@pellux/goodvibes-tui 2.0.13 → 2.0.15

package/src/input/commands/payment-card-intake.ts

@@ -1,5 +1,5 @@
 /**
- * /payments card — capture a payment card through the composer's concealed
+ * /payments card, capture a payment card through the composer's concealed
  * input mode, following the same guided-chain pattern as /channel pair
  * (channel-pairing.ts) and the SAME concealed-input mechanism as
  * provider-key-intake.ts (see concealed-input.ts).
@@ -9,48 +9,48 @@
  * masked concealed-input prompt in turn and stored via
  * persistSecretBackedConfigValue, the same secret-manager + config-reference
  * path every other secret-backed setting in this app uses. The plaintext
- * never reaches the transcript, input history, or a log line — only a
+ * never reaches the transcript, input history, or a log line, only a
  * redacted confirmation is printed after each field.
  *
  * Billing and shipping address are ordinary (non-secret) config fields, now
  * real structured CONFIG_SCHEMA entries (payments.billingAddress.{name,
  * line1, line2, city, region, postalCode, country} and the shippingAddress
- * equivalents) — this command points the user at the Payments settings
+ * equivalents), this command points the user at the Payments settings
  * category (or /config payments) to set them, the same way /channel pair
  * directs non-secret credential fields, rather than routing plain text
  * through the concealed (masked) input path where it does not belong.
  *
- * Stored with `scope: 'daemon'`: the daemon — not just this interactive
- * client — is what completes an autonomous purchase, so the credential must
+ * Stored with `scope: 'daemon'`: the daemon, not just this interactive
+ * client, is what completes an autonomous purchase, so the credential must
  * land in the daemon-scoped secret tier the daemon actually reads.
  *
  * The config-reference half (the `goodvibes://secrets/...` marker
  * persistSecretBackedConfigValue writes alongside the secret) goes through
- * `ctx.platform.configManager` directly — the same real ConfigManager every
+ * `ctx.platform.configManager` directly, the same real ConfigManager every
  * other command in this app uses, not a TUI-local store. See
  * payments-config.ts's header comment for why these particular keys
  * (`payments.cardNumber`, etc., flat sub-keys under the SDK's real
  * `payments` section) are ConfigManager-safe even though the SDK's
  * CONFIG_SCHEMA has no scalar entry for them yet: `payments.` is a
  * daemon-owned config prefix, so the reference lands in the daemon's own
- * settings file and is visible to the daemon, the webui and the agent —
+ * settings file and is visible to the daemon, the webui and the agent,
  * not just this TUI session.
  *
  * ── Card details are entered only at a local terminal or the webui ────────
  *
  * Owner ruling (see the SDK's platform/payments/entry-surface.ts): card
- * material may be TYPED only on `tui`, `agent-terminal`, or `webui` — never
+ * material may be TYPED only on `tui`, `agent-terminal`, or `webui`, never
  * over Telegram, ntfy, Discord, Slack, WhatsApp, Signal, a webhook, or any
  * other remote messaging surface. A card number typed into a hosted chat is
  * stored on that provider's own servers, in history this app cannot erase,
- * and it already passed through their infrastructure before reaching us —
+ * and it already passed through their infrastructure before reaching us,
  * our own encryption at rest does nothing for a value copied elsewhere on
  * its way in. This is a SEPARATE question from which surfaces may APPROVE or
  * VETO a purchase (every command-authority channel still can); the two are
  * never merged into one check.
  *
  * This command always runs inside the TUI's own composer (CARD_ENTRY_SURFACE
- * below), which the SDK's allowlist accepts — so this gate changes nothing
+ * below), which the SDK's allowlist accepts, so this gate changes nothing
  * about today's behavior. What it buys is that the refusal already exists
  * the moment this app (or a shared command registry) ever grows a path that
  * lets `/payments card` be reached from somewhere else: the check is real
@@ -69,7 +69,7 @@ import {
 } from '../payments-config.ts';
 
 /**
- * This command is wired only into the TUI's own composer command registry —
+ * This command is wired only into the TUI's own composer command registry,
  * it is never reachable from a channel bridge (Telegram, Discord, ...), each
  * of which has its own separate command surface in the daemon. The constant
  * still names the surface explicitly and is checked through the SDK's own
@@ -110,7 +110,7 @@ function renderCardStatus(ctx: CommandContext): string[] {
 /** Chain a masked prompt for each card secret field, storing each through the daemon-scoped secret tier. */
 function promptCardFields(ctx: CommandContext, fields: readonly CardField[], index: number): void {
   if (index >= fields.length) {
-    ctx.print('\nCard stored. Billing/shipping address and the rest of the payment capability are ordinary config values — set them via /config payments or the Settings > Payments category.');
+    ctx.print('\nCard stored. Billing/shipping address and the rest of the payment capability are ordinary config values; set them via /config payments or the Settings > Payments category.');
     ctx.renderRequest();
     return;
   }
@@ -119,7 +119,7 @@ function promptCardFields(ctx: CommandContext, fields: readonly CardField[], ind
     ctx.print('[payments] Concealed input is unavailable on this surface; card entry requires it and cannot fall back to plaintext.');
     return;
   }
-  ctx.print(`[payments] Enter ${field.label} (e.g. ${field.placeholder}) — masked; Enter to store, Esc to stop.`);
+  ctx.print(`[payments] Enter ${field.label} (e.g. ${field.placeholder}): masked; Enter to store, Esc to stop.`);
   ctx.beginConcealedInput({
     label: field.label,
     onSubmit: (value) => {
@@ -153,7 +153,7 @@ function promptCardFields(ctx: CommandContext, fields: readonly CardField[], ind
 /**
  * Start the card-entry flow, gated on the SDK's own entry-surface allowlist
  * rather than an assumption baked into this command. `surface` defaults to
- * this command's real, fixed identity (CARD_ENTRY_SURFACE) — exposed as a
+ * this command's real, fixed identity (CARD_ENTRY_SURFACE), exposed as a
  * parameter only so tests can drive the refusal path without needing this
  * app to actually be reachable from a remote channel.
  */
@@ -166,11 +166,11 @@ export function startCardEntryFlow(ctx: CommandContext, surface: string = CARD_E
     ctx.print('[payments] Concealed input is unavailable on this surface.');
     return;
   }
-  ctx.print(`Entering ${CARD_SECRET_FIELDS.length} card field(s) — masked; Esc to stop at any point.`);
+  ctx.print(`Entering ${CARD_SECRET_FIELDS.length} card field(s): masked; Esc to stop at any point.`);
   promptCardFields(ctx, CARD_SECRET_FIELDS, 0);
 }
 
-/** Entry point for `/payments [card|status]` — exported directly so tests can drive it without the registry. */
+/** Entry point for `/payments [card|status]`, exported directly so tests can drive it without the registry. */
 export function runPaymentsCommand(args: readonly string[], ctx: CommandContext): void {
   const sub = (args[0] ?? '').toLowerCase();
   if (sub === '' || sub === 'status') {
@@ -184,7 +184,7 @@ export function runPaymentsCommand(args: readonly string[], ctx: CommandContext)
   ctx.print('Usage: /payments [card|status]');
 }
 
-/** Card secret fields in prompt order — exported for tests that need to drive the chain field-by-field. */
+/** Card secret fields in prompt order, exported for tests that need to drive the chain field-by-field. */
 export { CARD_SECRET_FIELDS };
 
 export function registerPaymentCardCommands(registry: CommandRegistry): void {

package/src/input/commands/permissions-provenance.ts

@@ -9,7 +9,7 @@ import { SHIPPED_CREDENTIAL_READ_RULES } from '@pellux/goodvibes-sdk/platform/pe
 // Shows every permission-relevant setting in effect AND where each value came
 // from. Provenance is taken from the platform's own ConfigManager.
 // describeConfigKeySource (the recorded on-disk tier: shared / project / global
-// / default) — never a guess. Because CLI --config overrides mutate the config
+// / default), never a guess. Because CLI --config overrides mutate the config
 // in memory WITHOUT touching any file, we additionally compare the live value
 // against the recorded on-disk / built-in-default value: when they diverge, the
 // value was changed at runtime and its true origin is NOT recorded on disk, so
@@ -34,7 +34,7 @@ export interface PermissionProvenanceRow {
   readonly note?: string;
 }
 
-/** A shipped (SDK-managed, code-embedded) policy rule — not driven by any config key, so it has no ConfigKey-based tier. */
+/** A shipped (SDK-managed, code-embedded) policy rule, not driven by any config key, so it has no ConfigKey-based tier. */
 export interface ShippedPolicyRuleRow {
   readonly id: string;
   readonly effect: 'allow' | 'deny';
@@ -50,8 +50,8 @@ export interface PermissionProvenance {
   /**
    * Shipped managed policy rules baked into the SDK's PermissionManager
    * (currently: default-deny reads of well-known credential stores). These
-   * are NOT config-key-driven — there is no on/off setting and no file they
-   * could be recorded in — so they cannot use the shared/project/global/
+   * are NOT config-key-driven, there is no on/off setting and no file they
+   * could be recorded in, so they cannot use the shared/project/global/
    * default tier model above. Listed separately with an honest "shipped
    * default" origin rather than force-fit into a ConfigKey row.
    */
@@ -165,7 +165,7 @@ function buildRow(
   } else if (originPath) {
     const fv = fileValue(originPath, key);
     if (!fv || !fv.present) {
-      // The tier says this file carries the key, but we could not read it back —
+      // The tier says this file carries the key, but we could not read it back,
       // do not guess; report the origin as unrecorded.
       return { ...base, origin: `origin not recorded (${tier} config file could not be read back)`, originPath, recorded: false, overridden: false };
     }
@@ -221,7 +221,7 @@ function displayValue(value: unknown): string {
 /** Render the provenance panel as plain lines for the command surface. */
 export function renderPermissionProvenance(provenance: PermissionProvenance): string {
   const lines: string[] = [
-    'Permissions — settings in effect and where each came from',
+    'Permissions: settings in effect and where each came from',
     `  session mode: ${provenance.sessionMode} (${provenance.sessionModeLabel})`,
     '',
     'Every line is traceable to its recorded origin. A value changed at runtime',
@@ -248,7 +248,7 @@ export function renderPermissionProvenance(provenance: PermissionProvenance): st
 
   if (provenance.shippedRules.length > 0) {
     lines.push('');
-    lines.push('Shipped policy rules — baked into the SDK, not driven by any config key');
+    lines.push('Shipped policy rules: baked into the SDK, not driven by any config key');
     lines.push('(origin: shipped default; a user allow-rule always wins over these):');
     for (const rule of provenance.shippedRules) {
       lines.push(`  ${rule.id}  [${rule.effect}]  tools: ${rule.toolPattern}`);

package/src/input/commands/permissions-runtime.ts

@@ -78,7 +78,7 @@ async function revokeRememberedRule(ctx: CommandContext, ruleId: string): Promis
 }
 
 /**
- * `/permissions` — the permission settings surface. With no arguments it prints
+ * `/permissions`, the permission settings surface. With no arguments it prints
  * every permission-relevant setting in effect and where each value came from
  * (provenance; read-only). `rules` lists the durable remembered approvals with a
  * press-Enter revoke; `revoke <id>` removes one by id. Revokes hit the same

package/src/input/commands/planning-runtime.ts

@@ -15,7 +15,7 @@ import { togglePlanMode, permissionModeLabel, type PermissionModeValue } from '.
  *
  * `dismiss` and `answer` are now REAL subcommands (handled above this
  * guard), so they were removed from the refuse-list. `pause`/`stop`/`cancel`
- * remain here — they still have no backing verb and must not seed a goal.
+ * remain here, they still have no backing verb and must not seed a goal.
  */
 const PSEUDO_SUBCOMMAND_VERBS = new Set(['pause', 'stop', 'cancel']);
 
@@ -178,7 +178,7 @@ export function registerPlanningRuntimeCommands(registry: CommandRegistry): void
         return;
       }
 
-      // /plan dismiss — archive the current plan. Dismisses the active
+      // /plan dismiss, archive the current plan. Dismisses the active
       // execution plan (ExecutionPlanManager.dismiss, honest per-state) AND
       // deactivates the project-planning interview state shown in the modal so a
       // later /plan <goal> starts fresh. Mid-execution is refused outright.
@@ -223,7 +223,7 @@ export function registerPlanningRuntimeCommands(registry: CommandRegistry): void
         return;
       }
 
-      // /plan answer <n|question-id> <text> — record a real answer to an
+      // /plan answer <n|question-id> <text>, record a real answer to an
       // open planning question (moves open → answered, consumed on next refine).
       if (args[0] === 'answer') {
         if (!projectPlanningService || !projectId) {
@@ -265,7 +265,7 @@ export function registerPlanningRuntimeCommands(registry: CommandRegistry): void
       }
 
       // Defense (review finding): a single verb-looking token is almost never a
-      // real planning goal — it is a mistyped or removed subcommand. The
+      // real planning goal, it is a mistyped or removed subcommand. The
       // Planning modal used to dispatch `/plan dismiss`, which has no
       // subcommand and silently fell through to this free-form branch, seeding
       // the goal with the literal "dismiss". Refuse to seed on a lone
@@ -273,7 +273,7 @@ export function registerPlanningRuntimeCommands(registry: CommandRegistry): void
       // corrupting the goal.
       if (args.length === 1 && PSEUDO_SUBCOMMAND_VERBS.has(args[0].toLowerCase())) {
         ctx.print(
-          `Unknown /plan subcommand "${args[0]}" — did you mean panel, approve, list, show, or status? ` +
+          `Unknown /plan subcommand "${args[0]}": did you mean panel, approve, list, show, or status? ` +
           `To seed a planning goal, use /plan <a real sentence describing the change>.`,
         );
         return;
@@ -318,13 +318,13 @@ export function registerPlanningRuntimeCommands(registry: CommandRegistry): void
   });
 
   // /plan now enters/toggles the SESSION PERMISSION plan mode (read-only
-  // planning posture) — distinct from the project-planning manager above, which
+  // planning posture), distinct from the project-planning manager above, which
   // moved to /project-plan (alias /planning). The change goes through the SDK
   // config surface (permissions.mode), the same value the PermissionManager
   // reads and Shift+Tab cycles, so plan mode is one concept across surfaces.
   registry.register({
     name: 'plan',
-    description: 'Enter or exit plan mode — a read-only planning posture where writes, commands, and network calls are blocked',
+    description: 'Enter or exit plan mode, a read-only planning posture where writes, commands, and network calls are blocked',
     usage: '[on | off | toggle]',
     argsHint: '[on|off]',
     handler(args, ctx) {
@@ -337,8 +337,8 @@ export function registerPlanningRuntimeCommands(registry: CommandRegistry): void
         : togglePlanMode(current);
       configManager.set('permissions.mode', next);
       ctx.print(next === 'plan'
-        ? '[Permissions] Plan mode ON — read-only: writes, commands, and network calls are blocked until you exit (/plan off or Shift+Tab).'
-        : `[Permissions] Plan mode OFF — mode: ${permissionModeLabel(next)}.`);
+        ? '[Permissions] Plan mode ON; read-only: writes, commands, and network calls are blocked until you exit (/plan off or Shift+Tab).'
+        : `[Permissions] Plan mode OFF; mode: ${permissionModeLabel(next)}.`);
     },
   });
 }

package/src/input/commands/platform-services-runtime.ts

@@ -130,7 +130,7 @@ export function registerPlatformServicesRuntimeCommands(registry: CommandRegistr
   registry.register({
     name: 'helpers',
     aliases: ['integration-api'],
-    description: 'Review local integration helper API surfaces for remote clients and future web frontends',
+    description: 'Review local integration helper APIs for remote clients and future web frontends',
     usage: '[review|bundle export <path>|bundle inspect <path>]',
     handler(args, ctx) {
       const shellPaths = requireShellPaths(ctx);
@@ -188,7 +188,7 @@ export function registerPlatformServicesRuntimeCommands(registry: CommandRegistr
   registry.register({
     name: 'deeplink',
     aliases: ['link'],
-    description: 'Review and package deep-link entrypoints for setup and operator surfaces',
+    description: 'Review and package deep-link entrypoints for setup and operator screens',
     usage: '[review|open <surface> [target]|bundle export <path>|bundle inspect <path>]',
     handler(args, ctx) {
       const shellPaths = requireShellPaths(ctx);

package/src/input/commands/policy-dispatch.ts

@@ -219,7 +219,7 @@ async function handlePreflight(_args: string[], context: CommandContext): Promis
   context.print(`[policy] ${review.summary}`);
   for (const issue of review.issues.slice(0, 8)) {
     const subject = issue.serverName ? ` ${issue.serverName}` : '';
-    const detail = issue.detail ? ` — ${issue.detail}` : '';
+    const detail = issue.detail ? `: ${issue.detail}` : '';
     context.print(`  [${issue.severity.toUpperCase()}] ${issue.source}${subject}: ${issue.message}${detail}`);
   }
 }
@@ -235,14 +235,14 @@ async function handlePromote(args: string[], context: CommandContext): Promise<v
   if (!result.ok) {
     context.print(`[policy] Promotion blocked: ${result.error}`);
     if (result.gate) {
-      context.print(`[policy] Gate: ${result.gate.status} — divergence rate ${result.gate.divergenceRate !== undefined ? fmtRate(result.gate.divergenceRate) : 'unknown'} (threshold ${fmtRate(result.gate.threshold)}, ${result.gate.totalEvaluations} evaluations).`);
+      context.print(`[policy] Gate: ${result.gate.status}; divergence rate ${result.gate.divergenceRate !== undefined ? fmtRate(result.gate.divergenceRate) : 'unknown'} (threshold ${fmtRate(result.gate.threshold)}, ${result.gate.totalEvaluations} evaluations).`);
     }
     return;
   }
   const current = registry.getCurrent();
   context.print(`[policy] Promoted: "${result.bundleId}" is now the active enforcement policy.`);
   if (result.gate) {
-    context.print(`[policy] Gate at promotion: ${result.gate.status} — divergence rate ${result.gate.divergenceRate !== undefined ? fmtRate(result.gate.divergenceRate) : 'unknown'} (threshold ${fmtRate(result.gate.threshold)}).`);
+    context.print(`[policy] Gate at promotion: ${result.gate.status}; divergence rate ${result.gate.divergenceRate !== undefined ? fmtRate(result.gate.divergenceRate) : 'unknown'} (threshold ${fmtRate(result.gate.threshold)}).`);
   }
   if (current) context.print(bundleSummary('[policy] Active bundle', current));
   policyState.notify();
@@ -280,7 +280,7 @@ async function handleStatus(_args: string[], context: CommandContext): Promise<v
   const dashboard = policyState.getDashboard();
   if (dashboard) {
     const snap = dashboard.getSnapshot();
-    context.print(`[policy] Divergence gate: ${snap.gate.status} — ${snap.gate.divergenceRate !== undefined ? fmtRate(snap.gate.divergenceRate) : fmtRate(snap.report.overall.divergenceRate)} (${snap.report.overall.totalEvaluations} evaluations).`);
+    context.print(`[policy] Divergence gate: ${snap.gate.status}; ${snap.gate.divergenceRate !== undefined ? fmtRate(snap.gate.divergenceRate) : fmtRate(snap.report.overall.divergenceRate)} (${snap.report.overall.totalEvaluations} evaluations).`);
   } else {
     context.print('[policy] No active simulation dashboard.');
   }
@@ -306,11 +306,11 @@ export function renderPolicyUsage(): string {
 // this._state.recordTrendEntry() directly and /policy had no equivalent verb.
 // This exposes it as a thin wrapper: recordTrendEntry() forwards to the attached
 // DivergencePanel, so it only captures a sample while a simulation dashboard is
-// active — reported honestly here rather than silently no-op'ing.
+// active, reported honestly here rather than silently no-op'ing.
 function handleRecordTrend(_args: string[], context: CommandContext): void {
   const policyState = getPolicyState(context);
   if (!policyState.getDashboard()) {
-    context.print('[policy] No active simulation dashboard — nothing to sample. Run `/policy simulate` first, then `/policy record-trend`.');
+    context.print('[policy] No active simulation dashboard; nothing to sample. Run `/policy simulate` first, then `/policy record-trend`.');
     return;
   }
   policyState.recordTrendEntry();

package/src/input/commands/power-runtime.ts

@@ -2,20 +2,20 @@ import type { CommandRegistry } from '../command-registry.ts';
 import { powerStatusLines } from '../../core/power-status.ts';
 
 // ---------------------------------------------------------------------------
-// /power — host sleep ownership (the ops/status idiom surface for power.*).
+// /power, host sleep ownership (the ops/status idiom surface for power.*).
 //
-// Shows the honest account of sleep ownership — the "sleep disabled" chip
+// Shows the honest account of sleep ownership, the "sleep disabled" chip
 // meaning, each "held because X" work-inhibition reason, and the lid-split note
 // rendered VERBATIM when the OS could block idle-sleep but not lid-close
-// suspend — and toggles the daemon-held keep-awake switch. Owner ruling: the
+// suspend, and toggles the daemon-held keep-awake switch. Owner ruling: the
 // always-visible chip IS the safety mechanism, so there is no timer and no
-// AC-only option — keep-awake is exactly one on/off toggle.
+// AC-only option, keep-awake is exactly one on/off toggle.
 // ---------------------------------------------------------------------------
 
 export function registerPowerRuntimeCommands(registry: CommandRegistry): void {
   registry.register({
     name: 'power',
-    description: 'Host sleep ownership — show status and toggle keep-awake',
+    description: 'Host sleep ownership: show status and toggle keep-awake',
     usage: '[status | on | off | toggle]',
     argsHint: '[status|on|off|toggle]',
     async handler(args, ctx) {
@@ -43,7 +43,7 @@ export function registerPowerRuntimeCommands(registry: CommandRegistry): void {
         const current = ctx.getPowerState().keepAwake;
         const next = sub === 'on' ? true : sub === 'off' ? false : !current;
         const state = await ctx.setKeepAwake(next);
-        const lines = [state.keepAwake ? 'Keep-awake ON — this host will not idle-sleep.' : 'Keep-awake OFF.'];
+        const lines = [state.keepAwake ? 'Keep-awake ON: this host will not idle-sleep.' : 'Keep-awake OFF.'];
         // Surface the honest lid-split note verbatim if the SDK served one.
         if (state.note) lines.push(`  ${state.note}`);
         ctx.print(lines.join('\n'));

package/src/input/commands/principals-runtime.ts

@@ -1,7 +1,7 @@
 /**
  * principals-runtime.ts
  *
- * `/principals` — identity-mapping admin over `principals.*`: named
+ * `/principals`, identity-mapping admin over `principals.*`: named
  * principals (people, bots, services, tokens) and the channel identities
  * ({channel, value} pairs, e.g. {channel:'slack', value:'U123'}) mapped to
  * them. Goes over the operator wire (see operator-rpc.ts) for the same
@@ -10,7 +10,7 @@
  *
  * `principals.resolve` is the honest lookup this command exists to make
  * reachable: an unmapped identity resolves to the shared "unknown" principal
- * with `known: false` — the registry never guesses, and this command never
+ * with `known: false`, the registry never guesses, and this command never
  * papers over that with a name that looks real.
  */
 import type { CommandRegistry } from '../command-registry.ts';
@@ -199,7 +199,7 @@ export function registerPrincipalsRuntimeCommands(registry: CommandRegistry): vo
         try {
           const result = await rpc.sdk.operator.invoke('principals.resolve', { channel, value });
           if (!result.known) {
-            ctx.print(`[principals resolve] unknown principal — ${channel}:${value} is not mapped to any registered principal.`);
+            ctx.print(`[principals resolve] unknown principal: ${channel}:${value} is not mapped to any registered principal.`);
             return;
           }
           ctx.print(`[principals resolve] ${channel}:${value} -> ${result.principal.name}\n${renderPrincipal(result.principal)}`);

package/src/input/commands/product-runtime.ts

@@ -167,13 +167,13 @@ export function registerProductRuntimeCommands(registry: CommandRegistry): void
         const choice = (args[1] ?? '').toLowerCase();
         if (choice === 'trusted' || choice === 'trust' || choice === 'full' || choice === 'yes') {
           await manager.setLevel('trusted');
-          ctx.print('This workspace is now TRUSTED — all tools may run, subject to your permission settings.');
+          ctx.print('This workspace is now TRUSTED; all tools may run, subject to your permission settings.');
           ctx.renderRequest();
           return;
         }
         if (choice === 'restricted' || choice === 'restrict' || choice === 'readonly' || choice === 'read-only' || choice === 'no') {
           await manager.setLevel('restricted');
-          ctx.print('This workspace is now RESTRICTED — read-only exploration; write/execute/delegate tools are denied until you run `/trust workspace trusted`.');
+          ctx.print('This workspace is now RESTRICTED; read-only exploration; write/execute/delegate tools are denied until you run `/trust workspace trusted`.');
           ctx.renderRequest();
           return;
         }
@@ -189,7 +189,7 @@ export function registerProductRuntimeCommands(registry: CommandRegistry): void
             ? 'All tools may run, subject to your normal permission settings.'
             : 'Read-only exploration: write, execute, and delegate tools are denied until you trust this workspace.',
         ];
-        if (!manager.isDecided()) lines.push('Not yet decided — run `/trust workspace trusted` to enable full capability.');
+        if (!manager.isDecided()) lines.push('Not yet decided: run `/trust workspace trusted` to enable full capability.');
         const registrationManager = ctx.workspace.workspaceRegistrationManager;
         if (registrationManager) {
           lines.push(`Registration: ${await registrationManager.describe()}`);

package/src/input/commands/profile-render.ts

@@ -3,7 +3,7 @@
  *
  * How `/profile` puts the owner profile on screen. Every function here is pure:
  * it takes a checked response (profile-types.ts) and returns a string. Nothing
- * in this file reads a file, opens a connection, or writes to a log — which is
+ * in this file reads a file, opens a connection, or writes to a log, which is
  * what makes the containment rule in docs/owner-profile.md §10/§11.3 testable
  * rather than a claim: a profile value can only leave through the string these
  * functions return, and the only thing that consumes that string is `ctx.print`.
@@ -17,7 +17,7 @@
  * Two rules the renderers hold to:
  *
  *   - **A write never echoes the value.** `renderProfileWriteResult` prints the
- *     daemon's own one-line disclosure ("Noted — saved your office address to
+ *     daemon's own one-line disclosure ("Noted, saved your office address to
  *     your profile.") and the field names that changed. The value the owner just
  *     set is deliberately absent: repeating it puts a closed-tier string into the
  *     transcript for no benefit (§8.2).
@@ -53,7 +53,7 @@ export function describeProfileState(state: ProfileStateView): string | null {
     return `Your profile could not be read: ${state.reason ?? 'no reason given'}\n  file: ${state.path}`;
   }
   if (state.exists === false) {
-    return `Your profile is empty — nothing has been recorded yet.\n  file: ${state.path}`;
+    return `Your profile is empty: nothing has been recorded yet.\n  file: ${state.path}`;
   }
   return null;
 }
@@ -66,7 +66,7 @@ function padTo(text: string, width: number): string {
  * One field row: the label as written in the file, the value, and the field id
  * so `/profile where <id>` and `/profile forget <id>` are copy-pasteable.
  *
- * An invalid value is shown verbatim with its reason rather than hidden — the
+ * An invalid value is shown verbatim with its reason rather than hidden, the
  * owner typed it, and a parser that disliked it is not grounds for pretending it
  * is not there (§4.3).
  */
@@ -88,7 +88,7 @@ function renderSection(section: ProfileSectionView): string {
 }
 
 /**
- * "What do you know about me?" — the whole document, by section, in the order
+ * "What do you know about me?", the whole document, by section, in the order
  * the file has it. Sections the owner added himself render exactly like the
  * canonical ones, because his headings are as real as the built-in ones (§4.5).
  */
@@ -120,7 +120,7 @@ function renderProvenanceDetail(provenance: ProfileProvenanceView, indent: strin
 }
 
 /**
- * "Where did you get that?" — the surface, the date and the owner's verbatim
+ * "Where did you get that?", the surface, the date and the owner's verbatim
  * words, plus every superseded predecessor still retained as a history comment.
  *
  * A field with no suffix reports that he wrote it by hand. That is the honest
@@ -135,9 +135,9 @@ export function renderProfileProvenance(report: ProfileProvenanceReportView): st
   }
 
   if (!report.present) {
-    lines.push('  not currently recorded — only superseded history remains:');
+    lines.push('  not currently recorded: only superseded history remains:');
   } else if (report.handEdited) {
-    lines.push('  no provenance recorded — you wrote or edited this line by hand.');
+    lines.push('  no provenance recorded: you wrote or edited this line by hand.');
   } else if (report.provenance) {
     lines.push(...renderProvenanceDetail(report.provenance, '  '));
   } else {
@@ -149,7 +149,7 @@ export function renderProfileProvenance(report: ProfileProvenanceReportView): st
     for (const previous of report.superseded) {
       lines.push(`    ${previous.value}   (replaced ${previous.supersededOn})`);
       if (previous.provenance) lines.push(...renderProvenanceDetail(previous.provenance, '      '));
-      else lines.push('      no provenance recorded — hand-written.');
+      else lines.push('      no provenance recorded: hand-written.');
     }
   }
   return lines.join('\n');
@@ -167,7 +167,7 @@ function renderChangeNames(result: ProfileWriteResultView): string[] {
 /**
  * What a write actually did.
  *
- * `ok: false` prints the daemon's reason and nothing else — no "done", no
+ * `ok: false` prints the daemon's reason and nothing else, no "done", no
  * change list, no disclosure. That covers the case §9.2 names explicitly:
  * forgetting something that was not there reports that it was not there.
  *
@@ -180,7 +180,7 @@ export function renderProfileWriteResult(result: ProfileWriteResultView): string
     return `${PROFILE_TAG} ${result.reason ?? 'the write was refused, and the daemon gave no reason.'}`;
   }
   if (result.changes.length === 0) {
-    return `${PROFILE_TAG} nothing changed${result.reason ? ` — ${result.reason}` : '.'}`;
+    return `${PROFILE_TAG} nothing changed${result.reason ? `: ${result.reason}` : '.'}`;
   }
   const disclosure = result.disclosure.trim();
   const lines = [disclosure.length > 0 ? `${PROFILE_TAG} ${disclosure}` : `${PROFILE_TAG} done.`];
@@ -214,7 +214,7 @@ export function renderProfileStatus(state: ProfileStateView): string {
   if (invalid.length === 0) {
     lines.push('  fields that did not validate: none');
   } else {
-    lines.push(`  fields that did not validate (${invalid.length}) — the value is kept as you typed it:`);
+    lines.push(`  fields that did not validate (${invalid.length}): the value is kept as you typed it:`);
     for (const entry of invalid) lines.push(`    ${entry.fieldId}: ${entry.reason}`);
   }
   return lines.join('\n');
@@ -224,7 +224,7 @@ export function renderProfileStatus(state: ProfileStateView): string {
  * Every field id present in the document, paired with the label written on its
  * line. Used to resolve `/profile where shipping address` to
  * `commerce.shippingAddress` without keeping a copy of the SDK's field registry
- * here — the mapping comes from the live response, so it cannot drift.
+ * here, the mapping comes from the live response, so it cannot drift.
  */
 export function collectFieldLabels(document: ProfileDocumentView): ReadonlyMap<string, string[]> {
   const byLabel = new Map<string, string[]>();

package/src/input/commands/profile-runtime.ts

@@ -1,7 +1,7 @@
 /**
  * profile-runtime.ts
  *
- * `/profile` — the owner profile in the TUI: what the platform knows about the
+ * `/profile`, the owner profile in the TUI: what the platform knows about the
  * person who owns it, kept as one hand-editable Markdown file at daemon scope
  * (docs/owner-profile.md).
  *
@@ -14,13 +14,13 @@
  *
  * plus `set`, `note`, `undo` and `status` so a correction, a note, a recovery
  * and a diagnosis do not require leaving the terminal or hand-editing the file
- * (which remains allowed, and authoritative — §4.5).
+ * (which remains allowed, and authoritative, §4.5).
  *
  * ## Why it goes over the operator wire
  *
  * Same reason `/principals`, `/ci` and `/checkin` do (see operator-rpc.ts): the
  * `profile.*` family ships in the operator contract and has not been promoted to
- * the in-process `OperatorClient` facade. Surfaces never open the profile file —
+ * the in-process `OperatorClient` facade. Surfaces never open the profile file,
  * the daemon is the single writer, which is what makes its rename-based atomic
  * writes sufficient with no lock (§3, §5.4). This command therefore has no file
  * path, no parser and no writer of its own, and could not corrupt the document
@@ -30,7 +30,7 @@
  *
  * Values reach exactly one place: the string handed to `ctx.print`. This module
  * imports no logger, builds no diagnostic payload, and never puts a value in an
- * error message — a failed call renders `describeOperatorRpcError`, which
+ * error message, a failed call renders `describeOperatorRpcError`, which
  * describes the transport, not the content. A write prints the daemon's
  * one-line disclosure and the field names that changed, never the value that was
  * just recorded (§8.2). The `People` section is third-party personal data and is
@@ -80,7 +80,7 @@ const USAGE = [
   '  in the file (e.g. "shipping address") once that field is recorded. /profile show',
   '  prints each field id beside its value.',
   '',
-  '  Notes in People, Places, Work and Notes have no field id — forget those with',
+  '  Notes in People, Places, Work and Notes have no field id; forget those with',
   '  --section and the line as /profile show prints it. The leading "-" is optional;',
   '  the rest must match, and if two notes read the same nothing is removed.',
 ].join('\n');
@@ -118,7 +118,7 @@ export interface ProfileCommandDeps {
 const DEFAULT_DEPS: ProfileCommandDeps = { resolveRpc: getOperatorRpc };
 
 function unrecognizedResponse(verb: string): string {
-  return `${PROFILE_TAG} the daemon answered ${verb} with a response this build does not recognise — it is probably running a different platform version. Nothing was read or written.`;
+  return `${PROFILE_TAG} the daemon answered ${verb} with a response this build does not recognise; it is probably running a different platform version. Nothing was read or written.`;
 }
 
 /**
@@ -126,7 +126,7 @@ function unrecognizedResponse(verb: string): string {
  *
  * A dotted token is already an id and is passed through untouched. A bare label
  * ("shipping address") is matched against the labels in the live `profile.read`
- * response — deliberately NOT against a copy of the SDK's field registry, which
+ * response, deliberately NOT against a copy of the SDK's field registry, which
  * would be a second list to keep in step with the first. A label that matches
  * nothing is passed through unchanged so the daemon answers with its own message
  * naming what is wrong, rather than this command guessing.
@@ -205,7 +205,7 @@ async function runWrite<TVerb extends ProfileWriteVerb, TBody extends ProfileInp
 /**
  * `--section <name>` followed by free text, shared by `/profile note` and
  * `/profile forget`. Section defaults to Notes, which is only meaningful for
- * `note` — `forget` calls this solely when `--section` was given.
+ * `note`, `forget` calls this solely when `--section` was given.
  */
 function parseSectionArgs(args: readonly string[]): { section: string; text: string } {
   if (args[1] === '--section' && typeof args[2] === 'string' && args[2].length > 0) {
@@ -235,12 +235,12 @@ export function registerProfileRuntimeCommands(
       //
       // where/forget/undo take the whole remainder as the field, so a label
       // written with a space ("shipping address") works unquoted. `set` cannot
-      // do that — everything after the first token is the value — so a label
+      // do that, everything after the first token is the value, so a label
       // there must be one word, or the field id.
       const fieldToken = sub === 'set' ? args[1] : args.slice(1).join(' ').trim();
 
       // `/profile forget --section <name> <text>` removes a prose bullet, which
-      // is the only way to forget a line in People, Places, Work or Notes —
+      // is the only way to forget a line in People, Places, Work or Notes,
       // those sections have no mechanical fields at all (§4.3), so without this
       // "forget that" would answer for a shipping address but not for a note
       // about a person. The line is named by its exact text, never by position:
@@ -272,7 +272,7 @@ export function registerProfileRuntimeCommands(
         return;
       }
       // `methodId as string` is what picks the generic overload, so the result
-      // stays `unknown` and has to go through a checker — see ProfileInvoke.
+      // stays `unknown` and has to go through a checker, see ProfileInvoke.
       const invoke: ProfileInvoke = (methodId, input) =>
         rpc.sdk.operator.invoke(methodId as string, input as unknown as Record<string, unknown>);
       const print = (text: string): void => { ctx.print(text); };
@@ -309,8 +309,8 @@ export function registerProfileRuntimeCommands(
         // outright. An earlier build defaulted it to owner-direct instead, and
         // stating the claim rather than leaning on that default is precisely
         // why this command kept working when it was tightened. It is the only
-        // gate `forget` and `undo` have — layers 2 and 3 do not apply to a
-        // removal — so it is not a field to leave to anyone else's default.
+        // gate `forget` and `undo` have, layers 2 and 3 do not apply to a
+        // removal, so it is not a field to leave to anyone else's default.
         //
         // This surface can hardcode it; the agent must not. The TUI's only
         // input is the owner at his own keyboard, whereas the agent can be