@pellux/goodvibes-agent 1.9.0 → 1.10.0

package/src/runtime/session-spine-rest-transport.ts

@@ -34,6 +34,7 @@ import {
   type SessionRegistrationInput,
 } from '../agent/session-registration.ts';
 import { readConnectedHostOperatorToken } from './connected-host-auth.ts';
+import { extractDaemonReceipts, type DaemonReceipt } from './daemon-receipts.ts';
 
 const DEFAULT_REGISTER_TIMEOUT_MS = 1_500;
 const DEFAULT_CLOSE_TIMEOUT_MS = 500;
@@ -122,12 +123,22 @@ export function createSpineRestTransport(options: SpineRestTransportOptions): Sp
   };
 }
 
-async function defaultProbe(connection: SessionRegistrationConnection, timeoutMs: number): Promise<boolean> {
+async function defaultProbe(
+  connection: SessionRegistrationConnection,
+  timeoutMs: number,
+): Promise<boolean> {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   try {
     // Any HTTP response (even 401) means the host answered -> reachable. Auth is
     // a separate concern surfaced by register/close results, not the probe.
+    //
+    // This is a LIVENESS read only. It fetches PLAIN /status, which a current
+    // daemon treats as receipt-NEUTRAL: it never delivers (or marks delivered)
+    // the daemon's one-shot honesty receipts. Consuming those is a separate,
+    // explicit `?receipts=consume` read done exactly once per attach (see
+    // createSpineReceiptConsumer), so this frequent keepalive poll can never
+    // silently drain them.
     await fetch(`${connection.baseUrl}/status`, {
       headers: connection.token ? { authorization: `Bearer ${connection.token}` } : undefined,
       signal: controller.signal,
@@ -143,18 +154,87 @@ async function defaultProbe(connection: SessionRegistrationConnection, timeoutMs
 export interface SpineRestProbeOptions {
   readonly resolveConnection: () => SessionRegistrationConnection;
   readonly probeTimeoutMs?: number;
-  /** Override for tests; default does a short GET {baseUrl}/status. */
-  readonly probeImpl?: (connection: SessionRegistrationConnection, timeoutMs: number) => Promise<boolean>;
+  /** Override for tests; default does a short PLAIN GET {baseUrl}/status. */
+  readonly probeImpl?: (
+    connection: SessionRegistrationConnection,
+    timeoutMs: number,
+  ) => Promise<boolean>;
 }
 
 /**
  * Builds the zero-argument `probe` the SDK core calls directly from
  * `probeReachability()` (its injected-probe shape takes no parameters — the
  * core has no connection to hand it). This closure captures the resolver and
- * timeout so the core stays connection-agnostic.
+ * timeout so the core stays connection-agnostic. Liveness only — receipt
+ * consumption is {@link createSpineReceiptConsumer}, not this.
  */
 export function createSpineRestProbe(options: SpineRestProbeOptions): () => Promise<boolean> {
   const probeTimeoutMs = options.probeTimeoutMs ?? DEFAULT_PROBE_TIMEOUT_MS;
   const probeImpl = options.probeImpl ?? defaultProbe;
   return () => probeImpl(options.resolveConnection(), probeTimeoutMs);
 }
+
+/**
+ * Performs ONE receipt-consuming /status read: it appends `?receipts=consume`,
+ * the only read a current daemon delivers (and then marks delivered) its
+ * undelivered honesty receipts to — "updated from X to Y", "restarted after a
+ * crash at HH:MM", settings-migration notes. A plain /status read (the liveness
+ * probe above) is receipt-neutral, so without this explicit consuming read the
+ * agent would never surface those lines against a current daemon.
+ *
+ * Delivery is destructive at the daemon (served exactly once), so this is issued
+ * exactly once per attach — never on the frequent liveness cadence. Returns []
+ * on any transport failure, a non-2xx status, or a non-JSON body; reachability
+ * is the probe's concern, not this read's.
+ */
+async function defaultConsumeReceipts(
+  connection: SessionRegistrationConnection,
+  timeoutMs: number,
+): Promise<readonly DaemonReceipt[]> {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const url = new URL(`${connection.baseUrl}/status`);
+    url.searchParams.set('receipts', 'consume');
+    const response = await fetch(url, {
+      headers: connection.token ? { authorization: `Bearer ${connection.token}` } : undefined,
+      signal: controller.signal,
+    });
+    if (!response.ok) return [];
+    try {
+      return extractDaemonReceipts(await response.json());
+    } catch {
+      return [];
+    }
+  } catch {
+    return [];
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+export interface SpineReceiptConsumerOptions {
+  readonly resolveConnection: () => SessionRegistrationConnection;
+  readonly consumeTimeoutMs?: number;
+  /** Override for tests; default does a short GET {baseUrl}/status?receipts=consume. */
+  readonly consumeImpl?: (
+    connection: SessionRegistrationConnection,
+    timeoutMs: number,
+  ) => Promise<readonly DaemonReceipt[]>;
+}
+
+/**
+ * Builds the zero-argument receipt consumer the agent invokes once per attach
+ * (see the memory-spine adoption reconciler's `onAttach`). Captures the
+ * connection resolver and timeout; the returned function performs a single
+ * `?receipts=consume` read and yields whatever honesty receipts the daemon
+ * delivered (empty when there are none, the daemon is old/absent, or the read
+ * fails).
+ */
+export function createSpineReceiptConsumer(
+  options: SpineReceiptConsumerOptions,
+): () => Promise<readonly DaemonReceipt[]> {
+  const consumeTimeoutMs = options.consumeTimeoutMs ?? DEFAULT_PROBE_TIMEOUT_MS;
+  const consumeImpl = options.consumeImpl ?? defaultConsumeReceipts;
+  return () => consumeImpl(options.resolveConnection(), consumeTimeoutMs);
+}

package/src/runtime/ui-services.ts

@@ -54,7 +54,7 @@ export interface UiPlatformServices {
   readonly tokenAuditor: RuntimeServices['tokenAuditor'];
   readonly replayEngine: RuntimeServices['replayEngine'];
   readonly webhookNotifier: RuntimeServices['webhookNotifier'];
-  /** OS-level terminal focus tracker, ported from goodvibes-tui's W2.3. */
+  /** OS-level terminal focus tracker, ported from goodvibes-tui's core/focus-tracker.ts. */
   readonly focusTracker: RuntimeServices['focusTracker'];
   readonly policyRuntimeState: RuntimeServices['policyRuntimeState'];
   readonly externalServices?: {

package/src/runtime/update-check.ts

@@ -0,0 +1,64 @@
+/**
+ * Pure logic for `/update` and the launch-time self-update: version
+ * comparison, the latest-release-tag redirect lookup, and honest install-kind
+ * detection.
+ *
+ * Version comparison and the release-tag lookup are re-exported from the
+ * SDK's canonical update policy module (platform/runtime/self-update) — one
+ * mechanism everywhere, the same module the TUI and the daemon's hourly loop
+ * consume. Install-kind detection stays local: it encodes how THIS package is
+ * installed (compiled binary vs bun/npm package vs source run) and what
+ * command replaces a swap for each kind.
+ *
+ * The self-update download/verify/swap orchestration that USES these lives in
+ * src/input/commands/update-runtime.ts; this module only decides "is there a
+ * newer version" and "can this install be swapped in place".
+ */
+export {
+  compareVersions,
+  normalizeVersion,
+  parseReleaseTagFromLocation,
+  resolveLatestReleaseTag,
+  type UpdateFetchLike,
+} from '@pellux/goodvibes-sdk/platform/runtime/self-update';
+
+/**
+ * How this running process was installed, detected honestly from
+ * process.execPath rather than assumed:
+ *   - "binary": a standalone `bun build --compile` executable with no
+ *     package-manager ancestry — the directly-downloaded release binary
+ *     (goodvibes-agent-<os>-<arch>). Swappable in place.
+ *   - "bun-global-package": running the vendored binary shipped inside an
+ *     npm/bun-managed package install (execPath contains a "node_modules"
+ *     path segment — true for both `bun add -g` and a local project
+ *     dependency). Managed by the package manager; swapping the vendored file
+ *     in place would fight the next `bun add -g` upgrade, so this is never
+ *     swapped — the user re-runs their package manager instead.
+ *   - "source": running directly via the `bun` interpreter (`bun run
+ *     src/main.ts`), not a compiled binary at all — a dev checkout, never
+ *     swapped.
+ */
+export type InstallKind = 'binary' | 'bun-global-package' | 'source';
+
+export function detectInstallKind(execPath: string): InstallKind {
+  const segments = execPath.split(/[\\/]/);
+  const execName = (segments[segments.length - 1] ?? '').toLowerCase();
+  if (execName === 'bun' || execName === 'bun.exe') {
+    return 'source';
+  }
+  if (segments.includes('node_modules')) {
+    return 'bun-global-package';
+  }
+  return 'binary';
+}
+
+/**
+ * The exact command to tell the user to run instead of a swap, for each
+ * non-binary install kind. The agent's supported managed install path is the
+ * Bun global package (see README) — there is no curl installer for this repo,
+ * so both non-binary kinds point at the package manager.
+ */
+export function fallbackUpdateCommand(kind: Exclude<InstallKind, 'binary'>): string {
+  void kind;
+  return 'bun add -g @pellux/goodvibes-agent';
+}

package/src/shell/ui-openers.ts

@@ -187,6 +187,14 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
   };
 
   commandContext.openModelPicker = () => {
+    // Picker-open re-check: re-verify each provider's live model list (TTL-
+    // respecting) so a freshly-opened picker reflects models the provider
+    // started or stopped serving. Fire-and-forget; a completed refresh re-renders
+    // so the list updates in place without blocking the open. (Same wiring as
+    // the TUI's picker — the fix-everywhere convention for this defect class.)
+    void providerRegistry.refreshLiveModelDiscovery?.().then((reports) => {
+      if (reports.some((report) => report.added.length > 0 || report.removed.length > 0)) render();
+    }).catch(() => {});
     void (async () => {
       const catalogModels = providerRegistry.getSelectableModels();
       const configuredIds = new Set(getConfiguredProviderIds());

package/src/tools/agent-harness-metadata.ts

@@ -144,6 +144,14 @@ export function describeCommandPolicy(commandName: string): CommandExecutionPoli
       boundary: 'Diagnostics and review commands inspect Agent, provider, MCP, security, and connected-host readiness without taking lifecycle ownership.',
     };
   }
+  if (root === 'update' || root === 'upgrade') {
+    return {
+      effect: 'mixed',
+      confirmation,
+      preferredModelTool: agentHarnessModes('run_command'),
+      boundary: 'Check is a read-only release lookup; apply downloads, checksum-verifies, and atomically swaps the installed binary (and vector addon) keeping the previous version beside it, and rollback exchanges the kept previous version back in. Apply and rollback change the installed program and require explicit user intent.',
+    };
+  }
   if (root === 'trust' || root === 'auth' || root === 'bundle') {
     return {
       effect: 'mixed',

package/src/tools/agent-harness-setup-connected-host.ts

@@ -496,6 +496,6 @@ export function connectedHostBootstrapPlan(
       serviceDiagnostics: 'host action:"services" includeParameters:true',
       setupItem: 'setup action:"item" setupItemId:"connected-host-readiness"',
     },
-    policy: 'Bootstrap commands are user-run setup guidance. Agent does not run host install/start commands implicitly; once the host is reachable, exact service mutations stay on confirmed operator methods.',
+    policy: 'Bootstrap commands are user-run setup guidance. At boot the Agent runtime starts an already-installed host whose service is stopped, through the platform service manager, and reports it; beyond that one bounded boot behavior the Agent does not run host install/start commands implicitly, and once the host is reachable exact service mutations stay on confirmed operator methods.',
   };
 }

package/src/tools/agent-harness-setup-posture.ts

@@ -92,7 +92,7 @@ export async function setupRepairSummary(context: CommandContext, args: AgentHar
       effect: 'read-only-repair-decision',
       boundary: 'This route chooses the safest next setup repair route only. It never starts, installs, restarts, writes tokens, imports settings, or opens UI by itself.',
       confirmation: 'Any returned confirmed-effect route still requires confirm:true and explicitUserRequest tied to the user request.',
-      hostOwnership: 'GoodVibes Agent does not take ambient ownership of the GoodVibes host lifecycle; disconnected hosts use user-run bootstrap guidance, and reachable hosts use daemon receipts before lifecycle mutation.',
+      hostOwnership: 'GoodVibes Agent does not take ambient ownership of the GoodVibes host lifecycle. At boot it starts an installed-but-stopped host once through the platform service manager and reports it; beyond that, disconnected hosts use user-run bootstrap guidance, and reachable hosts use daemon receipts before lifecycle mutation.',
     },
   };
 }

package/src/version.ts

@@ -6,7 +6,7 @@ import { join } from 'node:path';
 // The prebuild script updates the fallback value before compilation.
 // Uses import.meta.dir (Bun) to locate package.json relative to this file,
 // which is correct regardless of the process working directory.
-let _version = '1.9.0';
+let _version = '1.10.0';
 try {
   const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', 'package.json'), 'utf-8')) as {
     readonly version?: unknown;

package/src/runtime/diagnostics/panels/ops.ts

@@ -1,156 +0,0 @@
-/**
- * OpsPanel — diagnostic data provider for operator interventions.
- *
- * Subscribes to OPS_AUDIT events from the UI-facing ops event feed and maintains a
- * bounded buffer of intervention records for display
- * in the Ops panel.
- *
- * Controls are only shown when the OpsControlPlane reports the action is legal
- * (state machine allows it), satisfying requirement: "No illegal action appears in UI".
- */
-import type { RuntimeEventEnvelope } from '@/runtime/index.ts';
-import type { PanelConfig } from '@/runtime/index.ts';
-import { DEFAULT_PANEL_CONFIG, appendBounded, applyFilter } from '@/runtime/index.ts';
-import type { DiagnosticFilter } from '@/runtime/index.ts';
-import type { OpsInterventionReason, OpsEvent } from '@/runtime/index.ts';
-import type { UiEventFeed } from '../../ui-events.ts';
-
-// ---------------------------------------------------------------------------
-// Audit entry
-// ---------------------------------------------------------------------------
-
-/**
- * Immutable audit record for a single operator intervention.
- */
-export interface OpsAuditEntry {
-  /** Monotonic sequence number. */
-  readonly seq: number;
-  /** Epoch ms when the intervention was recorded. */
-  readonly ts: number;
-  /** The action taken (e.g. 'task.cancel', 'agent.cancel'). */
-  readonly action: string;
-  /** The target task or agent ID. */
-  readonly targetId: string;
-  /** Whether this intervention targeted a task or an agent. */
-  readonly targetKind: 'task' | 'agent';
-  /** The reason code for the intervention. */
-  readonly reason: OpsInterventionReason;
-  /** Optional operator note. */
-  readonly note?: string;
-  /** Outcome of the intervention. */
-  readonly outcome: 'success' | 'rejected' | 'error';
-  /** Error message if outcome is not success. */
-  readonly errorMessage?: string;
-  /** Trace identifier from the event envelope. */
-  readonly traceId: string;
-  /** Session identifier from the event envelope. */
-  readonly sessionId: string;
-}
-
-// ---------------------------------------------------------------------------
-// OpsPanel
-// ---------------------------------------------------------------------------
-
-/** Internal mutable record (same shape as immutable OpsAuditEntry). */
-type MutableAuditRecord = {
-  seq: number;
-  ts: number;
-  action: string;
-  targetId: string;
-  targetKind: 'task' | 'agent';
-  reason: OpsInterventionReason;
-  note?: string;
-  outcome: 'success' | 'rejected' | 'error';
-  errorMessage?: string;
-  traceId: string;
-  sessionId: string;
-};
-
-/** Type alias for the OPS_AUDIT event shape. */
-type OpsAuditEvent = Extract<OpsEvent, { type: 'OPS_AUDIT' }>;
-
-export class OpsPanel {
-  private readonly _config: PanelConfig;
-  private readonly _events: UiEventFeed<OpsEvent>;
-
-  private readonly _audit: MutableAuditRecord[] = [];
-  private _seq = 0;
-
-  private readonly _subscribers = new Set<() => void>();
-  private _unsub: (() => void) | null = null;
-
-  public constructor(
-    events: UiEventFeed<OpsEvent>,
-    config: PanelConfig = DEFAULT_PANEL_CONFIG
-  ) {
-    this._config = config;
-    this._events = events;
-    this._start();
-  }
-
-  private _start(): void {
-    this._unsub = this._events.onEnvelope('OPS_AUDIT', (envelope) => {
-      this._handleAudit(envelope as RuntimeEventEnvelope<'OPS_AUDIT', OpsAuditEvent>);
-    });
-  }
-
-  private _handleAudit(
-    envelope: RuntimeEventEnvelope<'OPS_AUDIT', OpsAuditEvent>
-  ): void {
-    const payload = envelope.payload;
-
-    const record: MutableAuditRecord = {
-      seq: ++this._seq,
-      ts: envelope.ts,
-      action: payload.action,
-      targetId: payload.targetId,
-      targetKind: payload.targetKind,
-      reason: payload.reason,
-      note: payload.note,
-      outcome: payload.outcome,
-      errorMessage: payload.errorMessage,
-      traceId: envelope.traceId ?? '',
-      sessionId: envelope.sessionId ?? '',
-    };
-
-    appendBounded(this._audit, record, this._config.bufferLimit);
-    this._notify();
-  }
-
-  /**
-   * Returns a filtered snapshot of the audit log, most recent first.
-   */
-  public getSnapshot(filter?: DiagnosticFilter): OpsAuditEntry[] {
-    const entries = this._audit.map((r) => ({ ...r }) as OpsAuditEntry);
-    return applyFilter(entries, filter, (e) => e.ts);
-  }
-
-  /**
-   * Subscribe to data changes. Returns an unsubscribe function.
-   */
-  public subscribe(callback: () => void): () => void {
-    this._subscribers.add(callback);
-    return () => { this._subscribers.delete(callback); };
-  }
-
-  /**
-   * Dispose the panel, unsubscribing from the event bus.
-   */
-  public dispose(): void {
-    if (this._unsub) {
-      this._unsub();
-      this._unsub = null;
-    }
-    this._subscribers.clear();
-  }
-
-  private _notify(): void {
-    for (const cb of this._subscribers) {
-      try {
-        cb();
-      } catch {
-        // Non-fatal — subscriber errors must not crash the panel
-      }
-    }
-  }
-}

package/src/runtime/surface-feature-flags.ts

@@ -1,100 +0,0 @@
-import type { ConfigManager, PersistedFlagState } from '../config/index.ts';
-import { surfaceFeatureGateId } from '@/runtime/index.ts';
-
-export const CONTROL_PLANE_FEATURE_FLAG = 'control-plane-gateway';
-export const ROUTE_BINDING_FEATURE_FLAG = 'route-binding';
-export const DELIVERY_ENGINE_FEATURE_FLAG = 'delivery-engine';
-export const SERVICE_MANAGEMENT_FEATURE_FLAG = 'service-management';
-
-const CORE_CHANNEL_FEATURE_FLAGS = [
-  CONTROL_PLANE_FEATURE_FLAG,
-  ROUTE_BINDING_FEATURE_FLAG,
-  DELIVERY_ENGINE_FEATURE_FLAG,
-] as const;
-
-export type FeatureFlagConfigKey = 'featureFlags' | `featureFlags.${string}`;
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
-}
-
-export function isFeatureFlagConfigKey(key: string): key is FeatureFlagConfigKey {
-  return key === 'featureFlags' || key.startsWith('featureFlags.');
-}
-
-function isPersistedFlagState(value: unknown): value is PersistedFlagState {
-  return value === 'enabled' || value === 'disabled';
-}
-
-export function readFeatureFlagConfigValue(config: Pick<ConfigManager, 'getCategory'>, key: FeatureFlagConfigKey): unknown {
-  const flags = config.getCategory('featureFlags');
-  if (key === 'featureFlags') return flags;
-  return flags[key.slice('featureFlags.'.length)];
-}
-
-export function mergeFeatureFlagConfigValue(config: Pick<ConfigManager, 'mergeCategory'>, key: FeatureFlagConfigKey, value: unknown): void {
-  if (key === 'featureFlags') {
-    if (!isRecord(value)) throw new Error('featureFlags expects an object value.');
-    const patch: Partial<Record<string, PersistedFlagState>> = {};
-    for (const [flagId, state] of Object.entries(value)) {
-      if (!isPersistedFlagState(state)) throw new Error(`featureFlags.${flagId} expects enabled or disabled.`);
-      patch[flagId] = state;
-    }
-    config.mergeCategory('featureFlags', patch);
-    return;
-  }
-
-  if (!isPersistedFlagState(value)) throw new Error(`${key} expects enabled or disabled.`);
-  config.mergeCategory('featureFlags', {
-    [key.slice('featureFlags.'.length)]: value,
-  });
-}
-
-export function getSurfaceFeatureFlag(surfaceId: string): string | null {
-  return surfaceFeatureGateId(surfaceId);
-}
-
-export function getServerSurfaceFeatureFlags(options: {
-  readonly serverBacked?: boolean;
-  readonly web?: boolean;
-  readonly externalSurfaces?: readonly string[];
-}): readonly string[] {
-  const flags = new Set<string>();
-  const hasExternalSurfaces = (options.externalSurfaces?.length ?? 0) > 0;
-
-  if (options.serverBacked || options.web || hasExternalSurfaces) {
-    flags.add(CONTROL_PLANE_FEATURE_FLAG);
-    flags.add(SERVICE_MANAGEMENT_FEATURE_FLAG);
-  }
-  if (options.web) {
-    const webFlag = getSurfaceFeatureFlag('web');
-    if (webFlag) flags.add(webFlag);
-  }
-
-  if (hasExternalSurfaces) {
-    for (const flag of CORE_CHANNEL_FEATURE_FLAGS) flags.add(flag);
-    for (const surfaceId of options.externalSurfaces ?? []) {
-      const surfaceFlag = getSurfaceFeatureFlag(surfaceId);
-      if (surfaceFlag) flags.add(surfaceFlag);
-    }
-  }
-
-  return [...flags].sort((left, right) => left.localeCompare(right));
-}
-
-export function isFeatureFlagEnabled(config: Pick<ConfigManager, 'getCategory'>, flagId: string): boolean {
-  const flags = config.getCategory('featureFlags');
-  return flags[flagId] === 'enabled';
-}
-
-export function getMissingSurfaceFeatureFlags(config: Pick<ConfigManager, 'getCategory'>, surfaceId: string): readonly string[] {
-  const required = surfaceId === 'web'
-    ? getServerSurfaceFeatureFlags({ web: true })
-    : getServerSurfaceFeatureFlags({ externalSurfaces: [surfaceId] });
-  return required.filter((flagId) => !isFeatureFlagEnabled(config, flagId));
-}
-
-export function enableFeatureFlags(config: Pick<ConfigManager, 'mergeCategory'>, flagIds: readonly string[]): void {
-  const patch = Object.fromEntries(flagIds.map((flagId) => [flagId, 'enabled'] as const));
-  config.mergeCategory('featureFlags', patch);
-}