@pellux/goodvibes-agent 1.5.6 → 1.5.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pellux/goodvibes-agent",
-  "version": "1.5.6",
+  "version": "1.5.8",
   "private": false,
   "description": "GoodVibes personal operator assistant TUI with a proactive Agent product brain, isolated Agent Knowledge, local profiles, routines, skills, personas, and explicit build delegation.",
   "type": "module",

package/src/agent/memory-prompt.ts

@@ -1,5 +1,5 @@
 import type { MemoryRecord, MemoryRegistry, MemoryVectorStats } from '@pellux/goodvibes-sdk/platform/state';
-// W6-C2 (E6): the recall-honesty floor + eligibility receipt now live in the SDK as
+// The recall-honesty floor + eligibility receipt now live in the SDK as
 // the ONE cross-surface contract (memory-recall-contract.ts) instead of being defined
 // per surface. This file re-exports them unchanged so every existing agent consumer
 // keeps importing from './memory-prompt.ts', while the SDK is the single source of the
@@ -32,9 +32,9 @@ function formatMemoryLine(record: MemoryRecord): string {
 }
 
 /**
- * Per-turn semantic ranking of an already-eligible memory set (Wave-4 W4-A1B).
+ * Per-turn semantic ranking of an already-eligible memory set.
  *
- * W4-A1 shipped eligibility (confidence + reviewState + provenance) as the hard trust
+ * Eligibility (confidence + reviewState + provenance) shipped as the hard trust
  * gate but had no per-turn query to rank WITHIN that eligible set — records were only
  * ever ordered by stored confidence/recency, regardless of whether they had anything to
  * do with what the user actually just asked. `rankMemoryForTurn` never touches the gate

package/src/agent/operator-actions.ts

@@ -103,7 +103,7 @@ export const OPERATOR_ACTIONS: Record<OperatorActionId, OperatorActionDescriptor
     pathTemplate: '/api/automation/jobs/{jobId}/run',
     targetField: 'jobId',
   },
-  // W6-C3: automation.jobs.pause/resume were retired (redundant with
+  // automation.jobs.pause/resume were retired (redundant with
   // disable/enable — same {id,enabled} output, same semantics). The
   // user-facing "pause"/"resume" verb is unchanged; only the wire action +
   // path moved to the canonical disable/enable methods.

package/src/agent/prompt-context-receipts.ts

@@ -9,7 +9,7 @@ import { AgentPersonaRegistry, buildActivePersonaPrompt } from './persona-regist
 import { buildProjectContextPrompt, discoverProjectContextFiles } from './project-context-files.ts';
 import { AgentRoutineRegistry, buildEnabledRoutinesPrompt, evaluateAgentRoutineReadiness } from './routine-registry.ts';
 import { AgentSkillRegistry, buildEnabledSkillsPrompt, evaluateAgentSkillBundleReadiness, evaluateAgentSkillReadiness } from './skill-registry.ts';
-import { buildVibePrompt, discoverVibeFiles } from './vibe-file.ts';
+import { buildVibeProjectionPrompt, discoverVibeFiles } from './vibe-file.ts';
 
 export type PromptContextReceiptStatus = 'active' | 'attention' | 'empty' | 'unavailable';
 export type PromptContextReceiptSource = 'turn' | 'follow_up' | 'manual';
@@ -140,7 +140,9 @@ function receiptSegment(input: Omit<PromptContextReceiptSegment, 'approxTokens'>
 
 function buildRuntimePromptReceiptSegments(input: RuntimePromptCompositionInput): readonly PromptContextReceiptSegment[] {
   const vibe = discoverVibeFiles(input.shellPaths);
-  const vibePrompt = buildVibePrompt(input.shellPaths) ?? '';
+  // The VIBE prompt is a PROJECTION of persona/constraint records, not a
+  // re-read of the files (discoverVibeFiles above stays for the file-discovery receipt).
+  const vibePrompt = buildVibeProjectionPrompt(input.memoryRegistry) ?? '';
   const projectContext = discoverProjectContextFiles(input.shellPaths);
   const projectContextPrompt = buildProjectContextPrompt(input.shellPaths) ?? '';
   const memoryRecords = input.memoryRegistry.getAll();
@@ -232,7 +234,7 @@ function buildRuntimePromptReceiptSegments(input: RuntimePromptCompositionInput)
       suppressedCount: suppressedMemory.length,
       promptChars: memoryPrompt.length,
       promptText: memoryPrompt,
-      // Honest degrade note (Wave-4 W4-A1B): when per-turn relevance scoring did not
+      // Honest degrade note: when per-turn relevance scoring did not
       // run — no active-turn text, semantic index unavailable, or no vector match —
       // say so instead of silently presenting the fallback confidence/recency order as
       // if it were a relevance ranking.
@@ -243,7 +245,7 @@ function buildRuntimePromptReceiptSegments(input: RuntimePromptCompositionInput)
         class: record.cls,
         confidence: record.confidence,
         reason: describeMemoryPromptEligibility(record).reason,
-        // Per-turn relevance (W4-A1B): honest wording, only present when actually scored.
+        // Per-turn relevance: honest wording, only present when actually scored.
         // F7a: the raw percent is paired with a qualitative band (see relevanceBand)
         // so a genuinely-lower-but-real score like "28%" doesn't read as noise.
         ...(memoryRanking.scored ? { relevance: `relevance to this turn: ${memoryRanking.relevanceById.get(record.id) ?? 0}% (${relevanceBand(memoryRanking.relevanceById.get(record.id) ?? 0)})` } : {}),
@@ -341,7 +343,7 @@ export function composeRuntimePromptWithReceipt(input: RuntimePromptCompositionI
   const supplement = getTierPromptSupplement(tier);
   const prompt = joinPromptParts(
     input.runtimePrompt,
-    buildVibePrompt(input.shellPaths),
+    buildVibeProjectionPrompt(input.memoryRegistry),
     buildProjectContextPrompt(input.shellPaths),
     input.operatorPolicy,
     buildReviewedMemoryPrompt(input.memoryRegistry, { turnText: input.turnText }),

package/src/agent/session-registration.ts

@@ -86,7 +86,7 @@ export interface SessionRecordSummary {
 }
 
 /**
- * Honest outcome discriminator. 'still_closed' is the Wave-1 heartbeat-resurrection
+ * Honest outcome discriminator. 'still_closed' is the heartbeat-resurrection
  * guard: a 200 that carries conflict:{status:'closed'} with reopened:false MUST NOT
  * be read as 'registered' or 'reopened'.
  */

package/src/agent/vibe-file.ts

@@ -1,15 +1,16 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
 import { dirname, isAbsolute, join, resolve } from 'node:path';
 import type { ShellPathService } from '@/runtime/index.ts';
 import { GOODVIBES_AGENT_SURFACE_ROOT } from '../config/surface.ts';
 import { assertNoSecretLikeText } from './persona-registry.ts';
 import { parseMarkdownFrontmatter, stripMarkdownFrontmatter } from './markdown-frontmatter.ts';
-// W6-C2 (E6): VIBE.md is now a PROJECTION of persona/constraint records in the
+// VIBE.md is now a PROJECTION of persona/constraint records in the
 // canonical memory store, not a separate source of truth. renderVibeProjection emits
 // the same '## VIBE.md' block from those records (caveat preserved); the file is
 // demoted to an import/export FORMAT folded in via vibeBodyToConstraintOptions.
 import { renderVibeProjection, vibeBodyToConstraintOptions } from '@pellux/goodvibes-sdk/platform/state';
-import type { MemoryRegistry, MemoryScope } from '@pellux/goodvibes-sdk/platform/state';
+import type { MemoryRecord, MemoryRegistry, MemoryScope } from '@pellux/goodvibes-sdk/platform/state';
 
 export type AgentVibeScope = 'project' | 'global';
 
@@ -212,7 +213,7 @@ export function buildVibePrompt(shellPaths: AgentVibePaths): string | null {
 }
 
 /**
- * W6-C2 (E6): the VIBE.md prompt block as a PROJECTION of persona/constraint records.
+ * The VIBE.md prompt block as a PROJECTION of persona/constraint records.
  *
  * This is the store-sourced replacement for buildVibePrompt (which reads the file
  * directly). It renders the same '## GoodVibes Agent VIBE.md' block — including the
@@ -220,12 +221,12 @@ export function buildVibePrompt(shellPaths: AgentVibePaths): string | null {
  * store, so persona instructions have a single source of truth alongside every other
  * durable fact. Returns null when there are no persona records to project.
  */
-export function buildVibeProjectionPrompt(memoryRegistry: MemoryRegistry): string | null {
-  return renderVibeProjection(memoryRegistry.getAll());
+export function buildVibeProjectionPrompt(memoryRecords: { getAll(): readonly MemoryRecord[] }): string | null {
+  return renderVibeProjection(memoryRecords.getAll());
 }
 
 /**
- * W6-C2 (E6): fold discovered VIBE.md files into the store as persona/constraint
+ * Fold discovered VIBE.md files into the store as persona/constraint
  * records — the file demoted to an IMPORT FORMAT. Each bullet becomes one record so a
  * later single-record edit changes exactly one projected line. Secret-like content is
  * already rejected by discoverVibeFiles (readVibeCandidate → assertNoSecretLikeText),
@@ -255,6 +256,86 @@ export async function importVibeFilesIntoMemory(
   return created;
 }
 
+/**
+ * The persisted marker that makes the VIBE.md → memory import a strictly
+ * ONE-TIME migration. Keyed by absolute file path → content hash, so importing the same
+ * VIBE.md twice is a no-op (re-import would create near-duplicate persona records), while
+ * a NEW project's VIBE.md still migrates exactly once. Mirrors the sessions.spine-folded
+ * marker precedent (bootstrap.ts) — a small JSON sidecar, read before and written after.
+ */
+interface VibeImportMarker {
+  readonly migrated: Record<string, string>;
+}
+
+function vibeImportMarkerPath(shellPaths: Pick<ShellPathService, 'resolveUserPath'>): string {
+  return shellPaths.resolveUserPath(GOODVIBES_AGENT_SURFACE_ROOT, 'vibe-import.migrated.json');
+}
+
+function readVibeImportMarker(path: string): VibeImportMarker {
+  if (!existsSync(path)) return { migrated: {} };
+  try {
+    const parsed = JSON.parse(readFileSync(path, 'utf-8')) as unknown;
+    const migrated = (parsed as { migrated?: unknown })?.migrated;
+    if (migrated && typeof migrated === 'object' && !Array.isArray(migrated)) {
+      const out: Record<string, string> = {};
+      for (const [key, value] of Object.entries(migrated as Record<string, unknown>)) {
+        if (typeof value === 'string') out[key] = value;
+      }
+      return { migrated: out };
+    }
+  } catch {
+    // Corrupt marker → treat as "nothing migrated"; the path+hash guard still prevents
+    // duplicating any record that was already imported in a prior clean run.
+  }
+  return { migrated: {} };
+}
+
+function writeVibeImportMarker(path: string, marker: VibeImportMarker): void {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${JSON.stringify(marker, null, 2)}\n`, 'utf-8');
+}
+
+function hashVibeBody(body: string): string {
+  return createHash('sha256').update(body, 'utf-8').digest('hex');
+}
+
+/**
+ * Fold discovered VIBE.md files into persona/constraint records ONCE.
+ * Guarded by a persisted path→hash marker so it never re-imports the same file (which
+ * would create near-duplicate persona records). Called at boot AFTER memoryStore.init().
+ * Returns the number of records created this run (0 when everything is already migrated).
+ */
+export async function importVibeFilesIntoMemoryOnce(
+  memoryRegistry: MemoryRegistry,
+  shellPaths: AgentVibePaths,
+): Promise<number> {
+  const markerPath = vibeImportMarkerPath(shellPaths);
+  const marker = readVibeImportMarker(markerPath);
+  const snapshot = discoverVibeFiles(shellPaths);
+  let created = 0;
+  let changed = false;
+  for (const file of snapshot.files) {
+    const key = resolve(file.path);
+    const hash = hashVibeBody(file.body);
+    if (marker.migrated[key] === hash) continue; // already migrated this exact content
+    const scope: MemoryScope = file.scope === 'global' ? 'team' : 'project';
+    const name = file.frontmatter.name?.trim();
+    const options = vibeBodyToConstraintOptions(file.body, {
+      scope,
+      ...(name ? { name } : {}),
+      sourceRef: file.path,
+    });
+    for (const opts of options) {
+      await memoryRegistry.add(opts);
+      created += 1;
+    }
+    marker.migrated[key] = hash;
+    changed = true;
+  }
+  if (changed) writeVibeImportMarker(markerPath, marker);
+  return created;
+}
+
 export function formatVibeStatus(snapshot: AgentVibeSnapshot): string {
   const lines: string[] = [
     'GoodVibes Agent VIBE.md',

package/src/cli/local-library-command-shared.ts

@@ -7,7 +7,7 @@ import type { CliCommandRuntime } from './management.ts';
 /**
  * Shared prelude for the Agent-local library CLI commands (personas, skills,
  * skill bundles): option parsing, success/failure envelopes, and registry
- * accessors. Split out of local-library-command.ts (W4-H1 ruling: the file
+ * accessors. Split out of local-library-command.ts (the file
  * cleanly contained three independent command handlers glued together) so
  * personas-command.ts, skills-command.ts, and skill-bundle-command.ts can
  * share one option-parsing/output prelude without duplicating it.

package/src/cli/memory-command.ts

@@ -1,10 +1,10 @@
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
-import { createShellPathService } from '@/runtime/index.ts';
 import {
   MemoryEmbeddingProviderRegistry,
   MemoryRegistry,
   MemoryStore,
+  resolveCanonicalMemoryDbPath,
   type MemoryBundle,
   type MemoryClass,
   type MemoryLink,
@@ -18,7 +18,6 @@ import {
 } from '@pellux/goodvibes-sdk/platform/state';
 import { assertNoSecretLikeMemoryText } from '../agent/memory-safety.ts';
 import { formatAgentRecordReference, formatAgentRecordReviewState } from '../agent/record-labels.ts';
-import { GOODVIBES_AGENT_SURFACE_ROOT } from '../config/surface.ts';
 import type { CliCommandOutput } from './types.ts';
 import type { CliCommandRuntime } from './management.ts';
 
@@ -196,11 +195,15 @@ function timestamp(value: number): string {
   return new Date(value).toISOString().slice(0, 19).replace('T', ' ');
 }
 
+// The CLI no longer opens a private per-surface agent/memory.sqlite. It opens the
+// ONE canonical cross-surface store (~/.goodvibes/shared/memory.sqlite) so a memory
+// added via `goodvibes-agent memory add` is visible to the runtime, the TUI, and the
+// SDK — and vice-versa. The old CLI-written store is folded into the canonical store
+// (loss-free, idempotent) by the runtime's foldAgentLegacyMemory at boot, since that
+// fold already sources shellPaths.resolveUserPath('agent', 'memory.sqlite') — the exact
+// path this function used to write to.
 function memoryDbPath(runtime: CliCommandRuntime): string {
-  return createShellPathService({
-    workingDirectory: runtime.workingDirectory,
-    homeDirectory: runtime.homeDirectory,
-  }).resolveUserPath(GOODVIBES_AGENT_SURFACE_ROOT, 'memory.sqlite');
+  return resolveCanonicalMemoryDbPath(runtime.homeDirectory);
 }
 
 async function withMemory<T>(runtime: CliCommandRuntime, fn: (context: MemoryContext) => Promise<T> | T): Promise<T> {

package/src/cli/resume-relaunch-notice.ts

@@ -1,7 +1,7 @@
 import type { SessionManager } from '@pellux/goodvibes-sdk/platform/sessions';
 
 /**
- * RESUME-ON-RELAUNCH (W4-A4).
+ * RESUME-ON-RELAUNCH.
  *
  * The dogfood finding: relaunching the agent after a normal (non-crash) exit
  * silently starts fresh with no offer or notice about the prior session — the

package/src/cli/tui-startup.ts

@@ -116,7 +116,7 @@ export function applyInitialTuiCliState(options: {
     // Normal relaunch: onboarding is done and the user didn't ask for
     // onboarding or an explicit `sessions resume`. Surface an honest,
     // non-blocking resume affordance instead of silently starting fresh
-    // (the W4-A4 dogfood finding) — never auto-resume, declining is
+    // (a dogfood finding) — never auto-resume, declining is
     // frictionless (just start typing).
     surfaceResumeRelaunchNotice({
       getLastSessionPointer: () => readLastSessionPointer({

package/src/config/credential-status.ts

@@ -0,0 +1,165 @@
+/**
+ * credential-status.ts — client-side, secret-FREE credential STATUS read.
+ *
+ * When GoodVibes Agent acts as a CLIENT of an adopted
+ * external daemon, it reads credential *status* (configured / usable) from the
+ * daemon's shared store over the wire — the `credentials.get` operator method
+ * (GET /config/credentials, admin + read:config). It NEVER receives raw secret
+ * bytes: the wire contract (CREDENTIALS_SNAPSHOT_SCHEMA) carries status metadata
+ * only. This is a VISIBILITY path, not secret transport.
+ *
+ * Host-vs-client (see the SDK decision record 2026-07-06-config-sharing): a surface
+ * that IS the daemon host reads its own local SecretsManager directly (no wire hop —
+ * src/config/secrets.ts). A surface acting as a daemon client reads STATUS here.
+ * Secret RESOLUTION (the value provider auth needs) always stays local/env; only the
+ * status read moves to the daemon path.
+ *
+ * The degrade contract mirrors goodvibes-webui v1.0.1 `deriveCredentialAvailability`
+ * exactly: a 503 CREDENTIAL_STORE_UNAVAILABLE (by machine code), a METHOD_NOT_FOUND
+ * from an older daemon, or any transport failure yields an honest reason-carrying
+ * `available: false` — NEVER a fabricated "configured", NEVER a surfaced secret byte.
+ */
+
+/** One credential's status metadata from the daemon's shared store — never bytes. */
+export interface CredentialStatusEntry {
+  readonly key: string;
+  readonly configured: boolean;
+  readonly usable: boolean;
+  readonly source?: string;
+  readonly scope?: string;
+  readonly secure?: boolean;
+  readonly overriddenByEnv?: boolean;
+  readonly refSource?: string;
+}
+
+export type CredentialAvailability =
+  | { readonly available: true; readonly credentials: readonly CredentialStatusEntry[] }
+  | { readonly available: false; readonly reason: string };
+
+/** Minimal connection shape for the daemon-client status read. */
+export interface CredentialStatusConnection {
+  readonly baseUrl: string;
+  readonly token: string | null;
+}
+
+type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
+
+const CREDENTIALS_ROUTE = '/config/credentials';
+const CREDENTIAL_STATUS_TIMEOUT_MS = 1500;
+
+function asRecord(value: unknown): Record<string, unknown> | null {
+  return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : null;
+}
+
+function firstString(record: Record<string, unknown>, keys: readonly string[]): string {
+  for (const key of keys) {
+    const item = record[key];
+    if (typeof item === 'string' && item.trim()) return item;
+  }
+  return '';
+}
+
+/**
+ * Fold a `credentials.get` outcome into an honest availability value. Pure — this is
+ * the exact degrade contract mirrored from webui v1.0.1: keyed on the MACHINE CODE, it
+ * never fabricates "configured" and never carries a secret value. A malformed body (no
+ * credentials array) is treated as unavailable, not silently empty-but-configured.
+ */
+export function deriveCredentialAvailability(
+  outcome: { ok: true; value: unknown } | { ok: false; error: unknown },
+): CredentialAvailability {
+  if (!outcome.ok) {
+    const err = asRecord(outcome.error);
+    const code = err ? firstString(err, ['code']) : '';
+    if (code === 'CREDENTIAL_STORE_UNAVAILABLE') {
+      return { available: false, reason: 'The daemon has no shared credential store wired.' };
+    }
+    if (code === 'METHOD_NOT_FOUND' || code === 'NOT_INVOKABLE') {
+      return { available: false, reason: 'This daemon does not serve credential status yet.' };
+    }
+    return { available: false, reason: 'Credential status unavailable right now.' };
+  }
+  const value = asRecord(outcome.value);
+  const raw = value?.credentials;
+  if (!Array.isArray(raw)) return { available: false, reason: 'Credential status unavailable right now.' };
+  const credentials: CredentialStatusEntry[] = [];
+  for (const item of raw) {
+    const rec = asRecord(item);
+    const key = rec ? firstString(rec, ['key']) : '';
+    if (!rec || !key) continue;
+    credentials.push({
+      key,
+      configured: rec.configured === true,
+      usable: rec.usable === true,
+      source: firstString(rec, ['source']) || undefined,
+      scope: firstString(rec, ['scope']) || undefined,
+      secure: rec.secure === true ? true : rec.secure === false ? false : undefined,
+      overriddenByEnv: rec.overriddenByEnv === true ? true : rec.overriddenByEnv === false ? false : undefined,
+      refSource: firstString(rec, ['refSource']) || undefined,
+    });
+  }
+  return { available: true, credentials };
+}
+
+/**
+ * Extract the machine code from a non-2xx daemon response body, falling back to the
+ * HTTP status for legacy daemons that predate the code field. A 404 with no code is
+ * treated as METHOD_NOT_FOUND (older daemon without the route — same as webui's
+ * isMethodUnavailableError); a 503 with no code as CREDENTIAL_STORE_UNAVAILABLE.
+ */
+function machineCodeFromResponse(body: unknown, status: number): string {
+  const record = asRecord(body);
+  const direct = record ? firstString(record, ['code']) : '';
+  if (direct) return direct;
+  const nested = record ? asRecord(record.error) : null;
+  const nestedCode = nested ? firstString(nested, ['code']) : '';
+  if (nestedCode) return nestedCode;
+  if (status === 404) return 'METHOD_NOT_FOUND';
+  if (status === 503) return 'CREDENTIAL_STORE_UNAVAILABLE';
+  return '';
+}
+
+/**
+ * Read credential status from the connected daemon as a client, honestly degraded.
+ * Status only — the response is folded through {@link deriveCredentialAvailability},
+ * so a down store, an older daemon, an absent token, or a transport failure all become
+ * a reason-carrying `available: false`, never a fabricated "configured" and never a
+ * secret byte. `key` narrows to a single credential (the daemon's caller-named probe).
+ */
+export async function fetchDaemonCredentialAvailability(
+  connection: CredentialStatusConnection,
+  options: { readonly key?: string; readonly fetchImpl?: FetchLike } = {},
+): Promise<CredentialAvailability> {
+  if (!connection.token) {
+    return { available: false, reason: 'No connected-host operator token; credential status is unavailable.' };
+  }
+  const fetchImpl = options.fetchImpl ?? (globalThis.fetch as FetchLike | undefined);
+  if (!fetchImpl) {
+    return { available: false, reason: 'Credential status unavailable right now.' };
+  }
+  const query = options.key ? `?key=${encodeURIComponent(options.key)}` : '';
+  const url = `${connection.baseUrl}${CREDENTIALS_ROUTE}${query}`;
+  try {
+    const response = await fetchImpl(url, {
+      method: 'GET',
+      headers: { authorization: `Bearer ${connection.token}` },
+      signal: AbortSignal.timeout(CREDENTIAL_STATUS_TIMEOUT_MS),
+    });
+    const text = await response.text();
+    let body: unknown = text;
+    try {
+      body = text.trim() ? JSON.parse(text) as unknown : {};
+    } catch {
+      body = text;
+    }
+    if (!response.ok) {
+      return deriveCredentialAvailability({
+        ok: false,
+        error: { code: machineCodeFromResponse(body, response.status), status: response.status },
+      });
+    }
+    return deriveCredentialAvailability({ ok: true, value: body });
+  } catch (error) {
+    return deriveCredentialAvailability({ ok: false, error });
+  }
+}

package/src/config/index.ts

@@ -55,3 +55,15 @@ export function getConfiguredSystemPrompt(configManager: Pick<ConfigManager, 'ge
 }
 
 export { getConfiguredApiKeys, resolveApiKeys } from '@pellux/goodvibes-sdk/platform/config';
+
+// The daemon-client credential STATUS read (secret-free, honest-degrade).
+// Value reads above stay local/env; only the status VISIBILITY path moves to the daemon.
+export {
+  deriveCredentialAvailability,
+  fetchDaemonCredentialAvailability,
+} from './credential-status.ts';
+export type {
+  CredentialAvailability,
+  CredentialStatusConnection,
+  CredentialStatusEntry,
+} from './credential-status.ts';

package/src/config/secrets.ts

@@ -16,6 +16,23 @@ import {
 import { isSecretRefInput } from '@pellux/goodvibes-sdk/platform/config';
 import { GOODVIBES_AGENT_SURFACE_ROOT } from './surface.ts';
 
+// Host-vs-client split: this SecretsManager is the LOCAL-HOST
+// read path — pinned to GOODVIBES_AGENT_SURFACE_ROOT, it resolves secret VALUES from the
+// surface store/env for provider auth, unchanged. When the Agent acts as a CLIENT of an
+// adopted external daemon, credential *status* (configured/usable — never bytes) is read
+// over the wire via ./credential-status.ts (`fetchDaemonCredentialAvailability`), which
+// degrades honestly and never fabricates "configured". Only STATUS visibility moves to
+// the daemon path; value resolution stays here, local and env-only for API keys.
+export {
+  deriveCredentialAvailability,
+  fetchDaemonCredentialAvailability,
+} from './credential-status.ts';
+export type {
+  CredentialAvailability,
+  CredentialStatusConnection,
+  CredentialStatusEntry,
+} from './credential-status.ts';
+
 export type SecretsManagerOptions = Omit<SdkSecretsManagerOptions, 'surfaceRoot'>;
 
 const RAW_SECRET_LITERAL_PREFIX = '__GOODVIBES_LITERAL_V1__';

package/src/core/conversation-rendering.ts

@@ -123,8 +123,8 @@ export function renderConversationAssistantMessage(
     // `numWidth=6` (fits 999,999 lines, but wastes 3-4 gutter columns on typical
     // messages) or rendering the numbered output into a scratch buffer and trimming.
     // Neither is clearly better than the current two-pass measurement approach.
-    // The 4α commit message claim that this "eliminates double-parse when line
-    // numbers are enabled" was inaccurate: 4α eliminated the legacy
+    // An earlier commit message's claim that this "eliminates double-parse when line
+    // numbers are enabled" was inaccurate: that commit eliminated the legacy
     // `renderMarkdown()` duplicate used for code-block line-number mode ('code').
     // The 'all' mode double-call is a deliberate design choice and remains unchanged.
     const measureWidth = showAllLineNumbers ? width : 0;

package/src/core/system-message-noise.ts

@@ -9,7 +9,7 @@
  * Ported from the TUI (src/core/system-message-noise.ts). The TUI regexes are
  * kept VERBATIM (provider-replay fold / agents-snapshot drop / stale-replay
  * drop); the only agent-specific addition is the `[Terminal] Captured …` rule
- * (W4-R2, absorbing A8 papercut #3 — the stdout-capture leak). Dropped noise is
+ * (the stdout-capture leak). Dropped noise is
  * drop-from-the-feed, NOT delete: the captured-write detail stays reachable via
  * the activity log (the terminal-output guard logs each intercept + the count).
  */
@@ -46,7 +46,7 @@ const REPLAY_CHAIN_RE = /WRFC chain (\S+) transitioned .* waiting for action/;
 
 /**
  * Matches the terminal-output guard's aggregate captured-write notice
- * (W4-R2, agent-specific). First-run plumbing writes a burst of direct stdout
+ * (agent-specific). First-run plumbing writes a burst of direct stdout
  * that the guard intercepts and would otherwise summarize into the Recent feed;
  * the count stays reachable in the activity log, so the feed copy is dropped.
  */
@@ -57,7 +57,7 @@ const TERMINAL_CAPTURED_RE = /^\[Terminal\] Captured \d+ direct /;
  * lookup, so it is trivially testable.
  */
 export function classifyNoise(message: string, deps: NoiseGateDeps): NoiseVerdict {
-  // agent (W4-R2) — the terminal-output guard's aggregate captured-write notice.
+  // Agent-specific — the terminal-output guard's aggregate captured-write notice.
   // Kept out of the Recent feed; the detail stays in the activity log.
   if (TERMINAL_CAPTURED_RE.test(message)) {
     return DROP;

package/src/core/thinking-overlay.ts

@@ -1,5 +1,5 @@
 /**
- * thinking-overlay.ts (W4-R4) — the thinking-indicator overlay + its honest
+ * thinking-overlay.ts — the thinking-indicator overlay + its honest
  * stall clock, extracted from main.ts's render loop.
  *
  * The SDK orchestrator surfaces no lastDeltaAtMs / reconnect signal directly, so

package/src/input/agent-workspace-basic-command-editor-submission.ts

@@ -42,7 +42,7 @@ function unconfirmed(editor: AgentWorkspaceLocalEditor, message: string, status:
 /**
  * The submission data table for the kinds this module builds itself (delegate-task and
  * workplan/notify/secret/profile kinds keep dispatching to their own sibling submission
- * modules below, unchanged). W4-H2: split out of the single ~570-line
+ * modules below, unchanged). Split out of the single ~570-line
  * `buildAgentWorkspaceBasicCommandEditorSubmission` if-chain, mirroring the
  * construction-side split in agent-workspace-basic-command-editors.ts.
  */

package/src/input/agent-workspace-basic-command-editors.ts

@@ -127,7 +127,7 @@ function modelPinUnpinSpec(kind: AgentWorkspaceBasicOwnCommandEditorKind): Agent
 
 /**
  * The field-spec data table for the kinds this module builds itself (the rest are
- * delegated to sibling domain modules above). W4-H2: split out of the single
+ * delegated to sibling domain modules above). Split out of the single
  * ~600-line `createAgentWorkspaceBasicCommandEditor` if-chain into a data table, the
  * same shape used by every other agent-workspace command-editor domain.
  */

package/src/input/agent-workspace-calendar-connect-editor.ts

@@ -1,5 +1,5 @@
 /**
- * Calendar connect card (W4-A5) — promotes the "Calendar workflows" workspace
+ * Calendar connect card — promotes the "Calendar workflows" workspace
  * card from a dead guidance card into a real, dispatchable action.
  *
  * GROUNDED: unlike email, there is no external calendar account/CalDAV

package/src/input/agent-workspace-calendar-oauth-editor.ts

@@ -1,5 +1,5 @@
 /**
- * Calendar OAuth advanced-credentials wizard (W4-A10).
+ * Calendar OAuth advanced-credentials wizard.
  *
  * The DEFAULT connect experience needs no card at all: `/calendar connect google`
  * (or `outlook`) uses the bundled project client id + PKCE and opens the browser.

package/src/input/agent-workspace-calendar-subscribe-editor.ts

@@ -1,5 +1,5 @@
 /**
- * Calendar subscribe wizard (W4-A9) — the "Calendar workflows" card's real
+ * Calendar subscribe wizard — the "Calendar workflows" card's real
  * connect flow. Subscribes to an external calendar by its iCalendar feed URL
  * (Google "secret address", Outlook published .ics, or any .ics URL), READ-ONLY.
  *

package/src/input/agent-workspace-command-editor-engine.ts

@@ -9,8 +9,8 @@
 // one place. Each domain keeps its own field content and command-building logic
 // (real product value, not boilerplate) as entries in a `Record<Kind, ...>` table.
 //
-// W4-H2 (Wave 4): consolidates the ~26 near-identical editor+submission file pairs
-// identified by the W4-H1 design ruling into this engine + per-domain data tables.
+// Consolidates the ~26 near-identical editor+submission file pairs
+// identified by an earlier design ruling into this engine + per-domain data tables.
 import type { AgentWorkspaceActionResult, AgentWorkspaceEditorField, AgentWorkspaceEditorKind, AgentWorkspaceLocalEditor } from './agent-workspace-types.ts';
 import { quoteSlashCommandArg } from './slash-command-parser.ts';
 

package/src/input/agent-workspace-direct-editor-submission.ts

@@ -4,7 +4,7 @@
  * generic command-editor dispatch pipeline (agent-workspace-command-editor.ts).
  * Centralizing the dispatch here keeps AgentWorkspace.submitLocalEditor()
  * under the architecture line cap as new direct-action editor kinds are
- * added (W4-A5 added email-connect-wizard alongside the existing
+ * added (email-connect-wizard alongside the existing
  * subscription-login-start/finish/logout kinds).
  */
 import type { CommandContext } from './command-registry.ts';

package/src/input/agent-workspace-email-connect-editor.ts

@@ -1,5 +1,5 @@
 /**
- * Email connect wizard (W4-A5) — promotes the "Inbox workflows" workspace
+ * Email connect wizard — promotes the "Inbox workflows" workspace
  * card from a dead guidance card into a real, stepped connect flow.
  *
  * Security: the raw password NEVER travels through the generic slash-command

package/src/input/agent-workspace-live-counters.ts

@@ -10,7 +10,7 @@ export interface SyncAgentWorkspaceLiveCountersOptions {
 }
 
 /**
- * Quiet, render-path refresh of the two counters the W4-A6 dogfood finding
+ * Quiet, render-path refresh of the two counters a dogfood finding
  * named as stale: the memory count and the routine counts (incl. each
  * routine's live start count). Call this once per repaint, before rendering,
  * so an external disk mutation (another shell deleting a memory, a CLI