@pellux/goodvibes-agent 0.1.16 → 0.1.18

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 All notable changes to GoodVibes Agent will be recorded here.
 
+## 0.1.18 - 2026-05-31
+
+- 1fd7729 Restrict state tool mutations in agent runtime
+
+## 0.1.17 - 2026-05-31
+
+- f148186 Restrict fetch side effects in agent runtime
+
 ## 0.1.16 - 2026-05-31
 
 - bea1197 Restrict MCP tool mutations in agent runtime

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pellux/goodvibes-agent",
-  "version": "0.1.16",
+  "version": "0.1.18",
   "private": false,
   "description": "Near-fork GoodVibes operator assistant with the GoodVibes TUI shell, renderer, input, fullscreen workspace, and daemon-connected Agent product brain.",
   "type": "module",

package/src/tools/wrfc-agent-guard.ts

@@ -26,6 +26,34 @@ type ModeToolArgs = {
   readonly [key: string]: unknown;
 };
 
+type FetchToolArgs = {
+  readonly urls?: unknown;
+  readonly parallel?: unknown;
+  readonly sanitize_mode?: unknown;
+  readonly trusted_hosts?: unknown;
+  readonly [key: string]: unknown;
+};
+
+type StateToolArgs = {
+  readonly mode?: unknown;
+  readonly memoryAction?: unknown;
+  readonly hookAction?: unknown;
+  readonly modeAction?: unknown;
+  readonly analyticsAction?: unknown;
+  readonly values?: unknown;
+  readonly clearKeys?: unknown;
+  readonly memoryValue?: unknown;
+  readonly hookDefinition?: unknown;
+  readonly modeName?: unknown;
+  readonly analyticsTool?: unknown;
+  readonly analyticsArgs?: unknown;
+  readonly analyticsResult?: unknown;
+  readonly analyticsDuration?: unknown;
+  readonly analyticsTokens?: unknown;
+  readonly analyticsFormat?: unknown;
+  readonly [key: string]: unknown;
+};
+
 type AgentToolPolicyGuardOptions = {
   readonly getLastUserMessage?: () => string | null;
 };
@@ -51,9 +79,21 @@ const BLOCKED_MAIN_CONVERSATION_TOOL_NAME_SET = new Set<string>(BLOCKED_MAIN_CON
 const READ_ONLY_REMOTE_TOOL_MODES = ['pools', 'contracts', 'artifacts', 'review'] as const;
 const READ_ONLY_CHANNEL_TOOL_MODES = ['accounts', 'directory', 'resolve_target', 'capabilities', 'tools', 'agent_tools', 'actions'] as const;
 const READ_ONLY_MCP_TOOL_MODES = ['servers', 'tools', 'schema', 'resources', 'security', 'auth'] as const;
+const READ_ONLY_FETCH_METHODS = ['GET', 'HEAD', 'OPTIONS'] as const;
+const READ_ONLY_STATE_TOOL_MODES = ['get', 'list', 'budget', 'context', 'memory', 'telemetry', 'hooks', 'mode', 'analytics'] as const;
+const READ_ONLY_STATE_MEMORY_ACTIONS = ['list', 'get'] as const;
+const READ_ONLY_STATE_HOOK_ACTIONS = ['list'] as const;
+const READ_ONLY_STATE_MODE_ACTIONS = ['get', 'list'] as const;
+const READ_ONLY_STATE_ANALYTICS_ACTIONS = ['summary', 'query', 'dashboard'] as const;
 const READ_ONLY_REMOTE_TOOL_MODE_SET = new Set<string>(READ_ONLY_REMOTE_TOOL_MODES);
 const READ_ONLY_CHANNEL_TOOL_MODE_SET = new Set<string>(READ_ONLY_CHANNEL_TOOL_MODES);
 const READ_ONLY_MCP_TOOL_MODE_SET = new Set<string>(READ_ONLY_MCP_TOOL_MODES);
+const READ_ONLY_FETCH_METHOD_SET = new Set<string>(READ_ONLY_FETCH_METHODS);
+const READ_ONLY_STATE_TOOL_MODE_SET = new Set<string>(READ_ONLY_STATE_TOOL_MODES);
+const READ_ONLY_STATE_MEMORY_ACTION_SET = new Set<string>(READ_ONLY_STATE_MEMORY_ACTIONS);
+const READ_ONLY_STATE_HOOK_ACTION_SET = new Set<string>(READ_ONLY_STATE_HOOK_ACTIONS);
+const READ_ONLY_STATE_MODE_ACTION_SET = new Set<string>(READ_ONLY_STATE_MODE_ACTIONS);
+const READ_ONLY_STATE_ANALYTICS_ACTION_SET = new Set<string>(READ_ONLY_STATE_ANALYTICS_ACTIONS);
 
 const LOCAL_AGENT_DENIAL = [
   'GoodVibes Agent does not spawn local Engineer/Reviewer/Tester/Verifier roots or run local WRFC chains.',
@@ -91,6 +131,18 @@ const MCP_SECURITY_MUTATION_DENIAL = [
   'MCP security mutations require an explicit Agent approval flow before they can run.',
 ].join(' ');
 
+const FETCH_NETWORK_MUTATION_DENIAL = [
+  'GoodVibes Agent only performs serial, unauthenticated, read-only HTTP fetches from the main conversation.',
+  'Non-read methods, request bodies, custom auth/header/service credentials, trust overrides, raw unsanitized responses, and parallel fetch batches are disabled here.',
+  'Network writes or credentialed external calls require an explicit Agent approval flow before they can run.',
+].join(' ');
+
+const STATE_MUTATION_DENIAL = [
+  'GoodVibes Agent only inspects copied runtime state from the main conversation.',
+  'Arbitrary state set/clear, copied memory writes, hook mutation, output-mode mutation, and analytics writes are disabled here.',
+  'Use Agent-owned memory, skills, personas, routines, and explicit CLI/slash commands for intentional local state changes.',
+].join(' ');
+
 export function installAgentToolPolicyGuard(registry: ToolRegistry, options: AgentToolPolicyGuardOptions = {}): void {
   const agentTool = registry.list().find((tool) => tool.definition.name === 'agent');
   if (!agentTool) throw new Error('Agent tool policy guard could not find the agent tool.');
@@ -120,6 +172,10 @@ export function installAgentToolPolicyGuard(registry: ToolRegistry, options: Age
         ].join(' '),
         denial: MCP_SECURITY_MUTATION_DENIAL,
       });
+    } else if (tool.definition.name === 'fetch') {
+      wrapFetchToolForAgentPolicy(tool);
+    } else if (tool.definition.name === 'state') {
+      wrapStateToolForAgentPolicy(tool);
     } else if (BLOCKED_MAIN_CONVERSATION_TOOL_NAME_SET.has(tool.definition.name)) {
       wrapBlockedMainConversationToolForAgentPolicy(tool);
     }
@@ -165,6 +221,26 @@ export function wrapExecToolForAgentPolicy(tool: Tool): void {
   };
 }
 
+export function wrapFetchToolForAgentPolicy(tool: Tool): void {
+  narrowFetchToolDefinitionForAgentPolicy(tool);
+  const originalExecute = tool.execute.bind(tool);
+  tool.execute = async (args) => {
+    const denial = validateFetchToolInvocationForAgentPolicy(args as FetchToolArgs);
+    if (denial) return { success: false, error: denial };
+    return originalExecute(normalizeFetchToolInvocationForAgentPolicy(args as FetchToolArgs) as Parameters<Tool['execute']>[0]);
+  };
+}
+
+export function wrapStateToolForAgentPolicy(tool: Tool): void {
+  narrowStateToolDefinitionForAgentPolicy(tool);
+  const originalExecute = tool.execute.bind(tool);
+  tool.execute = async (args) => {
+    const denial = validateStateToolInvocationForAgentPolicy(args as StateToolArgs);
+    if (denial) return { success: false, error: denial };
+    return originalExecute(args);
+  };
+}
+
 export function validateExecToolInvocationForAgentPolicy(args: ExecToolArgs): string | null {
   if (args.parallel === true) return BACKGROUND_EXEC_DENIAL;
   if (Array.isArray(args.file_ops) && args.file_ops.length > 0) return BACKGROUND_EXEC_DENIAL;
@@ -187,6 +263,68 @@ export function validateExecToolInvocationForAgentPolicy(args: ExecToolArgs): st
   return null;
 }
 
+export function validateFetchToolInvocationForAgentPolicy(args: FetchToolArgs): string | null {
+  if (args.parallel === true) return FETCH_NETWORK_MUTATION_DENIAL;
+  if (args.sanitize_mode === 'none') return FETCH_NETWORK_MUTATION_DENIAL;
+  if (isPresent(args.trusted_hosts)) return FETCH_NETWORK_MUTATION_DENIAL;
+  if (!Array.isArray(args.urls)) return null;
+
+  for (const urlArgs of args.urls) {
+    if (!isRecord(urlArgs)) continue;
+    const method = typeof urlArgs.method === 'string' ? urlArgs.method.toUpperCase() : 'GET';
+    if (!READ_ONLY_FETCH_METHOD_SET.has(method)) return FETCH_NETWORK_MUTATION_DENIAL;
+    if (isPresent(urlArgs.body) || isPresent(urlArgs.body_base64) || isPresent(urlArgs.body_type) || isPresent(urlArgs.body_data)) {
+      return FETCH_NETWORK_MUTATION_DENIAL;
+    }
+    if (isPresent(urlArgs.headers) || isPresent(urlArgs.auth) || isPresent(urlArgs.service) || isPresent(urlArgs.retry_on_auth)) {
+      return FETCH_NETWORK_MUTATION_DENIAL;
+    }
+  }
+
+  return null;
+}
+
+export function normalizeFetchToolInvocationForAgentPolicy(args: FetchToolArgs): FetchToolArgs {
+  return { ...args, parallel: false };
+}
+
+export function validateStateToolInvocationForAgentPolicy(args: StateToolArgs): string | null {
+  if (isPresent(args.values) || isPresent(args.clearKeys)) return STATE_MUTATION_DENIAL;
+  if (typeof args.mode === 'string' && !READ_ONLY_STATE_TOOL_MODE_SET.has(args.mode)) return STATE_MUTATION_DENIAL;
+
+  if (args.mode === 'memory') {
+    const action = typeof args.memoryAction === 'string' ? args.memoryAction : 'list';
+    if (!READ_ONLY_STATE_MEMORY_ACTION_SET.has(action) || isPresent(args.memoryValue)) return STATE_MUTATION_DENIAL;
+  }
+
+  if (args.mode === 'hooks') {
+    const action = typeof args.hookAction === 'string' ? args.hookAction : 'list';
+    if (!READ_ONLY_STATE_HOOK_ACTION_SET.has(action) || isPresent(args.hookDefinition)) return STATE_MUTATION_DENIAL;
+  }
+
+  if (args.mode === 'mode') {
+    const action = typeof args.modeAction === 'string' ? args.modeAction : 'get';
+    if (!READ_ONLY_STATE_MODE_ACTION_SET.has(action) || isPresent(args.modeName)) return STATE_MUTATION_DENIAL;
+  }
+
+  if (args.mode === 'analytics') {
+    const action = typeof args.analyticsAction === 'string' ? args.analyticsAction : 'summary';
+    if (!READ_ONLY_STATE_ANALYTICS_ACTION_SET.has(action)) return STATE_MUTATION_DENIAL;
+    if (
+      isPresent(args.analyticsTool)
+      || isPresent(args.analyticsArgs)
+      || isPresent(args.analyticsResult)
+      || isPresent(args.analyticsDuration)
+      || isPresent(args.analyticsTokens)
+      || isPresent(args.analyticsFormat)
+    ) {
+      return STATE_MUTATION_DENIAL;
+    }
+  }
+
+  return null;
+}
+
 type ModeRestrictedToolPolicy = {
   readonly allowedModes: readonly string[];
   readonly modeSet: ReadonlySet<string>;
@@ -240,14 +378,30 @@ export const AGENT_EXEC_BACKGROUND_DENIAL_MESSAGE = BACKGROUND_EXEC_DENIAL;
 export const AGENT_READ_ONLY_REMOTE_TOOL_MODES = READ_ONLY_REMOTE_TOOL_MODES;
 export const AGENT_READ_ONLY_CHANNEL_TOOL_MODES = READ_ONLY_CHANNEL_TOOL_MODES;
 export const AGENT_READ_ONLY_MCP_TOOL_MODES = READ_ONLY_MCP_TOOL_MODES;
+export const AGENT_READ_ONLY_FETCH_METHODS = READ_ONLY_FETCH_METHODS;
+export const AGENT_READ_ONLY_STATE_TOOL_MODES = READ_ONLY_STATE_TOOL_MODES;
+export const AGENT_READ_ONLY_STATE_MEMORY_ACTIONS = READ_ONLY_STATE_MEMORY_ACTIONS;
+export const AGENT_READ_ONLY_STATE_HOOK_ACTIONS = READ_ONLY_STATE_HOOK_ACTIONS;
+export const AGENT_READ_ONLY_STATE_MODE_ACTIONS = READ_ONLY_STATE_MODE_ACTIONS;
+export const AGENT_READ_ONLY_STATE_ANALYTICS_ACTIONS = READ_ONLY_STATE_ANALYTICS_ACTIONS;
 export const AGENT_REMOTE_MUTATION_DENIAL_MESSAGE = REMOTE_MUTATION_DENIAL;
 export const AGENT_CHANNEL_ACTION_DENIAL_MESSAGE = CHANNEL_ACTION_DENIAL;
 export const AGENT_MCP_SECURITY_MUTATION_DENIAL_MESSAGE = MCP_SECURITY_MUTATION_DENIAL;
+export const AGENT_FETCH_NETWORK_MUTATION_DENIAL_MESSAGE = FETCH_NETWORK_MUTATION_DENIAL;
+export const AGENT_STATE_MUTATION_DENIAL_MESSAGE = STATE_MUTATION_DENIAL;
 
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
 
+function isPresent(value: unknown): boolean {
+  if (value === undefined || value === null) return false;
+  if (typeof value === 'string') return value.length > 0;
+  if (Array.isArray(value)) return value.length > 0;
+  if (isRecord(value)) return Object.keys(value).length > 0;
+  return true;
+}
+
 function narrowAgentToolDefinitionForAgentPolicy(tool: Tool): void {
   tool.definition.description = [
     'Read-only local Agent inspection for GoodVibes Agent.',
@@ -293,6 +447,81 @@ function narrowExecToolDefinitionForAgentPolicy(tool: Tool): void {
   }
 }
 
+function narrowFetchToolDefinitionForAgentPolicy(tool: Tool): void {
+  tool.definition.description = [
+    'Fetch public URLs for GoodVibes Agent with serial, read-only HTTP requests.',
+    'Only GET, HEAD, and OPTIONS are available in the main conversation.',
+    'Credentialed requests, request bodies, trust overrides, raw unsanitized responses, and parallel batches are disabled by Agent policy.',
+  ].join(' ');
+
+  const properties = tool.definition.parameters.properties;
+  if (!isRecord(properties)) return;
+  delete properties.parallel;
+  delete properties.trusted_hosts;
+
+  const sanitizeModeProperty = properties.sanitize_mode;
+  if (isRecord(sanitizeModeProperty)) {
+    sanitizeModeProperty.enum = ['safe-text', 'strict'];
+    sanitizeModeProperty.description = 'Response sanitization mode. Raw unsanitized responses are disabled in GoodVibes Agent.';
+  }
+
+  const urlsProperty = properties.urls;
+  if (!isRecord(urlsProperty)) return;
+  const itemSchema = urlsProperty.items;
+  if (!isRecord(itemSchema)) return;
+  const urlProperties = itemSchema.properties;
+  if (!isRecord(urlProperties)) return;
+
+  const methodProperty = urlProperties.method;
+  if (isRecord(methodProperty)) {
+    methodProperty.enum = [...READ_ONLY_FETCH_METHODS];
+    methodProperty.description = 'Read-only HTTP method. GoodVibes Agent disables POST, PUT, PATCH, and DELETE in the main conversation.';
+  }
+
+  delete urlProperties.headers;
+  delete urlProperties.body;
+  delete urlProperties.body_base64;
+  delete urlProperties.body_type;
+  delete urlProperties.body_data;
+  delete urlProperties.retry_on_auth;
+  delete urlProperties.service;
+  delete urlProperties.auth;
+}
+
+function narrowStateToolDefinitionForAgentPolicy(tool: Tool): void {
+  tool.definition.description = [
+    'Inspect copied runtime state for GoodVibes Agent.',
+    'State mutation, copied memory writes, hook changes, output-mode changes, and analytics writes are disabled in the main conversation.',
+    'Use Agent-owned commands for intentional memory, skill, persona, and routine changes.',
+  ].join(' ');
+
+  const properties = tool.definition.parameters.properties;
+  if (!isRecord(properties)) return;
+  const modeProperty = properties.mode;
+  if (isRecord(modeProperty)) {
+    modeProperty.enum = [...READ_ONLY_STATE_TOOL_MODES];
+    modeProperty.description = 'Read-only copied runtime state mode. set and clear are disabled in GoodVibes Agent.';
+  }
+
+  delete properties.values;
+  delete properties.clearKeys;
+  delete properties.memoryValue;
+  delete properties.hookDefinition;
+  delete properties.hookName;
+  delete properties.modeName;
+  delete properties.analyticsTool;
+  delete properties.analyticsArgs;
+  delete properties.analyticsResult;
+  delete properties.analyticsDuration;
+  delete properties.analyticsTokens;
+  delete properties.analyticsFormat;
+
+  narrowStringEnumProperty(properties, 'memoryAction', READ_ONLY_STATE_MEMORY_ACTIONS, 'Read-only copied memory actions allowed by GoodVibes Agent.');
+  narrowStringEnumProperty(properties, 'hookAction', READ_ONLY_STATE_HOOK_ACTIONS, 'Read-only hook action allowed by GoodVibes Agent.');
+  narrowStringEnumProperty(properties, 'modeAction', READ_ONLY_STATE_MODE_ACTIONS, 'Read-only mode actions allowed by GoodVibes Agent.');
+  narrowStringEnumProperty(properties, 'analyticsAction', READ_ONLY_STATE_ANALYTICS_ACTIONS, 'Read-only analytics actions allowed by GoodVibes Agent.');
+}
+
 function narrowModeToolDefinitionForAgentPolicy(tool: Tool, allowedModes: readonly string[], description: string): void {
   tool.definition.description = description;
 
@@ -313,6 +542,18 @@ function narrowModeToolDefinitionForAgentPolicy(tool: Tool, allowedModes: readon
   }
 }
 
+function narrowStringEnumProperty(
+  properties: Record<string, unknown>,
+  key: string,
+  values: readonly string[],
+  description: string,
+): void {
+  const property = properties[key];
+  if (!isRecord(property)) return;
+  property.enum = [...values];
+  property.description = description;
+}
+
 // Compatibility exports for copied TUI tests/imports during the near-fork phase.
 export const installWrfcAgentToolGuard = installAgentToolPolicyGuard;
 export const wrapWrfcAgentTool = wrapAgentToolForAgentPolicy;

package/src/version.ts

@@ -6,7 +6,7 @@ import { join } from 'node:path';
 // The prebuild script updates the fallback value before compilation.
 // Uses import.meta.dir (Bun) to locate package.json relative to this file,
 // which is correct regardless of the process working directory.
-let _version = '0.1.16';
+let _version = '0.1.18';
 let _sdkVersion = '0.33.35';
 try {
   const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', 'package.json'), 'utf-8')) as {