@pellux/goodvibes-tui 1.19.6 → 1.20.1

package/src/renderer/shell-surface.ts

@@ -19,6 +19,13 @@ export interface ShellFooterBuildOptions {
   readonly showExitNotice: boolean;
   readonly lastCopyTime: number;
   readonly model?: string;
+  /**
+   * Divergence marker appended to the model segment while the serving backend
+   * is not the user's configured selection (core/active-model-identity.ts),
+   * e.g. "failover from abacusai:route-llm". Absent/empty in the normal case,
+   * where the context-info line renders exactly as it always has.
+   */
+  readonly modelNote?: string;
   readonly toolCount?: number;
   readonly workingDir?: string;
   readonly provider?: string;
@@ -53,6 +60,14 @@ export interface ShellFooterBuildOptions {
    * below the context pressure hint.
    */
   readonly scriptableStatusLine?: string | null;
+  /**
+   * The one-key retry/switch-model affordance's transient hint text (see
+   * retry-affordance.ts). Rendered as its own line ABOVE the context
+   * pressure hint while armed; present here only means "show it now" — the
+   * caller is responsible for passing null the instant it disarms, so this
+   * is a time-bounded status line, never a lingering claim.
+   */
+  readonly retryHint?: string | null;
   /**
    * Compact footer posture for short terminals (~<30 rows). Collapses the
    * footer to its essentials (prompt box + token/cost line + help) and drops
@@ -104,6 +119,34 @@ const DIM_STATUS_FG = '#64748b';
  */
 let lastRenderedFooterHeight: { compact: boolean; height: number } | null = null;
 
+/**
+ * The wrapped-prompt shape the composer reports each frame — the subset
+ * promptCursorOffset needs (see InputHandler.getWrappedPromptInfo).
+ */
+export interface WrappedPromptCursorInfo {
+  readonly visibleLines: readonly string[];
+  readonly visibleCursorLine: number;
+  readonly visibleCursorCol: number;
+}
+
+/**
+ * Flatten a wrapped-prompt cursor position (line + column) into the single
+ * character offset createFooter's `cursorPos` expects, counting one separator
+ * per wrapped line. Returns undefined when the cursor is not on a visible line
+ * (scrolled out of the composer's window), which suppresses the cursor overlay
+ * rather than drawing it in the wrong place.
+ *
+ * Lives here rather than inline at the render site so main.ts (a composition
+ * root already at the source-line gate) stays a wiring file.
+ */
+export function promptCursorOffset(info: WrappedPromptCursorInfo): number | undefined {
+  if (info.visibleCursorLine < 0) return undefined;
+  const precedingChars = info.visibleLines
+    .slice(0, info.visibleCursorLine)
+    .reduce((sum: number, line: string) => sum + line.length + 1, 0);
+  return precedingChars + info.visibleCursorCol;
+}
+
 export function estimateShellFooterHeight(
   promptLineCount: number,
   contextWindow?: number,
@@ -150,6 +193,7 @@ export function buildShellFooter(
     options.permissionMode,
     options.webSurfaceUrl,
     options.powerKeepAwake,
+    options.modelNote,
   );
   // Compact posture drops the process indicator and context hint entirely so
   // the footer fits within ~5 rows on short terminals.
@@ -173,6 +217,13 @@ export function buildShellFooter(
       const hintLine = UIFactory.stringToLine(options.contextStatusHint, options.width, { fg: DIM_STATUS_FG });
       lines.unshift(hintLine);
     }
+    // Retry affordance — topmost of the passive hint lines while armed (an
+    // actionable, time-bounded prompt outranks the passive status hints
+    // below it); simply absent the instant it disarms.
+    if (options.retryHint) {
+      const retryLine = UIFactory.stringToLine(options.retryHint, options.width, { fg: DIM_STATUS_FG, bold: true });
+      lines.unshift(retryLine);
+    }
   }
   lastRenderedFooterHeight = { compact: options.compact ?? false, height: lines.length };
   return { lines, height: lines.length };

package/src/renderer/tool-result-expanded-lines.ts

@@ -0,0 +1,48 @@
+/**
+ * tool-result-expanded-lines.ts — the single source of truth for how many
+ * screen lines a tool-result message's EXPANDED form actually renders to.
+ *
+ * Tool-result content gets pretty-printed (JSON.stringify(parsed, null, 2))
+ * or diff-rendered before display, so the raw message's `content.split('\n')`
+ * length is not what the user sees once expanded — a one-line JSON blob can
+ * pretty-print to 50 lines. Both the per-block "N lines" badge
+ * (conversation-rendering.ts) and the folded-group total (conversation-tool-
+ * groups.ts) must count the SAME post-render lines, or the two disagree with
+ * each other and both can disagree with what Tab actually reveals.
+ */
+
+import type { Line } from '../types/grid.ts';
+import { renderMarkdownTracked } from './markdown.ts';
+import { renderDiffView } from './diff-view.ts';
+
+/** True when `content` looks like a unified diff (matches the detection used
+ *  by renderConversationToolMessage to pick the diff block type). */
+export function isDiffContent(content: string): boolean {
+  const contentLines = content.split('\n');
+  const hasDiffHeader = contentLines.some((l) => l.startsWith('--- ')) && contentLines.some((l) => l.startsWith('+++ '));
+  const hasHunk = contentLines.some((l) => l.startsWith('@@ '));
+  return hasDiffHeader && hasHunk;
+}
+
+/**
+ * Render a tool result's content exactly as its EXPANDED form would appear in
+ * the transcript (diff view for diffs; pretty-printed JSON, when parseable,
+ * for everything else). The caller decides whether to actually display these
+ * lines or just count them.
+ */
+export function renderExpandedToolResultLines(content: string, width: number): Line[] {
+  if (isDiffContent(content)) {
+    return renderDiffView(content, width);
+  }
+  let contentToRender = content;
+  const trimmed = contentToRender.trimStart();
+  if ((trimmed.startsWith('{') || trimmed.startsWith('[')) && contentToRender.length < 100_000) {
+    try {
+      const parsed = JSON.parse(contentToRender);
+      contentToRender = `\`\`\`json\n${JSON.stringify(parsed, null, 2)}\n\`\`\``;
+    } catch {
+      // Leave invalid JSON as-is — falls through to the plain markdown render below.
+    }
+  }
+  return renderMarkdownTracked(contentToRender, width).lines;
+}

package/src/renderer/ui-factory.ts

@@ -3,6 +3,7 @@ import { LAYOUT } from './layout.ts';
 import { VERSION } from '../version.ts';
 import { fitDisplay, getDisplayWidth, truncateDisplay, wrapText, interpolateColor, joinPrioritizedSegments, type PrioritizedSegment } from '../utils/terminal-width.ts';
 import type { GitHeaderInfo } from './git-status.ts';
+import { renderHeaderLine } from './header-line.ts';
 import { renderConversationFragment, renderConversationStatusLine, type ConversationStatusSegment } from './conversation-surface.ts';
 import { GLYPHS } from './ui-primitives.ts';
 import { activeUiTones } from './theme.ts';
@@ -42,22 +43,6 @@ export interface ThinkingStallInfo {
   readonly reconnect?: { readonly attempt: number; readonly maxAttempts: number };
 }
 
-/** Build the git segment string and its display width. Single source of truth for header layout. */
-function buildGitSegment(gitInfo: GitHeaderInfo): { text: string; width: number } {
-  const branch = ` git:${gitInfo.branch}`;
-  if (gitInfo.dirty) {
-    const text = `${branch} * `;
-    return { text, width: getDisplayWidth(text) };
-  }
-  if (gitInfo.ahead > 0 || gitInfo.behind > 0) {
-    const arrows = (gitInfo.ahead > 0 ? ` +${gitInfo.ahead}` : '') + (gitInfo.behind > 0 ? ` -${gitInfo.behind}` : '');
-    const text = `${branch}${arrows} `;
-    return { text, width: getDisplayWidth(text) };
-  }
-  const text = `${branch} `;
-  return { text, width: getDisplayWidth(text) };
-}
-
 /** Format a number: up to 999, then 1.0k, 1.0M, 1.0B, 1.0T */
 function fmtNum(n: number): string {
   return abbreviateCount(n, { bSuffix: true });
@@ -75,68 +60,19 @@ function fmtCost(usd: number): string {
  * UIFactory - Generates standard UI fragments without needing Ink/React overhead.
  */
 export class UIFactory {
-  // `version` defaults to the live build VERSION; tests pass a pinned fixture so
-  // golden snapshots don't break on every release bump (version-decoupled goldens,
-  // mirroring the splash fixture-version pattern).
-  public static createHeader(width: number, model: string, provider: string, title?: string, gitInfo?: GitHeaderInfo, version: string = VERSION): Line[] {
-    const lines: Line[] = [];
-    // Header/footer/thinking paint on the transparent terminal background, so
-    // they read chrome.* (light-terminal-aware) — NOT fg.*/state.*, which stay
-    // tuned for the opaque dark modal/panel boxes. Read live per render so a
-    // mode flip re-resolves without any module reload (see theme.ts).
-    const t = activeUiTones();
-    const CYAN = t.accent.brand;
-    const GREY = t.chrome.faint;
-    const TITLE_COLOR = t.chrome.label;
-    const brand = ` GoodVibes `;
-    const ver = `v${version} `;
-    const stats = ` ${model} `;
-    const prov = `(${provider}) `;
-    const line = createEmptyLine(width);
-    let curX = 0;
-    for (const char of brand) { line[curX++] = { char, fg: CYAN, bg: '', bold: true, dim: false, underline: false, italic: false, strikethrough: false }; }
-    for (const char of ver) { line[curX++] = { char, fg: GREY, bg: '', bold: false, dim: true, underline: false, italic: false, strikethrough: false }; }
-    // Optional conversation title — shown after brand/ver, truncated to fit
-    if (title) {
-      const titleStr = `│ ${title} `;
-      // Reserve space for git info (if present) + model/provider on the right
-      const gitReserved = gitInfo ? buildGitSegment(gitInfo).width : 0;
-      const rightReserved = getDisplayWidth(stats + prov) + gitReserved;
-      const maxTitleW = width - curX - rightReserved - 1;
-      let displayTitle: string;
-      if (getDisplayWidth(titleStr) <= maxTitleW) {
-        displayTitle = titleStr;
-      } else {
-        let truncated = '';
-        let w = 0;
-        for (const ch of titleStr) {
-          const cw = getDisplayWidth(ch);
-          if (w + cw > maxTitleW - 3) { truncated += '...'; break; }
-          truncated += ch;
-          w += cw;
-        }
-        displayTitle = truncated;
-      }
-      for (const char of displayTitle) { if (curX < width) line[curX++] = { char, fg: TITLE_COLOR, bg: '', bold: false, dim: true, underline: false, italic: false, strikethrough: false }; }
-    }
-    // Build git info segment
-    let gitStr = '';
-    let gitFg: string = t.chrome.faint;
-    if (gitInfo) {
-      gitStr = buildGitSegment(gitInfo).text;
-      if (gitInfo.dirty || gitInfo.ahead > 0 || gitInfo.behind > 0) {
-        gitFg = t.chrome.warn; // yellow when dirty or out-of-sync
-      }
-    }
-    const rightSideText = stats + prov;
-    const rightSideW = getDisplayWidth(rightSideText) + getDisplayWidth(gitStr);
-    let rightX = width - rightSideW;
-    for (const char of gitStr) { if (rightX >= 0 && rightX < width) line[rightX++] = { char, fg: gitFg, bg: '', bold: false, dim: !gitInfo?.dirty && !(gitInfo?.ahead || gitInfo?.behind), underline: false, italic: false, strikethrough: false }; }
-    for (const char of stats) { if (rightX < width) line[rightX++] = { char, fg: CYAN, bg: '', bold: true, dim: false, underline: false, italic: false, strikethrough: false }; }
-    for (const char of prov) { if (rightX < width) line[rightX++] = { char, fg: GREY, bg: '', bold: false, dim: true, underline: false, italic: false, strikethrough: false }; }
-    lines.push(line);
-    lines.push(this.stringToLine('━'.repeat(width), width, { fg: t.chrome.faint }));
-    return lines;
+  /**
+   * The header row. Delegates to renderHeaderLine (header-line.ts) — extracted
+   * when the header gained the failover divergence marker and this file was
+   * already on the 800-line source gate.
+   *
+   * `model`/`provider` are the SERVING backend and `note` the divergence
+   * marker, both resolved by core/active-model-identity.ts so the header and
+   * the footer answer "who is serving?" from one place. `version` defaults to
+   * the live build VERSION; tests pass a pinned fixture so golden snapshots
+   * don't break on every release bump.
+   */
+  public static createHeader(width: number, model: string, provider: string, title?: string, gitInfo?: GitHeaderInfo, version: string = VERSION, note: string = ''): Line[] {
+    return renderHeaderLine(width, model, provider, title, gitInfo, version, note);
   }
 
   /**
@@ -221,6 +157,11 @@ export class UIFactory {
     // "sleep disabled" chip in the posture block (the danger-mode idiom: a
     // persistent, colored surface indicator, the safety mechanism itself).
     powerKeepAwake?: boolean,
+    // Divergence marker for the model segment (core/active-model-identity.ts):
+    // set only while the serving backend is not the user's configured
+    // selection, e.g. "failover from abacusai:route-llm". Empty/undefined
+    // renders the context-info line exactly as it did before the marker existed.
+    modelNote?: string,
   ): Line[] {
     const lines: Line[] = [];
     const promptLines = prompt.split('\n');
@@ -499,6 +440,12 @@ export class UIFactory {
       if (model) {
         ctxParts.push({ text: model + (provider ? ` (${provider})` : ''), priority: 0 });
       }
+      // Divergence marker — its own segment so a narrow line drops it WHOLE
+      // (joinPrioritizedSegments breaks priority ties toward the later
+      // segment) rather than truncating it into a half-word. Priority 0: it
+      // outranks every decorative segment, and what survives without it is
+      // still the SERVING backend, never a claim about the configured one.
+      if (modelNote) ctxParts.push({ text: modelNote, priority: 0 });
       // Cross-surface spine posture — plain words, no blame. Adopted mode only.
       if (sessionSpineStatus) ctxParts.push({ text: `spine:${sessionSpineStatus}`, priority: 1 });
       // Web surface reachability — plain, persistent; dropped first under width pressure.
@@ -624,7 +571,7 @@ export class UIFactory {
     // them; keep the elapsed timer since "how long the approval has waited" is honest.
     const speedSuffix = (!approvalPending && tokenSpeed !== undefined && tokenSpeed > 0) ? ` (${Math.round(tokenSpeed)} tok/s)` : '';
     const elapsedSuffix = elapsedMs !== undefined ? ` (${formatElapsed(elapsedMs)})` : '';
-    const ttftSuffix = (!approvalPending && ttftMs !== undefined && ttftMs > 0) ? ` ttft:${ttftMs}ms` : '';
+    const ttftSuffix = (!approvalPending && ttftMs !== undefined && ttftMs > 0) ? ` (first token ${formatElapsed(ttftMs)})` : '';
     const text = `  ${spinner} ${phrase}${speedSuffix}${elapsedSuffix}${ttftSuffix} `;
 
     const textWidth = Math.max(1, getDisplayWidth(text) - 1);

package/src/runtime/bootstrap-command-context.ts

@@ -30,7 +30,7 @@ import type { HookWorkbench } from '@pellux/goodvibes-sdk/platform/hooks';
 import type { WorktreeRegistry } from '@/runtime/index.ts';
 import type { SandboxSessionRegistry } from '@/runtime/index.ts';
 import type { UiReadModels } from './ui-read-models.ts';
-import type { ShellPathService } from '@/runtime/index.ts';
+import type { ShellPathService, SessionSurface } from '@/runtime/index.ts';
 import type {
   ShellAgentManagerService,
   ShellAutomationManagerRuntimeService,
@@ -76,6 +76,8 @@ export type CreateBootstrapCommandContextOptions = {
   policyRuntimeState: PolicyRuntimeState;
   readModels: UiReadModels;
   shellPaths: ShellPathService;
+  /** The runtime's declare-once session-storage handle (runtime/services.ts). */
+  surface: SessionSurface;
   remoteRuntime?: RemoteCommandService;
   planRuntime?: PlanRuntimeService;
   fileUndoManager: FileUndoManager;
@@ -163,6 +165,7 @@ export function createBootstrapCommandContext(
     policyRuntimeState,
     readModels,
     shellPaths,
+    surface,
     remoteRuntime,
     planRuntime,
     fileUndoManager,
@@ -277,6 +280,7 @@ export function createBootstrapCommandContext(
     benchmarkStore,
   });
   const workspace = createBootstrapCommandWorkspaceSection({
+    surface,
     keybindingsManager,
     fileUndoManager,
     workspaceCheckpointManager,

package/src/runtime/bootstrap-command-parts.ts

@@ -32,7 +32,7 @@ import type { HookWorkbench } from '@pellux/goodvibes-sdk/platform/hooks';
 import type { WorktreeRegistry } from '@/runtime/index.ts';
 import type { SandboxSessionRegistry } from '@/runtime/index.ts';
 import type { UiReadModels } from './ui-read-models.ts';
-import type { ShellPathService } from '@/runtime/index.ts';
+import type { ShellPathService, SessionSurface } from '@/runtime/index.ts';
 import type {
   ShellAgentManagerService,
   ShellAutomationManagerRuntimeService,
@@ -95,6 +95,8 @@ export interface BootstrapCommandSectionOptions {
   readonly policyRuntimeState: PolicyRuntimeState;
   readonly readModels: UiReadModels;
   readonly shellPaths: ShellPathService;
+  /** The runtime's declare-once session-storage handle (runtime/services.ts). */
+  readonly surface: SessionSurface;
   readonly fileUndoManager: FileUndoManager;
   readonly workspaceCheckpointManager?: WorkspaceCheckpointManager;
   readonly gatewayMethods?: GatewayMethodCatalog;
@@ -372,12 +374,13 @@ export function createBootstrapCommandProviderSection(
 export function createBootstrapCommandWorkspaceSection(
   options: Pick<
     BootstrapCommandSectionOptions,
-    'keybindingsManager' | 'fileUndoManager' | 'workspaceCheckpointManager' | 'gatewayMethods' | 'workspaceTrustManager' | 'workspaceRegistrationManager' | 'panelManager' | 'profileManager' | 'bookmarkManager'
+    'surface' | 'keybindingsManager' | 'fileUndoManager' | 'workspaceCheckpointManager' | 'gatewayMethods' | 'workspaceTrustManager' | 'workspaceRegistrationManager' | 'panelManager' | 'profileManager' | 'bookmarkManager'
     | 'projectPlanningService' | 'projectPlanningProjectId' | 'workPlanStore'
   >,
   shellServices: BootstrapCommandShellServices,
 ): BootstrapCommandWorkspaceSection {
   return {
+    surface: options.surface,
     keybindingsManager: options.keybindingsManager,
     fileUndoManager: options.fileUndoManager,
     workspaceCheckpointManager: options.workspaceCheckpointManager,

package/src/runtime/bootstrap-core.ts

@@ -350,7 +350,7 @@ export async function initializeBootstrapCore(
 
   const toolRegistry = new ToolRegistry();
   const { fileCache, projectIndex } = registerAllTools(toolRegistry, {
-    surfaceRoot: 'tui',
+    surfaceRoot: services.surface.surfaceRoot,
     localhostFetchApproval: services.localhostFetchApproval, // loopback-fetch ask, built once in the services composition
     execPromptAnswerHandler: services.execPromptAnswerHandler, // terminal prompt-answer path, built once in the services composition
     fileUndoManager: services.fileUndoManager,
@@ -384,7 +384,7 @@ export async function initializeBootstrapCore(
   });
   // Note: installWrfcAgentToolGuard is called after routeOrBuffer is defined (further below) so the onTrace callback routes guard decisions through the pre-router buffer.
   services.agentOrchestrator.setDependencies({
-    surfaceRoot: 'tui',
+    surfaceRoot: services.surface.surfaceRoot,
     // setDependencies is a wholesale replace: re-install the prompt-answer handler and the loopback-fetch ask here or this rewire silently drops them.
     execPromptAnswerHandler: services.execPromptAnswerHandler,
     localhostFetchApproval: services.localhostFetchApproval,
@@ -507,7 +507,7 @@ export async function initializeBootstrapCore(
 
   // ── WRFC chain persistence ──────────────────────────────────────────────────────────
   const wrfcPersistence = createWrfcPersistence({
-    snapshotPath: join(workingDir, '.goodvibes', 'tui', 'wrfc-chains.json'),
+    snapshotPath: join(workingDir, '.goodvibes', services.surface.surfaceRoot, 'wrfc-chains.json'),
     getSystemMessageRouter: () => systemMessageRouterRef.value,
     controller: services.wrfcController,
   });

package/src/runtime/bootstrap-hook-bridge.ts

@@ -14,7 +14,8 @@ import type { SessionManager } from '@pellux/goodvibes-sdk/platform/sessions';
 import type { PanelManager } from '../panels/panel-manager.ts';
 import type { ProviderRegistry } from '@pellux/goodvibes-sdk/platform/providers';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
-import { replayJournalForSession } from '../core/session-recovery.ts';
+import { resumeSessionCore } from '../core/session-resume-core.ts';
+import type { SessionSurface } from '@/runtime/index.ts';
 
 export interface ResumeSessionOptions {
   readonly runtimeBus: RuntimeEventBus;
@@ -31,77 +32,94 @@ export interface ResumeSessionOptions {
   readonly hookDispatcher: HookDispatcher;
   readonly sessionManager: SessionManager;
   readonly panelManager: PanelManager;
+  /** The app's declare-once session-storage handle — the same one /session resume threads. */
+  readonly surface: SessionSurface;
+  /**
+   * Multi-instance guard for this seam. Resolves false when the operator
+   * declines to fork a session another terminal still has open. Optional so a
+   * host without a modal surface keeps the seam's original behavior.
+   */
+  readonly confirmLiveResume?: (sessionId: string) => Promise<boolean>;
   readonly configManager: Pick<ConfigManager, 'get' | 'getCategory'>;
   readonly providerRegistry: Pick<ProviderRegistry, 'get' | 'getCurrentModel' | 'getForModel' | 'require' | 'resolveModelPricing'>;
-  readonly homeDirectory: string;
   /** See CommandSessionServices.hydrateSessionUsage (command-registry.ts). */
   readonly hydrateSessionUsage?: () => void;
+  /**
+   * Reselects the resumed session's saved model through the live provider
+   * registry (matches session-workflow.ts's `/session resume` reselection
+   * fallback — see core/session-resume-core.ts). Optional so a caller without
+   * a provider API wired still gets the direct-assignment behavior this seam
+   * always had.
+   */
+  readonly selectModel?: (model: string) => Promise<{ readonly registryKey: string; readonly providerId: string }>;
 }
 
-export function createResumeSessionHandler(options: ResumeSessionOptions): (sessionId: string) => void {
-  return (sessionId: string): void => {
+/**
+ * Delegates the mechanical resume sequence to resumeSessionCore (the same
+ * routine session-workflow.ts's `/session resume` calls) so the two seams
+ * cannot diverge on restoreTurnAnchors, resetAll-before-fromJSON, model
+ * reselection, or the modal-redirect panel-reopen skip — see
+ * core/session-resume-core.ts's header doc for the full list of divergences
+ * this closes. Everything below the resumeSessionCore call is plumbing only
+ * this seam performs (hook fire, session-spine mirror, shared-broker
+ * reopen, last-session pointer) plus this seam's own log/render idiom.
+ */
+export function createResumeSessionHandler(options: ResumeSessionOptions): (sessionId: string) => Promise<void> {
+  return async (sessionId: string): Promise<void> => {
     try {
-      const { messages, meta } = options.sessionManager.load(sessionId);
+      // Multi-instance safety, matching what `/session resume` already does
+      // for the text path: never fork a session another terminal is holding
+      // open without the operator saying so.
+      if (options.confirmLiveResume && !(await options.confirmLiveResume(sessionId))) {
+        options.conversation.log('Resume cancelled — the session is still open in another terminal.', { fg: '244' });
+        options.requestRender();
+        return;
+      }
+      // Pre-read purely for the emitSessionResumed announcement's turnCount,
+      // which reports the raw saved-snapshot size — resumeSessionCore performs
+      // its own load() right after this (SessionManager.load is a cheap JSONL
+      // parse; the tiny duplicate read keeps this announcement's meaning
+      // unchanged rather than repurposing it to a post-replay count).
+      const { messages: rawMessages } = options.sessionManager.load(sessionId);
       emitSessionResumed(options.runtimeBus, {
         sessionId: options.runtime.sessionId,
         traceId: `${options.runtime.sessionId}:session-resume:${sessionId}`,
         source: 'bootstrap',
       }, {
         sessionId,
-        turnCount: messages.length,
-      });
-      options.conversation.fromJSON({
-        messages: messages as Parameters<typeof options.conversation.fromJSON>[0]['messages'],
-        title: meta.title,
-        titleSource: meta.titleSource,
+        turnCount: rawMessages.length,
       });
-      options.runtime.sessionId = sessionId;
-      replayJournalForSession({
-        homeDirectory: options.homeDirectory,
-        sessionId,
-        snapshotTimestamp: meta.timestamp ?? 0,
+
+      const outcome = await resumeSessionCore(sessionId, {
+        sessionManager: options.sessionManager,
         conversation: options.conversation,
-        persistSnapshot: (replayedMessages) => {
-          options.sessionManager.save(sessionId, replayedMessages as never[], {
-            title: options.conversation.title || meta.title,
-            model: meta.model,
-            provider: meta.provider,
-            timestamp: Date.now(),
-            titleSource: meta.titleSource,
-            returnContext: meta.returnContext,
-          });
-        },
+        runtime: options.runtime,
+        surface: options.surface,
+        panelManager: options.panelManager,
+        selectModel: options.selectModel,
+        hydrateSessionUsage: options.hydrateSessionUsage,
       });
-      // Hydrate the footer's token counters from the resumed history now that
-      // fromJSON()/journal replay are both applied — before requestRender() below.
-      options.hydrateSessionUsage?.();
+      const { meta, panels } = outcome;
+
       options.onSessionIdChanged?.(sessionId);
-      if (meta?.model) options.runtime.model = meta.model;
-      if (meta?.provider) options.runtime.provider = meta.provider;
       options.writeLastSessionPointer(sessionId);
       void options.sharedSessionBroker.reopenSession(sessionId).catch((err) => { logger.debug('session broker reopen session failed', { err }); });
       // Fire-and-forget spine mirror (reopen:true — the user resume verb).
       options.sessionSpine.reopen({ sessionId, project: options.project, title: options.conversation.title || meta.title });
       options.conversation.log(`Resumed session: ${sessionId}`, { fg: '135' });
-      const reopenedPanels: string[] = [];
-      if (meta.returnContext?.openPanels?.length) {
-        for (const panelId of meta.returnContext.openPanels.slice(0, 4)) {
-          try {
-            options.panelManager.open(panelId);
-            reopenedPanels.push(panelId);
-          } catch {
-            // Ignore unavailable panels during restore.
-          }
-        }
-        if (reopenedPanels.length > 0) options.panelManager.show();
+      if (panels.movedToModal.length > 0) {
+        options.conversation.log(`Resume: ${panels.movedToModal.join(', ')} moved to a modal — reopen via its command instead of as a panel.`, { fg: '244' });
+      }
+      if (panels.notReopened.length > 0) {
+        options.conversation.log(`Resume: …and ${panels.notReopened.length} more not reopened (/panels to open)`, { fg: '244' });
       }
       const returnContextMode = getReturnContextMode(options.configManager);
       if (returnContextMode !== 'off' && meta.returnContext) {
         for (const line of formatReturnContextForDisplay(meta.returnContext)) {
           options.conversation.log(`Resume: ${line}`, { fg: '244' });
         }
-        if (reopenedPanels.length > 0) {
-          options.conversation.log(`Resume: Reopened panels: ${reopenedPanels.join(', ')}`, { fg: '244' });
+        if (panels.reopened.length > 0) {
+          options.conversation.log(`Resume: Reopened panels: ${panels.reopened.join(', ')}`, { fg: '244' });
         }
         if ((meta.returnContext.remoteRunners?.length ?? 0) > 0) {
           options.conversation.log(`Resume: Remote re-entry -> /remote recover ${meta.returnContext.remoteRunners![0]}`, { fg: '244' });

package/src/runtime/bootstrap-shell.ts

@@ -22,6 +22,7 @@ import { createSystemMessageRouter, type SystemMessageRouter } from '../core/sys
 import { getConfigSnapshot } from '../config/index.ts';
 import { createBootstrapCommandContext } from './bootstrap-command-context.ts';
 import { createResumeSessionHandler } from './bootstrap-hook-bridge.ts';
+import { confirmLiveResume } from './session-resume-liveness-confirm.ts';
 import { logger } from '@pellux/goodvibes-sdk/platform/utils';
 import { loadBootstrapSystemPrompt } from '@/runtime/index.ts';
 import { createShellPlanRuntime, createShellRemoteCommandService } from '@/runtime/index.ts';
@@ -102,6 +103,24 @@ export function createBootstrapShell(options: BootstrapShellOptions): BootstrapS
     orchestrator.usage = usage;
     orchestrator.lastInputTokens = lastInputTokens;
   };
+  // Built before resumeSession below so its providerApi.selectModel is
+  // available for the resume handler's model-reselection step (matches
+  // session-workflow.ts's /session resume — see core/session-resume-core.ts).
+  const foundationClients = createRuntimeFoundationClients({
+    runtimeServices: services,
+    tasksReadModel: uiServices.readModels.tasks,
+    taskManager,
+    opsControlPlane,
+  });
+  const {
+    directTransport,
+    hookApi,
+    knowledgeApi,
+    mcpApi,
+    opsApi,
+    providerApi,
+  } = foundationClients;
+
   const resumeSession = createResumeSessionHandler({
     runtimeBus,
     runtime,
@@ -115,26 +134,21 @@ export function createBootstrapShell(options: BootstrapShellOptions): BootstrapS
     hookDispatcher: services.hookDispatcher,
     sessionManager: services.sessionManager,
     panelManager: services.panelManager,
+    surface: services.surface,
+    // Read lazily on purpose. The selection modal lives on the command
+    // context, which is composed further down this function (and whose
+    // openSelection is patched later still, by wireShellUiOpeners); a resume
+    // only ever happens long after both. An unpatched opener reads as "no
+    // surface to ask through", and the resume proceeds as it always did.
+    confirmLiveResume: (sessionId) => confirmLiveResume(sessionId, {
+      surface: services.surface,
+      openSelection: () => commandContext.openSelection,
+    }),
     configManager,
     providerRegistry: services.providerRegistry,
-    homeDirectory: services.homeDirectory,
     hydrateSessionUsage,
+    selectModel: (model) => providerApi.selectModel(model),
   });
-
-  const foundationClients = createRuntimeFoundationClients({
-    runtimeServices: services,
-    tasksReadModel: uiServices.readModels.tasks,
-    taskManager,
-    opsControlPlane,
-  });
-  const {
-    directTransport,
-    hookApi,
-    knowledgeApi,
-    mcpApi,
-    opsApi,
-    providerApi,
-  } = foundationClients;
   const planRuntime = createShellPlanRuntime({
     adaptivePlanner: services.adaptivePlanner,
     runtimeBus,
@@ -263,6 +277,7 @@ export function createBootstrapShell(options: BootstrapShellOptions): BootstrapS
     policyRuntimeState,
     readModels: uiServices.readModels,
     shellPaths: services.shellPaths,
+    surface: services.surface,
     remoteRuntime,
     planRuntime,
     fileUndoManager: services.fileUndoManager,