@pellux/goodvibes-tui 1.27.1 → 2.0.2

package/src/runtime/cluster-group-composition.ts

@@ -1,284 +0,0 @@
-/**
- * cluster-group-composition.ts — this machine's membership of a LAN group.
- *
- * Leader election answers "which of us reads the inbox". This answers the
- * question underneath it: "which machines are US". Without a group, any daemon
- * that happened to be on the same network — a neighbour's, a colleague's, a
- * container someone left running — would join the same coordination and one of
- * you would silently stop receiving messages.
- *
- * The group layer owns the socket and the election rides on it: every
- * coordination datagram is wrapped in the group envelope and signed with the
- * current group key, so a datagram from outside the group never reaches the
- * election at all. That is why `createClusterComposition` is handed a transport
- * from here instead of opening one of its own.
- *
- * Key material lives ONLY in the encrypted secrets store. Never in config,
- * never in a log line, never in `/status`.
- */
-import {
-  ClusterGroupRuntime,
-  createClusterGroupVerbs,
-  createSystemClusterClock,
-  readClusterSettings,
-  rejoinGroup,
-  resolveClusterGroupSettings,
-  resolveNodeIdentity,
-  stillOnRoster,
-  UdpClusterTransport,
-  type ClusterGroupVerbSurface,
-  type ClusterSurfaceHolding,
-  type GroupOperationsContext,
-} from '@pellux/goodvibes-sdk/platform/cluster';
-import type { ConfigManager, SecretsManager } from '@pellux/goodvibes-sdk/platform/config';
-import type { ClusterTransport } from '@pellux/goodvibes-sdk/platform/cluster';
-import { logger } from '@pellux/goodvibes-sdk/platform/utils';
-import type { ShellPathService } from '@/runtime/index.ts';
-import { createClusterComposition } from './cluster-composition.ts';
-import type { ClusterCoordinator } from '@pellux/goodvibes-sdk/platform/cluster';
-import { GOODVIBES_TUI_SURFACE_ROOT } from '../config/surface.ts';
-import { VERSION } from '../version.ts';
-
-export interface ClusterGroupComposition {
-  readonly runtime: ClusterGroupRuntime;
-  readonly verbs: ClusterGroupVerbSurface;
-  /** The transport the leader election must use, so its traffic is group-signed. */
-  readonly electionTransport: ClusterTransport;
-  /** Start the group layer. Safe to call more than once. */
-  start(): Promise<void>;
-  stop(): Promise<void>;
-}
-
-/**
- * A label for THIS machine in the member list.
- *
- * Deliberately NOT the hostname. The roster replicates to every member and the
- * group name reaches the network in a beacon, so defaulting to a hostname would
- * quietly publish "mikes-laptop" to anything listening. A short slice of the
- * node id is meaningless and safe, and `cluster nodes` shows it plainly so an
- * operator who wants a real name can see there is one to set.
- */
-function defaultNodeDisplayName(nodeId: string): string {
-  return `machine ${nodeId.slice(0, 8)}`;
-}
-
-/**
- * Build the group layer.
- *
- * Constructing it is inert: no socket is opened and no key material is read
- * until `start()`, so composing a runtime in a test never touches the network
- * or the secrets store.
- */
-export function createClusterGroupComposition(options: {
-  readonly configManager: ConfigManager;
-  readonly shellPaths: ShellPathService;
-  readonly secretsManager: SecretsManager;
-  /**
-   * The leader election's own answer to "am I the master".
-   *
-   * Config replication needs exactly one machine issuing revisions, and it must
-   * be the SAME machine leadership already picked — two notions of master in
-   * one process would disagree the moment one of them changed.
-   *
-   * Late-bound because the coordinator is built from this composition's
-   * transport: it does not exist yet when this function runs.
-   */
-  readonly isMaster?: (() => boolean) | undefined;
-  /**
-   * Which surfaces this machine currently holds, and why.
-   *
-   * The per-surface election establishes this; the group layer only reports it,
-   * in `cluster status` and in /status. Late-bound for the same reason
-   * `isMaster` is. Absent means the group layer reports that the information is
-   * unavailable rather than reporting an empty list as though this machine held
-   * nothing — a distinction an operator diagnosing a silent inbox depends on.
-   */
-  readonly surfaceHoldings?: (() => readonly ClusterSurfaceHolding[]) | undefined;
-}): ClusterGroupComposition {
-  const settings = readClusterSettings(options.configManager);
-  const groupSettings = resolveClusterGroupSettings(
-    (options.configManager as { getCategory?: (name: string) => unknown }).getCategory?.('cluster'),
-  );
-  // Surface-scoped, alongside the election's node identity and this surface's
-  // other durable state.
-  const stateDirectory = options.shellPaths.resolveProjectPath(GOODVIBES_TUI_SURFACE_ROOT, 'cluster');
-  const nodeId = resolveNodeIdentity({ stateDirectory, logger }).nodeId;
-
-  const runtime = new ClusterGroupRuntime({
-    settings: groupSettings,
-    transport: new UdpClusterTransport({
-      port: settings.port,
-      multicastGroup: settings.multicastGroup,
-      peers: settings.peers,
-      logger,
-    }),
-    // Narrower than the SecretsManager itself: the group layer gets get/set/
-    // delete on one key and nothing else.
-    secrets: {
-      get: (key) => options.secretsManager.get(key),
-      set: (key, value) => options.secretsManager.set(key, value),
-      delete: (key) => options.secretsManager.delete(key),
-    },
-    stateDirectory,
-    nodeId,
-    nodeDisplayName: defaultNodeDisplayName(nodeId),
-    version: VERSION,
-    clock: createSystemClusterClock(),
-    logger,
-    ...(options.isMaster ? { isMaster: options.isMaster } : {}),
-    ...(options.surfaceHoldings ? { surfaceHoldings: options.surfaceHoldings } : {}),
-    // Only daemon-owned, group-scoped keys ever reach this; the SDK's
-    // replication policy decides which, and refuses anything machine-specific.
-    config: {
-      get: (path) => (options.configManager as unknown as {
-        get(key: string): unknown;
-      }).get(path),
-      set: (path, value) => (options.configManager as unknown as {
-        set(key: string, value: unknown): void;
-      }).set(path, value),
-    },
-  });
-
-  const context: GroupOperationsContext = {
-    runtime,
-    secrets: {
-      get: (key) => options.secretsManager.get(key),
-      set: (key, value) => options.secretsManager.set(key, value),
-      delete: (key) => options.secretsManager.delete(key),
-    },
-    settings: groupSettings,
-    nodeId,
-    nodeDisplayName: defaultNodeDisplayName(nodeId),
-    version: VERSION,
-    now: () => Date.now(),
-  };
-
-  let started = false;
-  return {
-    runtime,
-    verbs: createClusterGroupVerbs(context),
-    electionTransport: runtime.electionTransport(),
-    start: async () => {
-      if (started) return;
-      started = true;
-      await runtime.start();
-      await announceReturn(runtime, context, nodeId);
-    },
-    stop: async () => {
-      started = false;
-      await runtime.stop();
-    },
-  };
-}
-
-/**
- * Build both halves of the LAN cluster, wired to each other.
- *
- * They are mutually dependent and the dependency runs both ways, which is why
- * this exists rather than two calls at the composition root: the election
- * coordinates over the GROUP's transport, and the group's config replication
- * needs the ELECTION's answer to "am I the master". The master signal is read
- * through a closure because the coordinator does not exist yet when the group
- * layer is constructed.
- *
- * Constructing either is inert — no socket, no key material read — until
- * `startCluster` runs.
- */
-export function createClusterServices(options: {
-  readonly configManager: ConfigManager;
-  readonly shellPaths: ShellPathService;
-  readonly secretsManager: SecretsManager;
-}): { readonly clusterGroup: ClusterGroupComposition; readonly clusterCoordinator: ClusterCoordinator } {
-  let coordinator: ClusterCoordinator | null = null;
-  const clusterGroup = createClusterGroupComposition({
-    ...options,
-    isMaster: () => coordinator?.isMaster ?? false,
-    // The elections actually running are the only honest source for this, so
-    // the group layer reads them rather than keeping a second tally that could
-    // disagree. Before the coordinator exists there is nothing to report, and
-    // an empty list is the truthful answer at that point: no election has been
-    // held, so this machine holds nothing.
-    surfaceHoldings: () => coordinator?.surfaceHoldings() ?? [],
-  });
-  coordinator = createClusterComposition({
-    configManager: options.configManager,
-    shellPaths: options.shellPaths,
-    transport: clusterGroup.electionTransport,
-  });
-  return { clusterGroup, clusterCoordinator: coordinator };
-}
-
-/**
- * Start the LAN cluster, in the order it has to be started in.
- *
- * The group layer FIRST: it owns the socket the leader election coordinates
- * over, and starting the election against a transport whose group is not yet
- * loaded would sign its first datagrams with nothing. Both calls are
- * idempotent, so a composition root that reaches this twice is fine.
- */
-export async function startClusterServices(services: {
-  readonly clusterGroup: Pick<ClusterGroupComposition, 'start'>;
-  readonly clusterCoordinator: { start(): Promise<void> };
-}): Promise<void> {
-  await services.clusterGroup.start();
-  await services.clusterCoordinator.start();
-}
-
-/**
- * Ask the group to take this machine back, on start.
- *
- * This is the zero-touch return. A machine that has been switched off for
- * months — through many group-key rotations and possibly a join-key change —
- * comes up holding stale keys, says "it is still me" with a key that never
- * rotates, and is re-keyed to the current generation by whichever member
- * answers. The operator does nothing.
- *
- * It runs only when this machine still believes it is on the roster. A machine
- * that was REMOVED asks for nothing: it would be refused, and asking anyway
- * would put a pointless refusal in everyone's logs every time it started.
- */
-async function announceReturn(
-  runtime: ClusterGroupRuntime,
-  context: GroupOperationsContext,
-  nodeId: string,
-): Promise<void> {
-  if (runtime.membership !== 'member') return;
-  if (!stillOnRoster(runtime.groupState, nodeId)) return;
-  const result = await rejoinGroup(context);
-  if (result.ok) {
-    logger.info('cluster: rejoined the group and took the current group key', {
-      group: result.data.groupName,
-      members: result.data.memberCount,
-    });
-    return;
-  }
-  if (result.terminal) {
-    // A member refused this machine and proved it was a member when it did.
-    // Retrying will never succeed, so this is not a quiet debug line: without
-    // it the operator sees a healthy daemon that is simply never given any
-    // work, with nothing anywhere saying why. Stated at ERROR with the command
-    // that fixes it, the same standard a surface this node cannot serve is
-    // held to.
-    logger.error('cluster: this machine is no longer in its group and will not be given work', {
-      reason: result.error,
-      action: result.fix,
-    });
-    return;
-  }
-  if (result.failure === 'unverifiable-replies') {
-    // Something answered and none of it could be authenticated. This machine
-    // cannot tell a removal it slept through from a stranger making noise, so
-    // it says exactly that and does not assert either. WARN rather than ERROR
-    // for the same reason: anything on the network can produce this, and a
-    // machine that shouted "you were removed" on cue would be worse than one
-    // that stayed quiet.
-    logger.warn('cluster: replies to this machine\'s return could not be authenticated', {
-      reason: result.error,
-      action: result.fix,
-    });
-    return;
-  }
-  // Not an error. A machine that starts first, or is alone on the network, has
-  // nobody to answer it and carries on with the keys it already holds.
-  logger.debug('cluster: no other machine answered the return announcement', { reason: result.error });
-}

package/src/runtime/code-index-services.ts

@@ -1,167 +0,0 @@
-// ---------------------------------------------------------------------------
-// code-index-services.ts — repo source-tree code index (TUI wiring)
-//
-// Constructs the TUI's repo source-tree code index: CodeIndexStore
-// (@pellux/goodvibes-sdk/platform/state). Extracted into its own module rather than built inline in
-// services.ts: services.ts sits at the architecture check's 800-line cap
-// (scripts/check-architecture.ts), so any new service gets its own
-// construction module and a single wiring call there (mirrors
-// createWorkstreamServices's one-function-bundle shape).
-//
-// Schema-initialized eagerly (mirrors memoryStore: construction + init()
-// happen unconditionally so the store is queryable — /codebase status, the
-// fleet node — even before any build has ever run). The actual walk/chunk/
-// embed build is NEVER auto-triggered by default: the hundreds of existing
-// test fixtures (and every headless invocation) construct RuntimeServices
-// without asking for a full source-tree walk, and init() alone never runs
-// one (mirrors the SDK's own RuntimeServices wiring in
-// platform/runtime/services.ts, which gates its equivalent scheduleBuild()
-// call behind an explicit autoStartCodeIndex option).
-//
-// REALITY-WINS DIVERGENCE from the SDK's own shape: the SDK's
-// RuntimeServicesOptions exposes autoStartCodeIndex as a constructor-time
-// boolean because that call site is a library entrypoint threaded by each
-// embedder. This TUI's createRuntimeServices has no such per-call knob —
-// auto-start is decided from a TUI-local config key instead
-// (CODE_INDEX_ENABLED_CONFIG_KEY, default OFF), so every construction path
-// (interactive main.ts, the daemon, and every test fixture) shares one
-// honest, user-visible on/off switch rather than needing to thread a new
-// boolean through every call site. With it off (the default), `/codebase
-// build` is the explicit, visible trigger — exactly the shape this design
-// asks for.
-//
-// Shares memoryEmbeddingRegistry with MemoryStore (constructed in
-// services.ts) so code + memory retrieval use one embedding provider and one
-// dimensionality, per the SDK design doc (code-index-store.ts's constructor
-// takes the SAME MemoryEmbeddingProviderRegistry instance memory uses).
-// ---------------------------------------------------------------------------
-
-import { join } from 'node:path';
-import { CodeIndexStore, CodeIndexReindexScheduler } from '@pellux/goodvibes-sdk/platform/state';
-import type { MemoryEmbeddingProviderRegistry } from '@pellux/goodvibes-sdk/platform/state';
-import type { ConfigKey, ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
-import { readBooleanConfig } from '../core/alert-gating.ts';
-
-/**
- * TUI-local synthetic config key (not yet in the SDK's ConfigKey union) that
- * gates the code index's auto-build on construction. Default OFF — see this
- * module's header doc. Surfaced in /config via a synthetic entry
- * (settings-modal-data.ts) exactly like behavior.notifyAfterSeconds.
- */
-export const CODE_INDEX_ENABLED_CONFIG_KEY = 'storage.codeIndexEnabled';
-
-/**
- * Honest, generous bounds passed EXPLICITLY to CodeIndexStore (values equal
- * to its own internal defaults) so /codebase status and the settings
- * description can state them in one place without reaching into store
- * internals or duplicating magic numbers.
- */
-export const CODE_INDEX_MAX_FILES = 5000;
-export const CODE_INDEX_MAX_FILE_BYTES = 512 * 1024;
-export const CODE_INDEX_MAX_TOTAL_BYTES = 256 * 1024 * 1024;
-
-export interface CodeIndexServicesDeps {
-  readonly workingDirectory: string;
-  readonly configManager: Pick<ConfigManager, 'get'>;
-  readonly memoryEmbeddingRegistry: MemoryEmbeddingProviderRegistry;
-  /**
-   * Memory-governor backpressure (optional): when the governor pauses the
-   * 'code-index-reindex' job, the tool-site reindex scheduler stops scheduling
-   * new work; the critical tier refuses new reindex work outright via
-   * admitExpensiveWork. Absent (most test fixtures) → never paused, always
-   * admitted, exactly as before.
-   */
-  readonly isReindexPaused?: (() => boolean) | undefined;
-  readonly admitExpensiveWork?: ((label: string) => { allowed: boolean; reason?: string | undefined }) | undefined;
-}
-
-/**
- * Whether code auto-injection / tool-site reindex may run: the SAME
- * storage.codeIndexEnabled switch that gates auto-build. Read live so a runtime
- * /config toggle takes effect without restart. (The separate, default-off
- * `agent-passive-code-injection` feature flag gates injection additionally; this
- * is only the storage-side setting the SDK asks embedders to respect.)
- */
-export function isCodeInjectionSettingEnabled(configManager: Pick<ConfigManager, 'get'>): boolean {
-  return isCodeIndexAutoStartEnabled(configManager);
-}
-
-export interface CodeIndexServices {
-  readonly codeIndexStore: CodeIndexStore;
-  /**
-   * Tool-site incremental reindex scheduler, bound to codeIndexStore and
-   * gated live on storage.codeIndexEnabled. Threaded into both SDK orchestrators (main +
-   * agent) so a successful write/edit debounces an incremental reindex, and into the command
-   * context so /codebase status can report the last reindex activity honestly.
-   */
-  readonly codeIndexReindexScheduler: CodeIndexReindexScheduler;
-}
-
-/** Absolute path to the TUI's code-index sqlite file, sibling to memory.sqlite under .goodvibes/tui/. */
-export function codeIndexDbPath(workingDirectory: string): string {
-  return join(workingDirectory, '.goodvibes', 'tui', 'code-index.sqlite');
-}
-
-/**
- * Build the runtime's `rerootStores` implementation — called by
- * WorkspaceSwapManager after it has verified a new working directory.
- *
- * Only working-tree-bound stores move. The memory store is deliberately NOT
- * rerooted: it is the home-scoped canonical cross-surface store, and moving
- * it per project would re-silo memory back into the per-project stores that
- * were consolidated away.
- */
-export function createStoreRerooter(deps: {
-  readonly codeIndexStore: Pick<CodeIndexStore, 'reroot'>;
-  readonly projectIndex: { reroot(dir: string): Promise<unknown> };
-}): (newWorkingDir: string) => Promise<void> {
-  return async (newWorkingDir: string): Promise<void> => {
-    await deps.codeIndexStore.reroot(newWorkingDir, codeIndexDbPath(newWorkingDir));
-    await deps.projectIndex.reroot(newWorkingDir);
-  };
-}
-
-/**
- * Whether the code index's initial build should auto-start on construction.
- * Exported so /codebase status and the settings modal read the exact same
- * config key + default this module decides auto-start from.
- */
-export function isCodeIndexAutoStartEnabled(configManager: Pick<ConfigManager, 'get'>): boolean {
-  return readBooleanConfig(
-    (key) => configManager.get(key as ConfigKey),
-    CODE_INDEX_ENABLED_CONFIG_KEY,
-    false,
-  );
-}
-
-/**
- * Constructs the TUI's CodeIndexStore. Schema-init runs unconditionally
- * (init() never throws — it degrades to an honest `available: false` +
- * recorded error on failure, mirrored by CodeIndexStats/describeDegradation);
- * the initial full build only fires when isCodeIndexAutoStartEnabled() is
- * true, via the SAME fire-and-forget scheduleBuild() an explicit
- * `/codebase build` invocation uses.
- */
-export function createCodeIndexServices(deps: CodeIndexServicesDeps): CodeIndexServices {
-  const codeIndexStore = new CodeIndexStore(
-    deps.workingDirectory,
-    codeIndexDbPath(deps.workingDirectory),
-    deps.memoryEmbeddingRegistry,
-    { maxFiles: CODE_INDEX_MAX_FILES, maxFileBytes: CODE_INDEX_MAX_FILE_BYTES, maxTotalBytes: CODE_INDEX_MAX_TOTAL_BYTES },
-  );
-  codeIndexStore.init();
-  if (isCodeIndexAutoStartEnabled(deps.configManager)) {
-    codeIndexStore.scheduleBuild();
-  }
-  const codeIndexReindexScheduler = new CodeIndexReindexScheduler({
-    target: codeIndexStore,
-    workingDirectory: deps.workingDirectory,
-    // Honor governor backpressure: a paused code-index reindex job stops
-    // scheduling new work until the governor resumes it, and the critical
-    // memory tier refuses new reindex work outright (mirrors the SDK).
-    isEnabled: () => isCodeInjectionSettingEnabled(deps.configManager)
-      && !(deps.isReindexPaused?.() ?? false)
-      && (deps.admitExpensiveWork?.('code-index reindex').allowed ?? true),
-  });
-  return { codeIndexStore, codeIndexReindexScheduler };
-}

package/src/runtime/daemon-handler-composition.ts

@@ -1,76 +0,0 @@
-/**
- * daemon-handler-composition.ts — the daemon's HOST-side handler surfaces.
- *
- * Attaches this repository's handlers to the SDK-auto-registered builtin
- * gateway descriptors (channels.* / email.* / calendar.*) via
- * catalog.register(descriptor, handler, { replace: true }) — the SDK owns
- * every id, descriptor and schema; only the behaviour is ours. The remote
- * surface reuses the SAME DistributedRuntimeManager the SDK facade injects.
- *
- * Split out of services.ts for the 800-line file cap, the same reason
- * channel-composition.ts exists.
- *
- * The one behavioural decision that lives here: the inbox poller is handed to
- * the cluster coordinator instead of being started eagerly. It is this
- * product's own inbound consumer — the SDK facade does not know it exists —
- * so if it is not gated here it is not gated anywhere, and two goodvibes nodes
- * on one network each read the shared inbox and answer the same message twice.
- */
-import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
-import type { ClusterCoordinator } from '@pellux/goodvibes-sdk/platform/cluster';
-import type { GatewayMethodCatalog } from '@pellux/goodvibes-sdk/platform/control-plane';
-import type { SecretsManager } from '@pellux/goodvibes-sdk/platform/config';
-import { registerDaemonHandlers, type DaemonHandlerSurfaces } from '../daemon/handlers/index.ts';
-import type { HandlerContext, HandlerLogger } from '../daemon/handlers/context.ts';
-import { createDaemonCredentialStore } from '../daemon/handlers/credentials.ts';
-import { registerRouting } from '../daemon/handlers/routing/index.ts';
-import { registerInboxMethods } from '../daemon/handlers/inbox/index.ts';
-import { registerTriagedInbox } from '../daemon/handlers/triage/index.ts';
-import { registerDraftMethods } from '../daemon/handlers/drafts/index.ts';
-import { registerRemoteSurface } from '../daemon/handlers/remote/index.ts';
-import { inboxPollerGate } from './cluster-composition.ts';
-
-export interface DaemonHandlerCompositionOptions {
-  readonly gatewayMethods: GatewayMethodCatalog;
-  readonly secretsManager: SecretsManager;
-  readonly configManager: ConfigManager;
-  readonly workingDirectory: string;
-  readonly homeDirectory: string;
-  readonly distributedRuntime: NonNullable<Parameters<typeof registerRemoteSurface>[1]>['manager'];
-  /**
-   * Decides whether THIS node polls the shared inbox. Always supplied by the
-   * composition root; the poller is never started outside it.
-   */
-  readonly clusterCoordinator: ClusterCoordinator;
-}
-
-export function createDaemonHandlerComposition(
-  options: DaemonHandlerCompositionOptions,
-): DaemonHandlerSurfaces {
-  const handlerLogger: HandlerLogger = {
-    info: (message, meta) => console.info(message, meta ?? ''),
-    warn: (message, meta) => console.warn(message, meta ?? ''),
-    error: (message, meta) => console.error(message, meta ?? ''),
-  };
-  const handlerContext: HandlerContext = {
-    catalog: options.gatewayMethods,
-    credentials: createDaemonCredentialStore(options.secretsManager),
-    configManager: options.configManager,
-    workingDirectory: options.workingDirectory,
-    homeDirectory: options.homeDirectory,
-    logger: handlerLogger,
-  };
-  return registerDaemonHandlers(handlerContext, {
-    registerRouting,
-    registerInbox: (ctx, routing) =>
-      registerTriagedInbox(ctx, (inboxCtx) => registerInboxMethods(inboxCtx, routing, {
-        // Hands polling to leadership. The `channels.inbox.list` read stays
-        // available on every node — a standby still SERVES the persisted feed,
-        // it just does not FETCH into it.
-        gatePolling: (providerId, control) =>
-          options.clusterCoordinator.register(inboxPollerGate(providerId, control)),
-      })).unregister,
-    registerDrafts: (ctx) => registerDraftMethods(ctx),
-    registerRemote: (ctx) => registerRemoteSurface(ctx, { manager: options.distributedRuntime }),
-  });
-}

package/src/runtime/device-posture-composition.ts

@@ -1,110 +0,0 @@
-/**
- * device-posture-composition.ts — the paired-phone feature inside THIS daemon.
- *
- * A phone pairs with whichever daemon the person runs, and for this owner that
- * daemon is hosted by the terminal app. Until this module existed the app had no
- * device posture at all: `device.nodes.maxPaired` was enforced at the pairing
- * path (SDK-side) and `device.capabilities.mode` was an onboarding toggle, while
- * the other eleven `device.*` keys were recorded, read back, and governed
- * nothing — the capability service they describe was never built here, so there
- * was nothing for them to govern.
- *
- * The feature itself is platform-owned (`platform/devices`): the settings→policy
- * mapping, the grants ledger, the capture store, the housekeeping sweeps, the
- * confirmation flow, and the `phone` tool. This module supplies the three seams
- * that are actually ours and nothing else:
- *
- *   - the peer transport — the same DistributedRuntimeManager the remote surface
- *     pairs devices onto, so a phone paired here is a node here,
- *   - the approval path — the shared approval broker, so the confirmation
- *     appears wherever the person is looking (terminal, web app, companion),
- *   - the storage root and the live config manager.
- *
- * Constructing this starts nothing. `startHousekeeping()` is called from the
- * bootstrap tail: grants and captures both outlive a restart, so a grant whose
- * phone is gone, or a capture torn by a crash, is reaped BEFORE the first
- * request of this run is served — and the periodic sweep after it is what keeps
- * a long-running daemon from going days without one. A failed sweep is logged
- * and the app still runs: housekeeping failing is a reason to say so, not a
- * reason to refuse to start.
- */
-import { logger } from '@pellux/goodvibes-sdk/platform/utils';
-import { createDevicePostureRuntime, registerDevicePhoneTool } from '@pellux/goodvibes-sdk/platform/devices';
-import type {
-  DeviceApprovalBridge,
-  DevicePeerTransport,
-  DevicePhoneToolRegistry,
-  DevicePostureRuntime,
-} from '@pellux/goodvibes-sdk/platform/devices';
-import { registerDevicesGatewayMethods } from '@pellux/goodvibes-sdk/platform/control-plane';
-import type { GatewayMethodCatalog } from '@pellux/goodvibes-sdk/platform/control-plane';
-import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
-
-/** Who this surface records in the device audit trail. */
-export const TUI_DEVICE_ACTOR = 'tui:phone-tool';
-
-export interface DevicePostureCompositionOptions {
-  readonly configManager: ConfigManager;
-  /** The runtime devices pair onto; its listPeers/invokePeer are the transport. */
-  readonly distributedRuntime: DevicePeerTransport;
-  readonly approvals: DeviceApprovalBridge;
-  /** Surface-scoped directory the grants ledger, captures and disclosure live in. */
-  readonly stateDirectory: string;
-  /**
-   * Binding the catalog turns devices.nodes.list / devices.grants.* /
-   * devices.housekeeping.run from cataloged-but-unhandled into real handlers,
-   * which is what makes the grants surface work in the web app and the companion
-   * rather than only through this app's own tool.
-   */
-  readonly gatewayMethods?: GatewayMethodCatalog | undefined;
-  readonly getSessionId?: (() => string | undefined) | undefined;
-}
-
-export interface DevicePostureServices {
-  readonly devicePosture: DevicePostureRuntime;
-}
-
-/** Build the device posture runtime and bind the device verbs to it. */
-export function createDevicePostureServices(options: DevicePostureCompositionOptions): DevicePostureServices {
-  const devicePosture = createDevicePostureRuntime({
-    transport: options.distributedRuntime,
-    approvals: options.approvals,
-    config: options.configManager,
-    stateDirectory: options.stateDirectory,
-    actor: TUI_DEVICE_ACTOR,
-    ...(options.getSessionId ? { getSessionId: options.getSessionId } : {}),
-  });
-  if (options.gatewayMethods) registerDevicesGatewayMethods(options.gatewayMethods, devicePosture);
-  return { devicePosture };
-}
-
-/**
- * Everything a host with a tool registry has to do once it is up: register the
- * `phone` tool — the only path that reaches the capability service, so without it
- * the posture keys govern nothing a session can observe — and start housekeeping.
- *
- * One call, because these two belong to the same feature and a host that did the
- * first and forgot the second would serve requests while never reaping a grant
- * whose phone is gone.
- */
-export function installDevicePosture(
-  toolRegistry: DevicePhoneToolRegistry,
-  devicePosture: DevicePostureRuntime,
-): void {
-  registerDevicePhoneTool(toolRegistry, devicePosture);
-  startDeviceHousekeeping(devicePosture);
-}
-
-/**
- * The recovery sweep plus the periodic timer. Separate from construction so
- * composing a runtime in a test starts no timer and touches no disk, and
- * separate from the call above so the standalone daemon — which registers no
- * tools — still sweeps.
- */
-export function startDeviceHousekeeping(devicePosture: DevicePostureRuntime): void {
-  void devicePosture.startHousekeeping().catch((error: unknown) => {
-    logger.warn('Device housekeeping sweep failed at startup', {
-      error: error instanceof Error ? error.message : String(error),
-    });
-  });
-}