@pellux/goodvibes-agent 0.1.116 → 1.0.0

package/src/input/commands/platform-access-runtime.ts

@@ -3,6 +3,7 @@ import { dirname } from 'node:path';
 import type { CommandRegistry } from '../command-registry.ts';
 import { listBuiltinSubscriptionProviders } from '@pellux/goodvibes-sdk/platform/config';
 import { buildAuthInspectionSnapshot, inspectProviderAuth } from '@/runtime/index.ts';
+import { formatAgentRecordSource } from '../../agent/record-labels.ts';
 import { requireSecretsManager, requireServiceRegistry, requireShellPaths, requireSubscriptionManager } from './runtime-services.ts';
 import { requireYesFlag, stripYesFlag } from './confirmation.ts';
 
@@ -18,78 +19,15 @@ interface AuthReviewBundle {
 function inspectAuthBundle(bundle: AuthReviewBundle): string {
   return [
     'Auth Review Bundle',
-    `  exportedAt: ${new Date(bundle.exportedAt).toISOString()}`,
-    `  externalRuntimeAuth: ${bundle.externalRuntimeAuth}`,
-    `  stored secrets: ${bundle.secretKeys.length}`,
-    `  active subscriptions: ${bundle.activeSubscriptions.length}`,
-    `  pending subscriptions: ${bundle.pendingSubscriptions.length}`,
+    `  exported at ${new Date(bundle.exportedAt).toISOString()}`,
+    `  connected host auth ${bundle.externalRuntimeAuth}`,
+    `  stored secrets ${bundle.secretKeys.length}`,
+    `  active subscriptions ${bundle.activeSubscriptions.length}`,
+    `  pending subscriptions ${bundle.pendingSubscriptions.length}`,
   ].join('\n');
 }
 
 export function registerPlatformAccessRuntimeCommands(registry: CommandRegistry): void {
-  registry.register({
-    name: 'login',
-    description: 'Front-door login flow for provider subscriptions',
-    usage: 'provider <name> start|finish <code> --yes',
-    async handler(args, ctx) {
-      const parsed = stripYesFlag(args);
-      const commandArgs = [...parsed.rest];
-      const target = (commandArgs[0] ?? '').toLowerCase();
-      if (target === 'provider') {
-        const provider = commandArgs[1];
-        const mode = commandArgs[2]?.toLowerCase();
-        if (!provider || !mode) {
-          ctx.print('Usage: /login provider <name> start|finish <code> --yes');
-          return;
-        }
-        if (!parsed.yes) {
-          requireYesFlag(ctx, `${mode} provider subscription login for ${provider}`, '/login provider <name> start|finish <code> --yes');
-          return;
-        }
-        if (ctx.executeCommand) {
-          await ctx.executeCommand('subscription', ['login', provider, mode, ...commandArgs.slice(3), '--yes']);
-          return;
-        }
-        ctx.print(`Use /subscription login ${provider} ${mode}${commandArgs[3] ? ` ${commandArgs[3]}` : ''} --yes`);
-        return;
-      }
-      if (target === 'service' || target === 'runtime' || target === 'listener' || target === 'daemon') {
-        ctx.print([
-          'Connected-service login is outside GoodVibes Agent.',
-          'Agent does not create, exchange, store, rotate, revoke, or clear connected-service sessions.',
-          'Use the owning GoodVibes host for connected-service auth administration.',
-          'Agent login supports provider subscriptions only: /login provider <name> start|finish <code> --yes.',
-        ].join('\n'));
-        return;
-      }
-      ctx.print('Usage: /login provider <name> start|finish <code> --yes');
-    },
-  });
-
-  registry.register({
-    name: 'logout',
-    description: 'Front-door logout flow for provider subscription sessions and supported overrides',
-    usage: 'provider <name> --yes',
-    async handler(args, ctx) {
-      const parsed = stripYesFlag(args);
-      const commandArgs = [...parsed.rest];
-      const target = (commandArgs[0] ?? '').toLowerCase();
-      if (target !== 'provider' || !commandArgs[1]) {
-        ctx.print('Usage: /logout provider <name> --yes');
-        return;
-      }
-      if (!parsed.yes) {
-        requireYesFlag(ctx, `log out provider subscription ${commandArgs[1]}`, '/logout provider <name> --yes');
-        return;
-      }
-      if (ctx.executeCommand) {
-        await ctx.executeCommand('subscription', ['logout', commandArgs[1], '--yes']);
-        return;
-      }
-      ctx.print(`Use /subscription logout ${commandArgs[1]} --yes`);
-    },
-  });
-
   registry.register({
     name: 'auth',
     description: 'Review provider auth posture and export redacted auth review bundles',
@@ -100,18 +38,18 @@ export function registerPlatformAccessRuntimeCommands(registry: CommandRegistry)
       const sub = commandArgs[0] ?? 'review';
       if (sub === 'local') {
         ctx.print([
-          'Connected-service auth management is outside GoodVibes Agent.',
-          'Agent connects to GoodVibes services owned outside this package and does not create, delete, rotate, revoke, or clear connected-service auth users, sessions, or bootstrap credentials.',
-          'Use the owning GoodVibes host for connected-service auth administration.',
+          'Connected-host auth management is outside GoodVibes Agent.',
+          'Agent connects to a GoodVibes host owned outside this package and does not create, delete, rotate, revoke, or clear connected-host auth users, sessions, or bootstrap credentials.',
+          'Use the owning GoodVibes host for connected-host auth administration.',
           'Agent auth commands available here: /auth review, /auth show <provider>, /auth repair <provider>, /auth bundle export <path> --yes, /auth bundle inspect <path>.',
         ].join('\n'));
         return;
       }
       if (sub === 'login') {
         ctx.print([
-          'Connected-service login is outside GoodVibes Agent.',
-          'Agent does not create, exchange, store, rotate, revoke, or clear connected-service sessions.',
-          'Use the owning GoodVibes host for connected-service auth administration.',
+          'Connected-host login is outside GoodVibes Agent.',
+          'Agent does not create, exchange, store, rotate, revoke, or clear connected-host sessions.',
+          'Use the owning GoodVibes host for connected-host auth administration.',
         ].join('\n'));
         return;
       }
@@ -129,12 +67,12 @@ export function registerPlatformAccessRuntimeCommands(registry: CommandRegistry)
         const builtinProviders = listBuiltinSubscriptionProviders().map((entry) => entry.provider);
         ctx.print([
           'Auth Review',
-          '  connected-service auth: managed outside goodvibes-agent',
-          `  stored secrets: ${snapshot.secretKeyCount}`,
-          `  built-in providers: ${builtinProviders.length}${builtinProviders.length > 0 ? ` (${builtinProviders.join(', ')})` : ''}`,
-          `  active subscriptions: ${snapshot.activeSubscriptions}${snapshot.activeSubscriptions > 0 ? ` (${snapshot.providers.filter((provider) => provider.activeSubscription).map((provider) => provider.provider).join(', ')})` : ''}`,
-          `  pending subscriptions: ${snapshot.pendingSubscriptions}${snapshot.pendingSubscriptions > 0 ? ` (${snapshot.providers.filter((provider) => provider.pendingLogin).map((provider) => provider.provider).join(', ')})` : ''}`,
-          ...snapshot.providers.map((provider) => `  ${provider.provider}  freshness=${provider.freshness}  mode=${provider.callbackMode}  configured=${provider.configured ? 'yes' : 'no'}`),
+          '  connected host auth managed outside goodvibes-agent',
+          `  stored secrets ${snapshot.secretKeyCount}`,
+          `  built-in providers ${builtinProviders.length}${builtinProviders.length > 0 ? ` (${builtinProviders.join(', ')})` : ''}`,
+          `  active subscriptions ${snapshot.activeSubscriptions}${snapshot.activeSubscriptions > 0 ? ` (${snapshot.providers.filter((provider) => provider.activeSubscription).map((provider) => provider.provider).join(', ')})` : ''}`,
+          `  pending subscriptions ${snapshot.pendingSubscriptions}${snapshot.pendingSubscriptions > 0 ? ` (${snapshot.providers.filter((provider) => provider.pendingLogin).map((provider) => provider.provider).join(', ')})` : ''}`,
+          ...snapshot.providers.map((provider) => `  ${provider.provider}  auth ${provider.freshness}  finish manual  configured ${provider.configured ? 'yes' : 'no'}`),
         ].join('\n'));
         return;
       }
@@ -152,19 +90,18 @@ export function registerPlatformAccessRuntimeCommands(registry: CommandRegistry)
         });
         ctx.print([
           `Auth Provider ${provider}`,
-          `  configured: ${inspection.configured ? 'yes' : 'no'}`,
-          ...(inspection.source ? [`  source: ${inspection.source}`] : []),
-          `  freshness: ${inspection.freshness}`,
-          `  callbackMode: ${inspection.callbackMode}`,
-          ...(inspection.redirectUri ? [`  redirectUri: ${inspection.redirectUri}`] : []),
-          ...(inspection.localCallback ? [`  localCallback: ${inspection.localCallback}`] : []),
-          `  activeSubscription: ${inspection.activeSubscription ? 'yes' : 'no'}`,
-          `  pendingLogin: ${inspection.pendingLogin ? 'yes' : 'no'}`,
-          `  overrideAmbientApiKeys: ${inspection.overrideAmbientApiKeys ? 'yes' : 'no'}`,
-          ...(inspection.tokenType ? [`  tokenType: ${inspection.tokenType}`] : []),
-          ...(inspection.expiresAt ? [`  expiresAt: ${new Date(inspection.expiresAt).toISOString()}`] : []),
-          ...inspection.issues.map((issue) => `  issue: ${issue}`),
-          ...inspection.nextActions.map((action) => `  next: ${action}`),
+          `  configured ${inspection.configured ? 'yes' : 'no'}`,
+          ...(inspection.source ? [`  origin ${formatAgentRecordSource(inspection.source)}`] : []),
+          `  freshness ${inspection.freshness}`,
+          '  finish mode explicit manual',
+          ...(inspection.redirectUri ? [`  redirect URI ${inspection.redirectUri}`] : []),
+          `  active subscription ${inspection.activeSubscription ? 'yes' : 'no'}`,
+          `  pending login ${inspection.pendingLogin ? 'yes' : 'no'}`,
+          `  ambient API key override ${inspection.overrideAmbientApiKeys ? 'yes' : 'no'}`,
+          ...(inspection.tokenType ? [`  token type ${inspection.tokenType}`] : []),
+          ...(inspection.expiresAt ? [`  expires at ${new Date(inspection.expiresAt).toISOString()}`] : []),
+          ...inspection.issues.map((issue) => `  issue ${issue}`),
+          ...inspection.nextActions.map((action) => `  next ${action}`),
         ].join('\n'));
         return;
       }
@@ -182,12 +119,12 @@ export function registerPlatformAccessRuntimeCommands(registry: CommandRegistry)
         });
         ctx.print([
           `Auth Repair ${provider}`,
-          `  configured: ${inspection.configured ? 'yes' : 'no'}`,
-          `  freshness: ${inspection.freshness}`,
-          `  callbackMode: ${inspection.callbackMode}`,
-          ...inspection.issues.map((issue) => `  issue: ${issue}`),
+          `  configured ${inspection.configured ? 'yes' : 'no'}`,
+          `  freshness ${inspection.freshness}`,
+          '  finish mode explicit manual',
+          ...inspection.issues.map((issue) => `  issue ${issue}`),
           ...(inspection.nextActions.length > 0
-            ? ['  next:', ...inspection.nextActions.map((action) => `    ${action}`)]
+            ? ['  next', ...inspection.nextActions.map((action) => `    ${action}`)]
             : ['  No active repair actions suggested.']),
         ].join('\n'));
         return;

package/src/input/commands/product-runtime.ts

@@ -68,7 +68,7 @@ function formatTrustReview(bundle: TrustReviewBundle): string {
     'Trust Review',
     `  permission mode: ${bundle.permissionMode}`,
     `  secrets stored: ${bundle.secretKeys.length}`,
-    `  configured services: ${bundle.serviceNames.length}`,
+    `  configured integrations: ${bundle.serviceNames.length}`,
     `  plugins: ${bundle.pluginSummary.total} (trusted ${bundle.pluginSummary.trusted}, limited ${bundle.pluginSummary.limited}, untrusted ${bundle.pluginSummary.untrusted}, quarantined ${bundle.pluginSummary.quarantined})`,
     `  MCP servers: ${bundle.mcpSummary.total} (constrained ${bundle.mcpSummary.constrained}, ask-on-risk ${bundle.mcpSummary.askOnRisk}, allow-all ${bundle.mcpSummary.allowAll}, blocked ${bundle.mcpSummary.blocked}, quarantined ${bundle.mcpSummary.quarantined})`,
   ].join('\n');
@@ -81,7 +81,7 @@ function inspectTrustBundle(path: string): string {
     `  captured: ${new Date(parsed.capturedAt).toISOString()}`,
     `  permission mode: ${parsed.permissionMode}`,
     `  secrets stored: ${parsed.secretKeys.length}`,
-    `  configured services: ${parsed.serviceNames.length}`,
+    `  configured integrations: ${parsed.serviceNames.length}`,
     `  plugins: ${parsed.pluginSummary.total}`,
     `  MCP servers: ${parsed.mcpSummary.total}`,
   ].join('\n');

package/src/input/commands/provider-accounts-runtime.ts

@@ -2,13 +2,34 @@ import type { CommandContext, CommandRegistry } from '../command-registry.ts';
 import type {
   ProviderAccountRecord,
   ProviderAccountSnapshot,
-} from '@/runtime/index.ts';
+  ProviderAuthRoute,
+  ProviderRouteRecord,
+} from '../../panels/provider-account-snapshot.ts';
+import { buildProviderAccountSnapshot } from '../../panels/provider-account-snapshot.ts';
 import {
-  requireOperatorClient,
+  requireProvider,
+  requireServiceRegistry,
+  requireSubscriptionManager,
 } from './runtime-services.ts';
+import { formatProviderAuthRouteId } from '../../provider-auth-route-display.ts';
+
+function formatRouteList(routes: readonly ProviderAuthRoute[]): string {
+  return routes.map((route) => formatProviderAuthRouteId(route)).join(', ');
+}
+
+function formatRouteRecord(route: ProviderRouteRecord): string {
+  return `${formatProviderAuthRouteId(route.route)}  ${route.usable ? 'usable' : 'blocked'}  auth ${route.freshness}  ${route.detail}`;
+}
 
 async function loadProviderAccountSnapshot(context: CommandContext): Promise<ProviderAccountSnapshot> {
-  return await requireOperatorClient(context).providers.accountSnapshot();
+  return await buildProviderAccountSnapshot({
+    providerModels: requireProvider(context).providerRegistry,
+    services: requireServiceRegistry(context),
+    subscriptions: requireSubscriptionManager(context),
+    environment: {
+      hasEnvironmentVariable: (name: string) => Boolean(process.env[name]),
+    },
+  });
 }
 
 function findProviderAccountRecord(
@@ -28,7 +49,7 @@ export function registerProviderAccountsRuntimeCommands(registry: CommandRegistr
     async handler(args, ctx) {
       const sub = (args[0] ?? 'review').toLowerCase();
       if (sub === 'panel' || sub === 'open') {
-        ctx.print('Provider account panels are not part of the Agent workspace. Use /accounts review.');
+        ctx.print('Open Agent Workspace -> Setup -> Provider accounts for the workspace view, or run /accounts review for compact command output.');
         return;
       }
       const snapshot = await loadProviderAccountSnapshot(ctx);
@@ -36,16 +57,16 @@ export function registerProviderAccountsRuntimeCommands(registry: CommandRegistr
         const providerId = args[1];
         const record = findProviderAccountRecord(snapshot, providerId);
         if (!record) {
-          ctx.print(providerId ? `Unknown provider account: ${providerId}` : 'Usage: /accounts routes <provider>');
+          ctx.print(providerId ? `Unknown provider account ${providerId}` : 'Usage: /accounts routes <provider>');
           return;
         }
         ctx.print([
           `Provider Routes ${record.providerId}`,
-          `  preferred: ${record.preferredRoute}`,
-          `  active: ${record.activeRoute}`,
-          `  reason: ${record.activeRouteReason}`,
-          ...record.routeRecords.map((route) => `  ${route.route}  usable=${route.usable ? 'yes' : 'no'}  freshness=${route.freshness}  ${route.detail}`),
-          ...record.routeRecords.flatMap((route) => route.issues.map((issue) => `    issue: ${issue}`)),
+          `  preferred route ${formatProviderAuthRouteId(record.preferredRoute)}`,
+          `  active route ${formatProviderAuthRouteId(record.activeRoute)}`,
+          `  reason ${record.activeRouteReason}`,
+          ...record.routeRecords.map((route) => `  ${formatRouteRecord(route)}`),
+          ...record.routeRecords.flatMap((route) => route.issues.map((issue) => `    issue ${issue}`)),
         ].join('\n'));
         return;
       }
@@ -53,17 +74,17 @@ export function registerProviderAccountsRuntimeCommands(registry: CommandRegistr
         const providerId = args[1];
         const record = findProviderAccountRecord(snapshot, providerId);
         if (!record) {
-          ctx.print(providerId ? `Unknown provider account: ${providerId}` : 'Usage: /accounts repair <provider>');
+          ctx.print(providerId ? `Unknown provider account ${providerId}` : 'Usage: /accounts repair <provider>');
           return;
         }
         ctx.print([
           `Provider Account Repair ${record.providerId}`,
-          `  active route: ${record.activeRoute}`,
-          `  preferred route: ${record.preferredRoute}`,
-          ...(record.fallbackRisk ? [`  fallback: ${record.fallbackRisk}`] : []),
-          ...(record.issues.map((issue) => `  issue: ${issue}`)),
+          `  active route ${formatProviderAuthRouteId(record.activeRoute)}`,
+          `  preferred route ${formatProviderAuthRouteId(record.preferredRoute)}`,
+          ...(record.fallbackRisk ? [`  routing risk ${record.fallbackRisk}`] : []),
+          ...(record.issues.map((issue) => `  issue ${issue}`)),
           ...(record.recommendedActions.length > 0
-            ? ['  next:', ...record.recommendedActions.map((action) => `    ${action}`)]
+            ? ['  next', ...record.recommendedActions.map((action) => `    ${action}`)]
             : ['  No active repair actions suggested.']),
         ].join('\n'));
         return;
@@ -72,39 +93,39 @@ export function registerProviderAccountsRuntimeCommands(registry: CommandRegistr
         const providerId = args[1];
         const record = findProviderAccountRecord(snapshot, providerId);
         if (!record) {
-          ctx.print(providerId ? `Unknown provider account: ${providerId}` : 'Usage: /accounts show <provider>');
+          ctx.print(providerId ? `Unknown provider account ${providerId}` : 'Usage: /accounts show <provider>');
           return;
         }
         ctx.print([
           `Provider Account ${record.providerId}`,
-          `  preferredRoute: ${record.preferredRoute}`,
-          `  activeRoute: ${record.activeRoute}`,
-          `  authFreshness: ${record.authFreshness}`,
-          `  configured: ${record.configured ? 'yes' : 'no'}`,
-          `  oauthReady: ${record.oauthReady ? 'yes' : 'no'}`,
-          `  pendingLogin: ${record.pendingLogin ? 'yes' : 'no'}`,
-          `  availableRoutes: ${record.availableRoutes.join(', ')}`,
-          `  modelCount: ${record.modelCount}`,
-          `  routeReason: ${record.activeRouteReason}`,
-          ...(record.fallbackRoute ? [`  fallbackRoute: ${record.fallbackRoute}`] : []),
-          ...(record.fallbackRisk ? [`  fallbackRisk: ${record.fallbackRisk}`] : []),
-          ...(record.expiresAt ? [`  expiresAt: ${new Date(record.expiresAt).toISOString()}`] : []),
-          ...record.routeRecords.map((route) => `  route ${route.route}: usable=${route.usable ? 'yes' : 'no'} freshness=${route.freshness} — ${route.detail}`),
-          ...record.routeRecords.flatMap((route) => route.issues.map((issue) => `    issue: ${issue}`)),
-          ...record.usageWindows.map((entry) => `  window: ${entry.label} — ${entry.detail}`),
-          ...record.issues.map((issue) => `  issue: ${issue}`),
-          ...record.notes.map((note) => `  note: ${note}`),
-          ...record.recommendedActions.map((action) => `  next: ${action}`),
+          `  preferred route ${formatProviderAuthRouteId(record.preferredRoute)}`,
+          `  active route ${formatProviderAuthRouteId(record.activeRoute)}`,
+          `  auth freshness ${record.authFreshness}`,
+          `  configured ${record.configured ? 'yes' : 'no'}`,
+          `  OAuth ready ${record.oauthReady ? 'yes' : 'no'}`,
+          `  pending login ${record.pendingLogin ? 'yes' : 'no'}`,
+          `  available routes ${formatRouteList(record.availableRoutes)}`,
+          `  model count ${record.modelCount}`,
+          `  route reason ${record.activeRouteReason}`,
+          ...(record.fallbackRoute ? [`  fallback route ${formatProviderAuthRouteId(record.fallbackRoute)}`] : []),
+          ...(record.fallbackRisk ? [`  routing risk ${record.fallbackRisk}`] : []),
+          ...(record.expiresAt ? [`  expires at ${new Date(record.expiresAt).toISOString()}`] : []),
+          ...record.routeRecords.map((route) => `  route ${formatRouteRecord(route)}`),
+          ...record.routeRecords.flatMap((route) => route.issues.map((issue) => `    issue ${issue}`)),
+          ...record.usageWindows.map((entry) => `  window ${entry.label} — ${entry.detail}`),
+          ...record.issues.map((issue) => `  issue ${issue}`),
+          ...record.notes.map((note) => `  note ${note}`),
+          ...record.recommendedActions.map((action) => `  next ${action}`),
         ].join('\n'));
         return;
       }
       ctx.print([
         'Provider Account Review',
-        `  providers: ${snapshot.providers.length}`,
-        `  configured: ${snapshot.configuredCount}`,
-        `  issues: ${snapshot.issueCount}`,
+        `  providers ${snapshot.providers.length}`,
+        `  configured ${snapshot.configuredCount}`,
+        `  issues ${snapshot.issueCount}`,
         ...snapshot.providers.map((record) => (
-          `  ${record.providerId}  active=${record.activeRoute}  preferred=${record.preferredRoute}  freshness=${record.authFreshness}  models=${record.modelCount}  issues=${record.issues.length}`
+          `  ${record.providerId}  active route ${formatProviderAuthRouteId(record.activeRoute)}  preferred route ${formatProviderAuthRouteId(record.preferredRoute)}  auth ${record.authFreshness}  models ${record.modelCount}  issues ${record.issues.length}`
         )),
       ].join('\n'));
     },

package/src/input/commands/qrcode-runtime.ts

@@ -1,16 +1,15 @@
 import type { CommandRegistry } from '../command-registry.ts';
-import { join } from 'node:path';
 import { networkInterfaces } from 'node:os';
 import {
   buildCompanionConnectionInfo,
+  type CompanionConnectionInfo,
   encodeConnectionPayload,
-  formatConnectionBlock,
   generateQrMatrix,
-  getOrCreateCompanionToken,
   renderQrToString,
 } from '@pellux/goodvibes-sdk/platform/pairing';
 import { GOODVIBES_AGENT_PAIRING_SURFACE } from '../../config/surface.ts';
 import { resolveRuntimeEndpointBinding } from '../../cli/endpoints.ts';
+import { connectedHostOperatorTokenFingerprint, connectedHostTokenRequiredMessage, readConnectedHostOperatorToken } from '../../runtime/connected-host-auth.ts';
 import { requirePlatform, requireShellPaths } from './runtime-services.ts';
 
 function getLocalNetworkIp(): string {
@@ -32,28 +31,70 @@ function urlHostForBindHost(host: string): string {
   return host || '127.0.0.1';
 }
 
+function formatTokenLine(token: string, showToken: boolean): string {
+  if (showToken) return `Token:          ${token}`;
+  return `Token:          present sha256:${connectedHostOperatorTokenFingerprint(token)} (hidden in text; QR contains pairing payload)`;
+}
+
+function formatAgentPairingBlock(info: CompanionConnectionInfo, qr: string, showToken: boolean): string {
+  return [
+    `GoodVibes Agent companion pairing v${info.version}`,
+    '━━━━━━━━━━━━━━━━━━━━━━━━',
+    `Connected host: ${info.url}`,
+    `Surface:        ${info.surface}`,
+    `User:           ${info.username}`,
+    formatTokenLine(info.token, showToken),
+    '',
+    'Scan to connect:',
+    '',
+    qr,
+    '',
+    showToken
+      ? 'Manual token display was explicitly confirmed for this command.'
+      : 'For manual setup, rerun /pair --show-token --yes to print the token once.',
+    'Agent is waiting for the companion app to connect to the owning GoodVibes host.',
+  ].join('\n');
+}
+
+function shouldShowToken(args: readonly string[]): boolean {
+  return args.includes('--show-token') || args.includes('--manual-token');
+}
+
 export function registerQrcodeRuntimeCommands(registry: CommandRegistry): void {
   registry.register({
     name: 'qrcode',
     aliases: ['qr', 'pair'],
     description: 'Print companion pairing details and a QR code',
     usage: '',
-    handler(_args, ctx) {
+    handler(args, ctx) {
       const shellPaths = requireShellPaths(ctx);
       const configManager = requirePlatform(ctx).configManager;
-      const daemonHomeDir = join(shellPaths.homeDirectory, '.goodvibes', 'daemon');
-      const tokenRecord = getOrCreateCompanionToken(GOODVIBES_AGENT_PAIRING_SURFACE, { daemonHomeDir });
+      const tokenRecord = readConnectedHostOperatorToken(shellPaths.homeDirectory);
+      if (!tokenRecord.token) {
+        ctx.print(connectedHostTokenRequiredMessage(tokenRecord.path));
+        return;
+      }
       const binding = resolveRuntimeEndpointBinding(configManager, 'controlPlane');
-      const daemonUrl = `http://${urlHostForBindHost(binding.host)}:${binding.port}`;
+      const connectedHostUrl = `http://${urlHostForBindHost(binding.host)}:${binding.port}`;
       const info = buildCompanionConnectionInfo({
-        daemonUrl,
+        daemonUrl: connectedHostUrl,
         token: tokenRecord.token,
         username: 'admin',
         surface: GOODVIBES_AGENT_PAIRING_SURFACE,
       });
       const payload = encodeConnectionPayload(info);
       const qr = renderQrToString(generateQrMatrix(payload));
-      ctx.print([formatConnectionBlock(info, payload), '', qr].join('\n'));
+      const showToken = shouldShowToken(args);
+      if (showToken && !args.includes('--yes')) {
+        ctx.print([
+          'Manual companion token display requires confirmation.',
+          '  rerun: /pair --show-token --yes',
+          `  token fingerprint: sha256:${connectedHostOperatorTokenFingerprint(tokenRecord.token)}`,
+          '  QR pairing remains available without printing the raw token.',
+        ].join('\n'));
+        return;
+      }
+      ctx.print(formatAgentPairingBlock(info, qr, showToken));
     },
   });
 }

package/src/input/commands/recall-bundle.ts

@@ -31,7 +31,7 @@ export function handleRecallExport(args: string[], context: CommandContext): voi
   if (scopeIdx !== -1 && commandArgs[scopeIdx + 1]) {
     const scope = commandArgs[scopeIdx + 1];
     if (!isValidScope(scope)) {
-      context.print(`[memory] Unknown scope "${scope}". Valid: ${VALID_SCOPES.join(', ')}`);
+      context.print(`[memory] Unknown scope "${scope}". Valid values ${VALID_SCOPES.join(', ')}.`);
       return;
     }
     filter.scope = scope;
@@ -41,7 +41,7 @@ export function handleRecallExport(args: string[], context: CommandContext): voi
   if (clsIdx !== -1 && commandArgs[clsIdx + 1]) {
     const cls = commandArgs[clsIdx + 1];
     if (!isValidClass(cls)) {
-      context.print(`[memory] Unknown class "${cls}". Valid: ${VALID_CLASSES.join(', ')}`);
+      context.print(`[memory] Unknown class "${cls}". Valid values ${VALID_CLASSES.join(', ')}.`);
       return;
     }
     filter.cls = cls;
@@ -77,23 +77,23 @@ export async function handleRecallImport(args: string[], context: CommandContext
   try {
     bundle = JSON.parse(readFileSync(targetPath, 'utf-8')) as MemoryBundle;
   } catch (error) {
-    context.print(`[memory] Failed to read memory bundle: ${summarizeError(error)}`);
+    context.print(`[memory] Failed to read memory bundle ${summarizeError(error)}`);
     return;
   }
 
   const result = await memory.importBundle(bundle);
   context.print(`[memory] Imported bundle from ${targetPath}`);
-  context.print(`  Records: imported=${result.importedRecords} skipped=${result.skippedRecords}`);
-  context.print(`  Links:   imported=${result.importedLinks}`);
+  context.print(`  records imported=${result.importedRecords} skipped=${result.skippedRecords}`);
+  context.print(`  links imported=${result.importedLinks}`);
 }
 
 function inspectBundle(bundle: MemoryBundle): string {
   return [
     'Memory Handoff Review',
-    `  scope: ${bundle.scope}`,
-    `  records: ${bundle.recordCount}`,
-    `  links: ${bundle.linkCount}`,
-    `  exportedAt: ${new Date(bundle.exportedAt).toISOString()}`,
+    `  scope ${bundle.scope}`,
+    `  records ${bundle.recordCount}`,
+    `  links ${bundle.linkCount}`,
+    `  exportedAt ${new Date(bundle.exportedAt).toISOString()}`,
   ].join('\n');
 }
 
@@ -116,7 +116,7 @@ export function handleRecallHandoffExport(args: string[], context: CommandContex
   const scopeIdx = commandArgs.indexOf('--scope');
   const scopeRaw = scopeIdx !== -1 ? commandArgs[scopeIdx + 1] : 'team';
   if (!scopeRaw || !isValidScope(scopeRaw)) {
-    context.print(`[memory] Unknown scope "${scopeRaw ?? ''}". Valid: ${VALID_SCOPES.join(', ')}`);
+    context.print(`[memory] Unknown scope "${scopeRaw ?? ''}". Valid values ${VALID_SCOPES.join(', ')}.`);
     return;
   }
   const bundle = memory.exportBundle({ scope: scopeRaw });
@@ -137,7 +137,7 @@ export function handleRecallHandoffInspect(args: string[], context: CommandConte
     const bundle = JSON.parse(readFileSync(targetPath, 'utf-8')) as MemoryBundle;
     context.print(inspectBundle(bundle));
   } catch (error) {
-    context.print(`[memory] Failed to inspect handoff bundle: ${summarizeError(error)}`);
+    context.print(`[memory] Failed to inspect handoff bundle ${summarizeError(error)}`);
   }
 }
 

package/src/input/commands/recall-capture.ts

@@ -1,5 +1,6 @@
 import type { CommandContext } from '../command-registry.ts';
 import type { ProvenanceLink } from '@pellux/goodvibes-sdk/platform/state';
+import { formatAgentRecordReferences } from '../../agent/record-labels.ts';
 import {
   buildIncidentMemoryAddOptions,
   buildMcpSecurityMemoryAddOptions,
@@ -17,7 +18,7 @@ export async function handleRecallAdd(args: string[], context: CommandContext):
 
   const cls = args[0];
   if (!cls || !isValidClass(cls)) {
-    context.print(`[memory] Invalid class "${cls ?? ''}". Valid: ${VALID_CLASSES.join(', ')}`);
+    context.print(`[memory] Invalid class "${cls ?? ''}". Valid values ${VALID_CLASSES.join(', ')}.`);
     return;
   }
 
@@ -36,7 +37,7 @@ export async function handleRecallAdd(args: string[], context: CommandContext):
   const scope = scopeRaw && isValidScope(scopeRaw) ? scopeRaw : 'project';
 
   if (scopeRaw && !isValidScope(scopeRaw)) {
-    context.print(`[memory] Invalid scope "${scopeRaw}". Valid: ${VALID_SCOPES.join(', ')}`);
+    context.print(`[memory] Invalid scope "${scopeRaw}". Valid values ${VALID_SCOPES.join(', ')}.`);
     return;
   }
 
@@ -60,12 +61,13 @@ export async function handleRecallAdd(args: string[], context: CommandContext):
   }
 
   const record = await memory.add({ scope, cls, summary, detail, tags, provenance });
-  context.print(`[memory] Added ${cls}: ${record.id}`);
-  context.print(`  Scope:   ${record.scope}`);
-  context.print(`  Summary: ${record.summary}`);
-  if (record.tags.length) context.print(`  Tags: ${record.tags.join(', ')}`);
+  context.print(`[memory] Added ${cls}`);
+  context.print(`  id ${record.id}`);
+  context.print(`  scope ${record.scope}`);
+  context.print(`  summary ${record.summary}`);
+  if (record.tags.length) context.print(`  tags ${record.tags.join(', ')}`);
   if (record.provenance.length) {
-    context.print(`  Provenance: ${record.provenance.map((entry) => `${entry.kind}:${entry.ref}`).join(', ')}`);
+    context.print(`  origin ${formatAgentRecordReferences(record.provenance)}`);
   }
 }
 
@@ -87,12 +89,12 @@ export async function handleRecallCapture(args: string[], context: CommandContex
       ? context.extensions.forensicsRegistry.latest()
       : context.extensions.forensicsRegistry.getById(requestedId);
     if (!report) {
-      context.print(`[memory] Incident not found: ${requestedId ?? 'latest'}`);
+      context.print(`[memory] Incident not found ${requestedId ?? 'latest'}`);
       return;
     }
     const bundle = context.extensions.forensicsRegistry.buildBundle(report.id);
     if (!bundle) {
-      context.print(`[memory] Failed to build incident bundle: ${report.id}`);
+      context.print(`[memory] Failed to build incident bundle ${report.id}`);
       return;
     }
     const record = await memory.add(buildIncidentMemoryAddOptions(bundle));
@@ -119,7 +121,7 @@ export async function handleRecallCapture(args: string[], context: CommandContex
     }
     const server = context.extensions.mcpRegistry.listServerSecurity().find((entry) => entry.name === serverName);
     if (!server) {
-      context.print(`[memory] MCP server not found: ${serverName}`);
+      context.print(`[memory] MCP server not found ${serverName}`);
       return;
     }
     const record = await memory.add(buildMcpSecurityMemoryAddOptions(server));
@@ -139,7 +141,7 @@ export async function handleRecallCapture(args: string[], context: CommandContex
     }
     const plugin = pluginManager.list().find((entry) => entry.name === pluginName);
     if (!plugin) {
-      context.print(`[memory] Plugin not found: ${pluginName}`);
+      context.print(`[memory] Plugin not found ${pluginName}`);
       return;
     }
     const quarantineReason = pluginManager.getQuarantineRecord(plugin.name)?.reason;