@pellux/goodvibes-daemon 1.28.14 → 1.28.16

package/CHANGELOG.md

@@ -4,6 +4,34 @@ All notable changes to the GoodVibes daemon.
 
 ---
 
+## [1.28.16] - 2026-08-07
+
+### Changes
+
+- **One more module-scope read is gone from the compiled daemon's load path.**
+  The command catalog built its flag-arity table by calling an SDK helper at
+  module scope; under the single-file compiler's nondeterministic module
+  order that call could run before the helper exists, killing the binary at
+  load. The table is now built on first use. Found by auditing for the same
+  build-order lottery class 1.28.15 fixed — this was the last direct
+  module-scope call into the platform runtime in this product.
+
+## [1.28.15] - 2026-08-07
+
+### Changes
+
+- **The compiled daemon no longer plays a build-order lottery at load**
+  (platform runtime 2.0.13): the daemon's runtime barrel read fifteen values
+  off the SDK's runtime namespace objects at module scope (`export const X =
+  ns.X`). Bun's single-file compiler emits module bodies in an order that
+  varies build-to-build, and such a read can land before the module that
+  defines the binding — the binary then dies at load with a ReferenceError on
+  some builds of identical source. Every one of those reads is now a grouped
+  live re-export from the SDK's registered runtime subpaths, resolved by the
+  module system instead of read at module scope. The shared post-build smoke
+  now also scans the compiled artifact for the eager pattern, so a
+  reintroduction fails the build even on a lucky ordering.
+
 ## [1.28.14] - 2026-08-06
 
 ### Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pellux/goodvibes-daemon",
-  "version": "1.28.14",
+  "version": "1.28.16",
   "description": "The GoodVibes daemon \u2014 the one long-running host for the control plane, channels, cluster membership, scheduled work, knowledge and memory stores, and the verb families every GoodVibes client calls.",
   "type": "module",
   "main": "src/daemon/cli.ts",
@@ -65,8 +65,8 @@
     "@anthropic-ai/bedrock-sdk": "^0.28.1",
     "@anthropic-ai/sdk": "^0.82.0",
     "@ast-grep/napi": "^0.42.0",
-    "@pellux/goodvibes-sdk": "2.0.12",
-    "@pellux/goodvibes-terminal-shell": "2.0.12",
+    "@pellux/goodvibes-sdk": "2.0.13",
+    "@pellux/goodvibes-terminal-shell": "2.0.13",
     "bash-language-server": "^5.6.0",
     "fuse.js": "^7.1.0",
     "graphql": "^16.13.2",
@@ -87,7 +87,7 @@
     "web-tree-sitter": "^0.26.7"
   },
   "devDependencies": {
-    "@pellux/goodvibes-toolchain": "2.0.0",
+    "@pellux/goodvibes-toolchain": "2.0.13",
     "@types/bun": "^1.3.10",
     "typescript": "^5.9.3"
   },

package/src/cli/command-catalog.ts

@@ -820,7 +820,15 @@ export function isRawInterceptCommand(command: DaemonCommand): boolean {
  * than one command's flag list has the same kind in all of them — asserted by
  * a unit test rather than left as an assumption — so one table is honest.
  */
-export const ALL_FLAG_ARITY: ReadonlyMap<string, CliFlagKind> = catalogFlagArity(DAEMON_CLI_CATALOG);
+// Resolved on first use, not at module load: `catalogFlagArity` is an SDK
+// import, and the single-file compiler's nondeterministic module order could
+// run this line before the SDK module body exists — the binary then dies at
+// load (the build-order lottery class fixed at runtime 2.0.13).
+let allFlagArityCache: ReadonlyMap<string, CliFlagKind> | null = null;
+export function allFlagArity(): ReadonlyMap<string, CliFlagKind> {
+  allFlagArityCache ??= catalogFlagArity(DAEMON_CLI_CATALOG);
+  return allFlagArityCache;
+}
 
 /** Flag specs a given command accepts: the global ones plus its own. */
 export function flagsForCommand(command: DaemonCommand): readonly DaemonCommandFlagSpec[] {

package/src/runtime/index.ts

@@ -12,13 +12,17 @@
  * SDK.
  */
 
-import {
-  bootstrap,
-  observability,
+// Type-only: the runtime namespace objects must never be READ at module scope.
+// An eager `export const X = ns.X` compiles to a top-level property read off a
+// lazy namespace object, and Bun's single-file compiler orders module bodies
+// nondeterministically — on some builds the read lands before the defining
+// module and the binary dies at load. Values below are grouped live re-exports
+// from the SDK's registered subpaths instead; the toolchain post-build-smoke
+// scans compiled artifacts for the eager pattern and fails the build if one
+// returns.
+import type {
   operations,
-  security,
   shell,
-  transport,
   ui,
 } from '@pellux/goodvibes-sdk/platform/runtime';
 
@@ -29,46 +33,43 @@ export * from '@pellux/goodvibes-sdk/platform/runtime/feature-flags';
 export * from '@pellux/goodvibes-sdk/platform/runtime/settings';
 export * from '@pellux/goodvibes-sdk/platform/runtime/sandbox';
 
-// Shell paths + the surface-scoped storage handle.
-export const createShellPathService = shell.createShellPathService;
+// Shell paths + the surface-scoped storage handle. Grouped live re-exports:
+// class values (WorktreeRegistry etc.) carry their instance types with them.
+export { createShellPathService, WorktreeRegistry } from '@pellux/goodvibes-sdk/platform/runtime/shell';
 export type ShellPathService = shell.ShellPathService;
-export const createSessionSurface = operations.createSessionSurface;
+export { createSessionSurface } from '@pellux/goodvibes-sdk/platform/runtime/operations';
 export type SessionSurface = operations.SessionSurface;
-export const WorktreeRegistry = shell.WorktreeRegistry;
-export type WorktreeRegistry = shell.WorktreeRegistry;
 
 // Remote execution + the distributed runtime.
-export const DistributedRuntimeManager = operations.DistributedRuntimeManager;
-export type DistributedRuntimeManager = operations.DistributedRuntimeManager;
-export const RemoteRunnerRegistry = operations.RemoteRunnerRegistry;
-export type RemoteRunnerRegistry = operations.RemoteRunnerRegistry;
-export const RemoteSupervisor = operations.RemoteSupervisor;
-export type RemoteSupervisor = operations.RemoteSupervisor;
+export {
+  DistributedRuntimeManager,
+  RemoteRunnerRegistry,
+  RemoteSupervisor,
+} from '@pellux/goodvibes-sdk/platform/runtime/operations';
 
 // Boot helpers the daemon runs itself (the facade does not know about them).
-export const syncConfiguredServices = bootstrap.synchronizeConfiguredServices;
+export { synchronizeConfiguredServices as syncConfiguredServices } from '@pellux/goodvibes-sdk/platform/runtime/bootstrap';
 
 // Observability.
-export const TelemetryApiService = observability.TelemetryApiService;
-export type TelemetryApiService = observability.TelemetryApiService;
-export const ComponentHealthMonitor = observability.ComponentHealthMonitor;
-export type ComponentHealthMonitor = observability.ComponentHealthMonitor;
-export const IdempotencyStore = observability.IdempotencyStore;
-export type IdempotencyStore = observability.IdempotencyStore;
+export {
+  TelemetryApiService,
+  ComponentHealthMonitor,
+  IdempotencyStore,
+} from '@pellux/goodvibes-sdk/platform/runtime/observability';
 
 // Security.
-export const PolicyRuntimeState = security.PolicyRuntimeState;
-export type PolicyRuntimeState = security.PolicyRuntimeState;
+export { PolicyRuntimeState } from '@pellux/goodvibes-sdk/platform/runtime/security';
 
 // Integration helpers (surface-scoped continuity reads) and the no-op screen
 // stand-ins. The daemon facade's service-graph contract names a panel manager
 // and a keybindings manager because a surface that has a screen supplies real
 // ones; the daemon has no screen, and the SDK ships the honest no-ops for
 // exactly this case rather than leaving a hole a fake would fill.
-export const IntegrationHelperService = ui.IntegrationHelperService;
-export type IntegrationHelperService = ui.IntegrationHelperService;
-export const createNoopPanelManager = ui.createNoopPanelManager;
-export const createNoopKeybindingsManager = ui.createNoopKeybindingsManager;
+export {
+  IntegrationHelperService,
+  createNoopPanelManager,
+  createNoopKeybindingsManager,
+} from '@pellux/goodvibes-sdk/platform/runtime/ui';
 export type PanelManagerLike = ui.PanelManagerLike;
 export type KeybindingsManagerLike = ui.KeybindingsManagerLike;
 
@@ -77,8 +78,7 @@ export type Notification = ui.Notification;
 export type RoutingDecision = ui.RoutingDecision;
 
 // Outbound network transport installation (proxy/TLS policy from settings).
-export const GlobalNetworkTransportInstaller = transport.GlobalNetworkTransportInstaller;
-export type GlobalNetworkTransportInstaller = transport.GlobalNetworkTransportInstaller;
+export { GlobalNetworkTransportInstaller } from '@pellux/goodvibes-sdk/platform/runtime/transport';
 
 
 // Runtime event payload unions, re-exported so a consumer names one import path