@pellux/goodvibes-agent 0.1.111 → 0.1.113

package/src/input/commands/channels-runtime.ts

@@ -1,47 +1,409 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
 import type { CommandRegistry } from '../command-registry.ts';
+import type { CommandContext } from '../command-registry.ts';
+import type { AgentWorkspaceChannelStatus } from '../agent-workspace-channels.ts';
 import { buildAgentWorkspaceChannels } from '../agent-workspace-channels.ts';
 
+type ChannelFilter = 'all' | 'ready' | 'attention';
+type JsonRecord = Record<string, unknown>;
+
+interface ChannelDaemonConnection {
+  readonly baseUrl: string;
+  readonly token: string | null;
+  readonly tokenPath: string;
+}
+
+interface ChannelRouteSuccess {
+  readonly ok: true;
+  readonly route: string;
+  readonly body: unknown;
+}
+
+interface ChannelRouteFailure {
+  readonly ok: false;
+  readonly route: string;
+  readonly kind: 'auth_required' | 'daemon_unavailable' | 'route_unavailable' | 'daemon_error';
+  readonly message: string;
+}
+
+type ChannelRouteResult = ChannelRouteSuccess | ChannelRouteFailure;
+
+function isRecord(value: unknown): value is JsonRecord {
+  return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+}
+
+function readString(record: JsonRecord, key: string, fallback = ''): string {
+  const value = record[key];
+  return typeof value === 'string' ? value : fallback;
+}
+
+function readBoolean(record: JsonRecord, key: string, fallback = false): boolean {
+  const value = record[key];
+  return typeof value === 'boolean' ? value : fallback;
+}
+
+function readRecordArray(record: JsonRecord, key: string): readonly JsonRecord[] {
+  const value = record[key];
+  return Array.isArray(value) ? value.filter(isRecord) : [];
+}
+
+function resolveChannelDaemonConnection(context: CommandContext): ChannelDaemonConnection {
+  const hostValue = context.platform?.configManager?.get('controlPlane.host');
+  const portValue = context.platform?.configManager?.get('controlPlane.port');
+  const host = typeof hostValue === 'string' && hostValue.trim().length > 0 ? hostValue.trim() : '127.0.0.1';
+  const port = typeof portValue === 'number' && Number.isFinite(portValue) ? portValue : 3421;
+  const homeDirectory = context.workspace?.shellPaths?.homeDirectory ?? process.env.HOME ?? '';
+  const tokenPath = join(homeDirectory, '.goodvibes', 'daemon', 'operator-tokens.json');
+  if (!existsSync(tokenPath)) return { baseUrl: `http://${host}:${port}`, token: null, tokenPath };
+  try {
+    const parsed = JSON.parse(readFileSync(tokenPath, 'utf-8')) as unknown;
+    const token = isRecord(parsed) && typeof parsed.token === 'string' ? parsed.token : null;
+    return { baseUrl: `http://${host}:${port}`, token, tokenPath };
+  } catch {
+    return { baseUrl: `http://${host}:${port}`, token: null, tokenPath };
+  }
+}
+
+async function fetchChannelRoute(context: CommandContext, route: string): Promise<ChannelRouteResult> {
+  const connection = resolveChannelDaemonConnection(context);
+  if (!connection.token) {
+    return {
+      ok: false,
+      route,
+      kind: 'auth_required',
+      message: `No runtime operator token found at ${connection.tokenPath}`,
+    };
+  }
+
+  try {
+    const response = await fetch(`${connection.baseUrl}${route}`, {
+      headers: { authorization: `Bearer ${connection.token}` },
+    });
+    const text = await response.text();
+    let body: unknown = text;
+    if (text.trim().length > 0) {
+      try {
+        body = JSON.parse(text) as unknown;
+      } catch {
+        body = text;
+      }
+    }
+    if (!response.ok) {
+      const detail = isRecord(body) && typeof body.error === 'string' ? body.error : text;
+      return {
+        ok: false,
+        route,
+        kind: response.status === 401 || response.status === 403
+          ? 'auth_required'
+          : response.status === 404
+            ? 'route_unavailable'
+            : 'daemon_error',
+        message: `HTTP ${response.status}${detail ? `: ${detail}` : ''}`,
+      };
+    }
+    return { ok: true, route, body };
+  } catch (error) {
+    return {
+      ok: false,
+      route,
+      kind: 'daemon_unavailable',
+      message: error instanceof Error ? error.message : String(error),
+    };
+  }
+}
+
+function formatChannelRouteFailure(title: string, failure: ChannelRouteFailure): string {
+  return [
+    `${title}: unavailable`,
+    `  kind: ${failure.kind}`,
+    `  route: ${failure.route}`,
+    `  error: ${failure.message}`,
+    '  policy: read-only; no channel send/action route was called',
+  ].join('\n');
+}
+
+function formatChannelLine(channel: AgentWorkspaceChannelStatus): string {
+  const missing = channel.missingRequiredKeys.length > 0
+    ? ` missing=${channel.missingRequiredKeys.join('|')}`
+    : '';
+  const target = channel.configuredDefaultTargetKeys.length > 0
+    ? ` target=${channel.configuredDefaultTargetKeys.join('|')}`
+    : channel.defaultTargetKeys.length > 0
+      ? ` target=missing(${channel.defaultTargetKeys.join('|')})`
+      : ' target=not-required';
+  return [
+    `  ${channel.label}: ${channel.setupState}`,
+    `ready=${channel.ready ? 'yes' : 'no'}`,
+    `delivery=${channel.delivery}`,
+    `risk=${channel.risk}`,
+    target,
+    missing,
+  ].join(' ');
+}
+
+function filterChannels(
+  channels: readonly AgentWorkspaceChannelStatus[],
+  filter: ChannelFilter,
+): readonly AgentWorkspaceChannelStatus[] {
+  if (filter === 'ready') return channels.filter((channel) => channel.ready);
+  if (filter === 'attention') return channels.filter((channel) => channel.enabled && channel.setupState !== 'ready');
+  return channels;
+}
+
+function printChannelSummary(
+  print: (message: string) => void,
+  channels: readonly AgentWorkspaceChannelStatus[],
+  filter: ChannelFilter,
+): void {
+  const ready = channels.filter((channel) => channel.ready);
+  const enabled = channels.filter((channel) => channel.enabled);
+  const needsTarget = channels.filter((channel) => channel.setupState === 'needs-target');
+  const needsConfig = channels.filter((channel) => channel.setupState === 'needs-config');
+  const filtered = filterChannels(channels, filter);
+  const title = filter === 'ready'
+    ? 'Channel Readiness: Ready'
+    : filter === 'attention'
+      ? 'Channel Readiness: Needs Attention'
+      : 'Channel Readiness';
+  const lines: string[] = [
+    title,
+    `  ready: ${ready.length}/${channels.length}`,
+    `  enabled: ${enabled.length}/${channels.length}`,
+    `  needs target: ${needsTarget.length}`,
+    `  needs config: ${needsConfig.length}`,
+    '  policy: read-only inspection; sends require explicit user action and Agent policy',
+    '  details: /channels show <id>',
+    '',
+    ...(filtered.length > 0
+      ? filtered.map(formatChannelLine)
+      : [`  No ${filter === 'ready' ? 'ready' : 'attention'} channels matched.`]),
+  ];
+  print(lines.join('\n'));
+}
+
+function printChannelDetail(
+  print: (message: string) => void,
+  channel: AgentWorkspaceChannelStatus,
+): void {
+  print([
+    `Channel: ${channel.label} (${channel.id})`,
+    `  state: ${channel.setupState}`,
+    `  enabled: ${channel.enabled ? 'yes' : 'no'}`,
+    `  ready: ${channel.ready ? 'yes' : 'no'}`,
+    `  delivery: ${channel.delivery}`,
+    `  risk: ${channel.risk} (${channel.riskLabel})`,
+    `  required config keys: ${channel.requiredKeys.join(', ') || 'none'}`,
+    `  missing config keys: ${channel.missingRequiredKeys.join(', ') || 'none'}`,
+    `  default target keys: ${channel.defaultTargetKeys.join(', ') || 'not required'}`,
+    `  configured target keys: ${channel.configuredDefaultTargetKeys.join(', ') || 'none'}`,
+    `  next: ${channel.nextStep}`,
+    '  policy: this command never prints secret values and never sends messages',
+  ].join('\n'));
+}
+
+function formatChannelAccounts(body: unknown): string {
+  const root = isRecord(body) ? body : {};
+  const accounts = readRecordArray(root, 'accounts');
+  const lines = [
+    'Channel Accounts',
+    `  accounts: ${accounts.length}`,
+    '  policy: read-only account posture; secret values are never shown',
+    '',
+  ];
+  if (accounts.length === 0) return [...lines, '  No channel accounts reported by connected services.'].join('\n');
+  for (const account of accounts.slice(0, 20)) {
+    const surface = readString(account, 'surface', 'unknown');
+    const accountId = readString(account, 'accountId', '');
+    const authState = readString(account, 'authState', readString(account, 'state', 'unknown'));
+    const configured = readBoolean(account, 'configured') ? 'configured' : 'not-configured';
+    const linked = readBoolean(account, 'linked') ? 'linked' : 'not-linked';
+    const secrets = readRecordArray(account, 'secrets')
+      .map((secret) => `${readString(secret, 'field', 'secret')}:${readString(secret, 'source', 'configured')}`)
+      .join(', ') || 'none';
+    lines.push(`  ${surface}${accountId ? `/${accountId}` : ''}: ${configured}; ${linked}; auth=${authState}; secret refs=${secrets}`);
+  }
+  if (accounts.length > 20) lines.push(`  ${accounts.length - 20} more account(s) omitted.`);
+  return lines.join('\n');
+}
+
+function formatChannelPolicies(body: unknown): string {
+  const root = isRecord(body) ? body : {};
+  const policies = readRecordArray(root, 'policies');
+  const lines = [
+    'Channel Policies',
+    `  policies: ${policies.length}`,
+    '  policy: read-only policy posture; use exact confirmed commands for changes',
+    '',
+  ];
+  if (policies.length === 0) return [...lines, '  No channel policies reported by connected services.'].join('\n');
+  for (const policy of policies.slice(0, 20)) {
+    const surface = readString(policy, 'surface', 'unknown');
+    const direct = readBoolean(policy, 'allowDirectMessages') ? 'direct=yes' : 'direct=no';
+    const users = Array.isArray(policy.allowlistUserIds) ? policy.allowlistUserIds.length : 0;
+    const groups = Array.isArray(policy.allowlistGroupIds) ? policy.allowlistGroupIds.length : 0;
+    const groupPolicies = readRecordArray(policy, 'groupPolicies').length;
+    lines.push(`  ${surface}: ${direct}; allowlist users=${users}; groups=${groups}; group policies=${groupPolicies}`);
+  }
+  if (policies.length > 20) lines.push(`  ${policies.length - 20} more policy record(s) omitted.`);
+  return lines.join('\n');
+}
+
+function formatChannelStatus(body: unknown): string {
+  const root = isRecord(body) ? body : {};
+  const channels = readRecordArray(root, 'channels');
+  const lines = [
+    'Connected Channel Status',
+    `  channels: ${channels.length}`,
+    '  policy: read-only connected-service status',
+    '',
+  ];
+  if (channels.length === 0) return [...lines, '  No connected channel status reported.'].join('\n');
+  for (const channel of channels.slice(0, 20)) {
+    const surface = readString(channel, 'surface', 'unknown');
+    const state = readString(channel, 'state', readString(channel, 'status', 'unknown'));
+    const enabled = readBoolean(channel, 'enabled') ? 'enabled' : 'disabled';
+    const ready = readBoolean(channel, 'ready') ? 'ready' : 'not-ready';
+    lines.push(`  ${surface}: ${enabled}; ${ready}; state=${state}`);
+  }
+  if (channels.length > 20) lines.push(`  ${channels.length - 20} more channel(s) omitted.`);
+  return lines.join('\n');
+}
+
+function formatChannelDoctor(surface: string, body: unknown): string {
+  const root = isRecord(body) ? body : {};
+  const checks = readRecordArray(root, 'checks');
+  const repairActions = readRecordArray(root, 'repairActions');
+  const lines = [
+    `Channel Doctor: ${readString(root, 'surface', surface)}`,
+    `  checks: ${checks.length}`,
+    `  repair actions: ${repairActions.length}`,
+    '  policy: read-only doctor report; repair actions are not run here',
+    '',
+  ];
+  if (checks.length === 0) lines.push('  No doctor checks reported.');
+  for (const check of checks.slice(0, 20)) {
+    lines.push(`  ${readString(check, 'id', 'check')}: ${readString(check, 'status', 'unknown')}`);
+  }
+  if (repairActions.length > 0) {
+    lines.push('', '  Available repair action ids:');
+    for (const action of repairActions.slice(0, 12)) lines.push(`  - ${readString(action, 'id', 'action')}`);
+  }
+  return lines.join('\n');
+}
+
+function formatChannelSetup(surface: string, body: unknown): string {
+  const root = isRecord(body) ? body : {};
+  const fields = readRecordArray(root, 'fields');
+  const secretTargets = readRecordArray(root, 'secretTargets');
+  const lines = [
+    `Channel Setup Schema: ${readString(root, 'surface', surface)}`,
+    `  version: ${typeof root.version === 'number' ? root.version : 'unknown'}`,
+    `  fields: ${fields.length}`,
+    `  secret targets: ${secretTargets.length}`,
+    '  policy: read-only setup schema; no credentials or values are printed',
+    '',
+  ];
+  if (fields.length > 0) {
+    lines.push('  Fields:');
+    for (const field of fields.slice(0, 20)) lines.push(`  - ${readString(field, 'id', 'field')}`);
+  }
+  if (secretTargets.length > 0) {
+    lines.push('', '  Secret targets:');
+    for (const target of secretTargets.slice(0, 12)) {
+      const required = readBoolean(target, 'required') ? 'required' : 'optional';
+      lines.push(`  - ${readString(target, 'id', 'secret')} (${required})`);
+    }
+  }
+  return lines.join('\n');
+}
+
+async function printReadOnlyChannelRoute(
+  context: CommandContext,
+  title: string,
+  route: string,
+  format: (body: unknown) => string,
+): Promise<void> {
+  const result = await fetchChannelRoute(context, route);
+  if (!result.ok) {
+    context.print(formatChannelRouteFailure(title, result));
+    return;
+  }
+  context.print(format(result.body));
+}
+
 export function registerChannelsRuntimeCommands(registry: CommandRegistry): void {
   registry.register({
     name: 'channels',
     aliases: ['channel'],
     description: 'Inspect Agent channel readiness without sending messages',
-    usage: '[list|readiness]',
-    argsHint: 'list|readiness',
-    handler(_args, ctx) {
+    usage: '[list|readiness|ready|attention|show <id>|accounts|policies|status|doctor <id>|setup <id>]',
+    argsHint: 'list|readiness|ready|attention|show|accounts|policies|status|doctor|setup',
+    async handler(args, ctx) {
       const channels = buildAgentWorkspaceChannels(ctx);
-      const ready = channels.filter((channel) => channel.ready);
-      const enabled = channels.filter((channel) => channel.enabled);
-      const needsTarget = channels.filter((channel) => channel.setupState === 'needs-target');
-      const needsConfig = channels.filter((channel) => channel.setupState === 'needs-config');
-      const lines: string[] = [
-        'Channel Readiness',
-        `  ready: ${ready.length}/${channels.length}`,
-        `  enabled: ${enabled.length}/${channels.length}`,
-        `  needs target: ${needsTarget.length}`,
-        `  needs config: ${needsConfig.length}`,
-        '  policy: read-only inspection; sends require explicit user action and Agent policy',
-        '',
-        ...channels.map((channel) => {
-          const missing = channel.missingRequiredKeys.length > 0
-            ? ` missing=${channel.missingRequiredKeys.join('|')}`
-            : '';
-          const target = channel.configuredDefaultTargetKeys.length > 0
-            ? ` target=${channel.configuredDefaultTargetKeys.join('|')}`
-            : channel.defaultTargetKeys.length > 0
-              ? ` target=missing(${channel.defaultTargetKeys.join('|')})`
-              : ' target=not-required';
-          return [
-            `  ${channel.label}: ${channel.setupState}`,
-            `ready=${channel.ready ? 'yes' : 'no'}`,
-            `delivery=${channel.delivery}`,
-            `risk=${channel.risk}`,
-            target,
-            missing,
-          ].join(' ');
-        }),
-      ];
-      ctx.print(lines.join('\n'));
+      const subcommand = (args[0] ?? 'readiness').trim().toLowerCase();
+
+      if (subcommand === 'list' || subcommand === 'readiness') {
+        printChannelSummary(ctx.print, channels, 'all');
+        return;
+      }
+
+      if (subcommand === 'ready') {
+        printChannelSummary(ctx.print, channels, 'ready');
+        return;
+      }
+
+      if (subcommand === 'attention' || subcommand === 'issues') {
+        printChannelSummary(ctx.print, channels, 'attention');
+        return;
+      }
+
+      if (subcommand === 'show') {
+        const channelId = args[1]?.trim().toLowerCase();
+        if (!channelId) {
+          ctx.print('Usage: /channels show <id>');
+          return;
+        }
+        const channel = channels.find((entry) => entry.id.toLowerCase() === channelId || entry.label.toLowerCase() === channelId);
+        if (!channel) {
+          ctx.print(`Unknown channel: ${channelId}\nUse /channels list to see available channel ids.`);
+          return;
+        }
+        printChannelDetail(ctx.print, channel);
+        return;
+      }
+
+      if (subcommand === 'accounts') {
+        await printReadOnlyChannelRoute(ctx, 'Channel accounts', '/api/channels/accounts', formatChannelAccounts);
+        return;
+      }
+
+      if (subcommand === 'policies') {
+        await printReadOnlyChannelRoute(ctx, 'Channel policies', '/api/channels/policies', formatChannelPolicies);
+        return;
+      }
+
+      if (subcommand === 'status') {
+        await printReadOnlyChannelRoute(ctx, 'Channel status', '/api/channels/status', formatChannelStatus);
+        return;
+      }
+
+      if (subcommand === 'doctor' || subcommand === 'setup') {
+        const channelId = args[1]?.trim().toLowerCase();
+        if (!channelId) {
+          ctx.print(`Usage: /channels ${subcommand} <id>`);
+          return;
+        }
+        const encoded = encodeURIComponent(channelId);
+        if (subcommand === 'doctor') {
+          await printReadOnlyChannelRoute(ctx, 'Channel doctor', `/api/channels/doctor/${encoded}`, (body) => formatChannelDoctor(channelId, body));
+          return;
+        }
+        await printReadOnlyChannelRoute(ctx, 'Channel setup', `/api/channels/setup/${encoded}`, (body) => formatChannelSetup(channelId, body));
+        return;
+      }
+
+      ctx.print('Usage: /channels [list|readiness|ready|attention|show <id>|accounts|policies|status|doctor <id>|setup <id>]');
     },
   });
 }

package/src/input/commands/experience-runtime.ts

@@ -1,7 +1,7 @@
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 import type { CommandRegistry } from '../command-registry.ts';
-import { requirePanelManager, requireShellPaths } from './runtime-services.ts';
+import { requireShellPaths } from './runtime-services.ts';
 import { requireYesFlag, stripYesFlag } from './confirmation.ts';
 
 interface VoiceBundle {
@@ -29,12 +29,7 @@ export function registerExperienceRuntimeCommands(registry: CommandRegistry): vo
     async handler(args, ctx) {
       const sub = (args[0] ?? 'matrix').toLowerCase();
       if (sub === 'open' || sub === 'panel') {
-        if (ctx.showPanel) ctx.showPanel('approval');
-        else {
-          const panelManager = requirePanelManager(ctx);
-          panelManager.open('approval');
-          panelManager.show();
-        }
+        ctx.print('Approval panels are not part of the Agent workspace. Use /approval matrix.');
         return;
       }
       const matrix = [
@@ -64,11 +59,11 @@ export function registerExperienceRuntimeCommands(registry: CommandRegistry): vo
         ctx.print([
           `Approval Review: ${entry[0]}`,
           `  ${entry[1]}`,
-          '  Related workspaces: /security, /policy preflight, /trust, /mcp',
+          '  Related workspaces: /security, /trust, /mcp',
         ].join('\n'));
         return;
       }
-      ctx.print('Usage: /approval [open|matrix|review <kind>]');
+      ctx.print('Usage: /approval [matrix|review <kind>]');
     },
   });
 

package/src/input/commands/health-runtime.ts

@@ -7,7 +7,6 @@ import { buildProviderAccountSnapshot } from '@/runtime/index.ts';
 import { getSettingsControlPlaneSnapshot } from '@/runtime/index.ts';
 import { checkRecoveryFile, readLastSessionPointer } from '@/runtime/index.ts';
 import {
-  openCommandPanel,
   requireOperatorClient,
   requireProviderApi,
   requireReadModels,
@@ -22,16 +21,37 @@ export function registerHealthRuntimeCommands(registry: CommandRegistry): void {
     name: 'health',
     aliases: ['doctor'],
     description: 'Health workspace for startup posture, service readiness, provider health, and Agent continuity',
-    usage: '[open|review|setup|services|provider|accounts|auth|settings|remote|mcp|continuity|maintenance|repair [domain]]',
+    usage: '[review|setup|services|provider|accounts|auth|settings|remote|mcp|continuity|maintenance|repair [domain]]',
     async handler(args, ctx) {
       const sub = (args[0] ?? 'review').toLowerCase();
-      const readModels = requireReadModels(ctx);
 
-      if (sub === 'open' || sub === 'panel' || sub === 'provider') {
-        openCommandPanel(ctx, 'provider-health');
+      if (sub === 'open' || sub === 'panel') {
+        ctx.print('Health panels are not part of the Agent workspace. Use /health review.');
         return;
       }
 
+      if (sub === 'provider') {
+        const providerApi = requireProviderApi(ctx);
+        const currentModel = await providerApi.getCurrentModel().catch(() => null);
+        const accounts = await requireOperatorClient(ctx).providers.accountSnapshot();
+        ctx.print([
+          'Health Review: Provider',
+          `  selected model: ${currentModel?.registryKey ?? 'unknown'}`,
+          `  providers: ${providerApi.listProviderIds().length}`,
+          `  configured accounts: ${accounts.configuredCount}`,
+          `  account issues: ${accounts.issueCount}`,
+          ...(accounts.issueCount > 0
+            ? accounts.providers.flatMap((provider) => provider.issues.map((issue) => `  ${provider.providerId}: ${issue}`))
+            : ['  no provider account issues detected']),
+          '  next: /model',
+          '  next: /provider',
+          '  next: /accounts review',
+        ].join('\n'));
+        return;
+      }
+
+      const readModels = requireReadModels(ctx);
+
       if (sub === 'services') {
         const registry = requireServiceRegistry(ctx);
         const all = registry.getAll();
@@ -318,7 +338,7 @@ export function registerHealthRuntimeCommands(registry: CommandRegistry): void {
         ...(snapshot.serviceIssues.length > 0 ? ['', ...snapshot.serviceIssues.map((issue) => `  service: ${issue}`)] : []),
         '',
         'Next steps:',
-        '  /health open',
+        '  /health review',
         '  /health services',
         '  /health accounts',
         '  /health auth',

package/src/input/commands/mcp-runtime.ts

@@ -137,8 +137,8 @@ export function registerMcpRuntimeCommands(registry: CommandRegistry): void {
     name: 'mcp',
     aliases: [],
     description: 'Manage MCP servers and their tools',
-    usage: '[add|remove|reload|config|review|tools [<server>]|auth-review|repair [server]]',
-    argsHint: '[review|tools|config|add --yes|remove --yes]',
+    usage: '[servers|review|tools [<server>]|config|add|remove|reload|auth-review|repair [server]]',
+    argsHint: '[servers|review|tools|config|add --yes|remove --yes]',
     async handler(args, ctx) {
       const mcpApi = requireMcpApi(ctx);
       const listServerSecurity = () => mcpApi.listServerSecurity();
@@ -163,6 +163,25 @@ export function registerMcpRuntimeCommands(registry: CommandRegistry): void {
         ].join('\n'));
         return;
       }
+      if (subcommand === 'servers') {
+        const servers = listServerSecurity();
+        if (servers.length === 0) {
+          ctx.print(
+            'No MCP servers configured.\n'
+            + 'Add servers to one of these locations (scanned in order):\n'
+            + '  ~/.config/mcp/mcp.json               (global XDG)\n'
+            + '  ~/.mcp/mcp.json                      (global dotdir)\n'
+            + '  ~/.config/claude/claude_desktop_config.json  (Claude Desktop)\n'
+            + '  .mcp/mcp.json                        (project-local)\n'
+            + '  .goodvibes/mcp.json                  (goodvibes project)\n'
+            + '\nAdd one from inside Agent with explicit confirmation:\n'
+            + '  /mcp add filesystem npx -y @modelcontextprotocol/server-filesystem . --scope project --role filesystem --yes'
+          );
+          return;
+        }
+        ctx.print(formatMcpServerList(servers));
+        return;
+      }
       if (subcommand === 'tools') {
         const filterServer = commandArgs[1];
         ctx.print('Fetching MCP tool list...');
@@ -434,30 +453,36 @@ export function registerMcpRuntimeCommands(registry: CommandRegistry): void {
         return;
       }
 
-      const connected = servers.filter(s => s.connected);
-      const disconnected = servers.filter(s => !s.connected);
-      const lines: string[] = [`MCP Servers (${connected.length}/${servers.length} connected):`];
-      for (const s of servers) {
-        const pathScope = s.allowedPaths.length > 0 ? ` paths=${s.allowedPaths.length}` : '';
-        const hostScope = s.allowedHosts.length > 0 ? ` hosts=${s.allowedHosts.length}` : '';
-        const freshness = ` freshness=${s.schemaFreshness}`;
-        const quarantine = s.schemaFreshness === 'quarantined' ? ` quarantine=${s.quarantineReason ?? 'unknown'}` : '';
-        lines.push(`  ${s.connected ? '[connected]   ' : '[disconnected]'}  ${s.name}  trust=${s.trustMode}  role=${s.role}${freshness}${quarantine}${pathScope}${hostScope}`);
-      }
-      if (connected.length > 0) {
-        lines.push('');
-        lines.push('Run "/mcp tools" to list all tools, or "/mcp tools <server>" for a specific server.');
-        lines.push('Run "/mcp" to open the fullscreen MCP workspace, or "/mcp add <name> <command> [args...] [--scope project|global] --yes" to add/update.');
-        lines.push('Run "/mcp reload --yes" after editing MCP config outside Agent.');
-        lines.push('Run "/mcp trust <server> <mode> --yes" to change trust mode, or "/mcp role <server> <role> --yes" to change its coherence role.');
-        lines.push('Run "/mcp quarantine <server> [detail] --yes" to block a server, or "/mcp quarantine <server> approve [operatorId] --yes" to approve a temporary override.');
-        lines.push('Use /settings → MCP to explicitly enable allow-all for a server.');
-      }
-      if (disconnected.length > 0) {
-        lines.push('');
-        lines.push(`${disconnected.length} server(s) failed to connect. Check server command and args in your config.`);
-      }
-      ctx.print(lines.join('\n'));
+      ctx.print(formatMcpServerList(servers));
     },
   });
 }
+
+type McpSecurityServer = ReturnType<NonNullable<NonNullable<CommandContext['clients']>['mcpApi']>['listServerSecurity']>[number];
+
+function formatMcpServerList(servers: readonly McpSecurityServer[]): string {
+  const connected = servers.filter(s => s.connected);
+  const disconnected = servers.filter(s => !s.connected);
+  const lines: string[] = [`MCP Servers (${connected.length}/${servers.length} connected):`];
+  for (const s of servers) {
+    const pathScope = s.allowedPaths.length > 0 ? ` paths=${s.allowedPaths.length}` : '';
+    const hostScope = s.allowedHosts.length > 0 ? ` hosts=${s.allowedHosts.length}` : '';
+    const freshness = ` freshness=${s.schemaFreshness}`;
+    const quarantine = s.schemaFreshness === 'quarantined' ? ` quarantine=${s.quarantineReason ?? 'unknown'}` : '';
+    lines.push(`  ${s.connected ? '[connected]   ' : '[disconnected]'}  ${s.name}  trust=${s.trustMode}  role=${s.role}${freshness}${quarantine}${pathScope}${hostScope}`);
+  }
+  if (connected.length > 0) {
+    lines.push('');
+    lines.push('Run "/mcp tools" to list all tools, or "/mcp tools <server>" for a specific server.');
+    lines.push('Run "/mcp" to open the fullscreen MCP workspace, or "/mcp add <name> <command> [args...] [--scope project|global] --yes" to add/update.');
+    lines.push('Run "/mcp reload --yes" after editing MCP config outside Agent.');
+    lines.push('Run "/mcp trust <server> <mode> --yes" to change trust mode, or "/mcp role <server> <role> --yes" to change its coherence role.');
+    lines.push('Run "/mcp quarantine <server> [detail] --yes" to block a server, or "/mcp quarantine <server> approve [operatorId] --yes" to approve a temporary override.');
+    lines.push('Use /settings -> MCP to explicitly enable allow-all for a server.');
+  }
+  if (disconnected.length > 0) {
+    lines.push('');
+    lines.push(`${disconnected.length} server(s) failed to connect. Check server command and args in your config.`);
+  }
+  return lines.join('\n');
+}