Add workflow modes, structured workspace operations, service management hardening, and OAuth persistence fixes

.gitignore

@@ -3,3 +3,5 @@ dist/
 releases/
 .env
 *.log
+WORKING/
+skills/installed/

README.md

@@ -14,7 +14,11 @@
   <a href="https://github.com/Waishnav/devspace/blob/main/LICENSE"><img alt="License" src="https://img.shields.io/npm/l/%40waishnav%2Fdevspace?style=flat-square" /></a>
 </p>
 
-[![DevSpace connected to ChatGPT](https://raw.githubusercontent.com/Waishnav/devspace/main/docs/assets/devspace-screenshot.png)](https://raw.githubusercontent.com/Waishnav/devspace/main/docs/assets/devspace-screenshot.png)
+<p align="center">
+  English | <a href="./README.zh-CN.md">简体中文</a>
+</p>
+
+[![DevSpace connected to ChatGPT](docs/assets/devspace-screenshot.png)](docs/assets/devspace-screenshot.png)
 
 **Give ChatGPT a secure connection to your own machine and Turn ChatGPT into Codex**
 
@@ -117,6 +121,116 @@ Most users should connect through a public HTTPS tunnel:
 https://your-tunnel-host.example.com/mcp
 ```
 
+## Configuration Management
+
+Update the local server config with short commands:
+
+```bash
+# Show the effective runtime configuration
+devspace config show
+
+# Change the local listening port
+devspace config port 7676
+
+# Change the local bind host
+devspace config host 127.0.0.1
+
+# Set the public domain or URL
+devspace config domain devspace.example.com
+
+# Rotate the Owner password
+devspace config key
+```
+
+Configuration changes are saved immediately. If a managed DevSpace background
+service is currently running, DevSpace automatically restarts it so the new
+settings take effect right away.
+
+`devspace config show` displays the effective bind host, port, MCP path, public
+URL, workspace list, service state, and a masked access key. If the current
+Owner password comes from `DEVSPACE_OAUTH_OWNER_TOKEN`, DevSpace masks and shows
+that effective value instead of reporting it as missing.
+
+`devspace config key` rotates the existing DevSpace Owner password, clears saved
+OAuth approvals and tokens, and forces connected clients to reauthorize.
+
+## Workspace Management
+
+Persist the workspace roots DevSpace is allowed to open:
+
+```bash
+# Add a workspace and mark it as the default one
+devspace workspace add ~/workspace/project-a --default
+
+# Add another workspace without changing the default
+devspace workspace add ~/workspace/project-b
+
+# Show configured workspaces
+devspace workspace list
+
+# Switch the default workspace
+devspace workspace default ~/workspace/project-b
+
+# Remove a workspace from the allowlist
+devspace workspace remove ~/workspace/project-a
+```
+
+You can also allow extra paths for one run only:
+
+```bash
+devspace serve --add-dir ~/scratch/project-c --workspace ~/workspace/project-b
+```
+
+Workspace paths are the authorization boundary for DevSpace and MCP file tools.
+Adding a workspace authorizes only that path and its children.
+
+If you start DevSpace without any configured workspaces or `DEVSPACE_ALLOWED_ROOTS`,
+DevSpace now fails closed: the server can start, but workspace access is denied
+until you explicitly add an allowed path.
+
+## Service Management
+
+DevSpace service management only manages DevSpace itself. `devspace service start`
+acts as the single entrypoint: if the background service is missing, DevSpace
+creates it for the current platform and starts it; if it already exists, it
+just starts it. It does not manage arbitrary system services.
+
+```bash
+# Start the managed DevSpace background service
+devspace service start
+
+# Show whether the service is installed and running
+devspace service status
+
+# Read the service log output
+devspace service logs
+
+# Restart the running service
+devspace service restart
+
+# Stop the running service
+devspace service stop
+
+# Disable automatic service startup
+devspace service disable
+
+# Remove the installed DevSpace background service
+devspace service remove
+
+# Check service-manager support and current health
+devspace service doctor
+```
+
+Platform behavior:
+
+- macOS uses a per-user LaunchAgent.
+- Linux and Ubuntu use a per-user systemd service when available.
+- Windows uses Task Scheduler.
+- WSL prefers user systemd and otherwise reports a Windows Task Scheduler fallback.
+
+DevSpace does not automatically configure DNS, reverse proxies, TLS
+certificates, or firewall rules.
+
 ## What ChatGPT Can Do
 
 Once connected, ChatGPT can open one of your approved project folders as a
@@ -133,6 +247,113 @@ DevSpace gives ChatGPT tools to:
 - discover local agent skills from your skill folders
 - show tool cards and optional change summaries in ChatGPT Apps-compatible hosts
 
+DevSpace bundles durable workflow Skills rather than short prompt examples. Core Skills cover project Plan recovery, Goal definition and status, workflow resumption, architecture review, and Skill authoring.
+
+Project Skill directories are split by purpose:
+
+- `skills/.system`: exactly five DevSpace-owned system Skills: `plan`, `goal`, `workflow`, `architecture-review`, and `skill-authoring`
+- `skills/local`: project-defined Skills you want to keep in version control
+- `skills/installed`: user-installed external Skills, ignored by git by default
+
+ChatGPT Plus on the web cannot natively install or register Codex Skills. DevSpace provides MCP-side discovery, resolution, and controlled `skill://` resource access instead.
+
+`@devspace /plan` and `@devspace /goal` are stable alias-style workflow conventions. `/plan` always resolves to system `plan`; `/goal` always resolves to system `goal`; local, installed, and global Skills cannot silently override them. `skills/.system/README.md` records the system Skill policy and change log.
+
+## Using `/plan` and `/goal`
+
+Use these aliases in a normal ChatGPT message after DevSpace is connected. They are not native ChatGPT slash commands. Open the workspace first, then state the requested outcome clearly.
+
+### `/plan`: inspect first, then save an implementation plan
+
+Use `/plan` when you want repository analysis and a durable implementation plan before any file changes. DevSpace loads the current Plan when one exists, enters Plan Mode, inspects the repository read-only, then persists a Plan with ordered steps, validation, risks, and a revision number.
+
+```text
+@devspace Open /path/to/project.
+
+/plan Add a hello CLI command that prints "Hello DevSpace".
+First inspect the project and create a persistent Plan.
+Do not modify project files or run commands that write to the repository.
+```
+
+A good `/plan` request states the outcome, relevant constraints, and whether implementation should wait for approval. To review a saved Plan later, ask DevSpace to open the same workspace and read the current Plan before taking action.
+
+```text
+@devspace Open /path/to/project.
+
+Read the current Plan and summarize its title, revision, pending steps, validation, and blockers. Do not modify files.
+```
+
+### `/goal`: keep a durable outcome across sessions
+
+Use `/goal` when an objective should remain available across future DevSpace sessions. A Goal records the objective, scope, success criteria, verification, stop conditions, current status, and exact metrics where evidence exists. DevSpace reads the active Goal first and will not silently replace it with a competing one.
+
+```text
+@devspace Open /path/to/project.
+
+/goal Create a durable Goal to add a hello CLI command.
+Success criteria: the command runs and prints "Hello DevSpace".
+Verification: run the command and its automated test.
+Stop condition: the project requirements change to a non-CLI interface.
+Do not modify files yet.
+```
+
+You can explicitly start or pause the Goal work timer, or update its status when work is blocked, completed, or archived.
+
+```text
+@devspace Start the current Goal work timer.
+
+@devspace Pause the current Goal work timer and show the measured work duration.
+```
+
+### Using them together
+
+Create a Goal for the long-lived outcome, then create a Plan that breaks the Goal into concrete steps and explicitly links the Plan to that Goal. Goal progress is calculated only from completed steps in that linked Plan; DevSpace does not guess a percentage. Provider token metrics are recorded only when an API/provider returns real token usage and a stable request ID, so ChatGPT web usage is not filled in automatically.
+
+```text
+@devspace Create a Plan for the current Goal, link the Plan to the Goal, and save it without modifying files.
+```
+
+Manage installed skills with:
+
+```bash
+# Install a skill for the current context
+devspace skills install --repo openai/skills --path skills/.curated/research
+
+# Install a skill for one specific workspace
+devspace skills install --workspace /path/to/project --repo openai/skills --path skills/.curated/research
+
+# List skills for the current context
+devspace skills list
+
+# List skills for one specific workspace
+devspace skills list --workspace /path/to/project
+
+# Remove a skill from the current context
+devspace skills remove research
+
+# Remove a skill from one specific workspace
+devspace skills remove --workspace /path/to/project research
+
+# Install a global skill
+devspace skills install -g --repo openai/skills --path skills/.curated/research
+
+# List global skills
+devspace skills list -g
+
+# Remove a global skill
+devspace skills remove -g research
+```
+
+`--repo/--path` and `--local-path` must point directly at one standard skill directory that contains `SKILL.md`. Repository roots, plugin roots, command folders, and agent-rules directories are rejected.
+
+## Project Workflow Store
+
+DevSpace stores compact project-scoped workflow state: the current Plan, Goal, Plan Mode, structured step state, and at most 100 concise workflow events. It does not store chat transcripts, raw tool output, shell logs, or file snapshots. Goal metrics are limited to exact provider-reported token records, an explicit server work timer, and progress derived from a Plan explicitly linked to that Goal.
+
+The same canonical project directory shares Plan and Goal state across ChatGPT sessions and DevSpace restarts. Different projects and different Git worktree roots remain isolated. `open_workspace` returns a small `workflowDigest`; call `get_plan`, `get_goal`, and paginated `get_workflow_history` only when full state is needed.
+
+Plan and Goal writes use optimistic concurrency. Read the current state first, then send `expectedRevision`; stale sessions receive a revision conflict instead of silently overwriting newer work.
+
 ## Mental Model
 
 DevSpace is remote access to selected local folders.
@@ -152,7 +373,8 @@ For a normal ChatGPT coding session:
 ## Platform Support
 
 DevSpace supports Linux, macOS, and Windows environments with a Bash-compatible
-shell.
+shell for the main CLI, and supports native per-user service control on macOS,
+Linux, Windows, and WSL.
 
 | Platform                                          | Status            | Notes                                          |
 | ------------------------------------------------- | ----------------- | ---------------------------------------------- |