@pellux/goodvibes-agent 0.1.117 → 1.0.1

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 Product-facing release notes for GoodVibes Agent.
 
+## 1.0.1 - 2026-06-03
+
+- Preserved Agent Knowledge setup paths with spaces, quoted generated Agent command guidance, and hardened MCP trust and role command validation.
+- Blocked MCP allow-all escalation from Agent slash commands while keeping Settings as the explicit allow-all surface.
+- Preserved MCP server passthrough arguments after -- and local persona, skill, and routine text that starts with flag-like values.
+- Kept the 1.0 release package and install gates green across typecheck, architecture, performance, package build, publish check, packed install smoke, and verification ledger.
+
+## 1.0.0 - 2026-06-03
+
+- Promoted GoodVibes Agent to the release-candidate operator product surface: the fullscreen Agent workspace is the primary TUI, with setup, provider/model routing, status, compatibility, and doctor flows shaped around personal operator use instead of copied host lifecycle controls.
+- Completed the Agent-local behavior system for day-one operation: local memory and notes, personas, skills, skill bundles, routines, starter profiles, discovery/import flows, review/stale/delete controls, and secret-looking content rejection all stay under Agent ownership.
+- Completed isolated Agent Knowledge coverage across CLI, slash commands, workspace panels, connector/source/node/issue views, URL/file/browser/connector ingest, semantic ask/search, and connected-host `/api/goodvibes-agent/knowledge/*` routes without fallback to default or non-Agent knowledge surfaces.
+- Completed connected-host operator integration without taking host lifecycle ownership: compatibility/status checks, authenticated health and model routes, channel readiness, provider-account posture, approvals, automation snapshots, schedules, work plans, media/voice readiness, pairing, and explicit public-route diagnostics are all visible from Agent.
+- Completed explicit side-effect boundaries for personal operation: channel sends, notifications, routine schedule promotion, reminders, subscription/auth actions, memory bundle imports/exports, support bundles, MCP configuration, profile changes, and build delegation require explicit confirmation where they mutate state or call external routes.
+- Completed package and release hardening for the 1.0 gate: Bun-only install/run instructions, package-facing text verification, package runtime bundling, packed global install smoke, blocked lifecycle command smoke, source/package boundary checks, architecture checks, recorded performance snapshot checks, verification ledger, strict live verification artifacts, and release readiness inventory are now part of the validated release path.
+
 ## 0.1.117 - 2026-06-02
 
 - Added TUI workspace entrypoints for Agent Knowledge connectors, source/node/issue list views, review queue, transcript controls, doctor diagnostics, and connected-host compatibility.
@@ -25,7 +41,7 @@ Product-facing release notes for GoodVibes Agent.
 ## 0.1.80 - 0.1.107
 
 - Made the Agent operator workspace the normal TUI landing surface after first-run setup.
-- Added local Agent memory, personas, skills, skill bundles, routines, schedule receipts, and schedule reconciliation.
+- Added Agent-local memory, personas, skills, skill bundles, routines, schedule receipts, and schedule reconciliation.
 - Added connected-host diagnostics for status, compatibility, auth presence, Agent Knowledge readiness, approvals, work plans, automation, and schedules.
 - Strengthened release gates around Bun-only install, TypeScript-only source, package contents, packed install checks, and single branch-CI test execution.
 
@@ -43,9 +59,9 @@ Product-facing release notes for GoodVibes Agent.
 
 ## 0.1.2 - 0.1.47
 
-- Added isolated Agent Knowledge CLI and slash-command routing with no fallback to default Knowledge/Wiki or non-Agent knowledge segments.
-- Added local Agent personas, skills, and routines with create/list/search/show/review/stale/delete workflows and secret-looking value rejection.
-- Added explicit build/fix/review delegation to the GoodVibes build environment; WRFC is requested only through explicit delegation.
+- Added isolated Agent Knowledge CLI and slash-command routing with no fallback to default knowledge/wiki or non-Agent knowledge segments.
+- Added Agent-local personas, skills, and routines with create/list/search/show/review/stale/delete workflows and secret-looking value rejection.
+- Added explicit build/fix/review delegation to the GoodVibes build environment; delegated review is requested only through explicit delegation.
 - Established release checks for package-facing docs, installability, executable bin behavior, and Agent product policy.
 
 ## 0.1.0 - 0.1.1

package/README.md

@@ -46,48 +46,63 @@ bun run package:install-check
 bun run publish:check
 ```
 
-After setup has been applied once, the Agent TUI opens directly into the operator workspace. You can also reopen it with `/agent`, `/home`, or `/operator`. It is the Agent-first fullscreen workspace for setup, model/provider selection, isolated Agent Knowledge, local memory/skills/routines/personas, channel readiness, voice/media setup, work-plan/approval review, automation observability, and explicit build delegation to GoodVibes TUI.
+After setup has been applied once, the Agent TUI opens directly into the operator workspace. You can also reopen it with `/agent`, `/home`, or `/operator`. It is the Agent-first fullscreen workspace for setup, conversation/session controls, model/provider selection, isolated Agent Knowledge, local memory/notes/skills/routines/personas, channel readiness, voice/media setup, work-plan/approval review, automation observability, and explicit build delegation to GoodVibes TUI.
 
 Use the workspace as the primary product surface:
 
 - Home: normal assistant chat, operator briefing, model selection, setup, and health.
+- Conversation: context usage, inline `@file`/`@folder`/`@url` references, compaction, title/session save/load/search/export, transcript search, bookmarks, paste/image/TTS helpers, undo/redo/retry, clear/reset, shortcuts, and keybindings.
+- Research: read-only web research, URL inspection, source triage, and explicit handoff into isolated Agent Knowledge when a source should become durable.
+- Artifacts: image attachment, conversation/session export, source-file ingest, source lookup, bookmark/browser-history import, and generated media artifact handling.
 - Setup: provider/model, compatibility, Agent Knowledge readiness, profiles, support bundles, subscriptions, and auth review.
 - Tools & MCP: MCP server setup, tool inventory, trust review, secret storage/link/test/delete, and settings.
 - Knowledge: isolated Agent Knowledge status, ask/search, URL/URL-list/file/bookmark/browser-history/connector ingest, source library, review queue, and reindex.
-- Memory & Skills: local memory, learned behavior capture, personas, skills, routines, and schedule promotion.
-- Channels: companion pairing, channel readiness, notification routes, and webhook add/remove/test.
-- Automation: reminder creation, schedule status, routine promotion, receipts, and reconciliation.
+- Memory & Skills: local memory, scratchpad notes, learned behavior capture, personas, skills, routines, and schedule promotion.
+- Notes: Agent-local scratchpad for source triage, temporary decisions, and operator handoff. Notes do not become memory or Agent Knowledge unless you explicitly promote or ingest something; reviewed notes can prefill memory, skills, routines, personas, or an isolated Agent Knowledge URL ingest.
+- Channels: companion pairing, channel readiness, confirmed channel delivery, and confirmed webhook add/remove/test/send.
+- Voice & Media: voice review, spoken response setup, image input, confirmed image/video generation, browser-tool posture, MCP inventory, and media provider readiness.
+- Automation: reminder creation, schedule status, routine promotion, receipts, reconciliation, and explicitly confirmed approve/deny/cancel/run/pause/resume/retry actions.
 - Build Delegation: explicit handoff to GoodVibes TUI for build/fix/review work.
 
-The setup workspace surfaces discovered local Agent persona, skill, and routine markdown files so day-one setup can import useful behavior instead of starting from blank records. It can also create one initial local persona, skill, and routine directly during first-run setup; those records stay in Agent-local registries and never write to default Knowledge/Wiki or non-Agent segments.
+Inside the Agent workspace, press `/` to search every workspace action by name, category, command, or detail. This is the primary discovery path for product actions; slash commands and CLI subcommands remain power-user/scriptable mirrors.
 
-Inside the workspace, use `/agent-profile guide` to author custom profile starters without leaving the Agent TUI. The guided flow lists starters, exports starter JSON, imports edited local starters, and creates isolated Agent profiles from them.
+The setup workspace surfaces discovered Agent-local persona, skill, and routine markdown files so day-one setup can import useful behavior instead of starting from blank records. It can also create one initial scratchpad note, local persona, skill, and routine directly during first-run setup; those records stay in Agent-local registries and never write to default knowledge or non-Agent segments.
+
+In the Profiles workspace, choose Starter authoring guide to author custom profile starters without leaving the Agent TUI. The guided flow lists starters, exports starter JSON, imports edited local starters, and creates isolated Agent profiles from them.
 
 Use the Profiles workspace form to turn reviewed discovered persona, skill, and routine files into a local starter template and isolated Agent profile in one confirmed flow. The scriptable equivalent is `profiles create-from-discovered <name> --yes`; `profiles templates from-discovered <id> --yes` is still available when you only want to save the starter first.
 
 The Knowledge area includes an in-workspace URL ingest form. It writes only to Agent Knowledge, requires typed confirmation, and dispatches the existing isolated `/knowledge ingest-url ... --yes` route.
 
+The Research workspace submits web research and URL inspection requests back to the normal Agent conversation. These requests can use connected read-only web tools when the user asks, but they do not ingest sources into Agent Knowledge. Use the separate confirmed Agent Knowledge ingest actions when a reviewed source should become durable.
+
+The Voice & Media workspace includes `Generate media`, a confirmed form for image/video generation through configured media providers. Generated bytes are stored as GoodVibes artifacts and the transcript shows artifact ids, not inline base64. The power-user mirror is `/media generate [--provider <id>] [--model <id>] [--mime <mime>] <prompt> --yes`; `/media providers` lists readiness.
+
 Use isolated Agent profiles when one machine needs separate operator identities or local state. In the TUI, open Agent Workspace -> Profiles to browse starters, create a profile, use it as the default for the next launch, clear the default, and export/import starter JSON. The same profile selection is available for one launch with `goodvibes-agent --agent-profile <name>`.
 
-Profiles isolate Agent-local config, sessions, local memory, personas, skills, routines, and setup state. Starter templates seed local personas, skills, and routines for household, research, travel, operations, and personal productivity profiles; exported starter JSON can be edited and re-imported as a local starter. The connected GoodVibes host remains shared unless that host is separately configured otherwise.
+Profiles isolate Agent-local config, sessions, local memory, scratchpad notes, personas, skills, routines, and setup state. First-run setup seeds new profiles from a built-in starter by default unless you explicitly choose `No profile`. Starter templates seed local personas, skills, and routines for household, research, travel, operations, and personal productivity profiles; exported starter JSON can be edited and re-imported as a local starter. The connected GoodVibes host remains shared unless that host is separately configured otherwise.
 
 The installed CLI mirrors the same local behavior libraries for scripts and automation, but it is not the primary product path. Personas, skills, memory, and routines are created, reviewed, enabled, exported/imported where relevant, and deleted from the TUI workspace first; destructive actions still require explicit confirmation.
 
 The Agent workspace also has a `Capture learned behavior` form. Use it after reviewing a repeated workflow, lesson, or operating style; it saves one local skill, routine, or persona directly from the TUI and does not write to connected-host routes or non-Agent knowledge.
 
-Local Agent behavior is editable from the TUI workspace:
+When the user explicitly asks, the main assistant conversation can perform the same narrow operator actions exposed by the TUI: approve/deny/cancel a named approval, run/pause/resume a named automation job, cancel/retry a named automation run, or run a named schedule. These actions require explicit confirmation, use only public connected-host operator routes, and do not create, edit, or delete automation definitions.
+
+Agent-local behavior is editable from the TUI workspace:
 
 - Agent Workspace -> Personas: create, inspect, activate, review, stale, and delete local personas.
 - Agent Workspace -> Skills: create skills, import discovered skills, enable or disable them, and manage skill bundles.
 - Agent Workspace -> Routines: create routines, start a routine in the main conversation, review receipts, and explicitly promote one routine to a connected schedule.
+- Agent Workspace -> Work: review the visible local work plan, add work items, and update status from the TUI while the main assistant conversation can keep the same plan current.
 - Agent Workspace -> Memory & Skills: create memory, search memory, review/stale/delete records, export/import bundles, and rebuild the local vector index.
-- Agent Workspace -> Channels: inspect readiness, pair companion clients, and manage notification targets with confirmation.
+- Agent Workspace -> Notes: create, edit, review, stale, delete, and promote Agent-local scratchpad notes into memory, skills, routines, or personas.
+- Agent Workspace -> Channels: inspect readiness, pair companion clients, send one confirmed channel delivery message, and manage or send configured notification targets with confirmation.
 
 Slash commands remain available inside the TUI for power users, but the fullscreen Agent workspace is the primary path for these workflows.
 
-Starting a routine records local usage and prints its steps; it does not launch local workers or automation jobs. Promotion to a connected schedule is separate and explicit: it calls the public `schedules.create` route only after `--yes`, can include explicit delivery targets such as `--delivery-channel slack`, records a redacted local receipt, and the generated scheduled prompt keeps Agent Knowledge isolated from default Knowledge/Wiki and non-Agent knowledge segments. Use `/schedule reconcile` to compare those local receipts against live connected schedules through public `schedules.list`.
+Starting a routine records local usage and prints its steps in the main conversation; it does not start background automation. Promotion to a connected schedule is separate and explicit: it calls the public `schedules.create` route only after `--yes`, can include explicit delivery targets such as `--delivery-channel slack`, records a redacted local receipt, and the generated scheduled prompt keeps Agent Knowledge isolated from default knowledge and non-Agent knowledge segments. Use `/schedule reconcile` to compare those local receipts against live connected schedules through public `schedules.list`.
 
-Use `/channels` inside the TUI for a read-only channel readiness matrix. It shows enabled channels, missing config key names, delivery posture, and risk labels without sending messages or rendering token values.
+Use `/channels` inside the TUI for channel readiness and exact confirmed sends. Readiness views show enabled channels, missing config key names, delivery posture, and risk labels without sending messages or rendering token values. Companion pairing is QR-first; `/pair` hides the raw token in text, and manual token display requires `/pair --show-token --yes`. `/channels send --channel <surface[:route[:label]]> --message <text> --yes` sends one explicit delivery through configured strategies.
 
 ## Connected Host
 
@@ -99,13 +114,13 @@ Agent reports unavailable, unauthenticated, or incompatible connected-host state
 
 ## Product Boundary
 
-GoodVibes Agent owns the operator assistant TUI: serial assistant flow, proactive safe actions, local memory/routines/skills/personas, Agent knowledge routes, companion chat, approvals/automation observability, and explicit build delegation.
+GoodVibes Agent owns the operator assistant TUI: serial assistant flow, proactive safe actions, local memory/notes/routines/skills/personas, Agent knowledge routes, companion chat, approvals/automation observability, and explicit build delegation.
 
-Agent Knowledge/Wiki is its own product segment. Agent uses `/api/goodvibes-agent/knowledge/*` and must not fall back to default Knowledge/Wiki or other product-specific knowledge routes.
+Agent Knowledge is its own product segment. Agent uses `/api/goodvibes-agent/knowledge/*` and must not fall back to default knowledge or other product-specific knowledge routes.
 
 Agent Workspace -> Knowledge can ask/search, inspect sources/nodes/issues, inspect connectors, ingest URL/file/bookmark/browser-history/connector input, and reindex the Agent segment. CLI commands mirror those same isolated Agent Knowledge workflows for scripts. Confirmed mutations require explicit confirmation.
 
-GoodVibes TUI owns coding execution: file edits, git/worktree workflows, coding panels, execution isolation UX, and WRFC execution. Agent may delegate explicit build/fix/review work to TUI through public runtime/session contracts; normal assistant chat must not use shared coding sessions.
+GoodVibes TUI owns coding execution: file edits, git/worktree workflows, coding panels, execution isolation UX, and delegated review execution. Agent may delegate explicit build/fix/review work to TUI through public runtime/session contracts; normal assistant chat must not use shared coding sessions.
 
 ## Package Docs
 
@@ -113,6 +128,12 @@ Package-facing docs:
 
 - [Getting Started](docs/getting-started.md)
 - [Connected Host](docs/connected-host.md)
+- [Knowledge, Artifacts, and Multimodal](docs/knowledge-artifacts-and-multimodal.md)
+- [Tools and Commands](docs/tools-and-commands.md)
+- [Channels, Remote Access, and API](docs/channels-remote-and-api.md)
+- [Providers and Routing](docs/providers-and-routing.md)
+- [Voice and Live TTS](docs/voice-and-live-tts.md)
+- [Project Planning](docs/project-planning.md)
 - [Release And Publishing](docs/release-and-publishing.md)
 
 The package-facing Agent documentation is limited to the docs listed above.

package/bin/goodvibes-agent.ts

@@ -6,8 +6,22 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 const runtimeEntry = join(dirname(fileURLToPath(import.meta.url)), '..', 'dist', 'package', 'main.js');
 
 if (!existsSync(runtimeEntry)) {
-  console.error('goodvibes-agent packaged runtime is missing. Reinstall @pellux/goodvibes-agent with Bun.');
+  console.error([
+    'goodvibes-agent packaged runtime is missing.',
+    'Reinstall with Bun: bun add -g @pellux/goodvibes-agent',
+    'If the command is not on PATH, add Bun global bin: export PATH="$HOME/.bun/bin:$PATH"',
+  ].join('\n'));
   process.exit(1);
 }
 
-await import(pathToFileURL(runtimeEntry).href);
+try {
+  await import(pathToFileURL(runtimeEntry).href);
+} catch (error) {
+  const message = error instanceof Error ? error.message : String(error);
+  console.error([
+    `goodvibes-agent failed to launch the packaged runtime: ${message}`,
+    'Reinstall with Bun: bun add -g @pellux/goodvibes-agent',
+    'Then run: goodvibes-agent',
+  ].join('\n'));
+  process.exit(1);
+}