@pellux/goodvibes-agent 1.5.5 → 1.5.6

package/docs/tools-and-commands.md

@@ -197,7 +197,7 @@ None of those modes expose host start, stop, restart, install, expose-listener,
 
 ## Visible Autonomy
 
-Use `autonomy action:"intake"` first when the user asks for ongoing work and the safest route is not obvious. It is read-only and returns the likely route, missing fields, confirmation boundary, and trigger workflow posture for time-based wakeups/schedules, incoming webhooks/watchers, Gmail/email connector triggers, and control-plane event streams. Webhook, watcher, Gmail, or event-trigger requests now point to the published `watchers.create` contract when applicable, but watcher creation is an admin connected-host mutation: require trusted source/scope, task or run target, success criteria, `confirm:true`, and `explicitUserRequest`. The intake action also returns watcher receipt success criteria plus a read-only watcher evidence contract for SDK/daemon-owned durable run-history receipts, provider source records, redacted event payload descriptors, and autonomy queue correlation. Confirmed `agent_operator_method` calls summarize `watchers.create/patch/run/start/stop/delete` receipts into certified or follow-up outcomes without exposing operator tokens. Use `schedule action:"create"` for one visible autonomous schedule, `schedule action:"remind"` for reminders, `schedule action:"edit"` for one exact schedule edit, and `schedule action:"run|pause|resume|delete"` for lifecycle controls; it forwards to the same preview, read-only current-state diff, confirmation, and connected-host routes as `agent_autonomy_schedule`, `agent_reminder_schedule`, `agent_schedule_edit`, and allowlisted `agent_operator_action`, then returns post-action next routes for schedule list, autonomy queue inspection, run, edit, pause, resume, and delete where the schedule still exists. Unconfirmed schedule and routine-promotion previews return `confirmationRoutes` so the user or model can confirm the same intent without guessing the next command. Confirmed routine schedule promotion through the workspace or `/schedule promote-routine` returns the same post-action schedule next routes. Use `autonomy action:"queue"` before creating recurring autonomous work, reminders, routine schedules, delegated work, run controls, schedule edits, approval decisions, watcher triggers, or follow-up delivery. The queue is read-only and normalizes work-plan, research-run, connected task, approval, automation, schedule, reminder, routine-promotion, delegated-agent, and delivery cards. Research runs, connected-host tasks, approvals, automation runs, SDK/daemon watcher run/source records, and schedules include live records with status/progress, source ids, next steps, log tails when available, task retry/output/correlation diagnostics, bounded redacted host task and watcher output route/preview descriptors, automation telemetry/delivery/route diagnostics, watcher run-history/source diagnostics, available controls, unavailable controls with reasons, and exact inspect/checkpoint/pause/resume/cancel/approve/deny/retry/run/edit/enable/disable/delete routes where supported. Provider-source watcher records are read-only context with inspect/refresh controls; watcher run effects appear only when the owning SDK or daemon publishes exact confirmed routes. Schedule records expose pause/resume aliases over daemon enable/disable lifecycle routes so users do not have to translate scheduler terminology. Connected-host task cancel/retry uses `agent_operator_method` exact daemon methods with `confirm:true` plus `explicitUserRequest`; slash `/tasks` remains inspection-only. Inspect one card with `autonomy action:"item"`; lower-level `agent_harness mode:"autonomy_intake|autonomy_queue|autonomy_queue_item"` remains available for detailed route inspection. Create, edit, run, pause, resume, cancel, approve, deny, send, schedule, and schedule lifecycle effects stay on the owning confirmed route returned by that card.
+Use `autonomy action:"intake"` first when the user asks for ongoing work and the safest route is not obvious. It is read-only and returns the likely route, missing fields, confirmation boundary, and trigger workflow posture for time-based wakeups/schedules, incoming webhooks/watchers, Gmail/email connector triggers, and control-plane event streams. Webhook, watcher, Gmail, or event-trigger requests now point to the published `watchers.create` contract when applicable, but watcher creation is an admin connected-host mutation: require trusted source/scope, task or run target, success criteria, `confirm:true`, and `explicitUserRequest`. The intake action also returns watcher receipt success criteria plus a read-only watcher evidence contract for SDK/daemon-owned durable run-history receipts, provider source records, redacted event payload descriptors, and autonomy queue correlation. Confirmed `agent_operator_method` calls summarize `watchers.create/update/run/start/stop/delete` receipts into certified or follow-up outcomes without exposing operator tokens. Use `schedule action:"create"` for one visible autonomous schedule, `schedule action:"remind"` for reminders, `schedule action:"edit"` for one exact schedule edit, and `schedule action:"run|pause|resume|delete"` for lifecycle controls; it forwards to the same preview, read-only current-state diff, confirmation, and connected-host routes as `agent_autonomy_schedule`, `agent_reminder_schedule`, `agent_schedule_edit`, and allowlisted `agent_operator_action`, then returns post-action next routes for schedule list, autonomy queue inspection, run, edit, pause, resume, and delete where the schedule still exists. Unconfirmed schedule and routine-promotion previews return `confirmationRoutes` so the user or model can confirm the same intent without guessing the next command. Confirmed routine schedule promotion through the workspace or `/schedule promote-routine` returns the same post-action schedule next routes. Use `autonomy action:"queue"` before creating recurring autonomous work, reminders, routine schedules, delegated work, run controls, schedule edits, approval decisions, watcher triggers, or follow-up delivery. The queue is read-only and normalizes work-plan, research-run, connected task, approval, automation, schedule, reminder, routine-promotion, delegated-agent, and delivery cards. Research runs, connected-host tasks, approvals, automation runs, SDK/daemon watcher run/source records, and schedules include live records with status/progress, source ids, next steps, log tails when available, task retry/output/correlation diagnostics, bounded redacted host task and watcher output route/preview descriptors, automation telemetry/delivery/route diagnostics, watcher run-history/source diagnostics, available controls, unavailable controls with reasons, and exact inspect/checkpoint/pause/resume/cancel/approve/deny/retry/run/edit/enable/disable/delete routes where supported. Provider-source watcher records are read-only context with inspect/refresh controls; watcher run effects appear only when the owning SDK or daemon publishes exact confirmed routes. Schedule records expose pause/resume aliases over daemon enable/disable lifecycle routes so users do not have to translate scheduler terminology. Connected-host task cancel/retry uses `agent_operator_method` exact daemon methods with `confirm:true` plus `explicitUserRequest`; slash `/tasks` remains inspection-only. Inspect one card with `autonomy action:"item"`; lower-level `agent_harness mode:"autonomy_intake|autonomy_queue|autonomy_queue_item"` remains available for detailed route inspection. Create, edit, run, pause, resume, cancel, approve, deny, send, schedule, and schedule lifecycle effects stay on the owning confirmed route returned by that card.
 
 ## Agent Knowledge
 
@@ -290,6 +290,7 @@ Routine promotion is an explicit scheduling route. Local routines stay local unt
 | `/memory` | Add, search, review, stale, or delete Agent-local memory records. |
 | `/mode` | Manage Agent interaction mode and per-domain verbosity. |
 | `/model` | Select or display the current LLM model. |
+| `/network-scan` | Turn local-network scanning for model servers on or off, or check its status. Off until explicitly turned on; never scans silently on first run. |
 | `/next-error` | Jump to the next error message in the conversation. |
 | `/notes` | Open Agent-local scratchpad notes in the operator workspace. |
 | `/notify` | Manage and send configured Agent webhook notifications. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pellux/goodvibes-agent",
-  "version": "1.5.5",
+  "version": "1.5.6",
   "private": false,
   "description": "GoodVibes personal operator assistant TUI with a proactive Agent product brain, isolated Agent Knowledge, local profiles, routines, skills, personas, and explicit build delegation.",
   "type": "module",
@@ -53,7 +53,10 @@
     "publish:dry-run": "bun run scripts/publish-package.ts --dry-run",
     "publish:check": "bun run scripts/publish-check.ts",
     "package:install-check": "bun run scripts/package-install-check.ts",
-    "ci:gate": "bun run typecheck && bun run typecheck:test && bun run test && bun run architecture:check && bun run perf:check && bun run build && bun run publish:check && bun run package:install-check && bun run verification:ledger",
+    "ci:gate": "bun run typecheck && bun run typecheck:test && bun run test && bun run coverage:gate && bun run architecture:check && bun run perf:check && bun run build && bun run publish:check && bun run package:install-check && bun run verification:ledger",
+    "coverage:gate": "bun run scripts/coverage-gate.ts",
+    "sdk:gate": "bun run scripts/sdk-release-gates.ts",
+    "sdk:dev": "bun run scripts/sdk-dev.ts",
     "build:prod": "bun run scripts/build.ts",
     "build:all": "bun run scripts/build.ts --all",
     "perf:check": "bun run scripts/perf-check.ts",
@@ -89,7 +92,7 @@
   },
   "dependencies": {},
   "devDependencies": {
-    "@pellux/goodvibes-sdk": "0.35.0",
+    "@pellux/goodvibes-sdk": "1.0.0",
     "sql.js": "^1.14.1",
     "sqlite-vec": "^0.1.9",
     "zustand": "^5.0.12",

package/src/agent/autonomy-schedule-format.ts

@@ -90,7 +90,7 @@ export function formatAutonomyScheduleFailure(failure: AutonomyScheduleFailure):
       ? '  next make the connected GoodVibes host available outside Agent, then retry.'
       : null,
     failure.kind === 'connected_host_incompatible' || failure.kind === 'connected_host_route_unavailable'
-      ? '  next update the connected GoodVibes host so public schedules.create is available.'
+      ? '  next update the connected GoodVibes host so public automation.schedules.create is available.'
       : null,
   ].filter((line): line is string => Boolean(line)).join('\n');
 }

package/src/agent/autonomy-schedule.ts

@@ -15,8 +15,8 @@ import {
   type RoutineScheduleSpec,
 } from './routine-schedule-promotion.ts';
 
-type ScheduleCreateInput = OperatorMethodInput<'schedules.create'>;
-type ScheduleCreateOutput = OperatorMethodOutput<'schedules.create'>;
+type ScheduleCreateInput = OperatorMethodInput<'automation.schedules.create'>;
+type ScheduleCreateOutput = OperatorMethodOutput<'automation.schedules.create'>;
 type ScheduleDeliveryInput = NonNullable<ScheduleCreateInput['delivery']>;
 type ScheduleDeliveryTargetInput = ScheduleDeliveryInput['targets'] extends readonly (infer T)[] ? T : never;
 
@@ -466,7 +466,7 @@ async function classifyAutonomyScheduleError(
       return {
         ok: false,
         kind: 'connected_host_incompatible',
-        error: 'Connected GoodVibes host compatibility does not satisfy Agent schedule requirements; schedules.create is unavailable.',
+        error: 'Connected GoodVibes host compatibility does not satisfy Agent schedule requirements; automation.schedules.create is unavailable.',
         route: AUTONOMY_SCHEDULE_ROUTE,
         baseUrl: connection.baseUrl,
       };

package/src/agent/calendar/calendar-oauth-service.ts

@@ -0,0 +1,324 @@
+/**
+ * calendar-oauth-service.ts — the agent's bridge to the SDK calendar OAuth connector.
+ *
+ * It wires the SDK CalendarConnector with the REAL runtime adapters the SDK module
+ * deliberately leaves injected (so the SDK stays pure and testable): the runtime
+ * fetch, and a loopback redirect listener built on the SDK's createOAuthLocalListener.
+ * Tokens persist through the Agent secret manager. Client id/secret OVERRIDES are
+ * read from config (id) + the secret store (secret); the default is the bundled
+ * project client id shipped in the SDK profile.
+ *
+ * Every connect returns an honest STAGED result ({ ok, stage, error }) — config,
+ * authorize, or token — the same honesty shape the email connect wizard uses. The
+ * connector is injectable so tests drive the whole flow against fakes with no real
+ * network, port, or browser.
+ */
+
+import {
+  CalendarConnector,
+  fetchAdapter,
+  providerProfile,
+  resolveClientConfig,
+  type CalendarProviderId,
+  type ConnectedAccount,
+  type ConnectionState,
+  type DeviceCodeFlowStart,
+  type EventWindow,
+  type LoopbackListenerFactory,
+  type MergedCalendarEvent,
+  type OAuthClientOverrides,
+  type ResolvedClientConfig,
+} from '@pellux/goodvibes-sdk/platform/calendar';
+import { createOAuthLocalListener } from '@pellux/goodvibes-sdk/platform/config';
+import type { ConfigKey } from '../../config/index.ts';
+
+/** The config keys the connector reads. clientId is not a secret (RFC 8252); the
+ *  secret ref is secret-backed and listed in SECRET_CONFIG_KEYS. */
+export const CALENDAR_OAUTH_CLIENT_ID_KEYS: Record<CalendarProviderId, string> = {
+  google: 'calendar.google.clientId',
+  microsoft: 'calendar.microsoft.clientId',
+};
+export const CALENDAR_OAUTH_CLIENT_SECRET_KEYS: Record<CalendarProviderId, string> = {
+  google: 'calendar.google.clientSecretRef',
+  microsoft: 'calendar.microsoft.clientSecretRef',
+};
+
+/** The narrow config-manager slice this service reads. */
+export interface CalendarConfigReader {
+  get(key: string): unknown;
+}
+
+/** The narrow secret slice used for token storage + reading a stored client secret. */
+export interface CalendarSecretSlice {
+  get(key: string): Promise<string | null>;
+  set(key: string, value: string): Promise<void>;
+  delete(key: string): Promise<void>;
+}
+
+/** Default (empty) calendar config section, seeded so get()/setDynamic() resolve the
+ *  nested path. Mirrors ensureEmailConfigDefaults — the sanctioned app-layer pattern
+ *  for a category absent from the SDK config schema. */
+const CALENDAR_CONFIG_DEFAULTS = {
+  google: { clientId: '', clientSecretRef: '' },
+  microsoft: { clientId: '', clientSecretRef: '' },
+};
+
+/** Seed the calendar config section on the real ConfigManager if absent. */
+export function ensureCalendarConfigDefaults(configManager: object): void {
+  const cm = configManager as unknown as { config?: Record<string, unknown> };
+  if (cm.config && !('calendar' in cm.config)) {
+    cm.config['calendar'] = structuredClone(CALENDAR_CONFIG_DEFAULTS);
+  }
+}
+
+export type ConnectStage = 'config' | 'authorize' | 'token';
+
+export interface ConnectResult {
+  readonly ok: boolean;
+  readonly stage?: ConnectStage;
+  readonly error?: string;
+  readonly account?: ConnectedAccount;
+  readonly transport?: 'loopback' | 'device-code';
+}
+
+export interface AccountStatus {
+  readonly account: ConnectedAccount;
+  readonly state: ConnectionState;
+}
+
+/** The real loopback factory — binds 127.0.0.1 and waits for the browser callback. */
+const realLoopbackFactory: LoopbackListenerFactory = async ({ expectedState, host, port, timeoutMs }) => {
+  const listener = await createOAuthLocalListener({
+    expectedState,
+    ...(host ? { host } : {}),
+    ...(typeof port === 'number' ? { port } : {}),
+    ...(typeof timeoutMs === 'number' ? { timeoutMs } : {}),
+  });
+  return {
+    redirectUri: listener.redirectUri,
+    async waitForCode() {
+      const { code } = await listener.waitForCode();
+      return { code, state: expectedState };
+    },
+    close() {
+      listener.close();
+    },
+  };
+};
+
+export interface CalendarOAuthServiceOptions {
+  readonly config: CalendarConfigReader;
+  readonly secrets: CalendarSecretSlice;
+  /** Injected for tests; production builds a real connector over runtime fetch + loopback. */
+  readonly connector?: CalendarConnector;
+  /** Injected fetch for tests; ignored when a connector is injected. */
+  readonly fetchImpl?: Parameters<typeof fetchAdapter>[0];
+  /** Injected loopback factory for tests; ignored when a connector is injected. */
+  readonly listenerFactory?: LoopbackListenerFactory;
+}
+
+export class CalendarOAuthService {
+  private readonly config: CalendarConfigReader;
+  private readonly secrets: CalendarSecretSlice;
+  private readonly connector: CalendarConnector;
+
+  constructor(options: CalendarOAuthServiceOptions) {
+    this.config = options.config;
+    this.secrets = options.secrets;
+    this.connector = options.connector ?? new CalendarConnector({
+      secrets: options.secrets,
+      fetchImpl: options.fetchImpl ? fetchAdapter(options.fetchImpl) : fetchAdapter(),
+      listenerFactory: options.listenerFactory ?? realLoopbackFactory,
+    });
+  }
+
+  /** Resolve the client config (bundled default or config/secret-store overrides). */
+  async resolveConfig(provider: CalendarProviderId): Promise<ResolvedClientConfig> {
+    const overrides = await this.resolveOverrides(provider);
+    return resolveClientConfig(providerProfile(provider), overrides);
+  }
+
+  /** Read client-id (config) + client-secret (secret store) overrides, if any. */
+  async resolveOverrides(provider: CalendarProviderId): Promise<OAuthClientOverrides> {
+    const clientId = this.readString(CALENDAR_OAUTH_CLIENT_ID_KEYS[provider]);
+    const clientSecret = await this.resolveSecretBacked(CALENDAR_OAUTH_CLIENT_SECRET_KEYS[provider]);
+    const overrides: OAuthClientOverrides = {
+      ...(clientId ? { clientId } : {}),
+      ...(clientSecret ? { clientSecret } : {}),
+    };
+    return overrides;
+  }
+
+  /** Connect via the loopback authorization-code flow. `openUrl` is best-effort. */
+  async connectLoopback(
+    provider: CalendarProviderId,
+    hooks: { openUrl?: (url: string) => void } = {},
+  ): Promise<ConnectResult> {
+    const config = await this.resolveConfig(provider);
+    const guard = this.guardConfigured(config);
+    if (guard) return guard;
+    let begun;
+    try {
+      begun = await this.connector.beginConnectAuthCode(config);
+    } catch (error) {
+      return { ok: false, stage: 'authorize', error: `Could not start the sign-in flow: ${describe(error)}` };
+    }
+    hooks.openUrl?.(begun.start.authorizationUrl);
+    let code: string;
+    try {
+      code = (await begun.waiter.waitForCode()).code;
+    } catch (error) {
+      begun.waiter.close();
+      return { ok: false, stage: 'authorize', error: `The browser sign-in did not complete: ${describe(error)}` };
+    }
+    try {
+      const account = await this.connector.completeConnectAuthCode(config, {
+        code,
+        verifier: begun.start.verifier,
+        redirectUri: begun.start.redirectUri,
+      });
+      return { ok: true, account, transport: 'loopback' };
+    } catch (error) {
+      return { ok: false, stage: 'token', error: `The provider rejected the sign-in: ${describe(error)}` };
+    } finally {
+      begun.waiter.close();
+    }
+  }
+
+  /** Connect via the device-code flow (headless fallback). */
+  async connectDeviceCode(
+    provider: CalendarProviderId,
+    hooks: { onDeviceCode?: (start: DeviceCodeFlowStart) => void } = {},
+  ): Promise<ConnectResult> {
+    const config = await this.resolveConfig(provider);
+    const guard = this.guardConfigured(config);
+    if (guard) return guard;
+    let start: DeviceCodeFlowStart;
+    try {
+      start = await this.connector.beginConnectDeviceCode(config);
+    } catch (error) {
+      return { ok: false, stage: 'authorize', error: `Could not start device sign-in: ${describe(error)}` };
+    }
+    hooks.onDeviceCode?.(start);
+    try {
+      const account = await this.connector.completeConnectDeviceCode(config, start);
+      return { ok: true, account, transport: 'device-code' };
+    } catch (error) {
+      return { ok: false, stage: 'token', error: `Device sign-in was not approved: ${describe(error)}` };
+    }
+  }
+
+  /**
+   * Auto-select: try the loopback flow; if the listener cannot bind (headless), fall
+   * back to device-code. `--device` callers use connectDeviceCode directly.
+   */
+  async connectAuto(
+    provider: CalendarProviderId,
+    hooks: { openUrl?: (url: string) => void; onDeviceCode?: (start: DeviceCodeFlowStart) => void } = {},
+  ): Promise<ConnectResult> {
+    const config = await this.resolveConfig(provider);
+    const guard = this.guardConfigured(config);
+    if (guard) return guard;
+    try {
+      // Probe: beginning the loopback flow binds the port; a bind failure throws here.
+      const begun = await this.connector.beginConnectAuthCode(config);
+      hooks.openUrl?.(begun.start.authorizationUrl);
+      let code: string;
+      try {
+        code = (await begun.waiter.waitForCode()).code;
+      } catch (error) {
+        begun.waiter.close();
+        return { ok: false, stage: 'authorize', error: `The browser sign-in did not complete: ${describe(error)}` };
+      }
+      try {
+        const account = await this.connector.completeConnectAuthCode(config, {
+          code,
+          verifier: begun.start.verifier,
+          redirectUri: begun.start.redirectUri,
+        });
+        return { ok: true, account, transport: 'loopback' };
+      } finally {
+        begun.waiter.close();
+      }
+    } catch {
+      // No loopback available — fall back to the headless device-code flow.
+      return this.connectDeviceCode(provider, hooks);
+    }
+  }
+
+  /** Disconnect a provider: revoke where possible + clear stored tokens. */
+  async disconnect(provider: CalendarProviderId): Promise<{ readonly revokedRemotely: boolean }> {
+    const overrides = await this.resolveOverrides(provider);
+    return this.connector.disconnect(provider, overrides);
+  }
+
+  /** List connected accounts with their honest connection state. */
+  async listAccounts(): Promise<AccountStatus[]> {
+    const accounts = await this.connector.listAccounts();
+    const out: AccountStatus[] = [];
+    for (const account of accounts) {
+      out.push({ account, state: await this.connector.connectionState(account.provider) });
+    }
+    return out;
+  }
+
+  /** Events for one already-resolved provider config over a window (source-labeled). */
+  async listEventsForProvider(config: ResolvedClientConfig, window: EventWindow): Promise<MergedCalendarEvent[]> {
+    return this.connector.listEvents(config, window);
+  }
+
+  /** Merged, source-labeled events across every connected provider in a window. */
+  async listEvents(window: EventWindow): Promise<MergedCalendarEvent[]> {
+    const accounts = await this.connector.listAccounts();
+    const out: MergedCalendarEvent[] = [];
+    for (const account of accounts) {
+      const config = await this.resolveConfig(account.provider);
+      const events = await this.connector.listEvents(config, window);
+      out.push(...events);
+    }
+    return out;
+  }
+
+  // --- internals ------------------------------------------------------------
+
+  private guardConfigured(config: ResolvedClientConfig): ConnectResult | null {
+    if (!config.isPlaceholder) return null;
+    const label = config.provider === 'google' ? 'Google Calendar' : 'Microsoft Outlook';
+    const cardLabel = config.provider === 'google' ? 'Connect Google Calendar (advanced)' : 'Connect Microsoft Outlook (advanced)';
+    return {
+      ok: false,
+      stage: 'config',
+      error:
+        `This build ships no ${label} client id — connecting needs your own. ` +
+        `Run /calendar connect for the setup steps, or open "${cardLabel}" under /agent personal-ops and paste your client id in.`,
+    };
+  }
+
+  private readString(key: string): string | undefined {
+    // get() throws when the config section does not exist yet (nothing has seeded
+    // 'calendar' via the advanced card). Treat that as "unset" so the bundled default
+    // is used rather than surfacing a schema error.
+    let value: unknown;
+    try {
+      value = this.config.get(key);
+    } catch {
+      return undefined;
+    }
+    return typeof value === 'string' && value.trim().length > 0 ? value.trim() : undefined;
+  }
+
+  /** Read a secret-backed config value: resolve a goodvibes:// ref to its secret. */
+  private async resolveSecretBacked(configKey: string): Promise<string | undefined> {
+    const ref = this.readString(configKey);
+    if (!ref) return undefined;
+    const prefix = 'goodvibes://secrets/goodvibes/';
+    if (!ref.startsWith(prefix)) return ref; // a literal value (unusual, but honored)
+    const secretKey = decodeURIComponent(ref.slice(prefix.length));
+    const value = await this.secrets.get(secretKey);
+    return value ?? undefined;
+  }
+}
+
+function describe(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}