@pellux/goodvibes-tui 1.24.2 → 1.26.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pellux/goodvibes-tui",
-  "version": "1.24.2",
+  "version": "1.26.0",
   "description": "Terminal-native GoodVibes product for coding, operations, automation, knowledge, channels, and daemon-backed control-plane workflows.",
   "type": "module",
   "main": "src/main.ts",
@@ -43,6 +43,7 @@
     "build:all-shell": "bun run build:linux-x64 && bun run build:linux-arm64 && bun run build:macos-x64 && bun run build:macos-arm64 && bun run build:windows",
     "typecheck": "bunx tsc --noEmit",
     "typecheck:test": "bunx tsc --noEmit -p tsconfig.test.json",
+    "typecheck:coverage": "bun run scripts/typecheck-coverage-rule.ts",
     "test": "bun run scripts/run-tests.ts",
     "test:coverage": "bun run scripts/coverage-gate.ts",
     "version": "bun run scripts/prebuild.ts",
@@ -106,8 +107,8 @@
     "@anthropic-ai/vertex-sdk": "^0.16.0",
     "@ast-grep/napi": "^0.42.0",
     "@aws/bedrock-token-generator": "^1.1.0",
-    "@pellux/goodvibes-sdk": "1.17.2",
-    "@pellux/goodvibes-terminal-shell": "1.17.2",
+    "@pellux/goodvibes-sdk": "1.19.2",
+    "@pellux/goodvibes-terminal-shell": "1.19.2",
     "bash-language-server": "^5.6.0",
     "fuse.js": "^7.1.0",
     "graphql": "^16.13.2",
@@ -133,10 +134,10 @@
     "typescript": "^5.9.3"
   },
   "optionalDependencies": {
-    "@pellux/goodvibes-tui-linux-x64": "1.24.2",
-    "@pellux/goodvibes-tui-linux-arm64": "1.24.2",
-    "@pellux/goodvibes-tui-darwin-x64": "1.24.2",
-    "@pellux/goodvibes-tui-darwin-arm64": "1.24.2"
+    "@pellux/goodvibes-tui-linux-x64": "1.26.0",
+    "@pellux/goodvibes-tui-linux-arm64": "1.26.0",
+    "@pellux/goodvibes-tui-darwin-x64": "1.26.0",
+    "@pellux/goodvibes-tui-darwin-arm64": "1.26.0"
   },
   "trustedDependencies": [],
   "overrides": {

package/src/cli/help.ts

@@ -341,6 +341,16 @@ export function renderGoodVibesDaemonHelp(binary = 'goodvibes-daemon'): string {
     '  service-status                 Show whether the daemon service is installed / enabled / active',
     '  migrate-service                Guided migration from an install-script goodvibes-daemon.service unit; prints a plan',
     '                                 unless run with -y/--yes (never auto-migrates)',
+    '  send [message]                 Send a message to one of your configured channels — Telegram, ntfy,',
+    '                                 Discord, Slack, Google Chat, Signal, WhatsApp, iMessage, Teams,',
+    '                                 BlueBubbles, Mattermost, Matrix or a webhook. Takes the message as',
+    '                                 an argument or on stdin, so it composes with other tooling.',
+    '                                 --channel <id> picks the channel; with none named it uses your one',
+    '                                 configured channel and says which. --to <address> targets a specific',
+    '                                 topic / chat / room within it, --title <text> sets a title, and',
+    '                                 --list shows every channel with where it would send. A channel that',
+    '                                 is off is refused rather than redirected to the default, and a',
+    '                                 failed send exits non-zero with the provider\'s own error.',
     '  cluster <command>              Share inbound channel work with your other machines on this network.',
     '                                 status | create | join | key | nodes | forget <machine> | rotate [--now]',
     '                                 | leave | rename | groups',

package/src/cli/redaction.ts

@@ -1,6 +1,56 @@
 export const REDACTED_VALUE = '<redacted>';
 
+// Matches a config path whose LAST SEGMENT is exactly one of these words. That
+// is the whole reach of this pattern, and it is why the declared list below
+// exists: `surfaces.calendar.caldavPassword` does not end in a `.password`
+// segment, it ends in a `caldavPassword` segment, so this pattern answers false
+// for it — as it does for `imapPassword`, `appPassword` and `authToken`.
 const SENSITIVE_PATH_PATTERN = /(^|\.)(apiKey|accessToken|botToken|appToken|signingSecret|webhookSecret|verifyToken|verificationToken|secret|password|token|keyFile)$/i;
+
+// Credential-bearing config keys that are sensitive by NAME rather than by the
+// generic trailing-word list above. Every one of these was carried in the clear
+// by a support bundle before it was listed here, because the pattern matches a
+// trailing WORD and these names carry the credential word in the middle or
+// prefixed by a protocol ("caldavPassword", "imapPassword", "appPassword",
+// "authToken").
+//
+// The `*Ref` Cloudflare keys normally hold a `goodvibes://secrets/...`
+// reference, which shouldRedactValue already lets through as safe. They are
+// listed as a BACKSTOP, for the same reason the mail keys are worth listing
+// twice over: it costs nothing, and it is what stands between a future code
+// path that writes a literal token there and that token reaching a file the
+// owner emails to someone for support.
+const SENSITIVE_CONFIG_KEYS: ReadonlySet<string> = new Set([
+  // Mailbox / CalDAV — the credentials the daemon polls mail and calendar with.
+  'surfaces.email.password',
+  'surfaces.email.imapPassword',
+  'surfaces.email.imap.password',
+  'surfaces.email.smtp.password',
+  'surfaces.calendar.caldavPassword',
+  // Telephony.
+  'surfaces.telephony.authToken',
+  'surfaces.msteams.appPassword',
+  // Cloudflare token references.
+  'cloudflare.apiTokenRef',
+  'cloudflare.tunnelTokenRef',
+  'cloudflare.accessServiceTokenRef',
+  'cloudflare.workerTokenRef',
+  'cloudflare.workerClientTokenRef',
+  // Cluster shared phrase.
+  'cluster.secret',
+  // Payment card material. ADDED to this set, never substituted for it: this
+  // set is a hardcoded list with no delegation, so replacing it wholesale with
+  // another product's would silently stop redacting whatever that one omits.
+  // The four names below end in no word the suffix pattern knows —
+  // "cardNumber", "cardExpiry" and "cardholderName" match none of them — which
+  // is the whole reason a declared list exists rather than a naming habit.
+  // (The `.map` below lowercases every entry; the lookup lowercases too.)
+  'payments.cardNumber',
+  'payments.cardExpiry',
+  'payments.cardCvv',
+  'payments.cardholderName',
+].map((key) => key.toLowerCase()));
+
 const SECRET_LIKE_TEXT_PATTERNS: readonly RegExp[] = [
   /\bsk-[A-Za-z0-9_-]{16,}\b/g,
   /\bghp_[A-Za-z0-9_]{16,}\b/g,
@@ -13,7 +63,7 @@ const SECRET_LIKE_TEXT_PATTERNS: readonly RegExp[] = [
 ];
 
 export function isSensitiveConfigPath(path: string): boolean {
-  return SENSITIVE_PATH_PATTERN.test(path);
+  return SENSITIVE_PATH_PATTERN.test(path) || SENSITIVE_CONFIG_KEYS.has(path.toLowerCase());
 }
 
 export function isRedactedValue(value: unknown): boolean {
@@ -25,9 +75,14 @@ export interface RedactedConfigResult<T> {
   readonly redactedPaths: readonly string[];
 }
 
+// Redaction rule for sensitive config paths:
+// - Non-string values: redact if truthy (i.e. non-null, non-undefined, non-zero, non-false).
+//   Rationale: zero and false are never meaningful secrets; null/undefined mean absent.
+// - String values: redact non-empty strings that are not goodvibes:// secret refs.
+//   Rationale: empty string means unset; secret refs are safe placeholders, not raw values.
 function shouldRedactValue(path: string, value: unknown): boolean {
   if (!isSensitiveConfigPath(path)) return false;
-  if (typeof value !== 'string') return value !== undefined && value !== null;
+  if (typeof value !== 'string') return value !== null && value !== undefined && Boolean(value);
   if (value.trim().length === 0) return false;
   if (value.startsWith('goodvibes://secrets/')) return false;
   return true;
@@ -64,7 +119,17 @@ export function redactConfig<T>(config: T): RedactedConfigResult<T> {
 }
 
 export function redactText(input: string): string {
-  let output = input;
+  // Assignment form: keyword=value — anchored so 'monkey=' and 'donkey=' do NOT match.
+  // Matches: token=, access_token=, api_key=, api-key=, secret=, password= and colon form token: value
+  let output = input
+    .replace(
+      /(?<![A-Za-z])(?:access_token|api[_-]?key|secret|password|token)\s*=\s*([^ \t\r\n"'`]+)/gi,
+      (m, val) => m.slice(0, m.length - val.length) + REDACTED_VALUE,
+    )
+    .replace(
+      /(?<![A-Za-z])(?:access_token|api[_-]?key|secret|password|token)\s*:\s*([^ \t\r\n"'`]+)/gi,
+      (m, val) => m.slice(0, m.length - val.length) + REDACTED_VALUE,
+    );
   for (const pattern of SECRET_LIKE_TEXT_PATTERNS) {
     output = output.replace(pattern, REDACTED_VALUE);
   }

package/src/config/goodvibes-home.ts

@@ -0,0 +1,149 @@
+/**
+ * goodvibes-home.ts — where this process's GoodVibes tree lives, resolved in
+ * ONE place for every entry point.
+ *
+ * ## The defect this closes
+ *
+ * `GOODVIBES_HOME` relocates the tree root. It was read by exactly one file —
+ * `src/daemon/cli.ts` — and the CLIENT entry point (`src/main.ts`) called
+ * `homedir()` unconditionally, on the same object literal where it did honour
+ * `GOODVIBES_WORKING_DIR`. So a harness that set `GOODVIBES_HOME` to a
+ * throwaway directory and then ran a client command got a process that read and
+ * wrote the REAL tree: settings, workspace state, and — because the daemon-tier
+ * secret store is derived from the tree root — `~/.goodvibes/daemon/secrets.enc`.
+ *
+ * That is not hypothetical. An isolated round stored two throwaway credentials
+ * and they landed in the owner's live secret store, where they had to be
+ * removed by hand. An isolation boundary a process can walk out of is not a
+ * boundary; the honest fix is that no entry point resolves a home of its own.
+ *
+ * ## What each variable means
+ *
+ *  - `GOODVIBES_HOME` — the tree ROOT, the directory `.goodvibes/` sits under.
+ *    Setting it relocates settings, workspace, discovery roots, and every tier
+ *    of the secret store. This is what an isolated harness or a service unit
+ *    sets.
+ *  - `GOODVIBES_DAEMON_HOME` — the daemon's own IDENTITY directory (auth users,
+ *    operator tokens, daemon settings). It falls under the tree root unless set
+ *    separately, and it names only that directory: it is not a second way to
+ *    move the tree. Both entry points resolve it the same way now, so a client
+ *    given only this variable no longer computes the daemon-tier secret path
+ *    from the real home while everything else points at a sandbox.
+ *
+ * Both readers take `env` as an argument rather than reaching for
+ * `process.env`, so the resolution is exercisable without a test having to
+ * mutate the environment of the process running it.
+ */
+
+import { homedir } from 'node:os';
+import { isAbsolute, join, resolve } from 'node:path';
+
+/** The two roots every surface derives its storage from. */
+export interface GoodVibesHomeOwnership {
+  /** The tree root: the directory `.goodvibes/` sits under. */
+  readonly homeDirectory: string;
+  /** The daemon's own identity directory, under the tree root by default. */
+  readonly daemonHomeDirectory: string;
+  /**
+   * True when either `GOODVIBES_HOME` or `GOODVIBES_DAEMON_HOME` named an
+   * override (a blank/whitespace-only value does not count — see
+   * resolveGoodVibesHome). Callers that need to know "is this process running
+   * out of a relocated tree or identity directory" (e.g. to refuse adopting
+   * the machine's real service unit) read this instead of re-reading the raw
+   * environment variable themselves — this module is the one reader.
+   */
+  readonly isOverridden: boolean;
+}
+
+/**
+ * The tree root for this process.
+ *
+ * A blank or whitespace-only value is treated as absent rather than as the
+ * empty path, because `GOODVIBES_HOME=` in a unit file or a shell wrapper means
+ * "unset", and resolving it to `''` would put the whole tree at the filesystem
+ * root.
+ */
+export function resolveGoodVibesHome(env: NodeJS.ProcessEnv = process.env): string {
+  const override = env['GOODVIBES_HOME']?.trim();
+  if (override) return isAbsolute(override) ? override : resolve(process.cwd(), override);
+  // The login home comes from the injected env first so the whole resolution is
+  // exercisable without a test mutating the environment it is running in. This
+  // is not a behaviour change: on Linux and macOS `homedir()` already prefers
+  // $HOME, and where it does not (Windows, where HOME is usually unset) the
+  // fallback below is what answers.
+  const loginHome = env['HOME']?.trim();
+  return loginHome ? loginHome : homedir();
+}
+
+/**
+ * The daemon's identity directory.
+ *
+ * @param homeDirectory - The already-resolved tree root, so a caller cannot
+ *   accidentally combine an overridden root with a default daemon home.
+ */
+export function resolveGoodVibesDaemonHome(
+  homeDirectory: string,
+  env: NodeJS.ProcessEnv = process.env,
+): string {
+  const override = env['GOODVIBES_DAEMON_HOME']?.trim();
+  if (!override) return join(homeDirectory, '.goodvibes', 'daemon');
+  return isAbsolute(override) ? override : resolve(process.cwd(), override);
+}
+
+/**
+ * The `.goodvibes` directory itself — the tree, not the root it sits under.
+ *
+ * This exists because the two were being derived independently and did not
+ * agree. `GOODVIBES_HOME` meant the tree ROOT to the runtime
+ * (`<GOODVIBES_HOME>/.goodvibes/...`) and meant the `.goodvibes` DIRECTORY to
+ * the two reporting scripts, which read it as
+ * `process.env.GOODVIBES_HOME ?? join(homedir(), '.goodvibes')`. Set it to
+ * `/tmp/sandbox` to isolate a run and the runtime wrote
+ * `/tmp/sandbox/.goodvibes/`, while a script inspected `/tmp/sandbox` as though
+ * it were already the tree — so the two halves of one round disagreed about
+ * which files were even in scope.
+ *
+ * That is the shape of an incident that has already happened here: a
+ * home-redirection variable honoured by one entry point and ignored by another
+ * put two throwaway credentials in the owner's live secret store. One variable
+ * has one meaning now, and it is the runtime's, because the runtime is what
+ * writes secrets and because an isolation harness needs a single root that
+ * everything falls under.
+ *
+ * A caller that genuinely wants to name a `.goodvibes` directory directly —
+ * auditing a tree that is not under any home — passes it explicitly rather than
+ * through the environment. Both scripts keep a `--home` flag for exactly that.
+ */
+export function resolveGoodVibesTreeDirectory(env: NodeJS.ProcessEnv = process.env): string {
+  return join(resolveGoodVibesHome(env), '.goodvibes');
+}
+
+/** Both roots at once — what an entry point wants. */
+export function resolveGoodVibesHomeOwnership(
+  env: NodeJS.ProcessEnv = process.env,
+): GoodVibesHomeOwnership {
+  const homeDirectory = resolveGoodVibesHome(env);
+  return {
+    homeDirectory,
+    daemonHomeDirectory: resolveGoodVibesDaemonHome(homeDirectory, env),
+    isOverridden: Boolean(env['GOODVIBES_HOME']?.trim()) || Boolean(env['GOODVIBES_DAEMON_HOME']?.trim()),
+  };
+}
+
+/**
+ * True when either root was relocated for this process.
+ *
+ * The daemon lifecycle asks this to decide whether it may adopt the machine's
+ * service unit: a process told to run out of somewhere else is a throwaway, and
+ * one that adopted the unit had systemd supervise it as the machine's daemon
+ * for five hours while it read the real home's credentials.
+ *
+ * It lives here because the two variables have exactly one reader, and the
+ * answer is a question ABOUT them. A caller checking `process.env` for itself is
+ * how the second meaning that started all of this gets reintroduced — so the
+ * question is answered here rather than asked again somewhere else.
+ */
+export function hasOverriddenGoodVibesHome(env: NodeJS.ProcessEnv = process.env): boolean {
+  return (env['GOODVIBES_HOME']?.trim() ?? '') !== ''
+    || (env['GOODVIBES_DAEMON_HOME']?.trim() ?? '') !== '';
+}

package/src/config/secret-config.ts

@@ -1,8 +1,27 @@
-import { isSecretRefInput } from '@pellux/goodvibes-sdk/platform/config';
+import { isSecretRefInput, isDaemonOwnedConfigKey } from '@pellux/goodvibes-sdk/platform/config';
 import type { ConfigKey } from './index.ts';
 import type { SecretScope, SecretStorageMedium } from './secrets.ts';
 
 export const SECRET_CONFIG_KEYS = new Set<ConfigKey>([
+  // Mailbox and CalDAV credentials. Their own CONFIG_SCHEMA descriptions read
+  // "Stored in the daemon secret tier, never in config" — and until they were
+  // listed here that sentence was aspirational: the settings modal wrote them
+  // as plain strings into a config JSON file, because membership in this set is
+  // the thing that routes an edit through the secret manager instead.
+  //
+  // The daemon reads each of these back with
+  // resolveConfigSecret('<key>') → GOODVIBES_<KEY>, which is exactly the store
+  // key buildGoodVibesSecretKey() writes — see
+  // daemon/handlers/inbox/providers/email.ts.
+  'surfaces.email.password',
+  'surfaces.email.imapPassword',
+  'surfaces.email.imap.password',
+  'surfaces.email.smtp.password',
+  'surfaces.calendar.caldavPassword',
+  // Telephony delivery credentials — same shape, same file, same gap.
+  'surfaces.telephony.authToken',
+  'surfaces.telephony.token',
+  'surfaces.telephony.webhookSecret',
   'surfaces.slack.signingSecret',
   'surfaces.slack.botToken',
   'surfaces.slack.appToken',
@@ -23,6 +42,16 @@ export const SECRET_CONFIG_KEYS = new Set<ConfigKey>([
   'surfaces.bluebubbles.password',
   'surfaces.mattermost.botToken',
   'surfaces.matrix.accessToken',
+  // TUI-local synthetic sub-keys, one level under the SDK's real `payments`
+  // section (not yet a scalar CONFIG_SCHEMA entry — same situation as
+  // tts.speed, behavior.notifyAfterSeconds, etc. in settings-modal-data.ts),
+  // hence the cast. See input/payments-config.ts for why these are named flat
+  // (payments.cardNumber, not payments.card.number): a flat one-level leaf is
+  // the shape the real ConfigManager tolerates for an undeclared key.
+  'payments.cardNumber' as ConfigKey,
+  'payments.cardExpiry' as ConfigKey,
+  'payments.cardCvv' as ConfigKey,
+  'payments.cardholderName' as ConfigKey,
 ]);
 
 export interface SecretBackedConfigUpdate {
@@ -96,6 +125,28 @@ export function buildSecretBackedConfigUpdate(configKey: ConfigKey, rawValue: st
   };
 }
 
+/**
+ * Where a secret-backed write lands when the caller did not name a scope.
+ *
+ * A daemon-owned config key (`surfaces.*`, `payments.*`, `controlPlane.*`, ...)
+ * names a credential the DAEMON executes with, not this interactive client, so
+ * its secret material belongs in the daemon-scoped tier the daemon actually
+ * reads — the same rule the SDK's config-ownership.ts already applies to the
+ * `goodvibes://` reference that points at it.
+ *
+ * Defaulting these to 'user' (the historical behavior here) split the pair: the
+ * reference landed in the daemon's own settings file, because ConfigManager
+ * routes daemon-owned keys there, while the value it pointed at sat in a tier
+ * the daemon never resolves. The surface reported success and the daemon found
+ * nothing. For the mailbox password that is the whole feature failing silently —
+ * the daemon is the process that polls IMAP and answers over Telegram, and it
+ * does so with every surface closed. A payment card entered through
+ * /payments card is the same shape of failure at purchase time.
+ */
+export function defaultSecretBackedScope(configKey: ConfigKey): SecretScope {
+  return isDaemonOwnedConfigKey(configKey) ? 'daemon' : 'user';
+}
+
 export async function persistSecretBackedConfigValue(
   configManager: SecretBackedConfigManager,
   secretsManager: SecretBackedSecretStore | null | undefined,
@@ -104,16 +155,21 @@ export async function persistSecretBackedConfigValue(
   options: { readonly scope?: SecretScope } = {},
 ): Promise<string> {
   const update = buildSecretBackedConfigUpdate(configKey, rawValue);
-  const scope = options.scope ?? 'user';
+  const scope = options.scope ?? defaultSecretBackedScope(configKey);
+  const medium = getSecretWriteMedium(configManager.get('storage.secretPolicy'));
+
+  // 1. Validate config write first. If setDynamic throws, no secret is written (avoids orphans).
+  configManager.setDynamic(configKey, update.configValue);
+
+  // 2. Write new secret only after config accepted it.
   if (update.secretKey && update.secretValue !== undefined && secretsManager) {
-    await secretsManager.set(update.secretKey, update.secretValue, {
-      scope,
-      medium: getSecretWriteMedium(configManager.get('storage.secretPolicy')),
-    });
+    await secretsManager.set(update.secretKey, update.secretValue, { scope, medium });
   }
+
+  // 3. Clear old secret — pass the same medium so plaintext-medium secrets are found for deletion.
   if (update.clearSecretKey && secretsManager?.delete) {
-    await secretsManager.delete(update.clearSecretKey, { scope });
+    await secretsManager.delete(update.clearSecretKey, { scope, medium });
   }
-  configManager.setDynamic(configKey, update.configValue);
+
   return update.configValue;
 }

package/src/core/turn-event-wiring.ts

@@ -1,7 +1,7 @@
 import type { UiRuntimeEvents, RuntimeEventBus } from '@/runtime/index.ts';
 import { buildPersistedSessionContext, persistConversation } from '@/runtime/index.ts';
 import { buildCompactionReceiptBlock } from './compaction-receipt.ts';
-import { formatTurnBudgetOutcome } from './turn-budget-outcome.ts';
+import { workstreamFailureNotification } from './workstream-notification.ts';
 import { persistTurnAnchors, recordTurnAnchor, summarizeTurnLabel } from './rewind-turn-anchors.ts';
 import { logger } from '@pellux/goodvibes-sdk/platform/utils';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
@@ -328,21 +328,12 @@ export function wireTurnEventHandlers(
     unsubs.push(events.workflows.on('WORKFLOW_CHAIN_FAILED', (payload) => {
       if (!shouldFireAlert(focusTracker, configGet, 'behavior.notifyOnChainFailure')) return;
       try {
-        // An operator cancellation is an intended stop, not a failure — narrate it
-        // as cancelled (the reason already carries the landed-work count from the
-        // chain's edit ledger), so the notification never contradicts the cancelled
-        // chain/owner/cohort surfaces.
-        if (payload.failureKind === 'cancelled') {
-          notifyCompletion('GoodVibes — WRFC chain cancelled', `chain ${payload.chainId.slice(0, 12)} cancelled: ${payload.reason}`, FORCE_NOTIFY_DURATION_MS);
-        } else if (payload.failureKind === 'max_turns') {
-          // A turn-budget exhaustion is a spent ceiling, not an infrastructure
-          // failure — narrate the limit and where it came from, from the typed
-          // event fields, never a regex of the prose reason.
-          notifyCompletion('GoodVibes — WRFC chain hit its turn budget', `chain ${payload.chainId.slice(0, 12)} ${formatTurnBudgetOutcome({ limit: payload.turnLimit, source: payload.turnLimitSource })}`, FORCE_NOTIFY_DURATION_MS);
-        } else {
-          const kindLabel = payload.failureKind === 'transport' ? 'transient transport error' : payload.reason;
-          notifyCompletion('GoodVibes — WRFC chain failed', `chain ${payload.chainId.slice(0, 12)} failed: ${kindLabel}`, FORCE_NOTIFY_DURATION_MS);
-        }
+        // Title and body come from workstream-notification.ts, which is where
+        // the three branches (cancelled / turn budget / failed) are narrated and
+        // tested. A notification is a message to a person, so it carries neither
+        // the internal name for the machinery nor the chain id.
+        const notice = workstreamFailureNotification(payload);
+        notifyCompletion(notice.title, notice.body, FORCE_NOTIFY_DURATION_MS);
       } catch (err) {
         logger.debug('turn-event-wiring: chain-failure notify error', { error: String(err) });
       }

package/src/core/workstream-notification.ts

@@ -0,0 +1,69 @@
+/**
+ * workstream-notification.ts — the desktop notification a finished workstream
+ * pushes, in words rather than identifiers.
+ *
+ * These three notifications used to read:
+ *
+ *     GoodVibes — WRFC chain failed
+ *     chain 7f3a91c02b4e failed: review rejected
+ *
+ * A desktop notification is a message TO a person, so the standing rule applies
+ * to it the same way it applies to a chat message: no internal name for the
+ * machinery, and no register id. `WRFC` is the first; `7f3a91c02b4e` is the
+ * second, and it is not something the reader can do anything with — it is not
+ * the commit, not the branch, not the session.
+ *
+ * What the reader can act on is why the work stopped, so that is what the body
+ * now leads with. Two workstreams that end at the same moment are told apart by
+ * their reasons, which is the same principle the channel renderer follows: in
+ * plain words, never by an opaque identifier.
+ *
+ * Split out of turn-event-wiring.ts as a pure function so the text is testable
+ * on its own — the wiring itself cannot be asserted against without mocking a
+ * process-global notifier.
+ */
+import { formatTurnBudgetOutcome } from './turn-budget-outcome.ts';
+
+/** The fields of WORKFLOW_CHAIN_FAILED this narration reads. */
+export interface WorkstreamFailureNarrationInput {
+  readonly reason: string;
+  readonly failureKind?: 'transport' | 'other' | 'cancelled' | 'max_turns' | undefined;
+  readonly turnLimit?: number | undefined;
+  readonly turnLimitSource?: 'default' | 'spawn-override' | 'policy-bound' | undefined;
+}
+
+export interface WorkstreamNotification {
+  readonly title: string;
+  readonly body: string;
+}
+
+/**
+ * Title and body for a workstream that reached a terminal state.
+ *
+ * An operator cancellation is an intended stop, not a failure — it is narrated
+ * as cancelled (the reason already carries the landed-work count from the
+ * workstream's edit ledger) so the notification never contradicts the cancelled
+ * workstream/owner/cohort surfaces. A turn-budget exhaustion is a spent ceiling
+ * rather than an infrastructure error, and its limit and source are read from
+ * the typed event fields, never from a regex of the prose reason.
+ */
+export function workstreamFailureNotification(
+  payload: WorkstreamFailureNarrationInput,
+): WorkstreamNotification {
+  if (payload.failureKind === 'cancelled') {
+    return {
+      title: 'GoodVibes — workstream cancelled',
+      body: `Cancelled: ${payload.reason}`,
+    };
+  }
+  if (payload.failureKind === 'max_turns') {
+    return {
+      title: 'GoodVibes — workstream hit its turn budget',
+      body: `The workstream ${formatTurnBudgetOutcome({ limit: payload.turnLimit, source: payload.turnLimitSource })}`,
+    };
+  }
+  return {
+    title: 'GoodVibes — workstream failed',
+    body: `Failed: ${payload.failureKind === 'transport' ? 'transient transport error' : payload.reason}`,
+  };
+}

package/src/daemon/cli.ts

@@ -1,5 +1,4 @@
 import { homedir } from 'node:os';
-import { isAbsolute, join, resolve } from 'node:path';
 import {
   ConfigManager,
   deriveControlPlaneBaseUrl,
@@ -8,6 +7,7 @@ import {
 } from '@pellux/goodvibes-sdk/platform/config';
 import type { ConfigKey } from '@pellux/goodvibes-sdk/platform/config';
 import { formatProviderModel, getModelIdFromProviderModel, getProviderIdFromModel } from '../config/provider-model.ts';
+import { resolveGoodVibesHomeOwnership } from '../config/goodvibes-home.ts';
 import { RuntimeEventBus, GlobalNetworkTransportInstaller } from '@/runtime/index.ts';
 import { bindFeatureSettingsBridge, createFeatureFlagManager, deriveFeatureStates } from '@/runtime/index.ts';
 import { createRuntimeStore } from '../runtime/store/index.ts';
@@ -34,6 +34,9 @@ import {
   persistProviders,
 } from '@pellux/goodvibes-sdk/platform/discovery';
 import { createSafeHostServeFactory } from './safe-serve.ts';
+import { runSendCommand } from './send/command.ts';
+import { createSendStack } from './send/composition.ts';
+import { readAllStdin } from './send/stdin.ts';
 import { isDaemonServiceSubcommand, resolveInstalledDaemonBinary, runDaemonServiceCli } from './service-commands.ts';
 import { runClusterCommand } from '../cluster/commands.ts';
 import { resolveConfiguredServiceName } from '../runtime/legacy-daemon-migration.ts';
@@ -59,6 +62,8 @@ type DaemonCliOwnership = {
   readonly homeDirectory: string;
   /** The daemon's OWN identity home (auth users, operator tokens, daemon settings). */
   readonly daemonHomeDirectory: string;
+  /** True when GOODVIBES_HOME or GOODVIBES_DAEMON_HOME named an override — see goodvibes-home.ts. */
+  readonly isOverridden: boolean;
 };
 
 // CLI flag parsing delegated to shared module — see src/cli-flags.ts
@@ -83,15 +88,16 @@ type DaemonCliTokens = {
  * daemon home then falls under it unless separately overridden.
  */
 function resolveDaemonCliOwnership(): DaemonCliOwnership {
-  const homeDirectory = process.env['GOODVIBES_HOME']?.trim() || homedir();
-  const daemonHomeOverride = process.env['GOODVIBES_DAEMON_HOME']?.trim();
-  const daemonHomeDirectory = daemonHomeOverride
-    ? (isAbsolute(daemonHomeOverride) ? daemonHomeOverride : resolve(process.cwd(), daemonHomeOverride))
-    : join(homeDirectory, '.goodvibes', 'daemon');
+  // Both roots come from src/config/goodvibes-home.ts, which the CLIENT entry
+  // point also uses. They were resolved independently, and the client's copy
+  // simply did not read GOODVIBES_HOME — so a redirected client wrote into the
+  // real tree while the daemon honoured the redirect.
+  const { homeDirectory, daemonHomeDirectory, isOverridden } = resolveGoodVibesHomeOwnership();
   return {
     workingDirectory: process.env['GOODVIBES_WORKING_DIR'] ?? process.cwd(),
     homeDirectory,
     daemonHomeDirectory,
+    isOverridden,
   };
 }
 
@@ -137,6 +143,44 @@ async function main(): Promise<void> {
     process.exit(result.exitCode);
   }
 
+  // `send …` is intercepted here for both of the reasons `cluster` is, plus one
+  // of its own.
+  //
+  // Before the parser, because the message is arbitrary operator text: a
+  // message beginning with a dash, or one carrying `--port` inside it, must
+  // reach the channel rather than be eaten as a daemon flag.
+  //
+  // Before the runtime, because this composes only the services a delivery
+  // needs (see send/composition.ts) and must not start a second copy of the
+  // pollers, cluster election and LAN scan a running daemon already owns.
+  //
+  // And it must work when NO daemon is running, which is much of the point: the
+  // reason to message the owner is usually that something stopped.
+  if (rawArgs[0] === 'send') {
+    const ownership = resolveDaemonCliOwnership();
+    runDaemonConfigMigration(ownership.homeDirectory);
+    const stack = createSendStack({
+      workingDirectory: ownership.workingDirectory,
+      homeDirectory: ownership.homeDirectory,
+      daemonHomeDirectory: ownership.daemonHomeDirectory,
+    });
+    const result = await runSendCommand(rawArgs.slice(1), {
+      configManager: stack.configManager,
+      deliver: stack.deliver,
+      readStdin: readAllStdin,
+      stdinIsTty: process.stdin.isTTY === true,
+    });
+    for (const line of result.lines) {
+      // eslint-disable-next-line no-console
+      if (result.exitCode === 0) console.log(line);
+      else console.error(line);
+    }
+    // The activity log holds the OUTBOUND_HTTP record for the send that just
+    // happened (or did not); a process exiting this promptly would drop it.
+    flushActivityLogSync();
+    process.exit(result.exitCode);
+  }
+
   // Parse CLI flags first so --daemon-home and --working-dir env vars are set
   // before resolveDaemonCliOwnership() reads them.
   const cli = parseGoodVibesCli(process.argv.slice(2), 'goodvibes-daemon');
@@ -169,7 +213,7 @@ async function main(): Promise<void> {
     logger.info('daemon: --working-dir flag applied', { workingDir: cliFlags.workingDir });
   }
 
-  const { workingDirectory: workingDir, homeDirectory, daemonHomeDirectory } = resolveDaemonCliOwnership();
+  const { workingDirectory: workingDir, homeDirectory, daemonHomeDirectory, isOverridden: hasOverriddenHome } = resolveDaemonCliOwnership();
   runDaemonConfigMigration(homeDirectory);
   const config = new ConfigManager({ workingDir, homeDir: homeDirectory, surfaceRoot: 'tui' });
   new GlobalNetworkTransportInstaller().install(config);
@@ -314,6 +358,11 @@ async function main(): Promise<void> {
     getConversationTitle: () => 'goodvibes daemon',
     workingDir,
     homeDirectory,
+    // Honour --daemon-home / GOODVIBES_DAEMON_HOME on the CREDENTIAL store, not
+    // just the identity directory. Without this a daemon told to run out of a
+    // temp tree still read the real home's daemon secrets, so "isolating" a
+    // test daemon left it holding the owner's live credentials.
+    daemonHomeDirectory,
     // The standalone daemon observes externally-launched coding-agent sessions
     // on the host read-only (fleet visibility + steer; never counted, never
     // stopped). Daemon-side only — the interactive process reads this snapshot
@@ -361,6 +410,12 @@ async function main(): Promise<void> {
     // undefined for a non-binary install, so a dev run stays host-managed and
     // never swaps the interpreter. See lifecycle.ts.
     updateArtifact: resolveDaemonUpdateArtifact({ version: VERSION }),
+    // A daemon running out of an overridden home must never adopt the machine's
+    // service unit. One did: started from a scratchpad with --daemon-home, it
+    // found the unit not running, wrote its own scratchpad ExecStart into
+    // ~/.config/systemd/user/goodvibes.service and exited, and systemd then
+    // supervised the throwaway as the machine's daemon for five hours.
+    hasOverriddenHome,
     // The SAME coordinator this repository's inbox poller registered with (see
     // runtime/cluster-composition.ts). The facade must reuse it rather than
     // compose its own: two coordinators in one process are two nodes in the