@pellux/goodvibes-agent 1.0.33 → 1.0.35

package/src/runtime/bootstrap-core.ts

@@ -39,6 +39,7 @@ import { registerAgentOperatorActionTool } from '../tools/agent-operator-action-
 import { registerAgentOperatorBriefingTool } from '../tools/agent-operator-briefing-tool.ts';
 import { registerAgentReminderScheduleTool } from '../tools/agent-reminder-schedule-tool.ts';
 import { registerAgentWorkPlanTool } from '../tools/agent-work-plan-tool.ts';
+import { compactRegisteredToolDefinitions } from '../tools/tool-definition-compaction.ts';
 import { GOODVIBES_AGENT_SURFACE_ROOT } from '../config/surface.ts';
 import { registerAgentRuntimeEvents } from './agent-runtime-events.ts';
 
@@ -249,6 +250,7 @@ export async function initializeBootstrapCore(
   installAgentToolPolicyGuard(toolRegistry, {
     getLastUserMessage: () => conversation.getLastUserMessage(),
   });
+  compactRegisteredToolDefinitions(toolRegistry);
   services.agentOrchestrator.setDependencies({
     surfaceRoot: GOODVIBES_AGENT_SURFACE_ROOT,
     fileCache,

package/src/runtime/bootstrap.ts

@@ -43,27 +43,20 @@ import { buildEnabledSkillsPrompt } from '../agent/skill-registry.ts';
 import { buildEnabledRoutinesPrompt } from '../agent/routine-registry.ts';
 import { buildReviewedMemoryPrompt } from '../agent/memory-prompt.ts';
 import { registerAgentHarnessTool } from '../tools/agent-harness-tool.ts';
+import { compactRegisteredToolDefinitions } from '../tools/tool-definition-compaction.ts';
 
 const GOODVIBES_AGENT_OPERATOR_POLICY = [
   '## GoodVibes Agent Operator Policy',
-  '- Default to serial, proactive assistant work in the main conversation. Answer, inspect, summarize, remember useful non-secret facts, configure Agent-local state, use read-only connected-host/operator routes, and take safe non-destructive actions without creating separate Agent jobs or GoodVibes TUI delegations.',
-  '- GoodVibes Agent connects to a GoodVibes host owned outside this package. Do not start, stop, restart, install, expose, or mutate connected-host network/listener posture from Agent.',
-  '- Use the `agent_operator_briefing` tool for read-only main-conversation summaries of connected work plan, approvals, automation, schedules, and scheduler capacity. This tool must not call mutation routes, connected-host lifecycle routes, default knowledge, non-Agent knowledge spaces, separate Agent job creation, or GoodVibes TUI delegation.',
-  '- When the user explicitly asks Agent to approve, deny, or cancel a specific approval, run/pause/resume a specific automation job, cancel/retry a specific automation run, or run a specific schedule, use the `agent_operator_action` tool with confirm:true and the original user request. It can call only its allowlisted public operator routes and must not create, edit, delete, or discover automation definitions.',
-  '- Use the `agent_work_plan` tool to keep the visible Agent-local work plan current while working in the main conversation. Create, inspect, and update local work items proactively when useful. Removing items or clearing completed items requires an explicit user request and confirm:true.',
-  '- Use the `agent_harness` tool to inspect and operate the harness surface itself: Agent workspace action catalog, slash command catalog, model tool catalog, release evidence bundle, release readiness inventory, connected-host posture, and Agent settings. Use it to change Agent settings, invoke workspace action mirrors, or invoke slash-command mirrors only when the user explicitly asks; preserve confirm:true and explicitUserRequest for mutations, keep secret-backed settings in the secret manager, and keep connected-host lifecycle/posture externally owned.',
-  '- Use the `agent_knowledge` tool for Agent Knowledge status, ask, search, source/node/issue lists, item lookup, map summary, connector list/detail, and connector doctor from the main conversation. It must use only /api/goodvibes-agent/knowledge/* and must fail closed instead of falling back to default knowledge or non-Agent knowledge spaces.',
-  '- When the user explicitly asks Agent to add, import, remember, or ingest a URL, URL-list file, local file, bookmarks file, browser history, or connector input into Agent Knowledge, use the `agent_knowledge_ingest` tool with confirm:true and the original user request. It must write only to /api/goodvibes-agent/knowledge/* ingest routes and never to default knowledge or non-Agent knowledge spaces.',
-  '- Use the `agent_local_registry` tool when a scratchpad note, durable memory, reusable persona, skill, skill bundle, or routine would improve later work. Keep those records Agent-local, non-secret, source/provenance tagged, and reviewable. Notes are for temporary/source-triage context; promote them explicitly into memory, skills, personas, routines, or Agent Knowledge only when that is the correct durable home. Review memory with a confidence score when it should shape later turns. Starting a routine means applying its steps in this same serial conversation, not creating a background job.',
-  '- When the user explicitly asks Agent to generate an image, video, or other media artifact, use the `agent_media_generate` tool with confirm:true and the original user request. Generated media is stored as artifacts; do not print base64, call default knowledge, use non-Agent knowledge spaces, send channels, create separate Agent jobs, or request GoodVibes TUI delegation for media generation.',
-  '- When the user explicitly asks Agent to send an alert, message, or notification to configured notification targets, use the `agent_notify` tool with confirm:true and the original user request. Do not infer external notifications from vague suggestions, and never create channel routes or account authorizations from the main conversation.',
-  '- When the user explicitly asks Agent to send one message to a specific configured channel, route, webhook, or link target, use the `agent_channel_send` tool with confirm:true and the original user request. It can deliver one message through configured delivery strategies, but must not create routes, authorize accounts, manage connected-host hosting, use default knowledge, use non-Agent knowledge spaces, create separate Agent jobs, or request GoodVibes TUI delegation.',
-  '- When the user explicitly asks for a reminder or asks Agent to schedule a reminder, use the `agent_reminder_schedule` tool with confirm:true and the original user request. That creates one connected schedules.create reminder on the external GoodVibes host. Do not infer reminders from vague suggestions or routine startup, and never create local scheduler jobs.',
-  '- GoodVibes TUI delegation is never the default Agent reasoning path. Do not delegate planning, research, operations, knowledge, memory, configuration, approvals, automation observability, or ordinary assistant work.',
-  '- GoodVibes Agent is not the coding TUI. Do not use the `agent` tool to create coding-role Agent jobs or batch job roots from Agent.',
-  '- When the user explicitly asks to build, implement, fix, patch, or review code, preserve the full original user ask and delegate one build request to GoodVibes TUI through the public shared-session/build-delegation contract. Include clear executionIntent and request delegated review only for explicit build/fix/review work or when the user explicitly asks for delegated Agent review.',
-  '- Do not narrow explicit build/fix/review requests into design-only, read-only, or no-write work unless the user explicitly requested that limitation. TUI owns file edits, git/worktree work, execution isolation UX, and delegated review coordination.',
-  '- If a stable public delegation route is unavailable, say that the task needs GoodVibes TUI delegation and report the missing route instead of pretending to implement it locally or creating sibling Agent jobs.',
+  '- Work serially in the main conversation by default: answer, inspect, summarize, remember useful non-secret facts, configure Agent-local state, and use safe read-only connected-host/operator routes.',
+  '- Connected-host lifecycle is external. Do not start, stop, restart, install, expose, or mutate host listeners/network posture from Agent.',
+  '- Read tools: `agent_operator_briefing` for connected work/approvals/automation/schedules, `agent_knowledge` for isolated Agent Knowledge, `agent_harness` for harness catalogs/settings/status.',
+  '- State tools: `agent_work_plan` for visible local work items; `agent_local_registry` for Agent-local notes, memory, personas, skills, bundles, and routines. Keep records non-secret, sourced, and reviewable.',
+  '- Confirmed tools: use `agent_operator_action`, `agent_knowledge_ingest`, `agent_media_generate`, `agent_notify`, `agent_channel_send`, and `agent_reminder_schedule` only for explicit user requests with confirm:true and explicitUserRequest.',
+  '- Agent Knowledge must use only `/api/goodvibes-agent/knowledge/*` and fail closed. Do not use default knowledge or non-Agent knowledge spaces.',
+  '- External delivery, media generation, reminders, settings writes, slash-command mirrors, workspace action mirrors, and destructive local changes require explicit user intent and the owning tool/command confirmation.',
+  '- Routines run in this serial conversation unless explicitly promoted to a connected schedule. Do not create hidden Agent jobs or local scheduler jobs.',
+  '- Do not delegate planning, research, operations, knowledge, memory, configuration, approvals, observability, or ordinary assistant work.',
+  '- For explicit build, implement, fix, patch, or review requests, preserve the full original ask and use the public shared-session/build-delegation route. If that route is unavailable, report the missing route instead of pretending to perform the work locally.',
 ].join('\n');
 
 function joinPromptParts(...parts: Array<string | null | undefined>): string {
@@ -288,6 +281,7 @@ export async function bootstrapRuntime(
   const commandContext = shell.commandContext;
   const inputHistory = shell.inputHistory;
   registerAgentHarnessTool(toolRegistry, commandRegistry, commandContext);
+  compactRegisteredToolDefinitions(toolRegistry);
   const pluginCommandRegistry = {
     register(command: {
       readonly name: string;

package/src/tools/agent-analysis-registry-policy.ts

@@ -82,11 +82,7 @@ export function validateRegistryToolInvocationForAgentPolicy(args: RegistryToolA
 }
 
 function narrowAnalyzeToolDefinitionForAgentPolicy(tool: Tool): void {
-  tool.definition.description = [
-    'Run local, static project analysis for GoodVibes Agent.',
-    'npm registry upgrade checks and hidden secondary LLM diff analysis are disabled in the main conversation.',
-    'Delegate package-upgrade and review workflows to GoodVibes TUI when they become build/fix/review work.',
-  ].join(' ');
+  tool.definition.description = 'Run local, static project analysis for GoodVibes Agent.';
   tool.definition.sideEffects = ['read_fs'];
 
   const properties = tool.definition.parameters.properties;
@@ -101,10 +97,7 @@ function narrowAnalyzeToolDefinitionForAgentPolicy(tool: Tool): void {
 }
 
 function narrowRegistryToolDefinitionForAgentPolicy(tool: Tool): void {
-  tool.definition.description = [
-    'Discover and preview GoodVibes Agent skills, agents, and tools.',
-    'Full content materialization and arbitrary .goodvibes file reads are disabled in the main conversation.',
-  ].join(' ');
+  tool.definition.description = 'Discover and preview GoodVibes Agent registry entries.';
   tool.definition.sideEffects = ['read_fs'];
 
   const properties = tool.definition.parameters.properties;

package/src/tools/agent-channel-send-tool.ts

@@ -41,11 +41,7 @@ export function createAgentChannelSendTool(
   return {
     definition: {
       name: 'agent_channel_send',
-      description: [
-        'Send one confirmed message through a configured Agent target.',
-        'Use only for explicit send/message/alert requests.',
-        'Provide exactly one target.',
-      ].join(' '),
+      description: 'Send one confirmed message through one configured Agent target.',
       parameters: {
         type: 'object',
         properties: {

package/src/tools/agent-context-policy.ts

@@ -7,11 +7,7 @@ const CONTEXT_TOOL_DENIAL = [
 ].join(' ');
 
 export function wrapBlockedContextToolForAgentPolicy(tool: Tool): void {
-  tool.definition.description = [
-    'Blocked in GoodVibes Agent main conversation: non-Agent runtime context.',
-    'Use explicit Agent CLI/slash status, compat, setup, and Agent Knowledge commands for product-scoped context.',
-    'Default knowledge, non-Agent knowledge segments, and non-Agent runtime assumptions are not Agent fallbacks.',
-  ].join(' ');
+  tool.definition.description = 'Blocked in GoodVibes Agent: non-Agent runtime context.';
   tool.definition.sideEffects = [];
   tool.definition.parameters = {
     type: 'object',

package/src/tools/agent-find-policy.ts

@@ -82,10 +82,7 @@ export function normalizeFindToolInvocationForAgentPolicy(args: FindToolArgs): F
 }
 
 function narrowFindToolDefinitionForAgentPolicy(tool: Tool): void {
-  tool.definition.description = [
-    'Search the project for GoodVibes Agent using serial, gitignore-respecting read-only queries.',
-    'Hidden-file scans, symlink traversal, gitignore bypass, broad previews, full symbol dumps, and parallel search are disabled in the main conversation.',
-  ].join(' ');
+  tool.definition.description = 'Search project files with serial, gitignore-respecting read-only queries.';
   tool.definition.sideEffects = ['read_fs'];
   tool.definition.concurrency = 'serial';
 

package/src/tools/agent-harness-channel-metadata.ts

@@ -83,31 +83,31 @@ function describeChannel(
     defaultTargetKeys: channel.defaultTargetKeys,
     configuredDefaultTargetKeys: channel.configuredDefaultTargetKeys,
     ...(options.lookup ? { lookup: options.lookup } : {}),
-    policy: {
-      effect: 'read-only',
-      values: 'Config key names and target key names are shown; secret values and stored target values are never returned.',
-      delivery: 'Use agent_channel_send only for one explicit, confirmed delivery target requested by the user.',
-      setup: 'Use connected-host setup/account/policy routes only as read-only diagnostics unless another confirmed first-class tool owns the mutation.',
-    },
-    modelAccess: {
-      sendTool: 'agent_channel_send',
-      notificationTool: 'agent_notify',
-      reminderTool: 'agent_reminder_schedule',
-      slashCommandDetail: `/channels show ${channel.id}`,
-      readOnlyConnectedRoutes: [
-        '/channels accounts',
-        '/channels policies',
-        '/channels status',
-        `/channels doctor ${channel.id}`,
-        `/channels setup ${channel.id}`,
-      ],
-      settingsFilter: `agent_harness mode:"settings" prefix:"surfaces.${channel.id}" includeHidden:true`,
-      connectedHostBoundary: 'agent_harness mode:"connected_host_capability" query:"delivery"',
-      ...(options.includeParameters ? {
+    ...(options.includeParameters ? {
+      policy: {
+        effect: 'read-only',
+        values: 'Config key names and target key names are shown; secret values and stored target values are never returned.',
+        delivery: 'Use agent_channel_send only for one explicit, confirmed delivery target requested by the user.',
+        setup: 'Use connected-host setup/account/policy routes only as read-only diagnostics unless another confirmed first-class tool owns the mutation.',
+      },
+      modelAccess: {
+        sendTool: 'agent_channel_send',
+        notificationTool: 'agent_notify',
+        reminderTool: 'agent_reminder_schedule',
+        slashCommandDetail: `/channels show ${channel.id}`,
+        readOnlyConnectedRoutes: [
+          '/channels accounts',
+          '/channels policies',
+          '/channels status',
+          `/channels doctor ${channel.id}`,
+          `/channels setup ${channel.id}`,
+        ],
+        settingsFilter: `agent_harness mode:"settings" prefix:"surfaces.${channel.id}" includeHidden:true`,
+        connectedHostBoundary: 'agent_harness mode:"connected_host_capability" query:"delivery"',
         deliveryTargetShape: 'surface[:route[:label]]',
         exampleTarget: `${channel.id}:route:Label`,
-      } : {}),
-    },
+      },
+    } : {}),
   };
 }
 

package/src/tools/agent-harness-cli-metadata.ts

@@ -14,6 +14,7 @@ export interface AgentHarnessCliArgs {
   readonly cliCommand?: unknown;
   readonly commandName?: unknown;
   readonly target?: unknown;
+  readonly includeParameters?: unknown;
   readonly limit?: unknown;
 }
 
@@ -106,12 +107,14 @@ export function blockedHarnessCliCommandTokens(): readonly string[] {
 export function listHarnessCliCommands(args: AgentHarnessCliArgs): readonly Record<string, unknown>[] {
   const query = readString(args.query);
   const limit = readLimit(args.limit, 200);
+  const includeParameters = args.includeParameters === true;
   return listGoodVibesCliCommands()
     .filter((command) => command !== 'unknown')
     .map((command) => describeCliCommand(command))
     .filter((command) => cliCommandMatches(command, query))
     .sort((a, b) => String(a.name).localeCompare(String(b.name)))
-    .slice(0, limit);
+    .slice(0, limit)
+    .map((command) => includeParameters ? command : cliCommandCandidate(command));
 }
 
 function cliInputFromArgs(args: AgentHarnessCliArgs): { readonly source: CliCommandLookup['source']; readonly input: string } | null {

package/src/tools/agent-harness-command-catalog.ts

@@ -8,6 +8,7 @@ export interface AgentHarnessCommandCatalogArgs {
   readonly commandName?: unknown;
   readonly args?: unknown;
   readonly target?: unknown;
+  readonly includeParameters?: unknown;
   readonly limit?: unknown;
 }
 
@@ -38,6 +39,11 @@ function readStringArray(value: unknown): readonly string[] {
   return value.map((entry) => typeof entry === 'string' ? entry : String(entry));
 }
 
+function previewText(value: string, maxLength = 120): string {
+  const normalized = value.replace(/\s+/g, ' ').trim();
+  return normalized.length <= maxLength ? normalized : `${normalized.slice(0, maxLength - 1).trimEnd()}...`;
+}
+
 function commandMatches(command: SlashCommand, query: string): boolean {
   if (!query) return true;
   const haystack = [
@@ -76,8 +82,8 @@ function describeCommandCandidate(command: SlashCommand): Record<string, unknown
     name: command.name,
     slash: `/${command.name}`,
     aliases: command.aliases ?? [],
-    description: command.description,
-    usage: command.usage ?? '',
+    summary: previewText(command.description),
+    ...(command.argsHint ? { argsHint: command.argsHint } : {}),
   };
 }
 
@@ -165,11 +171,12 @@ export function resolveHarnessCommandDetail(commandRegistry: CommandRegistry, ar
 export function listHarnessCommands(commandRegistry: CommandRegistry, args: AgentHarnessCommandCatalogArgs): readonly Record<string, unknown>[] {
   const query = readString(args.query);
   const limit = readLimit(args.limit, 200);
+  const includeParameters = args.includeParameters === true;
   return commandRegistry.list()
     .filter((command) => commandMatches(command, query))
     .sort((a, b) => a.name.localeCompare(b.name))
     .slice(0, limit)
-    .map((command) => describeCommand(command));
+    .map((command) => includeParameters ? describeCommand(command) : describeCommandCandidate(command));
 }
 
 export function describeHarnessCommand(commandRegistry: CommandRegistry, args: AgentHarnessCommandCatalogArgs): Record<string, unknown> | null {

package/src/tools/agent-harness-connected-host-status.ts

@@ -73,6 +73,7 @@ function connectedHostFindings(
 export async function connectedHostStatusSummary(
   context: CommandContext,
   toolRegistry: ToolRegistry,
+  options: { readonly includeParameters?: boolean } = {},
 ): Promise<Record<string, unknown>> {
   const homeDirectory = resolveHomeDirectory(context);
   const workingDirectory = resolveWorkingDirectory(context);
@@ -134,13 +135,18 @@ export async function connectedHostStatusSummary(
       },
     ],
     findings: connectedHostFindings(runtime, tokenUsable),
-    modelAccess: {
+    capabilitySummary: {
+      routeFamilies: connectedHostRouteFamilies().length,
+      availableCapabilities: connectedHostCapabilityMap(toolRegistry).filter((capability) => capability.available === true).length,
+      blockedCapabilities: blockedConnectedHostCapabilities().length,
+    },
+    ...(options.includeParameters ? { modelAccess: {
       diagnostics: 'Use mode:"connected_host_status" for live read-only host readiness, mode:"service_posture" for endpoint posture, mode:"service_endpoint" for one endpoint, and mode:"connected_host" for capability and boundary inventory.',
       cliMirrors: ['goodvibes-agent status --json', 'goodvibes-agent doctor', 'goodvibes-agent compat'],
       tuiMirrors: ['Agent Workspace -> Home -> Host compatibility', 'Agent Workspace -> Home -> Doctor diagnostics', 'Agent Workspace -> Home -> Review health'],
     },
     routeFamilies: connectedHostRouteFamilies(),
     capabilities: connectedHostCapabilityMap(toolRegistry),
-    blockedCapabilities: blockedConnectedHostCapabilities(),
+    blockedCapabilities: blockedConnectedHostCapabilities() } : {}),
   };
 }

package/src/tools/agent-harness-delegation-posture.ts

@@ -136,12 +136,12 @@ function describeRoute(
       operatorClientAttached: Boolean(context.clients?.operator),
     },
     ...(options.lookup ? { lookup: options.lookup } : {}),
-    policy: {
-      effect: route.effect,
-      values: 'Delegation posture returns policy, route, confirmation, and runtime availability metadata only; it does not submit delegated work.',
-      mutation: 'Delegated work submission stays a visible confirmed workspace or slash-command flow and must preserve the full original user ask.',
-    },
     ...(options.includeParameters ? {
+      policy: {
+        effect: route.effect,
+        values: 'Delegation posture returns policy, route, confirmation, and runtime availability metadata only; it does not submit delegated work.',
+        mutation: 'Delegated work submission stays a visible confirmed workspace or slash-command flow and must preserve the full original user ask.',
+      },
       modelAccess: {
         inspectDelegation: 'agent_harness mode:"delegation_posture"',
         inspectRoute: 'agent_harness mode:"delegation_route"',

package/src/tools/agent-harness-mcp-metadata.ts

@@ -116,34 +116,36 @@ function describeServer(
       })),
       toolCount: tools.length,
     } : { toolCount: tools.length }),
-    policy: {
-      effect: 'read-only',
-      values: 'Server posture returns trust, role, connection, quarantine, and tool metadata; env values and secret config values are never returned.',
-      mutation: 'MCP add/remove/reload/trust/role/quarantine operations stay explicit confirmation-gated workspace or slash-command flows.',
-      allowAll: 'allow-all trust decisions remain routed through Settings -> MCP, not direct command escalation.',
-    },
-    modelAccess: {
-      reviewCommand: '/mcp review',
-      serversCommand: '/mcp servers',
-      toolsCommand: `/mcp tools ${server.name}`,
-      repairCommand: `/mcp repair ${server.name}`,
-      authReviewCommand: '/mcp auth-review',
-      configCommand: '/mcp config',
-      workspaceActionIds: [
-        'mcp-review',
-        'mcp-tools-server',
-        'mcp-repair',
-        'mcp-config',
-        'mcp-add-server',
-        'mcp-settings',
-      ],
-      confirmationGatedCommands: [
-        `/mcp trust ${server.name} <constrained|ask-on-risk|blocked> --yes`,
-        `/mcp role ${server.name} <role> --yes`,
-        `/mcp quarantine ${server.name} approve <operatorId> --yes`,
-        `/mcp remove ${server.name} --yes`,
-      ],
-    },
+    ...(options.includeParameters ? {
+      policy: {
+        effect: 'read-only',
+        values: 'Server posture returns trust, role, connection, quarantine, and tool metadata; env values and secret config values are never returned.',
+        mutation: 'MCP add/remove/reload/trust/role/quarantine operations stay explicit confirmation-gated workspace or slash-command flows.',
+        allowAll: 'allow-all trust decisions remain routed through Settings -> MCP, not direct command escalation.',
+      },
+      modelAccess: {
+        reviewCommand: '/mcp review',
+        serversCommand: '/mcp servers',
+        toolsCommand: `/mcp tools ${server.name}`,
+        repairCommand: `/mcp repair ${server.name}`,
+        authReviewCommand: '/mcp auth-review',
+        configCommand: '/mcp config',
+        workspaceActionIds: [
+          'mcp-review',
+          'mcp-tools-server',
+          'mcp-repair',
+          'mcp-config',
+          'mcp-add-server',
+          'mcp-settings',
+        ],
+        confirmationGatedCommands: [
+          `/mcp trust ${server.name} <constrained|ask-on-risk|blocked> --yes`,
+          `/mcp role ${server.name} <role> --yes`,
+          `/mcp quarantine ${server.name} approve <operatorId> --yes`,
+          `/mcp remove ${server.name} --yes`,
+        ],
+      },
+    } : {}),
   };
 }
 

package/src/tools/agent-harness-media-posture.ts

@@ -116,14 +116,14 @@ function describeProvider(
         inspectPosture: 'agent_harness mode:"media_posture"',
         inspectProvider: 'agent_harness mode:"media_provider"',
         generateMedia: 'agent_media_generate with confirm:true and explicitUserRequest',
-        ttsSettings: 'agent_harness settings/get_setting/set_setting for tts.provider, tts.voice, tts.llmProvider, and tts.llmModel',
+        ttsSettings: 'agent_harness mode:"settings", mode:"get_setting", mode:"set_setting" for tts.provider, tts.voice, tts.llmProvider, and tts.llmModel',
+      },
+      policy: {
+        effect: 'read-only',
+        values: 'Provider posture returns capability, setup, selected, health, and safe environment key names only; secret values and media payloads are never returned.',
+        mutation: 'Media generation, voice enable/disable, TTS setting changes, and bundle export stay explicit confirmation-gated tool, setting, workspace, or slash-command flows.',
       },
     } : {}),
-    policy: {
-      effect: 'read-only',
-      values: 'Provider posture returns capability, setup, selected, health, and safe environment key names only; secret values and media payloads are never returned.',
-      mutation: 'Media generation, voice enable/disable, TTS setting changes, and bundle export stay explicit confirmation-gated tool, setting, workspace, or slash-command flows.',
-    },
   };
 }
 
@@ -215,14 +215,14 @@ export async function mediaPostureSummary(context: CommandContext, args: AgentHa
     returned: filtered.length,
     total: providers.length,
     policy: 'Read-only voice/media posture. Media generation, voice enable/disable, TTS setting changes, and bundle export stay confirmation-gated through first-class tools, settings modes, workspace actions, or slash-command mirrors.',
-    modelAccess: {
+    ...(args.includeParameters === true ? { modelAccess: {
       mediaGenerateTool: 'agent_media_generate',
       providerCatalogMode: 'media_posture',
       singleProviderMode: 'media_provider',
-      ttsProviderPicker: 'open_ui_surface surfaceId:"tts-provider-picker"',
-      ttsVoicePicker: 'open_ui_surface surfaceId:"tts-voice-picker"',
+      ttsProviderPicker: 'agent_harness mode:"open_ui_surface" surfaceId:"tts-provider-picker" confirm:true explicitUserRequest:"..."',
+      ttsVoicePicker: 'agent_harness mode:"open_ui_surface" surfaceId:"tts-voice-picker" confirm:true explicitUserRequest:"..."',
       commands: ['/media providers', '/voice review', '/tts <prompt>', '/image <path>'],
-    },
+    } } : {}),
   };
 }