@pellux/goodvibes-agent 1.0.1 → 1.0.3

package/src/agent/harness-control.ts

@@ -0,0 +1,266 @@
+import type { ConfigKey, ConfigManager, ConfigSetting } from '@pellux/goodvibes-sdk/platform/config';
+import { isValidConfigKey } from '@pellux/goodvibes-sdk/platform/config';
+import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
+import type { SecretsManager } from '../config/secrets.ts';
+import {
+  buildGoodVibesSecretKey,
+  isSecretConfigKey,
+  isSecretReferenceValue,
+  persistSecretBackedConfigValue,
+} from '../config/secret-config.ts';
+import {
+  AGENT_EXTERNAL_HOST_SETTING_LOCK_REASON,
+  isAgentHiddenSettingKey,
+  isExternalHostOwnedSettingKey,
+} from '../config/agent-settings-policy.ts';
+
+export interface HarnessSettingFilters {
+  readonly key?: string;
+  readonly category?: string;
+  readonly prefix?: string;
+  readonly query?: string;
+  readonly includeHidden?: boolean;
+  readonly limit?: number;
+}
+
+export interface HarnessSettingDescriptor {
+  readonly key: string;
+  readonly category: string;
+  readonly type: ConfigSetting['type'];
+  readonly value: unknown;
+  readonly default: unknown;
+  readonly configured: boolean;
+  readonly writable: boolean;
+  readonly visibleInWorkspace: boolean;
+  readonly lockReason?: string;
+  readonly description: string;
+  readonly enumValues?: readonly string[];
+}
+
+export interface HarnessSettingMutationResult {
+  readonly key: string;
+  readonly action: 'set' | 'reset';
+  readonly previous: unknown;
+  readonly current: unknown;
+}
+
+const DEFAULT_SETTING_LIMIT = 100;
+const SENSITIVE_KEY_PATTERN = /(?:secret|token|password|api[-_.]?key|signing)/i;
+
+function valuesEqual(left: unknown, right: unknown): boolean {
+  return JSON.stringify(left) === JSON.stringify(right);
+}
+
+function clampLimit(value: unknown, fallback = DEFAULT_SETTING_LIMIT): number {
+  if (typeof value !== 'number' || !Number.isFinite(value)) return fallback;
+  return Math.max(1, Math.min(500, Math.trunc(value)));
+}
+
+function findSetting(configManager: Pick<ConfigManager, 'getSchema'>, rawKey: string): ConfigSetting | null {
+  if (!rawKey || !isValidConfigKey(rawKey)) return null;
+  return configManager.getSchema().find((setting) => setting.key === rawKey) ?? null;
+}
+
+export function redactHarnessSettingValue(key: string, value: unknown): unknown {
+  if (typeof value !== 'string') return value;
+  if (!value) return value;
+  if (isSecretConfigKey(key) || SENSITIVE_KEY_PATTERN.test(key)) {
+    if (isSecretReferenceValue(value)) return '<secret-ref>';
+    return '<redacted>';
+  }
+  return value;
+}
+
+export function describeHarnessSetting(
+  configManager: Pick<ConfigManager, 'get'>,
+  setting: ConfigSetting,
+): HarnessSettingDescriptor {
+  const value = configManager.get(setting.key as ConfigKey);
+  const hostOwned = isExternalHostOwnedSettingKey(setting.key);
+  return {
+    key: setting.key,
+    category: setting.key.split('.')[0] ?? '',
+    type: setting.type,
+    value: redactHarnessSettingValue(setting.key, value),
+    default: redactHarnessSettingValue(setting.key, setting.default),
+    configured: !valuesEqual(value, setting.default),
+    writable: !hostOwned,
+    visibleInWorkspace: !isAgentHiddenSettingKey(setting.key),
+    ...(hostOwned ? { lockReason: AGENT_EXTERNAL_HOST_SETTING_LOCK_REASON } : {}),
+    description: setting.description,
+    ...(setting.enumValues ? { enumValues: setting.enumValues } : {}),
+  };
+}
+
+export function listHarnessSettings(
+  configManager: Pick<ConfigManager, 'get' | 'getSchema'>,
+  filters: HarnessSettingFilters = {},
+): readonly HarnessSettingDescriptor[] {
+  const key = filters.key?.trim();
+  const category = filters.category?.trim();
+  const prefix = filters.prefix?.trim();
+  const query = filters.query?.trim().toLowerCase();
+  const limit = clampLimit(filters.limit);
+
+  return configManager.getSchema()
+    .filter((setting) => {
+      if (key && setting.key !== key) return false;
+      if (category && setting.key.split('.')[0] !== category) return false;
+      if (prefix && !setting.key.startsWith(prefix)) return false;
+      if (!filters.includeHidden && isAgentHiddenSettingKey(setting.key)) return false;
+      if (query) {
+        const text = [setting.key, setting.description, setting.type, ...(setting.enumValues ?? [])].join('\n').toLowerCase();
+        if (!text.includes(query)) return false;
+      }
+      return true;
+    })
+    .map((setting) => describeHarnessSetting(configManager, setting))
+    .slice(0, limit);
+}
+
+export function getHarnessSetting(
+  configManager: Pick<ConfigManager, 'get' | 'getSchema'>,
+  key: string,
+): HarnessSettingDescriptor | null {
+  const setting = findSetting(configManager, key);
+  return setting ? describeHarnessSetting(configManager, setting) : null;
+}
+
+function coerceBoolean(value: unknown): boolean {
+  if (typeof value === 'boolean') return value;
+  if (typeof value === 'number') {
+    if (value === 1) return true;
+    if (value === 0) return false;
+  }
+  if (typeof value === 'string') {
+    const normalized = value.trim().toLowerCase();
+    if (['true', '1', 'yes', 'on', 'enabled'].includes(normalized)) return true;
+    if (['false', '0', 'no', 'off', 'disabled'].includes(normalized)) return false;
+  }
+  throw new Error(`Expected boolean value, got ${String(value)}.`);
+}
+
+export function coerceHarnessSettingValue(setting: ConfigSetting, value: unknown): unknown {
+  if (setting.type === 'boolean') return coerceBoolean(value);
+  if (setting.type === 'number') {
+    const parsed = typeof value === 'number' ? value : Number(String(value).trim());
+    if (!Number.isFinite(parsed)) throw new Error(`Expected numeric value for ${setting.key}.`);
+    return parsed;
+  }
+  if (setting.type === 'enum') {
+    const parsed = String(value).trim();
+    if (!setting.enumValues?.includes(parsed)) {
+      throw new Error(`Invalid value for ${setting.key}. Allowed: ${(setting.enumValues ?? []).join(', ')}.`);
+    }
+    return parsed;
+  }
+  return typeof value === 'string' ? value : String(value);
+}
+
+export async function setHarnessSetting(
+  configManager: ConfigManager,
+  secretsManager: Pick<SecretsManager, 'set' | 'delete'> | null | undefined,
+  key: string,
+  value: unknown,
+): Promise<HarnessSettingMutationResult> {
+  const setting = findSetting(configManager, key);
+  if (!setting) throw new Error(`Unknown setting ${key || '<missing>'}.`);
+  if (isExternalHostOwnedSettingKey(setting.key)) throw new Error(AGENT_EXTERNAL_HOST_SETTING_LOCK_REASON);
+
+  const previous = configManager.get(setting.key as ConfigKey);
+  const coerced = coerceHarnessSettingValue(setting, value);
+  if (setting.type === 'string' && isSecretConfigKey(setting.key)) {
+    const secretValue = String(coerced);
+    if (secretValue.trim() && !isSecretReferenceValue(secretValue) && !secretsManager?.set) {
+      throw new Error(`Cannot store raw secret value for ${setting.key}: secrets manager is unavailable.`);
+    }
+    const current = await persistSecretBackedConfigValue(
+      configManager,
+      secretsManager,
+      setting.key as ConfigKey,
+      secretValue,
+      { scope: 'user' },
+    );
+    return {
+      key: setting.key,
+      action: 'set',
+      previous: redactHarnessSettingValue(setting.key, previous),
+      current: redactHarnessSettingValue(setting.key, current),
+    };
+  }
+
+  configManager.setDynamic(setting.key as ConfigKey, coerced);
+  return {
+    key: setting.key,
+    action: 'set',
+    previous: redactHarnessSettingValue(setting.key, previous),
+    current: redactHarnessSettingValue(setting.key, configManager.get(setting.key as ConfigKey)),
+  };
+}
+
+export async function resetHarnessSetting(
+  configManager: ConfigManager,
+  secretsManager: Pick<SecretsManager, 'delete'> | null | undefined,
+  key: string,
+): Promise<HarnessSettingMutationResult> {
+  const setting = findSetting(configManager, key);
+  if (!setting) throw new Error(`Unknown setting ${key || '<missing>'}.`);
+  if (isExternalHostOwnedSettingKey(setting.key)) throw new Error(AGENT_EXTERNAL_HOST_SETTING_LOCK_REASON);
+
+  const previous = configManager.get(setting.key as ConfigKey);
+  if (isSecretConfigKey(setting.key)) {
+    if (typeof previous === 'string' && isSecretReferenceValue(previous) && !secretsManager?.delete) {
+      throw new Error(`Cannot reset ${setting.key}: secrets manager is unavailable to delete the stored secret.`);
+    }
+    await secretsManager?.delete?.(buildGoodVibesSecretKey(setting.key), { scope: 'user' });
+  }
+  configManager.reset(setting.key as ConfigKey);
+  return {
+    key: setting.key,
+    action: 'reset',
+    previous: redactHarnessSettingValue(setting.key, previous),
+    current: redactHarnessSettingValue(setting.key, configManager.get(setting.key as ConfigKey)),
+  };
+}
+
+export function formatHarnessSettingList(settings: readonly HarnessSettingDescriptor[]): string {
+  if (settings.length === 0) return 'No settings matched.';
+  return [
+    `Settings (${settings.length})`,
+    ...settings.map((setting) => {
+      const status = setting.writable ? 'writable' : 'read-only';
+      const visible = setting.visibleInWorkspace ? 'workspace' : 'scriptable';
+      return `  ${setting.key}  ${setting.type}  ${status}/${visible}  current=${String(setting.value)}`;
+    }),
+  ].join('\n');
+}
+
+export function formatHarnessSetting(setting: HarnessSettingDescriptor | null): string {
+  if (!setting) return 'Unknown setting.';
+  return [
+    `Setting ${setting.key}`,
+    `  category ${setting.category}`,
+    `  type ${setting.type}`,
+    `  current ${String(setting.value)}`,
+    `  default ${String(setting.default)}`,
+    `  configured ${setting.configured ? 'yes' : 'no'}`,
+    `  writable ${setting.writable ? 'yes' : 'no'}`,
+    `  workspace visible ${setting.visibleInWorkspace ? 'yes' : 'no'}`,
+    ...(setting.enumValues ? [`  values ${setting.enumValues.join(', ')}`] : []),
+    ...(setting.lockReason ? [`  lock ${setting.lockReason}`] : []),
+    `  ${setting.description}`,
+  ].join('\n');
+}
+
+export function formatHarnessMutation(result: HarnessSettingMutationResult): string {
+  return [
+    `Setting ${result.action}`,
+    `  key ${result.key}`,
+    `  previous ${String(result.previous)}`,
+    `  current ${String(result.current)}`,
+  ].join('\n');
+}
+
+export function formatHarnessError(error: unknown): string {
+  return summarizeError(error);
+}

package/src/cli/help.ts

@@ -131,6 +131,15 @@ type CommandHelp = {
   readonly examples?: readonly string[];
 };
 
+export interface GoodVibesCommandHelpDescriptor {
+  readonly command: string;
+  readonly aliases: readonly string[];
+  readonly summary: string;
+  readonly usage: readonly string[];
+  readonly subcommands: readonly string[];
+  readonly examples: readonly string[];
+}
+
 const COMMAND_HELP: Record<string, CommandHelp> = {
   run: {
     usage: ['run [prompt] [--output text|json|stream-json]', 'exec [prompt]'],
@@ -416,6 +425,23 @@ export function hasGoodVibesCommandHelp(topic: string): boolean {
   return COMMAND_HELP[normalizeHelpTopic(topic)] !== undefined;
 }
 
+export function describeGoodVibesCommandHelp(topic: string): GoodVibesCommandHelpDescriptor | null {
+  const normalized = normalizeHelpTopic(topic);
+  const help = COMMAND_HELP[normalized];
+  if (!help) return null;
+  return {
+    command: normalized,
+    aliases: Object.entries(HELP_ALIASES)
+      .filter(([, target]) => target === normalized)
+      .map(([alias]) => alias)
+      .sort(),
+    summary: help.summary,
+    usage: help.usage,
+    subcommands: help.subcommands ?? [],
+    examples: help.examples ?? [],
+  };
+}
+
 export function renderGoodVibesCommandHelp(topic: string, binary = 'goodvibes-agent'): string {
   const normalized = normalizeHelpTopic(topic);
   const help = COMMAND_HELP[normalized];

package/src/config/agent-settings-policy.ts

@@ -0,0 +1,44 @@
+export const AGENT_EXTERNAL_HOST_SETTING_LOCK_REASON = 'GoodVibes Agent uses a connected GoodVibes host. Change host lifecycle and bind posture from the owning host; Agent settings are read-only for those controls.';
+
+const AGENT_HIDDEN_SETTING_PREFIXES = [
+  ['cloud', 'flare.'].join(''),
+  ['surfaces.', 'home', 'assistant.'].join(''),
+  'batch.',
+  'controlPlane.',
+  'danger.',
+  'httpListener.',
+  'network.',
+  'orchestration.',
+  'runtime.',
+  'service.',
+  'sandbox.',
+  'web.',
+  'watchers.',
+  'wrfc.',
+] as const;
+
+const AGENT_HIDDEN_SETTING_KEYS = new Set<string>([
+  'ui.wrfcMessages',
+]);
+
+const EXTERNAL_HOST_SETTING_PREFIXES = [
+  'service.',
+  'controlPlane.',
+  'httpListener.',
+  'web.',
+] as const;
+
+const EXTERNAL_HOST_SETTING_KEYS = new Set<string>([
+  'danger.daemon',
+  'danger.httpListener',
+]);
+
+export function isExternalHostOwnedSettingKey(key: string): boolean {
+  return EXTERNAL_HOST_SETTING_KEYS.has(key)
+    || EXTERNAL_HOST_SETTING_PREFIXES.some((prefix) => key.startsWith(prefix));
+}
+
+export function isAgentHiddenSettingKey(key: string): boolean {
+  return AGENT_HIDDEN_SETTING_KEYS.has(key)
+    || AGENT_HIDDEN_SETTING_PREFIXES.some((prefix) => key.startsWith(prefix));
+}

package/src/input/agent-workspace-activation.ts

@@ -9,12 +9,14 @@ import type {
   AgentWorkspaceActionResult,
   AgentWorkspaceCategory,
   AgentWorkspaceCommandDispatcher,
+  AgentWorkspaceEditorKind,
   AgentWorkspaceFocusPane,
   AgentWorkspaceLocalEditor,
   AgentWorkspaceLocalEditorKind,
   AgentWorkspaceLocalLibraryItem,
   AgentWorkspaceLocalOperation,
   AgentWorkspaceRuntimeSnapshot,
+  AgentWorkspaceRuntimeStarterTemplateItem,
 } from './agent-workspace-types.ts';
 
 interface AgentWorkspaceActivationHost {
@@ -55,7 +57,10 @@ export function activateAgentWorkspaceSelection(
   const action = workspace.selectedAction;
   if (!action) return;
   if (action.kind === 'editor' && action.editorKind) {
-    const editor = createWorkspaceEditor(workspace, action.editorKind);
+    const editor = createAgentWorkspaceEditor(action.editorKind, {
+      runtimeStarterTemplates: workspace.runtimeSnapshot?.runtimeStarterTemplates ?? [],
+      selectedRoutine: workspace.selectedLocalLibraryItem('routine'),
+    });
     if (!editor) {
       workspace.status = `Editor unavailable: ${action.editorKind}.`;
       workspace.lastActionResult = {
@@ -143,11 +148,14 @@ export function activateAgentWorkspaceSelection(
   workspace.dispatchWorkspaceCommand(action.command);
 }
 
-function createWorkspaceEditor(
-  workspace: AgentWorkspaceActivationHost,
-  editorKind: NonNullable<AgentWorkspaceCategory['actions'][number]['editorKind']>,
+export function createAgentWorkspaceEditor(
+  editorKind: AgentWorkspaceEditorKind,
+  options: {
+    readonly runtimeStarterTemplates?: readonly AgentWorkspaceRuntimeStarterTemplateItem[];
+    readonly selectedRoutine?: AgentWorkspaceLocalLibraryItem | null;
+  } = {},
 ): AgentWorkspaceLocalEditor | null {
-  if (editorKind === 'profile') return createProfileEditor(workspace.runtimeSnapshot?.runtimeStarterTemplates ?? []);
+  if (editorKind === 'profile') return createProfileEditor(options.runtimeStarterTemplates ?? []);
   if (editorKind === 'learned-behavior') return createLearnedBehaviorEditor();
   if (editorKind === 'web-research') return createAgentWorkspaceWebResearchEditor('research');
   if (editorKind === 'web-fetch') return createAgentWorkspaceWebResearchEditor('fetch');
@@ -155,7 +163,7 @@ function createWorkspaceEditor(
   if (editorKind === 'knowledge-ask') return createAgentKnowledgeQueryEditor('ask');
   if (editorKind === 'knowledge-search') return createAgentKnowledgeQueryEditor('search');
   if (editorKind === 'reminder-schedule') return createReminderScheduleEditor();
-  if (editorKind === 'routine-schedule') return createRoutineScheduleEditor(workspace.selectedLocalLibraryItem('routine'));
+  if (editorKind === 'routine-schedule') return createRoutineScheduleEditor(options.selectedRoutine ?? null);
   if (
     editorKind === 'memory'
     || editorKind === 'note'

package/src/input/commands/operator-runtime.ts

@@ -2,14 +2,150 @@ import type { CommandRegistry } from '../command-registry.ts';
 import { logger } from '@pellux/goodvibes-sdk/platform/utils';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 import { requireYesFlag, stripYesFlag } from './confirmation.ts';
+import {
+  formatHarnessError,
+  formatHarnessMutation,
+  formatHarnessSetting,
+  formatHarnessSettingList,
+  getHarnessSetting,
+  listHarnessSettings,
+  resetHarnessSetting,
+  setHarnessSetting,
+} from '../../agent/harness-control.ts';
+
+function readValuedFlag(args: readonly string[], flag: string): string | undefined {
+  const assignmentPrefix = `${flag}=`;
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === flag) {
+      const value = args[index + 1];
+      return value && !value.startsWith('--') ? value : undefined;
+    }
+    if (arg?.startsWith(assignmentPrefix)) return arg.slice(assignmentPrefix.length);
+  }
+  return undefined;
+}
+
+function stripValuedFlag(args: readonly string[], flag: string): readonly string[] {
+  const next: string[] = [];
+  const assignmentPrefix = `${flag}=`;
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === flag) {
+      const value = args[index + 1];
+      if (value && !value.startsWith('--')) index += 1;
+      continue;
+    }
+    if (arg?.startsWith(assignmentPrefix)) {
+      continue;
+    }
+    next.push(arg!);
+  }
+  return next;
+}
+
+function parseSettingListArgs(args: readonly string[]): {
+  readonly category?: string;
+  readonly prefix?: string;
+  readonly query?: string;
+  readonly includeHidden: boolean;
+  readonly limit?: number;
+} {
+  const category = readValuedFlag(args, '--category');
+  const prefix = readValuedFlag(args, '--prefix');
+  const limitText = readValuedFlag(args, '--limit');
+  const remaining = stripValuedFlag(stripValuedFlag(stripValuedFlag(args, '--category'), '--prefix'), '--limit')
+    .filter((arg) => arg !== '--include-hidden');
+  const query = remaining.join(' ').trim();
+  return {
+    ...(category ? { category } : {}),
+    ...(prefix ? { prefix } : {}),
+    ...(query ? { query } : {}),
+    includeHidden: args.includes('--include-hidden'),
+    ...(limitText ? { limit: Number(limitText) } : {}),
+  };
+}
 
 export function registerOperatorRuntimeCommands(registry: CommandRegistry): void {
   registry.register({
     name: 'settings',
     aliases: ['cfg-ui'],
-    description: 'Open the fullscreen configuration workspace',
-    handler(_args, ctx) {
-      if (ctx.openSettingsModal) ctx.openSettingsModal();
+    description: 'Open, inspect, or update Agent settings',
+    usage: '[category|key|list|get <key>|set <key> <value> --yes|reset <key> --yes]',
+    argsHint: '[list|get|set|reset]',
+    async handler(args, ctx) {
+      const parsed = stripYesFlag(args);
+      const commandArgs = [...parsed.rest];
+      const sub = commandArgs[0];
+
+      if (!sub) {
+        if (ctx.openSettingsModal) ctx.openSettingsModal();
+        else ctx.print('Configuration workspace is not available in this runtime.');
+        return;
+      }
+
+      if (sub === 'list' || sub === 'schema') {
+        ctx.print(formatHarnessSettingList(listHarnessSettings(ctx.platform.configManager, parseSettingListArgs(commandArgs.slice(1)))));
+        return;
+      }
+
+      if (sub === 'get' || sub === 'show') {
+        const key = commandArgs[1];
+        if (!key) {
+          ctx.print('Usage: /settings get <key>');
+          return;
+        }
+        ctx.print(formatHarnessSetting(getHarnessSetting(ctx.platform.configManager, key)));
+        return;
+      }
+
+      if (sub === 'set') {
+        const key = commandArgs[1];
+        const rawValue = commandArgs.slice(2).join(' ');
+        if (!key || rawValue.length === 0) {
+          ctx.print('Usage: /settings set <key> <value> --yes');
+          return;
+        }
+        if (!parsed.yes) {
+          requireYesFlag(ctx, `set setting ${key}`, '/settings set <key> <value> --yes');
+          return;
+        }
+        try {
+          const result = await setHarnessSetting(ctx.platform.configManager, ctx.platform.secretsManager, key, rawValue);
+          ctx.print(formatHarnessMutation(result));
+          ctx.renderRequest();
+        } catch (error) {
+          ctx.print(formatHarnessError(error));
+        }
+        return;
+      }
+
+      if (sub === 'reset') {
+        const key = commandArgs[1];
+        if (!key) {
+          ctx.print('Usage: /settings reset <key> --yes');
+          return;
+        }
+        if (!parsed.yes) {
+          requireYesFlag(ctx, `reset setting ${key}`, '/settings reset <key> --yes');
+          return;
+        }
+        try {
+          const result = await resetHarnessSetting(ctx.platform.configManager, ctx.platform.secretsManager, key);
+          ctx.print(formatHarnessMutation(result));
+          ctx.renderRequest();
+        } catch (error) {
+          ctx.print(formatHarnessError(error));
+        }
+        return;
+      }
+
+      if (sub.includes('.')) {
+        ctx.print(formatHarnessSetting(getHarnessSetting(ctx.platform.configManager, sub)));
+        return;
+      }
+
+      if (ctx.openSettingsModal) ctx.openSettingsModal(sub);
       else ctx.print('Configuration workspace is not available in this runtime.');
     },
   });

package/src/input/settings-modal-agent-policy.ts

@@ -1,44 +1,5 @@
-export const AGENT_EXTERNAL_HOST_SETTING_LOCK_REASON = 'GoodVibes Agent uses a connected GoodVibes host. Change host lifecycle and bind posture from the owning host; Agent settings are read-only for those controls.';
-
-const AGENT_HIDDEN_SETTING_PREFIXES = [
-  ['cloud', 'flare.'].join(''),
-  ['surfaces.', 'home', 'assistant.'].join(''),
-  'batch.',
-  'controlPlane.',
-  'danger.',
-  'httpListener.',
-  'network.',
-  'orchestration.',
-  'runtime.',
-  'service.',
-  'sandbox.',
-  'web.',
-  'watchers.',
-  'wrfc.',
-] as const;
-
-const AGENT_HIDDEN_SETTING_KEYS = new Set<string>([
-  'ui.wrfcMessages',
-]);
-
-const EXTERNAL_HOST_SETTING_PREFIXES = [
-  'service.',
-  'controlPlane.',
-  'httpListener.',
-  'web.',
-] as const;
-
-const EXTERNAL_HOST_SETTING_KEYS = new Set<string>([
-  'danger.daemon',
-  'danger.httpListener',
-]);
-
-export function isExternalHostOwnedSettingKey(key: string): boolean {
-  return EXTERNAL_HOST_SETTING_KEYS.has(key)
-    || EXTERNAL_HOST_SETTING_PREFIXES.some((prefix) => key.startsWith(prefix));
-}
-
-export function isAgentHiddenSettingKey(key: string): boolean {
-  return AGENT_HIDDEN_SETTING_KEYS.has(key)
-    || AGENT_HIDDEN_SETTING_PREFIXES.some((prefix) => key.startsWith(prefix));
-}
+export {
+  AGENT_EXTERNAL_HOST_SETTING_LOCK_REASON,
+  isAgentHiddenSettingKey,
+  isExternalHostOwnedSettingKey,
+} from '../config/agent-settings-policy.ts';

package/src/runtime/bootstrap.ts

@@ -42,6 +42,7 @@ import { buildActivePersonaPrompt } from '../agent/persona-registry.ts';
 import { buildEnabledSkillsPrompt } from '../agent/skill-registry.ts';
 import { buildEnabledRoutinesPrompt } from '../agent/routine-registry.ts';
 import { buildReviewedMemoryPrompt } from '../agent/memory-prompt.ts';
+import { registerAgentHarnessTool } from '../tools/agent-harness-tool.ts';
 
 const GOODVIBES_AGENT_OPERATOR_POLICY = [
   '## GoodVibes Agent Operator Policy',
@@ -50,6 +51,7 @@ const GOODVIBES_AGENT_OPERATOR_POLICY = [
   '- Use the `agent_operator_briefing` tool for read-only main-conversation summaries of connected work plan, approvals, automation, schedules, and scheduler capacity. This tool must not call mutation routes, connected-host lifecycle routes, default knowledge, non-Agent knowledge spaces, separate Agent job creation, or GoodVibes TUI delegation.',
   '- When the user explicitly asks Agent to approve, deny, or cancel a specific approval, run/pause/resume a specific automation job, cancel/retry a specific automation run, or run a specific schedule, use the `agent_operator_action` tool with confirm:true and the original user request. It can call only its allowlisted public operator routes and must not create, edit, delete, or discover automation definitions.',
   '- Use the `agent_work_plan` tool to keep the visible Agent-local work plan current while working in the main conversation. Create, inspect, and update local work items proactively when useful. Removing items or clearing completed items requires an explicit user request and confirm:true.',
+  '- Use the `agent_harness` tool to inspect and operate the harness surface itself: Agent workspace action catalog, slash command catalog, model tool catalog, connected-host posture, and Agent settings. Use it to change Agent settings, invoke workspace action mirrors, or invoke slash-command mirrors only when the user explicitly asks; preserve confirm:true and explicitUserRequest for mutations, keep secret-backed settings in the secret manager, and keep connected-host lifecycle/posture externally owned.',
   '- Use the `agent_knowledge` tool for Agent Knowledge status, ask, and search from the main conversation. It must use only /api/goodvibes-agent/knowledge/* and must fail closed instead of falling back to default knowledge or non-Agent knowledge spaces.',
   '- When the user explicitly asks Agent to add, import, remember, or ingest a URL, URL-list file, local file, bookmarks file, browser history, or connector input into Agent Knowledge, use the `agent_knowledge_ingest` tool with confirm:true and the original user request. It must write only to /api/goodvibes-agent/knowledge/* ingest routes and never to default knowledge or non-Agent knowledge spaces.',
   '- Use the `agent_local_registry` tool when a scratchpad note, durable memory, reusable persona, skill, skill bundle, or routine would improve later work. Keep those records Agent-local, non-secret, source/provenance tagged, and reviewable. Notes are for temporary/source-triage context; promote them explicitly into memory, skills, personas, routines, or Agent Knowledge only when that is the correct durable home. Review memory with a confidence score when it should shape later turns. Starting a routine means applying its steps in this same serial conversation, not creating a background job.',
@@ -285,6 +287,7 @@ export async function bootstrapRuntime(
   const commandRegistry = shell.commandRegistry;
   const commandContext = shell.commandContext;
   const inputHistory = shell.inputHistory;
+  registerAgentHarnessTool(toolRegistry, commandRegistry, commandContext);
   const pluginCommandRegistry = {
     register(command: {
       readonly name: string;