@pellux/goodvibes-agent 0.1.47 → 0.1.49

package/src/input/agent-workspace.ts

@@ -5,18 +5,29 @@ import { AgentPersonaRegistry } from '../agent/persona-registry.ts';
 import { AgentRoutineRegistry } from '../agent/routine-registry.ts';
 import { AgentSkillRegistry } from '../agent/skill-registry.ts';
 import { getAgentRuntimeProfilesRoot, listAgentRuntimeProfiles, listAgentRuntimeProfileTemplates } from '../agent/runtime-profile.ts';
+import {
+  buildAgentWorkspaceChannels,
+  type AgentWorkspaceChannelStatus,
+} from './agent-workspace-channels.ts';
+import {
+  buildAgentWorkspaceSetupChecklist,
+  type AgentWorkspaceSetupChecklistItem,
+} from './agent-workspace-setup.ts';
+
+export type { AgentWorkspaceChannelRisk, AgentWorkspaceChannelStatus } from './agent-workspace-channels.ts';
 
 export const AGENT_WORKSPACE_MODAL_NAME = 'agentWorkspace';
 
 export type AgentWorkspaceFocusPane = 'categories' | 'actions';
 
-export type AgentWorkspaceActionKind = 'command' | 'guidance';
+export type AgentWorkspaceActionKind = 'command' | 'guidance' | 'workspace';
 
 export interface AgentWorkspaceAction {
   readonly id: string;
   readonly label: string;
   readonly detail: string;
   readonly command?: string;
+  readonly targetCategoryId?: string;
   readonly kind: AgentWorkspaceActionKind;
   readonly safety: 'safe' | 'read-only' | 'delegates' | 'blocked';
 }
@@ -32,20 +43,6 @@ export interface AgentWorkspaceCategory {
 
 export type AgentWorkspaceCommandDispatcher = (command: string) => void;
 
-export type AgentWorkspaceChannelRisk = 'dm' | 'group' | 'public' | 'webhook' | 'bridge';
-
-export interface AgentWorkspaceChannelStatus {
-  readonly id: string;
-  readonly label: string;
-  readonly enabled: boolean;
-  readonly ready: boolean;
-  readonly missingConfigCount: number;
-  readonly defaultTarget: 'configured' | 'missing' | 'not-required';
-  readonly delivery: 'disabled' | 'blocked' | 'explicit-target' | 'default-ready';
-  readonly risk: AgentWorkspaceChannelRisk;
-  readonly riskLabel: string;
-}
-
 export type AgentWorkspaceActionResultKind = 'guidance' | 'blocked' | 'dispatched' | 'refreshed' | 'error';
 
 export interface AgentWorkspaceActionResult {
@@ -100,139 +97,10 @@ export interface AgentWorkspaceRuntimeSnapshot {
   readonly runtimeStarterTemplateCount: number;
   readonly localStarterTemplateCount: number;
   readonly configProfileCount: number;
+  readonly setupChecklist: readonly AgentWorkspaceSetupChecklistItem[];
   readonly warnings: readonly string[];
 }
 
-interface AgentWorkspaceChannelSpec {
-  readonly id: string;
-  readonly label: string;
-  readonly enabledKey: string;
-  readonly requiredKeys: readonly string[];
-  readonly defaultTargetKeys: readonly string[];
-  readonly risk: AgentWorkspaceChannelRisk;
-  readonly riskLabel: string;
-}
-
-const AGENT_WORKSPACE_CHANNEL_SPECS: readonly AgentWorkspaceChannelSpec[] = [
-  {
-    id: 'slack',
-    label: 'Slack',
-    enabledKey: 'surfaces.slack.enabled',
-    requiredKeys: ['surfaces.slack.botToken', 'surfaces.slack.signingSecret'],
-    defaultTargetKeys: ['surfaces.slack.defaultChannel'],
-    risk: 'group',
-    riskLabel: 'workspace/group channel',
-  },
-  {
-    id: 'discord',
-    label: 'Discord',
-    enabledKey: 'surfaces.discord.enabled',
-    requiredKeys: ['surfaces.discord.botToken', 'surfaces.discord.publicKey', 'surfaces.discord.applicationId'],
-    defaultTargetKeys: ['surfaces.discord.defaultChannelId'],
-    risk: 'group',
-    riskLabel: 'server/channel delivery',
-  },
-  {
-    id: 'telegram',
-    label: 'Telegram',
-    enabledKey: 'surfaces.telegram.enabled',
-    requiredKeys: ['surfaces.telegram.botToken'],
-    defaultTargetKeys: ['surfaces.telegram.defaultChatId'],
-    risk: 'dm',
-    riskLabel: 'bot DM/group delivery',
-  },
-  {
-    id: 'ntfy',
-    label: 'ntfy',
-    enabledKey: 'surfaces.ntfy.enabled',
-    requiredKeys: ['surfaces.ntfy.baseUrl', 'surfaces.ntfy.chatTopic', 'surfaces.ntfy.agentTopic'],
-    defaultTargetKeys: ['surfaces.ntfy.topic'],
-    risk: 'public',
-    riskLabel: 'topic-based public/private feed',
-  },
-  {
-    id: 'googleChat',
-    label: 'Google Chat',
-    enabledKey: 'surfaces.googleChat.enabled',
-    requiredKeys: ['surfaces.googleChat.webhookUrl', 'surfaces.googleChat.verificationToken'],
-    defaultTargetKeys: ['surfaces.googleChat.spaceId'],
-    risk: 'group',
-    riskLabel: 'space delivery',
-  },
-  {
-    id: 'signal',
-    label: 'Signal',
-    enabledKey: 'surfaces.signal.enabled',
-    requiredKeys: ['surfaces.signal.bridgeUrl', 'surfaces.signal.account'],
-    defaultTargetKeys: ['surfaces.signal.defaultRecipient'],
-    risk: 'bridge',
-    riskLabel: 'private bridge delivery',
-  },
-  {
-    id: 'whatsapp',
-    label: 'WhatsApp',
-    enabledKey: 'surfaces.whatsapp.enabled',
-    requiredKeys: ['surfaces.whatsapp.accessToken', 'surfaces.whatsapp.verifyToken', 'surfaces.whatsapp.phoneNumberId'],
-    defaultTargetKeys: ['surfaces.whatsapp.defaultRecipient'],
-    risk: 'dm',
-    riskLabel: 'phone-number delivery',
-  },
-  {
-    id: 'imessage',
-    label: 'iMessage',
-    enabledKey: 'surfaces.imessage.enabled',
-    requiredKeys: ['surfaces.imessage.bridgeUrl', 'surfaces.imessage.account'],
-    defaultTargetKeys: ['surfaces.imessage.defaultChatId'],
-    risk: 'bridge',
-    riskLabel: 'Apple bridge delivery',
-  },
-  {
-    id: 'bluebubbles',
-    label: 'BlueBubbles',
-    enabledKey: 'surfaces.bluebubbles.enabled',
-    requiredKeys: ['surfaces.bluebubbles.serverUrl', 'surfaces.bluebubbles.password'],
-    defaultTargetKeys: ['surfaces.bluebubbles.defaultChatGuid'],
-    risk: 'bridge',
-    riskLabel: 'iMessage bridge delivery',
-  },
-  {
-    id: 'msteams',
-    label: 'Microsoft Teams',
-    enabledKey: 'surfaces.msteams.enabled',
-    requiredKeys: ['surfaces.msteams.appId', 'surfaces.msteams.appPassword'],
-    defaultTargetKeys: ['surfaces.msteams.defaultConversationId', 'surfaces.msteams.defaultChannelId'],
-    risk: 'group',
-    riskLabel: 'tenant/channel delivery',
-  },
-  {
-    id: 'mattermost',
-    label: 'Mattermost',
-    enabledKey: 'surfaces.mattermost.enabled',
-    requiredKeys: ['surfaces.mattermost.baseUrl', 'surfaces.mattermost.botToken'],
-    defaultTargetKeys: ['surfaces.mattermost.defaultChannelId'],
-    risk: 'group',
-    riskLabel: 'team/channel delivery',
-  },
-  {
-    id: 'matrix',
-    label: 'Matrix',
-    enabledKey: 'surfaces.matrix.enabled',
-    requiredKeys: ['surfaces.matrix.homeserverUrl', 'surfaces.matrix.accessToken'],
-    defaultTargetKeys: ['surfaces.matrix.defaultRoomId'],
-    risk: 'group',
-    riskLabel: 'room delivery',
-  },
-  {
-    id: 'webhook',
-    label: 'Webhook',
-    enabledKey: 'surfaces.webhook.enabled',
-    requiredKeys: ['surfaces.webhook.defaultTarget'],
-    defaultTargetKeys: ['surfaces.webhook.defaultTarget'],
-    risk: 'webhook',
-    riskLabel: 'external HTTP delivery',
-  },
-];
-
 function readConfigString(context: CommandContext, key: string, fallback: string): string {
   try {
     const configManager = context.platform?.configManager as unknown as AgentWorkspaceConfigReader | undefined;
@@ -270,48 +138,6 @@ function readConfigBoolean(context: CommandContext, key: string, fallback: boole
   }
 }
 
-function hasConfigValue(context: CommandContext, key: string): boolean {
-  try {
-    const configManager = context.platform?.configManager as unknown as AgentWorkspaceConfigReader | undefined;
-    const value = configManager?.get(key);
-    if (typeof value === 'string') return value.trim().length > 0;
-    if (typeof value === 'number') return Number.isFinite(value);
-    if (typeof value === 'boolean') return value;
-    return value !== null && value !== undefined;
-  } catch {
-    return false;
-  }
-}
-
-function buildChannelStatus(context: CommandContext, spec: AgentWorkspaceChannelSpec): AgentWorkspaceChannelStatus {
-  const enabled = readConfigBoolean(context, spec.enabledKey, false);
-  const missingConfigCount = spec.requiredKeys.filter((key) => !hasConfigValue(context, key)).length;
-  const defaultTarget = spec.defaultTargetKeys.length === 0
-    ? 'not-required'
-    : spec.defaultTargetKeys.some((key) => hasConfigValue(context, key))
-      ? 'configured'
-      : 'missing';
-  const ready = enabled && missingConfigCount === 0;
-  const delivery = !enabled
-    ? 'disabled'
-    : !ready
-      ? 'blocked'
-      : defaultTarget === 'configured'
-        ? 'default-ready'
-        : 'explicit-target';
-  return {
-    id: spec.id,
-    label: spec.label,
-    enabled,
-    ready,
-    missingConfigCount,
-    defaultTarget,
-    delivery,
-    risk: spec.risk,
-    riskLabel: spec.riskLabel,
-  };
-}
-
 function inferActiveRuntimeProfile(homeDirectory: string): string {
   const marker = `${sep}.goodvibes${sep}agent${sep}profile-homes${sep}`;
   return homeDirectory.includes(marker) ? basename(homeDirectory) : '(default home)';
@@ -408,6 +234,24 @@ export function buildAgentWorkspaceRuntimeSnapshot(context: CommandContext): Age
   const ttsVoice = readConfigString(context, 'tts.voice', '(voice default)');
   const ttsLlmProvider = readConfigString(context, 'tts.llmProvider', '');
   const ttsLlmModel = readConfigString(context, 'tts.llmModel', '');
+  const daemonBaseUrl = `http://${host}:${port}`;
+  const channels = buildAgentWorkspaceChannels(context);
+  const setupChecklist = buildAgentWorkspaceSetupChecklist({
+    provider,
+    model,
+    daemonBaseUrl,
+    sessionMemoryCount,
+    routineCount: routineSnapshot.count,
+    enabledRoutineCount: routineSnapshot.enabled,
+    skillCount: skillSnapshot.count,
+    enabledSkillCount: skillSnapshot.enabled,
+    activePersonaName: personaSnapshot.activeName,
+    readyChannelCount: channels.filter((channel) => channel.ready).length,
+    voiceProviderCount: voiceProviders.length,
+    mediaProviderCount: mediaProviders.length,
+    runtimeProfileCount: runtimeProfiles.length,
+    runtimeStarterTemplateCount: runtimeStarterTemplates.length,
+  });
 
   return {
     provider,
@@ -416,7 +260,7 @@ export function buildAgentWorkspaceRuntimeSnapshot(context: CommandContext): Age
     sessionId: context.session?.runtime?.sessionId ?? 'unknown',
     workingDirectory: context.workspace?.shellPaths?.workingDirectory ?? 'unavailable',
     homeDirectory: context.workspace?.shellPaths?.homeDirectory ?? 'unavailable',
-    daemonBaseUrl: `http://${host}:${port}`,
+    daemonBaseUrl,
     daemonOwnership: 'external',
     sessionMemoryCount,
     localRoutineCount: routineSnapshot.count,
@@ -429,7 +273,7 @@ export function buildAgentWorkspaceRuntimeSnapshot(context: CommandContext): Age
     knowledgeIsolation: 'agent-only',
     executionPolicy: 'serial-proactive',
     wrfcPolicy: 'explicit-build-delegation-only',
-    channels: AGENT_WORKSPACE_CHANNEL_SPECS.map((spec) => buildChannelStatus(context, spec)),
+    channels,
     voiceProviderCount: voiceProviders.length,
     voiceStreamingProviderCount: voiceProviders.filter((entry) => entry.capabilities.includes('tts-stream')).length,
     voiceSttProviderCount: voiceProviders.filter((entry) => entry.capabilities.includes('stt')).length,
@@ -449,6 +293,7 @@ export function buildAgentWorkspaceRuntimeSnapshot(context: CommandContext): Age
     runtimeStarterTemplateCount: runtimeStarterTemplates.length,
     localStarterTemplateCount: runtimeStarterTemplates.filter((template) => template.source === 'local').length,
     configProfileCount,
+    setupChecklist,
     warnings,
   };
 }
@@ -463,6 +308,11 @@ export const AGENT_WORKSPACE_CATEGORIES: readonly AgentWorkspaceCategory[] = [
     actions: [
       { id: 'chat', label: 'Continue assistant chat', detail: 'Close this workspace and type a normal message. Agent work stays serial in the main conversation.', kind: 'guidance', safety: 'safe' },
       { id: 'model', label: 'Choose model', detail: 'Open the model/provider workspace for the Agent chat route.', command: '/model', kind: 'command', safety: 'safe' },
+      { id: 'setup-home', label: 'Setup checklist', detail: 'Jump to the first-run checklist for provider, knowledge, personas, skills, routines, memory, channels, and voice/media.', targetCategoryId: 'setup', kind: 'workspace', safety: 'safe' },
+      { id: 'knowledge-home', label: 'Agent Knowledge', detail: 'Jump to isolated Agent Knowledge status, ingest, search, and review flows.', targetCategoryId: 'knowledge', kind: 'workspace', safety: 'read-only' },
+      { id: 'memory-home', label: 'Memory, skills, routines', detail: 'Jump to local memory, persona, skill, and routine setup. These are core Agent product features.', targetCategoryId: 'memory', kind: 'workspace', safety: 'safe' },
+      { id: 'channels-home', label: 'Channels', detail: 'Jump to companion pairing and channel readiness without changing daemon lifecycle.', targetCategoryId: 'channels', kind: 'workspace', safety: 'read-only' },
+      { id: 'voice-home', label: 'Voice and media', detail: 'Jump to voice, TTS, image input, browser, and node posture setup.', targetCategoryId: 'voice-media', kind: 'workspace', safety: 'safe' },
       { id: 'help', label: 'Browse commands', detail: 'Open registry-driven command help.', command: '/help', kind: 'command', safety: 'safe' },
       { id: 'health', label: 'Review health', detail: 'Show the local health review surface without starting or mutating daemon services.', command: '/health review', kind: 'command', safety: 'read-only' },
     ],
@@ -476,28 +326,19 @@ export const AGENT_WORKSPACE_CATEGORIES: readonly AgentWorkspaceCategory[] = [
     actions: [
       { id: 'config', label: 'Open config workspace', detail: 'Use the TUI-derived fullscreen settings workspace.', command: '/config', kind: 'command', safety: 'safe' },
       { id: 'onboarding', label: 'Open setup wizard', detail: 'Review Agent runtime settings in the fullscreen setup flow.', command: '/onboarding', kind: 'command', safety: 'safe' },
+      { id: 'setup-provider-model', label: 'Provider and model', detail: 'Choose the provider/model route for normal assistant chat.', command: '/model', kind: 'command', safety: 'safe' },
+      { id: 'setup-agent-knowledge', label: 'Agent Knowledge', detail: 'Inspect the isolated Agent Knowledge store before ingesting source-backed material.', command: '/knowledge status', kind: 'command', safety: 'read-only' },
+      { id: 'setup-runtime-profiles', label: 'Runtime profiles', detail: 'Browse starter templates for isolated Agent homes and operator identities.', command: '/agent-profile templates', kind: 'command', safety: 'read-only' },
+      { id: 'setup-personas', label: 'Personas', detail: 'Create or select the active local Agent persona.', command: '/personas', kind: 'command', safety: 'safe' },
+      { id: 'setup-skills', label: 'Skills', detail: 'Create, review, and enable reusable local Agent skills.', command: '/agent-skills', kind: 'command', safety: 'safe' },
+      { id: 'setup-routines', label: 'Routines', detail: 'Create, review, and enable local Agent routines before any explicit schedule promotion.', command: '/routines', kind: 'command', safety: 'safe' },
+      { id: 'setup-memory', label: 'Local memory', detail: 'Inspect local/session memory; secrets stay rejected or redacted.', command: '/memory', kind: 'command', safety: 'read-only' },
+      { id: 'setup-channels', label: 'Channels', detail: 'Open companion pairing and channel readiness setup.', command: '/pair', kind: 'command', safety: 'safe' },
+      { id: 'setup-voice-media', label: 'Voice and media', detail: 'Open TTS/media settings for voice and image-capable Agent flows.', command: '/config tts', kind: 'command', safety: 'safe' },
       { id: 'provider', label: 'Provider status', detail: 'Review provider/model posture.', command: '/provider', kind: 'command', safety: 'read-only' },
       { id: 'auth', label: 'Auth review', detail: 'Review authentication posture without printing token values.', command: '/auth review', kind: 'command', safety: 'read-only' },
     ],
   },
-  {
-    id: 'capabilities',
-    group: 'SETUP',
-    label: 'Capabilities',
-    summary: 'OpenClaw/Hermes benchmark and live daemon coverage.',
-    detail: 'Use this area to measure both layers: what GoodVibes Agent makes usable, and what the externally owned GoodVibes daemon actually exposes through public routes. Agent Knowledge is checked only through /api/goodvibes-agent/knowledge/*.',
-    actions: [
-      { id: 'capabilities-benchmark', label: 'Benchmark report', detail: 'Show the OpenClaw/Hermes parity benchmark with Agent posture, setup commands, usage paths, and remaining product gaps.', command: '/capabilities', kind: 'command', safety: 'read-only' },
-      { id: 'capabilities-daemon', label: 'Live daemon audit', detail: 'Inspect the public daemon method catalog plus isolated Agent Knowledge route coverage. Does not query default Knowledge/Wiki or HomeGraph.', command: '/capabilities daemon', kind: 'command', safety: 'read-only' },
-      { id: 'capabilities-daemon-gaps', label: 'Daemon gap plan', detail: 'Classify live daemon coverage into platform gaps, Agent route gaps, route-risk reviews, and Agent UX work without querying default Knowledge/Wiki or HomeGraph.', command: '/capabilities daemon gaps', kind: 'command', safety: 'read-only' },
-      { id: 'capabilities-daemon-risk', label: 'Route risk review', detail: 'Inspect daemon read-only, mutating, dangerous, and authenticated route metadata for approval-center planning.', command: '/capabilities daemon risk', kind: 'command', safety: 'read-only' },
-      { id: 'capabilities-daemon-inventory', label: 'Full method inventory', detail: 'List every public daemon method by category, HTTP posture, access, and dangerous flag without querying default Knowledge/Wiki or HomeGraph.', command: '/capabilities daemon inventory', kind: 'command', safety: 'read-only' },
-      { id: 'capabilities-daemon-coverage', label: 'UX coverage matrix', detail: 'Map every public daemon method to Agent UX coverage: usable, read-only, explicit confirmation, blocked, or not surfaced.', command: '/capabilities daemon coverage', kind: 'command', safety: 'read-only' },
-      { id: 'capabilities-daemon-knowledge', label: 'Knowledge coverage', detail: 'Filter the live daemon audit to the isolated Agent Knowledge segment.', command: '/capabilities daemon knowledge', kind: 'command', safety: 'read-only' },
-      { id: 'capabilities-daemon-channels', label: 'Channel coverage', detail: 'Filter the live daemon audit to channel and delivery gateway route coverage.', command: '/capabilities daemon channels', kind: 'command', safety: 'read-only' },
-      { id: 'capabilities-daemon-automation', label: 'Automation coverage', detail: 'Filter the live daemon audit to automation, schedule, run, and capacity route coverage.', command: '/capabilities daemon automation', kind: 'command', safety: 'read-only' },
-    ],
-  },
   {
     id: 'channels',
     group: 'SETUP',
@@ -532,7 +373,7 @@ export const AGENT_WORKSPACE_CATEGORIES: readonly AgentWorkspaceCategory[] = [
     group: 'SETUP',
     label: 'Voice, Media & Nodes',
     summary: 'Voice, TTS, image input, browser surface, and node/remote posture.',
-    detail: 'Hermes and OpenClaw expose voice, media, browser, and node surfaces as first-class operator capabilities. Agent uses the GoodVibes voice/media/provider/browser/remote bones while keeping daemon ownership external and side effects explicit.',
+    detail: 'Voice, media, browser, and node surfaces are first-class operator surfaces. Agent uses the GoodVibes voice/media/provider/browser/remote bones while keeping daemon ownership external and side effects explicit.',
     actions: [
       { id: 'tts-config', label: 'Configure live TTS', detail: 'Open the TUI-derived config workspace at the TTS settings group.', command: '/config tts', kind: 'command', safety: 'safe' },
       { id: 'tts-provider', label: 'Choose TTS provider', detail: 'Open provider/model routing for spoken responses through the settings flow.', command: '/config tts.provider', kind: 'command', safety: 'safe' },
@@ -548,7 +389,7 @@ export const AGENT_WORKSPACE_CATEGORIES: readonly AgentWorkspaceCategory[] = [
     group: 'SETUP',
     label: 'Profiles & Portability',
     summary: 'Isolated Agent homes, config profiles, and setup bundles.',
-    detail: 'Hermes profiles isolate agent state. GoodVibes Agent exposes named runtime homes, config profile pickers, profile-sync bundles, setup transfer bundles, and support bundles while keeping the daemon external.',
+    detail: 'Profiles isolate agent state. GoodVibes Agent exposes named runtime homes, config profile pickers, profile-sync bundles, setup transfer bundles, and support bundles while keeping the daemon external.',
     actions: [
       { id: 'profiles-open', label: 'Open config profiles', detail: 'Open the TUI-derived config profile picker for display/provider/behavior profile files.', command: '/profiles', kind: 'command', safety: 'safe' },
       { id: 'runtime-profile-guide', label: 'Starter authoring guide', detail: 'Open the Agent-local starter authoring flow inside the TUI command surface.', command: '/agent-profile guide', kind: 'command', safety: 'safe' },
@@ -584,7 +425,6 @@ export const AGENT_WORKSPACE_CATEGORIES: readonly AgentWorkspaceCategory[] = [
       { id: 'workplan', label: 'Open work plan', detail: 'Open the workspace-scoped work plan panel.', command: '/workplan panel', kind: 'command', safety: 'read-only' },
       { id: 'workplan-list', label: 'List work plan', detail: 'Print a concise work plan summary.', command: '/workplan list', kind: 'command', safety: 'read-only' },
       { id: 'approvals', label: 'Review approvals', detail: 'Open/read approval posture. This workspace does not approve or deny requests.', command: '/approval open', kind: 'command', safety: 'read-only' },
-      { id: 'approval-risk', label: 'Route risk review', detail: 'Inspect daemon route risk and dangerous method metadata without approving, denying, or mutating requests.', command: '/approval risk', kind: 'command', safety: 'read-only' },
     ],
   },
   {
@@ -741,6 +581,31 @@ export class AgentWorkspace {
     const action = this.selectedAction;
     if (!action) return;
     if (action.kind === 'guidance' || !action.command) {
+      if (action.kind === 'workspace' && action.targetCategoryId) {
+        const targetIndex = this.categories.findIndex((category) => category.id === action.targetCategoryId);
+        if (targetIndex >= 0) {
+          this.selectedCategoryIndex = targetIndex;
+          this.selectedActionIndex = 0;
+          this.focusActions();
+          this.status = `Opened ${this.selectedCategory.label}.`;
+          this.lastActionResult = {
+            kind: 'refreshed',
+            title: `Opened ${this.selectedCategory.label}`,
+            detail: action.detail,
+            safety: action.safety,
+          };
+          this.clampSelection();
+          return;
+        }
+        this.status = `Workspace area unavailable: ${action.targetCategoryId}.`;
+        this.lastActionResult = {
+          kind: 'error',
+          title: 'Workspace area unavailable',
+          detail: `No Agent workspace category exists for ${action.targetCategoryId}.`,
+          safety: action.safety,
+        };
+        return;
+      }
       this.status = action.detail;
       this.lastActionResult = {
         kind: 'guidance',

package/src/input/commands/experience-runtime.ts

@@ -4,13 +4,6 @@ import type { CommandRegistry } from '../command-registry.ts';
 import { requirePanelManager, requireShellPaths } from './runtime-services.ts';
 import { requireYesFlag, stripYesFlag } from './confirmation.ts';
 import { resolveAgentDaemonConnection } from '../../agent/routine-schedule-promotion.ts';
-import {
-  buildDaemonCapabilityRouteRiskReport,
-  fetchLiveDaemonCapabilityAudit,
-  filterDaemonCapabilityRouteRiskAreas,
-  renderDaemonCapabilityFailure,
-  renderDaemonCapabilityRouteRisk,
-} from '../../operator/daemon-capability-audit.ts';
 
 interface VoiceBundle {
   readonly version: 1;
@@ -186,7 +179,7 @@ export function registerExperienceRuntimeCommands(registry: CommandRegistry): vo
     name: 'approval',
     aliases: ['approvals'],
     description: 'Review action-specific approval classes and the specialized security UX matrix',
-    usage: '[matrix|risk|review <kind>]',
+    usage: '[matrix|review <kind>]',
     async handler(args, ctx) {
       const sub = (args[0] ?? 'matrix').toLowerCase();
       if (sub === 'open' || sub === 'panel') {
@@ -213,25 +206,9 @@ export function registerExperienceRuntimeCommands(registry: CommandRegistry): vo
         ctx.print([
           'Approval Matrix',
           ...matrix.map(([kind, summary]) => `  ${kind.padEnd(10)} ${summary}`),
-          '',
-          'Live daemon route risk: /approval risk',
         ].join('\n'));
         return;
       }
-      if (sub === 'risk' || sub === 'route-risk') {
-        const shellPaths = requireShellPaths(ctx);
-        const connection = resolveAgentDaemonConnection(ctx.platform.configManager, shellPaths.homeDirectory);
-        const audit = await fetchLiveDaemonCapabilityAudit(connection);
-        if (!audit.ok) {
-          ctx.print(renderDaemonCapabilityFailure(audit));
-          return;
-        }
-        const report = buildDaemonCapabilityRouteRiskReport(audit);
-        const query = args.slice(1).join(' ').trim() || undefined;
-        const areas = filterDaemonCapabilityRouteRiskAreas(report.areas, query);
-        ctx.print(renderDaemonCapabilityRouteRisk(report, areas));
-        return;
-      }
       if (sub === 'review') {
         const kind = (args[1] ?? '').toLowerCase();
         const entry = matrix.find(([id]) => id === kind);
@@ -246,7 +223,7 @@ export function registerExperienceRuntimeCommands(registry: CommandRegistry): vo
         ].join('\n'));
         return;
       }
-      ctx.print('Usage: /approval [open|matrix|risk|review <kind>]');
+      ctx.print('Usage: /approval [open|matrix|review <kind>]');
     },
   });
 

package/src/input/commands/remote-runtime.ts

@@ -46,7 +46,7 @@ export function registerRemoteRuntimeCommands(registry: CommandRegistry): void {
     name: 'remote',
     aliases: [],
     description: 'Inspect, dispatch, and review self-hosted remote runners and artifacts',
-    usage: '[list | show [agentId] | supervisor [runnerId] | capabilities [runnerId] | recover [runnerId] | setup [export <path> --yes] | env [export <path> --yes] | tunnel [review|export <path> --yes] | bootstrap [export <path> --yes|inspect <path>] | session <export|inspect|import> <path> [--yes] | pool <list|show|create|assign|unassign> ... | dispatch [template] <description> | dispatch-pool <pool> [template] <description> | contract [agentId] | cancel <agentId> | export <agentId> [path] --yes | artifact list | artifact show <id> | artifact export <id> [path] --yes | review <id> | rerun-local <id> | import <path> --yes]',
+    usage: '[list | show [agentId] | supervisor [runnerId] | support [runnerId] | recover [runnerId] | setup [export <path> --yes] | env [export <path> --yes] | tunnel [review|export <path> --yes] | bootstrap [export <path> --yes|inspect <path>] | session <export|inspect|import> <path> [--yes] | pool <list|show|create|assign|unassign> ... | dispatch [template] <description> | dispatch-pool <pool> [template] <description> | contract [agentId] | cancel <agentId> | export <agentId> [path] --yes | artifact list | artifact show <id> | artifact export <id> [path] --yes | review <id> | rerun-local <id> | import <path> --yes]',
     async handler(args, ctx) {
       if (args.length === 0) {
         if (ctx.openRemotePanel) {
@@ -131,7 +131,7 @@ export function registerRemoteRuntimeCommands(registry: CommandRegistry): void {
           `  messageCount: ${selected.messageCount}`,
           `  errorCount: ${selected.errorCount}`,
           ...(selected.lastError ? [`  lastError: ${selected.lastError}`] : []),
-          '  capabilities:',
+          '  runner support:',
           ...selected.capabilities.map((capability) => `    ${capability.id}: ${capability.supported ? 'yes' : 'no'} (${capability.detail})`),
           '  recovery:',
           ...selected.recovery.map((action) => `    ${action.command} — ${action.reason}`),
@@ -139,7 +139,7 @@ export function registerRemoteRuntimeCommands(registry: CommandRegistry): void {
         return;
       }
 
-      if (subcommand === 'capabilities') {
+      if (subcommand === 'support') {
         const snapshot = peerSnapshot.supervisor;
         const runnerId = args[1];
         const selected = runnerId
@@ -150,14 +150,14 @@ export function registerRemoteRuntimeCommands(registry: CommandRegistry): void {
           return;
         }
         ctx.print([
-          `Remote Capabilities ${selected.runnerId}`,
+          `Remote Support ${selected.runnerId}`,
           `  label: ${selected.label}`,
           `  transport: ${selected.transportState}`,
           `  executionProtocol: ${selected.negotiation.executionProtocol}`,
           `  reviewMode: ${selected.negotiation.reviewMode}`,
           `  communicationLane: ${selected.negotiation.communicationLane}`,
           `  trustClass: ${selected.negotiation.trustClass}`,
-          '  capabilities:',
+          '  runner support:',
           ...selected.capabilities.map((capability) => (
             `    ${capability.id}: ${capability.supported ? 'supported' : 'missing'} — ${capability.detail}`
           )),

package/src/input/commands.ts

@@ -59,7 +59,6 @@ import { registerDelegationRuntimeCommands } from './commands/delegation-runtime
 import { registerPersonasRuntimeCommands } from './commands/personas-runtime.ts';
 import { registerAgentSkillsRuntimeCommands } from './commands/agent-skills-runtime.ts';
 import { registerRoutinesRuntimeCommands } from './commands/routines-runtime.ts';
-import { registerCapabilitiesRuntimeCommands } from './commands/capabilities-runtime.ts';
 
 /**
  * registerBuiltinCommands - Register all built-in slash commands into the registry.
@@ -69,7 +68,6 @@ export function registerBuiltinCommands(registry: CommandRegistry): void {
   registerShellCoreCommands(registry);
   registerAgentWorkspaceRuntimeCommands(registry);
   registerAgentRuntimeProfileRuntimeCommands(registry);
-  registerCapabilitiesRuntimeCommands(registry);
   registerPersonasRuntimeCommands(registry);
   registerAgentSkillsRuntimeCommands(registry);
   registerRoutinesRuntimeCommands(registry);

package/src/input/onboarding/onboarding-wizard-steps.ts

@@ -114,7 +114,7 @@ export function buildCapabilitiesStep(controller: OnboardingWizardController): O
         kind: 'action',
         id: 'capabilities.select-all',
         action: 'select-all-capabilities',
-        label: 'Review external-daemon capabilities',
+        label: 'Review external-daemon surfaces',
         hint: 'Review browser, LAN, webhooks/events, and external app surfaces without letting Agent own daemon lifecycle.',
         defaultValue: 'Action',
       },
@@ -123,17 +123,17 @@ export function buildCapabilitiesStep(controller: OnboardingWizardController): O
         id: 'capabilities.clear',
         action: 'clear-capabilities',
         label: 'Keep Agent local-only',
-        hint: 'Clear external-daemon capabilities and keep Agent work in this terminal conversation.',
+        hint: 'Clear external-daemon surfaces and keep Agent work in this terminal conversation.',
         defaultValue: 'Action',
       },
     ];
 
     return {
       id: 'capabilities',
-      title: 'Choose GoodVibes capabilities',
+      title: 'Choose GoodVibes surfaces',
       shortLabel: 'Capabilities',
-      description: 'Choose what Agent should prepare locally. Daemon-backed capabilities are reviewed as external dependencies; Agent does not enable service mode or autostart.',
-      summaryTitle: 'Selected capabilities',
+      description: 'Choose what Agent should prepare locally. Daemon-backed surfaces are reviewed as external dependencies; Agent does not enable service mode or autostart.',
+      summaryTitle: 'Selected surfaces',
       summaryLines: [
         `${selectedCount}/${capabilities.length} option(s) selected`,
         `Mode: ${controller.mode === 'edit' ? 'edit existing shell state' : controller.mode === 'reopen' ? 'reopen review flow' : 'new setup'}`,
@@ -327,7 +327,7 @@ export function buildExternalServicesStep(controller: OnboardingWizardController
         id: 'external-services.clear',
         action: 'clear-external-surfaces',
         label: 'Clear all external surfaces',
-        hint: 'Hide all external surface setup screens. The HTTP listener can still be enabled separately by webhook/event capabilities.',
+        hint: 'Hide all external surface setup screens. The HTTP listener can still be enabled separately by webhook/event settings.',
         defaultValue: 'Action',
       },
       {
@@ -705,7 +705,7 @@ export function buildAccountsStep(controller: OnboardingWizardController): Onboa
             ? 'An existing local auth admin user was detected and will be kept.'
             : controller.hasLocalAuthUser()
               ? 'Existing local auth users were detected and will be kept.'
-              : 'No server-backed capability is selected, so local auth is not required.',
+              : 'No server-backed surface is selected, so local auth is not required.',
         defaultValue: needsAuthBootstrap
           ? controller.hasBootstrapCredentialPresent() ? 'Bootstrap replacement required' : 'Local admin required'
           : controller.hasAdminAuthUser() ? 'Admin detected' : controller.hasLocalAuthUser() ? 'Local auth detected' : 'Not required',

package/src/panels/builtin/knowledge.ts

@@ -6,14 +6,14 @@ import type { ResolvedBuiltinPanelDeps } from './shared.ts';
 export function registerKnowledgePanels(manager: PanelManager, deps: ResolvedBuiltinPanelDeps): void {
   if (!deps.memoryRegistry) return;
 
-  const { memoryRegistry } = deps;
+  const { agentKnowledgeService, memoryRegistry } = deps;
   manager.registerType({
     id: 'knowledge',
     name: 'Knowledge',
     icon: 'K',
     category: 'agent',
-    description: 'Structured project knowledge: risks, runbooks, architecture notes, incidents, and durable facts',
-    factory: () => new KnowledgePanel(memoryRegistry),
+    description: 'Isolated Agent Knowledge plus local non-secret memory review',
+    factory: () => new KnowledgePanel(memoryRegistry, agentKnowledgeService ?? null),
   });
   manager.registerType({
     id: 'memory',

package/src/panels/builtin/shared.ts

@@ -21,6 +21,7 @@ import type { SessionMemoryStore } from '@pellux/goodvibes-sdk/platform/core';
 import type { ExecutionPlanManager } from '@pellux/goodvibes-sdk/platform/core';
 import type { AdaptivePlanner } from '@pellux/goodvibes-sdk/platform/core';
 import type { ProjectPlanningService } from '@pellux/goodvibes-sdk/platform/knowledge';
+import type { KnowledgeService } from '@pellux/goodvibes-sdk/platform/knowledge';
 import type { ApiTokenAuditor } from '@pellux/goodvibes-sdk/platform/security';
 import type { ComponentHealthMonitor } from '../../runtime/perf/panel-health-monitor.ts';
 import type { WorktreeRegistry } from '@/runtime/index.ts';
@@ -65,6 +66,8 @@ export interface BuiltinPanelDeps {
   evalRegistry?: import('../eval-panel.ts').EvalRegistry;
   /** MemoryRegistry for the Memory panel. */
   memoryRegistry?: MemoryRegistry;
+  /** Isolated Agent Knowledge service for the Agent Knowledge panel. */
+  agentKnowledgeService?: Pick<KnowledgeService, 'getStatus'>;
   /** Shared policy runtime state for governance/policy diagnostics. */
   policyRuntimeState?: import('@/runtime/index.ts').PolicyRuntimeState;
   /** Approval broker for control-plane/operator panels. */