@pellux/goodvibes-tui 1.7.0 → 1.9.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pellux/goodvibes-tui",
-  "version": "1.7.0",
+  "version": "1.9.1",
   "description": "Terminal-native GoodVibes product for coding, operations, automation, knowledge, channels, and daemon-backed control-plane workflows.",
   "type": "module",
   "main": "src/main.ts",
@@ -99,7 +99,7 @@
     "@anthropic-ai/vertex-sdk": "^0.16.0",
     "@ast-grep/napi": "^0.42.0",
     "@aws/bedrock-token-generator": "^1.1.0",
-    "@pellux/goodvibes-sdk": "0.38.0",
+    "@pellux/goodvibes-sdk": "1.0.0",
     "bash-language-server": "^5.6.0",
     "fuse.js": "^7.1.0",
     "graphql": "^16.13.2",

package/src/audio/spoken-turn-controller.ts

@@ -61,7 +61,16 @@ export class SpokenTurnController {
     return true;
   }
 
-  stop(message?: string): void {
+  /**
+   * Returns whether speech was actually ACTIVE when stopped. The notice only
+   * prints in that case — stop() on an idle controller used to notify anyway,
+   * spamming "[TTS] Spoken output stopped." on every Ctrl+C (batch replay
+   * D5/N-noise); callers use the return to decide whether the press "did a
+   * job" (see handleCtrlC's consume-on-speech-stop).
+   */
+  stop(message?: string): boolean {
+    const wasActive = this.pendingPrompt !== null || this.activeTurnId !== null
+      || this.chunker !== null || this.abortControllers.size > 0;
     this.pendingPrompt = null;
     this.activeTurnId = null;
     this.chunker?.reset();
@@ -72,7 +81,8 @@ export class SpokenTurnController {
     this.player.stop();
     this.playbackChain = Promise.resolve();
     this.errorReportedForTurn = false;
-    if (message) this.notify?.(`[TTS] ${message}`);
+    if (message && wasActive) this.notify?.(`[TTS] ${message}`);
+    return wasActive;
   }
 
   handleTurnEvent(event: TurnEvent): void {

package/src/audio/spoken-turn-wiring.ts

@@ -8,7 +8,8 @@ import { SpokenTurnController } from './spoken-turn-controller.ts';
 export interface SpokenTurnRuntime {
   readonly unsubs: readonly (() => void)[];
   submitNextTurn(prompt: string): boolean;
-  stop(message?: string): void;
+  /** Returns whether speech was actually active (see controller.stop). */
+  stop(message?: string): boolean;
 }
 
 export interface WireSpokenTurnRuntimeOptions {

package/src/cli/help.ts

@@ -283,10 +283,17 @@ export function renderGoodVibesCommandHelp(topic: string, binary = 'goodvibes'):
 
 export function renderGoodVibesDaemonHelp(binary = 'goodvibes-daemon'): string {
   return [
-    `Usage: ${binary} [OPTIONS]`,
+    `Usage: ${binary} [COMMAND] [OPTIONS]`,
     '',
     'Starts the headless GoodVibes daemon/API host.',
     '',
+    'Commands:',
+    '  install-service                Install + enable the daemon as a systemd user service (survives reboots)',
+    '  uninstall-service              Disable + remove the daemon systemd user service',
+    '  service-status                 Show whether the daemon service is installed / enabled / active',
+    '  migrate-service                Guided takeover of a legacy goodvibes-daemon.service unit; prints a plan',
+    '                                 unless run with -y/--yes (never auto-migrates)',
+    '',
     'Options:',
     '      --daemon-home <dir>        Override daemon home',
     '      --working-dir <dir>        Override working directory',

package/src/cli/service-posture.ts

@@ -5,6 +5,7 @@ import { basename, delimiter, dirname, isAbsolute, join, resolve } from 'node:pa
 import { fileURLToPath } from 'node:url';
 import { PlatformServiceManager } from '@pellux/goodvibes-sdk/platform/daemon';
 import type { ManagedServiceStatus } from '@pellux/goodvibes-sdk/platform/daemon';
+import { resolveDaemonEnabled } from '@pellux/goodvibes-sdk/platform/config';
 import type { ConfigManager } from '../config/index.ts';
 import { resolveRuntimeEndpointBinding } from './endpoints.ts';
 import type { RuntimeEndpointBinding, RuntimeEndpointId } from './endpoints.ts';
@@ -392,7 +393,7 @@ export async function buildCliServicePosture(
     enabled: runtime.configManager.get('service.enabled') === true,
     autostart: runtime.configManager.get('service.autostart') === true,
     restartOnFailure: runtime.configManager.get('service.restartOnFailure') === true,
-    daemonEnabled: runtime.configManager.get('danger.daemon') === true,
+    daemonEnabled: resolveDaemonEnabled(runtime.configManager),
   };
   const serverBackedEnabled = config.daemonEnabled || endpoints.some((endpoint) => endpoint.enabled);
   const issues: string[] = [];

package/src/cli/status.ts

@@ -1,4 +1,5 @@
 import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
+import { resolveDaemonEnabled } from '@pellux/goodvibes-sdk/platform/config';
 import type { OnboardingCheckMarkersState } from '../runtime/onboarding/index.ts';
 import { resolveRuntimeEndpointBinding } from './endpoints.ts';
 import { isNetworkFacing } from './network-posture.ts';
@@ -98,7 +99,7 @@ export function buildCliDoctorFindings(options: CliStatusOptions): readonly CliD
   const serviceEnabled = config.get('service.enabled') === true;
   const serviceAutostart = config.get('service.autostart') === true;
   const restartOnFailure = config.get('service.restartOnFailure') === true;
-  const daemonEnabled = config.get('danger.daemon') === true;
+  const daemonEnabled = resolveDaemonEnabled(config);
   const listenerEnabled = config.get('danger.httpListener') === true;
   const webEnabled = config.get('web.enabled') === true;
   const controlPlaneEnabled = config.get('controlPlane.enabled') === true;

package/src/cli/surface-command.ts

@@ -47,7 +47,7 @@ export async function handleSurfacesCommand(runtime: CliCommandRuntime): Promise
       runtime.configManager.setDynamic('web.enabled', enabled);
       if (enabled) {
         enableFeatureFlags(runtime.configManager, getServerSurfaceFeatureFlags({ serverBacked: true, web: true }));
-        runtime.configManager.setDynamic('danger.daemon', true);
+        runtime.configManager.setDynamic('daemon.enabled', true);
         runtime.configManager.setDynamic('controlPlane.enabled', true);
         const webError = applyTargetEndpointFlagsOrDefault(runtime, 'web');
         if (webError) return { output: webError, exitCode: 2 };
@@ -70,7 +70,7 @@ export async function handleSurfacesCommand(runtime: CliCommandRuntime): Promise
     }
     else if (target === 'control-plane' || target === 'controlPlane') {
       runtime.configManager.setDynamic('controlPlane.enabled', enabled);
-      runtime.configManager.setDynamic('danger.daemon', enabled);
+      runtime.configManager.setDynamic('daemon.enabled', enabled);
       if (enabled) {
         const controlPlaneError = applyTargetEndpointFlagsOrDefault(runtime, 'controlPlane');
         if (controlPlaneError) return { output: controlPlaneError, exitCode: 2 };

package/src/config/credential-availability.ts

@@ -0,0 +1,122 @@
+/**
+ * credential-availability.ts — W6-C1 client-side credential-status read.
+ *
+ * When the TUI acts as a CLIENT of an adopted external daemon (the host-service
+ * `mode === 'external'` topology — see runtime/bootstrap.ts), provider/model/secret
+ * STATUS is read from that daemon's `credentials.get` wire method rather than from
+ * the TUI's own surfaceRoot ('tui') store. This module folds a `credentials.get`
+ * outcome into an honest availability value, mirroring the goodvibes-webui v1.0.1
+ * `deriveCredentialAvailability` contract exactly:
+ *
+ *   - a 503 CREDENTIAL_STORE_UNAVAILABLE (matched by machine code), a METHOD_NOT_FOUND
+ *     from an older daemon, or ANY transport failure  ->  { available: false, reason }
+ *     — an honest, reason-carrying "unavailable" state.
+ *   - NEVER a fabricated "configured"; NEVER a secret byte. Only the boolean status
+ *     metadata surface (key / configured / usable / source / secure) is carried.
+ *
+ * STATUS ONLY moves to the daemon path. Secret RESOLUTION — the value-reads provider
+ * auth needs, plus the env-only API-key posture — stays local and is untouched by
+ * this module. The daemon's `credentials.get` never returns raw key bytes over the
+ * wire (see the SDK decision record 2026-07-06-config-sharing-shared-tier-and-secret-read),
+ * so no plaintext can reach a caller through this path by construction.
+ */
+
+/** One credential's status metadata from the daemon's shared store — never bytes. */
+export interface CredentialStatusEntry {
+  readonly key: string;
+  readonly configured: boolean;
+  readonly usable: boolean;
+  readonly source?: string;
+  readonly secure?: boolean;
+}
+
+/** Honest availability: either a status list, or a reason we could not read it. */
+export type CredentialAvailability =
+  | { readonly available: true; readonly credentials: readonly CredentialStatusEntry[] }
+  | { readonly available: false; readonly reason: string };
+
+/** A `credentials.get` invocation outcome — success value OR a thrown error. */
+export type CredentialStatusOutcome =
+  | { readonly ok: true; readonly value: unknown }
+  | { readonly ok: false; readonly error: unknown };
+
+/** Credential-read posture: read the daemon's shared store, or the local own store. */
+export type CredentialReadMode = 'host' | 'client';
+
+function asRecord(value: unknown): Record<string, unknown> | null {
+  return typeof value === 'object' && value !== null ? (value as Record<string, unknown>) : null;
+}
+
+function readString(record: Record<string, unknown> | null, key: string): string {
+  if (!record) return '';
+  const value = record[key];
+  return typeof value === 'string' ? value : '';
+}
+
+/**
+ * Map the authoritative host-service mode string to the credential-read posture.
+ * Only 'external' (a separately-running daemon this TUI adopted) reads credential
+ * STATUS over the wire; every other mode ('embedded'/'disabled'/'blocked'/
+ * 'incompatible'/'unavailable') is the local host reading its own store.
+ */
+export function credentialReadModeFromHostMode(hostMode: string): CredentialReadMode {
+  return hostMode === 'external' ? 'client' : 'host';
+}
+
+/**
+ * Fold a `credentials.get` outcome into an honest availability value. Mirrors
+ * goodvibes-webui v1.0.1 `deriveCredentialAvailability`: any failure becomes a
+ * reason-carrying `available: false`; a malformed success (no credentials array)
+ * is treated as unavailable rather than fabricated as configured; on success only
+ * the boolean status surface is carried, never a secret value.
+ */
+export function deriveCredentialAvailability(outcome: CredentialStatusOutcome): CredentialAvailability {
+  if (!outcome.ok) {
+    const err = asRecord(outcome.error);
+    const code = readString(err, 'code');
+    if (code === 'CREDENTIAL_STORE_UNAVAILABLE') {
+      return { available: false, reason: 'The daemon has no shared credential store wired.' };
+    }
+    if (code === 'METHOD_NOT_FOUND' || code === 'NOT_INVOKABLE') {
+      return { available: false, reason: 'This daemon does not serve credential status yet.' };
+    }
+    return { available: false, reason: 'Credential status unavailable right now.' };
+  }
+  const value = asRecord(outcome.value);
+  const raw = value?.credentials;
+  if (!Array.isArray(raw)) return { available: false, reason: 'Credential status unavailable right now.' };
+  const credentials: CredentialStatusEntry[] = [];
+  for (const item of raw) {
+    const rec = asRecord(item);
+    const key = readString(rec, 'key');
+    if (!rec || !key) continue;
+    credentials.push({
+      key,
+      configured: rec.configured === true,
+      usable: rec.usable === true,
+      source: readString(rec, 'source') || undefined,
+      secure: rec.secure === true ? true : rec.secure === false ? false : undefined,
+    });
+  }
+  return { available: true, credentials };
+}
+
+/**
+ * Client-side credential-status read. Invokes the adopted external daemon's
+ * `credentials.get` and folds success OR any thrown transport/daemon error into an
+ * honest availability. The daemon's `credentials.get` transport error carries the
+ * machine `code` at the top level (e.g. an HttpStatusError whose body supplied
+ * `CREDENTIAL_STORE_UNAVAILABLE` / `METHOD_NOT_FOUND`), which `deriveCredentialAvailability`
+ * classifies. Only the boolean status surface is returned; a raw secret value can
+ * never reach a caller through this path.
+ */
+export async function readClientCredentialStatus(
+  invokeCredentialsGet: () => Promise<unknown>,
+): Promise<CredentialAvailability> {
+  try {
+    const value = await invokeCredentialsGet();
+    return deriveCredentialAvailability({ ok: true, value });
+  } catch (error) {
+    return deriveCredentialAvailability({ ok: false, error });
+  }
+}

package/src/config/index.ts

@@ -55,3 +55,18 @@ export function getConfiguredSystemPrompt(configManager: Pick<ConfigManager, 'ge
 }
 
 export { getConfiguredApiKeys, resolveApiKeys } from '@pellux/goodvibes-sdk/platform/config';
+
+// W6-C1: client-side credential-status read (honest-degrade, status-only). When the
+// TUI acts as a client of an adopted external daemon it reads provider/model/secret
+// STATUS from that daemon's `credentials.get`, never from its own surfaceRoot store.
+export {
+  credentialReadModeFromHostMode,
+  deriveCredentialAvailability,
+  readClientCredentialStatus,
+} from './credential-availability.ts';
+export type {
+  CredentialAvailability,
+  CredentialReadMode,
+  CredentialStatusEntry,
+  CredentialStatusOutcome,
+} from './credential-availability.ts';

package/src/core/composer-state.ts

@@ -20,8 +20,13 @@ export function deriveComposerState(input: ComposerStateInput): ComposerState {
   const flags: string[] = [];
   let pendingRisk: ComposerState['pendingRisk'] = 'none';
 
-  if (input.pendingApproval) {
-    flags.push('approval');
+  // An approval wait is the dominant composer state and owns the single honest
+  // status tag: `risk:approval-wait`. It is therefore NOT also duplicated as a
+  // `approval` flag, and (below) it suppresses the competing `state:` turn tag —
+  // the turn is blocked on the user, not really streaming. Precedence:
+  // approval-wait > live turn state. (UX-B item 4.)
+  const approvalWait = input.pendingApproval === true;
+  if (approvalWait) {
     pendingRisk = 'approval-wait';
   }
   if (intent.kind === 'shell') {
@@ -35,7 +40,7 @@ export function deriveComposerState(input: ComposerStateInput): ComposerState {
   }
   if (input.hasAttachments) flags.push('attachments');
 
-  const statusLabel = (() => {
+  const turnStatus = (() => {
     switch (input.turnState) {
       case 'preflight': return 'preflight';
       case 'streaming': return 'streaming';
@@ -47,6 +52,9 @@ export function deriveComposerState(input: ComposerStateInput): ComposerState {
       default: return 'idle';
     }
   })();
+  // 'idle' is suppressed by the footer renderer, so an approval wait shows only
+  // `risk:approval-wait` — one honest tag, not three spellings of the wait.
+  const statusLabel = approvalWait ? 'idle' : turnStatus;
 
   return {
     intent,

package/src/core/conversation-line-cache.ts

@@ -49,6 +49,7 @@ import {
   renderConversationSystemMessage,
   renderConversationToolMessage,
   renderConversationUserMessage,
+  collectCompletedToolCallIds,
 } from './conversation-rendering.ts';
 import type { ConversationMessageSnapshot } from '@pellux/goodvibes-sdk/platform/core';
 // SystemMessageKind imported from runtime directly to avoid a cycle, mirroring
@@ -94,6 +95,18 @@ interface KeyMeta {
   readonly showReasoningSummary: boolean;
   readonly blockBase: number;
   readonly kind: SystemMessageKind | undefined;
+  /**
+   * True when this (assistant) message has a tool call with no result yet — it
+   * renders as pending rather than done. Keyed so the entry invalidates and
+   * re-renders ✓ once the tool result arrives. (UX-B item 2c.)
+   */
+  readonly hasPendingTool: boolean;
+}
+
+/** Whether an assistant message has any tool call still awaiting a result. */
+function hasPendingToolCall(m: Message, completed: ReadonlySet<string>): boolean {
+  if (m.role !== 'assistant' || !m.toolCalls) return false;
+  return m.toolCalls.some((tc) => tc.id === undefined || !completed.has(tc.id));
 }
 
 interface CacheEntry {
@@ -272,6 +285,11 @@ export class MessageLineCache {
       showReasoningSummary: context.configManager?.get('display.showReasoningSummary') ?? false,
     };
 
+    // Tool calls with no matching tool-result message are still pending; the
+    // render context and the cache key both depend on this. (UX-B item 2c.)
+    const completedToolCallIds = collectCompletedToolCallIds(messages);
+    const renderContext: ConversationRenderContext = { ...context, completedToolCallIds };
+
     const touched = new Set<number>();
 
     for (let i = 0; i < messages.length; i++) {
@@ -283,17 +301,18 @@ export class MessageLineCache {
 
       const uncacheable = absoluteIdx === streamingPlaceholderAbsIdx;
       const kind = context.messageKindRegistry.get(absoluteIdx);
+      const hasPendingTool = hasPendingToolCall(message, completedToolCallIds);
 
       if (!uncacheable) {
         const existing = this.entries.get(absoluteIdx);
-        if (existing && this.isValid(existing, message, width, cfg, blockBase, kind, context.collapseState)) {
+        if (existing && this.isValid(existing, message, width, cfg, blockBase, kind, hasPendingTool, context.collapseState)) {
           this.applyEntry(context, existing, base);
           touched.add(absoluteIdx);
           continue;
         }
       }
 
-      const entry = this.renderScratch(context, message, width, absoluteIdx, cfg, blockBase, kind);
+      const entry = this.renderScratch(renderContext, message, width, absoluteIdx, cfg, blockBase, kind, hasPendingTool);
       this.applyEntry(context, entry, base);
       if (!uncacheable) {
         this.entries.set(absoluteIdx, entry);
@@ -319,6 +338,7 @@ export class MessageLineCache {
     cfg: RenderConfig,
     blockBase: number,
     kind: SystemMessageKind | undefined,
+    hasPendingTool: boolean,
     collapseState: Map<string, boolean>,
   ): boolean {
     const k = entry.keyMeta;
@@ -330,7 +350,8 @@ export class MessageLineCache {
       k.showThinking !== cfg.showThinking ||
       k.showReasoningSummary !== cfg.showReasoningSummary ||
       k.blockBase !== blockBase ||
-      k.kind !== kind
+      k.kind !== kind ||
+      k.hasPendingTool !== hasPendingTool
     ) {
       return false;
     }
@@ -355,6 +376,7 @@ export class MessageLineCache {
     cfg: RenderConfig,
     blockBase: number,
     kind: SystemMessageKind | undefined,
+    hasPendingTool: boolean,
   ): CacheEntry {
     const scratchLines: Line[] = [];
     const scratchHistory = {
@@ -378,6 +400,7 @@ export class MessageLineCache {
       messageKindRegistry: context.messageKindRegistry,
       configManager: context.configManager,
       splashOptions: context.splashOptions,
+      completedToolCallIds: context.completedToolCallIds,
     };
 
     renderOne(scratchCtx, message, width, absoluteIdx, cfg);
@@ -397,6 +420,7 @@ export class MessageLineCache {
         showReasoningSummary: cfg.showReasoningSummary,
         blockBase,
         kind,
+        hasPendingTool,
       },
       contentSig: contentSigOf(message),
       lines: scratchLines,

package/src/core/conversation-rendering.ts

@@ -1,8 +1,9 @@
 import { UIFactory } from '../renderer/ui-factory.ts';
 import { renderMarkdownTracked } from '../renderer/markdown.ts';
 import { renderDiffView } from '../renderer/diff-view.ts';
-import { DARK_THEME } from '../renderer/theme.ts';
+import { activeTheme } from '../renderer/theme.ts';
 import { renderToolCallBlock } from '../renderer/tool-call.ts';
+import { summarizeToolResult } from '../renderer/tool-result-summary.ts';
 import type { ToolCall } from '@pellux/goodvibes-sdk/platform/types';
 import { renderThinkingBlock } from '../renderer/thinking.ts';
 import { renderSystemMessage } from '../renderer/system-message.ts';
@@ -21,7 +22,9 @@ import { extractUserDisplayText } from '@pellux/goodvibes-sdk/platform/core';
 //   conversation-rendering.ts → system-message-router.ts → conversation.ts → conversation-rendering.ts
 import type { SystemMessageKind } from '@/runtime/index.ts';
 
-const T = DARK_THEME;
+// Transcript tokens are read live per render (const T = activeTheme() at the top
+// of each render function that styles content) so a dark→light repaint
+// re-resolves with no module reload. See theme.ts's active-mode runtime note.
 
 /**
  * Navigable system message kinds for error-navigation (nextErrorLine/prevErrorLine).
@@ -39,6 +42,20 @@ const NAVIGABLE_KINDS: ReadonlySet<SystemMessageKind> = new Set(['system', 'wrfc
 
 type Message = ConversationMessageSnapshot;
 
+/**
+ * Collect the ids of tool calls that have a matching tool-result message in the
+ * given slice — i.e. the tools that actually ran. Used to decide whether an
+ * assistant tool call still shows as pending (awaiting approval) or done.
+ * (UX-B item 2c.)
+ */
+export function collectCompletedToolCallIds(messages: readonly Message[]): Set<string> {
+  const ids = new Set<string>();
+  for (const message of messages) {
+    if (message.role === 'tool' && message.callId) ids.add(message.callId);
+  }
+  return ids;
+}
+
 function summarizeCallId(callId: string, maxLength = 24): string {
   return callId.length <= maxLength ? callId : `${callId.slice(0, maxLength - 1)}…`;
 }
@@ -56,6 +73,15 @@ export interface ConversationRenderContext {
   readonly messageKindRegistry: ReadonlyMap<number, SystemMessageKind>;
   readonly configManager: ConfigManager | null;
   readonly splashOptions: SplashOptions;
+  /**
+   * Tool-call ids that have a corresponding tool-result message (i.e. the tool
+   * actually ran). An assistant tool call whose id is NOT in this set is still
+   * awaiting a decision (e.g. an approval prompt) and renders with a pending
+   * glyph instead of the completed ✓. When undefined (single-message callers
+   * without sibling context), every tool call renders as done — the prior
+   * behaviour. (UX-B item 2c.)
+   */
+  readonly completedToolCallIds?: ReadonlySet<string>;
 }
 
 export function renderConversationUserMessage(
@@ -63,6 +89,7 @@ export function renderConversationUserMessage(
   message: Extract<Message, { role: 'user' }>,
   width: number,
 ): void {
+  const T = activeTheme();
   const displayText = extractUserDisplayText(message.content);
   if (message.cancelled) {
     context.history.addLines(UIFactory.createMessageBar(width, displayText, T.errorBarBg, '196', ' x ', true));
@@ -79,6 +106,7 @@ export function renderConversationAssistantMessage(
   collapseThreshold: number,
   msgIdx: number,
 ): void {
+  const T = activeTheme();
   const assistantHeaderDetails = [];
   if (message.model) {
     assistantHeaderDetails.push({ text: ` ${message.model}${message.provider ? ` (${message.provider})` : ''} `, fg: T.modelNameDim, dim: true });
@@ -196,7 +224,11 @@ export function renderConversationAssistantMessage(
 
   if (message.toolCalls && message.toolCalls.length > 0) {
     for (const tc of message.toolCalls) {
-      context.history.addLines(renderToolCallBlock(tc, 'done', undefined, width));
+      // A tool call with no result message yet is still awaiting a decision
+      // (e.g. approval) — show a pending glyph, not the completed ✓.
+      const ran = context.completedToolCallIds === undefined
+        || (tc.id !== undefined && context.completedToolCallIds.has(tc.id));
+      context.history.addLines(renderToolCallBlock(tc, ran ? 'done' : 'pending', undefined, width));
     }
   }
 }
@@ -224,6 +256,7 @@ export function renderConversationToolMessage(
   width: number,
   msgIdx: number,
 ): void {
+  const T = activeTheme();
   const collapseKey = `msg_${msgIdx}`;
   const blockIdx = context.blockRegistry.length;
   const startLine = context.history.getLineCount();
@@ -237,7 +270,17 @@ export function renderConversationToolMessage(
   // block-registry meta merge below regardless of collapsed/expanded state.
   const diffParse = isDiff ? parseDiffForApply(message.content) : undefined;
 
-  const isShort = message.content.length <= 200;
+  // Human one-line summary for tool results (write/read/exec/edit): shown as the
+  // collapsed line so the transcript reads "wrote foo.txt (532 B)" instead of a
+  // raw JSON blob; the full payload stays behind the expand toggle. Only for
+  // 'tool' blocks (diffs render their own view). (UX-B item 3.)
+  const resultSummary = blockType === 'tool'
+    ? summarizeToolResult(message.toolName, message.content)
+    : null;
+
+  // A summarizable result is kept collapsed-by-default even when short, so the
+  // one-line summary wins and the raw JSON is tucked behind the expand toggle.
+  const isShort = message.content.length <= 200 && resultSummary === null;
   const isCollapsed = isShort
     ? false
     : context.collapseState.has(collapseKey)
@@ -263,11 +306,20 @@ export function renderConversationToolMessage(
 
   if (isCollapsed) {
     const collapseSuffixReserve = 30;
-    const preview = contentLines[0].slice(0, width - LAYOUT.LEFT_MARGIN - LAYOUT.RIGHT_MARGIN - collapseSuffixReserve);
+    const avail = Math.max(0, width - LAYOUT.LEFT_MARGIN - LAYOUT.RIGHT_MARGIN - collapseSuffixReserve);
     const hiddenCount = lineCount - 1;
-    const collapsedText = hiddenCount > 0
-      ? `${preview}...  [${GLYPHS.navigation.collapsed} ${hiddenCount} hidden]`
-      : preview;
+    let collapsedText: string;
+    if (resultSummary !== null) {
+      // Summary line — the header already shows "▸ N lines", so no hidden badge.
+      collapsedText = resultSummary.length > avail
+        ? `${resultSummary.slice(0, Math.max(0, avail - 1))}…`
+        : resultSummary;
+    } else {
+      const preview = contentLines[0].slice(0, avail);
+      collapsedText = hiddenCount > 0
+        ? `${preview}...  [${GLYPHS.navigation.collapsed} ${hiddenCount} hidden]`
+        : preview;
+    }
     const rendered = renderConversationCollapsedFragment(collapsedText, width, {
       prefix: blockType === 'diff' ? ` ${GLYPHS.status.dualPane} ` : ` ${GLYPHS.navigation.collapsed} `,
       prefixFg: blockType === 'diff' ? T.diffAccent : T.toolAccent,
@@ -326,23 +378,28 @@ export function appendConversationMessages(
 ): void {
   const lineNumberMode = context.configManager?.get('display.lineNumbers') ?? 'off';
   const collapseThreshold = context.configManager?.get('display.collapseThreshold') ?? 30;
+  // Derive pending vs done for tool calls from sibling tool-result messages,
+  // unless the caller already supplied the set. (UX-B item 2c.)
+  const renderContext: ConversationRenderContext = context.completedToolCallIds !== undefined
+    ? context
+    : { ...context, completedToolCallIds: collectCompletedToolCallIds(messages) };
 
   for (let msgIdx = 0; msgIdx < messages.length; msgIdx++) {
     const message = messages[msgIdx];
     // absoluteIdx aligns the slice-relative loop counter with the absolute
     // message index used as the key in messageKindRegistry and messageLineRegistry.
     const absoluteIdx = msgIndexOffset + msgIdx;
-    messageLineRegistry[absoluteIdx] = context.history.getLineCount();
+    messageLineRegistry[absoluteIdx] = renderContext.history.getLineCount();
     if (message.role === 'user') {
-      renderConversationUserMessage(context, message, width);
+      renderConversationUserMessage(renderContext, message, width);
     } else if (message.role === 'assistant') {
-      renderConversationAssistantMessage(context, message, width, lineNumberMode, collapseThreshold, absoluteIdx);
+      renderConversationAssistantMessage(renderContext, message, width, lineNumberMode, collapseThreshold, absoluteIdx);
     } else if (message.role === 'system') {
-      renderConversationSystemMessage(context, message, width, absoluteIdx);
+      renderConversationSystemMessage(renderContext, message, width, absoluteIdx);
     } else if (message.role === 'tool') {
-      renderConversationToolMessage(context, message, width, absoluteIdx);
+      renderConversationToolMessage(renderContext, message, width, absoluteIdx);
     }
-    context.history.addLine(createEmptyLine(width));
+    renderContext.history.addLine(createEmptyLine(width));
   }
 }
 

package/src/core/stream-event-wiring.ts

@@ -155,6 +155,20 @@ export interface WireStreamEventMetricsOptions {
    * unavailable for either model, the notice honestly states "cost data unavailable".
    */
   readonly costLookup?: FailoverCostLookup;
+  /**
+   * Optional accessor for whether an approval card is currently waiting on the USER. When it
+   * returns true, the stall watchdog does NOT emit its "Still waiting on <provider>… Ctrl+C to
+   * cancel" hint: the stream is legitimately silent because we asked the user a question, so
+   * blaming the provider (or framing it as a stall) would be dishonest. The approval surface owns
+   * the honest "Waiting for your approval" label instead.
+   */
+  readonly isApprovalPending?: (() => boolean) | undefined;
+  /**
+   * Stall watchdog threshold in ms. Defaults to the watchdog's own default (STALL_THRESHOLD_MS,
+   * 30 000). Exposed only so unit tests can drive the stall path without waiting 30s — production
+   * callers omit it.
+   */
+  readonly stallThresholdMs?: number | undefined;
 }
 
 /** Result of wireStreamEventMetrics. */
@@ -237,6 +251,7 @@ export function wireStreamEventMetrics(
   const {
     events, metrics, orchestrator, providerRegistry,
     systemMessageRouter, render, providerOptimizer, retryTurn, costLookup,
+    isApprovalPending, stallThresholdMs,
   } = options;
 
   const unsubs: Array<() => void> = [];
@@ -364,12 +379,16 @@ export function wireStreamEventMetrics(
   const stallWatchdog = createStreamStallWatchdog({
     events: events.turns,
     onStall: (providerName, episode) => {
+      // Suppress the provider-blaming stall hint while an approval card is waiting on the user: the
+      // stream is silent because WE asked the user a question, not because the provider stalled.
+      if (isApprovalPending?.()) return;
       metrics.stallEpisode = episode;
       systemMessageRouter.low(`Still waiting on ${providerName}… Ctrl+C to cancel`);
       render();
     },
     getProviderName: () => providerRegistry.getCurrentModel().provider,
-    // thresholdMs uses the default 30 000
+    // thresholdMs defaults to 30 000 in the watchdog; only unit tests override it.
+    ...(stallThresholdMs !== undefined ? { thresholdMs: stallThresholdMs } : {}),
   });
   unsubs.push(() => stallWatchdog.dispose());