@pellux/goodvibes-tui 1.27.0 → 2.0.1

package/src/runtime/durability-housekeeping.ts

@@ -1,183 +0,0 @@
-/**
- * durability-housekeeping.ts — the reclaim half of every crash-durability
- * artefact this product writes to disk.
- *
- * The standing rule this module implements: if something is persisted across
- * restarts and crashes, recovery has to do the housekeeping. Each individual
- * store already knew how to WRITE its artefact and how to retire it on a clean
- * path; none of them reclaimed what a SIGKILL left behind. Four stores, four
- * kinds of residue:
- *
- *   - liveness markers      `<home>/.goodvibes/<root>/liveness/<id>.json`
- *                           removed only on a clean exit, so a crash leaks one
- *                           file per session id ever opened.
- *   - transcript journals   `<home>/.goodvibes/<root>/transcript-<id>.journal`
- *                           deleted on snapshot or replay, so a session that
- *                           crashes and is never resumed leaks its journal.
- *   - quarantine files      `<path>.unrecognized` — written so a human can
- *                           inspect a corrupt file, never removed afterwards.
- *   - anchor sidecars       `<sessionsDir>/<id>.anchors.json` — outlives the
- *                           session JSONL that owns it.
- *
- * Every reap here is bounded by BOTH an age window and a count cap, decides
- * what to keep by reading content rather than by a file merely existing, never
- * touches the current session, tolerates a competing sweeper deleting the same
- * file first, and reports what it removed. `startDurabilityHousekeeping` runs
- * the sweep at startup and then on a repeating timer, because a long-lived
- * process that only sweeps at boot never sweeps.
- *
- * Best-effort throughout: a failure in one reap never aborts the others and
- * nothing here ever throws to its caller.
- */
-import { logger, summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
-import { join } from 'node:path';
-import { reapQuarantinedFiles } from '@/config/read-versioned.ts';
-import { reapOrphanedAnchorSidecars } from '@/core/rewind-turn-anchors.ts';
-import { reapOrphanedJournals } from '@/core/transcript-journal.ts';
-import { checkSessionLiveness, reapStaleLivenessMarkers } from '@/runtime/session-liveness-marker.ts';
-import type { SessionSurface } from '@/runtime/index.ts';
-
-/**
- * How often the sweep repeats after startup: 6 hours. Hours, not minutes — the
- * residue this reclaims accumulates per crashed session, not continuously, and
- * a directory scan is not something a foreground TUI should be doing often.
- */
-export const DURABILITY_HOUSEKEEPING_INTERVAL_MS = 6 * 60 * 60 * 1000;
-
-export interface DurabilityHousekeepingInput {
-  /** The app's declare-once storage handle; every swept path derives from it. */
-  readonly surface: SessionSurface;
-  /**
-   * The session this process is using right now, read at sweep time rather
-   * than captured once — a resume or fork can repoint it between sweeps.
-   * Returning null means "not known yet", which is safe: the age and liveness
-   * rules independently protect an actively written artefact.
-   */
-  readonly currentSessionId?: () => string | null;
-  /** Extra directories to scan for `.unrecognized` quarantine files. */
-  readonly extraQuarantineDirs?: readonly string[];
-}
-
-export interface DurabilityHousekeepingOutcome {
-  readonly livenessMarkers: number;
-  readonly transcriptJournals: number;
-  readonly quarantineFiles: number;
-  readonly anchorSidecars: number;
-  /** Sum of the four counts above — zero means nothing was reclaimed. */
-  readonly total: number;
-}
-
-/**
- * Run all four reaps once and return what each reclaimed.
- *
- * Each reap is isolated: one throwing is logged at warn level and counted as
- * zero, and the remaining reaps still run. The caller never sees an exception.
- */
-export function runDurabilityHousekeeping(input: DurabilityHousekeepingInput): DurabilityHousekeepingOutcome {
-  const { surface } = input;
-  const currentSessionId = safely('current session id', () => input.currentSessionId?.() ?? null, null);
-
-  const livenessMarkers = safely('liveness markers', () =>
-    reapStaleLivenessMarkers(surface, {
-      keepSessionIds: currentSessionId ? [currentSessionId] : [],
-    }).reaped, 0);
-
-  const transcriptJournals = safely('transcript journals', () =>
-    reapOrphanedJournals(surface, {
-      currentSessionId,
-      // Composition happens here so transcript-journal.ts keeps no dependency
-      // on the liveness marker: a journal whose session is open in another
-      // running instance is live state, not residue.
-      isSessionLive: (sessionId) => checkSessionLiveness(surface, sessionId).live,
-    }).reaped, 0);
-
-  const quarantineFiles = safely('quarantine files', () =>
-    reapQuarantinedFiles(quarantineDirsFor(input)).reaped, 0);
-
-  const anchorSidecars = safely('anchor sidecars', () =>
-    reapOrphanedAnchorSidecars(surface, { currentSessionId }).reaped, 0);
-
-  const outcome: DurabilityHousekeepingOutcome = {
-    livenessMarkers,
-    transcriptJournals,
-    quarantineFiles,
-    anchorSidecars,
-    total: livenessMarkers + transcriptJournals + quarantineFiles + anchorSidecars,
-  };
-  discloseHousekeeping(outcome);
-  return outcome;
-}
-
-/**
- * Start durability housekeeping: one sweep now, then a repeating sweep every
- * `DURABILITY_HOUSEKEEPING_INTERVAL_MS`. Returns a disposer that stops the
- * timer; calling it more than once is harmless.
- *
- * The timer is `unref()`d, so an undisposed sweeper can never hold the process
- * open — same convention the store-snapshot scheduler and the config-file
- * watchers in durability-services.ts use.
- */
-export function startDurabilityHousekeeping(
-  input: DurabilityHousekeepingInput,
-  options: { readonly intervalMs?: number } = {},
-): () => void {
-  runDurabilityHousekeeping(input);
-  const timer = setInterval(
-    () => { runDurabilityHousekeeping(input); },
-    options.intervalMs ?? DURABILITY_HOUSEKEEPING_INTERVAL_MS,
-  );
-  timer.unref?.();
-  let stopped = false;
-  return () => {
-    if (stopped) return;
-    stopped = true;
-    clearInterval(timer);
-  };
-}
-
-/**
- * Disclose what was reclaimed — silent deletion is indistinguishable from data
- * loss. Paths and counts only; nothing about a reclaimed file's contents.
- *
- * A sweep that reclaimed nothing logs nothing: the overwhelmingly common boot
- * has no residue at all, and a per-boot "reclaimed 0" line would train readers
- * to ignore the line that actually matters.
- */
-function discloseHousekeeping(outcome: DurabilityHousekeepingOutcome): void {
-  if (outcome.total === 0) return;
-  logger.info('durability housekeeping reclaimed crash residue', {
-    livenessMarkers: outcome.livenessMarkers,
-    transcriptJournals: outcome.transcriptJournals,
-    quarantineFiles: outcome.quarantineFiles,
-    anchorSidecars: outcome.anchorSidecars,
-    total: outcome.total,
-  });
-}
-
-/**
- * Every directory that can accumulate `.unrecognized` files: the home-scoped
- * surface root (transcript-journal quarantines) and the per-project session,
- * state, recovery and checkpoint directories (versioned-config quarantines),
- * plus whatever the caller adds.
- */
-function quarantineDirsFor(input: DurabilityHousekeepingInput): readonly string[] {
-  const { surface } = input;
-  return [
-    join(surface.homeDirectory, '.goodvibes', surface.surfaceRoot),
-    surface.sessionsDir,
-    surface.stateDir,
-    surface.recoveryDir,
-    surface.checkpointsDir,
-    ...(input.extraQuarantineDirs ?? []),
-  ].filter((dir): dir is string => typeof dir === 'string' && dir.length > 0);
-}
-
-/** Run one reap in isolation: never throws, returns `fallback` if it would have. */
-function safely<T>(label: string, run: () => T, fallback: T): T {
-  try {
-    return run();
-  } catch (error) {
-    logger.warn('durability housekeeping step failed', { step: label, error: summarizeError(error) });
-    return fallback;
-  }
-}

package/src/runtime/durability-services.ts

@@ -1,155 +0,0 @@
-/**
- * durability-services.ts — the data-safety and remembered-decision stores the
- * daemon composition wires (mirrors the SDK's own createRuntimeServices):
- *
- *  - StoreSnapshotScheduler: a daily snapshot of every SQLite store this
- *    runtime writes (memory store, memory vector index, code index store),
- *    bounded by the retention engine. Timers are unref'd so an undisposed
- *    scheduler cannot pin the event loop; hosts that tear down a runtime
- *    stop() it themselves.
- *  - UserPermissionRuleStore: durable user-origin permission rules
- *    (remembered approvals) — one store per project, shared by every
- *    PermissionManager built on this runtime; permissions.rules.*
- *    lists/deletes. Background init is fail-safe (asks just prompt).
- *  - One credential chain (env -> secrets -> subscription): boot applies
- *    secrets-backed keys; every secrets write/delete re-registers builtins
- *    LIVE (no restart) — badges/picker/chat read the same instances.
- *  - Start-time retention janitor: one best-effort append-only sweep over
- *    EVERY root the composition knows (working dir, surface root, home,
- *    logDir, telemetryDir) — omitting logDir/telemetryDir/home would silently
- *    skip the activity-log, telemetry-ledger, and recovery-snapshot stores.
- *  - Durability housekeeping: the crash-residue reclaim the retention janitor
- *    above does NOT cover — stale liveness markers, orphaned transcript
- *    journals, `.unrecognized` quarantine files, and anchor sidecars whose
- *    session is gone (see durability-housekeeping.ts). It runs at startup AND
- *    on a repeating unref'd timer, because a long-lived process that only
- *    sweeps at boot never sweeps; the returned disposer stops that timer.
- *  - Live config-file watch: external edits to the settings file apply through
- *    the same subscribe() pipeline an in-process set() uses — no restart. The
- *    underlying watchers are unref'd, so this never pins the event loop.
- */
-import { join } from 'node:path';
-import { operations } from '@pellux/goodvibes-sdk/platform/runtime';
-import { resolveMemoryVectorDbPath } from '@pellux/goodvibes-sdk/platform/state';
-import { StoreSnapshotScheduler } from '@pellux/goodvibes-sdk/platform/state/store-snapshots';
-import { UserPermissionRuleStore } from '@pellux/goodvibes-sdk/platform/permissions';
-import { logger, summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
-import { startDurabilityHousekeeping } from './durability-housekeeping.ts';
-import type { SessionSurface } from '@/runtime/index.ts';
-
-export interface DurabilityServicesInput {
-  readonly configManager: {
-    getControlPlaneConfigDir(): string;
-    get(key: never): unknown;
-    watchConfigFiles(options?: { intervalMs?: number }): () => void;
-  };
-  readonly secretsManager: { onDidChange(listener: (key: string) => void): () => void };
-  readonly providerRegistry: { refreshProviderCredentials(): Promise<void> };
-  readonly memoryDbPath: string;
-  readonly codeIndexDbPath: string;
-  /**
-   * The app's declare-once storage handle. The retention-sweep roots below
-   * are read straight off it rather than re-declared here, so the janitor can
-   * never sweep a different scope than the one sessions and recovery
-   * snapshots are actually written to.
-   */
-  readonly surface: SessionSurface;
-  readonly shellPaths: { resolveUserPath(...segments: string[]): string };
-  /**
-   * The session id this process is currently using, read at each sweep. When
-   * omitted the crash-residue reap still protects live artefacts through its
-   * age and liveness rules — this is the explicit belt-and-braces guard.
-   */
-  /**
-   * Resolves the live session id, read fresh on every crash-residue sweep so
-   * the running session's own transcript journal and liveness marker are
-   * exempt from reaping.
-   *
-   * A getter, not a value: the id is reassigned in place when a recovery
-   * snapshot is accepted, and this sweep repeats for the life of the process.
-   *
-   * Omitting it is not merely untidy. The journal reaper's other guard is the
-   * liveness marker, and that marker goes stale after 150 seconds — so a host
-   * that passes nothing here is trusting a heartbeat that a single long
-   * blocking turn can outrun, and an in-process sweep landing in that window
-   * would delete the journal of the session currently writing it. Passing this
-   * makes the exemption unconditional instead of timing-dependent.
-   */
-  readonly currentSessionId?: () => string | null;
-}
-
-export interface DurabilityServices {
-  readonly storeSnapshotScheduler: StoreSnapshotScheduler;
-  /**
-   * Re-sweeps every registered append-only store on a cadence. The start-time
-   * sweep alone never prunes again in a process that stays up, which is the
-   * window in which those stores grow. Unref'd timers; teardown stop()s it.
-   */
-  readonly appendOnlyRetentionScheduler: InstanceType<typeof operations.AppendOnlyRetentionScheduler>;
-  readonly userPermissionRuleStore: UserPermissionRuleStore;
-  /**
-   * Stops the repeating crash-residue sweep. The timer is unref'd, so a host
-   * that never calls this is not held open by it; teardown calls it to stop
-   * the work rather than to release the loop.
-   */
-  readonly stopDurabilityHousekeeping: () => void;
-  /** Stops the live config-file watch this factory started. */
-  readonly stopConfigWatch: () => void;
-}
-
-export function createDurabilityServices(input: DurabilityServicesInput): DurabilityServices {
-  const { configManager, secretsManager, providerRegistry } = input;
-  secretsManager.onDidChange(() => void providerRegistry.refreshProviderCredentials().catch((error) => logger.warn('live credential refresh failed', { error: summarizeError(error) })));
-  void providerRegistry.refreshProviderCredentials().catch((error) => logger.warn('boot credential refresh failed', { error: summarizeError(error) }));
-
-  const storeSnapshotScheduler = new StoreSnapshotScheduler({
-    stores: [
-      { name: 'memory store', dbPath: input.memoryDbPath },
-      { name: 'memory vector index', dbPath: resolveMemoryVectorDbPath(input.memoryDbPath) },
-      { name: 'code index store', dbPath: input.codeIndexDbPath },
-    ],
-  });
-  storeSnapshotScheduler.start();
-
-  // Start-time retention janitor: pass EVERY root the composition knows so the
-  // activity-log, telemetry-ledger, and recovery-snapshot stores are all swept.
-  // Best-effort — a retention failure never takes startup down (the sweep
-  // swallows its own errors).
-  const appendOnlyRetentionRoots = {
-    workingDirectory: input.surface.workingDirectory,
-    surfaceRoot: input.surface.surfaceRoot,
-    homeDirectory: input.surface.homeDirectory,
-    logDir: input.shellPaths.resolveUserPath('logs'),
-    telemetryDir: input.shellPaths.resolveUserPath('telemetry'),
-  };
-  const appendOnlyRetentionConfigGet = (k: string): unknown => configManager.get(k as never);
-  operations.runStartupAppendOnlySweep(appendOnlyRetentionRoots, appendOnlyRetentionConfigGet);
-  // ...and again on a cadence for as long as this process lives. A start-time
-  // sweep alone never prunes a long-lived session again after boot, which is
-  // exactly the window in which these stores grow. Unref'd timers; the disposer
-  // below stops it, same posture as storeSnapshotScheduler.
-  const appendOnlyRetentionScheduler = new operations.AppendOnlyRetentionScheduler({
-    roots: appendOnlyRetentionRoots,
-    configGet: appendOnlyRetentionConfigGet,
-  });
-  appendOnlyRetentionScheduler.start();
-  // Crash-residue reclaim the sweep above does not cover (liveness markers,
-  // orphaned transcript journals, .unrecognized quarantine files, anchor
-  // sidecars whose session file is gone). Runs once now and every few hours
-  // after that; the timer is unref'd and the disposer stops it.
-  const stopDurabilityHousekeeping = startDurabilityHousekeeping({
-    surface: input.surface,
-    currentSessionId: input.currentSessionId,
-    extraQuarantineDirs: [configManager.getControlPlaneConfigDir()],
-  });
-  // External config edits apply LIVE through the same subscribe() pipeline an
-  // in-process set() uses; the underlying watchers are unref'd. The returned
-  // handle is the only way to stop them — dropping it left a 250ms poll running
-  // for the life of the process after the graph that started it was gone.
-  const stopConfigWatch = configManager.watchConfigFiles();
-
-  const userPermissionRuleStore = new UserPermissionRuleStore(join(configManager.getControlPlaneConfigDir(), 'permission-rules.json'));
-  void userPermissionRuleStore.init().catch((error) => logger.warn('user permission rule store init failed; asks will prompt', { error: summarizeError(error) }));
-
-  return { storeSnapshotScheduler, appendOnlyRetentionScheduler, userPermissionRuleStore, stopDurabilityHousekeeping, stopConfigWatch };
-}

package/src/runtime/embedded-service-factories.ts

@@ -1,58 +0,0 @@
-/**
- * embedded-service-factories.ts — the factories startExternalServices uses to
- * construct the interactive session's embedded DaemonServer + HttpListener
- * (extracted from bootstrap.ts for file-size hygiene).
- *
- * The embedded DaemonServer suppresses the facade's internal auto-updater:
- * that loop compares the sdk package's version — not this binary's — against
- * this repo's releases, so inside the interactive session it would find an
- * "update" hourly and exit the user's process on "restart". Clients update at
- * launch (cli/launch-auto-update.ts); the embedded daemon runs no update loop
- * at all. See daemon/lifecycle.ts.
- */
-import { DaemonServer, HttpListener } from '@pellux/goodvibes-sdk/platform/daemon';
-import type { ClusterCoordinator, ClusterGroupVerbSurface } from '@pellux/goodvibes-sdk/platform/cluster';
-import { createSafeHostServeFactory } from '../daemon/safe-serve.ts';
-import type { startExternalServices } from '@/runtime/index.ts';
-
-export type ExternalServiceFactories = NonNullable<Parameters<typeof startExternalServices>[4]>;
-
-/**
- * `clusterCoordinator` is threaded through explicitly rather than read off the
- * runtimeServices the SDK hands the factory: that object is typed by the SDK,
- * which has no field for a coordinator this product composed. Passing it here
- * keeps the ONE-coordinator-per-process rule enforceable by the type checker.
- */
-export function createEmbeddedServiceFactories(
-  sharedDaemonToken: string,
-  clusterCoordinator: ClusterCoordinator,
-  clusterGroupVerbs: ClusterGroupVerbSurface,
-): ExternalServiceFactories {
-  return {
-    sharedDaemonToken,
-    createDaemonServer: (bus, userAuth, runtimeServices) => {
-      // No updateArtifact: the embedded daemon keeps updates host-managed (the
-      // TUI client updates itself), so the facade runs no self-update loop.
-      const daemonServer = new DaemonServer({
-        runtimeBus: bus,
-        userAuth,
-        runtimeServices,
-        serveFactory: createSafeHostServeFactory('Embedded daemon'),
-        // The SAME coordinator the inbox poller registered with. Letting the
-        // facade compose its own would put two election nodes in one process,
-        // and whichever lost would silence consumers the other owns.
-        clusterCoordinator,
-        // The `cluster` verbs (/api/cluster/*), so the CLI and the TUI command
-        // reach one implementation whether the daemon is embedded or standalone.
-        clusterGroupVerbs,
-      });
-      return daemonServer;
-    },
-    createHttpListener: (dispatcher, userAuth, configManager) => new HttpListener({
-      hookDispatcher: dispatcher,
-      userAuth,
-      configManager,
-      serveFactory: createSafeHostServeFactory('Embedded HTTP listener'),
-    }),
-  };
-}

package/src/runtime/feature-settings.ts

@@ -1,154 +0,0 @@
-/**
- * feature-settings — TUI-side helpers over the SDK's FEATURE_SETTINGS surface.
- *
- * Every platform capability is configured through a first-class settings key
- * in its natural domain (behavior.compactionStrategy, sandbox.enabled,
- * surfaces.slack.enabled, ...). There is no separate enablement namespace.
- * These helpers answer the recurring TUI questions:
- *   - which feature a given id names, and whether a stock config has it on,
- *   - whether a raw config value means the feature is currently on,
- *   - which single settings write turns a feature on or off.
- *
- * Enablement kinds (from the SDK binding layer):
- *   - boolean : the key's boolean value is the enablement.
- *   - enum    : active while the key's value is in enabledValues (several
- *               features can share one key, e.g. behavior.compactionStrategy).
- *   - constant: the capability has no separate off switch. When its key is a
- *               boolean (the surface enabled keys) that value is the honest
- *               user-facing switch; a non-boolean constant key (e.g.
- *               fetch.sanitizeMode) has no off position at all.
- */
-
-import { CONFIG_SCHEMA, type ConfigKey, type ConfigManager, type ConfigSetting } from '@pellux/goodvibes-sdk/platform/config';
-import {
-  FEATURE_SETTINGS,
-  deriveFeatureState,
-  type FeatureSetting,
-} from '@pellux/goodvibes-sdk/platform/runtime/state';
-
-export type { FeatureSetting } from '@pellux/goodvibes-sdk/platform/runtime/state';
-
-// ---------------------------------------------------------------------------
-// Lookups
-// ---------------------------------------------------------------------------
-
-/** Every capability by id, in SDK declaration order. */
-export const FEATURE_SETTINGS_BY_ID: ReadonlyMap<string, FeatureSetting> = new Map(
-  FEATURE_SETTINGS.map((feature) => [feature.id, feature]),
-);
-
-const SCHEMA_BY_KEY: ReadonlyMap<string, ConfigSetting> = new Map(
-  CONFIG_SCHEMA.map((setting) => [setting.key, setting]),
-);
-
-export function getFeatureSetting(featureId: string): FeatureSetting | null {
-  return FEATURE_SETTINGS_BY_ID.get(featureId) ?? null;
-}
-
-/** The CONFIG_SCHEMA descriptor for a settings key, or null for TUI-local synthetics. */
-export function getConfigSchemaSetting(key: string): ConfigSetting | null {
-  return SCHEMA_BY_KEY.get(key) ?? null;
-}
-
-/** Whether a stock configuration has the feature active. */
-export function isFeatureDefaultEnabled(featureId: string): boolean {
-  return getFeatureSetting(featureId)?.defaultEnabled === true;
-}
-
-/** All features whose enablement key is `key` (several features can share one). */
-export function featuresForEnablementKey(key: string): readonly FeatureSetting[] {
-  return FEATURE_SETTINGS.filter((feature) => feature.enablement.key === key);
-}
-
-// ---------------------------------------------------------------------------
-// Enablement derivation
-// ---------------------------------------------------------------------------
-
-/**
- * Whether a raw config value means the feature is on, as a settings surface
- * should display it. Boolean/enum kinds derive exactly as the runtime gate
- * does; constant kinds fall back to the boolean key value when there is one
- * (the honest user-facing switch for the surface adapters) and read as always
- * on otherwise.
- */
-export function isFeatureValueEnabled(feature: FeatureSetting, value: unknown): boolean {
-  const { key, kind, enabledValues } = feature.enablement;
-  // A capability declared not operable in this build never reads as on, whatever
-  // its settings key says. deriveFeatureState already enforces this for the
-  // boolean and enum kinds; stating it once here covers the constant kind too,
-  // so no surface can show "on" for something that is doing nothing. The user's
-  // value is untouched — it is kept for the release that wires the capability up
-  // — and `feature.inoperableDetail` is the written reason a surface renders.
-  if (feature.operable === false) return false;
-  if (kind === 'constant') {
-    const schema = getConfigSchemaSetting(key);
-    if (schema?.type === 'boolean') return value === true;
-    return true;
-  }
-  return deriveFeatureState(
-    {
-      featureId: feature.id,
-      key,
-      kind,
-      ...(enabledValues !== undefined ? { enabledValues } : {}),
-    },
-    value,
-  ) === 'enabled';
-}
-
-/** Whether the live config currently has the feature on (see isFeatureValueEnabled). */
-export function isFeatureConfigEnabled(
-  configManager: Pick<ConfigManager, 'get'>,
-  featureId: string,
-): boolean {
-  const feature = getFeatureSetting(featureId);
-  if (!feature) return false;
-  return isFeatureValueEnabled(feature, configManager.get(feature.enablement.key));
-}
-
-// ---------------------------------------------------------------------------
-// Enablement writes
-// ---------------------------------------------------------------------------
-
-export interface FeatureEnablementWrite {
-  readonly key: ConfigKey;
-  readonly value: boolean | string;
-}
-
-/**
- * The single settings write that turns a feature on or off, or null when the
- * feature has no off position (a constant-kind capability on a non-boolean
- * key). For enum kinds the schema default is preferred whenever it sits on
- * the requested side, so "enable" lands on the feature's stock mode and
- * "disable" lands on the stock off mode rather than an arbitrary value.
- */
-export function featureEnablementWrite(
-  featureId: string,
-  enabled: boolean,
-): FeatureEnablementWrite | null {
-  const feature = getFeatureSetting(featureId);
-  if (!feature) return null;
-  const { key, kind, enabledValues } = feature.enablement;
-
-  if (kind === 'boolean') return { key, value: enabled };
-
-  const schema = getConfigSchemaSetting(key);
-  if (kind === 'constant') {
-    return schema?.type === 'boolean' ? { key, value: enabled } : null;
-  }
-
-  // enum
-  const active = enabledValues ?? [];
-  const allValues = schema?.enumValues ?? [];
-  const schemaDefault = typeof schema?.default === 'string' ? schema.default : undefined;
-  if (enabled) {
-    const target = schemaDefault !== undefined && active.includes(schemaDefault)
-      ? schemaDefault
-      : active[0];
-    return target !== undefined ? { key, value: target } : null;
-  }
-  const offTarget = schemaDefault !== undefined && !active.includes(schemaDefault)
-    ? schemaDefault
-    : allValues.find((value) => !active.includes(value));
-  return offTarget !== undefined ? { key, value: offTarget } : null;
-}

package/src/runtime/fleet-needs-input-push.ts

@@ -1,70 +0,0 @@
-/**
- * fleet-needs-input-push.ts — wires the fleet "needs-input" browser-push fan-out
- * that the SDK's registerGatewayVerbGroups (reached through the terminal-shell's
- * attachWsOnlyGatewayVerbHandlers wrapper) gates on two deps: `runtimeBus` and
- * `sessionPresence` (see push/service.ts's attachFleetNeedsInputSource). When a
- * fleet node blocks on the operator, it pushes an "Input needed" notification
- * carrying the session/node deep link to every registered device — suppressed
- * while an operator surface is already attached to that node's session.
- *
- * TWO seams have to be live for a real push, not just descriptor presence:
- *  1. Fleet lifecycle deltas (FLEET_NODE_BLOCKED_ON_USER etc.) have to reach the
- *     runtime bus's 'fleet' domain in the first place. That is
- *     attachFleetEmitBridge, diffing the process registry's own coalesced
- *     snapshot tick into per-node lifecycle events. The terminal-shell package's
- *     createArchivableFleetRegistry only builds the registry — it does not
- *     attach the bridge — so the composition root that owns both the registry
- *     and the bus (this file) is the one place responsible for it. The SDK's
- *     own daemon composition (platform/runtime/services.ts) attaches this same
- *     bridge right after building its process registry.
- *  2. registerGatewayVerbGroups has to be handed `runtimeBus` (to subscribe onto
- *     that domain) and `sessionPresence` (to suppress a push when an operator is
- *     already looking at the session).
- *
- * sessionPresence mirrors the SDK's own daemon composition: a session counts as
- * attended when any participant heartbeated within the freshness window below.
- * Reimplemented here on the broker's public getSession()/SharedSessionRecord
- * shape rather than imported, because the SDK does not expose its own
- * hasFreshSurfaceParticipant helper as public API.
- */
-import { attachFleetEmitBridge } from '@pellux/goodvibes-sdk/platform/runtime/fleet';
-import type { ArchivableProcessRegistry } from '@pellux/goodvibes-sdk/platform/runtime/fleet';
-import type { SharedSessionBroker } from '@pellux/goodvibes-sdk/platform/control-plane';
-import type { RuntimeEventBus } from '@/runtime/index.ts';
-
-/**
- * How recently a participant must have been seen to count as actively
- * attached. Mirrors the SDK's own (private) SURFACE_ROUTE_FRESHNESS_MS.
- */
-const SURFACE_ATTACHED_FRESHNESS_MS = 2 * 60 * 1000;
-
-export interface FleetNeedsInputPushDeps {
-  readonly runtimeBus: RuntimeEventBus;
-  readonly sessionPresence: { isAttached(sessionId: string): boolean };
-}
-
-/**
- * Attach the fleet emit-bridge (registry snapshot deltas -> runtime bus `fleet`
- * domain) and build the presence lookup, returning both as the deps
- * `attachWsOnlyGatewayVerbHandlers` spreads into its call so the needs-input
- * push source registers for real instead of gracefully degrading to absent.
- */
-export function wireFleetNeedsInputPush(input: {
-  readonly registry: ArchivableProcessRegistry;
-  readonly runtimeBus: RuntimeEventBus;
-  readonly sessionBroker: Pick<SharedSessionBroker, 'getSession'>;
-}): FleetNeedsInputPushDeps {
-  attachFleetEmitBridge({ registry: input.registry, bus: input.runtimeBus });
-  const sessionBroker = input.sessionBroker;
-  return {
-    runtimeBus: input.runtimeBus,
-    sessionPresence: {
-      isAttached: (sessionId: string) => {
-        const session = sessionBroker.getSession(sessionId);
-        if (!session) return false;
-        const now = Date.now();
-        return session.participants.some((participant) => now - participant.lastSeenAt < SURFACE_ATTACHED_FRESHNESS_MS);
-      },
-    },
-  };
-}

package/src/runtime/fleet-services.ts

@@ -1,41 +0,0 @@
-/**
- * fleet-services.ts — the shared, archive-aware fleet registry construction,
- * lifted out of services.ts so the composition root stays under the file-size
- * cap. Mirrors the sibling create*Services helpers (durability, code-index,
- * workstream): a single dependency-injected call that services.ts makes once.
- *
- * Also owns the daemon-side observed foreign-agent source: when
- * observeExternalAgents is on (the standalone daemon), externally-launched
- * coding-agent sessions observed read-only on the host fold in as
- * 'observed-external' rows (visibility + steer; never counted against
- * fleet.maxSize, never stopped). The interactive process leaves it off and
- * reads the daemon's snapshot, so it never double-scans. Absence ⇒ a quiet
- * empty set. Mirrors the SDK's own createRuntimeServices wiring.
- */
-import { computeUsageCostUsd, type ProviderRegistry } from '@pellux/goodvibes-sdk/platform/providers';
-import { type ArchivableProcessRegistry } from '@pellux/goodvibes-sdk/platform/runtime/fleet';
-import { ObservedAgentSource } from '@pellux/goodvibes-sdk/platform/runtime/fleet/observed';
-import { createArchivableFleetRegistry, type ProcessRegistryDeps } from '@pellux/goodvibes-terminal-shell';
-
-export interface FleetServicesDeps
-  extends Omit<ProcessRegistryDeps, 'observedAgents' | 'priceUsage'> {
-  /** Turns on the daemon-side observed foreign-agent source (daemon only). */
-  readonly observeExternalAgents?: boolean | undefined;
-  /** Backs the honest pricing resolver folded into priceUsage below. */
-  readonly providerRegistry: Pick<ProviderRegistry, 'resolveModelPricing'>;
-}
-
-export function createFleetServices(
-  deps: FleetServicesDeps,
-): { processRegistry: ArchivableProcessRegistry } {
-  const { observeExternalAgents, providerRegistry, ...registryDeps } = deps;
-  const observedAgents = observeExternalAgents ? new ObservedAgentSource() : undefined;
-  const processRegistry = createArchivableFleetRegistry({
-    ...registryDeps,
-    observedAgents, // Daemon-side observed foreign-agent rows (undefined in the interactive process)
-    // Honest-unpriced through the ONE pricing resolver (manual -> registration -> provider-served
-    // -> catalog -> unknown); unknown/subscription yields null, never $0. Mirrors the SDK composition.
-    priceUsage: (model, usage) => (model ? computeUsageCostUsd(providerRegistry.resolveModelPricing(model), usage) : null),
-  });
-  return { processRegistry };
-}