@pellux/goodvibes-tui 1.19.6 → 1.20.0

package/src/input/commands/session-workflow.ts

@@ -6,9 +6,9 @@ import type { TranscriptEventKind } from '@pellux/goodvibes-sdk/platform/core';
 import type { ConversationTitleSource } from '../../core/conversation';
 import type { SessionReturnContextSummary } from '@/runtime/index.ts';
 import { formatReturnContextForDisplay, getReturnContextMode, maybeAssistReturnContextSummary } from '@/runtime/index.ts';
-import { requirePanelManager, requireProviderApi, requireSessionManager, requireShellPaths } from './runtime-services.ts';
-import { replayJournalForSession } from '../../core/session-recovery.ts';
-import { restoreTurnAnchors } from '../../core/rewind-turn-anchors.ts';
+import { requirePanelManager, requireProviderApi, requireSessionManager, requireSurface } from './runtime-services.ts';
+import { resumeSessionCore, reopenPanelsWithModalSkip, DEFAULT_PANEL_REOPEN_LIMIT } from '../../core/session-resume-core.ts';
+import { checkSessionLiveness } from '../../runtime/session-liveness-marker.ts';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 
 function parseTranscriptKind(raw: string | undefined): TranscriptEventKind | 'all' {
@@ -83,32 +83,20 @@ function buildTranscriptReviewLines(
 // Exported (test-only concern) so the MIGRATE-TO-MODAL redirect-skip honesty
 // (W6 review, finding 3: saved-layout restore with 'sessions' must not lie)
 // can be unit-tested directly instead of through a full /resume harness.
+// Delegates to the shared reopenPanelsWithModalSkip (core/session-resume-core.ts)
+// — the same routine resumeSessionCore uses — so this standalone entry point
+// and the canonical resume sequence can never diverge on panel-reopen behavior.
 export function reopenPanelsFromReturnContext(ctx: CommandContext, summary: SessionReturnContextSummary | undefined): string[] {
   if (!summary?.openPanels || summary.openPanels.length === 0) return [];
   const panelManager = requirePanelManager(ctx);
-  const reopened: string[] = [];
-  const movedToModal: string[] = [];
-  for (const panelId of summary.openPanels.slice(0, 4)) {
-    // (the purge): a MIGRATE-TO-MODAL id has no panel to restore — a modal
-    // is not part of the saved panel layout. Skip it (don't pop a modal
-    // mid-resume) and note it once, rather than firing openModal + revealing an
-    // empty workspace during resume.
-    if (panelManager.getModalRedirect(panelId) !== undefined) {
-      movedToModal.push(panelId);
-      continue;
-    }
-    try {
-      panelManager.open(panelId);
-      reopened.push(panelId);
-    } catch {
-      // Ignore unknown or currently unavailable panel ids during resume.
-    }
-  }
-  if (reopened.length > 0) panelManager.show();
+  const { reopened, movedToModal, notReopened } = reopenPanelsWithModalSkip(panelManager, summary.openPanels, DEFAULT_PANEL_REOPEN_LIMIT);
   if (movedToModal.length > 0) {
     ctx.print(`Note: ${movedToModal.join(', ')} moved to a modal — reopen via its command instead of as a panel.`);
   }
-  return reopened;
+  if (notReopened.length > 0) {
+    ctx.print(`  …and ${notReopened.length} more not reopened (/panels to open)`);
+  }
+  return [...reopened];
 }
 
 function printSessionExport(
@@ -198,7 +186,9 @@ export async function handleSessionWorkflowCommand(args: string[], ctx: CommandC
           session.returnContext.activeTasks ? `active=${session.returnContext.activeTasks}` : null,
           session.returnContext.blockedTasks ? `blocked=${session.returnContext.blockedTasks}` : null,
           session.returnContext.pendingApprovals ? `approvals=${session.returnContext.pendingApprovals}` : null,
-          session.returnContext.openPanels?.length ? `panels=${session.returnContext.openPanels.slice(0, 3).join(',')}` : null,
+          session.returnContext.openPanels?.length
+            ? `panels=${session.returnContext.openPanels.slice(0, 3).join(',')}${session.returnContext.openPanels.length > 3 ? ` (+${session.returnContext.openPanels.length - 3} more)` : ''}`
+            : null,
         ].filter(Boolean).join('  ');
         if (posture) lines.push(`     posture: ${posture}`);
       }
@@ -222,6 +212,10 @@ export async function handleSessionWorkflowCommand(args: string[], ctx: CommandC
           model: ctx.session.runtime.model,
           provider: ctx.session.runtime.provider,
           timestamp: Date.now(),
+          // Naming a session is an act of curation, so the file this
+          // materializes for rename to act on is a user save, not machinery —
+          // the retention sweep must not expire something the user named.
+          saveSource: 'user',
         });
       }
       sm.rename(ctx.session.runtime.sessionId, newName);
@@ -235,9 +229,13 @@ export async function handleSessionWorkflowCommand(args: string[], ctx: CommandC
   }
 
   if (sub === 'resume') {
-    const target = args.slice(1).join(' ').trim();
+    // '--force' bypasses the multi-instance liveness confirm below — never a
+    // session-id/name token itself (session ids never start with '--').
+    const rawArgs = args.slice(1);
+    const force = rawArgs.includes('--force');
+    const target = rawArgs.filter((a) => a !== '--force').join(' ').trim();
     if (!target) {
-      ctx.print('Usage: /session resume <session-id-or-name>');
+      ctx.print('Usage: /session resume <session-id-or-name> [--force]');
       return true;
     }
     const sessions = sm.list();
@@ -250,56 +248,36 @@ export async function handleSessionWorkflowCommand(args: string[], ctx: CommandC
       ctx.print(`Session not found: ${target}\nUse /session list to see available sessions.`);
       return true;
     }
-    try {
-      const { meta, messages } = sm.load(found.name);
-      const providerApi = requireProviderApi(ctx);
-      ctx.session.conversationManager.resetAll();
-      ctx.session.conversationManager.fromJSON({ messages: messages as never[], title: meta.title, titleSource: meta.titleSource });
-      ctx.session.conversationManager.rebuildHistory();
-      ctx.session.runtime.sessionId = found.name;
 
-      // Restore the resumed session's message-anchored rewind anchors from its
-      // sidecar so /rewind works identically before and after the resume. The
-      // in-memory registry is process-local, so a fresh process would otherwise
-      // start with no anchors for the loaded session.
-      const restoredAnchorCount = restoreTurnAnchors(found.name, requireShellPaths(ctx).workingDirectory);
+    // Multi-instance safety: warn (and require --force) when this session
+    // looks open in another still-running terminal right now — resuming it
+    // here would fork its live state out from under that other instance.
+    // Best-effort: a missing/stale marker (or this process's OWN marker,
+    // e.g. re-resuming the session already active here) never blocks anything.
+    const liveness = checkSessionLiveness(requireSurface(ctx), found.name);
+    if (liveness.live && liveness.pid !== process.pid && !force) {
+      ctx.print(
+        `Session appears open in another terminal (pid ${liveness.pid}) — resuming will fork its live state.\n` +
+        `Re-run \`/session resume ${found.name} --force\` to proceed anyway.`,
+      );
+      return true;
+    }
 
-      // Journal replay: recover turns that post-date the loaded snapshot.
-      const shellPaths = requireShellPaths(ctx);
-      const journalReplay = replayJournalForSession({
-        homeDirectory: shellPaths.homeDirectory,
-        snapshotTimestamp: meta.timestamp,
+    try {
+      const providerApi = requireProviderApi(ctx);
+      const outcome = await resumeSessionCore(found.name, {
+        sessionManager: sm,
         conversation: ctx.session.conversationManager,
-        sessionId: found.name,
-        persistSnapshot: (replayedMessages) => {
-          sm.save(found.name, replayedMessages as never[], {
-            title: ctx.session.conversationManager.title || meta.title,
-            model: meta.model,
-            provider: meta.provider,
-            timestamp: Date.now(),
-            titleSource: meta.titleSource,
-            returnContext: meta.returnContext,
-          });
-        },
+        runtime: ctx.session.runtime,
+        surface: requireSurface(ctx),
+        panelManager: requirePanelManager(ctx),
+        selectModel: (model) => providerApi.selectModel(model),
+        hydrateSessionUsage: ctx.session.hydrateSessionUsage,
       });
-      // Hydrate the footer's token counters from the resumed (+ journal-replayed)
-      // history now, before ctx.renderRequest() below.
-      ctx.session.hydrateSessionUsage?.();
+      const { meta, journalReplay, restoredAnchorCount, resumedMessageCount, panels } = outcome;
 
-      if (meta.model) {
-        try {
-          const selected = await providerApi.selectModel(meta.model);
-          ctx.session.runtime.model = selected.registryKey;
-          ctx.session.runtime.provider = selected.providerId;
-        } catch {
-          ctx.session.runtime.model = meta.model;
-          // model may not exist locally
-        }
-      }
-      if (meta.provider) ctx.session.runtime.provider = meta.provider;
       ctx.renderRequest();
-      const resumedMsgCount = ctx.session.conversationManager.getMessageCount();
-      ctx.print(`Resumed session: ${found.name}\n  Name: ${meta.title || '(untitled)'}\n  Messages: ${resumedMsgCount}\n  Model: ${meta.model || ctx.session.runtime.model}`);
+      ctx.print(`Resumed session: ${found.name}\n  Name: ${meta.title || '(untitled)'}\n  Messages: ${resumedMessageCount}\n  Model: ${meta.model || ctx.session.runtime.model}`);
       if (restoredAnchorCount > 0) {
         ctx.print(`  Rewind: restored ${restoredAnchorCount} turn anchor(s) — /rewind is available for this resumed session.`);
       }
@@ -311,14 +289,19 @@ export async function handleSessionWorkflowCommand(args: string[], ctx: CommandC
       } else if (journalReplay.hadCorruptTail) {
         ctx.print('  [Recovery] Journal tail was partially corrupt (quarantined). Replay stopped at last good record.');
       }
-      const reopenedPanels = reopenPanelsFromReturnContext(ctx, meta.returnContext);
+      if (panels.movedToModal.length > 0) {
+        ctx.print(`Note: ${panels.movedToModal.join(', ')} moved to a modal — reopen via its command instead of as a panel.`);
+      }
+      if (panels.notReopened.length > 0) {
+        ctx.print(`  …and ${panels.notReopened.length} more not reopened (/panels to open)`);
+      }
       const returnContextMode = getReturnContextMode(ctx.platform.configManager);
       if (returnContextMode !== 'off' && meta.returnContext) {
         for (const line of formatReturnContextForDisplay(meta.returnContext)) {
           ctx.print(`  ${line}`);
         }
-        if (reopenedPanels.length > 0) {
-          ctx.print(`  Reopened panels: ${reopenedPanels.join(', ')}`);
+        if (panels.reopened.length > 0) {
+          ctx.print(`  Reopened panels: ${panels.reopened.join(', ')}`);
         }
         if ((meta.returnContext.remoteRunners?.length ?? 0) > 0) {
           ctx.print(`  Remote re-entry: /remote recover ${meta.returnContext.remoteRunners![0]}`);
@@ -354,6 +337,8 @@ export async function handleSessionWorkflowCommand(args: string[], ctx: CommandC
       timestamp: Date.now(),
       titleSource: exportData.titleSource,
       returnContext: exportData.returnContext,
+      // The operator asked for this fork by name; it is not turn machinery.
+      saveSource: 'user',
     };
     try {
       sm.save(newId, messages, meta);
@@ -378,6 +363,10 @@ export async function handleSessionWorkflowCommand(args: string[], ctx: CommandC
       timestamp: Date.now(),
       titleSource: exportData.titleSource,
       returnContext: exportData.returnContext,
+      // The one unambiguous "keep this" act in the app. Marked so the
+      // session-conversations retention sweep never expires it, unlike the
+      // automatic per-turn snapshot (turn-event-wiring.ts, saveSource 'auto').
+      saveSource: 'user',
     };
     try {
       const { filePath, sanitizedName } = sm.save(rawName, messages, meta);

package/src/input/commands/session.ts

@@ -22,6 +22,7 @@ import type { CancellationScope, CrossSessionTaskRef } from '@pellux/goodvibes-s
 import { VALID_SCOPES } from '@pellux/goodvibes-sdk/platform/sessions';
 import { handleSessionWorkflowCommand } from './session-workflow.ts';
 import { requireSessionOrchestration, requireSessionManager } from './runtime-services.ts';
+import { filterUserFacingSessions } from './session-picker-filter.ts';
 
 // ── Argument parsing helpers ──────────────────────────────────────────────────
 
@@ -316,6 +317,37 @@ function handleCancel(args: string[], context: CommandContext): void {
 
 // ── Top-level command definition ───────────────────────────────────────────────
 
+/**
+ * SESSION_SUBCOMMAND_ARG_HINTS — the single source of truth for each
+ * `/session <subcommand>` argument hint, co-located with the switch below so
+ * the two can't silently drift apart (command-args-hint.ts imports this
+ * directly instead of hand-maintaining its own copy; a drift test —
+ * src/test/input/command-args-hint.test.ts — cross-checks every key here
+ * against the default usage text's own subcommand list). Aliases (`link`,
+ * `ho`, `g`) share their canonical subcommand's hint text.
+ */
+export const SESSION_SUBCOMMAND_ARG_HINTS: Record<string, string> = {
+  list: '',
+  rename: '<name>',
+  resume: '<id|name>',
+  fork: '[name]',
+  save: '[name]',
+  info: '[id]',
+  export: '<id|.> [markdown|text]',
+  search: '<query>',
+  delete: '<id>',
+  events: '[kind]',
+  groups: '[kind]',
+  hotspots: '',
+  'link-task': '<taskId> [--session <sid>] [--depends-on <sid:taskId>] [--label <label>]',
+  link: '<taskId> [--session <sid>] [--depends-on <sid:taskId>] [--label <label>]',
+  handoff: '<taskId> --to <sid> [--session <sid>] [--reason <reason>]',
+  ho: '<taskId> --to <sid> [--session <sid>] [--reason <reason>]',
+  graph: '[--session <sid>] [--format text|json]',
+  g: '[--session <sid>] [--format text|json]',
+  cancel: '<taskId> [--scope task|subtree|session] [--session <sid>] [--reason <reason>]',
+};
+
 /**
  * sessionCommand — The `/session` slash command.
  *
@@ -446,7 +478,10 @@ export const resumeCommand: SlashCommand = {
       return;
     }
     const sm = requireSessionManager(ctx);
-    const sessions = sm.list().filter((s) => s.name !== ctx.session.runtime.sessionId);
+    // Excludes the current session and subagent-shaped transcripts (see
+    // session-picker-filter.ts) — a direct `/resume agent-xxxxxxxx` still
+    // reaches them, this only keeps the picker itself readable.
+    const sessions = filterUserFacingSessions(sm.list()).filter((s) => s.name !== ctx.session.runtime.sessionId);
     if (sessions.length === 0) {
       ctx.print('No previous sessions to resume yet. /session save [name] stores the current one explicitly.');
       return;

package/src/input/commands/shell-core.ts

@@ -71,7 +71,20 @@ export function registerShellCoreCommands(registry: CommandRegistry): void {
         ctx.openShortcutsOverlay();
         return;
       }
-      ctx.print('Use ? key or /help for shortcuts');
+      ctx.print('Use /commands for shortcuts');
+    },
+  });
+
+  registry.register({
+    name: 'find',
+    aliases: ['findtext'],
+    description: 'Search THIS conversation transcript (same as Ctrl+F) — searching the web instead? use /search',
+    handler(_args, ctx) {
+      if (ctx.openTranscriptSearch) {
+        ctx.openTranscriptSearch();
+        return;
+      }
+      ctx.print('Transcript search is not available in this context — try Ctrl+F.');
     },
   });
 
@@ -81,10 +94,18 @@ export function registerShellCoreCommands(registry: CommandRegistry): void {
     description: 'List current keyboard bindings and their config file path',
     handler(_args, ctx) {
       const km = requireKeybindingsManager(ctx);
+      // The full binding table (~45 rows) is presented via the same
+      // generated, scrollable overlay /shortcuts opens (see
+      // renderShortcutsOverlay) rather than a one-shot transcript dump —
+      // the file path (dynamic, per-user) still gets a short transcript
+      // line since the overlay itself doesn't show it.
+      ctx.print(`Keybindings config: ${km.getConfigPath()}  (create it to override any binding: { "action": { "key": "x", "ctrl": true } })`);
+      if (ctx.openShortcutsOverlay) {
+        ctx.openShortcutsOverlay();
+        return;
+      }
       const all = km.getAll();
       const lines: string[] = [
-        `Keybindings config: ${km.getConfigPath()}`,
-        '',
         `  ${'Action'.padEnd(28)}  ${'Binding'.padEnd(20)}  Description`,
         `  ${'─'.repeat(28)}  ${'─'.repeat(20)}  ${'─'.repeat(34)}`,
       ];
@@ -92,8 +113,6 @@ export function registerShellCoreCommands(registry: CommandRegistry): void {
         const label = combos.map((combo) => km.formatCombo(combo)).join(', ');
         lines.push(`  ${action.padEnd(28)}  ${label.padEnd(20)}  ${description}`);
       }
-      lines.push('');
-      lines.push('To customize: create the config file with { "action": { "key": "x", "ctrl": true } }');
       ctx.print(lines.join('\n'));
     },
   });
@@ -114,6 +133,39 @@ export function registerShellCoreCommands(registry: CommandRegistry): void {
     },
   });
 
+  registry.register({
+    name: 'pastes',
+    aliases: ['pending-pastes'],
+    description: 'Preview the actual content behind each [TEXT: pN, M lines] fold in the composer, before you submit',
+    usage: '[pN]',
+    argsHint: '[pN]',
+    handler(args, ctx) {
+      const pending = ctx.getPendingPastes?.();
+      if (!pending || pending.size === 0) {
+        ctx.print('[Pastes] No folded pastes are currently in the composer (pastes over 8 lines fold to [TEXT: pN, M lines]).');
+        return;
+      }
+      const requestedId = args[0]?.trim();
+      if (requestedId) {
+        const content = pending.get(requestedId);
+        if (!content) {
+          ctx.print(`[Pastes] No pending paste with id "${requestedId}". Pending: ${[...pending.keys()].join(', ')}`);
+          return;
+        }
+        ctx.print(`[Pastes] ${requestedId} (${content.split('\n').length} lines):\n${content}`);
+        return;
+      }
+      const lines = ['[Pastes] Folded in the composer right now:'];
+      for (const [id, content] of pending) {
+        const contentLines = content.split('\n');
+        const preview = contentLines[0].slice(0, 80);
+        lines.push(`  ${id} — ${contentLines.length} lines — ${preview}${contentLines.length > 1 || preview.length < contentLines[0].length ? '…' : ''}`);
+      }
+      lines.push('', 'Full text: /pastes <id>');
+      ctx.print(lines.join('\n'));
+    },
+  });
+
   registry.register({
     name: 'help',
     aliases: ['h', '?'],

package/src/input/commands/update-runtime.ts

@@ -82,6 +82,91 @@ async function downloadText(fetchImpl: UpdateFetchLike, url: string): Promise<st
   return await response.text();
 }
 
+/**
+ * Where cancellation stops being allowed. An update is genuinely abortable up
+ * to and including the moment BEFORE the first file is written: every fetch on
+ * the way there carries the caller's signal, and every await boundary re-checks
+ * it. From the first write onward the swap owns the installed files and always
+ * runs to completion — a half-applied swap is the one outcome worse than a slow
+ * one.
+ *
+ * This record makes that boundary readable from outside the call. The launch
+ * updater gives `applyUpdate` a budget and abandons the promise when it runs
+ * out, so it cannot learn from the return value which side of the line the work
+ * was on — it reads these flags instead, and prints the receipt that is
+ * actually true (see src/cli/launch-auto-update.ts).
+ */
+export interface UpdateSwapProgress {
+  /** True from the first file write of the swap phase; from here the swap is never interrupted. */
+  begun: boolean;
+  /** True once every target file has been swapped into place and the update is fully installed. */
+  committed: boolean;
+  /** The release tag being installed, set as soon as the target is resolved (before any download). */
+  targetTag: string | null;
+}
+
+export function createUpdateSwapProgress(): UpdateSwapProgress {
+  return { begun: false, committed: false, targetTag: null };
+}
+
+/** The failure an aborted update ends with — raised only while nothing has been written yet. */
+export const UPDATE_ABORTED_MESSAGE = 'update cancelled before any file was replaced';
+
+function throwIfAborted(signal: AbortSignal | undefined): void {
+  if (signal?.aborted) {
+    throw new Error(UPDATE_ABORTED_MESSAGE);
+  }
+}
+
+/**
+ * The shared UpdateFetchLike init shape predates cancellation, so the signal
+ * rides on a widened version of it: the real `fetch` reads it — which is what
+ * makes the DOWNLOAD itself cancellable rather than merely abandoned — and a
+ * test stub that ignores the extra field behaves exactly as it did before.
+ */
+type AbortableFetchInit = NonNullable<Parameters<UpdateFetchLike>[1]> & { signal?: AbortSignal };
+
+function abortableFetch(fetchImpl: UpdateFetchLike, signal: AbortSignal | undefined): UpdateFetchLike {
+  if (!signal) return fetchImpl;
+  const withSignal = fetchImpl as (url: string, init?: AbortableFetchInit) => ReturnType<UpdateFetchLike>;
+  return async (url, init) => {
+    throwIfAborted(signal);
+    return await withSignal(url, { ...init, signal });
+  };
+}
+
+/**
+ * Wraps the filesystem seam so the first MUTATING call flips `begun`. The swap
+ * phase is the only part of the apply path that writes anything, so that first
+ * write is exactly the point after which cancellation must no longer be
+ * honoured. Reads (the daemon-present probe, the target-exists check inside the
+ * swap) leave the flag alone.
+ */
+function trackSwapProgress(io: UpdateFileIo, progress: UpdateSwapProgress): UpdateFileIo {
+  const begin = (): void => {
+    progress.begun = true;
+  };
+  return {
+    writeFile: (path, data) => {
+      begin();
+      io.writeFile(path, data);
+    },
+    rename: (from, to) => {
+      begin();
+      io.rename(from, to);
+    },
+    chmod: (path, mode) => {
+      begin();
+      io.chmod(path, mode);
+    },
+    mkdir: (path) => {
+      begin();
+      io.mkdir(path);
+    },
+    exists: (path) => io.exists(path),
+  };
+}
+
 /**
  * Suffix under which every swap keeps the file it replaced — re-exported
  * from the SDK's canonical update policy module so rollback and swap share
@@ -153,6 +238,16 @@ export interface ApplyUpdateOptions {
   readonly runCommand?: RunCommand;
   /** Injectable filesystem seam (the SDK's UpdateFileIo) so tests observe swaps in memory. */
   readonly io?: UpdateFileIo;
+  /**
+   * Cancels the update — for real: it is passed to every fetch in the path and
+   * re-checked at every await boundary, so an abort stops the download instead
+   * of leaving it running unwatched. Honoured only up to the moment before the
+   * swap begins; from the first file write onward it is deliberately ignored
+   * (see UpdateSwapProgress).
+   */
+  readonly signal?: AbortSignal;
+  /** Shared record letting the caller tell a cancelled update apart from one whose swap had already started. */
+  readonly progress?: UpdateSwapProgress;
 }
 
 /**
@@ -178,7 +273,14 @@ export async function applyUpdate(options: ApplyUpdateOptions): Promise<void> {
     return;
   }
 
-  const latestTag = await resolveLatestReleaseTag(options.fetchImpl, REPO_RELEASES_LATEST_URL);
+  // Every network call from here carries the caller's signal, so an abort
+  // cancels the request in flight rather than orphaning it.
+  const signal = options.signal;
+  const progress = options.progress;
+  const fetchImpl = abortableFetch(options.fetchImpl, signal);
+
+  throwIfAborted(signal);
+  const latestTag = await resolveLatestReleaseTag(fetchImpl, REPO_RELEASES_LATEST_URL);
   if (compareVersions(options.currentVersion, latestTag) >= 0) {
     options.print(`Already current: running v${normalizeVersion(options.currentVersion)}, latest release is ${latestTag}.`);
     return;
@@ -190,6 +292,10 @@ export async function applyUpdate(options: ApplyUpdateOptions): Promise<void> {
     return;
   }
 
+  // Named before the first download, so a caller that gives up on a slow apply
+  // can still report WHICH version the work was installing.
+  if (progress) progress.targetTag = latestTag;
+
   options.print(`Update available: ${latestTag} (running v${normalizeVersion(options.currentVersion)}). Downloading and verifying...`);
 
   const baseUrl = releaseDownloadBaseUrl(latestTag);
@@ -209,7 +315,8 @@ export async function applyUpdate(options: ApplyUpdateOptions): Promise<void> {
   // file is refreshed for consistency even though the platform blocks extension
   // loading. This inclusion decision needs one manifest pre-read; the swap
   // itself re-verifies every included artifact inside applyVerifiedUpdate.
-  const checksumText = await downloadText(options.fetchImpl, `${baseUrl}/${CHECKSUM_MANIFEST_NAME}`);
+  throwIfAborted(signal);
+  const checksumText = await downloadText(fetchImpl, `${baseUrl}/${CHECKSUM_MANIFEST_NAME}`);
   const checksums = parseChecksumFile(checksumText);
   const addon = resolveSqliteVecAsset(options.platform, options.arch);
   const addonIncluded = addon !== null && checksums.get(addon.assetName) !== undefined;
@@ -230,13 +337,22 @@ export async function applyUpdate(options: ApplyUpdateOptions): Promise<void> {
   // One mechanism everywhere: downloads + verifies ALL targets before any
   // write, then swaps each atomically with the outgoing file kept at
   // `<path>.previous`.
+  //
+  // This is the last point at which the update can be called off. The
+  // downloads inside applyVerifiedUpdate are still cancellable (the signal
+  // rides on every request), but its swap loop is synchronous and runs to
+  // completion once its first write lands — which is precisely what
+  // `progress.begun` records, and why nothing below this call re-checks the
+  // signal.
+  throwIfAborted(signal);
   await applyVerifiedUpdate({
-    fetchImpl: options.fetchImpl,
+    fetchImpl,
     downloadBaseUrl: baseUrl,
     targets,
-    io,
+    io: progress ? trackSwapProgress(io, progress) : io,
     platform: options.platform,
   });
+  if (progress) progress.committed = true;
 
   const serviceInfo = detectDaemonServiceManaged(options.platform, options.configManager, options.runCommand);
 

package/src/input/commands/websearch-runtime.ts

@@ -35,7 +35,7 @@ function parseSearchArgs(args: string[]): ParsedSearchArgs {
 export function registerWebSearchRuntimeCommands(registry: CommandRegistry): void {
   registry.register({
     name: 'search',
-    description: 'Search the web and render ranked results with source labels',
+    description: 'Web search — ranked results with source labels (searching THIS transcript? use /find)',
     usage: '<query> [--limit <n>]',
     argsHint: '<query> [--limit <n>]',
     async handler(args, ctx) {