@pellux/goodvibes-agent 0.1.9 → 0.1.11

package/CHANGELOG.md

@@ -2,6 +2,47 @@
 
 All notable changes to GoodVibes Agent will be recorded here.
 
+## 0.1.11 - 2026-05-31
+
+- d20a93e Allow explicit recall review without yes
+- 601f41c Require confirmation for eval execution
+- f41befb Block Cloudflare onboarding mutations
+- 79071ec Block implicit block file saves
+- 40aca02 Block inline diff file edits in Agent
+- 854eda8 Block MCP workspace config mutations
+- 665c423 Require confirmation for CLI Agent Knowledge ingest
+- f07255a Require confirmation for recall review mutations
+- 6e78ec3 Require confirmation for Agent Knowledge mutations
+- c1e5ac1 Require confirmation for operator control mutations
+- 5d6fc3c Require confirmation for local state mutations
+- 3afd788 Require confirmation for remaining export paths
+- d36ae96 Require confirmation for portable state bundles
+- 1f0caab Require confirmation for setup and remote exports
+- 2e149c9 Require confirmation for incident and handoff exports
+- b439c55 Require confirmation for settings mutations
+- f7c8fe6 Require confirmation for platform auth mutations
+- 09064e0 Require confirmation for auth and service mutations
+- 55e8b8d Require confirmation for marketplace mutations
+- 88becca Require confirmation for plugin mutations
+- 89c0584 Require confirmation for local provider mutations
+- 7f3af1b Require confirmation for managed hook mutations
+- 323426c Require confirmation for destructive workplan cleanup
+- 191350e Require confirmation for side-effecting slash commands
+
+## 0.1.10 - 2026-05-31
+
+- 93aba19 Block agent-spawning hook authoring
+- 735839a Prune git header renderer from Agent
+- 95d22fd Remove unused git shell bootstrap wiring
+- 1392ebc Remove Agent write-quit commit helper
+- df6572f Remove coding header posture from Agent shell
+- 2b8e679 Align live verification with Agent routes
+- 70eb800 Add stable typecheck release scripts
+- 6b57500 Hide local agent activity in Agent UI
+- 7166188 Add Agent Knowledge CLI shortcuts
+- 386c19d Align service diagnostics with Agent boundaries
+- e8b19db Lock daemon-owned settings in Agent
+
 ## 0.1.9 - 2026-05-31
 
 - 75e5d4a Align shell surface delegation test

package/README.md

@@ -35,7 +35,7 @@ bun run dev
 Useful checks:
 
 ```sh
-bunx tsc --noEmit
+bun run typecheck
 bun run build
 bun run package:install-check
 bun run publish:check

package/docs/getting-started.md

@@ -1,6 +1,6 @@
 # Getting Started
 
-GoodVibes Agent `0.1.7` is the current installable public alpha of the personal operator assistant built on the GoodVibes TUI foundation.
+GoodVibes Agent `0.1.9` is the current installable public alpha of the personal operator assistant built on the GoodVibes TUI foundation.
 
 ## Requirements
 

package/docs/release-and-publishing.md

@@ -1,6 +1,6 @@
 # Release And Publishing
 
-GoodVibes Agent `0.1.7` is the current installable public alpha release.
+GoodVibes Agent `0.1.9` is the current installable public alpha release.
 
 ## Package Identity
 
@@ -17,7 +17,7 @@ Before any release candidate:
 
 ```sh
 bun install
-bunx tsc --noEmit
+bun run typecheck
 bun run build
 bun run package:install-check
 bun run publish:check

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pellux/goodvibes-agent",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "private": false,
   "description": "Near-fork GoodVibes operator assistant with the GoodVibes TUI shell, renderer, input, fullscreen workspace, and daemon-connected Agent product brain.",
   "type": "module",
@@ -40,6 +40,8 @@
     "dev": "bun run src/main.ts",
     "tui": "bun run src/main.ts",
     "dev:watch": "bun --watch src/main.ts",
+    "typecheck": "bunx tsc --noEmit",
+    "check:types": "bun run typecheck",
     "prebuild": "bun run scripts/prebuild.ts",
     "build": "bun build src/main.ts --compile --outfile dist/goodvibes-agent",
     "build:linux-x64": "bun build src/main.ts --compile --target=bun-linux-x64 --outfile dist/goodvibes-agent-linux-x64",
@@ -61,6 +63,7 @@
     "build:all": "bun run scripts/build.ts --all",
     "perf:check": "bun run scripts/perf-check.ts",
     "architecture:check": "bun run scripts/check-architecture.ts",
+    "audit:home": "bun run scripts/audit-goodvibes-home.ts",
     "foundation:artifacts": "bun run scripts/export-foundation-artifacts.ts",
     "verification:ledger": "bun run scripts/verification-ledger.ts",
     "verification:live": "bun run scripts/verify-live.ts",

package/src/cli/agent-knowledge-command.ts

@@ -1,8 +1,8 @@
 import { existsSync, readFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
+import { join } from 'node:path';
 import { createBrowserAgentSdk } from '@pellux/goodvibes-sdk/browser/agent';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
+import { SDK_VERSION, VERSION } from '../version.ts';
 import type { CliCommandOutput } from './types.ts';
 import type { CliCommandRuntime } from './management.ts';
 import { formatJsonOrText, yesNo } from './management.ts';
@@ -149,24 +149,21 @@ function hasFlag(args: readonly string[], flag: string): boolean {
   return args.includes(flag);
 }
 
-function packageJsonPath(): string {
-  return join(dirname(fileURLToPath(import.meta.url)), '..', '..', 'package.json');
+function stripCommandFlag(args: readonly string[], flag: string): { readonly rest: readonly string[]; readonly present: boolean } {
+  const rest: string[] = [];
+  let present = false;
+  for (const arg of args) {
+    if (arg === flag) {
+      present = true;
+      continue;
+    }
+    rest.push(arg);
+  }
+  return { rest, present };
 }
 
 function readPackageMetadata(): { readonly version: string; readonly sdkVersion: string } {
-  try {
-    const parsed = JSON.parse(readFileSync(packageJsonPath(), 'utf-8')) as unknown;
-    if (!isRecord(parsed)) return { version: 'unknown', sdkVersion: 'unknown' };
-    const dependencies = isRecord(parsed.dependencies) ? parsed.dependencies : {};
-    return {
-      version: typeof parsed.version === 'string' ? parsed.version : 'unknown',
-      sdkVersion: typeof dependencies['@pellux/goodvibes-sdk'] === 'string'
-        ? dependencies['@pellux/goodvibes-sdk']
-        : 'unknown',
-    };
-  } catch {
-    return { version: 'unknown', sdkVersion: 'unknown' };
-  }
+  return { version: VERSION, sdkVersion: SDK_VERSION };
 }
 
 function resolveDaemonConnection(runtime: CliCommandRuntime): AgentDaemonConnection {
@@ -460,7 +457,9 @@ async function runKnowledgeCall<TData>(
 }
 
 export async function handleAgentKnowledgeCommand(runtime: CliCommandRuntime): Promise<CliCommandOutput> {
-  const [sub = 'status', ...rest] = runtime.cli.commandArgs;
+  const [sub = 'status', ...rawRest] = runtime.cli.commandArgs;
+  const confirmation = stripCommandFlag(rawRest, '--yes');
+  const rest = confirmation.rest;
   const normalized = sub.toLowerCase();
   const json = runtime.cli.flags.outputFormat === 'json';
   const disallowedScopeFlag = findDisallowedKnowledgeScopeFlag(rest);
@@ -528,7 +527,19 @@ export async function handleAgentKnowledgeCommand(runtime: CliCommandRuntime): P
   if (normalized === 'ingest-url') {
     const values = commandValues(rest);
     const url = values[0];
-    if (!url) return { output: 'Usage: goodvibes-agent knowledge ingest-url <url> [--title <title>] [--tags a,b]', exitCode: 2 };
+    if (!url) return { output: 'Usage: goodvibes-agent knowledge ingest-url <url> [--title <title>] [--tags a,b] --yes', exitCode: 2 };
+    if (!confirmation.present) {
+      const failure = {
+        ok: false,
+        kind: 'confirmation_required',
+        error: `Refusing to ingest URL into Agent Knowledge ${url} without --yes.`,
+        route: AGENT_KNOWLEDGE_METHODS.ingestUrl.route,
+      };
+      return {
+        output: json ? JSON.stringify(failure, null, 2) : `${failure.error}\nUsage: goodvibes-agent knowledge ingest-url <url> [--title <title>] [--tags a,b] --yes`,
+        exitCode: 2,
+      };
+    }
     const title = readOptionValue(rest, '--title');
     const tags = readStringList(rest, '--tags');
     const result = await runKnowledgeCall(runtime, AGENT_KNOWLEDGE_METHODS.ingestUrl, async (connection) => (
@@ -548,11 +559,26 @@ export async function handleAgentKnowledgeCommand(runtime: CliCommandRuntime): P
   }
 
   return {
-    output: 'Usage: goodvibes-agent knowledge [status|ask <question>|search <query>|ingest-url <url>]',
+    output: 'Usage: goodvibes-agent knowledge [status|ask <question>|search <query>|ingest-url <url> --yes]',
     exitCode: 2,
   };
 }
 
+export async function handleAgentKnowledgeShortcutCommand(
+  runtime: CliCommandRuntime,
+  subcommand: 'ask' | 'search',
+): Promise<CliCommandOutput> {
+  return handleAgentKnowledgeCommand({
+    ...runtime,
+    cli: {
+      ...runtime.cli,
+      command: 'knowledge',
+      rawCommand: 'knowledge',
+      commandArgs: [subcommand, ...runtime.cli.commandArgs],
+    },
+  });
+}
+
 export async function handleCompatCommand(runtime: CliCommandRuntime): Promise<CliCommandOutput> {
   const connection = resolveDaemonConnection(runtime);
   const metadata = readPackageMetadata();

package/src/cli/help.ts

@@ -41,6 +41,7 @@ export function renderGoodVibesHelp(binary = 'goodvibes-agent'): string {
     '  auth                       Inspect and manage local users, sessions, and bootstrap auth',
     '  compat                     Inspect Agent SDK pin, daemon version, and Agent knowledge route readiness',
     '  knowledge                  Use isolated Agent Knowledge/Wiki routes',
+    '  ask|search                 Shortcuts for isolated Agent Knowledge ask/search',
     '  delegate                   Explicitly delegate build/fix/review work to GoodVibes TUI',
     '  subscription               Start/finish/logout provider subscription sessions',
     '  secrets                    List, set, link, delete, and test GoodVibes secret refs',
@@ -95,6 +96,8 @@ export function renderGoodVibesHelp(binary = 'goodvibes-agent'): string {
     `  ${binary} compat`,
     `  ${binary} knowledge status`,
     `  ${binary} knowledge ask "What is GoodVibes Agent?"`,
+    `  ${binary} ask "What is GoodVibes Agent?"`,
+    `  ${binary} search "release checklist"`,
     `  ${binary} delegate --wrfc "fix the failing tests in ~/work/project"`,
     `  ${binary} surfaces`,
     `  ${binary} surfaces check`,
@@ -164,16 +167,26 @@ const COMMAND_HELP: Record<string, CommandHelp> = {
       'knowledge status',
       'knowledge ask <question> [--limit <n>] [--mode concise|standard|detailed]',
       'knowledge search <query> [--limit <n>]',
-      'knowledge ingest-url <url> [--title <title>] [--tags a,b]',
+      'knowledge ingest-url <url> [--title <title>] [--tags a,b] --yes',
     ],
     summary: 'Call isolated Agent Knowledge/Wiki routes under /api/goodvibes-agent/knowledge. No default wiki or HomeGraph fallback.',
     examples: [
       'knowledge status',
       'knowledge ask "What is GoodVibes Agent?"',
       'knowledge search "release checklist"',
-      'knowledge ingest-url https://example.com/page --title "Reference"',
+      'knowledge ingest-url https://example.com/page --title "Reference" --yes',
     ],
   },
+  ask: {
+    usage: ['ask <question> [--limit <n>] [--mode concise|standard|detailed]'],
+    summary: 'Shortcut for isolated Agent Knowledge ask. This never queries default Knowledge/Wiki or HomeGraph.',
+    examples: ['ask "What is GoodVibes Agent?"', 'ask "release checklist" --mode concise'],
+  },
+  search: {
+    usage: ['search <query> [--limit <n>]'],
+    summary: 'Shortcut for isolated Agent Knowledge search. This never queries default Knowledge/Wiki or HomeGraph.',
+    examples: ['search "release checklist"', 'search "operator workspace" --limit 5'],
+  },
   delegate: {
     usage: ['delegate [--wrfc] <build/fix/review task>'],
     summary: 'Create one shared-session task request for GoodVibes TUI. WRFC is requested only with --wrfc.',

package/src/cli/management-commands.ts

@@ -329,9 +329,9 @@ export async function buildControlPlaneStatusResult(runtime: CliCommandRuntime):
   };
   const issues: string[] = [];
   if (enabled === true && !reachable) issues.push(`Control plane is enabled but not reachable on ${binding.host}:${binding.port}.`);
-  if (enabled === true && service.enabled !== true) issues.push('Control plane is enabled but service mode is off.');
-  if (enabled === true && service.autostart !== true) issues.push('Control plane is enabled but service autostart is off.');
-  if (enabled === true && service.restartOnFailure !== true) issues.push('Control plane is enabled but service restart-on-failure is off.');
+  if (enabled === true && service.enabled !== true) issues.push('Control plane is enabled on the external daemon config, but Agent service ownership is disabled.');
+  if (enabled === true && service.autostart !== true) issues.push('Control plane is enabled on the external daemon config, but daemon autostart is off.');
+  if (enabled === true && service.restartOnFailure !== true) issues.push('Control plane is enabled on the external daemon config, but restart-on-failure is off.');
   if (isNetworkFacing(enabled, binding) && !auth.userStorePresent) issues.push('Network-facing control plane has no local auth user store.');
   if (isNetworkFacing(enabled, binding) && auth.bootstrapCredentialPresent) issues.push('Network-facing control plane still has a bootstrap credential file.');
   return {

package/src/cli/management.ts

@@ -32,7 +32,7 @@ import { handleServiceCommand } from './service-command.ts';
 import { handleBundleCommand } from './bundle-command.ts';
 import { buildListenerTestResult, formatListenerTestResult, handleSurfacesCommand } from './surface-command.ts';
 import { buildControlPlaneStatusResult, formatControlPlaneStatus, handleSecrets, handleSessions, handleTasks, renderPairing, renderRemote, renderSubscriptions, renderWeb } from './management-commands.ts';
-import { handleAgentKnowledgeCommand, handleCompatCommand, handleDelegateCommand } from './agent-knowledge-command.ts';
+import { handleAgentKnowledgeCommand, handleAgentKnowledgeShortcutCommand, handleCompatCommand, handleDelegateCommand } from './agent-knowledge-command.ts';
 import { GOODVIBES_AGENT_SURFACE_ROOT } from '../config/surface.ts';
 
 export interface CliCommandRuntime {
@@ -703,6 +703,12 @@ export async function handleGoodVibesCliCommand(runtime: CliCommandRuntime): Pro
         console.log(result.output);
         return { handled: true, exitCode: result.exitCode };
       }
+      case 'ask':
+      case 'search': {
+        const result = await handleAgentKnowledgeShortcutCommand(runtime, runtime.cli.command);
+        console.log(result.output);
+        return { handled: true, exitCode: result.exitCode };
+      }
       case 'delegate': {
         const result = await handleDelegateCommand(runtime);
         console.log(result.output);

package/src/cli/parser.ts

@@ -31,6 +31,9 @@ const COMMAND_ALIASES: Readonly<Record<string, GoodVibesCliCommand>> = {
   knowledge: 'knowledge',
   know: 'knowledge',
   kb: 'knowledge',
+  ask: 'ask',
+  search: 'search',
+  find: 'search',
   delegate: 'delegate',
   build: 'delegate',
   subscription: 'subscription',

package/src/cli/service-posture.ts

@@ -397,19 +397,19 @@ export async function buildCliServicePosture(
   const issues: string[] = [];
 
   if (serverBackedEnabled && !config.enabled) {
-    issues.push('Server-backed surfaces are enabled but service mode is off.');
+    issues.push('Daemon-owned surfaces are configured, but Agent service ownership is disabled.');
   }
   if (config.enabled && !config.autostart) {
-    issues.push('Service mode is enabled but autostart is off.');
+    issues.push('External daemon service config has autostart off.');
   }
   if (config.enabled && !config.restartOnFailure) {
-    issues.push('Service mode is enabled but restart-on-failure is off.');
+    issues.push('External daemon service config has restart-on-failure off.');
   }
   if (config.enabled && !status.installed) {
-    issues.push('Service mode is enabled but no platform service definition is installed.');
+    issues.push('External daemon service config is enabled, but no platform service definition is installed.');
   }
   if (config.enabled && !status.running) {
-    issues.push('Service mode is enabled but the managed service is not running.');
+    issues.push('External daemon service config is enabled, but the managed service is not running.');
   }
   if (status.actionError) {
     issues.push(`Service manager reported an error: ${status.actionError}`);
@@ -454,7 +454,7 @@ function yesNo(value: boolean): string {
 export function formatCliServicePosture(posture: CliServicePosture, json = false): string {
   if (json) return JSON.stringify(posture, null, 2);
   return [
-    'GoodVibes service',
+    'GoodVibes external daemon service',
     `  enabled: ${yesNo(posture.config.enabled)}`,
     `  autostart: ${yesNo(posture.config.autostart)}`,
     `  restartOnFailure: ${yesNo(posture.config.restartOnFailure)}`,

package/src/cli/status.ts

@@ -122,10 +122,10 @@ export function buildCliDoctorFindings(options: CliStatusOptions): readonly CliD
       id: 'service-disabled-for-server-surfaces',
       area: 'service',
       severity: 'warning',
-      summary: 'Server-backed surfaces are enabled but service mode is off.',
+      summary: 'Daemon-owned surfaces are configured while Agent service ownership is disabled.',
       cause: 'One or more daemon, control-plane, listener, or web settings are enabled while service.enabled is false.',
-      impact: 'The configured surfaces may not start automatically or survive restarts.',
-      action: 'Enable service mode or disable the server-backed surfaces you do not want.',
+      impact: 'The external daemon host must own availability for those surfaces; Agent will not start or enable them.',
+      action: 'Manage surface/service posture from GoodVibes TUI or the daemon host, then use Agent for read-only diagnostics.',
     });
   }
 
@@ -134,10 +134,10 @@ export function buildCliDoctorFindings(options: CliStatusOptions): readonly CliD
       id: 'service-autostart-disabled',
       area: 'service',
       severity: 'warning',
-      summary: 'Service mode is enabled but autostart is off.',
+      summary: 'External daemon service config has autostart off.',
       cause: 'service.enabled is true and service.autostart is false.',
       impact: 'The external GoodVibes daemon may not be available after login or reboot even though service mode is selected.',
-      action: 'Enable service.autostart if the daemon/listener/web surfaces should stay available.',
+      action: 'Configure daemon autostart from GoodVibes TUI or the daemon host; Agent will not mutate this setting.',
     });
   }
 
@@ -146,10 +146,10 @@ export function buildCliDoctorFindings(options: CliStatusOptions): readonly CliD
       id: 'service-restart-disabled',
       area: 'service',
       severity: 'warning',
-      summary: 'Service restart-on-failure is off.',
+      summary: 'External daemon service config has restart-on-failure off.',
       cause: 'service.enabled is true and service.restartOnFailure is false.',
       impact: 'A crashed daemon or listener may stay down until manually restarted.',
-      action: 'Enable service.restartOnFailure for durable daemon/listener operation.',
+      action: 'Configure restart-on-failure from GoodVibes TUI or the daemon host; Agent will not mutate this setting.',
     });
   }
 
@@ -163,7 +163,7 @@ export function buildCliDoctorFindings(options: CliStatusOptions): readonly CliD
         summary: issue,
         cause: 'The service lifecycle inspection found a mismatch between configured service/surface state and observed host state.',
         impact: 'Daemon, control-plane, listener, or web availability may not match the configuration.',
-        action: 'Run goodvibes-agent service check, then manage the daemon from GoodVibes TUI or your daemon host tooling.',
+        action: 'Use goodvibes-agent service check for read-only detail, then manage the daemon from GoodVibes TUI or your daemon host tooling.',
       });
     }
   }
@@ -326,7 +326,7 @@ export function renderCliStatus(options: CliStatusOptions): string {
       ? `  operatorTokens: ${options.auth.operatorTokenPresent ? 'present' : 'missing'} (${options.auth.operatorTokenPath})`
       : '  operatorTokens: unknown',
     '',
-    'Service:',
+    'External Daemon Service:',
     `  enabled: ${yesNo(serviceEnabled)}`,
     `  autostart: ${yesNo(serviceAutostart)}`,
     `  restartOnFailure: ${yesNo(restartOnFailure)}`,

package/src/cli/surface-command.ts

@@ -217,9 +217,9 @@ export async function buildListenerTestResult(runtime: CliCommandRuntime): Promi
   }).filter((surface) => surface.enabled === true);
   const issues: string[] = [];
   if (enabled !== true) issues.push('HTTP listener is disabled.');
-  if (enabled === true && service.enabled !== true) issues.push('HTTP listener is enabled but service mode is off.');
-  if (enabled === true && service.autostart !== true) issues.push('HTTP listener is enabled but service autostart is off.');
-  if (enabled === true && service.restartOnFailure !== true) issues.push('HTTP listener is enabled but service restart-on-failure is off.');
+  if (enabled === true && service.enabled !== true) issues.push('HTTP listener is enabled on the external daemon config, but Agent service ownership is disabled.');
+  if (enabled === true && service.autostart !== true) issues.push('HTTP listener is enabled on the external daemon config, but daemon autostart is off.');
+  if (enabled === true && service.restartOnFailure !== true) issues.push('HTTP listener is enabled on the external daemon config, but restart-on-failure is off.');
   if (isNetworkFacing(enabled, binding) && !auth.userStorePresent) issues.push('Network-facing listener has no local auth user store.');
   if (isNetworkFacing(enabled, binding) && auth.bootstrapCredentialPresent) issues.push('Network-facing listener still has a bootstrap credential file.');
   for (const surface of surfaces) {

package/src/cli/types.ts

@@ -12,6 +12,8 @@ export type GoodVibesCliCommand =
   | 'auth'
   | 'compat'
   | 'knowledge'
+  | 'ask'
+  | 'search'
   | 'delegate'
   | 'subscription'
   | 'secrets'

package/src/input/commands/cloudflare-runtime.ts

@@ -11,6 +11,7 @@ import {
 } from '../../runtime/cloudflare-control-plane.ts';
 import type { CommandContext, CommandRegistry } from '../command-registry.ts';
 import { requireShellPaths } from './runtime-services.ts';
+import { requireYesFlag, stripYesFlag } from './confirmation.ts';
 
 interface ParsedCloudflareArgs {
   readonly positional: readonly string[];
@@ -22,10 +23,12 @@ export function registerCloudflareRuntimeCommands(registry: CommandRegistry): vo
     name: 'cloudflare',
     aliases: ['cf'],
     description: 'Inspect and manage optional Cloudflare batch/control-plane integration through daemon SDK routes',
-    usage: '[status|setup|requirements|create-token|discover|validate|provision|verify|disable] [flags]',
+    usage: '[status|setup|requirements|create-token --yes|discover|validate|provision --yes|verify|disable --yes] [flags]',
     async handler(args, ctx) {
-      const subcommand = (args[0] ?? 'status').toLowerCase();
-      const parsed = parseCloudflareArgs(args.slice(1));
+      const confirmation = stripYesFlag(args);
+      const commandArgs = [...confirmation.rest];
+      const subcommand = (commandArgs[0] ?? 'status').toLowerCase();
+      const parsed = parseCloudflareArgs(commandArgs.slice(1));
       if (subcommand === 'setup' || subcommand === 'onboarding') {
         ctx.openOnboardingWizard?.({ mode: 'edit', reset: true });
         ctx.print('Opening onboarding wizard. Select the Cloudflare batch capability to configure Cloudflare.');
@@ -80,9 +83,13 @@ export function registerCloudflareRuntimeCommands(registry: CommandRegistry): vo
         }
 
         if (subcommand === 'create-token') {
+          if (!confirmation.yes) {
+            requireYesFlag(ctx, 'create and store a Cloudflare operational token', '/cloudflare create-token [flags] --yes');
+            return;
+          }
           const bootstrapToken = getFlag(parsed, 'bootstrap-token') || readTokenEnv(parsed, 'bootstrap-env');
           if (!bootstrapToken) {
-            ctx.print('Usage: /cloudflare create-token --account <account-id> --bootstrap-token <token> or --bootstrap-env <env-name>');
+            ctx.print('Usage: /cloudflare create-token --account <account-id> (--bootstrap-token <token> | --bootstrap-env <env-name>) --yes');
             return;
           }
           const result = await client.createOperationalToken({
@@ -141,6 +148,10 @@ export function registerCloudflareRuntimeCommands(registry: CommandRegistry): vo
         }
 
         if (subcommand === 'provision') {
+          if (!confirmation.yes) {
+            requireYesFlag(ctx, 'provision Cloudflare resources and persist config', '/cloudflare provision [flags] --yes');
+            return;
+          }
           const result = await client.provision({
             ...cloudflareAuthInput(parsed),
             components: componentsFromArgs(parsed),
@@ -212,6 +223,10 @@ export function registerCloudflareRuntimeCommands(registry: CommandRegistry): vo
         }
 
         if (subcommand === 'disable') {
+          if (!confirmation.yes) {
+            requireYesFlag(ctx, 'disable Cloudflare integration and persist config', '/cloudflare disable [flags] --yes');
+            return;
+          }
           const result = await client.disable({
             ...cloudflareAuthInput(parsed),
             ...optionalString('workerName', getFlag(parsed, 'worker-name')),
@@ -227,7 +242,7 @@ export function registerCloudflareRuntimeCommands(registry: CommandRegistry): vo
           return;
         }
 
-        ctx.print('Usage: /cloudflare [status|setup|requirements|create-token|discover|validate|provision|verify|disable] [flags]');
+        ctx.print('Usage: /cloudflare [status|setup|requirements|create-token --yes|discover|validate|provision --yes|verify|disable --yes] [flags]');
       } catch (error) {
         ctx.print(`Cloudflare ${subcommand} failed: ${formatCloudflareError(error)}`);
       }

package/src/input/commands/confirmation.ts

@@ -0,0 +1,24 @@
+import type { CommandContext } from '../command-registry.ts';
+
+export interface ConfirmationArgs {
+  readonly rest: readonly string[];
+  readonly yes: boolean;
+}
+
+export function stripYesFlag(args: readonly string[]): ConfirmationArgs {
+  const rest: string[] = [];
+  let yes = false;
+  for (const token of args) {
+    if (token === '--yes') {
+      yes = true;
+      continue;
+    }
+    rest.push(token);
+  }
+  return { rest, yes };
+}
+
+export function requireYesFlag(ctx: CommandContext, action: string, usage: string): boolean {
+  ctx.print(`Refusing to ${action} without --yes.\nUsage: ${usage}`);
+  return false;
+}

package/src/input/commands/discovery-runtime.ts

@@ -3,13 +3,16 @@ import { scan, persistProviders } from '@pellux/goodvibes-sdk/platform/discovery
 import { requireProviderApi, requireShellPaths } from './runtime-services.ts';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 import { GOODVIBES_AGENT_SURFACE_ROOT } from '../../config/surface.ts';
+import { requireYesFlag, stripYesFlag } from './confirmation.ts';
 
 export function registerDiscoveryRuntimeCommands(registry: CommandRegistry): void {
   registry.register({
     name: 'scan',
     aliases: [],
     description: 'Scan localhost and LAN for local LLM servers',
-    async handler(_args, ctx) {
+    usage: '[--yes]',
+    async handler(args, ctx) {
+      const { yes } = stripYesFlag(args);
       ctx.print('Scanning for local LLM servers...');
       ctx.renderRequest();
 
@@ -33,18 +36,24 @@ export function registerDiscoveryRuntimeCommands(registry: CommandRegistry): voi
         ctx.print(lines.join('\n'));
       }
 
-      try {
-        await requireProviderApi(ctx).registerDiscoveredProviders(result.servers);
-      } catch (err) {
-        ctx.print(`[Scan] Warning: failed to register some providers: ${summarizeError(err)}`);
-      }
-
       if (result.servers.length > 0) {
+        if (!yes) {
+          requireYesFlag(ctx, 'persist discovered local provider configuration', '/scan --yes');
+          ctx.print('[Scan] Discovery results were not saved. Rerun /scan --yes to register and persist providers.');
+          ctx.renderRequest();
+          return;
+        }
+        try {
+          await requireProviderApi(ctx).registerDiscoveredProviders(result.servers);
+        } catch (err) {
+          ctx.print(`[Scan] Warning: failed to register some providers: ${summarizeError(err)}`);
+        }
         const shellPaths = requireShellPaths(ctx);
         persistProviders({
           homeDirectory: shellPaths.homeDirectory,
           surfaceRoot: GOODVIBES_AGENT_SURFACE_ROOT,
         }, result.servers);
+        ctx.print('[Scan] Discovered providers registered and persisted.');
       }
       ctx.renderRequest();
     },