@pellux/goodvibes-agent 0.1.10 → 0.1.11

package/CHANGELOG.md

@@ -2,6 +2,33 @@
 
 All notable changes to GoodVibes Agent will be recorded here.
 
+## 0.1.11 - 2026-05-31
+
+- d20a93e Allow explicit recall review without yes
+- 601f41c Require confirmation for eval execution
+- f41befb Block Cloudflare onboarding mutations
+- 79071ec Block implicit block file saves
+- 40aca02 Block inline diff file edits in Agent
+- 854eda8 Block MCP workspace config mutations
+- 665c423 Require confirmation for CLI Agent Knowledge ingest
+- f07255a Require confirmation for recall review mutations
+- 6e78ec3 Require confirmation for Agent Knowledge mutations
+- c1e5ac1 Require confirmation for operator control mutations
+- 5d6fc3c Require confirmation for local state mutations
+- 3afd788 Require confirmation for remaining export paths
+- d36ae96 Require confirmation for portable state bundles
+- 1f0caab Require confirmation for setup and remote exports
+- 2e149c9 Require confirmation for incident and handoff exports
+- b439c55 Require confirmation for settings mutations
+- f7c8fe6 Require confirmation for platform auth mutations
+- 09064e0 Require confirmation for auth and service mutations
+- 55e8b8d Require confirmation for marketplace mutations
+- 88becca Require confirmation for plugin mutations
+- 89c0584 Require confirmation for local provider mutations
+- 7f3af1b Require confirmation for managed hook mutations
+- 323426c Require confirmation for destructive workplan cleanup
+- 191350e Require confirmation for side-effecting slash commands
+
 ## 0.1.10 - 2026-05-31
 
 - 93aba19 Block agent-spawning hook authoring

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pellux/goodvibes-agent",
-  "version": "0.1.10",
+  "version": "0.1.11",
   "private": false,
   "description": "Near-fork GoodVibes operator assistant with the GoodVibes TUI shell, renderer, input, fullscreen workspace, and daemon-connected Agent product brain.",
   "type": "module",

package/src/cli/agent-knowledge-command.ts

@@ -149,6 +149,19 @@ function hasFlag(args: readonly string[], flag: string): boolean {
   return args.includes(flag);
 }
 
+function stripCommandFlag(args: readonly string[], flag: string): { readonly rest: readonly string[]; readonly present: boolean } {
+  const rest: string[] = [];
+  let present = false;
+  for (const arg of args) {
+    if (arg === flag) {
+      present = true;
+      continue;
+    }
+    rest.push(arg);
+  }
+  return { rest, present };
+}
+
 function readPackageMetadata(): { readonly version: string; readonly sdkVersion: string } {
   return { version: VERSION, sdkVersion: SDK_VERSION };
 }
@@ -444,7 +457,9 @@ async function runKnowledgeCall<TData>(
 }
 
 export async function handleAgentKnowledgeCommand(runtime: CliCommandRuntime): Promise<CliCommandOutput> {
-  const [sub = 'status', ...rest] = runtime.cli.commandArgs;
+  const [sub = 'status', ...rawRest] = runtime.cli.commandArgs;
+  const confirmation = stripCommandFlag(rawRest, '--yes');
+  const rest = confirmation.rest;
   const normalized = sub.toLowerCase();
   const json = runtime.cli.flags.outputFormat === 'json';
   const disallowedScopeFlag = findDisallowedKnowledgeScopeFlag(rest);
@@ -512,7 +527,19 @@ export async function handleAgentKnowledgeCommand(runtime: CliCommandRuntime): P
   if (normalized === 'ingest-url') {
     const values = commandValues(rest);
     const url = values[0];
-    if (!url) return { output: 'Usage: goodvibes-agent knowledge ingest-url <url> [--title <title>] [--tags a,b]', exitCode: 2 };
+    if (!url) return { output: 'Usage: goodvibes-agent knowledge ingest-url <url> [--title <title>] [--tags a,b] --yes', exitCode: 2 };
+    if (!confirmation.present) {
+      const failure = {
+        ok: false,
+        kind: 'confirmation_required',
+        error: `Refusing to ingest URL into Agent Knowledge ${url} without --yes.`,
+        route: AGENT_KNOWLEDGE_METHODS.ingestUrl.route,
+      };
+      return {
+        output: json ? JSON.stringify(failure, null, 2) : `${failure.error}\nUsage: goodvibes-agent knowledge ingest-url <url> [--title <title>] [--tags a,b] --yes`,
+        exitCode: 2,
+      };
+    }
     const title = readOptionValue(rest, '--title');
     const tags = readStringList(rest, '--tags');
     const result = await runKnowledgeCall(runtime, AGENT_KNOWLEDGE_METHODS.ingestUrl, async (connection) => (
@@ -532,7 +559,7 @@ export async function handleAgentKnowledgeCommand(runtime: CliCommandRuntime): P
   }
 
   return {
-    output: 'Usage: goodvibes-agent knowledge [status|ask <question>|search <query>|ingest-url <url>]',
+    output: 'Usage: goodvibes-agent knowledge [status|ask <question>|search <query>|ingest-url <url> --yes]',
     exitCode: 2,
   };
 }

package/src/cli/help.ts

@@ -167,14 +167,14 @@ const COMMAND_HELP: Record<string, CommandHelp> = {
       'knowledge status',
       'knowledge ask <question> [--limit <n>] [--mode concise|standard|detailed]',
       'knowledge search <query> [--limit <n>]',
-      'knowledge ingest-url <url> [--title <title>] [--tags a,b]',
+      'knowledge ingest-url <url> [--title <title>] [--tags a,b] --yes',
     ],
     summary: 'Call isolated Agent Knowledge/Wiki routes under /api/goodvibes-agent/knowledge. No default wiki or HomeGraph fallback.',
     examples: [
       'knowledge status',
       'knowledge ask "What is GoodVibes Agent?"',
       'knowledge search "release checklist"',
-      'knowledge ingest-url https://example.com/page --title "Reference"',
+      'knowledge ingest-url https://example.com/page --title "Reference" --yes',
     ],
   },
   ask: {

package/src/input/commands/cloudflare-runtime.ts

@@ -11,6 +11,7 @@ import {
 } from '../../runtime/cloudflare-control-plane.ts';
 import type { CommandContext, CommandRegistry } from '../command-registry.ts';
 import { requireShellPaths } from './runtime-services.ts';
+import { requireYesFlag, stripYesFlag } from './confirmation.ts';
 
 interface ParsedCloudflareArgs {
   readonly positional: readonly string[];
@@ -22,10 +23,12 @@ export function registerCloudflareRuntimeCommands(registry: CommandRegistry): vo
     name: 'cloudflare',
     aliases: ['cf'],
     description: 'Inspect and manage optional Cloudflare batch/control-plane integration through daemon SDK routes',
-    usage: '[status|setup|requirements|create-token|discover|validate|provision|verify|disable] [flags]',
+    usage: '[status|setup|requirements|create-token --yes|discover|validate|provision --yes|verify|disable --yes] [flags]',
     async handler(args, ctx) {
-      const subcommand = (args[0] ?? 'status').toLowerCase();
-      const parsed = parseCloudflareArgs(args.slice(1));
+      const confirmation = stripYesFlag(args);
+      const commandArgs = [...confirmation.rest];
+      const subcommand = (commandArgs[0] ?? 'status').toLowerCase();
+      const parsed = parseCloudflareArgs(commandArgs.slice(1));
       if (subcommand === 'setup' || subcommand === 'onboarding') {
         ctx.openOnboardingWizard?.({ mode: 'edit', reset: true });
         ctx.print('Opening onboarding wizard. Select the Cloudflare batch capability to configure Cloudflare.');
@@ -80,9 +83,13 @@ export function registerCloudflareRuntimeCommands(registry: CommandRegistry): vo
         }
 
         if (subcommand === 'create-token') {
+          if (!confirmation.yes) {
+            requireYesFlag(ctx, 'create and store a Cloudflare operational token', '/cloudflare create-token [flags] --yes');
+            return;
+          }
           const bootstrapToken = getFlag(parsed, 'bootstrap-token') || readTokenEnv(parsed, 'bootstrap-env');
           if (!bootstrapToken) {
-            ctx.print('Usage: /cloudflare create-token --account <account-id> --bootstrap-token <token> or --bootstrap-env <env-name>');
+            ctx.print('Usage: /cloudflare create-token --account <account-id> (--bootstrap-token <token> | --bootstrap-env <env-name>) --yes');
             return;
           }
           const result = await client.createOperationalToken({
@@ -141,6 +148,10 @@ export function registerCloudflareRuntimeCommands(registry: CommandRegistry): vo
         }
 
         if (subcommand === 'provision') {
+          if (!confirmation.yes) {
+            requireYesFlag(ctx, 'provision Cloudflare resources and persist config', '/cloudflare provision [flags] --yes');
+            return;
+          }
           const result = await client.provision({
             ...cloudflareAuthInput(parsed),
             components: componentsFromArgs(parsed),
@@ -212,6 +223,10 @@ export function registerCloudflareRuntimeCommands(registry: CommandRegistry): vo
         }
 
         if (subcommand === 'disable') {
+          if (!confirmation.yes) {
+            requireYesFlag(ctx, 'disable Cloudflare integration and persist config', '/cloudflare disable [flags] --yes');
+            return;
+          }
           const result = await client.disable({
             ...cloudflareAuthInput(parsed),
             ...optionalString('workerName', getFlag(parsed, 'worker-name')),
@@ -227,7 +242,7 @@ export function registerCloudflareRuntimeCommands(registry: CommandRegistry): vo
           return;
         }
 
-        ctx.print('Usage: /cloudflare [status|setup|requirements|create-token|discover|validate|provision|verify|disable] [flags]');
+        ctx.print('Usage: /cloudflare [status|setup|requirements|create-token --yes|discover|validate|provision --yes|verify|disable --yes] [flags]');
       } catch (error) {
         ctx.print(`Cloudflare ${subcommand} failed: ${formatCloudflareError(error)}`);
       }

package/src/input/commands/confirmation.ts

@@ -0,0 +1,24 @@
+import type { CommandContext } from '../command-registry.ts';
+
+export interface ConfirmationArgs {
+  readonly rest: readonly string[];
+  readonly yes: boolean;
+}
+
+export function stripYesFlag(args: readonly string[]): ConfirmationArgs {
+  const rest: string[] = [];
+  let yes = false;
+  for (const token of args) {
+    if (token === '--yes') {
+      yes = true;
+      continue;
+    }
+    rest.push(token);
+  }
+  return { rest, yes };
+}
+
+export function requireYesFlag(ctx: CommandContext, action: string, usage: string): boolean {
+  ctx.print(`Refusing to ${action} without --yes.\nUsage: ${usage}`);
+  return false;
+}

package/src/input/commands/discovery-runtime.ts

@@ -3,13 +3,16 @@ import { scan, persistProviders } from '@pellux/goodvibes-sdk/platform/discovery
 import { requireProviderApi, requireShellPaths } from './runtime-services.ts';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 import { GOODVIBES_AGENT_SURFACE_ROOT } from '../../config/surface.ts';
+import { requireYesFlag, stripYesFlag } from './confirmation.ts';
 
 export function registerDiscoveryRuntimeCommands(registry: CommandRegistry): void {
   registry.register({
     name: 'scan',
     aliases: [],
     description: 'Scan localhost and LAN for local LLM servers',
-    async handler(_args, ctx) {
+    usage: '[--yes]',
+    async handler(args, ctx) {
+      const { yes } = stripYesFlag(args);
       ctx.print('Scanning for local LLM servers...');
       ctx.renderRequest();
 
@@ -33,18 +36,24 @@ export function registerDiscoveryRuntimeCommands(registry: CommandRegistry): voi
         ctx.print(lines.join('\n'));
       }
 
-      try {
-        await requireProviderApi(ctx).registerDiscoveredProviders(result.servers);
-      } catch (err) {
-        ctx.print(`[Scan] Warning: failed to register some providers: ${summarizeError(err)}`);
-      }
-
       if (result.servers.length > 0) {
+        if (!yes) {
+          requireYesFlag(ctx, 'persist discovered local provider configuration', '/scan --yes');
+          ctx.print('[Scan] Discovery results were not saved. Rerun /scan --yes to register and persist providers.');
+          ctx.renderRequest();
+          return;
+        }
+        try {
+          await requireProviderApi(ctx).registerDiscoveredProviders(result.servers);
+        } catch (err) {
+          ctx.print(`[Scan] Warning: failed to register some providers: ${summarizeError(err)}`);
+        }
         const shellPaths = requireShellPaths(ctx);
         persistProviders({
           homeDirectory: shellPaths.homeDirectory,
           surfaceRoot: GOODVIBES_AGENT_SURFACE_ROOT,
         }, result.servers);
+        ctx.print('[Scan] Discovered providers registered and persisted.');
       }
       ctx.renderRequest();
     },

package/src/input/commands/eval.ts

@@ -4,9 +4,9 @@
  * Implements the Evaluation Harness commands:
  *
  *   /eval list                    — List all available eval suites
- *   /eval run <suite>             — Run a named suite (or 'all')
+ *   /eval run <suite> --yes       — Run a named suite (or 'all')
  *   /eval compare <baseline-file> — Compare last run against a baseline file
- *   /eval gate <suite>            — Run suite and apply CI gate (exits 1 on regression)
+ *   /eval gate <suite> --yes      — Run suite and apply CI gate (exits 1 on regression)
  */
 
 import type { SlashCommand, CommandContext } from '../command-registry.ts';
@@ -18,6 +18,7 @@ import type { EvalRegistry } from '../../panels/eval-panel.ts';
 import { formatSuiteResult, formatGateResult } from '@/runtime/index.ts';
 import { requireShellPaths } from './runtime-services.ts';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
+import { requireYesFlag, stripYesFlag } from './confirmation.ts';
 
 // ── Subcommand helpers ────────────────────────────────────────────────────────
 
@@ -29,7 +30,7 @@ function printSuiteList(context: CommandContext): void {
       context.print(`    - ${s.id}: ${s.name}`);
     }
   }
-  context.print('[eval] Usage: /eval run <suite>  or  /eval run all');
+  context.print('[eval] Usage: /eval run <suite> --yes  or  /eval run all --yes');
 }
 
 function getRegistry(context: CommandContext): EvalRegistry | undefined {
@@ -45,7 +46,8 @@ function handleList(_args: string[], context: CommandContext): void {
 // ── /eval run ────────────────────────────────────────────────────────────────
 
 async function handleRun(args: string[], context: CommandContext): Promise<void> {
-  const suiteName = args[0] ?? 'all';
+  const { rest, yes } = stripYesFlag(args);
+  const suiteName = rest[0] ?? 'all';
   const registry = getRegistry(context);
 
   const suitesToRun =
@@ -59,6 +61,10 @@ async function handleRun(args: string[], context: CommandContext): Promise<void>
     context.print(`[eval] Unknown suite: "${suiteName}". Run /eval list to see available suites.`);
     return;
   }
+  if (!yes) {
+    requireYesFlag(context, `run eval suite ${suiteName}`, '/eval run <suite|all> --yes');
+    return;
+  }
 
   const runner = new EvalRunner();
   registry?.setRunning(true);
@@ -90,14 +96,14 @@ async function handleCompare(args: string[], context: CommandContext): Promise<v
   const suiteResults = registry?.getSuiteResults() ?? [];
 
   if (suiteResults.length === 0) {
-    context.print('[eval] No suite results to compare. Run /eval run <suite> first.');
+    context.print('[eval] No suite results to compare. Run /eval run <suite> --yes first.');
     return;
   }
 
   const baseline = await loadBaseline(baselineFile, projectRoot);
   if (!baseline) {
     context.print(`[eval] Baseline file not found: ${baselineFile}`);
-    context.print('[eval] Tip: run /eval gate <suite> to create a baseline.');
+    context.print('[eval] Tip: run /eval gate <suite> [baseline-file] --save-baseline --yes to create a baseline.');
     return;
   }
 
@@ -109,13 +115,15 @@ async function handleCompare(args: string[], context: CommandContext): Promise<v
 // ── /eval gate ────────────────────────────────────────────────────────────────
 
 async function handleGate(args: string[], context: CommandContext): Promise<void> {
-  const suiteName = args[0];
-  const baselineFile = args[1] ?? '.goodvibes/eval/baseline.json';
-  const saveFlag = args.includes('--save-baseline');
+  const { rest, yes } = stripYesFlag(args);
+  const positional = rest.filter((arg) => arg !== '--save-baseline');
+  const suiteName = positional[0];
+  const baselineFile = positional[1] ?? '.goodvibes/eval/baseline.json';
+  const saveFlag = rest.includes('--save-baseline');
   const projectRoot = requireShellPaths(context).workingDirectory;
 
   if (!suiteName) {
-    context.print('[eval] Usage: /eval gate <suite> [baseline-file] [--save-baseline]');
+    context.print('[eval] Usage: /eval gate <suite> [baseline-file] [--save-baseline] --yes');
     return;
   }
 
@@ -124,6 +132,10 @@ async function handleGate(args: string[], context: CommandContext): Promise<void
     context.print(`[eval] Unknown suite: "${suiteName}". Run /eval list to see available suites.`);
     return;
   }
+  if (!yes) {
+    requireYesFlag(context, `run eval gate ${suiteName}`, '/eval gate <suite> [baseline-file] [--save-baseline] --yes');
+    return;
+  }
 
   const registry = getRegistry(context);
   const runner = new EvalRunner();
@@ -141,7 +153,7 @@ async function handleGate(args: string[], context: CommandContext): Promise<void
   context.print(formatGateResult(gate));
 
   if (saveFlag || !baseline) {
-    const label = args[0] ?? 'latest';
+    const label = suiteName ?? 'latest';
     const newBaseline = captureBaseline(label, [fresh]);
     try {
       await writeBaseline(baselineFile, newBaseline, projectRoot);
@@ -164,7 +176,7 @@ export const evalCommand: SlashCommand = {
   name: 'eval',
   description: 'Evaluation harness: run benchmark suites, compare baselines, and gate regressions.',
   usage: '<subcommand> [args]',
-  argsHint: 'list|run <suite>|compare <baseline>|gate <suite>',
+  argsHint: 'list|run <suite> --yes|compare <baseline>|gate <suite> --yes',
   handler: async (args: string[], context: CommandContext): Promise<void> => {
     const [sub, ...rest] = args;
 
@@ -191,9 +203,10 @@ export const evalCommand: SlashCommand = {
         const usage = [
           'Usage: /eval <subcommand>',
           '  list                           — List all available eval suites',
-          '  run <suite|all>                — Run a named suite (or all suites)',
+          '  run <suite|all> --yes          — Run a named suite (or all suites)',
           '  compare [baseline-file]        — Compare last results against baseline',
-          '  gate <suite> [baseline-file]   — Run suite and apply regression gate',
+          '  gate <suite> [baseline-file] --yes',
+          '                                 — Run suite and apply regression gate',
           '    --save-baseline              — Save fresh run as new baseline',
         ].join('\n');
         context.print(usage);

package/src/input/commands/experience-runtime.ts

@@ -2,6 +2,7 @@ import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 import type { CommandRegistry } from '../command-registry.ts';
 import { requirePanelManager, requireShellPaths } from './runtime-services.ts';
+import { requireYesFlag, stripYesFlag } from './confirmation.ts';
 
 interface VoiceBundle {
   readonly version: 1;
@@ -23,21 +24,27 @@ export function registerExperienceRuntimeCommands(registry: CommandRegistry): vo
   registry.register({
     name: 'remote-setup',
     description: 'Dedicated front-door for remote setup review and portable setup bundles',
-    usage: '[review|export <path>]',
+    usage: '[review|export <path> --yes]',
     async handler(args, ctx) {
-      const sub = (args[0] ?? 'review').toLowerCase();
+      const parsed = stripYesFlag(args);
+      const commandArgs = [...parsed.rest];
+      const sub = (commandArgs[0] ?? 'review').toLowerCase();
       if (ctx.executeCommand) {
         if (sub === 'review') {
           await ctx.executeCommand('remote', ['setup']);
           return;
         }
         if (sub === 'export') {
-          const pathArg = args[1];
+          const pathArg = commandArgs[1];
           if (!pathArg) {
-            ctx.print('Usage: /remote-setup export <path>');
+            ctx.print('Usage: /remote-setup export <path> --yes');
             return;
           }
-          await ctx.executeCommand('remote', ['setup', 'export', pathArg]);
+          if (!parsed.yes) {
+            requireYesFlag(ctx, `export remote setup bundle to ${pathArg}`, '/remote-setup export <path> --yes');
+            return;
+          }
+          await ctx.executeCommand('remote', ['setup', 'export', pathArg, '--yes']);
           return;
         }
       }
@@ -48,21 +55,27 @@ export function registerExperienceRuntimeCommands(registry: CommandRegistry): vo
   registry.register({
     name: 'remote-env',
     description: 'Dedicated front-door for remote environment snippets and portable env exports',
-    usage: '[review|export <path>]',
+    usage: '[review|export <path> --yes]',
     async handler(args, ctx) {
-      const sub = (args[0] ?? 'review').toLowerCase();
+      const parsed = stripYesFlag(args);
+      const commandArgs = [...parsed.rest];
+      const sub = (commandArgs[0] ?? 'review').toLowerCase();
       if (ctx.executeCommand) {
         if (sub === 'review') {
           await ctx.executeCommand('remote', ['env']);
           return;
         }
         if (sub === 'export') {
-          const pathArg = args[1];
+          const pathArg = commandArgs[1];
           if (!pathArg) {
-            ctx.print('Usage: /remote-env export <path>');
+            ctx.print('Usage: /remote-env export <path> --yes');
+            return;
+          }
+          if (!parsed.yes) {
+            requireYesFlag(ctx, `export remote environment snippet to ${pathArg}`, '/remote-env export <path> --yes');
             return;
           }
-          await ctx.executeCommand('remote', ['env', 'export', pathArg]);
+          await ctx.executeCommand('remote', ['env', 'export', pathArg, '--yes']);
           return;
         }
       }
@@ -73,21 +86,27 @@ export function registerExperienceRuntimeCommands(registry: CommandRegistry): vo
   registry.register({
     name: 'tunnel',
     description: 'Dedicated front-door for remote tunnel review and export flows',
-    usage: '[review|export <path>]',
+    usage: '[review|export <path> --yes]',
     async handler(args, ctx) {
-      const sub = (args[0] ?? 'review').toLowerCase();
+      const parsed = stripYesFlag(args);
+      const commandArgs = [...parsed.rest];
+      const sub = (commandArgs[0] ?? 'review').toLowerCase();
       if (ctx.executeCommand) {
         if (sub === 'review') {
           await ctx.executeCommand('remote', ['tunnel', 'review']);
           return;
         }
         if (sub === 'export') {
-          const pathArg = args[1];
+          const pathArg = commandArgs[1];
           if (!pathArg) {
-            ctx.print('Usage: /tunnel export <path>');
+            ctx.print('Usage: /tunnel export <path> --yes');
             return;
           }
-          await ctx.executeCommand('remote', ['tunnel', 'export', pathArg]);
+          if (!parsed.yes) {
+            requireYesFlag(ctx, `export remote tunnel review to ${pathArg}`, '/tunnel export <path> --yes');
+            return;
+          }
+          await ctx.executeCommand('remote', ['tunnel', 'export', pathArg, '--yes']);
           return;
         }
       }
@@ -98,19 +117,29 @@ export function registerExperienceRuntimeCommands(registry: CommandRegistry): vo
   registry.register({
     name: 'bootstrap',
     description: 'Dedicated front-door for remote bootstrap bundle export and inspection',
-    usage: '[export <path>|inspect <path>]',
+    usage: '[export <path> --yes|inspect <path>]',
     async handler(args, ctx) {
-      const sub = (args[0] ?? '').toLowerCase();
-      const pathArg = args[1];
+      const parsed = stripYesFlag(args);
+      const commandArgs = [...parsed.rest];
+      const sub = (commandArgs[0] ?? '').toLowerCase();
+      const pathArg = commandArgs[1];
       if (!ctx.executeCommand) {
         ctx.print('Bootstrap controls are not available in this runtime.');
         return;
       }
-      if ((sub === 'export' || sub === 'inspect') && pathArg) {
+      if (sub === 'export' && pathArg) {
+        if (!parsed.yes) {
+          requireYesFlag(ctx, `export remote bootstrap bundle to ${pathArg}`, '/bootstrap export <path> --yes');
+          return;
+        }
+        await ctx.executeCommand('remote', ['bootstrap', sub, pathArg, '--yes']);
+        return;
+      }
+      if (sub === 'inspect' && pathArg) {
         await ctx.executeCommand('remote', ['bootstrap', sub, pathArg]);
         return;
       }
-      ctx.print('Usage: /bootstrap [export <path>|inspect <path>]');
+      ctx.print('Usage: /bootstrap [export <path> --yes|inspect <path>]');
     },
   });
 
@@ -223,10 +252,12 @@ export function registerExperienceRuntimeCommands(registry: CommandRegistry): vo
   registry.register({
     name: 'voice',
     description: 'Review voice posture and package portable voice-surface metadata',
-    usage: '[review|enable|disable|bundle export <path>|bundle inspect <path>]',
+    usage: '[review|enable --yes|disable --yes|bundle export <path> --yes|bundle inspect <path>]',
     handler(args, ctx) {
+      const parsed = stripYesFlag(args);
+      const commandArgs = [...parsed.rest];
       const shellPaths = requireShellPaths(ctx);
-      const sub = (args[0] ?? 'review').toLowerCase();
+      const sub = (commandArgs[0] ?? 'review').toLowerCase();
       if (sub === 'review') {
         const enabled = Boolean(ctx.platform.configManager.get('ui.voiceEnabled') ?? false);
         ctx.print([
@@ -238,20 +269,28 @@ export function registerExperienceRuntimeCommands(registry: CommandRegistry): vo
         return;
       }
       if (sub === 'enable' || sub === 'disable') {
+        if (!parsed.yes) {
+          requireYesFlag(ctx, `${sub} voice surface`, `/voice ${sub} --yes`);
+          return;
+        }
         const next = sub === 'enable';
         ctx.platform.configManager.setDynamic('ui.voiceEnabled', next);
         ctx.print(`Voice surface ${next ? 'enabled' : 'disabled'} for this runtime.`);
         return;
       }
       if (sub === 'bundle') {
-        const mode = args[1];
-        const pathArg = args[2];
+        const mode = commandArgs[1];
+        const pathArg = commandArgs[2];
         if ((mode === 'export' || mode === 'inspect') && !pathArg) {
-          ctx.print(`Usage: /voice bundle ${mode} <path>`);
+          ctx.print(`Usage: /voice bundle ${mode} <path>${mode === 'export' ? ' --yes' : ''}`);
           return;
         }
         const targetPath = shellPaths.resolveWorkspacePath(pathArg!);
         if (mode === 'export') {
+          if (!parsed.yes) {
+            requireYesFlag(ctx, `export voice bundle to ${pathArg}`, '/voice bundle export <path> --yes');
+            return;
+          }
           const bundle: VoiceBundle = {
             version: 1,
             exportedAt: Date.now(),
@@ -272,7 +311,7 @@ export function registerExperienceRuntimeCommands(registry: CommandRegistry): vo
           return;
         }
       }
-      ctx.print('Usage: /voice [review|enable|disable|bundle export <path>|bundle inspect <path>]');
+      ctx.print('Usage: /voice [review|enable --yes|disable --yes|bundle export <path> --yes|bundle inspect <path>]');
     },
   });
 }

package/src/input/commands/health-runtime.ts

@@ -299,7 +299,7 @@ export function registerHealthRuntimeCommands(registry: CommandRegistry): void {
           lines.push('  domain: auth');
           lines.push(...(
             auth.bootstrapCredentialPresent
-              ? ['  /auth local review', '  /auth local rotate-password admin <password>', '  /auth local clear-bootstrap-file']
+              ? ['  /auth local review', '  /auth local rotate-password admin <password> --yes', '  /auth local clear-bootstrap-file --yes']
               : ['  /auth local review']
           ));
           lines.push('  verify: /health auth');