@pellux/goodvibes-daemon 1.28.0

package/src/runtime/plugin-composition.ts

@@ -0,0 +1,111 @@
+/**
+ * plugin-composition.ts — what a plugin dropped into the plugin directory gets
+ * to register when the host loading it is the daemon.
+ *
+ * A plugin registers into whatever registries the host hands its loader. Two
+ * hosts load a plugin today — the terminal app and this daemon — and neither
+ * holds every registry a plugin might want. The design (see
+ * goodvibes-tui/docs/decisions/2026-07-30-plugin-registrations-split-verb-side-and-surface-side.md)
+ * is: one plugin package, loaded by both hosts, each loading the registrations
+ * it can serve and ignoring the rest.
+ *
+ * This is the daemon's half of that. It serves the three verb-side kinds:
+ *
+ *   - `registerGatewayMethod` → the catalog this process actually answers from,
+ *     because unlike a pure client it runs a DaemonServer.
+ *   - `registerChannelPlugin` → the registry that receives inbound channel
+ *     traffic and elects a single reader across the cluster.
+ *   - `registerDeliveryStrategy` → the router replies leave through.
+ *
+ * plus the provider-shaped registries the daemon really has (providers, memory
+ * embeddings, voice, media, web search), which are neither host's exclusively.
+ *
+ * The two surface-side kinds are the ones this host cannot serve. The SDK's
+ * PluginLoaderDeps has no optional members and its API guards nothing, so a
+ * host that passes nothing for a registry does not decline that kind — it
+ * throws a TypeError inside the plugin's own init, which the loader catches by
+ * dropping THE WHOLE PLUGIN, including the halves this host could have run.
+ * "Ignores the rest" therefore has to be a real registry that accepts the
+ * registration and goes nowhere.
+ *
+ * What it must not be is silent. Accepting a registration that reaches nothing,
+ * with a cheerful success line, is exactly the failure this module exists to
+ * prevent. Both stand-ins below say what they took and that nothing here will
+ * run it, naming the plugin, so the same plugin loaded by a surface is visibly
+ * where that half happens.
+ */
+import { logger } from '@pellux/goodvibes-sdk/platform/utils';
+import { ToolRegistry } from '@pellux/goodvibes-sdk/platform/tools';
+import type { Tool } from '@pellux/goodvibes-sdk/platform/types';
+import type { CommandRegistryLike, HostSlashCommand } from '@pellux/goodvibes-sdk/platform/runtime/ui';
+import type { PluginLoaderDeps } from '@pellux/goodvibes-sdk/platform/plugins';
+import type { RuntimeServices } from './runtime-services-types.ts';
+
+/**
+ * A slash-command registry for a process with no prompt to type into.
+ *
+ * Slash commands are read from a composer and rendered on a screen. The daemon
+ * has neither, and the decision doc classifies them surface-side, so this
+ * accepts them and says so rather than crashing the load of a plugin whose
+ * other half this host does run.
+ */
+export function createUnservedCommandRegistry(): CommandRegistryLike {
+  return {
+    register(command: HostSlashCommand): void {
+      logger.info('[plugins] slash command registered against the daemon; it runs where there is a prompt to type it into', {
+        command: command.name,
+      });
+    },
+    unregister(): void {
+      // Nothing was ever held, so nothing is released.
+    },
+  };
+}
+
+/**
+ * A tool registry the daemon holds but does not execute from.
+ *
+ * The runs this daemon hosts build their tools through the agent orchestrator's
+ * own registry, not this one, so a plugin tool registered here is cataloged and
+ * unhandled. That is the recorded classification — `registerTool` is on the
+ * surface-side list — and it was written when the daemon hosted no runs of its
+ * own; the round that moves session hosting daemon-side is the one that
+ * re-examines it. Until then, a registration here is honest rather than quiet.
+ */
+export class UnservedToolRegistry extends ToolRegistry {
+  override register(tool: Tool): void {
+    logger.info('[plugins] tool registered against the daemon; the runs here build their tools elsewhere', {
+      tool: tool.definition.name,
+    });
+    super.register(tool);
+  }
+}
+
+/**
+ * Build the loader dependencies for this host.
+ *
+ * The delivery router is deliberately the manager's own — the one replies leave
+ * through — so a registered strategy is a strategy that sends. Handing over a
+ * second router built from the same arguments is how a registration succeeds
+ * and reaches nothing, which is the shape this whole seam is about.
+ */
+export function createDaemonPluginLoaderDeps(services: RuntimeServices): PluginLoaderDeps {
+  return {
+    runtimeBus: services.runtimeBus,
+    // Verb-side: served here.
+    gatewayMethods: services.gatewayMethods,
+    channelRegistry: services.channelPlugins,
+    channelDeliveryRouter: services.deliveryManager.getDeliveryRouter(),
+    // Provider-shaped: real registries, neither host's exclusively.
+    providerRegistry: services.providerRegistry,
+    memoryEmbeddingRegistry: services.memoryEmbeddingRegistry,
+    voiceProviderRegistry: services.voiceProviders,
+    mediaProviderRegistry: services.mediaProviders,
+    webSearchProviderRegistry: services.webSearchProviders,
+    // Surface-side: accepted and named, never silently swallowed.
+    commandRegistry: createUnservedCommandRegistry(),
+    toolRegistry: new UnservedToolRegistry(),
+    getPluginConfig: (name: string) => services.pluginManager.getPluginConfig(name),
+    isEnabled: (name: string) => services.pluginManager.isEnabled(name),
+  };
+}

package/src/runtime/runtime-services-types.ts

@@ -0,0 +1,268 @@
+/**
+ * runtime-services-types.ts — the public contract createRuntimeServices() takes
+ * and returns.
+ *
+ * Split out of services.ts (the composition root that builds every one of
+ * these fields) so the construction logic can stay under the repo's
+ * architecture line-count gate without trimming 35 arbitrary lines to clear
+ * the number. This module owns ONLY the shape of the input options and the
+ * output surface — no runtime code, no wiring order, nothing that constructs
+ * anything. services.ts re-exports both types from here, so no import site
+ * anywhere else in the app had to change.
+ */
+
+import type { ConfigManager, ServiceRegistry, SubscriptionManager, ToolLLM } from '@pellux/goodvibes-sdk/platform/config';
+import type { SecretsManager } from '../config/secrets.ts';
+import type { AutomationDeliveryManager, AutomationManager } from '@pellux/goodvibes-sdk/platform/automation';
+import type { ChannelDeliveryRouter, ChannelPolicyManager, ChannelPluginRegistry, RouteBindingManager, SurfaceRegistry } from '@pellux/goodvibes-sdk/platform/channels';
+import type { ApprovalBroker, GatewayMethodCatalog, SessionLiveTurnControlsHolder, SharedSessionBroker } from '@pellux/goodvibes-sdk/platform/control-plane';
+import type { PowerManager } from '@pellux/goodvibes-sdk/platform/power';
+
+import type { StepUpService } from '@pellux/goodvibes-sdk/daemon';
+import type { PairingTokenManager } from '@pellux/goodvibes-sdk/platform/pairing';
+import type { WatcherRegistry } from '@pellux/goodvibes-sdk/platform/watchers';
+import type { ArtifactStore } from '@pellux/goodvibes-sdk/platform/artifacts';
+import type { HomeGraphService, KnowledgeService, ProjectPlanningService } from '@pellux/goodvibes-sdk/platform/knowledge';
+import type { MediaProviderRegistry } from '@pellux/goodvibes-sdk/platform/media';
+import type { MultimodalService } from '@pellux/goodvibes-sdk/platform/multimodal';
+import type { AgentMessageBus, AgentOrchestrator, ArchetypeLoader, WrfcController } from '@pellux/goodvibes-sdk/platform/agents';
+import type { AgentManager, ContextAccountingHolder, OverflowHandler, ProcessManager, WorkflowServices } from '@pellux/goodvibes-sdk/platform/tools';
+import type { FileUndoManager, MemoryConsolidationScheduler, MemoryEmbeddingProviderRegistry, MemoryRegistry, MemoryStore, ModeManager, ProjectIndex, CodeIndexStore, CodeIndexReindexScheduler } from '@pellux/goodvibes-sdk/platform/state';
+import type { StoreSnapshotScheduler } from '@pellux/goodvibes-sdk/platform/state/store-snapshots';
+import type { PermissionManager, UserPermissionRuleStore } from '@pellux/goodvibes-sdk/platform/permissions';
+import type { buildExecPromptAnswerHandler } from '@pellux/goodvibes-sdk/platform/runtime/permissions/exec-prompt-wiring';
+import type { buildLocalhostFetchApproval } from '@pellux/goodvibes-sdk/platform/runtime/permissions/localhost-fetch-approval';
+import type { operations } from '@pellux/goodvibes-sdk/platform/runtime';
+import type { MemorySpineClient } from '@pellux/goodvibes-sdk/platform/runtime/memory-spine';
+import type { WorkspaceCheckpointManager } from '@pellux/goodvibes-sdk/platform/workspace';
+import type { DomainDispatch, RuntimeStore } from '@pellux/goodvibes-sdk/platform/runtime/store';
+import type { DevicePostureRuntime } from '@pellux/goodvibes-sdk/platform/devices';
+import type { RuntimeEventBus, DistributedRuntimeManager, RemoteRunnerRegistry, RemoteSupervisor, IntegrationHelperService, PanelManagerLike, KeybindingsManagerLike, IdempotencyStore, ComponentHealthMonitor, WorktreeRegistry, SandboxSessionRegistry, ShellPathService, FeatureFlagManager, PolicyRuntimeState, SessionSurface } from '@/runtime/index.ts';
+import type { VoiceProviderRegistry, VoiceService } from '@pellux/goodvibes-sdk/platform/voice';
+import type { CacheRegistry, PauseController, MemoryGovernor } from '@pellux/goodvibes-sdk/platform/runtime/memory';
+import type { WebSearchProviderRegistry, WebSearchService } from '@pellux/goodvibes-sdk/platform/web-search';
+import type { HookActivityTracker } from '@pellux/goodvibes-sdk/platform/hooks';
+import type { HookDispatcher, HookWorkbench } from '@pellux/goodvibes-sdk/platform/hooks';
+import type { PluginManager } from '@pellux/goodvibes-sdk/platform/plugins';
+import type { BookmarkManager } from '@pellux/goodvibes-sdk/platform/bookmarks';
+import type { ProfileManager } from '@pellux/goodvibes-sdk/platform/profiles';
+import type { SessionManager, CrossSessionTaskRegistry, SessionChangeTracker } from '@pellux/goodvibes-sdk/platform/sessions';
+import type { ApiTokenAuditor, UserAuthManager } from '@pellux/goodvibes-sdk/platform/security';
+import type { WebhookNotifier } from '@pellux/goodvibes-sdk/platform/integrations';
+import type { McpRegistry } from '@pellux/goodvibes-sdk/platform/mcp';
+import type { BenchmarkStore, CacheHitTracker, FavoritesStore, ModelLimitsService, ProviderCapabilityRegistry, ProviderOptimizer, ProviderRegistry } from '@pellux/goodvibes-sdk/platform/providers';
+import type { AdaptivePlanner, DeterministicReplayEngine, ExecutionPlanManager, SessionLineageTracker, SessionMemoryStore } from '@pellux/goodvibes-sdk/platform/core';
+import type { ArchivableProcessRegistry } from '@pellux/goodvibes-sdk/platform/runtime/fleet';
+import type { OrchestrationEngine, WorkstreamCommandService } from '@pellux/goodvibes-sdk/platform/orchestration';
+import type { WorkPlanStore } from '@pellux/goodvibes-sdk/platform/workflow';
+import type { DaemonHandlerSurfaces } from '../daemon/handlers/index.ts';
+import type { ClusterGroupComposition } from './cluster-group-composition.ts';
+import type { ClusterCoordinator } from '@pellux/goodvibes-sdk/platform/cluster';
+
+import type { TriggerManager } from '@pellux/goodvibes-sdk/platform/triggers';
+
+export interface RuntimeServicesOptions {
+  readonly runtimeBus: RuntimeEventBus;
+  readonly runtimeStore: RuntimeStore;
+  readonly configManager: ConfigManager;
+  readonly localUserAuthManager?: UserAuthManager;
+  readonly featureFlags?: FeatureFlagManager;
+  readonly getConversationTitle?: () => string | undefined;
+  readonly workingDir: string;
+  readonly homeDirectory: string;
+  /**
+   * The daemon's state root when the host was told one (`--daemon-home`,
+   * `GOODVIBES_DAEMON_HOME`); absent ⇒ `<homeDirectory>/.goodvibes/daemon`.
+   * Threaded into `SecretsManager` so the override MOVES the daemon-scoped
+   * credential store; without it a daemon told to run out of a temp tree still
+   * read the real home's daemon secrets, so an "isolated" test daemon held the
+   * owner's live credentials. One name for one thing — `resolveGoodVibesHomeOwnership`
+   * is the single reader that produces it.
+   */
+  readonly daemonHomeDirectory?: string | undefined;
+  /** Opt-in (daemon-side only): fold host-observed external coding-agent sessions
+   * into the fleet as 'observed-external' rows. Interactive leaves it off and reads
+   * the daemon snapshot. Mirrors the SDK's own createRuntimeServices option. */
+  readonly observeExternalAgents?: boolean | undefined;
+  /** Host power seam opt-in. Left out, the SDK's idle-power wiring falls back to
+   * the non-spawning unavailable seam; the daemon entrypoint passes the real
+   * host seam, which is what starts systemd-inhibit and the sleep-edge watcher. */
+  readonly powerSeam?: operations.IdlePowerServicesDeps['powerSeam'];
+  /** Live session id, read per crash-residue sweep so the running session is exempt. */
+  readonly currentSessionId?: (() => string | null) | undefined;
+  /**
+   * Wake-word boot provisioning opt-in. Same shape as `powerSeam`: the real
+   * entrypoint (`daemon/cli.ts`) asks for it, the one-shot CLI commands do
+   * not, and a test composing this graph gets neither a network fetch nor an
+   * hourly sweep it did not ask for.
+   */
+  readonly provisionWakeModelsAtBoot?: boolean | undefined;
+}
+
+export interface RuntimeServices {
+  readonly workingDirectory: string;
+  readonly homeDirectory: string;
+  /** The declare-once session-storage handle every session reader and writer threads through. */
+  readonly surface: SessionSurface;
+  readonly shellPaths: ShellPathService;
+  readonly configManager: ConfigManager;
+  readonly featureFlags: FeatureFlagManager;
+  readonly runtimeBus: RuntimeEventBus;
+  readonly runtimeStore: RuntimeStore;
+  readonly runtimeDispatch: DomainDispatch;
+  /** No-op stand-ins: the facade's contract names them, and the daemon has no screen. */
+  readonly panelManager: PanelManagerLike;
+  readonly keybindingsManager: KeybindingsManagerLike;
+  readonly routeBindings: RouteBindingManager;
+  readonly surfaceRegistry: SurfaceRegistry;
+  readonly channelPlugins: ChannelPluginRegistry;
+  readonly channelDeliveryRouter: ChannelDeliveryRouter;
+  readonly watcherRegistry: WatcherRegistry;
+  readonly approvalBroker: ApprovalBroker;
+  /** Loopback-fetch approval that rides the approval broker; shared by the tool registry and orchestrator so every surface asks the same way. */
+  readonly localhostFetchApproval: ReturnType<typeof buildLocalhostFetchApproval>;
+  /** Terminal prompt-answer handler that rides the approval broker; shared by the tool registry and orchestrator so an interactive command's prompt gets an ask/card on every surface. */
+  readonly execPromptAnswerHandler: ReturnType<typeof buildExecPromptAnswerHandler>;
+  /** Durable user-origin permission rules (remembered approvals); permissions.rules.* surface. Mirrors the SDK composition. */
+  readonly userPermissionRuleStore: UserPermissionRuleStore;
+  readonly sessionBroker: SharedSessionBroker;
+  readonly deliveryManager: AutomationDeliveryManager;
+  readonly automationManager: AutomationManager;
+  readonly gatewayMethods: GatewayMethodCatalog;
+  readonly artifactStore: ArtifactStore;
+  readonly knowledgeService: KnowledgeService;
+  readonly agentKnowledgeService: KnowledgeService;
+  readonly homeGraphService: HomeGraphService;
+  readonly projectPlanningService: ProjectPlanningService;
+  readonly projectPlanningProjectId: string;
+  readonly workPlanStore: WorkPlanStore;
+  readonly memoryStore: MemoryStore;
+  readonly memoryRegistry: MemoryRegistry;
+  /** Host-vs-client memory access: local until bootstrap.ts activates it for an adopted 'external' daemon (mirrors sessionSpine). */
+  readonly memorySpine: MemorySpineClient;
+  readonly serviceRegistry: ServiceRegistry;
+  readonly secretsManager: SecretsManager;
+  readonly stepUpService: StepUpService;
+  readonly pairingTokens: PairingTokenManager; // backs pairing.tokens.* verbs + the settings device surface (mirrors the SDK composition)
+  readonly subscriptionManager: SubscriptionManager;
+  readonly localUserAuthManager: UserAuthManager;
+  readonly profileManager: ProfileManager;
+  readonly bookmarkManager: BookmarkManager;
+  readonly sessionManager: SessionManager;
+  readonly sessionOrchestration: CrossSessionTaskRegistry;
+  readonly hookDispatcher: HookDispatcher;
+  readonly hookActivityTracker: HookActivityTracker;
+  readonly hookWorkbench: HookWorkbench;
+  readonly pluginManager: PluginManager;
+  readonly workflow: WorkflowServices;
+  /** Stream watchers, on-exit process triggers and condition checks, supervised as one — see trigger-services.ts. */
+  readonly triggerManager: TriggerManager;
+  readonly voiceProviders: VoiceProviderRegistry;
+  readonly voiceService: VoiceService;
+  readonly webSearchProviders: WebSearchProviderRegistry;
+  readonly webSearchService: WebSearchService;
+  readonly mediaProviders: MediaProviderRegistry;
+  readonly multimodalService: MultimodalService;
+  readonly memoryEmbeddingRegistry: MemoryEmbeddingProviderRegistry;
+  readonly channelPolicy: ChannelPolicyManager;
+  readonly mcpRegistry: McpRegistry;
+  readonly tokenAuditor: ApiTokenAuditor;
+  readonly componentHealthMonitor: ComponentHealthMonitor;
+  readonly worktreeRegistry: WorktreeRegistry;
+  readonly sandboxSessionRegistry: SandboxSessionRegistry;
+  readonly webhookNotifier: WebhookNotifier;
+  readonly replayEngine: DeterministicReplayEngine;
+  readonly providerOptimizer: ProviderOptimizer;
+  readonly providerCapabilityRegistry: ProviderCapabilityRegistry;
+  readonly cacheHitTracker: CacheHitTracker;
+  readonly favoritesStore: FavoritesStore;
+  readonly benchmarkStore: BenchmarkStore;
+  readonly modelLimitsService: ModelLimitsService;
+  readonly providerRegistry: ProviderRegistry;
+  readonly toolLLM: ToolLLM;
+  readonly distributedRuntime: DistributedRuntimeManager;
+  /**
+   * The paired-phone feature for this host: the grants ledger, the capture
+   * store, the housekeeping sweeps, and the capability service every `device.*`
+   * setting governs. Bound to the `devices.*` verbs at composition; the `phone`
+   * tool is registered on it in the bootstrap tail.
+   */
+  readonly devicePosture: DevicePostureRuntime;
+  readonly daemonHandlers: DaemonHandlerSurfaces;
+  /** Elects the one node on this network that consumes inbound messages; hand it to the DaemonServer so its consumers share this leadership instead of holding a second election. */
+  readonly clusterCoordinator: ClusterCoordinator;
+  /** LAN group membership: identity, keys, roster, and the `cluster` verbs. */
+  readonly clusterGroup: ClusterGroupComposition;
+  /** Start the group layer and then the election, in that order. Idempotent. */
+  readonly startCluster: () => Promise<void>;
+  readonly remoteRunnerRegistry: RemoteRunnerRegistry;
+  readonly remoteSupervisor: RemoteSupervisor;
+  readonly sessionMemoryStore: SessionMemoryStore;
+  readonly sessionLineageTracker: SessionLineageTracker;
+  readonly sessionChangeTracker: SessionChangeTracker;
+  readonly planManager: ExecutionPlanManager;
+  readonly adaptivePlanner: AdaptivePlanner;
+  readonly idempotencyStore: IdempotencyStore;
+  readonly overflowHandler: OverflowHandler;
+  readonly policyRuntimeState: PolicyRuntimeState;
+  readonly archetypeLoader: ArchetypeLoader;
+  readonly agentManager: AgentManager;
+  readonly agentMessageBus: AgentMessageBus;
+  readonly agentOrchestrator: AgentOrchestrator;
+  readonly contextAccountingHolder: ContextAccountingHolder; // bound at bootstrap.ts; see context-accounting-source.ts
+  readonly wrfcController: WrfcController;
+  readonly processManager: ProcessManager;
+  /** The phase/work-item orchestration engine — the SDK's platform/orchestration. */
+  readonly orchestrationEngine: OrchestrationEngine;
+  readonly workstreamCommands: WorkstreamCommandService;
+  /** The repo source-tree code index. */
+  readonly codeIndexStore: CodeIndexStore;
+  readonly codeIndexReindexScheduler: CodeIndexReindexScheduler; // tool-site reindex
+  /** Daily snapshots of every SQLite store this runtime writes, with bounded retention; unref'd timers (mirrors the SDK composition — hosts that tear down a runtime stop() it themselves). */
+  readonly storeSnapshotScheduler: StoreSnapshotScheduler;
+  readonly appendOnlyRetentionScheduler: operations.DurabilityServices['appendOnlyRetentionScheduler']; // periodic append-only sweep; unref'd timers, stop() on teardown
+  /** Stops the recurring crash-residue sweep; idempotent, unref'd timer (hosts that tear a runtime down call it). */
+  readonly stopDurabilityHousekeeping: () => void;
+  /** Stops the wake-word recovery sweep and a pending boot provision; a no-op unless `provisionWakeModelsAtBoot` was set. */
+  readonly stopWakeHousekeeping: () => void;
+  readonly memoryConsolidationScheduler: MemoryConsolidationScheduler;
+  readonly powerManager: PowerManager;
+  /** The daemon's memory governor (default ON). Backs ops.memory.get and defends the daemon's footprint by tier. */
+  readonly memoryGovernor: MemoryGovernor;
+  /** Registry of every retained cache the governor can shrink (knowledge stores + shared session broker). */
+  readonly cacheRegistry: CacheRegistry;
+  /** Controller the governor uses to pause/resume the deferrable background jobs under pressure. */
+  readonly pauseController: PauseController;
+  readonly sessionLiveTurnControls: SessionLiveTurnControlsHolder;
+  /** Unified live process registry (agents, WRFC chains, workflows, watchers, background processes) backing the Fleet panel; archive-aware — finished subtrees can be moved to the session archive view. */
+  readonly processRegistry: ArchivableProcessRegistry;
+  readonly modeManager: ModeManager;
+  readonly fileUndoManager: FileUndoManager;
+  readonly workspaceCheckpointManager: WorkspaceCheckpointManager;
+  /** Whether checkpoints are currently permitted for this workspace; re-reads the registration store on every call. */
+  readonly checkpointsCurrentlyAllowed: () => boolean;
+  /** Surface-scoped continuity reads (recovery-file presence, last-session pointer). */
+  readonly integrationHelpers: IntegrationHelperService;
+  /** Per-workspace trust gate — restricts write/execute/delegate tools until the workspace is trusted. */
+  readonly workspaceTrustManager: operations.WorkspaceTrustManager;
+  /**
+   * The permission manager the runs this daemon hosts ask through. Its ask seam
+   * is the workspace trust gate over the approval broker, so an undecided
+   * workspace has the trust question raised as an approval record rather than
+   * being treated as trusted (which is what a missing manager means to the
+   * background permission gate) or refused without a word.
+   */
+  readonly permissionManager: PermissionManager;
+  /** Re-root path-bound stores (MemoryStore, ProjectIndex) to a new working directory, called by WorkspaceSwapManager after verification; stores needing a process restart just warn-log and keep serving the old path until the daemon restarts with the new --working-dir. */
+  rerootStores(newWorkingDir: string): Promise<void>;
+  /**
+   * Cancel the agent runs this graph is hosting, returning how many.
+   *
+   * Required by the SDK's RuntimePollerOwners: by dispose() time the fleet
+   * registry, orchestration engine, process registry and bus these runs report
+   * through are already down, so a run still described as "running" is orphaned
+   * rather than preserved.
+   */
+  cancelHostedAgentRuns(): number;
+  dispose(): void; // Stop every poller this graph started; best-effort, total, idempotent. This surface owns its graph — the SDK's disposal scope drives it.
+}