@pellux/goodvibes-agent 1.1.5 → 1.1.7

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 Product-facing release notes for GoodVibes Agent.
 
+## 1.1.7 - 2026-06-05
+
+- Hardened the Agent model tool surface so goodvibes_context routes to the Agent harness instead of dead-ending.
+- Added tool execution and permission safety guards so registered model tools return structured failures instead of aborting turns.
+- Added registered-tool smoke coverage for the Agent-guarded platform tool roster.
+
+## 1.1.6 - 2026-06-05
+
+- Fixed Import GoodVibes settings so it also imports active and pending provider subscriptions from the GoodVibes TUI user store into Agent-owned subscription state.
+- Preserved existing Agent-only subscriptions while merging imported provider sessions by provider id.
+- Updated onboarding copy and added regression coverage for subscription import.
+
 ## 1.1.5 - 2026-06-05
 
 - Replaced onboarding with the real Agent setup flow for subscription login, provider/model selection, settings persistence, channels, voice, local context, automation, and finish.

package/dist/package/main.js

@@ -817034,7 +817034,7 @@ var createStyledCell = (char, overrides = {}) => ({
 // src/version.ts
 import { readFileSync } from "fs";
 import { join } from "path";
-var _version = "1.1.5";
+var _version = "1.1.7";
 try {
   const pkg = JSON.parse(readFileSync(join(import.meta.dir, "..", "package.json"), "utf-8"));
   _version = typeof pkg.version === "string" ? pkg.version : _version;
@@ -840573,20 +840573,132 @@ function isRecord17(value) {
 }
 
 // src/tools/agent-context-policy.ts
-var CONTEXT_TOOL_DENIAL = [
-  "GoodVibes Agent does not expose non-Agent runtime context through model tools in the main conversation.",
-  "The runtime context tool can describe assumptions that are outside the Agent product boundary.",
-  "Use explicit Agent CLI/slash commands such as status, compat, setup, and isolated Agent Knowledge instead."
-].join(" ");
-function wrapBlockedContextToolForAgentPolicy(tool2) {
-  tool2.definition.description = "Blocked in GoodVibes Agent: non-Agent runtime context.";
+var AGENT_CONTEXT_TOOL_MODES = [
+  "summary",
+  "capabilities",
+  "modes",
+  "tools",
+  "tool",
+  "settings",
+  "setting",
+  "commands",
+  "command",
+  "workspace",
+  "status"
+];
+var CONTEXT_TOOL_FALLBACK = {
+  runtime: "GoodVibes Agent",
+  preferredTool: "agent_harness",
+  routes: {
+    summary: 'agent_harness mode:"summary"',
+    capabilities: 'agent_harness mode:"summary" includeParameters:true',
+    tools: 'agent_harness mode:"tools"',
+    tool: 'agent_harness mode:"tool"',
+    settings: 'agent_harness mode:"settings"',
+    commands: 'agent_harness mode:"commands"',
+    workspace: 'agent_harness mode:"workspace"',
+    status: 'agent_harness mode:"connected_host_status"'
+  }
+};
+function wrapAgentContextToolForAgentPolicy(tool2, registry5) {
+  tool2.definition.description = "Inspect GoodVibes Agent harness capabilities.";
   tool2.definition.sideEffects = [];
   tool2.definition.parameters = {
     type: "object",
-    properties: {},
+    properties: {
+      mode: { type: "string", enum: [...AGENT_CONTEXT_TOOL_MODES] },
+      query: { type: "string" },
+      target: { type: "string" },
+      toolName: { type: "string" },
+      command: { type: "string" },
+      commandName: { type: "string" },
+      key: { type: "string" },
+      category: { type: "string" },
+      prefix: { type: "string" },
+      includeHidden: { type: "boolean" },
+      includeParameters: { type: "boolean" },
+      limit: { type: "number" }
+    },
     additionalProperties: false
   };
-  tool2.execute = async () => ({ success: false, error: CONTEXT_TOOL_DENIAL });
+  tool2.execute = async (rawArgs) => {
+    const args2 = rawArgs;
+    const mode = readAgentContextMode(args2.mode);
+    const harnessMode = agentContextModeToHarnessMode(mode);
+    const harnessTool = registry5?.list().find((entry) => entry.definition.name === "agent_harness");
+    if (!harnessTool) {
+      return ok3({
+        ...CONTEXT_TOOL_FALLBACK,
+        status: "agent_harness_not_registered_yet",
+        requestedMode: mode,
+        route: `agent_harness mode:"${harnessMode}"`
+      });
+    }
+    const harnessArgs = {
+      mode: harnessMode,
+      query: args2.query,
+      target: args2.target,
+      toolName: args2.toolName,
+      command: args2.command,
+      commandName: args2.commandName,
+      key: args2.key,
+      category: args2.category,
+      prefix: args2.prefix,
+      includeHidden: args2.includeHidden,
+      includeParameters: mode === "capabilities" ? true : args2.includeParameters,
+      limit: args2.limit
+    };
+    const result2 = await harnessTool.execute(dropUndefined(harnessArgs));
+    if (!result2.success)
+      return result2;
+    return ok3({
+      source: "agent_harness",
+      requestedMode: mode,
+      route: `agent_harness mode:"${harnessMode}"`,
+      result: parseToolOutput2(result2.output)
+    });
+  };
+}
+function readAgentContextMode(value) {
+  return typeof value === "string" && AGENT_CONTEXT_TOOL_MODES.includes(value) ? value : "summary";
+}
+function agentContextModeToHarnessMode(mode) {
+  if (mode === "capabilities")
+    return "summary";
+  if (mode === "modes")
+    return "modes";
+  if (mode === "tools")
+    return "tools";
+  if (mode === "tool")
+    return "tool";
+  if (mode === "settings")
+    return "settings";
+  if (mode === "setting")
+    return "get_setting";
+  if (mode === "commands")
+    return "commands";
+  if (mode === "command")
+    return "command";
+  if (mode === "workspace")
+    return "workspace";
+  if (mode === "status")
+    return "connected_host_status";
+  return "summary";
+}
+function dropUndefined(value) {
+  return Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== undefined));
+}
+function parseToolOutput2(value) {
+  if (typeof value !== "string")
+    return value ?? null;
+  try {
+    return JSON.parse(value);
+  } catch {
+    return value;
+  }
+}
+function ok3(value) {
+  return { success: true, output: JSON.stringify(value, null, 2) };
 }
 
 // src/tools/agent-find-policy.ts
@@ -841057,7 +841169,7 @@ function installAgentToolPolicyGuard(registry5, options = {}) {
     } else if (tool2.definition.name === "state") {
       wrapStateToolForAgentPolicy(tool2);
     } else if (tool2.definition.name === "goodvibes_context") {
-      wrapBlockedContextToolForAgentPolicy(tool2);
+      wrapAgentContextToolForAgentPolicy(tool2, registry5);
     } else if (tool2.definition.name === "goodvibes_settings") {
       wrapBlockedSettingsToolForAgentPolicy(tool2);
     } else if (tool2.definition.name === "inspect") {
@@ -848549,6 +848661,119 @@ function compactRegisteredToolDefinitions(toolRegistry) {
   }
 }
 
+// src/tools/tool-execution-safety.ts
+var TOOL_SAFETY_MARKER = Symbol.for("goodvibes-agent.tool-execution-safety-wrapped");
+var REGISTRY_SAFETY_MARKER = Symbol.for("goodvibes-agent.tool-registry-safety-installed");
+function installToolExecutionSafetyGuard(registry5) {
+  const marked = registry5;
+  if (marked[REGISTRY_SAFETY_MARKER])
+    return;
+  marked[REGISTRY_SAFETY_MARKER] = true;
+  for (const tool2 of registry5.list())
+    wrapToolExecutionSafety(tool2);
+  const originalRegister = registry5.register.bind(registry5);
+  registry5.register = (tool2) => {
+    wrapToolExecutionSafety(tool2);
+    originalRegister(tool2);
+  };
+}
+function wrapToolExecutionSafety(tool2) {
+  const marked = tool2;
+  if (marked[TOOL_SAFETY_MARKER])
+    return;
+  marked[TOOL_SAFETY_MARKER] = true;
+  const originalExecute = tool2.execute.bind(tool2);
+  tool2.execute = async (args2) => {
+    try {
+      return await originalExecute(args2);
+    } catch (error51) {
+      return {
+        success: false,
+        error: summarizeError(error51)
+      };
+    }
+  };
+}
+
+// src/runtime/tool-permission-safety.ts
+var SAFETY_MARKER = Symbol.for("goodvibes-agent.permission-safety-installed");
+var READ_TOOL_NAMES = new Set([
+  "read",
+  "find",
+  "fetch",
+  "analyze",
+  "inspect",
+  "state",
+  "registry",
+  "goodvibes_context",
+  "agent_harness",
+  "agent_knowledge",
+  "agent_operator_briefing"
+]);
+var WRITE_TOOL_NAMES = new Set([
+  "write",
+  "edit",
+  "goodvibes_settings",
+  "agent_knowledge_ingest",
+  "agent_local_registry",
+  "agent_work_plan"
+]);
+var EXECUTE_TOOL_NAMES = new Set(["exec", "repl"]);
+function installPermissionManagerSafetyGuard(manager5) {
+  const marked = manager5;
+  if (marked[SAFETY_MARKER])
+    return;
+  marked[SAFETY_MARKER] = true;
+  const originalGetCategory = manager5.getCategory.bind(manager5);
+  const originalCheck = manager5.check.bind(manager5);
+  const originalCheckDetailed = manager5.checkDetailed?.bind(manager5);
+  manager5.getCategory = (toolName, args2 = {}) => {
+    try {
+      return originalGetCategory(toolName, args2);
+    } catch {
+      return fallbackPermissionCategory(toolName);
+    }
+  };
+  manager5.check = async (toolName, args2) => {
+    try {
+      return await originalCheck(toolName, args2);
+    } catch {
+      return fallbackPermissionCategory(toolName) === "read";
+    }
+  };
+  if (originalCheckDetailed) {
+    manager5.checkDetailed = async (toolName, args2) => {
+      try {
+        return await originalCheckDetailed(toolName, args2);
+      } catch (error51) {
+        const category = fallbackPermissionCategory(toolName);
+        const approved = category === "read";
+        return {
+          approved,
+          persisted: false,
+          sourceLayer: "runtime_mode",
+          reasonCode: approved ? "config_allow" : "config_deny",
+          analysis: {
+            classification: "generic",
+            riskLevel: category === "read" ? "low" : "high",
+            summary: `Permission fallback for ${toolName}: ${summarizeError(error51)}`,
+            reasons: ["permission-manager-exception"]
+          }
+        };
+      }
+    };
+  }
+}
+function fallbackPermissionCategory(toolName) {
+  if (READ_TOOL_NAMES.has(toolName))
+    return "read";
+  if (WRITE_TOOL_NAMES.has(toolName))
+    return "write";
+  if (EXECUTE_TOOL_NAMES.has(toolName))
+    return "execute";
+  return "delegate";
+}
+
 // src/runtime/agent-runtime-events.ts
 var AGENT_STATUS_INTERVAL_MS2 = 30000;
 function withRouter2(getSystemMessageRouter, action2) {
@@ -848805,6 +849030,7 @@ async function initializeBootstrapCore(stdout, options, getControlPlaneRecentEve
   installAgentToolPolicyGuard(toolRegistry, {
     getLastUserMessage: () => conversation.getLastUserMessage()
   });
+  installToolExecutionSafetyGuard(toolRegistry);
   compactRegisteredToolDefinitions(toolRegistry);
   services.agentOrchestrator.setDependencies({
     surfaceRoot: GOODVIBES_AGENT_SURFACE_ROOT,
@@ -848943,6 +849169,7 @@ async function initializeBootstrapCore(stdout, options, getControlPlaneRecentEve
     sessionId: runtimeSessionIdRef.value,
     localPrompt: permissionPromptRef.requestPermission
   }), createPermissionConfigReader(configManager), policyRuntimeState, services.hookDispatcher, featureFlags);
+  installPermissionManagerSafetyGuard(permissionManager);
   await hookWorkbench.loadAndApplyManagedHooks();
   const runtime2 = {
     model: configManager.get("provider.model"),
@@ -890625,7 +890852,7 @@ var AGENT_WORKSPACE_CATEGORIES = [
     summary: "Import preferences, sign in, and choose the main model.",
     detail: "Start here on a fresh install. Every row either saves state, opens the shared model picker, or opens a confirmed in-modal form.",
     actions: [
-      { id: "import-goodvibes-tui-settings", label: "Import GoodVibes settings", detail: "Copy existing display, provider, behavior, permission, TTS, channel, helper, tool, release, and automation values into Agent-owned settings.", kind: "settings-import", safety: "safe" },
+      { id: "import-goodvibes-tui-settings", label: "Import GoodVibes settings", detail: "Copy existing display, provider, subscription, behavior, permission, TTS, channel, helper, tool, release, and automation values into Agent-owned state.", kind: "settings-import", safety: "safe" },
       { id: "subscription-login-start", label: "Start subscription login", detail: "Start one provider sign-in flow, save pending state, and return here.", editorKind: "subscription-login-start", kind: "editor", safety: "safe" },
       { id: "subscription-login-finish", label: "Finish subscription login", detail: "Exchange a code or redirect URL and save the provider subscription session.", editorKind: "subscription-login-finish", kind: "editor", safety: "safe" },
       { id: "setup-provider-model", label: "Choose main model", detail: "Open the shared provider/model picker for normal assistant turns.", kind: "model-picker", modelPickerFlow: "providerModel", modelPickerTarget: "main", safety: "safe" },
@@ -896068,6 +896295,62 @@ function canImportTuiSetting(key) {
 function valuesMatch(left, right) {
   return JSON.stringify(left) === JSON.stringify(right);
 }
+function readRecordMap(record2, key) {
+  const value = record2[key];
+  return isRecord45(value) ? Object.values(value) : [];
+}
+function isProviderSubscription(value) {
+  return isRecord45(value) && typeof value.provider === "string" && typeof value.accessToken === "string" && typeof value.tokenType === "string" && value.authMode === "oauth" && typeof value.overrideAmbientApiKeys === "boolean" && typeof value.createdAt === "number" && typeof value.updatedAt === "number";
+}
+function isPendingSubscriptionLogin(value) {
+  return isRecord45(value) && typeof value.provider === "string" && typeof value.state === "string" && typeof value.verifier === "string" && typeof value.redirectUri === "string" && typeof value.createdAt === "number";
+}
+function importTuiSubscriptions(context, parseErrors) {
+  const shellPaths3 = context.workspace.shellPaths;
+  const manager5 = context.platform.subscriptionManager;
+  const result2 = {
+    importedActive: [],
+    importedPending: [],
+    unchangedActive: [],
+    unchangedPending: [],
+    skipped: []
+  };
+  if (!shellPaths3 || !manager5)
+    return result2;
+  const sourcePath = shellPaths3.resolveUserPath(GOODVIBES_TUI_SURFACE_ROOT, "subscriptions.json");
+  try {
+    const store2 = readJsonRecord(sourcePath);
+    if (!store2)
+      return result2;
+    for (const entry of readRecordMap(store2, "subscriptions")) {
+      if (!isProviderSubscription(entry)) {
+        result2.skipped.push("active subscription with invalid shape");
+        continue;
+      }
+      if (valuesMatch(manager5.get(entry.provider), entry)) {
+        result2.unchangedActive.push(entry.provider);
+        continue;
+      }
+      manager5.saveSubscription(entry);
+      result2.importedActive.push(entry.provider);
+    }
+    for (const entry of readRecordMap(store2, "pending")) {
+      if (!isPendingSubscriptionLogin(entry)) {
+        result2.skipped.push("pending subscription with invalid shape");
+        continue;
+      }
+      if (valuesMatch(manager5.getPending(entry.provider), entry)) {
+        result2.unchangedPending.push(entry.provider);
+        continue;
+      }
+      manager5.savePending(entry);
+      result2.importedPending.push(entry.provider);
+    }
+  } catch (error53) {
+    parseErrors.push(`subscriptions: ${error53 instanceof Error ? error53.message : String(error53)}`);
+  }
+  return result2;
+}
 function agentWorkspaceSettingSchema(context, key) {
   return context?.platform?.configManager?.getSchema().find((setting) => setting.key === key) ?? null;
 }
@@ -896171,7 +896454,7 @@ async function applyAgentWorkspaceSettingValue(context, setting, value) {
 async function importAgentWorkspaceTuiSettings(context) {
   const shellPaths3 = context?.workspace?.shellPaths;
   const configManager = context?.platform?.configManager;
-  if (!shellPaths3 || !configManager) {
+  if (!context || !shellPaths3 || !configManager) {
     return {
       status: "GoodVibes TUI settings import is unavailable in this runtime.",
       runtimeSnapshot: null,
@@ -896205,8 +896488,11 @@ async function importAgentWorkspaceTuiSettings(context) {
       parseErrors.push(`${source.label}: ${error53 instanceof Error ? error53.message : String(error53)}`);
     }
   }
-  if (values2.size === 0) {
-    const detail = parseErrors.length > 0 ? `No importable settings found. ${parseErrors.join("; ")}` : "No GoodVibes TUI settings file with importable Agent-owned settings was found.";
+  const subscriptions = importTuiSubscriptions(context, parseErrors);
+  const subscriptionImports = subscriptions.importedActive.length + subscriptions.importedPending.length;
+  const subscriptionUnchanged = subscriptions.unchangedActive.length + subscriptions.unchangedPending.length;
+  if (values2.size === 0 && subscriptionImports === 0 && subscriptionUnchanged === 0 && subscriptions.skipped.length === 0) {
+    const detail = parseErrors.length > 0 ? `No importable settings or subscriptions found. ${parseErrors.join("; ")}` : "No GoodVibes TUI settings or subscription store with importable Agent-owned state was found.";
     return {
       status: "No GoodVibes TUI settings imported.",
       runtimeSnapshot: null,
@@ -896236,15 +896522,20 @@ async function importAgentWorkspaceTuiSettings(context) {
       skipped.push(`${setting.key}: ${error53 instanceof Error ? error53.message : String(error53)}`);
     }
   }
+  skipped.push(...subscriptions.skipped);
+  const changedCount = imported.length + subscriptionImports;
+  const unchangedCount = unchanged.length + subscriptionUnchanged;
   return {
-    status: imported.length > 0 ? `Imported ${imported.length} GoodVibes TUI setting(s).` : "No GoodVibes TUI settings changed.",
+    status: changedCount > 0 ? `Imported ${changedCount} GoodVibes TUI item(s).` : "No GoodVibes TUI settings changed.",
     runtimeSnapshot: context ? buildAgentWorkspaceRuntimeSnapshot(context) : null,
     result: {
-      kind: skipped.length > 0 && imported.length === 0 ? "error" : imported.length > 0 ? "refreshed" : "guidance",
-      title: imported.length > 0 ? "GoodVibes TUI settings imported" : "No settings changed",
+      kind: skipped.length > 0 && changedCount === 0 ? "error" : changedCount > 0 ? "refreshed" : "guidance",
+      title: changedCount > 0 ? "GoodVibes TUI settings imported" : "No settings changed",
       detail: [
         imported.length > 0 ? `Imported: ${imported.slice(0, 10).join(", ")}${imported.length > 10 ? `, +${imported.length - 10} more` : ""}.` : "",
-        unchanged.length > 0 ? `${unchanged.length} setting(s) already matched.` : "",
+        subscriptions.importedActive.length > 0 ? `Imported active subscription(s): ${subscriptions.importedActive.join(", ")}.` : "",
+        subscriptions.importedPending.length > 0 ? `Imported pending subscription(s): ${subscriptions.importedPending.join(", ")}.` : "",
+        unchangedCount > 0 ? `${unchangedCount} item(s) already matched.` : "",
         skipped.length > 0 ? `Skipped: ${skipped.slice(0, 5).join("; ")}${skipped.length > 5 ? `; +${skipped.length - 5} more` : ""}.` : "",
         parseErrors.length > 0 ? `Parse issues: ${parseErrors.join("; ")}.` : ""
       ].filter((line2) => line2.length > 0).join(" "),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pellux/goodvibes-agent",
-  "version": "1.1.5",
+  "version": "1.1.7",
   "private": false,
   "description": "GoodVibes personal operator assistant TUI with a proactive Agent product brain, isolated Agent Knowledge, local profiles, routines, skills, personas, and explicit build delegation.",
   "type": "module",

package/src/input/agent-workspace-categories.ts

@@ -43,7 +43,7 @@ export const AGENT_WORKSPACE_CATEGORIES: readonly AgentWorkspaceCategory[] = [
     summary: 'Import preferences, sign in, and choose the main model.',
     detail: 'Start here on a fresh install. Every row either saves state, opens the shared model picker, or opens a confirmed in-modal form.',
     actions: [
-      { id: 'import-goodvibes-tui-settings', label: 'Import GoodVibes settings', detail: 'Copy existing display, provider, behavior, permission, TTS, channel, helper, tool, release, and automation values into Agent-owned settings.', kind: 'settings-import', safety: 'safe' },
+      { id: 'import-goodvibes-tui-settings', label: 'Import GoodVibes settings', detail: 'Copy existing display, provider, subscription, behavior, permission, TTS, channel, helper, tool, release, and automation values into Agent-owned state.', kind: 'settings-import', safety: 'safe' },
       { id: 'subscription-login-start', label: 'Start subscription login', detail: 'Start one provider sign-in flow, save pending state, and return here.', editorKind: 'subscription-login-start', kind: 'editor', safety: 'safe' },
       { id: 'subscription-login-finish', label: 'Finish subscription login', detail: 'Exchange a code or redirect URL and save the provider subscription session.', editorKind: 'subscription-login-finish', kind: 'editor', safety: 'safe' },
       { id: 'setup-provider-model', label: 'Choose main model', detail: 'Open the shared provider/model picker for normal assistant turns.', kind: 'model-picker', modelPickerFlow: 'providerModel', modelPickerTarget: 'main', safety: 'safe' },

package/src/input/agent-workspace-settings.ts

@@ -1,5 +1,6 @@
 import { existsSync, readFileSync } from 'node:fs';
 import type { ConfigKey, ConfigSetting } from '@pellux/goodvibes-sdk/platform/config';
+import type { PendingSubscriptionLogin, ProviderSubscription } from '@pellux/goodvibes-sdk/platform/config';
 import { setHarnessSetting } from '../agent/harness-control.ts';
 import { isExternalHostOwnedSettingKey } from '../config/agent-settings-policy.ts';
 import { buildAgentWorkspaceRuntimeSnapshot } from './agent-workspace-snapshot.ts';
@@ -83,6 +84,83 @@ function valuesMatch(left: unknown, right: unknown): boolean {
   return JSON.stringify(left) === JSON.stringify(right);
 }
 
+function readRecordMap(record: Record<string, unknown>, key: string): readonly unknown[] {
+  const value = record[key];
+  return isRecord(value) ? Object.values(value) : [];
+}
+
+function isProviderSubscription(value: unknown): value is ProviderSubscription {
+  return isRecord(value)
+    && typeof value.provider === 'string'
+    && typeof value.accessToken === 'string'
+    && typeof value.tokenType === 'string'
+    && value.authMode === 'oauth'
+    && typeof value.overrideAmbientApiKeys === 'boolean'
+    && typeof value.createdAt === 'number'
+    && typeof value.updatedAt === 'number';
+}
+
+function isPendingSubscriptionLogin(value: unknown): value is PendingSubscriptionLogin {
+  return isRecord(value)
+    && typeof value.provider === 'string'
+    && typeof value.state === 'string'
+    && typeof value.verifier === 'string'
+    && typeof value.redirectUri === 'string'
+    && typeof value.createdAt === 'number';
+}
+
+function importTuiSubscriptions(context: CommandContext, parseErrors: string[]): {
+  readonly importedActive: string[];
+  readonly importedPending: string[];
+  readonly unchangedActive: string[];
+  readonly unchangedPending: string[];
+  readonly skipped: string[];
+} {
+  const shellPaths = context.workspace.shellPaths;
+  const manager = context.platform.subscriptionManager;
+  const result = {
+    importedActive: [] as string[],
+    importedPending: [] as string[],
+    unchangedActive: [] as string[],
+    unchangedPending: [] as string[],
+    skipped: [] as string[],
+  };
+  if (!shellPaths || !manager) return result;
+
+  const sourcePath = shellPaths.resolveUserPath(GOODVIBES_TUI_SURFACE_ROOT, 'subscriptions.json');
+  try {
+    const store = readJsonRecord(sourcePath);
+    if (!store) return result;
+    for (const entry of readRecordMap(store, 'subscriptions')) {
+      if (!isProviderSubscription(entry)) {
+        result.skipped.push('active subscription with invalid shape');
+        continue;
+      }
+      if (valuesMatch(manager.get(entry.provider), entry)) {
+        result.unchangedActive.push(entry.provider);
+        continue;
+      }
+      manager.saveSubscription(entry);
+      result.importedActive.push(entry.provider);
+    }
+    for (const entry of readRecordMap(store, 'pending')) {
+      if (!isPendingSubscriptionLogin(entry)) {
+        result.skipped.push('pending subscription with invalid shape');
+        continue;
+      }
+      if (valuesMatch(manager.getPending(entry.provider), entry)) {
+        result.unchangedPending.push(entry.provider);
+        continue;
+      }
+      manager.savePending(entry);
+      result.importedPending.push(entry.provider);
+    }
+  } catch (error) {
+    parseErrors.push(`subscriptions: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  return result;
+}
+
 export function agentWorkspaceSettingSchema(context: CommandContext | null, key: string): ConfigSetting | null {
   return context?.platform?.configManager
     ?.getSchema()
@@ -200,7 +278,7 @@ export async function applyAgentWorkspaceSettingValue(
 export async function importAgentWorkspaceTuiSettings(context: CommandContext | null): Promise<TuiSettingsImportOutcome> {
   const shellPaths = context?.workspace?.shellPaths;
   const configManager = context?.platform?.configManager;
-  if (!shellPaths || !configManager) {
+  if (!context || !shellPaths || !configManager) {
     return {
       status: 'GoodVibes TUI settings import is unavailable in this runtime.',
       runtimeSnapshot: null,
@@ -232,11 +310,14 @@ export async function importAgentWorkspaceTuiSettings(context: CommandContext |
       parseErrors.push(`${source.label}: ${error instanceof Error ? error.message : String(error)}`);
     }
   }
+  const subscriptions = importTuiSubscriptions(context, parseErrors);
+  const subscriptionImports = subscriptions.importedActive.length + subscriptions.importedPending.length;
+  const subscriptionUnchanged = subscriptions.unchangedActive.length + subscriptions.unchangedPending.length;
 
-  if (values.size === 0) {
+  if (values.size === 0 && subscriptionImports === 0 && subscriptionUnchanged === 0 && subscriptions.skipped.length === 0) {
     const detail = parseErrors.length > 0
-      ? `No importable settings found. ${parseErrors.join('; ')}`
-      : 'No GoodVibes TUI settings file with importable Agent-owned settings was found.';
+      ? `No importable settings or subscriptions found. ${parseErrors.join('; ')}`
+      : 'No GoodVibes TUI settings or subscription store with importable Agent-owned state was found.';
     return {
       status: 'No GoodVibes TUI settings imported.',
       runtimeSnapshot: null,
@@ -266,16 +347,21 @@ export async function importAgentWorkspaceTuiSettings(context: CommandContext |
       skipped.push(`${setting.key}: ${error instanceof Error ? error.message : String(error)}`);
     }
   }
+  skipped.push(...subscriptions.skipped);
+  const changedCount = imported.length + subscriptionImports;
+  const unchangedCount = unchanged.length + subscriptionUnchanged;
 
   return {
-    status: imported.length > 0 ? `Imported ${imported.length} GoodVibes TUI setting(s).` : 'No GoodVibes TUI settings changed.',
+    status: changedCount > 0 ? `Imported ${changedCount} GoodVibes TUI item(s).` : 'No GoodVibes TUI settings changed.',
     runtimeSnapshot: context ? buildAgentWorkspaceRuntimeSnapshot(context) : null,
     result: {
-      kind: skipped.length > 0 && imported.length === 0 ? 'error' : imported.length > 0 ? 'refreshed' : 'guidance',
-      title: imported.length > 0 ? 'GoodVibes TUI settings imported' : 'No settings changed',
+      kind: skipped.length > 0 && changedCount === 0 ? 'error' : changedCount > 0 ? 'refreshed' : 'guidance',
+      title: changedCount > 0 ? 'GoodVibes TUI settings imported' : 'No settings changed',
       detail: [
         imported.length > 0 ? `Imported: ${imported.slice(0, 10).join(', ')}${imported.length > 10 ? `, +${imported.length - 10} more` : ''}.` : '',
-        unchanged.length > 0 ? `${unchanged.length} setting(s) already matched.` : '',
+        subscriptions.importedActive.length > 0 ? `Imported active subscription(s): ${subscriptions.importedActive.join(', ')}.` : '',
+        subscriptions.importedPending.length > 0 ? `Imported pending subscription(s): ${subscriptions.importedPending.join(', ')}.` : '',
+        unchangedCount > 0 ? `${unchangedCount} item(s) already matched.` : '',
         skipped.length > 0 ? `Skipped: ${skipped.slice(0, 5).join('; ')}${skipped.length > 5 ? `; +${skipped.length - 5} more` : ''}.` : '',
         parseErrors.length > 0 ? `Parse issues: ${parseErrors.join('; ')}.` : '',
       ].filter((line) => line.length > 0).join(' '),

package/src/runtime/bootstrap-core.ts

@@ -41,6 +41,8 @@ import { registerAgentReminderScheduleTool } from '../tools/agent-reminder-sched
 import { getTerminalSize } from '../shell/terminal-size.ts';
 import { registerAgentWorkPlanTool } from '../tools/agent-work-plan-tool.ts';
 import { compactRegisteredToolDefinitions } from '../tools/tool-definition-compaction.ts';
+import { installToolExecutionSafetyGuard } from '../tools/tool-execution-safety.ts';
+import { installPermissionManagerSafetyGuard } from './tool-permission-safety.ts';
 import { GOODVIBES_AGENT_SURFACE_ROOT } from '../config/surface.ts';
 import { registerAgentRuntimeEvents } from './agent-runtime-events.ts';
 
@@ -251,6 +253,7 @@ export async function initializeBootstrapCore(
   installAgentToolPolicyGuard(toolRegistry, {
     getLastUserMessage: () => conversation.getLastUserMessage(),
   });
+  installToolExecutionSafetyGuard(toolRegistry);
   compactRegisteredToolDefinitions(toolRegistry);
   services.agentOrchestrator.setDependencies({
     surfaceRoot: GOODVIBES_AGENT_SURFACE_ROOT,
@@ -432,6 +435,7 @@ export async function initializeBootstrapCore(
     services.hookDispatcher,
     featureFlags,
   );
+  installPermissionManagerSafetyGuard(permissionManager);
   await hookWorkbench.loadAndApplyManagedHooks();
 
   const runtime: MutableRuntimeState = {

package/src/runtime/tool-permission-safety.ts

@@ -0,0 +1,93 @@
+import type { PermissionCategory, PermissionCheckResult } from '@pellux/goodvibes-sdk/platform/permissions';
+import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
+
+type PermissionManagerLike = {
+  check(toolName: string, args: Record<string, unknown>): Promise<boolean>;
+  checkDetailed?: (toolName: string, args: Record<string, unknown>) => Promise<PermissionCheckResult>;
+  getCategory(toolName: string, args?: Record<string, unknown>): PermissionCategory;
+};
+
+const SAFETY_MARKER = Symbol.for('goodvibes-agent.permission-safety-installed');
+
+const READ_TOOL_NAMES = new Set([
+  'read',
+  'find',
+  'fetch',
+  'analyze',
+  'inspect',
+  'state',
+  'registry',
+  'goodvibes_context',
+  'agent_harness',
+  'agent_knowledge',
+  'agent_operator_briefing',
+]);
+
+const WRITE_TOOL_NAMES = new Set([
+  'write',
+  'edit',
+  'goodvibes_settings',
+  'agent_knowledge_ingest',
+  'agent_local_registry',
+  'agent_work_plan',
+]);
+
+const EXECUTE_TOOL_NAMES = new Set(['exec', 'repl']);
+
+type MarkedPermissionManager = PermissionManagerLike & { [SAFETY_MARKER]?: true };
+
+export function installPermissionManagerSafetyGuard(manager: PermissionManagerLike): void {
+  const marked = manager as MarkedPermissionManager;
+  if (marked[SAFETY_MARKER]) return;
+  marked[SAFETY_MARKER] = true;
+
+  const originalGetCategory = manager.getCategory.bind(manager);
+  const originalCheck = manager.check.bind(manager);
+  const originalCheckDetailed = manager.checkDetailed?.bind(manager);
+
+  manager.getCategory = (toolName, args = {}) => {
+    try {
+      return originalGetCategory(toolName, args);
+    } catch {
+      return fallbackPermissionCategory(toolName);
+    }
+  };
+
+  manager.check = async (toolName, args) => {
+    try {
+      return await originalCheck(toolName, args);
+    } catch {
+      return fallbackPermissionCategory(toolName) === 'read';
+    }
+  };
+
+  if (originalCheckDetailed) {
+    manager.checkDetailed = async (toolName, args) => {
+      try {
+        return await originalCheckDetailed(toolName, args);
+      } catch (error) {
+        const category = fallbackPermissionCategory(toolName);
+        const approved = category === 'read';
+        return {
+          approved,
+          persisted: false,
+          sourceLayer: 'runtime_mode',
+          reasonCode: approved ? 'config_allow' : 'config_deny',
+          analysis: {
+            classification: 'generic',
+            riskLevel: category === 'read' ? 'low' : 'high',
+            summary: `Permission fallback for ${toolName}: ${summarizeError(error)}`,
+            reasons: ['permission-manager-exception'],
+          },
+        };
+      }
+    };
+  }
+}
+
+export function fallbackPermissionCategory(toolName: string): PermissionCategory {
+  if (READ_TOOL_NAMES.has(toolName)) return 'read';
+  if (WRITE_TOOL_NAMES.has(toolName)) return 'write';
+  if (EXECUTE_TOOL_NAMES.has(toolName)) return 'execute';
+  return 'delegate';
+}

package/src/tools/agent-context-policy.ts

@@ -1,20 +1,147 @@
 import type { Tool } from '@pellux/goodvibes-sdk/platform/types';
+import type { ToolRegistry } from '@pellux/goodvibes-sdk/platform/tools';
 
-const CONTEXT_TOOL_DENIAL = [
-  'GoodVibes Agent does not expose non-Agent runtime context through model tools in the main conversation.',
-  'The runtime context tool can describe assumptions that are outside the Agent product boundary.',
-  'Use explicit Agent CLI/slash commands such as status, compat, setup, and isolated Agent Knowledge instead.',
-].join(' ');
+const AGENT_CONTEXT_TOOL_MODES = [
+  'summary',
+  'capabilities',
+  'modes',
+  'tools',
+  'tool',
+  'settings',
+  'setting',
+  'commands',
+  'command',
+  'workspace',
+  'status',
+] as const;
 
-export function wrapBlockedContextToolForAgentPolicy(tool: Tool): void {
-  tool.definition.description = 'Blocked in GoodVibes Agent: non-Agent runtime context.';
+type AgentContextMode = typeof AGENT_CONTEXT_TOOL_MODES[number];
+
+type AgentContextArgs = {
+  readonly mode?: unknown;
+  readonly query?: unknown;
+  readonly target?: unknown;
+  readonly toolName?: unknown;
+  readonly command?: unknown;
+  readonly commandName?: unknown;
+  readonly key?: unknown;
+  readonly category?: unknown;
+  readonly prefix?: unknown;
+  readonly includeHidden?: unknown;
+  readonly includeParameters?: unknown;
+  readonly limit?: unknown;
+};
+
+const CONTEXT_TOOL_FALLBACK = {
+  runtime: 'GoodVibes Agent',
+  preferredTool: 'agent_harness',
+  routes: {
+    summary: 'agent_harness mode:"summary"',
+    capabilities: 'agent_harness mode:"summary" includeParameters:true',
+    tools: 'agent_harness mode:"tools"',
+    tool: 'agent_harness mode:"tool"',
+    settings: 'agent_harness mode:"settings"',
+    commands: 'agent_harness mode:"commands"',
+    workspace: 'agent_harness mode:"workspace"',
+    status: 'agent_harness mode:"connected_host_status"',
+  },
+};
+
+export function wrapAgentContextToolForAgentPolicy(tool: Tool, registry?: ToolRegistry): void {
+  tool.definition.description = 'Inspect GoodVibes Agent harness capabilities.';
   tool.definition.sideEffects = [];
   tool.definition.parameters = {
     type: 'object',
-    properties: {},
+    properties: {
+      mode: { type: 'string', enum: [...AGENT_CONTEXT_TOOL_MODES] },
+      query: { type: 'string' },
+      target: { type: 'string' },
+      toolName: { type: 'string' },
+      command: { type: 'string' },
+      commandName: { type: 'string' },
+      key: { type: 'string' },
+      category: { type: 'string' },
+      prefix: { type: 'string' },
+      includeHidden: { type: 'boolean' },
+      includeParameters: { type: 'boolean' },
+      limit: { type: 'number' },
+    },
     additionalProperties: false,
   };
-  tool.execute = async () => ({ success: false, error: CONTEXT_TOOL_DENIAL });
+  tool.execute = async (rawArgs) => {
+    const args = rawArgs as AgentContextArgs;
+    const mode = readAgentContextMode(args.mode);
+    const harnessMode = agentContextModeToHarnessMode(mode);
+    const harnessTool = registry?.list().find((entry) => entry.definition.name === 'agent_harness');
+    if (!harnessTool) {
+      return ok({
+        ...CONTEXT_TOOL_FALLBACK,
+        status: 'agent_harness_not_registered_yet',
+        requestedMode: mode,
+        route: `agent_harness mode:"${harnessMode}"`,
+      });
+    }
+
+    const harnessArgs = {
+      mode: harnessMode,
+      query: args.query,
+      target: args.target,
+      toolName: args.toolName,
+      command: args.command,
+      commandName: args.commandName,
+      key: args.key,
+      category: args.category,
+      prefix: args.prefix,
+      includeHidden: args.includeHidden,
+      includeParameters: mode === 'capabilities' ? true : args.includeParameters,
+      limit: args.limit,
+    };
+    const result = await harnessTool.execute(dropUndefined(harnessArgs));
+    if (!result.success) return result;
+    return ok({
+      source: 'agent_harness',
+      requestedMode: mode,
+      route: `agent_harness mode:"${harnessMode}"`,
+      result: parseToolOutput(result.output),
+    });
+  };
+}
+
+export const AGENT_CONTEXT_TOOL_COMPATIBILITY_MODES = AGENT_CONTEXT_TOOL_MODES;
+
+function readAgentContextMode(value: unknown): AgentContextMode {
+  return typeof value === 'string' && AGENT_CONTEXT_TOOL_MODES.includes(value as AgentContextMode)
+    ? value as AgentContextMode
+    : 'summary';
 }
 
-export const AGENT_CONTEXT_TOOL_DENIAL_MESSAGE = CONTEXT_TOOL_DENIAL;
+function agentContextModeToHarnessMode(mode: AgentContextMode): string {
+  if (mode === 'capabilities') return 'summary';
+  if (mode === 'modes') return 'modes';
+  if (mode === 'tools') return 'tools';
+  if (mode === 'tool') return 'tool';
+  if (mode === 'settings') return 'settings';
+  if (mode === 'setting') return 'get_setting';
+  if (mode === 'commands') return 'commands';
+  if (mode === 'command') return 'command';
+  if (mode === 'workspace') return 'workspace';
+  if (mode === 'status') return 'connected_host_status';
+  return 'summary';
+}
+
+function dropUndefined<T extends Record<string, unknown>>(value: T): Record<string, unknown> {
+  return Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== undefined));
+}
+
+function parseToolOutput(value: unknown): unknown {
+  if (typeof value !== 'string') return value ?? null;
+  try {
+    return JSON.parse(value);
+  } catch {
+    return value;
+  }
+}
+
+function ok(value: unknown): { readonly success: true; readonly output: string } {
+  return { success: true, output: JSON.stringify(value, null, 2) };
+}

package/src/tools/agent-tool-policy-guard.ts

@@ -5,7 +5,7 @@ import {
   wrapRegistryToolForAgentPolicy,
 } from './agent-analysis-registry-policy.ts';
 import {
-  wrapBlockedContextToolForAgentPolicy,
+  wrapAgentContextToolForAgentPolicy,
 } from './agent-context-policy.ts';
 import { wrapFindToolForAgentPolicy } from './agent-find-policy.ts';
 import { wrapReadToolForAgentPolicy } from './agent-read-policy.ts';
@@ -223,7 +223,7 @@ export function installAgentToolPolicyGuard(registry: ToolRegistry, options: Age
     } else if (tool.definition.name === 'state') {
       wrapStateToolForAgentPolicy(tool);
     } else if (tool.definition.name === 'goodvibes_context') {
-      wrapBlockedContextToolForAgentPolicy(tool);
+      wrapAgentContextToolForAgentPolicy(tool, registry);
     } else if (tool.definition.name === 'goodvibes_settings') {
       wrapBlockedSettingsToolForAgentPolicy(tool);
     } else if (tool.definition.name === 'inspect') {
@@ -538,8 +538,8 @@ export const AGENT_DURABLE_WORKFLOW_MUTATION_DENIAL_MESSAGE = DURABLE_WORKFLOW_M
 export const AGENT_CONTROL_MUTATION_DENIAL_MESSAGE = CONTROL_MUTATION_DENIAL;
 
 export {
-  AGENT_CONTEXT_TOOL_DENIAL_MESSAGE,
-  wrapBlockedContextToolForAgentPolicy,
+  AGENT_CONTEXT_TOOL_COMPATIBILITY_MODES,
+  wrapAgentContextToolForAgentPolicy,
 } from './agent-context-policy.ts';
 
 export {

package/src/tools/tool-execution-safety.ts

@@ -0,0 +1,41 @@
+import type { Tool } from '@pellux/goodvibes-sdk/platform/types';
+import type { ToolRegistry } from '@pellux/goodvibes-sdk/platform/tools';
+import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
+
+const TOOL_SAFETY_MARKER = Symbol.for('goodvibes-agent.tool-execution-safety-wrapped');
+const REGISTRY_SAFETY_MARKER = Symbol.for('goodvibes-agent.tool-registry-safety-installed');
+
+type MarkedTool = Tool & { [TOOL_SAFETY_MARKER]?: true };
+type MarkedRegistry = ToolRegistry & { [REGISTRY_SAFETY_MARKER]?: true };
+
+export function installToolExecutionSafetyGuard(registry: ToolRegistry): void {
+  const marked = registry as MarkedRegistry;
+  if (marked[REGISTRY_SAFETY_MARKER]) return;
+  marked[REGISTRY_SAFETY_MARKER] = true;
+
+  for (const tool of registry.list()) wrapToolExecutionSafety(tool);
+
+  const originalRegister = registry.register.bind(registry);
+  registry.register = (tool: Tool): void => {
+    wrapToolExecutionSafety(tool);
+    originalRegister(tool);
+  };
+}
+
+export function wrapToolExecutionSafety(tool: Tool): void {
+  const marked = tool as MarkedTool;
+  if (marked[TOOL_SAFETY_MARKER]) return;
+  marked[TOOL_SAFETY_MARKER] = true;
+
+  const originalExecute = tool.execute.bind(tool);
+  tool.execute = async (args) => {
+    try {
+      return await originalExecute(args);
+    } catch (error) {
+      return {
+        success: false,
+        error: summarizeError(error),
+      };
+    }
+  };
+}

package/src/version.ts

@@ -6,7 +6,7 @@ import { join } from 'node:path';
 // The prebuild script updates the fallback value before compilation.
 // Uses import.meta.dir (Bun) to locate package.json relative to this file,
 // which is correct regardless of the process working directory.
-let _version = '1.1.5';
+let _version = '1.1.7';
 try {
   const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', 'package.json'), 'utf-8')) as {
     readonly version?: unknown;