@pellux/goodvibes-agent 1.8.0 → 1.8.2

package/src/cli/principals-command.ts

@@ -0,0 +1,230 @@
+import type { OperatorMethodInput, OperatorMethodOutput } from '@pellux/goodvibes-sdk/contracts';
+import {
+  formatOperatorGatewayFailure,
+  invokeOperatorGatewayMethod,
+} from '../agent/operator-gateway-call.ts';
+import { resolveAgentConnectedHostConnection } from '../agent/routine-schedule-promotion.ts';
+import {
+  operatorFlagValue,
+  operatorRequiredFlag,
+  parseIdentityPairs,
+  parseOperatorCommandArgs,
+} from './operator-command-args.ts';
+import type { CliCommandOutput } from './types.ts';
+import type { CliCommandRuntime } from './management.ts';
+import { appendTemporalLabel } from './temporal-label.ts';
+
+const PRINCIPALS_ROUTE = '/api/principals';
+const PRINCIPAL_ROUTE = '/api/principals/{principalId}';
+const PRINCIPALS_RESOLVE_ROUTE = '/api/principals/resolve';
+
+const PRINCIPALS_GET_USAGE = 'Usage: goodvibes-agent principals get <id>';
+const PRINCIPALS_CREATE_USAGE = 'Usage: goodvibes-agent principals create --name <name> --kind <user|bot|service|token> [--identity channel:value,channel:value] --yes';
+const PRINCIPALS_UPDATE_USAGE = 'Usage: goodvibes-agent principals update <id> [--name <name>] [--kind <user|bot|service|token>] [--identity channel:value,channel:value] --yes';
+const PRINCIPALS_DELETE_USAGE = 'Usage: goodvibes-agent principals delete <id> --yes';
+const PRINCIPALS_RESOLVE_USAGE = 'Usage: goodvibes-agent principals resolve --channel <channel> --value <value>';
+const PRINCIPALS_USAGE = 'Usage: goodvibes-agent principals [list|get <id>|create --name <name> --kind <user|bot|service|token> --yes|update <id> [--name ..] [--kind ..] --yes|delete <id> --yes|resolve --channel <channel> --value <value>]';
+
+const PRINCIPAL_KINDS = new Set(['user', 'bot', 'service', 'token']);
+
+type Principal = OperatorMethodOutput<'principals.list'>['principals'][number];
+type PrincipalKind = OperatorMethodInput<'principals.create'>['kind'];
+
+function jsonOrText(runtime: CliCommandRuntime, value: unknown, text: string): string {
+  return runtime.cli.flags.outputFormat === 'json' ? JSON.stringify(value, null, 2) : text;
+}
+
+function usageFailure(runtime: CliCommandRuntime, error: string): CliCommandOutput {
+  return {
+    output: jsonOrText(runtime, { ok: false, kind: 'invalid_principals_command', error }, error),
+    exitCode: 2,
+  };
+}
+
+function requirePrincipalKind(value: string, usage: string): PrincipalKind {
+  const normalized = value.trim().toLowerCase();
+  if (!PRINCIPAL_KINDS.has(normalized)) throw new Error(`${usage}\n--kind must be one of: user, bot, service, token.`);
+  return normalized as PrincipalKind;
+}
+
+function renderPrincipal(principal: Principal): string {
+  const identities = principal.identities.length > 0
+    ? principal.identities.map((identity) => `${identity.channel}:${identity.value}`).join(', ')
+    : '(none)';
+  return [
+    `Principal ${principal.id}`,
+    `  name ${principal.name}`,
+    `  kind ${principal.kind}`,
+    `  identities ${identities}`,
+    `  created ${appendTemporalLabel(new Date(principal.createdAt).toISOString(), principal.createdAt)}`,
+    `  updated ${appendTemporalLabel(new Date(principal.updatedAt).toISOString(), principal.updatedAt)}`,
+  ].join('\n');
+}
+
+function renderPrincipalLine(principal: Principal): string {
+  const identities = principal.identities.length > 0
+    ? principal.identities.map((identity) => `${identity.channel}:${identity.value}`).join(', ')
+    : '(none)';
+  return `  ${principal.id}  ${principal.kind.padEnd(8)} ${principal.name}  identities ${identities}`;
+}
+
+function renderPrincipalList(principals: readonly Principal[]): string {
+  if (principals.length === 0) {
+    return [
+      'Principals',
+      '  No principals registered yet.',
+      '  next goodvibes-agent principals create --name <name> --kind user --yes',
+    ].join('\n');
+  }
+  return [`Principals (${principals.length})`, ...principals.map(renderPrincipalLine)].join('\n');
+}
+
+async function handlePrincipalsList(runtime: CliCommandRuntime): Promise<CliCommandOutput> {
+  const connection = resolveAgentConnectedHostConnection(runtime.configManager, runtime.homeDirectory);
+  const result = await invokeOperatorGatewayMethod<OperatorMethodOutput<'principals.list'>>(connection, 'principals.list', PRINCIPALS_ROUTE, {});
+  if (!result.ok) {
+    return { output: jsonOrText(runtime, result, formatOperatorGatewayFailure(result)), exitCode: 1 };
+  }
+  return { output: jsonOrText(runtime, result, renderPrincipalList(result.data.principals)), exitCode: 0 };
+}
+
+async function handlePrincipalsGet(runtime: CliCommandRuntime, args: readonly string[]): Promise<CliCommandOutput> {
+  const parsed = parseOperatorCommandArgs(args);
+  const principalId = parsed.positionals[0];
+  if (!principalId) return usageFailure(runtime, PRINCIPALS_GET_USAGE);
+  const payload: OperatorMethodInput<'principals.get'> = { principalId };
+  const connection = resolveAgentConnectedHostConnection(runtime.configManager, runtime.homeDirectory);
+  const result = await invokeOperatorGatewayMethod<OperatorMethodOutput<'principals.get'>>(connection, 'principals.get', PRINCIPAL_ROUTE, payload);
+  if (!result.ok) {
+    return { output: jsonOrText(runtime, result, formatOperatorGatewayFailure(result)), exitCode: 1 };
+  }
+  return { output: jsonOrText(runtime, result, renderPrincipal(result.data.principal)), exitCode: 0 };
+}
+
+async function handlePrincipalsCreate(runtime: CliCommandRuntime, args: readonly string[]): Promise<CliCommandOutput> {
+  const parsed = parseOperatorCommandArgs(args, ['name', 'kind', 'identity']);
+  let name: string;
+  let kind: PrincipalKind;
+  let identities: readonly { readonly channel: string; readonly value: string }[];
+  try {
+    name = operatorRequiredFlag(parsed, 'name', PRINCIPALS_CREATE_USAGE);
+    kind = requirePrincipalKind(operatorRequiredFlag(parsed, 'kind', PRINCIPALS_CREATE_USAGE), PRINCIPALS_CREATE_USAGE);
+    identities = parseIdentityPairs(operatorFlagValue(parsed, 'identity'));
+  } catch (error) {
+    return usageFailure(runtime, error instanceof Error ? error.message : String(error));
+  }
+  if (!parsed.yes) {
+    return { output: `Refusing to create principal ${name} without --yes.`, exitCode: 2 };
+  }
+  const payload: OperatorMethodInput<'principals.create'> = {
+    name,
+    kind,
+    identities: identities.length > 0 ? identities : undefined,
+  };
+  const connection = resolveAgentConnectedHostConnection(runtime.configManager, runtime.homeDirectory);
+  const result = await invokeOperatorGatewayMethod<OperatorMethodOutput<'principals.create'>>(connection, 'principals.create', PRINCIPALS_ROUTE, payload);
+  if (!result.ok) {
+    return { output: jsonOrText(runtime, result, formatOperatorGatewayFailure(result)), exitCode: 1 };
+  }
+  return {
+    output: jsonOrText(runtime, result, [`Created principal ${result.data.principal.id}`, renderPrincipal(result.data.principal)].join('\n')),
+    exitCode: 0,
+  };
+}
+
+async function handlePrincipalsUpdate(runtime: CliCommandRuntime, args: readonly string[]): Promise<CliCommandOutput> {
+  const parsed = parseOperatorCommandArgs(args, ['name', 'kind', 'identity']);
+  const principalId = parsed.positionals[0];
+  if (!principalId) return usageFailure(runtime, PRINCIPALS_UPDATE_USAGE);
+  let kind: PrincipalKind | undefined;
+  let identities: readonly { readonly channel: string; readonly value: string }[];
+  try {
+    const kindValue = operatorFlagValue(parsed, 'kind');
+    kind = kindValue ? requirePrincipalKind(kindValue, PRINCIPALS_UPDATE_USAGE) : undefined;
+    identities = parseIdentityPairs(operatorFlagValue(parsed, 'identity'));
+  } catch (error) {
+    return usageFailure(runtime, error instanceof Error ? error.message : String(error));
+  }
+  if (!parsed.yes) {
+    return { output: `Refusing to update principal ${principalId} without --yes.`, exitCode: 2 };
+  }
+  const payload: OperatorMethodInput<'principals.update'> = {
+    principalId,
+    name: operatorFlagValue(parsed, 'name'),
+    kind,
+    identities: identities.length > 0 ? identities : undefined,
+  };
+  const connection = resolveAgentConnectedHostConnection(runtime.configManager, runtime.homeDirectory);
+  const result = await invokeOperatorGatewayMethod<OperatorMethodOutput<'principals.update'>>(connection, 'principals.update', PRINCIPAL_ROUTE, payload);
+  if (!result.ok) {
+    return { output: jsonOrText(runtime, result, formatOperatorGatewayFailure(result)), exitCode: 1 };
+  }
+  return {
+    output: jsonOrText(runtime, result, [`Updated principal ${result.data.principal.id}`, renderPrincipal(result.data.principal)].join('\n')),
+    exitCode: 0,
+  };
+}
+
+async function handlePrincipalsDelete(runtime: CliCommandRuntime, args: readonly string[]): Promise<CliCommandOutput> {
+  const parsed = parseOperatorCommandArgs(args);
+  const principalId = parsed.positionals[0];
+  if (!principalId) return usageFailure(runtime, PRINCIPALS_DELETE_USAGE);
+  if (!parsed.yes) {
+    return { output: `Refusing to delete principal ${principalId} without --yes.`, exitCode: 2 };
+  }
+  const payload: OperatorMethodInput<'principals.delete'> = { principalId };
+  const connection = resolveAgentConnectedHostConnection(runtime.configManager, runtime.homeDirectory);
+  const result = await invokeOperatorGatewayMethod<OperatorMethodOutput<'principals.delete'>>(connection, 'principals.delete', PRINCIPAL_ROUTE, payload);
+  if (!result.ok) {
+    return { output: jsonOrText(runtime, result, formatOperatorGatewayFailure(result)), exitCode: 1 };
+  }
+  return {
+    output: jsonOrText(runtime, result, `Deleted principal ${result.data.principalId}: ${result.data.deleted ? 'ok' : 'not found'}`),
+    exitCode: result.data.deleted ? 0 : 1,
+  };
+}
+
+async function handlePrincipalsResolve(runtime: CliCommandRuntime, args: readonly string[]): Promise<CliCommandOutput> {
+  const parsed = parseOperatorCommandArgs(args, ['channel', 'value']);
+  let channel: string;
+  let value: string;
+  try {
+    channel = operatorRequiredFlag(parsed, 'channel', PRINCIPALS_RESOLVE_USAGE);
+    value = operatorRequiredFlag(parsed, 'value', PRINCIPALS_RESOLVE_USAGE);
+  } catch (error) {
+    return usageFailure(runtime, error instanceof Error ? error.message : String(error));
+  }
+  const payload: OperatorMethodInput<'principals.resolve'> = { channel, value };
+  const connection = resolveAgentConnectedHostConnection(runtime.configManager, runtime.homeDirectory);
+  const result = await invokeOperatorGatewayMethod<OperatorMethodOutput<'principals.resolve'>>(connection, 'principals.resolve', PRINCIPALS_RESOLVE_ROUTE, payload);
+  if (!result.ok) {
+    return { output: jsonOrText(runtime, result, formatOperatorGatewayFailure(result)), exitCode: 1 };
+  }
+  // known: false means the identity lookup found nothing for this channel/value — never assert a match in that case.
+  const text = result.data.known
+    ? [`known: true`, renderPrincipal(result.data.principal)].join('\n')
+    : `known: false\n  No principal is mapped to ${channel}:${value}.`;
+  return { output: jsonOrText(runtime, result, text), exitCode: 0 };
+}
+
+export async function handlePrincipalsCommand(runtime: CliCommandRuntime): Promise<CliCommandOutput> {
+  const [sub = 'list', ...rest] = runtime.cli.commandArgs;
+  switch (sub.toLowerCase()) {
+    case 'list':
+      return handlePrincipalsList(runtime);
+    case 'get':
+    case 'show':
+      return handlePrincipalsGet(runtime, rest);
+    case 'create':
+      return handlePrincipalsCreate(runtime, rest);
+    case 'update':
+      return handlePrincipalsUpdate(runtime, rest);
+    case 'delete':
+    case 'remove':
+      return handlePrincipalsDelete(runtime, rest);
+    case 'resolve':
+      return handlePrincipalsResolve(runtime, rest);
+    default:
+      return usageFailure(runtime, PRINCIPALS_USAGE);
+  }
+}

package/src/cli/profiles-command.ts

@@ -18,6 +18,7 @@ import {
 } from '../agent/runtime-profile.ts';
 import { formatAgentRecordSource } from '../agent/record-labels.ts';
 import type { CliCommandOutput, GoodVibesCliParseResult } from './types.ts';
+import { appendTemporalLabel } from './temporal-label.ts';
 
 interface ProfilesCommandRuntime {
   readonly cli: GoodVibesCliParseResult;
@@ -67,7 +68,7 @@ function parseCsvFlag(args: readonly string[], names: readonly string[]): readon
 }
 
 function profileLine(profile: AgentRuntimeProfileInfo): string {
-  const created = profile.createdAt ? ` created ${profile.createdAt}` : '';
+  const created = profile.createdAt ? ` created ${appendTemporalLabel(profile.createdAt, profile.createdAt)}` : '';
   const starter = profile.starterTemplateId ? ` starter=${profile.starterTemplateId}` : '';
   return `  ${profile.id}  home ${profile.homeDirectory}${created}${starter}`;
 }

package/src/cli/relay-command.ts

@@ -0,0 +1,100 @@
+import { FEATURE_FLAG_MAP } from '@pellux/goodvibes-sdk/platform/runtime/state';
+import type { CliCommandOutput } from './types.ts';
+import type { CliCommandRuntime } from './management.ts';
+
+/**
+ * `goodvibes-agent relay status|pair` — the outbound zero-knowledge relay
+ * (SDK 1.6.1, platform/relay) that lets a daemon register with a
+ * self-hostable rendezvous relay so surfaces can reach it from outside the
+ * LAN. Relay reachability (RelayReachability, the live registration
+ * lifecycle, and the relay identity keypair a pairing payload is minted
+ * from) is owned entirely by the SDK's DaemonServer facade
+ * (buildDaemonRelayReachability, started at boot in facade.ts) — the daemon
+ * process holding the relay identity's private key material.
+ *
+ * GoodVibes Agent does not host that daemon. Its product boundary is
+ * explicit and enforced elsewhere in this CLI (see parser.ts's
+ * BLOCKED_PRODUCT_COMMAND_HINTS: "GoodVibes Agent connects to an externally
+ * managed GoodVibes host and does not start or manage host processes" /
+ * "does not start listeners or expose inbound host endpoints"). Relay is the
+ * same shape of concern as those blocked commands, so this command reports
+ * what is honestly knowable from here — the connected host's imported
+ * relay.* configuration and the relay-connect feature flag's static
+ * definition — and refuses to fabricate a live registration status or a
+ * pairing payload neither of which this process can observe or mint. The
+ * SDK's operator wire ships no remote relay-status/pairing route yet (relay
+ * reuses the existing REST surface for tunneled traffic, not a status
+ * query), so there is no live check to perform even for a genuinely
+ * connected host.
+ */
+
+const RELAY_USAGE = 'Usage: goodvibes-agent relay [status|pair]';
+
+function jsonOrText(runtime: CliCommandRuntime, value: unknown, text: string): string {
+  return runtime.cli.flags.outputFormat === 'json' ? JSON.stringify(value, null, 2) : text;
+}
+
+function relayConnectFlagSummary(): { readonly id: string; readonly name: string; readonly defaultState: string } {
+  const flag = FEATURE_FLAG_MAP.get('relay-connect');
+  return {
+    id: 'relay-connect',
+    name: flag?.name ?? 'Outbound Zero-Knowledge Relay',
+    defaultState: flag?.defaultState ?? 'disabled',
+  };
+}
+
+function handleRelayStatus(runtime: CliCommandRuntime): CliCommandOutput {
+  const config = runtime.configManager;
+  const enabled = config.get('relay.enabled') === true;
+  const url = String(config.get('relay.url') ?? '');
+  const rendezvousId = String(config.get('relay.rendezvousId') ?? '');
+  const label = String(config.get('relay.label') ?? '');
+  const requireStepUpForMutations = config.get('relay.requireStepUpForMutations') === true;
+  const flag = relayConnectFlagSummary();
+
+  const payload = {
+    ok: true,
+    source: 'agent-local-config' as const,
+    liveVerified: false,
+    config: { enabled, url, rendezvousId, label, requireStepUpForMutations },
+    flag,
+    note: 'This reflects goodvibes-agent\'s own imported copy of relay.* settings, not a live check of the connected GoodVibes daemon\'s actual relay registration — Agent hosts no daemon and the SDK has no remote relay-status route yet.',
+  };
+
+  const lines = [
+    'GoodVibes relay (connected-host configuration; not live-verified)',
+    `  relay.enabled: ${enabled ? 'true' : 'false'}`,
+    `  relay.url: ${url || '(empty)'}`,
+    `  relay.rendezvousId: ${rendezvousId || '(not generated yet)'}`,
+    `  relay.label: ${label || '(empty)'}`,
+    `  relay.requireStepUpForMutations: ${requireStepUpForMutations ? 'true' : 'false'}`,
+    `  ${flag.id} feature flag: ${flag.name} (default ${flag.defaultState})`,
+    '',
+    'disabled/registered/offline is a property of the daemon that actually holds the relay',
+    'identity and dials the relay server — that daemon is managed outside goodvibes-agent.',
+    'Check its own status/doctor output, or the connected host directly.',
+  ];
+
+  return { output: jsonOrText(runtime, payload, lines.join('\n')), exitCode: 0 };
+}
+
+function handleRelayPair(runtime: CliCommandRuntime): CliCommandOutput {
+  const message = [
+    'GoodVibes Agent cannot mint a relay pairing payload.',
+    'A pairing payload (relay URL + rendezvous id + pinned daemon public key) is minted',
+    'in-process by the daemon that holds the relay identity\'s private key — Agent never',
+    'holds that key material because it does not host the daemon (see "goodvibes-agent',
+    'relay status"). Run the pairing step on the machine hosting the connected GoodVibes',
+    'daemon, or use that host\'s own relay pairing surface once it ships one.',
+  ].join('\n');
+  const payload = { ok: false, available: false, reason: 'relay-identity-not-hosted-here', error: message };
+  return { output: jsonOrText(runtime, payload, message), exitCode: 1 };
+}
+
+export function handleRelayCommand(runtime: CliCommandRuntime): CliCommandOutput {
+  const [sub = 'status'] = runtime.cli.commandArgs;
+  if (sub === 'status') return handleRelayStatus(runtime);
+  if (sub === 'pair' || sub === 'pairing' || sub === 'qr' || sub === 'qrcode') return handleRelayPair(runtime);
+  const message = `Unknown relay subcommand: ${sub}\n${RELAY_USAGE}`;
+  return { output: jsonOrText(runtime, { ok: false, error: message }, message), exitCode: 2 };
+}

package/src/cli/routines-command.ts

@@ -9,6 +9,7 @@ import {
   resolveAgentConnectedHostConnection,
 } from '../agent/routine-schedule-promotion.ts';
 import { parseRoutineSchedulePromotionArgs } from '../agent/routine-schedule-args.ts';
+import { appendTemporalLabel } from './temporal-label.ts';
 import {
   formatRoutineScheduleCorrelation,
   formatRoutineScheduleFailure,
@@ -245,9 +246,9 @@ function renderRoutine(routine: AgentRoutineRecord): string {
     `  origin ${formatAgentRecordOrigin(routine.source, routine.provenance)}`,
     `  tags ${routine.tags.join(', ') || '(none)'}`,
     `  triggers ${routine.triggers.join(', ') || '(manual)'}`,
-    `  started ${routine.startCount}${routine.lastStartedAt ? `; last ${routine.lastStartedAt}` : ''}`,
-    `  created ${routine.createdAt}`,
-    `  updated ${routine.updatedAt}`,
+    `  started ${routine.startCount}${routine.lastStartedAt ? `; last ${appendTemporalLabel(routine.lastStartedAt, routine.lastStartedAt)}` : ''}`,
+    `  created ${appendTemporalLabel(routine.createdAt, routine.createdAt)}`,
+    `  updated ${appendTemporalLabel(routine.updatedAt, routine.updatedAt)}`,
     routine.staleReason ? `  stale reason ${routine.staleReason}` : '',
     '',
     routine.description,

package/src/cli/skill-bundle-command.ts

@@ -7,6 +7,7 @@ import {
 } from '../agent/skill-registry.ts';
 import type { CliCommandOutput } from './types.ts';
 import type { CliCommandRuntime } from './management.ts';
+import { appendTemporalLabel } from './temporal-label.ts';
 import {
   csvOption,
   errorOutput,
@@ -60,8 +61,8 @@ function renderBundle(bundle: AgentSkillBundleRecord, skills: readonly AgentSkil
     `  review: ${formatAgentRecordReviewState(bundle.reviewState)}`,
     `  origin: ${formatAgentRecordOrigin(bundle.source, bundle.provenance)}`,
     `  skills: ${bundle.skillIds.join(', ')}`,
-    `  created: ${bundle.createdAt}`,
-    `  updated: ${bundle.updatedAt}`,
+    `  created: ${appendTemporalLabel(bundle.createdAt, bundle.createdAt)}`,
+    `  updated: ${appendTemporalLabel(bundle.updatedAt, bundle.updatedAt)}`,
     bundle.staleReason ? `  stale reason: ${bundle.staleReason}` : '',
     '',
     bundle.description,

package/src/cli/skills-command.ts

@@ -9,6 +9,7 @@ import {
 import type { CliCommandOutput } from './types.ts';
 import type { CliCommandRuntime } from './management.ts';
 import { handleSkillBundleCommand, renderBundleList } from './skill-bundle-command.ts';
+import { appendTemporalLabel } from './temporal-label.ts';
 import {
   csvOption,
   errorOutput,
@@ -114,8 +115,8 @@ function renderSkill(skill: AgentSkillRecord): string {
     `  origin: ${formatAgentRecordOrigin(skill.source, skill.provenance)}`,
     `  tags: ${skill.tags.join(', ') || '(none)'}`,
     `  triggers: ${skill.triggers.join(', ') || '(manual)'}`,
-    `  created: ${skill.createdAt}`,
-    `  updated: ${skill.updatedAt}`,
+    `  created: ${appendTemporalLabel(skill.createdAt, skill.createdAt)}`,
+    `  updated: ${appendTemporalLabel(skill.updatedAt, skill.updatedAt)}`,
     skill.staleReason ? `  stale reason: ${skill.staleReason}` : '',
     '',
     skill.description,

package/src/cli/status.ts

@@ -4,10 +4,12 @@ import { resolveRuntimeEndpointBinding } from './endpoints.ts';
 import type { GoodVibesCliOutputFormat } from './types.ts';
 import type { CliServicePosture } from './service-posture.ts';
 import type { CliExternalRuntimeSnapshot } from './external-runtime.ts';
+import type { CliConnectedHostMetricsSnapshot } from './connected-host-metrics.ts';
 import { getProviderIdFromModel } from '../config/provider-model.ts';
 import { formatAgentRecordSource } from '../agent/record-labels.ts';
 import { formatAgentKnowledgeFailureKind } from './agent-knowledge-format.ts';
 import { computeApprovalPosture, type ApprovalPosture } from '../permissions/approval-posture.ts';
+import { appendTemporalLabel } from './temporal-label.ts';
 
 export interface CliStatusOptions {
   readonly configManager: Pick<ConfigManager, 'get'>;
@@ -17,10 +19,23 @@ export interface CliStatusOptions {
   readonly auth?: CliAuthStatus;
   readonly service?: CliServicePosture;
   readonly externalRuntime?: CliExternalRuntimeSnapshot;
+  readonly connectedHostMetrics?: CliConnectedHostMetricsSnapshot;
+  readonly checkpoints?: CliCheckpointsStatus;
   readonly doctor?: boolean;
   readonly outputFormat?: GoodVibesCliOutputFormat;
 }
 
+/**
+ * Registered-workspaces-only checkpoint posture (owner ruling, 2026-07-10; see
+ * ../config/workspace-registration.ts and ../runtime/services.ts). Computed by the
+ * caller (entrypoint.ts already builds a ShellPathService for status/doctor)
+ * and passed in here so this module stays a pure renderer.
+ */
+export interface CliCheckpointsStatus {
+  readonly workspaceRegistered: boolean;
+  readonly unregisteredWorkspaceMode: 'off' | 'guarded';
+}
+
 export interface CliAuthStatus {
   readonly userStorePath: string;
   readonly userStorePresent: boolean;
@@ -65,6 +80,13 @@ export interface CliStatusSnapshot {
     readonly lifecycle?: CliServicePosture;
   };
   readonly externalRuntime: CliExternalRuntimeSnapshot | null;
+  readonly connectedHostMetrics: CliConnectedHostMetricsSnapshot | null;
+  readonly relay: {
+    readonly enabled: boolean;
+    readonly url: string;
+    readonly requireStepUpForMutations: boolean;
+    readonly liveVerified: false;
+  };
   readonly runtimeEndpoints: {
     readonly controlPlane: ReturnType<typeof resolveRuntimeEndpointBinding> & { readonly enabled: unknown };
     readonly httpListener: ReturnType<typeof resolveRuntimeEndpointBinding> & { readonly enabled: unknown };
@@ -75,13 +97,70 @@ export interface CliStatusSnapshot {
     readonly scope: string;
     readonly updatedAt: number | null;
   };
+  readonly checkpoints: {
+    readonly automaticCheckpointsActive: boolean;
+    readonly workspaceRegistered: boolean;
+    readonly unregisteredWorkspaceMode: 'off' | 'guarded';
+    readonly statusLine: string;
+  } | null;
   readonly findings: readonly CliDoctorFinding[];
 }
 
+/**
+ * The one honest line this surface must never omit or soften (owner ruling,
+ * 2026-07-10): whether automatic checkpoints are active for THIS working
+ * directory, and why. `"checkpoints off: workspace not registered"` is the
+ * literal wording the ruling calls for the default (unregistered, `"off"`) case.
+ */
+function checkpointsStatusLine(checkpoints: CliCheckpointsStatus): { active: boolean; line: string } {
+  if (checkpoints.workspaceRegistered) {
+    return { active: true, line: 'checkpoints on: workspace registered' };
+  }
+  if (checkpoints.unregisteredWorkspaceMode === 'guarded') {
+    return { active: true, line: 'checkpoints on: unregistered workspace allowed via checkpoints.unregisteredWorkspaces="guarded"' };
+  }
+  return { active: false, line: 'checkpoints off: workspace not registered' };
+}
+
 function yesNo(value: unknown): string {
   return value === true ? 'yes' : 'no';
 }
 
+/**
+ * The connected-host runtime-metrics lines. Each non-ok state is rendered as a
+ * plain sentence naming exactly why there are no numbers to show — most
+ * importantly, a token without the read:telemetry scope reads as "not
+ * permitted", never as a wall of zeros that would misrepresent an unauthorized
+ * token as a healthy idle host.
+ */
+function connectedHostMetricsLines(snapshot: CliConnectedHostMetricsSnapshot | null): string[] {
+  if (!snapshot) return ['  live check unavailable'];
+  switch (snapshot.status) {
+    case 'ok': {
+      const m = snapshot.metrics!;
+      return [
+        `  http requests total: ${m.httpRequestsTotal}`,
+        `  llm requests total: ${m.llmRequestsTotal}`,
+        `  auth success/failure: ${m.authSuccessTotal}/${m.authFailureTotal}`,
+        `  transport retries total: ${m.transportRetriesTotal}`,
+        `  sessions active: ${m.sessionsActive}`,
+        `  sse subscribers: ${m.sseSubscribers}`,
+        `  telemetry buffer fill: ${m.telemetryBufferFill}`,
+      ];
+    }
+    case 'scope_missing':
+      return [`  not shown: the connected-host token does not include the ${snapshot.requiredScope} scope required by ${snapshot.methodId}.`];
+    case 'auth_required':
+      return ['  not shown: connected-host operator token is missing or unauthenticated.'];
+    case 'route_unavailable':
+      return [`  not shown: this connected host does not expose ${snapshot.route} (incompatible or older daemon).`];
+    case 'unavailable':
+      return [`  not shown: connected host is not reachable${snapshot.error ? ` (${snapshot.error})` : '.'}`];
+    default:
+      return [`  not shown: ${snapshot.error ?? 'runtime metrics could not be read.'}`];
+  }
+}
+
 /** permissions.tools.* keys — mirrors PermissionsToolConfig in the SDK config schema. */
 const PERMISSION_TOOL_KEYS = [
   'read', 'write', 'edit', 'exec', 'find', 'fetch', 'analyze',
@@ -268,6 +347,13 @@ export function buildCliStatusSnapshot(options: CliStatusOptions): CliStatusSnap
       ...(options.service ? { lifecycle: options.service } : {}),
     },
     externalRuntime: options.externalRuntime ?? null,
+    connectedHostMetrics: options.connectedHostMetrics ?? null,
+    relay: {
+      enabled: config.get('relay.enabled') === true,
+      url: String(config.get('relay.url') ?? ''),
+      requireStepUpForMutations: config.get('relay.requireStepUpForMutations') === true,
+      liveVerified: false,
+    },
     runtimeEndpoints: {
       controlPlane: { enabled: config.get('controlPlane.enabled'), ...controlPlaneBinding },
       httpListener: { enabled: config.get('danger.httpListener'), ...httpListenerBinding },
@@ -278,6 +364,14 @@ export function buildCliStatusSnapshot(options: CliStatusOptions): CliStatusSnap
       scope: marker?.scope ?? 'none',
       updatedAt: marker?.payload?.updatedAt ?? null,
     },
+    checkpoints: options.checkpoints
+      ? {
+        automaticCheckpointsActive: checkpointsStatusLine(options.checkpoints).active,
+        workspaceRegistered: options.checkpoints.workspaceRegistered,
+        unregisteredWorkspaceMode: options.checkpoints.unregisteredWorkspaceMode,
+        statusLine: checkpointsStatusLine(options.checkpoints).line,
+      }
+      : null,
     findings,
   };
 }
@@ -327,6 +421,14 @@ export function renderCliStatus(options: CliStatusOptions): string {
       '  live check unavailable',
     ]),
     '',
+    'Connected host metrics (runtime.metrics.get; read:telemetry):',
+    ...connectedHostMetricsLines(snapshot.connectedHostMetrics),
+    '',
+    'Relay (connected host\'s imported config; not live-verified — see goodvibes-agent relay status):',
+    `  relay.enabled: ${yesNo(snapshot.relay.enabled)}`,
+    `  relay.url: ${snapshot.relay.url || '(empty)'}`,
+    `  relay.requireStepUpForMutations: ${yesNo(snapshot.relay.requireStepUpForMutations)}`,
+    '',
     'Agent role:',
     '  product: interactive operator TUI',
     '  host lifecycle: external',
@@ -337,7 +439,17 @@ export function renderCliStatus(options: CliStatusOptions): string {
     'Onboarding',
     `  checked ${marker?.exists ? 'yes' : 'no'}`,
     `  scope ${marker?.scope ?? 'none'}`,
-    `  updated ${marker?.payload ? new Date(marker.payload.updatedAt).toISOString() : 'n/a'}`,
+    `  updated ${marker?.payload ? appendTemporalLabel(new Date(marker.payload.updatedAt).toISOString(), marker.payload.updatedAt) : 'n/a'}`,
+    '',
+    'Checkpoints',
+    ...(snapshot.checkpoints ? [
+      `  ${snapshot.checkpoints.statusLine}`,
+      `  unregisteredWorkspaces mode: ${snapshot.checkpoints.unregisteredWorkspaceMode}`,
+      '  next goodvibes-agent workspaces list',
+      ...(snapshot.checkpoints.workspaceRegistered ? [] : ['  next goodvibes-agent workspaces register --yes']),
+    ] : [
+      '  checkpoint posture unknown',
+    ]),
   ];
 
   if (options.doctor) {
@@ -375,7 +487,7 @@ export function renderOnboardingCliStatus(options: CliStatusOptions): string {
     `  scope ${marker?.scope ?? 'none'}`,
     `  origin ${marker?.payload?.source ? formatAgentRecordSource(marker.payload.source) : 'n/a'}`,
     `  mode ${marker?.payload?.mode ?? 'n/a'}`,
-    `  updated ${marker?.payload ? new Date(marker.payload.updatedAt).toISOString() : 'n/a'}`,
+    `  updated ${marker?.payload ? appendTemporalLabel(new Date(marker.payload.updatedAt).toISOString(), marker.payload.updatedAt) : 'n/a'}`,
     `  working directory ${options.workingDirectory}`,
   ].join('\n');
 }