@pellux/goodvibes-daemon 1.28.19 → 1.28.21

package/src/core/pairing-banner.ts

@@ -1,16 +1,16 @@
 /**
- * pairing-banner.ts — the pairing block, in one place.
+ * pairing-banner.ts, the pairing block, in one place.
  *
  * A daemon prints this once, as it finishes starting. That was the ONLY way to
  * see it: scroll it off the screen, start the daemon as a service where nothing
  * reads stdout, or come back to the box tomorrow, and there was no way to get
  * the link back short of restarting the daemon. `goodvibes-daemon pair` prints
- * it again — and prints exactly THIS, because both callers render from here.
+ * it again, and prints exactly THIS, because both callers render from here.
  *
  * It reprints the daemon's existing shared token rather than minting a new one.
  * Minting is a different act with a different consequence (a per-device token,
  * one more record in the token store, a link the boot banner's QR no longer
- * matches), and `pair` is not the command for it — `pairing.handoff.create` is.
+ * matches), and `pair` is not the command for it, `pairing.handoff.create` is.
  */
 import {
   buildPairingHandoffLink,
@@ -28,7 +28,7 @@ export interface PairingBannerInput {
   readonly version: string;
   /** The web-app origin the deep link opens. */
   readonly origin: string;
-  /** The token the link carries — the daemon's existing shared companion token. */
+  /** The token the link carries, the daemon's existing shared companion token. */
   readonly token: string;
   readonly offers: readonly PairingHandoffOfferKind[];
   /** False to print the link and the offers without the QR block. */
@@ -69,7 +69,7 @@ export function renderPairingBanner(input: PairingBannerInput): PairingBanner {
     capabilities,
     notice,
     lines: [
-      `GoodVibes daemon ${input.version} — scan to pair a device (opens the web app signed in):`,
+      `GoodVibes daemon ${input.version}: scan to pair a device (opens the web app signed in):`,
       '',
       `  ${input.origin}`,
       '',

package/src/daemon/cli.ts

@@ -7,8 +7,8 @@ import {
   readControlPlaneBinding,
   resolveDaemonEnabled,
 } from '@pellux/goodvibes-sdk/platform/config';
-import type { ConfigKey } from '@pellux/goodvibes-sdk/platform/config';
 import { GOODVIBES_DAEMON_SURFACE_ROOT } from '../config/surface.ts';
+import { isKnownConfigKey } from '../config/config-key-guard.ts';
 import { formatProviderModel, getModelIdFromProviderModel, getProviderIdFromModel } from '@pellux/goodvibes-sdk/platform/providers';
 import { resolveGoodVibesHomeOwnership } from '@pellux/goodvibes-sdk/platform/config';
 import { RuntimeEventBus, GlobalNetworkTransportInstaller, configureRuntimeEventBusDefaults, runtimeEventBusOptionsFrom } from '@/runtime/index.ts';
@@ -72,15 +72,15 @@ import { renderPairingBanner } from '../core/pairing-banner.ts';
 import { readOperatorTokenFile } from '@pellux/goodvibes-sdk/platform/workspace';
 type DaemonCliOwnership = {
   readonly workingDirectory: string;
-  /** The GoodVibes tree root — settings, workspace, and discovery all hang off this. */
+  /** The GoodVibes tree root, settings, workspace, and discovery all hang off this. */
   readonly homeDirectory: string;
   /** The daemon's OWN identity home (auth users, operator tokens, daemon settings). */
   readonly daemonHomeDirectory: string;
-  /** True when GOODVIBES_HOME or GOODVIBES_DAEMON_HOME named an override — see goodvibes-home.ts. */
+  /** True when GOODVIBES_HOME or GOODVIBES_DAEMON_HOME named an override, see goodvibes-home.ts. */
   readonly isOverridden: boolean;
 };
 
-// CLI flag parsing delegated to shared module — see src/cli-flags.ts
+// CLI flag parsing delegated to shared module, see src/cli-flags.ts
 
 type DaemonCliTokens = {
   readonly daemonToken: string | undefined;
@@ -90,11 +90,11 @@ type DaemonCliTokens = {
 /**
  * Two different directories that used to be one.
  *
- * `GOODVIBES_DAEMON_HOME` names the DAEMON's home — the identity directory
+ * `GOODVIBES_DAEMON_HOME` names the DAEMON's home, the identity directory
  * holding auth-users.json, operator-tokens.json, and daemon-settings.json. That
  * is what the name says and what the SDK's `resolveDaemonHomeDir()` has always
  * meant by it. This function used to read it as the GoodVibes tree ROOT, so
- * setting it relocated settings, workspace, and every discovery root as well —
+ * setting it relocated settings, workspace, and every discovery root as well,
  * far more than the daemon's own state.
  *
  * `GOODVIBES_HOME` is the variable for relocating the tree root. It is what a
@@ -104,7 +104,7 @@ type DaemonCliTokens = {
 function resolveDaemonCliOwnership(): DaemonCliOwnership {
   // Both roots come from the SDK's platform/config goodvibes-home, which the CLIENT entry
   // point also uses. They were resolved independently, and the client's copy
-  // simply did not read GOODVIBES_HOME — so a redirected client wrote into the
+  // simply did not read GOODVIBES_HOME, so a redirected client wrote into the
   // real tree while the daemon honoured the redirect.
   const { homeDirectory, daemonHomeDirectory, isOverridden } = resolveGoodVibesHomeOwnership();
   return {
@@ -130,7 +130,7 @@ async function main(): Promise<void> {
   // Before the parser, because the subcommand has its own flag vocabulary
   // (--group, --key, --host, --port, --token) that the daemon parser would
   // reject as unknown. Before the runtime, because this command talks to a
-  // daemon that is ALREADY RUNNING — composing a second runtime here would
+  // daemon that is ALREADY RUNNING, composing a second runtime here would
   // build a competing set of state on a machine that already has one.
   //
   // See the terminal shell's cluster-remote-daemon-target for the
@@ -156,7 +156,7 @@ async function main(): Promise<void> {
     });
     // Every write below is immediately followed by process.exit, so all of them
     // go to the descriptor synchronously rather than through a stream that can
-    // still be in flight when the process stops existing — see
+    // still be in flight when the process stops existing, see
     // fatal-boot-report.ts. (The OSC 52 clipboard sequence is unterminated
     // either way; the line terminator this adds after it is inert.)
     if (result.rawOutput) writeExitingStdoutLine(`\u001b${result.rawOutput}`);
@@ -183,7 +183,7 @@ async function main(): Promise<void> {
   if (rawArgs[0] === 'send') {
     const ownership = resolveDaemonCliOwnership();
     // Named before the delivery runs, because the flushActivityLogSync() below
-    // is what preserves this send's OUTBOUND_HTTP record — and a logger with no
+    // is what preserves this send's OUTBOUND_HTTP record, and a logger with no
     // destination has nothing to flush, so that record was never written.
     configureActivityLogger(join(ownership.workingDirectory, '.goodvibes', 'logs'));
     runDaemonConfigMigration(ownership.homeDirectory);
@@ -214,7 +214,7 @@ async function main(): Promise<void> {
   // `provision-wake-model …` is intercepted here for the same two reasons, plus
   // its own: the curl installer runs it on the binary it has just placed, before
   // any daemon exists, and it must reach the SDK's pinned manifest rather than
-  // have install.sh carry a second copy of the pins. It composes no runtime — it
+  // have install.sh carry a second copy of the pins. It composes no runtime, it
   // resolves a home directory, derives the managed voice root the running daemon
   // uses, and calls one SDK function. See provision-wake-model.ts for why it
   // exits 0 on a failed download.
@@ -236,7 +236,7 @@ async function main(): Promise<void> {
   // placed, right after unpacking the web UI bundle, so that the key names, the
   // settings-tier routing and the "which listener actually serves this" question
   // all stay in one implementation instead of being copied into shell. It
-  // composes no runtime — it resolves a home directory, opens the same config
+  // composes no runtime, it resolves a home directory, opens the same config
   // manager the daemon boots with, and writes two or three keys. See
   // webui-command.ts.
   if (rawArgs[0] === 'webui') {
@@ -323,7 +323,7 @@ async function main(): Promise<void> {
     process.exit(0);
   }
   // `cluster`, `send`, `webui` and `provision-wake-model` are handled at the top
-  // of this function, off the raw argument list, for the reasons stated there —
+  // of this function, off the raw argument list, for the reasons stated there,
   // which means they only work as the FIRST word. Reaching one here means a
   // global flag was written in front of it. Refusing says so; falling through
   // would start a daemon in the foreground, which is the exact behaviour this
@@ -360,8 +360,8 @@ async function main(): Promise<void> {
   // Give the shared logger a destination before anything else runs. It never
   // had one in this entrypoint: `logger` only writes to a file once
   // `configureActivityLogger()` has named one, so every logger.info/warn/error
-  // in this daemon — including the fatal handler at the bottom of this file
-  // and every flushActivityLogSync() call — went nowhere at all. That is why
+  // in this daemon, including the fatal handler at the bottom of this file
+  // and every flushActivityLogSync() call, went nowhere at all. That is why
   // a crash-looping daemon left an empty activity log next to a silent
   // console. The terminal app's own src/cli/entrypoint.ts configures its
   // logger the same way at the same point in startup.
@@ -479,23 +479,23 @@ async function main(): Promise<void> {
 
   // Service lifecycle: install / uninstall / start / stop / restart / status /
   // migrate manage this host's service definition for the shared daemon. They
-  // run BEFORE the daemon boots — no runtime/services are constructed — and
+  // run BEFORE the daemon boots, no runtime/services are constructed, and
   // exit with the honest result code.
   const serviceSubcommand = cli.command;
   if (isDaemonServiceSubcommand(serviceSubcommand)) {
     // The host/port baked into the unit's ExecStart (and displayed) come from
-    // the SAME hostMode-aware resolution the SDK bind path uses — never from
+    // the SAME hostMode-aware resolution the SDK bind path uses, never from
     // the GOODVIBES_DAEMON_HOST env var, which nothing in the bind path reads
     // (the --hostname flag already lands in config via
     // applyRuntimeEndpointFlagOverrides above, so it is covered here).
     const binding = resolveRuntimeEndpointBinding(config, 'controlPlane');
     if (!binding.recognized) {
-      // The SDK bind path has no default case for an unrecognized hostMode —
+      // The SDK bind path has no default case for an unrecognized hostMode,
       // a daemon launched with this config throws before binding. Say so
       // instead of presenting the fallback values as a real binding.
       console.warn(
         `[goodvibes-daemon] warning: controlPlane.hostMode '${binding.hostMode}' is not a recognized mode ` +
-          "(local|network|custom) — the daemon will fail to start until it is corrected.",
+          "(local|network|custom); the daemon will fail to start until it is corrected.",
       );
     }
     const binaryPath = resolveInstalledDaemonBinary({ moduleUrl: import.meta.url });
@@ -504,12 +504,12 @@ async function main(): Promise<void> {
       binaryPath,
       homeDir: homeDirectory,
       // Unit-file paths resolve from the LOGIN home, never the
-      // GOODVIBES_HOME-overridable tree home above — see
+      // GOODVIBES_HOME-overridable tree home above, see
       // BuildManagedDaemonServiceManagerParams.unitHomeDir's doc.
       unitHomeDir: homedir(),
       host: binding.host,
       port: binding.port,
-      // migrate-service only: never auto-migrate — requires the same explicit
+      // migrate-service only: never auto-migrate, requires the same explicit
       // consent as any other non-interactive destructive confirmation.
       confirmMigration: cliFlags.yes,
       // service-status only.
@@ -521,7 +521,7 @@ async function main(): Promise<void> {
       portFlagProvided: cliFlags.port !== undefined,
     });
     // These print the unit path, the follow-up commands and the honest result,
-    // then exit immediately — exactly the race a stream write loses. Descriptor
+    // then exit immediately, exactly the race a stream write loses. Descriptor
     // writes instead.
     for (const line of result.lines) {
       writeExitingStdoutLine(line);
@@ -529,14 +529,14 @@ async function main(): Promise<void> {
     process.exit(result.exitCode);
   }
 
-  // Honest startup identity, printed for EVERY launch shape — including a bare
+  // Honest startup identity, printed for EVERY launch shape, including a bare
   // (no-arg) systemd launch, and BEFORE any runtime construction so it still
   // reaches the journal when a broken config makes the daemon throw during
   // composition. It states the resolved version (never a placeholder) and the
   // home/host/port the daemon will actually bind: the binding comes from the
   // SAME hostMode-aware resolution the SDK bind path uses (resolveHostBinding:
   // 'local' forces 127.0.0.1, 'network' forces 0.0.0.0, port 0/non-numeric
-  // falls back to the default) — never from controlPlane.host alone, and never
+  // falls back to the default), never from controlPlane.host alone, and never
   // from the GOODVIBES_DAEMON_HOST env var, which the bind path does not read.
   const bannerBinding = resolveRuntimeEndpointBinding(config, 'controlPlane');
   // eslint-disable-next-line no-console
@@ -547,14 +547,14 @@ async function main(): Promise<void> {
     // serving). Warn here so the journaled crash is explained.
     console.warn(
       `[goodvibes-daemon] warning: controlPlane.hostMode '${bannerBinding.hostMode}' is not a recognized mode ` +
-        "(local|network|custom) — the daemon cannot bind until it is corrected; the host/port above are fallback values, not a real binding.",
+        "(local|network|custom): the daemon cannot bind until it is corrected; the host/port above are fallback values, not a real binding.",
     );
   }
 
   // Boot-time reconciliation. The banner above states the real bind; this
   // compares it to the URL clients are actually handed. Those are produced by
   // two different resolvers, and when they disagree the daemon is advertising an
-  // address it does not answer on — the state that produced two different click
+  // address it does not answer on, the state that produced two different click
   // hosts from one daemon. The comparison is the SDK's own
   // describeDerivedBindMismatch, which already knows the two cases that are NOT
   // drift: a wildcard bind reported as 0.0.0.0 against a loopback dial target is
@@ -564,7 +564,9 @@ async function main(): Promise<void> {
   if (bannerBinding.recognized) {
     const mismatch = describeDerivedBindMismatch(
       { host: bannerBinding.host, port: bannerBinding.port },
-      readControlPlaneBinding((key) => config.get(key as ConfigKey)),
+      readControlPlaneBinding((key) =>
+        isKnownConfigKey(key, config.getSchema()) ? config.get(key) : undefined,
+      ),
     );
     if (mismatch) {
       console.warn(`[goodvibes-daemon] warning: ${mismatch}`);
@@ -601,7 +603,7 @@ async function main(): Promise<void> {
     daemonHomeDirectory,
     // This daemon observes externally-launched coding-agent sessions on the
     // host read-only (fleet visibility + steer; never counted, never
-    // stopped). Daemon-side only — the interactive process reads this snapshot
+    // stopped). Daemon-side only, the interactive process reads this snapshot
     // rather than double-detecting. Mirrors the SDK daemon cli.
     observeExternalAgents: true,
     // Opt into the REAL host power seam (Linux logind: systemd-inhibit children
@@ -613,7 +615,7 @@ async function main(): Promise<void> {
     // The wake-word model ships with the installation, and this is the retry: at
     // every daemon start, sweep the managed wake tree and fetch whatever the
     // install could not (an offline install, a killed download, a changed pin).
-    // It never blocks startup and never fails it — see the SDK's
+    // It never blocks startup and never fails it, see the SDK's
     // voice/wake/install-provision.ts. The webui reads the model bytes from THIS
     // process, so a provisioned daemon is what makes the browser path work too.
     provisionWakeModelsAtBoot: true,
@@ -669,7 +671,7 @@ async function main(): Promise<void> {
     // against a REMOTE daemon behaves exactly like one run on that machine.
     clusterGroupVerbs: runtimeServices.clusterGroup.verbs,
     // Daemon-hosted sessions. Stating this is what turns `sessions.hosted.*`
-    // on, and what it states is where a hosted run's asks are gated — this
+    // on, and what it states is where a hosted run's asks are gated, this
     // daemon's per-workspace trust decision. See
     // runtime/hosted-session-composition.ts.
     hostedSessions: createHostedSessionOptions(runtimeServices),
@@ -733,7 +735,7 @@ async function main(): Promise<void> {
   // product's rather than the platform's: the legacy memory fold, provider
   // watching, and the notifier/integration attachments. They run AFTER
   // daemon.start(), because the fold has to follow the facade's memoryStore
-  // init(), and none of them may keep the daemon from serving — see
+  // init(), and none of them may keep the daemon from serving, see
   // runtime/boot-tasks.ts.
   await runDaemonBootTasks(runtimeServices);
 
@@ -756,11 +758,11 @@ async function main(): Promise<void> {
     // crash timeout.
     //
     // This process built the runtime graph and handed it to DaemonServer, so by
-    // the SDK's ownership rule the facade leaves it alone — nothing else stops
+    // the SDK's ownership rule the facade leaves it alone, nothing else stops
     // these pollers. Without dispose() the config watch, fleet tick, memory
     // governor, watcher registry and six more kept ticking until process exit.
     // The handler surfaces (inbox store + its poll timers, catalog handlers) are
-    // the FIRST thing dispose() unwinds — they are on the disposal owner list
+    // the FIRST thing dispose() unwinds, they are on the disposal owner list
     // now rather than sequenced by hand here, which is what makes every other
     // shutdown path stop them too instead of only this one.
     const stop = Promise.allSettled([listener.stop(), daemon.stop()])
@@ -768,7 +770,7 @@ async function main(): Promise<void> {
       .then(() => 'done' as const);
     const result = await Promise.race([stop, timeout]);
     if (result === 'timeout') {
-      logger.warn('shutdown deadline exceeded — forcing exit');
+      logger.warn('shutdown deadline exceeded; forcing exit');
       // A forced exit is exactly the case where the log matters most and is
       // least likely to have drained on its own.
       flushActivityLogSync();
@@ -795,16 +797,16 @@ async function main(): Promise<void> {
 
   // Cheap unattended reconcile: if this (canonical) daemon unit is confirmed
   // serving AND a redundant installer-managed goodvibes-daemon.service (the
-  // retired unit name) sits enabled-but-NOT-running beside it — the exact
-  // production-incident state — auto-disable and remove it, printing a
+  // retired unit name) sits enabled-but-NOT-running beside it, the exact
+  // production-incident state, auto-disable and remove it, printing a
   // receipt. A RUNNING legacy daemon, a hand-written unit, or an unanswered
   // configured endpoint all refuse with a notice instead. Best-effort: never
   // let this block or crash daemon boot (per-call systemctl timeouts plus one
   // cumulative pass deadline). The unit search root is the LOGIN user's home
   // (where systemd user units live), never the daemon data home
   // (GOODVIBES_DAEMON_HOME); the tracked name honors service.serviceName. The
-  // endpoint requirement uses the CLIENT view of the config — a fresh read of
-  // settings.json with none of this process's runtime flag overrides — because
+  // endpoint requirement uses the CLIENT view of the config, a fresh read of
+  // settings.json with none of this process's runtime flag overrides, because
   // that is what clients resolve when they look for the daemon.
   try {
     runDaemonConfigMigration(homeDirectory);
@@ -827,8 +829,8 @@ async function main(): Promise<void> {
       }
     }
     if (reconcile.reason !== 'no-legacy-unit') {
-      // Breadcrumb for EVERY outcome where a legacy unit file exists —
-      // including guard refusals — so a persisting two-unit state is never
+      // Breadcrumb for EVERY outcome where a legacy unit file exists,
+      // including guard refusals, so a persisting two-unit state is never
       // silent about why nothing was reconciled.
       logger.info('daemon: legacy-unit reconcile', { action: reconcile.action, reason: reconcile.reason });
     }
@@ -837,7 +839,7 @@ async function main(): Promise<void> {
   }
 
   // Print a device-pairing QR to stdout. The QR encodes the canonical
-  // `#pair=<token>` deep link the web app consumes — a camera scan opens it
+  // `#pair=<token>` deep link the web app consumes, a camera scan opens it
   // already signed in. No raw JSON connection blob is printed. This is also the
   // one place web.publicBaseUrl is frozen from the stable-name resolution (never
   // clobbering a user-set value), so the printed origin survives a DHCP change.
@@ -849,7 +851,7 @@ async function main(): Promise<void> {
     stepUpAvailable: true,
   });
   // Rendered by core/pairing-banner.ts, which `goodvibes-daemon pair` also
-  // calls — so the block printed here and the one printed on demand are the
+  // calls, so the block printed here and the one printed on demand are the
   // same block, from the same token, and cannot drift.
   const banner = renderPairingBanner({
     version: VERSION,
@@ -870,7 +872,7 @@ void main().catch((error) => {
   //
   // Doing it the other way round is what shipped mute. This handler used to
   // call logger.error and flushActivityLogSync and nothing else, and the
-  // logger had no destination this early in boot — so the released 1.27.0
+  // logger had no destination this early in boot, so the released 1.27.0
   // binary crash-looped 77 times with exit 1, zero bytes on stdout, zero bytes
   // on stderr and an empty activity log. See fatal-boot-report.ts.
   reportFatalBootFailure(error);

package/src/daemon/config-command.ts

@@ -1,12 +1,12 @@
 /**
- * config-command.ts — `goodvibes-daemon config list|get|set|unset`.
+ * config-command.ts, `goodvibes-daemon config list|get|set|unset`.
  *
  * A headless daemon's settings had no command at all: the only ways to change
  * one were to hand-edit a JSON file whose path and tier you had to already
  * know, or to attach a client. `webui enable` proved the pattern for a
- * settings-writing command that the installer and a person can both run — open
+ * settings-writing command that the installer and a person can both run, open
  * the same ConfigManager the daemon boots with, write through `set()`, print an
- * honest receipt — and this is that pattern generalised to every key.
+ * honest receipt, and this is that pattern generalised to every key.
  *
  * WHICH FILE A WRITE LANDS IN is not decided here. `ConfigManager.set()` routes
  * a daemon-owned key to the daemon's own settings store and a shared key to the
@@ -17,12 +17,12 @@
  * cli-redaction
  * first, so a token, a password, an API key or a card number reads as
  * `<redacted>` and a `config list` pasted into a bug report carries no
- * credential. Writes are NOT redacted — `config set` stores the real value; it
+ * credential. Writes are NOT redacted, `config set` stores the real value; it
  * is the OUTPUT that is cleaned. A `goodvibes://secrets/...` reference is left
  * visible on purpose: it is a pointer, not a secret, and hiding it would make
  * the indirection impossible to verify.
  */
-import type { ConfigManager, ConfigKey, ConfigSetting } from '@pellux/goodvibes-sdk/platform/config';
+import type { ConfigManager, ConfigSetting } from '@pellux/goodvibes-sdk/platform/config';
 import { ConfigError } from '@pellux/goodvibes-sdk/platform/config';
 import {
   REDACTED_VALUE,
@@ -30,6 +30,7 @@ import {
   parseConfigValueText,
   redactConfig,
 } from '@pellux/goodvibes-terminal-shell';
+import { isKnownConfigKey } from '../config/config-key-guard.ts';
 
 export const CONFIG_SUBCOMMANDS = ['list', 'get', 'set', 'unset'] as const;
 export type ConfigSubcommand = (typeof CONFIG_SUBCOMMANDS)[number];
@@ -107,8 +108,9 @@ function message(error: unknown): string {
 }
 
 function readValue(deps: ConfigCommandDeps, key: string): unknown {
+  if (!isKnownConfigKey(key, deps.configManager.getSchema())) return undefined;
   try {
-    return deps.configManager.get(key as ConfigKey);
+    return deps.configManager.get(key);
   } catch {
     return undefined;
   }
@@ -181,19 +183,18 @@ function getResult(deps: ConfigCommandDeps, key: string): ConfigCommandResult {
 }
 
 function setResult(deps: ConfigCommandDeps, key: string, rawValue: string): ConfigCommandResult {
-  const setting = schemaFor(deps, key);
-  if (!setting) {
+  if (!isKnownConfigKey(key, deps.configManager.getSchema())) {
     return failure(`'${key}' is not a settings key. Run \`${deps.binary ?? 'goodvibes-daemon'} config list\` to see them.`, deps);
   }
   const value = parseConfigValueText(rawValue);
   try {
-    deps.configManager.set(key as ConfigKey, value as never);
+    deps.configManager.set(key, value as never);
   } catch (error) {
     // A schema refusal is the common case (wrong type, value outside an enum),
     // and its message already names what was wrong. Passing it through beats
     // rewording it into something vaguer.
     return failure(
-      error instanceof ConfigError ? error.message : `could not write ${key} — ${message(error)}`,
+      error instanceof ConfigError ? error.message : `could not write ${key}: ${message(error)}`,
       deps,
     );
   }
@@ -219,14 +220,13 @@ function setResult(deps: ConfigCommandDeps, key: string, rawValue: string): Conf
 }
 
 function unsetResult(deps: ConfigCommandDeps, key: string): ConfigCommandResult {
-  const setting = schemaFor(deps, key);
-  if (!setting) {
+  if (!isKnownConfigKey(key, deps.configManager.getSchema())) {
     return failure(`'${key}' is not a settings key. Run \`${deps.binary ?? 'goodvibes-daemon'} config list\` to see them.`, deps);
   }
   try {
-    deps.configManager.reset(key as ConfigKey);
+    deps.configManager.reset(key);
   } catch (error) {
-    return failure(`could not reset ${key} — ${message(error)}`, deps);
+    return failure(`could not reset ${key}: ${message(error)}`, deps);
   }
   const stored = readValue(deps, key);
   if (deps.json) {
@@ -254,7 +254,7 @@ export function runConfigCommand(args: readonly string[], deps: ConfigCommandDep
   const subcommand = args[0];
   if (subcommand === undefined) return refusal('name what to do with the settings.', deps);
   if (!isConfigSubcommand(subcommand)) {
-    return refusal(`'${subcommand}' is not a config command — try ${CONFIG_SUBCOMMANDS.join(', ')}.`, deps);
+    return refusal(`'${subcommand}' is not a config command; try ${CONFIG_SUBCOMMANDS.join(', ')}.`, deps);
   }
 
   if (subcommand === 'list') {

package/src/daemon/handlers/context.ts

@@ -3,7 +3,7 @@
  * former OperatorContext. It carries the SDK gateway catalog (handlers attach
  * to it), the daemon credential store, a read-only slice of the config manager,
  * resolved directories, and a logger. No SDK descriptor or schema is declared
- * here — the catalog type is re-exported through the contracts seam.
+ * here, the catalog type is re-exported through the contracts seam.
  */
 import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
 import type { GatewayMethodCatalog } from './contracts.ts';

package/src/daemon/handlers/contracts.ts

@@ -4,7 +4,7 @@
  * Every other module under `src/daemon/handlers/` imports SDK contract
  * identifiers from HERE and nowhere else. Concentrating the SDK imports in one
  * concrete-submodule module keeps the rest of the layer free of barrel cycles
- * and guarantees the host NEVER re-declares an SDK id, descriptor, or schema —
+ * and guarantees the host NEVER re-declares an SDK id, descriptor, or schema,
  * it only attaches handlers to the descriptors the SDK already registered.
  */
 
@@ -17,6 +17,21 @@ export type {
   GatewayMethodHandler,
 } from '@pellux/goodvibes-sdk/platform/control-plane';
 
+// The SDK's own `payments.*` route module: the registrar and the service seam
+// it dispatches to. Exported by the SDK barrel as of 2.0.18 (CHANGELOG). Three
+// of the seven verbs attach through this unchanged; see
+// daemon/handlers/payments/register.ts and checkout-handlers.ts for why the
+// other four (`cards.create`, `purchases.list`, `checkout.begin`,
+// `checkout.fillCard`) stay local wrappers instead.
+export { registerPaymentsGatewayMethods } from '@pellux/goodvibes-sdk/platform/control-plane';
+export type { PaymentsGatewayService, PaymentPurchaseView } from '@pellux/goodvibes-sdk/platform/control-plane';
+
+// The browser-checkout seam a daemon composition receives through
+// `onBrowserCheckout` (sdk 2.0.19, platform/control-plane's
+// `composeDaemonBrowser`). See daemon/handlers/payments/register.ts for how
+// the checkout pair reads it.
+export type { BrowserCheckoutSeam } from '@pellux/goodvibes-sdk/platform/control-plane';
+
 // Channel domain types reused in handler signatures (read-only SDK interfaces; never re-declared).
 export type {
   ChannelIdentity,
@@ -31,13 +46,13 @@ export type {
  * `remote.peers.*` HTTP routes can dispatch to it.
  *
  * Both were declared here, by hand, as a verbatim structural mirror of the
- * daemon-sdk's own declarations — seventeen methods copied signature for
- * signature — for one reason: neither carried the `export` keyword upstream,
+ * daemon-sdk's own declarations, seventeen methods copied signature for
+ * signature, for one reason: neither carried the `export` keyword upstream,
  * so neither could be imported. Both do now, and a mirror that can drift out of
  * agreement with the interface it must satisfy is worse than no mirror at all.
  *
  * They are re-exported under the same names so every implementer in this
  * product keeps naming them the way it already does. The SDK ships no
- * docker/ssh/cloud backend — the host still owns the implementation.
+ * docker/ssh/cloud backend, the host still owns the implementation.
  */
 export type { DistributedRuntimeRouteService, RemotePeerAuth } from '@pellux/goodvibes-daemon-sdk/remote-routes';

package/src/daemon/handlers/credentials.ts

@@ -20,7 +20,7 @@ export interface DaemonCredentialStore {
    * Store a daemon-owned credential. scope defaults 'daemon'.
    *
    * This is the DAEMON's own credential store: every caller is daemon code, and
-   * every value written through it is one the daemon itself has to read back —
+   * every value written through it is one the daemon itself has to read back,
    * including its own generated draft encryption key (createAtRestCipher below,
    * which calls put() with no scope at all). Defaulting to 'user' filed those
    * in a surface-scoped tier, so the daemon's own material lived somewhere it

package/src/daemon/handlers/drafts/draft-store.ts

@@ -8,14 +8,14 @@ import { HandlerSqliteStore } from '../sqlite-store.ts';
 // Mirrors the agent's local draft store (channels/drafts.json) server-side so
 // drafts are visible across surfaces. The agent's local file remains the source
 // of truth; this store is a sync mirror. Conflict resolution (most-recent
-// updatedAt wins) is the integrator's concern — this store performs a plain
+// updatedAt wins) is the integrator's concern, this store performs a plain
 // upsert and records the supplied/derived updatedAt.
 //
 // SECURITY POSTURE:
 //   - The plaintext message body is NEVER persisted. It is encrypted at rest
 //     via the daemon at-rest cipher (AES-256-GCM) as `bodyEnc`.
 //   - The webhook URL is encrypted at rest (`webhookEnc`) and is ALWAYS
-//     redacted ('[redacted]') in every list/get response — the raw URL never
+//     redacted ('[redacted]') in every list/get response, the raw URL never
 //     leaves the store.
 //   - `messageDigest` (sha256First(body, 12)) is computed at save time and
 //     stored alongside, so reads never need to decrypt the body. The required
@@ -170,7 +170,7 @@ function parseTags(raw: string | null): string[] | undefined {
       return tags.length > 0 ? tags : undefined;
     }
   } catch {
-    // Corrupt tags column — treat as absent rather than throwing on read.
+    // Corrupt tags column, treat as absent rather than throwing on read.
   }
   return undefined;
 }

package/src/daemon/handlers/drafts/register.ts

@@ -9,7 +9,7 @@
  *
  * The SDK owns every id, descriptor, access flag, and I/O schema (auto-
  * registered with handler:undefined). This module NEVER re-declares any of
- * them — it looks each up via catalog.get(id) (inside registerCatalogHandler)
+ * them, it looks each up via catalog.get(id) (inside registerCatalogHandler)
  * and re-registers with the wrapped handler. save/delete are confirm-gated via
  * RegisterHandlerOptions.confirm; the wrapper enforces body.confirm === true
  * AND context.explicitUserRequest === true before the handler runs.
@@ -17,7 +17,7 @@
  * SECURITY: the message body is encrypted at rest and NEVER returned (the wire
  * `message` field carries the sha256First(body,12) digest). Webhooks are
  * encrypted at rest and ALWAYS redacted on read; RAW webhook tokens submitted
- * to save are REJECTED — the agent must redact ('[redacted]') or pass a
+ * to save are REJECTED, the agent must redact ('[redacted]') or pass a
  * goodvibes://secrets/ reference before transmission.
  */
 import type { HandlerContext } from '../context.ts';
@@ -131,7 +131,7 @@ function optionalIso8601(value: unknown, field: string): string | undefined {
  * to be redacted before transmission; the daemon only stores '[redacted]' or a
  * goodvibes://secrets/ reference (which carries no token material). Any other
  * value bearing a scheme (e.g. an https:// URL with an embedded token) is a raw
- * secret and is rejected outright — never persisted, never logged.
+ * secret and is rejected outright, never persisted, never logged.
  */
 function validateWebhook(value: string | undefined): string | undefined {
   if (value === undefined) return undefined;
@@ -287,7 +287,7 @@ export function registerDraftMethods(
     const id = parseDraftId(body);
     const record = store.get(id);
     if (record === null) return { notFound: true, id };
-    // get output permits additional properties — expose messageDigest explicitly
+    // get output permits additional properties, expose messageDigest explicitly
     // alongside the schema-required `message` field (both carry the digest).
     return { ...record, messageDigest: record.message };
   };