@pellux/goodvibes-tui 1.19.6 → 1.20.0

package/src/core/transcript-journal.ts

@@ -67,6 +67,7 @@ import {
 } from 'node:fs';
 import { dirname, join } from 'node:path';
 import type { ConversationMessageSnapshot } from '@pellux/goodvibes-sdk/platform/core';
+import type { SessionSurface } from '@/runtime/index.ts';
 
 // ─── Constants ──────────────────────────────────────────────────────────────
 
@@ -128,6 +129,17 @@ export interface TranscriptJournal {
 
   /** Absolute path to the journal file. */
   readonly path: string;
+
+  /**
+   * Point this journal at a different session's file, resetting the sequence
+   * counter and initialization flag. Used when the session a journal was
+   * opened for is switched out from under it (e.g. `/session resume` or
+   * `/session fork` reassigning `runtime.sessionId`) — without this, the
+   * journal keeps appending the NEW session's records into the OLD session's
+   * file. Does not touch the old file on disk; it is simply no longer
+   * written to.
+   */
+  rebind(journalPath: string, sessionId: string): void;
 }
 
 // ─── Factory ────────────────────────────────────────────────────────────────
@@ -148,11 +160,15 @@ export function openTranscriptJournal(
 /**
  * Build the canonical journal path for a session.
  *
- * @param homeDirectory  The goodvibes home directory (e.g. ~/.goodvibes).
- * @param sessionId      The session identifier.
+ * Both the home directory and the scope segment come off the caller's
+ * SessionSurface, so the journal lands beside the sessions and recovery
+ * snapshots it fills gaps for rather than under a separately-spelled scope.
+ *
+ * @param surface    The app's declare-once session-storage handle.
+ * @param sessionId  The session identifier.
  */
-export function journalPathFor(homeDirectory: string, sessionId: string): string {
-  return join(homeDirectory, '.goodvibes', 'tui', `transcript-${sessionId}.journal`);
+export function journalPathFor(surface: SessionSurface, sessionId: string): string {
+  return join(surface.homeDirectory, '.goodvibes', surface.surfaceRoot, `transcript-${sessionId}.journal`);
 }
 
 /**
@@ -248,8 +264,11 @@ export function replayJournal(
 // ─── Implementation ─────────────────────────────────────────────────────────
 
 class TranscriptJournalImpl implements TranscriptJournal {
-  readonly path: string;
-  private readonly _sessionId: string;
+  // Not `readonly` at the class level (unlike the public interface) so
+  // rebind() can repoint it; external callers only ever see it through the
+  // `TranscriptJournal` interface, which keeps it read-only for them.
+  path: string;
+  private _sessionId: string;
   private _seq = 0;
   private _initialised = false;
 
@@ -258,6 +277,13 @@ class TranscriptJournalImpl implements TranscriptJournal {
     this._sessionId = sessionId;
   }
 
+  rebind(journalPath: string, sessionId: string): void {
+    this.path = journalPath;
+    this._sessionId = sessionId;
+    this._seq = 0;
+    this._initialised = false;
+  }
+
   appendRecord(type: JournalEventType, messages: ConversationMessageSnapshot[]): void {
     try {
       this._ensureInitialised();

package/src/core/turn-event-wiring.ts

@@ -7,6 +7,7 @@ import { logger } from '@pellux/goodvibes-sdk/platform/utils';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 import type { HookDispatcher, HookPhase, HookCategory, HookEventPath } from '@pellux/goodvibes-sdk/platform/hooks';
 import type { ConversationManager } from './conversation.ts';
+import type { SessionSurface } from '@/runtime/index.ts';
 import { journalPathFor, openTranscriptJournal, type TranscriptJournal } from './transcript-journal.ts';
 import type { WebhookNotifier } from '@pellux/goodvibes-sdk/platform/integrations';
 import { notifyCompletion } from '@pellux/goodvibes-sdk/platform/utils';
@@ -16,9 +17,6 @@ import { shouldFireAlert, FORCE_NOTIFY_DURATION_MS } from './alert-gating.ts';
 import { createBudgetBreachNotifier, type BudgetBreachNotifier } from './budget-breach-notifier.ts';
 import { readBudgetAlertUsd } from '../export/cost-utils.ts';
 
-/** Infer the options param of persistConversation to pick up SessionManager correctly. */
-type PersistOptions = NonNullable<Parameters<typeof persistConversation>[5]>;
-
 /** Minimal orchestrator surface required by turn-event wiring. */
 interface TurnOrchestrator {
   readonly lastInputTokens: number;
@@ -64,9 +62,14 @@ export interface WireTurnEventHandlersOptions {
   readonly providerRegistry: TurnProviderRegistry;
   readonly systemMessageRouter: TurnSystemMessageRouter;
   readonly hookDispatcher: HookDispatcher;
-  readonly workingDir: string;
-  readonly homeDirectory: string;
-  readonly sessionManager: PersistOptions['sessionManager'];
+  /**
+   * The app's declare-once session-storage handle. The turn snapshot, the
+   * last-session pointer it writes, the transcript journal, and the rewind
+   * anchor sidecar all resolve off this one handle — so the boot notice and
+   * `--continue`, which read through the same handle, land on the files this
+   * writer actually produced.
+   */
+  readonly surface: SessionSurface;
   readonly gitStatusProvider: { refresh(): Promise<unknown> };
   readonly lastGitInfoRef: { value: unknown };
   readonly buildSessionContinuityHints: () => Record<string, unknown>;
@@ -104,6 +107,32 @@ export interface WireTurnEventHandlersOptions {
   readonly _clock?: () => number;
 }
 
+/**
+ * Wrap a TranscriptJournal so every write first checks whether
+ * `runtime.sessionId` has moved on from the session the journal is currently
+ * bound to, rebinding to the new session's file when it has. See the
+ * `transcriptJournal` construction above for why this is necessary.
+ */
+function wrapJournalWithSessionRebind(
+  journal: TranscriptJournal,
+  surface: SessionSurface,
+  runtime: { readonly sessionId: string },
+): TranscriptJournal {
+  let boundSessionId = runtime.sessionId;
+  const ensureBoundToCurrentSession = (): void => {
+    if (runtime.sessionId !== boundSessionId) {
+      boundSessionId = runtime.sessionId;
+      journal.rebind(journalPathFor(surface, boundSessionId), boundSessionId);
+    }
+  };
+  return {
+    get path(): string { return journal.path; },
+    appendRecord: (type, messages) => { ensureBoundToCurrentSession(); journal.appendRecord(type, messages); },
+    rotate: () => { ensureBoundToCurrentSession(); journal.rotate(); },
+    rebind: (path, sessionId) => { boundSessionId = sessionId; journal.rebind(path, sessionId); },
+  };
+}
+
 export interface WireTurnEventHandlersResult {
   /** Trigger a git status refresh; may be called from external code after tool execution. */
   readonly refreshGit: () => void;
@@ -134,7 +163,7 @@ export function wireTurnEventHandlers(
 ): WireTurnEventHandlersResult {
   const {
     events, conversation, runtime, configManager, hookDispatcher, orchestrator, providerRegistry,
-    workingDir, homeDirectory, sessionManager, gitStatusProvider,
+    surface, gitStatusProvider,
     lastGitInfoRef, buildSessionContinuityHints, render, webhookNotifier, focusTracker,
     terminalNotifier, runtimeBus, systemMessageRouter,
     _clock = Date.now,
@@ -145,9 +174,19 @@ export function wireTurnEventHandlers(
 
   // Create the per-session transcript journal. Path mirrors recovery-file
   // convention (homeDirectory-scoped). Created lazily on first append.
-  const transcriptJournal: TranscriptJournal = openTranscriptJournal(
-    journalPathFor(homeDirectory, runtime.sessionId),
-    runtime.sessionId,
+  //
+  // `runtime` is the same MutableRuntimeState object /session resume and
+  // /session fork reassign `sessionId` on in place (session-workflow.ts,
+  // bootstrap-hook-bridge.ts), so a session switch is visible here just by
+  // re-reading `runtime.sessionId`. Wrapped so every write re-checks it and
+  // rebinds to the new session's file first — otherwise the journal opened
+  // for the OLD session keeps appending the NEW session's snapshots into the
+  // OLD session's file, and a later resume of the old session replays the
+  // wrong conversation.
+  const transcriptJournal: TranscriptJournal = wrapJournalWithSessionRebind(
+    openTranscriptJournal(journalPathFor(surface, runtime.sessionId), runtime.sessionId),
+    surface,
+    runtime,
   );
 
   // Track turn start time for long-task notification threshold.
@@ -210,7 +249,11 @@ export function wireTurnEventHandlers(
         runtime.model,
         runtime.provider,
         conversation.title || '',
-        { workingDirectory: workingDir, homeDirectory, sessionManager },
+        { surface },
+        // Turn-completion persistence is machinery, not a user act: stated
+        // explicitly so the retention sweep can tell it apart from a session
+        // the user asked to keep via /session save.
+        'auto',
       );
       hookDispatcher.fire({ path: 'Lifecycle:session:save' as HookEventPath, phase: 'Lifecycle' as HookPhase, category: 'session' as HookCategory, specific: 'save', sessionId: runtime.sessionId, timestamp: Date.now(), payload: { sessionId: runtime.sessionId } }).catch((err: unknown) => logger.debug('hook fire error', { error: summarizeError(err) }));
       // Snapshot succeeded — rotate the journal (gap-filler no longer needed).
@@ -238,7 +281,7 @@ export function wireTurnEventHandlers(
       });
       // Mirror the anchors to the session's sidecar so message-anchored /rewind
       // survives a resume (the in-memory registry alone is process-local).
-      persistTurnAnchors(runtime.sessionId, workingDir);
+      persistTurnAnchors(runtime.sessionId, surface);
     } catch { /* best-effort; a rewind-anchor miss must never break the turn */ }
     // Auto-compaction is owned by the SDK Orchestrator's post-turn maintenance
     // (handlePostTurnContextMaintenance), which runs on every turn against the

package/src/input/command-args-hint.ts

@@ -1,12 +1,21 @@
 import type { CommandRegistry } from './command-registry.ts';
+import { SESSION_SUBCOMMAND_ARG_HINTS } from './commands/session.ts';
 
+/**
+ * Per-command subcommand → argument-hint maps. `session`'s entries come
+ * straight from session.ts (SESSION_SUBCOMMAND_ARG_HINTS) — the same table
+ * the `/session` switch itself is built from — so the two can never drift
+ * apart; the others are hand-maintained here since they're small and their
+ * owning modules don't export an equivalent table. A drift test
+ * (src/test/input/command-args-hint.test.ts) checks every top-level key
+ * below resolves to a real registered command.
+ */
 const SUBCOMMAND_HINTS: Record<string, Record<string, string>> = {
-  session: { rename: '<name>', resume: '<id|name>', info: '<id>', export: '<id> [format]', search: '<query>', delete: '<id>' },
+  session: SESSION_SUBCOMMAND_ARG_HINTS,
   template: { save: '<name>', use: '<name> [args]', edit: '<name>', delete: '<name>' },
   secrets: { set: '<KEY> <value>', get: '<KEY>', delete: '<KEY>' },
   permissions: { tool: '<name> allow|prompt|deny' },
   config: { reset: '<key>' },
-  danger: {},
   plugin: { enable: '<name>', disable: '<name>', reload: '' },
 };
 

package/src/input/command-registry.ts

@@ -23,6 +23,7 @@ import type { FeatureFlagManager } from '@/runtime/index.ts';
 import type { OperatorClient } from '@/runtime/index.ts';
 import type { PeerClient } from '@/runtime/index.ts';
 import type { DirectTransport } from '@/runtime/index.ts';
+import type { SessionSurface } from '@/runtime/index.ts';
 import type { VoiceProviderRegistry, VoiceService } from '@pellux/goodvibes-sdk/platform/voice';
 import type { UiPlatformServices } from '../runtime/ui-services.ts';
 import type {
@@ -80,6 +81,14 @@ export interface CommandUiActions {
     kind: 'image' | 'text' | 'none';
     marker?: string;
   };
+  /**
+   * Read-only view of pending `[TEXT: pN, M lines]` fold markers currently
+   * sitting in the composer (registerPaste in handler-content-actions.ts) —
+   * backs /pastes, which previews a folded paste's actual content before the
+   * user submits it. A paste over the fold threshold is otherwise invisible
+   * until the LLM sees it.
+   */
+  getPendingPastes?: () => ReadonlyMap<string, string>;
   executeCommand?: (name: string, args: string[]) => Promise<boolean>;
   /** Arm the one-key jump to a spawned CI fix-session (the surface attaches on the jump key; the user never retypes an id). */
   armFixSessionAttach?: (fixSessionId: string) => void;
@@ -152,6 +161,8 @@ export interface CommandShellUiOpeners {
   jumpToBookmark?: (key: string) => void;
   scrollToLine?: (line: number) => void;
   openHelpOverlay?: () => void;
+  /** Toggle the transcript search overlay (same action as Ctrl+F) — backs /find. */
+  openTranscriptSearch?: () => void;
   openSelection?: (
     title: string,
     items: SelectionItem[],
@@ -270,6 +281,14 @@ export interface CommandProviderServices {
  * runtime surfaces exported from runtime/shell-command-services.ts.
  */
 export interface CommandWorkspaceUiServices {
+  /**
+   * The app's declare-once session-storage handle (runtime/services.ts). Every
+   * command that reads or writes session state — resume, save, the liveness
+   * markers, the rewind anchor sidecar — takes its paths from here instead of
+   * re-deriving a scope from shellPaths, so a command can never land on a
+   * different directory than the runtime that wrote the file.
+   */
+  surface?: SessionSurface;
   keybindingsManager?: KeybindingsManager;
   fileUndoManager?: FileUndoManager;
   workspaceCheckpointManager?: WorkspaceCheckpointManager;

package/src/input/commands/checkpoint-runtime.ts

@@ -19,8 +19,8 @@ import type { CommandContext, CommandRegistry } from '../command-registry.ts';
 // Formatting helpers
 // ---------------------------------------------------------------------------
 
-/** Drop the redundant 'wcp_' prefix and cap length for compact listing. Full ids (and any unambiguous prefix of one) are still accepted by /rewind. */
-function shortId(id: string): string {
+/** Drop the redundant 'wcp_' prefix and cap length for compact listing. Full ids (and any unambiguous prefix of one) are still accepted by /rewind. Exported: /rewind's no-anchors checkpoint fallback (rewind-runtime.ts) reuses this same formatting. */
+export function shortId(id: string): string {
   const stripped = id.startsWith('wcp_') ? id.slice(4) : id;
   return stripped.length > 12 ? stripped.slice(0, 12) : stripped;
 }
@@ -77,7 +77,7 @@ export function registerCheckpointRuntimeCommands(registry: CommandRegistry): vo
       // them would cost one diff spawn per checkpoint (O(checkpoints)), which
       // stops being cheap once there are more than a handful. /rewind <id>
       // loads exactly one diff, so the exact file list is available there.
-      ctx.print('Use /rewind to preview and restore a completed turn (files and/or conversation) — it reuses these checkpoints for the files half.');
+      ctx.print('Use /rewind to preview and restore a completed turn (files and/or conversation) — it reuses these checkpoints for the files half. With no completed turns recorded this run (e.g. right after a restart), /rewind falls back to restoring one of these checkpoints directly, by number or id — files only, no conversation state.');
     },
   });
 

package/src/input/commands/health-runtime.ts

@@ -1,4 +1,3 @@
-import { ServiceRegistry } from '@pellux/goodvibes-sdk/platform/config';
 import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
 import { probeTermCaps } from '../../renderer/term-caps.ts';
 import { evaluateSessionMaintenance, formatSessionMaintenanceLines } from '@/runtime/index.ts';
@@ -8,7 +7,6 @@ import { buildSetupReviewSnapshot } from './local-setup-review.ts';
 import { buildProviderAccountSnapshot } from '@/runtime/index.ts';
 import { getSettingsControlPlaneSnapshot } from '@/runtime/index.ts';
 import { listPersistedWorktreeMeta, summarizeWorktreeOwnership } from '@/runtime/index.ts';
-import { checkRecoveryFile, readLastSessionPointer } from '@/runtime/index.ts';
 import {
   openCommandPanel,
   requireLocalUserAuthManager,
@@ -425,7 +423,7 @@ export function registerHealthRuntimeCommands(registry: CommandRegistry): void {
         } else if (domain === 'continuity') {
           lines.push('  domain: continuity');
           lines.push('  /session list');
-          lines.push('  /session resume <id>');
+          lines.push('  /resume <id>');
           lines.push('  /session hotspots');
           lines.push('  verify: /health continuity');
         } else if (domain === 'maintenance') {

package/src/input/commands/local-runtime.ts

@@ -165,7 +165,7 @@ export function registerLocalRuntimeCommands(registry: CommandRegistry): void {
 
   registry.register({
     name: 'secrets',
-    description: 'Manage hierarchy-aware secrets, external secret refs, and secure/plaintext storage policy controls',
+    description: 'Persistent secret storage: hierarchy-aware, external secret refs, providers (a quick one-off masked value instead: /secret)',
     usage: 'set <KEY> <value> [--user|--project] [--secure|--plaintext] | link <KEY> <secret-ref> [--user|--project] [--secure|--plaintext] | get <KEY> | test <secret-ref> | providers | list | delete <KEY> [--user|--project] [--secure|--plaintext]',
     argsHint: '<set|link|get|test|providers|list|delete> [KEY]',
     async handler(args, ctx) {

package/src/input/commands/rewind-runtime.ts

@@ -39,12 +39,13 @@ import {
   type RewindWorkspacePort,
 } from '@pellux/goodvibes-sdk/platform/rewind';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
-import type { WorkspaceCheckpointManager } from '@pellux/goodvibes-sdk/platform/workspace';
+import type { WorkspaceCheckpoint, WorkspaceCheckpointManager } from '@pellux/goodvibes-sdk/platform/workspace';
 import type { CommandContext, CommandRegistry } from '../command-registry.ts';
 import { buildRewindReceiptBlock } from '../../core/rewind-receipt.ts';
 import { getTurnAnchors, type TurnAnchor } from '../../core/rewind-turn-anchors.ts';
 import { createConversationRewindPort, type ConversationRewindPort } from '../../runtime/conversation-rewind-port.ts';
 import { requirePanelManager } from './runtime-services.ts';
+import { shortId } from './checkpoint-runtime.ts';
 
 export type RewindScope = SdkRewindScope;
 const REWIND_SCOPES: readonly RewindScope[] = ['files', 'conversation', 'both'];
@@ -231,6 +232,127 @@ function parseScope(token: string | undefined): RewindScope | null {
   return (REWIND_SCOPES as readonly string[]).includes(lower) ? (lower as RewindScope) : null;
 }
 
+// ---------------------------------------------------------------------------
+// Checkpoint-only fallback — no completed turns recorded THIS run (e.g. right
+// after a restart) means the message-anchored picker above has nothing to
+// list, even though real workspace checkpoints exist on disk. Rather than
+// dead-ending on "no completed turns" while /checkpoints and the boot notice
+// both point back here, /rewind falls back to listing and restoring
+// checkpoints directly — a FILES-ONLY restore (there is no turn anchor to
+// join a conversation boundary against), reusing the same diff-panel
+// preview/confirm idiom as the turn-anchored path above.
+// ---------------------------------------------------------------------------
+
+const CHECKPOINT_FALLBACK_NO_ANCHORS_MESSAGE = 'No completed turns recorded this run yet. /rewind targets turns completed in the current session run.';
+
+function renderCheckpointFallbackList(checkpoints: readonly WorkspaceCheckpoint[]): string {
+  const lines = [
+    'No completed turns recorded this run yet — falling back to workspace checkpoints (FILES ONLY, no conversation state):',
+    ...checkpoints.slice(0, 20).map((cp, i) => `  ${String(i + 1).padStart(2)}. ${shortId(cp.id).padEnd(12)} ${cp.kind.padEnd(9)} ${cp.label}  (${formatAge(cp.createdAt)})`),
+    'Restore one: /rewind <n|id> — files only; conversation history is untouched.',
+  ];
+  return lines.join('\n');
+}
+
+/** Resolve a user ref ('1'..'N' newest-first, or a checkpoint id / id prefix) to a checkpoint. */
+function resolveCheckpointRef(checkpoints: readonly WorkspaceCheckpoint[], ref: string): WorkspaceCheckpoint | { error: string } {
+  if (/^\d+$/.test(ref)) {
+    const idx = Number(ref) - 1;
+    const cp = checkpoints[idx];
+    return cp ? cp : { error: `No checkpoint #${ref}. Run /rewind to list checkpoints (1–${checkpoints.length}).` };
+  }
+  const exact = checkpoints.find((cp) => cp.id === ref);
+  if (exact) return exact;
+  const prefix = checkpoints.filter((cp) => cp.id.startsWith(ref) || shortId(cp.id).startsWith(ref));
+  if (prefix.length === 1) return prefix[0]!;
+  if (prefix.length > 1) return { error: `Checkpoint ref "${ref}" is ambiguous (${prefix.length} matches). Use the list number instead.` };
+  return { error: `Unknown checkpoint ref "${ref}". Run /rewind to list checkpoints.` };
+}
+
+/**
+ * Handles bare `/rewind` and `/rewind <ref>` when this run has recorded no
+ * turn anchors at all. Returns true if it handled the invocation (always,
+ * once called), false is never returned — kept boolean-shaped only to mirror
+ * the calling convention at the call site.
+ */
+async function handleCheckpointOnlyRewind(args: string[], ctx: CommandContext): Promise<void> {
+  const mgr = ctx.workspace.workspaceCheckpointManager;
+  if (!mgr) {
+    ctx.print(CHECKPOINT_FALLBACK_NO_ANCHORS_MESSAGE);
+    return;
+  }
+  let checkpoints: WorkspaceCheckpoint[];
+  try {
+    checkpoints = await mgr.list();
+  } catch {
+    checkpoints = [];
+  }
+  if (checkpoints.length === 0) {
+    ctx.print(CHECKPOINT_FALLBACK_NO_ANCHORS_MESSAGE);
+    return;
+  }
+
+  if (args.length === 0) {
+    ctx.print(renderCheckpointFallbackList(checkpoints));
+    return;
+  }
+
+  const resolved = resolveCheckpointRef(checkpoints, args[0]!);
+  if ('error' in resolved) {
+    ctx.print(resolved.error);
+    return;
+  }
+  const checkpoint = resolved;
+
+  const { DiffPanel } = await import('../../panels/diff-panel.ts');
+  const pm = requirePanelManager(ctx);
+  let panel = pm.getAllOpen().find((p) => p.id === 'diff');
+  if (!panel) {
+    try { panel = pm.open('diff'); } catch { ctx.print('Could not open diff panel.'); return; }
+  }
+  pm.activateById('diff');
+  if (!pm.isVisible()) pm.show();
+  ctx.focusPanels?.();
+  const diffPanel = panel as InstanceType<typeof DiffPanel>;
+
+  try {
+    const diff = await mgr.diff(checkpoint.id);
+    if (diff.unifiedDiff.trim()) diffPanel.loadRawDiff(diff.unifiedDiff);
+    else diffPanel.showDiff('(no file changes)', '@@ -0,0 +0,0 @@\n Working tree already matches this checkpoint.');
+  } catch {
+    diffPanel.showDiff('(preview unavailable)', '@@ -0,0 +0,0 @@\n Could not load the checkpoint diff.');
+  }
+
+  diffPanel.confirmOverlay.arm({
+    id: checkpoint.id,
+    label: `${checkpoint.label} — restore FILES ONLY (no conversation state this run)`,
+    verb: 'Restore',
+    onConfirm: async () => {
+      try {
+        await mgr.restore(checkpoint.id, { safetyCheckpoint: true });
+        ctx.session.conversationManager.addTypedSystemMessage(
+          `[Rewind] Restored files from checkpoint ${shortId(checkpoint.id)} ("${checkpoint.label}"). Files only — no turn anchors exist this run, so conversation state is unchanged.`,
+          'operational',
+        );
+        pm.close('diff');
+        ctx.focusPrompt?.();
+        ctx.renderRequest();
+      } catch (err) {
+        ctx.print(`Checkpoint restore failed: ${summarizeError(err)}`);
+      }
+    },
+    onCancel: () => {
+      ctx.print('Restore cancelled — nothing changed.');
+      pm.close('diff');
+      ctx.focusPrompt?.();
+      ctx.renderRequest();
+    },
+  });
+
+  ctx.print(`Previewing checkpoint restore: "${checkpoint.label}" (FILES ONLY — no conversation state this run). Confirm in the diff panel: Enter/y to restore, n/Esc to cancel.`);
+  ctx.renderRequest();
+}
+
 // ---------------------------------------------------------------------------
 // Command registration
 // ---------------------------------------------------------------------------
@@ -244,6 +366,15 @@ export function registerRewindRuntimeCommands(registry: CommandRegistry): void {
     handler: async (args, ctx: CommandContext) => {
       const sessionId = ctx.session.runtime.sessionId;
 
+      // No turn anchors recorded this run (most commonly: right after a
+      // restart, before /session resume has restored any) — fall back to a
+      // files-only restore over the real workspace checkpoints instead of a
+      // dead end (see handleCheckpointOnlyRewind's header doc).
+      if (recentTurnsNewestFirst(sessionId).length === 0) {
+        await handleCheckpointOnlyRewind(args, ctx);
+        return;
+      }
+
       if (args.length === 0) {
         ctx.print(renderTurnList(sessionId));
         return;

package/src/input/commands/runtime-services.ts

@@ -12,7 +12,7 @@ import type { CompactionContext, CompactionEvent } from '@pellux/goodvibes-sdk/p
 import { recordCompactionQualityScore, scoreCompactionRun } from '../../renderer/compaction-quality.ts';
 import type { CompactionQualityScore } from '../../renderer/compaction-quality.ts';
 import type { UiReadModels } from '../../runtime/ui-read-models.ts';
-import type { ShellPathService } from '@/runtime/index.ts';
+import type { ShellPathService, SessionSurface } from '@/runtime/index.ts';
 import type { EcosystemCatalogPathOptions } from '@/runtime/index.ts';
 import type { PluginPathOptions } from '../../plugins/loader';
 import type { DirectTransport } from '@/runtime/index.ts';
@@ -72,6 +72,16 @@ export function requireShellPaths(context: Pick<CommandContext, 'workspace'>): S
   return requireContextValue(context.workspace.shellPaths, 'workspace.shellPaths');
 }
 
+/**
+ * The runtime's declare-once session-storage handle. Commands that touch
+ * session state take their paths from here rather than rebuilding a scope out
+ * of shellPaths, so a command and the runtime that wrote the file always agree
+ * on where it lives.
+ */
+export function requireSurface(context: Pick<CommandContext, 'workspace'>): SessionSurface {
+  return requireContextValue(context.workspace.surface, 'workspace.surface');
+}
+
 export function requireEcosystemCatalogPaths(
   context: CommandContext,
 ): EcosystemCatalogPathOptions {

package/src/input/commands/secret-runtime.ts

@@ -21,7 +21,7 @@ function toEnvVarName(raw: string): string {
 export function registerSecretRuntimeCommands(registry: CommandRegistry): void {
   registry.register({
     name: 'secret',
-    description: 'Enter a secret with concealed (masked) input and store it as an environment variable — plaintext never enters the transcript',
+    description: 'Quick one-off: type a value with masked input, stored as an env var for THIS session only (persistent storage + providers: /secrets)',
     usage: '/secret <NAME>',
     argsHint: '<NAME>',
     handler(args, ctx) {

package/src/input/commands/session-content.ts

@@ -9,6 +9,7 @@ import { requireSessionManager, requireSessionMemoryStore, requireShellPaths } f
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 import { sessionCommand } from './session.ts';
 import { undoLastRewind, redoLastRewind } from './rewind-runtime.ts';
+import { filterUserFacingSessions } from './session-picker-filter.ts';
 
 export function registerSessionContentCommands(registry: CommandRegistry): void {
   registry.register({
@@ -113,6 +114,10 @@ export function registerSessionContentCommands(registry: CommandRegistry): void
         model: ctx.session.runtime.model,
         provider: ctx.session.runtime.provider,
         timestamp: Date.now(),
+        // `/save` is the user asking to keep this conversation. Stamped so
+        // the session-conversations retention sweep never expires it, unlike
+        // the automatic per-turn snapshot (turn-event-wiring.ts, 'auto').
+        saveSource: 'user' as const,
       };
       try {
         const agentManager = ctx.ops.agentManager;
@@ -263,7 +268,10 @@ export function registerSessionContentCommands(registry: CommandRegistry): void
         return;
       }
       const sessionManager = requireSessionManager(ctx);
-      const sessions = sessionManager.list();
+      // Excludes subagent-shaped transcripts (see session-picker-filter.ts) —
+      // an unfiltered list here drowns real user sessions in spawned-agent
+      // noise. A direct `/sessions resume agent-xxxxxxxx` still reaches them.
+      const sessions = filterUserFacingSessions(sessionManager.list());
       if (ctx.openSelection) {
         const deleteAction = new Map([['d', 'delete' as const]]);
         const items: SelectionItem[] = sessions.length === 0

package/src/input/commands/session-picker-filter.ts

@@ -0,0 +1,28 @@
+/**
+ * session-picker-filter.ts — keep subagent transcripts out of user-facing
+ * session pickers.
+ *
+ * Subagents spawned during a session get their own SessionManager-persisted
+ * transcript, named `agent-<id>` (see the SDK's agent manager, which mints
+ * ids as `agent-${uuid.slice(0, 8)}`). Those files are real, loadable
+ * sessions — useful for forensic/debugging access — but they are not
+ * sessions a user ever started, and in a workspace with many spawned agents
+ * they drown the handful of sessions the user actually wants to pick from
+ * in `/resume` and `/sessions`.
+ *
+ * Both pickers filter agent-shaped entries out of the LIST/BROWSE view only.
+ * Direct resume by exact id/name (`/resume agent-xxxxxxxx`, `/session resume
+ * agent-xxxxxxxx`) is untouched and still reaches them — this only affects
+ * what shows up when the id isn't already known.
+ */
+import type { SessionInfo } from '@pellux/goodvibes-sdk/platform/sessions';
+
+/** Whether a saved session's name follows the subagent-transcript naming convention. */
+export function isAgentSessionName(name: string): boolean {
+  return name.startsWith('agent-');
+}
+
+/** Filter a session list down to user-facing (non-subagent) entries. */
+export function filterUserFacingSessions<T extends Pick<SessionInfo, 'name'>>(sessions: readonly T[]): T[] {
+  return sessions.filter((s) => !isAgentSessionName(s.name));
+}