@pellux/goodvibes-tui 1.20.0 → 1.20.1

package/src/renderer/ui-factory.ts

@@ -3,6 +3,7 @@ import { LAYOUT } from './layout.ts';
 import { VERSION } from '../version.ts';
 import { fitDisplay, getDisplayWidth, truncateDisplay, wrapText, interpolateColor, joinPrioritizedSegments, type PrioritizedSegment } from '../utils/terminal-width.ts';
 import type { GitHeaderInfo } from './git-status.ts';
+import { renderHeaderLine } from './header-line.ts';
 import { renderConversationFragment, renderConversationStatusLine, type ConversationStatusSegment } from './conversation-surface.ts';
 import { GLYPHS } from './ui-primitives.ts';
 import { activeUiTones } from './theme.ts';
@@ -42,22 +43,6 @@ export interface ThinkingStallInfo {
   readonly reconnect?: { readonly attempt: number; readonly maxAttempts: number };
 }
 
-/** Build the git segment string and its display width. Single source of truth for header layout. */
-function buildGitSegment(gitInfo: GitHeaderInfo): { text: string; width: number } {
-  const branch = ` git:${gitInfo.branch}`;
-  if (gitInfo.dirty) {
-    const text = `${branch} * `;
-    return { text, width: getDisplayWidth(text) };
-  }
-  if (gitInfo.ahead > 0 || gitInfo.behind > 0) {
-    const arrows = (gitInfo.ahead > 0 ? ` +${gitInfo.ahead}` : '') + (gitInfo.behind > 0 ? ` -${gitInfo.behind}` : '');
-    const text = `${branch}${arrows} `;
-    return { text, width: getDisplayWidth(text) };
-  }
-  const text = `${branch} `;
-  return { text, width: getDisplayWidth(text) };
-}
-
 /** Format a number: up to 999, then 1.0k, 1.0M, 1.0B, 1.0T */
 function fmtNum(n: number): string {
   return abbreviateCount(n, { bSuffix: true });
@@ -75,68 +60,19 @@ function fmtCost(usd: number): string {
  * UIFactory - Generates standard UI fragments without needing Ink/React overhead.
  */
 export class UIFactory {
-  // `version` defaults to the live build VERSION; tests pass a pinned fixture so
-  // golden snapshots don't break on every release bump (version-decoupled goldens,
-  // mirroring the splash fixture-version pattern).
-  public static createHeader(width: number, model: string, provider: string, title?: string, gitInfo?: GitHeaderInfo, version: string = VERSION): Line[] {
-    const lines: Line[] = [];
-    // Header/footer/thinking paint on the transparent terminal background, so
-    // they read chrome.* (light-terminal-aware) — NOT fg.*/state.*, which stay
-    // tuned for the opaque dark modal/panel boxes. Read live per render so a
-    // mode flip re-resolves without any module reload (see theme.ts).
-    const t = activeUiTones();
-    const CYAN = t.accent.brand;
-    const GREY = t.chrome.faint;
-    const TITLE_COLOR = t.chrome.label;
-    const brand = ` GoodVibes `;
-    const ver = `v${version} `;
-    const stats = ` ${model} `;
-    const prov = `(${provider}) `;
-    const line = createEmptyLine(width);
-    let curX = 0;
-    for (const char of brand) { line[curX++] = { char, fg: CYAN, bg: '', bold: true, dim: false, underline: false, italic: false, strikethrough: false }; }
-    for (const char of ver) { line[curX++] = { char, fg: GREY, bg: '', bold: false, dim: true, underline: false, italic: false, strikethrough: false }; }
-    // Optional conversation title — shown after brand/ver, truncated to fit
-    if (title) {
-      const titleStr = `│ ${title} `;
-      // Reserve space for git info (if present) + model/provider on the right
-      const gitReserved = gitInfo ? buildGitSegment(gitInfo).width : 0;
-      const rightReserved = getDisplayWidth(stats + prov) + gitReserved;
-      const maxTitleW = width - curX - rightReserved - 1;
-      let displayTitle: string;
-      if (getDisplayWidth(titleStr) <= maxTitleW) {
-        displayTitle = titleStr;
-      } else {
-        let truncated = '';
-        let w = 0;
-        for (const ch of titleStr) {
-          const cw = getDisplayWidth(ch);
-          if (w + cw > maxTitleW - 3) { truncated += '...'; break; }
-          truncated += ch;
-          w += cw;
-        }
-        displayTitle = truncated;
-      }
-      for (const char of displayTitle) { if (curX < width) line[curX++] = { char, fg: TITLE_COLOR, bg: '', bold: false, dim: true, underline: false, italic: false, strikethrough: false }; }
-    }
-    // Build git info segment
-    let gitStr = '';
-    let gitFg: string = t.chrome.faint;
-    if (gitInfo) {
-      gitStr = buildGitSegment(gitInfo).text;
-      if (gitInfo.dirty || gitInfo.ahead > 0 || gitInfo.behind > 0) {
-        gitFg = t.chrome.warn; // yellow when dirty or out-of-sync
-      }
-    }
-    const rightSideText = stats + prov;
-    const rightSideW = getDisplayWidth(rightSideText) + getDisplayWidth(gitStr);
-    let rightX = width - rightSideW;
-    for (const char of gitStr) { if (rightX >= 0 && rightX < width) line[rightX++] = { char, fg: gitFg, bg: '', bold: false, dim: !gitInfo?.dirty && !(gitInfo?.ahead || gitInfo?.behind), underline: false, italic: false, strikethrough: false }; }
-    for (const char of stats) { if (rightX < width) line[rightX++] = { char, fg: CYAN, bg: '', bold: true, dim: false, underline: false, italic: false, strikethrough: false }; }
-    for (const char of prov) { if (rightX < width) line[rightX++] = { char, fg: GREY, bg: '', bold: false, dim: true, underline: false, italic: false, strikethrough: false }; }
-    lines.push(line);
-    lines.push(this.stringToLine('━'.repeat(width), width, { fg: t.chrome.faint }));
-    return lines;
+  /**
+   * The header row. Delegates to renderHeaderLine (header-line.ts) — extracted
+   * when the header gained the failover divergence marker and this file was
+   * already on the 800-line source gate.
+   *
+   * `model`/`provider` are the SERVING backend and `note` the divergence
+   * marker, both resolved by core/active-model-identity.ts so the header and
+   * the footer answer "who is serving?" from one place. `version` defaults to
+   * the live build VERSION; tests pass a pinned fixture so golden snapshots
+   * don't break on every release bump.
+   */
+  public static createHeader(width: number, model: string, provider: string, title?: string, gitInfo?: GitHeaderInfo, version: string = VERSION, note: string = ''): Line[] {
+    return renderHeaderLine(width, model, provider, title, gitInfo, version, note);
   }
 
   /**
@@ -221,6 +157,11 @@ export class UIFactory {
     // "sleep disabled" chip in the posture block (the danger-mode idiom: a
     // persistent, colored surface indicator, the safety mechanism itself).
     powerKeepAwake?: boolean,
+    // Divergence marker for the model segment (core/active-model-identity.ts):
+    // set only while the serving backend is not the user's configured
+    // selection, e.g. "failover from abacusai:route-llm". Empty/undefined
+    // renders the context-info line exactly as it did before the marker existed.
+    modelNote?: string,
   ): Line[] {
     const lines: Line[] = [];
     const promptLines = prompt.split('\n');
@@ -499,6 +440,12 @@ export class UIFactory {
       if (model) {
         ctxParts.push({ text: model + (provider ? ` (${provider})` : ''), priority: 0 });
       }
+      // Divergence marker — its own segment so a narrow line drops it WHOLE
+      // (joinPrioritizedSegments breaks priority ties toward the later
+      // segment) rather than truncating it into a half-word. Priority 0: it
+      // outranks every decorative segment, and what survives without it is
+      // still the SERVING backend, never a claim about the configured one.
+      if (modelNote) ctxParts.push({ text: modelNote, priority: 0 });
       // Cross-surface spine posture — plain words, no blame. Adopted mode only.
       if (sessionSpineStatus) ctxParts.push({ text: `spine:${sessionSpineStatus}`, priority: 1 });
       // Web surface reachability — plain, persistent; dropped first under width pressure.

package/src/runtime/recovery-decisions.ts

@@ -0,0 +1,126 @@
+/**
+ * recovery-decisions.ts — a durable record of the recovery snapshots the user
+ * has already said "Remove" to.
+ *
+ * The defect this exists for: answering Remove deletes the snapshot file, and
+ * that was the whole memory of the decision. Anything that puts the file back
+ * — a session still running on an older build rewriting its snapshot every
+ * 60s, a restored backup, a synced directory — produced the same question
+ * again on the next launch, and again after the next removal, with no way for
+ * the user to make it stop. A decision the product forgets the instant it acts
+ * on it is not a decision the user gets to make.
+ *
+ * So Remove now writes a record that outlives the process, and a recorded
+ * snapshot found on disk again is deleted without asking. "Keep" is
+ * deliberately NOT recorded here: Keep means "leave it, ask me next launch",
+ * and recovery-prompt.ts's in-process set already holds it for the rest of the
+ * run.
+ *
+ * WHERE IT LIVES, and why not under `surface.stateDir`:
+ * `<homeDirectory>/.goodvibes/<surfaceRoot>/recovery-decisions.json` — home-
+ * anchored, matching session-liveness-marker.ts, and deliberately NOT the
+ * project-anchored `surface.stateDir`. The snapshots this defends against
+ * include the ones in the SDK's legacy shared recovery directory, which is
+ * itself home-anchored and shared by every project that ever used this
+ * surfaceRoot; the current build dual-reads it, so ONE such snapshot is
+ * offered at the launch of EVERY project. A project-scoped record could only
+ * ever silence one project at a time, which is the same nag wearing a
+ * different hat. Records are matched on session id alone; ids are unique, so
+ * a record made in one project cannot suppress a different snapshot in
+ * another. Each record still carries the workspace it was made in, so the file
+ * says plainly where the decision came from.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import type { SessionSurface } from '@/runtime/index.ts';
+
+/** One "the user removed this snapshot" decision. */
+export interface RecoveryRemovalRecord {
+  readonly sessionId: string;
+  /** The project the decision was made in. Provenance — matching is on sessionId alone. */
+  readonly workspace: string;
+  readonly removedAt: number;
+}
+
+/**
+ * Bounds on the ledger. It is append-mostly and never read by anything but
+ * the boot offer, so it stays small by construction; these are the guards
+ * against a pathological case, not a routine cleanup.
+ *
+ * Note what is deliberately NOT the pruning rule: "drop records whose snapshot
+ * file no longer exists". Every record in here describes a file that was just
+ * deleted, so that rule would empty the ledger immediately and reinstate the
+ * exact defect it was written to fix — the point is precisely to still
+ * remember once the file comes back. Age and count are the honest bounds.
+ */
+const MAX_RECORDS = 200;
+const RECORD_TTL_MS = 90 * 24 * 60 * 60 * 1000;
+
+/** Absolute path to this surface's removal ledger. */
+export function recoveryDecisionsPathFor(surface: SessionSurface): string {
+  return join(surface.homeDirectory, '.goodvibes', surface.surfaceRoot, 'recovery-decisions.json');
+}
+
+function isRecord(value: unknown): value is RecoveryRemovalRecord {
+  if (typeof value !== 'object' || value === null) return false;
+  const candidate = value as Partial<RecoveryRemovalRecord>;
+  return typeof candidate.sessionId === 'string'
+    && candidate.sessionId.length > 0
+    && typeof candidate.workspace === 'string'
+    && typeof candidate.removedAt === 'number'
+    && Number.isFinite(candidate.removedAt);
+}
+
+/**
+ * Every removal decision still in force, oldest first. A missing, unreadable
+ * or malformed ledger reads as "no decisions recorded" rather than throwing:
+ * a corrupt file must not be able to take a boot down, and the worst outcome
+ * of losing it is that the user is asked once more.
+ */
+export function readRecoveryRemovals(surface: SessionSurface, nowMs: number = Date.now()): RecoveryRemovalRecord[] {
+  try {
+    const path = recoveryDecisionsPathFor(surface);
+    if (!existsSync(path)) return [];
+    const parsed = JSON.parse(readFileSync(path, 'utf-8')) as unknown;
+    if (!Array.isArray(parsed)) return [];
+    return parsed.filter(isRecord).filter((record) => nowMs - record.removedAt < RECORD_TTL_MS);
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Has the user already chosen Remove for this snapshot's session, in this or
+ * any earlier run?
+ */
+export function isRecoveryRemovalRecorded(surface: SessionSurface, sessionId: string, nowMs: number = Date.now()): boolean {
+  if (!sessionId.trim()) return false;
+  return readRecoveryRemovals(surface, nowMs).some((record) => record.sessionId === sessionId);
+}
+
+/**
+ * Record that the user chose Remove for `sessionId`. Idempotent — a repeat
+ * removal of a snapshot that came back refreshes the existing record's
+ * timestamp rather than adding a second one, so the ledger cannot grow by one
+ * entry per reappearance.
+ *
+ * Best-effort: a ledger that cannot be written must not break the removal the
+ * user actually asked for. The cost of a failed write is one more question on
+ * a future launch, which is exactly the behaviour that shipped before this
+ * file existed.
+ */
+export function recordRecoveryRemoval(surface: SessionSurface, sessionId: string, nowMs: number = Date.now()): void {
+  if (!sessionId.trim()) return;
+  try {
+    const kept = readRecoveryRemovals(surface, nowMs).filter((record) => record.sessionId !== sessionId);
+    kept.push({ sessionId, workspace: surface.workingDirectory, removedAt: nowMs });
+    // Oldest decisions fall off first; the newest are the ones a reappearing
+    // snapshot is most likely to match.
+    const bounded = kept.slice(-MAX_RECORDS);
+    const path = recoveryDecisionsPathFor(surface);
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, JSON.stringify(bounded, null, 2) + '\n', { mode: 0o600 });
+  } catch {
+    // Best-effort by construction — see the doc comment above.
+  }
+}

package/src/runtime/recovery-prompt.ts

@@ -39,10 +39,18 @@
  *     without reading keeps the snapshot.
  *   - Keep (or a dismissal) stays quiet for the rest of the run. The snapshot
  *     is offered again on the next launch, not again in this one.
+ *   - Remove is permanent, not just for this file. The decision is written to
+ *     the durable ledger in recovery-decisions.ts, so a snapshot that comes
+ *     back byte-for-byte — because a session still running on an older build
+ *     is rewriting it every minute — is deleted on sight instead of asked
+ *     about again. Deleting the file used to be the entire memory of the
+ *     answer, which is how the same question survived being answered three
+ *     times.
  */
 import { statSync } from 'node:fs';
 import { checkRecoveryFile, checkRecoveryForSession, consumeRecovery, removeRecoveryPoint } from '@/runtime/index.ts';
 import type { RecoveryFileInfo, SessionSurface } from '@/runtime/index.ts';
+import { isRecoveryRemovalRecorded, recordRecoveryRemoval } from './recovery-decisions.ts';
 import { checkSessionLiveness } from './session-liveness-marker.ts';
 import type { SelectionItem, SelectionResult } from '../input/selection-modal.ts';
 
@@ -213,11 +221,50 @@ function defaultSnapshotBytes(surface: SessionSurface, sessionId: string): numbe
  */
 const answeredThisRun = new Set<string>();
 
-/** Test seam: a fresh process has no answered offers. */
+/**
+ * Test seam: a fresh process has no answered offers. Only clears the
+ * in-process Keep memory — removal decisions are durable on purpose and live
+ * in the surface's own directory, so a test gets a clean ledger by using a
+ * fresh temp surface, the same way a real user gets one by using a different
+ * machine.
+ */
 export function resetAnsweredRecoveryOffersForTest(): void {
   answeredThisRun.clear();
 }
 
+/**
+ * How many times one offer pass will delete a recorded-removed snapshot and
+ * look again. A bound rather than a `while (true)`: the same session can have
+ * a snapshot in both the canonical and the legacy shared directory, so one
+ * removal can legitimately need a second pass, but nothing here should be able
+ * to spin if a delete ever fails to take.
+ */
+const MAX_RECORDED_REMOVAL_PASSES = 8;
+
+/**
+ * The snapshot to actually ask about, after honouring decisions already made.
+ *
+ * A snapshot whose session is in the removal ledger is deleted here and NOT
+ * offered: the user answered that question already, and re-asking because the
+ * file came back is the defect. Deleting rather than merely skipping matters —
+ * skipping would leave the file to mask an older, genuinely-orphaned snapshot
+ * underneath it forever.
+ */
+function findOfferableSnapshot(deps: RecoveryPromptDeps): RecoveryFileInfo | null {
+  for (let pass = 0; pass < MAX_RECORDED_REMOVAL_PASSES; pass += 1) {
+    const info = deps.targetSessionId !== undefined
+      ? checkRecoveryForSession(deps.surface, deps.targetSessionId)
+      : checkRecoveryFile({ surface: deps.surface });
+    if (!info) return null;
+    if (!isRecoveryRemovalRecorded(deps.surface, info.sessionId)) return info;
+    // Silently, because the user already said remove. A receipt here would be
+    // a notification about a decision they made and do not need re-confirmed.
+    const { removed } = removeRecoveryPoint(deps.surface, info.sessionId);
+    if (!removed) return null;
+  }
+  return null;
+}
+
 /**
  * Run the startup recovery offer. Resolves once the user has answered (or
  * once it is established that there is nothing to ask about). Never throws:
@@ -225,9 +272,7 @@ export function resetAnsweredRecoveryOffersForTest(): void {
  */
 export async function offerRecoverySnapshot(deps: RecoveryPromptDeps): Promise<RecoveryPromptOutcome> {
   try {
-    const info = deps.targetSessionId !== undefined
-      ? checkRecoveryForSession(deps.surface, deps.targetSessionId)
-      : checkRecoveryFile({ surface: deps.surface });
+    const info = findOfferableSnapshot(deps);
     if (!info) return 'none';
     // Already answered about this snapshot earlier in this same run (the
     // targeted --continue offer and the general startup offer can both find
@@ -270,9 +315,14 @@ export async function offerRecoverySnapshot(deps: RecoveryPromptDeps): Promise<R
     const retire = await ask(open, RECOVERY_RETIRE_TITLE, buildRecoveryRetireItems(facts));
     if (retire === 'remove') {
       const { removed } = removeRecoveryPoint(deps.surface, info.sessionId);
+      // Recorded whether or not a file was there to delete: the answer is
+      // about this snapshot, and a snapshot that vanished between the question
+      // and the answer can still be rewritten a minute later by whatever wrote
+      // it in the first place.
+      recordRecoveryRemoval(deps.surface, info.sessionId);
       deps.receipt(removed
-        ? `Recovery point removed (session ${info.sessionId}).`
-        : `No recovery point was found to remove (session ${info.sessionId}).`);
+        ? `Recovery point removed (session ${info.sessionId}) — it will not be offered again, even if the file reappears.`
+        : `No recovery point was found to remove (session ${info.sessionId}) — if one reappears for that session it will be discarded, not offered.`);
       deps.render();
       return 'removed';
     }

package/src/version.ts

@@ -6,7 +6,7 @@ import { join } from 'node:path';
 // The prebuild script updates the fallback value before compilation.
 // Uses import.meta.dir (Bun) to locate package.json relative to this file,
 // which is correct regardless of the process working directory.
-let _version = '1.20.0';
+let _version = '1.20.1';
 try {
   const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', 'package.json'), 'utf-8'));
   // Only trust a version read from OUR OWN package.json. A Bun single-file