@pellux/goodvibes-tui 1.19.6 → 1.20.1

package/src/input/selection-modal-queue.ts

@@ -0,0 +1,176 @@
+/**
+ * selection-modal-queue.ts — Serializes overlapping InputHandler.openSelection() calls.
+ *
+ * openSelection (handler.ts) writes into a singleton SelectionModal plus a
+ * single callback slot. A second openSelection call while one is already
+ * showing used to silently overwrite both — the pre-empted caller's callback
+ * was never invoked, not even with null, so any caller that awaits it (see
+ * the `ask()` helper in runtime/recovery-prompt.ts, which wraps the callback
+ * in a Promise) hung forever. This is reachable in production: the
+ * `--continue` liveness-confirm modal (session-resume-liveness-confirm.ts)
+ * races the startup recovery offer, which is scheduled on a 0ms macrotask
+ * (scheduleRecoveryOffer in runtime/recovery-prompt.ts).
+ *
+ * Fix: queue overlapping requests FIFO and open each automatically once the
+ * previous one resolves, through the SAME callback the caller already
+ * supplied — openSelection's public signature never changes.
+ *
+ * Why the drain is deferred to a microtask instead of running inline inside
+ * the resolving callback: both resolution paths — the select/enter path in
+ * handler-modal-routes.ts's dispatchSelectionAction, and the Escape path in
+ * handler-modal-stack.ts's handleEscape/closeSelection — take a snapshot of
+ * the current selectionCallback before dispatch and write some form of that
+ * snapshot back into handler/context state AFTER invoking the callback (the
+ * select path re-reads via getSelectionCallback; the Escape path threads a
+ * local variable back out through handleEscapeForHandler in
+ * handler-interactions.ts). If this module opened the next queued request
+ * synchronously inside the resolving callback, those post-callback
+ * write-backs would immediately clobber the freshly-set callback for the
+ * newly-opened modal. Deferring past the end of the synchronous resolution
+ * (queueMicrotask) lets all of that settle first, then opens the next
+ * request cleanly — the same shape as the production race this fixes, which
+ * itself resolves via a deferred (macrotask) call.
+ */
+import type { SelectionItem, SelectionAction, SelectionResult, SelectionModal } from './selection-modal.ts';
+
+export type SelectionModalCallback = (result: SelectionResult | null) => void;
+
+export interface SelectionOpenOpts {
+  preSelectId?: string;
+  allowSearch?: boolean;
+  customActions?: Map<string, SelectionAction>;
+  primaryVerbLabel?: string;
+}
+
+export interface PendingSelectionRequest {
+  readonly title: string;
+  readonly items: SelectionItem[];
+  readonly opts: SelectionOpenOpts | undefined;
+  readonly callback: SelectionModalCallback;
+}
+
+/**
+ * Maximum number of openSelection() calls held while one is already showing.
+ * In practice at most two calls ever race in production (the liveness-confirm
+ * modal vs. the recovery offer's 0ms macrotask), so 8 is generous headroom
+ * for any future chained-picker sequence without letting a misbehaving
+ * caller queue without bound. Once full, the overflowing call is resolved
+ * with `null` immediately — a bounded queue must still give every caller a
+ * definite answer, never silently drop one.
+ */
+export const MAX_QUEUED_SELECTIONS = 8;
+
+/** Dependencies the queue needs from InputHandler, kept minimal and explicit. */
+export interface SelectionQueueHost {
+  readonly selectionModal: Pick<SelectionModal, 'active' | 'open'>;
+  /** Assigns InputHandler.selectionCallback (the live resolution slot). */
+  setSelectionCallback(callback: SelectionModalCallback | null): void;
+  /** Mirrors the callback into the in-flight feed context, when a feed() call is in progress (no-op otherwise). */
+  syncFeedSelectionCallback(callback: SelectionModalCallback | null): void;
+  modalOpened(name: string): void;
+  requestRender(): void;
+}
+
+/** Owns the FIFO of pending openSelection() requests for one InputHandler instance. */
+export class SelectionModalQueue {
+  private readonly pending: PendingSelectionRequest[] = [];
+
+  constructor(private readonly host: SelectionQueueHost) {}
+
+  /** Number of requests currently queued (excludes whichever modal is actively showing, if any). */
+  public get size(): number {
+    return this.pending.length;
+  }
+
+  /**
+   * Open `request` immediately if no selection modal is currently showing;
+   * otherwise queue it FIFO. If the queue is already at MAX_QUEUED_SELECTIONS,
+   * the request is resolved with `null` right away instead of being queued.
+   */
+  public request(request: PendingSelectionRequest): void {
+    if (this.host.selectionModal.active) {
+      if (this.pending.length >= MAX_QUEUED_SELECTIONS) {
+        request.callback(null);
+        return;
+      }
+      this.pending.push(request);
+      return;
+    }
+    this.openNow(request);
+  }
+
+  /**
+   * Resolve every still-queued request with `null`. Called when the handler
+   * is torn down (see the exitApp wrap in handler.ts's constructor) so no
+   * queued caller is ever left permanently pending.
+   */
+  public clear(): void {
+    while (this.pending.length > 0) {
+      const next = this.pending.shift();
+      next?.callback(null);
+    }
+  }
+
+  private openNow(request: PendingSelectionRequest): void {
+    const wrapped: SelectionModalCallback = (result) => {
+      request.callback(result);
+      // Only a terminal resolution (select/cancel/escape) actually closes
+      // the modal — dispatchSelectionAction's toggle/increment/decrement
+      // branch invokes the callback but leaves the modal open for further
+      // interaction, so only drain the queue once the modal has gone
+      // inactive, never on every callback invocation.
+      if (!this.host.selectionModal.active) {
+        queueMicrotask(() => this.drain());
+      }
+    };
+    this.host.modalOpened('selection');
+    this.host.selectionModal.open(request.title, request.items, request.opts);
+    this.host.setSelectionCallback(wrapped);
+    this.host.syncFeedSelectionCallback(wrapped);
+    this.host.requestRender();
+  }
+
+  private drain(): void {
+    // Something else already opened a modal in the meantime (e.g. a
+    // synchronously chained openSelection call from inside the resolving
+    // callback) — leave the queue alone; that modal's own resolution will
+    // drain it in turn.
+    if (this.host.selectionModal.active) return;
+    const next = this.pending.shift();
+    if (!next) return;
+    this.openNow(next);
+  }
+}
+
+/** InputHandler's actual field/method shape — satisfies this structurally, no import needed. */
+export interface SelectionQueueOwner {
+  readonly selectionModal: Pick<SelectionModal, 'active' | 'open'>;
+  selectionCallback: SelectionModalCallback | null;
+  syncFeedSelectionCallback: ((callback: SelectionModalCallback | null) => void) | null;
+  modalOpened(name: string): void;
+  requestRender(): void;
+  exitApp: () => void;
+}
+
+/**
+ * Builds the queue for one InputHandler and wires teardown: wraps
+ * `owner.exitApp` (the one path guaranteed to run when the handler is torn
+ * down) so every still-queued selection request resolves with `null`
+ * instead of being left pending. Keeps this bookkeeping out of handler.ts,
+ * which only needs `this.selectionQueue = attachSelectionModalQueue(this);`.
+ */
+export function attachSelectionModalQueue(owner: SelectionQueueOwner): SelectionModalQueue {
+  const queue = new SelectionModalQueue({
+    selectionModal: owner.selectionModal,
+    setSelectionCallback: (callback) => { owner.selectionCallback = callback; },
+    syncFeedSelectionCallback: (callback) => { owner.syncFeedSelectionCallback?.(callback); },
+    modalOpened: (name) => owner.modalOpened(name),
+    requestRender: () => owner.requestRender(),
+  });
+  const suppliedExitApp = owner.exitApp;
+  owner.exitApp = () => {
+    queue.clear();
+    suppliedExitApp();
+  };
+  return queue;
+}

package/src/main.ts

@@ -24,7 +24,8 @@ import { getTierPromptSupplement, getTierForContextWindow } from '@pellux/goodvi
 import { GitStatusProvider } from './renderer/git-status.ts';
 import type { GitHeaderInfo } from './renderer/git-status.ts';
 import { createShellLayout } from './renderer/layout-engine.ts';
-import { buildShellFooter, estimateShellFooterHeight } from './renderer/shell-surface.ts';
+import { buildShellFooter, estimateShellFooterHeight, promptCursorOffset } from './renderer/shell-surface.ts';
+import { createFailoverTurnState, resolveActiveModelDisplay } from './core/active-model-identity.ts';
 import { computePromptContentWidth } from './renderer/prompt-content-width.ts';
 import { buildConversationViewport } from './renderer/conversation-layout.ts';
 import { applyConversationOverlays } from './renderer/conversation-overlays.ts';
@@ -37,13 +38,16 @@ import { selfUpdateAtLaunch } from './cli/launch-auto-update.ts';
 import { buildSharedOrchestratorCoreServices, refreshMemoryRecallSnapshot } from './runtime/orchestrator-core-services.ts';
 import { createSessionContinuityHintsBuilder } from './runtime/session-continuity-hints.ts';
 import { resolveWebSurfaceUrl } from '@pellux/goodvibes-sdk/platform/runtime/feature-announcements';
-import { readLastSessionPointer, writeRecoveryFile } from '@/runtime/index.ts';
+import { readLastSessionPointer } from '@/runtime/index.ts';
+import { startRecoveryAutosave } from './runtime/recovery-autosave.ts';
+import { scheduleRecoveryOffer } from './runtime/recovery-prompt.ts';
+import { buildRecoveryOfferWiring } from './runtime/recovery-offer-wiring.ts';
 import { handleBlockingShellInput, type PendingPermissionState } from './shell/blocking-input.ts';
 import { handleErrorAffordanceKey } from './shell/recovery-input-helpers.ts';
+import { createRetryAffordanceState, disarmRetryAffordance, retryAffordanceHint, wireRetryAffordanceOnError } from './shell/retry-affordance.ts';
 import { wireShellUiOpeners } from './shell/ui-openers.ts';
 import { deriveComposerState } from './core/composer-state.ts';
 import { resolveFoldedBookmarkLine } from './core/bookmark-navigation.ts';
-import { buildPersistedSessionContext, getReturnContextMode, maybeAssistReturnContextSummary } from '@/runtime/index.ts';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 import { prepareShellCliRuntime } from './cli/entrypoint.ts';
 import { applyInitialTuiCliState, reportFatalStartupError } from './cli/tui-startup.ts';
@@ -60,7 +64,7 @@ import { footerFleetCost } from './panels/fleet-read-model.ts';
 import { formatUserFacingErrorLine } from './core/format-user-error.ts';
 import { wireStreamEventMetrics, createStreamMetrics, type StreamMetrics, type WireStreamEventMetricsResult } from './core/stream-event-wiring.ts';
 import { wireTurnEventHandlers } from './core/turn-event-wiring.ts';
-import { buildContextStatusHint } from './renderer/context-status-hint.ts';
+import { resolveContextStatusHint } from './renderer/context-status-hint.ts';
 import { isEffectiveDangerMode } from './config/index.ts';
 import { createScriptableStatusline } from './core/scriptable-statusline.ts';
 import { applyComposerCapture } from './input/composer-capture.ts';
@@ -77,6 +81,7 @@ import { setPanelFrameRequester } from './panels/base-panel.ts';
 
 import { ALT_SCREEN_ENTER, ALT_SCREEN_EXIT, MOUSE_ENABLE, MOUSE_DISABLE, CURSOR_HIDE, CURSOR_SHOW, CLEAR_SCREEN, KEYBOARD_EXT_ENABLE, KEYBOARD_EXT_DISABLE, PASTE_ENABLE, PASTE_DISABLE, FOCUS_ENABLE, FOCUS_DISABLE } from './renderer/terminal-escapes.ts';
 import { installBackgroundThemeProbe } from './renderer/terminal-bg-probe.ts';
+import { VERSION } from './version.ts';
 
 async function main() {
   const stdout = process.stdout;
@@ -86,6 +91,12 @@ async function main() {
     homeDirectory: homedir(),
   }, 'goodvibes');
 
+  // Between binary start and the first frame, boot used to be silent (config
+  // load, trust manager, memory init, hooks). One honest pre-alt-screen line,
+  // placed after the help/version/completion early-exits above so those stay
+  // byte-clean.
+  stdout.write(`goodvibes v${VERSION} starting…\n`);
+
   // Launch-time self-update, before any bootstrap or terminal mode change; on
   // an installed update this restarts onto the swapped binary and never returns.
   const launchUpdateLines = await selfUpdateAtLaunch({ configManager, stdout });
@@ -135,8 +146,11 @@ async function main() {
   applyConfiguredHitlMode(configManager, modeManager);
   applyTuiRuntimeConfigDefaults(configManager);
 
-  // Re-surface pre-TUI launch-update lines in-session (the alt screen wipes stdout).
-  for (const line of launchUpdateLines) systemMessageRouter.high(`[Update] ${line}`);
+  // Re-surface pre-TUI launch-update lines in-session (the alt screen wipes
+  // stdout). Launch-time update mechanics are routine, not urgent — low
+  // priority, not high (a skipped/deferred check is not the kind of thing
+  // that should compete with real session alerts for attention).
+  for (const line of launchUpdateLines) systemMessageRouter.low(`[Update] ${line}`);
 
   const panelManager = ctx.services.panelManager;
   const buildSessionContinuityHints = createSessionContinuityHintsBuilder({ readModels: uiServices.readModels, panelManager });
@@ -165,6 +179,8 @@ async function main() {
   let lastMaxScroll: number | null = null;
   // Stream and tool-timer state; mutated by wireStreamEventMetrics handlers, read during render.
   const streamMetrics: StreamMetrics = createStreamMetrics();
+  // Live failover record — written by the failover path, read every frame so the header and footer agree.
+  const failoverState = createFailoverTurnState();
 
   const getPromptContentWidth = () => computePromptContentWidth(stdout.columns);
 
@@ -324,6 +340,9 @@ async function main() {
   commandContext.submitInput = submitInput;
   commandContext.submitSpokenInput = (text, content) => submitInput(text, content, { spokenOutput: true });
   commandContext.stopSpokenOutput = () => spokenTurns.stop(); commandContext.pasteFromClipboard = () => input.handlePaste();
+  // Read-only view of pending [TEXT: pN, M lines] fold markers, so /pastes
+  // can preview a folded paste's actual content before the user submits it.
+  commandContext.getPendingPastes = () => input.pasteRegistry;
   commandContext.executeCommand = (name, args) => commandRegistry.execute(name, args, commandContext);
   // Late-patched: bootstrap.ts populates uiServices.platform.externalServices AFTER commandContext is built.
   commandContext.platform.externalServices = uiServices.platform.externalServices;
@@ -423,7 +442,7 @@ async function main() {
     model: runtime.model,
     provider: runtime.provider,
     toolCount,
-    lastSessionId: readLastSessionPointer({ workingDirectory: workingDir, homeDirectory, surfaceRoot: 'tui' }) ?? undefined,
+    lastSessionId: readLastSessionPointer({ surface: ctx.services.surface }) ?? undefined,
   };
 
   const renderNow = () => {
@@ -438,10 +457,9 @@ async function main() {
     const sessionSnapshot = uiServices.readModels.session.getSnapshot();
     const agentSnapshot = uiServices.readModels.agents.getSnapshot();
 
-    const headerLines = UIFactory.createHeader(width, currentModel.id, currentModel.provider, conversation.title || undefined, lastGitInfoRef.value);
-    const managerAgents = agentManager.list().filter(
-      (a) => a.status === 'running' || a.status === 'pending',
-    );
+    const activeModel = resolveActiveModelDisplay({ serving: currentModel, configuredRegistryKey: configManager.get('provider.model') as string, configuredLabel: runtime.model, configuredProvider: runtime.provider, failover: failoverState.current() });
+    const headerLines = UIFactory.createHeader(width, activeModel.headerModel, activeModel.headerProvider, conversation.title || undefined, lastGitInfoRef.value, undefined, activeModel.divergenceNote);
+    const managerAgents = agentManager.list().filter((a) => a.status === 'running' || a.status === 'pending');
     const runtimeAgents = agentSnapshot.active;
     const runningAgentSummary = summarizeRunningAgents(managerAgents, runtimeAgents, ctx.services.wrfcController.listChains());
     const runningAgentCount = runningAgentSummary.count;
@@ -454,38 +472,27 @@ async function main() {
       commandMode: input.commandMode,
       panelFocused: input.panelFocused,
       pendingApproval: pendingPermission !== null,
-      hasAttachments: input.getImageAttachments().size > 0,
-      turnState: sessionSnapshot.turnState,
-    });
-    const maintenanceStatus = evaluateSessionMaintenance({
-      configManager,
-      currentTokens: orchestrator.lastInputTokens,
-      contextWindow,
-      sessionMemoryCount: ctx.services.sessionMemoryStore.list().length,
+      hasAttachments: input.getImageAttachments().size > 0, turnState: sessionSnapshot.turnState,
     });
-    const contextStatusHint = buildContextStatusHint({
-      level: maintenanceStatus.level,
-      autoCompactEnabled: maintenanceStatus.autoCompactEnabled,
-      usagePct: maintenanceStatus.usagePct,
+    const contextStatusHint = resolveContextStatusHint({
+      evaluate: (args) => evaluateSessionMaintenance({ configManager, ...args, sessionMemoryCount: ctx.services.sessionMemoryStore.list().length }),
+      currentTokens: orchestrator.lastInputTokens, contextWindow,
     });
     const footerLines = buildShellFooter({
       width,
       promptText: promptInfo.visibleLines.join('\n'),
       promptLineCount: promptInfo.visibleLines.length,
-      promptCursorPos: promptInfo.visibleCursorLine >= 0
-        ? promptInfo.visibleLines
-          .slice(0, promptInfo.visibleCursorLine)
-          .reduce((sum: number, line: string) => sum + line.length + 1, 0) + promptInfo.visibleCursorCol
-        : undefined,
+      promptCursorPos: promptCursorOffset(promptInfo),
       usage: { up: orchestrator.usage.input, down: orchestrator.usage.output, fleetCostUsd: footerFleetCost(() => ctx.services.processRegistry.query().nodes, runningAgentCount > 0) },
       showExitNotice: input.showExitNotice,
       lastCopyTime: input.lastCopyTime,
-      model: runtime.model,
+      model: activeModel.footerModel, modelNote: activeModel.divergenceNote,
       toolCount: toolRegistry.list().length,
       workingDir,
-      provider: runtime.provider,
+      provider: activeModel.footerProvider,
       contextWindow,
       contextStatusHint,
+      retryHint: retryAffordanceHint(retryAffordance),
       scriptableStatusLine: scriptableStatusline.current(),
       // Compact footer posture on short terminals so the shell stays usable.
       compact: height < 30,
@@ -680,9 +687,7 @@ async function main() {
     providerRegistry,
     systemMessageRouter,
     hookDispatcher,
-    workingDir,
-    homeDirectory,
-    sessionManager: ctx.services.sessionManager,
+    surface: ctx.services.surface,
     gitStatusProvider,
     lastGitInfoRef,
     buildSessionContinuityHints,
@@ -696,29 +701,31 @@ async function main() {
   let retryCtx: { count: number; text: string; content?: ContentPart[]; opts?: Parameters<typeof orchestrator.handleUserInput>[2] } | null = null;
   // One-key retry affordance, active right after a user-visible TURN_ERROR: 'r' re-submits on the
   // current provider, 'm' opens the model picker, any other character clears it and routes normally.
-  let errorAffordanceActive = false;
-  const retryTurn = (): void => {
+  // Surfaced as a transient FOOTER hint (see retryAffordanceHint below), not a transcript message.
+  // Time-bounded: onExpire repaints once the 60s disarm timer fires, so a stray keypress hours
+  // later can never trigger a real retry — see retry-affordance.ts.
+  const retryAffordance = createRetryAffordanceState({ onExpire: render });
+  const retryTurn = (notice?: string): void => {
     if (!retryCtx) return;
     const { count, text, content: rContent, opts: rOpts } = retryCtx;
     // Roll back to pre-submission count, then re-submit. SDK gap — no retry-in-place (see handoff).
+    // The rollback erases the failed turn's transcript — the failover notice included, which is how
+    // that notice used to vanish before anyone could read it. The caller hands it over instead, and
+    // it is posted here: after the rollback, above the prompt it explains.
     conversation.removeMessagesAfter(count);
+    if (notice) systemMessageRouter.userReceipt(notice);
     void refreshMemoryRecallSnapshot(ctx.services).then(() => orchestrator.handleUserInput(text, rContent, rOpts)).catch((e: unknown) => logger.debug('retryTurn', { error: summarizeError(e) }));
   };
   const streamResult: WireStreamEventMetricsResult = wireStreamEventMetrics({
     events: uiServices.events, orchestrator, providerRegistry,
     systemMessageRouter, render, metrics: streamMetrics,
     providerOptimizer: ctx.services.providerOptimizer, costLookup: providerRegistry, retryTurn,
+    failoverState, getConfiguredRegistryKey: () => configManager.get('provider.model') as string | undefined,
     isApprovalPending: () => pendingPermission !== null,
   });
   unsubs.push(...streamResult.unsubs);
   // Activate one-key retry affordance when a user-visible error surfaces.
-  streamResult.onErrorSurfaced((exhausted) => {
-    if (retryCtx) {
-      errorAffordanceActive = true;
-      systemMessageRouter.low(exhausted ? '[Retry] r retry same provider · m switch model' : '[Retry] r retry · m switch model');
-      render();
-    }
-  });
+  wireRetryAffordanceOnError(streamResult.onErrorSurfaced, retryAffordance, () => retryCtx !== null, render);
 
   // Register terminal-restoring crash/termination handlers BEFORE entering raw mode so a throw
   // during setup or the initial render still restores the terminal; 'exit' is the final safety net.
@@ -736,7 +743,8 @@ async function main() {
   // OSC 11 probe and repaints once if light wins. filterInput strips the reply from stdin.
   const themeProbe = installBackgroundThemeProbe({ configManager, isTTY: Boolean(stdout.isTTY), env: process.env, writeQuery: (b) => allowTerminalWrite(() => stdout.write(b)), requestRepaint: () => { compositor.resetDiff(); render(); } });
 
-  applyInitialTuiCliState({ cli, input, commandRegistry, commandContext, shellPaths: ctx.services.shellPaths, render });
+  // continueRecovery lets --continue/bare --resume check the target session for a live crash snapshot newer than its store before resuming (see tui-startup.ts).
+  applyInitialTuiCliState({ cli, input, commandRegistry, commandContext, shellPaths: ctx.services.shellPaths, surface: ctx.services.surface, render, continueRecovery: { sessionManager: ctx.services.sessionManager, runtime, conversation, writeLastSessionPointer, receipt: (line) => systemMessageRouter.userReceipt(line) } });
 
   stdin.on('data', (raw: string) => {
     const data = themeProbe.filterInput(raw); if (data.length === 0) return;
@@ -749,9 +757,10 @@ async function main() {
       return;
     }
     // One-key retry affordance: armed after a user-visible TURN_ERROR; any key other than r/m dismisses it and routes normally.
-    if (errorAffordanceActive) {
-      errorAffordanceActive = false;
+    if (retryAffordance.armed) {
+      disarmRetryAffordance(retryAffordance);
       if (handleErrorAffordanceKey(data, { retryArmed: retryCtx !== null, retry: retryTurn, openModelPicker: () => commandContext.openModelPicker?.(), render })) return;
+      render(); // disarm must repaint immediately so the footer hint clears even when the key fell through
     }
     // One-key jump to a spawned CI fix-session: 'j' attaches, any other key dismisses and routes normally.
     if (fixSessionAttachArmed !== null) {
@@ -768,28 +777,24 @@ async function main() {
 
   // State restores happen ONLY when the user explicitly asks — a CLI flag
   // (--continue/--resume/--fork), a slash command (/session resume,
-  // /checkpoints, /rewind), or the boot resume notice's advertised command.
-  // There is deliberately no unconditional auto-restore here: a bare launch
-  // never loads a saved conversation on its own (owner ruling). Any live
-  // recovery snapshot is surfaced (never applied) by the boot resume
-  // notice — see announceResumeState in runtime/resume-notice.ts.
+  // /checkpoints, /rewind), or the startup recovery offer's modal. There is
+  // deliberately no unconditional auto-restore here: a bare launch never
+  // loads a saved conversation on its own (owner ruling).
 
   // Initial render
   conversation.rebuildHistory();
   render();
 
-  // --- Auto-save to recovery file every 60s ---
-  recoveryInterval = setInterval(() => {
-    const snapshot = conversation.toJSON() as { messages: Array<import('./core/conversation.ts').ConversationMessageSnapshot> };
-    const persisted = buildPersistedSessionContext(snapshot.messages, conversation.getTitleSource(), buildSessionContinuityHints());
-    writeRecoveryFile(
-      { ...snapshot, ...persisted },
-      runtime.sessionId,
-      conversation.title ?? '',
-      { workingDirectory: workingDir, homeDirectory },
-    );
-  }, 60_000);
+  // Crash-recovery snapshot: asked, never assumed. Scheduled after the first
+  // frame so the question is drawn rather than posed at a blank terminal.
+  scheduleRecoveryOffer(buildRecoveryOfferWiring({
+    surface: ctx.services.surface, sessionManager: ctx.services.sessionManager, runtime, conversation, commandContext,
+    writeLastSessionPointer, receipt: (line) => systemMessageRouter.userReceipt(line), render,
+  }));
 
+  // Auto-save to recovery file every 60s + multi-instance liveness-marker
+  // refresh — see runtime/recovery-autosave.ts.
+  recoveryInterval = startRecoveryAutosave({ conversation, runtime, surface: ctx.services.surface, buildSessionContinuityHints });
 }
 
 main().catch(reportFatalStartupError);

package/src/panels/builtin/operations.ts

@@ -9,6 +9,7 @@ import { LocalAuthPanel } from '../local-auth-panel.ts';
 import { NotificationsPanel } from '../notifications-panel.ts';
 import type { ResolvedBuiltinPanelDeps } from './shared.ts';
 import { requireUiServices } from './shared.ts';
+import { GOODVIBES_TUI_SURFACE_ROOT } from '../../config/surface.ts';
 
 // the former single 'monitoring' category (33 panels pre-merge) is
 // split into five operator domains, applied per-registration below. Kept in
@@ -113,7 +114,7 @@ export function registerOperationsPanels(manager: PanelManager, deps: ResolvedBu
       // (AgentManager's bounded retention ring), empty once evicted (the
       // panel degrades to the on-disk ledger fallback in that case).
       getConversationSnapshot: (agentId: string) => ui.agents.agentManager.getConversationSnapshot(agentId),
-      resolveSessionLogPath: (agentId: string) => ui.environment.shellPaths.resolveProjectPath('tui', 'sessions', `${agentId}.jsonl`),
+      resolveSessionLogPath: (agentId: string) => ui.environment.shellPaths.resolveProjectPath(GOODVIBES_TUI_SURFACE_ROOT, 'sessions', `${agentId}.jsonl`),
       // Queue a message for a live in-process agent/wrfc-subtask member.
       steer: (id: string, text: string) => fleetReadModel.steer(id, text),
     }, deps.configManager, fleetActs, fleetSpawn),

package/src/panels/provider-health-domains.ts

@@ -181,14 +181,14 @@ export function buildProviderHealthDomainSummaries(
     summary: continuity.recoveryFilePresent
       ? `recovery file present for ${continuity.sessionId || '(unknown session)'}`
       : continuity.lastSessionPointer ? `last session pointer ${continuity.lastSessionPointer}` : 'no last-session pointer',
-    next: continuity.recoveryFilePresent ? '/session resume <id>' : '/session list',
+    next: continuity.recoveryFilePresent ? '/resume <id>' : '/session list',
     details: [
       continuity.returnContext ? `last activity: ${continuity.returnContext.activityLabel}` : '',
       continuity.returnContext ? `resume posture: ${continuity.returnContext.statusLabel}` : '',
       !continuity.lastSessionPointer ? 'no persisted last-session pointer recorded' : '',
     ].filter(Boolean),
     nextSteps: continuity.recoveryFilePresent
-      ? ['/session list', '/session resume <id>', '/health continuity']
+      ? ['/session list', '/resume <id>', '/health continuity']
       : ['/session list'],
   });
 

package/src/{cli → providers}/provider-classification.ts

@@ -1,3 +1,15 @@
+/**
+ * provider-classification.ts — how a provider is paid for: a raw API key, a
+ * cloud account, a stored subscription/OAuth session, a local runtime, or
+ * honestly unknown.
+ *
+ * Lives in the foundation `providers` layer (it imports nothing) because both
+ * the CLI management surfaces and the in-session failover notice need it: when
+ * automatic failover moves a turn onto a different backend, the notice names
+ * the billing class it moved from and to, so a switch from a metered API key
+ * onto the user's own subscription is something the user can see and object to
+ * rather than discover on an invoice.
+ */
 export type ProviderSetupClass =
   | 'api-key'
   | 'cloud-account'

package/src/renderer/block-actions-overlay.ts

@@ -0,0 +1,59 @@
+/**
+ * renderBlockActionsMenu — renders the BlockActionsMenu (src/renderer/block-actions.ts)
+ * as a docked overlay, so opening it via Enter-on-an-empty-composer actually
+ * shows something. Follows the established docked-overlay pattern (see
+ * selection-modal-overlay.ts / bookmark-modal.ts): ModalFactory sizes the box
+ * to its content, and every text section wraps rather than clips, so the
+ * block summary and action list are always shown in full.
+ */
+
+import { type Line } from '../types/grid.ts';
+import { ModalFactory, type ModalSection } from './modal-factory.ts';
+import type { BlockActionsMenu } from './block-actions.ts';
+import { describeBlockForReceipt } from '../input/handler-content-actions.ts';
+import { getOverlaySurfaceMetrics } from './overlay-viewport.ts';
+import { formatHints } from './hint-grammar.ts';
+
+export function renderBlockActionsMenu(
+  menu: BlockActionsMenu,
+  width: number,
+  viewportHeight = 24,
+): Line[] {
+  if (!menu.active || !menu.block) return [];
+
+  const summary = describeBlockForReceipt(menu.block);
+  const metrics = getOverlaySurfaceMetrics(width, viewportHeight, {
+    margin: 4,
+    maxWidth: 64,
+    chromeRows: 5,
+    minContentRows: 3,
+    maxContentRows: Math.max(6, viewportHeight - 8),
+  });
+
+  const sections: ModalSection[] = [
+    { type: 'text', content: `Target: ${summary}`, style: { dim: true } },
+    { type: 'separator' },
+    {
+      type: 'list',
+      items: menu.actions.map((action, i) => ({
+        label: `[${action.key}] ${action.label}`,
+        selected: i === menu.selectedIndex,
+      })),
+    },
+  ];
+
+  return ModalFactory.createModal(
+    {
+      title: 'Block Actions',
+      width: metrics.boxWidth,
+      margin: metrics.margin,
+      sections,
+      hints: [formatHints([
+        { key: 'Up/Down', verb: 'Navigate' },
+        { key: 'Enter', verb: 'Select' },
+        { key: 'Esc', verb: 'Close' },
+      ])],
+    },
+    width,
+  );
+}

package/src/renderer/block-actions.ts

@@ -1,6 +1,6 @@
 import type { BlockMeta } from '../core/conversation';
 
-export type BlockActionId = 'copy' | 'bookmark' | 'toggle' | 'apply' | 'rerun';
+export type BlockActionId = 'copy' | 'bookmark' | 'toggle' | 'apply';
 
 export interface BlockAction {
   id: BlockActionId;
@@ -13,7 +13,6 @@ const ALL_ACTIONS: BlockAction[] = [
   { id: 'bookmark', label: 'Bookmark',       key: 'b' },
   { id: 'toggle',   label: 'Collapse/Expand',key: 'Tab' },
   { id: 'apply',    label: 'Apply diff',     key: 'a' },
-  { id: 'rerun',    label: 'Re-run tool',    key: 'r' },
 ];
 
 /**
@@ -37,7 +36,6 @@ export class BlockActionsMenu {
     this.block = block;
     this.actions = ALL_ACTIONS.filter(a => {
       if (a.id === 'apply') return block.type === 'diff';
-      if (a.id === 'rerun') return block.type === 'tool';
       return true;
     });
     this.selectedIndex = 0;