@pellux/goodvibes-agent 0.1.117 → 1.0.1

package/src/input/commands/mcp-runtime.ts

@@ -3,15 +3,25 @@ import type { McpConfigScope, McpReloadResult, McpServerConfig } from '@pellux/g
 import { requireMcpApi, requireShellPaths } from './runtime-services.ts';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 import { requireYesFlag, stripYesFlag } from './confirmation.ts';
+import { quoteSlashCommandArg } from '../slash-command-parser.ts';
 
 const MCP_ROLES = ['general', 'docs', 'filesystem', 'git', 'database', 'browser', 'automation', 'ops', 'remote'] as const;
 const MCP_TRUST_MODES = ['constrained', 'ask-on-risk', 'allow-all', 'blocked'] as const;
+const MCP_COMMAND_TRUST_MODES = ['constrained', 'ask-on-risk', 'blocked'] as const;
+const MCP_ADD_COMMAND_USAGE = '/mcp add <name> <command> ... --yes; options: --scope project|global, --role <role>, --trust constrained|ask-on-risk|blocked, --env KEY=VALUE, --path <path>, --host <host>';
+const MCP_TRUST_COMMAND_USAGE = '/mcp trust <server> <constrained|ask-on-risk|blocked> --yes';
+const MCP_ROLE_COMMAND_USAGE = '/mcp role <server> <general|docs|filesystem|git|database|browser|automation|ops|remote> --yes';
 
 interface ParsedMcpAddArgs {
   readonly scope: McpConfigScope;
   readonly server: McpServerConfig;
 }
 
+type McpSecurityServer = ReturnType<NonNullable<NonNullable<CommandContext['clients']>['mcpApi']>['listServerSecurity']>[number];
+type McpDisplayTrustMode = NonNullable<McpServerConfig['trustMode']> | McpSecurityServer['trustMode'];
+type McpDisplayRole = NonNullable<McpServerConfig['role']> | McpSecurityServer['role'];
+type McpDisplayFreshness = McpSecurityServer['schemaFreshness'];
+
 function isMcpRole(value: string): value is NonNullable<McpServerConfig['role']> {
   return MCP_ROLES.includes(value as NonNullable<McpServerConfig['role']>);
 }
@@ -20,10 +30,52 @@ function isMcpTrustMode(value: string): value is NonNullable<McpServerConfig['tr
   return MCP_TRUST_MODES.includes(value as NonNullable<McpServerConfig['trustMode']>);
 }
 
+function isMcpCommandTrustMode(value: string): value is Exclude<NonNullable<McpServerConfig['trustMode']>, 'allow-all'> {
+  return MCP_COMMAND_TRUST_MODES.includes(value as Exclude<NonNullable<McpServerConfig['trustMode']>, 'allow-all'>);
+}
+
 function isMcpScope(value: string): value is McpConfigScope {
   return value === 'project' || value === 'global';
 }
 
+function stripMcpAddYesFlag(args: readonly string[]): { readonly rest: readonly string[]; readonly yes: boolean } {
+  const rest: string[] = [];
+  let yes = false;
+  let passthrough = false;
+  for (const token of args) {
+    if (passthrough) {
+      rest.push(token);
+      continue;
+    }
+    if (token === '--') {
+      passthrough = true;
+      rest.push(token);
+      continue;
+    }
+    if (token === '--yes') {
+      yes = true;
+      continue;
+    }
+    rest.push(token);
+  }
+  return { rest, yes };
+}
+
+function formatMcpTrustMode(mode: McpDisplayTrustMode): string {
+  if (mode === 'ask-on-risk') return 'ask on risky actions';
+  if (mode === 'allow-all') return 'allow all actions';
+  return mode.replace(/[_-]+/g, ' ');
+}
+
+function formatMcpFreshness(value: McpDisplayFreshness): string {
+  if (value === 'quarantined') return 'needs review';
+  return value.replace(/[_-]+/g, ' ');
+}
+
+function formatMcpRole(value: McpDisplayRole): string {
+  return value.replace(/[_-]+/g, ' ');
+}
+
 function validateServerName(name: string): string | null {
   if (!name.trim()) return 'MCP server name is required.';
   if (!/^[a-zA-Z0-9._-]+$/.test(name)) {
@@ -44,7 +96,7 @@ function parseAddServerArgs(args: string[]): ParsedMcpAddArgs {
   const name = args[1]?.trim();
   const command = args[2]?.trim();
   if (!name || !command) {
-    throw new Error('Usage: /mcp add <name> <command> [args...] [--scope project|global] [--role <role>] [--trust <mode>] [--env KEY=VALUE] [--path <path>] [--host <host>]');
+    throw new Error(`Usage: ${MCP_ADD_COMMAND_USAGE}`);
   }
   const nameError = validateServerName(name);
   if (nameError) throw new Error(nameError);
@@ -71,7 +123,7 @@ function parseAddServerArgs(args: string[]): ParsedMcpAddArgs {
     }
     if (token === '--role') {
       const value = readFlagValue(tokens, index, token);
-      if (!isMcpRole(value)) throw new Error(`Invalid MCP role "${value}". Expected one of: ${MCP_ROLES.join(', ')}`);
+      if (!isMcpRole(value)) throw new Error(`Invalid MCP role "${value}". Expected one of ${MCP_ROLES.join(', ')}.`);
       role = value;
       index += 1;
       continue;
@@ -85,7 +137,10 @@ function parseAddServerArgs(args: string[]): ParsedMcpAddArgs {
     }
     if (token === '--trust') {
       const value = readFlagValue(tokens, index, token);
-      if (!isMcpTrustMode(value)) throw new Error(`Invalid MCP trust mode "${value}". Expected one of: ${MCP_TRUST_MODES.join(', ')}`);
+      if (!isMcpTrustMode(value)) throw new Error(`Invalid MCP trust mode "${value}". Expected one of ${MCP_TRUST_MODES.join(', ')}.`);
+      if (!isMcpCommandTrustMode(value)) {
+        throw new Error(`Use /settings -> MCP to explicitly enable allow-all.\nUsage: ${MCP_ADD_COMMAND_USAGE}`);
+      }
       trustMode = value;
       index += 1;
       continue;
@@ -142,7 +197,7 @@ export function registerMcpRuntimeCommands(registry: CommandRegistry): void {
     async handler(args, ctx) {
       const mcpApi = requireMcpApi(ctx);
       const listServerSecurity = () => mcpApi.listServerSecurity();
-      const confirmation = stripYesFlag(args);
+      const confirmation = args[0] === 'add' ? stripMcpAddYesFlag(args) : stripYesFlag(args);
       const commandArgs = [...confirmation.rest];
       const subcommand = commandArgs[0];
       if (!subcommand && ctx.openMcpWorkspace) {
@@ -157,7 +212,7 @@ export function registerMcpRuntimeCommands(registry: CommandRegistry): void {
           `  servers: ${servers.length}`,
           `  connected: ${servers.filter((server) => server.connected).length}`,
           `  auth or repair attention: ${authRequired.length}`,
-          ...servers.map((server) => `  ${server.name}  trust=${server.trustMode}  role=${server.role}  freshness=${server.schemaFreshness}  connected=${server.connected ? 'yes' : 'no'}`),
+          ...servers.map((server) => `  ${server.name}  trust=${formatMcpTrustMode(server.trustMode)}  role=${formatMcpRole(server.role)}  status=${formatMcpFreshness(server.schemaFreshness)}  connected=${server.connected ? 'yes' : 'no'}`),
           '  next: /mcp auth-review',
           '  next: /mcp repair <server>',
         ].join('\n'));
@@ -218,7 +273,7 @@ export function registerMcpRuntimeCommands(registry: CommandRegistry): void {
           ? [
               'MCP Auth Review',
               ...needingAttention.map((server) => (
-                `  ${server.name}  connected=${server.connected ? 'yes' : 'no'}  freshness=${server.schemaFreshness}  trust=${server.trustMode}`
+                `  ${server.name}  connected ${server.connected ? 'yes' : 'no'}  status ${formatMcpFreshness(server.schemaFreshness)}  trust ${formatMcpTrustMode(server.trustMode)}`
               )),
               '  next: /auth review',
               '  next: /mcp repair <server>',
@@ -233,13 +288,13 @@ export function registerMcpRuntimeCommands(registry: CommandRegistry): void {
         const selected = serverName ? servers.find((server) => server.name === serverName) : servers.find((server) => !server.connected || server.schemaFreshness === 'quarantined');
         if (!selected) {
           ctx.print(serverName
-            ? `Unknown MCP server: ${serverName}`
+            ? `Unknown MCP server ${serverName}`
             : 'MCP Repair\n  No MCP server currently needs repair.');
           return;
         }
         const nextSteps = [
           selected.schemaFreshness === 'quarantined'
-            ? `/mcp quarantine ${selected.name} approve operator --yes`
+            ? `/mcp quarantine ${quoteSlashCommandArg(selected.name)} approve operator --yes`
             : null,
           !selected.connected ? '/auth review' : null,
           '/mcp review',
@@ -248,9 +303,9 @@ export function registerMcpRuntimeCommands(registry: CommandRegistry): void {
         ctx.print([
           `MCP Repair: ${selected.name}`,
           `  connected: ${selected.connected ? 'yes' : 'no'}`,
-          `  trust: ${selected.trustMode}`,
-          `  role: ${selected.role}`,
-          `  freshness: ${selected.schemaFreshness}`,
+          `  trust: ${formatMcpTrustMode(selected.trustMode)}`,
+          `  role: ${formatMcpRole(selected.role)}`,
+          `  status: ${formatMcpFreshness(selected.schemaFreshness)}`,
           ...(selected.quarantineReason ? [`  quarantine: ${selected.quarantineReason}`] : []),
           ...(selected.quarantineDetail ? [`  detail: ${selected.quarantineDetail}`] : []),
           '  next:',
@@ -261,48 +316,58 @@ export function registerMcpRuntimeCommands(registry: CommandRegistry): void {
 
       if (subcommand === 'trust') {
         const serverName = commandArgs[1];
-        const mode = commandArgs[2] as 'constrained' | 'ask-on-risk' | 'allow-all' | 'blocked' | undefined;
-        if (serverName && mode) {
+        const requestedMode = commandArgs[2];
+        if (serverName && requestedMode) {
+          if (!isMcpTrustMode(requestedMode)) {
+            ctx.print(`Invalid MCP trust mode "${requestedMode}". Expected constrained, ask-on-risk, blocked, or allow-all.\nUsage: ${MCP_TRUST_COMMAND_USAGE}\nUse /settings -> MCP to explicitly enable allow-all.`);
+            return;
+          }
+          const mode = requestedMode;
           if (mode === 'allow-all') {
             ctx.print(`Use /settings → MCP to explicitly enable allow-all for ${serverName}. Direct command escalation is blocked.`);
             ctx.openSettingsModal?.();
             return;
           }
           if (!confirmation.yes) {
-            requireYesFlag(ctx, `change MCP trust mode for ${serverName}`, '/mcp trust <server> <constrained|ask-on-risk|blocked> --yes');
+            requireYesFlag(ctx, `change MCP trust mode for ${serverName}`, MCP_TRUST_COMMAND_USAGE);
             return;
           }
           mcpApi.setServerTrustMode(serverName, mode);
-          ctx.print(`Updated MCP trust mode for ${serverName} to ${mode}.`);
+          ctx.print(`Updated MCP trust mode for ${serverName} to ${formatMcpTrustMode(mode)}.`);
           return;
         }
-        if (serverName || mode) {
-          ctx.print('Usage: /mcp trust <server> <constrained|ask-on-risk|blocked>\nUse /settings → MCP to explicitly enable allow-all.');
+        if (serverName || requestedMode) {
+          ctx.print(`Usage: ${MCP_TRUST_COMMAND_USAGE}\nUse /settings -> MCP to explicitly enable allow-all.`);
           return;
         }
       }
 
       if (subcommand === 'role') {
         const serverName = commandArgs[1];
-        const role = commandArgs[2] as 'general' | 'docs' | 'filesystem' | 'git' | 'database' | 'browser' | 'automation' | 'ops' | 'remote' | undefined;
-        if (serverName && role) {
+        const requestedRole = commandArgs[2];
+        if (serverName && requestedRole) {
+          if (!isMcpRole(requestedRole)) {
+            ctx.print(`Invalid MCP role "${requestedRole}". Expected one of ${MCP_ROLES.join(', ')}.\nUsage: ${MCP_ROLE_COMMAND_USAGE}`);
+            return;
+          }
+          const role = requestedRole;
           if (!confirmation.yes) {
-            requireYesFlag(ctx, `change MCP role for ${serverName}`, '/mcp role <server> <general|docs|filesystem|git|database|browser|automation|ops|remote> --yes');
+            requireYesFlag(ctx, `change MCP role for ${serverName}`, MCP_ROLE_COMMAND_USAGE);
             return;
           }
           mcpApi.setServerRole(serverName, role);
-          ctx.print(`Updated MCP role for ${serverName} to ${role}.`);
+          ctx.print(`Updated MCP role for ${serverName} to ${formatMcpRole(role)}.`);
           return;
         }
-        if (serverName || role) {
-          ctx.print('Usage: /mcp role <server> <general|docs|filesystem|git|database|browser|automation|ops|remote>');
+        if (serverName || requestedRole) {
+          ctx.print(`Usage: ${MCP_ROLE_COMMAND_USAGE}`);
           return;
         }
       }
 
       if (subcommand === 'add') {
         if (!confirmation.yes) {
-          requireYesFlag(ctx, 'add or update an MCP server config', '/mcp add <name> <command> [args...] [--scope project|global] [--role <role>] [--trust <mode>] --yes');
+          requireYesFlag(ctx, 'add or update an MCP server config', MCP_ADD_COMMAND_USAGE);
           return;
         }
         let parsedAdd: ParsedMcpAddArgs;
@@ -317,13 +382,16 @@ export function registerMcpRuntimeCommands(registry: CommandRegistry): void {
           const result = await mcpApi.upsertServerConfig(shellPaths, parsedAdd.scope, parsedAdd.server);
           const connected = listServerSecurity().find((entry) => entry.name === parsedAdd.server.name)?.connected ?? false;
           ctx.print([
-            `MCP server "${parsedAdd.server.name}" saved to ${parsedAdd.scope} config: ${result.path}.`,
-            `Runtime reload: ${connected ? 'connected' : 'server saved; connection needs attention'} (+${result.reload.added} ~${result.reload.changed} -${result.reload.removed}, unchanged ${result.reload.unchanged}).`,
-            `Command: ${parsedAdd.server.command}${parsedAdd.server.args?.length ? ` ${parsedAdd.server.args.join(' ')}` : ''}`,
-            'Next: /mcp tools',
+            `MCP server "${parsedAdd.server.name}" saved`,
+            `  scope ${parsedAdd.scope}`,
+            `  path ${result.path}`,
+            ...(parsedAdd.scope === 'global' ? ['  global config'] : []),
+            `  Runtime reload: ${connected ? 'connected' : 'server saved; connection needs attention'} (+${result.reload.added} ~${result.reload.changed} -${result.reload.removed}, unchanged ${result.reload.unchanged})`,
+            `  command ${parsedAdd.server.command}${parsedAdd.server.args?.length ? ` ${parsedAdd.server.args.join(' ')}` : ''}`,
+            '  next /mcp tools',
           ].join('\n'));
         } catch (error) {
-          ctx.print(`MCP add failed: ${summarizeError(error)}`);
+          ctx.print(`MCP add failed ${summarizeError(error)}`);
         }
         return;
       }
@@ -359,10 +427,10 @@ export function registerMcpRuntimeCommands(registry: CommandRegistry): void {
         try {
           const result = await mcpApi.removeServerConfig(shellPaths, scope, serverName);
           ctx.print(result.removed
-            ? `Removed MCP server "${serverName}" from ${scope} config ${result.path}. Reload: +${result.reload.added} ~${result.reload.changed} -${result.reload.removed}, unchanged ${result.reload.unchanged}.`
+            ? `Removed MCP server "${serverName}" from ${scope} config ${result.path}. Reload +${result.reload.added} ~${result.reload.changed} -${result.reload.removed}, unchanged ${result.reload.unchanged}.`
             : `No ${scope} MCP server named "${serverName}" exists in ${result.path}.\nIf it still appears, it is coming from another config scope or external MCP config.`);
         } catch (error) {
-          ctx.print(`MCP remove failed: ${summarizeError(error)}`);
+          ctx.print(`MCP remove failed ${summarizeError(error)}`);
         }
         return;
       }
@@ -375,9 +443,9 @@ export function registerMcpRuntimeCommands(registry: CommandRegistry): void {
         try {
           const result = await reloadMcpRuntime(ctx);
           const servers = listServerSecurity();
-          ctx.print(`Reloaded MCP runtime from config. ${servers.filter((server) => server.connected).length}/${servers.length} server(s) connected. Result: +${result.added} ~${result.changed} -${result.removed}, unchanged ${result.unchanged}.`);
+          ctx.print(`Reloaded MCP runtime from config. ${servers.filter((server) => server.connected).length}/${servers.length} server(s) connected. Result +${result.added} ~${result.changed} -${result.removed}, unchanged ${result.unchanged}.`);
         } catch (error) {
-          ctx.print(`MCP reload failed: ${summarizeError(error)}`);
+          ctx.print(`MCP reload failed ${summarizeError(error)}`);
         }
         return;
       }
@@ -388,22 +456,24 @@ export function registerMcpRuntimeCommands(registry: CommandRegistry): void {
           const effective = mcpApi.getEffectiveConfig(shellPaths);
           ctx.print([
             'MCP Config',
-            '  locations:',
+            '  locations',
             ...effective.locations.map((location) => `    ${location.scope}/${location.kind}${location.writable ? ' writable' : ' read-only'}  ${location.path}`),
-            `  effective servers: ${effective.servers.length}`,
+            `  effective servers ${effective.servers.length}`,
             ...effective.servers.map((entry) => {
               const server = entry.server;
               const envKeys = Object.keys(server.env ?? {});
-              return `  - ${server.name}: ${server.command}${server.args?.length ? ` ${server.args.join(' ')}` : ''}  source=${entry.source.scope}/${entry.source.kind}${envKeys.length ? ` envKeys=${envKeys.join(',')}` : ''}`;
+              return `  - ${server.name}: ${server.command}${server.args?.length ? ` ${server.args.join(' ')}` : ''}  origin ${entry.source.scope}/${entry.source.kind}${envKeys.length ? ` envKeys=${envKeys.join(',')}` : ''}`;
             }),
             '',
-            'Add or update from inside Agent with explicit confirmation:',
+            'Add or update from inside Agent with explicit confirmation',
             '  Open /mcp and choose Add or update server, or use Agent Workspace -> Tools & MCP -> Add MCP server.',
-            'Automation equivalent:',
-            '  /mcp add <name> <command> [args...] [--scope project|global] [--role <role>] [--trust <mode>] --yes',
+            '  Use Settings -> MCP for allow-all decisions.',
+            '  Use -- before server args that look like Agent flags.',
+            'Automation equivalent',
+            `  ${MCP_ADD_COMMAND_USAGE}`,
           ].join('\n'));
         } catch (error) {
-          ctx.print(`MCP config read failed: ${summarizeError(error)}`);
+          ctx.print(`MCP config read failed ${summarizeError(error)}`);
         }
         return;
       }
@@ -417,12 +487,12 @@ export function registerMcpRuntimeCommands(registry: CommandRegistry): void {
         }
         if (action === 'approve') {
           if (!confirmation.yes) {
-            requireYesFlag(ctx, `approve MCP schema quarantine override for ${serverName}`, '/mcp quarantine <server> approve [operatorId] --yes');
+            requireYesFlag(ctx, `approve MCP tool-definition quarantine override for ${serverName}`, '/mcp quarantine <server> approve [operatorId] --yes');
             return;
           }
           const operatorId = commandArgs[3] || 'operator';
           mcpApi.approveSchemaQuarantine(serverName, operatorId);
-          ctx.print(`Approved MCP schema quarantine override for ${serverName} as ${operatorId}. Refresh is still recommended.`);
+          ctx.print(`Approved MCP tool-definition quarantine override for ${serverName} as ${operatorId}. Refresh is still recommended.`);
           return;
         }
         if (!confirmation.yes) {
@@ -431,7 +501,7 @@ export function registerMcpRuntimeCommands(registry: CommandRegistry): void {
         }
         const detail = commandArgs.slice(2).join(' ') || 'quarantined by operator';
         mcpApi.quarantineSchema(serverName, 'operator_flagged', detail);
-        ctx.print(`Quarantined MCP schema for ${serverName}.\nReason: ${detail}`);
+        ctx.print(`Quarantined MCP tool definitions for ${serverName}.\nReason: ${detail}`);
         return;
       }
 
@@ -456,18 +526,16 @@ export function registerMcpRuntimeCommands(registry: CommandRegistry): void {
   });
 }
 
-type McpSecurityServer = ReturnType<NonNullable<NonNullable<CommandContext['clients']>['mcpApi']>['listServerSecurity']>[number];
-
 function formatMcpServerList(servers: readonly McpSecurityServer[]): string {
   const connected = servers.filter(s => s.connected);
   const disconnected = servers.filter(s => !s.connected);
   const lines: string[] = [`MCP Servers (${connected.length}/${servers.length} connected):`];
   for (const s of servers) {
-    const pathScope = s.allowedPaths.length > 0 ? ` paths=${s.allowedPaths.length}` : '';
-    const hostScope = s.allowedHosts.length > 0 ? ` hosts=${s.allowedHosts.length}` : '';
-    const freshness = ` freshness=${s.schemaFreshness}`;
-    const quarantine = s.schemaFreshness === 'quarantined' ? ` quarantine=${s.quarantineReason ?? 'unknown'}` : '';
-    lines.push(`  ${s.connected ? '[connected]   ' : '[disconnected]'}  ${s.name}  trust=${s.trustMode}  role=${s.role}${freshness}${quarantine}${pathScope}${hostScope}`);
+    const pathScope = s.allowedPaths.length > 0 ? ` paths ${s.allowedPaths.length}` : '';
+    const hostScope = s.allowedHosts.length > 0 ? ` hosts ${s.allowedHosts.length}` : '';
+    const freshness = ` status ${formatMcpFreshness(s.schemaFreshness)}`;
+    const quarantine = s.schemaFreshness === 'quarantined' ? ` review reason ${s.quarantineReason ?? 'unknown'}` : '';
+    lines.push(`  ${s.connected ? '[connected]   ' : '[disconnected]'}  ${s.name}  trust=${formatMcpTrustMode(s.trustMode)}  role=${formatMcpRole(s.role)}${freshness}${quarantine}${pathScope}${hostScope}`);
   }
   if (connected.length > 0) {
     lines.push('');

package/src/input/commands/notify-runtime.ts

@@ -6,9 +6,9 @@ export function registerNotifyRuntimeCommands(registry: CommandRegistry): void {
   registry.register({
     name: 'notify',
     aliases: [],
-    description: 'Manage webhook notification URLs (ntfy.sh format)',
-    usage: 'add <url> --yes | remove <url> --yes | list | clear --yes | test --yes',
-    argsHint: 'list|add --yes|remove --yes|test --yes',
+    description: 'Manage and send configured Agent webhook notifications',
+    usage: 'add <url> --yes | remove <url> --yes | list | clear --yes | test --yes | send <message> --yes',
+    argsHint: 'list|add --yes|remove --yes|test --yes|send --yes',
     async handler(args, ctx) {
       const parsed = stripYesFlag(args);
       const commandArgs = [...parsed.rest];
@@ -18,8 +18,8 @@ export function registerNotifyRuntimeCommands(registry: CommandRegistry): void {
       const sub = commandArgs[0];
 
       if (!sub || sub === 'list') {
-        if (urls.length === 0) ctx.print('No webhook URLs configured.\nUse: /notify add <url>');
-        else ctx.print(`Webhook URLs (${urls.length}):\n${urls.map((u, i) => `  ${i + 1}. ${u}`).join('\n')}`);
+        if (urls.length === 0) ctx.print('No webhook URLs configured.\nUse /notify add <url>');
+        else ctx.print(`Webhook URLs (${urls.length})\n${urls.map((u, i) => `  ${i + 1}. ${u}`).join('\n')}`);
         return;
       }
 
@@ -34,11 +34,11 @@ export function registerNotifyRuntimeCommands(registry: CommandRegistry): void {
           return;
         }
         try { new URL(url); } catch {
-          ctx.print(`Invalid URL: ${url}`);
+          ctx.print(`Invalid URL ${url}`);
           return;
         }
         if (urls.includes(url)) {
-          ctx.print(`Already configured: ${url}`);
+          ctx.print(`Already configured ${url}`);
           return;
         }
         urls.push(url);
@@ -86,7 +86,7 @@ export function registerNotifyRuntimeCommands(registry: CommandRegistry): void {
           return;
         }
         if (urls.length === 0) {
-          ctx.print('No webhook URLs configured. Use: /notify add <url>');
+          ctx.print('No webhook URLs configured. Use /notify add <url>');
           return;
         }
         ctx.print(`Testing ${urls.length} webhook${urls.length !== 1 ? 's' : ''}...`);
@@ -96,7 +96,36 @@ export function registerNotifyRuntimeCommands(registry: CommandRegistry): void {
         return;
       }
 
-      ctx.print('Usage: /notify add <url> --yes | remove <url> --yes | list | clear --yes | test --yes');
+      if (sub === 'send') {
+        const message = commandArgs.slice(1).join(' ').trim();
+        if (!message) {
+          ctx.print('Usage: /notify send <message> --yes');
+          return;
+        }
+        if (!parsed.yes) {
+          requireYesFlag(ctx, 'send a notification to configured webhook targets', '/notify send <message> --yes');
+          return;
+        }
+        if (urls.length === 0) {
+          ctx.print('No webhook URLs configured. Use /notify add <url>');
+          return;
+        }
+        notifier.setUrls(urls);
+        const result = await notifier.send(message);
+        ctx.print([
+          'Notification sent',
+          `  attempted ${result.attempted}`,
+          `  delivered ${result.delivered}`,
+          `  failed ${result.failed}`,
+          ...result.results.slice(0, 20).map((delivery, index) => (
+            `  target ${index + 1} ${delivery.ok ? 'ok' : `failed${delivery.error ? ` (${delivery.error})` : ''}`}`
+          )),
+          ...(result.results.length > 20 ? [`  ${result.results.length - 20} more target(s) omitted.`] : []),
+        ].join('\n'));
+        return;
+      }
+
+      ctx.print('Usage: /notify add <url> --yes | remove <url> --yes | list | clear --yes | test --yes | send <message> --yes');
     },
   });
 }

package/src/input/commands/operator-actions-runtime.ts

@@ -0,0 +1,138 @@
+import type { CommandContext, CommandRegistry } from '../command-registry.ts';
+import {
+  buildOperatorActionRequest,
+  formatOperatorActionFailure,
+  formatOperatorActionPreview,
+  formatOperatorActionSuccess,
+  postOperatorAction,
+  type OperatorActionId,
+} from '../../agent/operator-actions.ts';
+import { resolveAgentConnectedHostConnection } from '../../agent/routine-schedule-promotion.ts';
+import { requireShellPaths } from './runtime-services.ts';
+import { stripYesFlag } from './confirmation.ts';
+
+interface OperatorActionOptionParse {
+  readonly note?: string;
+  readonly remember?: boolean;
+  readonly errors: readonly string[];
+}
+
+function parseOperatorActionOptions(args: readonly string[]): OperatorActionOptionParse {
+  const errors: string[] = [];
+  let note: string | undefined;
+  let remember: boolean | undefined;
+  for (let index = 0; index < args.length; index += 1) {
+    const token = args[index];
+    if (token === '--note') {
+      const value = args[index + 1];
+      if (!value) {
+        errors.push('--note requires text');
+        continue;
+      }
+      note = value;
+      index += 1;
+      continue;
+    }
+    if (token === '--remember') {
+      remember = true;
+      continue;
+    }
+    if (token === '--no-remember') {
+      remember = false;
+      continue;
+    }
+    errors.push(`Unknown option ${token}`);
+  }
+  return { note, remember, errors };
+}
+
+export async function executeConfirmedOperatorAction(
+  ctx: CommandContext,
+  action: OperatorActionId,
+  targetField: 'approvalId' | 'jobId' | 'runId' | 'scheduleId',
+  targetId: string,
+  rawArgs: readonly string[],
+  usage: string,
+): Promise<void> {
+  const parsed = stripYesFlag(rawArgs);
+  const options = parseOperatorActionOptions(parsed.rest);
+  if (options.errors.length > 0) {
+    ctx.print([`Usage: ${usage}`, ...options.errors.map((error) => `  ${error}`)].join('\n'));
+    return;
+  }
+  const request = buildOperatorActionRequest({
+    action,
+    [targetField]: targetId,
+    note: options.note,
+    remember: options.remember,
+  });
+  if (!request.ok) {
+    ctx.print(request.error);
+    return;
+  }
+  const requestSummary = `/${action} ${targetId}`;
+  if (!parsed.yes) {
+    ctx.print(`${formatOperatorActionPreview(request, requestSummary)}\nUsage: ${usage}`);
+    return;
+  }
+  const shellPaths = requireShellPaths(ctx);
+  const connection = resolveAgentConnectedHostConnection(ctx.platform.configManager, shellPaths.homeDirectory);
+  const result = await postOperatorAction(connection, request);
+  ctx.print(result.ok ? formatOperatorActionSuccess(connection.baseUrl, result) : formatOperatorActionFailure(result));
+}
+
+function approvalActionFromSubcommand(sub: string): OperatorActionId | null {
+  if (sub === 'approve') return 'approvals.approve';
+  if (sub === 'deny') return 'approvals.deny';
+  if (sub === 'cancel') return 'approvals.cancel';
+  return null;
+}
+
+function automationActionFromParts(scope: string, verb: string): {
+  readonly action: OperatorActionId;
+  readonly targetField: 'jobId' | 'runId' | 'scheduleId';
+} | null {
+  if ((scope === 'job' || scope === 'jobs') && verb === 'run') return { action: 'automation.jobs.run', targetField: 'jobId' };
+  if ((scope === 'job' || scope === 'jobs') && verb === 'pause') return { action: 'automation.jobs.pause', targetField: 'jobId' };
+  if ((scope === 'job' || scope === 'jobs') && verb === 'resume') return { action: 'automation.jobs.resume', targetField: 'jobId' };
+  if ((scope === 'run' || scope === 'runs') && verb === 'cancel') return { action: 'automation.runs.cancel', targetField: 'runId' };
+  if ((scope === 'run' || scope === 'runs') && verb === 'retry') return { action: 'automation.runs.retry', targetField: 'runId' };
+  if ((scope === 'schedule' || scope === 'schedules') && verb === 'run') return { action: 'schedules.run', targetField: 'scheduleId' };
+  return null;
+}
+
+export async function handleApprovalOperatorAction(args: readonly string[], ctx: CommandContext): Promise<boolean> {
+  const sub = (args[0] ?? '').toLowerCase();
+  const action = approvalActionFromSubcommand(sub);
+  if (!action) return false;
+  const approvalId = args[1] ?? '';
+  const usage = `/approval ${sub} <approval-id> [--note <text>] [--remember|--no-remember] --yes`;
+  if (!approvalId) {
+    ctx.print(`Usage: ${usage}`);
+    return true;
+  }
+  await executeConfirmedOperatorAction(ctx, action, 'approvalId', approvalId, args.slice(2), usage);
+  return true;
+}
+
+export function registerOperatorActionRuntimeCommands(registry: CommandRegistry): void {
+  registry.register({
+    name: 'automation',
+    aliases: ['auto'],
+    description: 'Run confirmed connected-host automation actions from the Agent TUI',
+    usage: 'job <run|pause|resume> <job-id> --yes | run <cancel|retry> <run-id> --yes | schedule run <schedule-id> --yes',
+    argsHint: 'job run <id> --yes | run cancel <id> --yes | schedule run <id> --yes',
+    async handler(args, ctx) {
+      const scope = (args[0] ?? '').toLowerCase();
+      const verb = (args[1] ?? '').toLowerCase();
+      const targetId = args[2] ?? '';
+      const mapping = automationActionFromParts(scope, verb);
+      const usage = '/automation job <run|pause|resume> <job-id> --yes | /automation run <cancel|retry> <run-id> --yes | /automation schedule run <schedule-id> --yes';
+      if (!mapping || !targetId) {
+        ctx.print(`Usage: ${usage}`);
+        return;
+      }
+      await executeConfirmedOperatorAction(ctx, mapping.action, mapping.targetField, targetId, args.slice(3), usage);
+    },
+  });
+}

package/src/input/commands/operator-runtime.ts

@@ -57,21 +57,6 @@ export function registerOperatorRuntimeCommands(registry: CommandRegistry): void
       else ctx.scrollToLine?.(nextLine);
     },
   });
-
-  registry.register({
-    name: 'profiles',
-    aliases: ['profile'],
-    description: 'Blocked copied config-profile command; Agent uses isolated profile homes',
-    usage: 'disabled',
-    argsHint: 'disabled',
-    handler(_args, ctx) {
-      ctx.print([
-        'Copied config profiles are disabled in GoodVibes Agent.',
-        'Use /agent profiles or /agent-profile to create and manage isolated Agent profile homes.',
-      ].join('\n'));
-    },
-  });
-
   registry.register({
     name: 'prev-error',
     aliases: ['pe'],
@@ -153,7 +138,7 @@ export function registerOperatorRuntimeCommands(registry: CommandRegistry): void
           return;
         }
         if (verbosity !== 'minimal' && verbosity !== 'normal' && verbosity !== 'verbose') {
-          ctx.print(`Invalid verbosity "${verbosity}". Valid values: minimal, normal, verbose`);
+          ctx.print(`Invalid verbosity "${verbosity}". Valid values minimal, normal, verbose.`);
           return;
         }
         if (!parsed.yes) {
@@ -161,7 +146,11 @@ export function registerOperatorRuntimeCommands(registry: CommandRegistry): void
           return;
         }
         mgr.setDomainVerbosity(domain, verbosity as 'minimal' | 'normal' | 'verbose');
-        ctx.print(`Domain "${domain}" verbosity set to: ${verbosity}`);
+        ctx.print([
+          'Domain verbosity set',
+          `  domain ${domain}`,
+          `  verbosity ${verbosity}`,
+        ].join('\n'));
         return;
       }