@pellux/goodvibes-tui 1.20.0 → 1.21.0

package/src/input/search.ts

@@ -5,6 +5,34 @@ export interface SearchMatch {
   line: number;
   col: number;
   length: number;
+  /**
+   * Present when this match lives inside content that is still collapsed —
+   * `line`/`col` are placeholders (the containing block's own header line,
+   * col 0) rather than a real navigable position. `collapseKeys` names every
+   * collapse key that must be expanded to make the hit a real rendered
+   * line; `primaryKey` is the specific key whose block range identifies
+   * where the revealed match will land (see revealCurrentMatch).
+   * Absent entirely for a match already visible in the rendered buffer.
+   */
+  collapseKeys?: readonly string[];
+  primaryKey?: string;
+}
+
+/** Count non-overlapping occurrences of `needle` in `haystack` — used for
+ *  the collapsed-content scan below, mirroring the per-line indexOf loop
+ *  search() already runs over the rendered buffer, so a hidden hit counts
+ *  the same way a visible one would once revealed. */
+function countOccurrences(haystack: string, needle: string): number {
+  if (needle.length === 0) return 0;
+  let count = 0;
+  let col = 0;
+  while (col <= haystack.length - needle.length) {
+    const idx = haystack.indexOf(needle, col);
+    if (idx === -1) break;
+    count++;
+    col = idx + 1;
+  }
+  return count;
 }
 
 /**
@@ -45,127 +73,187 @@ export class SearchManager {
     this.locked = false;
   }
 
-  /** Close search mode. */
-  close(): void {
+  /**
+   * Close search mode. Re-collapses every block/group search auto-expanded
+   * while it was open — except ones the user explicitly acted on (toggled,
+   * copied, bookmarked, saved) while they were expanded, which stay exactly
+   * as the user left them (see SearchExpansionTracker.restoreOnto).
+   * `conversationManager` is optional so existing call sites that never had
+   * one (and therefore never auto-expanded anything) keep working unchanged.
+   */
+  close(conversationManager?: ConversationManager | null): void {
+    conversationManager?.searchExpansion.restoreOnto(conversationManager);
     this.active = false;
     this.locked = false;
   }
 
   /**
-   * Update query and find matches in the history buffer.
-   *
-   * A collapsed block (or folded tool-result group) renders 1-2 summary
-   * lines, so scanning only the rendered buffer misses text the user watched
-   * stream by before it folded. When `conversationManager` is provided, any
-   * currently-collapsed block whose searchable corpus contains the query is
-   * expanded first (never re-collapsed — a false "No matches" is a lie, an
-   * extra expand is not), so the match becomes a real, navigable line in the
-   * rendered buffer scanned below.
+   * Update query and find matches — honestly counting hits inside collapsed
+   * blocks and folded tool-result groups WITHOUT expanding them. Expansion
+   * only happens on navigation (see revealCurrentMatch): typing a query must
+   * never collapse-destroy the transcript the user folded on purpose, but a
+   * "no matches" while text the user watched stream by sits collapsed
+   * somewhere would be a lie too — so the count includes it, tagged as
+   * hidden until the user actually navigates there.
    *
-   * That corpus is the block's own RAW content, plus — for a folded
-   * tool-result group — the raw content of every one of its member messages.
-   * A group's own rawContent is only its summary header line ("2 tool results
-   * folded (read exec, 18 lines total)") and its members push no BlockMeta of
-   * their own while folded (see conversation-tool-groups.ts), so without the
-   * member corpus a needle living inside a member matches nothing at all and
-   * the user gets "No matches" for text they watched stream by. Member text is
-   * read off the message snapshot, and is the same string the renderer stores
-   * as that member's own block rawContent once the group is expanded.
+   * That collapsed corpus is the block's own RAW content, plus — for a
+   * folded tool-result group — the raw content of every one of its member
+   * messages (a group's own rawContent is only its summary header line, and
+   * its members push no BlockMeta of their own while folded — see
+   * conversation-tool-groups.ts — so without the member corpus a needle
+   * living inside a member would count as zero hits for text the user
+   * watched stream by).
    *
-   * A hit anywhere in that corpus expands the group's own collapseKey AND
-   * every member's `msg_<idx>` key — expanding the header alone would leave
-   * the member holding the hit invisible, and expanding all members keeps the
-   * behavior identical whether the hit came from the header or a member.
-   *
-   * `getDisplayBlocks()` is flushed before the buffer is scanned, and the
-   * overlay's match count is always derived from that same rendered scan, so
-   * it never claims more than it can actually navigate to.
+   * Matches are built in one pass over `history.getAllLines()` combined with
+   * one pass over collapsed blocks, then sorted into document order (by
+   * rendered line, with a collapsed block's hidden hits keyed to its own
+   * still-real header line) so that navigation lands on hits in the order
+   * they actually appear in the transcript.
    */
   search(query: string, history: InfiniteBuffer, conversationManager?: ConversationManager | null): void {
     this.query = query;
-    this.matches = [];
     this.currentMatch = 0;
-
     this.wrapAround = false;
-    if (query.length === 0) return;
 
+    if (query.length === 0) {
+      this.matches = [];
+      return;
+    }
+
+    this.matches = this.buildMatches(query, history, conversationManager);
+  }
+
+  /**
+   * Shared match builder for search() and revealCurrentMatch() — scans the
+   * currently-rendered buffer for visible matches and every collapsed
+   * block/folded group for hidden ones, without mutating any collapse
+   * state. Kept separate from search() so revealCurrentMatch can rebuild the
+   * match list after an expansion without resetting currentMatch back to 0.
+   */
+  private buildMatches(query: string, history: InfiniteBuffer, conversationManager?: ConversationManager | null): SearchMatch[] {
     const lowerQuery = query.toLowerCase();
+    const hiddenMatches: SearchMatch[] = [];
 
     if (conversationManager) {
       const registry = conversationManager.getBlockRegistry();
 
-      // A folded tool-result group's members render nothing and register no
-      // BlockMeta while collapsed (see conversation-tool-groups.ts), so the
-      // group's searchable corpus is its own header rawContent PLUS each
-      // member's raw content — which only the message snapshot can supply,
-      // since there is no member block to read it from.
-      const memberIndexes: number[] = [];
       for (const block of registry) {
-        if (block.type !== 'tool_group' || !block.groupMemberIndexes) continue;
         if (!conversationManager.isCollapsed(block.blockIndex)) continue;
-        memberIndexes.push(...block.groupMemberIndexes);
-      }
 
-      // Read in ONE snapshot pass: getMessageSnapshot() clones the whole
-      // message array (~0.8ms on a 900-message conversation) and search() runs
-      // on every keystroke, so a per-member read would stall typing outright.
-      // Skipped entirely when nothing is folded.
-      const memberContent = new Map<number, string>();
-      if (memberIndexes.length > 0) {
-        const snapshot = conversationManager.getMessageSnapshot();
-        for (const memberIdx of memberIndexes) {
-          // This is the exact string the renderer stores as a member's own
-          // block rawContent (renderConversationToolMessage in
-          // conversation-rendering.ts) — the corpus is what expanding really
-          // reveals, not a second notion of "content". A member index that
-          // outlived its message (undo() splices the messages tail while a
-          // stale registry still names it) reads back undefined and is simply
-          // skipped rather than throwing.
-          const content = snapshot[memberIdx]?.content;
-          if (typeof content === 'string') memberContent.set(memberIdx, content.toLowerCase());
-        }
-      }
+        if (block.type === 'tool_group' && block.groupMemberIndexes) {
+          // The header's own synthetic summary rarely matches, but count it
+          // honestly too — expanding the whole group is the only way to even
+          // attempt to reveal a header-corpus hit, since there is no single
+          // member to isolate it to.
+          const headerHits = countOccurrences(block.rawContent.toLowerCase(), lowerQuery);
+          const allKeys = [block.collapseKey, ...block.groupMemberIndexes.map((idx) => `msg_${idx}`)];
+          for (let i = 0; i < headerHits; i++) {
+            hiddenMatches.push({
+              line: block.startLine, col: 0, length: query.length,
+              collapseKeys: allKeys, primaryKey: block.collapseKey,
+            });
+          }
 
-      let expandedAny = false;
-      for (const block of registry) {
-        if (!conversationManager.isCollapsed(block.blockIndex)) continue;
-        const members = block.type === 'tool_group' ? (block.groupMemberIndexes ?? []) : [];
-        const hit = block.rawContent.toLowerCase().includes(lowerQuery)
-          || members.some((memberIdx) => (memberContent.get(memberIdx) ?? '').includes(lowerQuery));
-        if (!hit) continue;
-        conversationManager.setCollapsed(block.collapseKey, false);
-        // Expanding just the group header would still hide each member's own
-        // content — including the member the query actually matched — so open
-        // every member's own collapse key in the same pass. Already-expanded
-        // keys are unaffected; setting false over false is a no-op.
-        for (const memberIdx of members) {
-          conversationManager.setCollapsed(`msg_${memberIdx}`, false);
+          if (block.groupMemberIndexes.length > 0) {
+            // Read in ONE snapshot pass: getMessageSnapshot() clones the
+            // whole message array and search() runs on every keystroke, so a
+            // per-member read would stall typing outright.
+            const snapshot = conversationManager.getMessageSnapshot();
+            for (const memberIdx of block.groupMemberIndexes) {
+              const content = snapshot[memberIdx]?.content;
+              if (typeof content !== 'string') continue;
+              const memberKey = `msg_${memberIdx}`;
+              const memberHits = countOccurrences(content.toLowerCase(), lowerQuery);
+              for (let i = 0; i < memberHits; i++) {
+                hiddenMatches.push({
+                  line: block.startLine, col: 0, length: query.length,
+                  // Revealing a member-specific hit only needs the group
+                  // header (to unfold the group at all) and that member's own
+                  // key — not its siblings, which stay exactly as they were.
+                  collapseKeys: [block.collapseKey, memberKey], primaryKey: memberKey,
+                });
+              }
+            }
+          }
+        } else {
+          const hits = countOccurrences(block.rawContent.toLowerCase(), lowerQuery);
+          for (let i = 0; i < hits; i++) {
+            hiddenMatches.push({
+              line: block.startLine, col: 0, length: query.length,
+              collapseKeys: [block.collapseKey], primaryKey: block.collapseKey,
+            });
+          }
         }
-        expandedAny = true;
-      }
-      if (expandedAny) {
-        // Flush the pending re-render so `history` (the same buffer
-        // instance) reflects the newly-expanded content before it's scanned
-        // below — mirrors the existing getDisplayBlocks()-before-read idiom
-        // used by jumpToBookmark/scrollToLine.
-        conversationManager.getDisplayBlocks();
       }
     }
 
+    const visibleMatches: SearchMatch[] = [];
     const lines = history.getAllLines();
-
     for (let lineIdx = 0; lineIdx < lines.length; lineIdx++) {
       const line = lines[lineIdx];
-      // Build text from cells
       const text = line.map(c => c.char).join('').toLowerCase();
       let col = 0;
       while (col <= text.length - lowerQuery.length) {
         const idx = text.indexOf(lowerQuery, col);
         if (idx === -1) break;
-        this.matches.push({ line: lineIdx, col: idx, length: query.length });
+        visibleMatches.push({ line: lineIdx, col: idx, length: query.length });
         col = idx + 1;
       }
     }
+
+    // Stable sort (V8/JSC have guaranteed stable Array#sort) puts each
+    // block's hidden hits in the same relative order they were generated
+    // in — self-corpus first, then members in order — right where that
+    // block's header line falls among the visible matches.
+    return [...visibleMatches, ...hiddenMatches].sort((a, b) => a.line - b.line || a.col - b.col);
+  }
+
+  /**
+   * Reveal the current match if it lives inside collapsed content: expands
+   * exactly the block (and, for a folded tool-result group member, its
+   * containing group) needed to make the hit a real navigable line, marks
+   * those keys as search-owned so close() can restore them, and rebuilds
+   * the match list against the now-expanded buffer.
+   *
+   * `currentMatch` is repointed at the first now-visible match inside the
+   * revealed block's new line range, rather than reset to 0 — expansion
+   * only changes how many lines that ONE block renders as, so every match
+   * belonging to earlier blocks keeps its relative position.
+   *
+   * No-op when the current match is already visible, or when no
+   * conversationManager was supplied (nothing to expand against).
+   */
+  revealCurrentMatch(history: InfiniteBuffer, conversationManager?: ConversationManager | null): void {
+    const match = this.matches[this.currentMatch];
+    if (!match || !match.collapseKeys || match.collapseKeys.length === 0) return;
+    if (!conversationManager) return;
+
+    for (const key of match.collapseKeys) {
+      conversationManager.setCollapsed(key, false);
+      conversationManager.searchExpansion.markSearchExpanded(key);
+    }
+    // Flush so the registry read below reflects the newly-expanded content.
+    conversationManager.getDisplayBlocks();
+
+    const primaryKey = match.primaryKey ?? match.collapseKeys[match.collapseKeys.length - 1];
+    const revealedBlock = conversationManager.getBlockRegistry().find((b) => b.collapseKey === primaryKey);
+
+    this.matches = this.buildMatches(this.query, history, conversationManager);
+
+    if (revealedBlock) {
+      const idx = this.matches.findIndex((m) =>
+        !m.collapseKeys
+        && m.line >= revealedBlock.startLine
+        && m.line < revealedBlock.startLine + revealedBlock.lineCount,
+      );
+      if (idx >= 0) {
+        this.currentMatch = idx;
+        return;
+      }
+    }
+    // Fallback: keep the pointer in range rather than throwing if the exact
+    // target couldn't be relocated.
+    if (this.currentMatch >= this.matches.length) this.currentMatch = Math.max(0, this.matches.length - 1);
   }
 
   /** Jump to next match. Wraps around; sets wrapAround when it does. */
@@ -184,21 +272,27 @@ export class SearchManager {
     this.currentMatch = prev;
   }
 
-  /** Get the line number of the current match (for scroll). */
+  /** Get the line number of the current match (for scroll). Returns -1 for a
+   *  match that's still hidden inside collapsed content — revealCurrentMatch
+   *  must run first to give it a real line. */
   getCurrentMatchLine(): number {
     if (this.matches.length === 0) return -1;
-    return this.matches[this.currentMatch]?.line ?? -1;
+    const match = this.matches[this.currentMatch];
+    if (!match) return -1;
+    if (match.collapseKeys && match.collapseKeys.length > 0) return -1;
+    return match.line;
   }
 
-  /** Get matches on a given line. */
+  /** Get matches on a given line. Hidden (still-collapsed) matches are
+   *  excluded — they have no real line to render a highlight on yet. */
   getMatchesOnLine(lineIdx: number): SearchMatch[] {
-    return this.matches.filter(m => m.line === lineIdx);
+    return this.matches.filter(m => m.line === lineIdx && !m.collapseKeys);
   }
 
   /** Is the current match on the given line at the given col? */
   isCurrentMatch(lineIdx: number, col: number): boolean {
     if (this.matches.length === 0) return false;
     const m = this.matches[this.currentMatch];
-    return m !== undefined && m.line === lineIdx && m.col === col;
+    return m !== undefined && !m.collapseKeys && m.line === lineIdx && m.col === col;
   }
 }

package/src/main.ts

@@ -16,6 +16,7 @@ import { PermissionPromptUI, buildPendingPermissionExtras } from './permissions/
 import { handleBrokerApprovalChange, buildFixSessionAffordance, buildFixSessionErrorNotice, handleFixSessionAttachKey, refreshFixSessionsFromApprovals } from './permissions/broker-approval-card.ts';
 import { CommandRegistry } from './input/command-registry.ts';
 import type { CommandContext } from './input/command-registry.ts';
+import { requestedEffortLevel } from './providers/reasoning-effort-surface.ts';
 import { renderProcessIndicator } from './renderer/process-indicator.ts';
 import { registerBuiltinCommands } from './input/commands.ts';
 import { ScheduleManager } from '@pellux/goodvibes-sdk/platform/tools';
@@ -24,7 +25,8 @@ import { getTierPromptSupplement, getTierForContextWindow } from '@pellux/goodvi
 import { GitStatusProvider } from './renderer/git-status.ts';
 import type { GitHeaderInfo } from './renderer/git-status.ts';
 import { createShellLayout } from './renderer/layout-engine.ts';
-import { buildShellFooter, estimateShellFooterHeight } from './renderer/shell-surface.ts';
+import { buildShellFooter, estimateShellFooterHeight, promptCursorOffset } from './renderer/shell-surface.ts';
+import { createFailoverTurnState, resolveActiveModelDisplay } from './core/active-model-identity.ts';
 import { computePromptContentWidth } from './renderer/prompt-content-width.ts';
 import { buildConversationViewport } from './renderer/conversation-layout.ts';
 import { applyConversationOverlays } from './renderer/conversation-overlays.ts';
@@ -66,7 +68,7 @@ import { wireTurnEventHandlers } from './core/turn-event-wiring.ts';
 import { resolveContextStatusHint } from './renderer/context-status-hint.ts';
 import { isEffectiveDangerMode } from './config/index.ts';
 import { createScriptableStatusline } from './core/scriptable-statusline.ts';
-import { applyComposerCapture } from './input/composer-capture.ts';
+import { applyComposerCapture, applyAtModelDirective } from './input/composer-capture.ts';
 import { createSessionAutoTitler } from './core/session-auto-titler.ts';
 import { makeComposerEditorOpener } from './input/composer-editor.ts';
 import { evaluateSessionMaintenance } from '@/runtime/index.ts';
@@ -178,6 +180,8 @@ async function main() {
   let lastMaxScroll: number | null = null;
   // Stream and tool-timer state; mutated by wireStreamEventMetrics handlers, read during render.
   const streamMetrics: StreamMetrics = createStreamMetrics();
+  // Live failover record — written by the failover path, read every frame so the header and footer agree.
+  const failoverState = createFailoverTurnState();
 
   const getPromptContentWidth = () => computePromptContentWidth(stdout.columns);
 
@@ -271,23 +275,10 @@ async function main() {
   const submitInput = (text: string, content?: ContentPart[], options: { readonly spokenOutput?: boolean } = {}) => {
     input.clearModalStack();
     scrollLocked = true; // Re-lock on any user input
-    const AT_MODEL_RE = /@model:([^\s]+)/g;
-    let processedText = text;
-    let atModelMatch: RegExpExecArray | null;
-    while ((atModelMatch = AT_MODEL_RE.exec(text)) !== null) {
-      const modelId = atModelMatch[1];
-      try {
-        providerRegistry.setCurrentModel(modelId);
-        const def = providerRegistry.getCurrentModel();
-        runtime.model = def.id;
-        runtime.provider = def.provider;
-        configManager.set('provider.model', def.registryKey);
-        systemMessageRouter.high(`[Model] Switched to ${def.displayName} (${def.provider}) via @model:`);
-      } catch {
-        systemMessageRouter.high(`[Model] Unknown model: ${modelId}`);
-      }
-      processedText = processedText.replace(atModelMatch[0], '').trim();
-    }
+    conversation.dismissSplash(); // owner rule: any submission retires the splash for the run
+    let processedText = applyAtModelDirective(text, {
+      providerRegistry, runtime, configManager, notify: (m) => systemMessageRouter.high(m),
+    });
     // Composer capture markers: `!#` pins + sends; `#` saves a note without sending.
     processedText = applyComposerCapture(processedText, {
       sessionMemoryStore: ctx.services.sessionMemoryStore,
@@ -454,10 +445,9 @@ async function main() {
     const sessionSnapshot = uiServices.readModels.session.getSnapshot();
     const agentSnapshot = uiServices.readModels.agents.getSnapshot();
 
-    const headerLines = UIFactory.createHeader(width, currentModel.id, currentModel.provider, conversation.title || undefined, lastGitInfoRef.value);
-    const managerAgents = agentManager.list().filter(
-      (a) => a.status === 'running' || a.status === 'pending',
-    );
+    const activeModel = resolveActiveModelDisplay({ serving: currentModel, configuredRegistryKey: configManager.get('provider.model') as string, configuredLabel: runtime.model, configuredProvider: runtime.provider, failover: failoverState.current() });
+    const headerLines = UIFactory.createHeader(width, activeModel.headerModel, activeModel.headerProvider, conversation.title || undefined, lastGitInfoRef.value, undefined, activeModel.divergenceNote);
+    const managerAgents = agentManager.list().filter((a) => a.status === 'running' || a.status === 'pending');
     const runtimeAgents = agentSnapshot.active;
     const runningAgentSummary = summarizeRunningAgents(managerAgents, runtimeAgents, ctx.services.wrfcController.listChains());
     const runningAgentCount = runningAgentSummary.count;
@@ -470,30 +460,24 @@ async function main() {
       commandMode: input.commandMode,
       panelFocused: input.panelFocused,
       pendingApproval: pendingPermission !== null,
-      hasAttachments: input.getImageAttachments().size > 0,
-      turnState: sessionSnapshot.turnState,
+      hasAttachments: input.getImageAttachments().size > 0, turnState: sessionSnapshot.turnState,
     });
     const contextStatusHint = resolveContextStatusHint({
       evaluate: (args) => evaluateSessionMaintenance({ configManager, ...args, sessionMemoryCount: ctx.services.sessionMemoryStore.list().length }),
-      currentTokens: orchestrator.lastInputTokens,
-      contextWindow,
+      currentTokens: orchestrator.lastInputTokens, contextWindow,
     });
     const footerLines = buildShellFooter({
       width,
       promptText: promptInfo.visibleLines.join('\n'),
       promptLineCount: promptInfo.visibleLines.length,
-      promptCursorPos: promptInfo.visibleCursorLine >= 0
-        ? promptInfo.visibleLines
-          .slice(0, promptInfo.visibleCursorLine)
-          .reduce((sum: number, line: string) => sum + line.length + 1, 0) + promptInfo.visibleCursorCol
-        : undefined,
+      promptCursorPos: promptCursorOffset(promptInfo),
       usage: { up: orchestrator.usage.input, down: orchestrator.usage.output, fleetCostUsd: footerFleetCost(() => ctx.services.processRegistry.query().nodes, runningAgentCount > 0) },
       showExitNotice: input.showExitNotice,
       lastCopyTime: input.lastCopyTime,
-      model: runtime.model,
+      model: activeModel.footerModel, modelNote: activeModel.divergenceNote,
       toolCount: toolRegistry.list().length,
       workingDir,
-      provider: runtime.provider,
+      provider: activeModel.footerProvider,
       contextWindow,
       contextStatusHint,
       retryHint: retryAffordanceHint(retryAffordance),
@@ -554,6 +538,7 @@ async function main() {
     // Flush pending renders after updating the width provider and splash posture
     // so the transcript and splash rebuild against the current shell layout.
     conversation.getDisplayBlocks();
+    if (conversation.consumeSplashTransition()) compositor.requestFullRepaint(); // splash → transcript: repaint the whole viewport once
 
     // Calculate how many rows are consumed by overlays (thinking, permissions, queue, file picker)
     let overlayRows = 0;
@@ -709,17 +694,25 @@ async function main() {
   // Time-bounded: onExpire repaints once the 60s disarm timer fires, so a stray keypress hours
   // later can never trigger a real retry — see retry-affordance.ts.
   const retryAffordance = createRetryAffordanceState({ onExpire: render });
-  const retryTurn = (): void => {
-    if (!retryCtx) return;
+  const retryTurn = (notice?: string): boolean => {
+    if (!retryCtx) return false; // nothing to roll back to; the caller narrates instead
     const { count, text, content: rContent, opts: rOpts } = retryCtx;
     // Roll back to pre-submission count, then re-submit. SDK gap — no retry-in-place (see handoff).
+    // The rollback erases the failed turn's transcript — the failover notice included, which is how
+    // that notice used to vanish before anyone could read it. The caller hands it over instead, and
+    // it is posted here: after the rollback, above the prompt it explains.
     conversation.removeMessagesAfter(count);
+    if (notice) systemMessageRouter.userReceipt(notice);
     void refreshMemoryRecallSnapshot(ctx.services).then(() => orchestrator.handleUserInput(text, rContent, rOpts)).catch((e: unknown) => logger.debug('retryTurn', { error: summarizeError(e) }));
+    return true;
   };
   const streamResult: WireStreamEventMetricsResult = wireStreamEventMetrics({
     events: uiServices.events, orchestrator, providerRegistry,
     systemMessageRouter, render, metrics: streamMetrics,
     providerOptimizer: ctx.services.providerOptimizer, costLookup: providerRegistry, retryTurn,
+    failoverState, getConfiguredRegistryKey: () => configManager.get('provider.model') as string | undefined,
+    // The REQUESTED level, through the one helper every remap site reads from.
+    getConfiguredReasoningEffort: () => requestedEffortLevel(configManager),
     isApprovalPending: () => pendingPermission !== null,
   });
   unsubs.push(...streamResult.unsubs);
@@ -743,7 +736,7 @@ async function main() {
   const themeProbe = installBackgroundThemeProbe({ configManager, isTTY: Boolean(stdout.isTTY), env: process.env, writeQuery: (b) => allowTerminalWrite(() => stdout.write(b)), requestRepaint: () => { compositor.resetDiff(); render(); } });
 
   // continueRecovery lets --continue/bare --resume check the target session for a live crash snapshot newer than its store before resuming (see tui-startup.ts).
-  applyInitialTuiCliState({ cli, input, commandRegistry, commandContext, shellPaths: ctx.services.shellPaths, surface: ctx.services.surface, render, continueRecovery: { sessionManager: ctx.services.sessionManager, runtime, conversation, writeLastSessionPointer, receipt: (line) => systemMessageRouter.high(line) } });
+  applyInitialTuiCliState({ cli, input, commandRegistry, commandContext, shellPaths: ctx.services.shellPaths, surface: ctx.services.surface, render, continueRecovery: { sessionManager: ctx.services.sessionManager, runtime, conversation, writeLastSessionPointer, receipt: (line) => systemMessageRouter.userReceipt(line) } });
 
   stdin.on('data', (raw: string) => {
     const data = themeProbe.filterInput(raw); if (data.length === 0) return;
@@ -788,7 +781,7 @@ async function main() {
   // frame so the question is drawn rather than posed at a blank terminal.
   scheduleRecoveryOffer(buildRecoveryOfferWiring({
     surface: ctx.services.surface, sessionManager: ctx.services.sessionManager, runtime, conversation, commandContext,
-    writeLastSessionPointer, receipt: (line) => systemMessageRouter.high(line), render,
+    writeLastSessionPointer, receipt: (line) => systemMessageRouter.userReceipt(line), render,
   }));
 
   // Auto-save to recovery file every 60s + multi-instance liveness-marker

package/src/{cli → providers}/provider-classification.ts

@@ -1,3 +1,15 @@
+/**
+ * provider-classification.ts — how a provider is paid for: a raw API key, a
+ * cloud account, a stored subscription/OAuth session, a local runtime, or
+ * honestly unknown.
+ *
+ * Lives in the foundation `providers` layer (it imports nothing) because both
+ * the CLI management surfaces and the in-session failover notice need it: when
+ * automatic failover moves a turn onto a different backend, the notice names
+ * the billing class it moved from and to, so a switch from a metered API key
+ * onto the user's own subscription is something the user can see and object to
+ * rather than discover on an invoice.
+ */
 export type ProviderSetupClass =
   | 'api-key'
   | 'cloud-account'