@pellux/goodvibes-daemon 1.28.19 → 1.28.21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pellux/goodvibes-daemon",
-  "version": "1.28.19",
+  "version": "1.28.21",
   "description": "The GoodVibes daemon \u2014 the one long-running host for the control plane, channels, cluster membership, scheduled work, knowledge and memory stores, and the verb families every GoodVibes client calls.",
   "type": "module",
   "main": "src/daemon/cli.ts",
@@ -32,10 +32,12 @@
     "typecheck": "bunx tsc --noEmit",
     "typecheck:test": "bunx tsc --noEmit -p tsconfig.test.json",
     "test": "bun run scripts/run-tests.ts",
+    "test:coverage": "bun run scripts/coverage-gate.ts",
     "preinstall": "sh scripts/check-bun.sh",
     "postinstall": "bun scripts/postinstall.js",
     "postbuild": "bun scripts/postinstall.js --no-download",
     "version": "bun run scripts/prebuild.ts",
+    "architecture:check": "bun run scripts/check-architecture.ts",
     "workflows:check": "bun run scripts/check-workflows.ts",
     "changelog:check": "bun run scripts/check-changelog.ts",
     "verify:tag-version": "bun run scripts/verify-release-tag-version.ts",
@@ -65,8 +67,8 @@
     "@anthropic-ai/bedrock-sdk": "^0.28.1",
     "@anthropic-ai/sdk": "^0.82.0",
     "@ast-grep/napi": "^0.42.0",
-    "@pellux/goodvibes-sdk": "2.0.17",
-    "@pellux/goodvibes-terminal-shell": "2.0.17",
+    "@pellux/goodvibes-sdk": "2.0.19",
+    "@pellux/goodvibes-terminal-shell": "2.0.19",
     "bash-language-server": "^5.6.0",
     "fuse.js": "^7.1.0",
     "graphql": "^16.13.2",
@@ -87,7 +89,7 @@
     "web-tree-sitter": "^0.26.7"
   },
   "devDependencies": {
-    "@pellux/goodvibes-toolchain": "2.0.17",
+    "@pellux/goodvibes-toolchain": "2.0.19",
     "@types/bun": "^1.3.10",
     "typescript": "^5.9.3"
   },

package/scripts/postinstall.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env bun
 /**
- * postinstall — place the compiled daemon binary AND the sqlite-vec native
+ * postinstall, place the compiled daemon binary AND the sqlite-vec native
  * addon for this platform.
  *
  * The npm package carries source and the launcher; the daemon itself is a
@@ -11,22 +11,22 @@
  * The sqlite-vec addon gets the identical treatment for the identical reason:
  * `resolveSqliteVecPath()` (platform/state/sqlite-vec-loader.ts, reached from a
  * compiled binary) looks for it at `<execDir>/lib/sqlite-vec-<platform>-<arch>/
- * vec0.<suffix>` — `<execDir>` being vendor/ once bin/goodvibes-daemon has
- * placed the binary there — and nothing else stages it for an npm install. Skip
+ * vec0.<suffix>`, `<execDir>` being vendor/ once bin/goodvibes-daemon has
+ * placed the binary there, and nothing else stages it for an npm install. Skip
  * this and the addon is silently absent forever: the launcher's self-heal
  * (bin/launcher-support.js) only ever re-fetches the BINARY, and the daemon's
  * own auto-updater only refreshes the addon if a copy already exists on disk
  * (there is never a first one to refresh). The daemon degrades to lexical
  * search plus a log warning rather than failing loudly, so the loss is easy to
- * miss — this download is what gives every npm install the same vector search
+ * miss, this download is what gives every npm install the same vector search
  * a curl/install.sh install gets.
  *
  * What it deliberately does NOT do: deploy skills, deploy agents, or fetch the
  * wake-word model. Skills and agents are surface artifacts that ship with the
  * terminal app's own package, not this one. The wake-word model is fetched by
- * the daemon itself — the installer
+ * the daemon itself, the installer
  * runs `goodvibes-daemon provision-wake-model` on the placed binary, and every
- * daemon start retries whatever is still missing — so pulling it here as well
+ * daemon start retries whatever is still missing, so pulling it here as well
  * would be a second copy of a pin that already has one owner.
  *
  * A source checkout is skipped: a repository clone is a development tree, not an
@@ -152,7 +152,7 @@ async function installPlatformBinary() {
 
 /**
  * Places the sqlite-vec native addon at `vendor/lib/sqlite-vec-<platform>-
- * <arch>/vec0.<suffix>` — see the file banner for why this is a separate,
+ * <arch>/vec0.<suffix>`, see the file banner for why this is a separate,
  * equally load-bearing step from `installPlatformBinary`, not an optional
  * extra. Mirrors that function's gating and verification exactly (skip on an
  * unsupported target, `--no-download`, or a source checkout; the smoke-test
@@ -197,7 +197,7 @@ async function installSqliteVecAddon() {
 
   // A fresh manifest fetch (rather than sharing the one `installPlatformBinary`
   // already wrote to vendor/) keeps this function independently correct and
-  // testable — the extra request is a one-time postinstall cost, not a
+  // testable, the extra request is a one-time postinstall cost, not a
   // per-boot one.
   const checksumText = await downloadText(`${releaseBaseUrl}/${CHECKSUM_MANIFEST_NAME}`);
   const checksums = parseChecksumFile(checksumText);

package/src/cli/command-catalog.ts

@@ -1,5 +1,5 @@
 /**
- * command-catalog.ts — WHAT the daemon binary understands.
+ * command-catalog.ts, WHAT the daemon binary understands.
  *
  * This file is data. It holds no parsing logic and reads no argv. The engine is
  * `parseWithCatalog` in @pellux/goodvibes-terminal-shell: it knows tokens,
@@ -90,8 +90,8 @@ export type DaemonCliFlagField =
  * How a flag consumes argv, and what shape its value has.
  *
  * Four of the engine's seven kinds. The other three (`string-optional`,
- * `const`, `enum`) exist for a conversation-shaped vocabulary — an optional
- * `--resume [id]`, two flags writing one field, a checked value set — and this
+ * `const`, `enum`) exist for a conversation-shaped vocabulary, an optional
+ * `--resume [id]`, two flags writing one field, a checked value set, and this
  * binary declares none of them.
  */
 export type DaemonCliFlagKind = Extract<CliFlagKind, 'boolean' | 'string' | 'port' | 'string-list'>;
@@ -112,8 +112,8 @@ export type DaemonCommandFlagSpec = CommandFlagSpec<DaemonCliFlagField> & {
 /**
  * A command entry, narrowed the same way.
  *
- * `summary`, `usage` and `detail` are optional to the engine — a catalog with
- * no help surface of its own may omit them — and required here, because this
+ * `summary`, `usage` and `detail` are optional to the engine, a catalog with
+ * no help surface of its own may omit them, and required here, because this
  * binary has a `help <command>` page for every command it answers to.
  */
 export type DaemonCommandSpec = CommandSpec<DaemonCommand, DaemonCliFlagField> & {
@@ -167,7 +167,7 @@ const YES_FLAG: DaemonCommandFlagSpec = {
  * This is the convention @pellux/goodvibes-terminal-shell's
  * cluster-remote-daemon-target established and asked later subcommands to
  * follow: `--host`/`--port`/`--token`, each
- * defaulting to this machine's own daemon — the configured control-plane
+ * defaulting to this machine's own daemon, the configured control-plane
  * binding and the operator token in `<daemon home>/operator-tokens.json`. A
  * headless box the operator has SSHed into must work with no flags at all.
  */
@@ -251,13 +251,13 @@ const SERVE_FLAGS: readonly DaemonCommandFlagSpec[] = [
  * Flags this binary once accepted in silence, without acting on them.
  *
  * Every one of them means "start or resume a conversation", which this binary
- * does not do — and each was accepted, stored in a flag record nothing read,
+ * does not do, and each was accepted, stored in a flag record nothing read,
  * and then ignored. `goodvibes-daemon --resume` started a fresh foreground
  * daemon and said nothing about the flag. They are refused by name so the
  * message names the surface that does own them.
  *
  * `reason` is a NOUN PHRASE the engine drops into
- * "<flag> is not a <binary> flag — <reason> belongs to another surface.", so
+ * "<flag> is not a <binary> flag, <reason> belongs to another surface.", so
  * each one names the terminal app as well as the job, and the finished sentence
  * points at where the flag actually works.
  *
@@ -265,7 +265,7 @@ const SERVE_FLAGS: readonly DaemonCommandFlagSpec[] = [
  * to skip a refused flag's VALUE while hunting for the command word, or
  * `--prompt hello` reports "Unknown command: hello" instead of naming the flag
  * that is actually wrong. `--resume` and `--fork` took an OPTIONAL value, so
- * they are listed as taking none — over-skipping would swallow a real command
+ * they are listed as taking none, over-skipping would swallow a real command
  * word.
  */
 export type { RejectedFlagSpec };
@@ -426,7 +426,7 @@ export const DAEMON_COMMANDS: readonly DaemonCommandSpec[] = [
     summary: 'Restart the daemon service.',
     usage: 'goodvibes-daemon restart-service',
     detail: [
-      'Restart the service this binary manages — the usual way to pick up a settings',
+      'Restart the service this binary manages: the usual way to pick up a settings',
       'change that only applies at boot.',
       ...SERVICE_DETAIL_TAIL,
     ],
@@ -465,7 +465,7 @@ export const DAEMON_COMMANDS: readonly DaemonCommandSpec[] = [
     summary: 'Print the pairing link and QR code again, or mint one on a remote daemon.',
     usage: 'goodvibes-daemon pair [--json] [--host <name>] [--port <n>] [--token <t>] [-y]',
     detail: [
-      'LOCAL FORM — no --host, or one naming this machine: print the same pairing',
+      'LOCAL FORM (no --host, or one naming this machine): print the same pairing',
       'block a daemon prints once at startup: the web origin, the offers a new',
       'device can accept, what it will be able to do, and a QR code encoding the',
       'deep link that opens the web app already signed in.',
@@ -474,10 +474,10 @@ export const DAEMON_COMMANDS: readonly DaemonCommandSpec[] = [
       'printed here and one printed at boot are the same link. Scrolling the startup',
       'banner off the screen therefore costs nothing.',
       '',
-      'REMOTE FORM — --host naming another machine: ask THAT daemon to MINT A NEW',
+      'REMOTE FORM (--host naming another machine): ask THAT daemon to MINT A NEW',
       'per-device pairing token and print the pairing block for it. Minting is a',
       'different act than reprinting: it is a fresh token, and every token that',
-      'daemon already issued — its shared token included — is left untouched.',
+      'daemon already issued, its shared token included, is left untouched.',
       '',
       'Because it changes state on a daemon that may not be this process\'s own, it',
       'states the plan and asks for confirmation before acting: -y (or --yes) is the',
@@ -507,7 +507,7 @@ export const DAEMON_COMMANDS: readonly DaemonCommandSpec[] = [
       '--all includes sessions that have already ended; they are kept, with the reason',
       'they ended, until the retention window retires them.',
       '',
-      'These are the daemon\'s own hosted sessions — conversations running INSIDE it,',
+      'These are the daemon\'s own hosted sessions: conversations running INSIDE it,',
       'which outlive the client that started them. Sessions a terminal runs on this',
       'machine are that terminal\'s, and are not listed here.',
     ],
@@ -536,7 +536,7 @@ export const DAEMON_COMMANDS: readonly DaemonCommandSpec[] = [
       'works whether or not a daemon is running. A running daemon picks up most',
       'changes live; the ones that only apply at bind time say so.',
       '',
-      'Anything that reads like a credential — a token, a password, an API key — is',
+      'Anything that reads like a credential (a token, a password, an API key) is',
       'printed as <redacted>. `config set` still writes the real value; it is the',
       'OUTPUT that is redacted, so a settings dump pasted into an issue carries none.',
     ],
@@ -627,7 +627,7 @@ export const DAEMON_COMMANDS: readonly DaemonCommandSpec[] = [
     usage: 'goodvibes-daemon webui enable|disable|status [--bundle-dir <dir>] [--lan|--loopback]',
     detail: [
       'The web UI is a built bundle of static files served by the daemon\'s own',
-      'control-plane listener, on the same origin as the API — so the URL to open is',
+      'control-plane listener, on the same origin as the API; so the URL to open is',
       'the control-plane one, not the declared web port.',
       '',
       '  enable [--bundle-dir <dir>]  serve the bundle at that directory',
@@ -652,7 +652,7 @@ export const DAEMON_COMMANDS: readonly DaemonCommandSpec[] = [
       '',
       'The installer runs this on a binary it has just placed, and a daemon start',
       'retries it, so an install that happened offline heals on its own. A download',
-      'that fails is reported and exits 0 — a machine with no wake word still has a',
+      'that fails is reported and exits 0; a machine with no wake word still has a',
       'perfectly good daemon.',
     ],
     flags: [],
@@ -667,7 +667,7 @@ export const DAEMON_COMMANDS: readonly DaemonCommandSpec[] = [
     detail: [
       'Print a completion script for the named shell on stdout. It completes this',
       'binary\'s commands, their sub-words and their flags, generated from the same',
-      'catalog the parser and the help text use — so it cannot drift from what the',
+      'catalog the parser and the help text use; so it cannot drift from what the',
       'binary accepts.',
       '',
       'Install it by writing it somewhere the shell reads, for example:',
@@ -715,7 +715,7 @@ export const RAW_INTERCEPT_COMMANDS: readonly DaemonCommand[] = DAEMON_COMMANDS
   .map((spec) => spec.name);
 
 /**
- * The flag record a parse starts from — every field at its empty value, so a
+ * The flag record a parse starts from, every field at its empty value, so a
  * command's dispatcher reads only what its own catalog entry declares.
  */
 function createDefaultFlags(): DaemonCliFlags {
@@ -817,12 +817,12 @@ export function isRawInterceptCommand(command: DaemonCommand): boolean {
  * The engine needs this BEFORE it knows which command it is parsing: to find
  * the command word it has to skip over option values, and whether a token
  * takes a value is a property of the token. Every token that appears in more
- * than one command's flag list has the same kind in all of them — asserted by
- * a unit test rather than left as an assumption — so one table is honest.
+ * than one command's flag list has the same kind in all of them, asserted by
+ * a unit test rather than left as an assumption, so one table is honest.
  */
 // Resolved on first use, not at module load: `catalogFlagArity` is an SDK
 // import, and the single-file compiler's nondeterministic module order could
-// run this line before the SDK module body exists — the binary then dies at
+// run this line before the SDK module body exists, the binary then dies at
 // load (the build-order lottery class fixed at runtime 2.0.13).
 let allFlagArityCache: ReadonlyMap<string, CliFlagKind> | null = null;
 export function allFlagArity(): ReadonlyMap<string, CliFlagKind> {

package/src/cli/completion.ts

@@ -1,5 +1,5 @@
 /**
- * completion.ts — shell completion generated from the command catalog.
+ * completion.ts, shell completion generated from the command catalog.
  *
  * The scripts are DERIVED, never hand-maintained: a command added to
  * `./command-catalog.ts` is completable the moment it exists, and one removed
@@ -63,7 +63,7 @@ function bashScript(binary: string): string {
   }).join('\n');
 
   return [
-    `# bash completion for ${binary} — generated from its command catalog.`,
+    `# bash completion for ${binary}, generated from its command catalog.`,
     `# Install: ${binary} completion bash > ~/.local/share/bash-completion/completions/${binary}`,
     '',
     `${fn}() {`,
@@ -144,7 +144,7 @@ function zshScript(binary: string): string {
   const fn = `_${shellIdent(binary)}`;
   return [
     `#compdef ${binary}`,
-    `# zsh completion for ${binary} — generated from its command catalog.`,
+    `# zsh completion for ${binary}, generated from its command catalog.`,
     `# Install: ${binary} completion zsh > ~/.zfunc/_${binary}   (with ~/.zfunc on $fpath)`,
     '',
     `${fn}() {`,
@@ -189,7 +189,7 @@ function fishEscape(value: string): string {
 function fishScript(binary: string): string {
   const guard = `__${shellIdent(binary)}_no_command`;
   const lines: string[] = [
-    `# fish completion for ${binary} — generated from its command catalog.`,
+    `# fish completion for ${binary}, generated from its command catalog.`,
     `# Install: ${binary} completion fish > ~/.config/fish/completions/${binary}.fish`,
     '',
     `function ${guard}`,

package/src/cli/help.ts

@@ -14,7 +14,7 @@ function readJsonVersion(path: string): string | null {
   try {
     if (!existsSync(path)) return null;
     const parsed = JSON.parse(readFileSync(path, 'utf-8')) as { name?: unknown; version?: unknown };
-    // Only trust OUR package.json — a compiled single-file binary can resolve
+    // Only trust OUR package.json, a compiled single-file binary can resolve
     // this path to a different package.json (a bundled dependency's) that
     // reports a placeholder like "0.0.0". Fall through to the baked VERSION in
     // that case rather than rendering a stray version in `--version`/banners.
@@ -37,7 +37,7 @@ export function renderGoodVibesVersion(binary = 'goodvibes-daemon'): string {
 
 /**
  * Honest one-line startup identity for the daemon binary, emitted right as it
- * begins serving — including on a bare (no-arg) systemd launch. It states the
+ * begins serving, including on a bare (no-arg) systemd launch. It states the
  * RESOLVED version (never a placeholder), the home/host/port it actually bound,
  * and points at the real service-setup command. This replaces the field
  * behavior where a bare launch showed a wrong "v0.0.0" banner and gave an
@@ -51,7 +51,7 @@ export function renderDaemonStartupBanner(
   binary = 'goodvibes-daemon',
 ): string {
   return (
-    `${binary} ${version} starting — ` +
+    `${binary} ${version} starting: ` +
     `home=${binding.homeDir} host=${binding.host} port=${binding.port} ` +
     `(manage as a service: ${binary} install-service)`
   );
@@ -124,7 +124,7 @@ export function renderGoodVibesDaemonHelp(
     '',
     'Exit codes:',
     `${pad('  0')}the command did what it says`,
-    `${pad('  1')}it ran and failed — the reason is printed`,
+    `${pad('  1')}it ran and failed: the reason is printed`,
     `${pad('  2')}the command line was wrong: an unknown command, an unknown flag,`,
     `${pad('   ')}a flag this command does not take, or a missing value`,
     `${pad('  3')}service-status only: installed, but not running`,
@@ -133,7 +133,7 @@ export function renderGoodVibesDaemonHelp(
 }
 
 /**
- * `help <command>` — one command's usage, its own flags, and what it does.
+ * `help <command>`, one command's usage, its own flags, and what it does.
  *
  * Returns null when the word names no command, so the caller can refuse with
  * the same "Unknown command" message the parser produces rather than printing

package/src/cli/index.ts

@@ -2,15 +2,15 @@
  * CLI barrel for the daemon product.
  *
  * Two halves, deliberately separable:
- *   - `command-catalog.ts` is WHAT this binary understands — every command,
+ *   - `command-catalog.ts` is WHAT this binary understands, every command,
  *     alias, flag and help string, as data.
  *   - `parser.ts`, `help.ts` and `completion.ts` are the ENGINE that reads a
  *     catalog and produces a parse, a help page or a completion script. None of
  *     them names a daemon command.
  *
- * The argument surface a `goodvibes` front-end shares — the parse engine's
+ * The argument surface a `goodvibes` front-end shares, the parse engine's
  * catalog contract, redaction, config overrides, settings-value reading and
- * endpoint resolution — is @pellux/goodvibes-terminal-shell's, imported at the
+ * endpoint resolution, is @pellux/goodvibes-terminal-shell's, imported at the
  * point of use. What stays here is what only this binary has: its own command
  * vocabulary, and the help and completion built on it.
  */

package/src/cli/parser.ts

@@ -1,5 +1,5 @@
 /**
- * parser.ts — this binary's command line, read by the shared argument engine.
+ * parser.ts, this binary's command line, read by the shared argument engine.
  *
  * The engine is `parseWithCatalog` in @pellux/goodvibes-terminal-shell: tokens,
  * values, arity, `--`, refusals, and no knowledge of any product's commands.
@@ -15,7 +15,7 @@
  *    all silently served. `unmatchedFirstToken: 'reject'` is what ends that.
  *
  * 2. Every refusal is a refusal. An unrecognized command, a flag that belongs
- *    to another surface, a flag this command does not take, a missing value —
+ *    to another surface, a flag this command does not take, a missing value,
  *    each produces an error line, and the caller exits 2 with the help. Nothing
  *    is accepted-and-ignored.
  */

package/src/cli/surface-catalog.ts

@@ -4,7 +4,7 @@ import type { ConfigKey } from '@pellux/goodvibes-sdk/platform/config';
  * The channel surfaces the platform can speak on, with the settings keys each
  * one needs configured.
  *
- * The daemon reads this to answer "which channels are actually usable" — the
+ * The daemon reads this to answer "which channels are actually usable", the
  * `send` subcommand lists them and refuses a channel whose keys are unset,
  * rather than accepting the message and dropping it. A surface added here
  * becomes visible to `send` with no further wiring.

package/src/cli/types.ts

@@ -8,9 +8,9 @@ import type { DaemonCommand } from './command-catalog.ts';
  * the catalog is what decides which flags could have set them. A command's
  * dispatcher reads only the fields its own catalog entry declares.
  *
- * Fields describing starting or resuming a conversation — prompt, print,
+ * Fields describing starting or resuming a conversation, prompt, print,
  * outputFormat, noAltScreen, open, continueLast, resume, session, fork,
- * strict — are not here. This binary does not start or resume conversations,
+ * strict, are not here. This binary does not start or resume conversations,
  * so those flags are parsed, stored, and read by nothing. See
  * REJECTED_TERMINAL_FLAGS in ./command-catalog.ts for the refusal that
  * replaced them.

package/src/cluster/daemon-ws-call.ts

@@ -1,5 +1,5 @@
 /**
- * daemon-ws-call.ts — invoking a verb that has no REST binding.
+ * daemon-ws-call.ts, invoking a verb that has no REST binding.
  *
  * Most control-plane verbs answer on a plain HTTP path and `callDaemonVerb` in
  * @pellux/goodvibes-terminal-shell is all a subcommand needs. Some do not: the
@@ -171,7 +171,7 @@ export async function callDaemonWsVerb<T>(
           ok: false,
           error: `${where} refused the operator token`,
           fix: target.isLocal
-            ? 'the token may be stale — restart the daemon, or pass --token'
+            ? 'the token may be stale; restart the daemon, or pass --token'
             : 'pass --token with the operator token from that machine (its <daemon home>/operator-tokens.json)',
         });
         return;
@@ -197,7 +197,7 @@ export async function callDaemonWsVerb<T>(
         finish({
           ok: false,
           error: `${where} does not know the verb ${methodId}`,
-          fix: 'that daemon is running a build without this capability — update it, then try again',
+          fix: 'that daemon is running a build without this capability; update it, then try again',
         });
         return;
       }
@@ -221,14 +221,14 @@ export async function callDaemonWsVerb<T>(
     };
 
     socket.onclose = (): void => {
-      // A close before an answer is a refusal too — most often the upgrade
+      // A close before an answer is a refusal too, most often the upgrade
       // itself was rejected, which happens before any frame is sent.
       finish({
         ok: false,
         error: `${where} closed the connection before answering`,
         fix: target.isLocal
           ? 'check the daemon is running: goodvibes-daemon service-status'
-          : 'check the operator token for that machine — an upgrade with no valid token is closed immediately',
+          : 'check the operator token for that machine; an upgrade with no valid token is closed immediately',
       });
     };
   });

package/src/cluster/raw-reply-route.ts

@@ -1,10 +1,10 @@
 /**
- * raw-reply-route.ts — invoking a route that answers with its payload itself.
+ * raw-reply-route.ts, invoking a route that answers with its payload itself.
  *
  * `callDaemonVerb` in @pellux/goodvibes-terminal-shell reads the wrapped
  * convention every `/api/cluster/*` route follows: `{ ok: true, data }` on
  * success, `{ ok: false, error, fix }` on a refusal. Three routes this daemon
- * serves do not — `/status`, `/api/health` and `/api/channels/status` answer
+ * serves do not, `/status`, `/api/health` and `/api/channels/status` answer
  * with the payload ITSELF and put the verdict in the HTTP status. Reading one
  * as the other is not a subtle failure: a raw payload has no `ok` field, so the
  * wrapped reader called a perfectly healthy 200 "the daemon refused the
@@ -13,7 +13,7 @@
  * So this is the second half of the SAME convention, next to daemon-ws-call.ts:
  * the target is resolved by `resolveRemoteDaemonTarget`, the credential is the
  * same operator token, the reachability / stale-credential / unreadable-reply
- * refusals are the shared reader's — only the shape of a successful body
+ * refusals are the shared reader's, only the shape of a successful body
  * differs. `rawReplyReader` restates a raw reply in the wrapped convention
  * before the shared reader sees it, so there is one request path rather than
  * two.
@@ -29,8 +29,8 @@ export type DaemonReplyEnvelope = 'wrapped' | 'raw';
 /**
  * The status a restated reply carries.
  *
- * The shared reader looks at the status for exactly three verdicts — 401, 403
- * and 404 — and those are passed through untouched below, before any body is
+ * The shared reader looks at the status for exactly three verdicts, 401, 403
+ * and 404, and those are passed through untouched below, before any body is
  * read. Everything else it decides from the body, so a restated reply names a
  * status that is legal to attach a body to (a 204 or a 304 is not) rather than
  * echoing one that would make `new Response` throw.

package/src/config/checkpoint-settings.ts

@@ -7,15 +7,15 @@ import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
  * decide which directory it is safe to snapshot and how the first sweep and
  * retention behave:
  *
- *   - `checkpoints.preferGitRoot` (boolean, SDK default true) — prefer the
+ *   - `checkpoints.preferGitRoot` (boolean, SDK default true), prefer the
  *     enclosing git repository's top level over the raw working directory.
- *   - `checkpoints.allowBroadRoot` (boolean, SDK default false) — opt in to
+ *   - `checkpoints.allowBroadRoot` (boolean, SDK default false), opt in to
  *     snapshotting a broad root (filesystem root, home directory, ~/.goodvibes).
- *   - `checkpoints.allowLargeFirstSnapshot` (boolean, SDK default false) — opt
+ *   - `checkpoints.allowLargeFirstSnapshot` (boolean, SDK default false), opt
  *     in to a first snapshot whose full sweep exceeds `maxFirstSnapshotFiles`.
- *   - `checkpoints.maxFirstSnapshotFiles` (number, SDK default) — ceiling for
+ *   - `checkpoints.maxFirstSnapshotFiles` (number, SDK default), ceiling for
  *     the first-ever snapshot's file sweep.
- *   - `checkpoints.autoRetention` (boolean, SDK default true) — run a retention
+ *   - `checkpoints.autoRetention` (boolean, SDK default true), run a retention
  *     sweep automatically after each successful create and once at init.
  *
  * A sixth key, `checkpoints.unregisteredWorkspaces`, is read separately by
@@ -90,14 +90,14 @@ export function readCheckpointGuardSettings(
  * The registered-workspaces-only override (owner ruling, 2026-07-10):
  *
  *   - `checkpoints.unregisteredWorkspaces` (`'off' | 'guarded'`, default `'off'`)
- *     — `'off'` is the ruling's default: automatic (turn-end/lifecycle)
+ *    , `'off'` is the ruling's default: automatic (turn-end/lifecycle)
  *     checkpoints, and explicit checkpoint creation through the ws-only
  *     `checkpoints.create` gateway verb, both refuse when the resolved
  *     workspace root is not covered by the shared registration store
  *     (the SDK's workspace registration, platform/workspace).
  *     `'guarded'` opts back into the pre-ruling behavior for an unregistered
  *     workspace: automatic snapshots subscribe and explicit create proceeds,
- *     subject only to the SDK's own root/size guards above — never a silent
+ *     subject only to the SDK's own root/size guards above, never a silent
  *     re-enable, an explicit per-workspace opt-out of the registration gate.
  *
  * Any other value (including absence) reads as `'off'`.

package/src/config/config-key-guard.ts

@@ -0,0 +1,22 @@
+/**
+ * config-key-guard.ts
+ *
+ * ConfigManager.get/set/reset are typed `<K extends ConfigKey>`, a
+ * compile-time constraint that says nothing about a key that only exists as a
+ * plain string at runtime: a `config get <key>` CLI argument, or the
+ * `key: string` the SDK's readControlPlaneBinding hands back through its own
+ * read callback. Every one of those call sites used to write `key as
+ * ConfigKey` and trust the string was really a known key without the compiler
+ * ever seeing why that trust was justified.
+ *
+ * This guard makes the check honest: it is the schema lookup those call sites
+ * already ran (or could run) to decide the same thing, exposed as a real
+ * `key is ConfigKey` predicate so `key` narrows at the call site instead of
+ * being asserted. Same shape as isSecretConfigKey in ./secret-config.ts.
+ */
+import type { ConfigKey, ConfigSetting } from '@pellux/goodvibes-sdk/platform/config';
+
+/** True when `key` names a setting in `schema`; narrows `key` to ConfigKey. */
+export function isKnownConfigKey(key: string, schema: readonly ConfigSetting[]): key is ConfigKey {
+  return schema.some((setting) => setting.key === key);
+}

package/src/config/run-daemon-config-migration.ts

@@ -1,19 +1,19 @@
 /**
- * run-daemon-config-migration.ts — the one call every composition root in
+ * run-daemon-config-migration.ts, the one call every composition root in
  * this daemon makes before constructing its `ConfigManager`.
  *
  * Daemon-owned configuration now has exactly one home:
  * `~/.goodvibes/daemon/settings.json`. Before this migration, every product
  * wrote every key (including daemon-only ones like `surfaces.telegram.*`)
  * into its own per-surface silo, and the daemon only ever read
- * `~/.goodvibes/tui/settings.json` — so a value written by, say, the agent
+ * `~/.goodvibes/tui/settings.json`, so a value written by, say, the agent
  * surface reported a successful save and configured nothing the daemon could
  * see.
  *
  * `migrateDaemonOwnedConfig` (SDK, `platform/config`) is idempotent and cheap
  * on the fast path (one file read + JSON parse), so it is safe and correct to
  * call this at every composition root that is about to construct a
- * `ConfigManager` — not just the first one to run in a given process. It
+ * `ConfigManager`, not just the first one to run in a given process. It
  * must never abort startup: any failure is caught, logged with the marker
  * path so the failure is diagnosable, and startup continues on whatever
  * config state already exists.

package/src/config/secret-config.ts

@@ -4,21 +4,21 @@ import type { SecretScope, SecretStorageMedium } from './secrets.ts';
 
 export const SECRET_CONFIG_KEYS = new Set<ConfigKey>([
   // Mailbox and CalDAV credentials. Their own CONFIG_SCHEMA descriptions read
-  // "Stored in the daemon secret tier, never in config" — and until they were
+  // "Stored in the daemon secret tier, never in config", and until they were
   // listed here that sentence was aspirational: the settings modal wrote them
   // as plain strings into a config JSON file, because membership in this set is
   // the thing that routes an edit through the secret manager instead.
   //
   // The daemon reads each of these back with
   // resolveConfigSecret('<key>') → GOODVIBES_<KEY>, which is exactly the store
-  // key buildGoodVibesSecretKey() writes — see
+  // key buildGoodVibesSecretKey() writes, see
   // daemon/handlers/inbox/providers/email.ts.
   'surfaces.email.password',
   'surfaces.email.imapPassword',
   'surfaces.email.imap.password',
   'surfaces.email.smtp.password',
   'surfaces.calendar.caldavPassword',
-  // Telephony delivery credentials — same shape, same file, same gap.
+  // Telephony delivery credentials, same shape, same file, same gap.
   'surfaces.telephony.authToken',
   'surfaces.telephony.token',
   'surfaces.telephony.webhookSecret',
@@ -43,7 +43,7 @@ export const SECRET_CONFIG_KEYS = new Set<ConfigKey>([
   'surfaces.mattermost.botToken',
   'surfaces.matrix.accessToken',
   // Local synthetic sub-keys, one level under the SDK's real `payments`
-  // section (not yet a scalar CONFIG_SCHEMA entry — same situation as
+  // section (not yet a scalar CONFIG_SCHEMA entry, same situation as
   // tts.speed, behavior.notifyAfterSeconds, etc. in settings-modal-data.ts),
   // hence the cast. See input/payments-config.ts for why these are named flat
   // (payments.cardNumber, not payments.card.number): a flat one-level leaf is
@@ -131,14 +131,14 @@ export function buildSecretBackedConfigUpdate(configKey: ConfigKey, rawValue: st
  * A daemon-owned config key (`surfaces.*`, `payments.*`, `controlPlane.*`, ...)
  * names a credential the DAEMON executes with, not this interactive client, so
  * its secret material belongs in the daemon-scoped tier the daemon actually
- * reads — the same rule the SDK's config-ownership.ts already applies to the
+ * reads, the same rule the SDK's config-ownership.ts already applies to the
  * `goodvibes://` reference that points at it.
  *
  * Defaulting these to 'user' (the historical behavior here) split the pair: the
  * reference landed in the daemon's own settings file, because ConfigManager
  * routes daemon-owned keys there, while the value it pointed at sat in a tier
  * the daemon never resolves. The surface reported success and the daemon found
- * nothing. For the mailbox password that is the whole feature failing silently —
+ * nothing. For the mailbox password that is the whole feature failing silently,
  * the daemon is the process that polls IMAP and answers over Telegram, and it
  * does so with every surface closed. A payment card entered through
  * /payments card is the same shape of failure at purchase time.
@@ -166,7 +166,7 @@ export async function persistSecretBackedConfigValue(
     await secretsManager.set(update.secretKey, update.secretValue, { scope, medium });
   }
 
-  // 3. Clear old secret — pass the same medium so plaintext-medium secrets are found for deletion.
+  // 3. Clear old secret, pass the same medium so plaintext-medium secrets are found for deletion.
   if (update.clearSecretKey && secretsManager?.delete) {
     await secretsManager.delete(update.clearSecretKey, { scope, medium });
   }

package/src/config/surface.ts

@@ -1,5 +1,5 @@
 /**
- * surface.ts — the daemon's single surface-root identifier.
+ * surface.ts, the daemon's single surface-root identifier.
  *
  * Every piece of the daemon's own on-disk state (sessions, recovery snapshots,
  * checkpoints, the transcript journal, watchers, triggers, control-plane stores)
@@ -10,8 +10,8 @@
  * ── Why the daemon's surface root is still `tui` ────────────────────────────
  *
  * Because that is where the running daemon's state already is. Every store
- * this daemon has written on every installed machine — sessions, approvals,
- * watchers, devices, channel policies, the code index — sits under
+ * this daemon has written on every installed machine, sessions, approvals,
+ * watchers, devices, channel policies, the code index, sits under
  * `.goodvibes/tui/`. Renaming the segment here would not move that state; it
  * would make the daemon stop finding it, silently, on machines that have been
  * running for months.