@pellux/goodvibes-tui 1.16.1 → 1.18.0

package/src/input/commands/update-runtime.ts

@@ -1,8 +1,11 @@
 /**
- * `/update` — a real self-update path for binary installs, mirroring
- * scripts/install.sh's download-verify-swap semantics (that file is the
- * tested reference for release-asset naming and checksum verification; keep
- * this in lockstep with it).
+ * `/update` — a real self-update path for binary installs. The
+ * download-verify-swap mechanics are the SDK's canonical update policy
+ * module (platform/runtime/self-update — hoisted from this file's
+ * semantics), the same mechanism the daemon's hourly loop and
+ * scripts/install.sh follow: one update mechanism everywhere. This file owns
+ * only the /update UX: install-kind gating, target selection, and the
+ * printed report.
  *
  * Subcommands:
  *   /update [check]           — resolve the latest release tag and report
@@ -12,9 +15,17 @@
  *                                app and daemon binaries, and refresh the
  *                                sqlite-vec native addon in lockstep so the
  *                                vector index never goes stale beside a new
- *                                binary. For any other install kind, prints the
- *                                exact command to run instead — it never
- *                                attempts a swap it can't do safely.
+ *                                binary. Every swap parks the outgoing file
+ *                                at `<path>.previous`, so the replaced
+ *                                version is always kept. For any other
+ *                                install kind, prints the exact command to
+ *                                run instead — it never attempts a swap it
+ *                                can't do safely.
+ *   /update rollback           — exchange each installed file with its kept
+ *                                `.previous` counterpart: one command back to
+ *                                the version that ran before the last update
+ *                                (and, being an exchange, one more command
+ *                                forward again).
  *   /update review              — install/subscription/sandbox posture,
  *                                unrelated to the update mechanics above.
  *   /update bundle export|inspect <path> — portable posture bundle, as before.
@@ -26,9 +37,16 @@
  * (scripts/release.ts) does not publish separate stable/preview channels,
  * so there is no real channel selection to wire it to.
  */
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { spawnSync } from 'node:child_process';
+import {
+  applyVerifiedUpdate,
+  realUpdateFileIo,
+  rollbackKeptPrevious,
+  type UpdateFileIo,
+  type UpdateTarget,
+} from '@pellux/goodvibes-sdk/platform/runtime/self-update';
 import type { CommandRegistry } from '../command-registry.ts';
 import { VERSION } from '../../version.ts';
 import { listBuiltinSubscriptionProviders } from '@pellux/goodvibes-sdk/platform/config';
@@ -37,8 +55,6 @@ import {
   parseChecksumFile,
   resolveArtifactNames,
   resolveSqliteVecAsset,
-  sha256,
-  verifyChecksum,
 } from '../../runtime/release-artifacts.ts';
 import {
   compareVersions,
@@ -66,47 +82,13 @@ async function downloadText(fetchImpl: UpdateFetchLike, url: string): Promise<st
   return await response.text();
 }
 
-async function downloadBuffer(fetchImpl: UpdateFetchLike, url: string): Promise<Buffer> {
-  const response = await fetchImpl(url);
-  if (!response.ok) {
-    throw new Error(`download failed (${response.status}) for ${url}`);
-  }
-  return Buffer.from(await response.arrayBuffer());
-}
-
 /**
- * Writes the new binary next to the target, then renames over it — an
- * atomic replace on the same filesystem, so a currently-running process
- * that already opened the old file keeps its old inode (POSIX unlink
- * semantics) instead of executing a half-written file. Same approach as
- * scripts/install.sh's `mv -f "$WORKDIR/$artifact" "$target"`.
+ * Suffix under which every swap keeps the file it replaced — re-exported
+ * from the SDK's canonical update policy module so rollback and swap share
+ * one definition everywhere.
  */
-function swapBinaryAtomically(targetPath: string, buffer: Buffer): void {
-  const tempPath = `${targetPath}.update-download`;
-  writeFileSync(tempPath, buffer);
-  if (process.platform !== 'win32') {
-    chmodSync(tempPath, 0o755);
-  }
-  renameSync(tempPath, targetPath);
-}
-
-/**
- * Writes the sqlite-vec native addon into place with the same temp-write +
- * atomic-rename discipline as the binaries, so a running process never
- * dlopen()s a half-written extension. The addon's parent directory
- * (`<execDir>/lib/sqlite-vec-<os>-<arch>/`) is created first because a fresh
- * install may not have a `lib/` tree yet. A shared library needs no execute
- * bit, so this uses 0o644 rather than the binaries' 0o755.
- */
-function writeAddonAtomically(targetPath: string, buffer: Buffer): void {
-  mkdirSync(dirname(targetPath), { recursive: true });
-  const tempPath = `${targetPath}.update-download`;
-  writeFileSync(tempPath, buffer);
-  if (process.platform !== 'win32') {
-    chmodSync(tempPath, 0o644);
-  }
-  renameSync(tempPath, targetPath);
-}
+export { PREVIOUS_FILE_SUFFIX } from '@pellux/goodvibes-sdk/platform/runtime/self-update';
+import { PREVIOUS_FILE_SUFFIX } from '@pellux/goodvibes-sdk/platform/runtime/self-update';
 
 export interface DaemonServiceRestartInfo {
   readonly managed: boolean;
@@ -169,19 +151,19 @@ export interface ApplyUpdateOptions {
   readonly print: (line: string) => void;
   readonly configManager: { get(key: string): unknown };
   readonly runCommand?: RunCommand;
-  /** Injectable so tests can observe/skip the actual filesystem swap. */
-  readonly swap?: (targetPath: string, buffer: Buffer) => void;
-  /** Injectable so tests can observe/skip writing the sqlite-vec addon. */
-  readonly writeAddon?: (targetPath: string, buffer: Buffer) => void;
-  readonly fileExists?: (path: string) => boolean;
+  /** Injectable filesystem seam (the SDK's UpdateFileIo) so tests observe swaps in memory. */
+  readonly io?: UpdateFileIo;
 }
 
 /**
- * The real self-update path. For a binary install: resolve the latest tag,
- * compare to the running version, and if newer, download + verify both
- * artifacts BEFORE swapping either one (so a checksum failure on the second
- * artifact never leaves a mismatched pair installed), then atomically swap
- * each in place. For any other install kind, never attempts a swap — it
+ * The real self-update path, delegating the download-verify-swap mechanics
+ * to the SDK's canonical update policy module (applyVerifiedUpdate — the
+ * same mechanism the daemon's hourly loop uses). For a binary install:
+ * resolve the latest tag, compare to the running version, and if newer,
+ * download + checksum-verify EVERY artifact before swapping any one (so a
+ * checksum failure never leaves a mismatched pair installed), then
+ * atomically swap each in place with the outgoing file kept at
+ * `<path>.previous`. For any other install kind, never attempts a swap — it
  * prints the exact command for that install method instead.
  */
 export async function applyUpdate(options: ApplyUpdateOptions): Promise<void> {
@@ -211,22 +193,10 @@ export async function applyUpdate(options: ApplyUpdateOptions): Promise<void> {
   options.print(`Update available: ${latestTag} (running v${normalizeVersion(options.currentVersion)}). Downloading and verifying...`);
 
   const baseUrl = releaseDownloadBaseUrl(latestTag);
-  const checksumText = await downloadText(options.fetchImpl, `${baseUrl}/${CHECKSUM_MANIFEST_NAME}`);
-  const checksums = parseChecksumFile(checksumText);
-
+  const io = options.io ?? realUpdateFileIo;
   const appBinaryPath = options.execPath;
   const daemonBinaryPath = join(dirname(appBinaryPath), 'goodvibes-daemon');
-  const fileExists = options.fileExists ?? existsSync;
-  const daemonBinaryPresent = fileExists(daemonBinaryPath);
-
-  const appBuffer = await downloadBuffer(options.fetchImpl, `${baseUrl}/${artifacts.app}`);
-  verifyChecksum(artifacts.app, sha256(appBuffer), checksums.get(artifacts.app));
-
-  let daemonBuffer: Buffer | null = null;
-  if (daemonBinaryPresent) {
-    daemonBuffer = await downloadBuffer(options.fetchImpl, `${baseUrl}/${artifacts.daemon}`);
-    verifyChecksum(artifacts.daemon, sha256(daemonBuffer), checksums.get(artifacts.daemon));
-  }
+  const daemonBinaryPresent = io.exists(daemonBinaryPath);
 
   // The sqlite-vec native addon travels with the binaries: refresh it in the
   // same download-verify-swap pass so /update never leaves a new binary beside a
@@ -237,28 +207,36 @@ export async function applyUpdate(options: ApplyUpdateOptions): Promise<void> {
   // swap), while an absent entry means the target predates the addon and is
   // skipped rather than blocking an otherwise-valid binary update. On macOS the
   // file is refreshed for consistency even though the platform blocks extension
-  // loading.
+  // loading. This inclusion decision needs one manifest pre-read; the swap
+  // itself re-verifies every included artifact inside applyVerifiedUpdate.
+  const checksumText = await downloadText(options.fetchImpl, `${baseUrl}/${CHECKSUM_MANIFEST_NAME}`);
+  const checksums = parseChecksumFile(checksumText);
   const addon = resolveSqliteVecAsset(options.platform, options.arch);
-  const addonExpected = addon ? checksums.get(addon.assetName) : undefined;
-  let addonBuffer: Buffer | null = null;
-  if (addon && addonExpected !== undefined) {
-    addonBuffer = await downloadBuffer(options.fetchImpl, `${baseUrl}/${addon.assetName}`);
-    verifyChecksum(addon.assetName, sha256(addonBuffer), addonExpected);
-  }
-
-  // All downloads verified before any write — an update must not apply partially.
-  const swap = options.swap ?? swapBinaryAtomically;
-  swap(appBinaryPath, appBuffer);
-  if (daemonBuffer) {
-    swap(daemonBinaryPath, daemonBuffer);
-  }
-  const addonTargetPath = addon && addonBuffer
+  const addonIncluded = addon !== null && checksums.get(addon.assetName) !== undefined;
+  const addonTargetPath = addon && addonIncluded
     ? join(dirname(appBinaryPath), 'lib', addon.dirName, addon.fileName)
     : null;
-  if (addonBuffer && addonTargetPath) {
-    const writeAddon = options.writeAddon ?? writeAddonAtomically;
-    writeAddon(addonTargetPath, addonBuffer);
-  }
+
+  const targets: UpdateTarget[] = [
+    { label: 'app binary', path: appBinaryPath, assetName: artifacts.app, executable: true },
+    ...(daemonBinaryPresent
+      ? [{ label: 'daemon binary', path: daemonBinaryPath, assetName: artifacts.daemon, executable: true }]
+      : []),
+    ...(addon && addonTargetPath
+      ? [{ label: 'vector addon', path: addonTargetPath, assetName: addon.assetName, executable: false }]
+      : []),
+  ];
+
+  // One mechanism everywhere: downloads + verifies ALL targets before any
+  // write, then swaps each atomically with the outgoing file kept at
+  // `<path>.previous`.
+  await applyVerifiedUpdate({
+    fetchImpl: options.fetchImpl,
+    downloadBaseUrl: baseUrl,
+    targets,
+    io,
+    platform: options.platform,
+  });
 
   const serviceInfo = detectDaemonServiceManaged(options.platform, options.configManager, options.runCommand);
 
@@ -279,6 +257,70 @@ export async function applyUpdate(options: ApplyUpdateOptions): Promise<void> {
   );
 }
 
+export interface RollbackUpdateOptions {
+  readonly execPath: string;
+  readonly platform: NodeJS.Platform;
+  readonly arch: string;
+  readonly print: (line: string) => void;
+  readonly configManager: { get(key: string): unknown };
+  readonly runCommand?: RunCommand;
+  /** Injectable filesystem seam (the SDK's UpdateFileIo) so tests observe renames in memory. */
+  readonly io?: UpdateFileIo;
+}
+
+/**
+ * One-command rollback to the version that ran before the last update,
+ * delegating the exchange mechanics to the SDK's rollbackKeptPrevious (the
+ * same module the swap uses): every installed file (app binary, daemon
+ * binary, vector addon) that has a kept `.previous` counterpart is EXCHANGED
+ * with it — the previous version becomes live, and the version being rolled
+ * back is itself kept at `.previous`, so a second `/update rollback` rolls
+ * forward again. Files without a kept counterpart are reported and left
+ * untouched; nothing is downloaded.
+ */
+export function rollbackUpdate(options: RollbackUpdateOptions): void {
+  const installKind: InstallKind = detectInstallKind(options.execPath);
+  if (installKind !== 'binary') {
+    options.print(
+      [
+        `This install is not a self-updatable binary install (detected: ${installKind === 'bun-global-package' ? 'bun/npm package install' : 'running from source'}), so there is no kept previous binary to roll back to.`,
+        `Install a specific version with your package manager instead, e.g.: ${fallbackUpdateCommand(installKind)}`,
+      ].join('\n'),
+    );
+    return;
+  }
+
+  const io = options.io ?? realUpdateFileIo;
+  const addon = resolveSqliteVecAsset(options.platform, options.arch);
+  const targets = [
+    { label: 'app binary', path: options.execPath },
+    { label: 'daemon binary', path: join(dirname(options.execPath), 'goodvibes-daemon') },
+    ...(addon ? [{ label: 'vector addon', path: join(dirname(options.execPath), 'lib', addon.dirName, addon.fileName) }] : []),
+  ];
+
+  const result = rollbackKeptPrevious(targets, io);
+  if (result.restored.length === 0) {
+    options.print(
+      `No previous version is kept beside this install (nothing at ${options.execPath}${PREVIOUS_FILE_SUFFIX}). ` +
+      'The previous version is kept from the next update onward.',
+    );
+    return;
+  }
+
+  const serviceInfo = detectDaemonServiceManaged(options.platform, options.configManager, options.runCommand);
+  options.print(
+    [
+      'Rolled back to the previously installed version.',
+      ...result.restored.map((target) => `  ${target.label}: ${target.path} (the replaced version is kept at ${target.path}${PREVIOUS_FILE_SUFFIX})`),
+      '',
+      'Restart goodvibes to run the restored version.',
+      serviceInfo.managed
+        ? `The daemon is managed by systemd — restart it with: ${serviceInfo.restartCommand}`
+        : 'The daemon restarts automatically the next time goodvibes launches.',
+    ].join('\n'),
+  );
+}
+
 interface UpdateBundle {
   readonly version: 1;
   readonly exportedAt: number;
@@ -304,8 +346,8 @@ export function registerUpdateCommand(registry: CommandRegistry): void {
   registry.register({
     name: 'update',
     aliases: ['upgrade'],
-    description: 'Check for a newer GoodVibes release and, for binary installs, download/verify/apply it',
-    usage: '[check|apply|review|bundle export <path>|bundle inspect <path>]',
+    description: 'Check for a newer GoodVibes release and, for binary installs, download/verify/apply it or roll back to the kept previous version',
+    usage: '[check|apply|rollback|review|bundle export <path>|bundle inspect <path>]',
     async handler(args, ctx) {
       const sub = args[0] ?? 'check';
 
@@ -340,6 +382,21 @@ export function registerUpdateCommand(registry: CommandRegistry): void {
         return;
       }
 
+      if (sub === 'rollback') {
+        try {
+          rollbackUpdate({
+            execPath: process.execPath,
+            platform: process.platform,
+            arch: process.arch,
+            print: ctx.print,
+            configManager: ctx.platform.configManager,
+          });
+        } catch (error) {
+          ctx.print(`Rollback failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        return;
+      }
+
       if (sub === 'review') {
         const installKind = detectInstallKind(process.execPath);
         const subscriptions = requireSubscriptionManager(ctx);
@@ -358,7 +415,7 @@ export function registerUpdateCommand(registry: CommandRegistry): void {
             `  built-in subscription providers: ${builtinProviders.length}${builtinProviders.length > 0 ? ` (${builtinProviders.join(', ')})` : ''}`,
             `  active subscriptions: ${activeSubscriptions.length}${activeSubscriptions.length > 0 ? ` (${activeSubscriptions.join(', ')})` : ''}`,
             `  sandbox profile: ${sandboxProfile}`,
-            '  use /update check to look for a newer release, /update apply to install it',
+            '  use /update check to look for a newer release, /update apply to install it, /update rollback to return to the kept previous version',
           ].join('\n'),
         );
         return;
@@ -406,7 +463,7 @@ export function registerUpdateCommand(registry: CommandRegistry): void {
         }
       }
 
-      ctx.print('Usage: /update [check|apply|review|bundle export <path>|bundle inspect <path>]');
+      ctx.print('Usage: /update [check|apply|rollback|review|bundle export <path>|bundle inspect <path>]');
     },
   });
 }

package/src/input/commands/work-plan-runtime.ts

@@ -25,7 +25,7 @@ function getStore(ctx: import('../command-registry.ts').CommandContext): WorkPla
 }
 
 function openPanel(ctx: import('../command-registry.ts').CommandContext): void {
-  // W6.1: work-plan migrated to the 'work-plan' modal — open it via the seam.
+  // work-plan migrated to the 'work-plan' modal — open it via the seam.
   openModalCommand(ctx, 'work-plan-modal');
 }
 

package/src/input/commands/workstream-attempts.ts

@@ -25,6 +25,7 @@ import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 import type { CommandContext } from '../command-registry.ts';
 import type { WorkstreamCommandService } from '../../runtime/workstream-services.ts';
 import { requirePanelManager } from './runtime-services.ts';
+import { describeFailureReason, isTurnBudgetReason } from '../../core/turn-budget-outcome.ts';
 import { type AttemptGraphItem, renderDependentHoldLines } from './workstream-attempt-dependents.ts';
 
 /** Resolve a workstream's items for dependent-hold display; null-safe against a stubbed engine. */
@@ -58,7 +59,11 @@ function resolveCandidate(group: HeldMergeGroup, ref: string): AttemptCandidate
 
 function candidateLine(c: AttemptCandidate): string {
   const files = c.diff ? `${c.diff.files.length} file(s)` : 'no diff';
-  const state = c.state === 'held-merge' ? 'held (pick-ready)' : `failed${c.failureReason ? `: ${c.failureReason}` : ''}`;
+  const state = c.state === 'held-merge'
+    ? 'held (pick-ready)'
+    : isTurnBudgetReason(c.failureReason)
+      ? describeFailureReason(c.failureReason) // a spent budget, not an infrastructure failure
+      : `failed${c.failureReason ? `: ${c.failureReason}` : ''}`;
   return `    ${c.attemptIndex + 1}. [${state}] ${c.title} — ${files}, item ${shortId(c.itemId)}`;
 }
 

package/src/input/commands/workstream-runtime.ts

@@ -2,7 +2,7 @@
 // workstream-runtime.ts — /workstream
 //
 // UX over the OrchestrationEngine (@pellux/goodvibes-sdk/platform/orchestration,
-// wo701/W4.1) via its command-facing facade wired onto RuntimeServices as
+//) via its command-facing facade wired onto RuntimeServices as
 // `workstreamCommands` (src/runtime/workstream-services.ts) and threaded
 // through CommandContext.session.workstreamEngine exactly like wrfcController
 // already is (bootstrap-command-context.ts).
@@ -21,7 +21,7 @@
 // pre-creation "draft" concept, so approval happens on a TUI-held draft
 // (workstream-services.ts's WorkstreamDraft) before anything is created in
 // the engine at all — see that module's header doc for the full reality-wins
-// divergence from the wo703 design brief.
+// divergence from the design brief.
 // ---------------------------------------------------------------------------
 
 import { AdaptivePlanner } from '@pellux/goodvibes-sdk/platform/core';
@@ -102,6 +102,33 @@ async function checkFanoutQuotaWarning(ctx: CommandContext, draft: WorkstreamDra
   ].join('\n');
 }
 
+/**
+ * Launch an already-approved draft through its gates (best-of-N attempt
+ * validation, then the fan-out quota warning unless `--force`), and print the
+ * outcome. Shared by `launch` and by `approve` (which launches in the same act
+ * — the one confirmed step that replaces the old approve-then-retype ceremony).
+ */
+async function launchApprovedDraft(ctx: CommandContext, service: WorkstreamCommandService, id: string, draft: WorkstreamDraft, force: boolean): Promise<void> {
+  const attemptsCheck = validateAttempts(draft.spec);
+  if (attemptsCheck.violations.length > 0) {
+    ctx.print(`Cannot launch ${id} — best-of-N plan constraints are violated:\n${attemptsCheck.violations.map((v) => `  - ${v}`).join('\n')}\nFix the plan (or drop the attempts) and re-approve.`);
+    return;
+  }
+  if (!force) {
+    const quotaWarning = await checkFanoutQuotaWarning(ctx, draft);
+    if (quotaWarning) {
+      ctx.print(quotaWarning);
+      return;
+    }
+  }
+  const result = service.launchDraft(id);
+  if (!result) {
+    ctx.print(`Could not launch ${id}.`);
+    return;
+  }
+  ctx.print(`Launched workstream ${result.workstreamId} — track it with /workstream status ${result.workstreamId} or the Fleet panel.`);
+}
+
 /**
  * phase.role for a 'custom' phase is the free-text description passed to
  * `/workstream insert-phase` — it is purely COSMETIC. Neither
@@ -377,7 +404,7 @@ export function registerWorkstreamRuntimeCommands(registry: CommandRegistry): vo
   registry.register({
     name: 'workstream',
     description: 'Author and oversee multi-phase agent workstreams (orchestration engine)',
-    usage: 'create [--isolation shared|worktree] <task...> | list | status [id] | insert-phase <id> <description...> | edit-item <id> <item#> <brief...> | remove-item <id> <item#> | move-item <id> <item#> <pos> | approve <id> | edit <id> [--isolation shared|worktree] <task...> | launch <id> [--force] | cancel <id> | attempts list|diff|judge|pick',
+    usage: 'create [--isolation shared|worktree] <task...> | list | status [id] | insert-phase <id> <description...> | edit-item <id> <item#> <brief...> | remove-item <id> <item#> | move-item <id> <item#> <pos> | approve <id> [--no-launch] [--force] | edit <id> [--isolation shared|worktree] <task...> | launch <id> [--force] | cancel <id> | attempts list|diff|judge|pick',
     argsHint: 'create [--isolation worktree] <task> | list | status [id] | edit-item | remove-item | move-item | approve | edit | launch | cancel | attempts',
     handler: async (args, ctx: CommandContext) => {
       const service = ctx.session.workstreamEngine;
@@ -470,9 +497,14 @@ export function registerWorkstreamRuntimeCommands(registry: CommandRegistry): vo
       }
 
       if (sub === 'approve') {
-        const id = args[1];
+        // Approve IS the one confirmed act: it approves AND launches (typing the
+        // verb with an explicit id is the confirmation). --no-launch keeps the
+        // old split for scripts; --force skips the fan-out quota warning.
+        const noLaunch = args.includes('--no-launch');
+        const force = args.includes('--force');
+        const id = args.find((arg, index) => index > 0 && arg !== '--no-launch' && arg !== '--force');
         if (!id) {
-          ctx.print('Usage: /workstream approve <id>');
+          ctx.print('Usage: /workstream approve <id> [--no-launch] [--force]');
           return;
         }
         const draft = service.approveDraft(id);
@@ -480,7 +512,11 @@ export function registerWorkstreamRuntimeCommands(registry: CommandRegistry): vo
           ctx.print(draftNotFoundMessage(service, id));
           return;
         }
-        ctx.print(`Approved ${id}. Launch with: /workstream launch ${id}`);
+        if (noLaunch) {
+          ctx.print(`Approved ${id} (held, not launched). Launch it with /workstream launch ${id}.`);
+          return;
+        }
+        await launchApprovedDraft(ctx, service, id, draft, force);
         return;
       }
 
@@ -554,27 +590,10 @@ export function registerWorkstreamRuntimeCommands(registry: CommandRegistry): vo
           return;
         }
         if (!draft.approved) {
-          ctx.print(`Proposal ${id} is not approved yet. Run /workstream approve ${id} first.`);
-          return;
-        }
-        const attemptsCheck = validateAttempts(draft.spec);
-        if (attemptsCheck.violations.length > 0) {
-          ctx.print(`Cannot launch ${id} — best-of-N plan constraints are violated:\n${attemptsCheck.violations.map((v) => `  - ${v}`).join('\n')}\nFix the plan (or drop the attempts) and re-approve.`);
-          return;
-        }
-        if (!force) {
-          const quotaWarning = await checkFanoutQuotaWarning(ctx, draft);
-          if (quotaWarning) {
-            ctx.print(quotaWarning);
-            return;
-          }
-        }
-        const result = service.launchDraft(id);
-        if (!result) {
-          ctx.print(`Could not launch ${id}.`);
+          ctx.print(`Proposal ${id} is not approved yet. Run /workstream approve ${id} first (or approve launches it directly).`);
           return;
         }
-        ctx.print(`Launched workstream ${result.workstreamId} — track it with /workstream status ${result.workstreamId} or the Fleet panel.`);
+        await launchApprovedDraft(ctx, service, id, draft, force);
         return;
       }
 
@@ -616,9 +635,9 @@ export function registerWorkstreamRuntimeCommands(registry: CommandRegistry): vo
         + '  /workstream edit-item <id> <item#> <new brief...>\n'
         + '  /workstream remove-item <id> <item#>\n'
         + '  /workstream move-item <id> <item#> <new-position#>\n'
-        + '  /workstream approve <id>\n'
+        + '  /workstream approve <id> [--no-launch] [--force]   (approves AND launches in one act)\n'
         + '  /workstream edit <id> [--isolation shared|worktree] <new task...>\n'
-        + '  /workstream launch <id> [--force]\n'
+        + '  /workstream launch <id> [--force]   (for a --no-launch-held or re-launched draft)\n'
         + '  /workstream cancel <id>',
       );
     },

package/src/input/commands/worktree-runtime.ts

@@ -145,19 +145,46 @@ export function registerWorktreeRuntimeCommands(registry: CommandRegistry): void
           : `${header}: ${targetKind} ${targetId}\n  No attached worktrees tracked.`);
         return;
       }
-      if (sub === 'pause' || sub === 'resume' || sub === 'keep' || sub === 'discard') {
+      if (sub === 'discard') {
+        // Discard is a real destructive act, not a metadata flip: route it
+        // through the worktrees.discard operator verb (preservation commit,
+        // git worktree removal, honest receipt) — the SAME behavior as the
+        // Fleet panel's D key. Typing the verb with an explicit path is the
+        // confirmation.
+        const path = args[1];
+        if (!path) {
+          ctx.print('Usage: /worktree discard <path>');
+          return;
+        }
+        const rpc = getOperatorRpc(ctx);
+        if (!rpc.available) {
+          ctx.print(`[worktree discard] ${rpc.reason}`);
+          return;
+        }
+        try {
+          const receipt = await rpc.sdk.operator.invoke('worktrees.discard', { path });
+          if (receipt.ok) {
+            ctx.print([
+              `[worktree discard] Discarded ${receipt.path}`,
+              `  branch kept: ${receipt.branch || '(unknown)'}`,
+              `  preservation commit: ${receipt.preservedCommit || '(none — nothing to preserve)'}`,
+              `  ${receipt.detail}`,
+            ].join('\n'));
+          } else {
+            ctx.print(`[worktree discard] refused for ${receipt.path}: ${receipt.detail}`);
+          }
+        } catch (error) {
+          ctx.print(`[worktree discard] round-trip request failed: ${describeOperatorRpcError(error)}`);
+        }
+        return;
+      }
+      if (sub === 'pause' || sub === 'resume' || sub === 'keep') {
         const path = args[1];
         if (!path) {
           ctx.print(`Usage: /worktree ${sub} <path>`);
           return;
         }
-        const nextState = sub === 'resume'
-          ? 'active'
-          : sub === 'pause'
-            ? 'paused'
-            : sub === 'keep'
-              ? 'kept'
-              : 'discard';
+        const nextState = sub === 'resume' ? 'active' : sub === 'pause' ? 'paused' : 'kept';
         runtime.setState(path, nextState);
         ctx.print(`Updated ${path} to state ${nextState}.`);
         return;

package/src/input/commands.ts

@@ -17,6 +17,9 @@ import { registerOperatorRuntimeCommands } from './commands/operator-runtime.ts'
 import { registerPluginRuntimeCommands } from './commands/plugin-runtime.ts';
 import { registerDiffRuntimeCommands } from './commands/diff-runtime.ts';
 import { registerGitRuntimeCommands } from './commands/git-runtime.ts';
+import { registerQueueRuntimeCommands } from './commands/queue-runtime.ts';
+import { registerPowerRuntimeCommands } from './commands/power-runtime.ts';
+import { registerGraphRuntimeCommands } from './commands/graph-runtime.ts';
 import { registerTestRuntimeCommands } from './commands/test-runtime.ts';
 import { registerNotifyRuntimeCommands } from './commands/notify-runtime.ts';
 import { registerReplayRuntimeCommands } from './commands/replay-runtime.ts';
@@ -36,7 +39,6 @@ import { registerRemoteRuntimeCommands } from './commands/remote-runtime.ts';
 import { registerTeleportRuntimeCommands } from './commands/teleport-runtime.ts';
 import { registerSubscriptionRuntimeCommands } from './commands/subscription-runtime.ts';
 import { registerHooksRuntimeCommands } from './commands/hooks-runtime.ts';
-import { registerFlagsRuntimeCommands } from './commands/flags-runtime.ts';
 import { registerEditorRuntimeCommands } from './commands/editor-runtime.ts';
 import { registerControlRoomRuntimeCommands } from './commands/control-room-runtime.ts';
 import { registerMcpRuntimeCommands } from './commands/mcp-runtime.ts';
@@ -56,11 +58,13 @@ import { registerLocalProviderRuntimeCommands } from './commands/local-provider-
 import { registerHealthRuntimeCommands } from './commands/health-runtime.ts';
 import { registerSettingsSyncRuntimeCommands } from './commands/settings-sync-runtime.ts';
 import { registerWorktreeRuntimeCommands } from './commands/worktree-runtime.ts';
+import { registerAcpRuntimeCommands } from './commands/acp-runtime.ts';
 import { registerProviderAccountsRuntimeCommands } from './commands/provider-accounts-runtime.ts';
 import { registerLocalAuthRuntimeCommands } from './commands/local-auth-runtime.ts';
 import { registerIntelligenceRuntimeCommands } from './commands/intelligence-runtime.ts';
 import { registerConversationRuntimeCommands } from './commands/conversation-runtime.ts';
 import { registerQrcodeRuntimeCommands } from './commands/qrcode-runtime.ts';
+import { registerDevicesRuntimeCommands } from './commands/devices-runtime.ts';
 import { registerRelayRuntimeCommands } from './commands/relay-runtime.ts';
 import { registerOnboardingRuntimeCommands } from './commands/onboarding-runtime.ts';
 import { registerTtsRuntimeCommands } from './commands/tts-runtime.ts';
@@ -102,6 +106,9 @@ export const BUILTIN_COMMAND_GROUPS: readonly BuiltinCommandGroup[] = [
   { category: 'Plugins', register: registerPluginRuntimeCommands },
   { category: 'Diff & Review', register: registerDiffRuntimeCommands },
   { category: 'Git', register: registerGitRuntimeCommands },
+  { category: 'Shell & Session', register: registerQueueRuntimeCommands },
+  { category: 'Shell & Session', register: registerPowerRuntimeCommands },
+  { category: 'Automation', register: registerGraphRuntimeCommands },
   { category: 'Testing', register: registerTestRuntimeCommands },
   { category: 'Notifications', register: registerNotifyRuntimeCommands },
   { category: 'Sessions & Replay', register: registerReplayRuntimeCommands },
@@ -121,7 +128,6 @@ export const BUILTIN_COMMAND_GROUPS: readonly BuiltinCommandGroup[] = [
   { category: 'Remote', register: registerTeleportRuntimeCommands },
   { category: 'Subscriptions', register: registerSubscriptionRuntimeCommands },
   { category: 'Hooks', register: registerHooksRuntimeCommands },
-  { category: 'Feature Flags', register: registerFlagsRuntimeCommands },
   { category: 'Editor', register: registerEditorRuntimeCommands },
   { category: 'Control Room', register: registerControlRoomRuntimeCommands },
   { category: 'MCP', register: registerMcpRuntimeCommands },
@@ -135,11 +141,13 @@ export const BUILTIN_COMMAND_GROUPS: readonly BuiltinCommandGroup[] = [
   { category: 'Health', register: registerHealthRuntimeCommands },
   { category: 'Settings Sync', register: registerSettingsSyncRuntimeCommands },
   { category: 'Worktrees', register: registerWorktreeRuntimeCommands },
+  { category: 'Fleet', register: registerAcpRuntimeCommands },
   { category: 'Provider Accounts', register: registerProviderAccountsRuntimeCommands },
   { category: 'Local Auth', register: registerLocalAuthRuntimeCommands },
   { category: 'Intelligence', register: registerIntelligenceRuntimeCommands },
   { category: 'Conversation', register: registerConversationRuntimeCommands },
   { category: 'QR Codes', register: registerQrcodeRuntimeCommands },
+  { category: 'Security', register: registerDevicesRuntimeCommands },
   { category: 'Relay', register: registerRelayRuntimeCommands },
   { category: 'Onboarding', register: registerOnboardingRuntimeCommands },
   { category: 'Voice & TTS', register: registerTtsRuntimeCommands },