@pellux/goodvibes-tui 1.27.0 → 1.27.1

package/CHANGELOG.md

@@ -4,6 +4,15 @@ All notable changes to GoodVibes TUI.
 
 ---
 
+## [1.27.0] - 2026-07-30
+
+### Fixes
+
+- Fixed: the daemon died without saying why. Measured against the released 1.27.0 daemon binary, in a throwaway home whose `.goodvibes/daemon/settings.json` could not be parsed: it exited 1 with zero bytes on stdout, zero bytes on stderr, and no activity log at all. It restarted and failed 77 times overnight and the only sign anything was wrong was that everything had stopped. The cause was not output buffering and not a handler that got skipped — the daemon reported the failure to the activity logger and exited, and the daemon had never given that logger a file to write to, so nothing reached a console, a journal or a log. Writing to a log object is not the same as writing to the terminal. Every place the daemon can exit before its screen is up now writes to the error stream directly, before anything else and before the exit: the startup failure itself, the flag-parse refusal, the config and endpoint override refusals, and the `cluster`, `send`, `provision-wake-model` and service subcommands. Written to the file descriptor rather than through `process.stderr`, because this program replaces `process.stderr` to keep the rendered screen clean, and because a stream write issued immediately before the process exits can still be in flight when the process stops existing. Proven the only way it can be proven — by compiling a binary and running it — against a control that pins the old shape at zero bytes, so nobody can put the silence back without a test failing.
+- Fixed: the daemon now writes an activity log. The standalone daemon never named a log file at boot, so every line it logged for its whole lifetime went nowhere, and the flushes it performs before exiting had nothing to flush.
+- Fixed: the interactive program's startup failure message goes to the error stream directly too, for the same reason: the guard that keeps the screen clean is exactly the thing that could swallow the one line explaining why the screen is blank.
+- Fixed: `--daemon-home` is given the daemon's own state directory — `~/.goodvibes/daemon`, where its operator tokens, its users and its daemon settings live — instead of the home directory above it. The installer's systemd unit, the installer's macOS launch agent, the in-app install-service, and a daemon started in the background by the interactive program all named the home directory, so a daemon filed its identity one level above where every reader of it looks, and the program that started it went on reading an empty file. An already-installed service unit that carries no pinned host or port is still left alone on upgrade, so an existing install keeps the old location until its unit is regenerated.
+
 ## [1.26.0] - 2026-07-29
 
 ### Changes

package/README.md

@@ -2,7 +2,7 @@
 
 [![CI](https://github.com/mgd34msu/goodvibes-tui/actions/workflows/ci.yml/badge.svg)](https://github.com/mgd34msu/goodvibes-tui/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
-[![Version](https://img.shields.io/badge/version-1.27.0-blue.svg)](https://github.com/mgd34msu/goodvibes-tui)
+[![Version](https://img.shields.io/badge/version-1.27.1-blue.svg)](https://github.com/mgd34msu/goodvibes-tui)
 
 GoodVibes is a terminal console for coding and operations work with an AI model. You run `goodvibes` in a project directory and get a full-screen terminal app where you talk to a model that can read and edit your files, run shell commands, search the web, and hand work off to background agents — asking your permission before anything that writes or executes. It talks to many model providers (OpenAI, Anthropic, Gemini, Bedrock, Copilot, OpenRouter and other OpenAI-compatible gateways, plus local servers like Ollama and LM Studio that it finds on startup), keeps its settings, sessions, and secrets on your own machine, and shows you the token count and running cost of every turn. Alongside the conversation, panels turn background work — running agents, git state, diffs, tokens, cost — into live control rooms.
 

package/docs/foundation-artifacts/operator-contract.json

@@ -3,7 +3,7 @@
   "product": {
     "id": "goodvibes",
     "surface": "operator",
-    "version": "1.20.0"
+    "version": "1.21.0"
   },
   "auth": {
     "modes": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pellux/goodvibes-tui",
-  "version": "1.27.0",
+  "version": "1.27.1",
   "description": "Terminal-native GoodVibes product for coding, operations, automation, knowledge, channels, and daemon-backed control-plane workflows.",
   "type": "module",
   "main": "src/main.ts",
@@ -107,8 +107,8 @@
     "@anthropic-ai/vertex-sdk": "^0.16.0",
     "@ast-grep/napi": "^0.42.0",
     "@aws/bedrock-token-generator": "^1.1.0",
-    "@pellux/goodvibes-sdk": "1.20.0",
-    "@pellux/goodvibes-terminal-shell": "1.20.0",
+    "@pellux/goodvibes-sdk": "1.21.0",
+    "@pellux/goodvibes-terminal-shell": "1.21.0",
     "bash-language-server": "^5.6.0",
     "fuse.js": "^7.1.0",
     "graphql": "^16.13.2",
@@ -135,10 +135,10 @@
     "typescript": "^5.9.3"
   },
   "optionalDependencies": {
-    "@pellux/goodvibes-tui-linux-x64": "1.27.0",
-    "@pellux/goodvibes-tui-linux-arm64": "1.27.0",
-    "@pellux/goodvibes-tui-darwin-x64": "1.27.0",
-    "@pellux/goodvibes-tui-darwin-arm64": "1.27.0"
+    "@pellux/goodvibes-tui-linux-x64": "1.27.1",
+    "@pellux/goodvibes-tui-linux-arm64": "1.27.1",
+    "@pellux/goodvibes-tui-darwin-x64": "1.27.1",
+    "@pellux/goodvibes-tui-darwin-arm64": "1.27.1"
   },
   "trustedDependencies": [],
   "overrides": {

package/src/cli/tui-startup.ts

@@ -6,6 +6,7 @@ import { hasResumableWizardProgress, readOnboardingCheckMarker, readWizardProgre
 import { startOnboardingFastPath } from '../runtime/onboarding/fast-path.ts';
 import { checkRecoveryForSession, readLastSessionPointer, type SessionSurface } from '@/runtime/index.ts';
 import { logger } from '@pellux/goodvibes-sdk/platform/utils';
+import { writeFatalLine } from '../daemon/fatal-boot-report.ts';
 import { offerRecoverySnapshot } from '../runtime/recovery-prompt.ts';
 import { buildRecoveryOfferWiring } from '../runtime/recovery-offer-wiring.ts';
 import type { ConversationManager } from '../core/conversation.ts';
@@ -309,7 +310,15 @@ export function reportFatalStartupError(err: unknown): void {
     // Startup diagnostics must never hide the original launch failure.
   }
   try {
-    process.stderr.write(`goodvibes failed to start: ${message}\n${stack ? `${stack}\n` : ''}`);
+    // writeFatalLine, not process.stderr.write: this repository replaces
+    // process.stderr to keep the rendered screen clean
+    // (runtime/terminal-output-guard.ts), so a replaced writer that records
+    // instead of printing would swallow the one line explaining why the screen
+    // is blank — and a stream write issued immediately before the exit below
+    // can still be in flight when the process stops existing. The descriptor
+    // write is neither interceptable nor droppable. See
+    // daemon/fatal-boot-report.ts.
+    writeFatalLine(`goodvibes failed to start: ${message}${stack ? `\n${stack}` : ''}`);
   } catch {
     // Ignore secondary stderr failures during process teardown.
   }

package/src/daemon/cli.ts

@@ -1,6 +1,8 @@
 import { homedir } from 'node:os';
+import { join } from 'node:path';
 import {
   ConfigManager,
+  daemonConfigPathForHome,
   deriveControlPlaneBaseUrl,
   readControlPlaneBinding,
   resolveDaemonEnabled,
@@ -15,8 +17,9 @@ import { createRuntimeServices } from '../runtime/services.ts';
 import { startDeviceHousekeeping } from '../runtime/device-posture-composition.ts';
 import { DaemonServer, HttpListener } from '@pellux/goodvibes-sdk/platform/daemon';
 import { createHostPowerSeam } from '@pellux/goodvibes-sdk/platform/power';
-import { flushActivityLogSync, logger } from '@pellux/goodvibes-sdk/platform/utils';
+import { configureActivityLogger, flushActivityLogSync, logger } from '@pellux/goodvibes-sdk/platform/utils';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
+import { reportFatalBootFailure, writeExitingStdoutLine, writeFatalLine } from './fatal-boot-report.ts';
 import {
   getOrCreateCompanionToken,
   pruneStaleOperatorTokens,
@@ -130,17 +133,26 @@ async function main(): Promise<void> {
       workingDir: ownership.workingDirectory,
       homeDir: ownership.homeDirectory,
       surfaceRoot: 'tui',
+      // Named explicitly rather than left to ConfigManager's own
+      // `<homeDir>/.goodvibes/daemon/settings.json` derivation, so the daemon
+      // tier this reads/writes agrees with `ownership.daemonHomeDirectory`
+      // even when `GOODVIBES_DAEMON_HOME` moved it away from the plain home.
+      daemonTierPath: daemonConfigPathForHome(ownership.daemonHomeDirectory),
     });
     const result = await runClusterCommand({
       argv: rawArgs.slice(1),
       configManager: clusterConfig,
       daemonHomeDir: ownership.daemonHomeDirectory,
     });
-    if (result.rawOutput) process.stdout.write(`\u001b${result.rawOutput}`);
+    // Every write below is immediately followed by process.exit, so all of them
+    // go to the descriptor synchronously rather than through a stream that can
+    // still be in flight when the process stops existing — see
+    // fatal-boot-report.ts. (The OSC 52 clipboard sequence is unterminated
+    // either way; the line terminator this adds after it is inert.)
+    if (result.rawOutput) writeExitingStdoutLine(`\u001b${result.rawOutput}`);
     for (const line of result.lines) {
-      // eslint-disable-next-line no-console
-      if (result.exitCode === 0) console.log(line);
-      else console.error(line);
+      if (result.exitCode === 0) writeExitingStdoutLine(line);
+      else writeFatalLine(line);
     }
     process.exit(result.exitCode);
   }
@@ -160,6 +172,10 @@ async function main(): Promise<void> {
   // reason to message the owner is usually that something stopped.
   if (rawArgs[0] === 'send') {
     const ownership = resolveDaemonCliOwnership();
+    // Named before the delivery runs, because the flushActivityLogSync() below
+    // is what preserves this send's OUTBOUND_HTTP record — and a logger with no
+    // destination has nothing to flush, so that record was never written.
+    configureActivityLogger(join(ownership.workingDirectory, '.goodvibes', 'logs'));
     runDaemonConfigMigration(ownership.homeDirectory);
     const stack = createSendStack({
       workingDirectory: ownership.workingDirectory,
@@ -172,10 +188,12 @@ async function main(): Promise<void> {
       readStdin: readAllStdin,
       stdinIsTty: process.stdin.isTTY === true,
     });
+    // Descriptor writes, not stream writes: the exit two lines below can leave
+    // a `console.log` still in flight, and `send` is most often run precisely
+    // because something has already stopped. See fatal-boot-report.ts.
     for (const line of result.lines) {
-      // eslint-disable-next-line no-console
-      if (result.exitCode === 0) console.log(line);
-      else console.error(line);
+      if (result.exitCode === 0) writeExitingStdoutLine(line);
+      else writeFatalLine(line);
     }
     // The activity log holds the OUTBOUND_HTTP record for the send that just
     // happened (or did not); a process exiting this promptly would drop it.
@@ -195,9 +213,10 @@ async function main(): Promise<void> {
     const result = await runProvisionWakeModelCommand(rawArgs.slice(1), {
       homeDirectory: ownership.homeDirectory,
     });
+    // The curl installer runs this on a binary it has just placed and reads the
+    // result; an exit that discards the receipt would report nothing at all.
     for (const line of result.lines) {
-      // eslint-disable-next-line no-console
-      console.log(line);
+      writeExitingStdoutLine(line);
     }
     process.exit(result.exitCode);
   }
@@ -206,9 +225,12 @@ async function main(): Promise<void> {
   // before resolveDaemonCliOwnership() reads them.
   const cli = parseGoodVibesCli(process.argv.slice(2), 'goodvibes-daemon');
   if (cli.errors.length > 0) {
-    console.error(cli.errors.join('\n'));
-    console.error('');
-    console.error(renderGoodVibesDaemonHelp('goodvibes-daemon'));
+    // A parse refusal is the most common reason a service unit's daemon never
+    // starts, so it goes on the descriptor the journal is attached to rather
+    // than through a stream that exits out from under it.
+    writeFatalLine(cli.errors.join('\n'));
+    writeFatalLine('');
+    writeFatalLine(renderGoodVibesDaemonHelp('goodvibes-daemon'));
     process.exit(2);
   }
   if (cli.warnings.length > 0) {
@@ -217,11 +239,11 @@ async function main(): Promise<void> {
     }
   }
   if (cli.flags.help || cli.command === 'help') {
-    console.log(renderGoodVibesDaemonHelp('goodvibes-daemon'));
+    writeExitingStdoutLine(renderGoodVibesDaemonHelp('goodvibes-daemon'));
     process.exit(0);
   }
   if (cli.flags.version || cli.command === 'version') {
-    console.log(renderGoodVibesVersion('goodvibes-daemon'));
+    writeExitingStdoutLine(renderGoodVibesVersion('goodvibes-daemon'));
     process.exit(0);
   }
   const cliFlags = cli.flags;
@@ -235,13 +257,33 @@ async function main(): Promise<void> {
   }
 
   const { workingDirectory: workingDir, homeDirectory, daemonHomeDirectory, isOverridden: hasOverriddenHome } = resolveDaemonCliOwnership();
+  // Give the shared logger a destination before anything else runs. It never
+  // had one in this entrypoint: `logger` only writes to a file once
+  // `configureActivityLogger()` has named one, so every logger.info/warn/error
+  // in the standalone daemon — including the fatal handler at the bottom of
+  // this file and every flushActivityLogSync() call — went nowhere at all.
+  // That is why a crash-looping daemon left an empty activity log next to a
+  // silent console. src/cli/entrypoint.ts does the same for the interactive
+  // process; this is the daemon finally matching it.
+  configureActivityLogger(join(workingDir, '.goodvibes', 'logs'));
   runDaemonConfigMigration(homeDirectory);
-  const config = new ConfigManager({ workingDir, homeDir: homeDirectory, surfaceRoot: 'tui' });
+  // `daemonTierPath` named explicitly (SDK 1.21.0) rather than left to
+  // ConfigManager's own `<homeDir>/.goodvibes/daemon/settings.json`
+  // derivation: `daemonHomeDirectory` is this process's own resolution of
+  // `--daemon-home`/`GOODVIBES_DAEMON_HOME`, and the two must agree so the
+  // daemon's config reads and writes the same file its identity state
+  // (operator-tokens.json, auth-users.json) already lives beside.
+  const config = new ConfigManager({
+    workingDir,
+    homeDir: homeDirectory,
+    surfaceRoot: 'tui',
+    daemonTierPath: daemonConfigPathForHome(daemonHomeDirectory),
+  });
   new GlobalNetworkTransportInstaller().install(config);
 
   const overrideErrors = applyRuntimeConfigOverrides(config, cliFlags.configOverrides);
   if (overrideErrors.length > 0) {
-    console.error(overrideErrors.join('\n'));
+    writeFatalLine(overrideErrors.join('\n'));
     process.exit(2);
   }
   applyRuntimeFeatureFlagOverrides(config, {
@@ -261,7 +303,7 @@ async function main(): Promise<void> {
   }
   const endpointOverrideErrors = applyRuntimeEndpointFlagOverrides(config, 'controlPlane', cliFlags);
   if (endpointOverrideErrors.length > 0) {
-    console.error(endpointOverrideErrors.join('\n'));
+    writeFatalLine(endpointOverrideErrors.join('\n'));
     process.exit(2);
   }
   if (cliFlags.port !== undefined) logger.info('daemon: --port flag applied', { port: cliFlags.port });
@@ -301,9 +343,11 @@ async function main(): Promise<void> {
       // consent as any other non-interactive destructive confirmation.
       confirmMigration: cliFlags.yes,
     });
+    // install-service / uninstall-service / service-status print the unit path,
+    // the follow-up commands and the honest result, then exit immediately —
+    // exactly the race a stream write loses. Descriptor writes instead.
     for (const line of result.lines) {
-      // eslint-disable-next-line no-console
-      console.log(line);
+      writeExitingStdoutLine(line);
     }
     process.exit(result.exitCode);
   }
@@ -573,7 +617,12 @@ async function main(): Promise<void> {
   // that is what clients resolve when they look for the daemon.
   try {
     runDaemonConfigMigration(homeDirectory);
-    const clientViewConfig = new ConfigManager({ workingDir, homeDir: homeDirectory, surfaceRoot: 'tui' });
+    const clientViewConfig = new ConfigManager({
+      workingDir,
+      homeDir: homeDirectory,
+      surfaceRoot: 'tui',
+      daemonTierPath: daemonConfigPathForHome(daemonHomeDirectory),
+    });
     const clientEndpoint = resolveRuntimeEndpointBinding(clientViewConfig, 'controlPlane');
     const reconcile = await reconcileRedundantLegacyUnit({
       homeDir: homedir(),
@@ -629,13 +678,16 @@ async function main(): Promise<void> {
   console.log(bannerLines.join('\n'));
 }
 
-void main().catch(async (error) => {
-  logger.error('goodvibes daemon host failed', {
-    error: summarizeError(error),
-  });
-  // The daemon never came up. Without this the reason is buffered in a process
-  // that is about to stop existing, and the failure reads as a daemon that
-  // never logged anything at all.
-  flushActivityLogSync();
+void main().catch((error) => {
+  // A daemon that dies during startup must leave the reason where an operator
+  // will actually find it: on the file descriptor the service journal is
+  // attached to, written synchronously, BEFORE the activity log is attempted.
+  //
+  // Doing it the other way round is what shipped mute. This handler used to
+  // call logger.error and flushActivityLogSync and nothing else, and the
+  // logger had no destination this early in boot — so the released 1.27.0
+  // binary crash-looped 77 times with exit 1, zero bytes on stdout, zero bytes
+  // on stderr and an empty activity log. See fatal-boot-report.ts.
+  reportFatalBootFailure(error);
   process.exit(1);
 });

package/src/daemon/fatal-boot-report.ts

@@ -0,0 +1,111 @@
+/**
+ * fatal-boot-report.ts — saying why, on a stream, before the process stops.
+ *
+ * ── Where this module comes from ──────────────────────────────────────────
+ *
+ * This is a local mirror of the SDK's `platform/daemon/fatal-boot-report.ts`,
+ * kept identical in shape and in exported names (`writeFatalLine`,
+ * `writeExitingStdoutLine`, `reportFatalBootFailure`). It lives here only
+ * because the published `@pellux/goodvibes-sdk` this repository compiles
+ * against predates that export — importing it would not typecheck and CI
+ * builds against the published package regardless. Delete this file and switch
+ * every importer to the SDK's copy at the next re-pin — but check the SDK's
+ * `package.json` "exports" map first: as of the 1.21.0 re-pin (2026-07-30),
+ * the compiled `dist/platform/daemon/fatal-boot-report.js` still exists
+ * inside the published tarball and `cli.js` still imports it internally, but
+ * there is no `./platform/daemon/fatal-boot-report` (or any other) entry in
+ * "exports" that makes it importable from outside the package — confirmed by
+ * attempting `import { reportFatalBootFailure } from
+ * '@pellux/goodvibes-sdk/platform/daemon/fatal-boot-report'`, which Bun
+ * refuses to resolve. This file stays load-bearing until a future SDK release
+ * adds that subpath export.
+ *
+ * ── The failure this exists to close ──────────────────────────────────────
+ *
+ * The shipped daemon died mute. Measured, against the released 1.27.0 binary
+ * in an isolated home with an unparseable `.goodvibes/daemon/settings.json`:
+ * exit code 1, **zero bytes on stdout, zero bytes on stderr, and no activity
+ * log written at all**. It crash-looped 77 times overnight and the only signal
+ * an operator had was that everything had stopped.
+ *
+ * The mechanism was not buffering and not a bypassed handler. It was simpler:
+ * `daemon/cli.ts` reported the failure to the activity LOGGER and exited, and
+ * at that point in boot the logger had no destination — the daemon entrypoint
+ * never called `configureActivityLogger` at all — so the line went nowhere and
+ * no file descriptor was ever touched. A `logger.error` is not a disclosure.
+ * Only a write to a file descriptor is.
+ *
+ * ── Why `writeSync(2, …)` and not `process.stderr.write` ──────────────────
+ *
+ * Because the fatal path must not depend on anything a host can replace or
+ * defer. `process.stderr.write` is a property on a mutable global, and THIS
+ * repository is the one that replaces it: `src/runtime/terminal-output-guard.ts`
+ * intercepts terminal output to keep the rendered screen clean, and a replaced
+ * writer that records instead of printing turns a fatal error into silence. It
+ * is also a stream, so a write issued immediately before `process.exit()` can
+ * still be in flight when the process stops existing.
+ *
+ * `writeSync(fd, …)` is neither. It is a direct write to the descriptor the
+ * service journal is attached to, it has completed when it returns, and no
+ * amount of replacing `process.stderr` upstream can intercept it. That is the
+ * whole property this module provides, and it is why every early-exit site in
+ * the daemon boot path routes through here.
+ */
+
+import { writeSync } from 'node:fs';
+import { flushActivityLogSync, logger, summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
+
+/** stdout and stderr, as the file descriptors they actually are. */
+const STDOUT_FD = 1;
+const STDERR_FD = 2;
+
+function writeLineToFd(fd: number, line: string): void {
+  try {
+    writeSync(fd, line.endsWith('\n') ? line : `${line}\n`);
+  } catch {
+    // A closed or unwritable descriptor must never turn a diagnostic into a
+    // second failure. There is nothing further to fall back to: this IS the
+    // fallback.
+  }
+}
+
+/**
+ * Write one line to stderr synchronously, immune to a replaced
+ * `process.stderr` and to exit-time truncation. Use this for anything that
+ * gates a process exit.
+ */
+export function writeFatalLine(line: string): void {
+  writeLineToFd(STDERR_FD, line);
+}
+
+/**
+ * The stdout twin, for output that must survive an exit that follows it — the
+ * help text, the version line, the service-subcommand receipt and the cluster
+ * output are all printed and then immediately exited on, which is the same
+ * race.
+ */
+export function writeExitingStdoutLine(line: string): void {
+  writeLineToFd(STDOUT_FD, line);
+}
+
+/**
+ * Report a fatal boot failure everywhere it can be found, then leave the exit
+ * to the caller.
+ *
+ * The stream write happens FIRST and synchronously. The activity log is
+ * attempted after, because it is the part that can fail — it needs a
+ * configured destination, a writable directory, and a flush — and the
+ * guarantee this function makes is the stream line, not the log line.
+ */
+export function reportFatalBootFailure(error: unknown, context = 'goodvibes daemon host'): void {
+  const summary = summarizeError(error);
+  writeFatalLine(`${context} failed: ${summary}`);
+  if (error instanceof Error && error.stack) writeFatalLine(error.stack);
+  try {
+    logger.error(`${context} failed`, { error: summary });
+    flushActivityLogSync();
+  } catch {
+    // The reason is already on stderr, which is the guarantee. A log that
+    // cannot be written must not escalate into a different failure.
+  }
+}

package/src/runtime/bootstrap.ts

@@ -482,9 +482,9 @@ export async function bootstrapRuntime(
   };
 
   // Embedded DaemonServer/HttpListener factories (incl. the facade auto-update
-  // suppression) — see embedded-service-factories.ts.
+  // suppression), plus the daemon STATE directory — see embedded-service-factories.ts.
   const createExternalServiceFactories = (token: string): ExternalServiceFactories =>
-    createEmbeddedServiceFactories(token, services.clusterCoordinator, services.clusterGroup.verbs);
+    createEmbeddedServiceFactories(token, services.clusterCoordinator, services.clusterGroup.verbs, join(services.homeDirectory, '.goodvibes', 'daemon'));
 
   let externalServices: ExternalServicesHandle = {
     daemonServer: null, httpListener: null,

package/src/runtime/embedded-service-factories.ts

@@ -27,9 +27,25 @@ export function createEmbeddedServiceFactories(
   sharedDaemonToken: string,
   clusterCoordinator: ClusterCoordinator,
   clusterGroupVerbs: ClusterGroupVerbSurface,
+  daemonStateDirectory: string,
 ): ExternalServiceFactories {
   return {
     sharedDaemonToken,
+    // `daemonRuntimeDir` names the daemon's own STATE directory — the one
+    // holding operator-tokens.json, auth-users.json and daemon-settings.json —
+    // which is `<home>/.goodvibes/daemon`, not the user home above it. Every
+    // reader in this repository resolves it that way (config/goodvibes-home.ts,
+    // cli/service-posture.ts, runtime/bootstrap.ts). Passing it explicitly
+    // through this typed field (rather than appending a duplicate
+    // `--daemon-home` CLI arg via `daemonLaunchArgs` and relying on
+    // last-wins flag parsing) also keeps a detached spawn correct when
+    // `GOODVIBES_HOME` overrides the tree root away from the OS home
+    // directory, which the SDK's own `daemonHomeDir` default does not account
+    // for. The SDK's
+    // fix (sdk commit d1336a2b) that put the state directory behind the FIRST
+    // `--daemon-home` argument shipped in 1.21.0 and made the old
+    // flag-duplication workaround redundant; this is its replacement.
+    daemonRuntimeDir: daemonStateDirectory,
     createDaemonServer: (bus, userAuth, runtimeServices) => {
       // No updateArtifact: the embedded daemon keeps updates host-managed (the
       // TUI client updates itself), so the facade runs no self-update loop.

package/src/runtime/legacy-daemon-migration.ts

@@ -135,7 +135,18 @@ export function buildManagedDaemonServiceManager(params: BuildManagedDaemonServi
     description: MANAGED_SERVICE_DESCRIPTION,
     workingDirectory,
     command: params.binaryPath,
-    args: ['--daemon-home', params.homeDir],
+    // `--daemon-home` names the daemon's own STATE directory — the one holding
+    // operator-tokens.json, auth-users.json and daemon-settings.json — which is
+    // `<home>/.goodvibes/daemon`. This baked the USER HOME, so a serviced
+    // daemon filed its identity a level above where every reader in this
+    // repository looks: config/goodvibes-home.ts resolves the flag AS the state
+    // directory, cli/service-posture.ts already writes the state directory into
+    // GOODVIBES_DAEMON_HOME for the unit it installs, and runtime/bootstrap.ts
+    // reads the companion token from the state directory. On a normal machine
+    // the mismatch is invisible from the outside — the daemon simply mints a
+    // second operator-tokens.json in the home directory and the client keeps
+    // reading the empty one under .goodvibes/daemon.
+    args: ['--daemon-home', join(params.homeDir, '.goodvibes', 'daemon')],
     env: {},
     restartOnFailure: true,
   };

package/src/version.ts

@@ -6,7 +6,7 @@ import { join } from 'node:path';
 // The prebuild script updates the fallback value before compilation.
 // Uses import.meta.dir (Bun) to locate package.json relative to this file,
 // which is correct regardless of the process working directory.
-let _version = '1.27.0';
+let _version = '1.27.1';
 try {
   const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', 'package.json'), 'utf-8'));
   // Only trust a version read from OUR OWN package.json. A Bun single-file