@pellux/goodvibes-agent 0.1.56 → 0.1.58

package/src/shell/service-settings-sync.ts

@@ -1,30 +1,7 @@
-import { mkdirSync } from 'node:fs';
-import { spawnSync } from 'node:child_process';
 import type { ConfigKey } from '@pellux/goodvibes-sdk/platform/config';
-import type { ManagedServiceStatus } from '@pellux/goodvibes-sdk/platform/daemon';
-import { logger, summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
-import {
-  createPlatformServiceManager,
-  getServiceStateRoot,
-  type CliServiceRuntime,
-} from '../cli/service-posture.ts';
+import type { CliServiceRuntime } from '../cli/service-posture.ts';
 
-type ManagedServiceAction = 'install' | 'uninstall' | 'start' | 'stop' | 'restart' | 'status';
-
-export interface ServiceManagerLike {
-  status(): ManagedServiceStatus;
-  install(): ManagedServiceStatus;
-  uninstall(): ManagedServiceStatus;
-  start(): ManagedServiceStatus;
-  stop(): ManagedServiceStatus;
-  restart(): ManagedServiceStatus;
-}
-
-export interface CommandResult {
-  readonly status: number | null;
-  readonly stdout?: string;
-  readonly stderr?: string;
-}
+export const AGENT_EXTERNAL_DAEMON_SERVICE_MESSAGE = 'GoodVibes Agent connects to an external daemon and does not install, start, stop, restart, or uninstall daemon services. Manage daemon lifecycle from GoodVibes TUI or your daemon host tooling.';
 
 export interface ServiceSettingsSyncChange {
   readonly key: ConfigKey;
@@ -34,240 +11,34 @@ export interface ServiceSettingsSyncChange {
 
 export interface ServiceSettingsSyncResult {
   readonly handled: boolean;
-  readonly action?: ManagedServiceAction | 'install-start' | 'disable';
-  readonly status?: ManagedServiceStatus;
+  readonly action?: 'external-daemon-blocked' | 'unchanged';
   readonly message?: string;
   readonly error?: string;
 }
 
 export interface ServiceSettingsSyncOptions {
-  readonly createManager?: (runtime: CliServiceRuntime) => ServiceManagerLike;
-  readonly runCommand?: (command: string, args: readonly string[]) => CommandResult;
-  readonly mkdir?: typeof mkdirSync;
-}
-
-const SERVICE_DEFINITION_KEYS = new Set<ConfigKey>([
-  'service.restartOnFailure',
-  'service.platform',
-  'service.serviceName',
-  'service.logPath',
-] as ConfigKey[]);
-
-function runCommand(command: string, args: readonly string[], options: ServiceSettingsSyncOptions): CommandResult {
-  if (options.runCommand) return options.runCommand(command, args);
-  return spawnSync(command, [...args], { stdio: 'pipe', encoding: 'utf-8' });
-}
-
-function commandError(result: CommandResult): string | null {
-  if ((result.status ?? 1) === 0) return null;
-  return ((result.stderr ?? '') || (result.stdout ?? '') || `command exited with ${result.status}`).trim();
-}
-
-function serviceName(runtime: CliServiceRuntime, fallback = 'goodvibes'): string {
-  return String(runtime.configManager.get('service.serviceName') ?? fallback).trim() || fallback;
-}
-
-function runSystemd(runtime: CliServiceRuntime, args: readonly string[], options: ServiceSettingsSyncOptions): string | null {
-  const result = runCommand('systemctl', ['--user', ...args], options);
-  return commandError(result);
-}
-
-function reloadSystemdIfNeeded(
-  runtime: CliServiceRuntime,
-  status: ManagedServiceStatus,
-  options: ServiceSettingsSyncOptions,
-): string | null {
-  if (status.platform !== 'systemd') return null;
-  return runSystemd(runtime, ['daemon-reload'], options);
-}
-
-function disableSystemService(
-  runtime: CliServiceRuntime,
-  manager: ServiceManagerLike,
-  options: ServiceSettingsSyncOptions,
-): ServiceSettingsSyncResult {
-  const before = manager.status();
-  let disableError: string | null = null;
-  if (before.platform === 'systemd') {
-    disableError = before.installed || before.running
-      ? runSystemd(runtime, ['disable', '--now', `${serviceName(runtime)}.service`], options)
-      : null;
-    if (disableError) {
-      logger.warn('Settings service sync: systemd disable failed', { error: disableError });
-    }
-  } else if (before.running || before.installed) {
-    const stopped = manager.stop();
-    if (stopped.actionError) {
-      return {
-        handled: true,
-        action: 'stop',
-        status: stopped,
-        message: `Service disable failed: ${stopped.actionError}`,
-        error: stopped.actionError,
-      };
-    }
-  }
-
-  const uninstalled = manager.uninstall();
-  const reloadError = reloadSystemdIfNeeded(runtime, uninstalled, options);
-  const error = uninstalled.actionError ?? reloadError ?? disableError ?? undefined;
-  return {
-    handled: true,
-    action: 'disable',
-    status: uninstalled,
-    message: error ? `Service disable failed: ${error}` : 'OS service disabled',
-    ...(error ? { error } : {}),
-  };
-}
-
-function installAndStartSystemService(
-  runtime: CliServiceRuntime,
-  manager: ServiceManagerLike,
-  options: ServiceSettingsSyncOptions,
-): ServiceSettingsSyncResult {
-  (options.mkdir ?? mkdirSync)(getServiceStateRoot(runtime), { recursive: true });
-  const installed = manager.install();
-  if (installed.actionError) {
-    return {
-      handled: true,
-      action: 'install',
-      status: installed,
-      message: `Service install failed: ${installed.actionError}`,
-      error: installed.actionError,
-    };
-  }
-
-  const reloadError = reloadSystemdIfNeeded(runtime, installed, options);
-  if (reloadError) {
-    return {
-      handled: true,
-      action: 'install',
-      status: installed,
-      message: `Service install failed: ${reloadError}`,
-      error: reloadError,
-    };
-  }
-
-  const started = manager.start();
-  const error = started.actionError ?? undefined;
-  return {
-    handled: true,
-    action: 'install-start',
-    status: started,
-    message: error ? `Service start failed: ${error}` : 'OS service installed and started',
-    ...(error ? { error } : {}),
-  };
-}
-
-function refreshInstalledSystemService(
-  runtime: CliServiceRuntime,
-  manager: ServiceManagerLike,
-  options: ServiceSettingsSyncOptions,
-): ServiceSettingsSyncResult {
-  const before = manager.status();
-  if (!before.installed && runtime.configManager.get('service.autostart') !== true) {
-    return {
-      handled: true,
-      action: 'status',
-      status: before,
-      message: 'Service setting saved',
-    };
-  }
-
-  const installed = manager.install();
-  if (installed.actionError) {
-    return {
-      handled: true,
-      action: 'install',
-      status: installed,
-      message: `Service update failed: ${installed.actionError}`,
-      error: installed.actionError,
-    };
-  }
-
-  const reloadError = reloadSystemdIfNeeded(runtime, installed, options);
-  if (reloadError) {
-    return {
-      handled: true,
-      action: 'install',
-      status: installed,
-      message: `Service update failed: ${reloadError}`,
-      error: reloadError,
-    };
-  }
-
-  const next = before.running ? manager.restart() : manager.start();
-  const error = next.actionError ?? undefined;
-  return {
-    handled: true,
-    action: before.running ? 'restart' : 'start',
-    status: next,
-    message: error ? `Service update failed: ${error}` : 'OS service updated',
-    ...(error ? { error } : {}),
-  };
+  readonly allowExternalDaemonMutation?: false;
 }
 
 export function syncServiceSettingToPlatform(
   runtime: CliServiceRuntime,
   change: ServiceSettingsSyncChange,
-  options: ServiceSettingsSyncOptions = {},
+  _options: ServiceSettingsSyncOptions = {},
 ): ServiceSettingsSyncResult {
   if (!String(change.key).startsWith('service.')) return { handled: false };
-  if (change.previousValue === change.value) return { handled: true, message: 'Service setting unchanged' };
-
-  const manager = options.createManager?.(runtime) ?? createPlatformServiceManager(runtime);
-
-  try {
-    if (change.key === 'service.autostart') {
-      if (change.value === true) {
-        if (runtime.configManager.get('service.enabled') !== true) {
-          runtime.configManager.setDynamic('service.enabled', true);
-        }
-        return installAndStartSystemService(runtime, manager, options);
-      }
-      return disableSystemService(runtime, manager, options);
-    }
-
-    if (change.key === 'service.enabled') {
-      if (change.value === false) {
-        if (runtime.configManager.get('service.autostart') === true) {
-          runtime.configManager.setDynamic('service.autostart', false);
-        }
-        return disableSystemService(runtime, manager, options);
-      }
-      if (runtime.configManager.get('service.autostart') === true) {
-        return installAndStartSystemService(runtime, manager, options);
-      }
-      return {
-        handled: true,
-        action: 'status',
-        status: manager.status(),
-        message: 'Service mode saved; enable autostart to install the OS service',
-      };
-    }
-
-    if (SERVICE_DEFINITION_KEYS.has(change.key)) {
-      if (runtime.configManager.get('service.enabled') === true && runtime.configManager.get('service.autostart') === true) {
-        return refreshInstalledSystemService(runtime, manager, options);
-      }
-      return {
-        handled: true,
-        action: 'status',
-        status: manager.status(),
-        message: 'Service setting saved; enable autostart to install the OS service',
-      };
-    }
-  } catch (error) {
-    const summarized = summarizeError(error);
-    logger.error('Settings service sync failed', { key: change.key, error: summarized });
+  if (change.previousValue === change.value) {
     return {
       handled: true,
-      action: 'status',
-      status: manager.status(),
-      message: `Service sync failed: ${summarized}`,
-      error: summarized,
+      action: 'unchanged',
+      message: 'External daemon service setting unchanged',
     };
   }
 
-  return { handled: false };
+  runtime.configManager.setDynamic(change.key, change.previousValue);
+  return {
+    handled: true,
+    action: 'external-daemon-blocked',
+    message: AGENT_EXTERNAL_DAEMON_SERVICE_MESSAGE,
+    error: 'daemon_lifecycle_external',
+  };
 }

package/src/tools/agent-context-policy.ts

@@ -10,7 +10,7 @@ export function wrapBlockedContextToolForAgentPolicy(tool: Tool): void {
   tool.definition.description = [
     'Blocked in GoodVibes Agent main conversation: copied runtime context.',
     'Use explicit Agent CLI/slash status, compat, setup, and Agent Knowledge commands for product-scoped context.',
-    'Default Knowledge/Wiki, HomeGraph, and copied TUI runtime assumptions are not Agent fallbacks.',
+    'Default Knowledge/Wiki, non-Agent knowledge segments, and copied TUI runtime assumptions are not Agent fallbacks.',
   ].join(' ');
   tool.definition.sideEffects = [];
   tool.definition.parameters = {

package/src/tools/wrfc-agent-guard.ts

@@ -106,7 +106,7 @@ const READ_ONLY_TEAM_TOOL_MODES = ['list', 'show'] as const;
 const READ_ONLY_WORKLIST_TOOL_MODES = ['list', 'show'] as const;
 const READ_ONLY_PACKET_TOOL_MODES = ['list', 'show'] as const;
 const READ_ONLY_QUERY_TOOL_MODES = ['list', 'show'] as const;
-const READ_ONLY_CONTROL_TOOL_MODES = ['commands', 'panels', 'subscriptions', 'sandbox-presets'] as const;
+const READ_ONLY_CONTROL_TOOL_MODES = ['commands', 'panels', 'subscriptions'] as const;
 const READ_ONLY_REMOTE_TOOL_MODE_SET = new Set<string>(READ_ONLY_REMOTE_TOOL_MODES);
 const READ_ONLY_CHANNEL_TOOL_MODE_SET = new Set<string>(READ_ONLY_CHANNEL_TOOL_MODES);
 const READ_ONLY_MCP_TOOL_MODE_SET = new Set<string>(READ_ONLY_MCP_TOOL_MODES);
@@ -130,7 +130,7 @@ const LOCAL_AGENT_DENIAL = [
 ].join(' ');
 
 const LOCAL_CODING_TOOL_DENIAL = [
-  'GoodVibes Agent does not perform direct local file mutation, local WRFC workflow execution, or local sandbox/REPL execution from the main conversation.',
+  'GoodVibes Agent does not perform direct local file mutation, local WRFC workflow execution, or local runtime-isolation execution from the main conversation.',
   'For explicit build/fix/review/code execution work, delegate one request to GoodVibes TUI through the public shared-session/build-delegation contract with the full original user ask.',
   'For durable Agent memory, skills, personas, routines, and knowledge, use the Agent-owned commands and isolated Agent Knowledge routes.',
 ].join(' ');
@@ -250,7 +250,7 @@ export function installAgentToolPolicyGuard(registry: ToolRegistry, options: Age
         modeSet: READ_ONLY_CONTROL_TOOL_MODE_SET,
         description: [
           'Read-only product-control inspection for GoodVibes Agent.',
-          'Command, panel, subscription, and sandbox preset catalogs can be inspected, but product-control mutation and daemon lifecycle are external.',
+          'Command, panel, and subscription catalogs can be inspected, but product-control mutation and daemon lifecycle are external.',
         ].join(' '),
         denial: CONTROL_MUTATION_DENIAL,
       });

package/src/verification/live-verifier.ts

@@ -4,6 +4,12 @@ import { spawn } from 'node:child_process';
 import { buildVerificationLedger } from './verification-ledger.ts';
 import { SDK_VERSION } from '../version.ts';
 
+const AGENT_KNOWLEDGE_FORBIDDEN_RESPONSE_MARKERS = [
+  ['home', ' assistant'].join(''),
+  ['home', 'graph'].join(''),
+  ['home ', 'graph'].join(''),
+] as const;
+
 export type LiveVerificationStatus = 'pass' | 'warn' | 'fail' | 'skip';
 
 export interface LiveVerificationCheck {
@@ -284,7 +290,7 @@ export function buildAgentKnowledgeLiveSkipCheck(
     summary: `Skipped because external daemon SDK ${daemonVersion} does not match Agent SDK pin ${expectedSdkVersion}.`,
     detail: [
       'Agent Knowledge is intentionally isolated under /api/goodvibes-agent/knowledge/*.',
-      'An older daemon cannot validate those routes, and Agent must not fall back to default Knowledge/Wiki or HomeGraph.',
+      'An older daemon cannot validate those routes, and Agent must not fall back to default Knowledge/Wiki or non-Agent knowledge segments.',
       'Update/restart the external daemon, then rerun live verification.',
     ].join('\n'),
   };
@@ -495,8 +501,8 @@ export async function buildLiveVerificationReport(options: LiveVerificationOptio
             return { status: 'fail', summary: 'Agent Knowledge ask was not parseable JSON.' };
           }
           const lower = body.toLowerCase();
-          if (lower.includes('home assistant') || lower.includes('homegraph') || lower.includes('home graph')) {
-            return { status: 'fail', summary: 'Agent Knowledge ask returned HomeGraph/Home Assistant contamination.' };
+          if (AGENT_KNOWLEDGE_FORBIDDEN_RESPONSE_MARKERS.some((marker) => lower.includes(marker))) {
+            return { status: 'fail', summary: 'Agent Knowledge ask returned non-Agent knowledge contamination.' };
           }
           return { status: 'pass', summary: 'Agent Knowledge ask stayed on the isolated Agent route.' };
         },
@@ -519,8 +525,8 @@ export async function buildLiveVerificationReport(options: LiveVerificationOptio
             return { status: 'fail', summary: 'Agent Knowledge search was not parseable JSON.' };
           }
           const lower = body.toLowerCase();
-          if (lower.includes('home assistant') || lower.includes('homegraph') || lower.includes('home graph')) {
-            return { status: 'fail', summary: 'Agent Knowledge search returned HomeGraph/Home Assistant contamination.' };
+          if (AGENT_KNOWLEDGE_FORBIDDEN_RESPONSE_MARKERS.some((marker) => lower.includes(marker))) {
+            return { status: 'fail', summary: 'Agent Knowledge search returned non-Agent knowledge contamination.' };
           }
           return { status: 'pass', summary: 'Agent Knowledge search stayed on the isolated Agent route.' };
         },

package/src/verification/verification-ledger.ts

@@ -30,7 +30,6 @@ export interface VerificationLedger {
 const EXTERNAL_SLASH_COMMANDS = new Set([
   'auth',
   'bridge',
-  'cloudflare',
   'health',
   'listener',
   'login',
@@ -71,14 +70,12 @@ const ONBOARDING_CAPABILITIES = [
   'network-access',
   'webhook-events',
   'external-integrations',
-  'cloudflare-batch',
 ] as const;
 
 const EXTERNAL_SURFACES = [
   'bluebubbles',
   'discord',
   'googleChat',
-  'homeassistant',
   'imessage',
   'matrix',
   'mattermost',
@@ -185,9 +182,9 @@ export function buildVerificationLedger(root: string): VerificationLedger {
       area: 'Onboarding capability bundles',
       total: ONBOARDING_CAPABILITIES.length,
       localSignalVerified: ONBOARDING_CAPABILITIES.length,
-      localBehaviorVerified: 5,
-      externalOutcomeRequired: 1,
-      notes: 'Wizard state derivation/apply can be local; Cloudflare provisioning remains external.',
+      localBehaviorVerified: ONBOARDING_CAPABILITIES.length,
+      externalOutcomeRequired: 0,
+      notes: 'Wizard state derivation/apply is local; daemon-backed outcomes stay external to Agent ownership.',
     },
   ];
 

package/src/version.ts

@@ -6,7 +6,7 @@ import { join } from 'node:path';
 // The prebuild script updates the fallback value before compilation.
 // Uses import.meta.dir (Bun) to locate package.json relative to this file,
 // which is correct regardless of the process working directory.
-let _version = '0.1.56';
+let _version = '0.1.58';
 let _sdkVersion = '0.33.35';
 try {
   const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', 'package.json'), 'utf-8')) as {

package/src/input/commands/agent-externalized-tui.ts

@@ -1,73 +0,0 @@
-import type { CommandRegistry, SlashCommand } from '../command-registry.ts';
-
-type ExternalizedCommandId = 'git' | 'diff' | 'worktree' | 'sandbox';
-
-interface ExternalizedCommandSpec {
-  readonly name: ExternalizedCommandId;
-  readonly aliases?: readonly string[];
-  readonly description: string;
-  readonly usage: string;
-  readonly owner: string;
-  readonly reason: string;
-}
-
-const EXTERNALIZED_TUI_COMMANDS: readonly ExternalizedCommandSpec[] = [
-  {
-    name: 'git',
-    aliases: ['g'],
-    description: 'Externalized: git workflows are owned by GoodVibes TUI',
-    usage: '[status|log|diff]',
-    owner: 'GoodVibes TUI',
-    reason: 'Git status, commits, and repository mutation belong to the coding TUI, not the serial Agent surface.',
-  },
-  {
-    name: 'diff',
-    aliases: ['d'],
-    description: 'Externalized: code diff review is owned by GoodVibes TUI',
-    usage: '[session|head|working|staged|<git-ref>]',
-    owner: 'GoodVibes TUI',
-    reason: 'Diff views are part of delegated build/fix/review work and should stay attached to the coding TUI execution context.',
-  },
-  {
-    name: 'worktree',
-    aliases: ['worktrees'],
-    description: 'Externalized: git worktree lifecycle is owned by GoodVibes TUI',
-    usage: '[review|inspect|attach|recover|cleanup]',
-    owner: 'GoodVibes TUI',
-    reason: 'Worktree creation, attachment, recovery, and cleanup are coding-session lifecycle operations.',
-  },
-  {
-    name: 'sandbox',
-    description: 'Externalized: sandbox and QEMU workflows are owned by GoodVibes TUI',
-    usage: '[review|probe|session|qemu|bundle|preset]',
-    owner: 'GoodVibes TUI',
-    reason: 'Sandbox/QEMU setup and session execution are terminal-native coding/runtime isolation workflows.',
-  },
-];
-
-function makeExternalizedCommand(spec: ExternalizedCommandSpec): SlashCommand {
-  return {
-    name: spec.name,
-    aliases: spec.aliases ? [...spec.aliases] : undefined,
-    description: spec.description,
-    usage: spec.usage,
-    argsHint: spec.usage,
-    handler(_args, ctx) {
-      ctx.print([
-        `${spec.name} is externalized in GoodVibes Agent.`,
-        `  owner: ${spec.owner}`,
-        `  reason: ${spec.reason}`,
-        '  Agent policy: no local coding TUI, git/worktree, or sandbox execution from this surface.',
-        '  build/fix/review: ask Agent to delegate the full request to GoodVibes TUI, or run goodvibes-tui in the target workspace.',
-        '  result: blocked here; no local files, config, worktrees, sandbox sessions, or repository state were changed.',
-      ].join('\n'));
-    },
-  };
-}
-
-export function registerAgentExternalizedTuiCommands(registry: CommandRegistry): void {
-  for (const spec of EXTERNALIZED_TUI_COMMANDS) {
-    registry.register(makeExternalizedCommand(spec));
-  }
-}
-