@pellux/goodvibes-tui 1.7.0 → 1.9.0

package/src/shell/recovery-input-helpers.ts

@@ -5,8 +5,15 @@
  * architecture line ceiling; main() wires these with its live services.
  */
 
+import { copyFileSync, existsSync, readFileSync, unlinkSync } from 'node:fs';
 import type { ConversationMessageSnapshot } from '../core/conversation.ts';
-import type { SessionSnapshot } from '@/runtime/index.ts';
+import type { SessionReturnContextSummary, SessionSnapshot } from '@/runtime/index.ts';
+import {
+  checkRecoveryFile,
+  deleteRecoveryFile as deleteLiveRecoveryFile,
+  getRecoveryFilePath,
+  loadRecoveryConversation as loadLiveRecoveryConversation,
+} from '@/runtime/index.ts';
 
 export interface PersistRecoveryDeps {
   readonly sessionManager: {
@@ -41,6 +48,168 @@ export function createReopenRecoveryPanels(deps: ReopenPanelsDeps): (snapshot: S
   };
 }
 
+// ---------------------------------------------------------------------------
+// W3 Finding 3: preserve the dismissed recovery snapshot.
+//
+// main.ts's 60s autosave (writeRecoveryFile) overwrites the single shared
+// recovery.jsonl with the CURRENT session's live state within a minute — so
+// the dismiss banner's promise ("still on disk; you will be asked again next
+// time") went false silently well before the next launch. Fix: the moment
+// the user dismisses (blocking-input.ts), copy recovery.jsonl aside to a
+// preserved sibling file (recovery.jsonl.preserved) so it survives this
+// session's later autosaves. Startup then checks BOTH the live file and the
+// preserved sibling and offers whichever is newer (pickNewestRecoveryInfo),
+// bounded to exactly one preserved file — a later dismiss replaces it, and
+// that replacement is reported honestly (PreserveRecoveryResult.replacedPrevious)
+// rather than silently dropping the older snapshot.
+// ---------------------------------------------------------------------------
+
+export interface RecoveryFileDeps {
+  readonly homeDirectory: string;
+  readonly surfaceRoot?: string | undefined;
+}
+
+export interface PreservedRecoveryInfo {
+  readonly title: string;
+  readonly timestamp: number;
+  readonly sessionId: string;
+  readonly returnContext?: SessionReturnContextSummary | undefined;
+}
+
+export interface PreserveRecoveryResult {
+  /** True if a live recovery.jsonl existed and was copied to the preserved sibling. */
+  readonly preserved: boolean;
+  /** True if an existing preserved sibling (from an earlier dismiss) was overwritten. */
+  readonly replacedPrevious: boolean;
+}
+
+function preservedRecoveryPath(deps: RecoveryFileDeps): string {
+  return `${getRecoveryFilePath(deps.homeDirectory, deps.surfaceRoot)}.preserved`;
+}
+
+function readRecoveryMetaLine(path: string): { title?: string; timestamp?: number; sessionId?: string; returnContext?: SessionReturnContextSummary } | null {
+  try {
+    if (!existsSync(path)) return null;
+    const firstLine = readFileSync(path, 'utf-8').split('\n')[0];
+    if (!firstLine) return null;
+    return JSON.parse(firstLine) as { title?: string; timestamp?: number; sessionId?: string; returnContext?: SessionReturnContextSummary };
+  } catch {
+    return null;
+  }
+}
+
+/** Copy the live recovery.jsonl aside to the preserved sibling. Called once, at dismiss. */
+export function createPreserveRecoveryFile(deps: RecoveryFileDeps): () => PreserveRecoveryResult {
+  return () => {
+    const live = getRecoveryFilePath(deps.homeDirectory, deps.surfaceRoot);
+    const preserved = preservedRecoveryPath(deps);
+    if (!existsSync(live)) return { preserved: false, replacedPrevious: false };
+    const replacedPrevious = existsSync(preserved);
+    try {
+      copyFileSync(live, preserved);
+      return { preserved: true, replacedPrevious };
+    } catch {
+      return { preserved: false, replacedPrevious: false };
+    }
+  };
+}
+
+/**
+ * Startup check for the preserved sibling — mirrors the SDK's
+ * checkRecoveryFile meta read, but for the fixed preserved path. No
+ * mtime-vs-last-clean-save gate: the preserved file is inert (never
+ * autosaved-over) until explicitly replaced or cleared, so its mere
+ * existence is actionable.
+ */
+export function checkPreservedRecoveryFile(deps: RecoveryFileDeps): PreservedRecoveryInfo | null {
+  const meta = readRecoveryMetaLine(preservedRecoveryPath(deps));
+  if (!meta) return null;
+  return { title: meta.title ?? '', timestamp: meta.timestamp ?? 0, sessionId: meta.sessionId ?? '', returnContext: meta.returnContext };
+}
+
+/** Load the preserved sibling's full snapshot — same JSONL shape as recovery.jsonl since it's a byte-identical copy. */
+export function loadPreservedRecoveryConversation(deps: RecoveryFileDeps): SessionSnapshot | null {
+  const path = preservedRecoveryPath(deps);
+  try {
+    if (!existsSync(path)) return null;
+    const lines = readFileSync(path, 'utf-8').split('\n').filter(Boolean);
+    if (lines.length < 2) return { messages: [] };
+    const metaLine = JSON.parse(lines[0]!) as { title?: string; titleSource?: SessionSnapshot['titleSource']; returnContext?: SessionSnapshot['returnContext'] };
+    return {
+      title: metaLine.title,
+      titleSource: metaLine.titleSource,
+      returnContext: metaLine.returnContext,
+      messages: lines.slice(1).map((line) => {
+        const { type: _type, ...rest } = JSON.parse(line) as { type: string } & Record<string, unknown>;
+        return rest;
+      }),
+    };
+  } catch {
+    return null;
+  }
+}
+
+/** Remove the preserved sibling — called after it has been restored or discarded. */
+export function deletePreservedRecoveryFile(deps: RecoveryFileDeps): void {
+  try {
+    unlinkSync(preservedRecoveryPath(deps));
+  } catch {
+    // missing file is fine
+  }
+}
+
+/**
+ * Pick the newer of the live vs. preserved recovery info for the startup
+ * prompt, tagging which source it came from so the caller knows which
+ * load/delete pair to use. Null when neither exists.
+ */
+export function pickNewestRecoveryInfo<T extends { readonly timestamp: number }>(
+  live: T | null,
+  preserved: T | null,
+): (T & { readonly source: 'live' | 'preserved' }) | null {
+  if (!live && !preserved) return null;
+  if (!live) return { ...(preserved as T), source: 'preserved' };
+  if (!preserved) return { ...live, source: 'live' };
+  return preserved.timestamp > live.timestamp
+    ? { ...(preserved as T), source: 'preserved' }
+    : { ...live, source: 'live' };
+}
+
+/**
+ * Startup entry point: resolve which recovery prompt (if any) main.ts should
+ * show — the live recovery.jsonl, or an earlier dismiss's preserved sibling,
+ * whichever is newer. Bundles checkRecoveryFile + checkPreservedRecoveryFile
+ * + pickNewestRecoveryInfo so main.ts's entrypoint stays a one-liner.
+ */
+export function resolveStartupRecoveryInfo(
+  deps: RecoveryFileDeps & { readonly workingDirectory: string },
+): (PreservedRecoveryInfo & { readonly source: 'live' | 'preserved' }) | null {
+  const live = checkRecoveryFile({ workingDirectory: deps.workingDirectory, homeDirectory: deps.homeDirectory });
+  const preserved = checkPreservedRecoveryFile(deps);
+  return pickNewestRecoveryInfo(live, preserved);
+}
+
+export interface RecoveryFileOps {
+  readonly loadRecoveryConversation: () => SessionSnapshot | null;
+  readonly deleteRecoveryFile: () => void;
+  readonly preserveRecoveryFile?: () => PreserveRecoveryResult;
+}
+
+/**
+ * Build the three source-aware recovery callbacks main.ts's stdin handler
+ * wires into handleBlockingShellInput. `getSource` is read fresh by
+ * load/delete on every call (main.ts's recoverySource can change between
+ * events); preserveRecoveryFile is only ever wired when the CURRENT prompt
+ * came from the live file (see createPreserveRecoveryFile's doc comment).
+ */
+export function createRecoveryFileOps(getSource: () => 'live' | 'preserved', deps: RecoveryFileDeps): RecoveryFileOps {
+  return {
+    loadRecoveryConversation: () => (getSource() === 'preserved' ? loadPreservedRecoveryConversation(deps) : loadLiveRecoveryConversation(deps)),
+    deleteRecoveryFile: () => (getSource() === 'preserved' ? deletePreservedRecoveryFile(deps) : deleteLiveRecoveryFile(deps)),
+    preserveRecoveryFile: getSource() === 'live' ? createPreserveRecoveryFile(deps) : undefined,
+  };
+}
+
 export interface ErrorAffordanceDeps {
   /** True when the failover retry context is armed (a retry is actually possible). */
   readonly retryArmed: boolean;

package/src/shell/ui-openers.ts

@@ -15,6 +15,8 @@ import type { ServiceInspectionQuery } from '../runtime/ui-service-queries.ts';
 import type { EmbeddingProviderPickerEntry, ModelPickerTargetInfo } from '../input/model-picker.ts';
 import type { SelectionItem } from '../input/selection-modal.ts';
 import { syncServiceSettingToPlatform } from './service-settings-sync.ts';
+import { setActiveThemeMode } from '../renderer/theme.ts';
+import { THEME_MODE_CONFIG_KEY, coerceThemeModeSetting } from '../renderer/theme-mode-config.ts';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 
 type WireShellUiOpenersOptions = {
@@ -229,7 +231,13 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
 
   commandContext.openModelPicker = () => {
     void (async () => {
-      const models = providerRegistry.getSelectableModels();
+      // D5: getSelectableModels() is catalog-driven and can list models whose
+      // `provider` id (e.g. 'google', sourced from the pricing catalog) was never
+      // handed to providerRegistry.register()/registerRuntimeProvider(). Selecting
+      // such a model fails hard at turn time with ProviderNotFoundError
+      // ("Provider 'X' is not registered."). Filter to runtime-registered
+      // providers only, so the picker never offers a model that cannot work.
+      const models = providerRegistry.getSelectableModels().filter((m) => providerRegistry.has(m.provider));
       const configuredIds = new Set(getConfiguredProviderIds());
       input.modelPicker.configuredProviders = configuredIds;
       const providerIds = [...new Set(models.map((m) => m.provider))];
@@ -256,7 +264,13 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
 
   commandContext.openProviderPicker = () => {
     void (async () => {
-      const providers = [...new Set(providerRegistry.listModels().map((model) => model.provider))];
+      // D5: listModels() surfaces every catalog provider id, not just the ones
+      // actually registered on this runtime (see openModelPicker above for the
+      // same class of bug). Intersect against providerRegistry.has() so the
+      // provider picker never offers a provider that will fail with
+      // "Provider not registered" once a model under it is selected.
+      const providers = [...new Set(providerRegistry.listModels().map((model) => model.provider))]
+        .filter((providerId) => providerRegistry.has(providerId));
       const configuredIds = new Set(getConfiguredProviderIds());
       input.modelPicker.configuredProviders = configuredIds;
       const secretProviderIds = await resolveSecretProviderIds();
@@ -325,10 +339,23 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
   commandContext.openSettingsModal = (target?: string) => {
     input.modalOpened('settings');
     input.settingsModal.open(configManager, featureFlags, subscriptionManager, serviceRegistry, mcpRegistry, secretsManager, {
-      onSettingApplied: (change) => syncServiceSettingToPlatform(
-        { configManager, workingDirectory, homeDirectory },
-        change,
-      ),
+      onSettingApplied: (change) => {
+        // DEBT-2: forced dark/light applies immediately (rebuild palettes + full
+        // repaint); auto only re-probes at startup, so it takes effect next launch.
+        if (String(change.key) === THEME_MODE_CONFIG_KEY) {
+          const next = coerceThemeModeSetting(change.value);
+          if (next === 'dark' || next === 'light') {
+            setActiveThemeMode(next);
+            commandContext.requestFullRepaint?.();
+            return { message: `Theme mode: ${next} (applied now)` };
+          }
+          return { message: 'Theme mode: auto (probes terminal on next startup)' };
+        }
+        return syncServiceSettingToPlatform(
+          { configManager, workingDirectory, homeDirectory },
+          change,
+        );
+      },
     });
     input.settingsModal.selectTarget(target);
     render();
@@ -441,10 +468,16 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
     render();
   };
 
-  commandContext.showPanel = (panelId, pane) => {
-    panelManager.open(panelId, pane);
+  commandContext.showPanel = (panelId, pane, target, opts) => {
+    // DEBT-5: forward the deep-link target so a jumped-to panel lands on the
+    // right row (fleet --target); undefined for ordinary opens.
+    panelManager.open(panelId, pane, target);
     panelManager.show();
-    panelManager.focusPanels();
+    // UX-C focus rule 1a: every registered caller of showPanel is a slash
+    // command (/panel open, /routes, /approval, /tasks, /ops-control, ...) —
+    // the command path leaves focus in the composer ("the user is
+    // mid-command-flow") unless the caller explicitly asks to grab it.
+    if (opts?.focus) panelManager.focusPanels();
     conversation.setSplashSuppressed(true);
     conversation.rebuildHistory();
     render();

package/src/utils/terminal-width.ts

@@ -86,6 +86,13 @@ export function getDisplayWidth(text: string): number {
       code === 0x2717 ||
       code === 0x2714 ||
       code === 0x2718 ||
+      // ✕ (0x2715) and ✖ (0x2716) — the multiplication-X cross family used for
+      // the error-line prefix. Terminals draw them one cell wide, but they sit
+      // inside the 0x2600–0x27bf emoji block below and would otherwise be counted
+      // as width 2, desyncing the styled cell grid from the physical glyph and
+      // corrupting the following text (the "✕t" glitch on the steer error line).
+      code === 0x2715 ||
+      code === 0x2716 ||
       code === 0x2022 ||
       code === 0x258d ||
       (code >= 0x2500 && code <= 0x257f)
@@ -159,6 +166,51 @@ export function truncateDisplay(text: string, width: number, ellipsis = '…'):
   return result + ellipsis;
 }
 
+/** A single footer/status-line segment plus its survival priority. */
+export interface PrioritizedSegment {
+  readonly text: string;
+  /** Lower number = higher priority = dropped LAST under width pressure. */
+  readonly priority: number;
+}
+
+/**
+ * Join segments left-to-right with `separator`, but when the joined line
+ * would exceed `width`, drop whole low-priority segments (highest `priority`
+ * number first) one at a time until it fits — rather than character-truncating
+ * the joined string, which can mangle a high-value segment mid-word (e.g. a
+ * `spine:online` daemon-liveness marker clipped to `spi…`).
+ *
+ * Only falls back to character truncation (via truncateDisplay) if the
+ * remaining highest-priority segments still don't fit at width — a rare,
+ * very-narrow-terminal case.
+ */
+export function joinPrioritizedSegments(
+  segments: readonly PrioritizedSegment[],
+  separator: string,
+  width: number,
+): string {
+  const join = (list: readonly PrioritizedSegment[]) => list.map(s => s.text).join(separator);
+  let kept = segments;
+  // Keep dropping whole segments while more than one remains; once a single
+  // segment is left, stop — an empty result would be a worse outcome than
+  // falling through to character truncation on that last segment below.
+  while (kept.length > 1 && getDisplayWidth(join(kept)) > width) {
+    // Drop the single lowest-priority (highest `priority` number) segment;
+    // ties broken toward the leftmost (earlier-declared) segment surviving —
+    // `>=` (not `>`) so that on equal priority the LATER index keeps winning
+    // as the drop candidate, leaving the earliest-declared segment of that
+    // priority tier intact (e.g. cwd survives over model when both are
+    // priority 0, since cwd is declared first).
+    let dropIdx = 0;
+    for (let i = 1; i < kept.length; i++) {
+      if (kept[i].priority >= kept[dropIdx].priority) dropIdx = i;
+    }
+    kept = kept.slice(0, dropIdx).concat(kept.slice(dropIdx + 1));
+  }
+  const joined = join(kept);
+  return getDisplayWidth(joined) > width ? truncateDisplay(joined, width) : joined;
+}
+
 export function padDisplayEnd(text: string, width: number): string {
   const currentWidth = getDisplayWidth(text);
   if (currentWidth >= width) return text;

package/src/version.ts

@@ -6,7 +6,7 @@ import { join } from 'node:path';
 // The prebuild script updates the fallback value before compilation.
 // Uses import.meta.dir (Bun) to locate package.json relative to this file,
 // which is correct regardless of the process working directory.
-let _version = '1.7.0';
+let _version = '1.9.0';
 try {
   const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', 'package.json'), 'utf-8'));
   _version = pkg.version ?? _version;