@pellux/goodvibes-agent 0.1.8 → 0.1.10

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 All notable changes to GoodVibes Agent will be recorded here.
 
+## 0.1.10 - 2026-05-31
+
+- 93aba19 Block agent-spawning hook authoring
+- 735839a Prune git header renderer from Agent
+- 95d22fd Remove unused git shell bootstrap wiring
+- 1392ebc Remove Agent write-quit commit helper
+- df6572f Remove coding header posture from Agent shell
+- 2b8e679 Align live verification with Agent routes
+- 70eb800 Add stable typecheck release scripts
+- 6b57500 Hide local agent activity in Agent UI
+- 7166188 Add Agent Knowledge CLI shortcuts
+- 386c19d Align service diagnostics with Agent boundaries
+- e8b19db Lock daemon-owned settings in Agent
+
+## 0.1.9 - 2026-05-31
+
+- 75e5d4a Align shell surface delegation test
+- a24c581 Use delegation wording in runtime indicator
+- 259a75f Guard Agent knowledge isolation
+- 59b6729 Align task help with Agent policy
+- 0074a76 Classify stale daemon knowledge routes
+
 ## 0.1.8 - 2026-05-31
 
 - 384c85a Remove stale WRFC artifact test

package/README.md

@@ -35,7 +35,7 @@ bun run dev
 Useful checks:
 
 ```sh
-bunx tsc --noEmit
+bun run typecheck
 bun run build
 bun run package:install-check
 bun run publish:check

package/docs/getting-started.md

@@ -1,6 +1,6 @@
 # Getting Started
 
-GoodVibes Agent `0.1.7` is the current installable public alpha of the personal operator assistant built on the GoodVibes TUI foundation.
+GoodVibes Agent `0.1.9` is the current installable public alpha of the personal operator assistant built on the GoodVibes TUI foundation.
 
 ## Requirements
 

package/docs/release-and-publishing.md

@@ -1,6 +1,6 @@
 # Release And Publishing
 
-GoodVibes Agent `0.1.7` is the current installable public alpha release.
+GoodVibes Agent `0.1.9` is the current installable public alpha release.
 
 ## Package Identity
 
@@ -17,7 +17,7 @@ Before any release candidate:
 
 ```sh
 bun install
-bunx tsc --noEmit
+bun run typecheck
 bun run build
 bun run package:install-check
 bun run publish:check

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pellux/goodvibes-agent",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "private": false,
   "description": "Near-fork GoodVibes operator assistant with the GoodVibes TUI shell, renderer, input, fullscreen workspace, and daemon-connected Agent product brain.",
   "type": "module",
@@ -40,6 +40,8 @@
     "dev": "bun run src/main.ts",
     "tui": "bun run src/main.ts",
     "dev:watch": "bun --watch src/main.ts",
+    "typecheck": "bunx tsc --noEmit",
+    "check:types": "bun run typecheck",
     "prebuild": "bun run scripts/prebuild.ts",
     "build": "bun build src/main.ts --compile --outfile dist/goodvibes-agent",
     "build:linux-x64": "bun build src/main.ts --compile --target=bun-linux-x64 --outfile dist/goodvibes-agent-linux-x64",
@@ -61,6 +63,7 @@
     "build:all": "bun run scripts/build.ts --all",
     "perf:check": "bun run scripts/perf-check.ts",
     "architecture:check": "bun run scripts/check-architecture.ts",
+    "audit:home": "bun run scripts/audit-goodvibes-home.ts",
     "foundation:artifacts": "bun run scripts/export-foundation-artifacts.ts",
     "verification:ledger": "bun run scripts/verification-ledger.ts",
     "verification:live": "bun run scripts/verify-live.ts",

package/src/cli/agent-knowledge-command.ts

@@ -1,8 +1,8 @@
 import { existsSync, readFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
+import { join } from 'node:path';
 import { createBrowserAgentSdk } from '@pellux/goodvibes-sdk/browser/agent';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
+import { SDK_VERSION, VERSION } from '../version.ts';
 import type { CliCommandOutput } from './types.ts';
 import type { CliCommandRuntime } from './management.ts';
 import { formatJsonOrText, yesNo } from './management.ts';
@@ -17,10 +17,12 @@ interface AgentDaemonConnection {
 
 interface AgentKnowledgeFailure {
   readonly ok: false;
-  readonly kind: 'daemon_unavailable' | 'auth_required' | 'daemon_route_unavailable' | 'daemon_error';
+  readonly kind: 'daemon_unavailable' | 'auth_required' | 'version_mismatch' | 'daemon_route_unavailable' | 'daemon_error';
   readonly error: string;
   readonly baseUrl: string;
   readonly route: string;
+  readonly daemonVersion?: string;
+  readonly expectedSdkVersion?: string;
 }
 
 interface AgentKnowledgeSuccess<TData> {
@@ -147,24 +149,8 @@ function hasFlag(args: readonly string[], flag: string): boolean {
   return args.includes(flag);
 }
 
-function packageJsonPath(): string {
-  return join(dirname(fileURLToPath(import.meta.url)), '..', '..', 'package.json');
-}
-
 function readPackageMetadata(): { readonly version: string; readonly sdkVersion: string } {
-  try {
-    const parsed = JSON.parse(readFileSync(packageJsonPath(), 'utf-8')) as unknown;
-    if (!isRecord(parsed)) return { version: 'unknown', sdkVersion: 'unknown' };
-    const dependencies = isRecord(parsed.dependencies) ? parsed.dependencies : {};
-    return {
-      version: typeof parsed.version === 'string' ? parsed.version : 'unknown',
-      sdkVersion: typeof dependencies['@pellux/goodvibes-sdk'] === 'string'
-        ? dependencies['@pellux/goodvibes-sdk']
-        : 'unknown',
-    };
-  } catch {
-    return { version: 'unknown', sdkVersion: 'unknown' };
-  }
+  return { version: VERSION, sdkVersion: SDK_VERSION };
 }
 
 function resolveDaemonConnection(runtime: CliCommandRuntime): AgentDaemonConnection {
@@ -200,13 +186,28 @@ async function fetchDaemonStatus(connection: AgentDaemonConnection): Promise<{ r
   }
 }
 
-function classifyKnowledgeError(error: unknown, connection: AgentDaemonConnection, route: string): AgentKnowledgeFailure {
+async function classifyKnowledgeError(error: unknown, connection: AgentDaemonConnection, route: string): Promise<AgentKnowledgeFailure> {
   const message = summarizeError(error);
   const lower = message.toLowerCase();
   if (lower.includes('401') || lower.includes('unauthorized') || lower.includes('auth')) {
     return { ok: false, kind: 'auth_required', error: message, baseUrl: connection.baseUrl, route };
   }
   if (lower.includes('404') || lower.includes('not found')) {
+    const metadata = readPackageMetadata();
+    const daemon = await fetchDaemonStatus(connection);
+    const daemonRecord = isRecord(daemon.body) ? daemon.body : {};
+    const daemonVersion = readString(daemonRecord, 'version') ?? 'unknown';
+    if (daemon.ok && daemonVersion !== metadata.sdkVersion) {
+      return {
+        ok: false,
+        kind: 'version_mismatch',
+        error: `External daemon SDK version ${daemonVersion} does not match Agent SDK pin ${metadata.sdkVersion}; Agent Knowledge route is unavailable.`,
+        baseUrl: connection.baseUrl,
+        route,
+        daemonVersion,
+        expectedSdkVersion: metadata.sdkVersion,
+      };
+    }
     return { ok: false, kind: 'daemon_route_unavailable', error: message, baseUrl: connection.baseUrl, route };
   }
   if (lower.includes('fetch') || lower.includes('connect') || lower.includes('econnrefused')) {
@@ -407,6 +408,12 @@ function formatFailure(failure: AgentKnowledgeFailure, json: boolean): string {
     `  ${failure.error}`,
     `  daemon: ${failure.baseUrl}`,
     `  route: ${failure.route}`,
+    failure.kind === 'version_mismatch' && failure.daemonVersion && failure.expectedSdkVersion
+      ? `  versions: daemon=${failure.daemonVersion} expected=${failure.expectedSdkVersion}`
+      : null,
+    failure.kind === 'version_mismatch'
+      ? '  next: update/restart the external GoodVibes daemon so /status matches the Agent SDK pin.'
+      : null,
     failure.kind === 'daemon_route_unavailable'
       ? '  next: update/restart the external GoodVibes daemon to the SDK version required by this Agent package.'
       : null,
@@ -530,6 +537,21 @@ export async function handleAgentKnowledgeCommand(runtime: CliCommandRuntime): P
   };
 }
 
+export async function handleAgentKnowledgeShortcutCommand(
+  runtime: CliCommandRuntime,
+  subcommand: 'ask' | 'search',
+): Promise<CliCommandOutput> {
+  return handleAgentKnowledgeCommand({
+    ...runtime,
+    cli: {
+      ...runtime.cli,
+      command: 'knowledge',
+      rawCommand: 'knowledge',
+      commandArgs: [subcommand, ...runtime.cli.commandArgs],
+    },
+  });
+}
+
 export async function handleCompatCommand(runtime: CliCommandRuntime): Promise<CliCommandOutput> {
   const connection = resolveDaemonConnection(runtime);
   const metadata = readPackageMetadata();

package/src/cli/help.ts

@@ -41,11 +41,12 @@ export function renderGoodVibesHelp(binary = 'goodvibes-agent'): string {
     '  auth                       Inspect and manage local users, sessions, and bootstrap auth',
     '  compat                     Inspect Agent SDK pin, daemon version, and Agent knowledge route readiness',
     '  knowledge                  Use isolated Agent Knowledge/Wiki routes',
+    '  ask|search                 Shortcuts for isolated Agent Knowledge ask/search',
     '  delegate                   Explicitly delegate build/fix/review work to GoodVibes TUI',
     '  subscription               Start/finish/logout provider subscription sessions',
     '  secrets                    List, set, link, delete, and test GoodVibes secret refs',
     '  sessions                   List, show, export, or resume saved sessions',
-    '  tasks                      List/show in-process tasks or submit a non-interactive task',
+    '  tasks                      List/show in-process runtime tasks (read-only)',
     '  pair|qrcode                Print companion pairing payload and QR code',
     '  surfaces                   Inspect/check browser/listener/external surfaces (read-only)',
     '  listener test              Test HTTP listener/webhook readiness',
@@ -95,6 +96,8 @@ export function renderGoodVibesHelp(binary = 'goodvibes-agent'): string {
     `  ${binary} compat`,
     `  ${binary} knowledge status`,
     `  ${binary} knowledge ask "What is GoodVibes Agent?"`,
+    `  ${binary} ask "What is GoodVibes Agent?"`,
+    `  ${binary} search "release checklist"`,
     `  ${binary} delegate --wrfc "fix the failing tests in ~/work/project"`,
     `  ${binary} surfaces`,
     `  ${binary} surfaces check`,
@@ -174,6 +177,16 @@ const COMMAND_HELP: Record<string, CommandHelp> = {
       'knowledge ingest-url https://example.com/page --title "Reference"',
     ],
   },
+  ask: {
+    usage: ['ask <question> [--limit <n>] [--mode concise|standard|detailed]'],
+    summary: 'Shortcut for isolated Agent Knowledge ask. This never queries default Knowledge/Wiki or HomeGraph.',
+    examples: ['ask "What is GoodVibes Agent?"', 'ask "release checklist" --mode concise'],
+  },
+  search: {
+    usage: ['search <query> [--limit <n>]'],
+    summary: 'Shortcut for isolated Agent Knowledge search. This never queries default Knowledge/Wiki or HomeGraph.',
+    examples: ['search "release checklist"', 'search "operator workspace" --limit 5'],
+  },
   delegate: {
     usage: ['delegate [--wrfc] <build/fix/review task>'],
     summary: 'Create one shared-session task request for GoodVibes TUI. WRFC is requested only with --wrfc.',
@@ -198,9 +211,9 @@ const COMMAND_HELP: Record<string, CommandHelp> = {
     examples: ['sessions list', 'sessions show latest-session', 'sessions export abc123 session.json'],
   },
   tasks: {
-    usage: ['tasks list', 'tasks show <taskId>', 'tasks submit <prompt>'],
-    summary: 'Inspect runtime tasks or submit a non-interactive task.',
-    examples: ['tasks list', 'tasks submit "check provider readiness"'],
+    usage: ['tasks list', 'tasks show <taskId>'],
+    summary: 'Inspect in-process runtime tasks. Agent blocks copied task submission; use run for one-shot work or delegate for explicit build/fix/review handoff.',
+    examples: ['tasks list', 'tasks show task-123', 'run "check provider readiness"', 'delegate "fix the failing tests"'],
   },
   surfaces: {
     usage: ['surfaces [list]', 'surfaces check', 'surfaces show <surfaceId>'],

package/src/cli/management-commands.ts

@@ -329,9 +329,9 @@ export async function buildControlPlaneStatusResult(runtime: CliCommandRuntime):
   };
   const issues: string[] = [];
   if (enabled === true && !reachable) issues.push(`Control plane is enabled but not reachable on ${binding.host}:${binding.port}.`);
-  if (enabled === true && service.enabled !== true) issues.push('Control plane is enabled but service mode is off.');
-  if (enabled === true && service.autostart !== true) issues.push('Control plane is enabled but service autostart is off.');
-  if (enabled === true && service.restartOnFailure !== true) issues.push('Control plane is enabled but service restart-on-failure is off.');
+  if (enabled === true && service.enabled !== true) issues.push('Control plane is enabled on the external daemon config, but Agent service ownership is disabled.');
+  if (enabled === true && service.autostart !== true) issues.push('Control plane is enabled on the external daemon config, but daemon autostart is off.');
+  if (enabled === true && service.restartOnFailure !== true) issues.push('Control plane is enabled on the external daemon config, but restart-on-failure is off.');
   if (isNetworkFacing(enabled, binding) && !auth.userStorePresent) issues.push('Network-facing control plane has no local auth user store.');
   if (isNetworkFacing(enabled, binding) && auth.bootstrapCredentialPresent) issues.push('Network-facing control plane still has a bootstrap credential file.');
   return {

package/src/cli/management.ts

@@ -32,7 +32,7 @@ import { handleServiceCommand } from './service-command.ts';
 import { handleBundleCommand } from './bundle-command.ts';
 import { buildListenerTestResult, formatListenerTestResult, handleSurfacesCommand } from './surface-command.ts';
 import { buildControlPlaneStatusResult, formatControlPlaneStatus, handleSecrets, handleSessions, handleTasks, renderPairing, renderRemote, renderSubscriptions, renderWeb } from './management-commands.ts';
-import { handleAgentKnowledgeCommand, handleCompatCommand, handleDelegateCommand } from './agent-knowledge-command.ts';
+import { handleAgentKnowledgeCommand, handleAgentKnowledgeShortcutCommand, handleCompatCommand, handleDelegateCommand } from './agent-knowledge-command.ts';
 import { GOODVIBES_AGENT_SURFACE_ROOT } from '../config/surface.ts';
 
 export interface CliCommandRuntime {
@@ -703,6 +703,12 @@ export async function handleGoodVibesCliCommand(runtime: CliCommandRuntime): Pro
         console.log(result.output);
         return { handled: true, exitCode: result.exitCode };
       }
+      case 'ask':
+      case 'search': {
+        const result = await handleAgentKnowledgeShortcutCommand(runtime, runtime.cli.command);
+        console.log(result.output);
+        return { handled: true, exitCode: result.exitCode };
+      }
       case 'delegate': {
         const result = await handleDelegateCommand(runtime);
         console.log(result.output);

package/src/cli/parser.ts

@@ -31,6 +31,9 @@ const COMMAND_ALIASES: Readonly<Record<string, GoodVibesCliCommand>> = {
   knowledge: 'knowledge',
   know: 'knowledge',
   kb: 'knowledge',
+  ask: 'ask',
+  search: 'search',
+  find: 'search',
   delegate: 'delegate',
   build: 'delegate',
   subscription: 'subscription',

package/src/cli/service-posture.ts

@@ -397,19 +397,19 @@ export async function buildCliServicePosture(
   const issues: string[] = [];
 
   if (serverBackedEnabled && !config.enabled) {
-    issues.push('Server-backed surfaces are enabled but service mode is off.');
+    issues.push('Daemon-owned surfaces are configured, but Agent service ownership is disabled.');
   }
   if (config.enabled && !config.autostart) {
-    issues.push('Service mode is enabled but autostart is off.');
+    issues.push('External daemon service config has autostart off.');
   }
   if (config.enabled && !config.restartOnFailure) {
-    issues.push('Service mode is enabled but restart-on-failure is off.');
+    issues.push('External daemon service config has restart-on-failure off.');
   }
   if (config.enabled && !status.installed) {
-    issues.push('Service mode is enabled but no platform service definition is installed.');
+    issues.push('External daemon service config is enabled, but no platform service definition is installed.');
   }
   if (config.enabled && !status.running) {
-    issues.push('Service mode is enabled but the managed service is not running.');
+    issues.push('External daemon service config is enabled, but the managed service is not running.');
   }
   if (status.actionError) {
     issues.push(`Service manager reported an error: ${status.actionError}`);
@@ -454,7 +454,7 @@ function yesNo(value: boolean): string {
 export function formatCliServicePosture(posture: CliServicePosture, json = false): string {
   if (json) return JSON.stringify(posture, null, 2);
   return [
-    'GoodVibes service',
+    'GoodVibes external daemon service',
     `  enabled: ${yesNo(posture.config.enabled)}`,
     `  autostart: ${yesNo(posture.config.autostart)}`,
     `  restartOnFailure: ${yesNo(posture.config.restartOnFailure)}`,

package/src/cli/status.ts

@@ -122,10 +122,10 @@ export function buildCliDoctorFindings(options: CliStatusOptions): readonly CliD
       id: 'service-disabled-for-server-surfaces',
       area: 'service',
       severity: 'warning',
-      summary: 'Server-backed surfaces are enabled but service mode is off.',
+      summary: 'Daemon-owned surfaces are configured while Agent service ownership is disabled.',
       cause: 'One or more daemon, control-plane, listener, or web settings are enabled while service.enabled is false.',
-      impact: 'The configured surfaces may not start automatically or survive restarts.',
-      action: 'Enable service mode or disable the server-backed surfaces you do not want.',
+      impact: 'The external daemon host must own availability for those surfaces; Agent will not start or enable them.',
+      action: 'Manage surface/service posture from GoodVibes TUI or the daemon host, then use Agent for read-only diagnostics.',
     });
   }
 
@@ -134,10 +134,10 @@ export function buildCliDoctorFindings(options: CliStatusOptions): readonly CliD
       id: 'service-autostart-disabled',
       area: 'service',
       severity: 'warning',
-      summary: 'Service mode is enabled but autostart is off.',
+      summary: 'External daemon service config has autostart off.',
       cause: 'service.enabled is true and service.autostart is false.',
       impact: 'The external GoodVibes daemon may not be available after login or reboot even though service mode is selected.',
-      action: 'Enable service.autostart if the daemon/listener/web surfaces should stay available.',
+      action: 'Configure daemon autostart from GoodVibes TUI or the daemon host; Agent will not mutate this setting.',
     });
   }
 
@@ -146,10 +146,10 @@ export function buildCliDoctorFindings(options: CliStatusOptions): readonly CliD
       id: 'service-restart-disabled',
       area: 'service',
       severity: 'warning',
-      summary: 'Service restart-on-failure is off.',
+      summary: 'External daemon service config has restart-on-failure off.',
       cause: 'service.enabled is true and service.restartOnFailure is false.',
       impact: 'A crashed daemon or listener may stay down until manually restarted.',
-      action: 'Enable service.restartOnFailure for durable daemon/listener operation.',
+      action: 'Configure restart-on-failure from GoodVibes TUI or the daemon host; Agent will not mutate this setting.',
     });
   }
 
@@ -163,7 +163,7 @@ export function buildCliDoctorFindings(options: CliStatusOptions): readonly CliD
         summary: issue,
         cause: 'The service lifecycle inspection found a mismatch between configured service/surface state and observed host state.',
         impact: 'Daemon, control-plane, listener, or web availability may not match the configuration.',
-        action: 'Run goodvibes-agent service check, then manage the daemon from GoodVibes TUI or your daemon host tooling.',
+        action: 'Use goodvibes-agent service check for read-only detail, then manage the daemon from GoodVibes TUI or your daemon host tooling.',
       });
     }
   }
@@ -326,7 +326,7 @@ export function renderCliStatus(options: CliStatusOptions): string {
       ? `  operatorTokens: ${options.auth.operatorTokenPresent ? 'present' : 'missing'} (${options.auth.operatorTokenPath})`
       : '  operatorTokens: unknown',
     '',
-    'Service:',
+    'External Daemon Service:',
     `  enabled: ${yesNo(serviceEnabled)}`,
     `  autostart: ${yesNo(serviceAutostart)}`,
     `  restartOnFailure: ${yesNo(restartOnFailure)}`,

package/src/cli/surface-command.ts

@@ -217,9 +217,9 @@ export async function buildListenerTestResult(runtime: CliCommandRuntime): Promi
   }).filter((surface) => surface.enabled === true);
   const issues: string[] = [];
   if (enabled !== true) issues.push('HTTP listener is disabled.');
-  if (enabled === true && service.enabled !== true) issues.push('HTTP listener is enabled but service mode is off.');
-  if (enabled === true && service.autostart !== true) issues.push('HTTP listener is enabled but service autostart is off.');
-  if (enabled === true && service.restartOnFailure !== true) issues.push('HTTP listener is enabled but service restart-on-failure is off.');
+  if (enabled === true && service.enabled !== true) issues.push('HTTP listener is enabled on the external daemon config, but Agent service ownership is disabled.');
+  if (enabled === true && service.autostart !== true) issues.push('HTTP listener is enabled on the external daemon config, but daemon autostart is off.');
+  if (enabled === true && service.restartOnFailure !== true) issues.push('HTTP listener is enabled on the external daemon config, but restart-on-failure is off.');
   if (isNetworkFacing(enabled, binding) && !auth.userStorePresent) issues.push('Network-facing listener has no local auth user store.');
   if (isNetworkFacing(enabled, binding) && auth.bootstrapCredentialPresent) issues.push('Network-facing listener still has a bootstrap credential file.');
   for (const surface of surfaces) {

package/src/cli/types.ts

@@ -12,6 +12,8 @@ export type GoodVibesCliCommand =
   | 'auth'
   | 'compat'
   | 'knowledge'
+  | 'ask'
+  | 'search'
   | 'delegate'
   | 'subscription'
   | 'secrets'

package/src/input/commands/experience-runtime.ts

@@ -165,7 +165,7 @@ export function registerExperienceRuntimeCommands(registry: CommandRegistry): vo
         ['shell', 'Shell execution approval with side-effect and credential review.'],
         ['file', 'File mutation approval with config/notebook differentiation.'],
         ['network', 'Network access approval with host/scope review.'],
-        ['delegate', 'Agent spawn/delegation approval with recursion ceilings.'],
+        ['delegate', 'Explicit GoodVibes TUI build delegation approval; local Agent spawn is blocked.'],
         ['mcp', 'MCP trust escalation approval with host/path review.'],
         ['remote', 'Remote dispatch approval with trust/artifact review.'],
         ['hook', 'Hook execution approval with deny/mutate authority review.'],

package/src/input/commands/hooks-runtime.ts

@@ -1,6 +1,26 @@
+import { readFileSync } from 'node:fs';
 import type { CommandRegistry } from '../command-registry.ts';
 import { requireHookApi } from './runtime-services.ts';
 
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+function containsAgentHookType(value: unknown): boolean {
+  if (Array.isArray(value)) return value.some((entry) => containsAgentHookType(entry));
+  if (!isRecord(value)) return false;
+  if (value.type === 'agent') return true;
+  return Object.values(value).some((entry) => containsAgentHookType(entry));
+}
+
+function fileContainsAgentHookType(path: string): boolean {
+  try {
+    return containsAgentHookType(JSON.parse(readFileSync(path, 'utf-8')) as unknown);
+  } catch {
+    return false;
+  }
+}
+
 export function registerHooksRuntimeCommands(registry: CommandRegistry): void {
   registry.register({
     name: 'hooks',
@@ -25,10 +45,14 @@ export function registerHooksRuntimeCommands(registry: CommandRegistry): void {
       if (subcommand === 'scaffold') {
         const [name, match, type] = args.slice(1);
         if (!name || !match || !type) {
-          ctx.print('Usage: /hooks scaffold <name> <match> <command|prompt|agent|http|ts>');
+          ctx.print('Usage: /hooks scaffold <name> <match> <command|prompt|http|ts>');
+          return;
+        }
+        if (type === 'agent') {
+          ctx.print('Blocked: GoodVibes Agent does not author local agent-spawning hooks. Use command, prompt, http, or ts hooks, or delegate explicit build work to GoodVibes TUI.');
           return;
         }
-        if (!['command', 'prompt', 'agent', 'http', 'ts'].includes(type)) {
+        if (!['command', 'prompt', 'http', 'ts'].includes(type)) {
           ctx.print(`Unknown hook type: ${type}`);
           return;
         }
@@ -118,6 +142,10 @@ export function registerHooksRuntimeCommands(registry: CommandRegistry): void {
           ctx.print('Usage: /hooks import <path> [merge|replace]');
           return;
         }
+        if (fileContainsAgentHookType(path)) {
+          ctx.print('Blocked: hook bundle contains type=agent entries. GoodVibes Agent does not import local agent-spawning hooks.');
+          return;
+        }
         await workbench.import(path, strategy);
         ctx.print(`Imported managed hooks from ${path} using ${strategy} strategy.`);
         return;

package/src/input/handler.ts

@@ -238,6 +238,7 @@ export class InputHandler {
       agentManager: uiServices.agents.agentManager,
       processManager: uiServices.shell.processManager,
       wrfcController: uiServices.agents.wrfcController,
+      agentEntries: 'hidden',
     });
     this.liveTailModal = new LiveTailModal({
       agentManager: uiServices.agents.agentManager,

package/src/input/onboarding/onboarding-runtime-status.ts

@@ -19,24 +19,24 @@ export function runtimePortDiagnostic(
   if (status) {
     const reason = status.reason ? ` ${status.reason}` : '';
     if (status.mode === 'blocked') {
-      return `The configured endpoint ${status.baseUrl} is occupied but was not usable by this TUI instance.${reason}`;
+      return `The configured endpoint ${status.baseUrl} is occupied but was not usable by this Agent instance.${reason}`;
     }
     if (status.mode === 'disabled') {
       return `The configured endpoint ${status.baseUrl} is disabled in the runtime service configuration.${reason}`;
     }
     if (status.mode === 'unavailable') {
-      return `The configured endpoint ${status.baseUrl} is unavailable after startup or restart.${reason}`;
+      return `The configured endpoint ${status.baseUrl} is unavailable to Agent.${reason}`;
     }
     if (status.mode === 'external') {
       const version = status.version ? ` version ${status.version}` : '';
       return `An existing GoodVibes service was verified at ${status.baseUrl}${version}.`;
     }
-    return `An embedded GoodVibes service is running at ${status.baseUrl}.`;
+    return `A GoodVibes service reports embedded mode at ${status.baseUrl}; Agent still treats daemon lifecycle as external.`;
   }
   if (portInUse) {
-    return `The configured port ${binding.host}:${binding.port} is occupied after restart; another GoodVibes process, an overlapping restart, or another service may still own it.`;
+    return `The configured port ${binding.host}:${binding.port} is occupied; another GoodVibes process or another service may own it.`;
   }
-  return `No process is listening on ${binding.host}:${binding.port} after restart.`;
+  return `No process is listening on ${binding.host}:${binding.port}.`;
 }
 
 export function getRuntimeEndpointStatus(
@@ -79,9 +79,9 @@ export function formatRuntimeActiveSuccessMessage(
     return `${label} is already running as a verified external GoodVibes service at ${status.baseUrl}${version}.`;
   }
   if (status?.mode === 'embedded') {
-    return `${label} is running as an embedded service at ${status.baseUrl}.`;
+    return `${label} reports embedded mode at ${status.baseUrl}; Agent does not own that service lifecycle.`;
   }
   return endpoint === 'daemon'
-    ? 'The GoodVibes daemon is running with the applied onboarding settings.'
-    : 'The HTTP listener is running with the applied onboarding settings.';
+    ? 'The GoodVibes daemon is reachable to Agent.'
+    : 'The HTTP listener is reachable to Agent.';
 }

package/src/input/onboarding/onboarding-wizard-apply.ts

@@ -15,7 +15,7 @@ import {
   getExternalSurfaceAutoStartFieldId,
   isExternalSurfaceSelectedByDefault,
 } from './onboarding-wizard-external-surfaces.ts';
-import { buildGoodVibesSecretKey, buildGoodVibesSecretRef, isLoopbackAddress, isSecretReferenceValue } from './onboarding-wizard-helpers.ts';
+import { buildGoodVibesSecretKey, buildGoodVibesSecretRef, isSecretReferenceValue } from './onboarding-wizard-helpers.ts';
 import type { OnboardingWizardController } from './onboarding-wizard.ts';
 
 export function buildOnboardingApplyRequest(controller: OnboardingWizardController): OnboardingApplyRequest {
@@ -203,7 +203,7 @@ function addCloudflareOperations(
     setConfig('cloudflare.workerCron', controller.getStringFieldValue('cloudflare.worker-cron', config?.workerCron ?? '*/5 * * * *'));
     setConfig('cloudflare.queueName', controller.getStringFieldValue('cloudflare.queue-name', config?.queueName ?? 'goodvibes-batch'));
     setConfig('cloudflare.deadLetterQueueName', controller.getStringFieldValue('cloudflare.dead-letter-queue-name', config?.deadLetterQueueName ?? 'goodvibes-batch-dlq'));
-    setConfig('cloudflare.tunnelName', controller.getStringFieldValue('cloudflare.tunnel-name', config?.tunnelName ?? 'goodvibes-daemon'));
+    setConfig('cloudflare.tunnelName', controller.getStringFieldValue('cloudflare.tunnel-name', config?.tunnelName ?? 'goodvibes-agent-daemon'));
     setConfig('cloudflare.tunnelId', controller.getStringFieldValue('cloudflare.tunnel-id', config?.tunnelId ?? ''));
     setConfig('cloudflare.tunnelTokenRef', controller.getStringFieldValue('cloudflare.tunnel-token-ref', config?.tunnelTokenRef ?? ''));
     setConfig('cloudflare.accessAppId', controller.getStringFieldValue('cloudflare.access-app-id', config?.accessAppId ?? ''));
@@ -222,56 +222,16 @@ function addCloudflareOperations(
   }
 
 export function addNetworkOperations(
-  controller: OnboardingWizardController,
-    operations: OnboardingApplyOperation[],
-    customNetwork: boolean,
-    enabled: {
-      readonly controlPlane: boolean;
-      readonly controlPlaneRemote: boolean;
-      readonly httpListener: boolean;
-      readonly web: boolean;
-    },
+  _controller: OnboardingWizardController,
+  _operations: OnboardingApplyOperation[],
+  _customNetwork: boolean,
+  _enabled: {
+    readonly controlPlane: boolean;
+    readonly controlPlaneRemote: boolean;
+    readonly httpListener: boolean;
+    readonly web: boolean;
+  },
   ): void {
-    const setConfig = (
-      key: Extract<OnboardingApplyOperation, { kind: 'set-config' }>['key'],
-      value: unknown,
-    ): void => {
-      operations.push({ kind: 'set-config', key, value });
-    };
-    const networkFacingEnabled = {
-      controlPlane: enabled.controlPlaneRemote,
-      httpListener: enabled.httpListener,
-      web: enabled.web,
-    };
-    const sharedIpDefault = controller.getSharedIpDefault(networkFacingEnabled);
-    const sharedIp = controller.getBooleanFieldValue('network.shared-ip', sharedIpDefault);
-    const sharedHost = controller.getStringFieldValue('network.shared-ip-address', controller.getSharedIpHostDefault(networkFacingEnabled)) || '0.0.0.0';
-    const controlPlaneHost = sharedIp
-      ? sharedHost
-      : controller.getStringFieldValue('network.service-ip', controller.runtimeSnapshot?.bindSettings.controlPlane.host ?? '0.0.0.0');
-    const httpListenerHost = sharedIp
-      ? sharedHost
-      : controller.getStringFieldValue('network.webhook-ip', controller.runtimeSnapshot?.bindSettings.httpListener.host ?? '0.0.0.0');
-    const webHost = sharedIp
-      ? sharedHost
-      : controller.getStringFieldValue('network.browser-ip', controller.runtimeSnapshot?.bindSettings.web.host ?? '0.0.0.0');
-
-    if (enabled.controlPlane) {
-      setConfig('controlPlane.hostMode', enabled.controlPlaneRemote ? (customNetwork ? 'custom' : 'network') : 'local');
-      setConfig('controlPlane.host', enabled.controlPlaneRemote ? (customNetwork ? controlPlaneHost : '0.0.0.0') : '127.0.0.1');
-      setConfig('controlPlane.port', controller.getPortFieldValue('network.service-port', controller.runtimeSnapshot?.bindSettings.controlPlane.port ?? 3421));
-      setConfig('controlPlane.allowRemote', enabled.controlPlaneRemote && (customNetwork ? !isLoopbackAddress(controlPlaneHost) : true));
-    }
-
-    if (enabled.httpListener) {
-      setConfig('httpListener.hostMode', customNetwork ? 'custom' : 'network');
-      setConfig('httpListener.host', customNetwork ? httpListenerHost : '0.0.0.0');
-      setConfig('httpListener.port', controller.getPortFieldValue('network.webhook-port', controller.runtimeSnapshot?.bindSettings.httpListener.port ?? 3422));
-    }
-
-    if (enabled.web) {
-      setConfig('web.hostMode', customNetwork ? 'custom' : 'network');
-      setConfig('web.host', customNetwork ? webHost : '0.0.0.0');
-      setConfig('web.port', controller.getPortFieldValue('network.browser-port', controller.runtimeSnapshot?.bindSettings.web.port ?? 3423));
-    }
+    // Agent onboarding intentionally never mutates daemon/listener/web bind posture.
+    // Network fields are advisory for the external daemon owner.
   }