@pellux/goodvibes-tui 1.27.1 → 2.0.1

package/src/daemon/fatal-boot-report.ts

@@ -1,111 +0,0 @@
-/**
- * fatal-boot-report.ts — saying why, on a stream, before the process stops.
- *
- * ── Where this module comes from ──────────────────────────────────────────
- *
- * This is a local mirror of the SDK's `platform/daemon/fatal-boot-report.ts`,
- * kept identical in shape and in exported names (`writeFatalLine`,
- * `writeExitingStdoutLine`, `reportFatalBootFailure`). It lives here only
- * because the published `@pellux/goodvibes-sdk` this repository compiles
- * against predates that export — importing it would not typecheck and CI
- * builds against the published package regardless. Delete this file and switch
- * every importer to the SDK's copy at the next re-pin — but check the SDK's
- * `package.json` "exports" map first: as of the 1.21.0 re-pin (2026-07-30),
- * the compiled `dist/platform/daemon/fatal-boot-report.js` still exists
- * inside the published tarball and `cli.js` still imports it internally, but
- * there is no `./platform/daemon/fatal-boot-report` (or any other) entry in
- * "exports" that makes it importable from outside the package — confirmed by
- * attempting `import { reportFatalBootFailure } from
- * '@pellux/goodvibes-sdk/platform/daemon/fatal-boot-report'`, which Bun
- * refuses to resolve. This file stays load-bearing until a future SDK release
- * adds that subpath export.
- *
- * ── The failure this exists to close ──────────────────────────────────────
- *
- * The shipped daemon died mute. Measured, against the released 1.27.0 binary
- * in an isolated home with an unparseable `.goodvibes/daemon/settings.json`:
- * exit code 1, **zero bytes on stdout, zero bytes on stderr, and no activity
- * log written at all**. It crash-looped 77 times overnight and the only signal
- * an operator had was that everything had stopped.
- *
- * The mechanism was not buffering and not a bypassed handler. It was simpler:
- * `daemon/cli.ts` reported the failure to the activity LOGGER and exited, and
- * at that point in boot the logger had no destination — the daemon entrypoint
- * never called `configureActivityLogger` at all — so the line went nowhere and
- * no file descriptor was ever touched. A `logger.error` is not a disclosure.
- * Only a write to a file descriptor is.
- *
- * ── Why `writeSync(2, …)` and not `process.stderr.write` ──────────────────
- *
- * Because the fatal path must not depend on anything a host can replace or
- * defer. `process.stderr.write` is a property on a mutable global, and THIS
- * repository is the one that replaces it: `src/runtime/terminal-output-guard.ts`
- * intercepts terminal output to keep the rendered screen clean, and a replaced
- * writer that records instead of printing turns a fatal error into silence. It
- * is also a stream, so a write issued immediately before `process.exit()` can
- * still be in flight when the process stops existing.
- *
- * `writeSync(fd, …)` is neither. It is a direct write to the descriptor the
- * service journal is attached to, it has completed when it returns, and no
- * amount of replacing `process.stderr` upstream can intercept it. That is the
- * whole property this module provides, and it is why every early-exit site in
- * the daemon boot path routes through here.
- */
-
-import { writeSync } from 'node:fs';
-import { flushActivityLogSync, logger, summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
-
-/** stdout and stderr, as the file descriptors they actually are. */
-const STDOUT_FD = 1;
-const STDERR_FD = 2;
-
-function writeLineToFd(fd: number, line: string): void {
-  try {
-    writeSync(fd, line.endsWith('\n') ? line : `${line}\n`);
-  } catch {
-    // A closed or unwritable descriptor must never turn a diagnostic into a
-    // second failure. There is nothing further to fall back to: this IS the
-    // fallback.
-  }
-}
-
-/**
- * Write one line to stderr synchronously, immune to a replaced
- * `process.stderr` and to exit-time truncation. Use this for anything that
- * gates a process exit.
- */
-export function writeFatalLine(line: string): void {
-  writeLineToFd(STDERR_FD, line);
-}
-
-/**
- * The stdout twin, for output that must survive an exit that follows it — the
- * help text, the version line, the service-subcommand receipt and the cluster
- * output are all printed and then immediately exited on, which is the same
- * race.
- */
-export function writeExitingStdoutLine(line: string): void {
-  writeLineToFd(STDOUT_FD, line);
-}
-
-/**
- * Report a fatal boot failure everywhere it can be found, then leave the exit
- * to the caller.
- *
- * The stream write happens FIRST and synchronously. The activity log is
- * attempted after, because it is the part that can fail — it needs a
- * configured destination, a writable directory, and a flush — and the
- * guarantee this function makes is the stream line, not the log line.
- */
-export function reportFatalBootFailure(error: unknown, context = 'goodvibes daemon host'): void {
-  const summary = summarizeError(error);
-  writeFatalLine(`${context} failed: ${summary}`);
-  if (error instanceof Error && error.stack) writeFatalLine(error.stack);
-  try {
-    logger.error(`${context} failed`, { error: summary });
-    flushActivityLogSync();
-  } catch {
-    // The reason is already on stderr, which is the guarantee. A log that
-    // cannot be written must not escalate into a different failure.
-  }
-}

package/src/daemon/handlers/context.ts

@@ -1,29 +0,0 @@
-/**
- * Host-facing context passed to every surface register function. Replaces the
- * former OperatorContext. It carries the SDK gateway catalog (handlers attach
- * to it), the daemon credential store, a read-only slice of the config manager,
- * resolved directories, and a logger. No SDK descriptor or schema is declared
- * here — the catalog type is re-exported through the contracts seam.
- */
-import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
-import type { GatewayMethodCatalog } from './contracts.ts';
-import type { DaemonCredentialStore } from './credentials.ts';
-import type { Unregister } from './register.ts';
-
-export interface HandlerLogger {
-  info(message: string, meta?: unknown): void;
-  warn(message: string, meta?: unknown): void;
-  error(message: string, meta?: unknown): void;
-}
-
-export interface HandlerContext {
-  readonly catalog: GatewayMethodCatalog;
-  readonly credentials: DaemonCredentialStore;
-  readonly configManager: Pick<ConfigManager, 'get' | 'getCategory'>;
-  readonly workingDirectory: string;
-  readonly homeDirectory: string;
-  readonly logger: HandlerLogger;
-}
-
-/** Every surface module exports a register function of this shape. */
-export type SurfaceRegister = (ctx: HandlerContext) => Unregister;

package/src/daemon/handlers/contracts.ts

@@ -1,77 +0,0 @@
-/**
- * Single SDK-contract import seam for the daemon handler layer.
- *
- * Every other module under `src/daemon/handlers/` imports SDK contract
- * identifiers from HERE and nowhere else. Concentrating the SDK imports in one
- * concrete-submodule module keeps the rest of the layer free of barrel cycles
- * and guarantees the host NEVER re-declares an SDK id, descriptor, or schema —
- * it only attaches handlers to the descriptors the SDK already registered.
- */
-
-// Catalog + invocation contract types (concrete control-plane subpath, not a project barrel).
-export type {
-  GatewayMethodCatalog,
-  GatewayMethodDescriptor,
-  GatewayMethodInvocation,
-  GatewayMethodInvocationContext,
-  GatewayMethodHandler,
-} from '@pellux/goodvibes-sdk/platform/control-plane';
-
-// Channel domain types reused in handler signatures (read-only SDK interfaces; never re-declared).
-export type {
-  ChannelIdentity,
-  ChannelResolvedTarget,
-  ChannelAccountRecord,
-} from '@pellux/goodvibes-sdk/platform/channels';
-
-/**
- * Per-peer authentication envelope passed to peer-scoped remote routes.
- *
- * The daemon-sdk ships `RemotePeerAuth` only as an UNEXPORTED local alias
- * inside `@pellux/goodvibes-daemon-sdk/remote-routes` (it is `unknown` there),
- * so it cannot be re-exported. We mirror that exact shape here for the host
- * implementation. This is an implementable runtime contract, not a method
- * descriptor or schema — declaring it does not violate the no-re-declaration
- * rule for catalog methods.
- */
-export type RemotePeerAuth = unknown;
-
-/**
- * Remote distributed-runtime route service the HOST must implement and supply
- * as `RuntimeServices.distributedRuntime`. The SDK facade injects the instance
- * into `DaemonRemoteRouteContext.distributedRuntime` so the published
- * `remote.peers.*` HTTP routes can dispatch to it.
- *
- * The daemon-sdk declares this interface locally in
- * `@pellux/goodvibes-daemon-sdk/remote-routes` but does NOT export it (the
- * module ends with `export {}`), so it cannot be imported. This declaration
- * mirrors the SDK's exact structural shape (17 methods, verbatim signatures)
- * so a host implementation is assignable to the SDK's context field. The SDK
- * ships no docker/ssh/cloud backend — the host owns the implementation.
- */
-export interface DistributedRuntimeRouteService {
-  listPairRequests(): unknown;
-  approvePairRequest(requestId: string, input: Record<string, unknown>): Promise<unknown | null>;
-  rejectPairRequest(requestId: string, input: Record<string, unknown>): Promise<unknown | null>;
-  listPeers(): unknown;
-  rotatePeerToken(peerId: string, input: Record<string, unknown>): Promise<unknown | null>;
-  revokePeerToken(peerId: string, input: Record<string, unknown>): Promise<unknown | null>;
-  disconnectPeer(peerId: string, input: Record<string, unknown>): Promise<unknown | null>;
-  listWork(): unknown;
-  invokePeer(input: Record<string, unknown>): Promise<unknown>;
-  cancelWork(workId: string, input: Record<string, unknown>): Promise<unknown | null>;
-  getNodeHostContract(): unknown;
-  requestPairing(input: Record<string, unknown>): Promise<unknown>;
-  verifyPairRequest(
-    requestId: string,
-    challenge: string,
-    input: Record<string, unknown>,
-  ): Promise<unknown | null>;
-  heartbeatPeer(auth: RemotePeerAuth, input: Record<string, unknown>): Promise<unknown>;
-  claimWork(auth: RemotePeerAuth, input: Record<string, unknown>): Promise<unknown>;
-  completeWork(
-    auth: RemotePeerAuth,
-    workId: string,
-    input: Record<string, unknown>,
-  ): Promise<unknown | null>;
-}

package/src/daemon/handlers/credentials.ts

@@ -1,139 +0,0 @@
-import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';
-import type { SecretsManager, SecretScope } from '../../config/secrets.ts';
-import {
-  buildGoodVibesSecretKey,
-  isSecretReferenceValue,
-} from '../../config/secret-config.ts';
-
-export interface DaemonCredentialStore {
-  /**
-   * Resolve a goodvibes://secrets/ reference OR a raw secret key to its
-   * plaintext value (daemon-internal only).
-   */
-  resolveRef(ref: string): Promise<string | null>;
-  /**
-   * Resolve a config-key-derived secret
-   * (e.g. 'surfaces.slack.botToken' → GOODVIBES_SURFACES_SLACK_BOT_TOKEN).
-   */
-  resolveConfigSecret(configKey: string): Promise<string | null>;
-  /**
-   * Store a daemon-owned credential. scope defaults 'daemon'.
-   *
-   * This is the DAEMON's own credential store: every caller is daemon code, and
-   * every value written through it is one the daemon itself has to read back —
-   * including its own generated draft encryption key (createAtRestCipher below,
-   * which calls put() with no scope at all). Defaulting to 'user' filed those
-   * in a surface-scoped tier, so the daemon's own material lived somewhere it
-   * only found by accident, and a value written on one surface's behalf was
-   * invisible to the next.
-   */
-  put(
-    secretKey: string,
-    value: string,
-    opts?: { scope?: SecretScope; medium?: 'plaintext' | 'secure' },
-  ): Promise<void>;
-  has(secretKey: string): Promise<boolean>;
-}
-
-/** Extract the trailing secret-key segment from a goodvibes://secrets/ reference. */
-function secretKeyFromReference(ref: string): string {
-  const normalized = ref.trim();
-  const segments = normalized.split('/');
-  const last = segments[segments.length - 1] ?? '';
-  return decodeURIComponent(last);
-}
-
-export function createDaemonCredentialStore(secrets: SecretsManager): DaemonCredentialStore {
-  return {
-    async resolveRef(ref: string): Promise<string | null> {
-      const key = isSecretReferenceValue(ref) ? secretKeyFromReference(ref) : ref;
-      return secrets.get(key);
-    },
-    async resolveConfigSecret(configKey: string): Promise<string | null> {
-      return secrets.get(buildGoodVibesSecretKey(configKey));
-    },
-    async put(
-      secretKey: string,
-      value: string,
-      opts?: { scope?: SecretScope; medium?: 'plaintext' | 'secure' },
-    ): Promise<void> {
-      await secrets.set(secretKey, value, {
-        scope: opts?.scope ?? 'daemon',
-        medium: opts?.medium ?? 'secure',
-      });
-    },
-    async has(secretKey: string): Promise<boolean> {
-      const value = await secrets.get(secretKey);
-      return value !== null && value.length > 0;
-    },
-  };
-}
-
-// ---------------------------------------------------------------------------
-// At-rest encryption helper for drafts (draft body must be encrypted at rest).
-// ---------------------------------------------------------------------------
-
-export interface AtRestCipher {
-  encrypt(plaintext: string): Promise<string>;
-  decrypt(ciphertext: string): Promise<string>;
-}
-
-const DEFAULT_DRAFT_KEY_NAME = 'GOODVIBES_DAEMON_DRAFT_AESKEY';
-const AES_KEY_BYTES = 32; // AES-256
-const GCM_IV_BYTES = 12;
-const GCM_TAG_BYTES = 16;
-
-async function loadOrCreateKey(
-  store: DaemonCredentialStore,
-  keyName: string,
-): Promise<Buffer> {
-  const existing = await store.resolveRef(keyName);
-  if (existing && existing.length > 0) {
-    const buf = Buffer.from(existing, 'base64');
-    if (buf.length === AES_KEY_BYTES) return buf;
-  }
-  const generated = randomBytes(AES_KEY_BYTES);
-  await store.put(keyName, generated.toString('base64'), { medium: 'secure' });
-  return generated;
-}
-
-/**
- * Create an AES-256-GCM at-rest cipher backed by a daemon-owned key.
- * encrypt() returns base64(iv | tag | ciphertext). Uses node:crypto (Bun-compatible).
- * NEVER log resolved keys or plaintext.
- */
-export function createAtRestCipher(
-  store: DaemonCredentialStore,
-  keyName: string = DEFAULT_DRAFT_KEY_NAME,
-): AtRestCipher {
-  let keyPromise: Promise<Buffer> | null = null;
-  const getKey = (): Promise<Buffer> => {
-    if (!keyPromise) keyPromise = loadOrCreateKey(store, keyName);
-    return keyPromise;
-  };
-
-  return {
-    async encrypt(plaintext: string): Promise<string> {
-      const key = await getKey();
-      const iv = randomBytes(GCM_IV_BYTES);
-      const cipher = createCipheriv('aes-256-gcm', key, iv);
-      const encrypted = Buffer.concat([
-        cipher.update(plaintext, 'utf-8'),
-        cipher.final(),
-      ]);
-      const tag = cipher.getAuthTag();
-      return Buffer.concat([iv, tag, encrypted]).toString('base64');
-    },
-    async decrypt(ciphertext: string): Promise<string> {
-      const key = await getKey();
-      const raw = Buffer.from(ciphertext, 'base64');
-      const iv = raw.subarray(0, GCM_IV_BYTES);
-      const tag = raw.subarray(GCM_IV_BYTES, GCM_IV_BYTES + GCM_TAG_BYTES);
-      const data = raw.subarray(GCM_IV_BYTES + GCM_TAG_BYTES);
-      const decipher = createDecipheriv('aes-256-gcm', key, iv);
-      decipher.setAuthTag(tag);
-      const decrypted = Buffer.concat([decipher.update(data), decipher.final()]);
-      return decrypted.toString('utf-8');
-    },
-  };
-}