@pellux/goodvibes-daemon 1.28.19 → 1.28.21

package/src/runtime/notification-dispatch.ts

@@ -1,9 +1,9 @@
 /**
- * notification-dispatch.ts — how this daemon dispatches notices without a screen.
+ * notification-dispatch.ts, how this daemon dispatches notices without a screen.
  *
  * The SDK's NotificationRouter decides where a domain notification goes and
- * collapses bursts and batches. Its three targets — `conversation`,
- * `status_bar`, `panel_only` — are all SCREEN targets: an inline conversation
+ * collapses bursts and batches. Its three targets, `conversation`,
+ * `status_bar`, `panel_only`, are all SCREEN targets: an inline conversation
  * line, a status bar, a panel. There is no channel member in that type, and
  * there never was. Which means the router is a surface mechanism end to end,
  * and this process has no screen.
@@ -11,7 +11,7 @@
  * This module used to wire the router to every curated domain anyway, writing
  * into a bounded ring whose `list()` had no caller anywhere in this repository.
  * Six domains of events, for the daemon's whole lifetime, into a buffer nobody
- * read — and the type declaring it still described the ring as "the panel's
+ * read, and the type declaring it still described the ring as "the panel's
  * live producer", for a product with no panels. That silent-success failure
  * class is exactly what this module removes: the producer goes.
  *
@@ -23,7 +23,7 @@
  *
  * One notice had no such path: memory pressure. The MemoryGovernor measures the
  * process it runs in, so the daemon's pressure is the daemon's own and no
- * surface can report it — and the daemon that ran out of memory is exactly the
+ * surface can report it, and the daemon that ran out of memory is exactly the
  * one that cannot tell you afterwards. It now goes out over the operator's
  * configured notice destination (`notifications.webhookUrls`, the same list the
  * bus bridge uses), and says so at its own level in the activity log when no
@@ -56,7 +56,7 @@ export interface DaemonNoticeChannel {
  * one event type rather than a subscription to the domain: the tier change is
  * the operator's business and the churn is not.
  *
- * Delivery failure is logged, never thrown — a webhook endpoint being down is
+ * Delivery failure is logged, never thrown, a webhook endpoint being down is
  * not a reason for the process reporting memory pressure to also crash.
  */
 export function wireMemoryPressureChannelNotice(
@@ -69,7 +69,7 @@ export function wireMemoryPressureChannelNotice(
     const level = memoryPressureLevel(payload);
     const line = memoryPressureLine(payload);
     if (!channel.isConfigured()) {
-      // No destination configured. The notice still exists — at its own
+      // No destination configured. The notice still exists, at its own
       // severity, where the operator looks when the daemon misbehaves.
       if (level === 'critical') logger.error(line);
       else if (level === 'warning') logger.warn(line);

package/src/runtime/payments-composition.ts

@@ -0,0 +1,187 @@
+/**
+ * payments-composition.ts, the payment capability inside THIS daemon.
+ *
+ * ── What was wrong ────────────────────────────────────────────────────────
+ *
+ * All seven `payments.*` verbs were cataloged, advertised with a real HTTP
+ * route, and answered 501 NOT_INVOKABLE to every caller. The route existed, the
+ * descriptor was honest about its shape, and nothing was attached, so the webui
+ * and the desktop app could read the contract and never use it. The terminal app
+ * did not paper over this: it has no payments handlers either; what it has is a
+ * settings surface (`/payments card`) that writes four flat config keys, which
+ * is a per-surface stopgap, not a served capability.
+ *
+ * ── What this composes ────────────────────────────────────────────────────
+ *
+ * The SDK owns the capability (`platform/payments`) and states, in
+ * card-material.ts, that the store behind it "is implemented by the daemon
+ * against its own secret store". It ships no such implementation. So this
+ * composes the two stores that were missing, from paths the daemon already owns:
+ *
+ *   - card metadata at `<home>/.goodvibes/<surface>/control-plane/payments-cards.json`,
+ *     through `controlPlaneStorePath`, the one resolver every control-plane
+ *     store path goes through, so it lands beside pairing-tokens.json rather
+ *     than in the unscoped orphan directory that resolver exists to prevent;
+ *   - card MATERIAL one field per key in the DAEMON secret tier, written with an
+ *     explicit `scope: 'daemon'`. Explicit because a payments card key is not in
+ *     the SDK's daemon-needed registry, so an omitted scope would file the
+ *     material in the surface tier while the daemon reads the daemon tier, the
+ *     exact split secret-config.ts's `defaultSecretBackedScope` documents as the
+ *     mailbox-password failure and names "the same shape of failure at purchase
+ *     time" for a card;
+ *   - the purchase audit ledger beside the card file.
+ *
+ * ── The budget ledger is durable ──────────────────────────────────────────
+ *
+ * `BudgetLedger` used to be constructed empty here and never persisted, correct
+ * only while checkout stayed unattached (the sole writer of a spend record was
+ * the checkout flow, so there was nothing to persist). Now that checkout is
+ * wired below, `DurableBudgetLedger`
+ * (daemon/handlers/payments/budget-store.ts) is used instead: it loads its
+ * state from `payments-budget.json` beside the card and purchase files at
+ * construction and writes back after every reservation, commit and release, so
+ * a daemon restarted mid-day does not hand back a budget it already spent.
+ *
+ * ── The checkout pair, over the sdk 2.0.19 browser-checkout seam ──────────
+ *
+ * `payments.checkout.begin`/`.fillCard` need a `CardMaterialRedactor` bound to
+ * the SAME browser engine the `browser.*` verbs drive, and this daemon does not
+ * build that engine, `composeDaemonBrowser` does (control-plane/routes/
+ * browser-composition.ts), inside `registerGatewayVerbGroups`, which THIS
+ * composition runs before (see runtime/services.ts). `checkoutSeam` is
+ * therefore a GETTER, not a value: services.ts passes `onBrowserCheckout` to
+ * `attachWsOnlyGatewayVerbHandlers` wired to fill the SAME holder this getter
+ * reads (runtime/browser-checkout-seam-holder.ts), and `register.ts`'s checkout
+ * handlers read it fresh on every call rather than once at composition time.
+ *
+ * The rest of `PaymentsGatewayServiceImpl`'s dependencies this composition owns
+ * outright: `configBackedAddressStore` reads the shipping/billing addresses the
+ * owner profile already writes into `payments.*Address.*` config keys (see
+ * that module's header for the exact defect this closes), and
+ * `channelBackedPaymentNotifier`/`createProviderBackedMerchantJudgeModel` adapt
+ * this daemon's channel router and provider registry to the ports the SDK
+ * declares. The untrusted-content ledger is the SAME process-wide singleton the
+ * browser composition binds its engine to (`getProcessUntrustedContentLedger`),
+ * never a private one, for the reason browser-composition.ts's header gives:
+ * a private ledger would make cross-capability derivation invisible.
+ *
+ * `channelBackedPaymentNotifier`'s own header names the one piece deliberately
+ * left for a later pass: no live inbound-reply correlation, so every purchase
+ * settles on the windows' own silence rules rather than an early answer. That
+ * is a scoped, disclosed gap, not a silent one.
+ */
+import { controlPlaneStorePath } from '@pellux/goodvibes-sdk/platform/control-plane';
+import type { GatewayMethodCatalog } from '@pellux/goodvibes-sdk/platform/control-plane';
+import { createModelMerchantJudge, readCvvHandling } from '@pellux/goodvibes-sdk/platform/payments';
+import type { BudgetLedger, PaymentsConfigReader } from '@pellux/goodvibes-sdk/platform/payments';
+import { getProcessUntrustedContentLedger } from '@pellux/goodvibes-sdk/platform/security';
+import type { ConfigManager, SecretsManager } from '@pellux/goodvibes-sdk/platform/config';
+import type { ChannelDeliveryRouter } from '@pellux/goodvibes-sdk/platform/channels';
+import type { ProviderRegistry } from '@pellux/goodvibes-sdk/platform/providers';
+import type { ShellPathService } from '@/runtime/index.ts';
+import {
+  DaemonCardStore,
+  DaemonPurchaseLedger,
+  DurableBudgetLedger,
+  channelBackedPaymentNotifier,
+  configBackedAddressStore,
+  createProviderBackedMerchantJudgeModel,
+  registerPaymentsMethods,
+  type CheckoutComposition,
+  type PaymentsSecretStore,
+} from '../daemon/handlers/payments/index.ts';
+import { GOODVIBES_DAEMON_SURFACE_ROOT } from '../config/surface.ts';
+import type { BrowserCheckoutSeamHolder } from './browser-checkout-seam-holder.ts';
+
+export interface PaymentsCompositionOptions {
+  readonly configManager: ConfigManager;
+  readonly shellPaths: ShellPathService;
+  readonly secretsManager: SecretsManager;
+  /** Binding the catalog is what turns the family from a 501 facade into handlers. */
+  readonly gatewayMethods: GatewayMethodCatalog;
+  /**
+   * Whether this node is the one currently allowed to spend.
+   *
+   * Reported by `payments.budget.status` and never defaulted, see the SDK's
+   * gates.ts: on a clustered install the wrong answer is a double-spend.
+   */
+  readonly isPaymentsLeader: () => boolean;
+  /** Where the checkout pair reads the browser-checkout seam; see this file's header. */
+  readonly checkoutSeam: BrowserCheckoutSeamHolder['get'];
+  /** Delivers a purchase notice; the SAME router every other channel send in this daemon uses. */
+  readonly channelDeliveryRouter: Pick<ChannelDeliveryRouter, 'deliver'>;
+  /** Judges an unfamiliar merchant's recourse through the currently configured model. */
+  readonly providerRegistry: Pick<ProviderRegistry, 'getCurrentModel' | 'getForModel'>;
+}
+
+export interface PaymentsServices {
+  readonly cards: DaemonCardStore;
+  readonly purchases: DaemonPurchaseLedger;
+  readonly budget: BudgetLedger;
+  /** Detaches the handlers. Held by the runtime disposal scope. */
+  readonly unregister: () => void;
+}
+
+/**
+ * The narrow secret port the card store gets: three operations over the daemon
+ * tier, and no way to reach any other credential in the process. The same
+ * treatment cluster-group-composition.ts gives the group key.
+ */
+function daemonScopedSecrets(secretsManager: SecretsManager): PaymentsSecretStore {
+  return {
+    get: (key) => secretsManager.get(key),
+    set: async (key, value) => {
+      await secretsManager.set(key, value, { scope: 'daemon', medium: 'secure' });
+    },
+    delete: async (key) => {
+      await secretsManager.delete(key, { scope: 'daemon' });
+    },
+  };
+}
+
+/** Read live, per call: a budget raised five minutes ago applies to the next read. */
+function livePaymentsConfig(configManager: ConfigManager): PaymentsConfigReader {
+  return { get: (key: string) => configManager.get(key as Parameters<ConfigManager['get']>[0]) };
+}
+
+/**
+ * Build the payment stores and bind the answerable verbs to them.
+ *
+ * The card and purchase stores read lazily and write only when a verb asks
+ * them to, so composing either by itself creates no file activity. The budget
+ * ledger is different: `DurableBudgetLedger`'s constructor reads
+ * `payments-budget.json` synchronously to load today's pools
+ * (daemon/handlers/payments/budget-store.ts), so constructing the result of
+ * THIS function does touch disk, once, for that one file, before any verb is
+ * ever called.
+ */
+export function createPaymentsServices(options: PaymentsCompositionOptions): PaymentsServices {
+  const config = livePaymentsConfig(options.configManager);
+  const cards = new DaemonCardStore({
+    filePath: controlPlaneStorePath(options.shellPaths, GOODVIBES_DAEMON_SURFACE_ROOT, 'payments-cards.json'),
+    secrets: daemonScopedSecrets(options.secretsManager),
+    cvvHandling: () => readCvvHandling(config),
+  });
+  const purchases = new DaemonPurchaseLedger({
+    filePath: controlPlaneStorePath(options.shellPaths, GOODVIBES_DAEMON_SURFACE_ROOT, 'payments-purchases.json'),
+  });
+  const budget = new DurableBudgetLedger(
+    controlPlaneStorePath(options.shellPaths, GOODVIBES_DAEMON_SURFACE_ROOT, 'payments-budget.json'),
+  );
+  const checkout: CheckoutComposition = {
+    seam: options.checkoutSeam,
+    addresses: configBackedAddressStore(config),
+    notifier: channelBackedPaymentNotifier(config, options.channelDeliveryRouter),
+    merchantJudge: createModelMerchantJudge(createProviderBackedMerchantJudgeModel(options.providerRegistry)),
+    untrusted: getProcessUntrustedContentLedger(),
+  };
+  const unregister = registerPaymentsMethods(options.gatewayMethods, {
+    cards,
+    purchases,
+    budget,
+    config,
+    isPaymentsLeader: options.isPaymentsLeader,
+    checkout,
+  });
+  return { cards, purchases, budget, unregister };
+}

package/src/runtime/plugin-composition.ts

@@ -1,9 +1,9 @@
 /**
- * plugin-composition.ts — what a plugin dropped into the plugin directory gets
+ * plugin-composition.ts, what a plugin dropped into the plugin directory gets
  * to register when the host loading it is the daemon.
  *
  * A plugin registers into whatever registries the host hands its loader. Two
- * hosts load a plugin today — the terminal app and this daemon — and neither
+ * hosts load a plugin today, the terminal app and this daemon, and neither
  * holds every registry a plugin might want. The design (see
  * goodvibes-tui/docs/decisions/2026-07-30-plugin-registrations-split-verb-side-and-surface-side.md)
  * is: one plugin package, loaded by both hosts, each loading the registrations
@@ -22,7 +22,7 @@
  *
  * The two surface-side kinds are the ones this host cannot serve. The SDK's
  * PluginLoaderDeps has no optional members and its API guards nothing, so a
- * host that passes nothing for a registry does not decline that kind — it
+ * host that passes nothing for a registry does not decline that kind, it
  * throws a TypeError inside the plugin's own init, which the loader catches by
  * dropping THE WHOLE PLUGIN, including the halves this host could have run.
  * "Ignores the rest" therefore has to be a real registry that accepts the
@@ -67,8 +67,8 @@ export function createUnservedCommandRegistry(): CommandRegistryLike {
  *
  * The runs this daemon hosts build their tools through the agent orchestrator's
  * own registry, not this one, so a plugin tool registered here is cataloged and
- * unhandled. That is the recorded classification — `registerTool` is on the
- * surface-side list — and it was written when the daemon hosted no runs of its
+ * unhandled. That is the recorded classification, `registerTool` is on the
+ * surface-side list, and it was written when the daemon hosted no runs of its
  * own; the round that moves session hosting daemon-side is the one that
  * re-examines it. Until then, a registration here is honest rather than quiet.
  */
@@ -84,8 +84,8 @@ export class UnservedToolRegistry extends ToolRegistry {
 /**
  * Build the loader dependencies for this host.
  *
- * The delivery router is deliberately the manager's own — the one replies leave
- * through — so a registered strategy is a strategy that sends. Handing over a
+ * The delivery router is deliberately the manager's own, the one replies leave
+ * through, so a registered strategy is a strategy that sends. Handing over a
  * second router built from the same arguments is how a registration succeeds
  * and reaches nothing, which is the shape this whole seam is about.
  */

package/src/runtime/runtime-services-types.ts

@@ -1,12 +1,12 @@
 /**
- * runtime-services-types.ts — the public contract createRuntimeServices() takes
+ * runtime-services-types.ts, the public contract createRuntimeServices() takes
  * and returns.
  *
  * Split out of services.ts (the composition root that builds every one of
  * these fields) so the construction logic can stay under the repo's
  * architecture line-count gate without trimming 35 arbitrary lines to clear
  * the number. This module owns ONLY the shape of the input options and the
- * output surface — no runtime code, no wiring order, nothing that constructs
+ * output surface, no runtime code, no wiring order, nothing that constructs
  * anything. services.ts re-exports both types from here, so no import site
  * anywhere else in the app had to change.
  */
@@ -76,7 +76,7 @@ export interface RuntimeServicesOptions {
    * Threaded into `SecretsManager` so the override MOVES the daemon-scoped
    * credential store; without it a daemon told to run out of a temp tree still
    * read the real home's daemon secrets, so an "isolated" test daemon held the
-   * owner's live credentials. One name for one thing — `resolveGoodVibesHomeOwnership`
+   * owner's live credentials. One name for one thing, `resolveGoodVibesHomeOwnership`
    * is the single reader that produces it.
    */
   readonly daemonHomeDirectory?: string | undefined;
@@ -104,7 +104,7 @@ export interface RuntimeServices {
   readonly homeDirectory: string;
   /**
    * The `.goodvibes/<surface root>/` segment this daemon's own state lives
-   * under — always GOODVIBES_DAEMON_SURFACE_ROOT here (config/surface.ts).
+   * under, always GOODVIBES_DAEMON_SURFACE_ROOT here (config/surface.ts).
    * Declared so a consumer ASKS for it instead of deriving a second one; the
    * unscoped pre-split control-plane store is what deriving it twice produced.
    */
@@ -162,7 +162,7 @@ export interface RuntimeServices {
   readonly hookWorkbench: HookWorkbench;
   readonly pluginManager: PluginManager;
   readonly workflow: WorkflowServices;
-  /** Stream watchers, on-exit process triggers and condition checks, supervised as one — see trigger-services.ts. */
+  /** Stream watchers, on-exit process triggers and condition checks, supervised as one, see trigger-services.ts. */
   readonly triggerManager: TriggerManager;
   readonly voiceProviders: VoiceProviderRegistry;
   readonly voiceService: VoiceService;
@@ -219,13 +219,13 @@ export interface RuntimeServices {
   readonly contextAccountingHolder: ContextAccountingHolder; // bound at bootstrap.ts; see context-accounting-source.ts
   readonly wrfcController: WrfcController;
   readonly processManager: ProcessManager;
-  /** The phase/work-item orchestration engine — the SDK's platform/orchestration. */
+  /** The phase/work-item orchestration engine, the SDK's platform/orchestration. */
   readonly orchestrationEngine: OrchestrationEngine;
   readonly workstreamCommands: WorkstreamCommandService;
   /** The repo source-tree code index. */
   readonly codeIndexStore: CodeIndexStore;
   readonly codeIndexReindexScheduler: CodeIndexReindexScheduler; // tool-site reindex
-  /** Daily snapshots of every SQLite store this runtime writes, with bounded retention; unref'd timers (mirrors the SDK composition — hosts that tear down a runtime stop() it themselves). */
+  /** Daily snapshots of every SQLite store this runtime writes, with bounded retention; unref'd timers (mirrors the SDK composition, hosts that tear down a runtime stop() it themselves). */
   readonly storeSnapshotScheduler: StoreSnapshotScheduler;
   readonly appendOnlyRetentionScheduler: operations.DurabilityServices['appendOnlyRetentionScheduler']; // periodic append-only sweep; unref'd timers, stop() on teardown
   /** Stops the recurring crash-residue sweep; idempotent, unref'd timer (hosts that tear a runtime down call it). */
@@ -241,7 +241,7 @@ export interface RuntimeServices {
   /** Controller the governor uses to pause/resume the deferrable background jobs under pressure. */
   readonly pauseController: PauseController;
   readonly sessionLiveTurnControls: SessionLiveTurnControlsHolder;
-  /** Unified live process registry (agents, WRFC chains, workflows, watchers, background processes) backing the Fleet panel; archive-aware — finished subtrees can be moved to the session archive view. */
+  /** Unified live process registry (agents, WRFC chains, workflows, watchers, background processes) backing the Fleet panel; archive-aware, finished subtrees can be moved to the session archive view. */
   readonly processRegistry: ArchivableProcessRegistry;
   readonly modeManager: ModeManager;
   readonly fileUndoManager: FileUndoManager;
@@ -250,7 +250,7 @@ export interface RuntimeServices {
   readonly checkpointsCurrentlyAllowed: () => boolean;
   /** Surface-scoped continuity reads (recovery-file presence, last-session pointer). */
   readonly integrationHelpers: IntegrationHelperService;
-  /** Per-workspace trust gate — restricts write/execute/delegate tools until the workspace is trusted. */
+  /** Per-workspace trust gate, restricts write/execute/delegate tools until the workspace is trusted. */
   readonly workspaceTrustManager: operations.WorkspaceTrustManager;
   /**
    * The permission manager the runs this daemon hosts ask through. Its ask seam

package/src/runtime/services.ts

@@ -56,11 +56,12 @@ import { createTriggerServices } from './trigger-services.ts';
 import { createWorkstreamServices } from '@pellux/goodvibes-sdk/platform/orchestration';
 import { wireFleetNeedsInputPush } from './fleet-needs-input-push.ts';
 import { createDaemonHandlerComposition } from './daemon-handler-composition.ts';
+import { createBrowserCheckoutSeamHolder } from './browser-checkout-seam-holder.ts';
 import { createDevicePostureServices } from './device-posture-composition.ts';
 // Re-exported so the daemon entrypoint reaches the housekeeping sweep through
 // the same module it already imports the runtime graph from. `installDevicePosture`
 // is deliberately NOT re-exported: it registers the phone TOOL into a tool
-// registry, and the daemon registers no tools — the sweep is the half it needs.
+// registry, and the daemon registers no tools, the sweep is the half it needs.
 export { startDeviceHousekeeping } from './device-posture-composition.ts';
 import { createClusterServices, startClusterServices } from './cluster-group-composition.ts';
 import { createWorkspaceTrustDecisionAsk, trustGatedApprovalRaiser } from './trust/trust-gated-approvals.ts';
@@ -69,7 +70,7 @@ import type { RuntimeServicesOptions, RuntimeServices } from './runtime-services
 export type { RuntimeServicesOptions, RuntimeServices } from './runtime-services-types.ts';
 
 /**
- * createRuntimeServices — the daemon's service graph.
+ * createRuntimeServices, the daemon's service graph.
  *
  * This is the one composition root the daemon has. Capabilities a client and
  * the daemon both need live in the SDK and are composed from there (memory
@@ -81,7 +82,7 @@ export type { RuntimeServicesOptions, RuntimeServices } from './runtime-services
  */
 export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeServices {
   // The SDK's disposal scope and its all-required poller list, plus the four
-  // pollers only the daemon has — see disposal-wiring.ts.
+  // pollers only the daemon has, see disposal-wiring.ts.
   const disposalScope = createDisposalScope('RuntimeServices');
   const workingDirectory = options.workingDir;
   const homeDirectory = options.homeDirectory;
@@ -105,7 +106,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   // so the scheduler gates and the knowledge background jobs can consult the pause
   // controller before the MemoryGovernor (constructed at the composition tail)
   // drives it. The admission gate is late-bound: expensive entry points capture
-  // this closure now and the governor binds into it at the tail — until then
+  // this closure now and the governor binds into it at the tail, until then
   // everything is admitted (the daemon is still booting).
   const cacheRegistry = new CacheRegistry();
   const pauseController = new PauseController();
@@ -149,7 +150,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   // Launch-tolerant: a provider whose API key is absent from the environment is
   // constructed with a placeholder that is stripped immediately afterwards, so
   // it lands unconfigured instead of throwing during construction. The daemon
-  // has the same must-boot property the agent has — it is a supervised service,
+  // has the same must-boot property the agent has, it is a supervised service,
   // and a constructor that throws on a missing key turns one unset variable into
   // a crash loop with no screen to explain it.
   const providerRegistry = createLaunchTolerantProviderRegistry({
@@ -186,8 +187,8 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   );
   const hookActivityTracker = new HookActivityTracker();
   // featureFlags is REQUIRED here in practice, even though the SDK types it
-  // optional. isFeatureGateEnabled(null, ...) is permissive by design — a narrow
-  // embed with no manager wired gets the capability rather than a silent off —
+  // optional. isFeatureGateEnabled(null, ...) is permissive by design, a narrow
+  // embed with no manager wired gets the capability rather than a silent off,
   // so omitting it did not disable the watcher framework when watchers.enabled
   // is turned off; it made the setting configure nothing.
   const watcherRegistry = new WatcherRegistry({
@@ -235,9 +236,9 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
       task,
       // Conversation first: a follow-up message in a session gets an answer, not
       // a write-review-fix-confirm chain with a reviewer, quality gates and a
-      // second agent. A chain opens only for an explicit authorization marker —
+      // second agent. A chain opens only for an explicit authorization marker,
       // the channel confirmation the owner gave, or the schedule/trigger that
-      // was confirmed when it was created — or for a follow-up typed on a local
+      // was confirmed when it was created, or for a follow-up typed on a local
       // surface. Both `conversationGate.mode` and the gated-surfaces list are
       // read live.
       ...continuationChainOptions(input, {
@@ -256,7 +257,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
       // It also supplies the run's context, which is why the bare
       // `context: shared-session:<id>` line that used to sit below is gone.
       // Spread BEFORE the routing builder so an explicit tool list coming from
-      // a routing intent still wins — that builder emits `tools` only when it
+      // a routing intent still wins, that builder emits `tools` only when it
       // actually has one.
       ...conversationalTurnSpawnOptions(input, { configReader: configManager }),
       // Spawn routing through the SDK's shared model-reference resolver
@@ -286,7 +287,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     // through. Without the secrets manager it cannot resolve a
     // goodvibes://secrets/... credential, so Telegram accepted every inbound
     // message and dropped every reply with "Missing Telegram bot token" while
-    // ntfy — which needs no secret — worked.
+    // ntfy, which needs no secret, worked.
     secretsManager,
     serviceRegistry,
     runtimeBus: options.runtimeBus,
@@ -326,7 +327,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
       return record.id;
     },
   });
-  // Knowledge/wiki + home-graph stack (governor backpressure wired in) — see knowledge-services.ts.
+  // Knowledge/wiki + home-graph stack (governor backpressure wired in), see knowledge-services.ts.
   const {
     knowledgeStore, agentKnowledgeStore, homeGraphKnowledgeStore,
     knowledgeSemanticService, homeGraphSemanticService, agentKnowledgeSemanticService,
@@ -382,21 +383,32 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   });
 
   // Which machines on this network are "us", and which of them reads the shared
-  // inbox. Both inert until startCluster() — no socket, no key material read;
+  // inbox. Both inert until startCluster(), no socket, no key material read;
   // see cluster-group-composition.ts for why they are built together.
   const { clusterGroup, clusterCoordinator } = createClusterServices({
     configManager, shellPaths, secretsManager,
   });
+  // ONE router, not two (a second built from the same four arguments would
+  // differ from the one replies leave through). Moved up from its original
+  // spot near the ws-only verb options (still consumed there): the payments
+  // composition below needs it too.
+  const channelDeliveryRouter = deliveryManager.getDeliveryRouter();
   // Daemon handler surfaces (see daemon-handler-composition.ts); the inbox
-  // poller registers itself with the coordinator rather than starting eagerly.
+  // poller registers itself with the coordinator rather than starting eagerly,
+  // and the payments family stops being a cataloged 501 facade there.
+  // browserCheckoutSeam fills once `onBrowserCheckout` fires below, after this
+  // composition; read lazily, per call. See browser-checkout-seam-holder.ts.
+  const browserCheckoutSeam = createBrowserCheckoutSeamHolder();
   const daemonHandlers = createDaemonHandlerComposition({
     gatewayMethods,
     secretsManager,
     configManager,
     workingDirectory,
     homeDirectory,
+    shellPaths,
     distributedRuntime,
     clusterCoordinator,
+    checkoutSeam: browserCheckoutSeam.get, channelDeliveryRouter, providerRegistry,
   });
 
   // Remote runners and the sandboxes tool calls are confined to; see
@@ -424,12 +436,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   const policyRuntimeState = new PolicyRuntimeState();
   const fileCache = new FileStateCache();
   const projectIndex = new ProjectIndex(workingDirectory);
-  // ONE router, not two. This was a second ChannelDeliveryRouter built from the
-  // same four arguments AutomationDeliveryManager builds its own from, so the
-  // router the gateway verbs held and the router replies actually leave through
-  // were different objects — and a delivery strategy registered on one was
-  // invisible to the other. The manager's is the one that replies; it is the one.
-  const channelDeliveryRouter = deliveryManager.getDeliveryRouter();
+  // channelDeliveryRouter now built earlier, near clusterCoordinator above.
   const processManager = new ProcessManager();
   // The phase/work-item orchestration engine, constructed before the process
   // registry so its fleet nodes (workstream/phase/work-item) can be folded in
@@ -447,7 +454,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   });
   const codeInjectionOrchestratorDeps = { codeIndex: codeIndexStore, isCodeInjectionSettingEnabled: () => isCodeInjectionSettingEnabled(configManager), codeIndexReindexScheduler };
   // The trigger family: stream watchers, on-exit process triggers, condition
-  // checks — fed to the fleet below as its trigger supervisor, so a trigger
+  // checks, fed to the fleet below as its trigger supervisor, so a trigger
   // is visible and steerable like every other running thing.
   const triggerManager = createTriggerServices({
     configManager, shellPaths, surfaceRoot: GOODVIBES_DAEMON_SURFACE_ROOT,
@@ -477,7 +484,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     acpHost, // Folds live hosted-agent sessions into the fleet as 'acp' rows
   });
   const modeManager = new ModeManager({ featureFlags }); const fileUndoManager = new FileUndoManager();
-  // Checkpoints, gated on live workspace registration — see workspace-checkpointing.ts.
+  // Checkpoints, gated on live workspace registration, see workspace-checkpointing.ts.
   const checkpointing = createWorkspaceCheckpointing({
     workspaceRoot: workingDirectory, surface, runtimeBus: options.runtimeBus, configManager, shellPaths,
   });
@@ -487,7 +494,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   // admitted (mirrors the SDK's own createRuntimeServices idle gate).
   const { memoryConsolidationScheduler, powerManager, sessionLiveTurnControls } = wireIdlePowerAndLiveTurn({ configManager, memoryRegistry, runtimeBus: options.runtimeBus, isIdle: () => sessionBroker.countBusySessions() === 0 && !pauseController.isPaused('memory-consolidation') && admitExpensiveWork('memory consolidation').allowed, snapshotTick: () => storeSnapshotScheduler.tick(), heartbeat: async () => { await automationManager.triggerHeartbeat({ source: 'wake-catchup' }); }, powerSeam: options.powerSeam });
 
-  // Construct + start the MemoryGovernor (default ON — a safety feature) with the
+  // Construct + start the MemoryGovernor (default ON, a safety feature) with the
   // standard KNOWN cache adapters (knowledge stores + shared session broker),
   // then late-bind the admission gate the expensive entry points captured
   // earlier. The SDK owns this wiring.
@@ -514,7 +521,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   });
   admitExpensiveWorkRef.current = (label) => memoryGovernor.admitExpensiveWork(label);
 
-  // Managed local-voice provisioning (voice.local.status/install) — single-flight
+  // Managed local-voice provisioning (voice.local.status/install), single-flight
   // one-act install + no-network status.
   const { voiceSetup, stopWakeHousekeeping } = wireVoiceSetup({ configManager, shellPaths, voiceProviders, admitExpensiveWork,
     // Boot provisioning of the wake-word model + its recovery sweep, opted into
@@ -531,6 +538,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     // is what let these stores write to the unscoped orphan directory.
     surfaceRoot: GOODVIBES_DAEMON_SURFACE_ROOT,
     homeDirectory, emailServiceDeps, describeEmailConfigProblem, processRegistry,
+    onBrowserCheckout: browserCheckoutSeam.set,
     // The registration-gated surface, not the raw manager: an explicit create in
     // an unregistered workspace refuses with something actionable.
     workspaceCheckpointManager: checkpointing.gatewayManager,
@@ -543,11 +551,11 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     // to the owner principal instead of unknown.
     channelPolicy,
     approvalBroker, requestApproval: (input) => approvalBroker.requestApproval(input),
-    // approvals.raise — a surface CREATING an ask in this broker. Without it the
+    // approvals.raise, a surface CREATING an ask in this broker. Without it the
     // verb is cataloged and unhandled, and a client whose prompt runs outside
     // this process has no way to raise one.
     approvalRaise: approvalBroker,
-    // credentials.set / credentials.delete — a credential written THROUGH the
+    // credentials.set / credentials.delete, a credential written THROUGH the
     // control plane, so a client with no access to the daemon's settings file can
     // configure one. The value lands in the daemon's secret tier and the verb
     // never echoes it back.
@@ -562,6 +570,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     disposal: disposalScope.registry,
     ...wireFleetNeedsInputPush({ registry: processRegistry, runtimeBus: options.runtimeBus, sessionBroker }),
   });
+  disposalScope.registry.add('browser checkout seam holder', () => browserCheckoutSeam.clear()); // newer than 'browser sessions' above, so runs first
   // A loopback fetch that isn't allow-listed asks once through the approval
   // broker; "allow for this project" persists and later fetches never ask. Built
   // once and shared with the tool registry so both ask alike.
@@ -573,15 +582,15 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   const execPromptAnswerHandler = buildExecPromptAnswerHandler({ requestApproval: (input) => approvalBroker.requestApproval(input) });
   // Tool asks from the runs this daemon HOSTS. Without a manager here, the
   // background permission gate short-circuits to approved and every hosted
-  // write, command and delegation ran ungated — the workspace trust decision
+  // write, command and delegation ran ungated, the workspace trust decision
   // was read by nobody in this process.
   //
   // The ask seam is the trust gate wrapping the approval broker: a workspace
   // with no decision yet has the question raised as an approval record and
-  // answered by whichever surface is attached (trust-gated-approvals.ts) —
+  // answered by whichever surface is attached (trust-gated-approvals.ts),
   // there is no screen here to show a modal on, so the raise replaces it. The
-  // manager's own layers — permission mode, policy, session cache, durable
-  // user rules — still run first and are unchanged.
+  // manager's own layers, permission mode, policy, session cache, durable
+  // user rules, still run first and are unchanged.
   const permissionManager = createBrokeredPermissionManager({
     requestApproval: trustGatedApprovalRaiser(
       workspaceTrustManager,
@@ -648,7 +657,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   // whole high-churn 'ops' domain, and sent over the SAME WebhookNotifier the
   // notification verbs keep live and boot-tasks attaches to the bus. There is
   // no panel notification router here: its targets are all screen targets and
-  // this product has no screen — see notification-dispatch.ts.
+  // this product has no screen, see notification-dispatch.ts.
   wireMemoryPressureChannelNotice(options.runtimeBus, webhookNotifier);
 
   // In-process config changes become key-level events on the `config` domain, so
@@ -780,7 +789,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     // Cancels the agent runs this graph was hosting. By dispose() time the fleet
     // registry, orchestration engine, process registry and bus these runs report
     // through are already down, so a run still described as "running" is orphaned
-    // rather than preserved — and this is the only shutdown-reachable way to
+    // rather than preserved, and this is the only shutdown-reachable way to
     // abort its in-flight provider call instead of letting it sleep out a retry
     // backoff nobody is waiting on.
     cancelHostedAgentRuns: () => cancelAllAgentRuns(agentManager),

package/src/runtime/trigger-services.ts

@@ -11,7 +11,7 @@ import type { ShellPathService } from '@/runtime/index.ts';
  *
  * This daemon composes the full family and feeds the manager to the fleet as
  * its trigger supervisor, so a trigger defined against the daemon fires
- * reliably. The daemon is the right process to own it — it is the one that
+ * reliably. The daemon is the right process to own it, it is the one that
  * stays running.
  *
  * Two things about the shape are load-bearing: