@pellux/goodvibes-agent 1.8.0 → 1.8.2

package/src/permissions/approval-posture.ts

@@ -15,6 +15,13 @@ import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
  *      automatically, before permissions.mode is even read.
  *   2. permissions.mode === 'allow-all' -> every tool call is approved
  *      automatically.
+ *   2a. permissions.mode === 'plan' -> read-only tools are allowed; every
+ *       write, execute, or delegate tool call is REFUSED outright (not
+ *       asked) with a structured plan-mode denial, steering the model to
+ *       present a plan instead of acting.
+ *   2b. permissions.mode === 'accept-edits' -> read and file write/edit
+ *       tool calls are approved automatically; execute and every other
+ *       risky class still fall through to the prompt/cache path below.
  *   3. permissions.mode === 'custom' -> each tool category is allowed,
  *      prompted, or denied per its own configured rule; bypassesPrompts is
  *      true only when EVERY configured tool category resolves to 'allow'
@@ -26,10 +33,16 @@ import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
  * computeApprovalPosture (or the config-reading convenience below) rather
  * than re-deriving the precedence locally — that re-derivation is exactly
  * how cli/status.ts drifted from the gate (it read permissions.mode alone
- * and never looked at behavior.autoApprove).
+ * and never looked at behavior.autoApprove). It is also how 'plan' and
+ * 'accept-edits' modes previously drifted: normalizeMode used to fold any
+ * mode it did not recognize into 'prompt', so a surface reading the posture
+ * label for those two modes silently mislabeled them as "Ask before
+ * powerful actions" — wrong for plan mode (which never asks; it refuses)
+ * and wrong for accept-edits mode (which auto-approves file writes without
+ * asking).
  */
 
-export type ApprovalPostureKind = 'auto-approve' | 'allow-all' | 'custom' | 'prompt';
+export type ApprovalPostureKind = 'auto-approve' | 'allow-all' | 'custom' | 'prompt' | 'plan' | 'accept-edits';
 
 export interface ApprovalPostureInput {
   /** behavior.autoApprove, read via the SDK's isAutoApproveEnabled (or an equivalent duck-typed read). */
@@ -48,7 +61,7 @@ export interface ApprovalPosture {
   /** Which precedence branch produced this posture. */
   readonly kind: ApprovalPostureKind;
   /** The raw permissions.mode value, normalized to a known mode string (defaults to 'prompt'). */
-  readonly mode: 'prompt' | 'allow-all' | 'custom';
+  readonly mode: 'prompt' | 'allow-all' | 'custom' | 'plan' | 'accept-edits';
   /** The raw behavior.autoApprove value that drove this posture. */
   readonly autoApprove: boolean;
   /**
@@ -63,8 +76,8 @@ export interface ApprovalPosture {
   readonly detail: string;
 }
 
-function normalizeMode(mode: unknown): 'prompt' | 'allow-all' | 'custom' {
-  if (mode === 'allow-all' || mode === 'custom') return mode;
+function normalizeMode(mode: unknown): 'prompt' | 'allow-all' | 'custom' | 'plan' | 'accept-edits' {
+  if (mode === 'allow-all' || mode === 'custom' || mode === 'plan' || mode === 'accept-edits') return mode;
   return 'prompt';
 }
 
@@ -98,6 +111,28 @@ export function computeApprovalPosture(input: ApprovalPostureInput): ApprovalPos
     };
   }
 
+  if (mode === 'plan') {
+    return {
+      kind: 'plan',
+      mode,
+      autoApprove: false,
+      bypassesPrompts: false,
+      label: 'Plan mode — read-only, nothing prompts because nothing mutates',
+      detail: 'permissions.mode is plan: read-only tool calls are approved automatically; every write, execute, or delegate tool call is refused outright (never asked) so the model presents a plan instead of acting.',
+    };
+  }
+
+  if (mode === 'accept-edits') {
+    return {
+      kind: 'accept-edits',
+      mode,
+      autoApprove: false,
+      bypassesPrompts: false,
+      label: 'Accept edits — file writes auto-approve, execute/delegate still ask',
+      detail: 'permissions.mode is accept-edits: read and file write/edit tool calls are approved automatically without asking; execute and every other risky class still prompt for approval.',
+    };
+  }
+
   if (mode === 'custom') {
     const values = Object.values(input.customTools ?? {});
     const allAllow = values.length > 0 && values.every((value) => value === 'allow');

package/src/permissions/prompt.ts

@@ -30,10 +30,35 @@ export class PermissionPromptUI {
     };
   }
 
+  /**
+   * "Who is asking" line for the two attribution kinds (SDK 1.6.1) that have
+   * no OTHER rendered channel for it. `background-agent` attribution is
+   * deliberately excluded here: it already flows into the fleet
+   * ProcessRegistry via `metadata.agentId` (see
+   * bootstrap-core.ts's approvalMetadataForRequest), so a spawned agent's
+   * pending ask is attributed on its own ProcessNode. An MCP server
+   * elicitation or a sandbox host-access escalation has no ProcessNode to
+   * attach to — this prompt is the ONLY place a user learns who/what is
+   * asking, so those two kinds render an explicit line. Returns null for
+   * `background-agent` and for no-attribution (foreground) requests.
+   */
+  private static attributionLine(request: PermissionPromptRequest): string | null {
+    const attribution = request.attribution;
+    if (!attribution) return null;
+    if (attribution.kind === 'mcp-server') {
+      return `MCP server: ${attribution.serverName}`;
+    }
+    if (attribution.kind === 'sandbox-escalation') {
+      return `Sandbox ${attribution.sandbox}: ${attribution.escalations.join(', ')}`;
+    }
+    return null;
+  }
+
   static getPromptHeight(request: PermissionPromptRequest): number {
     const analysis = this.fallbackAnalysis(request);
     const reasonLines = Math.min(2, Math.max(1, analysis.reasons.length));
-    const extraLines = (analysis.host ? 1 : 0) + (analysis.surface ? 1 : 0) + (analysis.sideEffects && analysis.sideEffects.length > 0 ? 1 : 0);
+    const extraLines = (analysis.host ? 1 : 0) + (analysis.surface ? 1 : 0) + (analysis.sideEffects && analysis.sideEffects.length > 0 ? 1 : 0)
+      + (this.attributionLine(request) ? 1 : 0);
     return 12 + reasonLines + extraLines;
   }
 
@@ -89,6 +114,15 @@ export class PermissionPromptUI {
     const toolLine = `   Tool      : ${tool}`;
     lines.push(UIFactory.stringToLine(toolLine.padEnd(width), width, { fg: TEXT }));
 
+    // Attribution row (mcp-server / sandbox-escalation only — see attributionLine's doc comment)
+    const attributionText = this.attributionLine(request);
+    if (attributionText) {
+      const maxAttrLen = Math.max(10, width - 16);
+      const truncatedAttr = attributionText.length > maxAttrLen ? `${attributionText.slice(0, maxAttrLen - 3)}...` : attributionText;
+      const attributionRow = `   Asked by  : ${truncatedAttr}`;
+      lines.push(UIFactory.stringToLine(attributionRow.padEnd(width), width, { fg: DIM }));
+    }
+
     // Key argument row - truncate if too long
     const maxArgLen = Math.max(10, width - 16);
     const truncatedArg = displayArg.length > maxArgLen

package/src/renderer/settings-modal-helpers.ts

@@ -82,15 +82,18 @@ export const CATEGORY_LABELS: Record<(typeof SETTINGS_CATEGORIES)[number], strin
   behavior: 'Behavior',
   storage: 'Storage',
   permissions: 'Permissions',
+  diagnostics: 'Diagnostics',
   helper: 'Helper',
   tts: 'TTS',
   automation: 'Automation',
+  checkin: 'Check-in',
   service: 'Service',
   controlPlane: 'Control Plane',
   httpListener: 'HTTP Listener',
   web: 'Web',
   watchers: 'Watchers',
   network: 'Network',
+  relay: 'Relay',
   orchestration: 'Orchestration',
   planner: 'Planner',
   daemon: 'Daemon',
@@ -106,6 +109,14 @@ export const CATEGORY_LABELS: Record<(typeof SETTINGS_CATEGORIES)[number], strin
   release: 'Update Channel',
   tools: 'Tools',
   flags: 'Feature Controls',
+  atRest: 'At-Rest Protection',
+  learning: 'Memory Consolidation',
+  agents: 'Agent Runtime',
+  notifications: 'Notifications',
+  policy: 'Policy Bundles',
+  fetch: 'Fetch Safety',
+  security: 'Token Rotation',
+  integrations: 'Delivery Reliability',
 };
 
 export const SETTING_LABELS: Partial<Record<string, string>> = {

package/src/renderer/settings-modal.ts

@@ -31,15 +31,18 @@ const CATEGORY_INFO: Record<SettingsCategory, string> = {
   behavior: 'Day-to-day shell behavior: approval posture, compaction, history, guidance, notifications, stale-context warnings, return context, and Human-in-the-Loop mode.',
   storage: 'Local storage posture, including secret storage policy and maximum artifact size for Agent Knowledge, artifacts, and document ingestion.',
   permissions: 'Permission mode and tool-class policy. These settings decide whether the shell prompts before read/write/exec/network/agent actions.',
+  diagnostics: 'Post-edit diagnostics behavior: whether a successful file write/edit gets cheap, in-process syntax diagnostics appended to the tool result so the model sees a broken edit immediately. Syntax-level only — not type-checking.',
   helper: 'Helper model defaults used by helper subsystems when they do not use the main chat route.',
   tts: 'Text-to-speech provider, voice, and optional spoken-turn LLM overrides.',
   automation: 'Scheduled and automated run settings, concurrency, timeout, catch-up, cooldown, and retention behavior.',
+  checkin: 'Proactive check-in: off by default. When enabled, on a cadence the Agent assembles a compact briefing of current state, asks the model to judge whether anything warrants contacting you, and delivers a message through the configured channel only when the judgment says yes. Every run — delivered, quiet, skipped for quiet hours, or errored — leaves a receipt (checkin.receipts.list) so this automatic behavior stays accountable even when it decides to say nothing.',
   service: 'GoodVibes daemon service posture and restart/autostart preferences.',
   controlPlane: 'Control-plane endpoint, stream, remote access, and TLS settings used by daemon-backed operator routes.',
   httpListener: 'HTTP listener binding, trust proxy, and TLS settings for inbound companion/channel routes.',
   web: 'Web companion surface settings including host, port, public URL, and static asset path.',
   watchers: 'Polling watcher and heartbeat behavior for runtime recovery and periodic checks.',
   network: 'Outbound TLS and remote fetch network policy.',
+  relay: 'Outbound zero-knowledge relay reachability for the connected GoodVibes daemon: an end-to-end encrypted tunnel (ECDH P-256 -> HKDF -> AES-256-GCM) that terminates INSIDE the daemon, so the relay operator only ever sees ciphertext plus connection metadata (who paired with whom, byte counts, timing) — never plaintext requests, responses, or the operator token. Default off, and gated by the relay-connect feature flag in addition to relay.enabled. These are the connected daemon\'s own settings (imported here, not live-shared): changing them in Agent does not itself start or stop the daemon\'s relay registration.',
   orchestration: 'Visible agent orchestration limits such as recursion and active-agent caps.',
   planner: 'Planning-decomposition agent limits: decomposition strategy, max turns, token ceiling, and wall-clock timeout before falling back to the deterministic heuristic path.',
   daemon: 'Whether the local session daemon runs, and whether it is embedded in this surface process instead of spawned as a detached background service.',
@@ -55,6 +58,14 @@ const CATEGORY_INFO: Record<SettingsCategory, string> = {
   release: 'Update-channel preference.',
   tools: 'Tool LLM and helper model routing. Empty provider/model values inherit the active chat route unless a specific helper/tool route is set.',
   flags: 'Feature controls for optional behavior that can be enabled or disabled separately from normal configuration.',
+  atRest: 'Data-at-rest protection: whether stored content is redacted, and retention limits by age and total size.',
+  learning: 'Idle-time memory consolidation: dedupe merges, confidence decay of never-referenced records, and review proposals. Off by default.',
+  agents: 'Agent runtime tuning: the context-window fraction that triggers sub-agent conversation compaction, and the token budget, relevance floor, and code-chunk limit for per-turn passive knowledge/code injection.',
+  notifications: 'Adaptive notification-burst suppression: the observation window, trip threshold, and cooldown that collapse a rapid run of same-domain notifications to panel-only. Critical/milestone/alert notifications are always exempt.',
+  policy: 'Policy-as-code bundle loading: where the policy registry loads its initial bundle from at startup, and the file path when loading from disk. A loaded bundle is a candidate subject to the divergence gate before promotion.',
+  fetch: 'Fetch-tool response sanitization: the default sanitize mode, and default trusted/blocked host lists layered under any per-call overrides. The built-in SSRF-risk block applies independently.',
+  security: 'Credential rotation-audit defaults: how often tokens should rotate, how much lead time a warning gets, and whether overdue or over-scoped tokens are blocked from use rather than only reported.',
+  integrations: 'Integration delivery reliability: retry ceiling and exponential-backoff bounds for Slack/Discord/webhook delivery, dead-letter queue size, and whether dead-letter events log at error level.',
 };
 
 const ENUM_VALUE_DESCRIPTIONS: Record<string, Record<string, string>> = {
@@ -72,6 +83,16 @@ const ENUM_VALUE_DESCRIPTIONS: Record<string, Record<string, string>> = {
     prompt: 'Ask before powerful or risky actions according to tool policy.',
     'allow-all': 'Allow actions without prompting. This is fast but removes an important safety gate.',
     custom: 'Use per-tool-class permission settings from the rows below.',
+    plan: 'Read-only: every write, execute, or delegate tool call is refused outright (never asked) so the model presents a plan instead of acting.',
+    'accept-edits': 'File write/edit tool calls auto-approve without asking; execute and every other risky class still prompt for approval.',
+  },
+  'permissions.backgroundAgents': {
+    inherit: 'Background/subagent tool calls consult the same session permission mode as the foreground turn — prompt/plan/accept-edits/custom apply their matrices, and any resulting ask still brokers through the normal approval prompt with subagent attribution.',
+    'allow-all': 'Background/subagent tool calls are exempt from the session permission mode and auto-approve regardless of it.',
+  },
+  'diagnostics.postEdit': {
+    on: 'After a successful file write/edit, append cheap, in-process syntax diagnostics (errors only) to the tool result. Syntax-level only — not type-checking.',
+    off: 'Never append post-edit diagnostics to write/edit tool results.',
   },
   'storage.secretPolicy': {
     preferred_secure: 'Use secure secret storage when available, with supported fallback behavior.',

package/src/renderer/terminal-escapes.ts

@@ -4,22 +4,75 @@
  * focus reporting). Extracted as plain constants so callers share one definition
  * and the entry file stays within the source-file line-count gate.
  *
+ * ALT_SCREEN_ENTER / ALT_SCREEN_EXIT / MOUSE_* / CURSOR_* / KEYBOARD_EXT_* /
+ * PASTE_* / CLEAR_VIEWPORT_HOME: re-exported byte-for-byte from
+ * @pellux/goodvibes-terminal-shell's TERMINAL_ESCAPES so this app and the TUI
+ * cannot drift on the bytes (mechanical swap from a previously-inlined local
+ * copy — see main.ts history and the package's terminal-lifecycle module docs).
+ *
+ * There used to be a local CLEAR_SCREEN constant here that appended ESC[3J
+ * (scrollback erase) after ESC[2J. That sequence must never be written by this
+ * app: 3J wipes the user's PRIMARY-screen scrollback on several emulators even
+ * when issued mid-session or from the alt screen, and main.ts's exit teardown
+ * was doing exactly that. CLEAR_VIEWPORT_HOME (2J + cursor-home, no 3J) is the
+ * only clear this app ever writes now, for both the entry-time paint and the
+ * no-alt-screen restore path.
+ *
  * FOCUS_ENABLE / FOCUS_DISABLE (DECSET ?1004) are the shared home for the OS
  * window-focus reporting mode consumed by the focus-tracker: the focus-mode
  * module (shell/terminal-focus-mode.ts) imports FOCUS_ENABLE from here rather
- * than redefining it.
+ * than redefining it. The terminal-shell package does not define these, so
+ * they stay local literals.
  */
 
-export const ALT_SCREEN_ENTER = '\x1b[?1049h';
-export const ALT_SCREEN_EXIT = '\x1b[?1049l';
-export const MOUSE_ENABLE = '\x1b[?1000h\x1b[?1002h\x1b[?1006h';
-export const MOUSE_DISABLE = '\x1b[?1006l\x1b[?1002l\x1b[?1000l';
-export const CURSOR_HIDE = '\x1b[?25l';
-export const CURSOR_SHOW = '\x1b[?25h';
-export const CLEAR_SCREEN = '\x1b[2J\x1b[3J\x1b[H';
-export const KEYBOARD_EXT_ENABLE = '\x1b[>4;2m' + '\x1b[?1u';
-export const KEYBOARD_EXT_DISABLE = '\x1b[>4;0m' + '\x1b[?1l';
-export const PASTE_ENABLE = '\x1b[?2004h';
-export const PASTE_DISABLE = '\x1b[?2004l';
+import { TERMINAL_ESCAPES } from '@pellux/goodvibes-terminal-shell';
+
+export const ALT_SCREEN_ENTER = TERMINAL_ESCAPES.ALT_SCREEN_ENTER;
+export const ALT_SCREEN_EXIT = TERMINAL_ESCAPES.ALT_SCREEN_EXIT;
+export const MOUSE_ENABLE = TERMINAL_ESCAPES.MOUSE_ENABLE;
+export const MOUSE_DISABLE = TERMINAL_ESCAPES.MOUSE_DISABLE;
+export const CURSOR_HIDE = TERMINAL_ESCAPES.CURSOR_HIDE;
+export const CURSOR_SHOW = TERMINAL_ESCAPES.CURSOR_SHOW;
+export const KEYBOARD_EXT_ENABLE = TERMINAL_ESCAPES.KEYBOARD_EXT_ENABLE;
+export const KEYBOARD_EXT_DISABLE = TERMINAL_ESCAPES.KEYBOARD_EXT_DISABLE;
+export const PASTE_ENABLE = TERMINAL_ESCAPES.PASTE_ENABLE;
+export const PASTE_DISABLE = TERMINAL_ESCAPES.PASTE_DISABLE;
+/** Clear viewport + home the cursor, WITHOUT ESC[3J. Never wipes scrollback. */
+export const CLEAR_VIEWPORT_HOME = TERMINAL_ESCAPES.CLEAR_VIEWPORT_HOME;
+
 export const FOCUS_ENABLE = '\x1b[?1004h';
 export const FOCUS_DISABLE = '\x1b[?1004l';
+
+/**
+ * The bytes main.ts writes to enter terminal mode: alt screen (unless
+ * disabled), clear + home (no 3J), cursor hidden, then the input modes.
+ */
+export function buildEnterSequence(noAltScreen: boolean): string {
+  return (noAltScreen ? '' : ALT_SCREEN_ENTER)
+    + CLEAR_VIEWPORT_HOME
+    + CURSOR_HIDE
+    + MOUSE_ENABLE
+    + KEYBOARD_EXT_ENABLE
+    + PASTE_ENABLE
+    + FOCUS_ENABLE;
+}
+
+/**
+ * The bytes main.ts writes to restore the terminal on exit: input modes off,
+ * then the screen switch, then cursor-show LAST so visibility applies to the
+ * screen the shell prompt actually lands on.
+ *
+ * Alt-screen path: just leave the alt screen — 1049l restores the primary
+ * screen and cursor exactly as they were at launch. Clearing first is
+ * pointless (the alt screen is discarded) and actively harmful (3J wipes the
+ * primary scrollback even when issued from the alt screen).
+ *
+ * No-alt path: the compositor painted over the primary screen, so clear the
+ * viewport and home the cursor — but WITHOUT 3J, the user's scrollback is
+ * theirs.
+ */
+export function buildExitSequence(noAltScreen: boolean): string {
+  const exitScreen = noAltScreen ? CLEAR_VIEWPORT_HOME : ALT_SCREEN_EXIT;
+  return PASTE_DISABLE + KEYBOARD_EXT_DISABLE + MOUSE_DISABLE + FOCUS_DISABLE
+    + exitScreen + CURSOR_SHOW;
+}

package/src/runtime/agent-runtime-events.ts

@@ -1,8 +1,11 @@
 import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
 import type { ConversationFollowUpItem } from '@pellux/goodvibes-sdk/platform/core';
-import type { AgentManager } from '@pellux/goodvibes-sdk/platform/tools';
+import type { AgentManager, ToolRegistry } from '@pellux/goodvibes-sdk/platform/tools';
+import { logger } from '@pellux/goodvibes-sdk/platform/utils';
 import type {
   AgentEvent,
+  CompactionEvent,
+  PermissionEvent,
   ProviderEvent,
   RuntimeEventBus,
 } from '@/runtime/index.ts';
@@ -23,6 +26,7 @@ export interface AgentRuntimeEventBridgeOptions {
   readonly requestRender: () => void;
   readonly configManager: ConfigManager;
   readonly agentManager: AgentManager;
+  readonly toolRegistry: Pick<ToolRegistry, 'execute'>;
 }
 
 function withRouter(
@@ -37,6 +41,55 @@ function formatAgentTask(task: string): string {
   return task.length > 50 ? `${task.slice(0, 50)}...` : task;
 }
 
+/** Renders a COMPACTION_RECEIPT payload as a one-line honest summary: strategy, trigger, and outcome — with the fallback reason (`detail`) named when the compaction did not apply. */
+function formatCompactionReceipt(payload: Extract<CompactionEvent, { type: 'COMPACTION_RECEIPT' }>): string {
+  const { strategy, trigger, outcome, tokensBefore, tokensAfter, detail } = payload;
+  if (outcome === 'applied') {
+    const saved = Math.max(0, tokensBefore - tokensAfter);
+    return `${strategy} (${trigger}) applied — ${saved.toLocaleString()} tokens reclaimed`;
+  }
+  const reason = detail ? `: ${detail}` : '';
+  return `${strategy} (${trigger}) ${outcome}${reason}`;
+}
+
+interface ChildFailureEnvelopeLike {
+  readonly phase?: string;
+  readonly reason?: { readonly code?: string };
+  readonly partialOutputs?: { readonly note?: string; readonly turnsCompleted?: number };
+}
+
+/**
+ * Fetches the structured child-failure envelope the SDK's own `agent` tool
+ * attaches to its `status` action result (SDK 1.6.1, child-failure
+ * envelopes on the agent tool's status/get/wait results) and renders it as a
+ * compact suffix: `reason: <code>, phase: <phase>[, N turns completed][, note]`.
+ * Goes through `toolRegistry.execute` — the SAME tool the model calls —
+ * rather than re-deriving the classification locally: `classifyChildFailureReason`
+ * and `describeChildPhase` are internal to the SDK's tool module, not part of
+ * its public API, so calling the tool is the only faithful way to surface
+ * the real classification instead of guessing at it. Read-only, no side
+ * effects (see ToolRegistry.execute's own doc comment); returns null on any
+ * failure to look up the record or parse the result, so a fetch problem never
+ * blocks the (already-informative) base failure message.
+ */
+async function fetchChildFailureSummary(toolRegistry: Pick<ToolRegistry, 'execute'>, agentId: string): Promise<string | null> {
+  try {
+    const result = await toolRegistry.execute('agent-runtime-events:child-failure-envelope', 'agent', { mode: 'status', agentId });
+    if (!result.success || !result.output) return null;
+    const parsed = JSON.parse(result.output) as { failure?: ChildFailureEnvelopeLike };
+    const failure = parsed.failure;
+    if (!failure) return null;
+    const parts = [`reason: ${failure.reason?.code ?? 'error'}`];
+    if (failure.phase) parts.push(`phase: ${failure.phase}`);
+    if (failure.partialOutputs?.turnsCompleted !== undefined) parts.push(`${failure.partialOutputs.turnsCompleted} turns completed`);
+    if (failure.partialOutputs?.note) parts.push(failure.partialOutputs.note);
+    return parts.join(', ');
+  } catch (err) {
+    logger.debug('agent-runtime-events: child-failure envelope fetch failed (non-fatal)', { agentId, error: String(err) });
+    return null;
+  }
+}
+
 export function registerAgentRuntimeEvents(options: AgentRuntimeEventBridgeOptions): {
   unsubs: Array<() => void>;
   agentStatusIntervalRef: { value: ReturnType<typeof setInterval> | null };
@@ -48,6 +101,7 @@ export function registerAgentRuntimeEvents(options: AgentRuntimeEventBridgeOptio
     queueConversationFollowUp,
     requestRender,
     agentManager,
+    toolRegistry,
   } = options;
   const unsubs: Array<() => void> = [];
 
@@ -66,9 +120,46 @@ export function registerAgentRuntimeEvents(options: AgentRuntimeEventBridgeOptio
   unsubs.push(runtimeBus.onDomain('compaction', (env) => {
     domainDispatch.dispatchCompactionEvent(env.payload);
   }));
+  // The mandatory post-compaction receipt (SDK 1.6.1, emitted after every
+  // automatic and manual compaction path — see the SDK's own doc comment on
+  // emitCompactionReceipt) is the one compaction signal a user should never
+  // miss: system-message-router.ts's own tiering doc already names
+  // "compaction events" as 'high' priority (conversation + activity feed),
+  // but nothing routed COMPACTION_RECEIPT there before this — the domain
+  // subscription above only ever updated runtime-store session state, not a
+  // user-visible message. Surfaces strategy + outcome; when the compaction
+  // did not apply (kept-original/failed), `detail` carries the fallback
+  // reason so a silent revert is never actually silent.
+  unsubs.push(runtimeBus.on<Extract<CompactionEvent, { type: 'COMPACTION_RECEIPT' }>>('COMPACTION_RECEIPT', ({ payload }) => {
+    withRouter(getSystemMessageRouter, (router) => {
+      router.high(`[Compaction] ${formatCompactionReceipt(payload)}`);
+    });
+    requestRender();
+  }));
   unsubs.push(runtimeBus.onDomain('transport', (env) => {
     domainDispatch.dispatchTransportEvent(env.payload);
   }));
+  // Keep the session's stored permission-mode metadata live. The SDK emits
+  // PERMISSION_MODE_CHANGED on the 'permissions' domain whenever the
+  // permissions.mode config value changes (see emitPermissionModeChanged), but
+  // nothing consumed it before: the runtime store's permission domain was seeded
+  // once at boot and never advanced, so any surface reading the stored mode went
+  // stale until restart. Forwarding the domain event into the store reducer
+  // (dispatchPermissionEvent -> updatePermissionState) refreshes that stored
+  // metadata live from the wire event, and re-emitting it onto a remote surface's
+  // bus keeps cross-surface readers current too.
+  unsubs.push(runtimeBus.onDomain('permissions', (env) => {
+    domainDispatch.dispatchPermissionEvent(env.payload);
+  }));
+  // Make the mode change visible in-session the moment it lands, rather than
+  // only reflecting it the next time a surface happens to rebuild. The precise
+  // previous/next mode values ride the event, so the message states both.
+  unsubs.push(runtimeBus.on<Extract<PermissionEvent, { type: 'PERMISSION_MODE_CHANGED' }>>('PERMISSION_MODE_CHANGED', ({ payload }) => {
+    withRouter(getSystemMessageRouter, (router) => {
+      router.high(`[Permissions] Permission mode changed: ${payload.previousMode} -> ${payload.mode}.`);
+    });
+    requestRender();
+  }));
 
   unsubs.push(runtimeBus.on<Extract<ProviderEvent, { type: 'MODEL_FALLBACK' }>>('MODEL_FALLBACK', ({ payload }) => {
     withRouter(getSystemMessageRouter, (router) => {
@@ -102,8 +193,16 @@ export function registerAgentRuntimeEvents(options: AgentRuntimeEventBridgeOptio
     if (record && record.status !== 'cancelled') {
       const durationSeconds = record.completedAt !== undefined ? Math.round((record.completedAt - record.startedAt) / 1000) : 0;
       const taskSnippet = formatAgentTask(record.task);
-      withRouter(getSystemMessageRouter, (router) => {
-        router.low(`[Delegated task] ${record.template} ${payload.agentId.slice(-8)} failed in ${durationSeconds}s ${payload.error.slice(0, 80)}`);
+      // Compact child-failure envelope enrichment (SDK 1.6.1) — fetched via
+      // the SAME 'agent' tool the model calls, then appended to the base
+      // message. Deferred (async) rather than blocking this handler; no test
+      // or downstream consumer depends on this message landing synchronously
+      // with the AGENT_FAILED event.
+      void fetchChildFailureSummary(toolRegistry, payload.agentId).then((envelopeSummary) => {
+        withRouter(getSystemMessageRouter, (router) => {
+          router.low(`[Delegated task] ${record.template} ${payload.agentId.slice(-8)} failed in ${durationSeconds}s ${payload.error.slice(0, 80)}${envelopeSummary ? ` (${envelopeSummary})` : ''}`);
+        });
+        requestRender();
       });
       queueConversationFollowUp?.({
         key: `agent:${payload.agentId}:failed`,