@pellux/goodvibes-tui 1.1.0 → 1.9.0

package/src/runtime/onboarding/types.ts

@@ -125,6 +125,29 @@ export interface OnboardingSurfacesSnapshot {
   readonly records: readonly OnboardingSurfaceRecord[];
 }
 
+/**
+ * W4-D1 wizard wiring: read-only detection of a legacy `goodvibes-daemon.service`
+ * systemd unit (see `../legacy-daemon-migration.ts`'s `LegacyUnitInfo`), carried
+ * on the snapshot so the Network step can show the guided migration action only
+ * when there is actually something to migrate. Never implies anything was
+ * touched — detection only.
+ */
+export interface OnboardingLegacyDaemonSnapshot {
+  readonly present: boolean;
+  readonly active: boolean;
+  readonly path: string;
+  /**
+   * F2 follow-up: the unit name this tool actually manages on this host,
+   * resolved from the `service.serviceName` config key at snapshot-collection
+   * time (`resolveConfiguredServiceName`, `../legacy-daemon-migration.ts`) —
+   * so the wizard's detection banner names the real unit instead of the
+   * hardcoded default. Optional so snapshots built without config access
+   * (fallbacks, older fixtures) stay valid; readers fall back to
+   * `MANAGED_SERVICE_NAME`.
+   */
+  readonly trackedServiceName?: string;
+}
+
 export interface OnboardingProviderAccountRecord {
   readonly providerId: string;
   readonly configured: boolean;
@@ -170,7 +193,8 @@ export type OnboardingSnapshotCollectionIssueArea =
   | 'secrets-records'
   | 'surfaces'
   | 'provider-accounts'
-  | 'acknowledgements';
+  | 'acknowledgements'
+  | 'legacy-daemon';
 
 export interface OnboardingSnapshotCollectionIssue {
   readonly area: OnboardingSnapshotCollectionIssueArea;
@@ -190,6 +214,7 @@ export interface OnboardingSnapshotState {
   readonly bindSettings: OnboardingBindSettingsSnapshot;
   readonly surfaces: OnboardingSurfacesSnapshot;
   readonly providerAccounts: OnboardingProviderAccountsSnapshot | null;
+  readonly legacyDaemon: OnboardingLegacyDaemonSnapshot;
   readonly collectionIssues: readonly OnboardingSnapshotCollectionIssue[];
 }
 
@@ -377,6 +402,10 @@ export interface OnboardingProviderAccountReadHelper {
   loadSnapshot(): Promise<OnboardingProviderAccountsSnapshot>;
 }
 
+export interface OnboardingLegacyDaemonReadHelper {
+  detect(): OnboardingLegacyDaemonSnapshot | Promise<OnboardingLegacyDaemonSnapshot>;
+}
+
 export type OnboardingShellPaths = Pick<
   ShellPathService,
   'workingDirectory' | 'resolveProjectPath' | 'resolveUserPath'
@@ -391,6 +420,7 @@ export interface OnboardingSnapshotDependencies {
   readonly services: Pick<ServiceInspectionQuery, 'getAll' | 'inspect'>;
   readonly surfaces?: OnboardingSurfaceReadHelper;
   readonly providerAccounts?: OnboardingProviderAccountReadHelper;
+  readonly legacyDaemon?: OnboardingLegacyDaemonReadHelper;
   readonly shellPaths?: OnboardingShellPaths;
   readonly acknowledgementScope?: OnboardingStateScope;
 }

package/src/runtime/operator-token-cleanup.ts

@@ -11,7 +11,11 @@
  * the new path will be inspected on the next daemon boot.
  */
 
-import { join } from 'node:path';
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { randomBytes } from 'node:crypto';
+import { dirname, join } from 'node:path';
+import { getOrCreateCompanionToken } from '@pellux/goodvibes-sdk/platform/pairing';
+import type { CompanionPairingResult } from '@pellux/goodvibes-sdk/platform/pairing';
 
 /**
  * Return the list of absolute operator-tokens.json paths the TUI may have written
@@ -26,3 +30,80 @@ export function workspaceOperatorTokenCandidates(workingDirectory: string): read
     join(workingDirectory, '.goodvibes', 'tui', 'operator-tokens.json'),
   ];
 }
+
+/**
+ * F1 (adopt-an-already-running-external-daemon): resolve the operator/companion
+ * token this TUI process uses to authenticate with its daemon, honoring
+ * `GOODVIBES_DAEMON_TOKEN` as a non-interactive override.
+ *
+ * Without this override, the only way to make a TUI instance adopt an
+ * already-running external daemon that used an out-of-band or explicit token
+ * (rather than one derived from `getOrCreateCompanionToken` under a *shared*
+ * home directory) was to hand-write `<daemonHomeDir>/operator-tokens.json`
+ * before startup — there was no env var or CLI flag equivalent.
+ *
+ * `GOODVIBES_DAEMON_TOKEN` is already the documented env var `bin/goodvibes-daemon`
+ * honors for its own bearer token (see `src/daemon/cli.ts`'s `readDaemonCliTokens`)
+ * and the one `src/verification/live-verifier.ts`'s `readDaemonToken` already falls
+ * back to when probing a daemon's HTTP surface from the outside. Reusing the same
+ * name here means one env var configures both sides of an adopted-daemon setup —
+ * start the daemon with `GOODVIBES_DAEMON_TOKEN=<token>` and point the TUI at it
+ * with the same `GOODVIBES_DAEMON_TOKEN=<token>` plus
+ * `--config controlPlane.host=<host> --config controlPlane.port=<port>` — instead
+ * of introducing a second, TUI-only flag.
+ *
+ * When the override is set and does not already match the on-disk record, the
+ * file is rewritten so the override becomes durable for this home directory
+ * (an existing peerId is kept when present, so companion-pairing identity does
+ * not needlessly churn). Falls back to the existing `getOrCreateCompanionToken`
+ * behavior — read the existing file, or mint a fresh random token — when the
+ * override is unset.
+ *
+ * @param explicitToken - Takes precedence over `GOODVIBES_DAEMON_TOKEN` when
+ * provided. Used by the onboarding wizard's "connect to an existing daemon"
+ * action (a pasted token) so it shares this exact persistence logic with the
+ * env-var path instead of duplicating it.
+ */
+export function resolveDaemonCompanionToken(daemonHomeDir: string, explicitToken?: string): CompanionPairingResult {
+  const override = explicitToken?.trim() || process.env.GOODVIBES_DAEMON_TOKEN?.trim();
+  if (!override) return getOrCreateCompanionToken('tui', { daemonHomeDir });
+
+  const tokenPath = join(daemonHomeDir, 'operator-tokens.json');
+  let existingPeerId: string | undefined;
+  let existingCreatedAt: number | undefined;
+  if (existsSync(tokenPath)) {
+    try {
+      const record = JSON.parse(readFileSync(tokenPath, 'utf-8')) as {
+        token?: unknown;
+        peerId?: unknown;
+        createdAt?: unknown;
+      };
+      if (typeof record.token === 'string' && record.token === override) {
+        return {
+          token: override,
+          peerId: typeof record.peerId === 'string' ? record.peerId : randomBytes(12).toString('hex'),
+          createdAt: typeof record.createdAt === 'number' ? record.createdAt : Date.now(),
+        };
+      }
+      if (typeof record.peerId === 'string') existingPeerId = record.peerId;
+      if (typeof record.createdAt === 'number') existingCreatedAt = record.createdAt;
+    } catch {
+      // Malformed on-disk record — fall through and rewrite it with the override.
+    }
+  }
+
+  const record: CompanionPairingResult = {
+    token: override,
+    peerId: existingPeerId ?? randomBytes(12).toString('hex'),
+    createdAt: existingCreatedAt ?? Date.now(),
+  };
+  try {
+    mkdirSync(dirname(tokenPath), { recursive: true });
+    writeFileSync(tokenPath, JSON.stringify(record, null, 2), { encoding: 'utf-8', mode: 0o600 });
+    chmodSync(tokenPath, 0o600);
+  } catch {
+    // Best-effort persistence — the override still applies for this process
+    // even if the file could not be written (e.g. a read-only home directory).
+  }
+  return record;
+}

package/src/runtime/orchestrator-core-services.ts

@@ -0,0 +1,59 @@
+import type { OrchestratorCoreServices } from '@pellux/goodvibes-sdk/platform/core';
+import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
+import type { ProviderRegistry } from '@pellux/goodvibes-sdk/platform/providers';
+import type { RuntimeServices } from './services.ts';
+import { isCodeInjectionSettingEnabled } from './code-index-services.ts';
+
+/** The slice of the runtime services bag the shared orchestrator payload draws from. */
+export type OrchestratorCoreServicesSource = Pick<
+  RuntimeServices,
+  | 'planManager'
+  | 'adaptivePlanner'
+  | 'sessionMemoryStore'
+  | 'sessionLineageTracker'
+  | 'idempotencyStore'
+  | 'memoryRegistry'
+  | 'codeIndexStore'
+  | 'codeIndexReindexScheduler'
+>;
+
+/**
+ * The single source of truth for the `Orchestrator.setCoreServices()` payload
+ * fields shared by BOTH call sites (runtime/bootstrap.ts and main.ts). Each
+ * site spreads this and adds its own site-specific extras (bootstrap:
+ * cacheHitTracker; main: favoritesStore) — setCoreServices() merges, so the
+ * later main.ts call only overlays, never erases.
+ *
+ * Wave-5 (wo805) BLOCKER regression guard: `memoryRegistry` here is what turns
+ * on per-turn passive knowledge injection for the MAIN interactive session —
+ * the SDK turn loop hard-gates on `coreServices.memoryRegistry` (undefined is
+ * a silent no-op: Orchestrator.getTurnInjections() stays empty forever and
+ * `/recall injections` renders a misleading empty state). Both call sites once
+ * omitted it independently; routing them through this one function (with
+ * src/test/runtime/orchestrator-core-services.test.ts pinning the field) is
+ * what keeps that from regressing.
+ */
+export function buildSharedOrchestratorCoreServices(input: {
+  readonly services: OrchestratorCoreServicesSource;
+  readonly configManager: ConfigManager;
+  readonly providerRegistry: ProviderRegistry;
+}): OrchestratorCoreServices {
+  const { services, configManager, providerRegistry } = input;
+  return {
+    configManager,
+    providerRegistry,
+    planManager: services.planManager,
+    adaptivePlanner: services.adaptivePlanner,
+    sessionMemoryStore: services.sessionMemoryStore,
+    sessionLineageTracker: services.sessionLineageTracker,
+    idempotencyStore: services.idempotencyStore,
+    memoryRegistry: services.memoryRegistry,
+    // Wave-5 Stage B — main-session code auto-injection + tool-site reindex. Injection is
+    // additionally gated by the default-off `agent-passive-code-injection` flag inside the
+    // SDK; here we supply the source, the live storage.codeIndexEnabled predicate, and the
+    // reindex scheduler.
+    codeIndex: services.codeIndexStore,
+    isCodeInjectionSettingEnabled: () => isCodeInjectionSettingEnabled(configManager),
+    codeIndexReindexScheduler: services.codeIndexReindexScheduler,
+  };
+}

package/src/runtime/process-lifecycle.ts

@@ -34,6 +34,8 @@ export interface ProcessLifecycleAnsi {
   readonly KEYBOARD_EXT_DISABLE: string;
   readonly MOUSE_DISABLE: string;
   readonly CURSOR_SHOW: string;
+  /** Disables terminal focus-event reporting (DECSET ?1004l) — see main.ts FOCUS_ENABLE. */
+  readonly FOCUS_DISABLE: string;
 }
 
 export interface ProcessLifecycleDeps {
@@ -128,7 +130,7 @@ export function installProcessLifecycle(deps: ProcessLifecycleDeps): ProcessLife
     if (terminalRestored) return;
     terminalRestored = true;
     const exitScreen = noAltScreen ? ansi.CLEAR_SCREEN : ansi.CLEAR_SCREEN + ansi.ALT_SCREEN_EXIT;
-    allowTerminalWrite(() => stdout.write(ansi.PASTE_DISABLE + ansi.KEYBOARD_EXT_DISABLE + ansi.MOUSE_DISABLE + ansi.CURSOR_SHOW + exitScreen));
+    allowTerminalWrite(() => stdout.write(ansi.PASTE_DISABLE + ansi.KEYBOARD_EXT_DISABLE + ansi.MOUSE_DISABLE + ansi.FOCUS_DISABLE + ansi.CURSOR_SHOW + exitScreen));
     getTerminalOutputGuard().dispose();
     try { stdin.setRawMode(false); } catch { /* stdin may not be a TTY */ }
   };

package/src/runtime/resume-notice.ts

@@ -0,0 +1,209 @@
+/**
+ * resume-notice.ts — the boot-time "previous session found" transcript notice.
+ *
+ * UX-D item 1: a supervision-journey audit of 1.7.0 found that the TUI
+ * accumulates rich resumable state on disk (a saved conversation, workspace
+ * checkpoints, WRFC chain history) but never surfaces any of it at startup —
+ * an operator has no way to know it exists short of already knowing the
+ * right command. This module builds ONE compact, honest system-message block
+ * printed after the splash and before the first prompt, summarizing exactly
+ * what real state exists and how to reach it.
+ *
+ * Honesty constraints (verified against the actual runtime, not assumed):
+ *   - There is no bare `/resume` command and no `/sessions` command (a
+ *     pre-existing typo already lives in the splash's own hint at
+ *     utils/splash-lines.ts — out of scope here, splash stays byte-identical).
+ *     The real, working command is `/session resume <id|name>` — it always
+ *     requires an explicit target. So this notice advertises
+ *     `/session resume <id>` with the real last-session id substituted in,
+ *     never a bare `/resume`.
+ *   - `/checkpoints` works with zero arguments and behaves correctly at any
+ *     checkpoint count (including zero) — advertised whenever the checkpoint
+ *     manager is available in this session.
+ *   - `/recall` (memory) is only advertised when the memory API is actually
+ *     wired up in this session (context.clients?.knowledgeApi?.memory) —
+ *     some runtimes don't have it, and claiming it works there would not be
+ *     honest.
+ *   - Every clause is independently gated on real data: a claim about
+ *     checkpoints/chain history is only made when that data is known; "no
+ *     chain history" means no chain clause is printed, not a fabricated one.
+ */
+
+import { readLastSessionPointer } from '@/runtime/index.ts';
+import type { WrfcChain } from '@pellux/goodvibes-sdk/platform/agents';
+import type { SessionManager } from '@pellux/goodvibes-sdk/platform/sessions';
+import type { WorkspaceCheckpointManager } from '@pellux/goodvibes-sdk/platform/workspace';
+import type { SystemMessageRouter } from '../core/system-message-router.ts';
+
+// ─── Chain outcome ───────────────────────────────────────────────────────────
+
+/**
+ * Honest, human-facing outcome of a WRFC chain, derived from real chain
+ * state rather than guessed. `chain.state` alone cannot distinguish a
+ * user-cancelled chain from an ordinary review/gate failure. The SDK now
+ * records that distinction first-class as `chain.failureKind` ('cancelled'
+ * vs 'transport'/'other'), set by cancelChain()/failChain(), so that field
+ * is the primary source of truth. Snapshots persisted before the field
+ * existed lack it; for those we fall back to the owner-decision log, where
+ * cancelChain() also records a `chain_cancelled` decision. A chain still
+ * non-terminal after rehydrate's zombie-reap check (see wrfc-persistence.ts)
+ * is reported as 'interrupted' — re-imported and live again, not history.
+ */
+export type ChainOutcome = 'passed' | 'failed' | 'cancelled' | 'interrupted';
+
+/** Terminal WRFC states (mirrors wrfc-persistence.ts's own TERMINAL_STATES). */
+function isTerminalState(state: WrfcChain['state']): boolean {
+  return state === 'passed' || state === 'failed';
+}
+
+export function describeChainOutcome(chain: WrfcChain): ChainOutcome {
+  if (!isTerminalState(chain.state)) return 'interrupted';
+  if (chain.state === 'passed') return 'passed';
+  // Primary: the SDK's first-class failureKind, authoritative for chains
+  // failed/cancelled under the current SDK.
+  if (chain.failureKind === 'cancelled') return 'cancelled';
+  // Fallback for pre-failureKind snapshots: consult the owner-decision log,
+  // where cancelChain() records a chain_cancelled decision.
+  if (chain.failureKind === undefined) {
+    const lastAction = chain.ownerDecisions.length > 0 ? chain.ownerDecisions[chain.ownerDecisions.length - 1]?.action : undefined;
+    if (lastAction === 'chain_cancelled') return 'cancelled';
+  }
+  return 'failed';
+}
+
+/** Pick the most recently completed (or, if still interrupted, most recently created) chain from a set. Null if the set is empty. */
+export function mostRecentChain(chains: readonly WrfcChain[]): WrfcChain | null {
+  if (chains.length === 0) return null;
+  return [...chains].sort((a, b) => (b.completedAt ?? b.createdAt ?? 0) - (a.completedAt ?? a.createdAt ?? 0))[0]!;
+}
+
+// ─── Notice text ─────────────────────────────────────────────────────────────
+
+export interface ResumeNoticeFacts {
+  /** Number of user turns in the last saved session. Null when there is no prior session (or it could not be read). */
+  readonly turnCount: number | null;
+  /** Session id of the last saved session — needed to build a truthful, directly-runnable resume hint. Null when there is no prior session. */
+  readonly lastSessionId: string | null;
+  /** Number of workspace checkpoints. Null when the checkpoint manager is unavailable in this session (not the same as zero). */
+  readonly checkpointCount: number | null;
+  /** Outcome of the most recently known WRFC chain. Null when there is no chain history at all. */
+  readonly lastChainOutcome: ChainOutcome | null;
+  /** Whether /recall (memory) is wired up in this session. */
+  readonly memoryAvailable: boolean;
+}
+
+function plural(n: number, word: string): string {
+  return `${n} ${word}${n === 1 ? '' : 's'}`;
+}
+
+/**
+ * Build the boot resume notice text, or null when there is nothing to
+ * report (no prior session, no checkpoints ever taken, no chain history —
+ * a clean/new working directory prints nothing, respecting quiet startup).
+ */
+export function buildResumeNotice(facts: ResumeNoticeFacts): string | null {
+  const hasSession = facts.lastSessionId !== null && facts.turnCount !== null;
+  const checkpointsKnown = facts.checkpointCount !== null;
+  const checkpointCount = facts.checkpointCount ?? 0;
+  const hasCheckpoints = checkpointsKnown && checkpointCount > 0;
+  const hasChainHistory = facts.lastChainOutcome !== null;
+
+  if (!hasSession && !hasCheckpoints && !hasChainHistory) return null;
+
+  const summary: string[] = [];
+  if (hasSession) summary.push(plural(facts.turnCount!, 'turn'));
+  // Show the checkpoint count whenever it's knowable and there's a reason to
+  // (anchored to an existing session, or checkpoints genuinely exist even
+  // without one) — never guessed when the manager is unavailable.
+  if (checkpointsKnown && (hasSession || hasCheckpoints)) summary.push(plural(checkpointCount, 'checkpoint'));
+  if (hasChainHistory) summary.push(`last chain: ${facts.lastChainOutcome}`);
+
+  const lead = hasSession ? 'Previous session found' : 'Workspace history found';
+  let notice = `${lead}: ${summary.join(', ')}`;
+
+  const hints: string[] = [];
+  // No bare `/resume` exists — /session resume always requires a target.
+  if (hasSession) hints.push(`/session resume ${facts.lastSessionId} to continue`);
+  if (hasCheckpoints) hints.push('/checkpoints to browse');
+  if (facts.memoryAvailable) hints.push('/recall for memory');
+  if (hints.length > 0) notice += ` — ${hints.join(' · ')}`;
+
+  return notice;
+}
+
+// ─── Fact gathering (I/O) ────────────────────────────────────────────────────
+
+export interface ResumeNoticeDeps {
+  readonly workingDirectory: string;
+  readonly homeDirectory: string;
+  /** Surface root used by session persistence — the TUI always uses 'tui'. */
+  readonly surfaceRoot: string;
+  /** Only `load()` is needed — kept narrow for testability. */
+  readonly sessionManager: Pick<SessionManager, 'load'>;
+  /** Undefined when checkpoints are not wired up in this session at all. Only `list()` is needed. */
+  readonly checkpointManager: Pick<WorkspaceCheckpointManager, 'list'> | undefined;
+  /** The full known-chain set from WrfcPersistence.knownChains, gathered post-rehydrate. */
+  readonly chainHistory: readonly WrfcChain[];
+  readonly memoryAvailable: boolean;
+  readonly router: Pick<SystemMessageRouter, 'high'>;
+}
+
+/**
+ * Read the last session's real turn count from its saved JSONL file. A user
+ * turn is one stored message with role 'user' — the number of times the
+ * operator spoke, which is what "N turns" means to a human reading the
+ * notice (as opposed to a raw message count, which double-counts replies).
+ * Returns null when there is no last-session pointer, or the pointed-to
+ * session file is missing/corrupt — never a claim about a session that
+ * cannot actually be resumed.
+ */
+function readLastSessionTurns(deps: Pick<ResumeNoticeDeps, 'workingDirectory' | 'homeDirectory' | 'surfaceRoot' | 'sessionManager'>): { turnCount: number; lastSessionId: string } | null {
+  const lastSessionId = readLastSessionPointer({
+    workingDirectory: deps.workingDirectory,
+    homeDirectory: deps.homeDirectory,
+    surfaceRoot: deps.surfaceRoot,
+  });
+  if (!lastSessionId) return null;
+  try {
+    const { messages } = deps.sessionManager.load(lastSessionId);
+    const turnCount = messages.filter((m) => (m as { role?: unknown }).role === 'user').length;
+    return { turnCount, lastSessionId };
+  } catch {
+    // Pointer file present but the session it points to is gone/corrupt —
+    // there is nothing truthful to resume.
+    return null;
+  }
+}
+
+async function readCheckpointCount(mgr: ResumeNoticeDeps['checkpointManager']): Promise<number | null> {
+  if (!mgr) return null;
+  try {
+    return (await mgr.list()).length;
+  } catch {
+    // Checkpoint manager present but its cached init() rejection makes every
+    // call fail forever (see services.ts) — treat as "unknown", not zero.
+    return null;
+  }
+}
+
+/**
+ * Gather real facts from disk/services and, if there is anything to report,
+ * print ONE compact system message via `deps.router.high`. No-op (and no
+ * message) when there is no prior session, no checkpoints, and no chain
+ * history — a fresh working directory stays quiet.
+ */
+export async function announceResumeState(deps: ResumeNoticeDeps): Promise<void> {
+  const session = readLastSessionTurns(deps);
+  const checkpointCount = await readCheckpointCount(deps.checkpointManager);
+  const lastChain = mostRecentChain(deps.chainHistory);
+
+  const notice = buildResumeNotice({
+    turnCount: session?.turnCount ?? null,
+    lastSessionId: session?.lastSessionId ?? null,
+    checkpointCount,
+    lastChainOutcome: lastChain ? describeChainOutcome(lastChain) : null,
+    memoryAvailable: deps.memoryAvailable,
+  });
+
+  if (notice) deps.router.high(notice);
+}