@pellux/goodvibes-tui 1.13.1 → 1.14.0

package/src/input/commands/platform-access-runtime.ts

@@ -4,6 +4,7 @@ import type { CommandRegistry } from '../command-registry.ts';
 import { VERSION } from '../../version.ts';
 import { listBuiltinSubscriptionProviders } from '@pellux/goodvibes-sdk/platform/config';
 import { handleLocalAuthCommand } from './local-auth-runtime.ts';
+import { registerUpdateCommand } from './update-runtime.ts';
 import { buildAuthInspectionSnapshot, inspectProviderAuth } from '@/runtime/index.ts';
 import { requireProfileManager, requireSecretsManager, requireServiceRegistry, requireShellPaths, requireSubscriptionManager } from './runtime-services.ts';
 
@@ -18,16 +19,6 @@ interface InstallBundle {
   readonly setupLinks: readonly string[];
 }
 
-interface UpdateBundle {
-  readonly version: 1;
-  readonly exportedAt: number;
-  readonly appVersion: string;
-  readonly updateChannel: 'stable' | 'preview';
-  readonly subscriptionProviders: readonly string[];
-  readonly sandboxProfile: string;
-  readonly notes: readonly string[];
-}
-
 interface AuthReviewBundle {
   readonly version: 1;
   readonly exportedAt: number;
@@ -54,17 +45,6 @@ function inspectInstallBundle(bundle: InstallBundle): string {
   ].join('\n');
 }
 
-function inspectUpdateBundle(bundle: UpdateBundle): string {
-  return [
-    'Update Bundle Review',
-    `  appVersion: ${bundle.appVersion}`,
-    `  updateChannel: ${bundle.updateChannel}`,
-    `  subscriptionProviders: ${bundle.subscriptionProviders.length}`,
-    `  sandboxProfile: ${bundle.sandboxProfile}`,
-    `  notes: ${bundle.notes.length}`,
-  ].join('\n');
-}
-
 function inspectAuthBundle(bundle: AuthReviewBundle): string {
   return [
     'Auth Review Bundle',
@@ -189,82 +169,7 @@ export function registerPlatformAccessRuntimeCommands(registry: CommandRegistry)
     },
   });
 
-  registry.register({
-    name: 'update',
-    aliases: ['upgrade'],
-    description: 'Review update posture, choose release channel guidance, and package portable update bundles',
-    usage: '[review|channel <stable|preview>|bundle export <path>|bundle inspect <path>]',
-    handler(args, ctx) {
-      const shellPaths = requireShellPaths(ctx);
-      const sub = args[0] ?? 'review';
-      const subscriptions = requireSubscriptionManager(ctx);
-      const serviceRegistry = requireServiceRegistry(ctx);
-      const secretsManager = requireSecretsManager(ctx);
-      const builtinProviders = listBuiltinSubscriptionProviders().map((entry) => entry.provider);
-      const sandboxProfile = [
-        `${ctx.platform.configManager.get('sandbox.replIsolation')}`,
-        `${ctx.platform.configManager.get('sandbox.mcpIsolation')}`,
-        `${ctx.platform.configManager.get('sandbox.vmBackend')}`,
-      ].join('/');
-      const activeSubscriptions = subscriptions.list().map((entry) => entry.provider);
-      if (sub === 'review') {
-        const channel = ctx.platform.configManager.get('release.channel');
-        ctx.print([
-          'Update Review',
-          `  version: ${VERSION}`,
-          `  channel: ${channel}`,
-          `  built-in subscription providers: ${builtinProviders.length}${builtinProviders.length > 0 ? ` (${builtinProviders.join(', ')})` : ''}`,
-          `  active subscriptions: ${activeSubscriptions.length}${activeSubscriptions.length > 0 ? ` (${activeSubscriptions.join(', ')})` : ''}`,
-          `  sandbox profile: ${sandboxProfile}`,
-          '  use /update channel <stable|preview> to change release posture',
-        ].join('\n'));
-        return;
-      }
-      if (sub === 'channel') {
-        const channel = args[1];
-        if (channel !== 'stable' && channel !== 'preview') {
-          ctx.print('Usage: /update channel <stable|preview>');
-          return;
-        }
-        ctx.platform.configManager.setDynamic('release.channel', channel);
-        ctx.print(`Update channel set to ${channel}.`);
-        return;
-      }
-      if (sub === 'bundle') {
-        const mode = args[1];
-        const pathArg = args[2];
-        if ((mode === 'export' || mode === 'inspect') && !pathArg) {
-          ctx.print(`Usage: /update bundle ${mode} <path>`);
-          return;
-        }
-        const targetPath = shellPaths.resolveWorkspacePath(pathArg!);
-        if (mode === 'export') {
-          const bundle: UpdateBundle = {
-            version: 1,
-            exportedAt: Date.now(),
-            appVersion: VERSION,
-            updateChannel: ctx.platform.configManager.get('release.channel') as 'stable' | 'preview',
-            subscriptionProviders: [...new Set([...builtinProviders, ...activeSubscriptions])],
-            sandboxProfile,
-            notes: [
-              'Preview channel is recommended only when operator review and sandbox isolation are enabled.',
-              'OAuth-backed provider subscriptions survive channel changes and continue to apply to supported provider surfaces.',
-            ],
-          };
-          mkdirSync(dirname(targetPath), { recursive: true });
-          writeFileSync(targetPath, JSON.stringify(bundle, null, 2) + '\n', 'utf-8');
-          ctx.print(`Update bundle exported to ${targetPath}`);
-          return;
-        }
-        if (mode === 'inspect') {
-          const bundle = JSON.parse(readFileSync(targetPath, 'utf-8')) as UpdateBundle;
-          ctx.print(inspectUpdateBundle(bundle));
-          return;
-        }
-      }
-      ctx.print('Usage: /update [review|channel <stable|preview>|bundle export <path>|bundle inspect <path>]');
-    },
-  });
+  registerUpdateCommand(registry);
 
   registry.register({
     name: 'auth',

package/src/input/commands/principals-runtime.ts

@@ -0,0 +1,212 @@
+/**
+ * principals-runtime.ts
+ *
+ * `/principals` — identity-mapping admin over `principals.*`: named
+ * principals (people, bots, services, tokens) and the channel identities
+ * ({channel, value} pairs, e.g. {channel:'slack', value:'U123'}) mapped to
+ * them. Goes over the operator wire (see operator-rpc.ts) for the same
+ * reason /ci and /checkin do: this verb family is not yet on the in-process
+ * OperatorClient facade.
+ *
+ * `principals.resolve` is the honest lookup this command exists to make
+ * reachable: an unmapped identity resolves to the shared "unknown" principal
+ * with `known: false` — the registry never guesses, and this command never
+ * papers over that with a name that looks real.
+ */
+import type { CommandRegistry } from '../command-registry.ts';
+import { describeOperatorRpcError, getOperatorRpc } from './operator-rpc.ts';
+import type { OperatorMethodOutput } from '@pellux/goodvibes-sdk';
+
+type Principal = OperatorMethodOutput<'principals.list'>['principals'][number];
+type PrincipalKind = Principal['kind'];
+
+const PRINCIPAL_KINDS: readonly PrincipalKind[] = ['user', 'bot', 'service', 'token'];
+
+function isPrincipalKind(value: string | undefined): value is PrincipalKind {
+  return PRINCIPAL_KINDS.includes(value as PrincipalKind);
+}
+
+/** Parse `channel:value` tokens (e.g. `slack:U123`) into identity pairs. Skips malformed tokens. */
+function parseIdentities(tokens: readonly string[]): Array<{ channel: string; value: string }> {
+  const identities: Array<{ channel: string; value: string }> = [];
+  for (const token of tokens) {
+    const idx = token.indexOf(':');
+    if (idx <= 0 || idx === token.length - 1) continue;
+    identities.push({ channel: token.slice(0, idx), value: token.slice(idx + 1) });
+  }
+  return identities;
+}
+
+/** Extract `--flag value` pairs from an args array, returning the remaining positional tokens. */
+function extractFlags(args: readonly string[], flagNames: readonly string[]): { flags: Map<string, string>; positional: string[] } {
+  const flags = new Map<string, string>();
+  const positional: string[] = [];
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i]!;
+    const name = arg.startsWith('--') ? arg.slice(2) : null;
+    if (name && flagNames.includes(name)) {
+      const value = args[i + 1];
+      if (value !== undefined) {
+        flags.set(name, value);
+        i++;
+        continue;
+      }
+    }
+    positional.push(arg);
+  }
+  return { flags, positional };
+}
+
+export function renderPrincipal(principal: Principal): string {
+  const lines = [
+    `  ${principal.id}  ${principal.name}  [${principal.kind}]`,
+  ];
+  if (principal.identities.length > 0) {
+    lines.push(`    identities: ${principal.identities.map((i) => `${i.channel}:${i.value}`).join(', ')}`);
+  } else {
+    lines.push('    identities: (none)');
+  }
+  return lines.join('\n');
+}
+
+export function registerPrincipalsRuntimeCommands(registry: CommandRegistry): void {
+  registry.register({
+    name: 'principals',
+    description: 'Identity mappings: named principals and their channel identities',
+    usage: '[list|get <id>|create <name> <kind> [channel:value...]|update <id> [--name x] [--kind x] [--identities c:v,c:v]|delete <id>|resolve <channel> <value>]',
+    argsHint: '[list|get|create|update|delete|resolve]',
+    async handler(args, ctx) {
+      const sub = args[0] ?? 'list';
+      const knownSubcommands = ['list', 'get', 'create', 'update', 'delete', 'resolve'];
+      if (!knownSubcommands.includes(sub)) {
+        ctx.print(
+          'Usage: /principals <subcommand>\n'
+          + '  /principals list                                          — list every principal\n'
+          + '  /principals get <id>                                      — show one principal\n'
+          + '  /principals create <name> <user|bot|service|token> [channel:value...]\n'
+          + '  /principals update <id> [--name x] [--kind x] [--identities c:v,c:v]\n'
+          + '  /principals delete <id>                                   — permanently remove a principal\n'
+          + '  /principals resolve <channel> <value>                     — resolve a sender identity to its principal, or "unknown principal"'
+        );
+        return;
+      }
+
+      // Validate each subcommand's required positional arguments before
+      // touching the operator connection, so a usage mistake never depends
+      // on daemon reachability to be reported.
+      if (sub === 'get' && !args[1]) {
+        ctx.print('Usage: /principals get <id>');
+        return;
+      }
+      if (sub === 'create' && (!args[1] || !isPrincipalKind(args[2]))) {
+        ctx.print(`Usage: /principals create <name> <${PRINCIPAL_KINDS.join('|')}> [channel:value...]`);
+        return;
+      }
+      if (sub === 'update' && !args[1]) {
+        ctx.print('Usage: /principals update <id> [--name x] [--kind user|bot|service|token] [--identities c:v,c:v]');
+        return;
+      }
+      if (sub === 'delete' && !args[1]) {
+        ctx.print('Usage: /principals delete <id>');
+        return;
+      }
+      if (sub === 'resolve' && (!args[1] || !args[2])) {
+        ctx.print('Usage: /principals resolve <channel> <value>');
+        return;
+      }
+
+      const rpc = getOperatorRpc(ctx);
+      if (!rpc.available) {
+        ctx.print(`[principals] ${rpc.reason}`);
+        return;
+      }
+
+      if (sub === 'list') {
+        try {
+          const { principals } = await rpc.sdk.operator.invoke('principals.list', {});
+          if (principals.length === 0) {
+            ctx.print('[principals] no principals registered.');
+            return;
+          }
+          ctx.print(['Principals:', ...principals.map(renderPrincipal)].join('\n'));
+        } catch (error) {
+          ctx.print(`[principals list] ${describeOperatorRpcError(error)}`);
+        }
+        return;
+      }
+
+      if (sub === 'get') {
+        const id = args[1]!;
+        try {
+          const { principal } = await rpc.sdk.operator.invoke('principals.get', { principalId: id });
+          ctx.print(renderPrincipal(principal));
+        } catch (error) {
+          ctx.print(`[principals get] ${describeOperatorRpcError(error)}`);
+        }
+        return;
+      }
+
+      if (sub === 'create') {
+        const name = args[1]!;
+        const kind = args[2] as PrincipalKind;
+        const identities = parseIdentities(args.slice(3));
+        try {
+          const { principal } = await rpc.sdk.operator.invoke('principals.create', { name, kind, identities });
+          ctx.print(`[principals create] created ${principal.id}\n${renderPrincipal(principal)}`);
+        } catch (error) {
+          ctx.print(`[principals create] ${describeOperatorRpcError(error)}`);
+        }
+        return;
+      }
+
+      if (sub === 'update') {
+        const id = args[1]!;
+        const { flags } = extractFlags(args.slice(2), ['name', 'kind', 'identities']);
+        const kind = flags.get('kind');
+        if (kind !== undefined && !isPrincipalKind(kind)) {
+          ctx.print(`Invalid --kind "${kind}". Valid values: ${PRINCIPAL_KINDS.join(', ')}`);
+          return;
+        }
+        const identitiesRaw = flags.get('identities');
+        try {
+          const { principal } = await rpc.sdk.operator.invoke('principals.update', {
+            principalId: id,
+            ...(flags.has('name') ? { name: flags.get('name')! } : {}),
+            ...(kind !== undefined ? { kind } : {}),
+            ...(identitiesRaw !== undefined ? { identities: parseIdentities(identitiesRaw.split(',')) } : {}),
+          });
+          ctx.print(`[principals update] updated ${principal.id}\n${renderPrincipal(principal)}`);
+        } catch (error) {
+          ctx.print(`[principals update] ${describeOperatorRpcError(error)}`);
+        }
+        return;
+      }
+
+      if (sub === 'delete') {
+        const id = args[1]!;
+        try {
+          const result = await rpc.sdk.operator.invoke('principals.delete', { principalId: id });
+          ctx.print(result.deleted ? `[principals delete] deleted ${id}.` : `[principals delete] no principal found with id ${id}.`);
+        } catch (error) {
+          ctx.print(`[principals delete] ${describeOperatorRpcError(error)}`);
+        }
+        return;
+      }
+
+      if (sub === 'resolve') {
+        const channel = args[1]!;
+        const value = args[2]!;
+        try {
+          const result = await rpc.sdk.operator.invoke('principals.resolve', { channel, value });
+          if (!result.known) {
+            ctx.print(`[principals resolve] unknown principal — ${channel}:${value} is not mapped to any registered principal.`);
+            return;
+          }
+          ctx.print(`[principals resolve] ${channel}:${value} -> ${result.principal.name}\n${renderPrincipal(result.principal)}`);
+        } catch (error) {
+          ctx.print(`[principals resolve] ${describeOperatorRpcError(error)}`);
+        }
+      }
+    },
+  });
+}

package/src/input/commands/product-runtime.ts

@@ -154,11 +154,51 @@ function inspectReleaseBundle(path: string): string {
 export function registerProductRuntimeCommands(registry: CommandRegistry): void {
   registry.register({
     name: 'trust',
-    description: 'Review trust posture and export portable trust bundles',
-    usage: '[review|bundle export <path>|bundle inspect <path>]',
+    description: 'Review trust posture, set this workspace\'s trust level, or export trust bundles',
+    usage: '[review|workspace [trusted|restricted]|bundle export <path>|bundle inspect <path>]',
     async handler(args, ctx) {
-      const shellPaths = requireShellPaths(ctx);
       const sub = args[0] ?? 'review';
+      if (sub === 'workspace') {
+        const manager = ctx.workspace.workspaceTrustManager;
+        if (!manager) {
+          ctx.print('Workspace trust is unavailable in this context.');
+          return;
+        }
+        const choice = (args[1] ?? '').toLowerCase();
+        if (choice === 'trusted' || choice === 'trust' || choice === 'full' || choice === 'yes') {
+          await manager.setLevel('trusted');
+          ctx.print('This workspace is now TRUSTED — all tools may run, subject to your permission settings.');
+          ctx.renderRequest();
+          return;
+        }
+        if (choice === 'restricted' || choice === 'restrict' || choice === 'readonly' || choice === 'read-only' || choice === 'no') {
+          await manager.setLevel('restricted');
+          ctx.print('This workspace is now RESTRICTED — read-only exploration; write/execute/delegate tools are denied until you run `/trust workspace trusted`.');
+          ctx.renderRequest();
+          return;
+        }
+        if (choice && choice !== 'status' && choice !== 'show') {
+          ctx.print(`Unknown workspace trust option "${args[1]}". Usage: /trust workspace [trusted|restricted]`);
+          return;
+        }
+        const level = manager.getLevel();
+        const lines = [
+          `Workspace trust: ${level.toUpperCase()}` +
+            (manager.wasGrandfathered() ? ' (grandfathered from prior GoodVibes state)' : ''),
+          level === 'trusted'
+            ? 'All tools may run, subject to your normal permission settings.'
+            : 'Read-only exploration: write, execute, and delegate tools are denied until you trust this workspace.',
+        ];
+        if (!manager.isDecided()) lines.push('Not yet decided — run `/trust workspace trusted` to enable full capability.');
+        const registrationManager = ctx.workspace.workspaceRegistrationManager;
+        if (registrationManager) {
+          lines.push(`Registration: ${await registrationManager.describe()}`);
+        }
+        lines.push('Change with:  /trust workspace trusted   |   /trust workspace restricted');
+        ctx.print(lines.join('\n'));
+        return;
+      }
+      const shellPaths = requireShellPaths(ctx);
       if (sub === 'review') {
         const bundle = await buildTrustReviewBundle(ctx);
         ctx.print(formatTrustReview(bundle));

package/src/input/commands/recall-files-config.ts

@@ -0,0 +1,54 @@
+/**
+ * recall-files-config.ts — TUI-local synthetic setting for the memory file
+ * projection directory (`memory.projection.dir`).
+ *
+ * `memory.projection.dir` is not in the SDK's ConfigKey union — same
+ * situation as worktree.setup.commands (see worktree-setup-config.ts, which
+ * this file mirrors): a brand-new top-level config section with no
+ * DEFAULT_CONFIG entry, so ConfigManager.get()/set() path resolution can
+ * throw for it. Read defensively; the settings-modal write path already
+ * degrades a resolution failure into an honest "Save failed" message.
+ *
+ * Default: `.goodvibes/memory/projection`, relative to the project working
+ * directory — under the project's own `.goodvibes/` control directory,
+ * alongside the (separate) KV-state memory directory used by the state tool.
+ */
+import type { ConfigKey, ConfigManager, ConfigSetting } from '@pellux/goodvibes-sdk/platform/config';
+
+export const MEMORY_PROJECTION_DIR_CONFIG_KEY = 'memory.projection.dir' as ConfigKey;
+
+/** Default projection directory, relative to the project working directory. */
+export const MEMORY_PROJECTION_DIR_DEFAULT = '.goodvibes/memory/projection';
+
+export const MEMORY_PROJECTION_DIR_SYNTHETIC_SETTING: ConfigSetting = {
+  key: MEMORY_PROJECTION_DIR_CONFIG_KEY,
+  type: 'string',
+  default: MEMORY_PROJECTION_DIR_DEFAULT,
+  description: '/recall files sync writes one markdown file per standing (project/team-scope) memory record here, and commits the directory when it sits inside a git repository. Relative paths resolve against the project working directory. /recall files review reads user edits back from this directory as proposals — a file edit or deletion never mutates the store directly.',
+};
+
+/** Read the configured projection directory, falling back to the default for an absent/malformed value. */
+export function readMemoryProjectionDir(configManager: Pick<ConfigManager, 'get'>): string {
+  let raw: unknown;
+  try {
+    raw = configManager.get(MEMORY_PROJECTION_DIR_CONFIG_KEY);
+  } catch {
+    return MEMORY_PROJECTION_DIR_DEFAULT;
+  }
+  return typeof raw === 'string' && raw.length > 0 ? raw : MEMORY_PROJECTION_DIR_DEFAULT;
+}
+
+export function isMemoryProjectionDirConfigKey(key: ConfigKey): boolean {
+  return key === MEMORY_PROJECTION_DIR_CONFIG_KEY;
+}
+
+export function buildMemoryProjectionDirSyntheticEntry(
+  configManager: Pick<ConfigManager, 'get'>,
+): { setting: ConfigSetting; currentValue: string; isDefault: boolean } {
+  const currentValue = readMemoryProjectionDir(configManager);
+  return {
+    setting: MEMORY_PROJECTION_DIR_SYNTHETIC_SETTING,
+    currentValue,
+    isDefault: currentValue === MEMORY_PROJECTION_DIR_DEFAULT,
+  };
+}

package/src/input/commands/recall-files-git.ts

@@ -0,0 +1,57 @@
+/**
+ * recall-files-git.ts — the synchronous git seam for memory file projection.
+ *
+ * `projectMemoryToFiles(records, dir, { git })` (SDK, platform/state) is a
+ * pure synchronous function and its `MemoryProjectionGit` seam is declared
+ * synchronous (`add(dir): void`, `commit(dir, message): void`) — it throws on
+ * failure rather than returning a result. The TUI's existing git wrapper,
+ * `GitService` (platform/git), is async (wraps simple-git), so it cannot
+ * satisfy this seam directly. `GitService`'s own static helpers
+ * (initRepo/isGitRepo/getRepoRoot) ARE synchronous, using `Bun.spawnSync`
+ * directly (see service.ts) — this file follows the exact same convention
+ * for `add`/`commit` so the seam matches the SDK's synchronous contract.
+ */
+import type { MemoryProjectionGit } from '@pellux/goodvibes-sdk/platform/state';
+import { GitService } from '@pellux/goodvibes-sdk/platform/git';
+
+function decode(bytes: Uint8Array | undefined): string {
+  return bytes ? new TextDecoder().decode(bytes).trim() : '';
+}
+
+/**
+ * Build a synchronous git seam rooted at `repoRoot`. `commit()` treats a
+ * "nothing to commit" exit as a benign no-op (not an error) so
+ * `/recall files sync` stays safely re-runnable when the projection files
+ * did not actually change since the last sync — any OTHER commit failure
+ * (no git identity configured, hook rejection, etc.) still throws, since the
+ * seam's contract has no way to report partial failure back to the caller
+ * other than throwing.
+ */
+export function createSyncGitSeam(repoRoot: string): MemoryProjectionGit {
+  return {
+    add(dir: string): void {
+      const result = Bun.spawnSync(['git', 'add', dir], { cwd: repoRoot });
+      if (result.exitCode !== 0) {
+        throw new Error(`git add failed: ${decode(result.stderr) || 'unknown error'}`);
+      }
+    },
+    commit(dir: string, message: string): void {
+      const result = Bun.spawnSync(['git', 'commit', '-m', message, '--', dir], { cwd: repoRoot });
+      if (result.exitCode === 0) return;
+      const output = `${decode(result.stdout)} ${decode(result.stderr)}`;
+      if (/nothing to commit/i.test(output)) return; // benign — no new/changed files this run
+      throw new Error(`git commit failed: ${output.trim() || 'unknown error'}`);
+    },
+  };
+}
+
+/**
+ * Resolve the git seam for `dir`, or null when `dir` is not inside a git
+ * repository. Never auto-initializes a repository — that is a much bigger
+ * side effect than a memory sync command should take unasked.
+ */
+export function resolveSyncGitSeam(dir: string): { seam: MemoryProjectionGit; repoRoot: string } | null {
+  const repoRoot = GitService.getRepoRoot(dir);
+  if (!repoRoot) return null;
+  return { seam: createSyncGitSeam(repoRoot), repoRoot };
+}