@pellux/goodvibes-agent 0.1.6 → 0.1.8

package/src/tools/wrfc-agent-guard.ts

@@ -10,6 +10,20 @@ type AgentToolPolicyGuardOptions = {
   readonly getLastUserMessage?: () => string | null;
 };
 
+const READ_ONLY_AGENT_TOOL_MODES = [
+  'status',
+  'list',
+  'templates',
+  'get',
+  'budget',
+  'wrfc-chains',
+  'wrfc-history',
+  'cohort-status',
+  'cohort-report',
+] as const;
+
+const READ_ONLY_AGENT_TOOL_MODE_SET = new Set<string>(READ_ONLY_AGENT_TOOL_MODES);
+
 const LOCAL_AGENT_DENIAL = [
   'GoodVibes Agent does not spawn local Engineer/Reviewer/Tester/Verifier roots or run local WRFC chains.',
   'Keep ordinary assistant work serial in the main conversation.',
@@ -23,6 +37,7 @@ export function installAgentToolPolicyGuard(registry: ToolRegistry, options: Age
 }
 
 export function wrapAgentToolForAgentPolicy(tool: Tool, _options: AgentToolPolicyGuardOptions = {}): void {
+  narrowAgentToolDefinitionForAgentPolicy(tool);
   const originalExecute = tool.execute.bind(tool);
   tool.execute = async (args) => {
     const denial = validateAgentToolInvocationForAgentPolicy(args as AgentToolArgs);
@@ -32,7 +47,7 @@ export function wrapAgentToolForAgentPolicy(tool: Tool, _options: AgentToolPolic
 }
 
 export function validateAgentToolInvocationForAgentPolicy(args: AgentToolArgs): string | null {
-  if (args.mode === 'spawn' || args.mode === 'batch-spawn') return LOCAL_AGENT_DENIAL;
+  if (typeof args.mode === 'string' && !READ_ONLY_AGENT_TOOL_MODE_SET.has(args.mode)) return LOCAL_AGENT_DENIAL;
   return null;
 }
 
@@ -41,6 +56,27 @@ export function normalizeAgentToolInvocationForAgentPolicy(args: AgentToolArgs):
 }
 
 export const AGENT_LOCAL_SPAWN_DENIAL_MESSAGE = LOCAL_AGENT_DENIAL;
+export const AGENT_READ_ONLY_TOOL_MODES = READ_ONLY_AGENT_TOOL_MODES;
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+function narrowAgentToolDefinitionForAgentPolicy(tool: Tool): void {
+  tool.definition.description = [
+    'Read-only local Agent inspection for GoodVibes Agent.',
+    'This product does not spawn local worker agents or run local WRFC chains.',
+    'For build/fix/review work, delegate to GoodVibes TUI through the explicit build-delegation path instead.',
+  ].join(' ');
+  tool.definition.sideEffects = [];
+
+  const properties = tool.definition.parameters.properties;
+  if (!isRecord(properties)) return;
+  const modeProperty = properties.mode;
+  if (!isRecord(modeProperty)) return;
+  modeProperty.enum = [...READ_ONLY_AGENT_TOOL_MODES];
+  modeProperty.description = 'Read-only Agent inspection mode. Local spawn, batch-spawn, cancel, message, wait, and plan modes are disabled in GoodVibes Agent.';
+}
 
 // Compatibility exports for copied TUI tests/imports during the near-fork phase.
 export const installWrfcAgentToolGuard = installAgentToolPolicyGuard;

package/src/version.ts

@@ -6,7 +6,7 @@ import { join } from 'node:path';
 // The prebuild script updates the fallback value before compilation.
 // Uses import.meta.dir (Bun) to locate package.json relative to this file,
 // which is correct regardless of the process working directory.
-let _version = '0.1.6';
+let _version = '0.1.8';
 try {
   const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', 'package.json'), 'utf-8'));
   _version = pkg.version ?? _version;

package/.goodvibes/agents/reviewer.md

@@ -1,48 +0,0 @@
----
-name: reviewer
-description: Serial review of GoodVibes Agent changes against product policy, release gates, and TypeScript quality
-tools: [read, find, analyze]
----
-
-You review GoodVibes Agent work. Your job is to identify concrete defects, product-boundary violations, and release risks. You verify claims by inspecting files and cite exact paths.
-
-## Review Priorities
-
-1. Agent policy: main-conversation serial behavior by default; no hidden local agent fanout; no default WRFC.
-2. Product boundary: Agent connects to the external daemon; it does not start, restart, install, or own daemon/listener services.
-3. Delegation boundary: build/fix/review code work is explicitly delegated to GoodVibes TUI through public contracts.
-4. TypeScript quality: Bun-first TypeScript only, no explicit `any`, no authored JavaScript variants.
-5. SDK boundary: public `@pellux/goodvibes-sdk` imports and daemon/operator routes only; no runtime imports from `goodvibes-tui/src/*`.
-6. Packaging: `goodvibes-agent` bin, Agent package identity, Agent docs, and no copied TUI-only package-facing guidance.
-
-## Review Process
-
-1. Read the completion report or changed-file list.
-2. Inspect the files that define the behavior under review.
-3. Check tests and release gates that should cover the change.
-4. Report findings first, ordered by severity.
-5. Keep summaries brief and secondary.
-
-## Output Format
-
-Use this structure:
-
-```text
-Findings
-- severity: file:line - issue and impact
-
-Open Questions
-- question or assumption, if any
-
-Validation Notes
-- tests/gates reviewed or missing
-```
-
-If there are no findings, say so clearly and list residual risk or missing validation.
-
-## What You Do Not Do
-
-- Do not modify code.
-- Do not spawn other agents.
-- Do not broaden scope beyond the reviewed slice.
-- Do not treat copied coding-TUI behavior as acceptable unless it is blocked, externalized, or explicitly delegated.