@pellux/goodvibes-daemon 1.28.0

package/src/daemon/config-command.ts

@@ -0,0 +1,281 @@
+/**
+ * config-command.ts — `goodvibes-daemon config list|get|set|unset`.
+ *
+ * A headless daemon's settings had no command at all: the only ways to change
+ * one were to hand-edit a JSON file whose path and tier you had to already
+ * know, or to attach a client. `webui enable` proved the pattern for a
+ * settings-writing command that the installer and a person can both run — open
+ * the same ConfigManager the daemon boots with, write through `set()`, print an
+ * honest receipt — and this is that pattern generalised to every key.
+ *
+ * WHICH FILE A WRITE LANDS IN is not decided here. `ConfigManager.set()` routes
+ * a daemon-owned key to the daemon's own settings store and a shared key to the
+ * shared one; this command reports where it landed rather than choosing, so the
+ * routing stays in one place and this command cannot disagree with the daemon.
+ *
+ * READS ARE REDACTED. Every value printed goes through the terminal shell's
+ * cli-redaction
+ * first, so a token, a password, an API key or a card number reads as
+ * `<redacted>` and a `config list` pasted into a bug report carries no
+ * credential. Writes are NOT redacted — `config set` stores the real value; it
+ * is the OUTPUT that is cleaned. A `goodvibes://secrets/...` reference is left
+ * visible on purpose: it is a pointer, not a secret, and hiding it would make
+ * the indirection impossible to verify.
+ */
+import type { ConfigManager, ConfigKey, ConfigSetting } from '@pellux/goodvibes-sdk/platform/config';
+import { ConfigError } from '@pellux/goodvibes-sdk/platform/config';
+import {
+  REDACTED_VALUE,
+  isSensitiveConfigPath,
+  parseConfigValueText,
+  redactConfig,
+} from '@pellux/goodvibes-terminal-shell';
+
+export const CONFIG_SUBCOMMANDS = ['list', 'get', 'set', 'unset'] as const;
+export type ConfigSubcommand = (typeof CONFIG_SUBCOMMANDS)[number];
+
+export function isConfigSubcommand(value: string | undefined): value is ConfigSubcommand {
+  return typeof value === 'string' && (CONFIG_SUBCOMMANDS as readonly string[]).includes(value);
+}
+
+export interface ConfigCommandResult {
+  readonly exitCode: number;
+  readonly lines: readonly string[];
+}
+
+export interface ConfigCommandDeps {
+  /** The same manager the daemon boots with, so a write lands where the daemon reads. */
+  readonly configManager: Pick<ConfigManager, 'get' | 'set' | 'getSchema' | 'getRaw' | 'reset' | 'getConfigPath'>;
+  readonly json: boolean;
+  readonly binary?: string | undefined;
+}
+
+function usage(binary: string): string[] {
+  return [
+    `  ${binary} config list [--json]`,
+    `  ${binary} config get <key> [--json]`,
+    `  ${binary} config set <key> <value>`,
+    `  ${binary} config unset <key>`,
+  ];
+}
+
+function refusal(message: string, deps: ConfigCommandDeps): ConfigCommandResult {
+  const binary = deps.binary ?? 'goodvibes-daemon';
+  return {
+    exitCode: 2,
+    lines: deps.json
+      ? [JSON.stringify({ ok: false, error: message }, null, 2)]
+      : [`config: ${message}`, ...usage(binary)],
+  };
+}
+
+function failure(message: string, deps: ConfigCommandDeps): ConfigCommandResult {
+  return {
+    exitCode: 1,
+    lines: deps.json ? [JSON.stringify({ ok: false, error: message }, null, 2)] : [`config: ${message}`],
+  };
+}
+
+/**
+ * The redacted, printable form of one value.
+ *
+ * The path decides, not the value: `isSensitiveConfigPath` answers for the key
+ * name, so an empty password prints as empty (it IS unset) and a real one
+ * prints as `<redacted>` whatever it happens to contain. A secrets reference is
+ * a pointer and stays visible.
+ */
+export function renderConfigValue(key: string, value: unknown): string {
+  if (isSensitiveConfigPath(key)) {
+    if (value === null || value === undefined) return 'unset';
+    if (typeof value === 'string') {
+      if (value.trim().length === 0) return '""';
+      if (value.startsWith('goodvibes://secrets/')) return value;
+      return REDACTED_VALUE;
+    }
+    return value === false || value === 0 ? JSON.stringify(value) : REDACTED_VALUE;
+  }
+  if (value === undefined) return 'unset';
+  return typeof value === 'string' ? value : JSON.stringify(value);
+}
+
+function schemaFor(deps: ConfigCommandDeps, key: string): ConfigSetting | undefined {
+  return deps.configManager.getSchema().find((setting) => setting.key === key);
+}
+
+function message(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
+
+function readValue(deps: ConfigCommandDeps, key: string): unknown {
+  try {
+    return deps.configManager.get(key as ConfigKey);
+  } catch {
+    return undefined;
+  }
+}
+
+function listResult(deps: ConfigCommandDeps): ConfigCommandResult {
+  const schema = deps.configManager.getSchema();
+  const rows = schema.map((setting) => ({
+    key: setting.key,
+    value: readValue(deps, setting.key),
+    type: setting.type,
+  }));
+
+  if (deps.json) {
+    // The whole document goes through the recursive redactor as well as the
+    // per-key render, so a secret nested inside an object-valued setting is
+    // caught by its own path rather than only by its parent's name.
+    const redacted = redactConfig(
+      Object.fromEntries(rows.map((row) => [row.key, row.value])) as Record<string, unknown>,
+    );
+    return {
+      exitCode: 0,
+      lines: [JSON.stringify({
+        ok: true,
+        data: {
+          settingsFile: deps.configManager.getConfigPath(),
+          redactedKeys: redacted.redactedPaths,
+          settings: redacted.value,
+        },
+      }, null, 2)],
+    };
+  }
+
+  const width = rows.reduce((max, row) => Math.max(max, row.key.length), 0);
+  return {
+    exitCode: 0,
+    lines: [
+      `${rows.length} settings (values that read like credentials are shown as ${REDACTED_VALUE}):`,
+      '',
+      ...rows.map((row) => `  ${row.key.padEnd(width)}  ${renderConfigValue(row.key, row.value)}`),
+      '',
+      `settings file: ${deps.configManager.getConfigPath()}`,
+      'a daemon-owned key is written to the daemon\'s own settings store instead; `config set` says which.',
+    ],
+  };
+}
+
+function getResult(deps: ConfigCommandDeps, key: string): ConfigCommandResult {
+  const setting = schemaFor(deps, key);
+  if (!setting) {
+    return failure(`'${key}' is not a settings key. Run \`${deps.binary ?? 'goodvibes-daemon'} config list\` to see them.`, deps);
+  }
+  const value = readValue(deps, key);
+  if (deps.json) {
+    const redacted = redactConfig({ [key]: value } as Record<string, unknown>);
+    return {
+      exitCode: 0,
+      lines: [JSON.stringify({
+        ok: true,
+        data: {
+          key,
+          value: (redacted.value as Record<string, unknown>)[key],
+          type: setting.type,
+          redacted: redacted.redactedPaths.length > 0,
+        },
+      }, null, 2)],
+    };
+  }
+  return { exitCode: 0, lines: [renderConfigValue(key, value)] };
+}
+
+function setResult(deps: ConfigCommandDeps, key: string, rawValue: string): ConfigCommandResult {
+  const setting = schemaFor(deps, key);
+  if (!setting) {
+    return failure(`'${key}' is not a settings key. Run \`${deps.binary ?? 'goodvibes-daemon'} config list\` to see them.`, deps);
+  }
+  const value = parseConfigValueText(rawValue);
+  try {
+    deps.configManager.set(key as ConfigKey, value as never);
+  } catch (error) {
+    // A schema refusal is the common case (wrong type, value outside an enum),
+    // and its message already names what was wrong. Passing it through beats
+    // rewording it into something vaguer.
+    return failure(
+      error instanceof ConfigError ? error.message : `could not write ${key} — ${message(error)}`,
+      deps,
+    );
+  }
+  const stored = readValue(deps, key);
+  if (deps.json) {
+    const redacted = redactConfig({ [key]: stored } as Record<string, unknown>);
+    return {
+      exitCode: 0,
+      lines: [JSON.stringify({
+        ok: true,
+        data: { key, value: (redacted.value as Record<string, unknown>)[key], written: true },
+      }, null, 2)],
+    };
+  }
+  return {
+    exitCode: 0,
+    lines: [
+      `${key} = ${renderConfigValue(key, stored)}`,
+      '  written to disk. A running daemon picks most keys up live; the ones that only apply',
+      '  when it binds a port need a restart:  goodvibes-daemon restart-service',
+    ],
+  };
+}
+
+function unsetResult(deps: ConfigCommandDeps, key: string): ConfigCommandResult {
+  const setting = schemaFor(deps, key);
+  if (!setting) {
+    return failure(`'${key}' is not a settings key. Run \`${deps.binary ?? 'goodvibes-daemon'} config list\` to see them.`, deps);
+  }
+  try {
+    deps.configManager.reset(key as ConfigKey);
+  } catch (error) {
+    return failure(`could not reset ${key} — ${message(error)}`, deps);
+  }
+  const stored = readValue(deps, key);
+  if (deps.json) {
+    const redacted = redactConfig({ [key]: stored } as Record<string, unknown>);
+    return {
+      exitCode: 0,
+      lines: [JSON.stringify({
+        ok: true,
+        data: { key, value: (redacted.value as Record<string, unknown>)[key], reset: true },
+      }, null, 2)],
+    };
+  }
+  return {
+    exitCode: 0,
+    lines: [`${key} = ${renderConfigValue(key, stored)}  (back to its shipped default)`],
+  };
+}
+
+/**
+ * Run one config verb. Never throws for an ordinary refusal: a bad key, a value
+ * the schema rejects and an unwritable settings file all come back as an exit
+ * code and lines, because a caller is often a script reading both.
+ */
+export function runConfigCommand(args: readonly string[], deps: ConfigCommandDeps): ConfigCommandResult {
+  const subcommand = args[0];
+  if (subcommand === undefined) return refusal('name what to do with the settings.', deps);
+  if (!isConfigSubcommand(subcommand)) {
+    return refusal(`'${subcommand}' is not a config command — try ${CONFIG_SUBCOMMANDS.join(', ')}.`, deps);
+  }
+
+  if (subcommand === 'list') {
+    if (args.length > 1) return refusal(`'${args[1]}' is one argument too many.`, deps);
+    return listResult(deps);
+  }
+
+  const key = args[1];
+  if (key === undefined) return refusal(`${subcommand} needs a settings key.`, deps);
+
+  if (subcommand === 'get') {
+    if (args.length > 2) return refusal(`'${args[2]}' is one argument too many.`, deps);
+    return getResult(deps, key);
+  }
+  if (subcommand === 'unset') {
+    if (args.length > 2) return refusal(`'${args[2]}' is one argument too many.`, deps);
+    return unsetResult(deps, key);
+  }
+
+  const rawValue = args[2];
+  if (rawValue === undefined) return refusal(`set needs a value: \`config set ${key} <value>\`.`, deps);
+  if (args.length > 3) return refusal(`'${args[3]}' is one argument too many.`, deps);
+  return setResult(deps, key, rawValue);
+}

package/src/daemon/handlers/context.ts

@@ -0,0 +1,29 @@
+/**
+ * Host-facing context passed to every surface register function. Replaces the
+ * former OperatorContext. It carries the SDK gateway catalog (handlers attach
+ * to it), the daemon credential store, a read-only slice of the config manager,
+ * resolved directories, and a logger. No SDK descriptor or schema is declared
+ * here — the catalog type is re-exported through the contracts seam.
+ */
+import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
+import type { GatewayMethodCatalog } from './contracts.ts';
+import type { DaemonCredentialStore } from './credentials.ts';
+import type { Unregister } from './register.ts';
+
+export interface HandlerLogger {
+  info(message: string, meta?: unknown): void;
+  warn(message: string, meta?: unknown): void;
+  error(message: string, meta?: unknown): void;
+}
+
+export interface HandlerContext {
+  readonly catalog: GatewayMethodCatalog;
+  readonly credentials: DaemonCredentialStore;
+  readonly configManager: Pick<ConfigManager, 'get' | 'getCategory'>;
+  readonly workingDirectory: string;
+  readonly homeDirectory: string;
+  readonly logger: HandlerLogger;
+}
+
+/** Every surface module exports a register function of this shape. */
+export type SurfaceRegister = (ctx: HandlerContext) => Unregister;

package/src/daemon/handlers/contracts.ts

@@ -0,0 +1,43 @@
+/**
+ * Single SDK-contract import seam for the daemon handler layer.
+ *
+ * Every other module under `src/daemon/handlers/` imports SDK contract
+ * identifiers from HERE and nowhere else. Concentrating the SDK imports in one
+ * concrete-submodule module keeps the rest of the layer free of barrel cycles
+ * and guarantees the host NEVER re-declares an SDK id, descriptor, or schema —
+ * it only attaches handlers to the descriptors the SDK already registered.
+ */
+
+// Catalog + invocation contract types (concrete control-plane subpath, not a project barrel).
+export type {
+  GatewayMethodCatalog,
+  GatewayMethodDescriptor,
+  GatewayMethodInvocation,
+  GatewayMethodInvocationContext,
+  GatewayMethodHandler,
+} from '@pellux/goodvibes-sdk/platform/control-plane';
+
+// Channel domain types reused in handler signatures (read-only SDK interfaces; never re-declared).
+export type {
+  ChannelIdentity,
+  ChannelResolvedTarget,
+  ChannelAccountRecord,
+} from '@pellux/goodvibes-sdk/platform/channels';
+
+/**
+ * The two remote-route contracts a host has to name: the per-peer auth
+ * envelope, and the distributed-runtime service the SDK facade injects into
+ * `DaemonRemoteRouteContext.distributedRuntime` so the published
+ * `remote.peers.*` HTTP routes can dispatch to it.
+ *
+ * Both were declared here, by hand, as a verbatim structural mirror of the
+ * daemon-sdk's own declarations — seventeen methods copied signature for
+ * signature — for one reason: neither carried the `export` keyword upstream,
+ * so neither could be imported. Both do now, and a mirror that can drift out of
+ * agreement with the interface it must satisfy is worse than no mirror at all.
+ *
+ * They are re-exported under the same names so every implementer in this
+ * product keeps naming them the way it already does. The SDK ships no
+ * docker/ssh/cloud backend — the host still owns the implementation.
+ */
+export type { DistributedRuntimeRouteService, RemotePeerAuth } from '@pellux/goodvibes-daemon-sdk/remote-routes';

package/src/daemon/handlers/credentials.ts

@@ -0,0 +1,139 @@
+import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';
+import type { SecretsManager, SecretScope } from '../../config/secrets.ts';
+import {
+  buildGoodVibesSecretKey,
+  isSecretReferenceValue,
+} from '../../config/secret-config.ts';
+
+export interface DaemonCredentialStore {
+  /**
+   * Resolve a goodvibes://secrets/ reference OR a raw secret key to its
+   * plaintext value (daemon-internal only).
+   */
+  resolveRef(ref: string): Promise<string | null>;
+  /**
+   * Resolve a config-key-derived secret
+   * (e.g. 'surfaces.slack.botToken' → GOODVIBES_SURFACES_SLACK_BOT_TOKEN).
+   */
+  resolveConfigSecret(configKey: string): Promise<string | null>;
+  /**
+   * Store a daemon-owned credential. scope defaults 'daemon'.
+   *
+   * This is the DAEMON's own credential store: every caller is daemon code, and
+   * every value written through it is one the daemon itself has to read back —
+   * including its own generated draft encryption key (createAtRestCipher below,
+   * which calls put() with no scope at all). Defaulting to 'user' filed those
+   * in a surface-scoped tier, so the daemon's own material lived somewhere it
+   * only found by accident, and a value written on one surface's behalf was
+   * invisible to the next.
+   */
+  put(
+    secretKey: string,
+    value: string,
+    opts?: { scope?: SecretScope; medium?: 'plaintext' | 'secure' },
+  ): Promise<void>;
+  has(secretKey: string): Promise<boolean>;
+}
+
+/** Extract the trailing secret-key segment from a goodvibes://secrets/ reference. */
+function secretKeyFromReference(ref: string): string {
+  const normalized = ref.trim();
+  const segments = normalized.split('/');
+  const last = segments[segments.length - 1] ?? '';
+  return decodeURIComponent(last);
+}
+
+export function createDaemonCredentialStore(secrets: SecretsManager): DaemonCredentialStore {
+  return {
+    async resolveRef(ref: string): Promise<string | null> {
+      const key = isSecretReferenceValue(ref) ? secretKeyFromReference(ref) : ref;
+      return secrets.get(key);
+    },
+    async resolveConfigSecret(configKey: string): Promise<string | null> {
+      return secrets.get(buildGoodVibesSecretKey(configKey));
+    },
+    async put(
+      secretKey: string,
+      value: string,
+      opts?: { scope?: SecretScope; medium?: 'plaintext' | 'secure' },
+    ): Promise<void> {
+      await secrets.set(secretKey, value, {
+        scope: opts?.scope ?? 'daemon',
+        medium: opts?.medium ?? 'secure',
+      });
+    },
+    async has(secretKey: string): Promise<boolean> {
+      const value = await secrets.get(secretKey);
+      return value !== null && value.length > 0;
+    },
+  };
+}
+
+// ---------------------------------------------------------------------------
+// At-rest encryption helper for drafts (draft body must be encrypted at rest).
+// ---------------------------------------------------------------------------
+
+export interface AtRestCipher {
+  encrypt(plaintext: string): Promise<string>;
+  decrypt(ciphertext: string): Promise<string>;
+}
+
+const DEFAULT_DRAFT_KEY_NAME = 'GOODVIBES_DAEMON_DRAFT_AESKEY';
+const AES_KEY_BYTES = 32; // AES-256
+const GCM_IV_BYTES = 12;
+const GCM_TAG_BYTES = 16;
+
+async function loadOrCreateKey(
+  store: DaemonCredentialStore,
+  keyName: string,
+): Promise<Buffer> {
+  const existing = await store.resolveRef(keyName);
+  if (existing && existing.length > 0) {
+    const buf = Buffer.from(existing, 'base64');
+    if (buf.length === AES_KEY_BYTES) return buf;
+  }
+  const generated = randomBytes(AES_KEY_BYTES);
+  await store.put(keyName, generated.toString('base64'), { medium: 'secure' });
+  return generated;
+}
+
+/**
+ * Create an AES-256-GCM at-rest cipher backed by a daemon-owned key.
+ * encrypt() returns base64(iv | tag | ciphertext). Uses node:crypto (Bun-compatible).
+ * NEVER log resolved keys or plaintext.
+ */
+export function createAtRestCipher(
+  store: DaemonCredentialStore,
+  keyName: string = DEFAULT_DRAFT_KEY_NAME,
+): AtRestCipher {
+  let keyPromise: Promise<Buffer> | null = null;
+  const getKey = (): Promise<Buffer> => {
+    if (!keyPromise) keyPromise = loadOrCreateKey(store, keyName);
+    return keyPromise;
+  };
+
+  return {
+    async encrypt(plaintext: string): Promise<string> {
+      const key = await getKey();
+      const iv = randomBytes(GCM_IV_BYTES);
+      const cipher = createCipheriv('aes-256-gcm', key, iv);
+      const encrypted = Buffer.concat([
+        cipher.update(plaintext, 'utf-8'),
+        cipher.final(),
+      ]);
+      const tag = cipher.getAuthTag();
+      return Buffer.concat([iv, tag, encrypted]).toString('base64');
+    },
+    async decrypt(ciphertext: string): Promise<string> {
+      const key = await getKey();
+      const raw = Buffer.from(ciphertext, 'base64');
+      const iv = raw.subarray(0, GCM_IV_BYTES);
+      const tag = raw.subarray(GCM_IV_BYTES, GCM_IV_BYTES + GCM_TAG_BYTES);
+      const data = raw.subarray(GCM_IV_BYTES + GCM_TAG_BYTES);
+      const decipher = createDecipheriv('aes-256-gcm', key, iv);
+      decipher.setAuthTag(tag);
+      const decrypted = Buffer.concat([decipher.update(data), decipher.final()]);
+      return decrypted.toString('utf-8');
+    },
+  };
+}