@pellux/goodvibes-tui 1.7.0 → 1.9.1

package/CHANGELOG.md

@@ -4,6 +4,17 @@ All notable changes to GoodVibes TUI.
 
 ---
 
+## [1.9.1] — 2026-07-06
+
+Follow-up patch that completes the W6-C1 credential-status adoption for the TUI. The 1.9.0 release pinned SDK 1.0.0 and unified memory (C2) but left the C1 client-side credential-status read for a follow-up; this release lands it. Ships against @pellux/goodvibes-sdk 1.0.0.
+
+### Credential-status read as a daemon client (W6-C1)
+- When the TUI acts as a client of an adopted external daemon (`HostServiceStatus` mode `external`), provider/model/secret STATUS is read from that daemon's `credentials.get` wire method instead of the TUI's own surfaceRoot store. The read carries only status metadata (key / configured / usable / source / secure) — never a secret value, mirroring the SDK's status-only wire contract. The env-only API-key posture and all secret value-reads that provider auth needs stay local and are untouched; only STATUS reads use the daemon path.
+- Honest degraded state, mirroring goodvibes-webui v1.0.1 `deriveCredentialAvailability` exactly: a 503 `CREDENTIAL_STORE_UNAVAILABLE` (matched by machine code), a `METHOD_NOT_FOUND` from an older daemon, or any transport failure resolves to a reason-carrying `available: false` — never a fabricated "configured", never a stale confident value. The TUI-hosted daemon continues to serve `credentials.get` automatically from its existing secrets manager (SDK auto-wiring), so no serve-side change was needed.
+
+### Memory unification follow-up (W6-C2)
+- The legacy per-project TUI memory store now actually folds into the home-scoped canonical store once at boot, after the canonical store initializes — making good on the behavior 1.9.0 described. The fold is id-keyed and idempotent (a re-run imports nothing new and never deletes the legacy file) and is strictly non-fatal: a fold error degrades to a warning and the canonical store serves on. The home-scoped store deliberately does not re-root with the working directory; only the code index and project index do.
+
 ## [1.7.0] — 2026-07-04
 
 The evolution release: six batched development cycles (internal 1.2.0–1.6.0, which were never published) land together as one public version. The through-line is a product that reports the truth about itself — reversible edits you can actually undo, a live fleet you can watch and steer, orchestration that runs the plan it showed you, memory that demonstrably enters the turns it claims to, and a panel surface cut down to the consoles that earn their place. Ships against @pellux/goodvibes-sdk 0.38.0.

package/README.md

@@ -2,7 +2,7 @@
 
 [![CI](https://github.com/mgd34msu/goodvibes-tui/actions/workflows/ci.yml/badge.svg)](https://github.com/mgd34msu/goodvibes-tui/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
-[![Version](https://img.shields.io/badge/version-1.7.0-blue.svg)](https://github.com/mgd34msu/goodvibes-tui)
+[![Version](https://img.shields.io/badge/version-1.9.1-blue.svg)](https://github.com/mgd34msu/goodvibes-tui)
 
 A terminal-native AI coding, operations, automation, knowledge, and integration console with a typed runtime, omnichannel surfaces, structured memory/knowledge, and a raw ANSI renderer.
 
@@ -84,7 +84,7 @@ Typical workflows:
 - ingest URLs, bookmarks, docs, spreadsheets, and artifacts into the structured knowledge system for later retrieval
 - dispatch and review work across remote peers and node-host runners
 
-The compiled binary is the TUI entrypoint built from `src/main.ts`. When `danger.daemon` and/or `danger.httpListener` are enabled, that same binary starts the daemon and HTTP listener in-process. `bun run daemon` uses the separate headless daemon entrypoint from source.
+The compiled binary is the TUI entrypoint built from `src/main.ts`. The daemon (`daemon.enabled`, on by default, loopback-bound) and, when `danger.httpListener` is enabled, the HTTP listener both start in-process from that same binary. `bun run daemon` uses the separate headless daemon entrypoint from source.
 
 Inbound TLS can run in `off`, `proxy`, or `direct` mode. Direct mode defaults to the certificate files above unless explicit paths are configured. Outbound HTTPS trust uses Bun’s bundled roots by default and can be extended or replaced with custom CA files/directories for internal or enterprise endpoints. Operator auth now supports bearer headers and local session cookies across REST, SSE, and control-plane WebSocket flows.
 
@@ -446,7 +446,7 @@ bun run build
 # outputs dist/goodvibes
 ```
 
-`bun run build` compiles `src/main.ts` into `dist/goodvibes`. The compiled binary runs the TUI and can also host the daemon and HTTP listener in-process when `danger.daemon` and/or `danger.httpListener` are enabled in config. The default build does not produce a separate compiled daemon-only executable.
+`bun run build` compiles `src/main.ts` into `dist/goodvibes`. The compiled binary runs the TUI and also hosts the daemon in-process (`daemon.enabled`, on by default) plus, when `danger.httpListener` is enabled, the HTTP listener. The default build does not produce a separate compiled daemon-only executable.
 
 ---
 
@@ -560,7 +560,7 @@ Related storage paths:
 | `web.port` | `3423` | Web/browser surface port |
 | `danger.agentRecursion` | `false` | Allow agents to spawn subagents |
 | `danger.maxGlobalAgents` | `8` | Max simultaneous agents |
-| `danger.daemon` | `false` | Enable daemon mode (POST /task) |
+| `daemon.enabled` | `true` | Run the local session daemon (loopback-bound; on by default) |
 | `danger.httpListener` | `false` | Enable HTTP webhook listener |
 | `tools.autoHeal` | `false` | Auto-fix syntax errors on write/edit |
 | `tools.hooksFile` | `hooks.json` | Hook configuration file name |
@@ -740,10 +740,11 @@ Key commands:
 
 ### Local daemon and HTTP listener
 
-Local service surfaces are opt-in:
+The local session daemon runs by default (`daemon.enabled`, loopback-bound); the HTTP
+webhook listener is opt-in:
 
-- `danger.daemon`
-- `danger.httpListener`
+- `daemon.enabled` (default `true`)
+- `danger.httpListener` (default `false`)
 
 They are protected by local auth, which includes:
 
@@ -1275,10 +1276,10 @@ Those pieces cover conversation-noise routing, panel-health/performance budgets,
 | `/services` | `/svc` | Manage API service configurations |
 | `/accounts [action]` | — | Review provider-account routes, auth posture, and repair actions |
 | `/auth [action]` | — | Review auth posture and manage local service auth users/sessions |
-| `/memory [action]` | — | Session memory management: `list`, `add <text>`, `remove <id>` |
+| `/note [action]` | — | Session note management (pinned across context compaction): `list`, `add <text>`, `remove <id>` |
 | `/keep <text>` | — | Pin text to session memory; survives context compaction |
 | `/memory-sync [action]` | `/memsync` | Durable memory export/import and bundle exchange: `export <path> [scope]`, `import <path>` |
-| `/recall [action]` | `/rc` | Durable knowledge and memory substrate: capture, review, explain, inspect `injections`, export, import, and handoff |
+| `/recall [action]` | `/rc`, `/memory`, `/mem` | Durable knowledge and memory substrate: capture, review, explain, inspect `injections`, export, import, and handoff |
 | `/knowledge [action]` | `/know`, `/kb` | Structured knowledge graph: ingest URLs/bookmarks, inspect issues, build packets, and run consolidation jobs |
 | `/codebase [action]` | — | Repo source-tree code index: `build`, `status`, and `search` |
 | `/context` | `/ctx` | Inspect context window usage (token breakdown per message) |