@pellux/goodvibes-tui 1.23.0 → 1.24.0

package/src/runtime/services.ts

@@ -11,6 +11,7 @@ import { StepUpService } from '@pellux/goodvibes-sdk/daemon';
 import { PairingTokenManager } from '@pellux/goodvibes-sdk/platform/pairing';
 import { resolvePairingWebOrigin } from '../core/pairing-origin.ts';
 import { attachWsOnlyGatewayVerbHandlers } from '@pellux/goodvibes-terminal-shell';
+import { createDisposalScope, registerSurfaceRuntimePollers } from './disposal-wiring.ts';
 import { WatcherRegistry } from '@pellux/goodvibes-sdk/platform/watchers';
 import { ArtifactStore } from '@pellux/goodvibes-sdk/platform/artifacts';
 import { createWebKnowledgeGapRepairer } from '@pellux/goodvibes-sdk/platform/knowledge';
@@ -36,8 +37,7 @@ import type { DomainDispatch, RuntimeStore } from './store/index.ts';
 import {
   type RuntimeEventBus, DistributedRuntimeManager, RemoteRunnerRegistry, RemoteSupervisor, IntegrationHelperService,
   IdempotencyStore, ComponentHealthMonitor, WorktreeRegistry, SandboxSessionRegistry, createShellPathService,
-  type ShellPathService, type FeatureFlagManager, createFeatureFlagManager, PolicyRuntimeState,
-  type SessionSurface,
+  type ShellPathService, type FeatureFlagManager, createFeatureFlagManager, PolicyRuntimeState, type SessionSurface,
 } from '@/runtime/index.ts';
 import { createSessionStorageServices } from './session-storage-services.ts';
 import { VoiceProviderRegistry, VoiceService, ensureBuiltinVoiceProviders } from '@pellux/goodvibes-sdk/platform/voice';
@@ -55,6 +55,7 @@ import { SessionManager, CrossSessionTaskRegistry, SessionChangeTracker } from '
 import { ApiTokenAuditor, UserAuthManager } from '@pellux/goodvibes-sdk/platform/security';
 import { WebhookNotifier } from '@pellux/goodvibes-sdk/platform/integrations';
 import { McpRegistry } from '@pellux/goodvibes-sdk/platform/mcp';
+import { createRemoteExecutionServices } from './remote-execution-composition.ts';
 import { BenchmarkStore, CacheHitTracker, FavoritesStore, ModelLimitsService, ProviderCapabilityRegistry, ProviderOptimizer, ProviderRegistry } from '@pellux/goodvibes-sdk/platform/providers';
 import { KeybindingsManager } from '../input/keybindings.ts';
 import { AdaptivePlanner, DeterministicReplayEngine, ExecutionPlanManager, SessionLineageTracker, SessionMemoryStore } from '@pellux/goodvibes-sdk/platform/core';
@@ -67,16 +68,10 @@ import { createWorkstreamServices, type OrchestrationEngine, type WorkstreamComm
 import { wireFleetNeedsInputPush } from './fleet-needs-input-push.ts';
 import { codeIndexDbPath, createCodeIndexServices, createStoreRerooter, isCodeInjectionSettingEnabled } from './code-index-services.ts';
 import type { WorkPlanStore } from '../work-plans/work-plan-store.ts';
-import { registerDaemonHandlers, type DaemonHandlerSurfaces } from '../daemon/handlers/index.ts';
-import type { HandlerContext, HandlerLogger } from '../daemon/handlers/context.ts';
-import { createDaemonCredentialStore } from '../daemon/handlers/credentials.ts';
-import { registerRouting } from '../daemon/handlers/routing/index.ts';
-import { registerInboxMethods } from '../daemon/handlers/inbox/index.ts';
-import { registerTriagedInbox } from '../daemon/handlers/triage/index.ts';
-import { registerDraftMethods } from '../daemon/handlers/drafts/index.ts';
-import { registerCalendar } from '../daemon/handlers/calendar/index.ts';
-import { registerEmailMethods } from '../daemon/handlers/email/index.ts';
-import { registerRemoteSurface } from '../daemon/handlers/remote/index.ts';
+import type { DaemonHandlerSurfaces } from '../daemon/handlers/index.ts';
+import { createDaemonHandlerComposition } from './daemon-handler-composition.ts';
+import { createClusterServices, startClusterServices, type ClusterGroupComposition } from './cluster-group-composition.ts';
+import type { ClusterCoordinator } from '@pellux/goodvibes-sdk/platform/cluster';
 import { WorkspaceTrustManager } from './trust/workspace-trust.ts';
 import { ensureConfiguredModelIsRoutable } from './provider-fallback.ts';
 
@@ -184,6 +179,12 @@ export interface RuntimeServices {
   readonly toolLLM: ToolLLM;
   readonly distributedRuntime: DistributedRuntimeManager;
   readonly daemonHandlers: DaemonHandlerSurfaces;
+  /** Elects the one node on this network that consumes inbound messages; hand it to the DaemonServer so its consumers share this leadership instead of holding a second election. */
+  readonly clusterCoordinator: ClusterCoordinator;
+  /** LAN group membership: identity, keys, roster, and the `cluster` verbs. */
+  readonly clusterGroup: ClusterGroupComposition;
+  /** Start the group layer and then the election, in that order. Idempotent. */
+  readonly startCluster: () => Promise<void>;
   readonly remoteRunnerRegistry: RemoteRunnerRegistry;
   readonly remoteSupervisor: RemoteSupervisor;
   readonly sessionMemoryStore: SessionMemoryStore;
@@ -231,10 +232,11 @@ export interface RuntimeServices {
   readonly integrationHelpers: IntegrationHelperService;
   /** Re-root path-bound stores (MemoryStore, ProjectIndex) to a new working directory, called by WorkspaceSwapManager after verification; stores needing a process restart just warn-log and keep serving the old path until the daemon restarts with the new --working-dir. */
   rerootStores(newWorkingDir: string): Promise<void>;
+  dispose(): void; // Stop every poller this graph started; best-effort, total, idempotent. This surface owns its graph — see disposal-wiring.ts.
 }
 
 export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeServices {
-  const workingDirectory = options.workingDir;
+  const disposalScope = createDisposalScope('RuntimeServices'); const workingDirectory = options.workingDir; // disposal seam: see ./disposal-wiring.ts
   const homeDirectory = options.homeDirectory;
   const shellPaths = createShellPathService({
     workingDirectory,
@@ -419,6 +421,12 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   const memorySpine = new MemorySpineClient({ local: createLocalMemoryAccess(memoryRegistry) });
   const deliveryManager = new AutomationDeliveryManager({
     configManager,
+    // This manager builds the delivery router the daemon actually replies
+    // through (bootstrap.ts hands it to the daemon facade). Without the
+    // secrets manager it cannot resolve a goodvibes://secrets/... credential,
+    // so Telegram accepted every inbound message and dropped every reply with
+    // "Missing Telegram bot token" while ntfy — which needs no secret — worked.
+    secretsManager,
     serviceRegistry,
     runtimeBus: options.runtimeBus,
     runtimeStore: options.runtimeStore,
@@ -498,43 +506,30 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     automationBridge: automationManager,
   });
 
-  // Daemon handler surfaces: attach HOST handlers to the SDK-auto-registered builtin
-  // gateway descriptors (channels.* / email.* / calendar.*) via catalog.register(descriptor,
-  // handler, { replace: true }) — the SDK owns every id/descriptor/schema. The remote
-  // surface reuses the SAME DistributedRuntimeManager the SDK facade injects.
-  const handlerLogger: HandlerLogger = {
-    info: (message, meta) => console.info(message, meta ?? ''),
-    warn: (message, meta) => console.warn(message, meta ?? ''),
-    error: (message, meta) => console.error(message, meta ?? ''),
-  };
-  const handlerContext: HandlerContext = {
-    catalog: gatewayMethods,
-    credentials: createDaemonCredentialStore(secretsManager),
+  // Which machines on this network are "us", and which of them reads the
+  // shared inbox. Both inert until startCluster() — no socket, no key material
+  // read; see cluster-group-composition.ts for why they are built together.
+  const { clusterGroup, clusterCoordinator } = createClusterServices({
+    configManager, shellPaths, secretsManager,
+  });
+  // Daemon handler surfaces (see daemon-handler-composition.ts); the inbox
+  // poller registers itself with the coordinator rather than starting eagerly.
+  const daemonHandlers = createDaemonHandlerComposition({
+    gatewayMethods,
+    secretsManager,
     configManager,
     workingDirectory,
     homeDirectory,
-    logger: handlerLogger,
-  };
-  const daemonHandlers = registerDaemonHandlers(handlerContext, {
-    registerRouting,
-    registerInbox: (ctx, routing) =>
-      registerTriagedInbox(ctx, (inboxCtx) => registerInboxMethods(inboxCtx, routing))
-        .unregister,
-    registerDrafts: (ctx) => registerDraftMethods(ctx),
-    registerCalendar,
-    registerEmail: (ctx) => registerEmailMethods(ctx),
-    registerRemote: (ctx) => registerRemoteSurface(ctx, { manager: distributedRuntime }),
+    distributedRuntime,
+    clusterCoordinator,
   });
 
-  const remoteRunnerRegistry = new RemoteRunnerRegistry(agentManager);
-  const remoteSupervisor = new RemoteSupervisor(remoteRunnerRegistry);
-  const sandboxSessionRegistry = new SandboxSessionRegistry(workingDirectory);
-  const mcpRegistry = new McpRegistry({
-    hookDispatcher,
-    sandboxSessions: sandboxSessionRegistry,
-  });
-  mcpRegistry.setRuntimeBus(options.runtimeBus);
-  mcpRegistry.setSandboxRuntime(configManager, sandboxSessionRegistry);
+  // Remote runners and the sandboxes tool calls are confined to; see
+  // remote-execution-composition.ts for why the four are built as one.
+  const { remoteRunnerRegistry, remoteSupervisor, sandboxSessionRegistry, mcpRegistry }
+    = createRemoteExecutionServices({
+      agentManager, workingDirectory, hookDispatcher, configManager, runtimeBus: options.runtimeBus,
+    });
   const tokenAuditor = new ApiTokenAuditor({ managed: false });
   const componentHealthMonitor = new ComponentHealthMonitor();
   const worktreeRegistry = new WorktreeRegistry(workingDirectory);
@@ -572,7 +567,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   // code-index-services.ts's header doc.
   const { codeIndexStore, codeIndexReindexScheduler } = createCodeIndexServices({ workingDirectory, configManager, memoryEmbeddingRegistry, isReindexPaused: () => pauseController.isPaused('code-index-reindex'), admitExpensiveWork });
   // Store snapshots, the periodic append-only sweep, durable remembered-approval rules + the live credential chain — see durability-services.ts.
-  const { storeSnapshotScheduler, appendOnlyRetentionScheduler, userPermissionRuleStore, stopDurabilityHousekeeping } = createDurabilityServices({
+  const { storeSnapshotScheduler, appendOnlyRetentionScheduler, userPermissionRuleStore, stopDurabilityHousekeeping, stopConfigWatch } = createDurabilityServices({
     configManager, secretsManager, providerRegistry, memoryDbPath, codeIndexDbPath: codeIndexDbPath(workingDirectory), surface, shellPaths, // + retention-sweep roots & live config watch (mirrors the SDK)
     ...(options.currentSessionId ? { currentSessionId: options.currentSessionId } : {}), // exempts the running session from crash-residue reaping
   });
@@ -618,7 +613,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   const { voiceSetup } = wireVoiceSetup({ configManager, shellPaths, voiceProviders, admitExpensiveWork });
 
   // Terminal-shell wrapper over the SDK registerGatewayVerbGroups (gateway-verbs.ts); checkin.*/fleet-needs-input/pairing.* register only when their deps are present. memoryGovernor lights up ops.memory.get; voiceSetup lights up voice.local.status/install.
-  attachWsOnlyGatewayVerbHandlers(gatewayMethods, { processRegistry, workspaceCheckpointManager, conversationRewindPort: createSessionConversationRewindPort(), sessionBroker, secretsManager, stepUpService, approvalBroker, requestApproval: (input) => approvalBroker.requestApproval(input), watcherRegistry, userPermissionRuleStore, shellPaths, configManager, runtimeStore: options.runtimeStore, channelDeliveryRouter, providerRegistry, automationManager, sessionLister: sessionBroker, sessionIntake: sessionBroker, workingDirectory, memoryRegistry, pairingTokens, sessionLiveTurnControls, powerManager, memoryGovernor, voiceSetup, relayAvailable: () => configManager.get('relay.enabled') === true, pairingWebOrigin: () => resolvePairingWebOrigin(configManager).origin, ...wireFleetNeedsInputPush({ registry: processRegistry, runtimeBus: options.runtimeBus, sessionBroker }) });
+  attachWsOnlyGatewayVerbHandlers(gatewayMethods, { processRegistry, workspaceCheckpointManager, conversationRewindPort: createSessionConversationRewindPort(), sessionBroker, secretsManager, stepUpService, approvalBroker, requestApproval: (input) => approvalBroker.requestApproval(input), watcherRegistry, userPermissionRuleStore, shellPaths, configManager, runtimeStore: options.runtimeStore, channelDeliveryRouter, providerRegistry, automationManager, sessionLister: sessionBroker, sessionIntake: sessionBroker, workingDirectory, memoryRegistry, pairingTokens, sessionLiveTurnControls, powerManager, memoryGovernor, voiceSetup, relayAvailable: () => configManager.get('relay.enabled') === true, pairingWebOrigin: () => resolvePairingWebOrigin(configManager).origin, disposal: disposalScope.registry, ...wireFleetNeedsInputPush({ registry: processRegistry, runtimeBus: options.runtimeBus, sessionBroker }) });
   const integrationHelpers = new IntegrationHelperService({
     surface, // surface-scoped: continuity's recovery-file check must read the SAME paths the app writes with, not the unscoped legacy pair.
     runtimeStore: options.runtimeStore,
@@ -684,7 +679,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   // bridge (the high-churn 'ops' domain stays out of the wholesale allowlist).
   wireMemoryPressureNotice(options.runtimeBus, notificationDispatcher);
 
-  return {
+  const services: RuntimeServices = {
     workingDirectory,
     homeDirectory,
     surface,
@@ -762,6 +757,9 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     toolLLM,
     distributedRuntime,
     daemonHandlers,
+    clusterCoordinator,
+    clusterGroup,
+    startCluster: () => startClusterServices({ clusterGroup, clusterCoordinator }),
     remoteRunnerRegistry,
     remoteSupervisor,
     sessionMemoryStore,
@@ -796,5 +794,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     workspaceCheckpointManager,
     integrationHelpers,
     rerootStores: createStoreRerooter({ codeIndexStore, projectIndex }),
+    dispose: (): void => disposalScope.dispose(),
   };
+  registerSurfaceRuntimePollers(disposalScope.registry, services, { stopConfigWatch }); return services;
 }

package/src/verification/verification-ledger.ts

@@ -206,9 +206,47 @@ const ENABLEMENT_KEYS_BEHAVIOR_VERIFIED = new Set(
 ).size;
 
 /** Settings with real local behavior verification: the authored baseline plus the persistence-tested feature-knob, device/trigger, and enablement keys. */
+/**
+ * Config keys added by the LAN group-key layer: the automatic group-key
+ * rotation interval, the dual-generation acceptance window around a rotation,
+ * the discovery beacon interval, and the roster gossip interval.
+ *
+ * THIS CONSTANT IS NOT A DIAL, for the same reason as the two above. Each key
+ * is counted because a test that exercises it was actually written:
+ * `src/test/verification/cluster-group-settings-persistence.test.ts` runs the
+ * same four-part persistence contract — schema default exposure, `set()`
+ * through the key's own validator to disk, reload into a fresh ConfigManager
+ * with read-back equality, and reset-to-default that survives reload.
+ *
+ * PER-KEY EVIDENCE. All four have a LIVE consumer in this build, which is more
+ * than several of the keys counted above can claim:
+ *   cluster.keyRotationHours        — read by resolveClusterGroupSettings and
+ *                                     compared against the current key's age in
+ *                                     the group runtime's rotation check.
+ *   cluster.keyRotationGraceMinutes — sets how long the previous generation
+ *                                     stays accepted after a scheduled
+ *                                     rotation; drives the keyring's accepted
+ *                                     generation set.
+ *   cluster.beaconSeconds           — the discovery beacon timer interval, and
+ *                                     the basis of the "recently heard from"
+ *                                     window that decides which member mints a
+ *                                     rotation.
+ *   cluster.rosterGossipSeconds     — how often the member list is shared.
+ *
+ * `cluster.enabled` is NOT here: it is a feature enablement key and the ledger
+ * counts those in its own set.
+ */
+export const CLUSTER_GROUP_LOCAL_SETTINGS = [
+  'cluster.keyRotationHours',
+  'cluster.keyRotationGraceMinutes',
+  'cluster.beaconSeconds',
+  'cluster.rosterGossipSeconds',
+] as const;
+
 const SETTINGS_BEHAVIOR_VERIFIED = SETTINGS_BEHAVIOR_BASELINE
   + FEATURE_KNOB_LOCAL_SETTINGS.length
   + DEVICE_AND_TRIGGER_LOCAL_SETTINGS.length
+  + CLUSTER_GROUP_LOCAL_SETTINGS.length
   + ENABLEMENT_KEYS_BEHAVIOR_VERIFIED;
 
 const EXTERNAL_SLASH_COMMANDS = new Set([

package/src/version.ts

@@ -6,7 +6,7 @@ import { join } from 'node:path';
 // The prebuild script updates the fallback value before compilation.
 // Uses import.meta.dir (Bun) to locate package.json relative to this file,
 // which is correct regardless of the process working directory.
-let _version = '1.23.0';
+let _version = '1.24.0';
 try {
   const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', 'package.json'), 'utf-8'));
   // Only trust a version read from OUR OWN package.json. A Bun single-file