@pellux/goodvibes-tui 0.19.19 → 0.19.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pellux/goodvibes-tui",
-  "version": "0.19.19",
+  "version": "0.19.20",
   "description": "Terminal-native GoodVibes product for coding, operations, automation, knowledge, channels, and daemon-backed control-plane workflows.",
   "type": "module",
   "main": "src/main.ts",
@@ -90,7 +90,7 @@
     "@anthropic-ai/vertex-sdk": "^0.16.0",
     "@ast-grep/napi": "^0.42.0",
     "@aws/bedrock-token-generator": "^1.1.0",
-    "@pellux/goodvibes-sdk": "0.21.35",
+    "@pellux/goodvibes-sdk": "0.21.36",
     "bash-language-server": "^5.6.0",
     "fuse.js": "^7.1.0",
     "graphql": "^16.13.2",

package/src/daemon/cli.ts

@@ -12,11 +12,13 @@ import { GlobalNetworkTransportInstaller } from '@pellux/goodvibes-sdk/platform/
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils/error-display';
 import {
   getOrCreateCompanionToken,
+  pruneStaleOperatorTokens,
   buildCompanionConnectionInfo,
   encodeConnectionPayload,
   formatConnectionBlock,
 } from '@pellux/goodvibes-sdk/platform/pairing/index';
 import { generateQrMatrix, renderQrToString } from '@pellux/goodvibes-sdk/platform/pairing/qr-generator';
+import { workspaceOperatorTokenCandidates } from '../runtime/operator-token-cleanup.ts';
 import {
   scan,
   loadPersistedProviders,
@@ -147,7 +149,20 @@ async function main(): Promise<void> {
   const { daemonToken, httpToken } = readDaemonCliTokens(process.env);
 
   // If no explicit daemon token is set, use the companion token so mobile apps can connect.
-  const companionTokenRecord = getOrCreateCompanionToken('tui', { daemonHomeDir: join(homeDirectory, '.goodvibes', 'daemon') });
+  const daemonHomeDir = join(homeDirectory, '.goodvibes', 'daemon');
+  const companionTokenRecord = getOrCreateCompanionToken('tui', { daemonHomeDir });
+  // F3 resolution (TUI 0.19.20): remove stale pre-0.21.28 workspace-scoped operator
+  // token files so only the canonical <daemonHomeDir>/operator-tokens.json survives.
+  const prune = pruneStaleOperatorTokens({
+    daemonHomeDir,
+    candidatePaths: workspaceOperatorTokenCandidates(workingDir),
+  });
+  if (prune.prunedPaths.length > 0) {
+    logger.info('daemon: pruned stale operator-token files', { count: prune.prunedPaths.length, paths: prune.prunedPaths });
+  }
+  if (prune.failedPaths.length > 0) {
+    logger.warn('daemon: failed to prune stale operator-token files (permission/race)', { count: prune.failedPaths.length, paths: prune.failedPaths });
+  }
   const effectiveDaemonToken = daemonToken ?? companionTokenRecord.token;
   const effectiveHttpToken = httpToken ?? effectiveDaemonToken;
 

package/src/runtime/bootstrap.ts

@@ -36,7 +36,8 @@ import {
 import { startBackgroundProviderRegistration } from '@pellux/goodvibes-sdk/platform/runtime/bootstrap-background';
 import { restoreSavedModel } from '@pellux/goodvibes-sdk/platform/runtime/bootstrap-helpers';
 import { startExternalServices, type ExternalServicesHandle } from '@pellux/goodvibes-sdk/platform/runtime/bootstrap-services';
-import { getOrCreateCompanionToken } from '@pellux/goodvibes-sdk/platform/pairing/companion-token';
+import { getOrCreateCompanionToken, pruneStaleOperatorTokens } from '@pellux/goodvibes-sdk/platform/pairing/companion-token';
+import { workspaceOperatorTokenCandidates } from './operator-token-cleanup.ts';
 import type { UiRuntimeServices } from './ui-services.ts';
 import { createDeferredStartupCoordinator } from '@pellux/goodvibes-sdk/platform/runtime/deferred-startup';
 import { initializeBootstrapCore } from './bootstrap-core.ts';
@@ -331,7 +332,23 @@ export async function bootstrapRuntime(
       // Register the persistent companion-pairing token as the daemon's shared
       // bearer, so tokens scanned from the /qrcode panel's QR actually
       // authenticate against the embedded daemon this surface starts.
-      const companionTokenRecord = getOrCreateCompanionToken('tui', { daemonHomeDir: join(services.homeDirectory, '.goodvibes', 'daemon') });
+      const daemonHomeDir = join(services.homeDirectory, '.goodvibes', 'daemon');
+      const companionTokenRecord = getOrCreateCompanionToken('tui', { daemonHomeDir });
+      // F3 resolution (TUI 0.19.20): remove stale pre-0.21.28 workspace-scoped operator
+      // token files so only the canonical <daemonHomeDir>/operator-tokens.json survives.
+      // The prune is best-effort — it silently skips missing files, no-ops when tokens
+      // already match, and records un-deletable candidates in `failedPaths` for logging.
+      // See `pruneStaleOperatorTokens` in the SDK for semantics.
+      const prune = pruneStaleOperatorTokens({
+        daemonHomeDir,
+        candidatePaths: workspaceOperatorTokenCandidates(services.workingDirectory),
+      });
+      if (prune.prunedPaths.length > 0) {
+        logger.info(`[bootstrap] Pruned ${prune.prunedPaths.length} stale operator-token file(s): ${prune.prunedPaths.join(', ')}`);
+      }
+      if (prune.failedPaths.length > 0) {
+        logger.warn(`[bootstrap] Failed to prune ${prune.failedPaths.length} stale operator-token file(s) (permission/race): ${prune.failedPaths.join(', ')}`);
+      }
       externalServicesPromise = startExternalServices(
         configManager,
         runtimeBus,

package/src/runtime/operator-token-cleanup.ts

@@ -0,0 +1,28 @@
+/**
+ * operator-token-cleanup.ts
+ *
+ * Shared helper that enumerates the legacy workspace-scoped `operator-tokens.json`
+ * locations the TUI has written at various pre-0.21.28 versions. Used by both the
+ * in-process bootstrap path (`src/runtime/bootstrap.ts`) and the standalone daemon
+ * CLI (`src/daemon/cli.ts`) so F3 (stale-token pruning) has a single source of
+ * truth for where to look.
+ *
+ * Adding a new legacy location: append to `workspaceOperatorTokenCandidates` and
+ * the new path will be inspected on the next daemon boot.
+ */
+
+import { join } from 'node:path';
+
+/**
+ * Return the list of absolute operator-tokens.json paths the TUI may have written
+ * at legacy (pre-0.21.28) workspace-scoped locations under `workingDirectory`.
+ *
+ * The canonical, current-SDK location is `<daemonHomeDir>/operator-tokens.json`;
+ * this helper is strictly for legacy-cleanup candidates.
+ */
+export function workspaceOperatorTokenCandidates(workingDirectory: string): readonly string[] {
+  return [
+    join(workingDirectory, '.goodvibes', 'operator-tokens.json'),
+    join(workingDirectory, '.goodvibes', 'tui', 'operator-tokens.json'),
+  ];
+}

package/src/version.ts

@@ -6,7 +6,7 @@ import { join } from 'node:path';
 // The prebuild script updates the fallback value before compilation.
 // Uses import.meta.dir (Bun) to locate package.json relative to this file,
 // which is correct regardless of the process working directory.
-let _version = '0.19.19';
+let _version = '0.19.20';
 try {
   const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', 'package.json'), 'utf-8'));
   _version = pkg.version ?? _version;