@pellux/goodvibes-sdk 0.18.14 → 0.18.15

package/dist/_internal/platform/config/manager.js

@@ -0,0 +1,332 @@
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'fs';
+import { dirname, isAbsolute, join, resolve } from 'path';
+import { DEFAULT_CONFIG, CONFIG_SCHEMA } from '@pellux/goodvibes-sdk/platform/config/schema';
+import { ConfigError } from '@pellux/goodvibes-sdk/platform/types/errors';
+import { logger } from '@pellux/goodvibes-sdk/platform/utils/logger';
+import { getManagedSettingLock } from '../runtime/settings/control-plane.js';
+import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils/error-display';
+const DEFAULT_CONFIG_SNAPSHOT = structuredClone(DEFAULT_CONFIG);
+const PERMISSION_TOOL_KEYS = new Set(Object.keys(DEFAULT_CONFIG.permissions.tools));
+function cloneDefaultConfig() {
+    return structuredClone(DEFAULT_CONFIG_SNAPSHOT);
+}
+function sanitizeConfigShape(config) {
+    const sanitized = structuredClone(config);
+    const lineNumbers = sanitized.display.lineNumbers;
+    if (typeof lineNumbers === 'boolean') {
+        sanitized.display.lineNumbers = lineNumbers ? 'all' : 'off';
+    }
+    for (const key of Object.keys(sanitized.permissions.tools)) {
+        if (!PERMISSION_TOOL_KEYS.has(key)) {
+            delete sanitized.permissions.tools[key];
+        }
+    }
+    return sanitized;
+}
+function requireAbsoluteOwnedPath(path, name) {
+    if (path === undefined)
+        return undefined;
+    const trimmed = path.trim();
+    if (!trimmed) {
+        throw new Error(`ConfigManager ${name} must be a non-empty absolute path.`);
+    }
+    if (!isAbsolute(trimmed)) {
+        throw new Error(`ConfigManager ${name} must be an absolute path.`);
+    }
+    return resolve(trimmed);
+}
+/**
+ * Ensure the shared ~/.goodvibes/goodvibes.json exists (empty object if not).
+ * This is reserved for future cross-app use — no TUI settings go here.
+ */
+function ensureSharedConfig(sharedPath) {
+    if (!existsSync(sharedPath)) {
+        mkdirSync(dirname(sharedPath), { recursive: true });
+        try {
+            writeFileSync(sharedPath, '{}\n', 'utf-8');
+        }
+        catch (err) {
+            logger.debug('Could not create shared goodvibes.json (non-fatal)', { error: summarizeError(err) });
+        }
+    }
+}
+/**
+ * ConfigManager — Layered, mutable, persistent config system.
+ *
+ * Load order: defaults < global TUI settings < project TUI settings < CLI overrides
+ * API keys are never persisted — loaded from env vars only.
+ */
+export class ConfigManager {
+    config;
+    configDir;
+    configPath;
+    projectConfigPath;
+    workingDirectory;
+    homeDirectory;
+    hookDispatcher = null;
+    constructor(overrides) {
+        const roots = overrides;
+        const configDir = requireAbsoluteOwnedPath(roots.configDir, 'configDir');
+        const homeDirectory = requireAbsoluteOwnedPath(roots.homeDir, 'homeDir') ?? null;
+        const workingDirectory = requireAbsoluteOwnedPath(overrides.workingDir, 'workingDir') ?? null;
+        const sharedConfigPath = requireAbsoluteOwnedPath(roots.sharedConfigPath, 'sharedConfigPath');
+        const base = configDir ?? join(homeDirectory, '.goodvibes', 'goodvibes');
+        this.configDir = base;
+        this.configPath = join(base, 'settings.json');
+        this.workingDirectory = workingDirectory;
+        this.homeDirectory = homeDirectory;
+        this.projectConfigPath = this.workingDirectory
+            ? join(this.workingDirectory, '.goodvibes', 'goodvibes', 'settings.json')
+            : null;
+        this.config = cloneDefaultConfig();
+        const ownedSharedConfigPath = sharedConfigPath ?? (this.homeDirectory ? join(this.homeDirectory, '.goodvibes', 'goodvibes.json') : null);
+        if (ownedSharedConfigPath) {
+            ensureSharedConfig(ownedSharedConfigPath);
+        }
+        this.load();
+        // Apply constructor overrides (CLI args, etc.) after load
+        if (overrides.model !== undefined) {
+            this.config.provider.model = overrides.model;
+        }
+        if (overrides.provider !== undefined) {
+            this.config.provider.provider = overrides.provider;
+        }
+        if (overrides.autoApprove !== undefined) {
+            this.config.behavior.autoApprove = overrides.autoApprove;
+        }
+        if (overrides.systemPromptFile !== undefined) {
+            this.config.provider.systemPromptFile = overrides.systemPromptFile;
+        }
+    }
+    getControlPlaneConfigDir() {
+        return this.configDir;
+    }
+    getWorkingDirectory() {
+        return this.workingDirectory;
+    }
+    getHomeDirectory() {
+        return this.homeDirectory;
+    }
+    attachHookDispatcher(hookDispatcher) {
+        this.hookDispatcher = hookDispatcher;
+    }
+    resolvePath(key) {
+        const parts = key.split('.');
+        let cursor = this.config;
+        for (let i = 0; i < parts.length - 1; i++) {
+            const part = parts[i];
+            if (cursor == null || typeof cursor !== 'object' || !(part in cursor)) {
+                throw new Error(`Invalid config path: section '${parts.slice(0, i + 1).join('.')}' does not exist`);
+            }
+            cursor = cursor[part];
+        }
+        if (cursor == null || typeof cursor !== 'object') {
+            throw new Error(`Invalid config path: section '${parts.slice(0, -1).join('.')}' does not exist`);
+        }
+        return {
+            parent: cursor,
+            field: parts[parts.length - 1],
+        };
+    }
+    /** Get a config value by dot-path key. */
+    get(key) {
+        const { parent, field } = this.resolvePath(key);
+        return parent[field];
+    }
+    /** Set a config value by dot-path key and auto-save to disk. */
+    set(key, value, options = {}) {
+        const schema = CONFIG_SCHEMA.find(s => s.key === key);
+        if (schema?.validate && !schema.validate(value)) {
+            throw new ConfigError(`Invalid value for ${key}: ${String(value)}`);
+        }
+        if (schema?.type === 'enum' && schema.enumValues && !schema.enumValues.includes(value)) {
+            throw new ConfigError(`Invalid value for ${key}: "${String(value)}". Allowed: ${schema.enumValues.join(', ')}`);
+        }
+        if (!options.bypassManagedLock) {
+            const lock = getManagedSettingLock(key, this.configDir);
+            if (lock) {
+                throw new ConfigError(`Setting ${key} is locked by ${lock.source}: ${lock.reason}`);
+            }
+        }
+        const { parent, field } = this.resolvePath(key);
+        const previousValue = parent[field];
+        parent[field] = value;
+        this.save();
+        this.emitConfigHook(key, previousValue, value);
+    }
+    /**
+     * Fire the Change:config hook for a config key change.
+     * Best-effort: the hook dispatcher may not be initialised during startup.
+     */
+    emitConfigHook(key, previousValue, newValue) {
+        if (!this.hookDispatcher)
+            return;
+        try {
+            const event = {
+                path: `Change:config:${key}`,
+                phase: 'Change',
+                category: 'config',
+                specific: key,
+                sessionId: '',
+                timestamp: Date.now(),
+                payload: { key, value: newValue, previousValue },
+            };
+            this.hookDispatcher
+                .fire(event)
+                .catch(() => { });
+        }
+        catch {
+            // Dispatcher not ready during startup — safe to ignore
+        }
+    }
+    /**
+     * Set a config value from a validated ConfigKey with unknown value type.
+     * Used when iterating schema entries where the value type cannot be statically
+     * inferred. Runtime validation is still applied by the underlying set() method.
+     */
+    setDynamic(key, value, options = {}) {
+        this.set(key, value, options);
+    }
+    /** Return a deep-readonly snapshot of the full config. Nested objects are immutable. */
+    getAll() {
+        return structuredClone(this.config);
+    }
+    /** Return a deep-cloned snapshot of a config category. */
+    getCategory(category) {
+        return structuredClone(this.config[category]);
+    }
+    /** Return a deep-cloned snapshot of the live config. Safe for read-only external consumers. */
+    getRaw() {
+        return structuredClone(this.config);
+    }
+    /** Return the full schema. */
+    getSchema() {
+        return CONFIG_SCHEMA;
+    }
+    /** Persist current config to global TUI settings file. */
+    save() {
+        try {
+            mkdirSync(dirname(this.configPath), { recursive: true });
+            writeFileSync(this.configPath, JSON.stringify(this.config, null, 2) + '\n', 'utf-8');
+        }
+        catch (err) {
+            logger.debug('Config save failed (non-fatal)', { error: summarizeError(err) });
+        }
+    }
+    /** Persist current config to project-level TUI settings file (.goodvibes/goodvibes/settings.json). */
+    saveProject() {
+        if (!this.projectConfigPath) {
+            throw new Error('ConfigManager.saveProject requires an explicit workingDir.');
+        }
+        try {
+            mkdirSync(dirname(this.projectConfigPath), { recursive: true });
+            writeFileSync(this.projectConfigPath, JSON.stringify(this.config, null, 2) + '\n', 'utf-8');
+        }
+        catch (err) {
+            logger.debug('Project config save failed (non-fatal)', { error: summarizeError(err) });
+        }
+    }
+    /** Load config from disk: global then project (project wins). Deep-merges with defaults. */
+    load() {
+        // Load global settings
+        if (existsSync(this.configPath)) {
+            try {
+                const raw = readFileSync(this.configPath, 'utf-8');
+                const parsed = JSON.parse(raw);
+                this.config = sanitizeConfigShape(deepMerge(cloneDefaultConfig(), parsed));
+            }
+            catch (err) {
+                logger.debug('Global config load failed (non-fatal, using defaults)', { error: summarizeError(err) });
+            }
+        }
+        // Load project settings and deep-merge on top (project wins)
+        if (this.projectConfigPath && existsSync(this.projectConfigPath)) {
+            try {
+                const raw = readFileSync(this.projectConfigPath, 'utf-8');
+                const parsed = JSON.parse(raw);
+                this.config = sanitizeConfigShape(deepMerge(this.config, parsed));
+            }
+            catch (err) {
+                logger.debug('Project config load failed (non-fatal)', { error: summarizeError(err) });
+            }
+        }
+    }
+    /**
+     * Merge a partial patch into a config category and auto-save.
+     *
+     * This is the correct way to update array or object fields within a category
+     * that cannot be expressed as a scalar dot-path key (e.g. notifications.webhookUrls).
+     * The patch is shallow-merged into the existing category value.
+     */
+    mergeCategory(category, patch) {
+        const current = this.config[category];
+        const patchObj = patch;
+        for (const key of Object.keys(patchObj)) {
+            if (patchObj[key] !== undefined) {
+                current[key] = patchObj[key];
+            }
+        }
+        this.save();
+    }
+    /**
+     * Reset a specific key to its default, or reset all config.
+     * Saves to disk after reset.
+     */
+    reset(key) {
+        if (key === undefined) {
+            this.config = cloneDefaultConfig();
+        }
+        else {
+            const schema = CONFIG_SCHEMA.find(s => s.key === key);
+            if (!schema)
+                throw new ConfigError(`Unknown config key: ${key}`);
+            const livePath = this.resolvePath(key);
+            const defaultPath = resolveArbitraryPath(DEFAULT_CONFIG_SNAPSHOT, key);
+            livePath.parent[livePath.field] = structuredClone(defaultPath.parent[defaultPath.field]);
+        }
+        this.save();
+    }
+}
+/** Deep-merge source into target. Returns a new object. Source non-objects are ignored — target clone is returned.
+ * Non-object source values will not overwrite object target values (type-safe merge). */
+function deepMerge(target, source) {
+    const result = isObject(target)
+        ? structuredClone(target)
+        : {};
+    if (!isObject(source))
+        return result;
+    for (const key of Object.keys(source)) {
+        const sv = source[key];
+        const tv = result[key];
+        if (isObject(sv) && isObject(tv)) {
+            result[key] = deepMerge(tv, sv);
+        }
+        else if (sv !== undefined && !isObject(tv)) {
+            // Only overwrite non-object target values — never replace an object with a scalar.
+            // Clone assigned values so config instances never share mutable references.
+            result[key] = structuredClone(sv);
+        }
+    }
+    return result;
+}
+function isObject(val) {
+    return val !== null && typeof val === 'object' && !Array.isArray(val);
+}
+function resolveArbitraryPath(root, key) {
+    const parts = key.split('.');
+    let cursor = root;
+    for (let i = 0; i < parts.length - 1; i++) {
+        const part = parts[i];
+        if (cursor == null || typeof cursor !== 'object' || !(part in cursor)) {
+            throw new Error(`Invalid config path: section '${parts.slice(0, i + 1).join('.')}' does not exist`);
+        }
+        cursor = cursor[part];
+    }
+    if (cursor == null || typeof cursor !== 'object') {
+        throw new Error(`Invalid config path: section '${parts.slice(0, -1).join('.')}' does not exist`);
+    }
+    return {
+        parent: cursor,
+        field: parts[parts.length - 1],
+    };
+}

package/dist/_internal/platform/config/schema-domain-core.js

@@ -528,7 +528,7 @@ export const coreTailConfigSettings = [
         key: 'tools.hooksFile',
         type: 'string',
         default: 'hooks.json',
-        description: 'Hook configuration file name (relative to .goodvibes/tui/)',
+        description: 'Hook configuration file name (relative to .goodvibes/goodvibes/)',
     },
     {
         key: 'wrfc.scoreThreshold',

package/dist/_internal/platform/config/schema-domain-runtime.js

@@ -309,7 +309,7 @@ export const runtimeSecondaryConfigSettings = [
         key: 'service.logPath',
         type: 'string',
         default: '',
-        description: 'File path for daemon/service logs (empty = platform default under .goodvibes/tui/service/)',
+        description: 'File path for daemon/service logs (empty = platform default under .goodvibes/goodvibes/service/)',
     },
     {
         key: 'network.outboundTls.mode',

package/dist/_internal/platform/config/secrets.d.ts

@@ -0,0 +1,89 @@
+/**
+ * SecretsManager — hierarchy-aware secret resolution and persistence.
+ *
+ * Resolution order:
+ *   1. Environment variable (process.env[key])
+ *   2. Project/ancestor secure stores (.goodvibes/goodvibes/secrets.enc), nearest first
+ *   3. Project/ancestor plaintext stores (.goodvibes/goodvibes.secrets.json), nearest first
+ *   4. User secure store (~/.goodvibes/goodvibes/secrets.enc)
+ *   5. User plaintext store (~/.goodvibes/goodvibes.secrets.json)
+ *   6. If a resolved value is a SecretRef, resolve through the referenced provider
+ *
+ * The active policy decides whether plaintext stores are eligible:
+ *   - plaintext_allowed  → read/write plaintext or secure
+ *   - preferred_secure   → prefer secure, allow plaintext fallback with warning
+ *   - require_secure     → never read/write plaintext
+ *
+ * Secret values are never logged.
+ */
+import type { ConfigManager } from './manager.js';
+export type SecretStorageMode = 'plaintext_allowed' | 'preferred_secure' | 'require_secure';
+export type SecretScope = 'project' | 'user';
+export type SecretStorageMedium = 'secure' | 'plaintext';
+export type SecretSource = 'env' | 'project-secure' | 'project-plaintext' | 'user-secure' | 'user-plaintext';
+export interface SecretRecord {
+    readonly key: string;
+    readonly source: SecretSource;
+    readonly scope: SecretScope | 'env';
+    readonly secure: boolean;
+    readonly path?: string;
+    readonly overriddenByEnv: boolean;
+    readonly refSource?: string;
+}
+export interface SecretWriteOptions {
+    readonly scope?: SecretScope;
+    readonly medium?: SecretStorageMedium;
+}
+export interface SecretDeleteOptions {
+    readonly scope?: SecretScope;
+    readonly medium?: SecretStorageMedium;
+}
+export interface SecretStorageReview {
+    readonly policy: SecretStorageMode;
+    readonly secureAvailable: boolean;
+    readonly storedKeys: number;
+    readonly envBackedKeys: number;
+    readonly secureKeys: number;
+    readonly plaintextKeys: number;
+    readonly warnings: readonly string[];
+    readonly locations: readonly {
+        readonly source: Exclude<SecretSource, 'env'>;
+        readonly path: string;
+        readonly exists: boolean;
+        readonly readable: boolean;
+    }[];
+}
+export interface SecretsManagerOptions {
+    readonly projectRoot: string;
+    readonly globalHome: string;
+    readonly configManager?: Pick<ConfigManager, 'get'>;
+    readonly policy?: SecretStorageMode;
+    readonly secureProjectFilePath?: string;
+    readonly secureUserFilePath?: string;
+    readonly plaintextProjectFilePath?: string;
+    readonly plaintextUserFilePath?: string;
+}
+export declare class SecretsManager {
+    private readonly encKey;
+    private readonly options;
+    constructor(options: SecretsManagerOptions);
+    getGlobalHome(): string;
+    get(key: string): Promise<string | null>;
+    private getInternal;
+    private resolveMaybeReferencedValue;
+    set(key: string, value: string, options?: SecretWriteOptions): Promise<void>;
+    list(): Promise<string[]>;
+    listDetailed(): Promise<SecretRecord[]>;
+    inspect(): Promise<SecretStorageReview>;
+    delete(key: string, options?: SecretDeleteOptions): Promise<void>;
+    private getPolicy;
+    private getReadOrder;
+    private getAllCandidateStores;
+    private resolveWriteTarget;
+    private getDefaultWriteMedium;
+    private readEncryptedFile;
+    private writeEncryptedFile;
+    private readPlaintextFile;
+    private writePlaintextFile;
+}
+//# sourceMappingURL=secrets.d.ts.map

package/dist/_internal/platform/config/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/config/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAMH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAKlD,MAAM,MAAM,iBAAiB,GAAG,mBAAmB,GAAG,kBAAkB,GAAG,gBAAgB,CAAC;AAC5F,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;AAC7C,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,WAAW,CAAC;AACzD,MAAM,MAAM,YAAY,GACpB,KAAK,GACL,gBAAgB,GAChB,mBAAmB,GACnB,aAAa,GACb,gBAAgB,CAAC;AAErB,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,KAAK,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;CACvC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;CACvC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,SAAS;QAC3B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;QACzB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;KAC5B,EAAE,CAAC;CACL;AAoBD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IACpD,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAC3C,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CACzC;AAwED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwB;gBAEpC,OAAO,EAAE,qBAAqB;IAa1C,aAAa,IAAI,MAAM;IAIjB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;YAIhC,WAAW;YAqBX,2BAA2B;IA2BnC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;IAwChF,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAYzB,YAAY,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAoCvC,OAAO,IAAI,OAAO,CAAC,mBAAmB,CAAC;IA8BvC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC;IAmB3E,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,YAAY;IA2CpB,OAAO,CAAC,qBAAqB;IAiC7B,OAAO,CAAC,kBAAkB;IAkC1B,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,iBAAiB;IAczB,OAAO,CAAC,kBAAkB;IAO1B,OAAO,CAAC,iBAAiB;IAmBzB,OAAO,CAAC,kBAAkB;CAK3B"}