@pellux/goodvibes-daemon 1.28.7 → 1.28.10

package/CHANGELOG.md

@@ -6,6 +6,76 @@ All notable changes to the GoodVibes daemon.
 
 ## [Unreleased]
 
+## [1.28.10] - 2026-08-05
+
+### Changes
+
+- **Fixed: this daemon's answers match its own contract.** Profile field
+  reads leaked internal properties past a strict schema, so up-to-date
+  clients refused every profile answer and the platform could not tell its
+  owner his own address. Responses are explicit wire projections now, and a
+  conformance test runs the real routes against the contract (platform
+  runtime 2.0.8).
+- **Fixed: one control-plane store.** A path defect made every boot rewrite
+  a legacy store nothing reads; state that still lived only at the legacy
+  location (occasions, workspace registrations) migrates to the daemon's
+  surface-scoped store on boot with a receipt, duplicates are quarantined
+  with receipts, and the legacy directory empties and is removed.
+- **Changed: the daemon hosts conversation turns for the agent.** Hosted
+  session event streams are render-grade and session-scoped, so a client
+  rendering from the stream sees what the model said and what it did — and
+  agent conversations become genuinely cross-visible with their messages.
+- Changed: connecting Google is one action, with every needed scope in a
+  single consent and a live mail-and-calendar proof at the end; the settings
+  catalog now carries the calendar/google/email keys this daemon really
+  reads (platform runtime 2.0.8).
+
+## [1.28.9] - 2026-08-02
+
+### Changes
+
+- Changed: a conversational turn is told to understand what it captures, not
+  just file it — an itinerary also means an away-span said back in plain
+  words, travelers who are people in the owner's life, and durable facts
+  about the destination, and the turn uses what it stored: it names
+  collisions with existing plans and offers the obviously useful next steps
+  once (a reminder before departure, weather at the destination). Anything
+  beyond the conversation is still proposed and waits for a yes (platform
+  runtime 2.0.7).
+
+## [1.28.8] - 2026-08-02
+
+### Changes
+
+- **Fixed: a chat message gets an answer, never workflow paperwork.** The
+  conversation gate's decision that a channel message is conversation is now
+  authoritative — the review-wording heuristic that turned "I'll review the
+  route" in a transcript into a full write-review-fix-confirm chain can no
+  longer override it. When a chain does legitimately run, the reply sent back
+  over the channel carries what the agent actually found or did; chain status
+  lines stay in the operator progress feed. Duplicate replies from the two
+  completion reporters are gone (platform runtime 2.0.6).
+- **Added: personal information shared in conversation gets captured.** A
+  conversational channel turn — which previously ran with no tools at all —
+  now carries the profile capture tool with per-run owner authority: a trip
+  itinerary pasted into Telegram lands in the owner profile's Plans section
+  with its dates, flights, travelers and confirmation number, and the reply
+  states concretely what was stored. Configurable via
+  `profile.conversationalCapture` (default on) and `profile.ownerChannels`
+  (defaults to the occasions nudge channel).
+- **Fixed: a chat session is filed as a chat.** Channel-originated sessions
+  are classified by their channel instead of as TUI project sessions rooted
+  in a filesystem path, rollover re-derives the classification, and a sender
+  on the channel's owner allowlist is attributed as the owner principal
+  instead of unknown. The daemon now hands its channel ingress policy to the
+  session intake so that attribution works end to end.
+- Fixed: this daemon's settings file is rewritten only by this daemon.
+  Clients reading the daemon settings tier migrate their in-memory view and
+  leave the file bytes untouched, so a newer client can no longer rewrite the
+  file out from under an older running daemon; the daemon's own migration
+  folds the rename, the receipt, and a reader floor into one atomic write
+  (platform runtime 2.0.6).
+
 ## [1.28.7] - 2026-08-02
 
 ### Changes

package/README.md

@@ -2,7 +2,7 @@
 
 [![CI](https://github.com/mgd34msu/goodvibes-daemon/actions/workflows/ci.yml/badge.svg)](https://github.com/mgd34msu/goodvibes-daemon/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
-[![Version](https://img.shields.io/badge/version-1.28.7-blue.svg)](https://github.com/mgd34msu/goodvibes-daemon)
+[![Version](https://img.shields.io/badge/version-1.28.10-blue.svg)](https://github.com/mgd34msu/goodvibes-daemon)
 
 The GoodVibes daemon: one long-running process per machine that holds the control plane every
 GoodVibes client talks to. It answers the operator verb families over HTTP, reads and replies on

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pellux/goodvibes-daemon",
-  "version": "1.28.7",
+  "version": "1.28.10",
   "description": "The GoodVibes daemon \u2014 the one long-running host for the control plane, channels, cluster membership, scheduled work, knowledge and memory stores, and the verb families every GoodVibes client calls.",
   "type": "module",
   "main": "src/daemon/cli.ts",
@@ -65,8 +65,8 @@
     "@anthropic-ai/bedrock-sdk": "^0.28.1",
     "@anthropic-ai/sdk": "^0.82.0",
     "@ast-grep/napi": "^0.42.0",
-    "@pellux/goodvibes-sdk": "2.0.5",
-    "@pellux/goodvibes-terminal-shell": "2.0.5",
+    "@pellux/goodvibes-sdk": "2.0.8",
+    "@pellux/goodvibes-terminal-shell": "2.0.8",
     "bash-language-server": "^5.6.0",
     "fuse.js": "^7.1.0",
     "graphql": "^16.13.2",

package/src/runtime/runtime-services-types.ts

@@ -102,6 +102,13 @@ export interface RuntimeServicesOptions {
 export interface RuntimeServices {
   readonly workingDirectory: string;
   readonly homeDirectory: string;
+  /**
+   * The `.goodvibes/<surface root>/` segment this daemon's own state lives
+   * under — always GOODVIBES_DAEMON_SURFACE_ROOT here (config/surface.ts).
+   * Declared so a consumer ASKS for it instead of deriving a second one; the
+   * unscoped pre-split control-plane store is what deriving it twice produced.
+   */
+  readonly surfaceRoot: string;
   /** The declare-once session-storage handle every session reader and writer threads through. */
   readonly surface: SessionSurface;
   readonly shellPaths: ShellPathService;

package/src/runtime/services.ts

@@ -2,9 +2,10 @@ import { join } from 'node:path';
 import { ServiceRegistry, SubscriptionManager, ToolLLM } from '@pellux/goodvibes-sdk/platform/config';
 import { AutomationDeliveryManager, AutomationManager } from '@pellux/goodvibes-sdk/platform/automation';
 import { ChannelPolicyManager } from '@pellux/goodvibes-sdk/platform/channels';
-import { ApprovalBroker, GatewayMethodCatalog, SharedSessionBroker, buildSharedSessionAgentSpawnRoutingInput } from '@pellux/goodvibes-sdk/platform/control-plane';
+import { ApprovalBroker, GatewayMethodCatalog, SharedSessionBroker, buildSharedSessionAgentSpawnRoutingInput, controlPlaneStorePath } from '@pellux/goodvibes-sdk/platform/control-plane';
 import { AcpHostService } from '@pellux/goodvibes-sdk/platform/acp';
 import { continuationChainOptions } from '@pellux/goodvibes-sdk/platform/agents';
+import { PersonalCaptureHolder, conversationalTurnSpawnOptions } from '@pellux/goodvibes-sdk/platform/personal-capture';
 import { resolvePairingWebOrigin } from '@pellux/goodvibes-sdk/platform/pairing';
 import { attachWsOnlyGatewayVerbHandlers } from '@pellux/goodvibes-terminal-shell';
 import { composeMailDeps } from './mail-composition.ts';
@@ -131,7 +132,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   const { secretsManager, stepUpService, pairingTokens } = composeCredentialServices({
     workingDirectory, homeDirectory, configManager,
     daemonHomeDirectory: options.daemonHomeDirectory,
-    pairingTokenPath: shellPaths.resolveUserPath('control-plane', 'pairing-tokens.json'),
+    pairingTokenPath: controlPlaneStorePath(shellPaths, GOODVIBES_DAEMON_SURFACE_ROOT, 'pairing-tokens.json'),
   });
   const subscriptionManager = new SubscriptionManager(shellPaths.resolveUserPath(GOODVIBES_DAEMON_SURFACE_ROOT, 'subscriptions.json'));
   const serviceRegistry = new ServiceRegistry(shellPaths.resolveProjectPath(GOODVIBES_DAEMON_SURFACE_ROOT, 'services.json'), {
@@ -205,6 +206,13 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   } = createAgentGraph({
     runtimeBus: options.runtimeBus, workingDirectory, configManager, providerRegistry,
   });
+  // The one late-binding holder for the personal-capture port. The gateway verb
+  // groups fill it (they own the owner-profile store and the occasions service),
+  // and the agent orchestrator reads it when it builds a run's tool registry.
+  // Registration happens before setDependencies in this file, but the registry
+  // is built per run, so by the time a conversational turn asks for `profile`
+  // the port is already in place.
+  const personalCapture = new PersonalCaptureHolder();
   const hookDispatcher = new HookDispatcher({ agentManager, toolLLM, projectRoot: workingDirectory }, hookActivityTracker);
   configManager.attachHookDispatcher(hookDispatcher);
   const hookWorkbench = createHookWorkbench({
@@ -238,11 +246,23 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
           getCategory: (name: string) => configManager.getCategory(name as never),
         },
       }),
+      // What the answering agent is given and what it is told. `restrictTools:
+      // true` with no tool list used to mean an EMPTY registry: the agent could
+      // emit text and nothing else, which is why a trip pasted into a channel
+      // was answered and stored nowhere. This names the tools a conversational
+      // turn actually needs (read, find, fetch, and the `profile` capture tool),
+      // supplies the instruction that makes recording part of answering, and
+      // carries the write authority for the surface the message arrived on.
+      // It also supplies the run's context, which is why the bare
+      // `context: shared-session:<id>` line that used to sit below is gone.
+      // Spread BEFORE the routing builder so an explicit tool list coming from
+      // a routing intent still wins — that builder emits `tools` only when it
+      // actually has one.
+      ...conversationalTurnSpawnOptions(input, { configReader: configManager }),
       // Spawn routing through the SDK's shared model-reference resolver
       // (unique-across-registry auto-qualifies; ambiguous and unknown ids throw
       // errors naming real candidates), against the live registry's models.
       ...buildSharedSessionAgentSpawnRoutingInput(input.routing, { restrictTools: true, modelCandidates: providerRegistry.listModels() }),
-      context: `shared-session:${input.sessionId}`,
     });
     return { agentId: record.id };
   });
@@ -506,11 +526,22 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   // calendar.*/email.* are platform-served; these two let it register (mail-composition.ts).
   const { emailServiceDeps, describeEmailConfigProblem } = composeMailDeps({ configManager, secretsManager });
   attachWsOnlyGatewayVerbHandlers(gatewayMethods, {
+    // The surface segment every control-plane store path is built from
+    // (SDK control-plane-store-paths.ts). Required, not defaulted: a default
+    // is what let these stores write to the unscoped orphan directory.
+    surfaceRoot: GOODVIBES_DAEMON_SURFACE_ROOT,
     homeDirectory, emailServiceDeps, describeEmailConfigProblem, processRegistry,
     // The registration-gated surface, not the raw manager: an explicit create in
     // an unregistered workspace refuses with something actionable.
     workspaceCheckpointManager: checkpointing.gatewayManager,
     conversationRewindPort: createSessionConversationRewindPort(), sessionBroker, secretsManager, stepUpService,
+    // Fills the capture port with the owner-profile store and the occasions
+    // service, so the `profile` tool a conversational turn is given has
+    // somewhere real to write.
+    personalCapture,
+    // The session intake attributes a sender on this policy's owner allowlist
+    // to the owner principal instead of unknown.
+    channelPolicy,
     approvalBroker, requestApproval: (input) => approvalBroker.requestApproval(input),
     // approvals.raise — a surface CREATING an ask in this broker. Without it the
     // verb is cataloged and unhandled, and a client whose prompt runs outside
@@ -596,6 +627,9 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     sandboxSessionRegistry,
     workflowServices: workflow,
     contextAccountingHolder,
+    // Without this the `profile` tool is never registered, and a conversational
+    // turn that was told to record what the owner said has nothing to call.
+    personalCapture,
   });
 
   // Continuity reads (recovery-file presence, last-session pointer) scoped to
@@ -628,6 +662,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   const services: RuntimeServices = {
     workingDirectory,
     homeDirectory,
+    surfaceRoot: GOODVIBES_DAEMON_SURFACE_ROOT,
     surface,
     shellPaths,
     workspaceTrustManager,

package/src/runtime/trust/checkpoint-eligibility.ts

@@ -1,4 +1,5 @@
 import { existsSync, readFileSync } from 'node:fs';
+import { resolveWorkspaceRegisterReadPath } from '@pellux/goodvibes-sdk/platform/workspace';
 import type { ShellPathService } from '@/runtime/index.ts';
 import {
   normalizeWorkspaceRoot,
@@ -30,9 +31,24 @@ import {
 
 export type StoreShellPaths = Pick<ShellPathService, 'resolveUserPath' | 'homeDirectory'>;
 
-/** Path of the shared store's JSON document — the same path the SDK's gateway verb group constructs its own store over. */
+/**
+ * Path of the shared store's JSON document — the same path the SDK's gateway
+ * verb group constructs its own store over.
+ *
+ * "The same path" is the whole contract, and it is why this goes through the
+ * SDK's resolver rather than spelling any location out. goodvibes-agent reads
+ * and writes this same file directly and the SDK's gateway writes it, so the
+ * register is cross-product state rather than the daemon's own — it lives in
+ * the shared tier (~/.goodvibes/shared/), which takes no surface root, so all
+ * three resolve one identical path. Until the boot fold has moved it, the
+ * resolver falls back to the pre-split location read-only, so this reader never
+ * reports an empty register and silently refuses every checkpoint.
+ */
 export function sharedWorkspaceRegistrationStorePath(shellPaths: StoreShellPaths): string {
-  return shellPaths.resolveUserPath('control-plane', 'workspace-registrations.json');
+  // READ path: the shared tier when it is there, the pre-split location until
+  // the daemon's boot fold has moved it. This is a reader, so the fallback is
+  // read-only and nothing here ever writes to the legacy address.
+  return resolveWorkspaceRegisterReadPath(shellPaths, existsSync);
 }
 
 function isRecord(value: unknown): value is Record<string, unknown> {

package/src/version.ts

@@ -6,7 +6,7 @@ import { join } from 'node:path';
 // The prebuild script updates the fallback value before compilation.
 // Uses import.meta.dir (Bun) to locate package.json relative to this file,
 // which is correct regardless of the process working directory.
-let _version = '1.28.7';
+let _version = '1.28.10';
 try {
   const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', 'package.json'), 'utf-8'));
   // Only trust a version read from OUR OWN package.json. A Bun single-file