@pellux/goodvibes-agent 0.1.117 → 1.0.1

package/src/cli/routines-command.ts

@@ -1,11 +1,12 @@
 import { createShellPathService } from '@/runtime/index.ts';
+import { formatAgentRecordOrigin, formatAgentRecordReviewState } from '../agent/record-labels.ts';
 import { discoverRoutines, type DiscoveredRoutineRecord } from '../agent/routine-discovery.ts';
 import { AgentRoutineRegistry, evaluateAgentRoutineReadiness, type AgentRoutineRecord } from '../agent/routine-registry.ts';
 import { buildAgentSkillRequirements, formatAgentSkillRequirement } from '../agent/skill-registry.ts';
 import {
   buildRoutineSchedulePreview,
-  promoteRoutineToDaemonSchedule,
-  resolveAgentDaemonConnection,
+  promoteRoutineToConnectedSchedule,
+  resolveAgentConnectedHostConnection,
 } from '../agent/routine-schedule-promotion.ts';
 import { parseRoutineSchedulePromotionArgs } from '../agent/routine-schedule-args.ts';
 import {
@@ -42,6 +43,7 @@ interface ParsedRoutineOptions {
 }
 
 const ROUTINE_CREATE_USAGE = 'Usage: goodvibes-agent routines create --name <name> --description <summary> --steps <steps> [--tags a,b] [--triggers a,b] [--requires-env A,B] [--requires-command gh,jq] [--enabled]';
+const ROUTINE_VALUE_OPTIONS = ['name', 'description', 'steps', 'tags', 'triggers', 'requires-env', 'requires-command', 'requires-commands'] as const;
 
 function jsonOrText(runtime: CliCommandRuntime, value: unknown, text: string): string {
   return runtime.cli.flags.outputFormat === 'json' ? JSON.stringify(value, null, 2) : text;
@@ -82,19 +84,30 @@ function splitList(value: string | undefined): readonly string[] {
 }
 
 function parseRoutineOptions(args: readonly string[]): ParsedRoutineOptions {
+  const valued: ReadonlySet<string> = new Set(ROUTINE_VALUE_OPTIONS);
   const flags = new Map<string, string>();
   const positionals: string[] = [];
   let yes = false;
   for (let index = 0; index < args.length; index += 1) {
     const token = args[index] ?? '';
+    if (token === '--') {
+      positionals.push(...args.slice(index + 1));
+      break;
+    }
     if (token === '--yes') {
       yes = true;
       continue;
     }
-    if (token.startsWith('--')) {
-      const key = token.slice(2);
+    if (token.startsWith('--') && token.length > 2) {
+      const raw = token.slice(2);
+      const equalIndex = raw.indexOf('=');
+      if (equalIndex >= 0) {
+        flags.set(raw.slice(0, equalIndex), raw.slice(equalIndex + 1));
+        continue;
+      }
+      const key = raw;
       const next = args[index + 1];
-      if (next !== undefined && !next.startsWith('--')) {
+      if (next !== undefined && (valued.has(key) || !next.startsWith('--'))) {
         flags.set(key, next);
         index += 1;
       } else {
@@ -146,17 +159,17 @@ function parseImportFlags(args: readonly string[]): {
 
 function summarizeRoutine(routine: AgentRoutineRecord): string {
   const enabled = routine.enabled ? 'enabled' : 'disabled';
-  const tags = routine.tags.length > 0 ? ` tags=${routine.tags.join(',')}` : '';
+  const tags = routine.tags.length > 0 ? `  tags ${routine.tags.join(', ')}` : '';
   const readiness = evaluateAgentRoutineReadiness(routine);
   const ready = readiness.ready ? 'ready' : `needs ${readiness.missing.map(formatAgentSkillRequirement).join(',')}`;
-  return `  ${routine.id}  ${enabled}  ${routine.reviewState}  ${ready}  starts=${routine.startCount}  ${routine.name} - ${routine.description}${tags}`;
+  return `  ${routine.id}  ${enabled}  ${formatAgentRecordReviewState(routine.reviewState)}  ${ready}  starts ${routine.startCount}  ${routine.name} - ${routine.description}${tags}`;
 }
 
 function summarizeDiscoveredRoutine(routine: DiscoveredRoutineRecord): string {
   const description = routine.description ? ` - ${routine.description}` : '';
   return [
     `  ${routine.name}  ${routine.origin}${description}`,
-    `    path: ${routine.path}`,
+    `    path ${routine.path}`,
   ].join('\n');
 }
 
@@ -208,13 +221,13 @@ function renderRoutineList(title: string, path: string, routines: readonly Agent
   if (routines.length === 0) {
     return [
       title,
-      `  ${emptyMessage ?? 'No local Agent routines yet.'}`,
+      `  ${emptyMessage ?? 'No Agent-local routines yet.'}`,
       emptyMessage ? '' : '  Open /agent routines in the TUI, or use goodvibes-agent routines create for scripted setup.',
     ].filter(Boolean).join('\n');
   }
   return [
     `${title} (${routines.length})`,
-    `  store: ${path}`,
+    `  store ${path}`,
     ...routines.map(summarizeRoutine),
   ].join('\n');
 }
@@ -223,20 +236,19 @@ function renderRoutine(routine: AgentRoutineRecord): string {
   const readiness = evaluateAgentRoutineReadiness(routine);
   return [
     `Routine ${routine.name}`,
-    `  id: ${routine.id}`,
-    `  enabled: ${routine.enabled ? 'yes' : 'no'}`,
-    `  readiness: ${readiness.ready ? 'ready' : 'needs setup'}`,
-    `  requirements: ${routine.requirements.map(formatAgentSkillRequirement).join(', ') || '(none)'}`,
-    readiness.missing.length > 0 ? `  missing: ${readiness.missing.map(formatAgentSkillRequirement).join(', ')}` : '',
-    `  review: ${routine.reviewState}`,
-    `  source: ${routine.source}`,
-    `  provenance: ${routine.provenance}`,
-    `  tags: ${routine.tags.join(', ') || '(none)'}`,
-    `  triggers: ${routine.triggers.join(', ') || '(manual)'}`,
-    `  started: ${routine.startCount}${routine.lastStartedAt ? `; last ${routine.lastStartedAt}` : ''}`,
-    `  created: ${routine.createdAt}`,
-    `  updated: ${routine.updatedAt}`,
-    routine.staleReason ? `  stale reason: ${routine.staleReason}` : '',
+    `  id ${routine.id}`,
+    `  enabled ${routine.enabled ? 'yes' : 'no'}`,
+    `  readiness ${readiness.ready ? 'ready' : 'needs setup'}`,
+    `  requirements ${routine.requirements.map(formatAgentSkillRequirement).join(', ') || '(none)'}`,
+    readiness.missing.length > 0 ? `  missing ${readiness.missing.map(formatAgentSkillRequirement).join(', ')}` : '',
+    `  review ${formatAgentRecordReviewState(routine.reviewState)}`,
+    `  origin ${formatAgentRecordOrigin(routine.source, routine.provenance)}`,
+    `  tags ${routine.tags.join(', ') || '(none)'}`,
+    `  triggers ${routine.triggers.join(', ') || '(manual)'}`,
+    `  started ${routine.startCount}${routine.lastStartedAt ? `; last ${routine.lastStartedAt}` : ''}`,
+    `  created ${routine.createdAt}`,
+    `  updated ${routine.updatedAt}`,
+    routine.staleReason ? `  stale reason ${routine.staleReason}` : '',
     '',
     routine.description,
     '',
@@ -267,7 +279,7 @@ async function handleRoutinePromotion(runtime: CliCommandRuntime, args: readonly
     const failure: RoutinesCommandFailure = {
       ok: false,
       kind: 'routine_not_found',
-      error: `Unknown Agent routine: ${parsed.routineId ?? ''}`,
+      error: `Unknown Agent routine ${parsed.routineId ?? ''}`,
     };
     return {
       output: json ? JSON.stringify(failure, null, 2) : failure.error,
@@ -286,8 +298,8 @@ async function handleRoutinePromotion(runtime: CliCommandRuntime, args: readonly
       exitCode: 0,
     };
   }
-  const connection = resolveAgentDaemonConnection(runtime.configManager, runtime.homeDirectory);
-  const result = await promoteRoutineToDaemonSchedule(connection, preview);
+  const connection = resolveAgentConnectedHostConnection(runtime.configManager, runtime.homeDirectory);
+  const result = await promoteRoutineToConnectedSchedule(connection, preview);
   const receipt = routineReceiptStore(runtime).append(connection, preview, result);
   if (!result.ok) {
     return {
@@ -339,7 +351,7 @@ export async function handleRoutinesCommand(runtime: CliCommandRuntime): Promise
             : 'Agent routines',
         snapshot.path,
         routines,
-        normalized === 'attention' || normalized === 'needs-setup' ? 'No local Agent routines need setup.' : undefined,
+        normalized === 'attention' || normalized === 'needs-setup' ? 'No Agent-local routines need setup.' : undefined,
       )),
       exitCode: 0,
     };
@@ -374,7 +386,7 @@ export async function handleRoutinesCommand(runtime: CliCommandRuntime): Promise
       const failure: RoutinesCommandFailure = {
         ok: false,
         kind: 'routine_discovery_not_found',
-        error: `Unknown discovered Agent routine: ${parsed.name}\nRun goodvibes-agent routines discover to inspect available routine files.`,
+        error: `Unknown discovered Agent routine ${parsed.name}\nRun goodvibes-agent routines discover to inspect available routine files.`,
       };
       return {
         output: runtime.cli.flags.outputFormat === 'json' ? JSON.stringify(failure, null, 2) : failure.error,
@@ -390,12 +402,12 @@ export async function handleRoutinesCommand(runtime: CliCommandRuntime): Promise
       return {
         output: jsonOrText(runtime, value, [
           'Agent routine import preview',
-          `  name: ${discovered.name}`,
-          `  origin: ${discovered.origin}`,
-          `  path: ${discovered.path}`,
-          `  description: ${discovered.description || '(none)'}`,
-          `  steps characters: ${discovered.steps.length}`,
-          '  next: rerun with --yes to import into the Agent-local routine registry',
+          `  name ${discovered.name}`,
+          `  origin ${discovered.origin}`,
+          `  path ${discovered.path}`,
+          `  description ${discovered.description || '(none)'}`,
+          `  steps characters ${discovered.steps.length}`,
+          '  next rerun with --yes to import into the Agent-local routine registry',
         ].join('\n')),
         exitCode: 0,
       };
@@ -420,7 +432,11 @@ export async function handleRoutinesCommand(runtime: CliCommandRuntime): Promise
       data: routine,
     };
     return {
-      output: jsonOrText(runtime, value, `Imported Agent routine ${routine.id}: ${routine.name}${routine.enabled ? ' (enabled)' : ''}`),
+      output: jsonOrText(runtime, value, [
+        `Imported Agent routine ${routine.id}: ${routine.name}${routine.enabled ? ' (enabled)' : ''}`,
+        `  name ${routine.name}`,
+        `  enabled ${routine.enabled ? 'yes' : 'no'}`,
+      ].join('\n')),
       exitCode: 0,
     };
   }
@@ -447,7 +463,11 @@ export async function handleRoutinesCommand(runtime: CliCommandRuntime): Promise
         data: routine,
       };
       return {
-        output: jsonOrText(runtime, value, `Created Agent routine ${routine.id}: ${routine.name}${routine.enabled ? ' (enabled)' : ''}`),
+        output: jsonOrText(runtime, value, [
+          `Created Agent routine ${routine.id}: ${routine.name}${routine.enabled ? ' (enabled)' : ''}`,
+          `  name ${routine.name}`,
+          `  enabled ${routine.enabled ? 'yes' : 'no'}`,
+        ].join('\n')),
         exitCode: 0,
       };
     } catch (error) {
@@ -491,7 +511,7 @@ export async function handleRoutinesCommand(runtime: CliCommandRuntime): Promise
   if (normalized === 'reconcile' || normalized === 'sync' || normalized === 'status') {
     const store = routineReceiptStore(runtime);
     const result = await reconcileRoutineScheduleReceipts(
-      resolveAgentDaemonConnection(runtime.configManager, runtime.homeDirectory),
+      resolveAgentConnectedHostConnection(runtime.configManager, runtime.homeDirectory),
       store.snapshot(),
     );
     return {
@@ -504,7 +524,7 @@ export async function handleRoutinesCommand(runtime: CliCommandRuntime): Promise
     if (!id) return { output: 'Usage: goodvibes-agent routines receipt <receipt-id>', exitCode: 2 };
     const receipt = routineReceiptStore(runtime).get(id);
     if (!receipt) {
-      const failure: RoutinesCommandFailure = { ok: false, kind: 'routine_schedule_receipt_not_found', error: `Unknown routine schedule receipt: ${id}` };
+      const failure: RoutinesCommandFailure = { ok: false, kind: 'routine_schedule_receipt_not_found', error: `Unknown routine schedule receipt ${id}` };
       return {
         output: runtime.cli.flags.outputFormat === 'json' ? JSON.stringify(failure, null, 2) : failure.error,
         exitCode: 1,

package/src/cli/service-posture.ts

@@ -1,7 +1,7 @@
 import { closeSync, existsSync, openSync, readSync, statSync } from 'node:fs';
 import net from 'node:net';
 import { isAbsolute, join } from 'node:path';
-import type { ConfigManager } from '../config/index.ts';
+import type { ConfigKey, ConfigManager } from '../config/index.ts';
 import { resolveRuntimeEndpointBinding } from './endpoints.ts';
 import type { RuntimeEndpointBinding, RuntimeEndpointId } from './endpoints.ts';
 import { classifyBindPosture, isNetworkFacing } from './network-posture.ts';
@@ -60,7 +60,7 @@ export interface CliServicePosture {
   readonly issues: readonly string[];
 }
 
-const ENDPOINTS: readonly { readonly id: RuntimeEndpointId; readonly label: string; readonly enabledKey: string }[] = [
+const ENDPOINTS: readonly { readonly id: RuntimeEndpointId; readonly label: string; readonly enabledKey: ConfigKey }[] = [
   { id: 'controlPlane', label: 'runtime connection', enabledKey: 'controlPlane.enabled' },
   { id: 'httpListener', label: 'inbound events endpoint', enabledKey: 'danger.httpListener' },
   { id: 'web', label: 'browser companion route', enabledKey: 'web.enabled' },
@@ -161,7 +161,7 @@ export async function buildCliServicePosture(
   options: CliServicePostureOptions = {},
 ): Promise<CliServicePosture> {
   const endpoints = await Promise.all(ENDPOINTS.map(async (endpoint): Promise<CliServiceEndpointPosture> => {
-    const enabled = runtime.configManager.get(endpoint.enabledKey as never) === true;
+    const enabled = runtime.configManager.get(endpoint.enabledKey) === true;
     const binding = resolveRuntimeEndpointBinding(runtime.configManager, endpoint.id);
     return {
       id: endpoint.id,
@@ -232,12 +232,12 @@ export function formatCliServicePosture(posture: CliServicePosture, json = false
     `  log: ${posture.log.path ?? 'n/a'} (${posture.log.exists ? 'present' : 'missing'})`,
     ...(posture.log.readError ? [`  log read error: ${posture.log.readError}`] : []),
     '',
-    'Connected API checks:',
+    'Connected API checks',
     ...posture.endpoints.map((endpoint) =>
-      `  ${endpoint.label}: enabled=${yesNo(endpoint.enabled)} ${endpoint.binding.hostMode} ${endpoint.binding.host}:${endpoint.binding.port} posture=${endpoint.bindPosture.label}${endpoint.reachable === undefined ? '' : ` reachable=${yesNo(endpoint.reachable)}`}`,
+      `  ${endpoint.label} enabled ${yesNo(endpoint.enabled)}  ${endpoint.binding.hostMode} ${endpoint.binding.host}:${endpoint.binding.port}  posture ${endpoint.bindPosture.label}${endpoint.reachable === undefined ? '' : `  reachable ${yesNo(endpoint.reachable)}`}`,
     ),
     '',
-    posture.issues.length === 0 ? 'Readiness: ready' : 'Readiness: needs attention',
+    posture.issues.length === 0 ? 'Readiness ready' : 'Readiness needs attention',
     ...posture.issues.map((issue) => `  - ${issue}`),
   ].join('\n');
 }

package/src/cli/status.ts

@@ -1,11 +1,12 @@
 import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
 import type { OnboardingCheckMarkersState } from '../runtime/onboarding/index.ts';
 import { resolveRuntimeEndpointBinding } from './endpoints.ts';
-import { isNetworkFacing } from './network-posture.ts';
 import type { GoodVibesCliOutputFormat } from './types.ts';
 import type { CliServicePosture } from './service-posture.ts';
 import type { CliExternalRuntimeSnapshot } from './external-runtime.ts';
 import { getProviderIdFromModel } from '../config/provider-model.ts';
+import { formatAgentRecordSource } from '../agent/record-labels.ts';
+import { formatAgentKnowledgeFailureKind } from './agent-knowledge-format.ts';
 
 export interface CliStatusOptions {
   readonly configManager: Pick<ConfigManager, 'get'>;
@@ -30,7 +31,7 @@ export interface CliAuthStatus {
 
 export interface CliDoctorFinding {
   readonly id: string;
-  readonly area: 'auth' | 'network' | 'onboarding' | 'runtime' | 'security' | 'secrets';
+  readonly area: 'auth' | 'onboarding' | 'runtime' | 'security' | 'secrets';
   readonly severity: 'warning' | 'risk';
   readonly summary: string;
   readonly cause: string;
@@ -92,29 +93,11 @@ function secretPolicyLabel(policy: unknown): string {
   return String(policy ?? 'unknown');
 }
 
-function bindLine(label: string, enabled: unknown, binding: { readonly hostMode: string; readonly host: string; readonly port: number }): string {
-  return `  ${label}: ${yesNo(enabled)} (${binding.hostMode} ${binding.host}:${binding.port})`;
-}
-
 export function buildCliDoctorFindings(options: CliStatusOptions): readonly CliDoctorFinding[] {
   const config = options.configManager;
-  const serviceEnabled = config.get('service.enabled') === true;
-  const daemonEnabled = config.get('danger.daemon') === true;
-  const listenerEnabled = config.get('danger.httpListener') === true;
-  const webEnabled = config.get('web.enabled') === true;
-  const controlPlaneEnabled = config.get('controlPlane.enabled') === true;
-  const controlPlaneBinding = resolveRuntimeEndpointBinding(config, 'controlPlane');
-  const httpListenerBinding = resolveRuntimeEndpointBinding(config, 'httpListener');
-  const webBinding = resolveRuntimeEndpointBinding(config, 'web');
   const permissionMode = config.get('permissions.mode');
   const secretPolicy = config.get('storage.secretPolicy');
   const marker = options.onboardingMarkers?.effective;
-  const serverBackedEnabled = daemonEnabled || controlPlaneEnabled || listenerEnabled || webEnabled;
-  const networkFacingSurfaces = [
-    ['runtime connection', controlPlaneEnabled, controlPlaneBinding],
-    ['inbound events endpoint', listenerEnabled, httpListenerBinding],
-    ['browser companion route', webEnabled, webBinding],
-  ].filter(([, enabled, binding]) => isNetworkFacing(enabled, binding as typeof controlPlaneBinding));
 
   const findings: CliDoctorFinding[] = [];
 
@@ -127,7 +110,7 @@ export function buildCliDoctorFindings(options: CliStatusOptions): readonly CliD
         summary: 'Connected GoodVibes host is not reachable.',
         cause: `Agent could not reach ${options.externalRuntime.baseUrl}${options.externalRuntime.error ? `: ${options.externalRuntime.error}` : '.'}`,
         impact: 'Companion chat, isolated Agent Knowledge, approvals, automation status, and build delegation cannot work until the connected GoodVibes host is available.',
-        action: 'Start or repair the owning GoodVibes host, then rerun goodvibes-agent status.',
+        action: 'Make the owning GoodVibes host available, then rerun goodvibes-agent status.',
       });
     } else if (!options.externalRuntime.compatible) {
       findings.push({
@@ -160,24 +143,12 @@ export function buildCliDoctorFindings(options: CliStatusOptions): readonly CliD
         severity: 'warning',
         summary: 'Isolated Agent Knowledge route is not ready.',
         cause: `${options.externalRuntime.agentKnowledge.route} returned ${options.externalRuntime.agentKnowledge.kind}${options.externalRuntime.agentKnowledge.statusCode === null ? '' : ` (${options.externalRuntime.agentKnowledge.statusCode})`}.`,
-        impact: 'Agent Knowledge ask/search will not use any fallback wiki or non-Agent knowledge segment; it will fail closed until the Agent route is available.',
+        impact: 'Agent Knowledge ask/search will not use default or non-Agent knowledge fallback; it will fail closed until the Agent route is available.',
         action: 'Update the connected GoodVibes host to the Agent-compatible SDK and verify goodvibes-agent compat.',
       });
     }
   }
 
-  if (serverBackedEnabled && !serviceEnabled) {
-    findings.push({
-      id: 'runtime-ownership-external',
-      area: 'runtime',
-      severity: 'warning',
-      summary: 'Connected-host settings are present while Agent host ownership is disabled by design.',
-      cause: 'One or more connected API, inbound events, or browser companion settings are enabled while service.enabled is false.',
-      impact: 'The owning GoodVibes host must provide availability for those endpoints; Agent will not start or enable them.',
-      action: 'Manage connected-host availability from GoodVibes TUI or the owning host, then use Agent for read-only diagnostics.',
-    });
-  }
-
   if (options.service) {
     for (const issue of options.service.issues) {
       if (findings.some((finding) => finding.summary === issue)) continue;
@@ -187,8 +158,8 @@ export function buildCliDoctorFindings(options: CliStatusOptions): readonly CliD
         severity: 'warning',
         summary: issue,
         cause: 'The connected-host inspection found a mismatch between configured endpoint state and observed host state.',
-        impact: 'Connected API, listener, or web availability may not match the configuration.',
-        action: 'Use Agent status and doctor diagnostics here, then manage the connected host outside Agent.',
+        impact: 'Companion chat, Agent Knowledge, approvals, automation status, or build delegation may be unavailable.',
+        action: 'Use Agent status and doctor diagnostics here, then repair the connected GoodVibes host outside Agent.',
       });
     }
   }
@@ -200,35 +171,11 @@ export function buildCliDoctorFindings(options: CliStatusOptions): readonly CliD
       severity: 'warning',
       summary: 'Agent setup has not been applied for this user.',
       cause: 'No global user setup completion marker was found.',
-      impact: 'Important connected-host, network, provider, auth, or permission choices may still be implicit defaults.',
+      impact: 'Provider/model, Agent Knowledge, local behavior, channel, and permission choices may still be implicit defaults.',
       action: 'Run /setup in GoodVibes Agent or goodvibes-agent setup status to review setup state.',
     });
   }
 
-  if (networkFacingSurfaces.length > 0 && options.auth?.userStorePresent !== true) {
-    findings.push({
-      id: 'network-endpoint-without-runtime-auth-signal',
-      area: 'auth',
-      severity: 'risk',
-      summary: 'Network-facing connected-host endpoints are enabled without a visible auth signal.',
-      cause: `${networkFacingSurfaces.map(([name]) => name).join(', ')} are LAN/custom-bound, but Agent cannot see connected-host auth state from its local compatibility files.`,
-      impact: 'Remote access paths may be unusable or unsafe unless the owning host configured auth.',
-      action: 'Review connected-host auth outside Agent; Agent will not create local service users.',
-    });
-  }
-
-  if (networkFacingSurfaces.length > 0 && options.auth?.bootstrapCredentialPresent === true) {
-    findings.push({
-      id: 'network-endpoint-with-bootstrap-credential',
-      area: 'auth',
-      severity: 'risk',
-      summary: 'A bootstrap credential is still present while network-facing surfaces are enabled.',
-      cause: `${networkFacingSurfaces.map(([name]) => name).join(', ')} are LAN/custom-bound and auth-bootstrap.txt exists.`,
-      impact: 'Bootstrap credentials should be treated as temporary setup material, not long-lived network access credentials.',
-      action: 'Replace bootstrap auth and retire the bootstrap credential outside Agent.',
-    });
-  }
-
   if (permissionMode === 'allow-all') {
     findings.push({
       id: 'allow-all-permissions',
@@ -253,18 +200,6 @@ export function buildCliDoctorFindings(options: CliStatusOptions): readonly CliD
     });
   }
 
-  if (listenerEnabled && isNetworkFacing(listenerEnabled, httpListenerBinding)) {
-    findings.push({
-      id: 'network-http-listener-enabled',
-      area: 'network',
-      severity: 'warning',
-      summary: 'The inbound events endpoint is reachable beyond loopback.',
-      cause: `Inbound events endpoint is enabled on ${httpListenerBinding.host}:${httpListenerBinding.port} with ${httpListenerBinding.hostMode} binding.`,
-      impact: 'External tools and devices may be able to reach incoming event endpoints.',
-      action: 'Keep inbound-event secrets/signature checks configured for every enabled endpoint.',
-    });
-  }
-
   return findings;
 }
 
@@ -315,13 +250,6 @@ export function buildCliStatusSnapshot(options: CliStatusOptions): CliStatusSnap
 export function renderCliStatus(options: CliStatusOptions): string {
   const config = options.configManager;
   const snapshot = buildCliStatusSnapshot(options);
-  const serviceEnabled = snapshot.runtimeConnection.enabled;
-  const controlPlaneEnabled = snapshot.runtimeEndpoints.controlPlane.enabled;
-  const listenerEnabled = snapshot.runtimeEndpoints.httpListener.enabled;
-  const webEnabled = snapshot.runtimeEndpoints.web.enabled;
-  const controlPlaneBinding = snapshot.runtimeEndpoints.controlPlane;
-  const httpListenerBinding = snapshot.runtimeEndpoints.httpListener;
-  const webBinding = snapshot.runtimeEndpoints.web;
   const marker = options.onboardingMarkers?.effective;
   const findings = snapshot.findings;
   const externalRuntime = snapshot.externalRuntime;
@@ -330,66 +258,63 @@ export function renderCliStatus(options: CliStatusOptions): string {
 
   const lines = [
     snapshot.title,
-    `  workingDir: ${options.workingDirectory}`,
-    `  homeDir: ${options.homeDirectory}`,
+    `  working directory ${options.workingDirectory}`,
+    `  home directory ${options.homeDirectory}`,
     '',
-    'Provider:',
-    `  provider: ${getProviderIdFromModel(config.get('provider.model'))}`,
-    `  model: ${String(config.get('provider.model'))}`,
-    `  reasoning: ${String(config.get('provider.reasoningEffort'))}`,
+    'Provider',
+    `  provider ${getProviderIdFromModel(config.get('provider.model'))}`,
+    `  model ${String(config.get('provider.model'))}`,
+    `  reasoning ${String(config.get('provider.reasoningEffort'))}`,
     '',
-    'Auth:',
+    'Auth',
     `  permissions: ${permissionModeLabel(config.get('permissions.mode'))} (${String(config.get('permissions.mode'))})`,
     `  secretPolicy: ${secretPolicyLabel(config.get('storage.secretPolicy'))} (${String(config.get('storage.secretPolicy'))})`,
     options.auth
-      ? `  runtimeAuthSignal: ${options.auth.userStorePresent ? 'present' : 'missing'} (${options.auth.userStorePath})`
-      : '  runtimeAuthSignal: unknown',
+      ? `  local auth store ${options.auth.userStorePresent ? 'present' : 'missing'} (${options.auth.userStorePath})`
+      : '  local auth store unknown',
     options.auth
-      ? `  bootstrapCredential: ${options.auth.bootstrapCredentialPresent ? 'present' : 'missing'} (${options.auth.bootstrapCredentialPath})`
-      : '  bootstrapCredential: unknown',
+      ? `  setup credential ${options.auth.bootstrapCredentialPresent ? 'present' : 'missing'} (${options.auth.bootstrapCredentialPath})`
+      : '  setup credential unknown',
     options.auth
-      ? `  operatorTokens: ${options.auth.operatorTokenPresent ? 'present' : 'missing'} (${options.auth.operatorTokenPath})`
-      : '  operatorTokens: unknown',
+      ? `  connected host token ${options.auth.operatorTokenPresent ? 'present' : 'missing'} (${options.auth.operatorTokenPath})`
+      : '  connected host token unknown',
     '',
-    'Connected GoodVibes API:',
+    'Connected GoodVibes host:',
     ...(externalRuntime ? [
       `  baseUrl: ${externalRuntime.baseUrl}`,
       `  reachable: ${yesNo(externalRuntime.reachable)}${externalRuntime.statusCode === null ? '' : ` (HTTP ${externalRuntime.statusCode})`}`,
       `  sdk: ${externalRuntime.version} expected ${externalRuntime.expectedVersion}`,
       `  compatible: ${yesNo(externalRuntime.compatible)}`,
-      `  operatorToken: ${externalRuntime.operatorToken.present ? 'present' : 'missing'} (${externalRuntime.operatorToken.path})`,
-      `  Agent Knowledge: ${externalRuntime.agentKnowledge.ready ? 'ready' : `not ready (${externalRuntime.agentKnowledge.kind})`}`,
+      `  access token: ${externalRuntime.operatorToken.present ? 'present' : 'missing'} (${externalRuntime.operatorToken.path})`,
+      `  Agent Knowledge: ${externalRuntime.agentKnowledge.ready ? 'ready' : `not ready (${formatAgentKnowledgeFailureKind(externalRuntime.agentKnowledge.kind)})`}`,
       ...(externalRuntime.error ? [`  error: ${externalRuntime.error}`] : []),
     ] : [
-      '  live check: unavailable',
+      '  live check unavailable',
     ]),
     '',
-    'Connected Host:',
-    '  Agent role: client/operator TUI only',
-    '  lifecycle owner: outside Agent',
-    '  Agent starts connected host: no',
+    'Agent role:',
+    '  product: interactive operator TUI',
+    '  host lifecycle: external',
+    '  starts or exposes host: no',
     ...(options.service ? [
-      `  log: ${options.service.log.path ?? 'n/a'} (${options.service.log.exists ? 'present' : 'missing'})`,
+      `  host log signal ${options.service.log.path ?? 'n/a'} (${options.service.log.exists ? 'present' : 'missing'})`,
     ] : []),
-    'Onboarding:',
-    `  checked: ${marker?.exists ? 'yes' : 'no'}`,
-    `  scope: ${marker?.scope ?? 'none'}`,
-    `  updatedAt: ${marker?.payload ? new Date(marker.payload.updatedAt).toISOString() : 'n/a'}`,
+    'Onboarding',
+    `  checked ${marker?.exists ? 'yes' : 'no'}`,
+    `  scope ${marker?.scope ?? 'none'}`,
+    `  updated ${marker?.payload ? new Date(marker.payload.updatedAt).toISOString() : 'n/a'}`,
   ];
 
   if (options.doctor) {
     lines.push(
       '',
-      'Connected Host Config Signals:',
-      `  host config present: ${yesNo(serviceEnabled)}`,
-      '  lifecycle config: external to Agent',
-      '',
-      'Endpoint Diagnostics:',
-      bindLine('runtimeApi', controlPlaneEnabled, controlPlaneBinding),
-      bindLine('incomingWebhook', listenerEnabled, httpListenerBinding),
-      bindLine('browserCompanion', webEnabled, webBinding),
+      'Readiness Checks:',
+      '  companion chat route',
+      '  isolated Agent Knowledge route',
+      '  approvals and automation status routes',
+      '  explicit build delegation route',
     );
-    lines.push('', 'Warnings:');
+    lines.push('', 'Warnings');
     if (findings.length === 0) {
       lines.push('  none');
     } else {
@@ -411,11 +336,11 @@ export function renderOnboardingCliStatus(options: CliStatusOptions): string {
   const marker = options.onboardingMarkers?.effective;
   return [
     'GoodVibes Agent setup status',
-    `  checked: ${marker?.exists ? 'yes' : 'no'}`,
-    `  scope: ${marker?.scope ?? 'none'}`,
-    `  source: ${marker?.payload?.source ?? 'n/a'}`,
-    `  mode: ${marker?.payload?.mode ?? 'n/a'}`,
-    `  updatedAt: ${marker?.payload ? new Date(marker.payload.updatedAt).toISOString() : 'n/a'}`,
-    `  workingDir: ${options.workingDirectory}`,
+    `  checked ${marker?.exists ? 'yes' : 'no'}`,
+    `  scope ${marker?.scope ?? 'none'}`,
+    `  origin ${marker?.payload?.source ? formatAgentRecordSource(marker.payload.source) : 'n/a'}`,
+    `  mode ${marker?.payload?.mode ?? 'n/a'}`,
+    `  updated ${marker?.payload ? new Date(marker.payload.updatedAt).toISOString() : 'n/a'}`,
+    `  working directory ${options.workingDirectory}`,
   ].join('\n');
 }