aidevops 3.32.4 → 3.32.6

package/README.md

@@ -60,7 +60,7 @@ The result: an AI operations platform that manages projects across every busines
 [![Copyright](https://img.shields.io/badge/Copyright-Marcus%20Quinn%202025--2026-blue.svg)](https://github.com/marcusquinn)
 
 <!-- Release & Version Info -->
-[![Version](https://img.shields.io/badge/Version-3.32.4-blue.svg)](https://github.com/marcusquinn/aidevops/releases)
+[![Version](https://img.shields.io/badge/Version-3.32.6-blue.svg)](https://github.com/marcusquinn/aidevops/releases)
 [![npm version](https://img.shields.io/npm/v/aidevops)](https://www.npmjs.com/package/aidevops)
 [![Homebrew](https://img.shields.io/badge/homebrew-marcusquinn%2Ftap-orange)](https://github.com/marcusquinn/homebrew-tap)
 [![GitHub repository](https://img.shields.io/badge/github-repository-181717.svg?logo=github)](https://github.com/marcusquinn/aidevops)
@@ -116,9 +116,9 @@ the required notices and preferred credit text.
 
 ### Agent Structure
 
-- 12 primary agents (Build+, Automate, Product, SEO, Marketing-Sales, etc.) with specialist @subagents on demand
-- 2,200+ agent and subagent markdown files organized by domain
-- 1,800+ helper scripts in `.agents/scripts/`
+- 14 primary agents (Build+, Automate, Product, SEO, Marketing-Sales, etc.) with specialist @subagents on demand
+- 2,150+ agent and subagent markdown files organized by domain
+- 1,630+ helper scripts in `.agents/scripts/`
 - 185+ slash commands and workflow guides for common operations
 
 ### What You Can Ask aidevops To Do
@@ -782,9 +782,9 @@ aidevops implements proven agent design patterns identified by [Lance Martin (La
 
 | Pattern | Description | aidevops Implementation |
 |---------|-------------|------------------------|
-| **Give Agents a Computer** | Filesystem + shell for persistent context | `~/.aidevops/.agent-workspace/`, 1,480+ helper scripts |
+| **Give Agents a Computer** | Filesystem + shell for persistent context | `~/.aidevops/.agent-workspace/`, 1,630+ helper scripts |
 | **Multi-Layer Action Space** | Few tools, push actions to computer | Per-agent MCP filtering (~12-20 tools each) |
-| **Knowledge Graph Routing** | Indexed, cross-referenced agents instead of isolated skills | `subagent-index.toon` maps 2,050+ agents by domain, purpose, and dependency — agents discover related context through the graph, not just their own file |
+| **Knowledge Graph Routing** | Indexed, cross-referenced agents instead of isolated skills | `subagent-index.toon` maps 2,150+ agents by domain, purpose, and dependency — agents discover related context through the graph, not just their own file |
 | **Progressive Disclosure** | Load context on-demand | Subagent routing with content summaries, YAML frontmatter, read-on-demand |
 | **Offload Context** | Write results to filesystem | `.agent-workspace/work/[project]/` for persistence |
 | **Cache Context** | Prompt caching for cost | Stable instruction prefixes |
@@ -1907,7 +1907,7 @@ aidevops is registered as a **Claude Code plugin marketplace**. Install with two
 /plugin install aidevops@aidevops
 ```
 
-This installs the complete framework: 12 primary agents, 2,050+ subagents, and 1,480+ helper scripts.
+This installs the complete framework: 14 primary agents, 2,150+ subagents, and 1,630+ helper scripts.
 
 ### Importing External Skills
 
@@ -1989,7 +1989,7 @@ Primary agents live at `.agents/<name>.md`. Each is a domain expert with its own
 | Research | `research.md` | Technical and market research, competitive analysis | gemini/grok |
 | SEO | `seo.md` | SEO audits, keyword research, GSC, schema, technical SEO | opus |
 
-**Specialist subagents** (e.g. `@wordpress`, `@seo`, Build-Agent, Build-MCP, etc.) live under `.agents/tools/` or as `mode: subagent` files and are invoked via `@mention` when domain expertise is needed. See `subagent-index.toon` for the full roster.
+**Specialist subagents** (e.g. `@wordpress`, `@seo`, Build-Agent, Build-MCP, etc.) live under `.agents/tools/` or as `mode: subagent` files and are invoked via `@mention` when domain expertise is needed. See `subagent-index.toon` for the full roster. For read-only macOS Activity Monitor and background-efficiency audits, use `@macos-activity-cleaner` or `/aidevops-macos-activity-cleaner`.
 
 #### How to invoke a main agent
 
@@ -2037,7 +2037,7 @@ The long-term direction is to make slash commands and `@mentions` unnecessary al
 
 ### **Example Subagents with MCP Integration**
 
-These are examples of subagents that have supporting MCPs enabled. See `.agents/` for the full list of 2,050+ subagents organized by domain.
+These are examples of subagents that have supporting MCPs enabled. See `.agents/` for the full list of 2,150+ subagents organized by domain.
 
 | Agent | Purpose | MCPs Enabled |
 |-------|---------|--------------|
@@ -2858,7 +2858,7 @@ See `.agents/tools/credentials/multi-tenant.md` for complete documentation.
 - Autonomous supervisor — pulse runs every 2 minutes, merging PRs, dispatching workers, killing stuck processes, advancing missions
 - Operational intelligence — struggle-ratio detection, orphaned PR recovery, circuit breaker, dynamic concurrency
 - Cost-aware routing — provider-aware model selection across OpenAI, Anthropic, Gemini, Cursor, Grok, and local models with budget tracking
-- Progressive context — 2,050+ subagents loaded on demand, project bundles auto-configuring quality gates and model tiers
+- Progressive context — 2,150+ subagents loaded on demand, project bundles auto-configuring quality gates and model tiers
 - Self-improving — session mining extracts learnings, quality findings auto-create tasks, patterns feed back into agent prompts
 
 **Get Started:**

package/VERSION

@@ -1 +1 @@
-3.32.4
+3.32.6

package/aidevops.sh

@@ -5,7 +5,7 @@
 # AI DevOps Framework CLI
 # Usage: aidevops <command> [options]
 #
-# Version: 3.32.4
+# Version: 3.32.6
 
 set -euo pipefail
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aidevops",
-  "version": "3.32.4",
+  "version": "3.32.6",
   "description": "AI DevOps Framework - AI-assisted development workflows, code quality, and deployment automation",
   "type": "module",
   "workspaces": [

package/packages/gui-api/src/status-adapter.ts

@@ -153,6 +153,7 @@ export function readStatus(
     notifications,
     vault,
     pulse_workers: pulseWorkers.summary,
+    secrets: vault.unlocked ? statusFixture.secrets : [],
   };
 
   const envelope = createEnvelope({

package/packages/gui-api/src/status-vault.ts

@@ -1,4 +1,4 @@
-import { execFileSync } from "node:child_process";
+import { spawnSync } from "node:child_process";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import {
@@ -19,17 +19,43 @@ const GUI_VAULT_SETUP_STATES = [
 ] as const satisfies readonly GuiVaultSetupState[];
 const INITIALIZED_VAULT_STATUSES = new Set<GuiVaultStatus>(["locked", "unlocked", "corrupted"]);
 const RESTART_TEST_SETUP_STATES = new Set<GuiVaultSetupState>(["test-created", "restart-required", "test-verified"]);
+type VaultCommand = "status" | "setup-state";
+type VaultProbeValue = GuiVaultStatus | GuiVaultSetupState;
+const COHERENT_VAULT_STATES: Readonly<Record<GuiVaultStatus, ReadonlySet<GuiVaultSetupState>>> = {
+  uninitialized: new Set(["uninitialized"]),
+  locked: new Set(["test-created", "restart-required", "test-verified", "migration-ready"]),
+  unlocked: new Set(["migration-ready"]),
+  corrupted: new Set(["unknown"]),
+  unknown: new Set(),
+};
+const EXPECTED_VAULT_EXIT_CODES: Readonly<
+  Record<VaultCommand, Readonly<Partial<Record<VaultProbeValue, number>>>>
+> = {
+  status: { locked: 0, unlocked: 0, uninitialized: 2, corrupted: 3 },
+  "setup-state": {
+    "test-created": 0,
+    "restart-required": 0,
+    "test-verified": 0,
+    "migration-ready": 0,
+    uninitialized: 2,
+    unknown: 3,
+  },
+};
 
 export function readVaultSummary(repoRoot: string): GuiVaultStatusData {
   const helperPath = join(repoRoot, ".agents", "scripts", "vault-helper.sh");
   const helperExists = existsSync(helperPath);
-  const rawStatus = helperExists ? readVaultCommand(helperPath, ["status"], isGuiVaultStatus) : null;
-  const rawSetupState = helperExists ? readVaultCommand(helperPath, ["setup-state"], isGuiVaultSetupState) : null;
+  const parsedStatus = helperExists ? readVaultCommand(helperPath, "status", isGuiVaultStatus) : null;
+  const parsedSetupState = helperExists ? readVaultCommand(helperPath, "setup-state", isGuiVaultSetupState) : null;
+  const coherent = coherentVaultState(parsedStatus, parsedSetupState);
+  const rawStatus = coherent ? parsedStatus : null;
+  const rawSetupState = coherent ? parsedSetupState : null;
   const helperStatus = vaultHelperStatus(helperExists, rawStatus, rawSetupState);
   const status = rawStatus ?? "unknown";
   const setupState = rawSetupState ?? fallbackSetupState(status);
   const unlocked = status === "unlocked";
   const collectionState = vaultCollectionState(status);
+  const setupRequired = helperStatus === "available" && status === "uninitialized" && setupState === "uninitialized";
 
   return {
     ...statusFixture.vault,
@@ -38,12 +64,12 @@ export function readVaultSummary(repoRoot: string): GuiVaultStatusData {
     initialized: INITIALIZED_VAULT_STATUSES.has(status),
     locked: !unlocked,
     unlocked,
-    available: helperExists && helperStatus !== "error",
+    available: helperStatus === "available",
     helper_status: helperStatus,
     readiness: {
       ...statusFixture.vault.readiness,
       migration_allowed: unlocked && setupState === "migration-ready",
-      setup_required: status === "uninitialized" || setupState === "uninitialized",
+      setup_required: setupRequired,
       restart_test_required: RESTART_TEST_SETUP_STATES.has(setupState),
       locked_content_hidden: !unlocked,
     },
@@ -54,22 +80,39 @@ export function readVaultSummary(repoRoot: string): GuiVaultStatusData {
   };
 }
 
-function readVaultCommand<T extends string>(
+function readVaultCommand<T extends VaultProbeValue>(
   helperPath: string,
-  args: string[],
+  command: VaultCommand,
   isAllowed: (value: string) => value is T,
 ): T | null {
-  try {
-    const output = execFileSync("sh", [helperPath, ...args], {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"],
-      timeout: 300,
-    }).trim();
-    const firstLine = output.split(/\r?\n/).find((line) => line.trim().length > 0)?.trim() ?? "";
-    return isAllowed(firstLine) ? firstLine : null;
-  } catch {
-    return null;
+  const result = spawnSync("/bin/bash", [helperPath, command], {
+    encoding: "utf8",
+    env: vaultProbeEnvironment(),
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: 750,
+  });
+  if (result.error !== undefined || result.signal !== null || result.status === null || result.stderr.length > 0) return null;
+  const output = result.stdout.endsWith("\n") ? result.stdout.slice(0, -1) : result.stdout;
+  if (output.length === 0 || output.includes("\n") || output.includes("\r") || output.trim() !== output) return null;
+  return isAllowed(output) && isExpectedVaultExit(command, output, result.status) ? output : null;
+}
+
+function vaultProbeEnvironment(): NodeJS.ProcessEnv {
+  const environment: NodeJS.ProcessEnv = { PATH: "/usr/bin:/bin:/usr/sbin:/sbin" };
+  for (const name of ["HOME", "XDG_CONFIG_HOME", "XDG_RUNTIME_DIR", "AIDEVOPS_VAULT_DIR", "AIDEVOPS_VAULT_RUNTIME_DIR", "AIDEVOPS_VAULT_PYTHON"]) {
+    const value = process.env[name];
+    if (value !== undefined) environment[name] = value;
   }
+  return environment;
+}
+
+function coherentVaultState(status: GuiVaultStatus | null, setupState: GuiVaultSetupState | null): boolean {
+  if (status === null || setupState === null) return false;
+  return COHERENT_VAULT_STATES[status].has(setupState);
+}
+
+function isExpectedVaultExit(command: VaultCommand, value: VaultProbeValue, exitCode: number): boolean {
+  return EXPECTED_VAULT_EXIT_CODES[command][value] === exitCode;
 }
 
 function isGuiVaultStatus(value: string): value is GuiVaultStatus {
@@ -88,7 +131,7 @@ function vaultHelperStatus(
   if (!helperExists) {
     return "missing";
   }
-  return status === null && setupState === null ? "error" : "available";
+  return status === null || setupState === null ? "error" : "available";
 }
 
 function fallbackSetupState(status: GuiVaultStatus): GuiVaultSetupState {

package/packages/gui-desktop/scripts/install-macos-app.sh

@@ -198,6 +198,21 @@ notify() {
   return 0
 }
 
+run_vault_command() {
+  local action="\$1"
+  local command_name=""
+  case "\$action" in
+    init|unlock|lock|status|lost-passphrase) command_name="\$action" ;;
+    *) printf 'Unsupported Vault action\n' >&2; return 2 ;;
+  esac
+  AIDEVOPS_SESSION_ID="gui-desktop" exec /bin/bash "\${REPO_ROOT}/aidevops.sh" vault "\$command_name"
+  return 1
+}
+
+if [[ "\$MODE" == "vault-command" ]]; then
+  run_vault_command "\${2:-}"
+fi
+
 url_ready() {
   local url="\$1"
   curl --silent --fail --max-time 2 "\${url}" >/dev/null 2>&1
@@ -497,6 +512,8 @@ final class AppDelegate: NSObject, NSApplicationDelegate, WKNavigationDelegate,
             updateAccentHueFromMessage(message.body)
         case "externalLink":
             openExternalLinkFromMessage(message.body)
+        case "vaultCommand":
+            openVaultCommandFromMessage(message)
         default:
             return
         }
@@ -525,6 +542,68 @@ final class AppDelegate: NSObject, NSApplicationDelegate, WKNavigationDelegate,
         _ = openExternalURL(url)
     }
 
+    private func openVaultCommandFromMessage(_ message: WKScriptMessage) {
+        guard isTrustedVaultMessage(message), let action = message.body as? String else {
+            return
+        }
+
+        // #aidevops:trust-boundary — the main local frame selects only a fixed
+        // action. The bundled launcher independently allowlists it and resolves
+        // the repository CLI without PATH lookup.
+        switch action {
+        case "init", "unlock", "lock", "status", "lost-passphrase": break
+        default: return
+        }
+
+        guard let helperPath = Bundle.main.path(forResource: "aidevops-gui-services", ofType: "sh") else {
+            NSSound.beep()
+            notifyVaultCommandResult("failed")
+            return
+        }
+        guard helperPath.rangeOfCharacter(from: .newlines) == nil else {
+            NSSound.beep()
+            notifyVaultCommandResult("failed")
+            return
+        }
+
+        let command = "/bin/bash \(shellQuote(helperPath)) vault-command \(shellQuote(action))"
+        let source = "tell application \"Terminal\"\nactivate\ndo script \(appleScriptQuote(command))\nend tell"
+        guard let script = NSAppleScript(source: source) else {
+            NSSound.beep()
+            notifyVaultCommandResult("failed")
+            return
+        }
+        var error: NSDictionary?
+        script.executeAndReturnError(&error)
+        if error != nil {
+            NSSound.beep()
+            notifyVaultCommandResult("failed")
+            return
+        }
+        notifyVaultCommandResult("opened")
+    }
+
+    private func isTrustedVaultMessage(_ message: WKScriptMessage) -> Bool {
+        let origin = message.frameInfo.securityOrigin
+        return message.frameInfo.isMainFrame && origin.protocol == "http" && origin.host == "127.0.0.1" && origin.port == Int(webPort)
+    }
+
+    private func shellQuote(_ value: String) -> String {
+        return "'" + value.replacingOccurrences(of: "'", with: "'\\''") + "'"
+    }
+
+    private func appleScriptQuote(_ value: String) -> String {
+        let escaped = value
+            .replacingOccurrences(of: "\\", with: "\\\\")
+            .replacingOccurrences(of: "\"", with: "\\\"")
+        return "\"\(escaped)\""
+    }
+
+    private func notifyVaultCommandResult(_ result: String) {
+        let script = "window.dispatchEvent(new CustomEvent('aidevops:vault-command-result', { detail: '\(result)' }))"
+        webView.evaluateJavaScript(script, completionHandler: nil)
+    }
+
     private func revealFileURL(_ url: URL) -> Bool {
         guard url.isFileURL else {
             return false
@@ -536,7 +615,7 @@ final class AppDelegate: NSObject, NSApplicationDelegate, WKNavigationDelegate,
 
     func webView(_ webView: WKWebView, decidePolicyFor navigationAction: WKNavigationAction, decisionHandler: @escaping (WKNavigationActionPolicy) -> Void) {
         guard let url = navigationAction.request.url else {
-            decisionHandler(.allow)
+            decisionHandler(.cancel)
             return
         }
 
@@ -550,7 +629,12 @@ final class AppDelegate: NSObject, NSApplicationDelegate, WKNavigationDelegate,
             return
         }
 
-        decisionHandler(.allow)
+        if url.absoluteString == "about:blank" && !hasLoadedDashboard {
+            decisionHandler(.allow)
+            return
+        }
+
+        decisionHandler(.cancel)
     }
 
     func webView(_ webView: WKWebView, createWebViewWith configuration: WKWebViewConfiguration, for navigationAction: WKNavigationAction, windowFeatures: WKWindowFeatures) -> WKWebView? {
@@ -575,7 +659,7 @@ final class AppDelegate: NSObject, NSApplicationDelegate, WKNavigationDelegate,
 
     private func isLocalAppURL(_ url: URL) -> Bool {
         let host = url.host ?? ""
-        return (host == "127.0.0.1" || host == "localhost") && url.port == Int(webPort)
+        return url.scheme == "http" && host == "127.0.0.1" && url.port == Int(webPort)
     }
 
     private func configureMenu() {
@@ -838,6 +922,7 @@ final class AppDelegate: NSObject, NSApplicationDelegate, WKNavigationDelegate,
         let userContentController = WKUserContentController()
         userContentController.add(self, name: "accentHue")
         userContentController.add(self, name: "externalLink")
+        userContentController.add(self, name: "vaultCommand")
         configuration.userContentController = userContentController
         webView = WKWebView(frame: .zero, configuration: configuration)
         webView.navigationDelegate = self

package/packages/gui-shared/src/fixtures.ts

@@ -494,12 +494,7 @@ export const statusFixture: GuiStatusData = {
       doc_ref: "docs/gui/helper-api-contract.md:101",
     },
   ],
-  secrets: [
-    {
-      name: "GITHUB_TOKEN",
-      status: "unchecked",
-    },
-  ],
+  secrets: [],
   placeholders: [
     "Settings, repos, routines, OpenCode sessions, and capabilities will be added as read-only adapters.",
   ],

package/packages/gui-web/src/App.tsx

@@ -1,15 +1,15 @@
-import type { GuiResponseEnvelope, GuiStatusData } from "@aidevops/gui-shared";
-import { type KeyboardEvent as ReactKeyboardEvent, type MouseEvent as ReactMouseEvent, type ReactElement, useEffect, useRef, useState } from "react";
+import { type ReactElement, type KeyboardEvent as ReactKeyboardEvent, type MouseEvent as ReactMouseEvent, useEffect, useState } from "react";
 import { MachineRail, Sidebar } from "./AppNavigation";
 import { Workspace } from "./AppWorkspace";
-import type { ContrastPreference, ConversationMode, FontPreference, FontSizePreference, ShellMode, SurfaceId, ThemePreference } from "./app-model";
+import type { ContrastPreference, ConversationMode, FontPreference, FontSizePreference, ShellMode, ThemePreference } from "./app-model";
 import { DEFAULT_ACCENT_HUE, DEFAULT_CONTRAST, DEFAULT_FONT, DEFAULT_FONT_SIZE, fileRootBySurface, findSurface, findSurfaceSectionLabel, fontFamilyForPreference, fontSizeForPreference, getSystemTheme, isContrastPreference, isFontPreference, isFontSizePreference } from "./app-model";
 import { DesktopStatusBar } from "./DesktopStatusBar";
-import { type NavigationHistory, nextHistoryIndex, useNavigationHistoryKeyboard } from "./navigation-history";
 import { ScreenshotCaptureNotificationHost } from "./ScreenshotCaptureNotification";
-import { fetchStatus, mockedStatus } from "./status-client";
-import type { VaultDialogIntent } from "./VaultBadges";
-import { VaultPassphraseModal } from "./VaultPassphraseModal";
+import { useAppNavigation } from "./useAppNavigation";
+import { useGuiStatus } from "./useGuiStatus";
+import { VaultAccessModal } from "./VaultAccessModal";
+
+export { shouldPromptVaultSetup } from "./useGuiStatus";
 
 interface WebKitBridgeWindow extends Window {
   webkit?: {
@@ -92,9 +92,6 @@ export function readStoredAppearancePreferences(storage: ReadableAppearanceStora
 
 export function App(): ReactElement {
   const [storedAppearancePreferences] = useState<StoredAppearancePreferences>(() => readStoredAppearancePreferences());
-  const [status, setStatus] = useState<GuiResponseEnvelope<GuiStatusData>>(mockedStatus());
-  const [statusLoading, setStatusLoading] = useState(true);
-  const [navigation, setNavigation] = useState<NavigationHistory>({ entries: ["overview"], index: 0 });
   const [themePreference, setThemePreference] = useState<ThemePreference>(storedAppearancePreferences.themePreference);
   const [accentHue, setAccentHue] = useState(storedAppearancePreferences.accentHue);
   const [contrastPreference, setContrastPreference] = useState<ContrastPreference>(storedAppearancePreferences.contrastPreference);
@@ -107,38 +104,13 @@ export function App(): ReactElement {
   const [conversationMode, setConversationMode] = useState<ConversationMode>("ai");
   const [selectedLocalRepoIndex, setSelectedLocalRepoIndex] = useState(0);
   const [selectedSessionId, setSelectedSessionId] = useState<string | undefined>();
-  const [vaultDialogIntent, setVaultDialogIntent] = useState<VaultDialogIntent | null>(null);
-  const hasPromptedVaultSetup = useRef(false);
   const [systemTheme, setSystemTheme] = useState<"light" | "dark">("light");
+  const { activeSurface, canGoBack, canGoForward, goBack, goForward, setActiveSurface } = useAppNavigation();
+  const { markVaultTerminalLaunch, refreshStatus, setVaultDialogIntent, status, statusLoading, vaultDialogIntent } = useGuiStatus();
   const resolvedTheme = themePreference === "system" ? systemTheme : themePreference;
-  const activeSurface: SurfaceId = navigation.entries[navigation.index] ?? "overview";
   const activeItem = findSurface(activeSurface);
   const activeSectionLabel = findSurfaceSectionLabel(activeSurface);
-  const canGoBack = navigation.index > 0;
-  const canGoForward = navigation.index < navigation.entries.length - 1;
   const fileRoot = fileRootBySurface[activeSurface];
-  useNavigationHistoryKeyboard(setNavigation);
-
-  const setActiveSurface = (surface: SurfaceId) => {
-    setNavigation((current) => {
-      const currentSurface = current.entries[current.index] ?? "overview";
-      if (currentSurface === surface) {
-        return current;
-      }
-
-      const entries = current.entries.slice(0, current.index + 1);
-      entries.push(surface);
-      return { entries, index: entries.length - 1 };
-    });
-  };
-
-  const goBack = () => {
-    setNavigation((current) => ({ ...current, index: nextHistoryIndex(current, -1) }));
-  };
-
-  const goForward = () => {
-    setNavigation((current) => ({ ...current, index: nextHistoryIndex(current, 1) }));
-  };
 
   useEffect(() => {
     const isMacosDesktop = isMacosDesktopBrowser();
@@ -189,13 +161,6 @@ export function App(): ReactElement {
     persistAppearancePreference(appearanceStorageKeys.fontSize, fontSizePreference);
   }, [fontSizePreference]);
 
-  useEffect(() => {
-    fetchStatus()
-      .then(setStatus)
-      .catch(() => setStatus(mockedStatus()))
-      .finally(() => setStatusLoading(false));
-  }, []);
-
   useEffect(() => {
     persistAppearancePreference(appearanceStorageKeys.showNavCounts, String(showNavCounts));
   }, [showNavCounts]);
@@ -213,13 +178,6 @@ export function App(): ReactElement {
     setSelectedLocalRepoIndex((current) => Math.min(current, Math.max(0, status.data.local_repos.repos.length - 1)));
   }, [status.data.local_repos.repos.length]);
 
-  useEffect(() => {
-    if (shouldPromptVaultSetup(statusLoading, status.data.vault.readiness.setup_required, hasPromptedVaultSetup.current)) {
-      hasPromptedVaultSetup.current = true;
-      setVaultDialogIntent("setup");
-    }
-  }, [status.data.vault.readiness.setup_required, statusLoading]);
-
   return (
     <main className={machineRailVisible ? "app-shell" : "app-shell machine-rail-collapsed"} aria-busy={statusLoading}>
       <div className="desktop-titlebar-tagline" aria-hidden="true">Your data protected. Your systems managed. Your creations published.</div>
@@ -276,7 +234,7 @@ export function App(): ReactElement {
         status={status.data}
       />
       <DesktopStatusBar status={status.data} />
-      {vaultDialogIntent ? <VaultPassphraseModal intent={vaultDialogIntent} onClose={() => setVaultDialogIntent(null)} vault={status.data.vault} /> : null}
+      {vaultDialogIntent ? <VaultAccessModal intent={vaultDialogIntent} onClose={() => setVaultDialogIntent(null)} onRefresh={refreshStatus} onTerminalLaunch={markVaultTerminalLaunch} vault={status.data.vault} /> : null}
     </main>
   );
 }
@@ -345,10 +303,6 @@ export function clampSidebarWidth(width: number): number {
   return Math.min(maxSidebarWidth, Math.max(minSidebarWidth, Math.round(width)));
 }
 
-export function shouldPromptVaultSetup(statusLoading: boolean, setupRequired: boolean, hasPromptedVaultSetup: boolean): boolean {
-  return !statusLoading && setupRequired && !hasPromptedVaultSetup;
-}
-
 function SidebarResizeHandle(): ReactElement {
   const [sidebarWidth, setSidebarWidth] = useState(() => readStoredSidebarWidth());
 

package/packages/gui-web/src/AppWorkspace.tsx

@@ -12,7 +12,7 @@ import { TamboConversationPart } from "./GenUiCards";
 import { AppsSurface, EditableInventorySurface, InstallationSurface } from "./InventorySurfaces";
 import { PulseWorkersSurface } from "./PulseWorkersSurface";
 import { AiProvidersSurface, LocalReposSurface, LockedVaultGate, OverviewSurface, PlannedSurface, ProjectsSurface, SecuritySurface, VaultSurface } from "./StatusSurfaces";
-import { type VaultDialogIntent, isVaultSurfaceLocked, vaultCollectionForSurface, vaultDialogIntentForStatus } from "./VaultBadges";
+import { type VaultDialogIntent, isVaultSurfaceLocked, vaultActionLabel, vaultCollectionForSurface, vaultDialogIntentForStatus } from "./VaultBadges";
 import { applyCommandPaletteSelection, useHeaderMenuState } from "./workspace-header-state";
 import { useWorkspaceTour, WorkspaceTourProvider } from "./WorkspaceTour";
 
@@ -370,7 +370,7 @@ function ChatBubble({ body, speaker, title }: { body: string; speaker: "assistan
 
 function ProfileMenu({ onVaultRequest, openSurface, status, userName }: { onVaultRequest: (intent: VaultDialogIntent) => void; openSurface: (surface: SurfaceId) => void; status: GuiStatusData; userName: string }): ReactElement {
   const vaultIntent = vaultDialogIntentForStatus(status.vault);
-  const VaultIcon = vaultIntent === "lock" ? FiLock : FiUnlock;
+  const VaultIcon = vaultIntent === "lock" ? FiLock : vaultIntent === "recover" || vaultIntent === "unavailable" ? FiAlertTriangle : FiUnlock;
   return (
     <div className="popover-menu profile-menu" role="menu">
       <div className="profile-menu-heading">
@@ -380,7 +380,7 @@ function ProfileMenu({ onVaultRequest, openSurface, status, userName }: { onVaul
       <button onClick={() => openSurface("settings")} role="menuitem" type="button"><FiSettings aria-hidden="true" /> Settings</button>
       <button onClick={() => openSurface("settings")} role="menuitem" type="button"><FiCommand aria-hidden="true" /> Theme</button>
       <button onClick={() => openSurface("settings")} role="menuitem" type="button"><FiGlobe aria-hidden="true" /> Language</button>
-      <button onClick={() => onVaultRequest(vaultIntent)} role="menuitem" type="button"><VaultIcon aria-hidden="true" /> {vaultIntent === "lock" ? "Lock Vault" : "Unlock Vault"}</button>
+      <button onClick={() => onVaultRequest(vaultIntent)} role="menuitem" type="button"><VaultIcon aria-hidden="true" /> {vaultActionLabel(vaultIntent)}</button>
       <div className="menu-separator" />
       <strong>Community</strong>
       <a href={communityLinks.github} rel="noreferrer" role="menuitem" target="_blank"><FiMessageSquare aria-hidden="true" /> GitHub</a>
@@ -453,11 +453,11 @@ function SurfaceContent({ activeItem, activeSurface, fileRoot, onVaultRequest, o
     apps: <AppsSurface status={status} />,
     installation: <InstallationSurface />,
     projects: <ProjectsSurface status={status} />,
-    security: <SecuritySurface status={status} />,
+    security: <SecuritySurface onVaultRequest={onVaultRequest} status={status} />,
     aiProviders: <AiProvidersSurface status={status} />,
   };
 
-  if (isVaultSurfaceLocked(status.vault, activeSurface) && vaultCollection) {
+  if (activeSurface !== "security" && isVaultSurfaceLocked(status.vault, activeSurface) && vaultCollection) {
     return <LockedVaultGate collection={vaultCollection} label={activeItem.label} onVaultRequest={onVaultRequest} vault={status.vault} />;
   }
 

package/packages/gui-web/src/DesktopStatusBar.tsx

@@ -19,7 +19,7 @@ export function DesktopStatusBar({ status }: { status: GuiStatusData }): ReactEl
       <span>{versionLabel}</span>
       <span>{localRepoCount} local repos</span>
       <span>{remoteRepoCount} remote repos</span>
-      <span>{status.secrets.length} secrets</span>
+      <span>{status.vault.unlocked ? `${status.secrets.length} secret references` : "Secret references hidden"}</span>
       <span>{vaultLabel}</span>
       <span>{oauthAccounts} provider accounts</span>
       <span>{needsUpdate} need update</span>