@pellux/goodvibes-tui 1.16.1 → 1.18.0

package/src/runtime/daemon-attach-notices.ts

@@ -0,0 +1,120 @@
+/**
+ * daemon-attach-notices — the attach-time consuming read.
+ *
+ * On daemon attach a surface reads the daemon's undelivered receipts
+ * (update/crash/migration) AND the pending feature-announcement queue
+ * (web-surface URL, the sandbox first-contained-run line, …) exactly once,
+ * rendering each as a one-line notice. Both sources clear on read — the
+ * facade's receipt queue marks its entries delivered, and drainPending() clears
+ * the announcement queue — so a second attach with nothing new shows nothing.
+ * This mirrors the daemon's own /status?receipts=consume fold, done in-process
+ * for the embedded daemon.
+ */
+import { FeatureAnnouncementStore, featureAnnouncementsPath, createSandboxContainmentAnnouncer } from '@pellux/goodvibes-sdk/platform/runtime/feature-announcements';
+import type { ConfigManager } from '../config/index.ts';
+
+/** A daemon receipt line (already a human one-liner, e.g. "restarted after a crash at 14:32"). */
+export interface DaemonReceiptLike {
+  readonly id: string;
+  readonly text: string;
+  readonly at: number;
+}
+
+/** The minimal announcement-store surface this consume drains. */
+export interface DrainableAnnouncementStore {
+  drainPending(): readonly { readonly id: string; readonly text: string; readonly at: number }[];
+}
+
+export interface DaemonAttachNoticesDeps {
+  readonly configManager: Pick<ConfigManager, 'getControlPlaneConfigDir'>;
+  /** Reads (and marks delivered) the daemon's undelivered receipts. */
+  readonly collectReceipts: () => readonly DaemonReceiptLike[];
+  /** Injectable announcement store; defaults to the shared control-plane file store. */
+  readonly announcementStore?: DrainableAnnouncementStore;
+}
+
+/**
+ * Consume — exactly once — the daemon's receipts and the pending announcement
+ * queue, returning the one-line notices to render. Receipts first (crash /
+ * update / migration), then announcements (web-surface URL, sandbox line, …).
+ */
+export function consumeDaemonAttachNotices(deps: DaemonAttachNoticesDeps): string[] {
+  const store = deps.announcementStore
+    ?? new FeatureAnnouncementStore(featureAnnouncementsPath(deps.configManager));
+  const notices: string[] = [];
+  for (const receipt of deps.collectReceipts()) {
+    if (receipt.text.trim().length > 0) notices.push(receipt.text);
+  }
+  for (const announcement of store.drainPending()) {
+    if (announcement.text.trim().length > 0) notices.push(announcement.text);
+  }
+  return notices;
+}
+
+/** Milliseconds an external-daemon receipts read waits before giving up. */
+const EXTERNAL_RECEIPTS_TIMEOUT_MS = 1500;
+
+export interface ExternalDaemonAttachNoticesDeps {
+  /** The adopted daemon's base URL, e.g. "http://127.0.0.1:3421". */
+  readonly baseUrl: string;
+  /** The shared bearer the adopted daemon authenticates (the companion-pairing token). */
+  readonly authToken: string;
+  /** Injectable fetch for tests; defaults to the global fetch. */
+  readonly fetchImpl?: typeof fetch;
+  /** Injectable timeout (ms); defaults to EXTERNAL_RECEIPTS_TIMEOUT_MS. */
+  readonly timeoutMs?: number;
+}
+
+/**
+ * Consume — exactly once — a separately-hosted (external/systemd) daemon's
+ * undelivered receipts AND drained announcements over HTTP, returning the
+ * one-line notices to render. The default deployment adopts such a daemon with
+ * no in-process handle (daemonServer is null), so the embedded in-process fold
+ * sees nothing; this hits the daemon's own consuming endpoint instead —
+ * GET <baseUrl>/status?receipts=consume with the shared bearer. The daemon
+ * marks the served receipts delivered as it responds (its own exactly-once
+ * store), so a second attach with nothing new returns []. Any transport, auth,
+ * or parse failure yields no notices rather than throwing into the attach path.
+ */
+export async function consumeExternalDaemonAttachNotices(
+  deps: ExternalDaemonAttachNoticesDeps,
+): Promise<string[]> {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), deps.timeoutMs ?? EXTERNAL_RECEIPTS_TIMEOUT_MS);
+  try {
+    const headers = new Headers();
+    if (deps.authToken.trim()) headers.set('Authorization', `Bearer ${deps.authToken.trim()}`);
+    const url = `${deps.baseUrl.replace(/\/+$/, '')}/status?receipts=consume`;
+    const response = await fetchImpl(url, { headers, signal: controller.signal });
+    if (!response.ok) return [];
+    const body = (await response.json()) as { receipts?: unknown } | null;
+    const receipts = Array.isArray(body?.receipts) ? body.receipts : [];
+    const notices: string[] = [];
+    for (const entry of receipts) {
+      if (entry && typeof (entry as { text?: unknown }).text === 'string') {
+        const text = (entry as { text: string }).text;
+        if (text.trim().length > 0) notices.push(text);
+      }
+    }
+    return notices;
+  } catch {
+    return [];
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+/**
+ * The "commands now run contained" first-run announcer for the sandboxed exec
+ * path. Returns the callback registerAllTools calls on each contained run: the
+ * FIRST call records the announce-once line (so any later attach-time consume
+ * also sees it) and surfaces it now via `notify`; every later run is silent.
+ */
+export function createSandboxContainmentNotice(deps: {
+  readonly configManager: Pick<ConfigManager, 'getControlPlaneConfigDir'>;
+  readonly notify: (text: string) => void;
+}): () => void {
+  const store = new FeatureAnnouncementStore(featureAnnouncementsPath(deps.configManager));
+  return createSandboxContainmentAnnouncer(store, (announcement) => deps.notify(announcement.text));
+}

package/src/runtime/durability-services.ts

@@ -0,0 +1,90 @@
+/**
+ * durability-services.ts — the data-safety and remembered-decision stores the
+ * daemon composition wires (mirrors the SDK's own createRuntimeServices):
+ *
+ *  - StoreSnapshotScheduler: a daily snapshot of every SQLite store this
+ *    runtime writes (memory store, memory vector index, code index store),
+ *    bounded by the retention engine. Timers are unref'd so an undisposed
+ *    scheduler cannot pin the event loop; hosts that tear down a runtime
+ *    stop() it themselves.
+ *  - UserPermissionRuleStore: durable user-origin permission rules
+ *    (remembered approvals) — one store per project, shared by every
+ *    PermissionManager built on this runtime; permissions.rules.*
+ *    lists/deletes. Background init is fail-safe (asks just prompt).
+ *  - One credential chain (env -> secrets -> subscription): boot applies
+ *    secrets-backed keys; every secrets write/delete re-registers builtins
+ *    LIVE (no restart) — badges/picker/chat read the same instances.
+ *  - Start-time retention janitor: one best-effort append-only sweep over
+ *    EVERY root the composition knows (working dir, surface root, home,
+ *    logDir, telemetryDir) — omitting logDir/telemetryDir/home would silently
+ *    skip the activity-log, telemetry-ledger, and recovery-snapshot stores.
+ *  - Live config-file watch: external edits to the settings file apply through
+ *    the same subscribe() pipeline an in-process set() uses — no restart. The
+ *    underlying watchers are unref'd, so this never pins the event loop.
+ */
+import { join } from 'node:path';
+import { operations } from '@pellux/goodvibes-sdk/platform/runtime';
+import { resolveMemoryVectorDbPath } from '@pellux/goodvibes-sdk/platform/state';
+import { StoreSnapshotScheduler } from '@pellux/goodvibes-sdk/platform/state/store-snapshots';
+import { UserPermissionRuleStore } from '@pellux/goodvibes-sdk/platform/permissions';
+import { logger, summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
+
+export interface DurabilityServicesInput {
+  readonly configManager: {
+    getControlPlaneConfigDir(): string;
+    get(key: never): unknown;
+    watchConfigFiles(options?: { intervalMs?: number }): () => void;
+  };
+  readonly secretsManager: { onDidChange(listener: (key: string) => void): () => void };
+  readonly providerRegistry: { refreshProviderCredentials(): Promise<void> };
+  readonly memoryDbPath: string;
+  readonly codeIndexDbPath: string;
+  /** Retention-sweep roots (mirrors the SDK's own createRuntimeServices roots). */
+  readonly workingDirectory: string;
+  readonly surfaceRoot: string;
+  readonly homeDirectory: string;
+  readonly shellPaths: { resolveUserPath(...segments: string[]): string };
+}
+
+export interface DurabilityServices {
+  readonly storeSnapshotScheduler: StoreSnapshotScheduler;
+  readonly userPermissionRuleStore: UserPermissionRuleStore;
+}
+
+export function createDurabilityServices(input: DurabilityServicesInput): DurabilityServices {
+  const { configManager, secretsManager, providerRegistry } = input;
+  secretsManager.onDidChange(() => void providerRegistry.refreshProviderCredentials().catch((error) => logger.warn('live credential refresh failed', { error: summarizeError(error) })));
+  void providerRegistry.refreshProviderCredentials().catch((error) => logger.warn('boot credential refresh failed', { error: summarizeError(error) }));
+
+  const storeSnapshotScheduler = new StoreSnapshotScheduler({
+    stores: [
+      { name: 'memory store', dbPath: input.memoryDbPath },
+      { name: 'memory vector index', dbPath: resolveMemoryVectorDbPath(input.memoryDbPath) },
+      { name: 'code index store', dbPath: input.codeIndexDbPath },
+    ],
+  });
+  storeSnapshotScheduler.start();
+
+  // Start-time retention janitor: pass EVERY root the composition knows so the
+  // activity-log, telemetry-ledger, and recovery-snapshot stores are all swept.
+  // Best-effort — a retention failure never takes startup down (the sweep
+  // swallows its own errors).
+  operations.runStartupAppendOnlySweep(
+    {
+      workingDirectory: input.workingDirectory,
+      surfaceRoot: input.surfaceRoot,
+      homeDirectory: input.homeDirectory,
+      logDir: input.shellPaths.resolveUserPath('logs'),
+      telemetryDir: input.shellPaths.resolveUserPath('telemetry'),
+    },
+    (k: string) => configManager.get(k as never),
+  );
+  // External config edits apply LIVE through the same subscribe() pipeline an
+  // in-process set() uses; the underlying watchers are unref'd.
+  configManager.watchConfigFiles();
+
+  const userPermissionRuleStore = new UserPermissionRuleStore(join(configManager.getControlPlaneConfigDir(), 'permission-rules.json'));
+  void userPermissionRuleStore.init().catch((error) => logger.warn('user permission rule store init failed; asks will prompt', { error: summarizeError(error) }));
+
+  return { storeSnapshotScheduler, userPermissionRuleStore };
+}

package/src/runtime/embedded-service-factories.ts

@@ -0,0 +1,40 @@
+/**
+ * embedded-service-factories.ts — the factories startExternalServices uses to
+ * construct the interactive session's embedded DaemonServer + HttpListener
+ * (extracted from bootstrap.ts for file-size hygiene).
+ *
+ * The embedded DaemonServer suppresses the facade's internal auto-updater:
+ * that loop compares the sdk package's version — not this binary's — against
+ * this repo's releases, so inside the interactive session it would find an
+ * "update" hourly and exit the user's process on "restart". Clients update at
+ * launch (cli/launch-auto-update.ts); the embedded daemon runs no update loop
+ * at all. See daemon/lifecycle.ts.
+ */
+import { DaemonServer, HttpListener } from '@pellux/goodvibes-sdk/platform/daemon';
+import { createSafeHostServeFactory } from '../daemon/safe-serve.ts';
+import type { startExternalServices } from '@/runtime/index.ts';
+
+export type ExternalServiceFactories = NonNullable<Parameters<typeof startExternalServices>[4]>;
+
+export function createEmbeddedServiceFactories(sharedDaemonToken: string): ExternalServiceFactories {
+  return {
+    sharedDaemonToken,
+    createDaemonServer: (bus, userAuth, runtimeServices) => {
+      // No updateArtifact: the embedded daemon keeps updates host-managed (the
+      // TUI client updates itself), so the facade runs no self-update loop.
+      const daemonServer = new DaemonServer({
+        runtimeBus: bus,
+        userAuth,
+        runtimeServices,
+        serveFactory: createSafeHostServeFactory('Embedded daemon'),
+      });
+      return daemonServer;
+    },
+    createHttpListener: (dispatcher, userAuth, configManager) => new HttpListener({
+      hookDispatcher: dispatcher,
+      userAuth,
+      configManager,
+      serveFactory: createSafeHostServeFactory('Embedded HTTP listener'),
+    }),
+  };
+}

package/src/runtime/feature-settings.ts

@@ -0,0 +1,147 @@
+/**
+ * feature-settings — TUI-side helpers over the SDK's FEATURE_SETTINGS surface.
+ *
+ * Every platform capability is configured through a first-class settings key
+ * in its natural domain (behavior.compactionStrategy, sandbox.enabled,
+ * surfaces.slack.enabled, ...). There is no separate enablement namespace.
+ * These helpers answer the recurring TUI questions:
+ *   - which feature a given id names, and whether a stock config has it on,
+ *   - whether a raw config value means the feature is currently on,
+ *   - which single settings write turns a feature on or off.
+ *
+ * Enablement kinds (from the SDK binding layer):
+ *   - boolean : the key's boolean value is the enablement.
+ *   - enum    : active while the key's value is in enabledValues (several
+ *               features can share one key, e.g. behavior.compactionStrategy).
+ *   - constant: the capability has no separate off switch. When its key is a
+ *               boolean (the surface enabled keys) that value is the honest
+ *               user-facing switch; a non-boolean constant key (e.g.
+ *               fetch.sanitizeMode) has no off position at all.
+ */
+
+import { CONFIG_SCHEMA, type ConfigKey, type ConfigManager, type ConfigSetting } from '@pellux/goodvibes-sdk/platform/config';
+import {
+  FEATURE_SETTINGS,
+  deriveFeatureState,
+  type FeatureSetting,
+} from '@pellux/goodvibes-sdk/platform/runtime/state';
+
+export type { FeatureSetting } from '@pellux/goodvibes-sdk/platform/runtime/state';
+
+// ---------------------------------------------------------------------------
+// Lookups
+// ---------------------------------------------------------------------------
+
+/** Every capability by id, in SDK declaration order. */
+export const FEATURE_SETTINGS_BY_ID: ReadonlyMap<string, FeatureSetting> = new Map(
+  FEATURE_SETTINGS.map((feature) => [feature.id, feature]),
+);
+
+const SCHEMA_BY_KEY: ReadonlyMap<string, ConfigSetting> = new Map(
+  CONFIG_SCHEMA.map((setting) => [setting.key, setting]),
+);
+
+export function getFeatureSetting(featureId: string): FeatureSetting | null {
+  return FEATURE_SETTINGS_BY_ID.get(featureId) ?? null;
+}
+
+/** The CONFIG_SCHEMA descriptor for a settings key, or null for TUI-local synthetics. */
+export function getConfigSchemaSetting(key: string): ConfigSetting | null {
+  return SCHEMA_BY_KEY.get(key) ?? null;
+}
+
+/** Whether a stock configuration has the feature active. */
+export function isFeatureDefaultEnabled(featureId: string): boolean {
+  return getFeatureSetting(featureId)?.defaultEnabled === true;
+}
+
+/** All features whose enablement key is `key` (several features can share one). */
+export function featuresForEnablementKey(key: string): readonly FeatureSetting[] {
+  return FEATURE_SETTINGS.filter((feature) => feature.enablement.key === key);
+}
+
+// ---------------------------------------------------------------------------
+// Enablement derivation
+// ---------------------------------------------------------------------------
+
+/**
+ * Whether a raw config value means the feature is on, as a settings surface
+ * should display it. Boolean/enum kinds derive exactly as the runtime gate
+ * does; constant kinds fall back to the boolean key value when there is one
+ * (the honest user-facing switch for the surface adapters) and read as always
+ * on otherwise.
+ */
+export function isFeatureValueEnabled(feature: FeatureSetting, value: unknown): boolean {
+  const { key, kind, enabledValues } = feature.enablement;
+  if (kind === 'constant') {
+    const schema = getConfigSchemaSetting(key);
+    if (schema?.type === 'boolean') return value === true;
+    return true;
+  }
+  return deriveFeatureState(
+    {
+      featureId: feature.id,
+      key,
+      kind,
+      ...(enabledValues !== undefined ? { enabledValues } : {}),
+    },
+    value,
+  ) === 'enabled';
+}
+
+/** Whether the live config currently has the feature on (see isFeatureValueEnabled). */
+export function isFeatureConfigEnabled(
+  configManager: Pick<ConfigManager, 'get'>,
+  featureId: string,
+): boolean {
+  const feature = getFeatureSetting(featureId);
+  if (!feature) return false;
+  return isFeatureValueEnabled(feature, configManager.get(feature.enablement.key));
+}
+
+// ---------------------------------------------------------------------------
+// Enablement writes
+// ---------------------------------------------------------------------------
+
+export interface FeatureEnablementWrite {
+  readonly key: ConfigKey;
+  readonly value: boolean | string;
+}
+
+/**
+ * The single settings write that turns a feature on or off, or null when the
+ * feature has no off position (a constant-kind capability on a non-boolean
+ * key). For enum kinds the schema default is preferred whenever it sits on
+ * the requested side, so "enable" lands on the feature's stock mode and
+ * "disable" lands on the stock off mode rather than an arbitrary value.
+ */
+export function featureEnablementWrite(
+  featureId: string,
+  enabled: boolean,
+): FeatureEnablementWrite | null {
+  const feature = getFeatureSetting(featureId);
+  if (!feature) return null;
+  const { key, kind, enabledValues } = feature.enablement;
+
+  if (kind === 'boolean') return { key, value: enabled };
+
+  const schema = getConfigSchemaSetting(key);
+  if (kind === 'constant') {
+    return schema?.type === 'boolean' ? { key, value: enabled } : null;
+  }
+
+  // enum
+  const active = enabledValues ?? [];
+  const allValues = schema?.enumValues ?? [];
+  const schemaDefault = typeof schema?.default === 'string' ? schema.default : undefined;
+  if (enabled) {
+    const target = schemaDefault !== undefined && active.includes(schemaDefault)
+      ? schemaDefault
+      : active[0];
+    return target !== undefined ? { key, value: target } : null;
+  }
+  const offTarget = schemaDefault !== undefined && !active.includes(schemaDefault)
+    ? schemaDefault
+    : allValues.find((value) => !active.includes(value));
+  return offTarget !== undefined ? { key, value: offTarget } : null;
+}

package/src/runtime/fleet-services.ts

@@ -0,0 +1,41 @@
+/**
+ * fleet-services.ts — the shared, archive-aware fleet registry construction,
+ * lifted out of services.ts so the composition root stays under the file-size
+ * cap. Mirrors the sibling create*Services helpers (durability, code-index,
+ * workstream): a single dependency-injected call that services.ts makes once.
+ *
+ * Also owns the daemon-side observed foreign-agent source: when
+ * observeExternalAgents is on (the standalone daemon), externally-launched
+ * coding-agent sessions observed read-only on the host fold in as
+ * 'observed-external' rows (visibility + steer; never counted against
+ * fleet.maxSize, never stopped). The interactive process leaves it off and
+ * reads the daemon's snapshot, so it never double-scans. Absence ⇒ a quiet
+ * empty set. Mirrors the SDK's own createRuntimeServices wiring.
+ */
+import { computeUsageCostUsd, type ProviderRegistry } from '@pellux/goodvibes-sdk/platform/providers';
+import { type ArchivableProcessRegistry } from '@pellux/goodvibes-sdk/platform/runtime/fleet';
+import { ObservedAgentSource } from '@pellux/goodvibes-sdk/platform/runtime/fleet/observed';
+import { createArchivableFleetRegistry, type ProcessRegistryDeps } from '@pellux/goodvibes-terminal-shell';
+
+export interface FleetServicesDeps
+  extends Omit<ProcessRegistryDeps, 'observedAgents' | 'priceUsage'> {
+  /** Turns on the daemon-side observed foreign-agent source (daemon only). */
+  readonly observeExternalAgents?: boolean | undefined;
+  /** Backs the honest pricing resolver folded into priceUsage below. */
+  readonly providerRegistry: Pick<ProviderRegistry, 'resolveModelPricing'>;
+}
+
+export function createFleetServices(
+  deps: FleetServicesDeps,
+): { processRegistry: ArchivableProcessRegistry } {
+  const { observeExternalAgents, providerRegistry, ...registryDeps } = deps;
+  const observedAgents = observeExternalAgents ? new ObservedAgentSource() : undefined;
+  const processRegistry = createArchivableFleetRegistry({
+    ...registryDeps,
+    observedAgents, // Daemon-side observed foreign-agent rows (undefined in the interactive process)
+    // Honest-unpriced through the ONE pricing resolver (manual -> registration -> provider-served
+    // -> catalog -> unknown); unknown/subscription yields null, never $0. Mirrors the SDK composition.
+    priceUsage: (model, usage) => (model ? computeUsageCostUsd(providerRegistry.resolveModelPricing(model), usage) : null),
+  });
+  return { processRegistry };
+}

package/src/runtime/idle-power-services.ts

@@ -0,0 +1,85 @@
+// ---------------------------------------------------------------------------
+// idle-power-services.ts — the idle-time / sleep-ownership / live-turn slice of
+// the runtime composition, extracted from services.ts (file-size hygiene).
+//
+// Mirrors the SDK's own createRuntimeServices wiring: idle-time memory
+// consolidation (learning.consolidation.*), host sleep ownership (power.*), and
+// the per-session live-turn control holder that backs the
+// sessions.toolCalls.cancel / sessions.queuedMessages.* wire verbs. Consolidation
+// receipts ride the SAME attach-time queue every other receipt uses — a run that
+// changed something records a one-line notice into the file-backed
+// feature-announcement store, drained on the next surface attach; a quiet run
+// records nothing.
+// ---------------------------------------------------------------------------
+
+import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
+import type { MemoryRegistry } from '@pellux/goodvibes-sdk/platform/state';
+import { MemoryConsolidationScheduler } from '@pellux/goodvibes-sdk/platform/state';
+import { SessionLiveTurnControlsHolder } from '@pellux/goodvibes-sdk/platform/control-plane';
+import { PowerManager, wireRuntimePower, createUnavailablePowerSeam } from '@pellux/goodvibes-sdk/platform/power';
+import { FeatureAnnouncementStore, featureAnnouncementsPath } from '@pellux/goodvibes-sdk/platform/runtime/feature-announcements';
+import type { RuntimeEventBus } from '@pellux/goodvibes-sdk/platform/runtime/state';
+import { formatConsolidationReceipt } from '../core/consolidation-receipt.ts';
+
+export interface IdlePowerServicesDeps {
+  readonly configManager: ConfigManager;
+  readonly memoryRegistry: MemoryRegistry;
+  readonly runtimeBus: RuntimeEventBus;
+  /** True when no session is busy — the consolidation scheduler's idle gate. */
+  readonly isIdle: () => boolean;
+  /** Sleep-edge checkpoint + a wake catch-up tick (store snapshots). */
+  readonly snapshotTick: () => void;
+  /** Wake catch-up: fire the automation heartbeat. */
+  readonly heartbeat: () => Promise<void>;
+  /**
+   * Host power seam. SDK 1.9.0 makes wireRuntimePower default an absent seam to
+   * the REAL host seam (createHostPowerSeam — which spawns systemd-inhibit and a
+   * dbus-monitor sleep-edge watcher). That spawn is a host-level side effect, so
+   * this fork mirrors the SDK's own createRuntimeServices: when no seam is passed
+   * we default to the NON-spawning unavailable seam, keeping test-constructed
+   * runtimes deterministic. Only the real long-lived compositions (the standalone
+   * daemon and the embedded interactive runtime, which itself IS the daemon) pass
+   * createHostPowerSeam() to opt into live OS keep-awake/idle-inhibit.
+   */
+  readonly powerSeam?: Parameters<typeof wireRuntimePower>[0]['seam'];
+}
+
+export interface IdlePowerServices {
+  readonly memoryConsolidationScheduler: MemoryConsolidationScheduler;
+  readonly powerManager: PowerManager;
+  readonly sessionLiveTurnControls: SessionLiveTurnControlsHolder;
+}
+
+/** Construct (and start) the idle-consolidation scheduler, power manager, and live-turn holder. */
+export function wireIdlePowerAndLiveTurn(deps: IdlePowerServicesDeps): IdlePowerServices {
+  const consolidationReceiptStore = new FeatureAnnouncementStore(featureAnnouncementsPath(deps.configManager));
+  const memoryConsolidationScheduler = new MemoryConsolidationScheduler({
+    memoryRegistry: deps.memoryRegistry,
+    configSource: deps.configManager,
+    isIdle: deps.isIdle,
+    onReceipt: (receipt) => {
+      const text = formatConsolidationReceipt(receipt);
+      if (text) consolidationReceiptStore.record(receipt.runId, text);
+    },
+  });
+  memoryConsolidationScheduler.start();
+  const sessionLiveTurnControls = new SessionLiveTurnControlsHolder();
+  const powerManager = wireRuntimePower({
+    readConfig: (key) => deps.configManager.get(key as Parameters<typeof deps.configManager.get>[0]),
+    writeConfig: (key, value) => deps.configManager.setDynamic(key as Parameters<typeof deps.configManager.setDynamic>[0], value),
+    // Live config subscription: an external edit to power.keepAwake (a settings-
+    // modal toggle, a hand-edited settings file) applies LIVE to the in-process
+    // manager — acquires/releases the inhibitor and lights the chip with no
+    // restart. This is the config-apply path for the EMBEDDED topology + the
+    // local chip; the external daemon is reached separately over the verb.
+    subscribeConfig: (key, cb) => (deps.configManager.subscribe as unknown as (k: string, c: (v: unknown) => void) => () => void)(key, (newValue) => cb(newValue)),
+    runtimeBus: deps.runtimeBus,
+    sleepCheckpoint: deps.snapshotTick,
+    wakeCatchUp: [() => memoryConsolidationScheduler.tick(), deps.snapshotTick, deps.heartbeat],
+    // Non-spawning default (see powerSeam doc above): without an explicit opt-in
+    // the seam is the honest unavailable one, NOT the spawning host seam that
+    // wireRuntimePower would otherwise pick for an undefined seam.
+    seam: deps.powerSeam ?? createUnavailablePowerSeam('runtime services constructed without a host power seam'),
+  });
+  return { memoryConsolidationScheduler, powerManager, sessionLiveTurnControls };
+}

package/src/runtime/index.ts

@@ -13,10 +13,6 @@ import {
   shell,
   transport,
 } from '@pellux/goodvibes-sdk/platform/runtime';
-import {
-  createFeatureFlagManager as createSdkFeatureFlagManager,
-  FEATURE_FLAG_MAP,
-} from '@pellux/goodvibes-sdk/platform/runtime/state';
 import { existsSync, statSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import type {
@@ -26,7 +22,6 @@ import type {
   shell as Shell,
   transport as Transport,
 } from '@pellux/goodvibes-sdk/platform/runtime';
-import type { FeatureFlagManager, FlagConfig } from '@pellux/goodvibes-sdk/platform/runtime/state';
 
 // Local runtime entry points.
 export { bootstrapRuntime } from './bootstrap.ts';
@@ -35,22 +30,10 @@ export type { BootstrapContext } from './bootstrap.ts';
 export { createUiRuntimeServices } from './ui-services.ts';
 export type { UiRuntimeServices } from './ui-services.ts';
 
-export function createFeatureFlagManager(): FeatureFlagManager {
-  const manager = createSdkFeatureFlagManager();
-  const originalLoadFromConfig = manager.loadFromConfig.bind(manager);
-
-  manager.loadFromConfig = (config: FlagConfig): void => {
-    originalLoadFromConfig({
-      flags: Object.fromEntries(
-        Object.entries(config.flags).filter(([id]) => FEATURE_FLAG_MAP.has(id)),
-      ) as FlagConfig['flags'],
-    });
-  };
-
-  return manager;
-}
-
-// Public SDK runtime seams.
+// Public SDK runtime seams. createFeatureFlagManager comes straight from the
+// SDK state seam below: gate states derive from domain settings keys
+// (deriveFeatureStates), so the old TUI wrapper that filtered unknown ids out
+// of persisted `featureFlags` overrides has nothing left to filter.
 export * from '@pellux/goodvibes-sdk/platform/runtime/state';
 export * from '@pellux/goodvibes-sdk/platform/runtime/store';
 export * from '@pellux/goodvibes-sdk/platform/runtime/ui';
@@ -296,8 +279,10 @@ export const loadLastConversation = operations.loadLastConversation;
 export const loadRecoveryConversation = operations.loadRecoveryConversation;
 export const writeRecoveryFile = operations.writeRecoveryFile;
 export const deleteRecoveryFile = operations.deleteRecoveryFile;
+export const autoRestoreRecovery = operations.autoRestoreRecovery;
 export const checkRecoveryFile = operations.checkRecoveryFile;
 export const getRecoveryFilePath = operations.getRecoveryFilePath;
+export const getRecoveryDir = operations.getRecoveryDir;
 export const getLastSessionPointerPath = operations.getLastSessionPointerPath;
 export const writeLastSessionPointer = operations.writeLastSessionPointer;
 export const readLastSessionPointer = operations.readLastSessionPointer;