@pellux/goodvibes-agent 0.1.4 → 0.1.5

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to GoodVibes Agent will be recorded here.
 
+## 0.1.5 - 2026-05-31
+
+- Hardened package-facing release checks so shipped docs and Agent guidance cannot reintroduce default Knowledge/Wiki, HomeGraph, Home Assistant, copied TUI daemon, or copied WRFC-first policy text.
+- Removed the generic default `knowledgeApi` client from the active Agent command context so slash commands must use the isolated Agent Knowledge API.
+- Changed CLI `knowledge ingest-url` to post directly to `/api/goodvibes-agent/knowledge/ingest/url` instead of invoking the generic knowledge operator method.
+- Rejected `--space`, `--knowledge-space`, `--knowledgeSpaceId`, `--includeAllSpaces`, and HomeGraph-style flags in CLI and slash Agent Knowledge commands before any daemon call.
+
 ## 0.1.4 - 2026-05-31
 
 - Hardened Agent Knowledge route isolation for CLI JSON output and diagnostics: Agent status, ask, search, and ingest-url now report explicit `agentKnowledge.*` identities and `/api/goodvibes-agent/knowledge/*` routes.

package/docs/getting-started.md

@@ -1,6 +1,6 @@
 # Getting Started
 
-GoodVibes Agent `0.1.4` is the current installable public alpha of the personal operator assistant built on the GoodVibes TUI foundation.
+GoodVibes Agent `0.1.5` is the current installable public alpha of the personal operator assistant built on the GoodVibes TUI foundation.
 
 ## Requirements
 

package/docs/release-and-publishing.md

@@ -1,6 +1,6 @@
 # Release And Publishing
 
-GoodVibes Agent `0.1.4` is the current installable public alpha release.
+GoodVibes Agent `0.1.5` is the current installable public alpha release.
 
 ## Package Identity
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pellux/goodvibes-agent",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "private": false,
   "description": "Near-fork GoodVibes operator assistant with the GoodVibes TUI shell, renderer, input, fullscreen workspace, and daemon-connected Agent product brain.",
   "type": "module",

package/src/cli/agent-knowledge-command.ts

@@ -222,6 +222,62 @@ function createAgentSdk(connection: AgentDaemonConnection) {
   });
 }
 
+async function postAgentKnowledgeJson<TData>(
+  connection: AgentDaemonConnection,
+  route: string,
+  body: JsonRecord,
+): Promise<TData> {
+  const response = await fetch(`${connection.baseUrl}${route}`, {
+    method: 'POST',
+    headers: {
+      authorization: `Bearer ${connection.token ?? ''}`,
+      'content-type': 'application/json',
+    },
+    body: JSON.stringify(body),
+  });
+  const text = await response.text();
+  let parsed: unknown = text;
+  if (text.trim()) {
+    try {
+      parsed = JSON.parse(text) as unknown;
+    } catch {
+      parsed = text;
+    }
+  }
+  if (!response.ok) {
+    const detail = isRecord(parsed) && typeof parsed.error === 'string' ? parsed.error : text;
+    throw new Error(`HTTP ${response.status} ${response.statusText}${detail ? `: ${detail}` : ''}`);
+  }
+  return parsed as TData;
+}
+
+function findDisallowedKnowledgeScopeFlag(args: readonly string[]): string | null {
+  const disallowed = [
+    '--space',
+    '--knowledge-space',
+    '--knowledge-space-id',
+    '--knowledgeSpaceId',
+    '--include-all-spaces',
+    '--includeAllSpaces',
+    '--homegraph',
+    '--home-graph',
+  ];
+  for (const token of args) {
+    for (const flag of disallowed) {
+      if (token === flag || token.startsWith(`${flag}=`)) return flag;
+    }
+  }
+  return null;
+}
+
+function formatScopeFlagRejection(flag: string): string {
+  return [
+    `Agent Knowledge is isolated; ${flag} is not accepted.`,
+    'GoodVibes Agent must not use default Knowledge/Wiki, HomeGraph, or Home Assistant spaces.',
+    'Use only /api/goodvibes-agent/knowledge/* Agent-owned routes.',
+  ].join('\n');
+}
+
 function sourceLine(value: unknown): string {
   const record = isRecord(value) ? value : {};
   const title = cleanInline(record.title)
@@ -384,6 +440,19 @@ export async function handleAgentKnowledgeCommand(runtime: CliCommandRuntime): P
   const [sub = 'status', ...rest] = runtime.cli.commandArgs;
   const normalized = sub.toLowerCase();
   const json = runtime.cli.flags.outputFormat === 'json';
+  const disallowedScopeFlag = findDisallowedKnowledgeScopeFlag(rest);
+  if (disallowedScopeFlag) {
+    const failure = {
+      ok: false,
+      kind: 'agent_knowledge_scope_rejected',
+      error: formatScopeFlagRejection(disallowedScopeFlag),
+      route: '/api/goodvibes-agent/knowledge/*',
+    };
+    return {
+      output: json ? JSON.stringify(failure, null, 2) : failure.error,
+      exitCode: 2,
+    };
+  }
 
   if (normalized === 'status') {
     const result = await runKnowledgeCall(runtime, AGENT_KNOWLEDGE_METHODS.status, async (connection) => (
@@ -440,7 +509,7 @@ export async function handleAgentKnowledgeCommand(runtime: CliCommandRuntime): P
     const title = readOptionValue(rest, '--title');
     const tags = readStringList(rest, '--tags');
     const result = await runKnowledgeCall(runtime, AGENT_KNOWLEDGE_METHODS.ingestUrl, async (connection) => (
-      await createAgentSdk(connection).operator.invoke('knowledge.ingest.url', {
+      await postAgentKnowledgeJson(connection, AGENT_KNOWLEDGE_METHODS.ingestUrl.route, {
         url,
         title,
         tags,

package/src/cli/package-verification.ts

@@ -21,6 +21,10 @@ export interface PackageCliVerificationReport {
     readonly requiredPathsPresent: readonly string[];
     readonly forbiddenPaths: readonly string[];
   };
+  readonly packageFacingText: {
+    readonly checkedPaths: readonly string[];
+    readonly failures: readonly string[];
+  };
   readonly issues: readonly string[];
 }
 
@@ -46,6 +50,43 @@ const FORBIDDEN_TARBALL_DOCS = [
   'docs/homeassistant-surface.md',
   'docs/wrfc/',
 ] as const;
+const PACKAGE_FACING_TEXT_PATHS = [
+  'README.md',
+  'docs/README.md',
+  'docs/getting-started.md',
+  'docs/deployment-and-services.md',
+  'docs/release-and-publishing.md',
+  '.goodvibes/GOODVIBES.md',
+  '.goodvibes/agents/reviewer.md',
+  '.goodvibes/skills/add-provider/SKILL.md',
+] as const;
+const PACKAGE_FACING_FORBIDDEN_TEXT = [
+  '/api/knowledge',
+  '/api/homeassistant',
+  'homeassistant.homeGraph',
+  'includeAllSpaces',
+  'knowledgeSpaceId',
+  '@pellux/goodvibes-tui',
+  '@pellux/goodvibes-daemon',
+  'goodvibes-daemon',
+  '~/.goodvibes/tui',
+  'Every plan must have a multi-agent execution strategy',
+  'NEVER skip WRFC',
+  'ALWAYS work in parallel when implementing a plan',
+  'PRIMARY GOAL: Fully complete and functional code',
+  'You are a code reviewer for the WRFC',
+  'ReviewerReport',
+  '"wrfcId"',
+] as const;
+const PACKAGE_FACING_REQUIRED_TEXT: readonly {
+  readonly path: typeof PACKAGE_FACING_TEXT_PATHS[number];
+  readonly required: readonly string[];
+}[] = [
+  { path: 'README.md', required: ['/api/goodvibes-agent/knowledge'] },
+  { path: 'docs/README.md', required: ['/api/goodvibes-agent/knowledge'] },
+  { path: 'docs/getting-started.md', required: ['/api/goodvibes-agent/knowledge'] },
+  { path: 'docs/release-and-publishing.md', required: ['/api/goodvibes-agent/knowledge'] },
+];
 
 function readPackageJson(root: string): Record<string, unknown> {
   return JSON.parse(readFileSync(join(root, 'package.json'), 'utf-8')) as Record<string, unknown>;
@@ -82,6 +123,35 @@ function npmPackDryRun(root: string): { readonly files: readonly string[]; reado
   };
 }
 
+export function verifyPackageFacingText(root: string): { readonly checkedPaths: readonly string[]; readonly failures: readonly string[] } {
+  const failures: string[] = [];
+  for (const path of PACKAGE_FACING_TEXT_PATHS) {
+    const absolutePath = join(root, path);
+    if (!existsSync(absolutePath)) {
+      failures.push(`package-facing text is missing: ${path}`);
+      continue;
+    }
+    const content = readFileSync(absolutePath, 'utf-8');
+    for (const forbidden of PACKAGE_FACING_FORBIDDEN_TEXT) {
+      if (content.includes(forbidden)) {
+        failures.push(`package-facing text ${path} contains forbidden default/TUI route or policy: ${forbidden}`);
+      }
+    }
+    const requirement = PACKAGE_FACING_REQUIRED_TEXT.find((entry) => entry.path === path);
+    if (requirement) {
+      for (const required of requirement.required) {
+        if (!content.includes(required)) {
+          failures.push(`package-facing text ${path} is missing required Agent route/policy text: ${required}`);
+        }
+      }
+    }
+  }
+  return {
+    checkedPaths: PACKAGE_FACING_TEXT_PATHS,
+    failures,
+  };
+}
+
 export function verifyPackageCliInstall(root: string): PackageCliVerificationReport {
   const pkg = readPackageJson(root);
   const bin = pkg.bin && typeof pkg.bin === 'object' ? pkg.bin as Record<string, string | undefined> : {};
@@ -93,6 +163,7 @@ export function verifyPackageCliInstall(root: string): PackageCliVerificationRep
     return FORBIDDEN_TARBALL_DOCS.some((docPath) => path === docPath || path.startsWith(docPath));
   });
   const issues: string[] = [];
+  const packageFacingText = verifyPackageFacingText(root);
 
   for (const item of bins) {
     if (!item.target) issues.push(`package.json bin is missing ${item.command}.`);
@@ -107,6 +178,9 @@ export function verifyPackageCliInstall(root: string): PackageCliVerificationRep
   for (const path of forbiddenPaths) {
     issues.push(`npm tarball includes forbidden path: ${path}`);
   }
+  for (const failure of packageFacingText.failures) {
+    issues.push(failure);
+  }
 
   return {
     packageName: String(pkg.name ?? ''),
@@ -118,6 +192,7 @@ export function verifyPackageCliInstall(root: string): PackageCliVerificationRep
       requiredPathsPresent,
       forbiddenPaths,
     },
+    packageFacingText,
     issues,
   };
 }

package/src/input/command-registry.ts

@@ -203,7 +203,6 @@ export interface CommandContext
     readonly peer?: PeerClient;
     readonly providerApi?: ProviderApi;
     readonly agentKnowledgeApi?: KnowledgeApi;
-    readonly knowledgeApi?: KnowledgeApi;
     readonly hookApi?: HookApi;
     readonly mcpApi?: McpApi;
     readonly opsApi?: OpsApi;

package/src/input/commands/knowledge.ts

@@ -22,6 +22,33 @@ function readFlag(args: string[], name: string): string | undefined {
   return index >= 0 ? args[index + 1] : undefined;
 }
 
+function findDisallowedKnowledgeScopeFlag(args: readonly string[]): string | null {
+  const disallowed = [
+    '--space',
+    '--knowledge-space',
+    '--knowledge-space-id',
+    '--knowledgeSpaceId',
+    '--include-all-spaces',
+    '--includeAllSpaces',
+    '--homegraph',
+    '--home-graph',
+  ];
+  for (const token of args) {
+    for (const flag of disallowed) {
+      if (token === flag || token.startsWith(`${flag}=`)) return flag;
+    }
+  }
+  return null;
+}
+
+function printScopeFlagRejection(context: CommandContext, flag: string): void {
+  context.print([
+    `[knowledge] Agent Knowledge is isolated; ${flag} is not accepted.`,
+    '[knowledge] GoodVibes Agent must not use default Knowledge/Wiki, HomeGraph, or Home Assistant spaces.',
+    '[knowledge] Use only /api/goodvibes-agent/knowledge/* Agent-owned routes.',
+  ].join('\n'));
+}
+
 function readStringListFlag(args: string[], name: string): string[] {
   const value = readFlag(args, name);
   if (!value) return [];
@@ -143,6 +170,11 @@ export const knowledgeCommand: SlashCommand = {
     }
     const sub = (args[0] ?? 'status').toLowerCase();
     const rest = args.slice(1);
+    const disallowedScopeFlag = findDisallowedKnowledgeScopeFlag(rest);
+    if (disallowedScopeFlag) {
+      printScopeFlagRejection(context, disallowedScopeFlag);
+      return;
+    }
 
     switch (sub) {
       case 'ask': {
@@ -154,10 +186,6 @@ export const knowledgeCommand: SlashCommand = {
           context.print('[knowledge] Usage: /knowledge ask <query> [--limit <n>] [--mode <concise|standard|detailed>]');
           return;
         }
-        if (readFlag(rest, '--space') || readFlag(rest, '--knowledge-space')) {
-          context.print('[knowledge] Agent Knowledge is isolated. --space/--knowledge-space is not accepted because Agent must not fall back to default Knowledge/Wiki or HomeGraph.');
-          return;
-        }
         const requestedMode = readFlag(rest, '--mode') as KnowledgeAskMode | undefined;
         const mode: KnowledgeAskMode = requestedMode && ['concise', 'standard', 'detailed'].includes(requestedMode)
           ? requestedMode

package/src/input/commands/recall-query.ts

@@ -4,9 +4,10 @@ import type { MemorySearchFilter } from '@pellux/goodvibes-sdk/platform/state';
 import { VALID_CLASSES, VALID_SCOPES, isValidClass, isValidScope } from './recall-shared.ts';
 
 export function getMemoryApi(context: CommandContext): MemoryApi | null {
-  const memoryApi = context.clients?.knowledgeApi?.memory;
+  const memoryApi = context.clients?.agentKnowledgeApi?.memory;
   if (!memoryApi) {
-    context.print('[recall] Memory API is not available in this runtime.');
+    context.print('[recall] Agent Memory API is not available in this runtime.');
+    context.print('[recall] Refusing to use default Knowledge/Wiki or HomeGraph fallback.');
     return null;
   }
   return memoryApi;

package/src/input/commands/runtime-services.ts

@@ -246,8 +246,12 @@ export async function compactConversation(context: CommandContext): Promise<void
   );
 }
 
+export function requireAgentKnowledgeApi(context: CommandContext): KnowledgeApi {
+  return requireContextValue(context.clients?.agentKnowledgeApi, 'clients.agentKnowledgeApi');
+}
+
 export function requireKnowledgeApi(context: CommandContext): KnowledgeApi {
-  return requireContextValue(context.clients?.knowledgeApi, 'clients.knowledgeApi');
+  return requireAgentKnowledgeApi(context);
 }
 
 export function requireHookApi(context: CommandContext): HookApi {

package/src/runtime/bootstrap-command-context.ts

@@ -101,7 +101,6 @@ export type CreateBootstrapCommandContextOptions = {
   operatorClient?: OperatorClient;
   peerClient?: PeerClient;
   agentKnowledgeApi?: KnowledgeApi;
-  knowledgeApi?: KnowledgeApi;
   hookApi?: HookApi;
   mcpApi?: McpApi;
   opsApi?: OpsApi;
@@ -172,7 +171,6 @@ export function createBootstrapCommandContext(
     operatorClient,
     peerClient,
     agentKnowledgeApi,
-    knowledgeApi,
     hookApi,
     mcpApi,
     opsApi,
@@ -249,7 +247,6 @@ export function createBootstrapCommandContext(
     peerClient,
     agentKnowledgeApi,
     providerApi,
-    knowledgeApi,
     hookApi,
     mcpApi,
     opsApi,

package/src/runtime/bootstrap-command-parts.ts

@@ -118,7 +118,6 @@ export interface BootstrapCommandSectionOptions {
   readonly peerClient?: PeerClient;
   readonly providerApi?: ProviderApi;
   readonly agentKnowledgeApi?: KnowledgeApi;
-  readonly knowledgeApi?: KnowledgeApi;
   readonly hookApi?: HookApi;
   readonly mcpApi?: McpApi;
   readonly opsApi?: OpsApi;
@@ -373,7 +372,7 @@ export function createBootstrapCommandExtensionsSection(
 export function createBootstrapCommandClientsSection(
   options: Pick<
     BootstrapCommandSectionOptions,
-    'operatorClient' | 'peerClient' | 'providerApi' | 'agentKnowledgeApi' | 'knowledgeApi' | 'hookApi' | 'mcpApi' | 'opsApi' | 'directTransport'
+    'operatorClient' | 'peerClient' | 'providerApi' | 'agentKnowledgeApi' | 'hookApi' | 'mcpApi' | 'opsApi' | 'directTransport'
   >,
 ): BootstrapCommandClientSection {
   return {
@@ -381,7 +380,6 @@ export function createBootstrapCommandClientsSection(
     peer: options.peerClient,
     providerApi: options.providerApi,
     agentKnowledgeApi: options.agentKnowledgeApi,
-    knowledgeApi: options.knowledgeApi,
     hookApi: options.hookApi,
     mcpApi: options.mcpApi,
     opsApi: options.opsApi,

package/src/runtime/bootstrap-shell.ts

@@ -172,7 +172,6 @@ export function createBootstrapShell(options: BootstrapShellOptions): BootstrapS
   const {
     directTransport,
     hookApi,
-    knowledgeApi,
     mcpApi,
     opsApi,
     providerApi,
@@ -241,7 +240,6 @@ export function createBootstrapShell(options: BootstrapShellOptions): BootstrapS
     operatorClient: directTransport.operator,
     peerClient: directTransport.peer,
     agentKnowledgeApi,
-    knowledgeApi: agentKnowledgeApi,
     hookApi,
     mcpApi,
     opsApi,

package/src/version.ts

@@ -6,7 +6,7 @@ import { join } from 'node:path';
 // The prebuild script updates the fallback value before compilation.
 // Uses import.meta.dir (Bun) to locate package.json relative to this file,
 // which is correct regardless of the process working directory.
-let _version = '0.1.4';
+let _version = '0.1.5';
 try {
   const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', 'package.json'), 'utf-8'));
   _version = pkg.version ?? _version;

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 Michael Davis and GoodVibes contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.