@pellux/goodvibes-tui 1.27.1 → 2.0.2

package/src/runtime/client/operator-endpoint.ts

@@ -0,0 +1,213 @@
+/**
+ * operator-endpoint.ts — the one place this product resolves "the daemon I talk
+ * to", for every seam that talks to it.
+ *
+ * The terminal app is a pure client: it runs its own conversation loop and asks
+ * a separately-running daemon for everything else. Every one of those asks is
+ * an operator verb over HTTP, and every one of them needs the same three
+ * things — is the daemon enabled, what base URL does it answer on, and what
+ * bearer token proves this surface may call it. Resolving that in each seam is
+ * how the old composition ended up with a DirectTransport in one place and a
+ * real fetch in another.
+ *
+ * `resolveOperatorRpc` was previously the command layer's private helper
+ * (input/commands/operator-rpc.ts). It moved here unchanged in behaviour so the
+ * runtime seams — approvals, config, credentials, sessions, fleet, tasks,
+ * devices, checkpoints — reach the daemon through the SAME resolution the
+ * commands already used, and the command module now re-exports it.
+ *
+ * Refusals are values, never throws: a disabled daemon or an underivable base
+ * URL comes back as `{ available: false, reason }` so a caller prints an honest
+ * line instead of guessing. Once a call is made, a non-2xx (including the 404 a
+ * daemon that has not wired a verb returns) throws `GoodVibesSdkError` and
+ * `describeOperatorRpcError` renders it.
+ *
+ * Auth is the loopback file-token bootstrap: the token
+ * is read (or minted) from the daemon's own state directory. A daemon on
+ * another machine is reached by the network-adopt path, which writes that
+ * daemon's bearer into the same file — so this resolution covers both.
+ */
+import { join } from 'node:path';
+import { createGoodVibesSdk } from '@pellux/goodvibes-sdk';
+import type { GoodVibesSdk } from '@pellux/goodvibes-sdk';
+import { GoodVibesSdkError } from '@pellux/goodvibes-sdk';
+import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
+import { resolveDaemonEnabled } from '@pellux/goodvibes-sdk/platform/config';
+import { getOrCreateCompanionToken } from '@pellux/goodvibes-sdk/platform/pairing';
+import type { DaemonVerbCaller } from '@pellux/goodvibes-sdk/platform/runtime/client';
+
+/** Re-exported so this repo's importers keep one import site for the shape
+ * every client seam takes. See the doc comment further down for why
+ * `OperatorRpc`/`OperatorRpcAvailable` (declared below, carrying `sdk`)
+ * structurally satisfy the SDK's `DaemonReachability`, and so `DaemonVerbCaller`
+ * built here still type-checks as the SDK's own. */
+export type { DaemonVerbCaller };
+
+export interface OperatorRpcUnavailable {
+  readonly available: false;
+  readonly reason: string;
+}
+
+export interface OperatorRpcAvailable {
+  readonly available: true;
+  readonly sdk: GoodVibesSdk;
+}
+
+export type OperatorRpc = OperatorRpcUnavailable | OperatorRpcAvailable;
+
+/**
+ * Derive the dial address of the configured control-plane daemon.
+ *
+ * An explicitly declared external address wins; otherwise the URL is DERIVED
+ * from hostMode/host/port/tls.mode. This deliberately does not prefer a stored
+ * `controlPlane.baseUrl`: that key had no writers and so drifted from the bind
+ * on port, scheme, and host at once.
+ */
+export function resolveControlPlaneBaseUrl(configManager: ConfigManager): string | null {
+  const explicit = String(configManager.get('controlPlane.publicBaseUrl' as never) ?? '').trim();
+  if (explicit) return explicit.replace(/\/+$/, '');
+  const host = String(configManager.get('controlPlane.host') ?? '').trim();
+  const port = configManager.get('controlPlane.port');
+  if (host && typeof port === 'number' && port > 0) {
+    const scheme = String(configManager.get('controlPlane.tls.mode') ?? 'off') !== 'off' ? 'https' : 'http';
+    // A wildcard bind is not a dial target; loopback is the interface it answers on.
+    const dialHost = host === '0.0.0.0' || host === '::' ? '127.0.0.1' : host;
+    return `${scheme}://${dialHost.includes(':') && !dialHost.startsWith('[') ? `[${dialHost}]` : dialHost}:${port}`;
+  }
+  return null;
+}
+
+/** The daemon's own state directory — where the shared bearer token lives. */
+export function resolveDaemonStateDirectory(homeDirectory: string): string {
+  return join(homeDirectory, '.goodvibes', 'daemon');
+}
+
+/**
+ * Resolve (or honestly refuse to resolve) an operator SDK client wired to this
+ * workspace's control-plane daemon, from just the two things the resolution
+ * actually needs — the config manager and the home directory.
+ */
+export function resolveOperatorRpc(deps: {
+  readonly configManager: ConfigManager;
+  readonly homeDirectory: string | (() => string);
+}): OperatorRpc {
+  const { configManager } = deps;
+  // A refusal is a VALUE here, never a throw — that is the whole contract of
+  // this function, and callers rely on it to print an honest line rather than
+  // crash a keystroke. A context whose config manager cannot answer (a narrow
+  // embed, a partially-wired test double) is one more case of "no daemon can be
+  // resolved", not an exception to raise from a probe.
+  if (typeof (configManager as { get?: unknown } | null)?.get !== 'function') {
+    return { available: false, reason: 'no config manager is wired here, so no control-plane daemon can be resolved.' };
+  }
+  if (!resolveDaemonEnabled(configManager)) {
+    return { available: false, reason: 'the daemon is disabled (daemon.enabled=false) — no operator surface to reach. Enable it in /settings, then retry.' };
+  }
+  const baseUrl = resolveControlPlaneBaseUrl(configManager);
+  if (!baseUrl) {
+    return { available: false, reason: 'no control-plane base URL is configured (controlPlane.publicBaseUrl / controlPlane.host+port) — cannot reach the operator surface.' };
+  }
+  // Resolve the home directory only AFTER the static refusals — a caller whose
+  // shell paths are not wired (a disabled-daemon path) must still get the honest
+  // unavailable reason above, never a "shell paths not wired" throw.
+  const homeDirectory = typeof deps.homeDirectory === 'function' ? deps.homeDirectory() : deps.homeDirectory;
+  const token = getOrCreateCompanionToken('tui', { daemonHomeDir: resolveDaemonStateDirectory(homeDirectory) }).token;
+  const sdk = createGoodVibesSdk({ baseUrl, authToken: token });
+  return { available: true, sdk };
+}
+
+/**
+ * Render a thrown operator-rpc error honestly: a 404 means this daemon has not
+ * wired a handler for the verb (a live daemon that simply doesn't implement it
+ * yet), never "no result" or a fabricated empty state.
+ */
+export function describeOperatorRpcError(error: unknown): string {
+  if (error instanceof GoodVibesSdkError) {
+    if (error.status === 404) {
+      return 'the connected daemon returned 404 — this operator verb is not wired up on that daemon yet.';
+    }
+    if (error.status === 401 || error.status === 403) {
+      return `the connected daemon rejected the request (${error.status}): ${error.message}`;
+    }
+    return `operator request failed${error.status ? ` (${error.status})` : ''}: ${error.message}`;
+  }
+  return error instanceof Error ? error.message : String(error);
+}
+
+/**
+ * The generic gateway-method route, for a verb the contract carries with a
+ * WEBSOCKET binding only.
+ *
+ * This matters more than it looks. `sdk.operator.invoke` resolves a method's
+ * declared `http` route and refuses — with a contract error, before any request
+ * is made — when the method has none. A large part of what this client needs is
+ * exactly that class: `approvals.raise`, `credentials.set`/`delete`,
+ * `checkpoints.*`, `rewind.*` and the `fleet.*` reads are all `transport: ws`
+ * in the operator contract, with no REST path of their own.
+ *
+ * The daemon serves every catalogued verb over one generic route regardless of
+ * its declared transport, which is what a client that is not holding a
+ * websocket uses. Calling that route directly is not a workaround for a missing
+ * binding: it IS the binding for a ws-declared verb reached over HTTP.
+ */
+async function invokeGatewayMethodOverHttp<T>(
+  rpc: OperatorRpcAvailable,
+  baseUrl: string,
+  authToken: string,
+  methodId: string,
+  input: unknown,
+): Promise<T> {
+  void rpc;
+  const response = await fetch(`${baseUrl}/api/control-plane/methods/${encodeURIComponent(methodId)}/invoke`, {
+    method: 'POST',
+    headers: { Authorization: `Bearer ${authToken}`, 'Content-Type': 'application/json' },
+    // The envelope the route requires: `body` must be PRESENT even when empty,
+    // or the route refuses with a 400 naming the shape it wanted.
+    body: JSON.stringify({ body: input ?? {} }),
+  });
+  const payload = await response.json().catch(() => null) as unknown;
+  if (!response.ok) {
+    const described = payload && typeof payload === 'object' && 'error' in payload
+      ? String((payload as { error: unknown }).error)
+      : `HTTP ${response.status}`;
+    throw new GoodVibesSdkError(`'${methodId}' failed: ${described}`, {
+      // Mapped from the status rather than fixed, so `describeOperatorRpcError`
+      // and every caller that branches on category sees the same classification
+      // it would have seen through the typed client path.
+      category: response.status === 401 || response.status === 403
+        ? 'authorization'
+        : response.status === 404 ? 'not_found' : response.status >= 500 ? 'service' : 'bad_request',
+      source: 'runtime',
+      recoverable: response.status >= 500,
+      status: response.status,
+    });
+  }
+  return payload as T;
+}
+
+export function createDaemonVerbCaller(deps: {
+  readonly configManager: ConfigManager;
+  readonly homeDirectory: string | (() => string);
+}): DaemonVerbCaller {
+  return {
+    probe: () => resolveOperatorRpc(deps),
+    invoke: async <T,>(methodId: string, input?: unknown): Promise<T> => {
+      const rpc = resolveOperatorRpc(deps);
+      if (!rpc.available) throw new Error(`cannot invoke '${methodId}': ${rpc.reason}`);
+      try {
+        return await rpc.sdk.operator.invoke(methodId as never, (input ?? {}) as never) as T;
+      } catch (error) {
+        // A CONTRACT_MISMATCH here means exactly one thing: this verb declares
+        // no HTTP route. That is a routing fact, not a failure of the call, so
+        // it falls through to the generic gateway route rather than surfacing
+        // as "the daemon refused" to a user who did nothing wrong.
+        if (!(error instanceof GoodVibesSdkError) || error.code !== 'CONTRACT_MISMATCH') throw error;
+        const baseUrl = resolveControlPlaneBaseUrl(deps.configManager);
+        if (!baseUrl) throw error;
+        const homeDirectory = typeof deps.homeDirectory === 'function' ? deps.homeDirectory() : deps.homeDirectory;
+        const token = getOrCreateCompanionToken('tui', { daemonHomeDir: resolveDaemonStateDirectory(homeDirectory) }).token;
+        return await invokeGatewayMethodOverHttp<T>(rpc, baseUrl, token, methodId, input);
+      }
+    },
+  };
+}

package/src/runtime/client/spine-adoption.ts

@@ -0,0 +1,99 @@
+/**
+ * spine-adoption.ts — wiring this surface's session and memory spines to the
+ * daemon it adopted, over the SDK's adoption policy.
+ *
+ * ── What moved to the SDK, and what stays here ────────────────────────────
+ *
+ * The SDK's `@pellux/goodvibes-sdk/platform/runtime/client` now owns WHEN the
+ * wire comes up and goes down: idempotent per base URL, torn down on a
+ * change, the one-time legacy-store fold. This module owns WHAT the wire is —
+ * this terminal's own `createHttpTransport` + `createTuiSpineTransport` +
+ * `createTuiMemorySpineTransport`, injected as the SDK's `connect(baseUrl,
+ * authToken)` callback — because building the actual HTTP client is the same
+ * connection-resolution concern the verb caller already keeps product-side.
+ *
+ * `activation: 'adopt-on-status'` is passed explicitly: this terminal gates
+ * adoption on its boot discovery probe's `external` verdict (it can render
+ * "no daemon" honestly), rather than wiring live-immediately the moment it is
+ * handed a base URL.
+ *
+ * ── What crosses the wire ──────────────────────────────────────────────────
+ *
+ * Session IDENTITY, not session execution. The conversation itself runs here;
+ * what the daemon holds is the register —
+ * which sessions exist, which surface is live on each, and the inputs queued
+ * against them. Concretely, on adoption this wires:
+ *
+ *   - `sessions.register` / `sessions.close` — the identity mirror, deliberately
+ *     fire-and-forget so a slow daemon never shows up in a keystroke.
+ *   - `sessions.inputs.list` / `sessions.inputs.deliver` — the inbound steer
+ *     path, so a message another surface queued for THIS session lands in the
+ *     turn machinery here and is acknowledged on the wire.
+ *   - `sessions.list` — the cross-surface union the panels read, interval-
+ *     refreshed and served synchronously.
+ *   - the memory spine's wire transport, folded into the same handler by the
+ *     SDK — this module's own `syncMemorySpineToHostStatus` call is retired;
+ *     supplying `memoryTransport` in the bundle and `memorySpine` in the
+ *     options is what activates it now.
+ *
+ * Plus a one-time, marker-guarded fold of this project's own pre-spine
+ * `control-plane/sessions.json` into the adopted daemon, done by the SDK.
+ *
+ * ── Why this module's exported shape does not change ──────────────────────
+ *
+ * `bootstrap.ts` gates on `HostServiceStatus` and hands a bare
+ * `(daemonStatus, sharedDaemonToken)` pair to whatever this returns. The SDK's
+ * handler takes a narrower `{ mode, baseUrl }` signal instead, so the adapting
+ * happens inside this module rather than at the call site.
+ */
+import { createHttpTransport, type HostServiceStatus } from '@/runtime/index.ts';
+import { createSpineAdoptionSync as createSdkSpineAdoptionSync } from '@pellux/goodvibes-sdk/platform/runtime/client';
+import type { SpineAdoptionOptions as SdkSpineAdoptionOptions } from '@pellux/goodvibes-sdk/platform/runtime/client';
+
+import { createTuiSpineTransport, type SpineSessionsClient } from '../session-spine-transport.ts';
+import { createTuiMemorySpineTransport } from '../memory-spine-transport.ts';
+
+/** This module's own options: the SDK's shape minus the two fields it builds itself. */
+export type SpineAdoptionOptions = Omit<SdkSpineAdoptionOptions, 'connect' | 'activation'>;
+
+/**
+ * Build the "the adopted daemon changed" handler.
+ *
+ * Idempotent per base URL (the SDK's own guarantee): re-running it against the
+ * same adopted daemon is a no-op, so a re-probe after an autostart does not
+ * tear a live mirror down and put it back up.
+ */
+export function createSpineAdoptionSync(
+  options: SpineAdoptionOptions,
+): (daemonStatus: HostServiceStatus, sharedDaemonToken: string) => void {
+  const sync = createSdkSpineAdoptionSync({
+    ...options,
+    // This terminal has a boot discovery probe and can render "no daemon"
+    // honestly, so it gates on the probe's verdict rather than wiring the
+    // moment it is handed a base URL.
+    activation: 'adopt-on-status',
+    connect: (baseUrl, authToken) => {
+      const httpTransport = createHttpTransport({ baseUrl, authToken });
+      const sessionsClient: SpineSessionsClient = {
+        register: (input) => httpTransport.operator.sessions.register(input),
+        close: (sessionId) => httpTransport.operator.sessions.close(sessionId),
+      };
+      return {
+        sessionTransport: createTuiSpineTransport(sessionsClient),
+        inboundInputs: {
+          listInputs: async (sessionId, opts) => ({
+            inputs: await httpTransport.operator.sessions.inputs(sessionId, opts.limit, { state: opts.state, since: opts.since }),
+          }),
+          deliverInput: (sessionId, inputId, opts) =>
+            httpTransport.operator.sessions.deliverInput(sessionId, inputId, opts),
+        },
+        sessionList: { list: (limit: number) => httpTransport.operator.sessions.list(limit) },
+        memoryTransport: createTuiMemorySpineTransport({ baseUrl, authToken }),
+      };
+    },
+  });
+
+  return (daemonStatus, sharedDaemonToken) => {
+    sync({ mode: daemonStatus.mode, baseUrl: daemonStatus.baseUrl }, sharedDaemonToken);
+  };
+}

package/src/runtime/cloudflare-control-plane.ts

@@ -1,6 +1,6 @@
 import { join } from 'node:path';
 import { getOrCreateCompanionToken } from '@pellux/goodvibes-sdk/platform/pairing';
-import type { ConfigManager } from '../config/index.ts';
+import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
 
 export const CLOUDFLARE_COMPONENT_IDS = [
   'workers',

package/src/runtime/context-accounting-source.ts

@@ -1,4 +1,4 @@
-import type { Orchestrator } from '../core/orchestrator.ts';
+import type { Orchestrator } from '@pellux/goodvibes-sdk/platform/core';
 import type { ProviderRegistry } from '@pellux/goodvibes-sdk/platform/providers';
 import type { SessionLineageTracker } from '@pellux/goodvibes-sdk/platform/core';
 import type { ContextAccountingSource } from '@pellux/goodvibes-sdk/platform/tools';

package/src/runtime/context.ts

@@ -6,7 +6,7 @@
  * the runtime loop.
  */
 import type { ConversationManager } from '../core/conversation';
-import type { Orchestrator } from '../core/orchestrator';
+import type { Orchestrator } from '@pellux/goodvibes-sdk/platform/core';
 import type { ToolRegistry } from '@pellux/goodvibes-sdk/platform/tools';
 import type { PermissionManager } from '@pellux/goodvibes-sdk/platform/permissions';
 import type { HookDispatcher } from '@pellux/goodvibes-sdk/platform/hooks';
@@ -19,7 +19,7 @@ import type { FeatureFlagManager } from '@/runtime/index.ts';
 import type { MutableRuntimeState } from '@/runtime/index.ts';
 import type { SessionSnapshot } from '@/runtime/index.ts';
 import type { RuntimeServices } from './services.ts';
-import type { ComponentHealthMonitor } from './perf/panel-health-monitor.ts';
+import type { ComponentHealthMonitor } from '@pellux/goodvibes-sdk/platform/runtime/observability';
 import type { WorktreeRegistry } from '@/runtime/index.ts';
 import type { SandboxSessionRegistry } from '@/runtime/index.ts';
 

package/src/runtime/conversation-rewind-port.ts

@@ -11,11 +11,22 @@
 // for the anchor's turnId at TURN_COMPLETED (rewind-turn-anchors.ts) — the same
 // join key files rewind uses against the workspace checkpoint.
 //
-// This module is the single implementation of that port for the TUI, consumed by
-// BOTH the in-process /rewind command (bound to one session's conversation) and
-// the composed daemon's rewind.plan/apply verbs (resolving the live conversation
-// per anchor.sessionId from the registry below), so the truncation semantics
-// cannot drift between the two surfaces.
+// This module is the single implementation of that port for the TUI, and it has
+// two consumers again — but the second one reaches it differently now.
+//
+// It used to be the composed daemon's own rewind.plan/apply verbs, resolving a
+// conversation out of the registry below because the daemon was this process.
+// It is not any more. FILES rewind still works from anywhere (the workspace
+// checkpoint store is the daemon's), but the messages live in whichever process
+// runs the loop, and for a while a rewind driven from another surface got a
+// confident "0 messages to drop" from a daemon registry nothing could populate.
+//
+// The daemon now ASKS. This surface offers the conversation it is holding
+// (rewind.conversation.host.register), takes the questions the daemon puts to it
+// and answers them (the SDK's client/conversation-rewind-host.ts); this port is what
+// produces those answers. So conversation rewind works from any surface, and a
+// session nobody has offered is reported unavailable with the reason rather
+// than as a zero that cannot be told apart from a real one.
 // ---------------------------------------------------------------------------
 
 import type {
@@ -25,7 +36,7 @@ import type {
   RewindConversationPreview,
 } from '@pellux/goodvibes-sdk/platform/rewind';
 import type { ConversationManager } from '../core/conversation.ts';
-import { resolveTurnAnchor } from '../core/rewind-turn-anchors.ts';
+import { resolveTurnAnchor } from '@pellux/goodvibes-sdk/platform/rewind';
 
 type ConversationJson = Parameters<ConversationManager['fromJSON']>[0];
 
@@ -101,10 +112,13 @@ export function createConversationRewindPort(
 }
 
 // ---------------------------------------------------------------------------
-// Live per-session conversation registry — the daemon-hosted mutable store the
-// composed daemon's rewind.plan/apply verbs resolve conversations from. The TUI
-// registers its active session's ConversationManager at bootstrap; a session
-// with no registration reports conversation rewind as "nothing to drop".
+// Live per-session conversation registry.
+//
+// This process's conversations, by session id. Two readers now: the local
+// /rewind command, and the host loop that answers the DAEMON's questions about
+// a session this surface is running (the SDK's client/conversation-rewind-host.ts) —
+// which is what makes conversation rewind work from any surface again, since
+// only the process holding the messages can count or drop them.
 // ---------------------------------------------------------------------------
 
 const liveConversations = new Map<string, ConversationManager>();
@@ -120,10 +134,24 @@ export function unregisterSessionConversation(sessionId: string): void {
 }
 
 /**
- * The conversation rewind port the composed daemon threads into
- * registerGatewayVerbGroups — it resolves each anchor's live conversation from
- * the registry above, so the daemon's own rewind verbs serve conversation scope
- * live in this process.
+ * Whether this process is actually holding a session's conversation right now.
+ *
+ * The port below answers "nothing to drop" for a session it cannot resolve,
+ * which is the right degrade for a LOCAL /rewind (there is nothing to truncate
+ * here). It is the wrong answer for a rewind driven from another surface: a
+ * confident zero is indistinguishable from a real zero, and that is exactly the
+ * failure the surface-hosted rewind contract exists to end. The host loop
+ * (the SDK's client/conversation-rewind-host.ts) checks this first and answers
+ * `unavailable` with a reason instead.
+ */
+export function hasSessionConversation(sessionId: string): boolean {
+  return liveConversations.has(sessionId);
+}
+
+/**
+ * The port that answers for whichever of this process's conversations an anchor
+ * names. Used by the local /rewind command and, through the host loop, by the
+ * daemon when a rewind driven from anywhere touches a session running here.
  */
 export function createSessionConversationRewindPort(): ConversationRewindPort {
   return createConversationRewindPort((sessionId) => liveConversations.get(sessionId) ?? null);

package/src/runtime/daemon-attach-notices.ts

@@ -11,7 +11,8 @@
  * for the embedded daemon.
  */
 import { FeatureAnnouncementStore, featureAnnouncementsPath, createSandboxContainmentAnnouncer } from '@pellux/goodvibes-sdk/platform/runtime/feature-announcements';
-import type { ConfigManager } from '../config/index.ts';
+import { readClientCompatibilityFloor } from '@pellux/goodvibes-sdk/platform/control-plane';
+import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
 
 /** A daemon receipt line (already a human one-liner, e.g. "restarted after a crash at 14:32"). */
 export interface DaemonReceiptLike {
@@ -51,43 +52,73 @@ export function consumeDaemonAttachNotices(deps: DaemonAttachNoticesDeps): strin
   return notices;
 }
 
-/** Milliseconds an external-daemon receipts read waits before giving up. */
+/** Milliseconds an external-daemon `/status` read waits before giving up. */
 const EXTERNAL_RECEIPTS_TIMEOUT_MS = 1500;
 
-export interface ExternalDaemonAttachNoticesDeps {
+export interface ExternalDaemonAttachReadDeps {
   /** The adopted daemon's base URL, e.g. "http://127.0.0.1:3421". */
   readonly baseUrl: string;
   /** The shared bearer the adopted daemon authenticates (the companion-pairing token). */
   readonly authToken: string;
+  /**
+   * Ask for the daemon's undelivered receipts on this read. Delivery at the
+   * daemon is destructive — served once, to the consuming reader — so only the
+   * read that RENDERS them asks. A reconnect read that just refreshes the two
+   * build floors leaves this off, and no receipt is eaten before a surface can
+   * show it.
+   */
+  readonly consumeReceipts?: boolean;
   /** Injectable fetch for tests; defaults to the global fetch. */
   readonly fetchImpl?: typeof fetch;
   /** Injectable timeout (ms); defaults to EXTERNAL_RECEIPTS_TIMEOUT_MS. */
   readonly timeoutMs?: number;
 }
 
+/** Everything one `/status` read of an adopted daemon tells this terminal. */
+export interface ExternalDaemonAttachRead {
+  /** True only when the daemon answered with a usable 2xx body. */
+  readonly answered: boolean;
+  /** Receipt lines to render; empty unless `consumeReceipts` was asked for. */
+  readonly notices: string[];
+  /**
+   * The minimum CLIENT build the daemon announced on the
+   * `X-Goodvibes-Client-Floor` response header, or undefined when it announced
+   * none (a daemon too old to publish one is not asking for anything).
+   */
+  readonly clientFloor: string | undefined;
+  /** The parsed body, which carries the daemon's own `version`. */
+  readonly statusPayload: unknown;
+}
+
 /**
- * Consume — exactly once — a separately-hosted (external/systemd) daemon's
- * undelivered receipts AND drained announcements over HTTP, returning the
- * one-line notices to render. The default deployment adopts such a daemon with
- * no in-process handle (daemonServer is null), so the embedded in-process fold
- * sees nothing; this hits the daemon's own consuming endpoint instead —
- * GET <baseUrl>/status?receipts=consume with the shared bearer. The daemon
- * marks the served receipts delivered as it responds (its own exactly-once
- * store), so a second attach with nothing new returns []. Any transport, auth,
- * or parse failure yields no notices rather than throwing into the attach path.
+ * One `/status` read of a separately-hosted (external/systemd) daemon, carrying
+ * the three things attaching to it decides on: its undelivered receipts, the
+ * client build floor it publishes, and its own build.
+ *
+ * The default deployment adopts such a daemon with no in-process handle
+ * (daemonServer is null), so the embedded in-process fold sees nothing; this
+ * hits the daemon's own endpoint instead — GET <baseUrl>/status with the shared
+ * bearer, plus `?receipts=consume` when the caller is going to render them. The
+ * daemon marks the served receipts delivered as it responds (its own
+ * exactly-once store), so a second attach with nothing new returns no notices.
+ * Any transport, auth, or parse failure reads as unanswered rather than
+ * throwing into the attach path.
  */
-export async function consumeExternalDaemonAttachNotices(
-  deps: ExternalDaemonAttachNoticesDeps,
-): Promise<string[]> {
+export async function readExternalDaemonAttach(
+  deps: ExternalDaemonAttachReadDeps,
+): Promise<ExternalDaemonAttachRead> {
+  const unanswered: ExternalDaemonAttachRead = {
+    answered: false, notices: [], clientFloor: undefined, statusPayload: null,
+  };
   const fetchImpl = deps.fetchImpl ?? fetch;
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), deps.timeoutMs ?? EXTERNAL_RECEIPTS_TIMEOUT_MS);
   try {
     const headers = new Headers();
     if (deps.authToken.trim()) headers.set('Authorization', `Bearer ${deps.authToken.trim()}`);
-    const url = `${deps.baseUrl.replace(/\/+$/, '')}/status?receipts=consume`;
+    const url = `${deps.baseUrl.replace(/\/+$/, '')}/status${deps.consumeReceipts ? '?receipts=consume' : ''}`;
     const response = await fetchImpl(url, { headers, signal: controller.signal });
-    if (!response.ok) return [];
+    if (!response.ok) return unanswered;
     const body = (await response.json()) as { receipts?: unknown } | null;
     const receipts = Array.isArray(body?.receipts) ? body.receipts : [];
     const notices: string[] = [];
@@ -97,9 +128,14 @@ export async function consumeExternalDaemonAttachNotices(
         if (text.trim().length > 0) notices.push(text);
       }
     }
-    return notices;
+    return {
+      answered: true,
+      notices,
+      clientFloor: readClientCompatibilityFloor(response.headers),
+      statusPayload: body,
+    };
   } catch {
-    return [];
+    return unanswered;
   } finally {
     clearTimeout(timer);
   }

package/src/runtime/diagnostics/panels/ops.ts

@@ -13,7 +13,7 @@ import type { PanelConfig } from '@/runtime/index.ts';
 import { DEFAULT_PANEL_CONFIG, appendBounded, applyFilter } from '@/runtime/index.ts';
 import type { DiagnosticFilter } from '@/runtime/index.ts';
 import type { OpsInterventionReason, OpsEvent } from '@/runtime/index.ts';
-import type { UiEventFeed } from '../../ui-events.ts';
+import type { UiEventFeed } from '@/runtime/index.ts';
 
 // ---------------------------------------------------------------------------
 // Audit entry

package/src/runtime/disposal-wiring.ts

@@ -46,21 +46,6 @@ export interface SurfaceRuntimePollerOwners extends Omit<RuntimePollerOwners, 's
    * teardown path to have no way to stop it.
    */
   readonly stopWakeHousekeeping: () => void;
-  /**
-   * Fork-only: the daemon handler surfaces (daemon-handler-composition.ts).
-   *
-   * `unregister()` detaches the gateway handlers AND stops the two pollers this
-   * product's inbox surface owns — the retention sweep inside `InboxCursorStore`
-   * and the per-provider `InboundPoller` intervals. The SDK does not know either
-   * exists, so if this surface does not stop them nothing does.
-   */
-  readonly daemonHandlers: { readonly unregister: () => void };
-  /**
-   * Fork-only: the paired-phone feature's housekeeping timer
-   * (device-posture-composition.ts). Started by whichever entry point boots the
-   * host, so the stop belongs on this list rather than in one shutdown path.
-   */
-  readonly devicePosture: { readonly stopHousekeeping: () => void };
 }
 
 /**
@@ -86,14 +71,9 @@ export function registerSurfaceRuntimePollers(
 ): void {
   registerRuntimePollers(registry, { ...services, stopConfigWatch: extras.stopConfigWatch });
   registry.add('durability housekeeping', services.stopDurabilityHousekeeping);
-  registry.add('device housekeeping', () => services.devicePosture.stopHousekeeping());
   registry.add('wake-word housekeeping', services.stopWakeHousekeeping);
-  // Registered LAST so it tears down FIRST (the scope unwinds in reverse), which
-  // is the order daemon/cli.ts already used by hand: release the handler surfaces
-  // — closing the inbox store and stopping its poll timers — before the pollers
-  // the rest of the graph owns. Being on this list is what makes a plain
-  // `dispose()` total: every shutdown path (daemon/cli.ts, main.ts's teardown
-  // registry, the one-shot CLI commands) now stops these two, not just the one
-  // that remembered to call `unregister()` itself.
-  registry.add('daemon handler surfaces', () => services.daemonHandlers.unregister());
+  // The inbox surfaces and the device-posture housekeeping used to be stopped
+  // here too. Both moved to the daemon product with the runtimes that started
+  // them: nothing in this process polls a mailbox or reaps a device grant any
+  // more, so there is nothing left here to stop.
 }