@pellux/goodvibes-agent 0.1.13 → 0.1.15

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 All notable changes to GoodVibes Agent will be recorded here.
 
+## 0.1.15 - 2026-05-31
+
+- 67de700 Restrict remote and channel tools in agent runtime
+
+## 0.1.14 - 2026-05-31
+
+- d128004 Block background exec in agent runtime
+
 ## 0.1.13 - 2026-05-31
 
 - 989b048 Block local coding tools in agent runtime

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pellux/goodvibes-agent",
-  "version": "0.1.13",
+  "version": "0.1.15",
   "private": false,
   "description": "Near-fork GoodVibes operator assistant with the GoodVibes TUI shell, renderer, input, fullscreen workspace, and daemon-connected Agent product brain.",
   "type": "module",

package/src/tools/wrfc-agent-guard.ts

@@ -6,11 +6,32 @@ type AgentToolArgs = {
   readonly [key: string]: unknown;
 };
 
+type ExecCommandArgs = {
+  readonly cmd?: unknown;
+  readonly background?: unknown;
+  readonly until?: unknown;
+  readonly [key: string]: unknown;
+};
+
+type ExecToolArgs = {
+  readonly commands?: unknown;
+  readonly parallel?: unknown;
+  readonly file_ops?: unknown;
+  readonly [key: string]: unknown;
+};
+
+type ModeToolArgs = {
+  readonly mode?: unknown;
+  readonly createIfMissing?: unknown;
+  readonly [key: string]: unknown;
+};
+
 type AgentToolPolicyGuardOptions = {
   readonly getLastUserMessage?: () => string | null;
 };
 
 const BLOCKED_MAIN_CONVERSATION_TOOL_NAMES = ['write', 'edit', 'workflow', 'repl'] as const;
+const AGENT_EXEC_BACKGROUND_COMMAND = /^\s*bg_(?:status|output|stop)\b/;
 
 const READ_ONLY_AGENT_TOOL_MODES = [
   'status',
@@ -27,6 +48,11 @@ const READ_ONLY_AGENT_TOOL_MODES = [
 const READ_ONLY_AGENT_TOOL_MODE_SET = new Set<string>(READ_ONLY_AGENT_TOOL_MODES);
 const BLOCKED_MAIN_CONVERSATION_TOOL_NAME_SET = new Set<string>(BLOCKED_MAIN_CONVERSATION_TOOL_NAMES);
 
+const READ_ONLY_REMOTE_TOOL_MODES = ['pools', 'contracts', 'artifacts', 'review'] as const;
+const READ_ONLY_CHANNEL_TOOL_MODES = ['accounts', 'directory', 'resolve_target', 'capabilities', 'tools', 'agent_tools', 'actions'] as const;
+const READ_ONLY_REMOTE_TOOL_MODE_SET = new Set<string>(READ_ONLY_REMOTE_TOOL_MODES);
+const READ_ONLY_CHANNEL_TOOL_MODE_SET = new Set<string>(READ_ONLY_CHANNEL_TOOL_MODES);
+
 const LOCAL_AGENT_DENIAL = [
   'GoodVibes Agent does not spawn local Engineer/Reviewer/Tester/Verifier roots or run local WRFC chains.',
   'Keep ordinary assistant work serial in the main conversation.',
@@ -39,12 +65,44 @@ const LOCAL_CODING_TOOL_DENIAL = [
   'For durable Agent memory, skills, personas, routines, and knowledge, use the Agent-owned commands and isolated Agent Knowledge routes.',
 ].join(' ');
 
+const BACKGROUND_EXEC_DENIAL = [
+  'GoodVibes Agent only runs foreground, serial command-line work from the main conversation.',
+  'Background processes, parallel command batches, background process controls, and exec pre-command file operations are disabled here.',
+  'For long-running build/fix/review work, delegate one request to GoodVibes TUI through the public shared-session/build-delegation contract.',
+].join(' ');
+
+const REMOTE_MUTATION_DENIAL = [
+  'GoodVibes Agent only inspects remote runner pools, contracts, artifacts, and review summaries from the main conversation.',
+  'Remote pool creation, assignment, unassignment, and artifact import are disabled here.',
+  'Use explicit GoodVibes TUI delegation or a future Agent approval flow for remote execution changes.',
+].join(' ');
+
+const CHANNEL_ACTION_DENIAL = [
+  'GoodVibes Agent only inspects channel accounts, directories, capabilities, tools, and actions from the main conversation.',
+  'Channel account actions, tool runs, operator action runs, authorization, and target auto-creation are disabled here.',
+  'External channel side effects require an explicit Agent approval flow before they can run.',
+].join(' ');
+
 export function installAgentToolPolicyGuard(registry: ToolRegistry, options: AgentToolPolicyGuardOptions = {}): void {
   const agentTool = registry.list().find((tool) => tool.definition.name === 'agent');
   if (!agentTool) throw new Error('Agent tool policy guard could not find the agent tool.');
   wrapAgentToolForAgentPolicy(agentTool, options);
   for (const tool of registry.list()) {
-    if (BLOCKED_MAIN_CONVERSATION_TOOL_NAME_SET.has(tool.definition.name)) {
+    if (tool.definition.name === 'exec') {
+      wrapExecToolForAgentPolicy(tool);
+    } else if (tool.definition.name === 'remote') {
+      wrapModeRestrictedToolForAgentPolicy(tool, {
+        allowedModes: READ_ONLY_REMOTE_TOOL_MODES,
+        modeSet: READ_ONLY_REMOTE_TOOL_MODE_SET,
+        description: [
+          'Read-only remote runner inspection for GoodVibes Agent.',
+          'Pool creation, runner assignment, unassignment, and artifact import are disabled in the main conversation.',
+        ].join(' '),
+        denial: REMOTE_MUTATION_DENIAL,
+      });
+    } else if (tool.definition.name === 'channel') {
+      wrapChannelToolForAgentPolicy(tool);
+    } else if (BLOCKED_MAIN_CONVERSATION_TOOL_NAME_SET.has(tool.definition.name)) {
       wrapBlockedMainConversationToolForAgentPolicy(tool);
     }
   }
@@ -79,10 +137,92 @@ export function wrapBlockedMainConversationToolForAgentPolicy(tool: Tool): void
   tool.execute = async () => ({ success: false, error: LOCAL_CODING_TOOL_DENIAL });
 }
 
+export function wrapExecToolForAgentPolicy(tool: Tool): void {
+  narrowExecToolDefinitionForAgentPolicy(tool);
+  const originalExecute = tool.execute.bind(tool);
+  tool.execute = async (args) => {
+    const denial = validateExecToolInvocationForAgentPolicy(args as ExecToolArgs);
+    if (denial) return { success: false, error: denial };
+    return originalExecute(args);
+  };
+}
+
+export function validateExecToolInvocationForAgentPolicy(args: ExecToolArgs): string | null {
+  if (args.parallel === true) return BACKGROUND_EXEC_DENIAL;
+  if (Array.isArray(args.file_ops) && args.file_ops.length > 0) return BACKGROUND_EXEC_DENIAL;
+  if (args.file_ops !== undefined && !Array.isArray(args.file_ops)) return BACKGROUND_EXEC_DENIAL;
+  if (!Array.isArray(args.commands)) return null;
+
+  for (const command of args.commands) {
+    if (!isRecord(command)) continue;
+    const commandArgs = command as ExecCommandArgs;
+    if (commandArgs.background === true) return BACKGROUND_EXEC_DENIAL;
+    if (typeof commandArgs.cmd === 'string' && AGENT_EXEC_BACKGROUND_COMMAND.test(commandArgs.cmd)) {
+      return BACKGROUND_EXEC_DENIAL;
+    }
+    if (isRecord(commandArgs.until)) {
+      const killAfter = commandArgs.until.kill_after;
+      if (killAfter !== true) return BACKGROUND_EXEC_DENIAL;
+    }
+  }
+
+  return null;
+}
+
+type ModeRestrictedToolPolicy = {
+  readonly allowedModes: readonly string[];
+  readonly modeSet: ReadonlySet<string>;
+  readonly description: string;
+  readonly denial: string;
+};
+
+export function wrapModeRestrictedToolForAgentPolicy(tool: Tool, policy: ModeRestrictedToolPolicy): void {
+  narrowModeToolDefinitionForAgentPolicy(tool, policy.allowedModes, policy.description);
+  const originalExecute = tool.execute.bind(tool);
+  tool.execute = async (args) => {
+    const denial = validateModeRestrictedToolInvocationForAgentPolicy(args as ModeToolArgs, policy.modeSet, policy.denial);
+    if (denial) return { success: false, error: denial };
+    return originalExecute(args);
+  };
+}
+
+export function wrapChannelToolForAgentPolicy(tool: Tool): void {
+  narrowModeToolDefinitionForAgentPolicy(tool, READ_ONLY_CHANNEL_TOOL_MODES, [
+    'Read-only channel inspection for GoodVibes Agent.',
+    'Running channel tools/actions, account lifecycle actions, authorization, and target creation are disabled in the main conversation.',
+  ].join(' '));
+  const originalExecute = tool.execute.bind(tool);
+  tool.execute = async (args) => {
+    const denial = validateModeRestrictedToolInvocationForAgentPolicy(args as ModeToolArgs, READ_ONLY_CHANNEL_TOOL_MODE_SET, CHANNEL_ACTION_DENIAL)
+      ?? validateChannelToolInvocationForAgentPolicy(args as ModeToolArgs);
+    if (denial) return { success: false, error: denial };
+    return originalExecute(args);
+  };
+}
+
+export function validateModeRestrictedToolInvocationForAgentPolicy(
+  args: ModeToolArgs,
+  modeSet: ReadonlySet<string>,
+  denial: string,
+): string | null {
+  if (typeof args.mode === 'string' && !modeSet.has(args.mode)) return denial;
+  return null;
+}
+
+export function validateChannelToolInvocationForAgentPolicy(args: ModeToolArgs): string | null {
+  if (args.mode === 'resolve_target' && args.createIfMissing === true) return CHANNEL_ACTION_DENIAL;
+  return null;
+}
+
 export const AGENT_LOCAL_SPAWN_DENIAL_MESSAGE = LOCAL_AGENT_DENIAL;
 export const AGENT_READ_ONLY_TOOL_MODES = READ_ONLY_AGENT_TOOL_MODES;
 export const AGENT_BLOCKED_MAIN_CONVERSATION_TOOL_NAMES = BLOCKED_MAIN_CONVERSATION_TOOL_NAMES;
 export const AGENT_MAIN_CONVERSATION_TOOL_DENIAL_MESSAGE = LOCAL_CODING_TOOL_DENIAL;
+export const AGENT_EXEC_BACKGROUND_DENIAL_MESSAGE = BACKGROUND_EXEC_DENIAL;
+export const AGENT_READ_ONLY_REMOTE_TOOL_MODES = READ_ONLY_REMOTE_TOOL_MODES;
+export const AGENT_READ_ONLY_CHANNEL_TOOL_MODES = READ_ONLY_CHANNEL_TOOL_MODES;
+export const AGENT_REMOTE_MUTATION_DENIAL_MESSAGE = REMOTE_MUTATION_DENIAL;
+export const AGENT_CHANNEL_ACTION_DENIAL_MESSAGE = CHANNEL_ACTION_DENIAL;
 
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === 'object' && value !== null && !Array.isArray(value);
@@ -104,6 +244,55 @@ function narrowAgentToolDefinitionForAgentPolicy(tool: Tool): void {
   modeProperty.description = 'Read-only Agent inspection mode. Local spawn, batch-spawn, cancel, message, wait, and plan modes are disabled in GoodVibes Agent.';
 }
 
+function narrowExecToolDefinitionForAgentPolicy(tool: Tool): void {
+  tool.definition.description = [
+    'Execute foreground shell commands serially for GoodVibes Agent main-conversation work.',
+    'Background processes, parallel batches, background process controls, and exec file_ops are disabled by Agent policy.',
+    'Delegate long-running build/fix/review execution to GoodVibes TUI instead.',
+  ].join(' ');
+
+  const properties = tool.definition.parameters.properties;
+  if (!isRecord(properties)) return;
+  delete properties.parallel;
+  delete properties.file_ops;
+
+  const commandsProperty = properties.commands;
+  if (!isRecord(commandsProperty)) return;
+  const itemSchema = commandsProperty.items;
+  if (!isRecord(itemSchema)) return;
+  const commandProperties = itemSchema.properties;
+  if (!isRecord(commandProperties)) return;
+
+  delete commandProperties.background;
+  const untilProperty = commandProperties.until;
+  if (isRecord(untilProperty)) {
+    untilProperty.description = [
+      'Pattern-based early termination.',
+      'GoodVibes Agent requires kill_after:true so until-mode does not promote the process to background.',
+    ].join(' ');
+  }
+}
+
+function narrowModeToolDefinitionForAgentPolicy(tool: Tool, allowedModes: readonly string[], description: string): void {
+  tool.definition.description = description;
+
+  const properties = tool.definition.parameters.properties;
+  if (!isRecord(properties)) return;
+  const modeProperty = properties.mode;
+  if (isRecord(modeProperty)) {
+    modeProperty.enum = [...allowedModes];
+    modeProperty.description = 'Read-only modes allowed by GoodVibes Agent main-conversation policy.';
+  }
+
+  if (tool.definition.name === 'channel') {
+    delete properties.accountAction;
+    delete properties.toolId;
+    delete properties.actionId;
+    delete properties.actorId;
+    delete properties.createIfMissing;
+  }
+}
+
 // Compatibility exports for copied TUI tests/imports during the near-fork phase.
 export const installWrfcAgentToolGuard = installAgentToolPolicyGuard;
 export const wrapWrfcAgentTool = wrapAgentToolForAgentPolicy;

package/src/version.ts

@@ -6,7 +6,7 @@ import { join } from 'node:path';
 // The prebuild script updates the fallback value before compilation.
 // Uses import.meta.dir (Bun) to locate package.json relative to this file,
 // which is correct regardless of the process working directory.
-let _version = '0.1.13';
+let _version = '0.1.15';
 let _sdkVersion = '0.33.35';
 try {
   const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', 'package.json'), 'utf-8')) as {