@pellux/goodvibes-daemon 1.28.0

package/src/runtime/device-posture-composition.ts

@@ -0,0 +1,115 @@
+/**
+ * device-posture-composition.ts — the paired-phone feature inside THIS daemon.
+ *
+ * A phone pairs with whichever daemon the person runs. Until this module
+ * existed this daemon had no device posture at all: `device.nodes.maxPaired`
+ * was enforced at the pairing path (SDK-side) and `device.capabilities.mode`
+ * was an onboarding toggle, while the other eleven `device.*` keys were
+ * recorded, read back, and governed nothing — the capability service they
+ * describe was never built here, so there was nothing for them to govern.
+ *
+ * The feature itself is platform-owned (`platform/devices`): the settings→policy
+ * mapping, the grants ledger, the capture store, the housekeeping sweeps, the
+ * confirmation flow, and the `phone` tool. This module supplies the three seams
+ * that are actually ours and nothing else:
+ *
+ *   - the peer transport — the same DistributedRuntimeManager the remote surface
+ *     pairs devices onto, so a phone paired here is a node here,
+ *   - the approval path — the shared approval broker, so the confirmation
+ *     appears wherever the person is looking (terminal, web app, companion),
+ *   - the storage root and the live config manager.
+ *
+ * Constructing this starts nothing. `startHousekeeping()` is called from the
+ * bootstrap tail: grants and captures both outlive a restart, so a grant whose
+ * phone is gone, or a capture torn by a crash, is reaped BEFORE the first
+ * request of this run is served — and the periodic sweep after it is what keeps
+ * a long-running daemon from going days without one. A failed sweep is logged
+ * and the app still runs: housekeeping failing is a reason to say so, not a
+ * reason to refuse to start.
+ */
+import { logger } from '@pellux/goodvibes-sdk/platform/utils';
+import { createDevicePostureRuntime, registerDevicePhoneTool } from '@pellux/goodvibes-sdk/platform/devices';
+import type {
+  DeviceApprovalBridge,
+  DevicePeerTransport,
+  DevicePhoneToolRegistry,
+  DevicePostureRuntime,
+} from '@pellux/goodvibes-sdk/platform/devices';
+import { registerDevicesGatewayMethods } from '@pellux/goodvibes-sdk/platform/control-plane';
+import type { GatewayMethodCatalog } from '@pellux/goodvibes-sdk/platform/control-plane';
+import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
+
+/** Who this surface records in the device audit trail. */
+export const DAEMON_DEVICE_ACTOR = 'daemon:phone-tool';
+
+export interface DevicePostureCompositionOptions {
+  readonly configManager: ConfigManager;
+  /** The runtime devices pair onto; its listPeers/invokePeer are the transport. */
+  readonly distributedRuntime: DevicePeerTransport;
+  readonly approvals: DeviceApprovalBridge;
+  /** Surface-scoped directory the grants ledger, captures and disclosure live in. */
+  readonly stateDirectory: string;
+  /**
+   * Binding the catalog turns the whole devices.* family from
+   * cataloged-but-unhandled into real handlers: nodes.list, grants.*,
+   * housekeeping.run, and — since a surface with no device runtime of its own
+   * could read the grants and never open a camera — capability.request and
+   * artifacts.list/read. That is what makes the paired phone usable from the web
+   * app and the companion rather than only through this process's own tool.
+   *
+   * The runtime is handed over whole because the verbs and the tool must reach
+   * the SAME service: a second path to a phone would be a second place the
+   * confirmation prompt and the durable grants could be decided differently.
+   */
+  readonly gatewayMethods?: GatewayMethodCatalog | undefined;
+  readonly getSessionId?: (() => string | undefined) | undefined;
+}
+
+export interface DevicePostureServices {
+  readonly devicePosture: DevicePostureRuntime;
+}
+
+/** Build the device posture runtime and bind the device verbs to it. */
+export function createDevicePostureServices(options: DevicePostureCompositionOptions): DevicePostureServices {
+  const devicePosture = createDevicePostureRuntime({
+    transport: options.distributedRuntime,
+    approvals: options.approvals,
+    config: options.configManager,
+    stateDirectory: options.stateDirectory,
+    actor: DAEMON_DEVICE_ACTOR,
+    ...(options.getSessionId ? { getSessionId: options.getSessionId } : {}),
+  });
+  if (options.gatewayMethods) registerDevicesGatewayMethods(options.gatewayMethods, devicePosture);
+  return { devicePosture };
+}
+
+/**
+ * Everything a host with a tool registry has to do once it is up: register the
+ * `phone` tool — the only path that reaches the capability service, so without it
+ * the posture keys govern nothing a session can observe — and start housekeeping.
+ *
+ * One call, because these two belong to the same feature and a host that did the
+ * first and forgot the second would serve requests while never reaping a grant
+ * whose phone is gone.
+ */
+export function installDevicePosture(
+  toolRegistry: DevicePhoneToolRegistry,
+  devicePosture: DevicePostureRuntime,
+): void {
+  registerDevicePhoneTool(toolRegistry, devicePosture);
+  startDeviceHousekeeping(devicePosture);
+}
+
+/**
+ * The recovery sweep plus the periodic timer. Separate from construction so
+ * composing a runtime in a test starts no timer and touches no disk, and
+ * separate from the call above so this daemon — which registers no tools —
+ * still sweeps.
+ */
+export function startDeviceHousekeeping(devicePosture: DevicePostureRuntime): void {
+  void devicePosture.startHousekeeping().catch((error: unknown) => {
+    logger.warn('Device housekeeping sweep failed at startup', {
+      error: error instanceof Error ? error.message : String(error),
+    });
+  });
+}

package/src/runtime/disposal-wiring.ts

@@ -0,0 +1,101 @@
+/**
+ * disposal-wiring.ts
+ *
+ * Teardown for every poller the daemon's runtime graph starts.
+ *
+ * The mechanics — the ordered, best-effort, idempotent scope and the
+ * all-required owner list — live in the SDK (`platform/runtime/disposal`), so
+ * the daemon and the SDK's own composition root cannot drift into two different
+ * ideas of what "stop the graph" means. What lives here is only the mapping from
+ * the daemon's assembled graph onto that list, plus the four pollers the daemon
+ * owns that the SDK's composition does not have at all: the crash-residue sweep,
+ * the device housekeeping sweep, the wake-model recovery sweep, and the product
+ * handler surfaces with their inbox timers. Calling the SDK's list alone would
+ * silently leave every one of them running.
+ *
+ * It is a separate module because `runtime/services.ts` sits against the repo's
+ * 800-line source cap (check-architecture.ts) with no room for the wiring.
+ *
+ * Ownership note, and the reason any of this exists: this product builds the
+ * graph and hands the SAME object to `DaemonServer`. The SDK facade disposes
+ * only a graph it constructed itself, so it deliberately leaves this one alone
+ * — nothing upstream will ever stop these pollers. The shutdown paths in
+ * daemon/cli.ts and the one-shot CLI commands are the only things that can.
+ *
+ * The owner type below is declared structurally rather than imported from
+ * services.ts: that module imports this one, and a type-only edge is still a
+ * cycle to the architecture check.
+ */
+
+import {
+  createDisposalScope,
+  registerRuntimePollers,
+  type DisposalRegistry,
+  type RuntimePollerOwners,
+} from '@pellux/goodvibes-sdk/platform/runtime/disposal';
+
+/** Re-exported so the composition root reaches the whole seam through one import. */
+export { createDisposalScope };
+
+/** The assembled graph, narrowed to the poller owners it exposes as fields. */
+export interface DaemonRuntimePollerOwners extends Omit<RuntimePollerOwners, 'stopConfigWatch'> {
+  /** Daemon-only: the repeating crash-residue sweep. */
+  readonly stopDurabilityHousekeeping: () => void;
+  /**
+   * Daemon-only: the wake-word recovery sweep and a pending boot provision
+   * Started only when an entrypoint opted into boot
+   * provisioning, and a no-op otherwise — but it is on this list unconditionally,
+   * because "the graph did not start it this time" is not a reason for the
+   * teardown path to have no way to stop it.
+   */
+  readonly stopWakeHousekeeping: () => void;
+  /**
+   * Daemon-only: the product handler surfaces (daemon-handler-composition.ts).
+   *
+   * `unregister()` detaches the gateway handlers AND stops the two pollers this
+   * product's inbox surface owns — the retention sweep inside `InboxCursorStore`
+   * and the per-provider `InboundPoller` intervals. The SDK does not know either
+   * exists, so if this surface does not stop them nothing does.
+   */
+  readonly daemonHandlers: { readonly unregister: () => void };
+  /**
+   * This daemon only: the paired-phone feature's housekeeping timer
+   * (device-posture-composition.ts). Started by whichever entry point boots the
+   * host, so the stop belongs on this list rather than in one shutdown path.
+   */
+  readonly devicePosture: { readonly stopHousekeeping: () => void };
+}
+
+/**
+ * The poller owners this daemon holds that are NOT reachable from the
+ * assembled graph — handles the factory keeps as locals.
+ */
+export interface RuntimeDisposalExtras {
+  /** Handle returned by `ConfigManager.watchConfigFiles()`. */
+  readonly stopConfigWatch: () => void;
+}
+
+/**
+ * Register the stop call for every poller the graph started.
+ *
+ * `services` is the fully-assembled graph, which already exposes each poller
+ * owner as a field — so a poller whose owner reaches the public surface is
+ * wired by name rather than by threading another local out of the factory.
+ */
+export function registerDaemonRuntimePollers(
+  registry: DisposalRegistry,
+  services: DaemonRuntimePollerOwners,
+  extras: RuntimeDisposalExtras,
+): void {
+  registerRuntimePollers(registry, { ...services, stopConfigWatch: extras.stopConfigWatch });
+  registry.add('durability housekeeping', services.stopDurabilityHousekeeping);
+  registry.add('device housekeeping', () => services.devicePosture.stopHousekeeping());
+  registry.add('wake-word housekeeping', services.stopWakeHousekeeping);
+  // Registered LAST so it tears down FIRST (the scope unwinds in reverse), which
+  // is the order daemon/cli.ts already used by hand: release the handler surfaces
+  // — closing the inbox store and stopping its poll timers — before the pollers
+  // the rest of the graph owns. Being on this list is what makes a plain
+  // `dispose()` total: every shutdown path stops these, not just the one that
+  // remembered to call `unregister()` itself.
+  registry.add('daemon handler surfaces', () => services.daemonHandlers.unregister());
+}

package/src/runtime/fleet-needs-input-push.ts

@@ -0,0 +1,61 @@
+/**
+ * fleet-needs-input-push.ts — wires the fleet "needs-input" browser-push fan-out
+ * that the SDK's registerGatewayVerbGroups (reached through the terminal-shell's
+ * attachWsOnlyGatewayVerbHandlers wrapper) gates on two deps: `runtimeBus` and
+ * `sessionPresence` (see push/service.ts's attachFleetNeedsInputSource). When a
+ * fleet node blocks on the operator, it pushes an "Input needed" notification
+ * carrying the session/node deep link to every registered device — suppressed
+ * while an operator surface is already attached to that node's session.
+ *
+ * TWO seams have to be live for a real push, not just descriptor presence:
+ *  1. Fleet lifecycle deltas (FLEET_NODE_BLOCKED_ON_USER etc.) have to reach the
+ *     runtime bus's 'fleet' domain in the first place. That is
+ *     attachFleetEmitBridge, diffing the process registry's own coalesced
+ *     snapshot tick into per-node lifecycle events. The terminal-shell package's
+ *     createArchivableFleetRegistry only builds the registry — it does not
+ *     attach the bridge — so the composition root that owns both the registry
+ *     and the bus (this file) is the one place responsible for it. The SDK's
+ *     own daemon composition (platform/runtime/services.ts) attaches this same
+ *     bridge right after building its process registry.
+ *  2. registerGatewayVerbGroups has to be handed `runtimeBus` (to subscribe onto
+ *     that domain) and `sessionPresence` (to suppress a push when an operator is
+ *     already looking at the session).
+ *
+ * sessionPresence is the SDK's own hasFreshSurfaceParticipant: a session counts
+ * as attended when any participant heartbeated within the SDK's freshness
+ * window. This is the one implementation, imported, so every surface's
+ * push/suppress behavior agrees.
+ */
+import { attachFleetEmitBridge } from '@pellux/goodvibes-sdk/platform/runtime/fleet';
+import type { ArchivableProcessRegistry } from '@pellux/goodvibes-sdk/platform/runtime/fleet';
+import { hasFreshSurfaceParticipant, SURFACE_ROUTE_FRESHNESS_MS, type SharedSessionBroker } from '@pellux/goodvibes-sdk/platform/control-plane';
+import type { RuntimeEventBus } from '@/runtime/index.ts';
+
+export interface FleetNeedsInputPushDeps {
+  readonly runtimeBus: RuntimeEventBus;
+  readonly sessionPresence: { isAttached(sessionId: string): boolean };
+}
+
+/**
+ * Attach the fleet emit-bridge (registry snapshot deltas -> runtime bus `fleet`
+ * domain) and build the presence lookup, returning both as the deps
+ * `attachWsOnlyGatewayVerbHandlers` spreads into its call so the needs-input
+ * push source registers for real instead of gracefully degrading to absent.
+ */
+export function wireFleetNeedsInputPush(input: {
+  readonly registry: ArchivableProcessRegistry;
+  readonly runtimeBus: RuntimeEventBus;
+  readonly sessionBroker: Pick<SharedSessionBroker, 'getSession'>;
+}): FleetNeedsInputPushDeps {
+  attachFleetEmitBridge({ registry: input.registry, bus: input.runtimeBus });
+  const sessionBroker = input.sessionBroker;
+  return {
+    runtimeBus: input.runtimeBus,
+    sessionPresence: {
+      isAttached: (sessionId: string) => {
+        const session = sessionBroker.getSession(sessionId);
+        return session !== null && hasFreshSurfaceParticipant(session, Date.now(), SURFACE_ROUTE_FRESHNESS_MS);
+      },
+    },
+  };
+}

package/src/runtime/fleet-services.ts

@@ -0,0 +1,41 @@
+/**
+ * fleet-services.ts — the shared, archive-aware fleet registry construction,
+ * lifted out of services.ts so the composition root stays under the file-size
+ * cap. Mirrors the sibling create*Services helpers (durability, code-index,
+ * workstream): a single dependency-injected call that services.ts makes once.
+ *
+ * Also owns the daemon-side observed foreign-agent source: when
+ * observeExternalAgents is on (the standalone daemon), externally-launched
+ * coding-agent sessions observed read-only on the host fold in as
+ * 'observed-external' rows (visibility + steer; never counted against
+ * fleet.maxSize, never stopped). The interactive process leaves it off and
+ * reads the daemon's snapshot, so it never double-scans. Absence ⇒ a quiet
+ * empty set. Mirrors the SDK's own createRuntimeServices wiring.
+ */
+import { computeUsageCostUsd, type ProviderRegistry } from '@pellux/goodvibes-sdk/platform/providers';
+import { type ArchivableProcessRegistry } from '@pellux/goodvibes-sdk/platform/runtime/fleet';
+import { ObservedAgentSource } from '@pellux/goodvibes-sdk/platform/runtime/fleet/observed';
+import { createArchivableFleetRegistry, type ProcessRegistryDeps } from '@pellux/goodvibes-terminal-shell';
+
+export interface FleetServicesDeps
+  extends Omit<ProcessRegistryDeps, 'observedAgents' | 'priceUsage'> {
+  /** Turns on the daemon-side observed foreign-agent source (daemon only). */
+  readonly observeExternalAgents?: boolean | undefined;
+  /** Backs the honest pricing resolver folded into priceUsage below. */
+  readonly providerRegistry: Pick<ProviderRegistry, 'resolveModelPricing'>;
+}
+
+export function createFleetServices(
+  deps: FleetServicesDeps,
+): { processRegistry: ArchivableProcessRegistry } {
+  const { observeExternalAgents, providerRegistry, ...registryDeps } = deps;
+  const observedAgents = observeExternalAgents ? new ObservedAgentSource() : undefined;
+  const processRegistry = createArchivableFleetRegistry({
+    ...registryDeps,
+    observedAgents, // Daemon-side observed foreign-agent rows (undefined in the interactive process)
+    // Honest-unpriced through the ONE pricing resolver (manual -> registration -> provider-served
+    // -> catalog -> unknown); unknown/subscription yields null, never $0. Mirrors the SDK composition.
+    priceUsage: (model, usage) => (model ? computeUsageCostUsd(providerRegistry.resolveModelPricing(model), usage) : null),
+  });
+  return { processRegistry };
+}

package/src/runtime/hosted-session-composition.ts

@@ -0,0 +1,128 @@
+/**
+ * hosted-session-composition.ts — what this daemon states so it may host
+ * conversation loops.
+ *
+ * The engine is the SDK's (`@pellux/goodvibes-sdk/platform/hosted-sessions`):
+ * lifecycle, the detach policy, the bounded disk state, the verbs, the
+ * lifecycle channel. It is off until a product says how a workspace FLOOR is
+ * built, and that is deliberate — the floor's `requestApproval` seam is where a
+ * product's trust posture lives, and no default can stand in for a decision
+ * about who may write files and run commands in a directory a client named over
+ * the wire.
+ *
+ * This daemon's answer is the gate it already had: the workspace trust
+ * question is put in front of every ask a hosted run makes (trust/trust-gated-
+ * approvals.ts): an undecided workspace raises the question as an ordinary
+ * approval record for whichever surface is attached to answer, a trusted one is
+ * exactly as permissive as before, and a restricted one refuses non-read
+ * categories without asking. What this file adds is PER-WORKSPACE scope: the
+ * daemon's own gate reads `<its cwd>/.goodvibes/<surface>/trust.json`, and a
+ * session hosted in another directory has to be gated by that directory's
+ * decision, not by the daemon's.
+ *
+ * Everything else in a floor comes from `createClientRuntimeServices` — the
+ * same composition a terminal runs — so a hosted turn's tools, hooks, plugins
+ * and model stack are the ones the platform already has, not a second set.
+ */
+import { createShellPathService } from '@/runtime/index.ts';
+import { createClientRuntimeServices } from '@pellux/goodvibes-sdk/platform/runtime/client-services';
+import { createRuntimeStore } from '@pellux/goodvibes-sdk/platform/runtime/store';
+import { createLaunchTolerantProviderRegistry } from '@pellux/goodvibes-sdk/platform/providers';
+import type { DaemonHostedSessionsOptions } from '@pellux/goodvibes-sdk/platform/daemon';
+import type { HostedWorkspaceFloor } from '@pellux/goodvibes-sdk/platform/hosted-sessions';
+import { operations } from '@pellux/goodvibes-sdk/platform/runtime';
+const { WorkspaceTrustManager } = operations;
+import { createWorkspaceTrustDecisionAsk, trustGatedApprovalRaiser, type ApprovalRaise } from './trust/trust-gated-approvals.ts';
+import { GOODVIBES_DAEMON_SURFACE_ROOT } from '../config/surface.ts';
+import type { RuntimeServices } from './runtime-services-types.ts';
+
+/** The operator policy a session hosted by THIS daemon runs under. */
+function hostedSystemPrompt(input: { readonly workspaceRoot: string }): string {
+  return [
+    'You are a GoodVibes session hosted by the daemon rather than by a terminal.',
+    `Your working directory is ${input.workspaceRoot}.`,
+    'Someone may be attached and watching this turn, or may have detached and read it later —',
+    'write for both. Say what you did and why; never report work you did not do.',
+    'Tool permissions are decided by whoever is attached: an ask you raise may take a while to be',
+    'answered, and an unanswered one is a refusal, not a reason to find another way round.',
+  ].join(' ');
+}
+
+/**
+ * Build the hosted-session options this daemon passes to `DaemonServer`.
+ *
+ * `services` is the daemon's own graph: its config manager, event bus, secrets
+ * home and approval broker are shared with every floor, so a hosted session
+ * reads the same settings, publishes on the same bus and raises asks into the
+ * same broker every other surface is watching.
+ */
+export function createHostedSessionOptions(services: RuntimeServices): DaemonHostedSessionsOptions {
+  /**
+   * One trust manager per workspace, cached: `load()` is idempotent but a
+   * manager per floor keeps the decision file and the in-memory answer for a
+   * workspace in one place, so two sessions in one directory cannot end up
+   * having been asked the trust question twice.
+   */
+  const trustByWorkspace = new Map<string, operations.WorkspaceTrustManager>();
+
+  const gateFor = (workspaceRoot: string): ApprovalRaise => {
+    const shellPaths = createShellPathService({
+      workingDirectory: workspaceRoot,
+      homeDirectory: services.homeDirectory,
+    });
+    let trust = trustByWorkspace.get(workspaceRoot);
+    if (!trust) {
+      trust = new WorkspaceTrustManager({ shellPaths, surfaceRoot: GOODVIBES_DAEMON_SURFACE_ROOT });
+      trustByWorkspace.set(workspaceRoot, trust);
+    }
+    const raise: ApprovalRaise = (input) => services.approvalBroker.requestApproval(input);
+    return trustGatedApprovalRaiser(
+      trust,
+      raise,
+      // The question names the workspace it is about, which is the whole point
+      // of scoping it here: a daemon hosting three sessions in three
+      // directories asks three separate questions, each answerable on its own.
+      createWorkspaceTrustDecisionAsk({ requestApproval: raise, workingDirectory: workspaceRoot }),
+    );
+  };
+
+  return {
+    floorFactory: ({ workspaceRoot }): HostedWorkspaceFloor => {
+      const floor = createClientRuntimeServices({
+        configManager: services.configManager,
+        // The daemon's own bus: a hosted turn's stream events reach the
+        // control-plane SSE subscribers through the same path every other
+        // runtime event takes, stamped with the hosted session's id.
+        runtimeBus: services.runtimeBus,
+        // A store of its own. The daemon's runtime store describes the daemon's
+        // single local runtime, and a hosted session is not that runtime.
+        runtimeStore: createRuntimeStore(),
+        featureFlags: services.featureFlags,
+        surfaceRoot: GOODVIBES_DAEMON_SURFACE_ROOT,
+        workingDir: workspaceRoot,
+        homeDirectory: services.homeDirectory,
+        requestApproval: gateFor(workspaceRoot),
+        // A workspace with broken or absent provider credentials must degrade,
+        // not take the daemon down on a create call.
+        providerRegistryFactory: createLaunchTolerantProviderRegistry,
+      });
+      // The machine's own local models. The daemon's registry learned them at
+      // boot (the persisted discovery cache) and from the LAN scan; a floor
+      // builds its own registry and would otherwise be the only place on this
+      // box where they are not routable. Servers found by a scan that finishes
+      // AFTER a floor is built reach the next floor, not this one — stated
+      // rather than hidden, because a wrong claim here would look like a model
+      // that exists everywhere except in hosted sessions.
+      const discovered = services.providerRegistry.listDiscoveredServers();
+      if (discovered.length > 0) floor.providerRegistry.registerDiscoveredProviders([...discovered]);
+      return {
+        services: floor,
+        // The daemon has a real review-chain controller; a hosted session's
+        // orchestrator lists through it rather than reporting none.
+        wrfcController: services.wrfcController,
+        dispose: (): void => floor.dispose(),
+      };
+    },
+    systemPrompt: hostedSystemPrompt,
+  };
+}

package/src/runtime/index.ts

@@ -0,0 +1,100 @@
+/**
+ * Runtime barrel for the daemon product.
+ *
+ * The SDK groups its runtime seams into namespace exports (`bootstrap`,
+ * `observability`, `operations`, `security`, `shell`, `state`, `transport`,
+ * `ui`). This file names the ones the daemon composition actually uses so the
+ * composition modules import them as plain symbols, and so there is exactly one
+ * place to look when the SDK moves one.
+ *
+ * It re-exports and nothing else: no local runtime entry points, no wrappers, no
+ * behavior. Anything that needs behavior belongs in its own module or in the
+ * SDK.
+ */
+
+import {
+  bootstrap,
+  observability,
+  operations,
+  security,
+  shell,
+  transport,
+  ui,
+} from '@pellux/goodvibes-sdk/platform/runtime';
+
+// State, the event bus and the read-model store.
+export * from '@pellux/goodvibes-sdk/platform/runtime/state';
+export * from '@pellux/goodvibes-sdk/platform/runtime/store';
+export * from '@pellux/goodvibes-sdk/platform/runtime/feature-flags';
+export * from '@pellux/goodvibes-sdk/platform/runtime/settings';
+export * from '@pellux/goodvibes-sdk/platform/runtime/sandbox';
+
+// Shell paths + the surface-scoped storage handle.
+export const createShellPathService = shell.createShellPathService;
+export type ShellPathService = shell.ShellPathService;
+export const createSessionSurface = operations.createSessionSurface;
+export type SessionSurface = operations.SessionSurface;
+export const WorktreeRegistry = shell.WorktreeRegistry;
+export type WorktreeRegistry = shell.WorktreeRegistry;
+
+// Remote execution + the distributed runtime.
+export const DistributedRuntimeManager = operations.DistributedRuntimeManager;
+export type DistributedRuntimeManager = operations.DistributedRuntimeManager;
+export const RemoteRunnerRegistry = operations.RemoteRunnerRegistry;
+export type RemoteRunnerRegistry = operations.RemoteRunnerRegistry;
+export const RemoteSupervisor = operations.RemoteSupervisor;
+export type RemoteSupervisor = operations.RemoteSupervisor;
+
+// Boot helpers the daemon runs itself (the facade does not know about them).
+export const syncConfiguredServices = bootstrap.synchronizeConfiguredServices;
+
+// Observability.
+export const TelemetryApiService = observability.TelemetryApiService;
+export type TelemetryApiService = observability.TelemetryApiService;
+export const ComponentHealthMonitor = observability.ComponentHealthMonitor;
+export type ComponentHealthMonitor = observability.ComponentHealthMonitor;
+export const IdempotencyStore = observability.IdempotencyStore;
+export type IdempotencyStore = observability.IdempotencyStore;
+
+// Security.
+export const PolicyRuntimeState = security.PolicyRuntimeState;
+export type PolicyRuntimeState = security.PolicyRuntimeState;
+
+// Integration helpers (surface-scoped continuity reads) and the no-op screen
+// stand-ins. The daemon facade's service-graph contract names a panel manager
+// and a keybindings manager because a surface that has a screen supplies real
+// ones; the daemon has no screen, and the SDK ships the honest no-ops for
+// exactly this case rather than leaving a hole a fake would fill.
+export const IntegrationHelperService = ui.IntegrationHelperService;
+export type IntegrationHelperService = ui.IntegrationHelperService;
+export const createNoopPanelManager = ui.createNoopPanelManager;
+export const createNoopKeybindingsManager = ui.createNoopKeybindingsManager;
+export type PanelManagerLike = ui.PanelManagerLike;
+export type KeybindingsManagerLike = ui.KeybindingsManagerLike;
+
+// Notification routing types (the router itself is imported from its own subpath).
+export type Notification = ui.Notification;
+export type RoutingDecision = ui.RoutingDecision;
+
+// Outbound network transport installation (proxy/TLS policy from settings).
+export const GlobalNetworkTransportInstaller = transport.GlobalNetworkTransportInstaller;
+export type GlobalNetworkTransportInstaller = transport.GlobalNetworkTransportInstaller;
+
+
+// Runtime event payload unions, re-exported so a consumer names one import path
+// for the bus and the shapes that travel on it.
+export type {
+  AgentEvent,
+  CommunicationEvent,
+  OpsEvent,
+  OrchestrationEvent,
+  PermissionEvent,
+  ProviderEvent,
+  RouteEvent,
+  SessionEvent,
+  TaskEvent,
+  ToolEvent,
+  TransportEvent,
+  TurnEvent,
+  WorkflowEvent,
+} from '@pellux/goodvibes-sdk/events';

package/src/runtime/knowledge-services.ts

@@ -0,0 +1,101 @@
+// ---------------------------------------------------------------------------
+// knowledge-services.ts — the knowledge/wiki + home-graph stack
+//
+// Constructs the three KnowledgeStores (regular wiki, agent, home-graph), their
+// semantic services, the ingest services, the home-graph service, and the
+// project-planning + work-plan stores. Extracted into its own module rather
+// than built inline in services.ts, which sits at the architecture check's
+// 800-line cap (scripts/check-architecture.ts) — new/large construction blocks
+// get their own module and a single wiring call there (mirrors
+// createWorkstreamServices / createDurabilityServices / createCodeIndexServices).
+//
+// The semantic services + ingest services receive the memory-governor
+// backpressure seams (isBackgroundPaused for the knowledge-self-improvement job
+// + admitExpensiveWork for the critical-tier refusal), mirroring the SDK's own
+// createRuntimeServices. The web-knowledge gap repairer is wired by the caller
+// AFTER webSearchService exists (it is constructed later in services.ts), using
+// the semantic + ingest handles this returns.
+// ---------------------------------------------------------------------------
+
+import {
+  HomeGraphService,
+  GOODVIBES_AGENT_KNOWLEDGE_DB_FILE,
+  HOME_GRAPH_KNOWLEDGE_EXTENSION,
+  KnowledgeService,
+  KnowledgeSemanticService,
+  KnowledgeStore,
+  ProjectPlanningService,
+  createProviderBackedKnowledgeSemanticLlm,
+  projectPlanningProjectIdFromPath,
+} from '@pellux/goodvibes-sdk/platform/knowledge';
+import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
+import type { ProviderRegistry } from '@pellux/goodvibes-sdk/platform/providers';
+import type { ArtifactStore } from '@pellux/goodvibes-sdk/platform/artifacts';
+import type { MemoryRegistry } from '@pellux/goodvibes-sdk/platform/state';
+import type { RuntimeEventBus } from '@/runtime/index.ts';
+import { WorkPlanStore } from '@pellux/goodvibes-sdk/platform/workflow';
+import { GOODVIBES_DAEMON_SURFACE_ROOT } from '../config/surface.ts';
+
+const REGULAR_KNOWLEDGE_DB_FILE = 'knowledge-wiki.sqlite';
+const HOME_GRAPH_KNOWLEDGE_DB_FILE = 'knowledge-home-graph.sqlite';
+
+export interface KnowledgeServicesDeps {
+  readonly configManager: ConfigManager;
+  readonly providerRegistry: ProviderRegistry;
+  readonly artifactStore: ArtifactStore;
+  readonly memoryRegistry: MemoryRegistry;
+  readonly runtimeBus: RuntimeEventBus;
+  readonly workingDirectory: string;
+  readonly homeDirectory: string;
+  /** True while the 'knowledge-self-improvement' job is governor-paused. */
+  readonly isBackgroundPaused: () => boolean;
+  /** Critical-tier admission gate for expensive knowledge work. */
+  readonly admitExpensiveWork: (label: string) => { allowed: boolean; reason?: string | undefined };
+}
+
+export interface KnowledgeServices {
+  readonly knowledgeStore: KnowledgeStore;
+  readonly agentKnowledgeStore: KnowledgeStore;
+  readonly homeGraphKnowledgeStore: KnowledgeStore;
+  readonly knowledgeSemanticService: KnowledgeSemanticService;
+  readonly homeGraphSemanticService: KnowledgeSemanticService;
+  readonly agentKnowledgeSemanticService: KnowledgeSemanticService;
+  readonly knowledgeService: KnowledgeService;
+  readonly agentKnowledgeService: KnowledgeService;
+  readonly homeGraphService: HomeGraphService;
+  readonly projectPlanningService: ProjectPlanningService;
+  readonly projectPlanningProjectId: string;
+  readonly workPlanStore: WorkPlanStore;
+}
+
+/** Construct the knowledge/wiki + home-graph stack with governor backpressure wired in. */
+export function createKnowledgeServices(deps: KnowledgeServicesDeps): KnowledgeServices {
+  const { configManager, providerRegistry, artifactStore, memoryRegistry, runtimeBus, isBackgroundPaused, admitExpensiveWork } = deps;
+  const knowledgeStore = new KnowledgeStore({ configManager, dbFileName: REGULAR_KNOWLEDGE_DB_FILE });
+  const agentKnowledgeStore = new KnowledgeStore({ configManager, dbFileName: GOODVIBES_AGENT_KNOWLEDGE_DB_FILE });
+  const homeGraphKnowledgeStore = new KnowledgeStore({ configManager, dbFileName: HOME_GRAPH_KNOWLEDGE_DB_FILE });
+  const knowledgeSemanticLlm = createProviderBackedKnowledgeSemanticLlm(providerRegistry, { timeoutMs: 20_000, maxConcurrent: 1 });
+  const knowledgeSemanticService = new KnowledgeSemanticService(knowledgeStore, { llm: knowledgeSemanticLlm, maxLlmSourcesPerReindex: 3, isBackgroundPaused, admitExpensiveWork });
+  const homeGraphSemanticService = new KnowledgeSemanticService(homeGraphKnowledgeStore, { llm: knowledgeSemanticLlm, maxLlmSourcesPerReindex: 3, objectProfiles: HOME_GRAPH_KNOWLEDGE_EXTENSION.objectProfiles, isBackgroundPaused, admitExpensiveWork });
+  const agentKnowledgeSemanticService = new KnowledgeSemanticService(agentKnowledgeStore, { llm: knowledgeSemanticLlm, maxLlmSourcesPerReindex: 3, isBackgroundPaused, admitExpensiveWork });
+  const knowledgeService = new KnowledgeService(knowledgeStore, artifactStore, undefined, { memoryRegistry, runtimeBus, semanticService: knowledgeSemanticService, admitExpensiveWork });
+  knowledgeService.attachRuntimeBus(runtimeBus);
+  const agentKnowledgeService = new KnowledgeService(agentKnowledgeStore, artifactStore, undefined, { memoryRegistry, runtimeBus, semanticService: agentKnowledgeSemanticService, admitExpensiveWork });
+  agentKnowledgeService.attachRuntimeBus(runtimeBus);
+  const homeGraphService = new HomeGraphService(homeGraphKnowledgeStore, artifactStore, { semanticService: homeGraphSemanticService, admitExpensiveWork });
+  const projectPlanningProjectId = projectPlanningProjectIdFromPath(deps.workingDirectory);
+  const projectPlanningService = new ProjectPlanningService(knowledgeStore, { defaultProjectId: projectPlanningProjectId });
+  const workPlanStore = new WorkPlanStore({
+    homeDirectory: deps.homeDirectory,
+    surfaceRoot: GOODVIBES_DAEMON_SURFACE_ROOT,
+    projectId: projectPlanningProjectId,
+    projectRoot: deps.workingDirectory,
+    source: GOODVIBES_DAEMON_SURFACE_ROOT,
+  });
+  return {
+    knowledgeStore, agentKnowledgeStore, homeGraphKnowledgeStore,
+    knowledgeSemanticService, homeGraphSemanticService, agentKnowledgeSemanticService,
+    knowledgeService, agentKnowledgeService, homeGraphService,
+    projectPlanningService, projectPlanningProjectId, workPlanStore,
+  };
+}