@pellux/goodvibes-tui 1.24.1 → 1.25.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pellux/goodvibes-tui",
-  "version": "1.24.1",
+  "version": "1.25.0",
   "description": "Terminal-native GoodVibes product for coding, operations, automation, knowledge, channels, and daemon-backed control-plane workflows.",
   "type": "module",
   "main": "src/main.ts",
@@ -106,8 +106,8 @@
     "@anthropic-ai/vertex-sdk": "^0.16.0",
     "@ast-grep/napi": "^0.42.0",
     "@aws/bedrock-token-generator": "^1.1.0",
-    "@pellux/goodvibes-sdk": "1.17.2",
-    "@pellux/goodvibes-terminal-shell": "1.17.2",
+    "@pellux/goodvibes-sdk": "1.18.1",
+    "@pellux/goodvibes-terminal-shell": "1.18.1",
     "bash-language-server": "^5.6.0",
     "fuse.js": "^7.1.0",
     "graphql": "^16.13.2",
@@ -133,10 +133,10 @@
     "typescript": "^5.9.3"
   },
   "optionalDependencies": {
-    "@pellux/goodvibes-tui-linux-x64": "1.23.0",
-    "@pellux/goodvibes-tui-linux-arm64": "1.23.0",
-    "@pellux/goodvibes-tui-darwin-x64": "1.23.0",
-    "@pellux/goodvibes-tui-darwin-arm64": "1.23.0"
+    "@pellux/goodvibes-tui-linux-x64": "1.25.0",
+    "@pellux/goodvibes-tui-linux-arm64": "1.25.0",
+    "@pellux/goodvibes-tui-darwin-x64": "1.25.0",
+    "@pellux/goodvibes-tui-darwin-arm64": "1.25.0"
   },
   "trustedDependencies": [],
   "overrides": {

package/src/config/goodvibes-home.ts

@@ -0,0 +1,139 @@
+/**
+ * goodvibes-home.ts — where this process's GoodVibes tree lives, resolved in
+ * ONE place for every entry point.
+ *
+ * ## The defect this closes
+ *
+ * `GOODVIBES_HOME` relocates the tree root. It was read by exactly one file —
+ * `src/daemon/cli.ts` — and the CLIENT entry point (`src/main.ts`) called
+ * `homedir()` unconditionally, on the same object literal where it did honour
+ * `GOODVIBES_WORKING_DIR`. So a harness that set `GOODVIBES_HOME` to a
+ * throwaway directory and then ran a client command got a process that read and
+ * wrote the REAL tree: settings, workspace state, and — because the daemon-tier
+ * secret store is derived from the tree root — `~/.goodvibes/daemon/secrets.enc`.
+ *
+ * That is not hypothetical. An isolated round stored two throwaway credentials
+ * and they landed in the owner's live secret store, where they had to be
+ * removed by hand. An isolation boundary a process can walk out of is not a
+ * boundary; the honest fix is that no entry point resolves a home of its own.
+ *
+ * ## What each variable means
+ *
+ *  - `GOODVIBES_HOME` — the tree ROOT, the directory `.goodvibes/` sits under.
+ *    Setting it relocates settings, workspace, discovery roots, and every tier
+ *    of the secret store. This is what an isolated harness or a service unit
+ *    sets.
+ *  - `GOODVIBES_DAEMON_HOME` — the daemon's own IDENTITY directory (auth users,
+ *    operator tokens, daemon settings). It falls under the tree root unless set
+ *    separately, and it names only that directory: it is not a second way to
+ *    move the tree. Both entry points resolve it the same way now, so a client
+ *    given only this variable no longer computes the daemon-tier secret path
+ *    from the real home while everything else points at a sandbox.
+ *
+ * Both readers take `env` as an argument rather than reaching for
+ * `process.env`, so the resolution is exercisable without a test having to
+ * mutate the environment of the process running it.
+ */
+
+import { homedir } from 'node:os';
+import { isAbsolute, join, resolve } from 'node:path';
+
+/** The two roots every surface derives its storage from. */
+export interface GoodVibesHomeOwnership {
+  /** The tree root: the directory `.goodvibes/` sits under. */
+  readonly homeDirectory: string;
+  /** The daemon's own identity directory, under the tree root by default. */
+  readonly daemonHomeDirectory: string;
+}
+
+/**
+ * The tree root for this process.
+ *
+ * A blank or whitespace-only value is treated as absent rather than as the
+ * empty path, because `GOODVIBES_HOME=` in a unit file or a shell wrapper means
+ * "unset", and resolving it to `''` would put the whole tree at the filesystem
+ * root.
+ */
+export function resolveGoodVibesHome(env: NodeJS.ProcessEnv = process.env): string {
+  const override = env['GOODVIBES_HOME']?.trim();
+  if (override) return isAbsolute(override) ? override : resolve(process.cwd(), override);
+  // The login home comes from the injected env first so the whole resolution is
+  // exercisable without a test mutating the environment it is running in. This
+  // is not a behaviour change: on Linux and macOS `homedir()` already prefers
+  // $HOME, and where it does not (Windows, where HOME is usually unset) the
+  // fallback below is what answers.
+  const loginHome = env['HOME']?.trim();
+  return loginHome ? loginHome : homedir();
+}
+
+/**
+ * The daemon's identity directory.
+ *
+ * @param homeDirectory - The already-resolved tree root, so a caller cannot
+ *   accidentally combine an overridden root with a default daemon home.
+ */
+export function resolveGoodVibesDaemonHome(
+  homeDirectory: string,
+  env: NodeJS.ProcessEnv = process.env,
+): string {
+  const override = env['GOODVIBES_DAEMON_HOME']?.trim();
+  if (!override) return join(homeDirectory, '.goodvibes', 'daemon');
+  return isAbsolute(override) ? override : resolve(process.cwd(), override);
+}
+
+/**
+ * The `.goodvibes` directory itself — the tree, not the root it sits under.
+ *
+ * This exists because the two were being derived independently and did not
+ * agree. `GOODVIBES_HOME` meant the tree ROOT to the runtime
+ * (`<GOODVIBES_HOME>/.goodvibes/...`) and meant the `.goodvibes` DIRECTORY to
+ * the two reporting scripts, which read it as
+ * `process.env.GOODVIBES_HOME ?? join(homedir(), '.goodvibes')`. Set it to
+ * `/tmp/sandbox` to isolate a run and the runtime wrote
+ * `/tmp/sandbox/.goodvibes/`, while a script inspected `/tmp/sandbox` as though
+ * it were already the tree — so the two halves of one round disagreed about
+ * which files were even in scope.
+ *
+ * That is the shape of an incident that has already happened here: a
+ * home-redirection variable honoured by one entry point and ignored by another
+ * put two throwaway credentials in the owner's live secret store. One variable
+ * has one meaning now, and it is the runtime's, because the runtime is what
+ * writes secrets and because an isolation harness needs a single root that
+ * everything falls under.
+ *
+ * A caller that genuinely wants to name a `.goodvibes` directory directly —
+ * auditing a tree that is not under any home — passes it explicitly rather than
+ * through the environment. Both scripts keep a `--home` flag for exactly that.
+ */
+export function resolveGoodVibesTreeDirectory(env: NodeJS.ProcessEnv = process.env): string {
+  return join(resolveGoodVibesHome(env), '.goodvibes');
+}
+
+/** Both roots at once — what an entry point wants. */
+export function resolveGoodVibesHomeOwnership(
+  env: NodeJS.ProcessEnv = process.env,
+): GoodVibesHomeOwnership {
+  const homeDirectory = resolveGoodVibesHome(env);
+  return {
+    homeDirectory,
+    daemonHomeDirectory: resolveGoodVibesDaemonHome(homeDirectory, env),
+  };
+}
+
+/**
+ * True when either root was relocated for this process.
+ *
+ * The daemon lifecycle asks this to decide whether it may adopt the machine's
+ * service unit: a process told to run out of somewhere else is a throwaway, and
+ * one that adopted the unit had systemd supervise it as the machine's daemon
+ * for five hours while it read the real home's credentials.
+ *
+ * It lives here because the two variables have exactly one reader, and the
+ * answer is a question ABOUT them. A caller checking `process.env` for itself is
+ * how the second meaning that started all of this gets reintroduced — so the
+ * question is answered here rather than asked again somewhere else.
+ */
+export function hasOverriddenGoodVibesHome(env: NodeJS.ProcessEnv = process.env): boolean {
+  return (env['GOODVIBES_HOME']?.trim() ?? '') !== ''
+    || (env['GOODVIBES_DAEMON_HOME']?.trim() ?? '') !== '';
+}

package/src/daemon/cli.ts

@@ -1,5 +1,4 @@
 import { homedir } from 'node:os';
-import { isAbsolute, join, resolve } from 'node:path';
 import {
   ConfigManager,
   deriveControlPlaneBaseUrl,
@@ -8,6 +7,7 @@ import {
 } from '@pellux/goodvibes-sdk/platform/config';
 import type { ConfigKey } from '@pellux/goodvibes-sdk/platform/config';
 import { formatProviderModel, getModelIdFromProviderModel, getProviderIdFromModel } from '../config/provider-model.ts';
+import { resolveGoodVibesHomeOwnership, hasOverriddenGoodVibesHome } from '../config/goodvibes-home.ts';
 import { RuntimeEventBus, GlobalNetworkTransportInstaller } from '@/runtime/index.ts';
 import { bindFeatureSettingsBridge, createFeatureFlagManager, deriveFeatureStates } from '@/runtime/index.ts';
 import { createRuntimeStore } from '../runtime/store/index.ts';
@@ -83,11 +83,11 @@ type DaemonCliTokens = {
  * daemon home then falls under it unless separately overridden.
  */
 function resolveDaemonCliOwnership(): DaemonCliOwnership {
-  const homeDirectory = process.env['GOODVIBES_HOME']?.trim() || homedir();
-  const daemonHomeOverride = process.env['GOODVIBES_DAEMON_HOME']?.trim();
-  const daemonHomeDirectory = daemonHomeOverride
-    ? (isAbsolute(daemonHomeOverride) ? daemonHomeOverride : resolve(process.cwd(), daemonHomeOverride))
-    : join(homeDirectory, '.goodvibes', 'daemon');
+  // Both roots come from src/config/goodvibes-home.ts, which the CLIENT entry
+  // point also uses. They were resolved independently, and the client's copy
+  // simply did not read GOODVIBES_HOME — so a redirected client wrote into the
+  // real tree while the daemon honoured the redirect.
+  const { homeDirectory, daemonHomeDirectory } = resolveGoodVibesHomeOwnership();
   return {
     workingDirectory: process.env['GOODVIBES_WORKING_DIR'] ?? process.cwd(),
     homeDirectory,
@@ -314,6 +314,11 @@ async function main(): Promise<void> {
     getConversationTitle: () => 'goodvibes daemon',
     workingDir,
     homeDirectory,
+    // Honour --daemon-home / GOODVIBES_DAEMON_HOME on the CREDENTIAL store, not
+    // just the identity directory. Without this a daemon told to run out of a
+    // temp tree still read the real home's daemon secrets, so "isolating" a
+    // test daemon left it holding the owner's live credentials.
+    daemonHomeDirectory,
     // The standalone daemon observes externally-launched coding-agent sessions
     // on the host read-only (fleet visibility + steer; never counted, never
     // stopped). Daemon-side only — the interactive process reads this snapshot
@@ -361,6 +366,12 @@ async function main(): Promise<void> {
     // undefined for a non-binary install, so a dev run stays host-managed and
     // never swaps the interpreter. See lifecycle.ts.
     updateArtifact: resolveDaemonUpdateArtifact({ version: VERSION }),
+    // A daemon running out of an overridden home must never adopt the machine's
+    // service unit. One did: started from a scratchpad with --daemon-home, it
+    // found the unit not running, wrote its own scratchpad ExecStart into
+    // ~/.config/systemd/user/goodvibes.service and exited, and systemd then
+    // supervised the throwaway as the machine's daemon for five hours.
+    hasOverriddenHome: hasOverriddenGoodVibesHome(),
     // The SAME coordinator this repository's inbox poller registered with (see
     // runtime/cluster-composition.ts). The facade must reuse it rather than
     // compose its own: two coordinators in one process are two nodes in the

package/src/daemon/handlers/index.ts

@@ -56,10 +56,6 @@ export interface DaemonHandlerSurfaceProviders {
   readonly registerInbox: (ctx: HandlerContext, routing: RoutingRegistration) => Unregister;
   /** channels.drafts.* */
   readonly registerDrafts: SurfaceRegister;
-  /** calendar.* */
-  readonly registerCalendar: SurfaceRegister;
-  /** email.* */
-  readonly registerEmail: SurfaceRegister;
   /** remote.peers.* — supplies the host DistributedRuntimeRouteService + dispatch adapter. */
   readonly registerRemote: (ctx: HandlerContext) => RemoteSurfaceRegistration;
 }
@@ -82,8 +78,13 @@ export function registerDaemonHandlers(
 
   teardowns.push(providers.registerInbox(ctx, routing));
   teardowns.push(providers.registerDrafts(ctx));
-  teardowns.push(providers.registerCalendar(ctx));
-  teardowns.push(providers.registerEmail(ctx));
+  // calendar.* and email.* are NOT registered here any more. Both are served
+  // by the SDK (control-plane/routes/{calendar,email}.ts over the platform
+  // CalDAV/Google and IMAP/SMTP implementations), registered through
+  // registerGatewayVerbGroups in runtime/services.ts. This product used to
+  // carry its own handlers for the same descriptor ids and, registering later,
+  // won — two implementations behind one path, which is the drift the hoist
+  // exists to end.
 
   const remote = providers.registerRemote(ctx);
   teardowns.push(remote.unregister);

package/src/input/commands/calendar-runtime.ts

@@ -0,0 +1,245 @@
+/**
+ * calendar-runtime.ts — `/calendar`, the terminal surface over the daemon's
+ * calendar capability.
+ *
+ * As with `/mail`, no calendar logic lives here. CalDAV, ICS parsing, settings
+ * resolution and the confirmation gate are all in
+ * `src/daemon/handlers/calendar/`; this file parses arguments, renders results,
+ * and refuses honestly when the capability is not set up.
+ *
+ * ## What is exposed, and what is not
+ *
+ * `list` (the agenda) and `get` are exposed: knowing what is next without
+ * leaving the terminal is the whole value of a calendar on this surface.
+ * `create` is exposed behind the same preview-then-`--confirm` step `/mail
+ * send` uses, because the daemon gates it on both `body.confirm` and an
+ * explicit user request, and because an event created by a typo is a real
+ * nuisance to undo.
+ *
+ * `calendar.ics.import` and `calendar.ics.export` are deliberately NOT given a
+ * command. They are bulk file-level transfers of a whole calendar — an
+ * operation whose natural home is a file path and a scheduled job, not a line
+ * typed into a coding session. They stay available to any surface through the
+ * same catalog; this product simply does not claim to be the right place for
+ * them. That is a scoping decision, recorded here so it reads as a choice
+ * rather than an omission.
+ */
+
+import type { CommandContext, CommandRegistry } from '../command-registry.ts';
+import {
+  EXPLICIT_WRITE_INVOCATION_CONTEXT,
+  READ_INVOCATION_CONTEXT,
+  errorText,
+  probeConnection,
+  renderConnectionStatus,
+} from './connection-status.ts';
+
+/** Agenda item, exactly the daemon's `calendar.events.list` item shape. */
+interface CalendarEvent {
+  readonly id: string;
+  readonly title: string;
+  readonly start: string;
+  readonly end: string;
+  readonly location?: string;
+  readonly description?: string;
+  readonly attendees?: readonly string[];
+}
+
+const DEFAULT_LIST_LIMIT = 20;
+const MAX_LIST_LIMIT = 200;
+
+/**
+ * Render a timestamp for a terminal agenda.
+ *
+ * An unparseable value is printed verbatim rather than replaced with a
+ * placeholder — showing what the server actually returned is more useful than
+ * hiding it behind "invalid date".
+ */
+export function formatWhen(raw: string): string {
+  const parsed = new Date(raw);
+  if (Number.isNaN(parsed.getTime())) return raw;
+  const date = parsed.toISOString().slice(0, 10);
+  const time = parsed.toISOString().slice(11, 16);
+  return `${date} ${time}`;
+}
+
+function truncate(value: string, width: number): string {
+  const flat = value.replace(/\s+/g, ' ').trim();
+  return flat.length <= width ? flat : `${flat.slice(0, width - 1)}…`;
+}
+
+export function renderAgenda(events: readonly CalendarEvent[]): string {
+  if (events.length === 0) return 'No events in this window.';
+  const lines = [`Agenda — ${events.length} event${events.length === 1 ? '' : 's'}:`];
+  for (const event of events) {
+    const where = event.location ? `  @ ${truncate(event.location, 24)}` : '';
+    lines.push(`  ${formatWhen(event.start)}  ${truncate(event.title, 44).padEnd(44)}${where}`);
+  }
+  lines.push('', '  /calendar get <id> — open one event');
+  return lines.join('\n');
+}
+
+export function renderEvent(event: CalendarEvent): string {
+  const lines = [
+    `Title:  ${event.title}`,
+    `Start:  ${formatWhen(event.start)}`,
+    `End:    ${formatWhen(event.end)}`,
+  ];
+  if (event.location) lines.push(`Where:  ${event.location}`);
+  const attendees = event.attendees ?? [];
+  if (attendees.length > 0) lines.push(`With:   ${attendees.join(', ')}`);
+  if (event.description && event.description.trim().length > 0) {
+    lines.push('', event.description.trimEnd());
+  }
+  return lines.join('\n');
+}
+
+/**
+ * Split `title | start | end` on unescaped pipes — same separator rule as
+ * `/mail`, for the same reason: titles contain spaces and per-command quoting
+ * conventions are their own bug source.
+ */
+export function parseEventArgs(raw: string): { title: string; start: string; end: string } | null {
+  const parts = raw.split('|').map((part) => part.trim());
+  if (parts.length !== 3) return null;
+  const [title, start, end] = parts;
+  if (!title || !start || !end) return null;
+  return { title, start, end };
+}
+
+function parseLimit(raw: string | undefined): number {
+  const parsed = Number(raw);
+  if (!Number.isFinite(parsed) || parsed <= 0) return DEFAULT_LIST_LIMIT;
+  return Math.min(MAX_LIST_LIMIT, Math.floor(parsed));
+}
+
+const USAGE = [
+  'Usage:',
+  '  /calendar                   connection status and the agenda ahead',
+  '  /calendar status            connection status only',
+  '  /calendar list [n]          the next n events (default 20)',
+  '  /calendar get <id>          open one event',
+  '  /calendar create <title | start | end> [--confirm]   preview, then create',
+  '',
+  '  Times are ISO-8601, e.g. 2026-08-01T14:00:00Z',
+].join('\n');
+
+export function registerCalendarRuntimeCommands(registry: CommandRegistry): void {
+  registry.register({
+    name: 'calendar',
+    aliases: ['cal'],
+    description: 'Calendar over the daemon: connection status, agenda, event detail, create',
+    usage: '[status|list|get|create] …',
+    argsHint: '[status|list <n>|get <id>|create]',
+    async handler(args, ctx) {
+      const gateway = ctx.workspace.gatewayMethods;
+      const sub = (args[0] ?? '').toLowerCase();
+
+      if (sub === 'status') {
+        ctx.print(renderConnectionStatus(await probeConnection(gateway, 'calendar')));
+        return;
+      }
+
+      if (!gateway) {
+        ctx.print(renderConnectionStatus(await probeConnection(undefined, 'calendar')));
+        return;
+      }
+
+      if (sub === '' || sub === 'list') {
+        await listEvents(ctx, gateway, parseLimit(args[1]), sub === '');
+        return;
+      }
+      if (sub === 'get') {
+        await getEvent(ctx, gateway, args[1]);
+        return;
+      }
+      if (sub === 'create') {
+        await createEvent(ctx, gateway, args.slice(1));
+        return;
+      }
+      ctx.print(USAGE);
+    },
+  });
+}
+
+type Gateway = NonNullable<CommandContext['workspace']['gatewayMethods']>;
+
+async function withStatusOnFailure(
+  ctx: CommandContext,
+  gateway: Gateway,
+  label: string,
+  run: () => Promise<void>,
+): Promise<void> {
+  try {
+    await run();
+  } catch (error) {
+    ctx.print(`[calendar ${label}] ${errorText(error)}`);
+    ctx.print(renderConnectionStatus(await probeConnection(gateway, 'calendar')));
+  }
+}
+
+async function listEvents(ctx: CommandContext, gateway: Gateway, limit: number, withStatus: boolean): Promise<void> {
+  await withStatusOnFailure(ctx, gateway, 'list', async () => {
+    const result = await gateway.invoke('calendar.events.list', {
+      ...READ_INVOCATION_CONTEXT,
+      body: { limit, from: new Date().toISOString() },
+    }) as { readonly events?: readonly CalendarEvent[] };
+    if (withStatus) {
+      ctx.print(renderConnectionStatus({
+        surface: 'calendar',
+        state: 'ready',
+        detail: 'Calendar is connected — the daemon reached the server and returned a result.',
+        nextActions: [],
+      }));
+    }
+    ctx.print(renderAgenda(result.events ?? []));
+  });
+}
+
+async function getEvent(ctx: CommandContext, gateway: Gateway, eventId: string | undefined): Promise<void> {
+  if (!eventId) {
+    ctx.print('Usage: /calendar get <id> — the id from /calendar list.');
+    return;
+  }
+  await withStatusOnFailure(ctx, gateway, 'get', async () => {
+    const event = await gateway.invoke('calendar.events.get', {
+      ...READ_INVOCATION_CONTEXT,
+      body: { eventId },
+    }) as CalendarEvent;
+    ctx.print(renderEvent(event));
+  });
+}
+
+async function createEvent(ctx: CommandContext, gateway: Gateway, rest: readonly string[]): Promise<void> {
+  const raw = rest.filter((part) => part !== '--confirm').join(' ');
+  const confirmed = rest.includes('--confirm');
+  const parsed = parseEventArgs(raw);
+  if (parsed === null) {
+    ctx.print([
+      'Usage: /calendar create <title | start | end>',
+      '  Three fields separated by | — for example:',
+      '  /calendar create Design review | 2026-08-01T14:00:00Z | 2026-08-01T15:00:00Z',
+    ].join('\n'));
+    return;
+  }
+
+  if (!confirmed) {
+    ctx.print([
+      'This would create:',
+      `  Title: ${parsed.title}`,
+      `  Start: ${formatWhen(parsed.start)}`,
+      `  End:   ${formatWhen(parsed.end)}`,
+      '',
+      'Nothing has been created. Re-run the same line with --confirm to create it.',
+    ].join('\n'));
+    return;
+  }
+
+  await withStatusOnFailure(ctx, gateway, 'create', async () => {
+    const result = await gateway.invoke('calendar.events.create', {
+      ...EXPLICIT_WRITE_INVOCATION_CONTEXT,
+      body: { title: parsed.title, start: parsed.start, end: parsed.end, confirm: true },
+    }) as { readonly eventId: string; readonly createdAt: string };
+    ctx.print(`Created "${parsed.title}" (event id ${result.eventId}, at ${result.createdAt}).`);
+  });
+}