@pellux/goodvibes-tui 1.27.0 → 2.0.1

package/src/runtime/relay-reachability-bridge.ts

@@ -1,53 +1,64 @@
 /**
- * relay-reachability-bridge.ts — reads the LIVE outbound-relay reachability
- * state off the running embedded/standalone DaemonServer.
+ * relay-reachability-bridge.ts — what this terminal can honestly say about the
+ * outbound relay's live state.
  *
- * The SDK's `DaemonServer` composes and owns a `RelayReachability` controller
- * internally (gated by `relay.enabled` + the `relay-connect` feature flag) and
- * exposes it via `getRelayReachability(): RelayReachability | null` — but that
- * accessor is not on the narrow `DaemonService` interface `HostServicesHandle`
- * types its `daemonServer` field with (see
- * `@pellux/goodvibes-sdk/platform/runtime/bootstrap-services`), so the field
- * needs a defensive structural check before use — same pattern
- * `waitForConfigDrivenRestarts` in bootstrap.ts already uses for
- * `waitForRestart`. `platform/relay` itself has no public export subpath
- * (daemon-internal), so the RelayReachability shape is described locally as a
- * minimal structural type rather than imported by name.
+ * The relay is a DAEMON capability. The reachability controller is composed
+ * inside the SDK's `DaemonServer` (platform/daemon/facade.ts,
+ * `getRelayReachability()`), gated on `relay.enabled` plus the `relay-connect`
+ * feature flag, and the process holding that controller is the one that
+ * registers with the relay and can mint a pairing payload for it.
+ *
+ * This terminal is a client. It never constructs a `DaemonServer`, so it holds
+ * no controller of its own, and it has no handle to the adopted daemon's — the
+ * control plane exposes no verb for one. The operator contract's `relay`
+ * category carries the two step-up ceremony verbs (`stepup.challenge.mint`,
+ * `stepup.credential.register`) and nothing that reports registration state or
+ * mints a pairing payload, so there is no wire call to make.
+ *
+ * Hence `'unavailable'`, and deliberately NOT `'disabled'`. `'disabled'` is a
+ * real relay state meaning the owner turned it off; reporting it for a relay
+ * this terminal cannot see would tell an operator whose daemon IS registered
+ * that their relay is off. What is true is narrower and worth saying plainly:
+ * the state exists, it lives in the daemon, and this surface cannot read it.
+ *
+ * The accessors keep their shape rather than collapsing into the call sites,
+ * because the shape is what a relay-state verb would fill in: the day the
+ * daemon serves one, the call is made here and `/relay` renders a live state
+ * with nothing else changing.
  */
 
 import type { RelayRegistrationStatus } from '@pellux/goodvibes-daemon-sdk';
-import { encodeRelayPairingString, type RelayPairingPayload } from '@pellux/goodvibes-transport-core/relay';
+import type { RelayPairingPayload } from '@pellux/goodvibes-transport-core/relay';
 
-/** Structural subset of the SDK's `RelayReachability` this bridge needs. */
-interface RelayReachabilityLike {
-  readonly status: RelayRegistrationStatus | 'disabled';
-  mintPairing(): Promise<RelayPairingPayload | null>;
-}
+/**
+ * What `/relay` can be told: the daemon-side registration states, plus
+ * `'disabled'` for a relay that is off, plus `'unavailable'` for one whose
+ * state is real but not readable from here.
+ */
+export type RelayReadableStatus = RelayRegistrationStatus | 'disabled' | 'unavailable';
 
-/** Structural subset of a live daemon that may expose relay reachability. */
-interface RelayCapableDaemonService {
-  getRelayReachability?(): RelayReachabilityLike | null;
+/** A minted pairing payload, in both the structured and the scannable form. */
+export interface RelayPairingMint {
+  readonly payload: RelayPairingPayload;
+  readonly encoded: string;
 }
 
-function getRelay(daemonServer: unknown): RelayReachabilityLike | null {
-  const candidate = daemonServer as RelayCapableDaemonService | null;
-  if (!candidate || typeof candidate.getRelayReachability !== 'function') return null;
-  return candidate.getRelayReachability() ?? null;
+export interface RelayReadAccessors {
+  relayStatus(): RelayReadableStatus;
+  mintRelayPairing(): Promise<RelayPairingMint | null>;
 }
 
-/** Two live-relay accessors, spread into `externalServices` from bootstrap.ts. */
-export function buildRelayExternalServiceMethods(getDaemonServer: () => unknown): {
-  relayStatus(): RelayRegistrationStatus | 'disabled';
-  mintRelayPairing(): Promise<{ readonly payload: RelayPairingPayload; readonly encoded: string } | null>;
-} {
-  return {
-    relayStatus: () => getRelay(getDaemonServer())?.status ?? 'disabled',
-    mintRelayPairing: async () => {
-      const relay = getRelay(getDaemonServer());
-      if (!relay) return null;
-      const payload = await relay.mintPairing();
-      if (!payload) return null;
-      return { payload, encoded: encodeRelayPairingString(payload) };
-    },
-  };
-}
+/**
+ * The one sentence explaining an `'unavailable'` relay state, and a pairing
+ * payload this terminal cannot mint. Stated once so `/relay status` and
+ * `/relay pair` cannot drift into two different explanations of one fact.
+ */
+export const RELAY_STATE_NOT_READABLE_HERE =
+  'The daemon holds the relay connection and the control plane exposes no verb for its state, '
+  + 'so this terminal cannot read it — ask the machine running the daemon.';
+
+/** The two relay accessors, spread into `externalServices` from bootstrap.ts. */
+export const relayReadAccessors: RelayReadAccessors = {
+  relayStatus: () => 'unavailable',
+  mintRelayPairing: async () => null,
+};

package/src/runtime/release-artifacts.ts

@@ -8,7 +8,8 @@
  * stay in lockstep:
  *   - scripts/postinstall.js (npm install-time binary download)
  *   - src/input/commands/update-runtime.ts (the /update self-update)
- *   - scripts/install.sh (the shell installer; mirrors the same names)
+ *   - the suite installer (goodvibes-daemon scripts/install.sh; mirrors the
+ *     same names)
  */
 export {
   CHECKSUM_MANIFEST_NAME,

package/src/runtime/runtime-services-types.ts

@@ -11,16 +11,28 @@
  * anywhere else in the app had to change.
  */
 
-import type { FocusTracker } from '../core/focus-tracker.ts';
+import type { FocusTracker } from '@pellux/goodvibes-sdk/platform/runtime/operations';
+import type { ApprovalBroker, GatewayMethodCatalog, SessionLiveTurnControlsHolder, SharedSessionBroker } from '@pellux/goodvibes-sdk/platform/control-plane';
+import type { StepUpService } from '@pellux/goodvibes-sdk/daemon';
+import type { PairingTokenManager } from '@pellux/goodvibes-sdk/platform/pairing';
+import type {
+  ConversationRewindHostClient,
+  DaemonConfigClient,
+  DaemonCredentialsClient,
+  DaemonVerbCaller,
+  DevicesClient,
+  WireSessionDispatch,
+} from '@pellux/goodvibes-sdk/platform/runtime/client';
+import type { ClientBuildGuard } from './client/build-floors.ts';
+import type { FleetUnionReadModel } from './client/fleet-union.ts';
+import type { ApprovalRaiser } from '@pellux/goodvibes-sdk/platform/runtime/client-services';
+import type { PermissionPromptDecision, PermissionPromptRequest } from '@pellux/goodvibes-sdk/platform/permissions';
 import type { ConfigManager, ServiceRegistry, SubscriptionManager, ToolLLM } from '@pellux/goodvibes-sdk/platform/config';
 import type { SecretsManager } from '../config/secrets.ts';
 import type { AutomationDeliveryManager, AutomationManager } from '@pellux/goodvibes-sdk/platform/automation';
 import type { ChannelDeliveryRouter, ChannelPolicyManager, ChannelPluginRegistry, RouteBindingManager, SurfaceRegistry } from '@pellux/goodvibes-sdk/platform/channels';
-import type { ApprovalBroker, GatewayMethodCatalog, SessionLiveTurnControlsHolder, SharedSessionBroker } from '@pellux/goodvibes-sdk/platform/control-plane';
 import type { PowerManager } from '@pellux/goodvibes-sdk/platform/power';
-import type { wireIdlePowerAndLiveTurn } from './idle-power-services.ts';
-import type { StepUpService } from '@pellux/goodvibes-sdk/daemon';
-import type { PairingTokenManager } from '@pellux/goodvibes-sdk/platform/pairing';
+import type { wireIdlePowerAndLiveTurn } from '@pellux/goodvibes-sdk/platform/runtime/operations';
 import type { WatcherRegistry } from '@pellux/goodvibes-sdk/platform/watchers';
 import type { ArtifactStore } from '@pellux/goodvibes-sdk/platform/artifacts';
 import type { HomeGraphService, KnowledgeService, ProjectPlanningService } from '@pellux/goodvibes-sdk/platform/knowledge';
@@ -34,11 +46,10 @@ import type { UserPermissionRuleStore } from '@pellux/goodvibes-sdk/platform/per
 import type { buildExecPromptAnswerHandler } from '@pellux/goodvibes-sdk/platform/runtime/permissions/exec-prompt-wiring';
 import type { buildLocalhostFetchApproval } from '@pellux/goodvibes-sdk/platform/runtime/permissions/localhost-fetch-approval';
 import type { NotificationDispatcher } from './notification-dispatch.ts';
-import type { createDurabilityServices } from './durability-services.ts';
+import type { createDurabilityServices } from '@pellux/goodvibes-sdk/platform/runtime/operations';
 import type { MemorySpineClient } from '@pellux/goodvibes-sdk/platform/runtime/memory-spine';
 import type { WorkspaceCheckpointManager } from '@pellux/goodvibes-sdk/platform/workspace';
 import type { DomainDispatch, RuntimeStore } from './store/index.ts';
-import type { DevicePostureRuntime } from '@pellux/goodvibes-sdk/platform/devices';
 import type { RuntimeEventBus, DistributedRuntimeManager, RemoteRunnerRegistry, RemoteSupervisor, IntegrationHelperService, IdempotencyStore, ComponentHealthMonitor, WorktreeRegistry, SandboxSessionRegistry, ShellPathService, FeatureFlagManager, PolicyRuntimeState, SessionSurface } from '@/runtime/index.ts';
 import type { VoiceProviderRegistry, VoiceService } from '@pellux/goodvibes-sdk/platform/voice';
 import type { CacheRegistry, PauseController, MemoryGovernor } from '@pellux/goodvibes-sdk/platform/runtime/memory';
@@ -57,12 +68,9 @@ import type { BenchmarkStore, CacheHitTracker, FavoritesStore, ModelLimitsServic
 import type { KeybindingsManager } from '../input/keybindings.ts';
 import type { AdaptivePlanner, DeterministicReplayEngine, ExecutionPlanManager, SessionLineageTracker, SessionMemoryStore } from '@pellux/goodvibes-sdk/platform/core';
 import type { ArchivableProcessRegistry } from '@pellux/goodvibes-sdk/platform/runtime/fleet';
-import type { OrchestrationEngine, WorkstreamCommandService } from './workstream-services.ts';
-import type { WorkPlanStore } from '../work-plans/work-plan-store.ts';
-import type { DaemonHandlerSurfaces } from '../daemon/handlers/index.ts';
-import type { ClusterGroupComposition } from './cluster-group-composition.ts';
-import type { ClusterCoordinator } from '@pellux/goodvibes-sdk/platform/cluster';
-import type { WorkspaceTrustManager } from './trust/workspace-trust.ts';
+import type { OrchestrationEngine, WorkstreamCommandService } from '@pellux/goodvibes-sdk/platform/orchestration';
+import type { WorkPlanStore } from '@pellux/goodvibes-sdk/platform/workflow';
+import type { WorkspaceTrustManager } from '@pellux/goodvibes-sdk/platform/runtime/operations';
 
 export interface RuntimeServicesOptions {
   readonly runtimeBus: RuntimeEventBus;
@@ -83,12 +91,8 @@ export interface RuntimeServicesOptions {
    * is the single reader that produces it.
    */
   readonly daemonHomeDirectory?: string | undefined;
-  /** Opt-in (daemon-side only): fold host-observed external coding-agent sessions
-   * into the fleet as 'observed-external' rows. Interactive leaves it off and reads
-   * the daemon snapshot. Mirrors the SDK's own createRuntimeServices option. */
-  readonly observeExternalAgents?: boolean | undefined;
   /** Host power seam opt-in. Fork mirrors the SDK: non-spawning unavailable-seam
-   * default (idle-power-services.ts); daemon + embedded runtime pass createHostPowerSeam(). */
+   * default (idle-power-services.ts); this product always passes createHostPowerSeam(), since it never has a co-located daemon to own its own inhibitor. */
   readonly powerSeam?: Parameters<typeof wireIdlePowerAndLiveTurn>[0]['powerSeam'];
   /** Live session id, read per crash-residue sweep so the running session is exempt — see durability-services.ts. */
   readonly currentSessionId?: (() => string | null) | undefined;
@@ -117,9 +121,47 @@ export interface RuntimeServices {
   readonly routeBindings: RouteBindingManager;
   readonly surfaceRegistry: SurfaceRegistry;
   readonly channelPlugins: ChannelPluginRegistry;
+  /** The one router this surface delivers through — AutomationDeliveryManager's own, not a second copy of it. */
   readonly channelDeliveryRouter: ChannelDeliveryRouter;
   readonly watcherRegistry: WatcherRegistry;
+  /**
+   * This surface's own record of the asks IT raised — what the approval card
+   * and the panel render. Not authoritative: `requestApproval` below raises the
+   * same ask on the daemon, whose record every other surface reads.
+   */
   readonly approvalBroker: ApprovalBroker;
+  /** Raise an ask: `approvals.raise` on the daemon plus the prompt at this terminal. */
+  readonly requestApproval: ApprovalRaiser;
+  /** The one resolution of "which daemon", shared by every client seam. */
+  readonly daemonVerbs: DaemonVerbCaller;
+  /**
+   * Inbound dispatch for sessions this surface hosts, over the adopted daemon's
+   * session inputs. Inert until bootstrap.ts activates it; bound to the SAME
+   * continuation runner the local broker uses.
+   */
+  readonly wireSessionDispatch: WireSessionDispatch;
+  /**
+   * The daemon's build floor on this terminal. bootstrap.ts feeds it every
+   * floor the adopted daemon announces and attaches the notice sink; the
+   * continuation runner consults it before spawning, so a build the daemon has
+   * declared too old stops taking shared-session work instead of executing it
+   * under superseded rules. See client/build-floors.ts.
+   */
+  readonly clientBuildGuard: ClientBuildGuard;
+  /**
+   * This surface offering its live conversation to the daemon, so a rewind
+   * driven from anywhere can reach the messages — which only this process
+   * holds. Started on adoption; released on disposal.
+   */
+  readonly conversationRewindHost: ConversationRewindHostClient;
+  /** Daemon-owned settings, read and written over `config.get` / `config.set`. */
+  readonly daemonConfig: DaemonConfigClient;
+  /** Daemon-scoped credential writes: `credentials.set`/`delete` on the daemon, one verified sequence. */
+  readonly daemonCredentials: DaemonCredentialsClient;
+  /** The terminal prompt, late-bound — the UI layer patches the real one in after boot. */
+  readonly localPromptRef: { requestPermission: (request: PermissionPromptRequest) => Promise<PermissionPromptDecision> };
+  /** The live session id an ask belongs to; written by the bootstrap tail. */
+  readonly liveSessionIdRef: { value: string | null };
   /** Loopback-fetch approval that rides the approval broker; shared by the tool registry and orchestrator so every surface asks the same way. */
   readonly localhostFetchApproval: ReturnType<typeof buildLocalhostFetchApproval>;
   /** Terminal prompt-answer handler that rides the approval broker; shared by the tool registry and orchestrator so an interactive command's prompt gets an ask/card on every surface. */
@@ -128,10 +170,25 @@ export interface RuntimeServices {
   readonly notificationDispatcher: NotificationDispatcher;
   /** Durable user-origin permission rules (remembered approvals); permissions.rules.* surface. Mirrors the SDK composition. */
   readonly userPermissionRuleStore: UserPermissionRuleStore;
+  /**
+   * An EMPTY verb catalog. This product answers no verbs — it is a client. The
+   * field exists because the SDK's `startExternalServices` takes a daemon-grade
+   * `RuntimeServices` even in the adopt-only mode this surface runs in, and
+   * because plugin loading is handed one. Nothing is ever served off it: with
+   * `adoptOnly` no `DaemonServer` is constructed, so a descriptor registered
+   * here has no listener behind it. Plugin registrations that need to be
+   * ANSWERED belong daemon-side — see docs/decisions for the plugin split.
+   */
+  readonly gatewayMethods: GatewayMethodCatalog;
+  /** Step-up (re-auth) for this surface's own privileged actions. */
+  readonly stepUpService: StepUpService;
+  /** This installation's pairing tokens — the bearer a phone or browser presents. */
+  readonly pairingTokens: PairingTokenManager;
+  /** Paired-phone posture over `devices.*` verbs; the `phone` tool calls through it. */
+  readonly devices: DevicesClient;
   readonly sessionBroker: SharedSessionBroker;
   readonly deliveryManager: AutomationDeliveryManager;
   readonly automationManager: AutomationManager;
-  readonly gatewayMethods: GatewayMethodCatalog;
   readonly artifactStore: ArtifactStore;
   readonly knowledgeService: KnowledgeService;
   readonly agentKnowledgeService: KnowledgeService;
@@ -145,8 +202,6 @@ export interface RuntimeServices {
   readonly memorySpine: MemorySpineClient;
   readonly serviceRegistry: ServiceRegistry;
   readonly secretsManager: SecretsManager;
-  readonly stepUpService: StepUpService;
-  readonly pairingTokens: PairingTokenManager; // backs pairing.tokens.* verbs + the settings device surface (mirrors the SDK composition)
   readonly subscriptionManager: SubscriptionManager;
   readonly localUserAuthManager: UserAuthManager;
   readonly profileManager: ProfileManager;
@@ -184,20 +239,6 @@ export interface RuntimeServices {
   readonly providerRegistry: ProviderRegistry;
   readonly toolLLM: ToolLLM;
   readonly distributedRuntime: DistributedRuntimeManager;
-  /**
-   * The paired-phone feature for this host: the grants ledger, the capture
-   * store, the housekeeping sweeps, and the capability service every `device.*`
-   * setting governs. Bound to the `devices.*` verbs at composition; the `phone`
-   * tool is registered on it in the bootstrap tail.
-   */
-  readonly devicePosture: DevicePostureRuntime;
-  readonly daemonHandlers: DaemonHandlerSurfaces;
-  /** Elects the one node on this network that consumes inbound messages; hand it to the DaemonServer so its consumers share this leadership instead of holding a second election. */
-  readonly clusterCoordinator: ClusterCoordinator;
-  /** LAN group membership: identity, keys, roster, and the `cluster` verbs. */
-  readonly clusterGroup: ClusterGroupComposition;
-  /** Start the group layer and then the election, in that order. Idempotent. */
-  readonly startCluster: () => Promise<void>;
   readonly remoteRunnerRegistry: RemoteRunnerRegistry;
   readonly remoteSupervisor: RemoteSupervisor;
   readonly sessionMemoryStore: SessionMemoryStore;
@@ -239,6 +280,12 @@ export interface RuntimeServices {
   readonly sessionLiveTurnControls: SessionLiveTurnControlsHolder;
   /** Unified live process registry (agents, WRFC chains, workflows, watchers, background processes) backing the Fleet panel; archive-aware — finished subtrees can be moved to the session archive view. */
   readonly processRegistry: ArchivableProcessRegistry;
+  /**
+   * What the Fleet panel reads: this surface's own registry rows UNION the
+   * adopted daemon's, deduped by node id with the local (live, actionable) copy
+   * winning. Interval-refreshed on the daemon half — see client/fleet-union.ts.
+   */
+  readonly fleetReadModel: FleetUnionReadModel;
   readonly modeManager: ModeManager;
   readonly fileUndoManager: FileUndoManager;
   readonly workspaceCheckpointManager: WorkspaceCheckpointManager;