@pellux/goodvibes-tui 1.26.0 → 1.27.1

package/src/shell/voice-capture-shell.ts

@@ -0,0 +1,69 @@
+/**
+ * voice-capture-shell.ts — the shell's side of microphone capture.
+ *
+ * Extracted from main() for the same reason the process-lifecycle wiring was:
+ * the entrypoint is a wiring file held under a source-line gate, and new shell
+ * composition gets its own module and a single call there.
+ *
+ * What this owns is only the shell-facing half — where a transcript lands (the
+ * composer draft, through the same public `prompt`/`cursorPos` fields the
+ * external-editor path writes), how a turn is submitted, which keybinding seam
+ * the Alt+V action hangs off, and the teardown registration that guarantees a
+ * live recorder subprocess dies with the process. Everything about audio itself
+ * lives in src/audio/voice-capture-wiring.ts, which must not (and does not)
+ * import shell-UI.
+ */
+
+import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
+import type { CommandContext } from '../input/command-registry.ts';
+import type { ShellPathService } from '@/runtime/index.ts';
+import type { VoiceCaptureIndicatorState } from '../core/voice-capture-status.ts';
+import { wireVoiceCapture } from '../audio/voice-capture-wiring.ts';
+
+export interface VoiceCaptureShellDeps {
+  readonly configManager: ConfigManager;
+  readonly shellPaths: Pick<ShellPathService, 'resolveUserPath'>;
+  readonly homeDirectory: string | (() => string);
+  /** Names retained wake clips so the SDK's sweeper reaps them when this session ends. */
+  readonly sessionId: string;
+  /** The Alt+V seam is hung here (commandContext.toggleVoiceInput). */
+  readonly commandContext: CommandContext;
+  /** The shell's teardown registry; the device release is appended to it. */
+  readonly unsubs: Array<() => void>;
+  /** The live composer buffer — InputHandler exposes public `prompt`/`cursorPos`. */
+  readonly buffer: { prompt: string; cursorPos: number };
+  readonly submitInput: (text: string) => void;
+  readonly notify: (message: string) => void;
+  readonly render: () => void;
+}
+
+/**
+ * Compose voice capture and hand back the footer-row reader.
+ *
+ * Opens no device: wake detection consults `voice.wake.*` and refuses without
+ * touching the capture opener when it is off, and push-to-talk opens one only on
+ * a keypress.
+ */
+export function installVoiceCapture(deps: VoiceCaptureShellDeps): () => VoiceCaptureIndicatorState | null {
+  const capture = wireVoiceCapture({
+    configManager: deps.configManager,
+    // The same managed root `/voice setup` uses; the wake tree is `<root>/wake`.
+    managedVoiceRoot: deps.shellPaths.resolveUserPath('voice'),
+    // Surface-scoped: the extracted onnxruntime assets belong to this surface's
+    // own directory, beside its other managed state.
+    assetDirectory: deps.shellPaths.resolveUserPath('tui', 'onnxruntime'),
+    homeDirectory: deps.homeDirectory,
+    sessionId: deps.sessionId,
+    writeDraft: (text) => {
+      deps.buffer.prompt = text;
+      deps.buffer.cursorPos = text.length;
+      deps.render();
+    },
+    submitTurn: (text) => deps.submitInput(text),
+    notify: deps.notify,
+    render: deps.render,
+  });
+  deps.commandContext.toggleVoiceInput = capture.toggleVoiceInput;
+  deps.unsubs.push(...capture.unsubs);
+  return capture.status;
+}

package/src/verification/verification-ledger.ts

@@ -209,16 +209,16 @@ export const FEATURE_KNOB_LOCAL_SETTINGS = [
  *   watchers.triggers.onExitMaxDurationMs    persistence · live (on-exit trigger duration cap)
  *   watchers.triggers.onExitStdin            persistence · live (on-exit stdin posture)
  *   watchers.triggers.outputTailBytes        persistence · live (captured output tail)
- *   device.capabilities.allowAlwaysOffer     persistence · settings surface only in this build
- *   device.capabilities.requestTimeoutSeconds persistence · settings surface only in this build
- *   device.location.precision                persistence · settings surface only in this build
- *   device.clipboard.readMode                persistence · settings surface only in this build
- *   device.capture.retentionHours            persistence · settings surface only in this build
- *   device.capture.maxArtifacts              persistence · settings surface only in this build
- *   device.capture.sweepIntervalMinutes      persistence · settings surface only in this build
- *   device.grants.expiryDays                 persistence · settings surface only in this build
- *   device.grants.maxPerNode                 persistence · settings surface only in this build
- *   device.grants.auditRetentionDays         persistence · settings surface only in this build
+ *   device.capabilities.allowAlwaysOffer     persistence · behavior (durable-grant offer by sensitivity)
+ *   device.capabilities.requestTimeoutSeconds persistence · behavior (dispatch, wire payload and prompt deadline)
+ *   device.location.precision                persistence · behavior (precise fix refused / never granted)
+ *   device.clipboard.readMode                persistence · behavior (clipboard read refused / never granted)
+ *   device.capture.retentionHours            persistence · behavior (capture TTL, swept off disk at expiry)
+ *   device.capture.maxArtifacts              persistence · behavior (capture count cap at the sweep)
+ *   device.capture.sweepIntervalMinutes      persistence · behavior (period of the sweep that reaps)
+ *   device.grants.expiryDays                 persistence · behavior (grant TTL, then asks again)
+ *   device.grants.maxPerNode                 persistence · behavior (per-node grant cap at the sweep)
+ *   device.grants.auditRetentionDays         persistence · behavior (grant ledger retention)
  *   device.nodes.maxPaired                   persistence · live (enforced at the pairing path)
  *
  * On `device.nodes.maxPaired`: the SDK enforces it where a device pairs —
@@ -235,17 +235,56 @@ export const FEATURE_KNOB_LOCAL_SETTINGS = [
  * in this column so the "how live is it" audit stays accurate, not to claim
  * coverage this repo did not write.
  *
- * On the other ten `device.*` rows: DeviceCapabilityService carries its own
- * policy struct whose defaults match those keys one for one, and names them in
- * its field comments and refusal messages, but no code path in either tree maps
- * configuration into that struct. Persistence is therefore the whole of what is
- * verified for them, and the settings-workspace description for the `device`
- * category says exactly that to the user rather than implying live knobs.
+ * On the other ten `device.*` rows: they are live now. This app composes the
+ * platform's device posture runtime (src/runtime/device-posture-composition.ts)
+ * on the same distributed runtime phones pair onto and the same approval broker
+ * every other confirmation rides, registers the `phone` tool on it, and binds the
+ * devices.* verbs to it — so each of these keys is read, per request and per
+ * sweep, by the DeviceCapabilityService / DeviceGrantStore /
+ * DeviceCaptureArtifactStore / DeviceHousekeeper that serve them. They were dark
+ * before that: the policy struct carried matching defaults and named the keys in
+ * its refusal messages, but nothing mapped configuration into it in either tree.
+ * The mapping now lives in the SDK, so every daemon host honours it rather than
+ * only whichever consumer had written its own.
  *
- * DELIBERATELY NOT COUNTED: the 24 non-enablement `voice.wake.*` keys from the
- * same release. `wake-word-detection` is declared `notOperable` — no surface
- * captures audio — so its rows stay in `total` and out of the numerator. That is
- * the honest reading, and it is why this list raises coverage by 29 and not 53.
+ * The second column above is upgraded to "behavior" on the strength of
+ * `src/test/verification/device-posture-behavior.test.ts`, which drives THIS
+ * app's composition with a real ConfigManager over a temp home and the platform's
+ * real stores, stubs only the peer transport and the approval bridge, and asserts
+ * per key at two values that the observable outcome differs — refusal code, how
+ * authority was established, what reached the transport, what the prompt was
+ * given, and what survives on disk after a sweep. It also invokes the `phone`
+ * tool and the devices.* verbs off the composed runtime graph, because a mapping
+ * nothing composes is the same defect in a different place.
+ *
+ * STILL NOT COUNTED, FOR A DIFFERENT REASON NOW: the 24 non-enablement
+ * `voice.wake.*` keys from the same release. When this list was written they were
+ * excluded because nothing captured audio at all. That is no longer true — this
+ * terminal opens a recorder subprocess (src/audio/capture.ts), runs the SDK
+ * detector over it through onnxruntime-web (src/audio/wake-inference.ts), and
+ * hands both a confirmed wake's utterance and a push-to-talk recording to the
+ * daemon's `voice.stt` verb. Every one of those rows is read by
+ * resolveWakeRuntimeSettings and reaches this surface's runtime.
+ *
+ * They stay out of the NUMERATOR here because this constant counts exactly one
+ * thing — keys whose four-part PERSISTENCE contract is exercised by
+ * device-and-trigger-settings-persistence.test.ts — and that test does not cover
+ * them. The behaviour they now drive is covered instead by the capture and wake
+ * tests under src/test/audio/, which assert the frame path, the detection
+ * chain, the disabled-means-no-capture rule, the supervisor's restart and latch,
+ * and the recorder argv. Counting them in both places would double-count; adding
+ * them here without writing their persistence round-trip would overclaim. So the
+ * number this list raises coverage by is unchanged, and the reason it excludes
+ * them is recorded above rather than left reading as "the feature does nothing".
+ *
+ * Every wake row is now in force on this surface, with one condition stated at
+ * every surfacing: `voice.wake.vadThreshold` above 0 needs the speech gate's own
+ * pinned artifact provisioned (`/voice wake setup` fetches it with the models),
+ * and until it is, startup BLOCKS with that reason rather than scoring frames
+ * ungated behind a row that says they are screened. `voice.wake.noiseSuppression:
+ * speex` runs here: the filter is a WebAssembly module the SDK carries, applied
+ * by the wrapper the listener and the push-to-talk session put around this
+ * surface's capture opener.
  */
 export const DEVICE_AND_TRIGGER_LOCAL_SETTINGS = [
   'watchers.triggers.backoffLadderMs',

package/src/version.ts

@@ -6,7 +6,7 @@ import { join } from 'node:path';
 // The prebuild script updates the fallback value before compilation.
 // Uses import.meta.dir (Bun) to locate package.json relative to this file,
 // which is correct regardless of the process working directory.
-let _version = '1.26.0';
+let _version = '1.27.1';
 try {
   const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', 'package.json'), 'utf-8'));
   // Only trust a version read from OUR OWN package.json. A Bun single-file