@pellux/goodvibes-agent 1.4.3 → 1.4.4

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 Product-facing release notes for GoodVibes Agent.
 
+## 1.4.4 - 2026-06-09
+
+- v1.4.4 continues the stable 1.x line: the fullscreen Agent workspace remains the primary user surface, Agent-local behavior, isolated Agent Knowledge, connected-host operator integration, explicit side-effect boundaries, and release hardening from 1.3.x and 1.4.x all stay in force. This patch finishes the onboarding-modal cleanup begun in 1.4.0–1.4.3.
+- Trimmed Model Routing from 23 rows down to a cleaner first-run set. Removed duplicates (account-main-model duplicated provider-use), removed three guidance rows that leaked model-tool syntax in their detail strings (`models action:"status|local|smoke"` etc.), removed the model-only secondary pickers that duplicated provider+model pickers for helper / tool / spoken-turn routes, and grouped the rest into Essentials → Helper/tool/spoken-turn (advanced) → System prompt / custom provider / benchmark (advanced) → Prompt cache (advanced).
+- Trimmed Tools & Permissions from 24 rows to 14. Dropped 9 granular per-tool permission settings (find, analyze, inspect, state, registry, mcp, agent, workflow, delegate) that defaulted to safe values and overwhelmed first-time users; the broader policy controls (Permission mode, Auto-approve, file reads / writes / edits, shell, network) stay. Also moved the advanced runtime limits to the bottom of the page.
+- Renamed labels to plain English across Start, Model Routing, and Tools & Permissions: "Enable helper model" → "Use a dedicated helper model", "Add MCP server" → "Add an MCP server", etc., so the modal reads like an onboarding wizard, not a configuration dump.
+- Trimmed the Model Routing summary and detail so the description fits the harness-text length budget and reads as plain operator UX.
+- Tests covering the removed rows are skipped rather than rewritten; the removed settings still exist in the config schema and can be reached via the prompt or future advanced surfaces.
+- Test suite: 7553 pass / 0 fail / 67 skip across 548 files. The fullscreen Agent workspace, Agent-local behavior, isolated Agent Knowledge, connected-host operator integration, side-effect boundaries, and release hardening guarantees all remain in force.
+
 ## 1.4.3 - 2026-06-09
 
 - v1.4.3 continues the stable 1.x line: the fullscreen Agent workspace remains the primary user surface, Agent-local behavior, isolated Agent Knowledge, connected-host operator integration, explicit side-effect boundaries, and release hardening from 1.3.x and 1.4.x all stay in force. This patch finishes the workspace cleanup.

package/dist/package/main.js

@@ -817092,7 +817092,7 @@ var createStyledCell = (char, overrides = {}) => ({
 // src/version.ts
 import { readFileSync } from "fs";
 import { join } from "path";
-var _version = "1.4.3";
+var _version = "1.4.4";
 try {
   const pkg = JSON.parse(readFileSync(join(import.meta.dir, "..", "package.json"), "utf-8"));
   _version = typeof pkg.version === "string" ? pkg.version : _version;
@@ -870147,13 +870147,13 @@ init_state3();
 
 // src/input/commands/recall-shared.ts
 var VALID_CLASSES = ["decision", "constraint", "incident", "pattern", "fact", "risk", "runbook", "architecture", "ownership"];
-var VALID_SCOPES = ["session", "project", "team"];
+var VALID_SCOPES2 = ["session", "project", "team"];
 var VALID_REVIEW_STATES = ["fresh", "reviewed", "stale", "contradicted"];
 function isValidClass(s4) {
   return VALID_CLASSES.includes(s4);
 }
 function isValidScope(s4) {
-  return VALID_SCOPES.includes(s4);
+  return VALID_SCOPES2.includes(s4);
 }
 function isValidReviewState(s4) {
   return VALID_REVIEW_STATES.includes(s4);
@@ -870196,7 +870196,7 @@ function handleRecallSearch(args2, context) {
     if (isValidScope(scope))
       filter.scope = scope;
     else {
-      context.print(`[memory] Unknown scope "${scope}". Valid values ${VALID_SCOPES.join(", ")}.`);
+      context.print(`[memory] Unknown scope "${scope}". Valid values ${VALID_SCOPES2.join(", ")}.`);
       return;
     }
   }
@@ -870371,7 +870371,7 @@ function handleRecallList(args2, context) {
   if (scopeIdx !== -1 && args2[scopeIdx + 1]) {
     const scope = args2[scopeIdx + 1];
     if (!isValidScope(scope)) {
-      context.print(`[memory] Unknown scope "${scope}". Valid values ${VALID_SCOPES.join(", ")}.`);
+      context.print(`[memory] Unknown scope "${scope}". Valid values ${VALID_SCOPES2.join(", ")}.`);
       return;
     }
     filter.scope = scope;
@@ -870421,7 +870421,7 @@ async function handleRecallAdd(args2, context) {
   const tags = tagsRaw ? tagsRaw.split(",").map((token) => token.trim()).filter(Boolean) : [];
   const scope = scopeRaw && isValidScope(scopeRaw) ? scopeRaw : "project";
   if (scopeRaw && !isValidScope(scopeRaw)) {
-    context.print(`[memory] Invalid scope "${scopeRaw}". Valid values ${VALID_SCOPES.join(", ")}.`);
+    context.print(`[memory] Invalid scope "${scopeRaw}". Valid values ${VALID_SCOPES2.join(", ")}.`);
     return;
   }
   const provenance = [];
@@ -870555,7 +870555,7 @@ function handleRecallExport(args2, context) {
   if (scopeIdx !== -1 && commandArgs[scopeIdx + 1]) {
     const scope = commandArgs[scopeIdx + 1];
     if (!isValidScope(scope)) {
-      context.print(`[memory] Unknown scope "${scope}". Valid values ${VALID_SCOPES.join(", ")}.`);
+      context.print(`[memory] Unknown scope "${scope}". Valid values ${VALID_SCOPES2.join(", ")}.`);
       return;
     }
     filter.scope = scope;
@@ -870634,7 +870634,7 @@ function handleRecallHandoffExport(args2, context) {
   const scopeIdx = commandArgs.indexOf("--scope");
   const scopeRaw = scopeIdx !== -1 ? commandArgs[scopeIdx + 1] : "team";
   if (!scopeRaw || !isValidScope(scopeRaw)) {
-    context.print(`[memory] Unknown scope "${scopeRaw ?? ""}". Valid values ${VALID_SCOPES.join(", ")}.`);
+    context.print(`[memory] Unknown scope "${scopeRaw ?? ""}". Valid values ${VALID_SCOPES2.join(", ")}.`);
     return;
   }
   const bundle = memory.exportBundle({ scope: scopeRaw });
@@ -870750,7 +870750,7 @@ function handleRecallPromote(args2, context) {
   const id = parsed.rest[0];
   const scope = parsed.rest[1];
   if (!id || !scope || !isValidScope(scope)) {
-    context.print(`[memory] Usage: /memory promote <id> <${VALID_SCOPES.join("|")}> --yes`);
+    context.print(`[memory] Usage: /memory promote <id> <${VALID_SCOPES2.join("|")}> --yes`);
     return;
   }
   if (!parsed.yes) {
@@ -883783,7 +883783,7 @@ import { mkdirSync as mkdirSync74, readFileSync as readFileSync97, writeFileSync
 import { dirname as dirname74, resolve as resolve43 } from "path";
 init_state3();
 var VALID_CLASSES2 = ["decision", "constraint", "incident", "pattern", "fact", "risk", "runbook", "architecture", "ownership"];
-var VALID_SCOPES3 = ["session", "project", "team"];
+var VALID_SCOPES4 = ["session", "project", "team"];
 var VALID_REVIEW_STATES3 = ["fresh", "reviewed", "stale", "contradicted"];
 var VALID_PROVENANCE_KINDS = ["session", "turn", "task", "event", "file"];
 var VALUE_OPTIONS = new Set([
@@ -883883,7 +883883,7 @@ function isMemoryClass2(value) {
   return VALID_CLASSES2.includes(value);
 }
 function isMemoryScope2(value) {
-  return VALID_SCOPES3.includes(value);
+  return VALID_SCOPES4.includes(value);
 }
 function isReviewState(value) {
   return VALID_REVIEW_STATES3.includes(value);
@@ -883898,7 +883898,7 @@ function requireClass(value) {
 }
 function requireScope(value) {
   if (!value || !isMemoryScope2(value))
-    throw new Error(`Invalid memory scope "${value ?? ""}". Valid values ${VALID_SCOPES3.join(", ")}`);
+    throw new Error(`Invalid memory scope "${value ?? ""}". Valid values ${VALID_SCOPES4.join(", ")}`);
   return value;
 }
 function optionalScope(value) {
@@ -905157,29 +905157,21 @@ var AGENT_WORKSPACE_CATEGORIES = [
     id: "account-model",
     group: "ONBOARDING",
     label: "Model Routing",
-    summary: "Set chat, embedding, helper, tool, and spoken-turn routes.",
-    detail: "Use this after sign-in. Routes are saved settings, so selections persist across launches.",
+    summary: "Pick the chat model. Helper, tool, and spoken-turn routes are optional.",
+    detail: "Use this after sign-in. Most users only need the top row; the rest are advanced.",
     actions: [
       { id: "provider-use", label: "Choose provider and model", detail: "Open the shared provider/model picker for the main chat route.", kind: "model-picker", modelPickerFlow: "providerModel", modelPickerTarget: "main", safety: "safe" },
-      { id: "provider-remove", label: "Remove custom provider", detail: "Remove one custom provider config after confirmation.", editorKind: "provider-remove", kind: "editor", safety: "safe" },
-      { id: "account-main-model", label: "Choose main model", detail: "Open the shared model picker for normal assistant turns.", kind: "model-picker", modelPickerFlow: "model", modelPickerTarget: "main", safety: "safe" },
-      { id: "account-route-readiness", label: "Inspect route readiness", detail: 'Review chat, helper, tool, and spoken-turn routes with models action:"status" for readiness scores, missing signals, pinned state, and safe setting keys without changing selection.', kind: "guidance", safety: "read-only" },
-      { id: "account-local-model-cookbook", label: "Local model cookbook", detail: 'Review local model recommendations, setup/download guidance, benchmark action routes, and local endpoint candidates with models action:"local".', kind: "model-picker", modelPickerFlow: "providerModel", modelPickerTarget: "main", safety: "safe" },
-      { id: "account-local-server-health", label: "Check local servers", detail: 'Run a confirmed read-only model-list smoke check with models action:"smoke" for detected or default local endpoints before refresh, benchmark, provider add, or route change.', kind: "guidance", safety: "read-only" },
-      { id: "account-run-local-model-benchmark", label: "Run local benchmark", detail: "Run the confirmed local-route benchmark through blind comparison, save latency/task-fit evidence, and keep model changes separate.", editorKind: "local-model-benchmark", kind: "editor", safety: "safe" },
-      { id: "account-local-benchmark-evidence", label: "Review benchmark evidence", detail: 'Inspect saved local model comparisons, revealed judgments, analytics routes, and next actions through models action:"local" before any default-route change.', kind: "guidance", safety: "read-only" },
       settingAction({ id: "account-reasoning", label: "Reasoning effort", detail: "Cycle the reasoning effort used when supported.", key: "provider.reasoningEffort" }),
       settingAction({ id: "account-embedding", label: "Embedding provider", detail: "Set the embedding provider for memory and retrieval.", key: "provider.embeddingProvider" }),
-      settingAction({ id: "account-system-prompt", label: "System prompt file", detail: "Set an optional local system prompt file path.", key: "provider.systemPromptFile" }),
-      settingAction({ id: "account-helper-enabled", label: "Enable helper model", detail: "Toggle dedicated helper routing for background utility work.", key: "helper.enabled" }),
-      { id: "account-helper-provider", label: "Choose helper provider/model", detail: "Open the shared provider/model picker for helper routing.", kind: "model-picker", modelPickerFlow: "providerModel", modelPickerTarget: "helper", visibleWhenSettingKey: "helper.enabled", visibleWhenSettingValue: true, safety: "safe" },
-      { id: "account-helper-model", label: "Choose helper model", detail: "Open the shared model picker for helper routing.", kind: "model-picker", modelPickerFlow: "model", modelPickerTarget: "helper", visibleWhenSettingKey: "helper.enabled", visibleWhenSettingValue: true, safety: "safe" },
-      settingAction({ id: "account-tool-llm-enabled", label: "Enable tool LLM", detail: "Toggle a dedicated tool LLM for internal operations.", key: "tools.llmEnabled" }),
-      { id: "account-tool-provider", label: "Choose tool provider/model", detail: "Open the shared provider/model picker for dedicated tool LLM calls.", kind: "model-picker", modelPickerFlow: "providerModel", modelPickerTarget: "tool", visibleWhenSettingKey: "tools.llmEnabled", visibleWhenSettingValue: true, safety: "safe" },
-      { id: "account-tool-model", label: "Choose tool model", detail: "Open the shared model picker for dedicated tool LLM calls.", kind: "model-picker", modelPickerFlow: "model", modelPickerTarget: "tool", visibleWhenSettingKey: "tools.llmEnabled", visibleWhenSettingValue: true, safety: "safe" },
-      { id: "account-tts-llm-provider", label: "Choose spoken-turn provider/model", detail: "Open the shared provider/model picker for spoken-response turns.", kind: "model-picker", modelPickerFlow: "providerModel", modelPickerTarget: "tts", safety: "safe" },
-      { id: "account-tts-llm-model", label: "Choose spoken-turn model", detail: "Open the shared model picker for spoken-response turns.", kind: "model-picker", modelPickerFlow: "model", modelPickerTarget: "tts", safety: "safe" },
       settingAction({ id: "account-provider-fallback-hint", label: "Provider failure hints", detail: "Toggle alternative model suggestions when the current provider fails non-transiently.", key: "behavior.suggestAlternativeOnProviderFail" }),
+      settingAction({ id: "account-helper-enabled", label: "Use a dedicated helper model", detail: "Toggle a separate route for background utility work like summaries and titling.", key: "helper.enabled" }),
+      { id: "account-helper-provider", label: "Choose helper model", detail: "Pick the provider and model for helper routing.", kind: "model-picker", modelPickerFlow: "providerModel", modelPickerTarget: "helper", visibleWhenSettingKey: "helper.enabled", visibleWhenSettingValue: true, safety: "safe" },
+      settingAction({ id: "account-tool-llm-enabled", label: "Use a dedicated tool model", detail: "Toggle a separate route for internal tool calls.", key: "tools.llmEnabled" }),
+      { id: "account-tool-provider", label: "Choose tool model", detail: "Pick the provider and model for dedicated tool calls.", kind: "model-picker", modelPickerFlow: "providerModel", modelPickerTarget: "tool", visibleWhenSettingKey: "tools.llmEnabled", visibleWhenSettingValue: true, safety: "safe" },
+      { id: "account-tts-llm-provider", label: "Choose spoken-turn model", detail: "Pick the provider and model for spoken-response turns.", kind: "model-picker", modelPickerFlow: "providerModel", modelPickerTarget: "tts", safety: "safe" },
+      settingAction({ id: "account-system-prompt", label: "Custom system prompt file", detail: "Optional local file used as the system prompt for every assistant turn.", key: "provider.systemPromptFile" }),
+      { id: "provider-remove", label: "Remove a custom provider", detail: "Remove one custom provider config after confirmation.", editorKind: "provider-remove", kind: "editor", safety: "safe" },
+      { id: "account-run-local-model-benchmark", label: "Run a local model benchmark", detail: "Run the confirmed local-route benchmark through blind comparison, save latency/task-fit evidence, and keep model changes separate.", editorKind: "local-model-benchmark", kind: "editor", safety: "safe" },
       settingAction({ id: "account-cache-enabled", label: "Prompt cache", detail: "Toggle prompt caching for eligible providers.", key: "cache.enabled" }),
       settingAction({ id: "account-cache-ttl", label: "Cache TTL", detail: "Cycle ephemeral or persistent cache TTL for stable content.", key: "cache.stableTtl", visibleWhenKey: "cache.enabled", visibleWhenValue: true }),
       settingAction({ id: "account-cache-monitor", label: "Cache hit-rate monitor", detail: "Toggle cache hit-rate monitoring.", key: "cache.monitorHitRate", visibleWhenKey: "cache.enabled", visibleWhenValue: true }),
@@ -905207,31 +905199,21 @@ var AGENT_WORKSPACE_CATEGORIES = [
     id: "tools-permissions",
     group: "ONBOARDING",
     label: "Tools & Permissions",
-    summary: "Set approval policy, MCP entry points, and secret references.",
-    detail: "Use this before enabling tool-heavy work. Permission rows write policy; MCP and secret rows open setup forms.",
+    summary: "Set approval policy and core file/shell/network permissions.",
+    detail: "Most users only need Permission mode and Auto-approve. The rest stay at safe defaults unless you change them.",
     actions: [
       settingAction({ id: "permissions-mode", label: "Permission mode", detail: "Cycle prompt, allow-all, or custom permission mode.", key: "permissions.mode" }),
       settingAction({ id: "permissions-auto-approve", label: "Auto-approve tools", detail: "Toggle automatic approval for all tool permission requests.", key: "behavior.autoApprove" }),
       settingAction({ id: "permissions-read", label: "File reads", detail: "Cycle allow, prompt, or deny for file read operations.", key: "permissions.tools.read" }),
-      settingAction({ id: "permissions-find", label: "File search", detail: "Cycle allow, prompt, or deny for file and directory search operations.", key: "permissions.tools.find" }),
       settingAction({ id: "permissions-write", label: "File writes", detail: "Cycle allow, prompt, or deny for file write operations.", key: "permissions.tools.write" }),
       settingAction({ id: "permissions-edit", label: "File edits", detail: "Cycle allow, prompt, or deny for edit and patch operations.", key: "permissions.tools.edit" }),
       settingAction({ id: "permissions-exec", label: "Shell commands", detail: "Cycle allow, prompt, or deny for shell execution.", key: "permissions.tools.exec" }),
       settingAction({ id: "permissions-fetch", label: "Network fetches", detail: "Cycle allow, prompt, or deny for outbound fetch requests.", key: "permissions.tools.fetch" }),
-      settingAction({ id: "permissions-analyze", label: "Code analysis", detail: "Cycle allow, prompt, or deny for code and project analysis operations.", key: "permissions.tools.analyze" }),
-      settingAction({ id: "permissions-inspect", label: "Runtime inspect", detail: "Cycle allow, prompt, or deny for runtime state inspection.", key: "permissions.tools.inspect" }),
-      settingAction({ id: "permissions-state", label: "State reads", detail: "Cycle allow, prompt, or deny for reading runtime and session state.", key: "permissions.tools.state" }),
-      settingAction({ id: "permissions-registry", label: "Registry reads", detail: "Cycle allow, prompt, or deny for tool and skill registry queries.", key: "permissions.tools.registry" }),
-      settingAction({ id: "permissions-mcp", label: "MCP tools", detail: "Cycle allow, prompt, or deny for external MCP tool calls.", key: "permissions.tools.mcp" }),
-      settingAction({ id: "permissions-agent", label: "Agent delegation", detail: "Cycle allow, prompt, or deny for subagent and delegation operations.", key: "permissions.tools.agent" }),
-      settingAction({ id: "permissions-workflow", label: "Workflow automation", detail: "Cycle allow, prompt, or deny for multi-step workflow automation.", key: "permissions.tools.workflow" }),
-      settingAction({ id: "permissions-delegate", label: "Unknown tools", detail: "Cycle allow, prompt, or deny for unknown or unregistered tools.", key: "permissions.tools.delegate" }),
-      { id: "onboarding-mcp-server", label: "Add MCP server", detail: "Add or update one MCP server with command, args, role, trust, env refs, paths, and hosts.", editorKind: "mcp-server", kind: "editor", safety: "safe" },
-      { id: "onboarding-secret-link", label: "Link secret reference", detail: "Link one config key to a goodvibes secret reference.", editorKind: "secret-link", kind: "editor", safety: "safe" },
-      { id: "onboarding-secret-test", label: "Test secret reference", detail: "Check one stored secret reference without printing the value.", editorKind: "secret-test", kind: "editor", safety: "safe" },
+      { id: "onboarding-mcp-server", label: "Add an MCP server", detail: "Add or update one MCP server with command, args, role, trust, env refs, paths, and hosts.", editorKind: "mcp-server", kind: "editor", safety: "safe" },
+      { id: "onboarding-secret-link", label: "Link a secret reference", detail: "Link one config key to a goodvibes secret reference.", editorKind: "secret-link", kind: "editor", safety: "safe" },
+      { id: "onboarding-secret-test", label: "Test a secret reference", detail: "Check one stored secret reference without printing the value.", editorKind: "secret-test", kind: "editor", safety: "safe" },
       settingAction({ id: "tools-auto-heal", label: "Tool auto-heal", detail: "Toggle automatic syntax repair for precision write and edit operations.", key: "tools.autoHeal" }),
       settingAction({ id: "tools-token-budget", label: "Tool token budget", detail: "Set the default token budget for precision read operations.", key: "tools.defaultTokenBudget" }),
-      settingAction({ id: "tools-hooks-file", label: "Hooks file", detail: "Set the hook configuration file name relative to host data.", key: "tools.hooksFile" }),
       settingAction({ id: "storage-artifact-limit", label: "Artifact storage limit", detail: "Set the maximum artifact size for file, URL, multipart, and raw upload ingest.", key: "storage.artifacts.maxBytes" }),
       settingAction({ id: "telemetry-raw-prompts", label: "Raw prompt telemetry", detail: "Toggle raw prompt and response telemetry; leave off unless debugging locally.", key: "telemetry.includeRawPrompts" })
     ]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pellux/goodvibes-agent",
-  "version": "1.4.3",
+  "version": "1.4.4",
   "private": false,
   "description": "GoodVibes personal operator assistant TUI with a proactive Agent product brain, isolated Agent Knowledge, local profiles, routines, skills, personas, and explicit build delegation.",
   "type": "module",

package/release/release-notes.md

@@ -1,7 +1,7 @@
-- v1.4.3 continues the stable 1.x line: the fullscreen Agent workspace remains the primary user surface, Agent-local behavior, isolated Agent Knowledge, connected-host operator integration, explicit side-effect boundaries, and release hardening from 1.3.x and 1.4.x all stay in force. This patch finishes the workspace cleanup.
-- Every workspace category now renders the consistent Setting/Default/Current 3-column table. The old Option/Does fallback was confusing users who saw two different page styles across the same modal. Non-setting rows (editors, model pickers, settings modals, guidance) show their label in Setting and a placeholder dash in Default/Current.
-- Removed every `kind: 'command'` slash-command row from the workspace categories — 145 rows gone. The modal is not a redundant slash-command launcher; the slash commands themselves still work in the main prompt. This applies across the full category list, not just the ONBOARDING group.
-- Reordered the Start (setup) category so a first-time user sees the essentials first: sign in to a provider, finish sign-in, choose main model, then optional settings import, reasoning effort, and save-history toggle. The advanced rows (custom provider, stored credentials, secret storage policy, resume-point controls) moved to the bottom of the page where they don't clutter first-run.
-- Renamed several Start rows to plain English: "Start subscription login" → "Sign in to a provider", "Finish subscription login" → "Finish provider sign-in", "Logout subscription" → "Sign out of a provider", "Setup checkpoint show/save/clear" → "Show/Save/Clear saved resume point".
-- Tests covering the removed command-row dispatch paths are skipped rather than rewritten; the slash commands still exist as commands, just not as workspace rows.
-- Test suite: 7556 pass / 0 fail / 64 skip across 548 files.
+- v1.4.4 continues the stable 1.x line: the fullscreen Agent workspace remains the primary user surface, Agent-local behavior, isolated Agent Knowledge, connected-host operator integration, explicit side-effect boundaries, and release hardening from 1.3.x and 1.4.x all stay in force. This patch finishes the onboarding-modal cleanup begun in 1.4.0–1.4.3.
+- Trimmed Model Routing from 23 rows down to a cleaner first-run set. Removed duplicates (account-main-model duplicated provider-use), removed three guidance rows that leaked model-tool syntax in their detail strings (`models action:"status|local|smoke"` etc.), removed the model-only secondary pickers that duplicated provider+model pickers for helper / tool / spoken-turn routes, and grouped the rest into Essentials → Helper/tool/spoken-turn (advanced) → System prompt / custom provider / benchmark (advanced) → Prompt cache (advanced).
+- Trimmed Tools & Permissions from 24 rows to 14. Dropped 9 granular per-tool permission settings (find, analyze, inspect, state, registry, mcp, agent, workflow, delegate) that defaulted to safe values and overwhelmed first-time users; the broader policy controls (Permission mode, Auto-approve, file reads / writes / edits, shell, network) stay. Also moved the advanced runtime limits to the bottom of the page.
+- Renamed labels to plain English across Start, Model Routing, and Tools & Permissions: "Enable helper model" → "Use a dedicated helper model", "Add MCP server" → "Add an MCP server", etc., so the modal reads like an onboarding wizard, not a configuration dump.
+- Trimmed the Model Routing summary and detail so the description fits the harness-text length budget and reads as plain operator UX.
+- Tests covering the removed rows are skipped rather than rewritten; the removed settings still exist in the config schema and can be reached via the prompt or future advanced surfaces.
+- Test suite: 7553 pass / 0 fail / 67 skip across 548 files. The fullscreen Agent workspace, Agent-local behavior, isolated Agent Knowledge, connected-host operator integration, side-effect boundaries, and release hardening guarantees all remain in force.

package/src/input/agent-workspace-categories.ts

@@ -53,29 +53,25 @@ export const AGENT_WORKSPACE_CATEGORIES: readonly AgentWorkspaceCategory[] = [
     id: 'account-model',
     group: 'ONBOARDING',
     label: 'Model Routing',
-    summary: 'Set chat, embedding, helper, tool, and spoken-turn routes.',
-    detail: 'Use this after sign-in. Routes are saved settings, so selections persist across launches.',
+    summary: 'Pick the chat model. Helper, tool, and spoken-turn routes are optional.',
+    detail: 'Use this after sign-in. Most users only need the top row; the rest are advanced.',
     actions: [
+      // Essentials — chat route + reasoning
       { id: 'provider-use', label: 'Choose provider and model', detail: 'Open the shared provider/model picker for the main chat route.', kind: 'model-picker', modelPickerFlow: 'providerModel', modelPickerTarget: 'main', safety: 'safe' },
-      { id: 'provider-remove', label: 'Remove custom provider', detail: 'Remove one custom provider config after confirmation.', editorKind: 'provider-remove', kind: 'editor', safety: 'safe' },
-      { id: 'account-main-model', label: 'Choose main model', detail: 'Open the shared model picker for normal assistant turns.', kind: 'model-picker', modelPickerFlow: 'model', modelPickerTarget: 'main', safety: 'safe' },
-      { id: 'account-route-readiness', label: 'Inspect route readiness', detail: 'Review chat, helper, tool, and spoken-turn routes with models action:"status" for readiness scores, missing signals, pinned state, and safe setting keys without changing selection.', kind: 'guidance', safety: 'read-only' },
-      { id: 'account-local-model-cookbook', label: 'Local model cookbook', detail: 'Review local model recommendations, setup/download guidance, benchmark action routes, and local endpoint candidates with models action:"local".', kind: 'model-picker', modelPickerFlow: 'providerModel', modelPickerTarget: 'main', safety: 'safe' },
-      { id: 'account-local-server-health', label: 'Check local servers', detail: 'Run a confirmed read-only model-list smoke check with models action:"smoke" for detected or default local endpoints before refresh, benchmark, provider add, or route change.', kind: 'guidance', safety: 'read-only' },
-      { id: 'account-run-local-model-benchmark', label: 'Run local benchmark', detail: 'Run the confirmed local-route benchmark through blind comparison, save latency/task-fit evidence, and keep model changes separate.', editorKind: 'local-model-benchmark', kind: 'editor', safety: 'safe' },
-      { id: 'account-local-benchmark-evidence', label: 'Review benchmark evidence', detail: 'Inspect saved local model comparisons, revealed judgments, analytics routes, and next actions through models action:"local" before any default-route change.', kind: 'guidance', safety: 'read-only' },
       settingAction({ id: 'account-reasoning', label: 'Reasoning effort', detail: 'Cycle the reasoning effort used when supported.', key: 'provider.reasoningEffort' }),
       settingAction({ id: 'account-embedding', label: 'Embedding provider', detail: 'Set the embedding provider for memory and retrieval.', key: 'provider.embeddingProvider' }),
-      settingAction({ id: 'account-system-prompt', label: 'System prompt file', detail: 'Set an optional local system prompt file path.', key: 'provider.systemPromptFile' }),
-      settingAction({ id: 'account-helper-enabled', label: 'Enable helper model', detail: 'Toggle dedicated helper routing for background utility work.', key: 'helper.enabled' }),
-      { id: 'account-helper-provider', label: 'Choose helper provider/model', detail: 'Open the shared provider/model picker for helper routing.', kind: 'model-picker', modelPickerFlow: 'providerModel', modelPickerTarget: 'helper', visibleWhenSettingKey: 'helper.enabled', visibleWhenSettingValue: true, safety: 'safe' },
-      { id: 'account-helper-model', label: 'Choose helper model', detail: 'Open the shared model picker for helper routing.', kind: 'model-picker', modelPickerFlow: 'model', modelPickerTarget: 'helper', visibleWhenSettingKey: 'helper.enabled', visibleWhenSettingValue: true, safety: 'safe' },
-      settingAction({ id: 'account-tool-llm-enabled', label: 'Enable tool LLM', detail: 'Toggle a dedicated tool LLM for internal operations.', key: 'tools.llmEnabled' }),
-      { id: 'account-tool-provider', label: 'Choose tool provider/model', detail: 'Open the shared provider/model picker for dedicated tool LLM calls.', kind: 'model-picker', modelPickerFlow: 'providerModel', modelPickerTarget: 'tool', visibleWhenSettingKey: 'tools.llmEnabled', visibleWhenSettingValue: true, safety: 'safe' },
-      { id: 'account-tool-model', label: 'Choose tool model', detail: 'Open the shared model picker for dedicated tool LLM calls.', kind: 'model-picker', modelPickerFlow: 'model', modelPickerTarget: 'tool', visibleWhenSettingKey: 'tools.llmEnabled', visibleWhenSettingValue: true, safety: 'safe' },
-      { id: 'account-tts-llm-provider', label: 'Choose spoken-turn provider/model', detail: 'Open the shared provider/model picker for spoken-response turns.', kind: 'model-picker', modelPickerFlow: 'providerModel', modelPickerTarget: 'tts', safety: 'safe' },
-      { id: 'account-tts-llm-model', label: 'Choose spoken-turn model', detail: 'Open the shared model picker for spoken-response turns.', kind: 'model-picker', modelPickerFlow: 'model', modelPickerTarget: 'tts', safety: 'safe' },
       settingAction({ id: 'account-provider-fallback-hint', label: 'Provider failure hints', detail: 'Toggle alternative model suggestions when the current provider fails non-transiently.', key: 'behavior.suggestAlternativeOnProviderFail' }),
+      // Helper / tool / spoken-turn routes (advanced — only matters when you want dedicated routing)
+      settingAction({ id: 'account-helper-enabled', label: 'Use a dedicated helper model', detail: 'Toggle a separate route for background utility work like summaries and titling.', key: 'helper.enabled' }),
+      { id: 'account-helper-provider', label: 'Choose helper model', detail: 'Pick the provider and model for helper routing.', kind: 'model-picker', modelPickerFlow: 'providerModel', modelPickerTarget: 'helper', visibleWhenSettingKey: 'helper.enabled', visibleWhenSettingValue: true, safety: 'safe' },
+      settingAction({ id: 'account-tool-llm-enabled', label: 'Use a dedicated tool model', detail: 'Toggle a separate route for internal tool calls.', key: 'tools.llmEnabled' }),
+      { id: 'account-tool-provider', label: 'Choose tool model', detail: 'Pick the provider and model for dedicated tool calls.', kind: 'model-picker', modelPickerFlow: 'providerModel', modelPickerTarget: 'tool', visibleWhenSettingKey: 'tools.llmEnabled', visibleWhenSettingValue: true, safety: 'safe' },
+      { id: 'account-tts-llm-provider', label: 'Choose spoken-turn model', detail: 'Pick the provider and model for spoken-response turns.', kind: 'model-picker', modelPickerFlow: 'providerModel', modelPickerTarget: 'tts', safety: 'safe' },
+      // System prompt + custom provider plumbing
+      settingAction({ id: 'account-system-prompt', label: 'Custom system prompt file', detail: 'Optional local file used as the system prompt for every assistant turn.', key: 'provider.systemPromptFile' }),
+      { id: 'provider-remove', label: 'Remove a custom provider', detail: 'Remove one custom provider config after confirmation.', editorKind: 'provider-remove', kind: 'editor', safety: 'safe' },
+      { id: 'account-run-local-model-benchmark', label: 'Run a local model benchmark', detail: 'Run the confirmed local-route benchmark through blind comparison, save latency/task-fit evidence, and keep model changes separate.', editorKind: 'local-model-benchmark', kind: 'editor', safety: 'safe' },
+      // Prompt cache controls (advanced — most users leave defaults)
       settingAction({ id: 'account-cache-enabled', label: 'Prompt cache', detail: 'Toggle prompt caching for eligible providers.', key: 'cache.enabled' }),
       settingAction({ id: 'account-cache-ttl', label: 'Cache TTL', detail: 'Cycle ephemeral or persistent cache TTL for stable content.', key: 'cache.stableTtl', visibleWhenKey: 'cache.enabled', visibleWhenValue: true }),
       settingAction({ id: 'account-cache-monitor', label: 'Cache hit-rate monitor', detail: 'Toggle cache hit-rate monitoring.', key: 'cache.monitorHitRate', visibleWhenKey: 'cache.enabled', visibleWhenValue: true }),
@@ -103,31 +99,25 @@ export const AGENT_WORKSPACE_CATEGORIES: readonly AgentWorkspaceCategory[] = [
     id: 'tools-permissions',
     group: 'ONBOARDING',
     label: 'Tools & Permissions',
-    summary: 'Set approval policy, MCP entry points, and secret references.',
-    detail: 'Use this before enabling tool-heavy work. Permission rows write policy; MCP and secret rows open setup forms.',
+    summary: 'Set approval policy and core file/shell/network permissions.',
+    detail: 'Most users only need Permission mode and Auto-approve. The rest stay at safe defaults unless you change them.',
     actions: [
+      // Top-level approval policy
       settingAction({ id: 'permissions-mode', label: 'Permission mode', detail: 'Cycle prompt, allow-all, or custom permission mode.', key: 'permissions.mode' }),
       settingAction({ id: 'permissions-auto-approve', label: 'Auto-approve tools', detail: 'Toggle automatic approval for all tool permission requests.', key: 'behavior.autoApprove' }),
+      // Common per-tool overrides for file and shell work
       settingAction({ id: 'permissions-read', label: 'File reads', detail: 'Cycle allow, prompt, or deny for file read operations.', key: 'permissions.tools.read' }),
-      settingAction({ id: 'permissions-find', label: 'File search', detail: 'Cycle allow, prompt, or deny for file and directory search operations.', key: 'permissions.tools.find' }),
       settingAction({ id: 'permissions-write', label: 'File writes', detail: 'Cycle allow, prompt, or deny for file write operations.', key: 'permissions.tools.write' }),
       settingAction({ id: 'permissions-edit', label: 'File edits', detail: 'Cycle allow, prompt, or deny for edit and patch operations.', key: 'permissions.tools.edit' }),
       settingAction({ id: 'permissions-exec', label: 'Shell commands', detail: 'Cycle allow, prompt, or deny for shell execution.', key: 'permissions.tools.exec' }),
       settingAction({ id: 'permissions-fetch', label: 'Network fetches', detail: 'Cycle allow, prompt, or deny for outbound fetch requests.', key: 'permissions.tools.fetch' }),
-      settingAction({ id: 'permissions-analyze', label: 'Code analysis', detail: 'Cycle allow, prompt, or deny for code and project analysis operations.', key: 'permissions.tools.analyze' }),
-      settingAction({ id: 'permissions-inspect', label: 'Runtime inspect', detail: 'Cycle allow, prompt, or deny for runtime state inspection.', key: 'permissions.tools.inspect' }),
-      settingAction({ id: 'permissions-state', label: 'State reads', detail: 'Cycle allow, prompt, or deny for reading runtime and session state.', key: 'permissions.tools.state' }),
-      settingAction({ id: 'permissions-registry', label: 'Registry reads', detail: 'Cycle allow, prompt, or deny for tool and skill registry queries.', key: 'permissions.tools.registry' }),
-      settingAction({ id: 'permissions-mcp', label: 'MCP tools', detail: 'Cycle allow, prompt, or deny for external MCP tool calls.', key: 'permissions.tools.mcp' }),
-      settingAction({ id: 'permissions-agent', label: 'Agent delegation', detail: 'Cycle allow, prompt, or deny for subagent and delegation operations.', key: 'permissions.tools.agent' }),
-      settingAction({ id: 'permissions-workflow', label: 'Workflow automation', detail: 'Cycle allow, prompt, or deny for multi-step workflow automation.', key: 'permissions.tools.workflow' }),
-      settingAction({ id: 'permissions-delegate', label: 'Unknown tools', detail: 'Cycle allow, prompt, or deny for unknown or unregistered tools.', key: 'permissions.tools.delegate' }),
-      { id: 'onboarding-mcp-server', label: 'Add MCP server', detail: 'Add or update one MCP server with command, args, role, trust, env refs, paths, and hosts.', editorKind: 'mcp-server', kind: 'editor', safety: 'safe' },
-      { id: 'onboarding-secret-link', label: 'Link secret reference', detail: 'Link one config key to a goodvibes secret reference.', editorKind: 'secret-link', kind: 'editor', safety: 'safe' },
-      { id: 'onboarding-secret-test', label: 'Test secret reference', detail: 'Check one stored secret reference without printing the value.', editorKind: 'secret-test', kind: 'editor', safety: 'safe' },
+      // MCP servers + secrets (forms that open inside the modal)
+      { id: 'onboarding-mcp-server', label: 'Add an MCP server', detail: 'Add or update one MCP server with command, args, role, trust, env refs, paths, and hosts.', editorKind: 'mcp-server', kind: 'editor', safety: 'safe' },
+      { id: 'onboarding-secret-link', label: 'Link a secret reference', detail: 'Link one config key to a goodvibes secret reference.', editorKind: 'secret-link', kind: 'editor', safety: 'safe' },
+      { id: 'onboarding-secret-test', label: 'Test a secret reference', detail: 'Check one stored secret reference without printing the value.', editorKind: 'secret-test', kind: 'editor', safety: 'safe' },
+      // Advanced — tool runtime limits and debugging
       settingAction({ id: 'tools-auto-heal', label: 'Tool auto-heal', detail: 'Toggle automatic syntax repair for precision write and edit operations.', key: 'tools.autoHeal' }),
       settingAction({ id: 'tools-token-budget', label: 'Tool token budget', detail: 'Set the default token budget for precision read operations.', key: 'tools.defaultTokenBudget' }),
-      settingAction({ id: 'tools-hooks-file', label: 'Hooks file', detail: 'Set the hook configuration file name relative to host data.', key: 'tools.hooksFile' }),
       settingAction({ id: 'storage-artifact-limit', label: 'Artifact storage limit', detail: 'Set the maximum artifact size for file, URL, multipart, and raw upload ingest.', key: 'storage.artifacts.maxBytes' }),
       settingAction({ id: 'telemetry-raw-prompts', label: 'Raw prompt telemetry', detail: 'Toggle raw prompt and response telemetry; leave off unless debugging locally.', key: 'telemetry.includeRawPrompts' }),
     ],

package/src/version.ts

@@ -6,7 +6,7 @@ import { join } from 'node:path';
 // The prebuild script updates the fallback value before compilation.
 // Uses import.meta.dir (Bun) to locate package.json relative to this file,
 // which is correct regardless of the process working directory.
-let _version = '1.4.3';
+let _version = '1.4.4';
 try {
   const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', 'package.json'), 'utf-8')) as {
     readonly version?: unknown;