@pellux/goodvibes-daemon 1.28.11 → 1.28.12

package/CHANGELOG.md

@@ -4,7 +4,35 @@ All notable changes to the GoodVibes daemon.
 
 ---
 
-## [Unreleased]
+## [1.28.12] - 2026-08-05
+
+### Changes
+
+- **Fixed: a hosted conversational turn no longer gets the host.** The daemon
+  composes hosted sessions through the same `createClientRuntimeServices` a
+  terminal runs, so a hosted command already ran inside the same bubblewrap
+  boundary — network, PID, UTS and IPC namespaced, system read-only, /tmp and
+  $HOME masked, `sandbox.egressAllowlist` the one way network comes back. What
+  differed was the fallback: with no boundary available the command ran
+  directly on the host and only said so afterwards, and a conversational turn
+  used that to read the whole process table and drive the owner's terminal.
+  The daemon now STATES the posture. Every session it hosts is
+  `conversational`, which makes the boundary REQUIRED: a command that cannot be
+  contained is refused, naming why, and `background: true` is not a spelling
+  that gets around it. A hosted workstream that genuinely needs the machine is
+  a per-spawn grant written into this daemon's own composition — nothing on the
+  wire and nothing in a tool argument can reach it.
+- **Fixed: the owner's terminal is untouchable.** A command that drives an
+  existing tmux session, window or pane this platform did not create —
+  send-keys, kill, resize, attach, respawn, rename — is refused by the exec
+  guard for a hosted turn, with a refusal that names the rule. Creating and
+  driving the platform's own sessions is unchanged, and so is reading tmux
+  state (`list-sessions`, `list-panes`, `capture-pane`), which the fleet view
+  already does. The frozen catastrophic block is untouched.
+- Changed: this daemon's hosted operator prompt carries the platform's
+  conversational diagnosis contract — report the state and propose, never
+  restart the owner's applications or type into his terminal to "fix" things,
+  and a "fixed" claim needs the live evidence it rests on.
 
 ## [1.28.11] - 2026-08-05
 

package/README.md

@@ -2,7 +2,7 @@
 
 [![CI](https://github.com/mgd34msu/goodvibes-daemon/actions/workflows/ci.yml/badge.svg)](https://github.com/mgd34msu/goodvibes-daemon/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
-[![Version](https://img.shields.io/badge/version-1.28.11-blue.svg)](https://github.com/mgd34msu/goodvibes-daemon)
+[![Version](https://img.shields.io/badge/version-1.28.12-blue.svg)](https://github.com/mgd34msu/goodvibes-daemon)
 
 The GoodVibes daemon: one long-running process per machine that holds the control plane every
 GoodVibes client talks to. It answers the operator verb families over HTTP, reads and replies on

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pellux/goodvibes-daemon",
-  "version": "1.28.11",
+  "version": "1.28.12",
   "description": "The GoodVibes daemon \u2014 the one long-running host for the control plane, channels, cluster membership, scheduled work, knowledge and memory stores, and the verb families every GoodVibes client calls.",
   "type": "module",
   "main": "src/daemon/cli.ts",
@@ -65,8 +65,8 @@
     "@anthropic-ai/bedrock-sdk": "^0.28.1",
     "@anthropic-ai/sdk": "^0.82.0",
     "@ast-grep/napi": "^0.42.0",
-    "@pellux/goodvibes-sdk": "2.0.9",
-    "@pellux/goodvibes-terminal-shell": "2.0.9",
+    "@pellux/goodvibes-sdk": "2.0.10",
+    "@pellux/goodvibes-terminal-shell": "2.0.10",
     "bash-language-server": "^5.6.0",
     "fuse.js": "^7.1.0",
     "graphql": "^16.13.2",

package/src/runtime/hosted-session-composition.ts

@@ -23,13 +23,46 @@
  * Everything else in a floor comes from `createClientRuntimeServices` — the
  * same composition a terminal runs — so a hosted turn's tools, hooks, plugins
  * and model stack are the ones the platform already has, not a second set.
+ *
+ * ── The exec posture a hosted turn runs under ──────────────────────────────
+ *
+ * "The same composition a terminal runs" is what BUILDS the exec tool, and it
+ * builds it the same way here: the `sandbox.*` config and the `exec-sandbox`
+ * gate this daemon already reads produce the same bubblewrap boundary a local
+ * exec gets — network, PID, UTS and IPC namespaced, the system read-only, /tmp
+ * and $HOME masked, the workspace writable, and `sandbox.egressAllowlist` the
+ * one way network comes back — with the self-labelling note on every result.
+ *
+ * What was NOT the same was the fallback. When no boundary could be applied,
+ * the exec tool ran the command on the host and said so, which is right for a
+ * terminal (a person asked, a person is reading) and wrong for a turn nobody is
+ * watching. A hosted conversational turn reached the whole host that way: the
+ * full process table, the owner's /proc, and his tmux session — where it typed.
+ *
+ * So this daemon states the posture rather than inheriting a default:
+ *
+ *  - CONVERSATIONAL is what every session created over `sessions.hosted.*`
+ *    gets, and it is the posture the engine defaults to. The boundary is
+ *    REQUIRED: a command that cannot be contained is refused, naming why, and
+ *    running on the host is not a fallback available to it. The owner's
+ *    terminal is denied outright, at the exec guard, regardless of boundary.
+ *  - WORKSTREAM — a real work chain the owner authorized, which may genuinely
+ *    need the machine itself — is a per-spawn grant this composition makes
+ *    explicitly. There is no such spawn today, so the function below never
+ *    returns it; when there is one, the grant is written HERE, in the daemon's
+ *    own composition, where a reader can see which spawns hold it. Nothing on
+ *    the wire and nothing in a tool argument can reach it.
  */
 import { createShellPathService } from '@/runtime/index.ts';
 import { createClientRuntimeServices } from '@pellux/goodvibes-sdk/platform/runtime/client-services';
 import { createRuntimeStore } from '@pellux/goodvibes-sdk/platform/runtime/store';
 import { createLaunchTolerantProviderRegistry } from '@pellux/goodvibes-sdk/platform/providers';
 import type { DaemonHostedSessionsOptions } from '@pellux/goodvibes-sdk/platform/daemon';
-import type { HostedWorkspaceFloor } from '@pellux/goodvibes-sdk/platform/hosted-sessions';
+import type {
+  HostedSessionExecPosture,
+  HostedWorkspaceFloor,
+} from '@pellux/goodvibes-sdk/platform/hosted-sessions';
+import { CONVERSATIONAL_DIAGNOSIS_SECTION } from '@pellux/goodvibes-sdk/platform/agents';
 import { operations } from '@pellux/goodvibes-sdk/platform/runtime';
 const { WorkspaceTrustManager } = operations;
 import { createWorkspaceTrustDecisionAsk, trustGatedApprovalRaiser, type ApprovalRaise } from './trust/trust-gated-approvals.ts';
@@ -39,13 +72,32 @@ import type { RuntimeServices } from './runtime-services-types.ts';
 /** The operator policy a session hosted by THIS daemon runs under. */
 function hostedSystemPrompt(input: { readonly workspaceRoot: string }): string {
   return [
-    'You are a GoodVibes session hosted by the daemon rather than by a terminal.',
-    `Your working directory is ${input.workspaceRoot}.`,
-    'Someone may be attached and watching this turn, or may have detached and read it later —',
-    'write for both. Say what you did and why; never report work you did not do.',
-    'Tool permissions are decided by whoever is attached: an ask you raise may take a while to be',
-    'answered, and an unanswered one is a refusal, not a reason to find another way round.',
-  ].join(' ');
+    [
+      'You are a GoodVibes session hosted by the daemon rather than by a terminal.',
+      `Your working directory is ${input.workspaceRoot}.`,
+      'Someone may be attached and watching this turn, or may have detached and read it later —',
+      'write for both. Say what you did and why; never report work you did not do.',
+      'Tool permissions are decided by whoever is attached: an ask you raise may take a while to be',
+      'answered, and an unanswered one is a refusal, not a reason to find another way round.',
+    ].join(' '),
+    // The same contract every other conversational turn is held to, from the
+    // SDK rather than restated here — a second copy is a copy that drifts.
+    CONVERSATIONAL_DIAGNOSIS_SECTION,
+  ].join('\n\n');
+}
+
+/**
+ * What a hosted session's exec tool may do.
+ *
+ * Every session this daemon hosts is a conversation, so every one of them is
+ * contained (see the module header). Stated on the floor rather than left to
+ * the engine's default so that the day a workstream spawn exists, the grant is
+ * a visible change to THIS function and not an option someone set elsewhere —
+ * and it sits beside the trust gate, which is the other statement this daemon
+ * makes about how much authority a hosted run carries.
+ */
+function hostedExecPosture(): HostedSessionExecPosture {
+  return 'conversational';
 }
 
 /**
@@ -120,6 +172,7 @@ export function createHostedSessionOptions(services: RuntimeServices): DaemonHos
         // The daemon has a real review-chain controller; a hosted session's
         // orchestrator lists through it rather than reporting none.
         wrfcController: services.wrfcController,
+        execPosture: hostedExecPosture,
         dispose: (): void => floor.dispose(),
       };
     },

package/src/version.ts

@@ -6,7 +6,7 @@ import { join } from 'node:path';
 // The prebuild script updates the fallback value before compilation.
 // Uses import.meta.dir (Bun) to locate package.json relative to this file,
 // which is correct regardless of the process working directory.
-let _version = '1.28.11';
+let _version = '1.28.12';
 try {
   const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', 'package.json'), 'utf-8'));
   // Only trust a version read from OUR OWN package.json. A Bun single-file