@pellux/goodvibes-tui 1.27.0 → 2.0.1

package/src/cluster/render.ts

@@ -1,268 +0,0 @@
-/**
- * render.ts — turning the daemon's answers into lines a person reads.
- *
- * Every function here is pure: structured data in, strings out. The verb layer
- * decided what is true; this decides how to say it. That split is what lets
- * `--json` print the same data with no second code path, and what lets the TUI
- * and a web UI render the same answers their own way.
- */
-import { generateQrMatrix, renderQrToString } from '@pellux/goodvibes-sdk/platform/pairing';
-import type {
-  RotateKeyResult,
-  CreateGroupResult,
-  DiscoveredGroup,
-  ForgetNodeResult,
-  GroupStatusReport,
-  JoinGroupResult,
-  JoinKeyResult,
-  NodesResult,
-} from '@pellux/goodvibes-sdk/platform/cluster';
-
-/** How long ago, in words. Never a raw timestamp — nobody reads epoch millis. */
-export function describeAge(at: number, now: number): string {
-  const seconds = Math.max(0, Math.round((now - at) / 1_000));
-  if (seconds < 60) return `${seconds}s ago`;
-  const minutes = Math.round(seconds / 60);
-  if (minutes < 60) return `${minutes}m ago`;
-  const hours = Math.round(minutes / 60);
-  if (hours < 48) return `${hours}h ago`;
-  return `${Math.round(hours / 24)}d ago`;
-}
-
-function pad(value: string, width: number): string {
-  return value.length >= width ? value : value + ' '.repeat(width - value.length);
-}
-
-/**
- * `cluster status`.
- *
- * Leads with the thing the operator came for — the role of THIS machine and
- * which surfaces it holds — and finishes with the one sentence of advice, if
- * there is anything to do.
- */
-export function renderStatus(report: GroupStatusReport, now: number): string[] {
-  if (report.membership !== 'member') {
-    return [
-      report.membership === 'no-group'
-        ? 'this machine is not in a group'
-        : 'this machine has group key material that could not be read',
-      `machine: ${report.nodeName} (${report.nodeId})`,
-      `version: ${report.version}`,
-      ...(report.advice ? ['', report.advice] : []),
-    ];
-  }
-  const lines = [
-    `group:    ${report.groupName ?? '(unnamed)'}  [${report.groupId ?? 'unknown'}]`,
-    `machine:  ${report.nodeName} (${report.nodeId})`,
-    `members:  ${report.memberCount}`,
-    `version:  ${report.version}`,
-  ];
-
-  if (report.surfaces === null) {
-    lines.push('surfaces: not reported by this daemon');
-  } else if (report.surfaces.length === 0) {
-    lines.push('surfaces: none held by this machine right now');
-  } else {
-    lines.push('surfaces held by this machine:');
-    for (const holding of report.surfaces) {
-      lines.push(`  ${holding.surfaceId}  — ${holding.reason}`);
-    }
-  }
-
-  lines.push(
-    '',
-    `group key: generation ${report.keyGeneration ?? 0}, rotates every ${report.rotationHours}h`,
-    `           ${report.keyGenerationsHeld} of at most ${report.keyGenerationCap} generations kept; `
-      + `accepting ${report.acceptedGenerations.join(' and ') || 'none'}`,
-  );
-  if (report.removedNodeCount > 0) {
-    lines.push(`removed machines on record: ${report.removedNodeCount}`);
-  }
-  if (report.replication) {
-    const replication = report.replication;
-    lines.push(
-      '',
-      `shared settings: ${replication.entries} setting${replication.entries === 1 ? '' : 's'} and `
-        + `${replication.secrets} credential${replication.secrets === 1 ? '' : 's'} at revision ${replication.revision}`,
-    );
-    if (replication.tombstones > 0) {
-      lines.push(`                 ${replication.tombstones} deleted setting(s) still on record`);
-    }
-    if (replication.lastAppliedFrom) {
-      lines.push(
-        `                 last change from ${replication.lastAppliedFrom}`
-          + (replication.lastAppliedAt ? ` ${describeAge(replication.lastAppliedAt, now)}` : ''),
-      );
-    }
-    if (replication.pendingProposals > 0) {
-      lines.push(`                 ${replication.pendingProposals} change(s) waiting for the responsible machine`);
-    }
-  }
-  if (report.wire) {
-    lines.push(
-      `traffic:   ${report.wire.sent} sent, ${report.wire.received} received; dropped `
-        + `${report.wire.droppedOtherGroup} from other groups, ${report.wire.droppedBadSignature} unverified, `
-        + `${report.wire.droppedOldGeneration} on an old key, ${report.wire.droppedMalformed} malformed`
-        + (report.wire.droppedNoGroup > 0
-          ? `; ${report.wire.droppedNoGroup} not sent because this machine is in no group`
-          : ''),
-    );
-  }
-  if (report.advice) lines.push('', report.advice);
-  // Deliberately absent, and it should stay absent: the join key, the group
-  // key, any generation of it, this machine's private keys, and the VALUE of
-  // any replicated credential. `cluster key` is the only path to the join key
-  // and nothing shows the rest at all.
-  return lines;
-}
-
-/** `cluster nodes`. */
-export function renderNodes(result: NodesResult, now: number): string[] {
-  const lines = [`group: ${result.groupName}  [${result.groupId}]`, ''];
-  if (result.members.length === 0) {
-    lines.push('no machines in this group yet');
-  } else {
-    const width = Math.max(...result.members.map((member) => member.displayName.length), 12);
-    lines.push(`${pad('MACHINE', width)}  ${pad('NODE ID', 38)}  LAST SEEN`);
-    for (const member of result.members) {
-      const suffix = member.isThisMachine ? '  (this machine)' : '';
-      lines.push(
-        `${pad(member.displayName, width)}  ${pad(member.nodeId, 38)}  ${describeAge(member.lastSeenAt, now)}${suffix}`,
-      );
-    }
-  }
-  if (result.removed.length > 0) {
-    lines.push('', 'removed from this group:');
-    for (const entry of result.removed) {
-      lines.push(`  ${entry.nodeId}  ${describeAge(entry.removedAt, now)}  (${entry.reason})`);
-    }
-  }
-  return lines;
-}
-
-/** `cluster create`. */
-export function renderCreated(result: CreateGroupResult): string[] {
-  return [
-    `created the group "${result.groupName}"  [${result.groupId}]`,
-    '',
-    result.generatedKey
-      ? 'a join key was generated for you. Run `cluster key` on this machine at any'
-      : 'your join phrase is in use. Run `cluster key` on this machine at any',
-    'time to see it again — it is not a one-time reveal.',
-    '',
-    'to add another machine: run `cluster join` on it and give it this key.',
-    '',
-    `the group name ("${result.groupName}") is visible to anything on this network that`,
-    'is listening for goodvibes groups. Change it any time with `cluster rename`.',
-  ];
-}
-
-/** `cluster join`. */
-export function renderJoined(result: JoinGroupResult): string[] {
-  return [
-    `joined "${result.groupName}"  [${result.groupId}]`,
-    `the group now has ${result.memberCount} machine${result.memberCount === 1 ? '' : 's'}.`,
-  ];
-}
-
-/** `cluster forget`. */
-export function renderForgotten(result: ForgetNodeResult): string[] {
-  return [
-    `removed ${result.displayName} (${result.nodeId}) from the group`,
-    `the group key was replaced immediately, so that machine's copy no longer works.`,
-    `${result.memberCount} machine${result.memberCount === 1 ? '' : 's'} remain${result.memberCount === 1 ? 's' : ''}.`,
-  ];
-}
-
-/** The groups seen advertising themselves on this network. */
-export function renderDiscovered(groups: readonly DiscoveredGroup[], now: number): string[] {
-  if (groups.length === 0) {
-    return [
-      'no goodvibes groups are advertising themselves on this network',
-      '',
-      'if the machine you want to join is switched on and has clustering enabled,',
-      'check that both machines are on the same network and that it is not blocking',
-      'multicast. You can also join by id directly: cluster join --group <id> --key <key>',
-    ];
-  }
-  const width = Math.max(...groups.map((group) => group.displayName.length), 10);
-  const lines = [`${pad('GROUP', width)}  ${pad('ID', 18)}  MACHINES  VERSION  SEEN`];
-  for (const group of groups) {
-    lines.push(
-      `${pad(group.displayName, width)}  ${pad(group.groupId, 18)}  ${pad(String(group.nodeCount), 8)}  `
-        + `${pad(group.version, 7)}  ${describeAge(group.lastSeenAt, now)}`,
-    );
-  }
-  return lines;
-}
-
-/**
- * Ask the terminal to put the join key on the clipboard, using OSC 52.
- *
- * OSC 52 is the only clipboard mechanism that works through SSH, which is the
- * case that matters: the operator is on a headless box in a cupboard. It is
- * also not universally supported and gives no acknowledgement, so this NEVER
- * claims success — it says what it attempted, and the key is printed either
- * way. Silently doing nothing would be the worst of the three options.
- */
-export function clipboardEscapeSequence(value: string): string {
-  return `]52;c;${Buffer.from(value, 'utf8').toString('base64')}`;
-}
-
-export interface JoinKeyRendering {
-  /** Lines to print. */
-  readonly lines: string[];
-  /** The raw escape sequence to write, or null when the output is not a terminal. */
-  readonly clipboardSequence: string | null;
-}
-
-export function renderJoinKey(result: JoinKeyResult, isTerminal: boolean): JoinKeyRendering {
-  return {
-    lines: [
-      `join key for "${result.groupName}"  [${result.groupId}]`,
-      '',
-      `  ${result.joinKey}`,
-      '',
-      ...(isTerminal
-        ? ['copied to the clipboard, if this terminal accepts clipboard writes over its connection.',
-          'if nothing was copied, the key is printed above.']
-        : ['(not a terminal, so no clipboard copy was attempted)']),
-      '',
-      `to add a machine: run  cluster join --group ${result.groupId} --key <the key above>`,
-    ],
-    clipboardSequence: isTerminal ? clipboardEscapeSequence(result.joinKey) : null,
-  };
-}
-
-/** `cluster rotate`. */
-export function renderRotated(result: RotateKeyResult): string[] {
-  return [
-    `the group key is now generation ${result.keyGeneration}`,
-    result.immediate
-      ? 'the previous key stopped being accepted immediately, and the key the group signs with'
-      : 'the previous key stays accepted for a few minutes so nothing is interrupted while',
-    result.immediate
-      ? 'was replaced too. A machine that is asleep right now will ask to come back when it wakes.'
-      : `the other ${Math.max(0, result.memberCount - 1)} machine(s) pick the new one up.`,
-    '',
-    `accepting generation${result.acceptedGenerations.length === 1 ? '' : 's'} `
-      + `${result.acceptedGenerations.join(' and ')}`,
-  ];
-}
-
-/**
- * The join key as a QR code, for typing it into a phone or a second terminal.
- *
- * This reuses the daemon's existing QR renderer verbatim — the same one the
- * pairing flow already prints to a terminal — rather than introducing any new
- * machinery for it. Opt-in behind `--qr`, because a QR block is tall and most
- * of the time the operator is copying the key with the mouse or the clipboard.
- */
-export function renderJoinKeyQr(joinKey: string): string[] {
-  return [renderQrToString(generateQrMatrix(joinKey))];
-}
-
-/** A refusal, in the shape every failing subcommand prints. */
-export function renderFailure(error: string, fix: string): string[] {
-  return [`cluster: ${error}`, `  ${fix}`];
-}

package/src/config/atomic-write.ts

@@ -1,70 +0,0 @@
-import { closeSync, fsyncSync, mkdirSync, openSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
-import { randomUUID } from 'node:crypto';
-import { dirname } from 'node:path';
-
-export interface AtomicWriteOptions {
-  /**
-   * File permission mode for the written file. Defaults to 0o600 (owner read/write only).
-   */
-  readonly mode?: number;
-  /**
-   * When true, creates parent directories if they do not exist. Defaults to false.
-   */
-  readonly mkdirp?: boolean;
-}
-
-/**
- * Writes `data` to `path` atomically: writes to a sibling temp file, fsyncs
- * it, then renames it into place. On POSIX, rename(2) is atomic so readers
- * always see either the old file or the new file — never a partial write.
- *
- * If the write or fsync fails, the temp file is cleaned up before rethrowing.
- *
- * @param path   Destination file path.
- * @param data   UTF-8 string content to write.
- * @param opts   Optional mode and mkdirp flags.
- */
-export function atomicWriteFileSync(
-  path: string,
-  data: string,
-  opts: AtomicWriteOptions = {},
-): void {
-  const mode = opts.mode ?? 0o600;
-
-  if (opts.mkdirp) {
-    mkdirSync(dirname(path), { recursive: true });
-  }
-
-  const tmp = `${path}.${process.pid}.${Date.now()}.${randomUUID()}.tmp`;
-
-  try {
-    writeFileSync(tmp, data, { mode });
-
-    // fsync the temp file to flush OS write buffers before rename.
-    const fd = openSync(tmp, 'r+');
-    try {
-      fsyncSync(fd);
-    } finally {
-      closeSync(fd);
-    }
-
-    renameSync(tmp, path);
-
-    // fsync the parent directory to ensure the renamed directory entry is
-    // flushed. Without this, a hard crash immediately after rename could lose
-    // the entry on some filesystems (ext3/ext4 with data=ordered, etc.).
-    const dirFd = openSync(dirname(path), 'r');
-    try {
-      fsyncSync(dirFd);
-    } finally {
-      closeSync(dirFd);
-    }
-  } catch (err) {
-    try {
-      unlinkSync(tmp);
-    } catch {
-      // Best-effort cleanup — original error takes priority.
-    }
-    throw err;
-  }
-}

package/src/config/credential-availability.ts

@@ -1,122 +0,0 @@
-/**
- * credential-availability.ts — client-side credential-status read.
- *
- * When the TUI acts as a CLIENT of an adopted external daemon (the host-service
- * `mode === 'external'` topology — see runtime/bootstrap.ts), provider/model/secret
- * STATUS is read from that daemon's `credentials.get` wire method rather than from
- * the TUI's own surfaceRoot ('tui') store. This module folds a `credentials.get`
- * outcome into an honest availability value, mirroring the goodvibes-webui v1.0.1
- * `deriveCredentialAvailability` contract exactly:
- *
- *   - a 503 CREDENTIAL_STORE_UNAVAILABLE (matched by machine code), a METHOD_NOT_FOUND
- *     from an older daemon, or ANY transport failure  ->  { available: false, reason }
- *     — an honest, reason-carrying "unavailable" state.
- *   - NEVER a fabricated "configured"; NEVER a secret byte. Only the boolean status
- *     metadata surface (key / configured / usable / source / secure) is carried.
- *
- * STATUS ONLY moves to the daemon path. Secret RESOLUTION — the value-reads provider
- * auth needs, plus the env-only API-key posture — stays local and is untouched by
- * this module. The daemon's `credentials.get` never returns raw key bytes over the
- * wire (see the SDK decision record 2026-07-06-config-sharing-shared-tier-and-secret-read),
- * so no plaintext can reach a caller through this path by construction.
- */
-
-/** One credential's status metadata from the daemon's shared store — never bytes. */
-export interface CredentialStatusEntry {
-  readonly key: string;
-  readonly configured: boolean;
-  readonly usable: boolean;
-  readonly source?: string;
-  readonly secure?: boolean;
-}
-
-/** Honest availability: either a status list, or a reason we could not read it. */
-export type CredentialAvailability =
-  | { readonly available: true; readonly credentials: readonly CredentialStatusEntry[] }
-  | { readonly available: false; readonly reason: string };
-
-/** A `credentials.get` invocation outcome — success value OR a thrown error. */
-export type CredentialStatusOutcome =
-  | { readonly ok: true; readonly value: unknown }
-  | { readonly ok: false; readonly error: unknown };
-
-/** Credential-read posture: read the daemon's shared store, or the local own store. */
-export type CredentialReadMode = 'host' | 'client';
-
-function asRecord(value: unknown): Record<string, unknown> | null {
-  return typeof value === 'object' && value !== null ? (value as Record<string, unknown>) : null;
-}
-
-function readString(record: Record<string, unknown> | null, key: string): string {
-  if (!record) return '';
-  const value = record[key];
-  return typeof value === 'string' ? value : '';
-}
-
-/**
- * Map the authoritative host-service mode string to the credential-read posture.
- * Only 'external' (a separately-running daemon this TUI adopted) reads credential
- * STATUS over the wire; every other mode ('embedded'/'disabled'/'blocked'/
- * 'incompatible'/'unavailable') is the local host reading its own store.
- */
-export function credentialReadModeFromHostMode(hostMode: string): CredentialReadMode {
-  return hostMode === 'external' ? 'client' : 'host';
-}
-
-/**
- * Fold a `credentials.get` outcome into an honest availability value. Mirrors
- * goodvibes-webui v1.0.1 `deriveCredentialAvailability`: any failure becomes a
- * reason-carrying `available: false`; a malformed success (no credentials array)
- * is treated as unavailable rather than fabricated as configured; on success only
- * the boolean status surface is carried, never a secret value.
- */
-export function deriveCredentialAvailability(outcome: CredentialStatusOutcome): CredentialAvailability {
-  if (!outcome.ok) {
-    const err = asRecord(outcome.error);
-    const code = readString(err, 'code');
-    if (code === 'CREDENTIAL_STORE_UNAVAILABLE') {
-      return { available: false, reason: 'The daemon has no shared credential store wired.' };
-    }
-    if (code === 'METHOD_NOT_FOUND' || code === 'NOT_INVOKABLE') {
-      return { available: false, reason: 'This daemon does not serve credential status yet.' };
-    }
-    return { available: false, reason: 'Credential status unavailable right now.' };
-  }
-  const value = asRecord(outcome.value);
-  const raw = value?.credentials;
-  if (!Array.isArray(raw)) return { available: false, reason: 'Credential status unavailable right now.' };
-  const credentials: CredentialStatusEntry[] = [];
-  for (const item of raw) {
-    const rec = asRecord(item);
-    const key = readString(rec, 'key');
-    if (!rec || !key) continue;
-    credentials.push({
-      key,
-      configured: rec.configured === true,
-      usable: rec.usable === true,
-      source: readString(rec, 'source') || undefined,
-      secure: rec.secure === true ? true : rec.secure === false ? false : undefined,
-    });
-  }
-  return { available: true, credentials };
-}
-
-/**
- * Client-side credential-status read. Invokes the adopted external daemon's
- * `credentials.get` and folds success OR any thrown transport/daemon error into an
- * honest availability. The daemon's `credentials.get` transport error carries the
- * machine `code` at the top level (e.g. an HttpStatusError whose body supplied
- * `CREDENTIAL_STORE_UNAVAILABLE` / `METHOD_NOT_FOUND`), which `deriveCredentialAvailability`
- * classifies. Only the boolean status surface is returned; a raw secret value can
- * never reach a caller through this path.
- */
-export async function readClientCredentialStatus(
-  invokeCredentialsGet: () => Promise<unknown>,
-): Promise<CredentialAvailability> {
-  try {
-    const value = await invokeCredentialsGet();
-    return deriveCredentialAvailability({ ok: true, value });
-  } catch (error) {
-    return deriveCredentialAvailability({ ok: false, error });
-  }
-}

package/src/config/goodvibes-home.ts

@@ -1,149 +0,0 @@
-/**
- * goodvibes-home.ts — where this process's GoodVibes tree lives, resolved in
- * ONE place for every entry point.
- *
- * ## The defect this closes
- *
- * `GOODVIBES_HOME` relocates the tree root. It was read by exactly one file —
- * `src/daemon/cli.ts` — and the CLIENT entry point (`src/main.ts`) called
- * `homedir()` unconditionally, on the same object literal where it did honour
- * `GOODVIBES_WORKING_DIR`. So a harness that set `GOODVIBES_HOME` to a
- * throwaway directory and then ran a client command got a process that read and
- * wrote the REAL tree: settings, workspace state, and — because the daemon-tier
- * secret store is derived from the tree root — `~/.goodvibes/daemon/secrets.enc`.
- *
- * That is not hypothetical. An isolated round stored two throwaway credentials
- * and they landed in the owner's live secret store, where they had to be
- * removed by hand. An isolation boundary a process can walk out of is not a
- * boundary; the honest fix is that no entry point resolves a home of its own.
- *
- * ## What each variable means
- *
- *  - `GOODVIBES_HOME` — the tree ROOT, the directory `.goodvibes/` sits under.
- *    Setting it relocates settings, workspace, discovery roots, and every tier
- *    of the secret store. This is what an isolated harness or a service unit
- *    sets.
- *  - `GOODVIBES_DAEMON_HOME` — the daemon's own IDENTITY directory (auth users,
- *    operator tokens, daemon settings). It falls under the tree root unless set
- *    separately, and it names only that directory: it is not a second way to
- *    move the tree. Both entry points resolve it the same way now, so a client
- *    given only this variable no longer computes the daemon-tier secret path
- *    from the real home while everything else points at a sandbox.
- *
- * Both readers take `env` as an argument rather than reaching for
- * `process.env`, so the resolution is exercisable without a test having to
- * mutate the environment of the process running it.
- */
-
-import { homedir } from 'node:os';
-import { isAbsolute, join, resolve } from 'node:path';
-
-/** The two roots every surface derives its storage from. */
-export interface GoodVibesHomeOwnership {
-  /** The tree root: the directory `.goodvibes/` sits under. */
-  readonly homeDirectory: string;
-  /** The daemon's own identity directory, under the tree root by default. */
-  readonly daemonHomeDirectory: string;
-  /**
-   * True when either `GOODVIBES_HOME` or `GOODVIBES_DAEMON_HOME` named an
-   * override (a blank/whitespace-only value does not count — see
-   * resolveGoodVibesHome). Callers that need to know "is this process running
-   * out of a relocated tree or identity directory" (e.g. to refuse adopting
-   * the machine's real service unit) read this instead of re-reading the raw
-   * environment variable themselves — this module is the one reader.
-   */
-  readonly isOverridden: boolean;
-}
-
-/**
- * The tree root for this process.
- *
- * A blank or whitespace-only value is treated as absent rather than as the
- * empty path, because `GOODVIBES_HOME=` in a unit file or a shell wrapper means
- * "unset", and resolving it to `''` would put the whole tree at the filesystem
- * root.
- */
-export function resolveGoodVibesHome(env: NodeJS.ProcessEnv = process.env): string {
-  const override = env['GOODVIBES_HOME']?.trim();
-  if (override) return isAbsolute(override) ? override : resolve(process.cwd(), override);
-  // The login home comes from the injected env first so the whole resolution is
-  // exercisable without a test mutating the environment it is running in. This
-  // is not a behaviour change: on Linux and macOS `homedir()` already prefers
-  // $HOME, and where it does not (Windows, where HOME is usually unset) the
-  // fallback below is what answers.
-  const loginHome = env['HOME']?.trim();
-  return loginHome ? loginHome : homedir();
-}
-
-/**
- * The daemon's identity directory.
- *
- * @param homeDirectory - The already-resolved tree root, so a caller cannot
- *   accidentally combine an overridden root with a default daemon home.
- */
-export function resolveGoodVibesDaemonHome(
-  homeDirectory: string,
-  env: NodeJS.ProcessEnv = process.env,
-): string {
-  const override = env['GOODVIBES_DAEMON_HOME']?.trim();
-  if (!override) return join(homeDirectory, '.goodvibes', 'daemon');
-  return isAbsolute(override) ? override : resolve(process.cwd(), override);
-}
-
-/**
- * The `.goodvibes` directory itself — the tree, not the root it sits under.
- *
- * This exists because the two were being derived independently and did not
- * agree. `GOODVIBES_HOME` meant the tree ROOT to the runtime
- * (`<GOODVIBES_HOME>/.goodvibes/...`) and meant the `.goodvibes` DIRECTORY to
- * the two reporting scripts, which read it as
- * `process.env.GOODVIBES_HOME ?? join(homedir(), '.goodvibes')`. Set it to
- * `/tmp/sandbox` to isolate a run and the runtime wrote
- * `/tmp/sandbox/.goodvibes/`, while a script inspected `/tmp/sandbox` as though
- * it were already the tree — so the two halves of one round disagreed about
- * which files were even in scope.
- *
- * That is the shape of an incident that has already happened here: a
- * home-redirection variable honoured by one entry point and ignored by another
- * put two throwaway credentials in the owner's live secret store. One variable
- * has one meaning now, and it is the runtime's, because the runtime is what
- * writes secrets and because an isolation harness needs a single root that
- * everything falls under.
- *
- * A caller that genuinely wants to name a `.goodvibes` directory directly —
- * auditing a tree that is not under any home — passes it explicitly rather than
- * through the environment. Both scripts keep a `--home` flag for exactly that.
- */
-export function resolveGoodVibesTreeDirectory(env: NodeJS.ProcessEnv = process.env): string {
-  return join(resolveGoodVibesHome(env), '.goodvibes');
-}
-
-/** Both roots at once — what an entry point wants. */
-export function resolveGoodVibesHomeOwnership(
-  env: NodeJS.ProcessEnv = process.env,
-): GoodVibesHomeOwnership {
-  const homeDirectory = resolveGoodVibesHome(env);
-  return {
-    homeDirectory,
-    daemonHomeDirectory: resolveGoodVibesDaemonHome(homeDirectory, env),
-    isOverridden: Boolean(env['GOODVIBES_HOME']?.trim()) || Boolean(env['GOODVIBES_DAEMON_HOME']?.trim()),
-  };
-}
-
-/**
- * True when either root was relocated for this process.
- *
- * The daemon lifecycle asks this to decide whether it may adopt the machine's
- * service unit: a process told to run out of somewhere else is a throwaway, and
- * one that adopted the unit had systemd supervise it as the machine's daemon
- * for five hours while it read the real home's credentials.
- *
- * It lives here because the two variables have exactly one reader, and the
- * answer is a question ABOUT them. A caller checking `process.env` for itself is
- * how the second meaning that started all of this gets reintroduced — so the
- * question is answered here rather than asked again somewhere else.
- */
-export function hasOverriddenGoodVibesHome(env: NodeJS.ProcessEnv = process.env): boolean {
-  return (env['GOODVIBES_HOME']?.trim() ?? '') !== ''
-    || (env['GOODVIBES_DAEMON_HOME']?.trim() ?? '') !== '';
-}