@pellux/goodvibes-daemon 1.28.0

package/bin/launcher-support.js

@@ -0,0 +1,226 @@
+/**
+ * Launcher support for the daemon package.
+ *
+ * The npm package carries source and this launcher; the daemon itself is a
+ * compiled binary published as a GitHub release asset. The postinstall places
+ * it, and this module is the self-heal path for an install whose lifecycle
+ * script was blocked (which is the default for an untrusted global package under
+ * bun): the first run downloads the release asset, verifies it against the
+ * release's SHA256SUMS.txt, and caches it in vendor/.
+ *
+ * Asset names are the ones the daemon has always published
+ * (`goodvibes-daemon-<os>-<arch>`), so the curl installer, the release manifest
+ * and the daemon's own updater all keep resolving the same files.
+ *
+ * The sqlite-vec native addon gets the same self-heal: `resolveSqliteVecPath()`
+ * (platform/state/sqlite-vec-loader.ts, reached from a compiled binary) expects
+ * it at `<execDir>/lib/sqlite-vec-<platform>-<arch>/vec0.<suffix>` —
+ * `vendor/lib/...` once the binary above is placed there — and a blocked
+ * postinstall never staged it either. Without this, a self-healed install
+ * would get the daemon binary back but stay on lexical-only search forever.
+ */
+import { accessSync, chmodSync, constants, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { join } from 'node:path';
+
+const SUPPORTED_TARGETS = ['linux-x64', 'linux-arm64', 'darwin-x64', 'darwin-arm64'];
+
+/** Names the sqlite-vec addon for a platform/arch — mirrors resolveSqliteVecAsset
+ * in the SDK's platform/runtime/self-update module. Reimplemented (rather than
+ * imported) so this launcher never depends on that package resolving: it must
+ * keep working from the packaged bin/ directory alone, with no bundler step
+ * and no node_modules resolution beyond what's already vendored. */
+export function resolveSqliteVecAddonName(platform, arch) {
+  if ((platform !== 'linux' && platform !== 'darwin') || (arch !== 'x64' && arch !== 'arm64')) {
+    return null;
+  }
+  const suffix = platform === 'darwin' ? 'dylib' : 'so';
+  const dirName = `sqlite-vec-${platform}-${arch}`;
+  return { assetName: `${dirName}.${suffix}`, dirName, fileName: `vec0.${suffix}` };
+}
+
+export function isExecutable(path) {
+  try {
+    accessSync(path, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export function run(command, args) {
+  const child = spawnSync(command, args, { stdio: 'inherit' });
+  if (child.error) {
+    throw child.error;
+  }
+  process.exit(child.status ?? 1);
+}
+
+export function isSourceCheckout(packageRoot) {
+  return isExecutable(join(packageRoot, 'node_modules', '.bin', 'bun')) ||
+    isExecutable(join(packageRoot, 'node_modules', '.bin', 'tsc')) ||
+    fileExists(join(packageRoot, 'tsconfig.json'));
+}
+
+export function supportedTargetsText() {
+  return SUPPORTED_TARGETS.join(', ');
+}
+
+/** The published asset name for a platform, unchanged from what the daemon has always released. */
+export function resolveArtifactName(platform, arch) {
+  if (platform === 'linux' && arch === 'x64') return 'goodvibes-daemon-linux-x64';
+  if (platform === 'linux' && arch === 'arm64') return 'goodvibes-daemon-linux-arm64';
+  if (platform === 'darwin' && arch === 'x64') return 'goodvibes-daemon-macos-x64';
+  if (platform === 'darwin' && arch === 'arm64') return 'goodvibes-daemon-macos-arm64';
+  return null;
+}
+
+export async function ensureVendoredBinary({ packageRoot, artifactName }) {
+  const vendorDir = join(packageRoot, 'vendor');
+  const destination = join(vendorDir, artifactName);
+  if (isExecutable(destination)) {
+    return destination;
+  }
+
+  const pkg = JSON.parse(readFileSync(join(packageRoot, 'package.json'), 'utf8'));
+  const releaseBaseUrl =
+    process.env.GOODVIBES_RELEASE_BASE_URL?.trim() ||
+    `${resolveRepositoryBaseUrl(pkg)}/releases/download/v${pkg.version}`;
+
+  mkdirSync(vendorDir, { recursive: true });
+
+  const checksumText = await downloadText(`${releaseBaseUrl}/SHA256SUMS.txt`);
+  writeFileSync(join(vendorDir, 'SHA256SUMS.txt'), checksumText);
+  const checksums = parseChecksumFile(checksumText);
+
+  const tempDestination = `${destination}.download`;
+  rmSync(tempDestination, { force: true });
+
+  try {
+    const binary = await downloadBuffer(`${releaseBaseUrl}/${artifactName}`);
+    const actual = sha256(binary);
+    const expected = checksums.get(artifactName);
+    if (expected && expected !== actual) {
+      throw new Error(`checksum mismatch for ${artifactName}: expected ${expected}, got ${actual}`);
+    }
+    writeFileSync(tempDestination, binary);
+    prepareBinary(tempDestination);
+    rmSync(destination, { force: true });
+    writeFileSync(destination, readFileSync(tempDestination));
+    prepareBinary(destination);
+  } finally {
+    rmSync(tempDestination, { force: true });
+  }
+
+  return destination;
+}
+
+/**
+ * Self-heal counterpart to `ensureVendoredBinary` for the sqlite-vec native
+ * addon. Same shape, same verification posture (a missing manifest entry does
+ * not block the install, matching `ensureVendoredBinary` above), same
+ * vendor/ destination — placed at `vendor/lib/sqlite-vec-<platform>-<arch>/
+ * vec0.<suffix>`, which is exactly where `resolveSqliteVecPath()` looks
+ * relative to the vendored binary this module also places. A platform/arch
+ * with no addon (`resolveSqliteVecAddonName` returns null) is a no-op, not an
+ * error — same as an unsupported binary target.
+ */
+export async function ensureVendoredSqliteVecAddon({ packageRoot, platform, arch }) {
+  const asset = resolveSqliteVecAddonName(platform, arch);
+  if (!asset) return null;
+
+  const addonDir = join(packageRoot, 'vendor', 'lib', asset.dirName);
+  const destination = join(addonDir, asset.fileName);
+  if (fileExists(destination)) {
+    return destination;
+  }
+
+  const pkg = JSON.parse(readFileSync(join(packageRoot, 'package.json'), 'utf8'));
+  const releaseBaseUrl =
+    process.env.GOODVIBES_RELEASE_BASE_URL?.trim() ||
+    `${resolveRepositoryBaseUrl(pkg)}/releases/download/v${pkg.version}`;
+
+  mkdirSync(addonDir, { recursive: true });
+
+  const checksumText = await downloadText(`${releaseBaseUrl}/SHA256SUMS.txt`);
+  const checksums = parseChecksumFile(checksumText);
+
+  const tempDestination = `${destination}.download`;
+  rmSync(tempDestination, { force: true });
+
+  try {
+    const addon = await downloadBuffer(`${releaseBaseUrl}/${asset.assetName}`);
+    const actual = sha256(addon);
+    const expected = checksums.get(asset.assetName);
+    if (expected && expected !== actual) {
+      throw new Error(`checksum mismatch for ${asset.assetName}: expected ${expected}, got ${actual}`);
+    }
+    writeFileSync(tempDestination, addon);
+    rmSync(destination, { force: true });
+    writeFileSync(destination, readFileSync(tempDestination));
+  } finally {
+    rmSync(tempDestination, { force: true });
+  }
+
+  return destination;
+}
+
+function fileExists(path) {
+  try {
+    accessSync(path, constants.F_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function prepareBinary(path) {
+  if (process.platform !== 'win32') {
+    chmodSync(path, 0o755);
+  }
+}
+
+function resolveRepositoryBaseUrl(pkg) {
+  const repositoryUrl = typeof pkg.repository?.url === 'string' ? pkg.repository.url : '';
+  const normalized = repositoryUrl
+    .replace(/^git\+/, '')
+    .replace(/\.git$/, '')
+    .replace(/^git@github\.com:/, 'https://github.com/');
+  if (!normalized.startsWith('https://github.com/')) {
+    throw new Error(`unsupported repository URL for binary downloads: ${repositoryUrl || '(missing)'}`);
+  }
+  return normalized;
+}
+
+async function downloadText(url) {
+  const response = await fetch(url);
+  if (!response.ok) {
+    throw new Error(`download failed (${response.status}) for ${url}`);
+  }
+  return await response.text();
+}
+
+async function downloadBuffer(url) {
+  const response = await fetch(url);
+  if (!response.ok) {
+    throw new Error(`download failed (${response.status}) for ${url}`);
+  }
+  return Buffer.from(await response.arrayBuffer());
+}
+
+function sha256(buffer) {
+  return createHash('sha256').update(buffer).digest('hex');
+}
+
+function parseChecksumFile(contents) {
+  const checksums = new Map();
+  for (const rawLine of contents.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line) continue;
+    const match = line.match(/^([a-f0-9]{64})\s+\*?(.+)$/i);
+    if (!match) continue;
+    checksums.set(match[2], match[1].toLowerCase());
+  }
+  return checksums;
+}

package/package.json

@@ -0,0 +1,96 @@
+{
+  "name": "@pellux/goodvibes-daemon",
+  "version": "1.28.0",
+  "description": "The GoodVibes daemon \u2014 the one long-running host for the control plane, channels, cluster membership, scheduled work, knowledge and memory stores, and the verb families every GoodVibes client calls.",
+  "type": "module",
+  "main": "src/daemon/cli.ts",
+  "bin": {
+    "goodvibes-daemon": "bin/goodvibes-daemon"
+  },
+  "files": [
+    "bin",
+    "src",
+    "!src/test",
+    "!src/**/*.test.ts",
+    "scripts/check-bun.sh",
+    "scripts/postinstall.js",
+    "README.md",
+    "CHANGELOG.md"
+  ],
+  "scripts": {
+    "daemon": "bun run src/daemon/cli.ts",
+    "prebuild": "bun run scripts/prebuild.ts",
+    "build": "goodvibes-build-binaries",
+    "build:all": "goodvibes-build-binaries --all",
+    "build:linux-x64": "goodvibes-build-binaries --target linux-x64",
+    "build:linux-arm64": "goodvibes-build-binaries --target linux-arm64",
+    "build:macos-x64": "goodvibes-build-binaries --target darwin-x64",
+    "build:macos-arm64": "goodvibes-build-binaries --target darwin-arm64",
+    "smoke": "goodvibes-post-build-smoke",
+    "smoke:boot": "bun run scripts/boot-smoke.ts",
+    "smoke:hosted": "bun run scripts/hosted-session-proof.ts",
+    "typecheck": "bunx tsc --noEmit",
+    "typecheck:test": "bunx tsc --noEmit -p tsconfig.test.json",
+    "test": "bun run scripts/run-tests.ts",
+    "preinstall": "sh scripts/check-bun.sh",
+    "postinstall": "bun scripts/postinstall.js",
+    "postbuild": "bun scripts/postinstall.js --no-download",
+    "version": "bun run scripts/prebuild.ts",
+    "workflows:check": "bun run scripts/check-workflows.ts",
+    "changelog:check": "bun run scripts/check-changelog.ts",
+    "verify:tag-version": "bun run scripts/verify-release-tag-version.ts",
+    "publish:check": "bun run scripts/publish-check.ts",
+    "release": "bun run scripts/release.ts",
+    "release:dry": "bun run scripts/release.ts --dry-run"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/mgd34msu/goodvibes-daemon.git"
+  },
+  "keywords": [
+    "goodvibes",
+    "daemon",
+    "control-plane",
+    "automation",
+    "channels"
+  ],
+  "engines": {
+    "node": ">=20",
+    "bun": ">=1.3.10"
+  },
+  "dependencies": {
+    "@agentclientprotocol/sdk": "^0.21.0",
+    "@anthropic-ai/bedrock-sdk": "^0.28.1",
+    "@anthropic-ai/sdk": "^0.82.0",
+    "@ast-grep/napi": "^0.42.0",
+    "@pellux/goodvibes-sdk": "2.0.0",
+    "@pellux/goodvibes-terminal-shell": "2.0.0",
+    "bash-language-server": "^5.6.0",
+    "fuse.js": "^7.1.0",
+    "graphql": "^16.13.2",
+    "jszip": "^3.10.1",
+    "node-edge-tts": "^1.2.10",
+    "openai": "^6.29.0",
+    "pyright": "^1.1.408",
+    "simple-git": "^3.33.0",
+    "sql.js": "^1.14.1",
+    "sqlite-vec": "^0.1.9",
+    "tree-sitter-css": "^0.25.0",
+    "tree-sitter-javascript": "^0.25.0",
+    "tree-sitter-json": "^0.24.8",
+    "tree-sitter-python": "^0.25.0",
+    "tree-sitter-typescript": "^0.23.2",
+    "typescript-language-server": "^5.1.3",
+    "vscode-langservers-extracted": "^4.10.0",
+    "web-tree-sitter": "^0.26.7"
+  },
+  "devDependencies": {
+    "@pellux/goodvibes-toolchain": "2.0.0",
+    "@types/bun": "^1.3.10",
+    "typescript": "^5.9.3"
+  },
+  "overrides": {
+    "minimatch": "^10.2.5"
+  }
+}

package/scripts/check-bun.sh

@@ -0,0 +1,20 @@
+#!/bin/sh
+set -eu
+
+if ! command -v bun >/dev/null 2>&1; then
+  cat >&2 <<'EOF'
+goodvibes-daemon requires Bun.
+
+Install Bun first, then install the daemon from the npm registry with:
+
+  bun add -g goodvibes-daemon
+
+npm install -g goodvibes-daemon also works, but Bun must already be installed and available on PATH.
+EOF
+  exit 1
+fi
+
+if ! bun --version >/dev/null 2>&1; then
+  echo "goodvibes-daemon requires a working Bun executable on PATH." >&2
+  exit 1
+fi

package/scripts/postinstall.js

@@ -0,0 +1,244 @@
+#!/usr/bin/env bun
+/**
+ * postinstall — place the compiled daemon binary AND the sqlite-vec native
+ * addon for this platform.
+ *
+ * The npm package carries source and the launcher; the daemon itself is a
+ * compiled binary published as a GitHub release asset of THIS repository. This
+ * downloads the one matching binary asset, verifies it against the release's
+ * SHA256SUMS.txt, and caches it in vendor/ where bin/goodvibes-daemon finds it.
+ *
+ * The sqlite-vec addon gets the identical treatment for the identical reason:
+ * `resolveSqliteVecPath()` (platform/state/sqlite-vec-loader.ts, reached from a
+ * compiled binary) looks for it at `<execDir>/lib/sqlite-vec-<platform>-<arch>/
+ * vec0.<suffix>` — `<execDir>` being vendor/ once bin/goodvibes-daemon has
+ * placed the binary there — and nothing else stages it for an npm install. Skip
+ * this and the addon is silently absent forever: the launcher's self-heal
+ * (bin/launcher-support.js) only ever re-fetches the BINARY, and the daemon's
+ * own auto-updater only refreshes the addon if a copy already exists on disk
+ * (there is never a first one to refresh). The daemon degrades to lexical
+ * search plus a log warning rather than failing loudly, so the loss is easy to
+ * miss — this download is what gives every npm install the same vector search
+ * a curl/install.sh install gets.
+ *
+ * What it deliberately does NOT do: deploy skills, deploy agents, or fetch the
+ * wake-word model. Skills and agents are surface artifacts that ship with the
+ * terminal app's own package, not this one. The wake-word model is fetched by
+ * the daemon itself — the installer
+ * runs `goodvibes-daemon provision-wake-model` on the placed binary, and every
+ * daemon start retries whatever is still missing — so pulling it here as well
+ * would be a second copy of a pin that already has one owner.
+ *
+ * A source checkout is skipped: a repository clone is a development tree, not an
+ * installation.
+ */
+import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import {
+  CHECKSUM_MANIFEST_NAME,
+  parseChecksumFile,
+  resolveArtifactNames,
+  resolveSqliteVecAsset,
+  sha256,
+  verifyChecksum,
+} from '@pellux/goodvibes-sdk/platform/runtime/self-update';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const projectRoot = join(__dirname, '..');
+const pkg = JSON.parse(readFileSync(join(projectRoot, 'package.json'), 'utf8'));
+const noDownload = process.argv.includes('--no-download') || process.env.GOODVIBES_SKIP_BINARY_DOWNLOAD === '1';
+
+function isSourceCheckout() {
+  return existsSync(join(projectRoot, '.git')) || existsSync(join(projectRoot, 'bun.lock'));
+}
+
+function prepareBinary(path) {
+  if (process.platform !== 'win32') {
+    chmodSync(path, 0o755);
+  }
+}
+
+function resolveRepositoryBaseUrl() {
+  const repositoryUrl = typeof pkg.repository?.url === 'string' ? pkg.repository.url : '';
+  const normalized = repositoryUrl
+    .replace(/^git\+/, '')
+    .replace(/\.git$/, '')
+    .replace(/^git@github\.com:/, 'https://github.com/');
+  if (!normalized.startsWith('https://github.com/')) {
+    throw new Error(`unsupported repository URL for binary downloads: ${repositoryUrl || '(missing)'}`);
+  }
+  return normalized;
+}
+
+async function downloadFile(url, destination) {
+  const response = await fetch(url);
+  if (!response.ok) {
+    throw new Error(`download failed (${response.status}) for ${url}`);
+  }
+  writeFileSync(destination, Buffer.from(await response.arrayBuffer()));
+}
+
+async function downloadText(url) {
+  const response = await fetch(url);
+  if (!response.ok) {
+    throw new Error(`download failed (${response.status}) for ${url}`);
+  }
+  return await response.text();
+}
+
+async function installPlatformBinary() {
+  const artifacts = resolveArtifactNames(process.platform, process.arch);
+  if (!artifacts) {
+    console.log(`postinstall: no prebuilt binary for ${process.platform}-${process.arch}; skipping binary install`);
+    return;
+  }
+
+  if (noDownload) {
+    console.log('postinstall: skipping binary install (--no-download)');
+    return;
+  }
+
+  if (isSourceCheckout()) {
+    console.log('postinstall: source checkout detected; skipping release-binary install');
+    return;
+  }
+
+  const vendorDir = join(projectRoot, 'vendor');
+  mkdirSync(vendorDir, { recursive: true });
+
+  const localSourceDir = process.env.GOODVIBES_ASSET_SOURCE_DIR?.trim();
+  if (localSourceDir) {
+    const sourcePath = join(localSourceDir, artifacts.daemon);
+    if (!existsSync(sourcePath)) {
+      throw new Error(`missing local release artifact for postinstall smoke: ${sourcePath}`);
+    }
+    const destination = join(vendorDir, artifacts.daemon);
+    copyFileSync(sourcePath, destination);
+    prepareBinary(destination);
+    console.log(`postinstall: installed local smoke-test binary for ${process.platform}-${process.arch}`);
+    return;
+  }
+
+  const releaseBaseUrl =
+    process.env.GOODVIBES_RELEASE_BASE_URL?.trim() ||
+    `${resolveRepositoryBaseUrl()}/releases/download/v${pkg.version}`;
+
+  const checksumText = await downloadText(`${releaseBaseUrl}/${CHECKSUM_MANIFEST_NAME}`);
+  writeFileSync(join(vendorDir, CHECKSUM_MANIFEST_NAME), checksumText);
+  const checksums = parseChecksumFile(checksumText);
+
+  const destination = join(vendorDir, artifacts.daemon);
+  const tempDestination = `${destination}.download`;
+  rmSync(tempDestination, { force: true });
+  await downloadFile(`${releaseBaseUrl}/${artifacts.daemon}`, tempDestination);
+  const actual = sha256(readFileSync(tempDestination));
+  const expected = checksums.get(artifacts.daemon);
+  try {
+    // A missing manifest entry is as fatal as a mismatch: an unverifiable
+    // download is not a verified one.
+    verifyChecksum(artifacts.daemon, actual, expected);
+  } catch (error) {
+    rmSync(tempDestination, { force: true });
+    throw error;
+  }
+  rmSync(destination, { force: true });
+  copyFileSync(tempDestination, destination);
+  rmSync(tempDestination, { force: true });
+  prepareBinary(destination);
+
+  console.log(`postinstall: installed the release daemon binary for ${process.platform}-${process.arch}`);
+}
+
+/**
+ * Places the sqlite-vec native addon at `vendor/lib/sqlite-vec-<platform>-
+ * <arch>/vec0.<suffix>` — see the file banner for why this is a separate,
+ * equally load-bearing step from `installPlatformBinary`, not an optional
+ * extra. Mirrors that function's gating and verification exactly (skip on an
+ * unsupported target, `--no-download`, or a source checkout; the smoke-test
+ * local-source-dir seam; checksum-verify-then-place with no partial state on
+ * failure) so the two artifacts never drift in how they are trusted.
+ */
+async function installSqliteVecAddon() {
+  const asset = resolveSqliteVecAsset(process.platform, process.arch);
+  if (!asset) {
+    console.log(`postinstall: no sqlite-vec addon for ${process.platform}-${process.arch}; skipping addon install`);
+    return;
+  }
+
+  if (noDownload) {
+    console.log('postinstall: skipping sqlite-vec addon install (--no-download)');
+    return;
+  }
+
+  if (isSourceCheckout()) {
+    console.log('postinstall: source checkout detected; skipping release sqlite-vec addon install');
+    return;
+  }
+
+  const addonDir = join(projectRoot, 'vendor', 'lib', asset.dirName);
+  mkdirSync(addonDir, { recursive: true });
+  const destination = join(addonDir, asset.fileName);
+
+  const localSourceDir = process.env.GOODVIBES_ASSET_SOURCE_DIR?.trim();
+  if (localSourceDir) {
+    const sourcePath = join(localSourceDir, 'lib', asset.dirName, asset.fileName);
+    if (!existsSync(sourcePath)) {
+      throw new Error(`missing local sqlite-vec addon for postinstall smoke: ${sourcePath}`);
+    }
+    copyFileSync(sourcePath, destination);
+    console.log(`postinstall: installed local smoke-test sqlite-vec addon for ${process.platform}-${process.arch}`);
+    return;
+  }
+
+  const releaseBaseUrl =
+    process.env.GOODVIBES_RELEASE_BASE_URL?.trim() ||
+    `${resolveRepositoryBaseUrl()}/releases/download/v${pkg.version}`;
+
+  // A fresh manifest fetch (rather than sharing the one `installPlatformBinary`
+  // already wrote to vendor/) keeps this function independently correct and
+  // testable — the extra request is a one-time postinstall cost, not a
+  // per-boot one.
+  const checksumText = await downloadText(`${releaseBaseUrl}/${CHECKSUM_MANIFEST_NAME}`);
+  const checksums = parseChecksumFile(checksumText);
+
+  const tempDestination = `${destination}.download`;
+  rmSync(tempDestination, { force: true });
+  await downloadFile(`${releaseBaseUrl}/${asset.assetName}`, tempDestination);
+  const actual = sha256(readFileSync(tempDestination));
+  const expected = checksums.get(asset.assetName);
+  try {
+    verifyChecksum(asset.assetName, actual, expected);
+  } catch (error) {
+    rmSync(tempDestination, { force: true });
+    throw error;
+  }
+  rmSync(destination, { force: true });
+  copyFileSync(tempDestination, destination);
+  rmSync(tempDestination, { force: true });
+
+  console.log(`postinstall: installed the sqlite-vec addon for ${process.platform}-${process.arch}`);
+}
+
+async function main() {
+  await installPlatformBinary();
+  await installSqliteVecAddon();
+}
+
+// Guarded so this module can be imported by tests (to exercise verifyChecksum,
+// parseChecksumFile and friends) without triggering a real network install as a
+// side effect of the import.
+if (import.meta.main) {
+  await main();
+}
+
+export {
+  verifyChecksum,
+  parseChecksumFile,
+  sha256,
+  resolveArtifactNames,
+  resolveSqliteVecAsset,
+  CHECKSUM_MANIFEST_NAME,
+  installPlatformBinary,
+  installSqliteVecAddon,
+};