@pellux/goodvibes-tui 1.16.1 → 1.18.0

package/src/runtime/onboarding/types.ts

@@ -1,6 +1,5 @@
 import type { ConfigManager, ConfigKey, GoodVibesConfig } from '../../config/index.ts';
 import type { SecretsManager, SecretRecord, SecretStorageReview } from '../../config/secrets.ts';
-import type { FeatureFlagConfigKey } from '../surface-feature-flags.ts';
 import type { LocalAuthSnapshot, UserAuthManager } from '@pellux/goodvibes-sdk/platform/security';
 import type { ShellPathService } from '@/runtime/index.ts';
 import type {
@@ -46,7 +45,6 @@ export interface OnboardingConfigSnapshot {
   readonly network: GoodVibesConfig['network'];
   readonly surfaces: GoodVibesConfig['surfaces'];
   readonly service: GoodVibesConfig['service'];
-  readonly featureFlags: GoodVibesConfig['featureFlags'];
   readonly batch: GoodVibesConfig['batch'];
   readonly cloudflare: GoodVibesConfig['cloudflare'];
 }
@@ -157,6 +155,14 @@ export interface OnboardingProviderAccountRecord {
   readonly availableRoutes: readonly string[];
   readonly activeRoute: string;
   readonly authFreshness: string;
+  /**
+   * The secrets-store key this provider reads its API key from — its declared
+   * auth env var, read from the live provider's registration-time auth state.
+   * Present only for providers that accept an API key; absent for keyless /
+   * subscription-only providers. Used to offer provider-agnostic key entry in
+   * onboarding, and as the storage key when the entered value is saved.
+   */
+  readonly apiKeyEnvVar?: string;
 }
 
 export interface OnboardingProviderAccountsSnapshot {
@@ -267,7 +273,7 @@ export interface OnboardingStepDerivationState {
 export type OnboardingApplyOperation =
   | {
       readonly kind: 'set-config';
-      readonly key: ConfigKey | FeatureFlagConfigKey;
+      readonly key: ConfigKey;
       readonly value: unknown;
       readonly scope?: 'global' | 'project';
     }

package/src/runtime/power-keepawake-remote.ts

@@ -0,0 +1,75 @@
+// ---------------------------------------------------------------------------
+// power-keepawake-remote.ts — forward the keep-awake toggle to an adopted
+// EXTERNAL daemon over the power.keepAwake.set operator verb.
+//
+// In the external/adopted-daemon topology the in-process PowerManager is NOT
+// the daemon's, so a keep-awake toggle applied only locally dies when the TUI
+// closes. The owner ruling is that keep-awake is daemon-held: it must survive
+// the TUI closing. The config file does NOT carry it across (power.keepAwake is
+// not a cross-surface shared key), so the toggle is forwarded to the daemon
+// over the verb instead — best-effort, gated on reachability. Mirrors the
+// agent's own power-keep-awake-remote seam.
+//
+// A single config subscriber carries ALL THREE toggle paths (/power, Alt+A, the
+// settings modal): each lands on the power.keepAwake config key — the local
+// PowerManager persists it on set, and the settings modal writes it directly —
+// so subscribing to that one key catches every origin. In the EMBEDDED topology
+// this is a no-op: the in-process manager already IS the daemon.
+// ---------------------------------------------------------------------------
+
+import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
+import type { PowerState } from '@pellux/goodvibes-sdk/platform/power';
+import { resolveOperatorRpc } from '../input/commands/operator-rpc.ts';
+
+export interface KeepAwakeRemoteDeps {
+  readonly configManager: ConfigManager;
+  readonly homeDirectory: string | (() => string);
+  /** True only in the external/adopted-daemon topology (the local manager is not the daemon's). */
+  readonly isExternalDaemon: () => boolean;
+  /** Injectable rpc resolution (tests); defaults to the shared resolveOperatorRpc. */
+  readonly resolveRpc?: typeof resolveOperatorRpc;
+}
+
+/**
+ * Best-effort forward of the keep-awake toggle to the adopted external daemon so
+ * the DAEMON holds the inhibitor (surviving the TUI closing). A no-op in the
+ * embedded topology and quiet when the daemon is unreachable — a transient
+ * daemon hiccup never breaks the local toggle.
+ */
+export async function forwardKeepAwakeToDaemon(enabled: boolean, deps: KeepAwakeRemoteDeps): Promise<void> {
+  if (!deps.isExternalDaemon()) return;
+  const rpc = (deps.resolveRpc ?? resolveOperatorRpc)({ configManager: deps.configManager, homeDirectory: deps.homeDirectory });
+  if (!rpc.available) return;
+  try {
+    await rpc.sdk.operator.invoke('power.keepAwake.set', { enabled });
+  } catch {
+    // Best-effort by design; the local toggle already applied.
+  }
+}
+
+/**
+ * Install a config subscriber that forwards every power.keepAwake change to the
+ * adopted external daemon. Returns an unsubscribe handle. Because all three
+ * toggle origins land on the same config key, this one seam carries them all.
+ */
+export function installKeepAwakeRemoteForward(deps: KeepAwakeRemoteDeps): () => void {
+  return deps.configManager.subscribe('power.keepAwake', (newValue) => {
+    void forwardKeepAwakeToDaemon(newValue === true, deps);
+  });
+}
+
+/**
+ * Fetch the adopted DAEMON's power.status.get (null when unreachable or not in
+ * the external topology). The chip's external-mode poll source — the adopted
+ * wire is plain HTTP with no event bridge, so the chip syncs by polling.
+ */
+export async function fetchDaemonPowerState(deps: KeepAwakeRemoteDeps): Promise<PowerState | null> {
+  if (!deps.isExternalDaemon()) return null;
+  const rpc = (deps.resolveRpc ?? resolveOperatorRpc)({ configManager: deps.configManager, homeDirectory: deps.homeDirectory });
+  if (!rpc.available) return null;
+  try {
+    return await rpc.sdk.operator.invoke('power.status.get', {}) as unknown as PowerState;
+  } catch {
+    return null;
+  }
+}

package/src/runtime/process-lifecycle.ts

@@ -219,8 +219,10 @@ export function installProcessLifecycle(deps: ProcessLifecycleDeps): ProcessLife
     }
     // Only remove the recovery fallback once the durable shutdown save actually completed,
     // so an interrupted or timed-out shutdown leaves the snapshot for the next launch.
+    // Scoped to THIS session's id: without it, one session's clean exit wipes
+    // every session's crash snapshot (the concurrent-session isolation bug).
     if (shutdownOk) {
-      deleteRecoveryFile({ homeDirectory: ctx.services.homeDirectory });
+      deleteRecoveryFile({ homeDirectory: ctx.services.homeDirectory }, ctx.runtime.sessionId);
     }
     process.exit(0);
   };

package/src/runtime/provider-fallback.ts

@@ -0,0 +1,55 @@
+/**
+ * provider-fallback.ts — the pre-catalog fallback registration for the
+ * configured model, extracted verbatim from services.ts (file-size hygiene):
+ * before the model catalog cache has loaded, the configured provider:model is
+ * registered with SDK family-aware context-window inference so the meter and
+ * compaction denominator agree with the post-catalog window.
+ */
+import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
+import { inferFallbackContextWindow, type ModelDefinition, type ProviderRegistry } from '@pellux/goodvibes-sdk/platform/providers';
+
+function buildFallbackModelDefinition(provider: string, modelId: string): ModelDefinition {
+  const providerLower = provider.toLowerCase();
+  const isReasoningProvider = providerLower.includes('openai')
+    || providerLower.includes('anthropic')
+    || providerLower.includes('gemini')
+    || providerLower.includes('google');
+
+  return {
+    id: modelId,
+    provider,
+    registryKey: `${provider}:${modelId}`,
+    displayName: modelId,
+    description: 'Configured model available before the model catalog cache has loaded.',
+    capabilities: {
+      toolCalling: true,
+      codeEditing: true,
+      reasoning: isReasoningProvider,
+      multimodal: isReasoningProvider,
+    },
+    contextWindow: inferFallbackContextWindow(provider, modelId),
+    contextWindowProvenance: 'fallback',
+    selectable: true,
+    tier: 'standard',
+    ...(isReasoningProvider ? { reasoningEffort: ['instant', 'low', 'medium', 'high'] } : {}),
+  };
+}
+
+export function ensureConfiguredModelIsRoutable(providerRegistry: ProviderRegistry, configManager: ConfigManager): void {
+  const configuredModel = String(configManager.get('provider.model') ?? '').trim();
+  if (!configuredModel.includes(':')) return;
+  if (providerRegistry.listModels().some((model) => model.registryKey === configuredModel)) return;
+
+  const [providerId, ...modelParts] = configuredModel.split(':');
+  const modelId = modelParts.join(':').trim();
+  if (!providerId || !modelId) return;
+
+  const provider = providerRegistry.tryGet(providerId);
+  if (!provider) return;
+
+  providerRegistry.registerRuntimeProvider({
+    provider,
+    replace: true,
+    models: [buildFallbackModelDefinition(providerId, modelId)],
+  });
+}

package/src/runtime/provider-optimizer-wiring.ts

@@ -0,0 +1,55 @@
+/**
+ * provider-optimizer-wiring — bind the provider optimizer to its capability
+ * gate and seed its persisted routing mode at startup.
+ *
+ * Mirrors the SDK composition root's provider-optimizer-wiring module (which
+ * the SDK does not export through a public seam) so this repo's composition
+ * fork cannot drift from it silently: the optimizer is constructed dark, the
+ * gate subscription flips it live, and provider.optimizerMode seeds the mode.
+ */
+
+import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
+import type { ProviderOptimizer } from '@pellux/goodvibes-sdk/platform/providers';
+import type { FeatureFlagManager } from '@/runtime/index.ts';
+
+export function bindProviderOptimizerFeatureFlag(
+  featureFlags: Pick<FeatureFlagManager, 'isEnabled' | 'subscribe'>,
+  providerOptimizer: Pick<ProviderOptimizer, 'setEnabled'>,
+): () => void {
+  providerOptimizer.setEnabled(featureFlags.isEnabled('provider-optimizer'));
+  return featureFlags.subscribe((flagId, state) => {
+    if (flagId === 'provider-optimizer') {
+      providerOptimizer.setEnabled(state === 'enabled');
+    }
+  });
+}
+
+/**
+ * Apply the persistent provider-optimizer routing mode from config at startup.
+ * provider.optimizerMode 'off' keeps the optimizer inactive (its gate derives
+ * from the same key); this only seeds the mode/pin so an operator can persist
+ * "auto" or a pinned model without re-issuing a /provider command each
+ * session. Runtime pin/unpin/setMode still override for the live session.
+ */
+export function applyProviderOptimizerConfigMode(
+  configManager: Pick<ConfigManager, 'get'>,
+  providerOptimizer: Pick<ProviderOptimizer, 'setMode' | 'pin'>,
+): void {
+  const mode = configManager.get('provider.optimizerMode');
+  if (mode === 'off') {
+    providerOptimizer.setMode('manual'); // inert baseline while inactive
+    return;
+  }
+  if (mode === 'pinned') {
+    const pinned = configManager.get('provider.optimizerPinnedModel').trim();
+    const sep = pinned.indexOf(':');
+    if (sep > 0 && sep < pinned.length - 1) {
+      providerOptimizer.pin(pinned.slice(0, sep), pinned.slice(sep + 1));
+    } else {
+      // Pinned mode requested without a valid provider-qualified model — stay manual.
+      providerOptimizer.setMode('manual');
+    }
+  } else {
+    providerOptimizer.setMode(mode);
+  }
+}

package/src/runtime/release-artifacts.ts

@@ -1,109 +1,25 @@
 /**
- * Shared release-artifact naming and checksum-verification logic.
- *
- * This is the one place that knows the release asset naming convention
- * (`goodvibes[-daemon]-{platform}-{arch}`) and how to verify a downloaded
- * artifact against SHA256SUMS.txt. Two callers share it and must stay in
- * lockstep:
+ * Release-artifact naming and checksum verification — re-exported from the
+ * SDK's canonical update policy module (platform/runtime/self-update), which
+ * was hoisted from this file's semantics. One mechanism everywhere: the
+ * asset naming convention (`goodvibes[-daemon]-{platform}-{arch}`), the
+ * sqlite-vec addon naming, and the "no manifest entry is as fatal as a
+ * mismatch" verification rule now have a single owner. Consumers that must
+ * stay in lockstep:
  *   - scripts/postinstall.js (npm install-time binary download)
- *   - src/input/commands/update-runtime.ts (the /update command's self-update)
- *
- * A downloaded artifact with NO entry in the checksum manifest is just as
- * unverified as one with a mismatching entry — verifyChecksum() throws in
- * both cases, never silently skips.
+ *   - src/input/commands/update-runtime.ts (the /update self-update)
+ *   - scripts/install.sh (the shell installer; mirrors the same names)
  */
-import { createHash } from 'node:crypto';
-
-export const CHECKSUM_MANIFEST_NAME = 'SHA256SUMS.txt';
+export {
+  CHECKSUM_MANIFEST_NAME,
+  parseChecksumFile,
+  resolveArtifactNames,
+  resolveSqliteVecAsset,
+  sha256,
+  verifyChecksum,
+  type ReleaseArtifactNames,
+  type SqliteVecAsset,
+} from '@pellux/goodvibes-sdk/platform/runtime/self-update';
 
 export type SupportedPlatform = 'linux' | 'darwin';
 export type SupportedArch = 'x64' | 'arm64';
-
-export interface ReleaseArtifactNames {
-  readonly app: string;
-  readonly daemon: string;
-}
-
-/** Release-asset platform tag as used in artifact filenames ("linux" | "macos"). */
-const PLATFORM_TAGS: Record<SupportedPlatform, string> = {
-  linux: 'linux',
-  darwin: 'macos',
-};
-
-export function resolveArtifactNames(platform: string, arch: string): ReleaseArtifactNames | null {
-  const platformTag = PLATFORM_TAGS[platform as SupportedPlatform];
-  if (!platformTag || (arch !== 'x64' && arch !== 'arm64')) {
-    return null;
-  }
-  const suffix = `${platformTag}-${arch}`;
-  return {
-    app: `goodvibes-${suffix}`,
-    daemon: `goodvibes-daemon-${suffix}`,
-  };
-}
-
-export interface SqliteVecAsset {
-  /** Release asset filename, e.g. `sqlite-vec-linux-x64.so`. */
-  readonly assetName: string;
-  /** Directory name the SDK loader resolves, e.g. `sqlite-vec-linux-x64`. */
-  readonly dirName: string;
-  /** File the loader opens inside that directory, e.g. `vec0.so`. */
-  readonly fileName: string;
-}
-
-/**
- * Names the sqlite-vec native addon for a platform/arch. Unlike the binaries
- * (whose release tag maps darwin→"macos"), the addon keeps the Node-style
- * platform tag ("linux" | "darwin") because that is exactly what the SDK's
- * loader resolves at `<execDir>/lib/sqlite-vec-<process.platform>-<process.arch>/vec0.<suffix>`.
- * The scripts/install.sh installer and the release workflow name the asset the
- * same way; all three must stay in lockstep.
- */
-export function resolveSqliteVecAsset(platform: string, arch: string): SqliteVecAsset | null {
-  if ((platform !== 'linux' && platform !== 'darwin') || (arch !== 'x64' && arch !== 'arm64')) {
-    return null;
-  }
-  const suffix = platform === 'darwin' ? 'dylib' : 'so';
-  const dirName = `sqlite-vec-${platform}-${arch}`;
-  return {
-    assetName: `${dirName}.${suffix}`,
-    dirName,
-    fileName: `vec0.${suffix}`,
-  };
-}
-
-export function sha256(buffer: Buffer | Uint8Array): string {
-  return createHash('sha256').update(buffer).digest('hex');
-}
-
-export function parseChecksumFile(contents: string): Map<string, string> {
-  const checksums = new Map<string, string>();
-  for (const rawLine of contents.split(/\r?\n/)) {
-    const line = rawLine.trim();
-    if (!line) continue;
-    const match = line.match(/^([a-f0-9]{64})\s+\*?(.+)$/i);
-    if (!match) continue;
-    checksums.set(match[2], match[1].toLowerCase());
-  }
-  return checksums;
-}
-
-/**
- * Verify a downloaded artifact's checksum against the parsed manifest.
- * An artifact with no entry in the manifest is a hard failure, identical
- * in severity to a mismatching entry — never treated as "unverifiable, so
- * skip the check". Throws naming the artifact and the manifest.
- */
-export function verifyChecksum(
-  artifactName: string,
-  actual: string,
-  expected: string | undefined,
-  manifestName: string = CHECKSUM_MANIFEST_NAME,
-): void {
-  if (expected === undefined) {
-    throw new Error(`no checksum entry for ${artifactName} in ${manifestName} — refusing to install an unverified binary`);
-  }
-  if (expected !== actual) {
-    throw new Error(`checksum mismatch for ${artifactName}: expected ${expected}, got ${actual}`);
-  }
-}

package/src/runtime/resume-notice.ts

@@ -1,7 +1,7 @@
 /**
  * resume-notice.ts — the boot-time "previous session found" transcript notice.
  *
- * UX-D item 1: a supervision-journey audit of 1.7.0 found that the TUI
+ * item 1: a supervision-journey audit of 1.7.0 found that the TUI
  * accumulates rich resumable state on disk (a saved conversation, workspace
  * checkpoints, WRFC chain history) but never surfaces any of it at startup —
  * an operator has no way to know it exists short of already knowing the