@pellux/goodvibes-agent 0.1.42 → 0.1.43

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 All notable changes to GoodVibes Agent will be recorded here.
 
+## 0.1.43 - 2026-05-31
+
+- 3afba9c Add daemon route risk coverage
+
 ## 0.1.42 - 2026-05-31
 
 - 3c84649 Surface daemon capabilities in Agent workspace

package/README.md

@@ -45,7 +45,7 @@ bun run publish:check
 
 Inside the Agent TUI, use `/agent`, `/home`, or `/operator` to open the operator workspace. It is the Agent-first fullscreen surface for setup, status, live daemon capability coverage, knowledge, local memory/skills, work-plan/approval review, automation observability, and explicit build delegation to GoodVibes TUI.
 
-Use `goodvibes-agent capabilities` or `/capabilities` to inspect the OpenClaw/Hermes benchmark, current Agent posture, configuration commands, usage paths, and remaining gaps. Use `goodvibes-agent capabilities daemon` or `/capabilities daemon` for a live read-only audit of the GoodVibes daemon method catalog and isolated Agent Knowledge route coverage.
+Use `goodvibes-agent capabilities` or `/capabilities` to inspect the OpenClaw/Hermes benchmark, current Agent posture, configuration commands, usage paths, and remaining gaps. Use `goodvibes-agent capabilities daemon` or `/capabilities daemon` for a live read-only audit of the GoodVibes daemon method catalog, route risk posture, and isolated Agent Knowledge route coverage.
 
 Inside the workspace, use `/agent-profile guide` to author custom profile starters without leaving the Agent TUI. The guided flow lists starters, exports starter JSON, imports edited local starters, and creates isolated runtime profiles from them.
 

package/docs/operator-capability-benchmark.md

@@ -56,7 +56,7 @@ The benchmark measures two different GoodVibes layers:
 
 If the daemon already has a route but Agent lacks a good setup/workspace/CLI surface, the gap is treated as an Agent product gap rather than a missing platform capability.
 
-Use `goodvibes-agent capabilities daemon` for the live read-only daemon audit. It checks the public control-plane method catalog and the isolated Agent Knowledge status route. It intentionally does not call default `/api/knowledge/*`, HomeGraph, or Home Assistant routes.
+Use `goodvibes-agent capabilities daemon` for the live read-only daemon audit. It checks the public control-plane method catalog, route risk posture, and the isolated Agent Knowledge status route. It intentionally does not call default `/api/knowledge/*`, HomeGraph, or Home Assistant routes.
 
 ## Capability Targets
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pellux/goodvibes-agent",
-  "version": "0.1.42",
+  "version": "0.1.43",
   "private": false,
   "description": "Near-fork GoodVibes operator assistant with the GoodVibes TUI shell, renderer, input, fullscreen workspace, and daemon-connected Agent product brain.",
   "type": "module",

package/src/operator/daemon-capability-audit.ts

@@ -41,6 +41,12 @@ export interface DaemonCapabilityAuditArea {
     readonly route: string;
     readonly coverage: DaemonCapabilityRouteCoverage;
   }[];
+  readonly routeRisk: {
+    readonly readOnlyMethodCount: number;
+    readonly mutatingMethodCount: number;
+    readonly authenticatedMethodCount: number;
+    readonly dangerousMethodIds: readonly string[];
+  };
   readonly next: readonly string[];
 }
 
@@ -75,12 +81,13 @@ export type DaemonCapabilityAuditResult =
   | DaemonCapabilityAuditSuccess
   | DaemonCapabilityAuditFailure;
 
-interface DaemonMethodSummary {
+export interface DaemonMethodSummary {
   readonly id: string;
   readonly title?: string;
   readonly category?: string;
   readonly invokable?: boolean;
   readonly access?: string;
+  readonly dangerous?: boolean;
   readonly http?: {
     readonly method?: string;
     readonly path?: string;
@@ -294,6 +301,7 @@ function readMethodSummaries(body: unknown): readonly DaemonMethodSummary[] {
       category: readString(value, 'category') ?? undefined,
       access: readString(value, 'access') ?? undefined,
       invokable: typeof value.invokable === 'boolean' ? value.invokable : undefined,
+      dangerous: typeof value.dangerous === 'boolean' ? value.dangerous : undefined,
       http: httpRecord
         ? {
             method: readString(httpRecord, 'method') ?? undefined,
@@ -389,7 +397,9 @@ function failureFromThrown(error: unknown, connection: AgentDaemonConnection, ro
 export function buildDaemonCapabilityAuditAreas(
   methodIds: ReadonlySet<string>,
   agentKnowledgeRouteReady: boolean | null,
+  methodSummaries: readonly DaemonMethodSummary[] = [],
 ): readonly DaemonCapabilityAuditArea[] {
+  const methodsById = new Map(methodSummaries.map((method) => [method.id, method]));
   return DAEMON_CAPABILITY_REQUIREMENTS.map((requirement) => {
     const presentRequiredMethodIds = requirement.requiredMethodIds.filter((methodId) => methodIds.has(methodId));
     const missingRequiredMethodIds = requirement.requiredMethodIds.filter((methodId) => !methodIds.has(methodId));
@@ -404,6 +414,23 @@ export function buildDaemonCapabilityAuditAreas(
           : 'missing',
     } satisfies DaemonCapabilityAuditArea['agentRoutes'][number]));
     const missingAgentRoutes = agentRoutes.filter((route) => route.coverage === 'missing');
+    const areaMethodIds = [...requirement.requiredMethodIds, ...requirement.optionalMethodIds];
+    const areaMethods = areaMethodIds.flatMap((methodId): DaemonMethodSummary[] => {
+      const method = methodsById.get(methodId);
+      return method ? [method] : [];
+    });
+    const readOnlyMethodCount = areaMethods.filter((method) => {
+      const verb = method.http?.method?.toUpperCase();
+      return verb === 'GET' || verb === 'HEAD';
+    }).length;
+    const mutatingMethodCount = areaMethods.filter((method) => {
+      const verb = method.http?.method?.toUpperCase();
+      return Boolean(verb) && verb !== 'GET' && verb !== 'HEAD';
+    }).length;
+    const authenticatedMethodCount = areaMethods.filter((method) => method.access === 'authenticated').length;
+    const dangerousMethodIds = areaMethods
+      .filter((method) => method.dangerous === true)
+      .map((method) => method.id);
     const requiredCount = requirement.requiredMethodIds.length + requirement.requiredAgentRoutes.length;
     const presentRequiredCount = presentRequiredMethodIds.length
       + agentRoutes.filter((route) => route.coverage === 'ready').length;
@@ -423,6 +450,12 @@ export function buildDaemonCapabilityAuditAreas(
       presentOptionalMethodIds,
       missingOptionalMethodIds,
       agentRoutes,
+      routeRisk: {
+        readOnlyMethodCount,
+        mutatingMethodCount,
+        authenticatedMethodCount,
+        dangerousMethodIds,
+      },
       next: requirement.next,
     };
   });
@@ -472,7 +505,7 @@ export async function fetchLiveDaemonCapabilityAudit(
       defaultKnowledgeFallback: false,
       homeGraphFallback: false,
       warnings,
-      areas: buildDaemonCapabilityAuditAreas(methodIds, agentKnowledge.ok),
+      areas: buildDaemonCapabilityAuditAreas(methodIds, agentKnowledge.ok, methodSummaries),
     };
   } catch (error) {
     return failureFromThrown(error, connection, daemonVersion === 'unknown' ? DAEMON_STATUS_ROUTE : DAEMON_METHOD_CATALOG_ROUTE);
@@ -528,6 +561,10 @@ export function renderDaemonCapabilityAudit(
       lines.push(`  optional methods: ${area.presentOptionalMethodIds.length}/${optionalTotal}`);
       if (area.missingOptionalMethodIds.length > 0) lines.push(`  missing optional: ${area.missingOptionalMethodIds.join(', ')}`);
     }
+    lines.push(`  route risk: ${area.routeRisk.readOnlyMethodCount} read-only; ${area.routeRisk.mutatingMethodCount} mutating; ${area.routeRisk.dangerousMethodIds.length} dangerous; ${area.routeRisk.authenticatedMethodCount} authenticated`);
+    if (area.routeRisk.dangerousMethodIds.length > 0) {
+      lines.push(`  dangerous methods: ${area.routeRisk.dangerousMethodIds.join(', ')}`);
+    }
     for (const route of area.agentRoutes) lines.push(`  route: ${route.route} [${route.coverage}]`);
     lines.push(`  next: ${area.next.join(' | ')}`);
     lines.push('');

package/src/version.ts

@@ -6,7 +6,7 @@ import { join } from 'node:path';
 // The prebuild script updates the fallback value before compilation.
 // Uses import.meta.dir (Bun) to locate package.json relative to this file,
 // which is correct regardless of the process working directory.
-let _version = '0.1.42';
+let _version = '0.1.43';
 let _sdkVersion = '0.33.35';
 try {
   const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', 'package.json'), 'utf-8')) as {