@pellux/goodvibes-tui 1.24.2 → 1.26.0

package/src/runtime/runtime-services-types.ts

@@ -0,0 +1,243 @@
+/**
+ * runtime-services-types.ts — the public contract createRuntimeServices() takes
+ * and returns.
+ *
+ * Split out of services.ts (the composition root that builds every one of
+ * these fields) so the construction logic can stay under the repo's
+ * architecture line-count gate without trimming 35 arbitrary lines to clear
+ * the number. This module owns ONLY the shape of the input options and the
+ * output surface — no runtime code, no wiring order, nothing that constructs
+ * anything. services.ts re-exports both types from here, so no import site
+ * anywhere else in the app had to change.
+ */
+
+import type { FocusTracker } from '../core/focus-tracker.ts';
+import type { ConfigManager, ServiceRegistry, SubscriptionManager, ToolLLM } from '@pellux/goodvibes-sdk/platform/config';
+import type { SecretsManager } from '../config/secrets.ts';
+import type { AutomationDeliveryManager, AutomationManager } from '@pellux/goodvibes-sdk/platform/automation';
+import type { ChannelDeliveryRouter, ChannelPolicyManager, ChannelPluginRegistry, RouteBindingManager, SurfaceRegistry } from '@pellux/goodvibes-sdk/platform/channels';
+import type { ApprovalBroker, GatewayMethodCatalog, SessionLiveTurnControlsHolder, SharedSessionBroker } from '@pellux/goodvibes-sdk/platform/control-plane';
+import type { PowerManager } from '@pellux/goodvibes-sdk/platform/power';
+import type { wireIdlePowerAndLiveTurn } from './idle-power-services.ts';
+import type { StepUpService } from '@pellux/goodvibes-sdk/daemon';
+import type { PairingTokenManager } from '@pellux/goodvibes-sdk/platform/pairing';
+import type { WatcherRegistry } from '@pellux/goodvibes-sdk/platform/watchers';
+import type { ArtifactStore } from '@pellux/goodvibes-sdk/platform/artifacts';
+import type { HomeGraphService, KnowledgeService, ProjectPlanningService } from '@pellux/goodvibes-sdk/platform/knowledge';
+import type { MediaProviderRegistry } from '@pellux/goodvibes-sdk/platform/media';
+import type { MultimodalService } from '@pellux/goodvibes-sdk/platform/multimodal';
+import type { AgentMessageBus, AgentOrchestrator, ArchetypeLoader, WrfcController } from '@pellux/goodvibes-sdk/platform/agents';
+import type { AgentManager, ContextAccountingHolder, OverflowHandler, ProcessManager, WorkflowServices } from '@pellux/goodvibes-sdk/platform/tools';
+import type { FileUndoManager, MemoryConsolidationScheduler, MemoryEmbeddingProviderRegistry, MemoryRegistry, MemoryStore, ModeManager, ProjectIndex, CodeIndexStore, CodeIndexReindexScheduler } from '@pellux/goodvibes-sdk/platform/state';
+import type { StoreSnapshotScheduler } from '@pellux/goodvibes-sdk/platform/state/store-snapshots';
+import type { UserPermissionRuleStore } from '@pellux/goodvibes-sdk/platform/permissions';
+import type { buildExecPromptAnswerHandler } from '@pellux/goodvibes-sdk/platform/runtime/permissions/exec-prompt-wiring';
+import type { buildLocalhostFetchApproval } from '@pellux/goodvibes-sdk/platform/runtime/permissions/localhost-fetch-approval';
+import type { NotificationDispatcher } from './notification-dispatch.ts';
+import type { createDurabilityServices } from './durability-services.ts';
+import type { MemorySpineClient } from '@pellux/goodvibes-sdk/platform/runtime/memory-spine';
+import type { WorkspaceCheckpointManager } from '@pellux/goodvibes-sdk/platform/workspace';
+import type { DomainDispatch, RuntimeStore } from './store/index.ts';
+import type { RuntimeEventBus, DistributedRuntimeManager, RemoteRunnerRegistry, RemoteSupervisor, IntegrationHelperService, IdempotencyStore, ComponentHealthMonitor, WorktreeRegistry, SandboxSessionRegistry, ShellPathService, FeatureFlagManager, PolicyRuntimeState, SessionSurface } from '@/runtime/index.ts';
+import type { VoiceProviderRegistry, VoiceService } from '@pellux/goodvibes-sdk/platform/voice';
+import type { CacheRegistry, PauseController, MemoryGovernor } from '@pellux/goodvibes-sdk/platform/runtime/memory';
+import type { WebSearchProviderRegistry, WebSearchService } from '@pellux/goodvibes-sdk/platform/web-search';
+import type { PanelManager } from '../panels/panel-manager.ts';
+import type { HookActivityTracker } from '@pellux/goodvibes-sdk/platform/hooks';
+import type { HookDispatcher, HookWorkbench } from '@pellux/goodvibes-sdk/platform/hooks';
+import type { PluginManager } from '@pellux/goodvibes-sdk/platform/plugins';
+import type { BookmarkManager } from '@pellux/goodvibes-sdk/platform/bookmarks';
+import type { ProfileManager } from '@pellux/goodvibes-sdk/platform/profiles';
+import type { SessionManager, CrossSessionTaskRegistry, SessionChangeTracker } from '@pellux/goodvibes-sdk/platform/sessions';
+import type { ApiTokenAuditor, UserAuthManager } from '@pellux/goodvibes-sdk/platform/security';
+import type { WebhookNotifier } from '@pellux/goodvibes-sdk/platform/integrations';
+import type { McpRegistry } from '@pellux/goodvibes-sdk/platform/mcp';
+import type { BenchmarkStore, CacheHitTracker, FavoritesStore, ModelLimitsService, ProviderCapabilityRegistry, ProviderOptimizer, ProviderRegistry } from '@pellux/goodvibes-sdk/platform/providers';
+import type { KeybindingsManager } from '../input/keybindings.ts';
+import type { AdaptivePlanner, DeterministicReplayEngine, ExecutionPlanManager, SessionLineageTracker, SessionMemoryStore } from '@pellux/goodvibes-sdk/platform/core';
+import type { ArchivableProcessRegistry } from '@pellux/goodvibes-sdk/platform/runtime/fleet';
+import type { OrchestrationEngine, WorkstreamCommandService } from './workstream-services.ts';
+import type { WorkPlanStore } from '../work-plans/work-plan-store.ts';
+import type { DaemonHandlerSurfaces } from '../daemon/handlers/index.ts';
+import type { ClusterGroupComposition } from './cluster-group-composition.ts';
+import type { ClusterCoordinator } from '@pellux/goodvibes-sdk/platform/cluster';
+import type { WorkspaceTrustManager } from './trust/workspace-trust.ts';
+
+export interface RuntimeServicesOptions {
+  readonly runtimeBus: RuntimeEventBus;
+  readonly runtimeStore: RuntimeStore;
+  readonly configManager: ConfigManager;
+  readonly localUserAuthManager?: UserAuthManager;
+  readonly featureFlags?: FeatureFlagManager;
+  readonly getConversationTitle?: () => string | undefined;
+  readonly workingDir: string;
+  readonly homeDirectory: string;
+  /**
+   * The daemon's state root when the host was told one (`--daemon-home`,
+   * `GOODVIBES_DAEMON_HOME`); absent ⇒ `<homeDirectory>/.goodvibes/daemon`.
+   * Threaded into `SecretsManager` so the override MOVES the daemon-scoped
+   * credential store; without it a daemon told to run out of a temp tree still
+   * read the real home's daemon secrets, so an "isolated" test daemon held the
+   * owner's live credentials. One name for one thing — `resolveGoodVibesHomeOwnership`
+   * is the single reader that produces it.
+   */
+  readonly daemonHomeDirectory?: string | undefined;
+  /** Opt-in (daemon-side only): fold host-observed external coding-agent sessions
+   * into the fleet as 'observed-external' rows. Interactive leaves it off and reads
+   * the daemon snapshot. Mirrors the SDK's own createRuntimeServices option. */
+  readonly observeExternalAgents?: boolean | undefined;
+  /** Host power seam opt-in. Fork mirrors the SDK: non-spawning unavailable-seam
+   * default (idle-power-services.ts); daemon + embedded runtime pass createHostPowerSeam(). */
+  readonly powerSeam?: Parameters<typeof wireIdlePowerAndLiveTurn>[0]['powerSeam'];
+  /** Live session id, read per crash-residue sweep so the running session is exempt — see durability-services.ts. */
+  readonly currentSessionId?: (() => string | null) | undefined;
+}
+
+export interface RuntimeServices {
+  readonly workingDirectory: string;
+  readonly homeDirectory: string;
+  /** The declare-once session-storage handle every session reader and writer threads through — see session-storage-services.ts. */
+  readonly surface: SessionSurface;
+  readonly shellPaths: ShellPathService;
+  readonly configManager: ConfigManager;
+  readonly featureFlags: FeatureFlagManager;
+  readonly runtimeBus: RuntimeEventBus;
+  readonly runtimeStore: RuntimeStore;
+  readonly runtimeDispatch: DomainDispatch;
+  readonly panelManager: PanelManager;
+  readonly keybindingsManager: KeybindingsManager;
+  readonly routeBindings: RouteBindingManager;
+  readonly surfaceRegistry: SurfaceRegistry;
+  readonly channelPlugins: ChannelPluginRegistry;
+  readonly channelDeliveryRouter: ChannelDeliveryRouter;
+  readonly watcherRegistry: WatcherRegistry;
+  readonly approvalBroker: ApprovalBroker;
+  /** Loopback-fetch approval that rides the approval broker; shared by the tool registry and orchestrator so every surface asks the same way. */
+  readonly localhostFetchApproval: ReturnType<typeof buildLocalhostFetchApproval>;
+  /** Terminal prompt-answer handler that rides the approval broker; shared by the tool registry and orchestrator so an interactive command's prompt gets an ask/card on every surface. */
+  readonly execPromptAnswerHandler: ReturnType<typeof buildExecPromptAnswerHandler>;
+  /** Routes curated runtime-domain events into the panel_only notification feed (the panel's live producer). */
+  readonly notificationDispatcher: NotificationDispatcher;
+  /** Durable user-origin permission rules (remembered approvals); permissions.rules.* surface. Mirrors the SDK composition. */
+  readonly userPermissionRuleStore: UserPermissionRuleStore;
+  readonly sessionBroker: SharedSessionBroker;
+  readonly deliveryManager: AutomationDeliveryManager;
+  readonly automationManager: AutomationManager;
+  readonly gatewayMethods: GatewayMethodCatalog;
+  readonly artifactStore: ArtifactStore;
+  readonly knowledgeService: KnowledgeService;
+  readonly agentKnowledgeService: KnowledgeService;
+  readonly homeGraphService: HomeGraphService;
+  readonly projectPlanningService: ProjectPlanningService;
+  readonly projectPlanningProjectId: string;
+  readonly workPlanStore: WorkPlanStore;
+  readonly memoryStore: MemoryStore;
+  readonly memoryRegistry: MemoryRegistry;
+  /** Host-vs-client memory access: local until bootstrap.ts activates it for an adopted 'external' daemon (mirrors sessionSpine). */
+  readonly memorySpine: MemorySpineClient;
+  readonly serviceRegistry: ServiceRegistry;
+  readonly secretsManager: SecretsManager;
+  readonly stepUpService: StepUpService;
+  readonly pairingTokens: PairingTokenManager; // backs pairing.tokens.* verbs + the settings device surface (mirrors the SDK composition)
+  readonly subscriptionManager: SubscriptionManager;
+  readonly localUserAuthManager: UserAuthManager;
+  readonly profileManager: ProfileManager;
+  readonly bookmarkManager: BookmarkManager;
+  readonly sessionManager: SessionManager;
+  readonly sessionOrchestration: CrossSessionTaskRegistry;
+  readonly hookDispatcher: HookDispatcher;
+  readonly hookActivityTracker: HookActivityTracker;
+  readonly hookWorkbench: HookWorkbench;
+  readonly pluginManager: PluginManager;
+  readonly workflow: WorkflowServices;
+  readonly voiceProviders: VoiceProviderRegistry;
+  readonly voiceService: VoiceService;
+  readonly webSearchProviders: WebSearchProviderRegistry;
+  readonly webSearchService: WebSearchService;
+  readonly mediaProviders: MediaProviderRegistry;
+  readonly multimodalService: MultimodalService;
+  readonly memoryEmbeddingRegistry: MemoryEmbeddingProviderRegistry;
+  readonly channelPolicy: ChannelPolicyManager;
+  readonly mcpRegistry: McpRegistry;
+  readonly tokenAuditor: ApiTokenAuditor;
+  readonly componentHealthMonitor: ComponentHealthMonitor;
+  readonly worktreeRegistry: WorktreeRegistry;
+  readonly sandboxSessionRegistry: SandboxSessionRegistry;
+  readonly webhookNotifier: WebhookNotifier;
+  /** Terminal focus tracker — fed by input/handler-feed.ts, read by the alert notifiers in core/. */
+  readonly focusTracker: FocusTracker;
+  readonly replayEngine: DeterministicReplayEngine;
+  readonly providerOptimizer: ProviderOptimizer;
+  readonly providerCapabilityRegistry: ProviderCapabilityRegistry;
+  readonly cacheHitTracker: CacheHitTracker;
+  readonly favoritesStore: FavoritesStore;
+  readonly benchmarkStore: BenchmarkStore;
+  readonly modelLimitsService: ModelLimitsService;
+  readonly providerRegistry: ProviderRegistry;
+  readonly toolLLM: ToolLLM;
+  readonly distributedRuntime: DistributedRuntimeManager;
+  readonly daemonHandlers: DaemonHandlerSurfaces;
+  /** Elects the one node on this network that consumes inbound messages; hand it to the DaemonServer so its consumers share this leadership instead of holding a second election. */
+  readonly clusterCoordinator: ClusterCoordinator;
+  /** LAN group membership: identity, keys, roster, and the `cluster` verbs. */
+  readonly clusterGroup: ClusterGroupComposition;
+  /** Start the group layer and then the election, in that order. Idempotent. */
+  readonly startCluster: () => Promise<void>;
+  readonly remoteRunnerRegistry: RemoteRunnerRegistry;
+  readonly remoteSupervisor: RemoteSupervisor;
+  readonly sessionMemoryStore: SessionMemoryStore;
+  readonly sessionLineageTracker: SessionLineageTracker;
+  readonly sessionChangeTracker: SessionChangeTracker;
+  readonly planManager: ExecutionPlanManager;
+  readonly adaptivePlanner: AdaptivePlanner;
+  readonly idempotencyStore: IdempotencyStore;
+  readonly overflowHandler: OverflowHandler;
+  readonly policyRuntimeState: PolicyRuntimeState;
+  readonly archetypeLoader: ArchetypeLoader;
+  readonly agentManager: AgentManager;
+  readonly agentMessageBus: AgentMessageBus;
+  readonly agentOrchestrator: AgentOrchestrator;
+  readonly contextAccountingHolder: ContextAccountingHolder; // bound at bootstrap.ts; see context-accounting-source.ts
+  readonly wrfcController: WrfcController;
+  readonly processManager: ProcessManager;
+  /** The phase/work-item orchestration engine — see runtime/workstream-services.ts. */
+  readonly orchestrationEngine: OrchestrationEngine;
+  readonly workstreamCommands: WorkstreamCommandService;
+  /** The repo source-tree code index — see runtime/code-index-services.ts. */
+  readonly codeIndexStore: CodeIndexStore;
+  readonly codeIndexReindexScheduler: CodeIndexReindexScheduler; // tool-site reindex
+  /** Daily snapshots of every SQLite store this runtime writes, with bounded retention; unref'd timers (mirrors the SDK composition — hosts that tear down a runtime stop() it themselves). */
+  readonly storeSnapshotScheduler: StoreSnapshotScheduler;
+  readonly appendOnlyRetentionScheduler: ReturnType<typeof createDurabilityServices>['appendOnlyRetentionScheduler']; // periodic append-only sweep; unref'd timers, stop() on teardown
+  /** Stops the recurring crash-residue sweep; idempotent, unref'd timer (hosts that tear a runtime down call it). */
+  readonly stopDurabilityHousekeeping: () => void;
+  readonly memoryConsolidationScheduler: MemoryConsolidationScheduler;
+  readonly powerManager: PowerManager;
+  /** The daemon's memory governor (default ON). Backs ops.memory.get and defends the daemon's footprint by tier. */
+  readonly memoryGovernor: MemoryGovernor;
+  /** Registry of every retained cache the governor can shrink (knowledge stores + shared session broker). */
+  readonly cacheRegistry: CacheRegistry;
+  /** Controller the governor uses to pause/resume the deferrable background jobs under pressure. */
+  readonly pauseController: PauseController;
+  readonly sessionLiveTurnControls: SessionLiveTurnControlsHolder;
+  /** Unified live process registry (agents, WRFC chains, workflows, watchers, background processes) backing the Fleet panel; archive-aware — finished subtrees can be moved to the session archive view. */
+  readonly processRegistry: ArchivableProcessRegistry;
+  readonly modeManager: ModeManager;
+  readonly fileUndoManager: FileUndoManager;
+  readonly workspaceCheckpointManager: WorkspaceCheckpointManager;
+  /** Per-workspace trust gate — restricts write/execute/delegate tools until the workspace is trusted. */
+  readonly workspaceTrustManager: WorkspaceTrustManager;
+  readonly integrationHelpers: IntegrationHelperService;
+  /** Re-root path-bound stores (MemoryStore, ProjectIndex) to a new working directory, called by WorkspaceSwapManager after verification; stores needing a process restart just warn-log and keep serving the old path until the daemon restarts with the new --working-dir. */
+  rerootStores(newWorkingDir: string): Promise<void>;
+  /**
+   * Cancel the agent runs this graph is hosting, returning how many.
+   *
+   * Required by the SDK's RuntimePollerOwners: by dispose() time the fleet
+   * registry, orchestration engine, process registry and bus these runs report
+   * through are already down, so a run still described as "running" is orphaned
+   * rather than preserved.
+   */
+  cancelHostedAgentRuns(): number;
+  dispose(): void; // Stop every poller this graph started; best-effort, total, idempotent. This surface owns its graph — see disposal-wiring.ts.
+}

package/src/runtime/services.ts

@@ -1,60 +1,47 @@
 import { join } from 'node:path';
 import { FocusTracker } from '../core/focus-tracker.ts';
-import { ConfigManager, ServiceRegistry, SubscriptionManager, ToolLLM } from '@pellux/goodvibes-sdk/platform/config';
-import { SecretsManager } from '../config/secrets.ts';
+import { ServiceRegistry, SubscriptionManager, ToolLLM } from '@pellux/goodvibes-sdk/platform/config';
 import { AutomationDeliveryManager, AutomationManager } from '@pellux/goodvibes-sdk/platform/automation';
-import { ChannelDeliveryRouter, ChannelPolicyManager, type ChannelPluginRegistry, type RouteBindingManager, type SurfaceRegistry } from '@pellux/goodvibes-sdk/platform/channels';
-import { ApprovalBroker, GatewayMethodCatalog, SessionLiveTurnControlsHolder, SharedSessionBroker } from '@pellux/goodvibes-sdk/platform/control-plane';
-import type { PowerManager } from '@pellux/goodvibes-sdk/platform/power';
+import { ChannelDeliveryRouter, ChannelPolicyManager } from '@pellux/goodvibes-sdk/platform/channels';
+import { ApprovalBroker, GatewayMethodCatalog, SharedSessionBroker } from '@pellux/goodvibes-sdk/platform/control-plane';
 import { wireIdlePowerAndLiveTurn } from './idle-power-services.ts';
-import { StepUpService } from '@pellux/goodvibes-sdk/daemon';
-import { PairingTokenManager } from '@pellux/goodvibes-sdk/platform/pairing';
 import { resolvePairingWebOrigin } from '../core/pairing-origin.ts';
 import { attachWsOnlyGatewayVerbHandlers } from '@pellux/goodvibes-terminal-shell';
+import { composeMailDeps } from './mail-composition.ts';
+import { composeCredentialServices } from './credential-composition.ts';
 import { createDisposalScope, registerSurfaceRuntimePollers } from './disposal-wiring.ts';
 import { WatcherRegistry } from '@pellux/goodvibes-sdk/platform/watchers';
 import { ArtifactStore } from '@pellux/goodvibes-sdk/platform/artifacts';
 import { createWebKnowledgeGapRepairer } from '@pellux/goodvibes-sdk/platform/knowledge';
-import type { HomeGraphService, KnowledgeService, ProjectPlanningService } from '@pellux/goodvibes-sdk/platform/knowledge';
 import { createKnowledgeServices } from './knowledge-services.ts';
 import { MediaProviderRegistry, ensureBuiltinMediaProviders } from '@pellux/goodvibes-sdk/platform/media';
 import { MultimodalService } from '@pellux/goodvibes-sdk/platform/multimodal';
-import { AgentMessageBus, AgentOrchestrator, ArchetypeLoader, WrfcController } from '@pellux/goodvibes-sdk/platform/agents';
-import { AgentManager, ContextAccountingHolder, OverflowHandler, ProcessManager, cancelAllAgentRuns, createWorkflowServices, type WorkflowServices } from '@pellux/goodvibes-sdk/platform/tools';
-import { FileStateCache, FileUndoManager, MemoryConsolidationScheduler, MemoryEmbeddingProviderRegistry, MemoryRegistry, MemoryStore, ModeManager, ProjectIndex, resolveCanonicalMemoryDbPath, type CodeIndexStore, type CodeIndexReindexScheduler } from '@pellux/goodvibes-sdk/platform/state';
-import type { StoreSnapshotScheduler } from '@pellux/goodvibes-sdk/platform/state/store-snapshots';
-import type { UserPermissionRuleStore } from '@pellux/goodvibes-sdk/platform/permissions';
+import { OverflowHandler, ProcessManager, cancelAllAgentRuns, createWorkflowServices } from '@pellux/goodvibes-sdk/platform/tools';
+import { FileStateCache, FileUndoManager, MemoryEmbeddingProviderRegistry, MemoryRegistry, MemoryStore, ModeManager, ProjectIndex, resolveCanonicalMemoryDbPath } from '@pellux/goodvibes-sdk/platform/state';
 import { buildExecPromptAnswerHandler } from '@pellux/goodvibes-sdk/platform/runtime/permissions/exec-prompt-wiring';
 import { buildLocalhostFetchApproval } from '@pellux/goodvibes-sdk/platform/runtime/permissions/localhost-fetch-approval';
-import { createNotificationDispatcher, wireRuntimeNotificationBridge, wireMemoryPressureNotice, type NotificationDispatcher } from './notification-dispatch.ts';
+import { createNotificationDispatcher, wireRuntimeNotificationBridge, wireMemoryPressureNotice } from './notification-dispatch.ts';
 import { createDurabilityServices } from './durability-services.ts';
 import { MemorySpineClient, createLocalMemoryAccess } from '@pellux/goodvibes-sdk/platform/runtime/memory-spine';
-import { WorkspaceCheckpointManager } from '@pellux/goodvibes-sdk/platform/workspace';
 import { createWorkspaceCheckpointing } from './workspace-checkpointing.ts';
 import { createSessionConversationRewindPort } from './conversation-rewind-port.ts';
 import { createDomainDispatch } from './store/index.ts';
-import type { DomainDispatch, RuntimeStore } from './store/index.ts';
-import {
-  type RuntimeEventBus, DistributedRuntimeManager, RemoteRunnerRegistry, RemoteSupervisor, IntegrationHelperService,
-  IdempotencyStore, ComponentHealthMonitor, WorktreeRegistry, SandboxSessionRegistry, createShellPathService,
-  type ShellPathService, type FeatureFlagManager, createFeatureFlagManager, PolicyRuntimeState, type SessionSurface,
-} from '@/runtime/index.ts';
+import { DistributedRuntimeManager, IntegrationHelperService, IdempotencyStore, ComponentHealthMonitor, WorktreeRegistry, createShellPathService, createFeatureFlagManager, PolicyRuntimeState } from '@/runtime/index.ts';
 import { createSessionStorageServices } from './session-storage-services.ts';
 import { VoiceProviderRegistry, VoiceService, ensureBuiltinVoiceProviders } from '@pellux/goodvibes-sdk/platform/voice';
-import { CacheRegistry, PauseController, type MemoryGovernor } from '@pellux/goodvibes-sdk/platform/runtime/memory';
+import { CacheRegistry, PauseController } from '@pellux/goodvibes-sdk/platform/runtime/memory';
 import { wireMemoryGovernance } from './memory-governance-services.ts';
 import { wireVoiceSetup } from './voice-setup-services.ts';
 import { WebSearchProviderRegistry, WebSearchService } from '@pellux/goodvibes-sdk/platform/web-search';
 import { PanelManager } from '../panels/panel-manager.ts';
 import { HookActivityTracker } from '@pellux/goodvibes-sdk/platform/hooks';
-import { HookDispatcher, createHookWorkbench, type HookWorkbench } from '@pellux/goodvibes-sdk/platform/hooks';
+import { HookDispatcher, createHookWorkbench } from '@pellux/goodvibes-sdk/platform/hooks';
 import { PluginManager } from '@pellux/goodvibes-sdk/platform/plugins';
 import { BookmarkManager } from '@pellux/goodvibes-sdk/platform/bookmarks';
 import { ProfileManager } from '@pellux/goodvibes-sdk/platform/profiles';
-import { SessionManager, CrossSessionTaskRegistry, SessionChangeTracker } from '@pellux/goodvibes-sdk/platform/sessions';
+import { CrossSessionTaskRegistry, SessionChangeTracker } from '@pellux/goodvibes-sdk/platform/sessions';
 import { ApiTokenAuditor, UserAuthManager } from '@pellux/goodvibes-sdk/platform/security';
 import { WebhookNotifier } from '@pellux/goodvibes-sdk/platform/integrations';
-import { McpRegistry } from '@pellux/goodvibes-sdk/platform/mcp';
 import { createRemoteExecutionServices } from './remote-execution-composition.ts';
 import { createAgentGraph } from './agent-graph-composition.ts';
 import { BenchmarkStore, CacheHitTracker, FavoritesStore, ModelLimitsService, ProviderCapabilityRegistry, ProviderOptimizer, ProviderRegistry } from '@pellux/goodvibes-sdk/platform/providers';
@@ -63,187 +50,16 @@ import { AdaptivePlanner, DeterministicReplayEngine, ExecutionPlanManager, Sessi
 import { deriveFeatureStates, bindFeatureSettingsBridge } from '@pellux/goodvibes-sdk/platform/runtime/state';
 import { createChannelComposition } from './channel-composition.ts';
 import { applyProviderOptimizerConfigMode, bindProviderOptimizerFeatureFlag } from './provider-optimizer-wiring.ts';
-import { type ArchivableProcessRegistry } from '@pellux/goodvibes-sdk/platform/runtime/fleet';
 import { createFleetServices } from './fleet-services.ts';
-import { createWorkstreamServices, type OrchestrationEngine, type WorkstreamCommandService } from './workstream-services.ts';
+import { createWorkstreamServices } from './workstream-services.ts';
 import { wireFleetNeedsInputPush } from './fleet-needs-input-push.ts';
 import { codeIndexDbPath, createCodeIndexServices, createStoreRerooter, isCodeInjectionSettingEnabled } from './code-index-services.ts';
-import type { WorkPlanStore } from '../work-plans/work-plan-store.ts';
-import type { DaemonHandlerSurfaces } from '../daemon/handlers/index.ts';
 import { createDaemonHandlerComposition } from './daemon-handler-composition.ts';
-import { createClusterServices, startClusterServices, type ClusterGroupComposition } from './cluster-group-composition.ts';
-import type { ClusterCoordinator } from '@pellux/goodvibes-sdk/platform/cluster';
+import { createClusterServices, startClusterServices } from './cluster-group-composition.ts';
 import { WorkspaceTrustManager } from './trust/workspace-trust.ts';
 import { ensureConfiguredModelIsRoutable } from './provider-fallback.ts';
-
-export interface RuntimeServicesOptions {
-  readonly runtimeBus: RuntimeEventBus;
-  readonly runtimeStore: RuntimeStore;
-  readonly configManager: ConfigManager;
-  readonly localUserAuthManager?: UserAuthManager;
-  readonly featureFlags?: FeatureFlagManager;
-  readonly getConversationTitle?: () => string | undefined;
-  readonly workingDir: string;
-  readonly homeDirectory: string;
-  /** Opt-in (daemon-side only): fold host-observed external coding-agent sessions
-   * into the fleet as 'observed-external' rows. Interactive leaves it off and reads
-   * the daemon snapshot. Mirrors the SDK's own createRuntimeServices option. */
-  readonly observeExternalAgents?: boolean | undefined;
-  /** Host power seam opt-in. Fork mirrors the SDK: non-spawning unavailable-seam
-   * default (idle-power-services.ts); daemon + embedded runtime pass createHostPowerSeam(). */
-  readonly powerSeam?: Parameters<typeof wireIdlePowerAndLiveTurn>[0]['powerSeam'];
-  /** Live session id, read per crash-residue sweep so the running session is exempt — see durability-services.ts. */
-  readonly currentSessionId?: (() => string | null) | undefined;
-}
-
-export interface RuntimeServices {
-  readonly workingDirectory: string;
-  readonly homeDirectory: string;
-  /** The declare-once session-storage handle every session reader and writer threads through — see session-storage-services.ts. */
-  readonly surface: SessionSurface;
-  readonly shellPaths: ShellPathService;
-  readonly configManager: ConfigManager;
-  readonly featureFlags: FeatureFlagManager;
-  readonly runtimeBus: RuntimeEventBus;
-  readonly runtimeStore: RuntimeStore;
-  readonly runtimeDispatch: DomainDispatch;
-  readonly panelManager: PanelManager;
-  readonly keybindingsManager: KeybindingsManager;
-  readonly routeBindings: RouteBindingManager;
-  readonly surfaceRegistry: SurfaceRegistry;
-  readonly channelPlugins: ChannelPluginRegistry;
-  readonly channelDeliveryRouter: ChannelDeliveryRouter;
-  readonly watcherRegistry: WatcherRegistry;
-  readonly approvalBroker: ApprovalBroker;
-  /** Loopback-fetch approval that rides the approval broker; shared by the tool registry and orchestrator so every surface asks the same way. */
-  readonly localhostFetchApproval: ReturnType<typeof buildLocalhostFetchApproval>;
-  /** Terminal prompt-answer handler that rides the approval broker; shared by the tool registry and orchestrator so an interactive command's prompt gets an ask/card on every surface. */
-  readonly execPromptAnswerHandler: ReturnType<typeof buildExecPromptAnswerHandler>;
-  /** Routes curated runtime-domain events into the panel_only notification feed (the panel's live producer). */
-  readonly notificationDispatcher: NotificationDispatcher;
-  /** Durable user-origin permission rules (remembered approvals); permissions.rules.* surface. Mirrors the SDK composition. */
-  readonly userPermissionRuleStore: UserPermissionRuleStore;
-  readonly sessionBroker: SharedSessionBroker;
-  readonly deliveryManager: AutomationDeliveryManager;
-  readonly automationManager: AutomationManager;
-  readonly gatewayMethods: GatewayMethodCatalog;
-  readonly artifactStore: ArtifactStore;
-  readonly knowledgeService: KnowledgeService;
-  readonly agentKnowledgeService: KnowledgeService;
-  readonly homeGraphService: HomeGraphService;
-  readonly projectPlanningService: ProjectPlanningService;
-  readonly projectPlanningProjectId: string;
-  readonly workPlanStore: WorkPlanStore;
-  readonly memoryStore: MemoryStore;
-  readonly memoryRegistry: MemoryRegistry;
-  /** Host-vs-client memory access: local until bootstrap.ts activates it for an adopted 'external' daemon (mirrors sessionSpine). */
-  readonly memorySpine: MemorySpineClient;
-  readonly serviceRegistry: ServiceRegistry;
-  readonly secretsManager: SecretsManager;
-  readonly stepUpService: StepUpService;
-  readonly pairingTokens: PairingTokenManager; // backs pairing.tokens.* verbs + the settings device surface (mirrors the SDK composition)
-  readonly subscriptionManager: SubscriptionManager;
-  readonly localUserAuthManager: UserAuthManager;
-  readonly profileManager: ProfileManager;
-  readonly bookmarkManager: BookmarkManager;
-  readonly sessionManager: SessionManager;
-  readonly sessionOrchestration: CrossSessionTaskRegistry;
-  readonly hookDispatcher: HookDispatcher;
-  readonly hookActivityTracker: HookActivityTracker;
-  readonly hookWorkbench: HookWorkbench;
-  readonly pluginManager: PluginManager;
-  readonly workflow: WorkflowServices;
-  readonly voiceProviders: VoiceProviderRegistry;
-  readonly voiceService: VoiceService;
-  readonly webSearchProviders: WebSearchProviderRegistry;
-  readonly webSearchService: WebSearchService;
-  readonly mediaProviders: MediaProviderRegistry;
-  readonly multimodalService: MultimodalService;
-  readonly memoryEmbeddingRegistry: MemoryEmbeddingProviderRegistry;
-  readonly channelPolicy: ChannelPolicyManager;
-  readonly mcpRegistry: McpRegistry;
-  readonly tokenAuditor: ApiTokenAuditor;
-  readonly componentHealthMonitor: ComponentHealthMonitor;
-  readonly worktreeRegistry: WorktreeRegistry;
-  readonly sandboxSessionRegistry: SandboxSessionRegistry;
-  readonly webhookNotifier: WebhookNotifier;
-  /** Terminal focus tracker — fed by input/handler-feed.ts, read by the alert notifiers in core/. */
-  readonly focusTracker: FocusTracker;
-  readonly replayEngine: DeterministicReplayEngine;
-  readonly providerOptimizer: ProviderOptimizer;
-  readonly providerCapabilityRegistry: ProviderCapabilityRegistry;
-  readonly cacheHitTracker: CacheHitTracker;
-  readonly favoritesStore: FavoritesStore;
-  readonly benchmarkStore: BenchmarkStore;
-  readonly modelLimitsService: ModelLimitsService;
-  readonly providerRegistry: ProviderRegistry;
-  readonly toolLLM: ToolLLM;
-  readonly distributedRuntime: DistributedRuntimeManager;
-  readonly daemonHandlers: DaemonHandlerSurfaces;
-  /** Elects the one node on this network that consumes inbound messages; hand it to the DaemonServer so its consumers share this leadership instead of holding a second election. */
-  readonly clusterCoordinator: ClusterCoordinator;
-  /** LAN group membership: identity, keys, roster, and the `cluster` verbs. */
-  readonly clusterGroup: ClusterGroupComposition;
-  /** Start the group layer and then the election, in that order. Idempotent. */
-  readonly startCluster: () => Promise<void>;
-  readonly remoteRunnerRegistry: RemoteRunnerRegistry;
-  readonly remoteSupervisor: RemoteSupervisor;
-  readonly sessionMemoryStore: SessionMemoryStore;
-  readonly sessionLineageTracker: SessionLineageTracker;
-  readonly sessionChangeTracker: SessionChangeTracker;
-  readonly planManager: ExecutionPlanManager;
-  readonly adaptivePlanner: AdaptivePlanner;
-  readonly idempotencyStore: IdempotencyStore;
-  readonly overflowHandler: OverflowHandler;
-  readonly policyRuntimeState: PolicyRuntimeState;
-  readonly archetypeLoader: ArchetypeLoader;
-  readonly agentManager: AgentManager;
-  readonly agentMessageBus: AgentMessageBus;
-  readonly agentOrchestrator: AgentOrchestrator;
-  readonly contextAccountingHolder: ContextAccountingHolder; // bound at bootstrap.ts; see context-accounting-source.ts
-  readonly wrfcController: WrfcController;
-  readonly processManager: ProcessManager;
-  /** The phase/work-item orchestration engine — see runtime/workstream-services.ts. */
-  readonly orchestrationEngine: OrchestrationEngine;
-  readonly workstreamCommands: WorkstreamCommandService;
-  /** The repo source-tree code index — see runtime/code-index-services.ts. */
-  readonly codeIndexStore: CodeIndexStore;
-  readonly codeIndexReindexScheduler: CodeIndexReindexScheduler; // tool-site reindex
-  /** Daily snapshots of every SQLite store this runtime writes, with bounded retention; unref'd timers (mirrors the SDK composition — hosts that tear down a runtime stop() it themselves). */
-  readonly storeSnapshotScheduler: StoreSnapshotScheduler;
-  readonly appendOnlyRetentionScheduler: ReturnType<typeof createDurabilityServices>['appendOnlyRetentionScheduler']; // periodic append-only sweep; unref'd timers, stop() on teardown
-  /** Stops the recurring crash-residue sweep; idempotent, unref'd timer (hosts that tear a runtime down call it). */
-  readonly stopDurabilityHousekeeping: () => void;
-  readonly memoryConsolidationScheduler: MemoryConsolidationScheduler;
-  readonly powerManager: PowerManager;
-  /** The daemon's memory governor (default ON). Backs ops.memory.get and defends the daemon's footprint by tier. */
-  readonly memoryGovernor: MemoryGovernor;
-  /** Registry of every retained cache the governor can shrink (knowledge stores + shared session broker). */
-  readonly cacheRegistry: CacheRegistry;
-  /** Controller the governor uses to pause/resume the deferrable background jobs under pressure. */
-  readonly pauseController: PauseController;
-  readonly sessionLiveTurnControls: SessionLiveTurnControlsHolder;
-  /** Unified live process registry (agents, WRFC chains, workflows, watchers, background processes) backing the Fleet panel; archive-aware — finished subtrees can be moved to the session archive view. */
-  readonly processRegistry: ArchivableProcessRegistry;
-  readonly modeManager: ModeManager;
-  readonly fileUndoManager: FileUndoManager;
-  readonly workspaceCheckpointManager: WorkspaceCheckpointManager;
-  /** Per-workspace trust gate — restricts write/execute/delegate tools until the workspace is trusted. */
-  readonly workspaceTrustManager: WorkspaceTrustManager;
-  readonly integrationHelpers: IntegrationHelperService;
-  /** Re-root path-bound stores (MemoryStore, ProjectIndex) to a new working directory, called by WorkspaceSwapManager after verification; stores needing a process restart just warn-log and keep serving the old path until the daemon restarts with the new --working-dir. */
-  rerootStores(newWorkingDir: string): Promise<void>;
-  /**
-   * Cancel the agent runs this graph is hosting, returning how many.
-   *
-   * Required by the SDK's RuntimePollerOwners: by dispose() time the fleet
-   * registry, orchestration engine, process registry and bus these runs report
-   * through are already down, so a run still described as "running" is orphaned
-   * rather than preserved.
-   */
-  cancelHostedAgentRuns(): number;
-  dispose(): void; // Stop every poller this graph started; best-effort, total, idempotent. This surface owns its graph — see disposal-wiring.ts.
-}
+import type { RuntimeServicesOptions, RuntimeServices } from './runtime-services-types.ts';
+export type { RuntimeServicesOptions, RuntimeServices } from './runtime-services-types.ts';
 
 export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeServices {
   const disposalScope = createDisposalScope('RuntimeServices'); const workingDirectory = options.workingDir; // disposal seam: see ./disposal-wiring.ts
@@ -292,14 +108,12 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     runtimeBus: options.runtimeBus,
     featureFlags,
   });
-  const secretsManager = new SecretsManager({
-    projectRoot: workingDirectory,
-    globalHome: homeDirectory,
-    configManager,
+  // The credential/identity seam (credential-composition.ts).
+  const { secretsManager, stepUpService, pairingTokens } = composeCredentialServices({
+    workingDirectory, homeDirectory, configManager,
+    daemonHomeDirectory: options.daemonHomeDirectory,
+    pairingTokenPath: shellPaths.resolveUserPath('control-plane', 'pairing-tokens.json'),
   });
-  // Step-up (WebAuthn) ceremony service, shared between the ceremony gateway verbs and the relay gate's verifier.
-  const stepUpService = new StepUpService({ secrets: secretsManager });
-  const pairingTokens = new PairingTokenManager(shellPaths.resolveUserPath('control-plane', 'pairing-tokens.json'));
   const subscriptionManager = new SubscriptionManager(shellPaths.resolveUserPath('tui', 'subscriptions.json'));
   const serviceRegistry = new ServiceRegistry(shellPaths.resolveProjectPath('tui', 'services.json'), {
     secretsManager,
@@ -603,25 +417,17 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   const { voiceSetup } = wireVoiceSetup({ configManager, shellPaths, voiceProviders, admitExpensiveWork });
 
   // Terminal-shell wrapper over the SDK registerGatewayVerbGroups (gateway-verbs.ts); checkin.*/fleet-needs-input/pairing.* register only when their deps are present. memoryGovernor lights up ops.memory.get; voiceSetup lights up voice.local.status/install.
-  attachWsOnlyGatewayVerbHandlers(gatewayMethods, { processRegistry, workspaceCheckpointManager, conversationRewindPort: createSessionConversationRewindPort(), sessionBroker, secretsManager, stepUpService, approvalBroker, requestApproval: (input) => approvalBroker.requestApproval(input), watcherRegistry, userPermissionRuleStore, shellPaths, configManager, runtimeStore: options.runtimeStore, channelDeliveryRouter, providerRegistry, automationManager, sessionLister: sessionBroker, sessionIntake: sessionBroker, workingDirectory, memoryRegistry, pairingTokens, sessionLiveTurnControls, powerManager, memoryGovernor, voiceSetup, relayAvailable: () => configManager.get('relay.enabled') === true, pairingWebOrigin: () => resolvePairingWebOrigin(configManager).origin, disposal: disposalScope.registry, ...wireFleetNeedsInputPush({ registry: processRegistry, runtimeBus: options.runtimeBus, sessionBroker }) });
+  // calendar.*/email.* are platform-served; these two let it register (mail-composition.ts).
+  const { emailServiceDeps, describeEmailConfigProblem } = composeMailDeps({ configManager, secretsManager });
+  attachWsOnlyGatewayVerbHandlers(gatewayMethods, { homeDirectory, emailServiceDeps, describeEmailConfigProblem, processRegistry, workspaceCheckpointManager, conversationRewindPort: createSessionConversationRewindPort(), sessionBroker, secretsManager, stepUpService, approvalBroker, requestApproval: (input) => approvalBroker.requestApproval(input), watcherRegistry, userPermissionRuleStore, shellPaths, configManager, runtimeStore: options.runtimeStore, channelDeliveryRouter, providerRegistry, automationManager, sessionLister: sessionBroker, sessionIntake: sessionBroker, workingDirectory, memoryRegistry, pairingTokens, sessionLiveTurnControls, powerManager, memoryGovernor, voiceSetup, relayAvailable: () => configManager.get('relay.enabled') === true, pairingWebOrigin: () => resolvePairingWebOrigin(configManager).origin, disposal: disposalScope.registry, ...wireFleetNeedsInputPush({ registry: processRegistry, runtimeBus: options.runtimeBus, sessionBroker }) });
+  // surface-scoped: continuity's recovery-file check must read the SAME paths
+  // the app writes with, not the unscoped legacy pair.
   const integrationHelpers = new IntegrationHelperService({
-    surface, // surface-scoped: continuity's recovery-file check must read the SAME paths the app writes with, not the unscoped legacy pair.
-    runtimeStore: options.runtimeStore,
-    runtimeBus: options.runtimeBus,
-    configManager,
+    surface, configManager, automationManager, approvalBroker, sessionBroker, distributedRuntime,
+    remoteRunnerRegistry, remoteSupervisor, panelManager, localUserAuthManager, providerRegistry,
+    serviceRegistry, subscriptionManager, secretsManager,
+    runtimeStore: options.runtimeStore, runtimeBus: options.runtimeBus,
     getConversationTitle: options.getConversationTitle,
-    automationManager,
-    approvalBroker,
-    sessionBroker,
-    distributedRuntime,
-    remoteRunnerRegistry,
-    remoteSupervisor,
-    panelManager,
-    localUserAuthManager,
-    providerRegistry,
-    serviceRegistry,
-    subscriptionManager,
-    secretsManager,
   });
   // A loopback fetch that isn't allow-listed asks once through the approval
   // broker; "allow for this project" persists and later fetches never ask. Built

package/src/shell/ui-openers.ts

@@ -394,6 +394,13 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
   commandContext.openSettingsModal = (target?: string) => {
     input.modalOpened('settings');
     input.settingsModal.open(configManager, featureFlags, subscriptionManager, serviceRegistry, mcpRegistry, secretsManager, {
+      // The Connections category asks the daemon handlers directly, through the
+      // same in-process catalog `/mail` and `/calendar` use, so the workspace
+      // reports the daemon's state rather than a local guess about it.
+      ...(commandContext.workspace?.gatewayMethods
+        ? { gatewayMethods: commandContext.workspace.gatewayMethods }
+        : {}),
+      requestRender: render,
       onSettingApplied: (change) => {
         // forced dark/light applies immediately (rebuild palettes + full
         // repaint); auto only re-probes at startup, so it takes effect next launch.