@pellux/goodvibes-tui 1.7.0 → 1.9.0

package/src/runtime/onboarding/snapshot.ts

@@ -5,6 +5,7 @@ import { readOnboardingRuntimeState } from './state.ts';
 import type {
   OnboardingAcknowledgementSnapshot,
   OnboardingConfigSnapshot,
+  OnboardingLegacyDaemonSnapshot,
   OnboardingProviderRoutingSnapshot,
   OnboardingRuntimeDefaultsSnapshot,
   OnboardingServiceState,
@@ -198,6 +199,10 @@ function buildFallbackAuthSnapshot(): LocalAuthSnapshot {
   };
 }
 
+function buildFallbackLegacyDaemonSnapshot(): OnboardingLegacyDaemonSnapshot {
+  return { present: false, active: false, path: '' };
+}
+
 function buildConfiguredSurfaceKinds(
   surfaces: OnboardingConfigSnapshot['surfaces'],
 ): string[] {
@@ -320,6 +325,7 @@ export async function collectOnboardingSnapshot(
     secretRecordsResult,
     surfaceResult,
     providerAccountsResult,
+    legacyDaemonResult,
   ] = await Promise.all([
     loadOptionalSnapshot(
       'subscriptions-active',
@@ -357,6 +363,11 @@ export async function collectOnboardingSnapshot(
       deps.providerAccounts ? () => deps.providerAccounts!.loadSnapshot() : undefined,
       null,
     ),
+    loadOptionalSnapshot(
+      'legacy-daemon',
+      deps.legacyDaemon ? () => Promise.resolve(deps.legacyDaemon!.detect()) : undefined,
+      buildFallbackLegacyDaemonSnapshot(),
+    ),
   ]);
 
   const collectionIssues: OnboardingSnapshotCollectionIssue[] = [];
@@ -369,6 +380,7 @@ export async function collectOnboardingSnapshot(
   if (secretRecordsResult.issue) collectionIssues.push(secretRecordsResult.issue);
   if (surfaceResult.issue) collectionIssues.push(surfaceResult.issue);
   if (providerAccountsResult.issue) collectionIssues.push(providerAccountsResult.issue);
+  if (legacyDaemonResult.issue) collectionIssues.push(legacyDaemonResult.issue);
 
   return {
     capturedAt,
@@ -391,7 +403,20 @@ export async function collectOnboardingSnapshot(
       snapshot: authSnapshotResult.value,
     },
     bindSettings: {
-      daemonEnabled: Boolean(config.danger.daemon),
+      // danger.daemon (removed Wave 6 — see docs/decisions/2026-07-05-daemon-by-default.md)
+      // used to gate the pre-Wave-2 opt-in daemon posture; this site read it RAW
+      // (not through resolveDaemonEnabled) so the wizard's network-mode
+      // classification tracked "did the user explicitly request the legacy
+      // dangerous posture" rather than "does the daemon run" (which has defaulted
+      // true unconditionally since Wave 2, and would misclassify every default,
+      // local-only install as server-mode if read here). Every realistic config
+      // already evaluated this to `false` (unset, or an explicit `danger.daemon:
+      // false` both did); the alias's removal migration preserves the one case
+      // that changes real daemon behavior (explicit `false` -> `daemon.enabled:
+      // false`) but does not resurrect a signal for "explicitly true" — that path
+      // was always a no-op for actual daemon operation. With the alias gone there
+      // is no signal left to read, so this is pinned at its steady-state value.
+      daemonEnabled: false,
       httpListenerEnabled: Boolean(config.danger.httpListener),
       controlPlane: config.controlPlane,
       httpListener: config.httpListener,
@@ -402,6 +427,7 @@ export async function collectOnboardingSnapshot(
       records: sortSurfaceRecords(surfaceResult.value),
     },
     providerAccounts: providerAccountsResult.value,
+    legacyDaemon: legacyDaemonResult.value,
     collectionIssues,
   };
 }

package/src/runtime/onboarding/types.ts

@@ -125,6 +125,29 @@ export interface OnboardingSurfacesSnapshot {
   readonly records: readonly OnboardingSurfaceRecord[];
 }
 
+/**
+ * W4-D1 wizard wiring: read-only detection of a legacy `goodvibes-daemon.service`
+ * systemd unit (see `../legacy-daemon-migration.ts`'s `LegacyUnitInfo`), carried
+ * on the snapshot so the Network step can show the guided migration action only
+ * when there is actually something to migrate. Never implies anything was
+ * touched — detection only.
+ */
+export interface OnboardingLegacyDaemonSnapshot {
+  readonly present: boolean;
+  readonly active: boolean;
+  readonly path: string;
+  /**
+   * F2 follow-up: the unit name this tool actually manages on this host,
+   * resolved from the `service.serviceName` config key at snapshot-collection
+   * time (`resolveConfiguredServiceName`, `../legacy-daemon-migration.ts`) —
+   * so the wizard's detection banner names the real unit instead of the
+   * hardcoded default. Optional so snapshots built without config access
+   * (fallbacks, older fixtures) stay valid; readers fall back to
+   * `MANAGED_SERVICE_NAME`.
+   */
+  readonly trackedServiceName?: string;
+}
+
 export interface OnboardingProviderAccountRecord {
   readonly providerId: string;
   readonly configured: boolean;
@@ -170,7 +193,8 @@ export type OnboardingSnapshotCollectionIssueArea =
   | 'secrets-records'
   | 'surfaces'
   | 'provider-accounts'
-  | 'acknowledgements';
+  | 'acknowledgements'
+  | 'legacy-daemon';
 
 export interface OnboardingSnapshotCollectionIssue {
   readonly area: OnboardingSnapshotCollectionIssueArea;
@@ -190,6 +214,7 @@ export interface OnboardingSnapshotState {
   readonly bindSettings: OnboardingBindSettingsSnapshot;
   readonly surfaces: OnboardingSurfacesSnapshot;
   readonly providerAccounts: OnboardingProviderAccountsSnapshot | null;
+  readonly legacyDaemon: OnboardingLegacyDaemonSnapshot;
   readonly collectionIssues: readonly OnboardingSnapshotCollectionIssue[];
 }
 
@@ -377,6 +402,10 @@ export interface OnboardingProviderAccountReadHelper {
   loadSnapshot(): Promise<OnboardingProviderAccountsSnapshot>;
 }
 
+export interface OnboardingLegacyDaemonReadHelper {
+  detect(): OnboardingLegacyDaemonSnapshot | Promise<OnboardingLegacyDaemonSnapshot>;
+}
+
 export type OnboardingShellPaths = Pick<
   ShellPathService,
   'workingDirectory' | 'resolveProjectPath' | 'resolveUserPath'
@@ -391,6 +420,7 @@ export interface OnboardingSnapshotDependencies {
   readonly services: Pick<ServiceInspectionQuery, 'getAll' | 'inspect'>;
   readonly surfaces?: OnboardingSurfaceReadHelper;
   readonly providerAccounts?: OnboardingProviderAccountReadHelper;
+  readonly legacyDaemon?: OnboardingLegacyDaemonReadHelper;
   readonly shellPaths?: OnboardingShellPaths;
   readonly acknowledgementScope?: OnboardingStateScope;
 }

package/src/runtime/operator-token-cleanup.ts

@@ -11,7 +11,11 @@
  * the new path will be inspected on the next daemon boot.
  */
 
-import { join } from 'node:path';
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { randomBytes } from 'node:crypto';
+import { dirname, join } from 'node:path';
+import { getOrCreateCompanionToken } from '@pellux/goodvibes-sdk/platform/pairing';
+import type { CompanionPairingResult } from '@pellux/goodvibes-sdk/platform/pairing';
 
 /**
  * Return the list of absolute operator-tokens.json paths the TUI may have written
@@ -26,3 +30,80 @@ export function workspaceOperatorTokenCandidates(workingDirectory: string): read
     join(workingDirectory, '.goodvibes', 'tui', 'operator-tokens.json'),
   ];
 }
+
+/**
+ * F1 (adopt-an-already-running-external-daemon): resolve the operator/companion
+ * token this TUI process uses to authenticate with its daemon, honoring
+ * `GOODVIBES_DAEMON_TOKEN` as a non-interactive override.
+ *
+ * Without this override, the only way to make a TUI instance adopt an
+ * already-running external daemon that used an out-of-band or explicit token
+ * (rather than one derived from `getOrCreateCompanionToken` under a *shared*
+ * home directory) was to hand-write `<daemonHomeDir>/operator-tokens.json`
+ * before startup — there was no env var or CLI flag equivalent.
+ *
+ * `GOODVIBES_DAEMON_TOKEN` is already the documented env var `bin/goodvibes-daemon`
+ * honors for its own bearer token (see `src/daemon/cli.ts`'s `readDaemonCliTokens`)
+ * and the one `src/verification/live-verifier.ts`'s `readDaemonToken` already falls
+ * back to when probing a daemon's HTTP surface from the outside. Reusing the same
+ * name here means one env var configures both sides of an adopted-daemon setup —
+ * start the daemon with `GOODVIBES_DAEMON_TOKEN=<token>` and point the TUI at it
+ * with the same `GOODVIBES_DAEMON_TOKEN=<token>` plus
+ * `--config controlPlane.host=<host> --config controlPlane.port=<port>` — instead
+ * of introducing a second, TUI-only flag.
+ *
+ * When the override is set and does not already match the on-disk record, the
+ * file is rewritten so the override becomes durable for this home directory
+ * (an existing peerId is kept when present, so companion-pairing identity does
+ * not needlessly churn). Falls back to the existing `getOrCreateCompanionToken`
+ * behavior — read the existing file, or mint a fresh random token — when the
+ * override is unset.
+ *
+ * @param explicitToken - Takes precedence over `GOODVIBES_DAEMON_TOKEN` when
+ * provided. Used by the onboarding wizard's "connect to an existing daemon"
+ * action (a pasted token) so it shares this exact persistence logic with the
+ * env-var path instead of duplicating it.
+ */
+export function resolveDaemonCompanionToken(daemonHomeDir: string, explicitToken?: string): CompanionPairingResult {
+  const override = explicitToken?.trim() || process.env.GOODVIBES_DAEMON_TOKEN?.trim();
+  if (!override) return getOrCreateCompanionToken('tui', { daemonHomeDir });
+
+  const tokenPath = join(daemonHomeDir, 'operator-tokens.json');
+  let existingPeerId: string | undefined;
+  let existingCreatedAt: number | undefined;
+  if (existsSync(tokenPath)) {
+    try {
+      const record = JSON.parse(readFileSync(tokenPath, 'utf-8')) as {
+        token?: unknown;
+        peerId?: unknown;
+        createdAt?: unknown;
+      };
+      if (typeof record.token === 'string' && record.token === override) {
+        return {
+          token: override,
+          peerId: typeof record.peerId === 'string' ? record.peerId : randomBytes(12).toString('hex'),
+          createdAt: typeof record.createdAt === 'number' ? record.createdAt : Date.now(),
+        };
+      }
+      if (typeof record.peerId === 'string') existingPeerId = record.peerId;
+      if (typeof record.createdAt === 'number') existingCreatedAt = record.createdAt;
+    } catch {
+      // Malformed on-disk record — fall through and rewrite it with the override.
+    }
+  }
+
+  const record: CompanionPairingResult = {
+    token: override,
+    peerId: existingPeerId ?? randomBytes(12).toString('hex'),
+    createdAt: existingCreatedAt ?? Date.now(),
+  };
+  try {
+    mkdirSync(dirname(tokenPath), { recursive: true });
+    writeFileSync(tokenPath, JSON.stringify(record, null, 2), { encoding: 'utf-8', mode: 0o600 });
+    chmodSync(tokenPath, 0o600);
+  } catch {
+    // Best-effort persistence — the override still applies for this process
+    // even if the file could not be written (e.g. a read-only home directory).
+  }
+  return record;
+}

package/src/runtime/orchestrator-core-services.ts

@@ -2,6 +2,7 @@ import type { OrchestratorCoreServices } from '@pellux/goodvibes-sdk/platform/co
 import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
 import type { ProviderRegistry } from '@pellux/goodvibes-sdk/platform/providers';
 import type { RuntimeServices } from './services.ts';
+import { isCodeInjectionSettingEnabled } from './code-index-services.ts';
 
 /** The slice of the runtime services bag the shared orchestrator payload draws from. */
 export type OrchestratorCoreServicesSource = Pick<
@@ -12,6 +13,8 @@ export type OrchestratorCoreServicesSource = Pick<
   | 'sessionLineageTracker'
   | 'idempotencyStore'
   | 'memoryRegistry'
+  | 'codeIndexStore'
+  | 'codeIndexReindexScheduler'
 >;
 
 /**
@@ -45,5 +48,12 @@ export function buildSharedOrchestratorCoreServices(input: {
     sessionLineageTracker: services.sessionLineageTracker,
     idempotencyStore: services.idempotencyStore,
     memoryRegistry: services.memoryRegistry,
+    // Wave-5 Stage B — main-session code auto-injection + tool-site reindex. Injection is
+    // additionally gated by the default-off `agent-passive-code-injection` flag inside the
+    // SDK; here we supply the source, the live storage.codeIndexEnabled predicate, and the
+    // reindex scheduler.
+    codeIndex: services.codeIndexStore,
+    isCodeInjectionSettingEnabled: () => isCodeInjectionSettingEnabled(configManager),
+    codeIndexReindexScheduler: services.codeIndexReindexScheduler,
   };
 }

package/src/runtime/resume-notice.ts

@@ -0,0 +1,209 @@
+/**
+ * resume-notice.ts — the boot-time "previous session found" transcript notice.
+ *
+ * UX-D item 1: a supervision-journey audit of 1.7.0 found that the TUI
+ * accumulates rich resumable state on disk (a saved conversation, workspace
+ * checkpoints, WRFC chain history) but never surfaces any of it at startup —
+ * an operator has no way to know it exists short of already knowing the
+ * right command. This module builds ONE compact, honest system-message block
+ * printed after the splash and before the first prompt, summarizing exactly
+ * what real state exists and how to reach it.
+ *
+ * Honesty constraints (verified against the actual runtime, not assumed):
+ *   - There is no bare `/resume` command and no `/sessions` command (a
+ *     pre-existing typo already lives in the splash's own hint at
+ *     utils/splash-lines.ts — out of scope here, splash stays byte-identical).
+ *     The real, working command is `/session resume <id|name>` — it always
+ *     requires an explicit target. So this notice advertises
+ *     `/session resume <id>` with the real last-session id substituted in,
+ *     never a bare `/resume`.
+ *   - `/checkpoints` works with zero arguments and behaves correctly at any
+ *     checkpoint count (including zero) — advertised whenever the checkpoint
+ *     manager is available in this session.
+ *   - `/recall` (memory) is only advertised when the memory API is actually
+ *     wired up in this session (context.clients?.knowledgeApi?.memory) —
+ *     some runtimes don't have it, and claiming it works there would not be
+ *     honest.
+ *   - Every clause is independently gated on real data: a claim about
+ *     checkpoints/chain history is only made when that data is known; "no
+ *     chain history" means no chain clause is printed, not a fabricated one.
+ */
+
+import { readLastSessionPointer } from '@/runtime/index.ts';
+import type { WrfcChain } from '@pellux/goodvibes-sdk/platform/agents';
+import type { SessionManager } from '@pellux/goodvibes-sdk/platform/sessions';
+import type { WorkspaceCheckpointManager } from '@pellux/goodvibes-sdk/platform/workspace';
+import type { SystemMessageRouter } from '../core/system-message-router.ts';
+
+// ─── Chain outcome ───────────────────────────────────────────────────────────
+
+/**
+ * Honest, human-facing outcome of a WRFC chain, derived from real chain
+ * state rather than guessed. `chain.state` alone cannot distinguish a
+ * user-cancelled chain from an ordinary review/gate failure. The SDK now
+ * records that distinction first-class as `chain.failureKind` ('cancelled'
+ * vs 'transport'/'other'), set by cancelChain()/failChain(), so that field
+ * is the primary source of truth. Snapshots persisted before the field
+ * existed lack it; for those we fall back to the owner-decision log, where
+ * cancelChain() also records a `chain_cancelled` decision. A chain still
+ * non-terminal after rehydrate's zombie-reap check (see wrfc-persistence.ts)
+ * is reported as 'interrupted' — re-imported and live again, not history.
+ */
+export type ChainOutcome = 'passed' | 'failed' | 'cancelled' | 'interrupted';
+
+/** Terminal WRFC states (mirrors wrfc-persistence.ts's own TERMINAL_STATES). */
+function isTerminalState(state: WrfcChain['state']): boolean {
+  return state === 'passed' || state === 'failed';
+}
+
+export function describeChainOutcome(chain: WrfcChain): ChainOutcome {
+  if (!isTerminalState(chain.state)) return 'interrupted';
+  if (chain.state === 'passed') return 'passed';
+  // Primary: the SDK's first-class failureKind, authoritative for chains
+  // failed/cancelled under the current SDK.
+  if (chain.failureKind === 'cancelled') return 'cancelled';
+  // Fallback for pre-failureKind snapshots: consult the owner-decision log,
+  // where cancelChain() records a chain_cancelled decision.
+  if (chain.failureKind === undefined) {
+    const lastAction = chain.ownerDecisions.length > 0 ? chain.ownerDecisions[chain.ownerDecisions.length - 1]?.action : undefined;
+    if (lastAction === 'chain_cancelled') return 'cancelled';
+  }
+  return 'failed';
+}
+
+/** Pick the most recently completed (or, if still interrupted, most recently created) chain from a set. Null if the set is empty. */
+export function mostRecentChain(chains: readonly WrfcChain[]): WrfcChain | null {
+  if (chains.length === 0) return null;
+  return [...chains].sort((a, b) => (b.completedAt ?? b.createdAt ?? 0) - (a.completedAt ?? a.createdAt ?? 0))[0]!;
+}
+
+// ─── Notice text ─────────────────────────────────────────────────────────────
+
+export interface ResumeNoticeFacts {
+  /** Number of user turns in the last saved session. Null when there is no prior session (or it could not be read). */
+  readonly turnCount: number | null;
+  /** Session id of the last saved session — needed to build a truthful, directly-runnable resume hint. Null when there is no prior session. */
+  readonly lastSessionId: string | null;
+  /** Number of workspace checkpoints. Null when the checkpoint manager is unavailable in this session (not the same as zero). */
+  readonly checkpointCount: number | null;
+  /** Outcome of the most recently known WRFC chain. Null when there is no chain history at all. */
+  readonly lastChainOutcome: ChainOutcome | null;
+  /** Whether /recall (memory) is wired up in this session. */
+  readonly memoryAvailable: boolean;
+}
+
+function plural(n: number, word: string): string {
+  return `${n} ${word}${n === 1 ? '' : 's'}`;
+}
+
+/**
+ * Build the boot resume notice text, or null when there is nothing to
+ * report (no prior session, no checkpoints ever taken, no chain history —
+ * a clean/new working directory prints nothing, respecting quiet startup).
+ */
+export function buildResumeNotice(facts: ResumeNoticeFacts): string | null {
+  const hasSession = facts.lastSessionId !== null && facts.turnCount !== null;
+  const checkpointsKnown = facts.checkpointCount !== null;
+  const checkpointCount = facts.checkpointCount ?? 0;
+  const hasCheckpoints = checkpointsKnown && checkpointCount > 0;
+  const hasChainHistory = facts.lastChainOutcome !== null;
+
+  if (!hasSession && !hasCheckpoints && !hasChainHistory) return null;
+
+  const summary: string[] = [];
+  if (hasSession) summary.push(plural(facts.turnCount!, 'turn'));
+  // Show the checkpoint count whenever it's knowable and there's a reason to
+  // (anchored to an existing session, or checkpoints genuinely exist even
+  // without one) — never guessed when the manager is unavailable.
+  if (checkpointsKnown && (hasSession || hasCheckpoints)) summary.push(plural(checkpointCount, 'checkpoint'));
+  if (hasChainHistory) summary.push(`last chain: ${facts.lastChainOutcome}`);
+
+  const lead = hasSession ? 'Previous session found' : 'Workspace history found';
+  let notice = `${lead}: ${summary.join(', ')}`;
+
+  const hints: string[] = [];
+  // No bare `/resume` exists — /session resume always requires a target.
+  if (hasSession) hints.push(`/session resume ${facts.lastSessionId} to continue`);
+  if (hasCheckpoints) hints.push('/checkpoints to browse');
+  if (facts.memoryAvailable) hints.push('/recall for memory');
+  if (hints.length > 0) notice += ` — ${hints.join(' · ')}`;
+
+  return notice;
+}
+
+// ─── Fact gathering (I/O) ────────────────────────────────────────────────────
+
+export interface ResumeNoticeDeps {
+  readonly workingDirectory: string;
+  readonly homeDirectory: string;
+  /** Surface root used by session persistence — the TUI always uses 'tui'. */
+  readonly surfaceRoot: string;
+  /** Only `load()` is needed — kept narrow for testability. */
+  readonly sessionManager: Pick<SessionManager, 'load'>;
+  /** Undefined when checkpoints are not wired up in this session at all. Only `list()` is needed. */
+  readonly checkpointManager: Pick<WorkspaceCheckpointManager, 'list'> | undefined;
+  /** The full known-chain set from WrfcPersistence.knownChains, gathered post-rehydrate. */
+  readonly chainHistory: readonly WrfcChain[];
+  readonly memoryAvailable: boolean;
+  readonly router: Pick<SystemMessageRouter, 'high'>;
+}
+
+/**
+ * Read the last session's real turn count from its saved JSONL file. A user
+ * turn is one stored message with role 'user' — the number of times the
+ * operator spoke, which is what "N turns" means to a human reading the
+ * notice (as opposed to a raw message count, which double-counts replies).
+ * Returns null when there is no last-session pointer, or the pointed-to
+ * session file is missing/corrupt — never a claim about a session that
+ * cannot actually be resumed.
+ */
+function readLastSessionTurns(deps: Pick<ResumeNoticeDeps, 'workingDirectory' | 'homeDirectory' | 'surfaceRoot' | 'sessionManager'>): { turnCount: number; lastSessionId: string } | null {
+  const lastSessionId = readLastSessionPointer({
+    workingDirectory: deps.workingDirectory,
+    homeDirectory: deps.homeDirectory,
+    surfaceRoot: deps.surfaceRoot,
+  });
+  if (!lastSessionId) return null;
+  try {
+    const { messages } = deps.sessionManager.load(lastSessionId);
+    const turnCount = messages.filter((m) => (m as { role?: unknown }).role === 'user').length;
+    return { turnCount, lastSessionId };
+  } catch {
+    // Pointer file present but the session it points to is gone/corrupt —
+    // there is nothing truthful to resume.
+    return null;
+  }
+}
+
+async function readCheckpointCount(mgr: ResumeNoticeDeps['checkpointManager']): Promise<number | null> {
+  if (!mgr) return null;
+  try {
+    return (await mgr.list()).length;
+  } catch {
+    // Checkpoint manager present but its cached init() rejection makes every
+    // call fail forever (see services.ts) — treat as "unknown", not zero.
+    return null;
+  }
+}
+
+/**
+ * Gather real facts from disk/services and, if there is anything to report,
+ * print ONE compact system message via `deps.router.high`. No-op (and no
+ * message) when there is no prior session, no checkpoints, and no chain
+ * history — a fresh working directory stays quiet.
+ */
+export async function announceResumeState(deps: ResumeNoticeDeps): Promise<void> {
+  const session = readLastSessionTurns(deps);
+  const checkpointCount = await readCheckpointCount(deps.checkpointManager);
+  const lastChain = mostRecentChain(deps.chainHistory);
+
+  const notice = buildResumeNotice({
+    turnCount: session?.turnCount ?? null,
+    lastSessionId: session?.lastSessionId ?? null,
+    checkpointCount,
+    lastChainOutcome: lastChain ? describeChainOutcome(lastChain) : null,
+    memoryAvailable: deps.memoryAvailable,
+  });
+
+  if (notice) deps.router.high(notice);
+}

package/src/runtime/services.ts

@@ -23,7 +23,7 @@ import { MediaProviderRegistry, ensureBuiltinMediaProviders } from '@pellux/good
 import { MultimodalService } from '@pellux/goodvibes-sdk/platform/multimodal';
 import { AgentMessageBus, AgentOrchestrator, ArchetypeLoader, WrfcController } from '@pellux/goodvibes-sdk/platform/agents';
 import { AgentManager, OverflowHandler, ProcessManager, createWorkflowServices, type WorkflowServices } from '@pellux/goodvibes-sdk/platform/tools';
-import { FileStateCache, FileUndoManager, MemoryEmbeddingProviderRegistry, MemoryRegistry, MemoryStore, ModeManager, ProjectIndex, type CodeIndexStore } from '@pellux/goodvibes-sdk/platform/state';
+import { FileStateCache, FileUndoManager, MemoryEmbeddingProviderRegistry, MemoryRegistry, MemoryStore, ModeManager, ProjectIndex, resolveCanonicalMemoryDbPath, type CodeIndexStore, type CodeIndexReindexScheduler } from '@pellux/goodvibes-sdk/platform/state';
 import { WorkspaceCheckpointManager } from '@pellux/goodvibes-sdk/platform/workspace';
 import type { RuntimeEventBus } from '@/runtime/index.ts';
 import { createDomainDispatch } from './store/index.ts';
@@ -58,7 +58,7 @@ import { PolicyRuntimeState } from '@/runtime/index.ts';
 import { createProcessRegistry, type ProcessRegistry } from '@pellux/goodvibes-sdk/platform/runtime/fleet';
 import { calcSessionCost, isModelPriced } from '../export/cost-utils.ts';
 import { createWorkstreamServices, type OrchestrationEngine, type WorkstreamCommandService } from './workstream-services.ts';
-import { codeIndexDbPath, createCodeIndexServices } from './code-index-services.ts';
+import { codeIndexDbPath, createCodeIndexServices, isCodeInjectionSettingEnabled } from './code-index-services.ts';
 import { WorkPlanStore } from '../work-plans/work-plan-store.ts';
 import {
   registerDaemonHandlers,
@@ -227,6 +227,7 @@ export interface RuntimeServices {
   readonly workstreamCommands: WorkstreamCommandService;
   /** Wave 5 (wo804): the repo source-tree code index — see runtime/code-index-services.ts. */
   readonly codeIndexStore: CodeIndexStore;
+  readonly codeIndexReindexScheduler: CodeIndexReindexScheduler; // Wave-5 Stage B tool-site reindex
   /** W2.1/W2.2: unified live process registry (agents, WRFC chains, workflows, watchers, background processes) backing the Fleet panel. */
   readonly processRegistry: ProcessRegistry;
   readonly modeManager: ModeManager;
@@ -386,7 +387,8 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   });
   const artifactStore = new ArtifactStore({ configManager });
   const memoryEmbeddingRegistry = new MemoryEmbeddingProviderRegistry({ configManager });
-  const memoryDbPath = join(workingDirectory, '.goodvibes', 'tui', 'memory.sqlite');
+  // W6-C2 (E6): open the ONE home-scoped canonical store; legacy per-project TUI memory folds in at boot (foldTuiLegacyMemory).
+  const memoryDbPath = resolveCanonicalMemoryDbPath(homeDirectory);
   const memoryStore = new MemoryStore(memoryDbPath, {
     embeddingRegistry: memoryEmbeddingRegistry,
   });
@@ -603,7 +605,8 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   // Wave 5 (wo804): repo source-tree code index, sharing memoryEmbeddingRegistry
   // with MemoryStore above. Auto-build is config-gated (default off) — see
   // code-index-services.ts's header doc.
-  const { codeIndexStore } = createCodeIndexServices({ workingDirectory, configManager, memoryEmbeddingRegistry });
+  const { codeIndexStore, codeIndexReindexScheduler } = createCodeIndexServices({ workingDirectory, configManager, memoryEmbeddingRegistry });
+  const codeInjectionOrchestratorDeps = { codeIndex: codeIndexStore, isCodeInjectionSettingEnabled: () => isCodeInjectionSettingEnabled(configManager), codeIndexReindexScheduler }; // Wave-5 Stage B seam (agent here; main via orchestrator-core-services.ts)
   // W2.1/W2.2: one shared process registry aggregating the managers above —
   // the Fleet panel (panels/fleet-read-model.ts) is its first consumer.
   // Constructed once here (not per-consumer) so the coalesced tick and the
@@ -678,6 +681,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     remoteRunnerRegistry,
     knowledgeService,
     memoryRegistry,
+    ...codeInjectionOrchestratorDeps, // Wave-5 Stage B: agent-run code injection + tool-site reindex
     archetypeLoader,
     configManager,
     providerRegistry,
@@ -779,16 +783,16 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     orchestrationEngine,
     workstreamCommands,
     codeIndexStore,
+    codeIndexReindexScheduler,
     processRegistry,
     modeManager,
     fileUndoManager,
     workspaceCheckpointManager,
     integrationHelpers,
     async rerootStores(newWorkingDir: string): Promise<void> {
-      const newMemoryDbPath = join(newWorkingDir, '.goodvibes', 'tui', 'memory.sqlite');
-      await memoryStore.reroot(newMemoryDbPath);
-      // Wave 5 (wo804) risk #7: the code index must follow memory to the new
-      // tree, or it keeps pointing at the old working directory.
+      // W6-C2 (E6): the memory store is the home-scoped canonical cross-surface store and
+      // deliberately does NOT reroot per-project (that would re-silo memory, the E6
+      // regression). Only working-tree-bound stores (code index, project index) reroot.
       await codeIndexStore.reroot(newWorkingDir, codeIndexDbPath(newWorkingDir));
       await projectIndex.reroot(newWorkingDir);
     },