@pellux/goodvibes-agent 0.1.72 → 0.1.73

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to GoodVibes Agent will be recorded here.
 
+## 0.1.73 - 2026-05-31
+
+- Replaced copied first-run capability language with Agent-specific setup: operator TUI, provider access, isolated Agent Knowledge, local memory/skills, channels, automation review, and explicit TUI delegation.
+- Reworked the fullscreen settings workspace grouping and descriptions around Agent experience, models, local Agent state, tools/automation, and external runtime connection.
+- Added package-facing guards and regressions so copied browser/network/listener setup wording does not return to shipped Agent docs.
+
 ## 0.1.72 - 2026-05-31
 
 - Removed copied runtime lifecycle and transport words from the Agent CLI parser, command handler, detailed help, and package exports.

package/README.md

@@ -50,7 +50,7 @@ bun run package:install-check
 bun run publish:check
 ```
 
-Inside the Agent TUI, use `/agent`, `/home`, or `/operator` to open the operator workspace. It is the Agent-first fullscreen surface for setup, status, knowledge, local memory/skills, work-plan/approval review, automation observability, and explicit build delegation to GoodVibes TUI.
+Inside the Agent TUI, use `/agent`, `/home`, or `/operator` to open the operator workspace. It is the Agent-first fullscreen workspace for setup, status, knowledge, local memory/skills, work-plan/approval review, automation observability, and explicit build delegation to GoodVibes TUI.
 
 Inside the workspace, use `/agent-profile guide` to author custom profile starters without leaving the Agent TUI. The guided flow lists starters, exports starter JSON, imports edited local starters, and creates isolated Agent profiles from them.
 
@@ -91,11 +91,11 @@ Agent reports unavailable, unauthenticated, or incompatible runtime state throug
 
 ## Product Boundary
 
-GoodVibes Agent owns the operator assistant surface: serial assistant flow, proactive safe actions, local memory/routines/skills/personas, Agent knowledge routes, companion chat, approvals/automation observability, and explicit build delegation.
+GoodVibes Agent owns the operator assistant TUI: serial assistant flow, proactive safe actions, local memory/routines/skills/personas, Agent knowledge routes, companion chat, approvals/automation observability, and explicit build delegation.
 
 Agent Knowledge/Wiki is its own product segment. Agent uses `/api/goodvibes-agent/knowledge/*` and must not fall back to default Knowledge/Wiki or other product-specific knowledge routes.
 
-GoodVibes TUI owns coding execution: file edits, git/worktree workflows, coding panels, runtime-isolation UX, and WRFC execution. Agent may delegate explicit build/fix/review work to TUI through public runtime/session contracts; normal assistant chat must not use shared coding sessions.
+GoodVibes TUI owns coding execution: file edits, git/worktree workflows, coding panels, execution isolation UX, and WRFC execution. Agent may delegate explicit build/fix/review work to TUI through public runtime/session contracts; normal assistant chat must not use shared coding sessions.
 
 ## Package Docs
 

package/docs/README.md

@@ -18,7 +18,7 @@ Important baseline constraints:
 - Agent Knowledge/Wiki uses only `/api/goodvibes-agent/knowledge/*`; there is no default Knowledge/Wiki or non-Agent product fallback.
 - Agent supports isolated runtime homes with `GOODVIBES_AGENT_HOME=<path>` and named profile homes with `goodvibes-agent profiles create <name> --template <starter> --yes` plus `--agent-profile <name>`.
 - Agent ships starter profile templates for household, research, travel, operations, and personal productivity local state; `profiles templates export/import` and `/agent-profile guide` support local custom starters.
-- Local personas, routines, and Agent skills are stored under the Agent surface root and are injected only into the serial Agent conversation.
+- Local personas, routines, and Agent skills are stored under the Agent home and are injected only into the serial Agent conversation.
 - Normal assistant chat is not coding-session delegation.
 - Build/fix/review delegation to GoodVibes TUI must be explicit; WRFC is not the default Agent behavior.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pellux/goodvibes-agent",
-  "version": "0.1.72",
+  "version": "0.1.73",
   "private": false,
   "description": "GoodVibes personal operator assistant TUI with a proactive Agent product brain, isolated Agent Knowledge, local profiles, routines, skills, personas, and explicit build delegation.",
   "type": "module",

package/src/cli/agent-knowledge-command.ts

@@ -407,7 +407,7 @@ function buildDelegationBody(task: string, wrfcRequested: boolean): string {
     'Agent policy:',
     '- GoodVibes Agent is not the coding TUI.',
     '- Preserve the full original ask.',
-    '- GoodVibes TUI owns file edits, git/worktree flows, runtime-isolation UX, and any WRFC owner chain.',
+    '- GoodVibes TUI owns file edits, git/worktree flows, execution isolation UX, and any WRFC owner chain.',
     wrfcRequested
       ? '- WRFC was explicitly requested by the Agent user for this build/fix/review delegation.'
       : '- WRFC was not explicitly requested; do not turn this into WRFC solely because it came from Agent.',

package/src/cli/package-verification.ts

@@ -74,6 +74,12 @@ const PACKAGE_FACING_FORBIDDEN_TEXT = [
   ['capabilities', ' audit'].join(''),
   ['capabilities', ' command'].join(''),
   ['near', '-fork'].join(''),
+  ['Optional ', 'Browser Access'].join(''),
+  ['Optional ', 'Other-Device Access'].join(''),
+  ['Optional ', 'Incoming Events'].join(''),
+  ['Service ', '& Network'].join(''),
+  ['Surfaces ', '& Integrations'].join(''),
+  ['runtime', '-isolation'].join(''),
   ['goodvibes-agent', 'serve'].join(' '),
   ['goodvibes-agent', 'service'].join(' '),
   ['goodvibes-agent', 'services'].join(' '),

package/src/input/agent-workspace-categories.ts

@@ -5,7 +5,7 @@ export const AGENT_WORKSPACE_CATEGORIES: readonly AgentWorkspaceCategory[] = [
     id: 'home',
     group: 'OPERATE',
     label: 'Home',
-    summary: 'Main operator surface for normal assistant work.',
+    summary: 'Main operator workspace for normal assistant work.',
     detail: 'Use this as the Agent front door: chat in the main conversation, inspect state, choose model/provider, and open setup without switching modes.',
     actions: [
       { id: 'chat', label: 'Continue assistant chat', detail: 'Close this workspace and type a normal message. Agent work stays serial in the main conversation.', kind: 'guidance', safety: 'safe' },
@@ -16,14 +16,14 @@ export const AGENT_WORKSPACE_CATEGORIES: readonly AgentWorkspaceCategory[] = [
       { id: 'channels-home', label: 'Channels', detail: 'Jump to companion pairing and channel readiness without changing runtime connectivity.', targetCategoryId: 'channels', kind: 'workspace', safety: 'read-only' },
       { id: 'voice-home', label: 'Voice and media', detail: 'Jump to voice, TTS, image input, browser-tool, and media setup.', targetCategoryId: 'voice-media', kind: 'workspace', safety: 'safe' },
       { id: 'help', label: 'Browse commands', detail: 'Open registry-driven command help.', command: '/help', kind: 'command', safety: 'safe' },
-      { id: 'health', label: 'Review health', detail: 'Show the local health review surface without starting or mutating runtime services.', command: '/health review', kind: 'command', safety: 'read-only' },
+      { id: 'health', label: 'Review health', detail: 'Show local health and runtime connection status without starting or mutating anything.', command: '/health review', kind: 'command', safety: 'read-only' },
     ],
   },
   {
     id: 'setup',
     group: 'SETUP',
     label: 'Setup',
-    summary: 'Configuration, auth, provider, and onboarding surfaces.',
+    summary: 'Configuration, auth, provider, and onboarding workspaces.',
     detail: 'Agent connects to an existing GoodVibes runtime and owns local assistant configuration only. Runtime lifecycle and connectivity posture remain external.',
     actions: [
       { id: 'config', label: 'Open settings', detail: 'Open the fullscreen Agent settings workspace.', command: '/config', kind: 'command', safety: 'safe' },
@@ -46,9 +46,9 @@ export const AGENT_WORKSPACE_CATEGORIES: readonly AgentWorkspaceCategory[] = [
     group: 'SETUP',
     label: 'Channels',
     summary: 'Companion pairing, channel posture, and delivery safety.',
-    detail: 'Agent uses externally managed channel surfaces. Pairing, account inspection, and readiness checks are visible here; inbound delivery and public channel exposure stay policy-gated.',
+    detail: 'Agent uses externally managed channels. Pairing, account inspection, and readiness checks are visible here; inbound delivery and public channel exposure stay policy-gated.',
     actions: [
-      { id: 'pair', label: 'Pair companion', detail: 'Open the QR pairing surface for companion app setup.', command: '/pair', kind: 'command', safety: 'safe' },
+      { id: 'pair', label: 'Pair companion', detail: 'Open the QR pairing view for companion app setup.', command: '/pair', kind: 'command', safety: 'safe' },
       { id: 'communication', label: 'Communication routes', detail: 'Inspect structured communication routes and recent activity.', command: '/communication', kind: 'command', safety: 'read-only' },
       { id: 'setup-review', label: 'Channel setup review', detail: 'Review setup posture without starting inbound endpoints or mutating channel state.', command: '/setup review', kind: 'command', safety: 'read-only' },
       { id: 'channel-safety', label: 'Delivery safety', detail: 'External messages, channel DMs, and public delivery targets require explicit user action and runtime policy. Agent will not silently send or expose channels from this workspace.', kind: 'guidance', safety: 'blocked' },
@@ -75,13 +75,13 @@ export const AGENT_WORKSPACE_CATEGORIES: readonly AgentWorkspaceCategory[] = [
     group: 'SETUP',
     label: 'Voice & Media',
     summary: 'Voice, TTS, image input, browser tools, and media providers.',
-    detail: 'Voice, media, browser tools, and image-capable flows are first-class Agent surfaces. Runtime ownership stays external and side effects stay explicit.',
+    detail: 'Voice, media, browser tools, and image-capable flows are first-class Agent tools. Runtime ownership stays external and side effects stay explicit.',
     actions: [
       { id: 'tts-config', label: 'Configure live TTS', detail: 'Open the settings workspace at the TTS group.', command: '/config tts', kind: 'command', safety: 'safe' },
       { id: 'tts-provider', label: 'Choose TTS provider', detail: 'Open provider/model routing for spoken responses through the settings flow.', command: '/config tts.provider', kind: 'command', safety: 'safe' },
       { id: 'tts-speak', label: 'Speak a prompt', detail: 'Submit a normal assistant turn and play the reply through configured live TTS. Close this workspace and provide real prompt text.', command: '/tts <prompt>', kind: 'command', safety: 'safe' },
       { id: 'image-attach', label: 'Attach image input', detail: 'Attach an image to the next assistant turn. Close this workspace and provide a real path and prompt.', command: '/image <path> <prompt>', kind: 'command', safety: 'safe' },
-      { id: 'browser-tools', label: 'Browser tools', detail: 'Inspect browser/tool readiness without starting inbound endpoints or runtime services.', command: '/setup services', kind: 'command', safety: 'read-only' },
+      { id: 'browser-tools', label: 'Browser tools', detail: 'Inspect browser/tool readiness without starting inbound endpoints or mutating runtime state.', command: '/mcp servers', kind: 'command', safety: 'read-only' },
       { id: 'mcp-browser', label: 'Browser MCP tools', detail: 'Inspect MCP servers and tools, including browser/automation roles, without mutating server setup.', command: '/mcp servers', kind: 'command', safety: 'read-only' },
     ],
   },
@@ -93,7 +93,7 @@ export const AGENT_WORKSPACE_CATEGORIES: readonly AgentWorkspaceCategory[] = [
     detail: 'Profiles isolate Agent state. GoodVibes Agent exposes named homes, config profile pickers, profile-sync bundles, setup transfer bundles, and support bundles while keeping the shared runtime external.',
     actions: [
       { id: 'profiles-open', label: 'Open config profiles', detail: 'Open the config profile picker for display/provider/behavior profile files.', command: '/profiles', kind: 'command', safety: 'safe' },
-      { id: 'runtime-profile-guide', label: 'Starter authoring guide', detail: 'Open the Agent-local starter authoring flow inside the TUI command surface.', command: '/agent-profile guide', kind: 'command', safety: 'safe' },
+      { id: 'runtime-profile-guide', label: 'Starter authoring guide', detail: 'Open the Agent-local starter authoring flow inside the Agent TUI.', command: '/agent-profile guide', kind: 'command', safety: 'safe' },
       { id: 'runtime-profile-templates', label: 'Browse starter templates', detail: 'List built-in and local Agent starter templates with persona, skill, routine, and source details.', command: '/agent-profile templates', kind: 'command', safety: 'read-only' },
       { id: 'profile-sync-list', label: 'Profile sync list', detail: 'Inspect saved config profiles available for export/import.', command: '/profilesync list', kind: 'command', safety: 'read-only' },
       { id: 'profile-sync-export', label: 'Export profile sync', detail: 'Export config profiles to a portable bundle. Requires a real path and explicit --yes.', command: '/profilesync export <path> --yes', kind: 'command', safety: 'safe' },
@@ -110,7 +110,7 @@ export const AGENT_WORKSPACE_CATEGORIES: readonly AgentWorkspaceCategory[] = [
     summary: 'Local assistant memory, routines, skills, and reusable behavior.',
     detail: 'Memory, routines, skills, and personas stay Agent-local until stable shared registry contracts exist. Secrets must not be stored as memory.',
     actions: [
-      { id: 'memory', label: 'Open memory', detail: 'Inspect local/session memory commands and surfaces.', command: '/memory', kind: 'command', safety: 'read-only' },
+      { id: 'memory', label: 'Open memory', detail: 'Inspect local/session memory records and commands.', command: '/memory', kind: 'command', safety: 'read-only' },
       { id: 'personas', label: 'Persona library', detail: 'Open the local persona workspace for active role selection and review.', targetCategoryId: 'personas', kind: 'workspace', safety: 'safe' },
       { id: 'skills', label: 'Local skill library', detail: 'Open the local skill workspace for reusable procedures and review.', targetCategoryId: 'skills', kind: 'workspace', safety: 'safe' },
       { id: 'routines', label: 'Routine library', detail: 'Open the local routine workspace for repeatable workflows and schedule promotion review.', targetCategoryId: 'routines', kind: 'workspace', safety: 'safe' },
@@ -181,7 +181,7 @@ export const AGENT_WORKSPACE_CATEGORIES: readonly AgentWorkspaceCategory[] = [
     group: 'TRACK',
     label: 'Work & Approvals',
     summary: 'Visible task state, work plan, and approval posture.',
-    detail: 'Use these surfaces to inspect active operator state. Side-effecting approval decisions require explicit commands and confirmation outside this workspace.',
+    detail: 'Use this workspace to inspect active operator state. Side-effecting approval decisions require explicit commands and confirmation outside this workspace.',
     actions: [
       { id: 'workplan', label: 'Open work plan', detail: 'Open the workspace-scoped work plan panel.', command: '/workplan panel', kind: 'command', safety: 'read-only' },
       { id: 'workplan-list', label: 'List work plan', detail: 'Print a concise work plan summary.', command: '/workplan list', kind: 'command', safety: 'read-only' },
@@ -200,7 +200,7 @@ export const AGENT_WORKSPACE_CATEGORIES: readonly AgentWorkspaceCategory[] = [
       { id: 'schedule-receipts', label: 'Promotion receipts', detail: 'Review local redacted receipt history for routine-to-schedule promotion attempts.', command: '/schedule receipts', kind: 'command', safety: 'read-only' },
       { id: 'schedule-reconcile', label: 'Reconcile schedules', detail: 'Compare local promotion receipts with live external schedules using schedules.list.', command: '/schedule reconcile', kind: 'command', safety: 'read-only' },
       { id: 'schedule-policy', label: 'Local scheduler blocked', detail: 'Local schedule add/run/remove/enable/disable remain blocked; only explicit external schedule promotion is allowed here.', kind: 'guidance', safety: 'blocked' },
-      { id: 'health-services', label: 'Runtime health', detail: 'Inspect runtime readiness without starting, stopping, or restarting services.', command: '/health services', kind: 'command', safety: 'read-only' },
+      { id: 'health-services', label: 'Runtime status', detail: 'Inspect runtime readiness without starting, stopping, or restarting anything.', command: '/health review', kind: 'command', safety: 'read-only' },
     ],
   },
   {

package/src/input/commands/delegation-runtime.ts

@@ -29,7 +29,7 @@ function buildDelegationBody(task: string, wrfcRequested: boolean): string {
     'Agent policy:',
     '- GoodVibes Agent is not the coding TUI.',
     '- Preserve the full original ask.',
-    '- GoodVibes TUI owns file edits, git/worktree flows, runtime-isolation UX, and any WRFC owner chain.',
+    '- GoodVibes TUI owns file edits, git/worktree flows, execution isolation UX, and any WRFC owner chain.',
     wrfcRequested
       ? '- WRFC was explicitly requested by the Agent user for this build/fix/review delegation.'
       : '- WRFC was not explicitly requested; do not turn this into WRFC solely because it came from Agent.',

package/src/input/onboarding/onboarding-wizard-steps.ts

@@ -47,7 +47,7 @@ export function buildCommunicationStep(): OnboardingWizardStepDefinition {
     id: 'agent-communication',
     title: 'Channels and notifications',
     shortLabel: 'Channels',
-    description: 'Prepare the Agent for companion pairing, messaging-channel awareness, notification delivery, and safe outbound communication without changing runtime connectivity.',
+    description: 'Prepare the Agent for companion pairing, messaging-channel awareness, notification delivery, and safe outbound communication while leaving runtime hosting external.',
     summaryTitle: 'Communication posture',
     summaryLines: [
       'Companion chat: paired through the GoodVibes runtime',
@@ -60,13 +60,13 @@ export function buildCommunicationStep(): OnboardingWizardStepDefinition {
         id: 'agent-communication.companion',
         label: 'Companion pairing',
         hint: 'Use /pair from the Agent workspace to pair companion clients through the already-running GoodVibes runtime.',
-        defaultValue: 'External service route',
+        defaultValue: 'External runtime route',
       },
       {
         kind: 'status',
         id: 'agent-communication.channels',
         label: 'Messaging channels',
-        hint: 'Use the Channels workspace to inspect account readiness, delivery posture, and recent communication without changing runtime connectivity.',
+        hint: 'Use the Channels workspace to inspect account readiness, delivery posture, and recent communication without changing runtime hosting.',
         defaultValue: 'Inspectable',
       },
       {
@@ -97,7 +97,7 @@ export function buildToolsStep(): OnboardingWizardStepDefinition {
     summaryLines: [
       'MCP and tools: inspect before use',
       'Read/search/summarize: safe by default',
-      'Writes, installs, external sends, and service changes: require explicit user action',
+      'Writes, installs, external sends, and account changes: require explicit user action',
     ],
     fields: [
       {
@@ -111,14 +111,14 @@ export function buildToolsStep(): OnboardingWizardStepDefinition {
         kind: 'status',
         id: 'agent-tools.browser-media',
         label: 'Browser and media helpers',
-        hint: 'Browser, image, audio, and file helpers are capability surfaces. Agent uses them only when the current task needs them and policy allows it.',
+        hint: 'Browser, image, audio, and file helpers are task-scoped tools. Agent uses them only when the current task needs them and policy allows it.',
         defaultValue: 'Task scoped',
       },
       {
         kind: 'status',
         id: 'agent-tools.approval-boundary',
         label: 'Power action boundary',
-        hint: 'Workspace writes, package installs, external sends, account changes, and service changes require an explicit command or confirmation.',
+        hint: 'Workspace writes, package installs, external sends, and account changes require an explicit command or confirmation.',
         defaultValue: 'Approval required',
       },
       {
@@ -468,10 +468,10 @@ export function buildVoiceMediaStep(): OnboardingWizardStepDefinition {
     id: 'agent-voice-media',
     title: 'Voice and media',
     shortLabel: 'Voice',
-    description: 'Prepare voice, speech, image input, and media understanding as Agent operator surfaces rather than runtime lifecycle features.',
+    description: 'Prepare voice, speech, image input, and media understanding as Agent operator tools rather than runtime lifecycle features.',
     summaryTitle: 'Voice and media posture',
     summaryLines: [
-      'Voice and speech: optional operator surfaces',
+      'Voice and speech: optional operator tools',
       'Image/audio inputs: explicit attachment workflows',
       'Media generation and playback: provider-backed and policy-gated',
     ],

package/src/input/settings-modal-types.ts

@@ -55,12 +55,12 @@ export const SETTINGS_CATEGORY_GROUPS: ReadonlyArray<{
   readonly label: string;
   readonly categories: readonly SettingsCategory[];
 }> = [
-  { label: 'Interface', categories: ['display', 'ui', 'behavior', 'permissions'] },
-  { label: 'AI Routing', categories: ['provider', 'subscriptions', 'helper', 'tools', 'tts'] },
-  { label: 'Service & Network', categories: ['service', 'network', 'controlPlane', 'httpListener', 'web'] },
-  { label: 'Surfaces & Integrations', categories: ['surfaces', 'mcp'] },
-  { label: 'Automation', categories: ['batch', 'automation', 'watchers', 'orchestration', 'wrfc'] },
-  { label: 'Runtime & Data', categories: ['storage', 'runtime', 'cache', 'telemetry'] },
+  { label: 'Agent Experience', categories: ['display', 'ui', 'behavior', 'permissions'] },
+  { label: 'Models and Providers', categories: ['provider', 'subscriptions', 'helper', 'tools', 'tts'] },
+  { label: 'Local Agent State', categories: ['storage', 'runtime', 'cache', 'telemetry'] },
+  { label: 'Tools and Automation', categories: ['mcp', 'batch', 'automation', 'watchers'] },
+  { label: 'External Runtime Connection', categories: ['network', 'controlPlane', 'httpListener', 'web', 'service', 'surfaces'] },
+  { label: 'Delegation Compatibility', categories: ['orchestration', 'wrfc'] },
   { label: 'Advanced', categories: ['flags', 'release', 'danger'] },
 ];
 

package/src/renderer/settings-modal-helpers.ts

@@ -86,10 +86,10 @@ export const CATEGORY_LABELS: Record<(typeof SETTINGS_CATEGORIES)[number], strin
   wrfc: 'WRFC Delegation',
   helper: 'Helper',
   tts: 'TTS',
-  service: 'Service',
+  service: 'Runtime Install',
   controlPlane: 'Runtime API',
-  httpListener: 'HTTP Listener',
-  web: 'Web',
+  httpListener: 'Inbound Events',
+  web: 'Browser Companion',
   batch: 'Batch',
   automation: 'Automation',
   watchers: 'Watchers',
@@ -97,7 +97,7 @@ export const CATEGORY_LABELS: Record<(typeof SETTINGS_CATEGORIES)[number], strin
   telemetry: 'Telemetry',
   cache: 'Cache',
   mcp: 'MCP',
-  surfaces: 'Surfaces',
+  surfaces: 'Channels',
   release: 'Release',
   danger: 'Danger',
   tools: 'Tools',
@@ -109,7 +109,7 @@ export const SETTING_LABELS: Partial<Record<string, string>> = {
   'ui.systemMessages': 'System Message Target',
   'ui.operationalMessages': 'Operational Message Target',
   'ui.wrfcMessages': 'Delegated WRFC Message Target',
-  'ui.voiceEnabled': 'Voice Surface',
+  'ui.voiceEnabled': 'Voice Interaction',
   'behavior.autoCompactThreshold': 'Auto-Compact %',
   'behavior.staleContextWarnings': 'Context Warnings',
   'behavior.returnContextMode': 'Return Context',
@@ -135,14 +135,14 @@ export const SETTING_LABELS: Partial<Record<string, string>> = {
   'controlPlane.tls.mode': 'Runtime API TLS Mode',
   'controlPlane.tls.certFile': 'Runtime API TLS Cert',
   'controlPlane.tls.keyFile': 'Runtime API TLS Key',
-  // HTTP Listener
+  // Inbound event endpoint
   'httpListener.hostMode': 'HTTP Host Mode',
   'httpListener.host': 'HTTP Host',
   'httpListener.port': 'HTTP Port',
   'httpListener.trustProxy': 'HTTP Trust Proxy',
   'httpListener.tls.mode': 'HTTP TLS Mode',
   'httpListener.tls.certFile': 'HTTP TLS Cert',
-  // Web Server
+  // Browser companion
   'web.enabled': 'Web Enabled',
   'web.hostMode': 'Web Host Mode',
   'web.host': 'Web Host',

package/src/renderer/settings-modal.ts

@@ -24,7 +24,7 @@ import {
 
 const CATEGORY_INFO: Record<SettingsCategory, string> = {
   display: 'Presentation settings for the terminal transcript: streaming, line numbers, thinking visibility, reasoning summaries, token speed, and tool previews.',
-  ui: 'Controls where operational messages render and whether voice surfaces are enabled. These settings change visibility, not provider behavior.',
+  ui: 'Controls where operational messages render and whether voice interaction is enabled. These settings change visibility, not provider behavior.',
   provider: 'Default model routing for normal chat turns, embeddings, reasoning effort, and persistent system prompt file.',
   subscriptions: 'Provider subscription login state and routing posture. Active sessions can be reviewed or signed out here; API keys remain managed through secrets.',
   behavior: 'Day-to-day shell behavior: approval posture, compaction, history, guidance, notifications, stale-context warnings, return context, and Human-in-the-Loop mode.',
@@ -34,10 +34,10 @@ const CATEGORY_INFO: Record<SettingsCategory, string> = {
   wrfc: 'WRFC is external to normal Agent operation. Review these copied compatibility values only for explicit GoodVibes TUI build delegation.',
   helper: 'Helper model defaults used by helper subsystems when they do not use the main chat route.',
   tts: 'Text-to-speech provider, voice, and optional spoken-turn LLM overrides.',
-  service: 'External GoodVibes runtime service posture. Agent shows these compatibility keys for inspection only and does not install, start, stop, restart, or autostart services.',
-  controlPlane: 'External GoodVibes runtime API settings for local admin/API access. Agent connects to that runtime and does not mutate its bind posture.',
-  httpListener: 'External HTTP listener settings for webhook and integration ingress. Agent does not start or expose the listener.',
-  web: 'External browser surface settings. Agent does not own the web listener or network bind lifecycle.',
+  service: 'External runtime installation posture. Agent shows these compatibility keys for inspection only and does not install, start, stop, restart, or autostart anything.',
+  controlPlane: 'External runtime API connection settings. Agent connects to that runtime and does not mutate its bind posture.',
+  httpListener: 'Inbound event endpoint settings owned by the external runtime. Agent inspects readiness and does not expose endpoints.',
+  web: 'External browser companion settings. Agent does not own browser hosting or network bind lifecycle.',
   batch: 'Batch execution settings reported from the external GoodVibes runtime. Agent does not own remote queue provisioning.',
   automation: 'Scheduled and automated run settings, concurrency, timeout, catch-up, cooldown, and retention behavior.',
   watchers: 'File/process watcher heartbeat, polling, and recovery-window behavior.',
@@ -45,12 +45,12 @@ const CATEGORY_INFO: Record<SettingsCategory, string> = {
   telemetry: 'Telemetry payload policy.',
   cache: 'Provider and model cache behavior, TTL, and hit-rate monitoring.',
   mcp: 'MCP server trust and scope review. Trust changes can expose local files, tools, databases, browsers, or remote automation depending on the server.',
-  surfaces: 'External app surfaces such as Slack, Discord, ntfy, Telegram, webhooks, chat bridges, and messaging providers.',
+  surfaces: 'Messaging and notification channel accounts such as Slack, Discord, ntfy, Telegram, chat bridges, and delivery providers.',
   release: 'Release-channel preference.',
-  danger: 'High-impact runtime and listener switches. Agent renders host-owned switches read-only; use GoodVibes TUI or the owning host to change them.',
+  danger: 'High-impact runtime switches. Agent renders host-owned switches read-only; use the owning GoodVibes runtime host to change them.',
   tools: 'Tool LLM and helper model routing. Empty provider/model values inherit the active chat route unless a specific helper/tool route is set.',
   flags: 'Feature flags are SDK runtime gates. They are separate from normal config keys because they enable or disable staged runtime behavior.',
-  network: 'Read-only view of external GoodVibes runtime API, HTTP listener, and browser web bind posture plus editable Agent network settings.',
+  network: 'Read-only view of external runtime API, inbound-event, and browser companion bind posture plus editable Agent network settings.',
 };
 
 const ENUM_VALUE_DESCRIPTIONS: Record<string, Record<string, string>> = {
@@ -86,7 +86,7 @@ const ENUM_VALUE_DESCRIPTIONS: Record<string, Record<string, string>> = {
   },
   'httpListener.hostMode': {
     localhost: 'Bind only to this computer.',
-    network: 'Bind for LAN/webhook access using the default network host.',
+    network: 'Bind for LAN event delivery using the default network host.',
     custom: 'Use the explicit host value in the related host setting.',
   },
   'web.hostMode': {
@@ -110,12 +110,12 @@ const ENUM_VALUE_DESCRIPTIONS: Record<string, Record<string, string>> = {
     both: 'Show explicit delegated-build WRFC messages in both panels and the transcript.',
   },
   'surfaces.telegram.mode': {
-    webhook: 'Receive Telegram updates through webhook delivery.',
-    polling: 'Poll Telegram for updates from the service.',
+    webhook: 'Receive Telegram updates through externally hosted delivery.',
+    polling: 'Poll Telegram for updates from the configured account.',
   },
   'surfaces.whatsapp.provider': {
     'meta-cloud': 'Use Meta Cloud API credentials and identifiers.',
-    bridge: 'Use a bridge service URL/token flow instead of direct Meta Cloud API delivery.',
+    bridge: 'Use a bridge endpoint URL/token flow instead of direct Meta Cloud API delivery.',
   },
 };
 

package/src/runtime/bootstrap.ts

@@ -52,7 +52,7 @@ const GOODVIBES_AGENT_OPERATOR_POLICY = [
   '- WRFC is never the default Agent reasoning path. Do not create local WRFC chains for planning, research, operations, knowledge, memory, configuration, approvals, automation observability, or ordinary assistant work.',
   '- GoodVibes Agent is not the coding TUI. Do not use the `agent` tool to spawn local Engineer, Reviewer, Tester, Verifier, or batch-spawn roots from Agent.',
   '- When the user explicitly asks to build, implement, fix, patch, or review code, preserve the full original user ask and delegate one build request to GoodVibes TUI through the public shared-session/build-delegation contract. Include clear executionIntent and request WRFC only for explicit build/fix/review work or when the user explicitly asks for WRFC/agent review.',
-  '- Do not narrow explicit build/fix/review requests into design-only, read-only, or no-write work unless the user explicitly requested that limitation. TUI owns file edits, git/worktree work, runtime-isolation UX, and the WRFC owner chain.',
+  '- Do not narrow explicit build/fix/review requests into design-only, read-only, or no-write work unless the user explicitly requested that limitation. TUI owns file edits, git/worktree work, execution isolation UX, and the WRFC owner chain.',
   '- If a stable public delegation route is unavailable, say that the task needs GoodVibes TUI delegation and report the missing route instead of pretending to implement it locally or spawning sibling local agents.',
 ].join('\n');
 

package/src/runtime/onboarding/derivation.ts

@@ -6,6 +6,7 @@ import type {
   OnboardingNetworkMode,
   OnboardingReopenEditAcknowledgementState,
   OnboardingSnapshotState,
+  OnboardingStep1CapabilityFlags,
   OnboardingStep1CapabilityItem,
   OnboardingStepDerivationState,
 } from './types.ts';
@@ -185,10 +186,6 @@ function hasAnyServerEnabled(snapshot: OnboardingSnapshotState): boolean {
     || snapshot.bindSettings.web.enabled;
 }
 
-function hasBrowserAccess(snapshot: OnboardingSnapshotState): boolean {
-  return snapshot.bindSettings.web.enabled;
-}
-
 function isLoopbackHost(host: string | null | undefined): boolean {
   const normalized = (host ?? '').trim().toLowerCase();
   if (normalized.length === 0) return false;
@@ -251,43 +248,72 @@ function hasExternalIntegrations(snapshot: OnboardingSnapshotState): boolean {
     || countConfiguredSurfaceKinds(snapshot) > 0;
 }
 
-function describeLocalTuiOnly(snapshot: OnboardingSnapshotState): string {
+function hasLocalBehaviorCustomization(snapshot: OnboardingSnapshotState): boolean {
+  return hasCustomizedWorkspaceDefaults(snapshot)
+    || countPermissionToolOverrides(snapshot) > 0
+    || snapshot.runtimeDefaults.secretStoragePolicy !== DEFAULT_CONFIG.storage.secretPolicy;
+}
+
+function hasCommunicationChannelSignals(snapshot: OnboardingSnapshotState): boolean {
+  return hasExternalIntegrations(snapshot);
+}
+
+function hasAutomationReviewSignals(snapshot: OnboardingSnapshotState): boolean {
+  return hasWebhookOrEventIngress(snapshot);
+}
+
+function describeOperatorTerminal(snapshot: OnboardingSnapshotState): string {
   if (!hasAnyServerEnabled(snapshot)) {
-    return 'Use GoodVibes Agent in this terminal while connecting to the existing GoodVibes runtime. Agent setup does not enable network services or extra entrypoints.';
+    return 'Use GoodVibes Agent as the terminal operator while connecting to the existing GoodVibes runtime. Agent setup does not create new entrypoints.';
   }
 
-  return 'Keep Agent local-first by reviewing runtime connectivity separately from Agent-owned assistant setup.';
+  return 'Use GoodVibes Agent as the terminal operator; runtime host settings are shown only so the connection is understandable.';
 }
 
-function describeBrowserAccess(snapshot: OnboardingSnapshotState): string {
-  return snapshot.bindSettings.web.enabled
-    ? 'Review browser access already exposed by the runtime owner. Agent records visibility but does not change network posture.'
-    : 'Browser access is optional. Agent can stay terminal-first while the runtime owner controls any browser entrypoint.';
+function describeProviderAccess(snapshot: OnboardingSnapshotState): string {
+  const configuredCount = getConfiguredProviderSignalIds(snapshot).length;
+  if (configuredCount === 0 && !hasCustomizedProviderRouting(snapshot)) {
+    return 'Choose the model route the Agent should use for normal assistant turns, tool reasoning, and embeddings.';
+  }
+
+  return `Review ${Math.max(configuredCount, 1)} provider auth or routing signal(s) already available to Agent.`;
 }
 
-function describeRemoteDeviceAccess(snapshot: OnboardingSnapshotState): string {
-  return hasRemoteDeviceAccess(snapshot)
-    ? 'Review runtime access reachable from other devices on your LAN. Local authentication is required.'
-    : 'Other-device access is optional and remains controlled by the runtime owner.';
+function describeAgentKnowledge(): string {
+  return 'Agent Knowledge uses the isolated /api/goodvibes-agent/knowledge segment only; it never falls back to another knowledge segment.';
 }
 
-function describeWebhookIngress(snapshot: OnboardingSnapshotState): string {
-  return hasWebhookOrEventIngress(snapshot)
-    ? 'Review incoming webhook, callback, and automation-event routes exposed by the runtime owner.'
-    : 'Incoming webhook and callback routes are optional; Agent onboarding does not create them.';
+function describeLocalBehavior(snapshot: OnboardingSnapshotState): string {
+  if (!hasLocalBehaviorCustomization(snapshot)) {
+    return 'Configure local memory, routines, skills, personas, permissions, and secret handling before the Agent starts doing useful work.';
+  }
+
+  return 'Review existing local behavior, permission, display, or secret-handling choices before applying Agent setup.';
 }
 
-function describeExternalIntegrations(snapshot: OnboardingSnapshotState): string {
+function describeCommunicationChannels(snapshot: OnboardingSnapshotState): string {
   const integrationCount = new Set<string>([
     ...getExternalIntegrationServiceIds(snapshot),
     ...getConfiguredSurfaceKinds(snapshot),
   ]).size;
 
   if (integrationCount === 0) {
-    return 'Connect only the channels you want the assistant to use, then review delivery safety before sending externally.';
+    return 'Connect only the channels the Agent should use, and keep outbound delivery explicit until a user action allows it.';
+  }
+
+  return `Review ${integrationCount} configured channel or integration signal(s) before the Agent uses them for delivery.`;
+}
+
+function describeAutomationReview(snapshot: OnboardingSnapshotState): string {
+  if (!hasAutomationReviewSignals(snapshot)) {
+    return 'Review schedules, routine promotion, approvals, and automation visibility without starting hidden background work.';
   }
 
-  return `Review ${integrationCount} detected channel or integration signal(s) before allowing external delivery.`;
+  return 'Review existing event, schedule, or automation signals and keep all side effects behind explicit commands or confirmations.';
+}
+
+function describeTuiDelegation(): string {
+  return 'Delegate explicit build, fix, implementation, and review work to GoodVibes TUI; WRFC is requested only when the user explicitly asks for it.';
 }
 
 function getAcknowledgementAccepted(
@@ -329,61 +355,64 @@ export function deriveStep1Capabilities(
 ): readonly OnboardingStep1CapabilityItem[] {
   return [
     {
-      id: 'local-tui-only',
-      label: 'Agent Terminal First',
-      selected: !hasAnyServerEnabled(snapshot),
-      detail: describeLocalTuiOnly(snapshot),
+      id: 'operator-terminal',
+      label: 'Agent Operator TUI',
+      selected: true,
+      detail: describeOperatorTerminal(snapshot),
+    },
+    {
+      id: 'provider-access',
+      label: 'Provider and Model Access',
+      selected: hasConfiguredProviderState(snapshot) || hasCustomizedProviderRouting(snapshot),
+      detail: describeProviderAccess(snapshot),
+    },
+    {
+      id: 'agent-knowledge',
+      label: 'Isolated Agent Knowledge',
+      selected: true,
+      detail: describeAgentKnowledge(),
     },
     {
-      id: 'browser-access',
-      label: 'Optional Browser Access',
-      selected: hasBrowserAccess(snapshot),
-      detail: describeBrowserAccess(snapshot),
+      id: 'local-behavior',
+      label: 'Local Memory and Skills',
+      selected: hasLocalBehaviorCustomization(snapshot),
+      detail: describeLocalBehavior(snapshot),
     },
     {
-      id: 'network-access',
-      label: 'Optional Other-Device Access',
-      selected: hasRemoteDeviceAccess(snapshot),
-      detail: describeRemoteDeviceAccess(snapshot),
+      id: 'communication-channels',
+      label: 'Channels and Notifications',
+      selected: hasCommunicationChannelSignals(snapshot),
+      detail: describeCommunicationChannels(snapshot),
     },
     {
-      id: 'webhook-events',
-      label: 'Optional Incoming Events',
-      selected: hasWebhookOrEventIngress(snapshot),
-      detail: describeWebhookIngress(snapshot),
+      id: 'automation-review',
+      label: 'Routines and Automation Review',
+      selected: hasAutomationReviewSignals(snapshot),
+      detail: describeAutomationReview(snapshot),
     },
     {
-      id: 'external-integrations',
-      label: 'Channels and Integrations',
-      selected: hasExternalIntegrations(snapshot),
-      detail: describeExternalIntegrations(snapshot),
+      id: 'tui-delegation',
+      label: 'Explicit Build Delegation',
+      selected: true,
+      detail: describeTuiDelegation(),
     },
   ];
 }
 
 export function deriveStep1CapabilityFlags(
   snapshot: OnboardingSnapshotState,
-): {
-  readonly providers: boolean;
-  readonly services: boolean;
-  readonly subscriptions: boolean;
-  readonly auth: boolean;
-  readonly controlPlane: boolean;
-  readonly httpListener: boolean;
-  readonly web: boolean;
-  readonly surfaces: boolean;
-} {
+): OnboardingStep1CapabilityFlags {
   return {
-    providers: hasConfiguredProviderState(snapshot) || hasCustomizedProviderRouting(snapshot),
-    services: snapshot.services.total > 0,
+    providerAccess: hasConfiguredProviderState(snapshot) || hasCustomizedProviderRouting(snapshot),
     subscriptions: snapshot.subscriptions.active.length > 0 || snapshot.subscriptions.pending.length > 0,
     auth: snapshot.auth.snapshot.userCount > 0
       || snapshot.auth.snapshot.sessionCount > 0
       || snapshot.auth.snapshot.bootstrapCredentialPresent,
-    controlPlane: snapshot.bindSettings.daemonEnabled || snapshot.bindSettings.controlPlane.enabled,
-    httpListener: snapshot.bindSettings.httpListenerEnabled,
-    web: snapshot.bindSettings.web.enabled,
-    surfaces: countConfiguredSurfaceKinds(snapshot) > 0,
+    agentKnowledge: true,
+    localBehavior: hasLocalBehaviorCustomization(snapshot),
+    communicationChannels: hasCommunicationChannelSignals(snapshot),
+    automationReview: hasAutomationReviewSignals(snapshot),
+    tuiDelegation: true,
   };
 }
 

package/src/runtime/onboarding/types.ts

@@ -193,11 +193,13 @@ export interface OnboardingSnapshotState {
 }
 
 export type OnboardingStep1CapabilityId =
-  | 'local-tui-only'
-  | 'browser-access'
-  | 'network-access'
-  | 'webhook-events'
-  | 'external-integrations';
+  | 'operator-terminal'
+  | 'provider-access'
+  | 'agent-knowledge'
+  | 'local-behavior'
+  | 'communication-channels'
+  | 'automation-review'
+  | 'tui-delegation';
 
 export interface OnboardingStep1CapabilityItem {
   readonly id: OnboardingStep1CapabilityId;
@@ -207,14 +209,14 @@ export interface OnboardingStep1CapabilityItem {
 }
 
 export interface OnboardingStep1CapabilityFlags {
-  readonly providers: boolean;
-  readonly services: boolean;
+  readonly providerAccess: boolean;
   readonly subscriptions: boolean;
   readonly auth: boolean;
-  readonly controlPlane: boolean;
-  readonly httpListener: boolean;
-  readonly web: boolean;
-  readonly surfaces: boolean;
+  readonly agentKnowledge: boolean;
+  readonly localBehavior: boolean;
+  readonly communicationChannels: boolean;
+  readonly automationReview: boolean;
+  readonly tuiDelegation: boolean;
 }
 
 export interface OnboardingAcknowledgementState {

package/src/tools/wrfc-agent-guard.ts

@@ -130,7 +130,7 @@ const LOCAL_AGENT_DENIAL = [
 ].join(' ');
 
 const LOCAL_CODING_TOOL_DENIAL = [
-  'GoodVibes Agent does not perform direct local file mutation, local WRFC workflow execution, or local runtime-isolation execution from the main conversation.',
+  'GoodVibes Agent does not perform direct local file mutation, local WRFC workflow execution, or local execution-isolation work from the main conversation.',
   'For explicit build/fix/review/code execution work, delegate one request to GoodVibes TUI through the public shared-session/build-delegation contract with the full original user ask.',
   'For durable Agent memory, skills, personas, routines, and knowledge, use the Agent-owned commands and isolated Agent Knowledge routes.',
 ].join(' ');

package/src/version.ts

@@ -6,7 +6,7 @@ import { join } from 'node:path';
 // The prebuild script updates the fallback value before compilation.
 // Uses import.meta.dir (Bun) to locate package.json relative to this file,
 // which is correct regardless of the process working directory.
-let _version = '0.1.72';
+let _version = '0.1.73';
 let _sdkVersion = '0.33.35';
 try {
   const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', 'package.json'), 'utf-8')) as {