@pellux/goodvibes-daemon 1.28.0

package/src/config/secrets.ts

@@ -0,0 +1,71 @@
+export type {
+  SecretDeleteOptions,
+  SecretRecord,
+  SecretScope,
+  SecretSource,
+  SecretStorageMedium,
+  SecretStorageMode,
+  SecretStorageReview,
+  SecretWriteOptions,
+} from '@pellux/goodvibes-sdk/platform/config';
+
+import {
+  SecretsManager as SdkSecretsManager,
+  type SecretsManagerOptions as SdkSecretsManagerOptions,
+} from '@pellux/goodvibes-sdk/platform/config';
+import { isSecretRefInput } from '@pellux/goodvibes-sdk/platform/config';
+import { GOODVIBES_DAEMON_SURFACE_ROOT } from './surface.ts';
+
+export type SecretsManagerOptions = Omit<SdkSecretsManagerOptions, 'surfaceRoot'>;
+
+const RAW_SECRET_LITERAL_PREFIX = '__GOODVIBES_LITERAL_V1__';
+
+function isGoodVibesSecretRefInput(value: string): boolean {
+  const normalized = value.trim();
+  return normalized.startsWith('goodvibes://secrets/') && isSecretRefInput(normalized);
+}
+
+function shouldStoreAsLiteral(value: string): boolean {
+  return value.startsWith(RAW_SECRET_LITERAL_PREFIX)
+    || (isSecretRefInput(value) && !isGoodVibesSecretRefInput(value));
+}
+
+function encodeLiteralSecret(value: string): string {
+  return `${RAW_SECRET_LITERAL_PREFIX}${Buffer.from(JSON.stringify({ value }), 'utf-8').toString('base64url')}`;
+}
+
+function decodeLiteralSecret(value: string): string | null {
+  if (!value.startsWith(RAW_SECRET_LITERAL_PREFIX)) return null;
+  try {
+    const decoded = Buffer.from(value.slice(RAW_SECRET_LITERAL_PREFIX.length), 'base64url').toString('utf-8');
+    const parsed = JSON.parse(decoded) as unknown;
+    if (!parsed || typeof parsed !== 'object' || typeof (parsed as { value?: unknown }).value !== 'string') return null;
+    return (parsed as { value: string }).value;
+  } catch {
+    return null;
+  }
+}
+
+export class SecretsManager extends SdkSecretsManager {
+  constructor(options: SecretsManagerOptions) {
+    super({
+      ...options,
+      surfaceRoot: GOODVIBES_DAEMON_SURFACE_ROOT,
+    });
+  }
+
+  override async get(key: string): Promise<string | null> {
+    const envValue = process.env[key];
+    if (envValue !== undefined && shouldStoreAsLiteral(envValue)) {
+      return decodeLiteralSecret(envValue) ?? envValue;
+    }
+
+    const value = await super.get(key);
+    if (value === null) return null;
+    return decodeLiteralSecret(value) ?? value;
+  }
+
+  override async set(key: string, value: string, options?: Parameters<SdkSecretsManager['set']>[2]): Promise<void> {
+    await super.set(key, shouldStoreAsLiteral(value) ? encodeLiteralSecret(value) : value, options);
+  }
+}

package/src/config/surface.ts

@@ -0,0 +1,24 @@
+/**
+ * surface.ts — the daemon's single surface-root identifier.
+ *
+ * Every piece of the daemon's own on-disk state (sessions, recovery snapshots,
+ * checkpoints, the transcript journal, watchers, triggers, control-plane stores)
+ * lives under `.goodvibes/<surface root>/`. The segment used to be spelled as a
+ * bare string literal at each call site, which is how a writer and a reader
+ * ended up disagreeing about where the last-session pointer lives.
+ *
+ * ── Why the daemon's surface root is still `tui` ────────────────────────────
+ *
+ * Because that is where the running daemon's state already is. Every store
+ * this daemon has written on every installed machine — sessions, approvals,
+ * watchers, devices, channel policies, the code index — sits under
+ * `.goodvibes/tui/`. Renaming the segment here would not move that state; it
+ * would make the daemon stop finding it, silently, on machines that have been
+ * running for months.
+ *
+ * The rename is a migration, not a constant edit: it needs a copy-forward pass
+ * with a receipt, the same shape the SDK already performs for the unscoped →
+ * scoped move, plus the live-install rehearsal that goes with it. Until then
+ * this constant carries the reason so nobody "tidies" it.
+ */
+export const GOODVIBES_DAEMON_SURFACE_ROOT = 'tui';

package/src/core/pairing-banner.ts

@@ -0,0 +1,82 @@
+/**
+ * pairing-banner.ts — the pairing block, in one place.
+ *
+ * A daemon prints this once, as it finishes starting. That was the ONLY way to
+ * see it: scroll it off the screen, start the daemon as a service where nothing
+ * reads stdout, or come back to the box tomorrow, and there was no way to get
+ * the link back short of restarting the daemon. `goodvibes-daemon pair` prints
+ * it again — and prints exactly THIS, because both callers render from here.
+ *
+ * It reprints the daemon's existing shared token rather than minting a new one.
+ * Minting is a different act with a different consequence (a per-device token,
+ * one more record in the token store, a link the boot banner's QR no longer
+ * matches), and `pair` is not the command for it — `pairing.handoff.create` is.
+ */
+import {
+  buildPairingHandoffLink,
+  describeOriginPosture,
+  formatPairingOffers,
+  formatPostureCapabilities,
+  generateQrMatrix,
+  pairingPostureNotice,
+  renderQrToString,
+  type PairingHandoffOfferKind,
+} from '@pellux/goodvibes-sdk/platform/pairing';
+
+export interface PairingBannerInput {
+  /** The daemon version, stated so a scanned link is attributable to a build. */
+  readonly version: string;
+  /** The web-app origin the deep link opens. */
+  readonly origin: string;
+  /** The token the link carries — the daemon's existing shared companion token. */
+  readonly token: string;
+  readonly offers: readonly PairingHandoffOfferKind[];
+  /** False to print the link and the offers without the QR block. */
+  readonly includeQr?: boolean | undefined;
+}
+
+export interface PairingBanner {
+  readonly lines: readonly string[];
+  /** The exact `<origin>/#pair=<token>` URL the QR encodes. */
+  readonly deepLink: string;
+  /** The capability list, already worded, for a caller rendering its own shape. */
+  readonly capabilities: readonly string[];
+  /** The one honest posture line, when the posture carries one. */
+  readonly notice: string | undefined;
+}
+
+/**
+ * Render the block. Pure: it takes an origin and a token and returns lines, so
+ * the boot path and the `pair` command cannot drift, and a test can assert the
+ * exact text without a daemon, a socket or a token file.
+ */
+export function renderPairingBanner(input: PairingBannerInput): PairingBanner {
+  const deepLink = buildPairingHandoffLink({
+    webOrigin: input.origin,
+    token: input.token,
+    offers: input.offers,
+  });
+  // The banner renders the SAME SDK posture the pairing verb carries: the
+  // labeled capability list, and the one honest LAN line only when the posture
+  // holds it.
+  const posture = describeOriginPosture(input.origin);
+  const capabilities = formatPostureCapabilities(posture);
+  const notice = pairingPostureNotice(posture) ?? undefined;
+  const qr = input.includeQr === false ? [] : [renderQrToString(generateQrMatrix(deepLink))];
+
+  return {
+    deepLink,
+    capabilities,
+    notice,
+    lines: [
+      `GoodVibes daemon ${input.version} — scan to pair a device (opens the web app signed in):`,
+      '',
+      `  ${input.origin}`,
+      '',
+      ...(input.offers.length > 0 ? ['Offers (each declinable in the web app):', ...formatPairingOffers(input.offers), ''] : []),
+      ...(capabilities.length > 0 ? ['This device will get:', ...capabilities, ''] : []),
+      ...(notice ? [notice, ''] : []),
+      ...qr,
+    ],
+  };
+}