@pellux/goodvibes-tui 1.20.0 → 1.21.0

package/src/cli/status.ts

@@ -8,6 +8,7 @@ import type { GoodVibesCliOutputFormat } from './types.ts';
 import type { CliServicePosture } from './service-posture.ts';
 import type { InstallSelfCheckFinding } from '../runtime/install-self-check.ts';
 import { getProviderIdFromModel } from '../config/provider-model.ts';
+import { describeConfiguredEffort } from '../providers/reasoning-effort-surface.ts';
 
 export interface CliStatusOptions {
   readonly configManager: Pick<ConfigManager, 'get'>;
@@ -96,6 +97,13 @@ export interface CliStatusSnapshot {
     readonly provider: string;
     readonly model: string;
     readonly reasoning: string;
+    /**
+     * What the configured reasoning level actually becomes on the configured
+     * model. The level alone is not the whole truth: a model that does not
+     * offer it gets the next level down, and a model with no configurable
+     * reasoning gets nothing sent at all.
+     */
+    readonly reasoningResolved: string;
   };
   readonly auth: {
     readonly permissionMode: unknown;
@@ -551,6 +559,10 @@ export function buildCliStatusSnapshot(options: CliStatusOptions): CliStatusSnap
       provider: getProviderIdFromModel(config.get('provider.model')),
       model: String(config.get('provider.model')),
       reasoning: String(config.get('provider.reasoningEffort')),
+      reasoningResolved: describeConfiguredEffort(
+        String(config.get('provider.model') ?? ''),
+        String(config.get('provider.reasoningEffort') ?? ''),
+      ),
     },
     auth: {
       permissionMode: config.get('permissions.mode'),
@@ -609,6 +621,10 @@ export function renderCliStatus(options: CliStatusOptions): string {
     `  provider: ${getProviderIdFromModel(config.get('provider.model'))}`,
     `  model: ${String(config.get('provider.model'))}`,
     `  reasoning: ${String(config.get('provider.reasoningEffort'))}`,
+    `  reasoning (on this model): ${describeConfiguredEffort(
+      String(config.get('provider.model') ?? ''),
+      String(config.get('provider.reasoningEffort') ?? ''),
+    )}`,
     '',
     'Auth:',
     `  permissions: ${permissionModeLabel(config.get('permissions.mode'))} (${String(config.get('permissions.mode'))})`,

package/src/config/read-versioned.ts

@@ -1,4 +1,12 @@
-import { existsSync, readFileSync, renameSync } from 'node:fs';
+import { existsSync, readFileSync, readdirSync, renameSync, statSync, unlinkSync } from 'node:fs';
+import { join } from 'node:path';
+
+/**
+ * The suffix every quarantined file in this codebase gets. Exported so the
+ * other producer of these files (the transcript journal's corrupt-tail
+ * quarantine) and the reclaim sweep below all agree on one spelling.
+ */
+export const UNRECOGNIZED_SUFFIX = '.unrecognized';
 
 /**
  * A migration function that transforms data from version N to N+1.
@@ -108,8 +116,113 @@ function isPlainObject(value: unknown): value is Record<string, unknown> {
 
 function quarantine(path: string): void {
   try {
-    renameSync(path, `${path}.unrecognized`);
+    renameSync(path, `${path}${UNRECOGNIZED_SUFFIX}`);
   } catch {
     // Best-effort — if rename fails (e.g. race), proceed silently.
   }
 }
+
+// ─── Quarantine reclaim ───────────────────────────────────────────────────────
+//
+// Quarantining renames a bad file out of the way so a human can inspect it,
+// and until now nothing ever removed the result — every corrupt config file
+// and every torn journal tail left a `.unrecognized` file behind permanently.
+// Forensic value is real, so the retention window below is deliberately long,
+// but "keep forever" is a leak.
+
+/**
+ * How long a quarantined file is kept before it is reclaimed: 30 days
+ * (2_592_000_000 ms). These files exist so a person can look at what went
+ * wrong, so the window is a month rather than the hours-to-days retention the
+ * live durability artefacts get — long enough to survive a holiday, short
+ * enough that a recurring corruption cannot fill a disk.
+ */
+export const QUARANTINE_RETENTION_MS = 30 * 24 * 60 * 60 * 1000;
+
+/**
+ * Hard ceiling on quarantined files kept per swept directory, newest kept.
+ * The age rule alone cannot bound a fast repeating corruption (a boot loop
+ * quarantining the same file every restart), so a count cap runs alongside it.
+ */
+export const QUARANTINE_MAX_FILES_PER_DIR = 50;
+
+export interface QuarantineReapResult {
+  /** Quarantined files examined across every directory. */
+  readonly scanned: number;
+  /** Quarantined files deleted. */
+  readonly reaped: number;
+}
+
+export interface QuarantineReapOptions {
+  readonly now?: () => number;
+  /** Override the age window (tests). */
+  readonly maxAgeMs?: number;
+  /** Override the per-directory count cap (tests). */
+  readonly maxFilesPerDir?: number;
+}
+
+/**
+ * Delete `.unrecognized` quarantine files that are past the retention window,
+ * plus any beyond the per-directory count cap (newest kept).
+ *
+ * Each directory is scanned non-recursively; a missing or unreadable directory
+ * contributes nothing and is not an error. Idempotent, and safe to run
+ * concurrently from several processes — a file another sweeper already
+ * unlinked (ENOENT) counts as reclaimed rather than failing the sweep.
+ */
+export function reapQuarantinedFiles(
+  directories: readonly string[],
+  options: QuarantineReapOptions = {},
+): QuarantineReapResult {
+  const now = options.now?.() ?? Date.now();
+  const maxAgeMs = options.maxAgeMs ?? QUARANTINE_RETENTION_MS;
+  const maxFilesPerDir = options.maxFilesPerDir ?? QUARANTINE_MAX_FILES_PER_DIR;
+
+  let scanned = 0;
+  let reaped = 0;
+
+  for (const dir of new Set(directories)) {
+    let names: string[];
+    try {
+      names = readdirSync(dir).filter((name) => name.endsWith(UNRECOGNIZED_SUFFIX));
+    } catch {
+      continue;
+    }
+    scanned += names.length;
+
+    const survivors: { readonly path: string; readonly mtimeMs: number }[] = [];
+    for (const name of names) {
+      const path = join(dir, name);
+      let mtimeMs: number;
+      try {
+        mtimeMs = statSync(path).mtimeMs;
+      } catch {
+        // Vanished under us (another sweeper) — nothing left to reclaim.
+        continue;
+      }
+      if (now - mtimeMs > maxAgeMs) {
+        if (unlinkQuarantined(path)) reaped++;
+        continue;
+      }
+      survivors.push({ path, mtimeMs });
+    }
+
+    if (survivors.length > maxFilesPerDir) {
+      survivors.sort((a, b) => a.mtimeMs - b.mtimeMs); // oldest first
+      for (const victim of survivors.slice(0, survivors.length - maxFilesPerDir)) {
+        if (unlinkQuarantined(victim.path)) reaped++;
+      }
+    }
+  }
+
+  return { scanned, reaped };
+}
+
+function unlinkQuarantined(path: string): boolean {
+  try {
+    unlinkSync(path);
+    return true;
+  } catch (err) {
+    return (err as NodeJS.ErrnoException | undefined)?.code === 'ENOENT';
+  }
+}

package/src/core/active-model-identity.ts

@@ -0,0 +1,153 @@
+/**
+ * active-model-identity.ts — the single answer to "which backend is serving
+ * this session right now, and is that what the user chose?"
+ *
+ * Two shell surfaces used to answer that question independently and could
+ * therefore contradict each other:
+ *   - the top-right header read `providerRegistry.getCurrentModel()` live
+ *     every frame, so it followed an automatic failover switch immediately;
+ *   - the footer read `runtime.model` / `runtime.provider`, which only
+ *     bootstrap and explicit user model switches ever wrote, so it kept
+ *     naming the configured backend after failover had moved serving (and
+ *     billing) somewhere else.
+ *
+ * Both surfaces now resolve through resolveActiveModelDisplay() so they are
+ * computed from one comparison of serving-vs-configured. Divergence is
+ * detected structurally — by comparing the live registry key against the
+ * configured selection — not by trusting a flag, so ANY path that moves the
+ * registry off the user's choice is surfaced, not just the failover path that
+ * sets the record below.
+ *
+ * The failover record adds the REASON for a divergence ("failover from …");
+ * it never decides whether one exists.
+ */
+
+/**
+ * The live per-turn record of an automatic provider failover.
+ *
+ * `configuredRegistryKey` is sticky across repeated failovers within one turn
+ * (a second hop still reports divergence from what the USER chose, not from
+ * the first fallback). `servingRegistryKey` tracks the most recent switch.
+ */
+export interface FailoverTurnRecord {
+  /** The user's configured selection (`provider.model`) when failover began. */
+  readonly configuredRegistryKey: string;
+  /** The registry key failover switched serving to. */
+  readonly servingRegistryKey: string;
+}
+
+/**
+ * Mutable holder for the failover record, owned by the shell composition root
+ * (main.ts) and shared between the stream-event wiring that sets it and the
+ * render frame that reads it.
+ */
+export interface FailoverTurnState {
+  /** The active record, or null when no failover is in effect. */
+  current(): FailoverTurnRecord | null;
+  /**
+   * Record a failover switch. On a second switch within the same turn the
+   * originally-configured key is preserved — divergence is always reported
+   * against the user's own selection.
+   */
+  begin(record: FailoverTurnRecord): void;
+  /** Drop the record — called only after serving is actually back on the configured selection. */
+  clear(): void;
+}
+
+/** Create an empty FailoverTurnState. */
+export function createFailoverTurnState(): FailoverTurnState {
+  let active: FailoverTurnRecord | null = null;
+  return {
+    current: () => active,
+    begin(record: FailoverTurnRecord): void {
+      active = active === null
+        ? record
+        : { configuredRegistryKey: active.configuredRegistryKey, servingRegistryKey: record.servingRegistryKey };
+    },
+    clear(): void { active = null; },
+  };
+}
+
+/** What the live provider registry reports as serving this frame. */
+export interface ServingModelIdentity {
+  readonly id: string;
+  readonly provider: string;
+  readonly registryKey?: string | undefined;
+}
+
+export interface ActiveModelInputs {
+  /** Live registry answer — who is actually serving right now. */
+  readonly serving: ServingModelIdentity;
+  /** The user's configured selection as a registry key (config `provider.model`). */
+  readonly configuredRegistryKey: string | undefined;
+  /** The configured selection's footer label (session `runtime.model`). */
+  readonly configuredLabel: string | undefined;
+  /** The configured selection's provider id (session `runtime.provider`). */
+  readonly configuredProvider: string | undefined;
+  /** The live failover record, when one is in effect. */
+  readonly failover: FailoverTurnRecord | null;
+}
+
+export interface ActiveModelDisplay {
+  /** Model text for the header's right-hand segment. */
+  readonly headerModel: string;
+  /** Provider text for the header's right-hand segment. */
+  readonly headerProvider: string;
+  /** Model text for the footer's context-info segment. */
+  readonly footerModel: string;
+  /** Provider text for the footer's context-info segment. */
+  readonly footerProvider: string;
+  /**
+   * Divergence marker naming the configured selection, e.g.
+   * `failover from abacusai:route-llm`. Empty string when serving is the
+   * configured selection — in that case both surfaces render exactly as they
+   * did before this resolver existed.
+   */
+  readonly divergenceNote: string;
+  /** True when the serving backend is not the user's configured selection. */
+  readonly diverged: boolean;
+}
+
+/**
+ * Decide what the header and footer say about the active model this frame.
+ *
+ * Divergence requires BOTH a known live registry key and a known configured
+ * selection; if either is missing the resolver reports no divergence rather
+ * than guessing, because a false "failover" marker would be its own lie. The
+ * configured selection is matched against the serving registry key AND the
+ * bare serving model id, so a config value stored as a bare model id (rather
+ * than the `provider:model` registry key) does not read as permanent divergence.
+ */
+export function resolveActiveModelDisplay(input: ActiveModelInputs): ActiveModelDisplay {
+  const servingKey = input.serving.registryKey;
+  const configuredKey = input.configuredRegistryKey;
+  const diverged = Boolean(
+    servingKey && configuredKey && configuredKey !== servingKey && configuredKey !== input.serving.id,
+  );
+  if (!diverged) {
+    return {
+      headerModel: input.serving.id,
+      headerProvider: input.serving.provider,
+      // Footer keeps its own established label form (runtime.model) when there
+      // is nothing to correct, so the unchanged case renders byte-identically.
+      footerModel: input.configuredLabel ?? input.serving.id,
+      footerProvider: input.configuredProvider ?? input.serving.provider,
+      divergenceNote: '',
+      diverged: false,
+    };
+  }
+  // Serving != configured. Both surfaces now name the SERVING backend, plus a
+  // marker naming the configured selection it departed from. The failover
+  // record supplies the reason only when it matches the backend actually
+  // serving; any other divergence is described without claiming a cause.
+  const causedByFailover = input.failover !== null && input.failover.servingRegistryKey === servingKey;
+  const reason = causedByFailover ? 'failover from' : 'not the configured';
+  return {
+    headerModel: input.serving.id,
+    headerProvider: input.serving.provider,
+    footerModel: input.serving.id,
+    footerProvider: input.serving.provider,
+    divergenceNote: `${reason} ${configuredKey}`,
+    diverged: true,
+  };
+}

package/src/core/conversation-event-navigation.ts

@@ -0,0 +1,42 @@
+/**
+ * conversation-event-navigation.ts — resolving "jump to the next/previous
+ * transcript event" into a history-buffer line number.
+ *
+ * Extracted from ConversationManager (core/conversation.ts), which is at its
+ * line-count gate, and kept structural (no SDK imports beyond the event kind)
+ * so the ordering rule can be tested without building a conversation.
+ *
+ * The rule both directions share: take the events of the requested kind, map
+ * each to the line its message was rendered at, drop the ones that were never
+ * rendered (a message with no registry entry), sort ascending, then wrap —
+ * searching forward past `currentLine` falls back to the first line, searching
+ * backward falls back to the last. -1 means there is nowhere to go.
+ */
+
+import type { TranscriptEventKind } from '@pellux/goodvibes-sdk/platform/core';
+
+/** The subset of a transcript-event-index entry this module reads. */
+export interface TranscriptEventLike {
+  readonly kind: TranscriptEventKind;
+  readonly messageIndex: number;
+}
+
+export function resolveTranscriptEventLine(
+  events: readonly TranscriptEventLike[],
+  kind: TranscriptEventKind | 'all',
+  messageLineRegistry: readonly (number | undefined)[],
+  currentLine: number,
+  direction: 'next' | 'prev',
+): number {
+  const selected = kind === 'all' ? events : events.filter((event) => event.kind === kind);
+  if (selected.length === 0) return -1;
+  const lines = selected
+    .map((event) => messageLineRegistry[event.messageIndex] ?? -1)
+    .filter((line) => line >= 0)
+    .sort((a, b) => a - b);
+  if (lines.length === 0) return -1;
+  if (direction === 'next') {
+    return lines.find((line) => line > currentLine) ?? lines[0]!;
+  }
+  return [...lines].reverse().find((line) => line < currentLine) ?? lines[lines.length - 1]!;
+}

package/src/core/conversation-search-expansion.ts

@@ -0,0 +1,67 @@
+/**
+ * conversation-search-expansion.ts — tracks which collapse keys transcript
+ * search auto-expanded so they can be restored on search close, unless the
+ * user explicitly acted on the block while it was open.
+ *
+ * Extracted from conversation.ts to keep that file under the architecture
+ * line-count gate. restoreOnto() applies restoration through a structural
+ * `{ setCollapsed }` shape (ConversationManager's own public setCollapsed())
+ * rather than importing ConversationManager itself, so this module has no
+ * import-cycle back to conversation.ts.
+ *
+ * The contract (see SearchManager.revealCurrentMatch and .close in
+ * search.ts): a single keystroke in the search field must never expand
+ * collapsed content — only navigating TO a match hidden inside it does, and
+ * that expansion is undone when search closes UNLESS the user separately
+ * touched the block (toggled, copied, bookmarked, saved, or bulk-expanded
+ * via /expand) while it sat auto-expanded. An explicit user action always
+ * wins over search's own bookkeeping, regardless of which happened first.
+ */
+
+/** Structural shape restoreOnto() needs — matches ConversationManager's own
+ *  public setCollapsed() without importing the class (avoids a cycle). */
+export interface CollapseSettable {
+  setCollapsed(collapseKey: string, collapsed: boolean): void;
+}
+
+export class SearchExpansionTracker {
+  /**
+   * Collapse keys currently expanded because the user navigated to a search
+   * match hidden inside them. Never contains a key the user has touched
+   * explicitly — noteUserTouch() removes it on the way in.
+   */
+  private searchExpandedKeys = new Set<string>();
+
+  /**
+   * Collapse keys the user has explicitly acted on at least once. Growth is
+   * unbounded for the life of the conversation — membership only ever gates
+   * one decision (whether restoreSearchExpansions() may re-collapse a key),
+   * so a stale positive is harmless and pruning would add complexity for no
+   * behavioral gain.
+   */
+  private userTouchedKeys = new Set<string>();
+
+  /** Record that `collapseKey` was expanded because the user navigated to a
+   *  search match hidden inside it. No-op for a key the user already
+   *  touched explicitly, since that ownership always wins. */
+  markSearchExpanded(collapseKey: string): void {
+    if (!this.userTouchedKeys.has(collapseKey)) this.searchExpandedKeys.add(collapseKey);
+  }
+
+  /** Record an explicit user action on `collapseKey` (toggle/copy/bookmark/
+   *  save/bulk-expand). Exempts it from restoreSearchExpansions()'s
+   *  auto-re-collapse for the rest of the session. */
+  noteUserTouch(collapseKey: string): void {
+    this.userTouchedKeys.add(collapseKey);
+    this.searchExpandedKeys.delete(collapseKey);
+  }
+
+  /** Re-collapse every key search auto-expanded and not since user-touched,
+   *  through `conversationManager`'s public setCollapsed() — called from
+   *  SearchManager.close() to restore pre-search collapse state. */
+  restoreOnto(conversationManager: CollapseSettable): void {
+    const keys = [...this.searchExpandedKeys];
+    this.searchExpandedKeys.clear();
+    for (const key of keys) conversationManager.setCollapsed(key, true);
+  }
+}

package/src/core/conversation-splash-state.ts

@@ -0,0 +1,58 @@
+/**
+ * conversation-splash-state.ts — when the splash owns the conversation area,
+ * and what has to happen the moment it stops.
+ *
+ * Two pieces of state, kept out of ConversationManager (core/conversation.ts,
+ * already at its line-count gate) and out of `suppressSplash`, which is a
+ * per-frame posture the panel workspace sets both ways on every render:
+ *
+ *   - `dismissed` — sticky for the run. Owner rule: the splash yields to ANY
+ *     submission, a chat message or a slash command alike. A slash command
+ *     whose whole output is a modal (or nothing) still means the session has
+ *     started, so the splash must not reappear underneath it, and must not
+ *     come back in the gap before the first reply arrives.
+ *
+ *   - the splash→transcript EDGE — latched when a rebuild that would have
+ *     drawn the splash draws transcript content instead. The shell consumes
+ *     it to repaint the whole viewport for that one frame. Without that, the
+ *     differential renderer only rewrites rows it knows changed, so every row
+ *     the incoming transcript does not cover keeps showing splash art: rule
+ *     lines, the hint line, and half-overwritten rows where a short transcript
+ *     line collides with the tail of a longer splash line.
+ */
+export class SplashGateState {
+  private dismissedForRun = false;
+  private onScreen = false;
+  private yielded = false;
+
+  /** True once the run's first submission has retired the splash. */
+  get dismissed(): boolean {
+    return this.dismissedForRun;
+  }
+
+  /** Retire the splash for the run. Returns true when this call changed anything. */
+  dismiss(): boolean {
+    if (this.dismissedForRun) return false;
+    this.dismissedForRun = true;
+    return true;
+  }
+
+  /** Record that this rebuild drew the splash. */
+  enter(): void {
+    this.onScreen = true;
+  }
+
+  /** Record that this rebuild drew transcript content; latches the edge. */
+  leave(): void {
+    if (!this.onScreen) return;
+    this.onScreen = false;
+    this.yielded = true;
+  }
+
+  /** True exactly once per splash→transcript transition. */
+  consumeTransition(): boolean {
+    const transition = this.yielded;
+    this.yielded = false;
+    return transition;
+  }
+}

package/src/core/conversation-user-receipts.ts

@@ -0,0 +1,42 @@
+/**
+ * conversation-user-receipts.ts — tracks which system-role message indices
+ * are a direct receipt for an explicit user action (e.g. answering the
+ * startup recovery modal's Resume/Keep/Remove choice), as opposed to ambient
+ * boot chatter (provider registration, the resume notice, etc.). Kept in its
+ * own file so ConversationManager (core/conversation.ts) — already near its
+ * line-count gate — doesn't have to carry the bookkeeping inline.
+ *
+ * ConversationManager.rebuildHistory()'s splash-vs-transcript check consults
+ * this via ConversationManager.addUserActionReceipt(): a receipt the user is
+ * actively waiting on must displace the splash the way a user message does,
+ * while quiet startup plumbing keeps rendering underneath it. Indices mirror
+ * messageKindRegistry's own lifecycle — cleared on resetAll(), purged for
+ * indices an undo() frees for reuse, deleted when a later add overwrites the
+ * same recycled index with a non-receipt message.
+ */
+export class UserReceiptIndices {
+  private readonly indices = new Set<number>();
+
+  add(index: number): void {
+    this.indices.add(index);
+  }
+
+  delete(index: number): void {
+    this.indices.delete(index);
+  }
+
+  has(index: number): boolean {
+    return this.indices.has(index);
+  }
+
+  clear(): void {
+    this.indices.clear();
+  }
+
+  /** Drop every tracked index >= minIndex — mirrors undo()'s tail-splice. */
+  purgeFrom(minIndex: number): void {
+    for (const key of this.indices) {
+      if (key >= minIndex) this.indices.delete(key);
+    }
+  }
+}