@pellux/goodvibes-agent 1.5.5 → 1.5.6

package/src/cli/skills-command.ts

@@ -0,0 +1,309 @@
+import { discoverSkills, type SkillRecord } from '../agent/skill-discovery.ts';
+import { formatAgentRecordOrigin, formatAgentRecordReviewState } from '../agent/record-labels.ts';
+import {
+  buildAgentSkillRequirements,
+  evaluateAgentSkillReadiness,
+  formatAgentSkillRequirement,
+  type AgentSkillRecord,
+} from '../agent/skill-registry.ts';
+import type { CliCommandOutput } from './types.ts';
+import type { CliCommandRuntime } from './management.ts';
+import { handleSkillBundleCommand, renderBundleList } from './skill-bundle-command.ts';
+import {
+  csvOption,
+  errorOutput,
+  failure,
+  hasFlag,
+  optionValue,
+  parseOptions,
+  requiredOption,
+  shellPaths,
+  skillRegistry,
+  success,
+  type ParsedOptions,
+} from './local-library-command-shared.ts';
+
+function summarizeSkill(skill: AgentSkillRecord): string {
+  const enabled = skill.enabled ? 'enabled' : 'disabled';
+  const tags = skill.tags.length > 0 ? `  tags ${skill.tags.join(', ')}` : '';
+  const readiness = evaluateAgentSkillReadiness(skill);
+  const ready = readiness.ready ? 'ready' : `needs ${readiness.missing.map(formatAgentSkillRequirement).join(',')}`;
+  return `  ${skill.id}  ${enabled}  ${formatAgentRecordReviewState(skill.reviewState)}  ${ready}  ${skill.name} - ${skill.description}${tags}`;
+}
+
+function renderSkillList(title: string, path: string, skills: readonly AgentSkillRecord[], emptyMessage?: string): string {
+  if (skills.length === 0) {
+    return [
+      title,
+      emptyMessage ? '' : '  No local Agent skills yet.',
+      `  ${emptyMessage ?? 'No Agent-local skills yet.'}`,
+      emptyMessage ? '' : '  Create one with: goodvibes-agent skills create --name <name> --description <summary> --procedure <steps>',
+    ].filter(Boolean).join('\n');
+  }
+  return [
+    `${title} (${skills.length})`,
+    `  store ${path}`,
+    ...skills.map(summarizeSkill),
+  ].join('\n');
+}
+
+function summarizeDiscoveredSkill(skill: SkillRecord): string {
+  const description = skill.description ? ` - ${skill.description}` : '';
+  const dependencies = skill.dependencies.length > 0 ? `  dependencies ${skill.dependencies.join(', ')}` : '';
+  const includes = skill.includes.length > 0 ? `  includes ${skill.includes.join(', ')}` : '';
+  return [
+    `  ${skill.name}  ${skill.origin}${description}${dependencies}${includes}`,
+    `    path ${skill.path}`,
+  ].join('\n');
+}
+
+function renderDiscoveredSkillList(skills: readonly SkillRecord[]): string {
+  if (skills.length === 0) {
+    return [
+      'Discovered Agent skill files',
+      '  No SKILL.md or .md skill files found in Agent skill folders.',
+      '  Search roots: .goodvibes/skills, .goodvibes/agent/skills, ~/.goodvibes/skills, ~/.goodvibes/agent/skills',
+    ].join('\n');
+  }
+  return [
+    `Discovered Agent skill files (${skills.length})`,
+    ...skills.map(summarizeDiscoveredSkill),
+    '',
+    'Import one with: goodvibes-agent skills import-discovered <name> --yes',
+  ].join('\n');
+}
+
+function discoveredSkillLookupValues(skill: SkillRecord): readonly string[] {
+  const slug = skill.name.trim().toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '');
+  const basename = skill.path.split(/[\\/]/).pop()?.replace(/\.md$/i, '') ?? '';
+  return [skill.name, slug, skill.path, basename]
+    .map((value) => value.trim().toLowerCase())
+    .filter(Boolean);
+}
+
+function findDiscoveredSkill(skills: readonly SkillRecord[], idOrName: string): SkillRecord | null {
+  const lookup = idOrName.trim().toLowerCase();
+  if (!lookup) return null;
+  return skills.find((skill) => discoveredSkillLookupValues(skill).includes(lookup)) ?? null;
+}
+
+function discoveredFrontmatterList(skill: SkillRecord, key: string): readonly string[] {
+  const value = skill.frontmatter[key];
+  if (!value) return [];
+  return value.split(',').map((entry) => entry.trim()).filter(Boolean);
+}
+
+function discoveredFrontmatterAnyList(skill: SkillRecord, keys: readonly string[]): readonly string[] {
+  for (const key of keys) {
+    const values = discoveredFrontmatterList(skill, key);
+    if (values.length > 0) return values;
+  }
+  return [];
+}
+
+function renderSkill(skill: AgentSkillRecord): string {
+  const readiness = evaluateAgentSkillReadiness(skill);
+  return [
+    `Skill ${skill.name}`,
+    `  id ${skill.id}`,
+    `  enabled: ${skill.enabled ? 'yes' : 'no'}`,
+    `  readiness: ${readiness.ready ? 'ready' : 'needs setup'}`,
+    `  requirements: ${skill.requirements.map(formatAgentSkillRequirement).join(', ') || '(none)'}`,
+    readiness.missing.length > 0 ? `  missing: ${readiness.missing.map(formatAgentSkillRequirement).join(', ')}` : '',
+    `  review: ${formatAgentRecordReviewState(skill.reviewState)}`,
+    `  origin: ${formatAgentRecordOrigin(skill.source, skill.provenance)}`,
+    `  tags: ${skill.tags.join(', ') || '(none)'}`,
+    `  triggers: ${skill.triggers.join(', ') || '(manual)'}`,
+    `  created: ${skill.createdAt}`,
+    `  updated: ${skill.updatedAt}`,
+    skill.staleReason ? `  stale reason: ${skill.staleReason}` : '',
+    '',
+    skill.description,
+    '',
+    skill.procedure,
+  ].filter((line): line is string => Boolean(line)).join('\n');
+}
+
+function usageSkills(): string {
+  return 'Usage: goodvibes-agent skills [list|enabled|active|attention|discover|import-discovered <name> --yes|search <query>|show <id>|create [--requires-env A,B] [--requires-command gh,jq]|update <id>|enable <id>|disable <id>|review <id>|stale <id> <reason>|delete <id> --yes|bundle ...]';
+}
+
+function skillPayloadFromOptions(options: ParsedOptions): {
+  readonly name: string;
+  readonly description: string;
+  readonly procedure: string;
+  readonly tags: readonly string[] | undefined;
+  readonly triggers: readonly string[] | undefined;
+  readonly requirements: ReturnType<typeof buildAgentSkillRequirements>;
+  readonly enabled: boolean | undefined;
+  readonly provenance: string;
+} {
+  const usage = 'Usage: goodvibes-agent skills create --name <name> --description <summary> --procedure <steps>';
+  return {
+    name: requiredOption(options, 'name', usage),
+    description: requiredOption(options, 'description', usage),
+    procedure: requiredOption(options, 'procedure', usage),
+    tags: csvOption(options, 'tags'),
+    triggers: csvOption(options, 'triggers'),
+    requirements: buildAgentSkillRequirements({
+      env: csvOption(options, 'requires-env'),
+      commands: csvOption(options, 'requires-command') ?? csvOption(options, 'requires-commands'),
+    }),
+    enabled: hasFlag(options, 'enabled') ? true : undefined,
+    provenance: optionValue(options, 'provenance') ?? 'Command',
+  };
+}
+
+export async function handleSkillsCommand(runtime: CliCommandRuntime): Promise<CliCommandOutput> {
+  try {
+    const [sub = 'list', ...rest] = runtime.cli.commandArgs;
+    const normalized = sub.toLowerCase();
+    if (normalized === 'bundle' || normalized === 'bundles') return handleSkillBundleCommand(runtime, rest);
+    const registry = skillRegistry(runtime);
+    const snapshot = registry.snapshot();
+    if (normalized === 'list' || normalized === 'ls') {
+      return success(runtime, 'agent.skills.list', { path: snapshot.path, skills: snapshot.skills, enabledCount: snapshot.enabledSkills.length }, renderSkillList('Agent skills', snapshot.path, snapshot.skills));
+    }
+    if (normalized === 'enabled') {
+      return success(runtime, 'agent.skills.enabled', { path: snapshot.path, skills: snapshot.enabledSkills }, renderSkillList('Enabled Agent skills', snapshot.path, snapshot.enabledSkills));
+    }
+    if (normalized === 'active') {
+      return success(runtime, 'agent.skills.active', { path: snapshot.path, skills: snapshot.activeSkills, bundles: snapshot.enabledBundles }, [
+        renderSkillList('Active Agent skills', snapshot.path, snapshot.activeSkills),
+        snapshot.enabledBundles.length > 0 ? renderBundleList('Enabled Agent skill bundles', snapshot.path, snapshot.enabledBundles, snapshot.skills) : '',
+      ].filter(Boolean).join('\n\n'));
+    }
+    if (normalized === 'attention' || normalized === 'needs-setup') {
+      const skills = snapshot.skills.filter((skill) => !evaluateAgentSkillReadiness(skill).ready);
+      return success(runtime, 'agent.skills.attention', { path: snapshot.path, skills }, renderSkillList('Agent skills needing setup', snapshot.path, skills, 'No Agent-local skills need setup.'));
+    }
+    if (normalized === 'discover') {
+      const discovered = await discoverSkills(shellPaths(runtime));
+      return success(runtime, 'agent.skills.discover', { skills: discovered }, renderDiscoveredSkillList(discovered));
+    }
+    if (normalized === 'import-discovered' || normalized === 'import-skill') {
+      const options = parseOptions(rest);
+      const name = options.positionals.join(' ').trim();
+      if (!name) return failure(runtime, 'invalid_skill_command', 'Usage: goodvibes-agent skills import-discovered <name> [--enabled] --yes', 2);
+      const discovered = findDiscoveredSkill(await discoverSkills(shellPaths(runtime)), name);
+      if (!discovered) {
+        return failure(runtime, 'skill_discovery_not_found', `Unknown discovered Agent skill ${name}\nRun goodvibes-agent skills discover to inspect available skill files.`, 1);
+      }
+      if (!hasFlag(options, 'yes')) {
+        return success(runtime, 'agent.skills.import_discovered.preview', { skill: discovered }, [
+          'Agent skill import preview',
+          `  name ${discovered.name}`,
+          `  origin ${discovered.origin}`,
+          `  path ${discovered.path}`,
+          `  description ${discovered.description || '(none)'}`,
+          `  procedure characters ${discovered.body.length}`,
+          '  next rerun with --yes to import into the Agent-local skill registry',
+        ].join('\n'));
+      }
+      const skill = registry.create({
+        name: discovered.name,
+        description: discovered.description || `Imported skill from ${discovered.origin} skill file.`,
+        procedure: discovered.body,
+        tags: discoveredFrontmatterList(discovered, 'tags'),
+        triggers: discoveredFrontmatterList(discovered, 'triggers'),
+        requirements: buildAgentSkillRequirements({
+          env: discoveredFrontmatterAnyList(discovered, ['requiresEnv', 'requires-env', 'requires_env']),
+          commands: discoveredFrontmatterAnyList(discovered, ['requiresCommands', 'requires-commands', 'requires_commands', 'commands']),
+        }),
+        enabled: hasFlag(options, 'enabled'),
+        source: 'imported',
+        provenance: `discovered:${discovered.origin}:${discovered.path}`,
+      });
+      return success(runtime, 'agent.skills.import_discovered', skill, [
+        `Imported Agent skill ${skill.id}: ${skill.name}${skill.enabled ? ' (enabled)' : ''}`,
+        `  name ${skill.name}`,
+        `  enabled ${skill.enabled ? 'yes' : 'no'}`,
+      ].join('\n'));
+    }
+    if (normalized === 'search' || normalized === 'find') {
+      const query = rest.join(' ').trim();
+      const results = registry.search(query);
+      return success(runtime, 'agent.skills.search', { query, results }, renderSkillList(`Agent skills matching "${query}"`, snapshot.path, results));
+    }
+    if (normalized === 'show' || normalized === 'get') {
+      const id = rest[0];
+      if (!id) return failure(runtime, 'invalid_skill_command', 'Usage: goodvibes-agent skills show <id>', 2);
+      const skill = registry.get(id);
+      if (!skill) return failure(runtime, 'skill_not_found', `Unknown Agent skill ${id}`, 1);
+      return success(runtime, 'agent.skills.show', skill, renderSkill(skill));
+    }
+    if (normalized === 'create') {
+      const skill = registry.create(skillPayloadFromOptions(parseOptions(rest)));
+      return success(runtime, 'agent.skills.create', skill, [
+        'Agent skill created',
+        `  id ${skill.id}`,
+        skill.enabled ? '  (enabled)' : '',
+        `  enabled ${skill.enabled ? 'yes' : 'no'}`,
+      ].filter(Boolean).join('\n'));
+    }
+    if (normalized === 'update') {
+      const id = rest[0];
+      if (!id) return failure(runtime, 'invalid_skill_command', 'Usage: goodvibes-agent skills update <id> [--name ...] [--description ...] [--procedure ...]', 2);
+      const options = parseOptions(rest.slice(1));
+      const skill = registry.update(id, {
+        name: optionValue(options, 'name'),
+        description: optionValue(options, 'description'),
+        procedure: optionValue(options, 'procedure'),
+        tags: csvOption(options, 'tags'),
+        triggers: csvOption(options, 'triggers'),
+        requirements: options.values.has('requires-env') || options.values.has('requires-command') || options.values.has('requires-commands')
+          ? buildAgentSkillRequirements({
+            env: csvOption(options, 'requires-env'),
+            commands: csvOption(options, 'requires-command') ?? csvOption(options, 'requires-commands'),
+          })
+          : undefined,
+        provenance: optionValue(options, 'provenance'),
+      });
+      return success(runtime, 'agent.skills.update', skill, [
+        'Agent skill updated',
+        `  id ${skill.id}`,
+      ].join('\n'));
+    }
+    if (normalized === 'enable' || normalized === 'disable') {
+      const id = rest[0];
+      if (!id) return failure(runtime, 'invalid_skill_command', `Usage: goodvibes-agent skills ${normalized} <id>`, 2);
+      const skill = registry.setEnabled(id, normalized === 'enable');
+      return success(runtime, `agent.skills.${normalized}`, skill, [
+        `Agent skill ${normalized === 'enable' ? 'enabled' : 'disabled'}`,
+        `  id ${skill.id}`,
+      ].join('\n'));
+    }
+    if (normalized === 'review') {
+      const id = rest[0];
+      if (!id) return failure(runtime, 'invalid_skill_command', 'Usage: goodvibes-agent skills review <id>', 2);
+      const skill = registry.markReviewed(id);
+      return success(runtime, 'agent.skills.review', skill, [
+        'Agent skill reviewed',
+        `  id ${skill.id}`,
+      ].join('\n'));
+    }
+    if (normalized === 'stale') {
+      const id = rest[0];
+      if (!id || rest.length < 2) return failure(runtime, 'invalid_skill_command', 'Usage: goodvibes-agent skills stale <id> <reason>', 2);
+      const skill = registry.markStale(id, rest.slice(1).join(' '));
+      return success(runtime, 'agent.skills.stale', skill, [
+        'Agent skill marked stale',
+        `  id ${skill.id}`,
+      ].join('\n'));
+    }
+    if (normalized === 'delete' || normalized === 'remove' || normalized === 'rm') {
+      const options = parseOptions(rest);
+      const id = options.positionals[0];
+      if (!id) return failure(runtime, 'invalid_skill_command', 'Usage: goodvibes-agent skills delete <id> --yes', 2);
+      if (!hasFlag(options, 'yes')) return failure(runtime, 'confirmation_required', `Refusing to delete Agent skill ${id} without --yes.`, 2);
+      const skill = registry.deleteSkill(id);
+      return success(runtime, 'agent.skills.delete', skill, [
+        `Agent skill deleted: ${id}`,
+        `  id ${skill.id}`,
+      ].join('\n'));
+    }
+    return failure(runtime, 'invalid_skill_command', usageSkills(), 2);
+  } catch (error) {
+    return errorOutput(runtime, error, 'agent.skills.error');
+  }
+}

package/src/cli/status.ts

@@ -7,6 +7,7 @@ import type { CliExternalRuntimeSnapshot } from './external-runtime.ts';
 import { getProviderIdFromModel } from '../config/provider-model.ts';
 import { formatAgentRecordSource } from '../agent/record-labels.ts';
 import { formatAgentKnowledgeFailureKind } from './agent-knowledge-format.ts';
+import { computeApprovalPosture, type ApprovalPosture } from '../permissions/approval-posture.ts';
 
 export interface CliStatusOptions {
   readonly configManager: Pick<ConfigManager, 'get'>;
@@ -51,6 +52,8 @@ export interface CliStatusSnapshot {
   readonly auth: {
     readonly permissionMode: unknown;
     readonly permissionLabel: string;
+    readonly autoApprove: boolean;
+    readonly bypassesPrompts: boolean;
     readonly secretPolicy: unknown;
     readonly secretPolicyLabel: string;
     readonly runtimeAuthSignal: CliAuthStatus | null;
@@ -79,11 +82,27 @@ function yesNo(value: unknown): string {
   return value === true ? 'yes' : 'no';
 }
 
-function permissionModeLabel(mode: unknown): string {
-  if (mode === 'prompt') return 'Ask before powerful actions';
-  if (mode === 'allow-all') return 'Allow everything';
-  if (mode === 'custom') return 'Custom rules';
-  return String(mode ?? 'unknown');
+/** permissions.tools.* keys — mirrors PermissionsToolConfig in the SDK config schema. */
+const PERMISSION_TOOL_KEYS = [
+  'read', 'write', 'edit', 'exec', 'find', 'fetch', 'analyze',
+  'inspect', 'agent', 'state', 'workflow', 'registry', 'delegate', 'mcp',
+] as const;
+
+/**
+ * Reads the effective approval posture the SAME way the permission gate
+ * decides it (behavior.autoApprove first, then permissions.mode), so the
+ * displayed label can never disagree with what actually happens when a tool
+ * runs. Do not compute a posture label from permissions.mode alone here —
+ * that was the original bug (this surface ignored behavior.autoApprove).
+ */
+function readApprovalPosture(config: Pick<ConfigManager, 'get'>): ApprovalPosture {
+  const customTools: Record<string, unknown> = {};
+  for (const key of PERMISSION_TOOL_KEYS) customTools[key] = config.get(`permissions.tools.${key}`);
+  return computeApprovalPosture({
+    autoApprove: config.get('behavior.autoApprove') === true,
+    mode: config.get('permissions.mode'),
+    customTools,
+  });
 }
 
 function secretPolicyLabel(policy: unknown): string {
@@ -97,6 +116,7 @@ export function buildCliDoctorFindings(options: CliStatusOptions): readonly CliD
   const config = options.configManager;
   const permissionMode = config.get('permissions.mode');
   const secretPolicy = config.get('storage.secretPolicy');
+  const posture = readApprovalPosture(config);
   const marker = options.onboardingMarkers?.effective;
 
   const findings: CliDoctorFinding[] = [];
@@ -176,6 +196,18 @@ export function buildCliDoctorFindings(options: CliStatusOptions): readonly CliD
     });
   }
 
+  if (posture.autoApprove) {
+    findings.push({
+      id: 'auto-approve-enabled',
+      area: 'security',
+      severity: 'risk',
+      summary: 'Auto-approve is on: tool calls never prompt.',
+      cause: 'behavior.autoApprove is true.',
+      impact: 'Every tool call — including powerful write, edit, network, and execution actions — runs without a Human-in-the-Loop (HITL) approval prompt, regardless of permissions.mode or any custom per-tool rule.',
+      action: 'Disable behavior.autoApprove unless this is an intentionally trusted environment.',
+    });
+  }
+
   if (permissionMode === 'allow-all') {
     findings.push({
       id: 'allow-all-permissions',
@@ -210,6 +242,7 @@ export function buildCliStatusSnapshot(options: CliStatusOptions): CliStatusSnap
   const webBinding = resolveRuntimeEndpointBinding(config, 'web');
   const marker = options.onboardingMarkers?.effective;
   const findings = buildCliDoctorFindings(options);
+  const posture = readApprovalPosture(config);
   return {
     title: options.doctor ? 'GoodVibes Agent doctor' : 'GoodVibes Agent status',
     workingDirectory: options.workingDirectory,
@@ -221,7 +254,9 @@ export function buildCliStatusSnapshot(options: CliStatusOptions): CliStatusSnap
     },
     auth: {
       permissionMode: config.get('permissions.mode'),
-      permissionLabel: permissionModeLabel(config.get('permissions.mode')),
+      permissionLabel: posture.label,
+      autoApprove: posture.autoApprove,
+      bypassesPrompts: posture.bypassesPrompts,
       secretPolicy: config.get('storage.secretPolicy'),
       secretPolicyLabel: secretPolicyLabel(config.get('storage.secretPolicy')),
       runtimeAuthSignal: options.auth ?? null,
@@ -267,7 +302,8 @@ export function renderCliStatus(options: CliStatusOptions): string {
     `  reasoning ${String(config.get('provider.reasoningEffort'))}`,
     '',
     'Auth',
-    `  permissions: ${permissionModeLabel(config.get('permissions.mode'))} (${String(config.get('permissions.mode'))})`,
+    `  permissions: ${snapshot.auth.permissionLabel} (${String(config.get('permissions.mode'))})`,
+    `  autoApprove: ${yesNo(snapshot.auth.autoApprove)} (behavior.autoApprove)`,
     `  secretPolicy: ${secretPolicyLabel(config.get('storage.secretPolicy'))} (${String(config.get('storage.secretPolicy'))})`,
     options.auth
       ? `  local auth store ${options.auth.userStorePresent ? 'present' : 'missing'} (${options.auth.userStorePath})`

package/src/cli/tui-startup.ts

@@ -2,6 +2,8 @@ import type { CommandContext, CommandRegistry } from '../input/command-registry.
 import type { InputHandler } from '../input/handler.ts';
 import { readOnboardingCompletionMarker } from '../runtime/onboarding/index.ts';
 import type { GoodVibesCliParseResult } from './types.ts';
+import { checkRecoveryFile, readLastSessionPointer } from '@/runtime/index.ts';
+import { resolveResumableSession, surfaceResumeRelaunchNotice } from './resume-relaunch-notice.ts';
 
 export type InteractiveTerminalCheckInput = {
   readonly binary: string;
@@ -95,7 +97,7 @@ export function applyInitialTuiCliState(options: {
   readonly input: InputHandler;
   readonly commandRegistry: CommandRegistry;
   readonly commandContext: CommandContext;
-  readonly shellPaths: Parameters<typeof readOnboardingCompletionMarker>[0];
+  readonly shellPaths: Parameters<typeof readOnboardingCompletionMarker>[0] & { readonly homeDirectory: string };
   readonly render: () => void;
 }): void {
   const { cli, input, commandRegistry, commandContext, shellPaths, render } = options;
@@ -110,6 +112,27 @@ export function applyInitialTuiCliState(options: {
     }
   } else if (!onboardingCompletionMarker.payload) {
     input.openAgentWorkspace(commandContext, 'setup', 'ONBOARDING');
+  } else {
+    // Normal relaunch: onboarding is done and the user didn't ask for
+    // onboarding or an explicit `sessions resume`. Surface an honest,
+    // non-blocking resume affordance instead of silently starting fresh
+    // (the W4-A4 dogfood finding) — never auto-resume, declining is
+    // frictionless (just start typing).
+    surfaceResumeRelaunchNotice({
+      getLastSessionPointer: () => readLastSessionPointer({
+        workingDirectory: shellPaths.workingDirectory,
+        homeDirectory: shellPaths.homeDirectory,
+      }),
+      isRecoveryPending: () => Boolean(checkRecoveryFile({
+        workingDirectory: shellPaths.workingDirectory,
+        homeDirectory: shellPaths.homeDirectory,
+      })),
+      findSession: (sessionId) => {
+        const sessionManager = commandContext.session?.sessionManager;
+        return sessionManager ? resolveResumableSession(sessionManager, sessionId) : null;
+      },
+      print: (text) => commandContext.print(text),
+    });
   }
 
   if (seededPrompt) {

package/src/config/agent-settings-policy.ts

@@ -12,7 +12,6 @@ const EXTERNAL_HOST_SETTING_PREFIXES = [
 ] as const;
 
 const EXTERNAL_HOST_SETTING_KEYS = new Set<string>([
-  'danger.daemon',
   'danger.httpListener',
 ]);
 

package/src/config/secret-config.ts

@@ -5,6 +5,10 @@ import type { SecretScope, SecretStorageMedium } from './secrets.ts';
 export const SECRET_CONFIG_KEYS = new Set<ConfigKey>([
   // email section (app-layer extension, key is string-cast for ConfigKey compatibility)
   'email.passwordRef' as unknown as ConfigKey,
+  // calendar OAuth advanced overrides — only the client SECRET is secret-backed; the
+  // client id is not a secret (RFC 8252) and stays a plain config value.
+  'calendar.google.clientSecretRef' as unknown as ConfigKey,
+  'calendar.microsoft.clientSecretRef' as unknown as ConfigKey,
   'surfaces.slack.signingSecret',
   'surfaces.slack.botToken',
   'surfaces.slack.appToken',

package/src/core/conversation-rendering.ts

@@ -11,7 +11,13 @@ import { LAYOUT } from '../renderer/layout.ts';
 import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
 import { renderConversationCollapsedFragment, renderConversationEventLine } from '../renderer/conversation-surface.ts';
 import { GLYPHS } from '../renderer/ui-primitives.ts';
+import { activeTheme } from '../renderer/theme.ts';
 import type { BlockMeta, ConversationMessageSnapshot } from './conversation';
+
+// Transcript tokens are read live per render (const T = activeTheme() at the top
+// of each render function that styles content) so a dark→light repaint
+// re-resolves with no module reload. Dark values are byte-identical to the
+// agent's prior static reads.
 import { parseDiffForApply } from '@pellux/goodvibes-sdk/platform/core';
 import { extractUserDisplayText } from '@pellux/goodvibes-sdk/platform/core';
 
@@ -39,9 +45,10 @@ export function renderConversationUserMessage(
   message: Extract<Message, { role: 'user' }>,
   width: number,
 ): void {
+  const T = activeTheme();
   const displayText = extractUserDisplayText(message.content);
   if (message.cancelled) {
-    context.history.addLines(UIFactory.createMessageBar(width, displayText, '#3a1a1a', '196', ' x ', true));
+    context.history.addLines(UIFactory.createMessageBar(width, displayText, T.errorBarBg, '196', ' x ', true));
     return;
   }
   context.history.addLines(UIFactory.createMessageBar(width, displayText));
@@ -55,22 +62,23 @@ export function renderConversationAssistantMessage(
   collapseThreshold: number,
   msgIdx: number,
 ): void {
+  const T = activeTheme();
   const assistantHeaderDetails = [];
   if (message.model) {
-    assistantHeaderDetails.push({ text: ` ${message.model}${message.provider ? ` (${message.provider})` : ''} `, fg: '#94a3b8', dim: true });
+    assistantHeaderDetails.push({ text: ` ${message.model}${message.provider ? ` (${message.provider})` : ''} `, fg: T.modelNameDim, dim: true });
   }
   if (message.toolCalls && message.toolCalls.length > 0) {
-    assistantHeaderDetails.push({ text: ` ${GLYPHS.status.pending} tools:${message.toolCalls.length} `, fg: '#38bdf8' });
+    assistantHeaderDetails.push({ text: ` ${GLYPHS.status.pending} tools:${message.toolCalls.length} `, fg: T.toolAccent });
   }
   if (message.reasoningContent || message.reasoningSummary) {
-    assistantHeaderDetails.push({ text: ` ${GLYPHS.status.active} reasoning `, fg: '#a855f7', dim: true });
+    assistantHeaderDetails.push({ text: ` ${GLYPHS.status.active} reasoning `, fg: T.reasoningAccent, dim: true });
   }
   if (assistantHeaderDetails.length > 0) {
     context.history.addLine(renderConversationEventLine(width, {
       marker: GLYPHS.status.active,
-      markerFg: '#22d3ee',
+      markerFg: T.assistantHeader,
       label: 'assistant',
-      labelFg: '#22d3ee',
+      labelFg: T.assistantHeader,
       detailFg: '244',
     }, assistantHeaderDetails));
   }
@@ -198,6 +206,7 @@ export function renderConversationToolMessage(
   width: number,
   msgIdx: number,
 ): void {
+  const T = activeTheme();
   const collapseKey = `msg_${msgIdx}`;
   const blockIdx = context.blockRegistry.length;
   const startLine = context.history.getLineCount();
@@ -221,13 +230,13 @@ export function renderConversationToolMessage(
 
   context.history.addLine(renderConversationEventLine(width, {
     marker: blockType === 'diff' ? GLYPHS.status.dualPane : GLYPHS.status.active,
-    markerFg: blockType === 'diff' ? '#f59e0b' : '#38bdf8',
+    markerFg: blockType === 'diff' ? T.diffAccent : T.toolAccent,
     label: blockType === 'diff' ? 'diff' : 'tool result',
-    labelFg: blockType === 'diff' ? '#f59e0b' : '#38bdf8',
+    labelFg: blockType === 'diff' ? T.diffAccent : T.toolAccent,
     detailFg: '244',
   }, [
     ...(message.toolName
-      ? [{ text: ` ${friendlyToolLabel(message.toolName)} `, fg: '#e2e8f0' as const }]
+      ? [{ text: ` ${friendlyToolLabel(message.toolName)} `, fg: T.toolNameFg }]
       : [{ text: ` ${summarizeCallId(message.callId || 'standalone')} `, fg: '244' as const, dim: true }]),
     { text: ` ${isCollapsed ? GLYPHS.navigation.collapsed : GLYPHS.navigation.expanded} ${lineCount} line${lineCount === 1 ? '' : 's'} `, fg: '244', dim: true },
   ]));
@@ -242,9 +251,9 @@ export function renderConversationToolMessage(
       : preview;
     const rendered = renderConversationCollapsedFragment(collapsedText, width, {
       prefix: blockType === 'diff' ? ` ${GLYPHS.status.dualPane} ` : ` ${GLYPHS.navigation.collapsed} `,
-      prefixFg: blockType === 'diff' ? '#f59e0b' : '#38bdf8',
+      prefixFg: blockType === 'diff' ? T.diffAccent : T.toolAccent,
       text: '244',
-      bodyBg: '#1a1a1a',
+      bodyBg: T.collapsedBodyBg,
       dim: true,
     });
     context.history.addLines(rendered);

package/src/core/focus-tracker.ts

@@ -0,0 +1,41 @@
+/**
+ * focus-tracker — tracks whether the terminal window currently has OS-level
+ * input focus, using the terminal focus-reporting protocol (DECSET ?1004h,
+ * enabled at terminal setup in main.ts). The SDK's InputTokenizer already
+ * parses the resulting `\x1b[I` (focus-in) / `\x1b[O` (focus-out) sequences
+ * into `{ type: 'focus', action }` tokens (platform/core/tokenizer.ts); this
+ * module is the single place those tokens land (consumed in
+ * src/input/handler-feed.ts's feedInputTokens()).
+ *
+ * Honest degradation: a terminal that does not implement focus reporting
+ * (or a multiplexer that swallows the sequences) never sends focus tokens.
+ * In that case `isFocused()` stays `null` forever — "unknown", never a
+ * guessed `true`/`false`. Callers that gate a user-facing behavior on focus
+ * (e.g. the unfocused-alert notifiers in this directory) must treat `null`
+ * the same as "not focused" per the fallback rule: alerts fire when the
+ * terminal is definitely unfocused OR when focus state was never observed.
+ */
+export class FocusTracker {
+  private focused: boolean | null = null;
+
+  /** True/false once at least one focus token has arrived; null if none ever has. */
+  isFocused(): boolean | null {
+    return this.focused;
+  }
+
+  /** Called from the input pipeline on every focus token. */
+  setFocused(value: boolean): void {
+    this.focused = value;
+  }
+
+  /**
+   * The alert-gating rule shared by every unfocused-alert notifier: fire
+   * when the terminal is known to be unfocused, or when focus was never
+   * observed (honest fallback — never silently suppress on an unknown
+   * terminal). Only `isFocused() === true` (a real, observed focus-in with
+   * no observed focus-out since) suppresses an alert.
+   */
+  shouldAlertWhenUnfocused(): boolean {
+    return this.focused !== true;
+  }
+}