@pellux/goodvibes-agent 0.1.116 → 0.1.117

package/src/input/agent-workspace-operations-command-editor-submission.ts

@@ -0,0 +1,146 @@
+import type { AgentWorkspaceActionResult, AgentWorkspaceEditorKind, AgentWorkspaceLocalEditor } from './agent-workspace-types.ts';
+import type { AgentWorkspaceOperationsCommandEditorKind } from './agent-workspace-operations-command-editors.ts';
+import { isAgentWorkspaceOperationsCommandEditorKind } from './agent-workspace-operations-command-editors.ts';
+import { quoteSlashCommandArg } from './slash-command-parser.ts';
+
+type AgentWorkspaceFieldReader = (fieldId: string) => string;
+
+function isAffirmative(value: string): boolean {
+  return /^(y|yes|true)$/i.test(value.trim());
+}
+
+function unconfirmed(editor: AgentWorkspaceLocalEditor, message: string): AgentWorkspaceOperationsCommandEditorSubmission {
+  return {
+    kind: 'editor',
+    editor: { ...editor, message },
+    status: message,
+  };
+}
+
+export type AgentWorkspaceOperationsCommandEditorSubmission =
+  | {
+    readonly kind: 'editor';
+    readonly editor: AgentWorkspaceLocalEditor;
+    readonly status: string;
+    readonly actionResult?: AgentWorkspaceActionResult;
+  }
+  | {
+    readonly kind: 'dispatch';
+    readonly command: string;
+    readonly status: string;
+    readonly actionResult: AgentWorkspaceActionResult;
+  };
+
+export function isAgentWorkspaceOperationsCommandSubmissionKind(kind: AgentWorkspaceEditorKind): kind is AgentWorkspaceOperationsCommandEditorKind {
+  return isAgentWorkspaceOperationsCommandEditorKind(kind);
+}
+
+export function buildAgentWorkspaceOperationsCommandEditorSubmission(
+  editor: AgentWorkspaceLocalEditor,
+  readField: AgentWorkspaceFieldReader,
+): AgentWorkspaceOperationsCommandEditorSubmission {
+  if (editor.kind === 'plan-seed') {
+    const command = `/plan ${quoteSlashCommandArg(readField('goal'))}`;
+    return {
+      kind: 'dispatch',
+      command,
+      status: 'Opening planning goal seeding.',
+      actionResult: {
+        kind: 'dispatched',
+        title: 'Opening planning goal seeding',
+        detail: 'The workspace handed a concrete planning goal to the shell-owned command router without spawning coding agents.',
+        command,
+        safety: 'safe',
+      },
+    };
+  }
+  if (editor.kind === 'plan-approve') {
+    if (!isAffirmative(readField('confirm'))) return unconfirmed(editor, 'Planning approval not confirmed. Type yes, then press Enter.');
+    return {
+      kind: 'dispatch',
+      command: '/plan approve --yes',
+      status: 'Opening planning approval.',
+      actionResult: {
+        kind: 'dispatched',
+        title: 'Opening planning approval',
+        detail: 'The workspace handed confirmed planning approval to the shell-owned command router.',
+        command: '/plan approve --yes',
+        safety: 'safe',
+      },
+    };
+  }
+  if (editor.kind === 'plan-override') {
+    if (!isAffirmative(readField('confirm'))) return unconfirmed(editor, 'Planning strategy override not confirmed. Type yes, then press Enter.');
+    const command = `/plan override ${quoteSlashCommandArg(readField('strategy'))} --yes`;
+    return {
+      kind: 'dispatch',
+      command,
+      status: 'Opening planning strategy override.',
+      actionResult: {
+        kind: 'dispatched',
+        title: 'Opening planning strategy override',
+        detail: 'The workspace handed a confirmed planning strategy override to the shell-owned command router.',
+        command,
+        safety: 'safe',
+      },
+    };
+  }
+  if (editor.kind === 'plan-clear') {
+    if (!isAffirmative(readField('confirm'))) return unconfirmed(editor, 'Planning clear not confirmed. Type yes, then press Enter.');
+    return {
+      kind: 'dispatch',
+      command: '/plan clear --yes',
+      status: 'Opening planning clear.',
+      actionResult: {
+        kind: 'dispatched',
+        title: 'Opening planning clear',
+        detail: 'The workspace handed confirmed planning-state clearing to the shell-owned command router.',
+        command: '/plan clear --yes',
+        safety: 'safe',
+      },
+    };
+  }
+  if (editor.kind === 'routine-receipt' || editor.kind === 'schedule-receipt') {
+    const routine = editor.kind === 'routine-receipt';
+    const command = `/${routine ? 'routines' : 'schedule'} receipt ${quoteSlashCommandArg(readField('receiptId'))}`;
+    const title = routine ? 'Opening routine receipt' : 'Opening schedule receipt';
+    return {
+      kind: 'dispatch',
+      command,
+      status: `${title}.`,
+      actionResult: {
+        kind: 'dispatched',
+        title,
+        detail: routine
+          ? 'The workspace handed read-only routine receipt inspection to the shell-owned command router.'
+          : 'The workspace handed read-only schedule receipt inspection to the shell-owned command router.',
+        command,
+        safety: 'read-only',
+      },
+    };
+  }
+  const plan = editor.kind === 'plan-show';
+  const approval = editor.kind === 'approval-review';
+  const command = plan
+    ? `/plan show ${quoteSlashCommandArg(readField('planId'))}`
+    : approval
+      ? `/approval review ${quoteSlashCommandArg(readField('kind'))}`
+      : `/health repair ${quoteSlashCommandArg(readField('domain'))}`;
+  const title = plan ? 'Opening saved plan' : approval ? 'Opening approval review' : 'Opening health repair guidance';
+  return {
+    kind: 'dispatch',
+    command,
+    status: `${title}.`,
+    actionResult: {
+      kind: 'dispatched',
+      title,
+      detail: plan
+        ? 'The workspace handed read-only saved-plan inspection to the shell-owned command router.'
+        : approval
+          ? 'The workspace handed read-only approval class review to the shell-owned command router.'
+          : 'The workspace handed read-only health repair guidance to the shell-owned command router.',
+      command,
+      safety: 'read-only',
+    },
+  };
+}

package/src/input/agent-workspace-operations-command-editors.ts

@@ -0,0 +1,119 @@
+import type { AgentWorkspaceEditorKind, AgentWorkspaceLocalEditor } from './agent-workspace-types.ts';
+
+export type AgentWorkspaceOperationsCommandEditorKind = Extract<
+  AgentWorkspaceEditorKind,
+  'plan-seed' | 'plan-show' | 'plan-approve' | 'plan-override' | 'plan-clear' | 'health-repair' | 'approval-review' | 'routine-receipt' | 'schedule-receipt'
+>;
+
+export function isAgentWorkspaceOperationsCommandEditorKind(kind: AgentWorkspaceEditorKind): kind is AgentWorkspaceOperationsCommandEditorKind {
+  return kind === 'plan-seed'
+    || kind === 'plan-show'
+    || kind === 'plan-approve'
+    || kind === 'plan-override'
+    || kind === 'plan-clear'
+    || kind === 'health-repair'
+    || kind === 'approval-review'
+    || kind === 'routine-receipt'
+    || kind === 'schedule-receipt';
+}
+
+export function createAgentWorkspaceOperationsCommandEditor(kind: AgentWorkspaceOperationsCommandEditorKind): AgentWorkspaceLocalEditor {
+  if (kind === 'plan-seed') {
+    return {
+      kind,
+      mode: 'create',
+      title: 'Seed Planning Goal',
+      selectedFieldIndex: 0,
+      message: 'Seed Agent planning state from a concrete goal. This stays in the main Agent planning flow and does not spawn coding agents.',
+      fields: [
+        { id: 'goal', label: 'Planning goal', value: '', required: true, multiline: true, hint: 'Describe the goal or operating plan to evaluate. Ctrl-J inserts a new line.' },
+      ],
+    };
+  }
+  if (kind === 'health-repair') {
+    return {
+      kind,
+      mode: 'create',
+      title: 'Show Health Repair Guidance',
+      selectedFieldIndex: 0,
+      message: 'Show health repair guidance for one domain. Agent does not start services or mutate connected-host lifecycle.',
+      fields: [
+        { id: 'domain', label: 'Domain', value: 'settings', required: true, multiline: false, hint: 'settings, auth, accounts, host, remote, mcp, continuity, or maintenance.' },
+      ],
+    };
+  }
+  if (kind === 'approval-review') {
+    return {
+      kind,
+      mode: 'create',
+      title: 'Review Approval Class',
+      selectedFieldIndex: 0,
+      message: 'Review one approval class without approving, denying, or mutating pending requests.',
+      fields: [
+        { id: 'kind', label: 'Approval kind', value: 'shell', required: true, multiline: false, hint: 'shell, file, network, delegate, mcp, remote, hook, or plugin.' },
+      ],
+    };
+  }
+  if (kind === 'plan-approve') {
+    return {
+      kind,
+      mode: 'update',
+      title: 'Approve Planning State',
+      selectedFieldIndex: 0,
+      message: 'Approve the current Agent planning state for execution. This changes planning state and requires typed confirmation.',
+      fields: [
+        { id: 'confirm', label: 'Confirm', value: '', required: true, multiline: false, hint: 'Type yes to run /plan approve with --yes.' },
+      ],
+    };
+  }
+  if (kind === 'plan-override') {
+    return {
+      kind,
+      mode: 'update',
+      title: 'Override Planning Strategy',
+      selectedFieldIndex: 0,
+      message: 'Override the planner strategy through the runtime bridge. This changes planner state and requires typed confirmation.',
+      fields: [
+        { id: 'strategy', label: 'Strategy', value: 'serial', required: true, multiline: false, hint: 'Planner strategy, such as serial.' },
+        { id: 'confirm', label: 'Confirm', value: '', required: true, multiline: false, hint: 'Type yes to run /plan override with --yes.' },
+      ],
+    };
+  }
+  if (kind === 'plan-clear') {
+    return {
+      kind,
+      mode: 'delete',
+      title: 'Clear Planning State',
+      selectedFieldIndex: 0,
+      message: 'Clear planner state. This is destructive and requires typed confirmation.',
+      fields: [
+        { id: 'confirm', label: 'Confirm', value: '', required: true, multiline: false, hint: 'Type yes to run /plan clear with --yes.' },
+      ],
+    };
+  }
+  if (kind === 'routine-receipt' || kind === 'schedule-receipt') {
+    const routine = kind === 'routine-receipt';
+    return {
+      kind,
+      mode: 'create',
+      title: routine ? 'Show Routine Promotion Receipt' : 'Show Schedule Receipt',
+      selectedFieldIndex: 0,
+      message: routine
+        ? 'Show one local routine schedule-promotion receipt without reconciling or mutating connected schedules.'
+        : 'Show one local schedule receipt without reconciling or mutating connected schedules.',
+      fields: [
+        { id: 'receiptId', label: 'Receipt id', value: '', required: true, multiline: false, hint: 'Receipt id from Promotion receipts.' },
+      ],
+    };
+  }
+  return {
+    kind,
+    mode: 'create',
+    title: 'Show Saved Plan',
+    selectedFieldIndex: 0,
+    message: 'Show one saved execution plan by id or prefix without approving or starting execution.',
+    fields: [
+      { id: 'planId', label: 'Plan id', value: '', required: true, multiline: false, hint: 'Plan id or unique prefix from Saved plans.' },
+    ],
+  };
+}

package/src/input/agent-workspace-provider-command-editor-submission.ts

@@ -0,0 +1,155 @@
+import type { AgentWorkspaceActionResult, AgentWorkspaceEditorKind, AgentWorkspaceLocalEditor } from './agent-workspace-types.ts';
+import type { AgentWorkspaceProviderCommandEditorKind } from './agent-workspace-provider-command-editors.ts';
+import { isAgentWorkspaceProviderCommandEditorKind } from './agent-workspace-provider-command-editors.ts';
+import { quoteSlashCommandArg } from './slash-command-parser.ts';
+
+type AgentWorkspaceFieldReader = (fieldId: string) => string;
+
+export type AgentWorkspaceProviderCommandEditorSubmission =
+  | {
+    readonly kind: 'editor';
+    readonly editor: AgentWorkspaceLocalEditor;
+    readonly status: string;
+    readonly actionResult?: AgentWorkspaceActionResult;
+  }
+  | {
+    readonly kind: 'dispatch';
+    readonly command: string;
+    readonly status: string;
+    readonly actionResult: AgentWorkspaceActionResult;
+  };
+
+function isAffirmative(value: string): boolean {
+  return /^(y|yes|true)$/i.test(value.trim());
+}
+
+function unconfirmed(editor: AgentWorkspaceLocalEditor, label: string): AgentWorkspaceProviderCommandEditorSubmission {
+  return {
+    kind: 'editor',
+    editor: { ...editor, message: `${label} not confirmed. Type yes, then press Enter.` },
+    status: `${label} not confirmed.`,
+  };
+}
+
+export function isAgentWorkspaceProviderCommandSubmissionKind(kind: AgentWorkspaceEditorKind): kind is AgentWorkspaceProviderCommandEditorKind {
+  return isAgentWorkspaceProviderCommandEditorKind(kind);
+}
+
+export function buildAgentWorkspaceProviderCommandEditorSubmission(
+  editor: AgentWorkspaceLocalEditor,
+  readField: AgentWorkspaceFieldReader,
+): AgentWorkspaceProviderCommandEditorSubmission {
+  if (editor.kind === 'provider-use') {
+    const model = readField('model');
+    const command = [
+      '/provider',
+      quoteSlashCommandArg(readField('provider')),
+      ...(model.length > 0 ? [quoteSlashCommandArg(model)] : []),
+    ].join(' ');
+    return {
+      kind: 'dispatch',
+      command,
+      status: 'Opening provider selection.',
+      actionResult: {
+        kind: 'dispatched',
+        title: 'Opening provider selection',
+        detail: 'The workspace handed provider selection to the shell-owned command router.',
+        command,
+        safety: 'safe',
+      },
+    };
+  }
+  if (editor.kind === 'provider-inspect') {
+    const command = `/accounts show ${quoteSlashCommandArg(readField('provider'))}`;
+    return {
+      kind: 'dispatch',
+      command,
+      status: 'Opening provider inspection.',
+      actionResult: {
+        kind: 'dispatched',
+        title: 'Opening provider inspection',
+        detail: 'The workspace handed read-only provider inspection to the shell-owned command router.',
+        command,
+        safety: 'read-only',
+      },
+    };
+  }
+  if (editor.kind === 'provider-routes') {
+    const command = `/accounts routes ${quoteSlashCommandArg(readField('provider'))}`;
+    return {
+      kind: 'dispatch',
+      command,
+      status: 'Opening provider route inspection.',
+      actionResult: {
+        kind: 'dispatched',
+        title: 'Opening provider route inspection',
+        detail: 'The workspace handed read-only provider route inspection to the shell-owned command router.',
+        command,
+        safety: 'read-only',
+      },
+    };
+  }
+  if (editor.kind === 'provider-account-repair') {
+    const command = `/accounts repair ${quoteSlashCommandArg(readField('provider'))}`;
+    return {
+      kind: 'dispatch',
+      command,
+      status: 'Opening provider account repair review.',
+      actionResult: {
+        kind: 'dispatched',
+        title: 'Opening provider account repair review',
+        detail: 'The workspace handed read-only provider account repair guidance to the shell-owned command router.',
+        command,
+        safety: 'read-only',
+      },
+    };
+  }
+  if (editor.kind === 'provider-add') {
+    if (!isAffirmative(readField('confirm'))) {
+      return unconfirmed(editor, 'Custom provider add');
+    }
+    const key = readField('apiKey');
+    const parts = [
+      '/provider',
+      'add',
+      quoteSlashCommandArg(readField('name')),
+      quoteSlashCommandArg(readField('baseUrl')),
+    ];
+    const redactedParts = [...parts];
+    if (key.length > 0) {
+      parts.push(quoteSlashCommandArg(key));
+      redactedParts.push('<redacted-api-key>');
+    }
+    parts.push('--yes');
+    redactedParts.push('--yes');
+    return {
+      kind: 'dispatch',
+      command: parts.join(' '),
+      status: 'Opening custom provider add.',
+      actionResult: {
+        kind: 'dispatched',
+        title: 'Opening custom provider add',
+        detail: 'The workspace handed a confirmed custom provider add command to the shell-owned command router without rendering the raw API key.',
+        command: redactedParts.join(' '),
+        safety: 'safe',
+      },
+    };
+  }
+
+  if (!isAffirmative(readField('confirm'))) {
+    return unconfirmed(editor, 'Custom provider removal');
+  }
+  const command = `/provider remove ${quoteSlashCommandArg(readField('name'))} --yes`;
+  return {
+    kind: 'dispatch',
+    command,
+    status: 'Opening custom provider removal.',
+    actionResult: {
+      kind: 'dispatched',
+      title: 'Opening custom provider removal',
+      detail: 'The workspace handed a confirmed custom provider removal command to the shell-owned command router.',
+      command,
+      safety: 'safe',
+    },
+  };
+}

package/src/input/agent-workspace-provider-command-editors.ts

@@ -0,0 +1,93 @@
+import type { AgentWorkspaceEditorKind, AgentWorkspaceLocalEditor } from './agent-workspace-types.ts';
+
+export type AgentWorkspaceProviderCommandEditorKind = Extract<
+  AgentWorkspaceEditorKind,
+  'provider-add' | 'provider-remove' | 'provider-use' | 'provider-inspect' | 'provider-routes' | 'provider-account-repair'
+>;
+
+export function isAgentWorkspaceProviderCommandEditorKind(kind: AgentWorkspaceEditorKind): kind is AgentWorkspaceProviderCommandEditorKind {
+  return kind === 'provider-add'
+    || kind === 'provider-remove'
+    || kind === 'provider-use'
+    || kind === 'provider-inspect'
+    || kind === 'provider-routes'
+    || kind === 'provider-account-repair';
+}
+
+export function createAgentWorkspaceProviderCommandEditor(kind: AgentWorkspaceProviderCommandEditorKind): AgentWorkspaceLocalEditor {
+  if (kind === 'provider-use') {
+    return {
+      kind,
+      mode: 'create',
+      title: 'Use Provider',
+      selectedFieldIndex: 0,
+      message: 'Switch the Agent chat provider through the TUI command router. Add a model id when you want an exact provider/model route.',
+      fields: [
+        { id: 'provider', label: 'Provider id', value: '', required: true, multiline: false, hint: 'Provider row id, such as openai-subscriber, openai, anthropic, or a custom provider.' },
+        { id: 'model', label: 'Model id', value: '', required: false, multiline: false, hint: 'Optional model id or provider:model registry key. Blank uses the provider default selectable model.' },
+      ],
+    };
+  }
+  if (kind === 'provider-inspect') {
+    return {
+      kind,
+      mode: 'create',
+      title: 'Inspect Provider',
+      selectedFieldIndex: 0,
+      message: 'Inspect provider auth and setup routes from the Agent TUI without changing provider selection.',
+      fields: [
+        { id: 'provider', label: 'Provider id', value: '', required: true, multiline: false, hint: 'Provider row id to inspect.' },
+      ],
+    };
+  }
+  if (kind === 'provider-routes') {
+    return {
+      kind,
+      mode: 'create',
+      title: 'Inspect Provider Routes',
+      selectedFieldIndex: 0,
+      message: 'Inspect provider account routes from the Agent TUI without changing routing or auth.',
+      fields: [
+        { id: 'provider', label: 'Provider id', value: '', required: true, multiline: false, hint: 'Provider row id to inspect.' },
+      ],
+    };
+  }
+  if (kind === 'provider-account-repair') {
+    return {
+      kind,
+      mode: 'create',
+      title: 'Review Provider Account Repair',
+      selectedFieldIndex: 0,
+      message: 'Show provider account repair guidance from the Agent TUI without starting login or storing tokens.',
+      fields: [
+        { id: 'provider', label: 'Provider id', value: '', required: true, multiline: false, hint: 'Provider row id to inspect.' },
+      ],
+    };
+  }
+  if (kind === 'provider-add') {
+    return {
+      kind,
+      mode: 'create',
+      title: 'Add Custom Provider',
+      selectedFieldIndex: 0,
+      message: 'Add an OpenAI-compatible provider for Agent chat/model routing. Type yes on the final field to confirm.',
+      fields: [
+        { id: 'name', label: 'Provider name', value: '', required: true, multiline: false, hint: 'Letters, numbers, hyphens, and underscores only.' },
+        { id: 'baseUrl', label: 'Base URL', value: '', required: true, multiline: false, hint: 'OpenAI-compatible base URL, such as http://127.0.0.1:8000/v1.' },
+        { id: 'apiKey', label: 'API key', value: '', required: false, multiline: false, hint: 'Optional API key. Prefer a local provider or a secret-backed provider config when possible.', redact: true },
+        { id: 'confirm', label: 'Confirm', value: '', required: true, multiline: false, hint: 'Type yes to run /provider add with --yes.' },
+      ],
+    };
+  }
+  return {
+    kind,
+    mode: 'delete',
+    title: 'Remove Custom Provider',
+    selectedFieldIndex: 0,
+    message: 'Remove one custom provider config from the Agent provider list. Type yes on the final field to confirm.',
+    fields: [
+      { id: 'name', label: 'Provider name', value: '', required: true, multiline: false, hint: 'Existing custom provider name.' },
+      { id: 'confirm', label: 'Confirm', value: '', required: true, multiline: false, hint: 'Type yes to run /provider remove with --yes.' },
+    ],
+  };
+}

package/src/input/agent-workspace-requirements.ts

@@ -0,0 +1,11 @@
+import { buildAgentSkillRequirements, type AgentSkillRequirement } from '../agent/skill-registry.ts';
+import { splitList } from './agent-workspace-editors.ts';
+
+export type AgentWorkspaceEditorFieldReader = (fieldId: string) => string;
+
+export function buildAgentWorkspaceRequirements(readField: AgentWorkspaceEditorFieldReader): readonly AgentSkillRequirement[] {
+  return buildAgentSkillRequirements({
+    env: splitList(readField('requiresEnv')),
+    commands: splitList(readField('requiresCommands')),
+  });
+}

package/src/input/agent-workspace-secret-editor-submission.ts

@@ -0,0 +1,153 @@
+import type { AgentWorkspaceActionResult, AgentWorkspaceLocalEditor } from './agent-workspace-types.ts';
+import { quoteSlashCommandArg } from './slash-command-parser.ts';
+
+type AgentWorkspaceFieldReader = (fieldId: string) => string;
+
+type AgentWorkspaceSecretEditorSubmission =
+  | {
+    readonly kind: 'editor';
+    readonly editor: AgentWorkspaceLocalEditor;
+    readonly status: string;
+    readonly actionResult?: AgentWorkspaceActionResult;
+  }
+  | {
+    readonly kind: 'dispatch';
+    readonly command: string;
+    readonly status: string;
+    readonly actionResult: AgentWorkspaceActionResult;
+  };
+
+function isAffirmative(value: string): boolean {
+  return /^(y|yes|true)$/i.test(value.trim());
+}
+
+function secretScopeFlag(scope: string): string | null {
+  const normalized = scope.trim().toLowerCase();
+  if (normalized === 'user') return '--user';
+  if (normalized === 'project') return '--project';
+  return null;
+}
+
+function secretStorageFlag(storage: string): string | null {
+  const normalized = storage.trim().toLowerCase();
+  if (normalized === 'plaintext') return '--plaintext';
+  if (normalized === 'secure') return '--secure';
+  return null;
+}
+
+function appendOptionalSecretFlags(parts: string[], scope: string, storage: string): void {
+  const scopeFlag = secretScopeFlag(scope);
+  const storageFlag = secretStorageFlag(storage);
+  if (scopeFlag) parts.push(scopeFlag);
+  if (storageFlag) parts.push(storageFlag);
+}
+
+export function isAgentWorkspaceSecretEditorKind(kind: AgentWorkspaceLocalEditor['kind']): kind is 'secret-set' | 'secret-link' | 'secret-test' | 'secret-delete' {
+  return kind === 'secret-set' || kind === 'secret-link' || kind === 'secret-test' || kind === 'secret-delete';
+}
+
+export function buildAgentWorkspaceSecretEditorSubmission(
+  editor: AgentWorkspaceLocalEditor,
+  readField: AgentWorkspaceFieldReader,
+): AgentWorkspaceSecretEditorSubmission {
+  if (editor.kind === 'secret-set') {
+    if (!isAffirmative(readField('confirm'))) {
+      return {
+        kind: 'editor',
+        editor: { ...editor, message: 'Secret value storage not confirmed. Type yes, then press Enter.' },
+        status: 'Secret value storage not confirmed.',
+      };
+    }
+    const key = readField('key');
+    const parts = ['/secrets', 'set', quoteSlashCommandArg(key), quoteSlashCommandArg(readField('value'))];
+    appendOptionalSecretFlags(parts, readField('scope'), readField('storage'));
+    parts.push('--yes');
+    const redactedParts = ['/secrets', 'set', quoteSlashCommandArg(key), '<redacted>'];
+    appendOptionalSecretFlags(redactedParts, readField('scope'), readField('storage'));
+    redactedParts.push('--yes');
+    return {
+      kind: 'dispatch',
+      command: parts.join(' '),
+      status: 'Opening secret value storage.',
+      actionResult: {
+        kind: 'dispatched',
+        title: 'Opening secret value storage',
+        detail: 'The workspace handed a confirmed secret value storage command to the shell-owned command router without rendering the raw value.',
+        command: redactedParts.join(' '),
+        safety: 'safe',
+      },
+    };
+  }
+  if (editor.kind === 'secret-link') {
+    if (!isAffirmative(readField('confirm'))) {
+      return {
+        kind: 'editor',
+        editor: { ...editor, message: 'Secret reference link not confirmed. Type yes, then press Enter.' },
+        status: 'Secret reference link not confirmed.',
+      };
+    }
+    const key = readField('key');
+    const parts = ['/secrets', 'link', quoteSlashCommandArg(key), quoteSlashCommandArg(readField('ref'))];
+    appendOptionalSecretFlags(parts, readField('scope'), readField('storage'));
+    parts.push('--yes');
+    const redactedParts = ['/secrets', 'link', quoteSlashCommandArg(key), '<secret-ref>'];
+    appendOptionalSecretFlags(redactedParts, readField('scope'), readField('storage'));
+    redactedParts.push('--yes');
+    return {
+      kind: 'dispatch',
+      command: parts.join(' '),
+      status: 'Opening secret reference link.',
+      actionResult: {
+        kind: 'dispatched',
+        title: 'Opening secret reference link',
+        detail: 'The workspace handed a confirmed secret reference link command to the shell-owned command router without rendering the full reference.',
+        command: redactedParts.join(' '),
+        safety: 'safe',
+      },
+    };
+  }
+  if (editor.kind === 'secret-test') {
+    if (!isAffirmative(readField('confirm'))) {
+      return {
+        kind: 'editor',
+        editor: { ...editor, message: 'Secret reference test not confirmed. Type yes, then press Enter.' },
+        status: 'Secret reference test not confirmed.',
+      };
+    }
+    return {
+      kind: 'dispatch',
+      command: `/secrets test ${quoteSlashCommandArg(readField('ref'))}`,
+      status: 'Opening secret reference test.',
+      actionResult: {
+        kind: 'dispatched',
+        title: 'Opening secret reference test',
+        detail: 'The workspace handed a confirmed secret reference test command to the shell-owned command router; the command output remains redacted.',
+        command: '/secrets test <secret-ref>',
+        safety: 'safe',
+      },
+    };
+  }
+  if (!isAffirmative(readField('confirm'))) {
+    return {
+      kind: 'editor',
+      editor: { ...editor, message: 'Secret deletion not confirmed. Type yes, then press Enter.' },
+      status: 'Secret deletion not confirmed.',
+    };
+  }
+  const key = readField('key');
+  const parts = ['/secrets', 'delete', quoteSlashCommandArg(key)];
+  appendOptionalSecretFlags(parts, readField('scope'), readField('storage'));
+  parts.push('--yes');
+  return {
+    kind: 'dispatch',
+    command: parts.join(' '),
+    status: 'Opening secret deletion.',
+    actionResult: {
+      kind: 'dispatched',
+      title: 'Opening secret deletion',
+      detail: 'The workspace handed a confirmed secret deletion command to the shell-owned command router.',
+      command: parts.join(' '),
+      safety: 'safe',
+    },
+  };
+}