@pellux/goodvibes-agent 1.2.0 → 1.3.0

package/src/tools/agent-harness-browser-cockpit-route.ts

@@ -1,7 +1,18 @@
 import type { CommandContext } from '../input/command-registry.ts';
 import { resolveRuntimeEndpointBinding } from '../cli/endpoints.ts';
 import { AGENT_WORKSPACE_CATEGORIES } from '../input/agent-workspace-categories.ts';
+import type { AgentSetupWizardDurableReceipt } from '../agent/setup-wizard.ts';
+import { buildSetupWizardDurableReceipts } from '../agent/setup-wizard-artifact-receipts.ts';
+import { mergeSetupWizardDurableReceipts, setupWizardLiveDurableReceipts } from '../input/setup-wizard-live-receipts.ts';
 import { readOnboardingCompletionMarker } from '../runtime/onboarding/index.ts';
+import {
+  browserPwaReadModelSnapshot,
+  certifiedBrowserPwaCategoryRouteForCategory,
+  certifiedBrowserPwaFirstRunReceipts,
+  isCertifiedBrowserPwaCategoryRoute,
+  type BrowserPwaCategoryRouteRecord,
+  type BrowserPwaReadModelSnapshot,
+} from './agent-harness-browser-pwa-read-models.ts';
 
 function browserConnectHost(host: string): string {
   if (host === '0.0.0.0' || host === '::') return '127.0.0.1';
@@ -58,27 +69,97 @@ function confirmedCategoryRoute(categoryId: string, label: string): string {
   return `agent_harness mode:"open_ui_surface" surfaceId:"agent-workspace" categoryId:"${categoryId}" confirm:true explicitUserRequest:"Open the ${label} workspace."`;
 }
 
-function browserCockpitWorkspaceCoverage(enabled: boolean, includeDetails: boolean): Record<string, unknown> {
-  const browserStatus = enabled ? 'terminal-first' : 'blocked-by-web-setup';
+function browserPwaSetupReceipts(context: CommandContext): readonly AgentSetupWizardDurableReceipt[] {
+  const artifactReceipts = (() => {
+    try {
+      const artifacts = context.platform?.artifactStore?.list?.(100) ?? [];
+      return buildSetupWizardDurableReceipts(artifacts);
+    } catch {
+      return [];
+    }
+  })();
+  return mergeSetupWizardDurableReceipts(artifactReceipts, setupWizardLiveDurableReceipts(context))
+    .filter((receipt) => receipt.stepId === 'browser-pwa');
+}
+
+function readyBrowserPwaSetupReceipt(receipts: readonly AgentSetupWizardDurableReceipt[]): AgentSetupWizardDurableReceipt | null {
+  return receipts.find((receipt) => receipt.status === 'ready') ?? null;
+}
+
+function routeCertificationSummary(route: BrowserPwaCategoryRouteRecord): Record<string, unknown> {
+  return {
+    id: route.id,
+    categoryIds: route.categoryIds,
+    route: route.route,
+    mobileReady: route.mobileReady,
+    pwaReady: route.pwaReady,
+    modelRoute: route.modelRoute,
+    sourcePath: route.sourcePath,
+    certification: route.certification,
+  };
+}
+
+function browserCockpitWorkspaceCoverage(
+  enabled: boolean,
+  includeDetails: boolean,
+  browserPwa: BrowserPwaReadModelSnapshot,
+): Record<string, unknown> {
   const categories = AGENT_WORKSPACE_CATEGORIES.map((category) => ({
     id: category.id,
     label: category.label,
     group: category.group,
     actions: category.actions.length,
-    browserStatus,
-    browserRoute: null,
+    certifiedRoute: enabled ? certifiedBrowserPwaCategoryRouteForCategory(browserPwa, category.id) : null,
     agentRoute: confirmedCategoryRoute(category.id, category.label),
-    neededContract: 'connected-host browser-native Agent workspace category route',
   }));
   const categoryById = new Map(categories.map((category) => [category.id, category]));
+  const coveredCategoryCount = categories.filter((category) => category.certifiedRoute).length;
+  const nativeCategoryRoutesPublished = enabled && coveredCategoryCount === categories.length;
+  const status = !enabled
+    ? 'web-setup-needed'
+    : nativeCategoryRoutesPublished
+      ? 'browser-native-ready'
+      : coveredCategoryCount > 0
+        ? 'partial-browser-native-category-contracts'
+        : 'needs-browser-native-category-contracts';
+  const certifiedRoutes = browserPwa.categoryRoutes.filter(isCertifiedBrowserPwaCategoryRoute);
+  const categoryRows = categories.map((category) => {
+    const route = category.certifiedRoute;
+    return {
+      id: category.id,
+      label: category.label,
+      group: category.group,
+      actions: category.actions,
+      browserStatus: !enabled ? 'blocked-by-web-setup' : route ? 'browser-native-ready' : 'terminal-first',
+      browserRoute: route?.route ?? null,
+      ...(route ? {
+        browserRouteId: route.id,
+        browserRouteSource: route.sourcePath,
+        browserRouteReceiptId: route.certification.receiptId ?? null,
+        mobileReady: route.mobileReady,
+        pwaReady: route.pwaReady,
+      } : {
+        neededContract: 'connected-host browser-native Agent workspace category route',
+      }),
+      agentRoute: category.agentRoute,
+    };
+  });
   return {
-    status: enabled ? 'needs-browser-native-category-contracts' : 'web-setup-needed',
-    summary: enabled
-      ? 'The connected-host web URL is openable, but Agent has not received a published browser-native route contract for workspace categories yet.'
-      : 'The connected-host web endpoint is disabled, so browser-native workspace categories cannot be reached yet.',
+    status,
+    summary: !enabled
+      ? 'The connected-host web endpoint is disabled, so browser-native workspace categories cannot be reached yet.'
+      : nativeCategoryRoutesPublished
+        ? 'The connected host has published certified browser-native routes for every Agent workspace category.'
+        : coveredCategoryCount > 0
+          ? `${coveredCategoryCount}/${categories.length} Agent workspace categories have certified browser-native routes; terminal workspace fallback remains available for the rest.`
+          : 'The connected-host web URL is openable, but Agent has not received a published browser-native route contract for workspace categories yet.',
     categoryCount: categories.length,
-    nativeCategoryRoutesPublished: false,
-    terminalFallback: 'Every Agent workspace category remains reachable through the TUI Agent Workspace while browser-native category routes are being published.',
+    coveredCategoryCount,
+    certifiedCategoryRouteCount: certifiedRoutes.length,
+    nativeCategoryRoutesPublished,
+    terminalFallback: nativeCategoryRoutesPublished
+      ? 'The TUI Agent Workspace remains available as an equivalent local fallback.'
+      : 'Every Agent workspace category remains reachable through the TUI Agent Workspace while browser-native category routes are being published.',
     laneCount: BROWSER_COCKPIT_EXPECTED_LANES.length,
     ...(includeDetails ? {
       lanes: BROWSER_COCKPIT_EXPECTED_LANES.map((lane) => ({
@@ -86,19 +167,40 @@ function browserCockpitWorkspaceCoverage(enabled: boolean, includeDetails: boole
         label: lane.label,
         categoryIds: lane.categoryIds,
         userOutcome: lane.userOutcome,
-        browserStatus: enabled ? 'needs-browser-native-contract' : 'blocked-by-web-setup',
+        coveredCategoryCount: lane.categoryIds.filter((categoryId) => categoryById.get(categoryId)?.certifiedRoute).length,
+        browserStatus: !enabled
+          ? 'blocked-by-web-setup'
+          : lane.categoryIds.every((categoryId) => categoryById.get(categoryId)?.certifiedRoute)
+            ? 'browser-native-ready'
+            : lane.categoryIds.some((categoryId) => categoryById.get(categoryId)?.certifiedRoute)
+              ? 'partial-browser-native-contract'
+              : 'needs-browser-native-contract',
+        browserRoutes: lane.categoryIds
+          .map((categoryId) => categoryById.get(categoryId)?.certifiedRoute)
+          .filter((route): route is BrowserPwaCategoryRouteRecord => Boolean(route))
+          .map(routeCertificationSummary),
         agentRoutes: lane.categoryIds
           .map((categoryId) => categoryById.get(categoryId))
           .filter((category): category is NonNullable<typeof category> => Boolean(category))
           .map((category) => category.agentRoute),
       })),
-      categories,
+      categories: categoryRows,
+      publishedCategoryRoutes: certifiedRoutes.slice(0, 20).map(routeCertificationSummary),
+      sourceCounts: browserPwa.sourceCounts,
     } : {}),
-    policy: 'Workspace coverage is a route contract map, not a claim that the connected-host browser already renders these Agent category controls.',
+    policy: nativeCategoryRoutesPublished
+      ? 'Workspace coverage is counted ready only from certified SDK/daemon browser-native category route records with exact routes, mobile/touch evidence, publication, provenance, and freshness cursor metadata.'
+      : 'Workspace coverage is a route contract map, not a claim that the connected-host browser already renders these Agent category controls.',
   };
 }
 
-function browserCockpitMobileAffordances(enabled: boolean, includeDetails: boolean): Record<string, unknown> {
+function browserCockpitMobileAffordances(
+  enabled: boolean,
+  includeDetails: boolean,
+  browserPwa: BrowserPwaReadModelSnapshot,
+  nativeCategoryRoutesPublished: boolean,
+): Record<string, unknown> {
+  const certifiedFirstRun = certifiedBrowserPwaFirstRunReceipts(browserPwa);
   const controls = [
     {
       id: 'open-browser-cockpit',
@@ -125,22 +227,38 @@ function browserCockpitMobileAffordances(enabled: boolean, includeDetails: boole
       modelRoute: 'settings action:"list" query:"web" includeHidden:true',
     },
   ];
+  const laneControls = BROWSER_COCKPIT_EXPECTED_LANES.map((lane) => ({
+    id: lane.id,
+    label: lane.label,
+    status: nativeCategoryRoutesPublished ? 'ready' : enabled ? 'needs-browser-native-category-contracts' : 'blocked-by-web-setup',
+    categoryIds: lane.categoryIds,
+  }));
   return {
-    status: enabled ? 'openable' : 'setup-needed',
+    status: enabled ? nativeCategoryRoutesPublished ? 'browser-native-ready' : 'openable' : 'setup-needed',
     controlCount: controls.length,
-    ...(includeDetails ? { controls } : {}),
+    nativeControlCount: laneControls.length,
+    ...(includeDetails ? { controls, nativeControls: laneControls } : {}),
     pwaInstall: {
-      status: enabled ? 'browser-owned' : 'blocked-by-web-setup',
-      note: 'Agent can open the configured URL; installing the PWA remains a browser/connected-host UI action.',
+      status: certifiedFirstRun.length > 0 ? 'certified-live-receipt' : enabled ? 'browser-owned' : 'blocked-by-web-setup',
+      note: certifiedFirstRun.length > 0
+        ? 'The connected host published certified browser/PWA first-run evidence for the browser runtime.'
+        : 'Agent can open the configured URL; installing the PWA remains a browser/connected-host UI action until a certified first-run receipt is published.',
     },
     touchControls: {
-      status: 'needs-browser-native-category-contracts',
-      note: 'Agent has not received a connected-host contract proving mobile-native controls for chat, setup, approvals, memory, channels, or automation.',
+      status: nativeCategoryRoutesPublished ? 'ready' : 'needs-browser-native-category-contracts',
+      note: nativeCategoryRoutesPublished
+        ? 'Certified browser-native route contracts cover chat, setup, approvals, memory, channels, automation, research, and safety lanes with mobile/touch evidence.'
+        : 'Agent has not received a connected-host contract proving mobile-native controls for chat, setup, approvals, memory, channels, or automation.',
     },
   };
 }
 
-function browserCockpitReceipts(context: CommandContext, enabled: boolean, includeDetails: boolean): Record<string, unknown> {
+function browserCockpitReceipts(
+  context: CommandContext,
+  enabled: boolean,
+  includeDetails: boolean,
+  browserPwa: BrowserPwaReadModelSnapshot,
+): Record<string, unknown> {
   const marker = (() => {
     try {
       const shellPaths = context.workspace?.shellPaths;
@@ -162,18 +280,49 @@ function browserCockpitReceipts(context: CommandContext, enabled: boolean, inclu
       };
     }
   })();
+  const certifiedFirstRun = certifiedBrowserPwaFirstRunReceipts(browserPwa);
+  const setupReceipts = browserPwaSetupReceipts(context);
+  const readySetupReceipt = readyBrowserPwaSetupReceipt(setupReceipts);
+  const browserFirstRunStatus = certifiedFirstRun.length > 0
+    ? 'certified-live-receipt'
+    : readySetupReceipt
+      ? 'published'
+      : 'not-published';
   return {
-    status: marker.exists === true ? 'agent-complete-browser-receipt-missing' : 'needs-agent-closeout-and-browser-receipt',
+    status: browserFirstRunStatus !== 'not-published' && marker.exists === true
+      ? 'ready'
+      : browserFirstRunStatus !== 'not-published'
+        ? 'browser-ready-agent-onboarding-missing'
+        : marker.exists === true ? 'agent-complete-browser-receipt-missing' : 'needs-agent-closeout-and-browser-receipt',
     agentOnboardingStatus: marker.status,
-    browserFirstRunStatus: 'not-published',
+    browserFirstRunStatus,
     ...(includeDetails ? {
       agentOnboardingCompletion: marker,
-      browserFirstRunCompletion: {
-        status: 'not-published',
-        webEnabled: enabled,
-        evidence: null,
-        nextStep: 'Publish a connected-host browser/PWA completion receipt before using browser readiness as first-run closeout evidence.',
-      },
+      browserFirstRunCompletion: certifiedFirstRun.length > 0
+        ? {
+          status: 'certified-live-receipt',
+          webEnabled: enabled,
+          certifiedReadModelCount: certifiedFirstRun.length,
+          evidence: certifiedFirstRun[0],
+          setupReceiptEvidence: readySetupReceipt ?? null,
+          nextStep: 'Keep browser/PWA first-run receipts fresh with each connected-host browser runtime release.',
+        }
+        : readySetupReceipt
+          ? {
+            status: 'published',
+            webEnabled: enabled,
+            evidence: readySetupReceipt,
+            certifiedReadModelCount: 0,
+            nextStep: 'Publish certified browser/PWA runtime read-model receipts to make cockpit readiness independently verifiable.',
+          }
+          : {
+            status: 'not-published',
+            webEnabled: enabled,
+            evidence: null,
+            certifiedReadModelCount: 0,
+            nextStep: 'Publish a connected-host browser/PWA completion receipt before using browser readiness as first-run closeout evidence.',
+          },
+      browserPwaSetupReceipts: setupReceipts.slice(0, 8),
     } : {}),
     setupCloseoutRoute: 'setup action:"status" includeParameters:true',
     policy: 'Agent reports its own user onboarding marker separately from the connected-host browser/PWA receipt contract so setup closeout does not overclaim browser readiness.',
@@ -195,9 +344,14 @@ export function connectedBrowserCockpitRoute(context: CommandContext, options: {
     }
   }
   const url = publicBaseUrl || `http://${browserConnectHost(binding.host)}:${binding.port}`;
+  const browserPwa = browserPwaReadModelSnapshot(context);
+  const nativeCategoryRoutesPublished = enabled && AGENT_WORKSPACE_CATEGORIES.every((category) =>
+    Boolean(certifiedBrowserPwaCategoryRouteForCategory(browserPwa, category.id))
+  );
+  const browserFirstRunCertified = certifiedBrowserPwaFirstRunReceipts(browserPwa).length > 0;
   return {
     enabled,
-    readiness: enabled ? 'ready' : 'setup-needed',
+    readiness: enabled ? nativeCategoryRoutesPublished && browserFirstRunCertified ? 'browser-native-ready' : 'ready' : 'setup-needed',
     url,
     source: publicBaseUrl ? 'web.publicBaseUrl' : 'web endpoint binding',
     endpoint: {
@@ -205,9 +359,9 @@ export function connectedBrowserCockpitRoute(context: CommandContext, options: {
       binding,
       settings: ['web.enabled', 'web.hostMode', 'web.host', 'web.port', 'web.publicBaseUrl'],
     },
-    workspaceCoverage: browserCockpitWorkspaceCoverage(enabled, options.includeWorkspaceCoverage === true),
-    mobile: browserCockpitMobileAffordances(enabled, options.includeWorkspaceCoverage === true),
-    receipts: browserCockpitReceipts(context, enabled, options.includeWorkspaceCoverage === true),
+    workspaceCoverage: browserCockpitWorkspaceCoverage(enabled, options.includeWorkspaceCoverage === true, browserPwa),
+    mobile: browserCockpitMobileAffordances(enabled, options.includeWorkspaceCoverage === true, browserPwa, nativeCategoryRoutesPublished),
+    receipts: browserCockpitReceipts(context, enabled, options.includeWorkspaceCoverage === true, browserPwa),
     setupRoutes: {
       inspectEndpoint: 'host action:"service" endpointId:"web" includeParameters:true',
       servicePosture: 'host action:"services" includeParameters:true',

package/src/tools/agent-harness-browser-control.ts

@@ -1,5 +1,7 @@
 import type { ToolRegistry } from '@pellux/goodvibes-sdk/platform/tools';
 import type { CommandContext } from '../input/command-registry.ts';
+import { interactiveRuntimeCapabilitySummary, interactiveRuntimeParityStatus } from './agent-harness-interactive-runtime-records.ts';
+import type { AgentHarnessInteractiveRuntimeRecord } from './agent-harness-interactive-runtime-records.ts';
 
 type BrowserControlStatus = 'ready' | 'attention' | 'setup-needed';
 type BrowserControlDecisionStatus = 'ready-to-inspect-tool' | 'review-connector-first' | 'setup-needed';
@@ -47,6 +49,8 @@ export interface BrowserControlPosture {
   readonly needsReview: boolean;
   readonly toolMatches: readonly string[];
   readonly mcpServers: readonly BrowserControlMcpServer[];
+  readonly certifiedRuntimeRecords: readonly AgentHarnessInteractiveRuntimeRecord[];
+  readonly runtime: Record<string, unknown>;
   readonly workflows: readonly BrowserControlWorkflow[];
   readonly setupChecklist: readonly string[];
   readonly fallbackRoutes: readonly string[];
@@ -172,9 +176,11 @@ export function browserControlPosture(context: CommandContext, toolRegistry?: To
 
   const readyBrowserMcp = mcpServers.some((server) => server.readiness === 'ready');
   const needsReview = mcpServers.some((server) => server.readiness === 'attention');
-  const configured = toolMatches.length > 0 || readyBrowserMcp;
+  const runtime = interactiveRuntimeCapabilitySummary(context);
+  const runtimeParity = interactiveRuntimeParityStatus(context);
+  const configured = runtimeParity.browserDesktopControlContract || toolMatches.length > 0 || readyBrowserMcp;
   const recommendedRoute = configured
-    ? 'execution action:"route" id:"browser-or-desktop-control"'
+    ? runtimeParity.browserDesktopRoute ?? 'execution action:"route" id:"browser-or-desktop-control"'
     : needsReview
       ? 'agent_harness mode:"mcp_servers" query:"browser desktop"'
       : 'agent_harness mode:"mcp_servers" query:"browser desktop"';
@@ -185,6 +191,8 @@ export function browserControlPosture(context: CommandContext, toolRegistry?: To
     needsReview,
     toolMatches,
     mcpServers,
+    certifiedRuntimeRecords: runtimeParity.browserDesktopRecords.slice(0, 5),
+    runtime,
     workflows: browserControlWorkflows(configured, needsReview, recommendedRoute, setupRoute),
     setupChecklist: [
       'Inspect browser/desktop MCP servers and first-class tools before attempting live UI control.',
@@ -199,7 +207,7 @@ export function browserControlPosture(context: CommandContext, toolRegistry?: To
     executionRoute: 'execution action:"route" id:"browser-or-desktop-control"',
     setupRoute,
     recommendedRoute,
-    policy: 'Browser and desktop control stays explicit: no live UI control is assumed unless a trusted tool or fresh constrained MCP server is configured.',
+    policy: 'Browser and desktop control stays explicit: no live UI control is assumed unless a trusted tool, fresh constrained MCP server, or certified daemon browser/desktop command receipt is configured.',
   };
 }
 
@@ -270,7 +278,7 @@ function browserControlDecision(
     return {
       id: 'inspect-configured-browser-control',
       status: 'ready-to-inspect-tool',
-      modelRoute: firstToolRoute || firstReadyMcpRoute || posture.executionRoute,
+      modelRoute: firstToolRoute || firstReadyMcpRoute || posture.recommendedRoute || posture.executionRoute,
       userRoute: 'Agent Workspace -> Work & Approvals or Tools & MCP',
       nextStep: `Inspect the configured ${workflow.label.toLowerCase()} tool/server, then invoke the narrowest live-control tool only if the user request still needs it.`,
       reason: 'A browser/desktop control tool or fresh trusted MCP server is configured.',