@pellux/goodvibes-tui 1.9.0 → 1.9.1

package/CHANGELOG.md

@@ -4,6 +4,17 @@ All notable changes to GoodVibes TUI.
 
 ---
 
+## [1.9.1] — 2026-07-06
+
+Follow-up patch that completes the W6-C1 credential-status adoption for the TUI. The 1.9.0 release pinned SDK 1.0.0 and unified memory (C2) but left the C1 client-side credential-status read for a follow-up; this release lands it. Ships against @pellux/goodvibes-sdk 1.0.0.
+
+### Credential-status read as a daemon client (W6-C1)
+- When the TUI acts as a client of an adopted external daemon (`HostServiceStatus` mode `external`), provider/model/secret STATUS is read from that daemon's `credentials.get` wire method instead of the TUI's own surfaceRoot store. The read carries only status metadata (key / configured / usable / source / secure) — never a secret value, mirroring the SDK's status-only wire contract. The env-only API-key posture and all secret value-reads that provider auth needs stay local and are untouched; only STATUS reads use the daemon path.
+- Honest degraded state, mirroring goodvibes-webui v1.0.1 `deriveCredentialAvailability` exactly: a 503 `CREDENTIAL_STORE_UNAVAILABLE` (matched by machine code), a `METHOD_NOT_FOUND` from an older daemon, or any transport failure resolves to a reason-carrying `available: false` — never a fabricated "configured", never a stale confident value. The TUI-hosted daemon continues to serve `credentials.get` automatically from its existing secrets manager (SDK auto-wiring), so no serve-side change was needed.
+
+### Memory unification follow-up (W6-C2)
+- The legacy per-project TUI memory store now actually folds into the home-scoped canonical store once at boot, after the canonical store initializes — making good on the behavior 1.9.0 described. The fold is id-keyed and idempotent (a re-run imports nothing new and never deletes the legacy file) and is strictly non-fatal: a fold error degrades to a warning and the canonical store serves on. The home-scoped store deliberately does not re-root with the working directory; only the code index and project index do.
+
 ## [1.7.0] — 2026-07-04
 
 The evolution release: six batched development cycles (internal 1.2.0–1.6.0, which were never published) land together as one public version. The through-line is a product that reports the truth about itself — reversible edits you can actually undo, a live fleet you can watch and steer, orchestration that runs the plan it showed you, memory that demonstrably enters the turns it claims to, and a panel surface cut down to the consoles that earn their place. Ships against @pellux/goodvibes-sdk 0.38.0.

package/README.md

@@ -2,7 +2,7 @@
 
 [![CI](https://github.com/mgd34msu/goodvibes-tui/actions/workflows/ci.yml/badge.svg)](https://github.com/mgd34msu/goodvibes-tui/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
-[![Version](https://img.shields.io/badge/version-1.9.0-blue.svg)](https://github.com/mgd34msu/goodvibes-tui)
+[![Version](https://img.shields.io/badge/version-1.9.1-blue.svg)](https://github.com/mgd34msu/goodvibes-tui)
 
 A terminal-native AI coding, operations, automation, knowledge, and integration console with a typed runtime, omnichannel surfaces, structured memory/knowledge, and a raw ANSI renderer.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pellux/goodvibes-tui",
-  "version": "1.9.0",
+  "version": "1.9.1",
   "description": "Terminal-native GoodVibes product for coding, operations, automation, knowledge, channels, and daemon-backed control-plane workflows.",
   "type": "module",
   "main": "src/main.ts",

package/src/config/credential-availability.ts

@@ -0,0 +1,122 @@
+/**
+ * credential-availability.ts — W6-C1 client-side credential-status read.
+ *
+ * When the TUI acts as a CLIENT of an adopted external daemon (the host-service
+ * `mode === 'external'` topology — see runtime/bootstrap.ts), provider/model/secret
+ * STATUS is read from that daemon's `credentials.get` wire method rather than from
+ * the TUI's own surfaceRoot ('tui') store. This module folds a `credentials.get`
+ * outcome into an honest availability value, mirroring the goodvibes-webui v1.0.1
+ * `deriveCredentialAvailability` contract exactly:
+ *
+ *   - a 503 CREDENTIAL_STORE_UNAVAILABLE (matched by machine code), a METHOD_NOT_FOUND
+ *     from an older daemon, or ANY transport failure  ->  { available: false, reason }
+ *     — an honest, reason-carrying "unavailable" state.
+ *   - NEVER a fabricated "configured"; NEVER a secret byte. Only the boolean status
+ *     metadata surface (key / configured / usable / source / secure) is carried.
+ *
+ * STATUS ONLY moves to the daemon path. Secret RESOLUTION — the value-reads provider
+ * auth needs, plus the env-only API-key posture — stays local and is untouched by
+ * this module. The daemon's `credentials.get` never returns raw key bytes over the
+ * wire (see the SDK decision record 2026-07-06-config-sharing-shared-tier-and-secret-read),
+ * so no plaintext can reach a caller through this path by construction.
+ */
+
+/** One credential's status metadata from the daemon's shared store — never bytes. */
+export interface CredentialStatusEntry {
+  readonly key: string;
+  readonly configured: boolean;
+  readonly usable: boolean;
+  readonly source?: string;
+  readonly secure?: boolean;
+}
+
+/** Honest availability: either a status list, or a reason we could not read it. */
+export type CredentialAvailability =
+  | { readonly available: true; readonly credentials: readonly CredentialStatusEntry[] }
+  | { readonly available: false; readonly reason: string };
+
+/** A `credentials.get` invocation outcome — success value OR a thrown error. */
+export type CredentialStatusOutcome =
+  | { readonly ok: true; readonly value: unknown }
+  | { readonly ok: false; readonly error: unknown };
+
+/** Credential-read posture: read the daemon's shared store, or the local own store. */
+export type CredentialReadMode = 'host' | 'client';
+
+function asRecord(value: unknown): Record<string, unknown> | null {
+  return typeof value === 'object' && value !== null ? (value as Record<string, unknown>) : null;
+}
+
+function readString(record: Record<string, unknown> | null, key: string): string {
+  if (!record) return '';
+  const value = record[key];
+  return typeof value === 'string' ? value : '';
+}
+
+/**
+ * Map the authoritative host-service mode string to the credential-read posture.
+ * Only 'external' (a separately-running daemon this TUI adopted) reads credential
+ * STATUS over the wire; every other mode ('embedded'/'disabled'/'blocked'/
+ * 'incompatible'/'unavailable') is the local host reading its own store.
+ */
+export function credentialReadModeFromHostMode(hostMode: string): CredentialReadMode {
+  return hostMode === 'external' ? 'client' : 'host';
+}
+
+/**
+ * Fold a `credentials.get` outcome into an honest availability value. Mirrors
+ * goodvibes-webui v1.0.1 `deriveCredentialAvailability`: any failure becomes a
+ * reason-carrying `available: false`; a malformed success (no credentials array)
+ * is treated as unavailable rather than fabricated as configured; on success only
+ * the boolean status surface is carried, never a secret value.
+ */
+export function deriveCredentialAvailability(outcome: CredentialStatusOutcome): CredentialAvailability {
+  if (!outcome.ok) {
+    const err = asRecord(outcome.error);
+    const code = readString(err, 'code');
+    if (code === 'CREDENTIAL_STORE_UNAVAILABLE') {
+      return { available: false, reason: 'The daemon has no shared credential store wired.' };
+    }
+    if (code === 'METHOD_NOT_FOUND' || code === 'NOT_INVOKABLE') {
+      return { available: false, reason: 'This daemon does not serve credential status yet.' };
+    }
+    return { available: false, reason: 'Credential status unavailable right now.' };
+  }
+  const value = asRecord(outcome.value);
+  const raw = value?.credentials;
+  if (!Array.isArray(raw)) return { available: false, reason: 'Credential status unavailable right now.' };
+  const credentials: CredentialStatusEntry[] = [];
+  for (const item of raw) {
+    const rec = asRecord(item);
+    const key = readString(rec, 'key');
+    if (!rec || !key) continue;
+    credentials.push({
+      key,
+      configured: rec.configured === true,
+      usable: rec.usable === true,
+      source: readString(rec, 'source') || undefined,
+      secure: rec.secure === true ? true : rec.secure === false ? false : undefined,
+    });
+  }
+  return { available: true, credentials };
+}
+
+/**
+ * Client-side credential-status read. Invokes the adopted external daemon's
+ * `credentials.get` and folds success OR any thrown transport/daemon error into an
+ * honest availability. The daemon's `credentials.get` transport error carries the
+ * machine `code` at the top level (e.g. an HttpStatusError whose body supplied
+ * `CREDENTIAL_STORE_UNAVAILABLE` / `METHOD_NOT_FOUND`), which `deriveCredentialAvailability`
+ * classifies. Only the boolean status surface is returned; a raw secret value can
+ * never reach a caller through this path.
+ */
+export async function readClientCredentialStatus(
+  invokeCredentialsGet: () => Promise<unknown>,
+): Promise<CredentialAvailability> {
+  try {
+    const value = await invokeCredentialsGet();
+    return deriveCredentialAvailability({ ok: true, value });
+  } catch (error) {
+    return deriveCredentialAvailability({ ok: false, error });
+  }
+}

package/src/config/index.ts

@@ -55,3 +55,18 @@ export function getConfiguredSystemPrompt(configManager: Pick<ConfigManager, 'ge
 }
 
 export { getConfiguredApiKeys, resolveApiKeys } from '@pellux/goodvibes-sdk/platform/config';
+
+// W6-C1: client-side credential-status read (honest-degrade, status-only). When the
+// TUI acts as a client of an adopted external daemon it reads provider/model/secret
+// STATUS from that daemon's `credentials.get`, never from its own surfaceRoot store.
+export {
+  credentialReadModeFromHostMode,
+  deriveCredentialAvailability,
+  readClientCredentialStatus,
+} from './credential-availability.ts';
+export type {
+  CredentialAvailability,
+  CredentialReadMode,
+  CredentialStatusEntry,
+  CredentialStatusOutcome,
+} from './credential-availability.ts';

package/src/runtime/bootstrap-core.ts

@@ -27,6 +27,7 @@ import { loadBootstrapSystemPrompt, syncConfiguredServices } from '@/runtime/ind
 import { registerBootstrapHookBridge } from '@/runtime/index.ts';
 import { registerBootstrapRuntimeEvents } from '@/runtime/index.ts';
 import { createRuntimeServices, type RuntimeServices } from './services.ts';
+import { runBootMemoryFold } from './memory-fold.ts';
 import { setPricingSource } from '../export/cost-utils.ts';
 import { createUiRuntimeServices, type UiRuntimeServices } from './ui-services.ts';
 import { join } from 'node:path';
@@ -407,24 +408,23 @@ export async function initializeBootstrapCore(
     void memoryStore.save();
     memoryStore.close();
   });
+  // W6-C2 (E6): fold this project's legacy per-project TUI memory into the home-scoped canonical store, ONCE, AFTER init(). Idempotent and non-fatal.
+  await runBootMemoryFold(memoryStore, services.memoryEmbeddingRegistry, workingDir, logger);
 
   const renderRequestRef = { value: (): void => {} };
-  // R1: Coalescing render scheduler — collapses N requestRender() calls into 1
-  // and enforces a 16ms minimum interval to cap repaints at ~60fps.
-  //
-  // renderScheduled stays set for the ENTIRE window (until run() executes), so
-  // requestRender() calls that arrive on later event-loop ticks within the same
-  // 16ms window are coalesced into the one already-pending tail render instead
-  // of each queuing their own setTimeout. (The streaming hot path drives its own
-  // direct repaints and does not flow through this scheduler.)
+  // R1: Coalescing render scheduler — collapses N requestRender() calls into 1 and
+  // enforces a 16ms minimum interval to cap repaints at ~60fps. renderScheduled stays
+  // set for the ENTIRE window (until run() executes), so requestRender() calls arriving
+  // on later event-loop ticks within the same 16ms window coalesce into the one
+  // already-pending tail render instead of each queuing their own setTimeout. (The
+  // streaming hot path drives its own direct repaints and skips this scheduler.)
   let renderScheduled = false;
   let lastRenderTime = 0;
   const RENDER_INTERVAL_MS = 16;
-  // run() performs the actual render. It clears renderScheduled FIRST — even if
-  // the render callback throws — otherwise a single render exception would wedge
-  // the entire TUI (no future requestRender() call would schedule anything). The
-  // renderer is expected to surface failures via its own error path; we log at
-  // error so the next requestRender() can still reschedule.
+  // run() performs the actual render. It clears renderScheduled FIRST — even if the
+  // render callback throws — otherwise a single render exception would wedge the entire
+  // TUI (no future requestRender() would schedule anything); we log at error so the
+  // next requestRender() can still reschedule.
   const run = (): void => {
     renderScheduled = false;
     lastRenderTime = Date.now();

package/src/runtime/memory-fold.ts

@@ -1,6 +1,7 @@
 import { join } from 'node:path';
 import {
   foldMemoryStores,
+  formatMemoryFoldReport,
   type LegacyMemorySource,
   type MemoryEmbeddingProviderRegistry,
   type MemoryFoldReport,
@@ -24,3 +25,31 @@ export async function foldTuiLegacyMemory(
   ];
   return foldMemoryStores(memoryStore, sources, { embeddingRegistry: memoryEmbeddingRegistry });
 }
+
+/** A minimal boot logger seam (matches the SDK logger's info/warn shape). */
+export interface BootFoldLogger {
+  info(message: string, meta?: unknown): void;
+  warn(message: string, meta?: unknown): void;
+}
+
+/**
+ * Run the legacy TUI memory fold at boot and surface the report. Never blocks or
+ * fails boot: a fold error degrades to a warn and the canonical store serves on.
+ * Only logs the report when something actually moved (or a source failed), so a
+ * clean boot stays quiet.
+ */
+export async function runBootMemoryFold(
+  memoryStore: MemoryStore,
+  memoryEmbeddingRegistry: MemoryEmbeddingProviderRegistry,
+  workingDirectory: string,
+  log: BootFoldLogger,
+): Promise<void> {
+  try {
+    const report = await foldTuiLegacyMemory(memoryStore, memoryEmbeddingRegistry, workingDirectory);
+    if (report.totalImported > 0 || report.failedSources.length > 0) {
+      log.info(`[bootstrap] memory fold: ${formatMemoryFoldReport(report)}`);
+    }
+  } catch (err) {
+    log.warn('memory fold at bootstrap failed (non-fatal; canonical store unaffected)', { err });
+  }
+}

package/src/version.ts

@@ -6,7 +6,7 @@ import { join } from 'node:path';
 // The prebuild script updates the fallback value before compilation.
 // Uses import.meta.dir (Bun) to locate package.json relative to this file,
 // which is correct regardless of the process working directory.
-let _version = '1.9.0';
+let _version = '1.9.1';
 try {
   const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', 'package.json'), 'utf-8'));
   _version = pkg.version ?? _version;