@pellux/goodvibes-tui 1.17.0 → 1.19.0

package/CHANGELOG.md

@@ -4,6 +4,214 @@ All notable changes to GoodVibes TUI.
 
 ---
 
+## [1.19.0] — 2026-07-16
+
+### Changes
+- 654eae83 deps: adopt published SDK 1.10.0 and regenerate operator contract artifact
+- a7055269 docs: regenerate command reference + foundation artifacts for the new surfaces
+- 17bcce8a voice setup: live per-component install progress
+- cd1d1889 extract knowledge + voice-setup construction to hold services.ts under the 800-line cap
+- 6eabbe16 compose the memory governor + managed voice provisioning in the daemon
+- 4ea80514 voice status: render the real STT enums honestly
+- c7c99a05 memory: doctor/status surface + pressure notice over ops.memory.get
+- 49b5ac83 voice settings: size-labeled local-engine setup offer beside ElevenLabs
+- f2bf0bb6 voice: /voice setup + /voice status one-act over the managed local-voice verbs
+- f7bb30f6 changelog: macOS in-app fleet coverage, regeneration backups, provenance-gated replacement, kept promises, honest not-probed
+- c26ad724 cli: not-probed is a tri-state on control-plane status and listener test — never a definite reachable:false
+- 50e10f36 installer: the macOS in-app fleet is reachable — both LaunchAgent identities, structural plist provenance, zero silence on pinned plists
+- ac27ebdd installer: replace-broken gate at every call site, backups before fingerprint regeneration, promises fulfilled on transfer refusal
+- 576b3665 changelog: modern-systemd vocabulary, fielded pinned-unit repair, never-touch hand-written units, honest bind displays
+- e63581be cli: every display surface routes endpoint bindings through one formatter seam
+- 4c3c471e installer: hand-written units survive the corpse state untouched; launchd cannot-ask is never free-to-kill
+- 1d3b42d8 installer: re-derive fielded pinned-endpoint units on upgrade (systemd + launchd, transfer + plain paths)
+- 49fa896e tri-state honesty for modern systemd and flapping probes: rc-4 'no such unit' is ABSENT, a failed MainPID query is UNKNOWN
+- 0019f2bf runtime: split the startup reconcile into legacy-daemon-reconcile.ts
+- 3986860e changelog: config-derived units, fail-safe installer, serving-proof reconcile
+- 9433bb11 installer: fail-safe on unknown service state, config-derived unit, endpoint-aware retirement, launchd run-state parity
+- 5b66a3a1 daemon: endpoint-serving proof + never-stop-a-running-daemon on the reconcile; config-derived unit content; display parity flags
+- eba26f90 changelog: describe the hardened migration, reconcile guards, and bind-honest banner
+- b7e7a36e daemon: serving-proof + self-kill guards on the reconcile, timeout-bounded systemctl, bind-honest banner
+- b10000df installer: supervised transfer for the legacy-active upgrade state, exit-status-checked retirement, quoting, launchd analog
+- e55eb1e7 changelog: installer unit unification, honest daemon startup, legacy-unit reconcile
+- 366560a0 daemon: honest startup identity and unattended legacy-unit reconcile
+- 615d60aa installer: unify the daemon service on the canonical goodvibes.service unit
+
+## [Unreleased]
+
+### Fixed
+- Installer now creates one daemon service unit that matches the app. The curl
+  installer used to write a `goodvibes-daemon.service` unit with a bare launch
+  command (no arguments), while the in-app service setup manages a
+  `goodvibes.service` unit launched with `--daemon-home`/`--hostname`/`--port`.
+  On upgrade a host could end up running both, and the extra bare unit booted a
+  second daemon that fought the real one for the same port. The installer now
+  writes only `goodvibes.service` with the same launch arguments the app uses,
+  and its create, restart, and uninstall paths all target that one name.
+- Installer upgrade path migrates the old unit safely. When the daemon is
+  actively running under a leftover installer-created `goodvibes-daemon.service`
+  (the common upgrade state), the installer now performs a supervised transfer:
+  it writes the canonical unit, stops the old one, starts the new one, verifies
+  it is actually active, and only then disables and removes the old unit. If
+  the new unit fails to come up, everything rolls back and the old unit keeps
+  running. Every stop/disable checks its exit status — a failed disable (for
+  example, no user service bus) leaves the unit file in place and says so,
+  instead of removing it behind a false "disabled + removed" message. A
+  hand-written unit of that name (no installer marker) is never removed, an
+  unreadable one is reported as unreadable, and `GOODVIBES_RESTART_DAEMON=0`
+  now also keeps the migration from stopping a running unit. The installer's
+  process-restart fallback no longer kills a systemd-supervised daemon, and
+  paths with spaces are quoted in the generated unit. macOS gets the same
+  upgrade: an installer-managed LaunchAgent with the old bare launch command is
+  regenerated to the argument-driven form.
+- Daemon startup prints an honest one-line identity. Launching the daemon binary
+  now prints its real version plus the home directory, host, and port it will
+  actually bind — the host/port come from the same resolution the bind path
+  uses (including the `hostMode` setting and port fallbacks), so the banner can
+  no longer claim a loopback bind while listening on every interface, or print
+  `port=0`. It points at the `install-service` command, replacing a startup
+  banner that could show a wrong `0.0.0` version. Version resolution is
+  hardened so a compiled binary can never pick up an unrelated `package.json`'s
+  placeholder version.
+- Daemon self-heals the two-unit state at startup, carefully. If the daemon
+  finds a redundant installer-created `goodvibes-daemon.service` still enabled
+  beside its own unit, it disables and removes it and records what it did — but
+  only after verifying the canonical unit is genuinely serving (active with a
+  live main process), never from inside the old unit itself (it will not
+  disable the unit supervising its own process), never while the old unit has
+  a running daemon of its own (a running second daemon might be the one your
+  clients reach — retiring it needs the deliberate `migrate-service` command),
+  and only once the endpoint clients resolve from settings is confirmed to be
+  answering. The unit file is removed only after the disable actually
+  succeeded; a disable that times out is re-inspected and reported as exactly
+  what was confirmed, never a blanket claim. Refusals are logged with a reason,
+  the configured service name and the login home directory are used (custom
+  setups reconcile too), and every check runs with a per-call timeout plus one
+  overall time budget so even a slow service manager can never stall daemon
+  startup. A hand-written unit is only reported, never touched.
+- Service units no longer pin the network endpoint. Both the installer and the
+  in-app service setup now write a unit that launches the daemon with only its
+  home directory; the daemon reads the configured interface mode, host, and
+  port from settings at startup. A host configured for network access or a
+  non-default port keeps that endpoint across upgrades — previously an upgrade
+  could silently pin the daemon back to loopback and the default port while
+  reporting success.
+- Installer understands modern systemd's answers. Current systemd (verified on
+  systemd 260) reports "no such unit" with a distinct exit code that older
+  releases did not use; the installer now reads that as the affirmative "this
+  unit does not exist" — which permits writing the unit and migrating — instead
+  of refusing the whole upgrade with a false "service manager unreachable"
+  message. Transitional unit states (starting, stopping) are read as the unit
+  existing, and the same discipline applies to the daemon's startup check: a
+  service query that fails or times out is treated as unanswered, never as
+  "the old service is stopped".
+- Existing installs with a pinned network endpoint get fixed on upgrade. Units
+  written by earlier releases baked the interface and port into the launch
+  command, silently overriding later settings changes on every boot. The
+  installer now regenerates recognizably product-managed units (and the macOS
+  LaunchAgent) to the settings-driven launch during upgrade; hand-written units
+  are never rewritten — they get a clear notice instead, and the migration
+  refuses to move a running daemon onto a hand-written unit with pinned flags.
+- Hand-written service units are never modified, even broken ones. A
+  hand-written unit whose launch binary no longer exists is left exactly as it
+  is (no disable, no rename, no replacement unit written over it) with an
+  honest note about how to fix it.
+- macOS installs made by the app itself now get every upgrade repair. The
+  in-app service setup registers the daemon under its own LaunchAgent name and
+  file, which the installer previously never looked at: pinned endpoints there
+  survived every upgrade silently, and the upgrade's restart path could kill
+  and orphan a daemon supervised under that name. The installer now handles
+  both LaunchAgent identities, restarts either in place, recognizes
+  product-installed launch files by their launch command when no marker is
+  present, and never stays silent about a launch file that pins the endpoint —
+  it is either regenerated (with a timestamped backup and a receipt) or called
+  out with instructions.
+- Regenerating a recognized service unit always keeps a backup. A unit
+  identified as product-written by its description line may still carry user
+  customizations (proxy environment lines, a different binary path); the prior
+  file is saved as a timestamped backup next to the original, named in the
+  output, before any rewrite.
+- No service unit is replaced unless it is provably platform-managed. The
+  broken-unit replacement path (for units whose launch binary vanished) now
+  checks provenance at every entry point — a hand-written daemon or agent unit
+  is never disabled, renamed, or replaced, even when broken; the installer
+  never writes agent units, so it never replaces one.
+- The upgrade promise is always kept. When the installer defers a daemon
+  restart to the migration step and the migration then declines (for example, a
+  hand-written unit with pinned endpoint flags is in the way), the old unit is
+  restarted in place so the freshly installed binary actually starts serving,
+  with the reason explained.
+- "Not probed" is reported as exactly that. Control-plane status and the
+  listener test no longer show "reachable: no" (or machine-readable false) for
+  an endpoint they deliberately did not probe; the output says it was not
+  probed and why.
+- Status displays never invent a bind address. Every command that shows an
+  endpoint (status, doctor, control-plane status, web, listener test, service
+  posture, surfaces) now goes through one shared formatter: an unrecognized
+  interface mode is reported as exactly that — with a doctor finding naming the
+  fix — instead of being displayed as a definite loopback bind, and such
+  endpoints are never port-probed.
+- Installer treats "cannot ask the service manager" as a hard stop. When
+  systemd cannot be reached (for example, a session without a user bus), the
+  installer no longer guesses: nothing is stopped, killed, or removed, and it
+  prints what to run once a normal session is available. The process-restart
+  fallback now checks per-process supervision by asking systemd which unit owns
+  the process — any unit name counts, and an unanswerable check counts as
+  supervised. macOS gets the same discipline: a loaded LaunchAgent is restarted
+  in place through launchd, an agent the user deliberately stopped is never
+  started by an upgrade, and rollbacks restore the exact pre-upgrade enablement
+  state.
+
+---
+
+## [1.18.0] — 2026-07-14
+
+### Changes
+- 04356a3b adopt published SDK 1.9.0 and opt real runtimes into the host power seam
+- 1551e7f2 memory: consolidation proposals surface in the TUI, and a modal clipping bug fix
+- 6d65128a gates: reviewer fixtures carry the acceptance checklist; command reference regenerated
+- a975efdd keep-awake is daemon-held and the chip syncs across surfaces
+- 101d00de surface honesty: resolved provenance summaries, in-panel review checklist and task-graph posture
+- 97ddf140 dev-link: re-link to sdk fd0e6b29 (review wire seam on the fleet node; observed-agent composition subpath bundle entry)
+- 28d48db4 recovery honesty: session-scoped delete, silent auto-restore, no more .preserved dance
+- ed61ab6b one-act lifecycle verbs: approve launches, discard really discards
+- 3ec4f97b surface honesty: two gate tests write fleet.maxSize, not the dead orchestration.maxActiveAgents key
+- ad8eb489 observed rows get a real drill-in steer path
+- 70e55cf9 fork parity: run the startup retention sweep (full roots) and live config-file watch on TUI-composed runtimes
+- 86a3e24c fleet composition: extract createFleetServices helper so the observed wiring fits under the file-size cap
+- 6e50397b daemon composes observed foreign agents: wire observeExternalAgents through the fork so real users see observed rows
+- 4f92cb10 dev-link: re-link to sdk d0a1b96c (observed-agent source exposed on a daemon-composition subpath, unblocks the daemon composing observed rows)
+- 8f84a539 identifier rule: ban worded plan-item labels (mirror the SDK scanner extension)
+- cedeb53e dev-link: re-link to sdk e0a5595d (cert-minting removed, consolidation.receipts verb, recovery/ registered)
+- 62dd21e2 gates: adopt the SDK's fleet.maxSize rename and fix-phase rework; surface new keys; refresh goldens
+- d0d5d9d0 dev-link: re-link to sdk 89690d07 (memory-provenance rides TURN_COMPLETED.metadata.memory.recordIds)
+- d4ad82ce observed foreign agents render in the fleet pane; keep every touched file under the 800-line cap
+- fb721780 consolidation receipts: an idle memory-consolidation run surfaces as a one-line attach notice
+- d2402ea4 memory provenance chip: read the SDK metadata.memory.recordIds convention
+- ebd7f06b task graph renders: a workstream's nodes, edges, states, and pool posture, legible
+- 124332e6 voice settings: local engines surface, the local provider joins the picker, cost stays honest
+- 7a5c5fa9 memory provenance chip: an opt-in "used N memories" turn indicator with a drill-in
+- 93fed956 power surfaces: the "sleep disabled" chip, held-because reasons, the honest lid-split, a one-key toggle
+- 04273e8b queued mid-turn messages: an editable list, edit/delete until delivery
+- 50093a07 dev-link: re-link to sdk a03bf218; adopt per-session recovery + power/consolidation/live-turn services
+- 547fbc36 per-tool cancel: a key stops the running tool call, cancelled result renders structurally
+- 78dc782b /git diff: route the full structural diff into the diff panel, delete the 4,000-char slice
+- 59d0d1b2 dev-link: re-link to sdk a5c63e3b (per-tool cancel, queued-message verbs, power, task graph)
+- c48997e7 fleet: host third-party ACP agents as fleet rows, from the panel and a command
+- 2de952b9 pairing: LAN posture rendered honestly from the SDK, tailscale serve as one action
+- e0d548f9 dev-link: re-link to sdk 64c67eaf (LAN http posture, acp hosting)
+- ee4c8f51 test: drop the forbidden any cast in the conflict-files detail fixture
+- 1573e2d0 operator-rpc: resolve shell paths lazily, after the static refusals
+- 60c9d177 fleet: the pick, conflict, and discard rows act from the panel selection
+- c58becd0 fleet gateway: the pick/conflict/discard verbs over the shared operator invoke path
+- cb150d8e fleet: waiting-on-human inherits the pick and conflict reasons everywhere
+- 5d4d40d4 dev-link: re-link to sdk d07b49e8 (fleet waiting-on-human: picks, conflicts, worktree discard)
+- fd3c1ad8 dev-link housekeeping: move the tarball pins off tmpfs to the durable job dir
+- 08066730 gates: relocate shared pairing modules to core, hold the 800-line cap
+- a8fe4ec7 blocked-too-long settings + honest turn-budget outcomes
+- 47b568c1 pairing bundle UX + a device manager in the security domain
+- 3735b46e pairing: the QR is the deep link, on a name that survives a lease change
+- 1a48f148 dev-link: adopt the SDK pairing hand-off + per-device token surface
+
 ## [1.17.0] — 2026-07-13
 
 ### Changes

package/README.md

@@ -2,7 +2,7 @@
 
 [![CI](https://github.com/mgd34msu/goodvibes-tui/actions/workflows/ci.yml/badge.svg)](https://github.com/mgd34msu/goodvibes-tui/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
-[![Version](https://img.shields.io/badge/version-1.17.0-blue.svg)](https://github.com/mgd34msu/goodvibes-tui)
+[![Version](https://img.shields.io/badge/version-1.19.0-blue.svg)](https://github.com/mgd34msu/goodvibes-tui)
 
 A terminal-native AI coding, operations, automation, knowledge, and integration console with a typed runtime, omnichannel surfaces, structured memory/knowledge, and a raw ANSI renderer.