@pellux/goodvibes-agent 0.1.6 → 0.1.8

package/CHANGELOG.md

@@ -2,6 +2,37 @@
 
 All notable changes to GoodVibes Agent will be recorded here.
 
+## 0.1.8 - 2026-05-31
+
+- 384c85a Remove stale WRFC artifact test
+- 6230c64 Remove copied TUI historical docs
+- 9065f4d Add local Agent routines
+- e90d579 Lock Agent Knowledge CLI routes
+- 1b05f97 Guard agent runtime policy boundaries
+- 86f4bd1 Block agent cancellation from activity UI
+- 22d6a1d Block remote runner cancellation from agent
+- 9553688 Drop local agent records from saved sessions
+- f4b6f9d Block local session graph mutations
+- e372c44 Make orchestration command read-only
+- 7bb908c Narrow local agent tool to read-only modes
+- e8ed9c6 Verify packed global install smoke
+- fdc956b Forbid packaged local agent definitions
+- 881a18f Exclude local review agents from package
+- 649cac7 Improve full test failure reporting
+- 9982abc Remove default wiki from Agent runtime
+- f625ac6 Make ops command view only
+- af86ce5 Block copied CLI task submission
+- 567e07c Externalize worktree recovery guidance
+- 0fb2aa3 Block local runtime task mutations
+
+## 0.1.7 - 2026-05-31
+
+- Replaced active planning-loop output and tests that still described planning as TUI-owned with Agent-owned planning state and planning namespace language.
+- Added `LICENSE` to the explicit package file contract and release verification so npm tarballs cannot omit license text.
+- Prevented the operator workspace from dispatching placeholder delegation commands such as `/delegate --wrfc <task>`; those actions now provide guidance until the user supplies real task text.
+- Added local Agent routines with `/routines`: create/list/search/show/enable/disable/start/review/stale/delete, secret-looking value rejection, enabled routine prompt injection, and operator workspace status. Starting a routine stays in the main conversation and does not create hidden background jobs.
+- Removed copied TUI release, UAT, and WRFC artifact docs from the Agent source tree and updated remaining source docs so channel, Cloudflare, voice, Home Assistant, and panel guidance speaks in Agent/external-daemon terms.
+
 ## 0.1.6 - 2026-05-31
 
 - Made the publish helper use exported `NODE_AUTH_TOKEN` or `NPM_TOKEN` automatically by writing a temporary npm user config for publish commands.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Michael Davis and GoodVibes contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -48,6 +48,8 @@ Local Agent behavior is editable from the TUI:
 ```text
 /personas create --name Research --description "Source-backed research" --body "Check sources, call out uncertainty, keep answers concise."
 /personas use research
+/routines create --name "Evening Review" --description "Review open work before shutdown" --steps "Check work plan, approvals, and Agent Knowledge status before summarizing." --enabled true
+/routines start evening-review
 /agent-skills create --name "Morning Brief" --description "Daily briefing flow" --procedure "Check tasks, approvals, calendar, and unread state before summarizing." --enabled true
 /skills local list
 ```
@@ -68,7 +70,7 @@ Those commands should return explicit external-daemon guidance instead of mutati
 
 ## Product Boundary
 
-GoodVibes Agent owns the operator assistant surface: serial assistant flow, proactive safe actions, local memory/skills/personas, Agent knowledge routes, companion chat, approvals/automation observability, and explicit build delegation.
+GoodVibes Agent owns the operator assistant surface: serial assistant flow, proactive safe actions, local memory/routines/skills/personas, Agent knowledge routes, companion chat, approvals/automation observability, and explicit build delegation.
 
 Agent Knowledge/Wiki is its own product segment. Agent uses `/api/goodvibes-agent/knowledge/*` and must not fall back to default Knowledge/Wiki, HomeGraph, or Home Assistant routes.
 

package/docs/README.md

@@ -18,8 +18,8 @@ Important baseline constraints:
 - Agent connects to an externally managed daemon.
 - Agent does not start, stop, restart, install, uninstall, or own daemon/listener/web/service lifecycle.
 - Agent Knowledge/Wiki uses only `/api/goodvibes-agent/knowledge/*`; there is no default Knowledge/Wiki, HomeGraph, or Home Assistant fallback.
-- Local personas and Agent skills are stored under the Agent surface root and are injected only into the serial Agent conversation.
+- Local personas, routines, and Agent skills are stored under the Agent surface root and are injected only into the serial Agent conversation.
 - Normal assistant chat is not coding-session delegation.
 - Build/fix/review delegation to GoodVibes TUI must be explicit; WRFC is not the default Agent behavior.
 
-TUI-derived docs that remain outside this package-facing set are reference material during the near-fork foundation work. The Agent docs above define the supported alpha behavior.
+Copied TUI release and UAT histories are intentionally not part of this repository. The Agent docs above define the supported alpha behavior.

package/docs/deployment-and-services.md

@@ -50,7 +50,7 @@ If the daemon is unavailable, unauthenticated, or on an incompatible SDK version
 Only publish Agent releases that preserve the Agent product policy:
 
 - serial/proactive assistant by default
-- local memory/skills/personas until shared registries are stable
+- local memory/routines/skills/personas until shared registries are stable
 - Agent knowledge routes only for Agent wiki calls
 - companion chat for normal assistant chat
 - explicit delegation to GoodVibes TUI for build/fix/review work

package/docs/getting-started.md

@@ -1,6 +1,6 @@
 # Getting Started
 
-GoodVibes Agent `0.1.6` is the current installable public alpha of the personal operator assistant built on the GoodVibes TUI foundation.
+GoodVibes Agent `0.1.7` is the current installable public alpha of the personal operator assistant built on the GoodVibes TUI foundation.
 
 ## Requirements
 
@@ -37,20 +37,22 @@ bun run dev
 
 Once the TUI opens, run `/agent`, `/home`, or `/operator` to open the Agent operator workspace. That fullscreen workspace is the current front door for setup/config, knowledge status, local memory and skills, read-only work/approval/automation views, and explicit GoodVibes TUI build delegation.
 
-## Local Personas And Skills
+## Local Personas, Routines, And Skills
 
-Personas and reusable Agent skills are local to GoodVibes Agent. They do not write into default Knowledge/Wiki or HomeGraph.
+Personas, routines, and reusable Agent skills are local to GoodVibes Agent. They do not write into default Knowledge/Wiki or HomeGraph.
 
 ```text
 /personas list
 /personas create --name Research --description "Source-backed research" --body "Check sources, call out uncertainty, keep answers concise."
 /personas use research
+/routines create --name "Evening Review" --description "Review open work before shutdown" --steps "Check work plan, approvals, and Agent Knowledge status before summarizing." --enabled true
+/routines start evening-review
 /agent-skills create --name "Morning Brief" --description "Daily briefing flow" --procedure "Check tasks, approvals, calendar, and unread state before summarizing." --enabled true
 /agent-skills enabled
 /skills local list
 ```
 
-The active persona and enabled Agent skills are injected into the main serial assistant conversation. They do not spawn background agents.
+The active persona plus enabled Agent routines and skills are injected into the main serial assistant conversation. Starting a routine records local usage and prints its steps; it does not spawn background agents or daemon automation jobs.
 
 ## External Daemon
 

package/docs/release-and-publishing.md

@@ -1,6 +1,6 @@
 # Release And Publishing
 
-GoodVibes Agent `0.1.6` is the current installable public alpha release.
+GoodVibes Agent `0.1.7` is the current installable public alpha release.
 
 ## Package Identity
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pellux/goodvibes-agent",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "private": false,
   "description": "Near-fork GoodVibes operator assistant with the GoodVibes TUI shell, renderer, input, fullscreen workspace, and daemon-connected Agent product brain.",
   "type": "module",
@@ -11,7 +11,7 @@
   },
   "files": [
     "bin",
-    ".goodvibes/agents",
+    "LICENSE",
     ".goodvibes/skills",
     ".goodvibes/GOODVIBES.md",
     "src",

package/src/agent/routine-registry.ts

@@ -0,0 +1,389 @@
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+import type { ShellPathService } from '@/runtime/index.ts';
+import { GOODVIBES_AGENT_SURFACE_ROOT } from '../config/surface.ts';
+import { assertNoSecretLikeText } from './persona-registry.ts';
+
+export type AgentRoutineSource = 'user' | 'agent' | 'imported' | 'system';
+export type AgentRoutineReviewState = 'fresh' | 'reviewed' | 'stale';
+
+export interface AgentRoutineRecord {
+  readonly id: string;
+  readonly name: string;
+  readonly description: string;
+  readonly steps: string;
+  readonly triggers: readonly string[];
+  readonly tags: readonly string[];
+  readonly enabled: boolean;
+  readonly source: AgentRoutineSource;
+  readonly provenance: string;
+  readonly reviewState: AgentRoutineReviewState;
+  readonly staleReason?: string;
+  readonly createdAt: string;
+  readonly updatedAt: string;
+  readonly reviewedAt?: string;
+  readonly lastStartedAt?: string;
+  readonly startCount: number;
+}
+
+export interface AgentRoutineCreateInput {
+  readonly name: string;
+  readonly description: string;
+  readonly steps: string;
+  readonly triggers?: readonly string[];
+  readonly tags?: readonly string[];
+  readonly enabled?: boolean;
+  readonly source?: AgentRoutineSource;
+  readonly provenance?: string;
+}
+
+export interface AgentRoutineUpdateInput {
+  readonly name?: string;
+  readonly description?: string;
+  readonly steps?: string;
+  readonly triggers?: readonly string[];
+  readonly tags?: readonly string[];
+  readonly provenance?: string;
+}
+
+export interface AgentRoutineSnapshot {
+  readonly path: string;
+  readonly routines: readonly AgentRoutineRecord[];
+  readonly enabledRoutines: readonly AgentRoutineRecord[];
+}
+
+interface RoutineStoreFile {
+  readonly version: 1;
+  readonly routines: readonly AgentRoutineRecord[];
+}
+
+const STORE_VERSION = 1;
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+function readString(value: unknown, fallback = ''): string {
+  return typeof value === 'string' ? value : fallback;
+}
+
+function readStringArray(value: unknown): string[] {
+  if (!Array.isArray(value)) return [];
+  return value.filter((entry): entry is string => typeof entry === 'string').map((entry) => entry.trim()).filter(Boolean);
+}
+
+function readNonNegativeInteger(value: unknown): number {
+  const parsed = typeof value === 'number' ? value : Number(value);
+  return Number.isInteger(parsed) && parsed > 0 ? parsed : 0;
+}
+
+function normalizeName(name: string): string {
+  return name.trim().replace(/\s+/g, ' ');
+}
+
+function normalizeList(values: readonly string[] | undefined): string[] {
+  const seen = new Set<string>();
+  const result: string[] = [];
+  for (const value of values ?? []) {
+    const trimmed = value.trim();
+    if (!trimmed) continue;
+    const key = trimmed.toLowerCase();
+    if (seen.has(key)) continue;
+    seen.add(key);
+    result.push(trimmed);
+  }
+  return result;
+}
+
+function slugify(value: string): string {
+  const slug = value.trim().toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '');
+  return slug || 'routine';
+}
+
+function nowIso(): string {
+  return new Date().toISOString();
+}
+
+function parseRoutine(value: unknown): AgentRoutineRecord | null {
+  if (!isRecord(value)) return null;
+  const id = readString(value.id).trim();
+  const name = normalizeName(readString(value.name));
+  const description = readString(value.description).trim();
+  const steps = readString(value.steps).trim();
+  if (!id || !name || !description || !steps) return null;
+  const reviewState = value.reviewState === 'reviewed' || value.reviewState === 'stale' ? value.reviewState : 'fresh';
+  const source = value.source === 'agent' || value.source === 'imported' || value.source === 'system' ? value.source : 'user';
+  const staleReason = readString(value.staleReason).trim();
+  const reviewedAt = readString(value.reviewedAt).trim();
+  const lastStartedAt = readString(value.lastStartedAt).trim();
+  return {
+    id,
+    name,
+    description,
+    steps,
+    triggers: readStringArray(value.triggers),
+    tags: readStringArray(value.tags),
+    enabled: value.enabled === true,
+    source,
+    provenance: readString(value.provenance, source).trim() || source,
+    reviewState,
+    staleReason: staleReason || undefined,
+    createdAt: readString(value.createdAt, nowIso()),
+    updatedAt: readString(value.updatedAt, nowIso()),
+    reviewedAt: reviewedAt || undefined,
+    lastStartedAt: lastStartedAt || undefined,
+    startCount: readNonNegativeInteger(value.startCount),
+  };
+}
+
+function parseStore(raw: string): RoutineStoreFile {
+  const parsed: unknown = JSON.parse(raw);
+  if (!isRecord(parsed)) return { version: STORE_VERSION, routines: [] };
+  return {
+    version: STORE_VERSION,
+    routines: Array.isArray(parsed.routines)
+      ? parsed.routines.map(parseRoutine).filter((entry): entry is AgentRoutineRecord => entry !== null)
+      : [],
+  };
+}
+
+function formatStore(store: RoutineStoreFile): string {
+  return `${JSON.stringify(store, null, 2)}\n`;
+}
+
+export function routineStorePath(shellPaths: ShellPathService): string {
+  return shellPaths.resolveUserPath(GOODVIBES_AGENT_SURFACE_ROOT, 'routines', 'routines.json');
+}
+
+export class AgentRoutineRegistry {
+  public constructor(private readonly storePath: string) {}
+
+  public static fromShellPaths(shellPaths: ShellPathService): AgentRoutineRegistry {
+    return new AgentRoutineRegistry(routineStorePath(shellPaths));
+  }
+
+  public snapshot(): AgentRoutineSnapshot {
+    const store = this.readStore();
+    return {
+      path: this.storePath,
+      routines: [...store.routines],
+      enabledRoutines: store.routines.filter((routine) => routine.enabled),
+    };
+  }
+
+  public list(): readonly AgentRoutineRecord[] {
+    return this.snapshot().routines;
+  }
+
+  public search(query: string): readonly AgentRoutineRecord[] {
+    const normalized = query.trim().toLowerCase();
+    if (!normalized) return this.list();
+    return this.list().filter((routine) => [
+      routine.id,
+      routine.name,
+      routine.description,
+      routine.steps,
+      ...routine.tags,
+      ...routine.triggers,
+    ].some((field) => field.toLowerCase().includes(normalized)));
+  }
+
+  public get(idOrName: string): AgentRoutineRecord | null {
+    const lookup = idOrName.trim().toLowerCase();
+    if (!lookup) return null;
+    return this.list().find((routine) => routine.id.toLowerCase() === lookup || routine.name.toLowerCase() === lookup) ?? null;
+  }
+
+  public create(input: AgentRoutineCreateInput): AgentRoutineRecord {
+    const store = this.readStore();
+    const name = normalizeName(input.name);
+    const description = input.description.trim();
+    const steps = input.steps.trim();
+    this.validateRequired(name, description, steps);
+    assertNoSecretLikeText([name, description, steps, ...(input.tags ?? []), ...(input.triggers ?? [])]);
+    const duplicate = store.routines.find((routine) => routine.name.toLowerCase() === name.toLowerCase());
+    if (duplicate) throw new Error(`Routine already exists: ${duplicate.id}`);
+    const timestamp = nowIso();
+    const routine: AgentRoutineRecord = {
+      id: this.nextId(name, store.routines),
+      name,
+      description,
+      steps,
+      triggers: normalizeList(input.triggers),
+      tags: normalizeList(input.tags),
+      enabled: input.enabled === true,
+      source: input.source ?? 'user',
+      provenance: input.provenance?.trim() || input.source || 'user',
+      reviewState: 'fresh',
+      createdAt: timestamp,
+      updatedAt: timestamp,
+      startCount: 0,
+    };
+    this.writeStore({ ...store, routines: [...store.routines, routine] });
+    return routine;
+  }
+
+  public update(idOrName: string, input: AgentRoutineUpdateInput): AgentRoutineRecord {
+    const store = this.readStore();
+    const existing = this.findInStore(store, idOrName);
+    if (!existing) throw new Error(`Unknown routine: ${idOrName}`);
+    const name = input.name === undefined ? existing.name : normalizeName(input.name);
+    const description = input.description === undefined ? existing.description : input.description.trim();
+    const steps = input.steps === undefined ? existing.steps : input.steps.trim();
+    this.validateRequired(name, description, steps);
+    assertNoSecretLikeText([name, description, steps, ...(input.tags ?? []), ...(input.triggers ?? [])]);
+    const duplicate = store.routines.find((routine) => routine.id !== existing.id && routine.name.toLowerCase() === name.toLowerCase());
+    if (duplicate) throw new Error(`Routine already exists: ${duplicate.id}`);
+    const updated: AgentRoutineRecord = {
+      ...existing,
+      name,
+      description,
+      steps,
+      triggers: input.triggers === undefined ? existing.triggers : normalizeList(input.triggers),
+      tags: input.tags === undefined ? existing.tags : normalizeList(input.tags),
+      provenance: input.provenance === undefined ? existing.provenance : input.provenance.trim() || existing.provenance,
+      reviewState: 'fresh',
+      staleReason: undefined,
+      reviewedAt: undefined,
+      updatedAt: nowIso(),
+    };
+    this.writeStore({
+      ...store,
+      routines: store.routines.map((routine) => routine.id === existing.id ? updated : routine),
+    });
+    return updated;
+  }
+
+  public setEnabled(idOrName: string, enabled: boolean): AgentRoutineRecord {
+    const store = this.readStore();
+    const existing = this.findInStore(store, idOrName);
+    if (!existing) throw new Error(`Unknown routine: ${idOrName}`);
+    const updated: AgentRoutineRecord = { ...existing, enabled, updatedAt: nowIso() };
+    this.writeStore({
+      ...store,
+      routines: store.routines.map((routine) => routine.id === existing.id ? updated : routine),
+    });
+    return updated;
+  }
+
+  public markStarted(idOrName: string): AgentRoutineRecord {
+    const store = this.readStore();
+    const existing = this.findInStore(store, idOrName);
+    if (!existing) throw new Error(`Unknown routine: ${idOrName}`);
+    const timestamp = nowIso();
+    const updated: AgentRoutineRecord = {
+      ...existing,
+      lastStartedAt: timestamp,
+      startCount: existing.startCount + 1,
+      updatedAt: timestamp,
+    };
+    this.writeStore({
+      ...store,
+      routines: store.routines.map((routine) => routine.id === existing.id ? updated : routine),
+    });
+    return updated;
+  }
+
+  public markReviewed(idOrName: string): AgentRoutineRecord {
+    const store = this.readStore();
+    const existing = this.findInStore(store, idOrName);
+    if (!existing) throw new Error(`Unknown routine: ${idOrName}`);
+    const updated: AgentRoutineRecord = {
+      ...existing,
+      reviewState: 'reviewed',
+      staleReason: undefined,
+      reviewedAt: nowIso(),
+      updatedAt: nowIso(),
+    };
+    this.writeStore({
+      ...store,
+      routines: store.routines.map((routine) => routine.id === existing.id ? updated : routine),
+    });
+    return updated;
+  }
+
+  public markStale(idOrName: string, reason: string): AgentRoutineRecord {
+    const store = this.readStore();
+    const existing = this.findInStore(store, idOrName);
+    if (!existing) throw new Error(`Unknown routine: ${idOrName}`);
+    const updated: AgentRoutineRecord = {
+      ...existing,
+      reviewState: 'stale',
+      staleReason: reason.trim() || 'Marked stale by user.',
+      updatedAt: nowIso(),
+    };
+    this.writeStore({
+      ...store,
+      routines: store.routines.map((routine) => routine.id === existing.id ? updated : routine),
+    });
+    return updated;
+  }
+
+  public deleteRoutine(idOrName: string): AgentRoutineRecord {
+    const store = this.readStore();
+    const existing = this.findInStore(store, idOrName);
+    if (!existing) throw new Error(`Unknown routine: ${idOrName}`);
+    this.writeStore({
+      ...store,
+      routines: store.routines.filter((routine) => routine.id !== existing.id),
+    });
+    return existing;
+  }
+
+  private validateRequired(name: string, description: string, steps: string): void {
+    if (!name) throw new Error('Routine name is required.');
+    if (!description) throw new Error('Routine description is required.');
+    if (!steps) throw new Error('Routine steps are required.');
+  }
+
+  private nextId(name: string, routines: readonly AgentRoutineRecord[]): string {
+    const base = slugify(name);
+    const ids = new Set(routines.map((routine) => routine.id));
+    if (!ids.has(base)) return base;
+    for (let index = 2; index < 1000; index += 1) {
+      const candidate = `${base}-${index}`;
+      if (!ids.has(candidate)) return candidate;
+    }
+    throw new Error(`Could not allocate routine id for ${name}.`);
+  }
+
+  private findInStore(store: RoutineStoreFile, idOrName: string): AgentRoutineRecord | null {
+    const lookup = idOrName.trim().toLowerCase();
+    if (!lookup) return null;
+    return store.routines.find((routine) => routine.id.toLowerCase() === lookup || routine.name.toLowerCase() === lookup) ?? null;
+  }
+
+  private readStore(): RoutineStoreFile {
+    if (!existsSync(this.storePath)) return { version: STORE_VERSION, routines: [] };
+    try {
+      return parseStore(readFileSync(this.storePath, 'utf-8'));
+    } catch (error) {
+      throw new Error(`Could not read Agent routine store: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+
+  private writeStore(store: RoutineStoreFile): void {
+    mkdirSync(dirname(this.storePath), { recursive: true });
+    const tmpPath = `${this.storePath}.tmp`;
+    writeFileSync(tmpPath, formatStore(store), 'utf-8');
+    renameSync(tmpPath, this.storePath);
+  }
+}
+
+export function buildEnabledRoutinesPrompt(shellPaths: ShellPathService): string | null {
+  const enabled = AgentRoutineRegistry.fromShellPaths(shellPaths).snapshot().enabledRoutines;
+  if (enabled.length === 0) return null;
+  return [
+    '## Enabled GoodVibes Agent Routines',
+    'Use these local reusable routines inside the same serial assistant conversation when they fit the user request. Do not start hidden background jobs because a routine matches.',
+    '',
+    ...enabled.slice(0, 8).flatMap((routine) => [
+      `### ${routine.name}`,
+      `Description: ${routine.description}`,
+      `Review state: ${routine.reviewState}`,
+      `Triggers: ${routine.triggers.join(', ') || '(manual)'}`,
+      routine.steps,
+      '',
+    ]),
+  ].join('\n').trim();
+}

package/src/cli/management-commands.ts

@@ -10,7 +10,7 @@ import { generateQrMatrix, renderQrToString } from '@pellux/goodvibes-sdk/platfo
 import { resolveRuntimeEndpointBinding } from './endpoints.ts';
 import { classifyBindPosture, isNetworkFacing } from './network-posture.ts';
 import type { CliCommandRuntime } from './management.ts';
-import { extractAuthorizationCode, formatJsonOrText, hasCommandFlag, openBrowser, probeTcp, readAuthPaths, runNonInteractiveAgent, urlHostForBindHost, withRuntimeServices, yesNo } from './management.ts';
+import { extractAuthorizationCode, formatJsonOrText, hasCommandFlag, openBrowser, probeTcp, readAuthPaths, urlHostForBindHost, withRuntimeServices, yesNo } from './management.ts';
 import { GOODVIBES_AGENT_PAIRING_SURFACE } from '../config/surface.ts';
 
 export async function renderSubscriptions(runtime: CliCommandRuntime): Promise<string> {
@@ -277,16 +277,12 @@ export async function handleSessions(runtime: CliCommandRuntime): Promise<string
 export async function handleTasks(runtime: CliCommandRuntime): Promise<string> {
   const [sub = 'list', ...rest] = runtime.cli.commandArgs;
   if (sub === 'submit') {
-    const prompt = rest.join(' ').trim();
-    if (!prompt) return 'Usage: goodvibes tasks submit <prompt>';
-    const runCli = {
-      ...runtime.cli,
-      command: 'run' as const,
-      flags: { ...runtime.cli.flags, prompt },
-      positionals: [prompt],
-    };
-    const code = await runNonInteractiveAgent({ ...runtime, cli: runCli });
-    return code === 0 ? '' : `Task submit failed with exit code ${code}`;
+    return [
+      'GoodVibes Agent blocks CLI task submission from the copied task surface.',
+      '  policy: do normal assistant work in the main Agent conversation or use `goodvibes-agent run <prompt>` for an explicit one-shot run.',
+      '  build/fix/review: use `goodvibes-agent delegate <task>` for explicit GoodVibes TUI handoff.',
+      '  result: no local task was started.',
+    ].join('\n');
   }
   return await withRuntimeServices(runtime, (services) => {
     const tasks = [...services.runtimeStore.getState().tasks.tasks.values()];
@@ -300,7 +296,7 @@ export async function handleTasks(runtime: CliCommandRuntime): Promise<string> {
       const task = tasks.find((candidate) => candidate.id === rest[0]);
       return task ? JSON.stringify(task, null, 2) : `Unknown task: ${rest[0] ?? ''}`;
     }
-    return 'Usage: goodvibes tasks list|show <taskId>|submit <prompt>';
+    return 'Usage: goodvibes tasks list|show <taskId>';
   });
 }
 

package/src/cli/package-verification.ts

@@ -32,6 +32,7 @@ const REQUIRED_BIN_COMMANDS = ['goodvibes-agent'] as const;
 const REQUIRED_TARBALL_PATHS = [
   'README.md',
   'CHANGELOG.md',
+  'LICENSE',
   'package.json',
   'src/main.ts',
   'bin/goodvibes-agent.ts',
@@ -43,7 +44,7 @@ const REQUIRED_TARBALL_PATHS = [
   'docs/deployment-and-services.md',
   'docs/release-and-publishing.md',
 ] as const;
-const FORBIDDEN_TARBALL_PREFIXES = ['.github/', 'src/test/', 'src/.test/', '.goodvibes/memory/', 'vendor/'] as const;
+const FORBIDDEN_TARBALL_PREFIXES = ['.github/', 'src/test/', 'src/.test/', '.goodvibes/memory/', '.goodvibes/agents/', 'vendor/'] as const;
 const FORBIDDEN_TARBALL_DOCS = [
   'docs/qemu-sandbox.md',
   'docs/cloudflare-batch.md',
@@ -57,7 +58,6 @@ const PACKAGE_FACING_TEXT_PATHS = [
   'docs/deployment-and-services.md',
   'docs/release-and-publishing.md',
   '.goodvibes/GOODVIBES.md',
-  '.goodvibes/agents/reviewer.md',
   '.goodvibes/skills/add-provider/SKILL.md',
 ] as const;
 const PACKAGE_FACING_FORBIDDEN_TEXT = [