@pellux/goodvibes-tui 1.25.0 → 1.26.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pellux/goodvibes-tui",
-  "version": "1.25.0",
+  "version": "1.26.0",
   "description": "Terminal-native GoodVibes product for coding, operations, automation, knowledge, channels, and daemon-backed control-plane workflows.",
   "type": "module",
   "main": "src/main.ts",
@@ -43,6 +43,7 @@
     "build:all-shell": "bun run build:linux-x64 && bun run build:linux-arm64 && bun run build:macos-x64 && bun run build:macos-arm64 && bun run build:windows",
     "typecheck": "bunx tsc --noEmit",
     "typecheck:test": "bunx tsc --noEmit -p tsconfig.test.json",
+    "typecheck:coverage": "bun run scripts/typecheck-coverage-rule.ts",
     "test": "bun run scripts/run-tests.ts",
     "test:coverage": "bun run scripts/coverage-gate.ts",
     "version": "bun run scripts/prebuild.ts",
@@ -106,8 +107,8 @@
     "@anthropic-ai/vertex-sdk": "^0.16.0",
     "@ast-grep/napi": "^0.42.0",
     "@aws/bedrock-token-generator": "^1.1.0",
-    "@pellux/goodvibes-sdk": "1.18.1",
-    "@pellux/goodvibes-terminal-shell": "1.18.1",
+    "@pellux/goodvibes-sdk": "1.19.2",
+    "@pellux/goodvibes-terminal-shell": "1.19.2",
     "bash-language-server": "^5.6.0",
     "fuse.js": "^7.1.0",
     "graphql": "^16.13.2",
@@ -133,10 +134,10 @@
     "typescript": "^5.9.3"
   },
   "optionalDependencies": {
-    "@pellux/goodvibes-tui-linux-x64": "1.25.0",
-    "@pellux/goodvibes-tui-linux-arm64": "1.25.0",
-    "@pellux/goodvibes-tui-darwin-x64": "1.25.0",
-    "@pellux/goodvibes-tui-darwin-arm64": "1.25.0"
+    "@pellux/goodvibes-tui-linux-x64": "1.26.0",
+    "@pellux/goodvibes-tui-linux-arm64": "1.26.0",
+    "@pellux/goodvibes-tui-darwin-x64": "1.26.0",
+    "@pellux/goodvibes-tui-darwin-arm64": "1.26.0"
   },
   "trustedDependencies": [],
   "overrides": {

package/src/cli/help.ts

@@ -341,6 +341,16 @@ export function renderGoodVibesDaemonHelp(binary = 'goodvibes-daemon'): string {
     '  service-status                 Show whether the daemon service is installed / enabled / active',
     '  migrate-service                Guided migration from an install-script goodvibes-daemon.service unit; prints a plan',
     '                                 unless run with -y/--yes (never auto-migrates)',
+    '  send [message]                 Send a message to one of your configured channels — Telegram, ntfy,',
+    '                                 Discord, Slack, Google Chat, Signal, WhatsApp, iMessage, Teams,',
+    '                                 BlueBubbles, Mattermost, Matrix or a webhook. Takes the message as',
+    '                                 an argument or on stdin, so it composes with other tooling.',
+    '                                 --channel <id> picks the channel; with none named it uses your one',
+    '                                 configured channel and says which. --to <address> targets a specific',
+    '                                 topic / chat / room within it, --title <text> sets a title, and',
+    '                                 --list shows every channel with where it would send. A channel that',
+    '                                 is off is refused rather than redirected to the default, and a',
+    '                                 failed send exits non-zero with the provider\'s own error.',
     '  cluster <command>              Share inbound channel work with your other machines on this network.',
     '                                 status | create | join | key | nodes | forget <machine> | rotate [--now]',
     '                                 | leave | rename | groups',

package/src/cli/redaction.ts

@@ -1,6 +1,56 @@
 export const REDACTED_VALUE = '<redacted>';
 
+// Matches a config path whose LAST SEGMENT is exactly one of these words. That
+// is the whole reach of this pattern, and it is why the declared list below
+// exists: `surfaces.calendar.caldavPassword` does not end in a `.password`
+// segment, it ends in a `caldavPassword` segment, so this pattern answers false
+// for it — as it does for `imapPassword`, `appPassword` and `authToken`.
 const SENSITIVE_PATH_PATTERN = /(^|\.)(apiKey|accessToken|botToken|appToken|signingSecret|webhookSecret|verifyToken|verificationToken|secret|password|token|keyFile)$/i;
+
+// Credential-bearing config keys that are sensitive by NAME rather than by the
+// generic trailing-word list above. Every one of these was carried in the clear
+// by a support bundle before it was listed here, because the pattern matches a
+// trailing WORD and these names carry the credential word in the middle or
+// prefixed by a protocol ("caldavPassword", "imapPassword", "appPassword",
+// "authToken").
+//
+// The `*Ref` Cloudflare keys normally hold a `goodvibes://secrets/...`
+// reference, which shouldRedactValue already lets through as safe. They are
+// listed as a BACKSTOP, for the same reason the mail keys are worth listing
+// twice over: it costs nothing, and it is what stands between a future code
+// path that writes a literal token there and that token reaching a file the
+// owner emails to someone for support.
+const SENSITIVE_CONFIG_KEYS: ReadonlySet<string> = new Set([
+  // Mailbox / CalDAV — the credentials the daemon polls mail and calendar with.
+  'surfaces.email.password',
+  'surfaces.email.imapPassword',
+  'surfaces.email.imap.password',
+  'surfaces.email.smtp.password',
+  'surfaces.calendar.caldavPassword',
+  // Telephony.
+  'surfaces.telephony.authToken',
+  'surfaces.msteams.appPassword',
+  // Cloudflare token references.
+  'cloudflare.apiTokenRef',
+  'cloudflare.tunnelTokenRef',
+  'cloudflare.accessServiceTokenRef',
+  'cloudflare.workerTokenRef',
+  'cloudflare.workerClientTokenRef',
+  // Cluster shared phrase.
+  'cluster.secret',
+  // Payment card material. ADDED to this set, never substituted for it: this
+  // set is a hardcoded list with no delegation, so replacing it wholesale with
+  // another product's would silently stop redacting whatever that one omits.
+  // The four names below end in no word the suffix pattern knows —
+  // "cardNumber", "cardExpiry" and "cardholderName" match none of them — which
+  // is the whole reason a declared list exists rather than a naming habit.
+  // (The `.map` below lowercases every entry; the lookup lowercases too.)
+  'payments.cardNumber',
+  'payments.cardExpiry',
+  'payments.cardCvv',
+  'payments.cardholderName',
+].map((key) => key.toLowerCase()));
+
 const SECRET_LIKE_TEXT_PATTERNS: readonly RegExp[] = [
   /\bsk-[A-Za-z0-9_-]{16,}\b/g,
   /\bghp_[A-Za-z0-9_]{16,}\b/g,
@@ -13,7 +63,7 @@ const SECRET_LIKE_TEXT_PATTERNS: readonly RegExp[] = [
 ];
 
 export function isSensitiveConfigPath(path: string): boolean {
-  return SENSITIVE_PATH_PATTERN.test(path);
+  return SENSITIVE_PATH_PATTERN.test(path) || SENSITIVE_CONFIG_KEYS.has(path.toLowerCase());
 }
 
 export function isRedactedValue(value: unknown): boolean {
@@ -25,9 +75,14 @@ export interface RedactedConfigResult<T> {
   readonly redactedPaths: readonly string[];
 }
 
+// Redaction rule for sensitive config paths:
+// - Non-string values: redact if truthy (i.e. non-null, non-undefined, non-zero, non-false).
+//   Rationale: zero and false are never meaningful secrets; null/undefined mean absent.
+// - String values: redact non-empty strings that are not goodvibes:// secret refs.
+//   Rationale: empty string means unset; secret refs are safe placeholders, not raw values.
 function shouldRedactValue(path: string, value: unknown): boolean {
   if (!isSensitiveConfigPath(path)) return false;
-  if (typeof value !== 'string') return value !== undefined && value !== null;
+  if (typeof value !== 'string') return value !== null && value !== undefined && Boolean(value);
   if (value.trim().length === 0) return false;
   if (value.startsWith('goodvibes://secrets/')) return false;
   return true;
@@ -64,7 +119,17 @@ export function redactConfig<T>(config: T): RedactedConfigResult<T> {
 }
 
 export function redactText(input: string): string {
-  let output = input;
+  // Assignment form: keyword=value — anchored so 'monkey=' and 'donkey=' do NOT match.
+  // Matches: token=, access_token=, api_key=, api-key=, secret=, password= and colon form token: value
+  let output = input
+    .replace(
+      /(?<![A-Za-z])(?:access_token|api[_-]?key|secret|password|token)\s*=\s*([^ \t\r\n"'`]+)/gi,
+      (m, val) => m.slice(0, m.length - val.length) + REDACTED_VALUE,
+    )
+    .replace(
+      /(?<![A-Za-z])(?:access_token|api[_-]?key|secret|password|token)\s*:\s*([^ \t\r\n"'`]+)/gi,
+      (m, val) => m.slice(0, m.length - val.length) + REDACTED_VALUE,
+    );
   for (const pattern of SECRET_LIKE_TEXT_PATTERNS) {
     output = output.replace(pattern, REDACTED_VALUE);
   }

package/src/config/goodvibes-home.ts

@@ -44,6 +44,15 @@ export interface GoodVibesHomeOwnership {
   readonly homeDirectory: string;
   /** The daemon's own identity directory, under the tree root by default. */
   readonly daemonHomeDirectory: string;
+  /**
+   * True when either `GOODVIBES_HOME` or `GOODVIBES_DAEMON_HOME` named an
+   * override (a blank/whitespace-only value does not count — see
+   * resolveGoodVibesHome). Callers that need to know "is this process running
+   * out of a relocated tree or identity directory" (e.g. to refuse adopting
+   * the machine's real service unit) read this instead of re-reading the raw
+   * environment variable themselves — this module is the one reader.
+   */
+  readonly isOverridden: boolean;
 }
 
 /**
@@ -117,6 +126,7 @@ export function resolveGoodVibesHomeOwnership(
   return {
     homeDirectory,
     daemonHomeDirectory: resolveGoodVibesDaemonHome(homeDirectory, env),
+    isOverridden: Boolean(env['GOODVIBES_HOME']?.trim()) || Boolean(env['GOODVIBES_DAEMON_HOME']?.trim()),
   };
 }
 

package/src/config/secret-config.ts

@@ -1,8 +1,27 @@
-import { isSecretRefInput } from '@pellux/goodvibes-sdk/platform/config';
+import { isSecretRefInput, isDaemonOwnedConfigKey } from '@pellux/goodvibes-sdk/platform/config';
 import type { ConfigKey } from './index.ts';
 import type { SecretScope, SecretStorageMedium } from './secrets.ts';
 
 export const SECRET_CONFIG_KEYS = new Set<ConfigKey>([
+  // Mailbox and CalDAV credentials. Their own CONFIG_SCHEMA descriptions read
+  // "Stored in the daemon secret tier, never in config" — and until they were
+  // listed here that sentence was aspirational: the settings modal wrote them
+  // as plain strings into a config JSON file, because membership in this set is
+  // the thing that routes an edit through the secret manager instead.
+  //
+  // The daemon reads each of these back with
+  // resolveConfigSecret('<key>') → GOODVIBES_<KEY>, which is exactly the store
+  // key buildGoodVibesSecretKey() writes — see
+  // daemon/handlers/inbox/providers/email.ts.
+  'surfaces.email.password',
+  'surfaces.email.imapPassword',
+  'surfaces.email.imap.password',
+  'surfaces.email.smtp.password',
+  'surfaces.calendar.caldavPassword',
+  // Telephony delivery credentials — same shape, same file, same gap.
+  'surfaces.telephony.authToken',
+  'surfaces.telephony.token',
+  'surfaces.telephony.webhookSecret',
   'surfaces.slack.signingSecret',
   'surfaces.slack.botToken',
   'surfaces.slack.appToken',
@@ -23,6 +42,16 @@ export const SECRET_CONFIG_KEYS = new Set<ConfigKey>([
   'surfaces.bluebubbles.password',
   'surfaces.mattermost.botToken',
   'surfaces.matrix.accessToken',
+  // TUI-local synthetic sub-keys, one level under the SDK's real `payments`
+  // section (not yet a scalar CONFIG_SCHEMA entry — same situation as
+  // tts.speed, behavior.notifyAfterSeconds, etc. in settings-modal-data.ts),
+  // hence the cast. See input/payments-config.ts for why these are named flat
+  // (payments.cardNumber, not payments.card.number): a flat one-level leaf is
+  // the shape the real ConfigManager tolerates for an undeclared key.
+  'payments.cardNumber' as ConfigKey,
+  'payments.cardExpiry' as ConfigKey,
+  'payments.cardCvv' as ConfigKey,
+  'payments.cardholderName' as ConfigKey,
 ]);
 
 export interface SecretBackedConfigUpdate {
@@ -96,6 +125,28 @@ export function buildSecretBackedConfigUpdate(configKey: ConfigKey, rawValue: st
   };
 }
 
+/**
+ * Where a secret-backed write lands when the caller did not name a scope.
+ *
+ * A daemon-owned config key (`surfaces.*`, `payments.*`, `controlPlane.*`, ...)
+ * names a credential the DAEMON executes with, not this interactive client, so
+ * its secret material belongs in the daemon-scoped tier the daemon actually
+ * reads — the same rule the SDK's config-ownership.ts already applies to the
+ * `goodvibes://` reference that points at it.
+ *
+ * Defaulting these to 'user' (the historical behavior here) split the pair: the
+ * reference landed in the daemon's own settings file, because ConfigManager
+ * routes daemon-owned keys there, while the value it pointed at sat in a tier
+ * the daemon never resolves. The surface reported success and the daemon found
+ * nothing. For the mailbox password that is the whole feature failing silently —
+ * the daemon is the process that polls IMAP and answers over Telegram, and it
+ * does so with every surface closed. A payment card entered through
+ * /payments card is the same shape of failure at purchase time.
+ */
+export function defaultSecretBackedScope(configKey: ConfigKey): SecretScope {
+  return isDaemonOwnedConfigKey(configKey) ? 'daemon' : 'user';
+}
+
 export async function persistSecretBackedConfigValue(
   configManager: SecretBackedConfigManager,
   secretsManager: SecretBackedSecretStore | null | undefined,
@@ -104,16 +155,21 @@ export async function persistSecretBackedConfigValue(
   options: { readonly scope?: SecretScope } = {},
 ): Promise<string> {
   const update = buildSecretBackedConfigUpdate(configKey, rawValue);
-  const scope = options.scope ?? 'user';
+  const scope = options.scope ?? defaultSecretBackedScope(configKey);
+  const medium = getSecretWriteMedium(configManager.get('storage.secretPolicy'));
+
+  // 1. Validate config write first. If setDynamic throws, no secret is written (avoids orphans).
+  configManager.setDynamic(configKey, update.configValue);
+
+  // 2. Write new secret only after config accepted it.
   if (update.secretKey && update.secretValue !== undefined && secretsManager) {
-    await secretsManager.set(update.secretKey, update.secretValue, {
-      scope,
-      medium: getSecretWriteMedium(configManager.get('storage.secretPolicy')),
-    });
+    await secretsManager.set(update.secretKey, update.secretValue, { scope, medium });
   }
+
+  // 3. Clear old secret — pass the same medium so plaintext-medium secrets are found for deletion.
   if (update.clearSecretKey && secretsManager?.delete) {
-    await secretsManager.delete(update.clearSecretKey, { scope });
+    await secretsManager.delete(update.clearSecretKey, { scope, medium });
   }
-  configManager.setDynamic(configKey, update.configValue);
+
   return update.configValue;
 }

package/src/core/turn-event-wiring.ts

@@ -1,7 +1,7 @@
 import type { UiRuntimeEvents, RuntimeEventBus } from '@/runtime/index.ts';
 import { buildPersistedSessionContext, persistConversation } from '@/runtime/index.ts';
 import { buildCompactionReceiptBlock } from './compaction-receipt.ts';
-import { formatTurnBudgetOutcome } from './turn-budget-outcome.ts';
+import { workstreamFailureNotification } from './workstream-notification.ts';
 import { persistTurnAnchors, recordTurnAnchor, summarizeTurnLabel } from './rewind-turn-anchors.ts';
 import { logger } from '@pellux/goodvibes-sdk/platform/utils';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
@@ -328,21 +328,12 @@ export function wireTurnEventHandlers(
     unsubs.push(events.workflows.on('WORKFLOW_CHAIN_FAILED', (payload) => {
       if (!shouldFireAlert(focusTracker, configGet, 'behavior.notifyOnChainFailure')) return;
       try {
-        // An operator cancellation is an intended stop, not a failure — narrate it
-        // as cancelled (the reason already carries the landed-work count from the
-        // chain's edit ledger), so the notification never contradicts the cancelled
-        // chain/owner/cohort surfaces.
-        if (payload.failureKind === 'cancelled') {
-          notifyCompletion('GoodVibes — WRFC chain cancelled', `chain ${payload.chainId.slice(0, 12)} cancelled: ${payload.reason}`, FORCE_NOTIFY_DURATION_MS);
-        } else if (payload.failureKind === 'max_turns') {
-          // A turn-budget exhaustion is a spent ceiling, not an infrastructure
-          // failure — narrate the limit and where it came from, from the typed
-          // event fields, never a regex of the prose reason.
-          notifyCompletion('GoodVibes — WRFC chain hit its turn budget', `chain ${payload.chainId.slice(0, 12)} ${formatTurnBudgetOutcome({ limit: payload.turnLimit, source: payload.turnLimitSource })}`, FORCE_NOTIFY_DURATION_MS);
-        } else {
-          const kindLabel = payload.failureKind === 'transport' ? 'transient transport error' : payload.reason;
-          notifyCompletion('GoodVibes — WRFC chain failed', `chain ${payload.chainId.slice(0, 12)} failed: ${kindLabel}`, FORCE_NOTIFY_DURATION_MS);
-        }
+        // Title and body come from workstream-notification.ts, which is where
+        // the three branches (cancelled / turn budget / failed) are narrated and
+        // tested. A notification is a message to a person, so it carries neither
+        // the internal name for the machinery nor the chain id.
+        const notice = workstreamFailureNotification(payload);
+        notifyCompletion(notice.title, notice.body, FORCE_NOTIFY_DURATION_MS);
       } catch (err) {
         logger.debug('turn-event-wiring: chain-failure notify error', { error: String(err) });
       }

package/src/core/workstream-notification.ts

@@ -0,0 +1,69 @@
+/**
+ * workstream-notification.ts — the desktop notification a finished workstream
+ * pushes, in words rather than identifiers.
+ *
+ * These three notifications used to read:
+ *
+ *     GoodVibes — WRFC chain failed
+ *     chain 7f3a91c02b4e failed: review rejected
+ *
+ * A desktop notification is a message TO a person, so the standing rule applies
+ * to it the same way it applies to a chat message: no internal name for the
+ * machinery, and no register id. `WRFC` is the first; `7f3a91c02b4e` is the
+ * second, and it is not something the reader can do anything with — it is not
+ * the commit, not the branch, not the session.
+ *
+ * What the reader can act on is why the work stopped, so that is what the body
+ * now leads with. Two workstreams that end at the same moment are told apart by
+ * their reasons, which is the same principle the channel renderer follows: in
+ * plain words, never by an opaque identifier.
+ *
+ * Split out of turn-event-wiring.ts as a pure function so the text is testable
+ * on its own — the wiring itself cannot be asserted against without mocking a
+ * process-global notifier.
+ */
+import { formatTurnBudgetOutcome } from './turn-budget-outcome.ts';
+
+/** The fields of WORKFLOW_CHAIN_FAILED this narration reads. */
+export interface WorkstreamFailureNarrationInput {
+  readonly reason: string;
+  readonly failureKind?: 'transport' | 'other' | 'cancelled' | 'max_turns' | undefined;
+  readonly turnLimit?: number | undefined;
+  readonly turnLimitSource?: 'default' | 'spawn-override' | 'policy-bound' | undefined;
+}
+
+export interface WorkstreamNotification {
+  readonly title: string;
+  readonly body: string;
+}
+
+/**
+ * Title and body for a workstream that reached a terminal state.
+ *
+ * An operator cancellation is an intended stop, not a failure — it is narrated
+ * as cancelled (the reason already carries the landed-work count from the
+ * workstream's edit ledger) so the notification never contradicts the cancelled
+ * workstream/owner/cohort surfaces. A turn-budget exhaustion is a spent ceiling
+ * rather than an infrastructure error, and its limit and source are read from
+ * the typed event fields, never from a regex of the prose reason.
+ */
+export function workstreamFailureNotification(
+  payload: WorkstreamFailureNarrationInput,
+): WorkstreamNotification {
+  if (payload.failureKind === 'cancelled') {
+    return {
+      title: 'GoodVibes — workstream cancelled',
+      body: `Cancelled: ${payload.reason}`,
+    };
+  }
+  if (payload.failureKind === 'max_turns') {
+    return {
+      title: 'GoodVibes — workstream hit its turn budget',
+      body: `The workstream ${formatTurnBudgetOutcome({ limit: payload.turnLimit, source: payload.turnLimitSource })}`,
+    };
+  }
+  return {
+    title: 'GoodVibes — workstream failed',
+    body: `Failed: ${payload.failureKind === 'transport' ? 'transient transport error' : payload.reason}`,
+  };
+}

package/src/daemon/cli.ts

@@ -7,7 +7,7 @@ import {
 } from '@pellux/goodvibes-sdk/platform/config';
 import type { ConfigKey } from '@pellux/goodvibes-sdk/platform/config';
 import { formatProviderModel, getModelIdFromProviderModel, getProviderIdFromModel } from '../config/provider-model.ts';
-import { resolveGoodVibesHomeOwnership, hasOverriddenGoodVibesHome } from '../config/goodvibes-home.ts';
+import { resolveGoodVibesHomeOwnership } from '../config/goodvibes-home.ts';
 import { RuntimeEventBus, GlobalNetworkTransportInstaller } from '@/runtime/index.ts';
 import { bindFeatureSettingsBridge, createFeatureFlagManager, deriveFeatureStates } from '@/runtime/index.ts';
 import { createRuntimeStore } from '../runtime/store/index.ts';
@@ -34,6 +34,9 @@ import {
   persistProviders,
 } from '@pellux/goodvibes-sdk/platform/discovery';
 import { createSafeHostServeFactory } from './safe-serve.ts';
+import { runSendCommand } from './send/command.ts';
+import { createSendStack } from './send/composition.ts';
+import { readAllStdin } from './send/stdin.ts';
 import { isDaemonServiceSubcommand, resolveInstalledDaemonBinary, runDaemonServiceCli } from './service-commands.ts';
 import { runClusterCommand } from '../cluster/commands.ts';
 import { resolveConfiguredServiceName } from '../runtime/legacy-daemon-migration.ts';
@@ -59,6 +62,8 @@ type DaemonCliOwnership = {
   readonly homeDirectory: string;
   /** The daemon's OWN identity home (auth users, operator tokens, daemon settings). */
   readonly daemonHomeDirectory: string;
+  /** True when GOODVIBES_HOME or GOODVIBES_DAEMON_HOME named an override — see goodvibes-home.ts. */
+  readonly isOverridden: boolean;
 };
 
 // CLI flag parsing delegated to shared module — see src/cli-flags.ts
@@ -87,11 +92,12 @@ function resolveDaemonCliOwnership(): DaemonCliOwnership {
   // point also uses. They were resolved independently, and the client's copy
   // simply did not read GOODVIBES_HOME — so a redirected client wrote into the
   // real tree while the daemon honoured the redirect.
-  const { homeDirectory, daemonHomeDirectory } = resolveGoodVibesHomeOwnership();
+  const { homeDirectory, daemonHomeDirectory, isOverridden } = resolveGoodVibesHomeOwnership();
   return {
     workingDirectory: process.env['GOODVIBES_WORKING_DIR'] ?? process.cwd(),
     homeDirectory,
     daemonHomeDirectory,
+    isOverridden,
   };
 }
 
@@ -137,6 +143,44 @@ async function main(): Promise<void> {
     process.exit(result.exitCode);
   }
 
+  // `send …` is intercepted here for both of the reasons `cluster` is, plus one
+  // of its own.
+  //
+  // Before the parser, because the message is arbitrary operator text: a
+  // message beginning with a dash, or one carrying `--port` inside it, must
+  // reach the channel rather than be eaten as a daemon flag.
+  //
+  // Before the runtime, because this composes only the services a delivery
+  // needs (see send/composition.ts) and must not start a second copy of the
+  // pollers, cluster election and LAN scan a running daemon already owns.
+  //
+  // And it must work when NO daemon is running, which is much of the point: the
+  // reason to message the owner is usually that something stopped.
+  if (rawArgs[0] === 'send') {
+    const ownership = resolveDaemonCliOwnership();
+    runDaemonConfigMigration(ownership.homeDirectory);
+    const stack = createSendStack({
+      workingDirectory: ownership.workingDirectory,
+      homeDirectory: ownership.homeDirectory,
+      daemonHomeDirectory: ownership.daemonHomeDirectory,
+    });
+    const result = await runSendCommand(rawArgs.slice(1), {
+      configManager: stack.configManager,
+      deliver: stack.deliver,
+      readStdin: readAllStdin,
+      stdinIsTty: process.stdin.isTTY === true,
+    });
+    for (const line of result.lines) {
+      // eslint-disable-next-line no-console
+      if (result.exitCode === 0) console.log(line);
+      else console.error(line);
+    }
+    // The activity log holds the OUTBOUND_HTTP record for the send that just
+    // happened (or did not); a process exiting this promptly would drop it.
+    flushActivityLogSync();
+    process.exit(result.exitCode);
+  }
+
   // Parse CLI flags first so --daemon-home and --working-dir env vars are set
   // before resolveDaemonCliOwnership() reads them.
   const cli = parseGoodVibesCli(process.argv.slice(2), 'goodvibes-daemon');
@@ -169,7 +213,7 @@ async function main(): Promise<void> {
     logger.info('daemon: --working-dir flag applied', { workingDir: cliFlags.workingDir });
   }
 
-  const { workingDirectory: workingDir, homeDirectory, daemonHomeDirectory } = resolveDaemonCliOwnership();
+  const { workingDirectory: workingDir, homeDirectory, daemonHomeDirectory, isOverridden: hasOverriddenHome } = resolveDaemonCliOwnership();
   runDaemonConfigMigration(homeDirectory);
   const config = new ConfigManager({ workingDir, homeDir: homeDirectory, surfaceRoot: 'tui' });
   new GlobalNetworkTransportInstaller().install(config);
@@ -371,7 +415,7 @@ async function main(): Promise<void> {
     // found the unit not running, wrote its own scratchpad ExecStart into
     // ~/.config/systemd/user/goodvibes.service and exited, and systemd then
     // supervised the throwaway as the machine's daemon for five hours.
-    hasOverriddenHome: hasOverriddenGoodVibesHome(),
+    hasOverriddenHome,
     // The SAME coordinator this repository's inbox poller registered with (see
     // runtime/cluster-composition.ts). The facade must reuse it rather than
     // compose its own: two coordinators in one process are two nodes in the

package/src/daemon/handlers/credentials.ts

@@ -1,5 +1,5 @@
 import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';
-import type { SecretsManager } from '../../config/secrets.ts';
+import type { SecretsManager, SecretScope } from '../../config/secrets.ts';
 import {
   buildGoodVibesSecretKey,
   isSecretReferenceValue,
@@ -16,11 +16,21 @@ export interface DaemonCredentialStore {
    * (e.g. 'surfaces.slack.botToken' → GOODVIBES_SURFACES_SLACK_BOT_TOKEN).
    */
   resolveConfigSecret(configKey: string): Promise<string | null>;
-  /** Store a daemon-owned credential. scope defaults 'user'. */
+  /**
+   * Store a daemon-owned credential. scope defaults 'daemon'.
+   *
+   * This is the DAEMON's own credential store: every caller is daemon code, and
+   * every value written through it is one the daemon itself has to read back —
+   * including its own generated draft encryption key (createAtRestCipher below,
+   * which calls put() with no scope at all). Defaulting to 'user' filed those
+   * in a surface-scoped tier, so the daemon's own material lived somewhere it
+   * only found by accident, and a value written on one surface's behalf was
+   * invisible to the next.
+   */
   put(
     secretKey: string,
     value: string,
-    opts?: { scope?: 'user' | 'project'; medium?: 'plaintext' | 'secure' },
+    opts?: { scope?: SecretScope; medium?: 'plaintext' | 'secure' },
   ): Promise<void>;
   has(secretKey: string): Promise<boolean>;
 }
@@ -45,10 +55,10 @@ export function createDaemonCredentialStore(secrets: SecretsManager): DaemonCred
     async put(
       secretKey: string,
       value: string,
-      opts?: { scope?: 'user' | 'project'; medium?: 'plaintext' | 'secure' },
+      opts?: { scope?: SecretScope; medium?: 'plaintext' | 'secure' },
     ): Promise<void> {
       await secrets.set(secretKey, value, {
-        scope: opts?.scope ?? 'user',
+        scope: opts?.scope ?? 'daemon',
         medium: opts?.medium ?? 'secure',
       });
     },