@pellux/goodvibes-tui 2.0.21 → 2.1.1

package/src/runtime/bootstrap.ts

@@ -12,7 +12,7 @@
 import { join } from 'node:path';
 import { Orchestrator, type OrchestratorUserInputOptions } from '@pellux/goodvibes-sdk/platform/core';
 import { AcpManager } from '@pellux/goodvibes-sdk/platform/acp';
-import { getTierPromptSupplement, getTierForContextWindow } from '@pellux/goodvibes-sdk/platform/providers';
+import { getTierForContextWindow, getTierPromptSupplement } from '@pellux/goodvibes-sdk/platform/providers';
 import { logger, summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 import type { PermissionRequestHandler } from '@pellux/goodvibes-sdk/platform/permissions';
 import type { WorkspaceTrustLevel } from '@pellux/goodvibes-sdk/platform/runtime/operations';
@@ -39,6 +39,7 @@ import type { UiRuntimeServices } from './ui-services.ts';
 import { initializeBootstrapCore } from './bootstrap-core.ts';
 import { ensureBootModelResolvable } from './provider-fallback.ts';
 import { createBootstrapShell } from './bootstrap-shell.ts';
+import type { ShellViews } from '../views/builtin-views.ts';
 import { announceResumeState } from './resume-notice.ts';
 import { announceInstallHealth } from './install-self-check-startup.ts';
 import { buildSharedOrchestratorCoreServices, refreshMemoryRecallSnapshot } from './orchestrator-core-services.ts';
@@ -86,6 +87,8 @@ export type BootstrapContext = RuntimeContext & {
   commandContext: CommandContext;
   /** Shell-facing read models, events, and narrow runtime services. */
   uiServices: UiRuntimeServices;
+  /** The always-on read models and config-modal surfaces behind the built-in modals. */
+  views: ShellViews;
   /** Persists and navigates input history across sessions. */
   inputHistory: InputHistory;
   /** Provides git branch/dirty state for the header. */
@@ -120,7 +123,7 @@ export type BootstrapContext = RuntimeContext & {
    * @remarks
    * Route operational messages through this rather than calling
    * conversation.addSystemMessage() directly so routing-target config
-   * (panel/conversation/both) and the forced-inline critical prefixes stay
+   * (target 'panel' / 'conversation' / 'both') and the forced-inline critical prefixes stay
    * centralized in one place.
    */
   systemMessageRouter: SystemMessageRouter;
@@ -143,7 +146,7 @@ export type BootstrapContext = RuntimeContext & {
  *   4. Runtime bus subscriptions (WRFC, subagent, hook bridge)
  *   5. Providers, webhooks, PermissionManager, HookDispatcher
  *   6. Orchestrator + AcpManager
- *   7. MCP auto-connect + workspace/panel manager
+ *   7. MCP auto-connect + workspace/view manager
  *   8. Command registry + plugin init + CommandContext
  *   9. Input handler wiring
  *  10. Input history, splash options
@@ -195,7 +198,6 @@ export async function bootstrapRuntime(
   const {
     automationManager,
     hookDispatcher,
-    panelManager,
     pluginManager,
   } = services;
   // A saved custom-provider model must never crash boot, see provider-fallback.ts.
@@ -219,9 +221,10 @@ export async function bootstrapRuntime(
     permissionManager,
     getSystemPrompt: () => {
       const currentModel = providerRegistry.getCurrentModel();
-      const contextWindow = providerRegistry.getContextWindowForModel(currentModel);
-      const tier = getTierForContextWindow(contextWindow);
-      const supplement = getTierPromptSupplement(tier);
+      // An unknown window (null) picks the standard tier, never the small-model one.
+      const tier = getTierForContextWindow(providerRegistry.getKnownContextWindowForModel(currentModel));
+      // The main session is a conversation: never the agent-run completion-report demand.
+      const supplement = getTierPromptSupplement(tier, { audience: 'conversation' });
       return joinPromptParts(runtime.systemPrompt, TUI_ORCHESTRATION_GUARDRAILS, supplement);
     },
     hookDispatcher,
@@ -543,7 +546,7 @@ export async function bootstrapRuntime(
     label: 'external-services',
     run: async () => {
       // Register the persistent companion-pairing token as the daemon's shared
-      // bearer, so tokens scanned from the /qrcode panel's QR actually
+      // bearer, so tokens scanned from the /qrcode modal's QR actually
       // authenticate against the daemon this surface adopts.
       const daemonHomeDir = join(services.homeDirectory, '.goodvibes', 'daemon');
       const companionTokenRecord = resolveDaemonCompanionToken(daemonHomeDir, GOODVIBES_TUI_SURFACE_ROOT);
@@ -689,6 +692,7 @@ export async function bootstrapRuntime(
     selection,
     commandContext,
     uiServices,
+    views: shell.views,
     inputHistory,
     gitStatusProvider,
     lastGitInfoRef,
@@ -753,12 +757,8 @@ export async function bootstrapRuntime(
   // task manager exist unconditionally so pre-gate tasks stay visible. ───────
   ctx.commandContext.ops.acpManager = acpManager;
   if (opsControlPlane) {
-    ctx.commandContext.openOpsPanel = () => {
-      if (ctx.commandContext.showPanel) ctx.commandContext.showPanel('ops-control');
-      else {
-        panelManager.open('ops-control');
-        requestRender();
-      }
+    ctx.commandContext.openOpsView = () => {
+      ctx.commandContext.openView?.('ops-control');
     };
   }
 

package/src/runtime/client/fleet-union.ts

@@ -1,5 +1,5 @@
 /**
- * fleet-union.ts, the Fleet panel shows everything running, not just what this
+ * fleet-union.ts, the Agents modal shows everything running, not just what this
  * terminal started.
  *
  * ── What moved to the SDK, and what stays here ────────────────────────────
@@ -11,10 +11,10 @@
  * reason string a steer/archive against a daemon-only row gets, rather than a
  * bare false). This module is now a thin wrapper over that policy.
  *
- * What stays here is the panel binding: the TUI's own `FleetReadModel`
+ * What stays here is the modal binding: the TUI's own `FleetReadModel`
  * interface (interrupt/resume/kill/steer/archive, subscribe, snapshots) and
  * `buildFleetSnapshot`, the tree-builder + honest cost/token aggregator this
- * repo's Fleet panel renders from. Rebuilding through the SAME builder the
+ * repo's Agents modal renders from. Rebuilding through the SAME builder the
  * local view uses, rather than summing two halves, is what keeps the
  * rollups, the cost/token totals and the blocked-on-user ordering computed
  * once, over the whole fleet.
@@ -33,7 +33,7 @@
  * `interrupt`/`resume`/`kill`/`steer` reach this process's own children. A
  * daemon row has no child here to signal, so those refuse, and `steer`,
  * which has a reason channel, says why rather than returning a bare false
- * that reads as "the agent ignored you". The panel's own act surface
+ * that reads as "the agent ignored you". The modal's own act surface
  * (fleet-gateway.ts) already drives the daemon's verbs for the acts the
  * daemon serves.
  */
@@ -49,7 +49,7 @@ import {
   type DaemonVerbCaller,
 } from '@pellux/goodvibes-sdk/platform/runtime/client';
 import { logger } from '@pellux/goodvibes-sdk/platform/utils';
-import { buildFleetSnapshot, type FleetReadModel, type FleetSnapshot } from '../../panels/fleet-read-model.ts';
+import { buildFleetSnapshot, type FleetReadModel, type FleetSnapshot } from '../../views/fleet-read-model.ts';
 
 /** Re-exported so an importer that only needs the SDK's policy has one import site. */
 export { DEFAULT_FLEET_REFRESH_MS, daemonOnlyFleetActRefusal, mergeFleetNodes, readDaemonFleetRows };

package/src/runtime/client/hosted-exit.ts

@@ -26,7 +26,7 @@ import { logger, summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
 import { createDaemonVerbCaller } from './operator-endpoint.ts';
 import { createHostedSessionsClient } from './hosted-sessions.ts';
-import { getSharedHostedSessionFeed, type HostedSessionFeed } from '../../panels/hosted-session-feed.ts';
+import { getSharedHostedSessionFeed, type HostedSessionFeed } from '../../views/hosted-session-feed.ts';
 
 /** How long the exit will wait for the detach before giving up on it. */
 export const HOSTED_DETACH_ON_EXIT_TIMEOUT_MS = 1_500;
@@ -34,7 +34,7 @@ export const HOSTED_DETACH_ON_EXIT_TIMEOUT_MS = 1_500;
 export interface LeaveHostedSessionOnExitOptions {
   readonly configManager: ConfigManager;
   readonly homeDirectory: string | (() => string);
-  /** Defaults to the shared feed the `/hosted` command and the panel use. */
+  /** Defaults to the shared feed the `/hosted` command and the hosted-sessions modal use. */
   readonly feed?: HostedSessionFeed | undefined;
   readonly timeoutMs?: number | undefined;
 }

package/src/runtime/client/hosted-sessions.ts

@@ -68,7 +68,7 @@ export function terminalHostedClientId(): string {
   return cachedClientId;
 }
 
-/** The narrow client the command layer and the panel share. */
+/** The narrow client the command layer and the hosted-sessions modal share. */
 export interface HostedSessionsClient {
   /** This terminal's attach identity, the same string the records carry. */
   readonly clientId: string;

package/src/runtime/client/spine-adoption.ts

@@ -29,7 +29,7 @@
  *   - `sessions.inputs.list` / `sessions.inputs.deliver`, the inbound steer
  *     path, so a message another surface queued for THIS session lands in the
  *     turn machinery here and is acknowledged on the wire.
- *   - `sessions.list`, the cross-surface union the panels read, interval-
+ *   - `sessions.list`, the cross-surface union the modals read, interval-
  *     refreshed and served synchronously.
  *   - the memory spine's wire transport, folded into the same handler by the
  *     SDK, this module's own `syncMemorySpineToHostStatus` call is retired;

package/src/runtime/context-accounting-source.ts

@@ -24,7 +24,7 @@ export interface CompactionActivityBus {
  *  - getTurnInjections()  → Orchestrator.getTurnInjections() (the same bounded
  *    ring `/recall injections` renders from).
  *  - getTokenState()      → Orchestrator.usage / lastInputTokens (the same
- *    counters the footer's context bar and CostTrackerPanel read), plus the
+ *    counters the footer's context bar and the usage modal read), plus the
  *    current model's context window from the provider registry.
  *  - getCompactionState()  → compactionCount from SessionLineageTracker (the
  *    same counter session-maintenance and /compact read); isCompacting is
@@ -35,7 +35,7 @@ export interface CompactionActivityBus {
  */
 export interface ContextAccountingSourceDeps {
   readonly orchestrator: Pick<Orchestrator, 'getTurnInjections' | 'usage' | 'lastInputTokens'>;
-  readonly providerRegistry: Pick<ProviderRegistry, 'getCurrentModel' | 'getContextWindowForModel'>;
+  readonly providerRegistry: Pick<ProviderRegistry, 'getCurrentModel' | 'getKnownContextWindowForModel'>;
   readonly sessionLineageTracker: Pick<SessionLineageTracker, 'getCompactionCount'>;
   readonly runtimeBus?: CompactionActivityBus | null | undefined;
   readonly sessionId: string;
@@ -83,11 +83,12 @@ export function createContextAccountingSource(deps: ContextAccountingSourceDeps)
     getTurnInjections: () => deps.orchestrator.getTurnInjections(),
     getTokenState: () => {
       const currentModel = deps.providerRegistry.getCurrentModel();
-      const contextWindow = deps.providerRegistry.getContextWindowForModel(currentModel);
+      // null when nothing states the window (a guess, or disproven by a larger accepted request).
+      const contextWindow = deps.providerRegistry.getKnownContextWindowForModel(currentModel);
       return {
         measured: { ...deps.orchestrator.usage },
         lastInputTokens: deps.orchestrator.lastInputTokens,
-        contextWindow: contextWindow > 0 ? contextWindow : null,
+        contextWindow: contextWindow !== null && contextWindow > 0 ? contextWindow : null,
       };
     },
     getCompactionState: () => ({

package/src/runtime/index.ts

@@ -281,6 +281,7 @@ export {
   buildLocalReturnContextSummary,
   formatReturnContextForDisplay,
   getReturnContextMode,
+  loadedReturnContext,
   maybeAssistReturnContextSummary,
   persistConversation,
   generateUserSessionId,

package/src/runtime/notification-dispatch.ts

@@ -5,7 +5,7 @@
  * The SDK's NotificationRouter decides where each domain notification goes
  * (conversation / status_bar / panel_only) and collapses bursts and batches.
  * Nothing in the running app routed real notifications before this: the
- * panel_only feed (panels/notifications-feed.ts) and its panel existed with no
+ * panel_only feed (views/notifications-feed.ts) and the notifications modal existed with no
  * upstream. This module builds the router, records every panel_only decision
  * (including burst-collapsed ones) into the shared feed, and bridges the
  * runtime event bus so real domain events become notifications.
@@ -14,12 +14,19 @@
 import { createNotificationRouter, type NotificationRouter } from '@pellux/goodvibes-sdk/platform/runtime/ui';
 import type { Notification, RoutingDecision, RuntimeEventBus, RuntimeEventDomain } from '@/runtime/index.ts';
 import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
-import { getSharedNotificationFeed, type PanelNotificationFeed } from '../panels/notifications-feed.ts';
+import { getSharedNotificationFeed, type NotificationFeed } from '../views/notifications-feed.ts';
+import { publishNotice, type NoticeSink } from '../core/notices.ts';
 import { memoryPressureLine, memoryPressureLevel, type MemoryPressurePayload } from '@pellux/goodvibes-sdk/platform/runtime/memory';
+import { runtimeEventKey } from '@pellux/goodvibes-sdk/platform/runtime/bootstrap';
 
 export interface NotificationDispatcher {
-  /** Route a notification; a panel_only (or burst-collapsed) decision lands in the feed. Returns the decision. */
-  dispatch(notification: Notification): RoutingDecision;
+  /**
+   * Route a notification; a panel_only (or burst-collapsed) decision lands in
+   * the feed. `eventKey` names the runtime event it came from (the SDK's
+   * runtimeEventKey), so the feed keeps one entry when the same event also
+   * arrives as a conversation notice. Returns the decision.
+   */
+  dispatch(notification: Notification, eventKey?: string): RoutingDecision;
   /** Surface batch-held notifications (call on a timer / when quiet-typing ends). */
   flush(): void;
   readonly router: NotificationRouter;
@@ -28,7 +35,7 @@ export interface NotificationDispatcher {
 /**
  * The runtime event domains whose events surface as operational notifications.
  * Deliberately a curated set of user-relevant, completion/attention-shaped
- * domains, not every domain, so the panel reflects meaningful operational
+ * domains, not every domain, so the notifications modal reflects meaningful operational
  * activity rather than raw event churn. The router's per-domain verbosity and
  * burst/batch policies still collapse floods within these.
  */
@@ -41,46 +48,102 @@ export const NOTIFICATION_BRIDGE_DOMAINS: readonly RuntimeEventDomain[] = [
   'security',
 ];
 
-/** Turn an UPPER_SNAKE event type into a short human title ("AGENT_COMPLETED" → "Agent completed"). */
-export function humanizeEventType(type: string): string {
-  const words = type.toLowerCase().split(/[_\s]+/).filter(Boolean);
-  if (words.length === 0) return type;
-  return words.map((word, index) => (index === 0 ? word[0]!.toUpperCase() + word.slice(1) : word)).join(' ');
+/** A runtime event a person reads in the notification history: its plain title and severity. */
+export interface PersonFacingEvent {
+  readonly title: string;
+  readonly level: Notification['level'];
 }
 
-/** Derive a notification severity from an event type, errors/failures warn, the rest are informational. */
-export function levelForEventType(type: string): Notification['level'] {
-  const upper = type.toUpperCase();
-  if (/(FAILED|ERROR|CRASH|DENIED|BLOCKED)/.test(upper)) return 'warning';
-  if (/(CRITICAL|FATAL|BREACH)/.test(upper)) return 'critical';
-  return 'info';
+/**
+ * The runtime events that become notification-history entries, by event type,
+ * with the plain title each one shows. Everything else on the bridged domains
+ * (stream deltas, progress ticks, gate results, state changes, queue and start
+ * events) is internal traffic and never enters the history: this table is an
+ * allowlist, so a new SDK event type stays out until someone names it here.
+ */
+export const PERSON_FACING_EVENTS: Readonly<Record<string, PersonFacingEvent>> = {
+  // agents
+  AGENT_COMPLETED: { title: 'Agent finished', level: 'info' },
+  AGENT_FAILED: { title: 'Agent failed', level: 'warning' },
+  AGENT_CANCELLED: { title: 'Agent cancelled', level: 'info' },
+  AGENT_AWAITING_MESSAGE: { title: 'Agent is waiting for a reply', level: 'info' },
+  // tasks
+  TASK_COMPLETED: { title: 'Task finished', level: 'info' },
+  TASK_FAILED: { title: 'Task failed', level: 'warning' },
+  TASK_BLOCKED: { title: 'Task blocked', level: 'warning' },
+  TASK_CANCELLED: { title: 'Task cancelled', level: 'info' },
+  // workflows (review chains)
+  WORKFLOW_CHAIN_PASSED: { title: 'Review chain passed', level: 'info' },
+  WORKFLOW_CHAIN_FAILED: { title: 'Review chain failed', level: 'warning' },
+  WORKFLOW_CASCADE_ABORTED: { title: 'Review chain stopped', level: 'warning' },
+  WORKFLOW_AUTO_COMMITTED: { title: 'Reviewed changes committed', level: 'info' },
+  WORKFLOW_SCORE_REGRESSION: { title: 'Review score dropped', level: 'warning' },
+  // automation (scheduled jobs)
+  AUTOMATION_RUN_COMPLETED: { title: 'Scheduled job finished', level: 'info' },
+  AUTOMATION_RUN_FAILED: { title: 'Scheduled job failed', level: 'warning' },
+  AUTOMATION_JOB_AUTO_DISABLED: { title: 'Scheduled job turned off after repeated failures', level: 'warning' },
+  AUTOMATION_SCHEDULE_ERROR: { title: 'Schedule could not be read', level: 'warning' },
+  // deliveries (outgoing channel messages)
+  DELIVERY_FAILED: { title: 'Message delivery failed', level: 'warning' },
+  DELIVERY_DEAD_LETTERED: { title: 'Message could not be delivered', level: 'warning' },
+  // security
+  AUTH_FAILED: { title: 'Sign-in failed', level: 'warning' },
+  COMPANION_PAIR_REQUESTED: { title: 'Device pairing requested', level: 'info' },
+  COMPANION_PAIR_VERIFIED: { title: 'Device paired', level: 'info' },
+  COMPANION_TOKEN_REVOKED: { title: 'Device access revoked', level: 'info' },
+  TOKEN_ROTATION_WARNING: { title: 'Access token expires soon', level: 'warning' },
+  TOKEN_ROTATION_EXPIRED: { title: 'Access token expired', level: 'warning' },
+  TOKEN_BLOCKED: { title: 'Access token blocked', level: 'warning' },
+  TOKEN_SCOPE_VIOLATION: { title: 'Request refused: outside the token\'s permissions', level: 'warning' },
+};
+
+/** The history entry an event type makes, or undefined for internal traffic that is not recorded. */
+export function personFacingEvent(type: string): PersonFacingEvent | undefined {
+  return Object.prototype.hasOwnProperty.call(PERSON_FACING_EVENTS, type) ? PERSON_FACING_EVENTS[type] : undefined;
+}
+
+/** The detail line an event payload carries (an error or cancel reason, a chain's landing outcome, or the commit it made), if any. */
+export function eventDetail(payload: unknown): string | undefined {
+  if (!payload || typeof payload !== 'object') return undefined;
+  const record = payload as Record<string, unknown>;
+  // `note`: a passed review chain's landing outcome (committed, or why not, e.g. a refusing commit hook).
+  for (const field of ['error', 'reason', 'note']) {
+    const value = record[field];
+    if (typeof value === 'string' && value.trim()) return value.trim();
+  }
+  const commit = record['commitHash'];
+  if (typeof commit === 'string' && commit.trim()) return `commit ${commit.trim().slice(0, 7)}`;
+  return undefined;
 }
 
 export function createNotificationDispatcher(
   configManager: Pick<ConfigManager, 'get'>,
-  feed: PanelNotificationFeed = getSharedNotificationFeed(),
+  feed: NotificationFeed = getSharedNotificationFeed(),
 ): NotificationDispatcher {
   const router = createNotificationRouter(undefined, undefined, configManager);
-  const recordIfPanel = (notification: Notification, decision: RoutingDecision): void => {
+  /** Event keys of notifications the router is holding in a batch, for when the batch is flushed. */
+  const heldEventKeys = new WeakMap<Notification, string>();
+  const recordIfFeedTarget = (notification: Notification, decision: RoutingDecision, eventKey: string | undefined): void => {
     if (decision.suppressed) return;
-    if (decision.target === 'panel_only') feed.record(notification, decision);
+    if (decision.target === 'panel_only') feed.record(notification, decision, eventKey);
   };
   return {
     router,
-    dispatch(notification) {
+    dispatch(notification, eventKey) {
       const decision = router.route(notification);
-      recordIfPanel(notification, decision);
+      if (eventKey) heldEventKeys.set(notification, eventKey);
+      recordIfFeedTarget(notification, decision, eventKey);
       return decision;
     },
     flush() {
       for (const { notification } of router.flush()) {
-        // A flushed batch head surfaces as a batch-collapsed panel entry; the
+        // A flushed batch head surfaces as a batch-collapsed feed entry; the
         // feed folds all sharing this batch key into one running-count row.
         feed.record(notification, {
           target: 'panel_only',
           reasonCode: 'batch_window_collapsed',
           batchKey: `${notification.domain}:${notification.level}`,
-        });
+        }, heldEventKeys.get(notification));
       }
     },
   };
@@ -114,9 +177,10 @@ export function wireMemoryPressureNotice(
 }
 
 /**
- * Bridge the runtime event bus to the dispatcher: each event in a curated
- * domain becomes a notification and is routed. Returns an unsubscribe function
- * that detaches every domain listener.
+ * Bridge the runtime event bus to the dispatcher: each person-facing event
+ * (PERSON_FACING_EVENTS) in a curated domain becomes a notification with its
+ * plain title and is routed. Internal events are not recorded at all. Returns
+ * an unsubscribe function that detaches every domain listener.
  */
 export function wireRuntimeNotificationBridge(
   runtimeBus: RuntimeEventBus,
@@ -125,14 +189,23 @@ export function wireRuntimeNotificationBridge(
 ): () => void {
   const unsubscribes = domains.map((domain) =>
     runtimeBus.onDomain(domain, (envelope) => {
+      const event = personFacingEvent(envelope.type);
+      if (!event) return;
+      const body = eventDetail(envelope.payload);
       dispatcher.dispatch({
         id: envelope.traceId ?? `${domain}-${envelope.type}-${envelope.ts}`,
         domain,
-        level: levelForEventType(envelope.type),
-        title: humanizeEventType(envelope.type),
+        level: event.level,
+        title: event.title,
+        ...(body ? { body } : {}),
         timestamp: envelope.ts,
-      });
+      }, runtimeEventKey(envelope.type, envelope.payload));
     }),
   );
   return () => { for (const unsubscribe of unsubscribes) unsubscribe(); };
 }
+
+/** The shell's conversation notice sink: every system notice is a toast and a history entry (core/notices.ts). */
+export function createShellNoticeSink(feed: NotificationFeed = getSharedNotificationFeed()): NoticeSink {
+  return (content, { restored }) => publishNotice(feed, content, { restored });
+}

package/src/runtime/recovery-offer-wiring.ts

@@ -27,7 +27,7 @@
  *     numbers on screen describe the conversation actually in memory.
  */
 import { applyRecoverySnapshot, confirmRecoveryRestore } from '@pellux/goodvibes-sdk/platform/runtime/operations';
-import type { RecoveryPromptDeps } from './recovery-prompt.ts';
+import type { RecoveryPromptDeps, RecoveryTypeaheadHooks } from './recovery-prompt.ts';
 import type { ConversationManager, ConversationMessageSnapshot } from '../core/conversation.ts';
 import type { CommandContext } from '../input/command-registry.ts';
 import type { SessionSurface } from '@/runtime/index.ts';
@@ -44,6 +44,8 @@ export interface RecoveryOfferWiringInput {
   readonly writeLastSessionPointer: (sessionId: string) => void;
   readonly receipt: (line: string) => void;
   readonly render: () => void;
+  /** Holds typeahead out of the offer modal (see RecoveryPromptDeps.typeahead). */
+  readonly typeahead?: RecoveryTypeaheadHooks;
 }
 
 export function buildRecoveryOfferWiring(input: RecoveryOfferWiringInput): RecoveryPromptDeps {
@@ -54,6 +56,7 @@ export function buildRecoveryOfferWiring(input: RecoveryOfferWiringInput): Recov
     get openSelection() { return input.commandContext.openSelection; },
     receipt: input.receipt,
     render: input.render,
+    ...(input.typeahead ? { typeahead: input.typeahead } : {}),
     applySnapshot: ({ sessionId }) => {
       const persist = (messages: ConversationMessageSnapshot[]): void => {
         input.sessionManager.save(sessionId, messages as never[], {

package/src/runtime/recovery-prompt.ts

@@ -111,6 +111,19 @@ export interface RecoveryPromptDeps {
    * session has the newest snapshot".
    */
   readonly targetSessionId?: string;
+  /**
+   * Keys typed before the offer appeared must not answer it. Called right
+   * before the first modal opens (arm) and once the whole flow is over
+   * (settled), so the shell can hold typeahead out of the modal and replay it
+   * into the composer afterwards (runtime/startup-typeahead-gate.ts).
+   */
+  readonly typeahead?: RecoveryTypeaheadHooks;
+}
+
+/** See RecoveryPromptDeps.typeahead. */
+export interface RecoveryTypeaheadHooks {
+  readonly onModalShown: () => void;
+  readonly onFlowSettled: () => void;
 }
 
 // ─── Honest fact formatting ─────────────────────────────────────────────────
@@ -284,6 +297,7 @@ function findOfferableSnapshot(deps: RecoveryPromptDeps): RecoveryFileInfo | nul
  * a failure anywhere in here must not take a boot down.
  */
 export async function offerRecoverySnapshot(deps: RecoveryPromptDeps): Promise<RecoveryPromptOutcome> {
+  let shown = false;
   try {
     // Housekeeping first: recovery time is when the removal ledger gets its
     // bounds actually applied to disk and says what it discarded. Without this
@@ -308,6 +322,8 @@ export async function offerRecoverySnapshot(deps: RecoveryPromptDeps): Promise<R
     const bytes = deps.snapshotBytes ? deps.snapshotBytes(info.sessionId) : defaultSnapshotBytes(deps.surface, info.sessionId);
     const facts = describeRecoverySnapshot(info, { nowMs, bytes });
 
+    deps.typeahead?.onModalShown();
+    shown = true;
     const answer = await ask(open, RECOVERY_OFFER_TITLE, buildRecoveryOfferItems(facts));
 
     if (answer === 'resume') {
@@ -359,28 +375,28 @@ export async function offerRecoverySnapshot(deps: RecoveryPromptDeps): Promise<R
     // Best-effort by construction: a recovery offer that fails must leave the
     // snapshot untouched and the boot unharmed.
     return 'none';
+  } finally {
+    if (shown) deps.typeahead?.onFlowSettled();
   }
 }
 
 // ─── Startup wiring ─────────────────────────────────────────────────────────
 
 /**
- * Raise the recovery offer once the shell is up.
+ * Raise the recovery offer at startup, BEFORE the shell's first frame.
  *
- * Deliberately fire-and-forget and deliberately AFTER the first render: the
- * modal is drawn by the render loop, so asking before a frame exists would
- * mean a question nobody can see, and awaiting it would hold the terminal
- * blank while the user was expected to answer. Scheduled on a macrotask so
- * the caller's own initial render has completed first.
+ * The modal is opened synchronously (offerRecoverySnapshot runs synchronously
+ * up to the modal), so the first frame the user ever sees already has the
+ * question on it: the composer is never live underneath a question that is
+ * about to appear. It used to be raised on a macrotask after the first frame,
+ * which on a busy boot came seconds after the composer was drawn and took the
+ * keys typed into it (the search row got the text, Enter resumed). Keys typed
+ * before the frame was painted are the typeahead gate's job
+ * (deps.typeahead, startup-typeahead-gate.ts).
  *
- * Every failure mode here ends with the snapshot untouched: `offerRecoverySnapshot`
- * swallows its own errors, and this wrapper adds a catch for the scheduling
- * boundary.
+ * Fire-and-forget: nothing awaits the answer, and every failure mode ends with
+ * the snapshot untouched (offerRecoverySnapshot swallows its own errors).
  */
-export function scheduleRecoveryOffer(deps: RecoveryPromptDeps): void {
-  setTimeout(() => {
-    void offerRecoverySnapshot(deps).catch(() => {
-      // Best-effort: a failed offer must never take the shell down.
-    });
-  }, 0).unref?.();
+export function startRecoveryOffer(deps: RecoveryPromptDeps): Promise<RecoveryPromptOutcome> {
+  return offerRecoverySnapshot(deps);
 }

package/src/runtime/runtime-services-types.ts

@@ -54,7 +54,7 @@ import type { RuntimeEventBus, DistributedRuntimeManager, RemoteRunnerRegistry,
 import type { VoiceProviderRegistry, VoiceService } from '@pellux/goodvibes-sdk/platform/voice';
 import type { CacheRegistry, PauseController, MemoryGovernor } from '@pellux/goodvibes-sdk/platform/runtime/memory';
 import type { WebSearchProviderRegistry, WebSearchService } from '@pellux/goodvibes-sdk/platform/web-search';
-import type { PanelManager } from '../panels/panel-manager.ts';
+import type { ViewPanelAdapter } from '../views/view-panel-adapter.ts';
 import type { HookActivityTracker } from '@pellux/goodvibes-sdk/platform/hooks';
 import type { HookDispatcher, HookWorkbench } from '@pellux/goodvibes-sdk/platform/hooks';
 import type { PluginManager } from '@pellux/goodvibes-sdk/platform/plugins';
@@ -118,7 +118,11 @@ export interface RuntimeServices {
   readonly runtimeBus: RuntimeEventBus;
   readonly runtimeStore: RuntimeStore;
   readonly runtimeDispatch: DomainDispatch;
-  readonly panelManager: PanelManager;
+  /**
+   * The SDK's panel-manager contract (the operator API's panels.list /
+   * panels.open), answered by the modal views.
+   */
+  readonly panelManager: ViewPanelAdapter;
   readonly keybindingsManager: KeybindingsManager;
   readonly routeBindings: RouteBindingManager;
   readonly surfaceRegistry: SurfaceRegistry;
@@ -128,7 +132,7 @@ export interface RuntimeServices {
   readonly watcherRegistry: WatcherRegistry;
   /**
    * This surface's own record of the asks IT raised, what the approval card
-   * and the panel render. Not authoritative: `requestApproval` below raises the
+   * and the modal renders. Not authoritative: `requestApproval` below raises the
    * same ask on the daemon, whose record every other surface reads.
    */
   readonly approvalBroker: ApprovalBroker;
@@ -168,7 +172,7 @@ export interface RuntimeServices {
   readonly localhostFetchApproval: ReturnType<typeof buildLocalhostFetchApproval>;
   /** Terminal prompt-answer handler that rides the approval broker; shared by the tool registry and orchestrator so an interactive command's prompt gets an ask/card on every surface. */
   readonly execPromptAnswerHandler: ReturnType<typeof buildExecPromptAnswerHandler>;
-  /** Routes curated runtime-domain events into the panel_only notification feed (the panel's live producer). */
+  /** Routes curated runtime-domain events into the panel_only notification feed (the notifications modal's live producer). */
   readonly notificationDispatcher: NotificationDispatcher;
   /** Durable user-origin permission rules (remembered approvals); permissions.rules.* surface. Mirrors the SDK composition. */
   readonly userPermissionRuleStore: UserPermissionRuleStore;
@@ -280,10 +284,10 @@ export interface RuntimeServices {
   /** Controller the governor uses to pause/resume the deferrable background jobs under pressure. */
   readonly pauseController: PauseController;
   readonly sessionLiveTurnControls: SessionLiveTurnControlsHolder;
-  /** Unified live process registry (agents, WRFC chains, workflows, watchers, background processes) backing the Fleet panel; archive-aware, finished subtrees can be moved to the session archive view. */
+  /** Unified live process registry (agents, WRFC chains, workflows, watchers, background processes) backing the Agents modal; archive-aware, finished subtrees can be moved to the session archive view. */
   readonly processRegistry: ArchivableProcessRegistry;
   /**
-   * What the Fleet panel reads: this surface's own registry rows UNION the
+   * What the Agents modal reads: this surface's own registry rows UNION the
    * adopted daemon's, deduped by node id with the local (live, actionable) copy
    * winning. Interval-refreshed on the daemon half, see client/fleet-union.ts.
    */