pop a modal
-    // mid-resume) and note it once, rather than firing openModal + revealing an
-    // empty workspace during resume.
-    if (panelManager.getModalRedirect(panelId) !== undefined) {
-      movedToModal.push(panelId);
-      continue;
-    }
-    try {
-      panelManager.open(panelId);
-      reopened.push(panelId);
-    } catch {
-      // Ignore unknown or currently unavailable panel ids during resume.
-    }
-  }
-  if (reopened.length > 0) panelManager.show();
+  const { reopened, movedToModal, notReopened } = reopenPanelsWithModalSkip(panelManager, summary.openPanels, DEFAULT_PANEL_REOPEN_LIMIT);
   if (movedToModal.length > 0) {
     ctx.print(`Note: ${movedToModal.join(', ')} moved to a modal — reopen via its command instead of as a panel.`);
   }
-  return reopened;
+  if (notReopened.length > 0) {
+    ctx.print(`  …and ${notReopened.length} more not reopened (/panels to open)`);
+  }
+  return [...reopened];
 }
 
 function printSessionExport(
@@ -198,7 +186,9 @@ export async function handleSessionWorkflowCommand(args: string[], ctx: CommandC
           session.returnContext.activeTasks ? `active=${session.returnContext.activeTasks}` : null,
           session.returnContext.blockedTasks ? `blocked=${session.returnContext.blockedTasks}` : null,
           session.returnContext.pendingApprovals ? `approvals=${session.returnContext.pendingApprovals}` : null,
-          session.returnContext.openPanels?.length ? `panels=${session.returnContext.openPanels.slice(0, 3).join(',')}` : null,
+          session.returnContext.openPanels?.length
+            ? `panels=${session.returnContext.openPanels.slice(0, 3).join(',')}${session.returnContext.openPanels.length > 3 ? ` (+${session.returnContext.openPanels.length - 3} more)` : ''}`
+            : null,
         ].filter(Boolean).join('  ');
         if (posture) lines.push(`     posture: ${posture}`);
       }
@@ -222,6 +212,10 @@ export async function handleSessionWorkflowCommand(args: string[], ctx: CommandC
           model: ctx.session.runtime.model,
           provider: ctx.session.runtime.provider,
           timestamp: Date.now(),
+          // Naming a session is an act of curation, so the file this
+          // materializes for rename to act on is a user save, not machinery —
+          // the retention sweep must not expire something the user named.
+          saveSource: 'user',
         });
       }
       sm.rename(ctx.session.runtime.sessionId, newName);
@@ -235,9 +229,13 @@ export async function handleSessionWorkflowCommand(args: string[], ctx: CommandC
   }
 
   if (sub === 'resume') {
-    const target = args.slice(1).join(' ').trim();
+    // '--force' bypasses the multi-instance liveness confirm below — never a
+    // session-id/name token itself (session ids never start with '--').
+    const rawArgs = args.slice(1);
+    const force = rawArgs.includes('--force');
+    const target = rawArgs.filter((a) => a !== '--force').join(' ').trim();
     if (!target) {
-      ctx.print('Usage: /session resume <session-id-or-name>');
+      ctx.print('Usage: /session resume <session-id-or-name> [--force]');
       return true;
     }
     const sessions = sm.list();
@@ -250,56 +248,36 @@ export async function handleSessionWorkflowCommand(args: string[], ctx: CommandC
       ctx.print(`Session not found: ${target}\nUse /session list to see available sessions.`);
       return true;
     }
-    try {
-      const { meta, messages } = sm.load(found.name);
-      const providerApi = requireProviderApi(ctx);
-      ctx.session.conversationManager.resetAll();
-      ctx.session.conversationManager.fromJSON({ messages: messages as never[], title: meta.title, titleSource: meta.titleSource });
-      ctx.session.conversationManager.rebuildHistory();
-      ctx.session.runtime.sessionId = found.name;
 
-      // Restore the resumed session's message-anchored rewind anchors from its
-      // sidecar so /rewind works identically before and after the resume. The
-      // in-memory registry is process-local, so a fresh process would otherwise
-      // start with no anchors for the loaded session.
-      const restoredAnchorCount = restoreTurnAnchors(found.name, requireShellPaths(ctx).workingDirectory);
+    // Multi-instance safety: warn (and require --force) when this session
+    // looks open in another still-running terminal right now — resuming it
+    // here would fork its live state out from under that other instance.
+    // Best-effort: a missing/stale marker (or this process's OWN marker,
+    // e.g. re-resuming the session already active here) never blocks anything.
+    const liveness = checkSessionLiveness(requireSurface(ctx), found.name);
+    if (liveness.live && liveness.pid !== process.pid && !force) {
+      ctx.print(
+        `Session appears open in another terminal (pid ${liveness.pid}) — resuming will fork its live state.\n` +
+        `Re-run \`/session resume ${found.name} --force\` to proceed anyway.`,
+      );
+      return true;
+    }
 
-      // Journal replay: recover turns that post-date the loaded snapshot.
-      const shellPaths = requireShellPaths(ctx);
-      const journalReplay = replayJournalForSession({
-        homeDirectory: shellPaths.homeDirectory,
-        snapshotTimestamp: meta.timestamp,
+    try {
+      const providerApi = requireProviderApi(ctx);
+      const outcome = await resumeSessionCore(found.name, {
+        sessionManager: sm,
         conversation: ctx.session.conversationManager,
-        sessionId: found.name,
-        persistSnapshot: (replayedMessages) => {
-          sm.save(found.name, replayedMessages as never[], {
-            title: ctx.session.conversationManager.title || meta.title,
-            model: meta.model,
-            provider: meta.provider,
-            timestamp: Date.now(),
-            titleSource: meta.titleSource,
-            returnContext: meta.returnContext,
-          });
-        },
+        runtime: ctx.session.runtime,
+        surface: requireSurface(ctx),
+        panelManager: requirePanelManager(ctx),
+        selectModel: (model) => providerApi.selectModel(model),
+        hydrateSessionUsage: ctx.session.hydrateSessionUsage,
       });
-      // Hydrate the footer's token counters from the resumed (+ journal-replayed)
-      // history now, before ctx.renderRequest() below.
-      ctx.session.hydrateSessionUsage?.();
+      const { meta, journalReplay, restoredAnchorCount, resumedMessageCount, panels } = outcome;
 
-      if (meta.model) {
-        try {
-          const selected = await providerApi.selectModel(meta.model);
-          ctx.session.runtime.model = selected.registryKey;
-          ctx.session.runtime.provider = selected.providerId;
-        } catch {
-          ctx.session.runtime.model = meta.model;
-          // model may not exist locally
-        }
-      }
-      if (meta.provider) ctx.session.runtime.provider = meta.provider;
       ctx.renderRequest();
-      const resumedMsgCount = ctx.session.conversationManager.getMessageCount();
-      ctx.print(`Resumed session: ${found.name}\n  Name: ${meta.title || '(untitled)'}\n  Messages: ${resumedMsgCount}\n  Model: ${meta.model || ctx.session.runtime.model}`);
+      ctx.print(`Resumed session: ${found.name}\n  Name: ${meta.title || '(untitled)'}\n  Messages: ${resumedMessageCount}\n  Model: ${meta.model || ctx.session.runtime.model}`);
       if (restoredAnchorCount > 0) {
         ctx.print(`  Rewind: restored ${restoredAnchorCount} turn anchor(s) — /rewind is available for this resumed session.`);
       }
@@ -311,14 +289,19 @@ export async function handleSessionWorkflowCommand(args: string[], ctx: CommandC
       } else if (journalReplay.hadCorruptTail) {
         ctx.print('  [Recovery] Journal tail was partially corrupt (quarantined). Replay stopped at last good record.');
       }
-      const reopenedPanels = reopenPanelsFromReturnContext(ctx, meta.returnContext);
+      if (panels.movedToModal.length > 0) {
+        ctx.print(`Note: ${panels.movedToModal.join(', ')} moved to a modal — reopen via its command instead of as a panel.`);
+      }
+      if (panels.notReopened.length > 0) {
+        ctx.print(`  …and ${panels.notReopened.length} more not reopened (/panels to open)`);
+      }
       const returnContextMode = getReturnContextMode(ctx.platform.configManager);
       if (returnContextMode !== 'off' && meta.returnContext) {
         for (const line of formatReturnContextForDisplay(meta.returnContext)) {
           ctx.print(`  ${line}`);
         }
-        if (reopenedPanels.length > 0) {
-          ctx.print(`  Reopened panels: ${reopenedPanels.join(', ')}`);
+        if (panels.reopened.length > 0) {
+          ctx.print(`  Reopened panels: ${panels.reopened.join(', ')}`);
         }
         if ((meta.returnContext.remoteRunners?.length ?? 0) > 0) {
           ctx.print(`  Remote re-entry: /remote recover ${meta.returnContext.remoteRunners![0]}`);
@@ -354,6 +337,8 @@ export async function handleSessionWorkflowCommand(args: string[], ctx: CommandC
       timestamp: Date.now(),
       titleSource: exportData.titleSource,
       returnContext: exportData.returnContext,
+      // The operator asked for this fork by name; it is not turn machinery.
+      saveSource: 'user',
     };
     try {
       sm.save(newId, messages, meta);
@@ -378,6 +363,10 @@ export async function handleSessionWorkflowCommand(args: string[], ctx: CommandC
       timestamp: Date.now(),
       titleSource: exportData.titleSource,
       returnContext: exportData.returnContext,
+      // The one unambiguous "keep this" act in the app. Marked so the
+      // session-conversations retention sweep never expires it, unlike the
+      // automatic per-turn snapshot (turn-event-wiring.ts, saveSource 'auto').
+      saveSource: 'user',
     };
     try {
       const { filePath, sanitizedName } = sm.save(rawName, messages, meta);