@pellux/goodvibes-agent 0.1.0

package/src/input/commands/cloudflare-runtime.ts

@@ -0,0 +1,370 @@
+import {
+  CLOUDFLARE_COMPONENT_IDS,
+  CLOUDFLARE_COMPONENT_LABELS,
+  DEFAULT_CLOUDFLARE_COMPONENT_SELECTION,
+  CloudflareDaemonRouteError,
+  createCloudflareDaemonClient,
+  type CloudflareComponent,
+  type CloudflareComponentSelection,
+  type CloudflareDaemonClient,
+  type CloudflareProvisionStep,
+} from '../../runtime/cloudflare-control-plane.ts';
+import type { CommandContext, CommandRegistry } from '../command-registry.ts';
+import { requireShellPaths } from './runtime-services.ts';
+
+interface ParsedCloudflareArgs {
+  readonly positional: readonly string[];
+  readonly flags: ReadonlyMap<string, readonly string[]>;
+}
+
+export function registerCloudflareRuntimeCommands(registry: CommandRegistry): void {
+  registry.register({
+    name: 'cloudflare',
+    aliases: ['cf'],
+    description: 'Inspect and manage optional Cloudflare batch/control-plane integration through daemon SDK routes',
+    usage: '[status|setup|requirements|create-token|discover|validate|provision|verify|disable] [flags]',
+    async handler(args, ctx) {
+      const subcommand = (args[0] ?? 'status').toLowerCase();
+      const parsed = parseCloudflareArgs(args.slice(1));
+      if (subcommand === 'setup' || subcommand === 'onboarding') {
+        ctx.openOnboardingWizard?.({ mode: 'edit', reset: true });
+        ctx.print('Opening onboarding wizard. Select the Cloudflare batch capability to configure Cloudflare.');
+        return;
+      }
+
+      let client: CloudflareDaemonClient;
+      try {
+        client = createCloudflareClient(ctx);
+      } catch (error) {
+        ctx.print(`Cloudflare command unavailable: ${formatCloudflareError(error)}`);
+        return;
+      }
+
+      try {
+        if (subcommand === 'status' || subcommand === 'show') {
+          const status = await client.status();
+          ctx.print([
+            'Cloudflare Status',
+            `  enabled: ${status.enabled ? 'yes' : 'no'}`,
+            `  ready: ${status.ready ? 'yes' : 'no'}`,
+            `  account: ${status.config.accountId || '(not set)'}`,
+            `  token ref: ${status.config.apiTokenRef || '(CLOUDFLARE_API_TOKEN fallback)'}`,
+            `  worker: ${status.config.workerName || '(not set)'}`,
+            `  worker URL: ${status.config.workerBaseUrl || '(not set)'}`,
+            `  queue: ${status.config.queueName || '(not set)'}`,
+            `  DLQ: ${status.config.deadLetterQueueName || '(not set)'}`,
+            `  tunnel: ${status.config.tunnelName || '(not set)'} ${status.config.tunnelId ? `(${status.config.tunnelId})` : ''}`.trimEnd(),
+            `  access app: ${status.config.accessAppId || '(not set)'}`,
+            `  batch mode: ${String(ctx.platform.configManager.get('batch.mode') ?? 'off')}`,
+            `  queue backend: ${String(ctx.platform.configManager.get('batch.queueBackend') ?? 'local')}`,
+            ...status.warnings.map((warning) => `  warning: ${warning}`),
+          ].join('\n'));
+          return;
+        }
+
+        if (subcommand === 'requirements') {
+          const result = await client.tokenRequirements({
+            components: componentsFromArgs(parsed),
+            includeBootstrap: true,
+          });
+          ctx.print([
+            'Cloudflare Token Requirements',
+            `  components: ${formatComponents(result.components)}`,
+            '  permissions:',
+            ...result.permissions.map((permission) => `    ${permission.scope}: ${permission.permission} (${permission.component}) - ${permission.reason}`),
+            ...(result.bootstrapToken.instructions.length > 0
+              ? ['  bootstrap token:', ...result.bootstrapToken.instructions.map((line) => `    ${line}`)]
+              : []),
+          ].join('\n'));
+          return;
+        }
+
+        if (subcommand === 'create-token') {
+          const bootstrapToken = getFlag(parsed, 'bootstrap-token') || readTokenEnv(parsed, 'bootstrap-env');
+          if (!bootstrapToken) {
+            ctx.print('Usage: /cloudflare create-token --account <account-id> --bootstrap-token <token> or --bootstrap-env <env-name>');
+            return;
+          }
+          const result = await client.createOperationalToken({
+            components: componentsFromArgs(parsed),
+            ...optionalString('accountId', getFlag(parsed, 'account') || getFlag(parsed, 'account-id')),
+            ...optionalString('zoneId', getFlag(parsed, 'zone-id')),
+            ...optionalString('zoneName', getFlag(parsed, 'zone') || getFlag(parsed, 'zone-name')),
+            bootstrapToken,
+            storeApiToken: true,
+            persistConfig: true,
+          });
+          ctx.print([
+            'Cloudflare Operational Token Created',
+            `  token: ${result.tokenName}${result.tokenId ? ` (${result.tokenId})` : ''}`,
+            `  account: ${result.accountId}`,
+            `  zone: ${result.zoneId || '(none)'}`,
+            `  stored ref: ${result.apiTokenRef ?? '(not stored)'}`,
+            '  revoke or expire the temporary bootstrap token after validation.',
+          ].join('\n'));
+          return;
+        }
+
+        if (subcommand === 'discover') {
+          const result = await client.discover({
+            ...cloudflareAuthInput(parsed),
+            components: componentsFromArgs(parsed),
+            ...optionalString('zoneId', getFlag(parsed, 'zone-id')),
+            ...optionalString('zoneName', getFlag(parsed, 'zone') || getFlag(parsed, 'zone-name')),
+            includeResources: !hasFlag(parsed, 'fast'),
+          });
+          ctx.print([
+            'Cloudflare Discovery',
+            `  token source: ${result.tokenSource}`,
+            `  accounts: ${result.accounts.length}`,
+            ...result.accounts.slice(0, 12).map((account) => `    account ${account.id}: ${account.name}`),
+            `  zones: ${result.zones.length}`,
+            ...result.zones.slice(0, 12).map((zone) => `    zone ${zone.id}: ${zone.name}${zone.status ? ` (${zone.status})` : ''}`),
+            `  worker subdomain: ${result.workerSubdomain || '(not detected)'}`,
+            `  queues: ${result.queues?.length ?? 0}`,
+            `  KV namespaces: ${result.kvNamespaces?.length ?? 0}`,
+            `  R2 buckets: ${result.r2Buckets?.length ?? 0}`,
+            ...result.warnings.map((warning) => `  warning: ${warning}`),
+          ].join('\n'));
+          return;
+        }
+
+        if (subcommand === 'validate') {
+          const result = await client.validate(cloudflareAuthInput(parsed));
+          ctx.print([
+            'Cloudflare Token Validation',
+            `  ok: ${result.ok ? 'yes' : 'no'}`,
+            `  token source: ${result.tokenSource}`,
+            result.account ? `  account: ${result.account.name} (${result.account.id})` : '  account: not resolved',
+          ].join('\n'));
+          return;
+        }
+
+        if (subcommand === 'provision') {
+          const result = await client.provision({
+            ...cloudflareAuthInput(parsed),
+            components: componentsFromArgs(parsed),
+            ...optionalString('accountId', getFlag(parsed, 'account') || getFlag(parsed, 'account-id')),
+            ...optionalString('zoneId', getFlag(parsed, 'zone-id')),
+            ...optionalString('zoneName', getFlag(parsed, 'zone') || getFlag(parsed, 'zone-name')),
+            ...optionalString('daemonBaseUrl', getFlag(parsed, 'daemon-url')),
+            ...optionalString('daemonHostname', getFlag(parsed, 'daemon-hostname')),
+            ...optionalString('workerName', getFlag(parsed, 'worker-name')),
+            ...optionalString('workerSubdomain', getFlag(parsed, 'worker-subdomain')),
+            ...optionalString('workerHostname', getFlag(parsed, 'worker-hostname')),
+            ...optionalString('workerBaseUrl', getFlag(parsed, 'worker-url')),
+            ...optionalString('queueName', getFlag(parsed, 'queue') || getFlag(parsed, 'queue-name')),
+            ...optionalString('deadLetterQueueName', getFlag(parsed, 'dlq') || getFlag(parsed, 'dead-letter-queue')),
+            ...optionalString('tunnelName', getFlag(parsed, 'tunnel-name')),
+            ...optionalString('tunnelId', getFlag(parsed, 'tunnel-id')),
+            ...optionalString('tunnelServiceUrl', getFlag(parsed, 'tunnel-service-url')),
+            ...optionalString('tunnelTokenRef', getFlag(parsed, 'tunnel-token-ref')),
+            ...optionalString('accessAppId', getFlag(parsed, 'access-app-id')),
+            ...optionalString('accessServiceTokenId', getFlag(parsed, 'access-service-token-id')),
+            ...optionalString('accessServiceTokenRef', getFlag(parsed, 'access-service-token-ref')),
+            ...optionalString('kvNamespaceName', getFlag(parsed, 'kv-namespace-name')),
+            ...optionalString('kvNamespaceId', getFlag(parsed, 'kv-namespace-id')),
+            ...optionalString('durableObjectNamespaceName', getFlag(parsed, 'do-namespace-name') || getFlag(parsed, 'durable-object-namespace-name')),
+            ...optionalString('durableObjectNamespaceId', getFlag(parsed, 'do-namespace-id') || getFlag(parsed, 'durable-object-namespace-id')),
+            ...optionalString('r2BucketName', getFlag(parsed, 'r2-bucket-name')),
+            ...optionalString('secretsStoreName', getFlag(parsed, 'secrets-store-name')),
+            ...optionalString('secretsStoreId', getFlag(parsed, 'secrets-store-id')),
+            ...optionalString('workerCron', getFlag(parsed, 'worker-cron')),
+            ...optionalString('operatorToken', getFlag(parsed, 'operator-token')),
+            ...optionalString('operatorTokenRef', getFlag(parsed, 'operator-token-ref')),
+            ...optionalString('workerClientToken', getFlag(parsed, 'worker-client-token')),
+            ...optionalString('workerClientTokenRef', getFlag(parsed, 'worker-client-token-ref')),
+            ...optionalBatchMode(readBatchMode(parsed)),
+            persistConfig: true,
+            verify: !hasFlag(parsed, 'no-verify'),
+            storeApiToken: !hasFlag(parsed, 'no-store-token'),
+            enableWorkersDev: !hasFlag(parsed, 'no-workers-dev'),
+          });
+          ctx.print([
+            'Cloudflare Provisioning',
+            `  ok: ${result.ok ? 'yes' : 'no'}`,
+            ...(result.worker ? [`  worker: ${result.worker.name}${result.worker.baseUrl ? ` at ${result.worker.baseUrl}` : ''}`] : []),
+            ...(result.queues ? [`  queues: ${result.queues.queueName}; DLQ ${result.queues.deadLetterQueueName}`] : []),
+            ...(result.tunnel ? [`  tunnel: ${result.tunnel.name} (${result.tunnel.id})${result.tunnel.hostname ? ` ${result.tunnel.hostname}` : ''}`] : []),
+            ...(result.access ? [`  access: app=${result.access.appId || '(none)'} serviceToken=${result.access.serviceTokenId || '(none)'}`] : []),
+            ...(result.dns ? [`  dns: ${result.dns.zoneName || result.dns.zoneId} records=${result.dns.records.length}`] : []),
+            ...(result.kv ? [`  kv: ${result.kv.namespaceName} (${result.kv.namespaceId})`] : []),
+            ...(result.r2 ? [`  r2: ${result.r2.bucketName}`] : []),
+            ...(result.secretsStore ? [`  secrets store: ${result.secretsStore.storeName} (${result.secretsStore.storeId})`] : []),
+            ...formatProvisionSteps(result.steps),
+          ].join('\n'));
+          return;
+        }
+
+        if (subcommand === 'verify') {
+          const result = await client.verify({
+            ...optionalString('workerBaseUrl', getFlag(parsed, 'worker-url')),
+            ...optionalString('workerClientToken', getFlag(parsed, 'worker-token')),
+            ...optionalString('workerClientTokenRef', getFlag(parsed, 'worker-token-ref')),
+          });
+          ctx.print([
+            'Cloudflare Verification',
+            `  ok: ${result.ok ? 'yes' : 'no'}`,
+            `  worker health: ${result.workerHealth.ok ? 'ok' : 'failed'} (HTTP ${result.workerHealth.status})${result.workerHealth.error ? ` - ${result.workerHealth.error}` : ''}`,
+            ...(result.daemonBatchProxy ? [`  daemon batch proxy: ${result.daemonBatchProxy.ok ? 'ok' : 'failed'} (HTTP ${result.daemonBatchProxy.status})${result.daemonBatchProxy.error ? ` - ${result.daemonBatchProxy.error}` : ''}`] : []),
+          ].join('\n'));
+          return;
+        }
+
+        if (subcommand === 'disable') {
+          const result = await client.disable({
+            ...cloudflareAuthInput(parsed),
+            ...optionalString('workerName', getFlag(parsed, 'worker-name')),
+            disableWorkerSubdomain: hasFlag(parsed, 'disable-worker-subdomain'),
+            disableCron: !hasFlag(parsed, 'keep-cron'),
+            persistConfig: true,
+          });
+          ctx.print([
+            'Cloudflare Disabled',
+            `  ok: ${result.ok ? 'yes' : 'no'}`,
+            ...formatProvisionSteps(result.steps),
+          ].join('\n'));
+          return;
+        }
+
+        ctx.print('Usage: /cloudflare [status|setup|requirements|create-token|discover|validate|provision|verify|disable] [flags]');
+      } catch (error) {
+        ctx.print(`Cloudflare ${subcommand} failed: ${formatCloudflareError(error)}`);
+      }
+    },
+  });
+}
+
+function createCloudflareClient(ctx: CommandContext): CloudflareDaemonClient {
+  const shellPaths = requireShellPaths(ctx);
+  return createCloudflareDaemonClient({
+    configManager: ctx.platform.configManager,
+    homeDirectory: shellPaths.homeDirectory,
+  });
+}
+
+function parseCloudflareArgs(args: readonly string[]): ParsedCloudflareArgs {
+  const positional: string[] = [];
+  const flags = new Map<string, string[]>();
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index]!;
+    if (!arg.startsWith('--')) {
+      positional.push(arg);
+      continue;
+    }
+    const raw = arg.slice(2);
+    const equalsIndex = raw.indexOf('=');
+    if (equalsIndex >= 0) {
+      const key = raw.slice(0, equalsIndex);
+      const value = raw.slice(equalsIndex + 1);
+      flags.set(key, [...(flags.get(key) ?? []), value]);
+      continue;
+    }
+    const next = args[index + 1];
+    if (next && !next.startsWith('--')) {
+      flags.set(raw, [...(flags.get(raw) ?? []), next]);
+      index += 1;
+    } else {
+      flags.set(raw, [...(flags.get(raw) ?? []), 'true']);
+    }
+  }
+  return { positional, flags };
+}
+
+function hasFlag(args: ParsedCloudflareArgs, key: string): boolean {
+  return args.flags.has(key);
+}
+
+function getFlag(args: ParsedCloudflareArgs, key: string): string {
+  const values = args.flags.get(key);
+  const value = values?.[values.length - 1] ?? '';
+  return value === 'true' ? '' : value.trim();
+}
+
+function getFlagValues(args: ParsedCloudflareArgs, key: string): readonly string[] {
+  return args.flags.get(key)?.map((value) => value.trim()).filter(Boolean) ?? [];
+}
+
+function componentsFromArgs(args: ParsedCloudflareArgs): Record<CloudflareComponent, boolean> {
+  const components: Record<CloudflareComponent, boolean> = { ...DEFAULT_CLOUDFLARE_COMPONENT_SELECTION };
+  if (hasFlag(args, 'all') || hasFlag(args, 'advanced')) {
+    for (const component of CLOUDFLARE_COMPONENT_IDS) components[component] = true;
+  }
+  for (const raw of [...args.positional, ...getFlagValues(args, 'component')]) {
+    const normalized = normalizeComponent(raw);
+    if (normalized) components[normalized] = true;
+  }
+  for (const raw of getFlagValues(args, 'no-component')) {
+    const normalized = normalizeComponent(raw);
+    if (normalized) components[normalized] = false;
+  }
+  return components;
+}
+
+function normalizeComponent(value: string): CloudflareComponent | null {
+  const normalized = value.trim().toLowerCase().replace(/[-_]/g, '');
+  for (const component of CLOUDFLARE_COMPONENT_IDS) {
+    if (component.toLowerCase() === normalized) return component;
+  }
+  if (normalized === 'workerscript' || normalized === 'worker') return 'workers';
+  if (normalized === 'queue') return 'queues';
+  if (normalized === 'tunnel') return 'zeroTrustTunnel';
+  if (normalized === 'access') return 'zeroTrustAccess';
+  if (normalized === 'domain' || normalized === 'hostname') return 'dns';
+  if (normalized === 'do' || normalized === 'durableobject') return 'durableObjects';
+  if (normalized === 'secret' || normalized === 'secrets') return 'secretsStore';
+  return null;
+}
+
+function formatComponents(components: CloudflareComponentSelection): string {
+  const selected = CLOUDFLARE_COMPONENT_IDS
+    .filter((component) => components[component] === true)
+    .map((component) => CLOUDFLARE_COMPONENT_LABELS[component]);
+  return selected.length > 0 ? selected.join(', ') : 'none';
+}
+
+function cloudflareAuthInput(args: ParsedCloudflareArgs): {
+  readonly accountId?: string;
+  readonly apiToken?: string;
+  readonly apiTokenRef?: string;
+} {
+  const token = getFlag(args, 'token') || readTokenEnv(args, 'token-env');
+  const tokenRef = getFlag(args, 'token-ref');
+  return {
+    ...optionalString('accountId', getFlag(args, 'account') || getFlag(args, 'account-id')),
+    ...(token ? { apiToken: token } : tokenRef ? { apiTokenRef: tokenRef } : {}),
+  };
+}
+
+function readTokenEnv(args: ParsedCloudflareArgs, key: string): string {
+  const envName = getFlag(args, key);
+  if (!envName) return '';
+  return process.env[envName] ?? '';
+}
+
+function readBatchMode(args: ParsedCloudflareArgs): 'off' | 'explicit' | 'eligible-by-default' | undefined {
+  const value = getFlag(args, 'batch-mode');
+  if (value === 'off' || value === 'explicit' || value === 'eligible-by-default') return value;
+  return undefined;
+}
+
+function optionalString<K extends string>(key: K, value: string): Partial<Record<K, string>> {
+  return value.trim().length > 0 ? { [key]: value.trim() } as Partial<Record<K, string>> : {};
+}
+
+function optionalBatchMode(value: ReturnType<typeof readBatchMode>): { readonly batchMode?: 'off' | 'explicit' | 'eligible-by-default' } {
+  return value ? { batchMode: value } : {};
+}
+
+function formatProvisionSteps(steps: readonly CloudflareProvisionStep[]): string[] {
+  return steps.length > 0
+    ? steps.map((step) => `  ${step.status}: ${step.name}${step.message ? ` - ${step.message}` : ''}`)
+    : ['  no steps returned'];
+}
+
+function formatCloudflareError(error: unknown): string {
+  if (error instanceof CloudflareDaemonRouteError) {
+    return `${error.message} (HTTP ${error.status}, ${error.code})`;
+  }
+  return error instanceof Error ? error.message : String(error);
+}

package/src/input/commands/config.ts

@@ -0,0 +1,18 @@
+import type { CommandRegistry } from '../command-registry.ts';
+
+export function registerConfigCommand(registry: CommandRegistry): void {
+  registry.register({
+    name: 'config',
+    aliases: ['cfg'],
+    description: 'Open the fullscreen configuration workspace',
+    usage: '[category|key]',
+    argsHint: '[category|key]',
+    handler(args, ctx) {
+      if (ctx.openSettingsModal) {
+        ctx.openSettingsModal(args[0]);
+        return;
+      }
+      ctx.print('Fullscreen config workspace is not available in this runtime.');
+    },
+  });
+}

package/src/input/commands/control-room-runtime.ts

@@ -0,0 +1,255 @@
+import type { CommandRegistry } from '../command-registry.ts';
+import { buildMcpAttackPathReview } from '@/runtime/index.ts';
+import { buildKnowledgeInjectionPrompt, selectKnowledgeForTask } from '@pellux/goodvibes-sdk/platform/state';
+import { listBuiltinSubscriptionProviders } from '@pellux/goodvibes-sdk/platform/config';
+import { requireReadModels, requireSubscriptionManager, requireTokenAuditor } from './runtime-services.ts';
+import { getMemoryApi } from './recall-query.ts';
+
+export function registerControlRoomRuntimeCommands(registry: CommandRegistry): void {
+  registry.register({
+    name: 'cockpit',
+    aliases: [],
+    description: 'Open the unified operator cockpit',
+    usage: '',
+    handler(_args, ctx) {
+      if (ctx.openCockpitPanel) {
+        ctx.openCockpitPanel();
+        return;
+      }
+      ctx.print('Cockpit panel is not available in this runtime.');
+    },
+  });
+
+  registry.register({
+    name: 'orchestration',
+    aliases: ['orch'],
+    description: 'Inspect orchestration graphs and cancel active graphs or subtrees',
+    usage: '[show [graphId] | cancel graph <graphId> | cancel subtree <agentId>]',
+    handler(args, ctx) {
+      const graphs = [...requireReadModels(ctx).orchestration.getSnapshot().graphs];
+      if (args.length === 0) {
+        if (ctx.openOrchestrationPanel) {
+          ctx.openOrchestrationPanel();
+          return;
+        }
+        if (graphs.length === 0) {
+          ctx.print('Orchestration panel is not available in this runtime.');
+          return;
+        }
+      }
+      const subcommand = args[0]?.toLowerCase() ?? 'show';
+
+      if (subcommand === 'show') {
+        const graphId = args[1];
+        const graph = graphId ? graphs.find((entry) => entry.id === graphId) : graphs[0];
+        if (!graph) {
+          ctx.print(graphId ? `Unknown orchestration graph: ${graphId}` : 'No orchestration graphs recorded yet.');
+          return;
+        }
+        const lines = [
+          `Graph ${graph.id}`,
+          `  title: ${graph.title}`,
+          `  status: ${graph.status}`,
+          `  mode: ${graph.mode}`,
+          `  nodes: ${graph.nodeOrder.length}`,
+        ];
+        if (graph.lastRecursionGuard) {
+          lines.push(`  last guard: depth ${graph.lastRecursionGuard.depth}, active ${graph.lastRecursionGuard.activeAgents}, ${graph.lastRecursionGuard.reason}`);
+        }
+        for (const nodeId of graph.nodeOrder.slice(0, 12)) {
+          const node = graph.nodes.get(nodeId);
+          if (!node) continue;
+          lines.push(`  - ${node.id} ${node.role} ${node.status} ${node.title}`);
+        }
+        ctx.print(lines.join('\n'));
+        return;
+      }
+
+      if (subcommand === 'cancel') {
+        const mode = args[1]?.toLowerCase();
+        const target = args[2];
+        const manager = ctx.ops.agentManager;
+        if (!manager) {
+          ctx.print('Agent manager is not available in this runtime.');
+          return;
+        }
+        if (!mode || !target) {
+          ctx.print('Usage: /orchestration cancel graph <graphId> | /orchestration cancel subtree <agentId>');
+          return;
+        }
+        if (mode === 'graph') {
+          const cancelled = manager.cancelGraph(target);
+          ctx.print(cancelled.length > 0
+            ? `Cancelled ${cancelled.length} agent${cancelled.length !== 1 ? 's' : ''} in graph ${target}.`
+            : `No cancellable agents found in graph ${target}.`);
+          return;
+        }
+        if (mode === 'subtree') {
+          const cancelled = manager.cancelSubtree(target);
+          ctx.print(cancelled.length > 0
+            ? `Cancelled ${cancelled.length} agent${cancelled.length !== 1 ? 's' : ''} in subtree rooted at ${target}.`
+            : `No cancellable agents found in subtree rooted at ${target}.`);
+          return;
+        }
+        ctx.print(`Unknown orchestration cancel target: ${mode}`);
+        return;
+      }
+
+      ctx.print(`Unknown orchestration subcommand: ${subcommand}`);
+    },
+  });
+
+  registry.register({
+    name: 'communication',
+    aliases: ['comms'],
+    description: 'Inspect structured agent communication routes and recent activity',
+    usage: '',
+    handler(_args, ctx) {
+      if (ctx.openCommunicationPanel) {
+        ctx.openCommunicationPanel();
+        return;
+      }
+      ctx.print('Communication panel is not available in this runtime.');
+    },
+  });
+
+  registry.register({
+    name: 'security',
+    aliases: [],
+    description: 'Inspect security posture, attack paths, and review state',
+    usage: '[review | attack-paths | tokens]',
+    handler(args, ctx) {
+      if (args.length === 0) {
+        if (ctx.openSecurityPanel) {
+          ctx.openSecurityPanel();
+          return;
+        }
+        ctx.print('Security panel is not available in this runtime.');
+        return;
+      }
+
+      const subcommand = args[0]?.toLowerCase() ?? 'review';
+      const audit = requireTokenAuditor(ctx).auditAll(Date.now());
+      const securitySnapshot = requireReadModels(ctx).security.getSnapshot();
+      const policySnapshot = ctx.extensions.policyRuntimeState?.getSnapshot();
+      if (!policySnapshot) {
+        ctx.print('Policy runtime state is not available in this runtime.');
+        return;
+      }
+      const attackPaths = buildMcpAttackPathReview({
+        servers: securitySnapshot.mcpServers,
+        recentDecisions: securitySnapshot.recentMcpDecisions,
+      });
+
+      if (subcommand === 'tokens') {
+        if (audit.results.length === 0) {
+          ctx.print('No registered API tokens are currently under audit.');
+          return;
+        }
+        ctx.print([
+          `Token Audit (${audit.results.length})`,
+          ...audit.results.map((result) => (
+            `  ${result.label}  policy=${result.scope.policyId}  scope=${result.scope.outcome}  rotation=${result.rotation.outcome}  blocked=${result.blocked ? 'yes' : 'no'}`
+          )),
+        ].join('\n'));
+        return;
+      }
+
+      if (subcommand === 'attack-paths') {
+        if (attackPaths.findings.length === 0) {
+          ctx.print('No MCP attack-path findings are currently active.');
+          return;
+        }
+        ctx.print([
+          `MCP Attack-Path Review`,
+          `  summary: ${attackPaths.summary}`,
+          ...attackPaths.findings.slice(0, 12).map((finding) => (
+            `  ${finding.severity.toUpperCase()} ${finding.serverName}  ${finding.route}\n    ${finding.reason}`
+          )),
+        ].join('\n'));
+        return;
+      }
+
+      const plugins = ctx.extensions.pluginManager?.list() ?? [];
+      const subscriptions = requireSubscriptionManager(ctx);
+      const builtinProviders = listBuiltinSubscriptionProviders();
+      ctx.print([
+        'Security Review',
+        `  tokens: ${audit.results.length}`,
+        `  blocked tokens: ${audit.blocked.length}`,
+        `  scope violations: ${audit.scopeViolations.length}`,
+        `  rotation overdue: ${audit.rotationOverdue.length}`,
+        `  rotation warnings: ${audit.rotationWarnings.length}`,
+        `  built-in subscription providers: ${builtinProviders.length}`,
+        `  active subscriptions: ${subscriptions.list().length}`,
+        `  pending subscriptions: ${subscriptions.listPending().length}`,
+        `  policy lint findings: ${policySnapshot.lintFindings.length}`,
+        `  policy preflight: ${policySnapshot.lastPreflightReview?.status ?? 'n/a'}`,
+        `  mcp servers: ${securitySnapshot.mcpServers.length}`,
+        `  mcp quarantined: ${securitySnapshot.mcpServers.filter((server) => server.schemaFreshness === 'quarantined').length}`,
+        `  mcp elevated: ${securitySnapshot.mcpServers.filter((server) => server.trustMode === 'allow-all').length}`,
+        `  mcp attack-path findings: ${attackPaths.findings.length}`,
+        `  quarantined plugins: ${plugins.filter((plugin) => plugin.quarantined).length}`,
+        `  untrusted plugins: ${plugins.filter((plugin) => plugin.trustTier === 'untrusted').length}`,
+      ].join('\n'));
+    },
+  });
+
+  registry.register({
+    name: 'knowledge',
+    aliases: ['know'],
+    description: 'Inspect durable project knowledge, risks, runbooks, and architecture notes',
+    usage: '[open | queue [limit] | explain <task...> [--scope <path> ...]]',
+    handler(args, ctx) {
+      const subcommand = (args[0] ?? 'open').toLowerCase();
+      if (subcommand === 'open') {
+        if (ctx.openKnowledgePanel) {
+          ctx.openKnowledgePanel();
+          return;
+        }
+        ctx.print('Knowledge panel is not available in this runtime.');
+        return;
+      }
+      const memory = getMemoryApi(ctx);
+      if (!memory) return;
+      if (subcommand === 'queue') {
+        const limit = Math.max(1, parseInt(args[1] ?? '10', 10) || 10);
+        const queue = memory.reviewQueue(limit);
+        if (queue.length === 0) {
+          ctx.print('Knowledge review queue is empty.');
+          return;
+        }
+        ctx.print([
+          `Knowledge Review Queue (${queue.length})`,
+          ...queue.map((record) => `  ${record.id}  [${record.scope}/${record.cls}] ${record.reviewState} ${record.confidence}%  ${record.summary}`),
+        ].join('\n'));
+        return;
+      }
+      if (subcommand === 'explain') {
+        const scopeIdx = args.indexOf('--scope');
+        const scopeValues = scopeIdx !== -1
+          ? args.slice(scopeIdx + 1).filter((token) => !token.startsWith('--'))
+          : [];
+        const taskTokens = args.slice(1).filter((token, index) => {
+          if (token === '--scope') return false;
+          if (scopeIdx !== -1 && index + 1 > scopeIdx) return false;
+          return true;
+        });
+        const task = taskTokens.join(' ').trim();
+        if (!task) {
+          ctx.print('Usage: /knowledge explain <task...> [--scope <path> ...]');
+          return;
+        }
+        const injections = selectKnowledgeForTask(memory, task, scopeValues);
+        const prompt = buildKnowledgeInjectionPrompt(injections);
+        ctx.print(prompt ?? 'No reviewed project knowledge matched that task.');
+        return;
+      }
+      if (ctx.openKnowledgePanel) {
+        ctx.openKnowledgePanel();
+        return;
+      }
+      ctx.print(`Unknown knowledge subcommand: ${subcommand}`);
+    },
+  });
+}