@wrongstack/cli 0.276.3 → 0.277.0

package/README.md

@@ -17,8 +17,7 @@ The `wrongstack` umbrella package transitively installs `@wrongstack/cli` along
 ```bash
 wstack                        # interactive REPL — no flags = default
 wstack --tui                  # Ink-based TUI
-wstack --yolo                 # auto-approve normal project work
-wstack --yolo --yolo-destructive  # also auto-approve destructive-gated calls
+wstack --yolo                 # auto-approve normal project work; destructive calls still prompt
 wstack "refactor src/auth.ts" # one-shot query (no interactive loop)
 
 wstack --provider <id> --model <id>   # skip the picker
@@ -97,7 +96,8 @@ API keys are encrypted at rest with AES-256-GCM and the key file at `~/.wrongsta
 |------|--------|
 | `--tui` / `--no-tui` | Force/disable Ink TUI |
 | `--yolo` | Auto-approve normal in-project tool calls |
-| `--yolo-destructive` | Also auto-approve clearly destructive YOLO-gated calls |
+| `--confirm-destructive` | Deprecated; destructive confirmations are always on in YOLO |
+| `--yolo-destructive` | Deprecated compatibility flag; destructive calls still prompt |
 | `--force-all-yolo` | Deprecated alias for `--yolo-destructive` |
 | `--provider <id>` | Override the configured provider |
 | `--model <id>` | Override the configured model |

package/dist/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { color, CODEX_MODELS, ToolCapabilities, readBundledInstructionText, writeErr, loadPlugins, renderProgress, SpecStore, TaskGraphStore, analyzeCriticalPath, getTemplate, listTemplates, templateToMarkdown, SpecParser, renderSpecAnalysis, AISpecBuilder, expectDefined, DefaultTaskStore, TaskTracker, renderTaskGraph, withFileLock, ConfigError, resolveHqDataDir, ensureHqFirstRunAuthFile, DEFAULT_HQ_REDACTION_POLICY, watchHqAuthFile, parseHqFrame, HQ_PROTOCOL_VERSION, parseHqEventPayload, scrubAndTruncateHqPreview, FetchError, DefaultSecretScrubber, resolveWstackPaths, watchProviderConfig, projectHash, wstackGlobalRoot, PromptUsageStore, TOKENS, ToolRegistry, GlobalMailbox, resolveSessionLoggingConfig, createSessionEventBridge, HookRegistry, HookRunner, shellHooksEqual, countShellHooks, normalizeTokenSavingTier, SlashCommandRegistry, attachDepWatcherBridge, createFallbackModelExtension, SessionMemoryConsolidator, BrainDecisionQueue, ObservableBrainArbiter, HumanEscalatingBrainArbiter, createTieredBrainArbiter, DefaultBrainArbiter, BrainMonitor, mailboxSessionTag, createDelegateTool, FLEET_ROSTER, createMcpControlTool, startTechStackConsumer, startPackageOutdatedWatcher, SddRunRegistry, recordFileAction, createAutonomyBrain, DefaultPluginAPI, SpecVersioning, buildTranscriptFromEvents, DEFAULT_CONTEXT_WINDOW_MODE_ID, resolveProjectDir, DefaultLogger, DefaultModelsRegistry, isStdinTTY, FsError, atomicWrite, DefaultPathResolver, EventBus, runProviderWithRetry, ReplayLogStore, ReplayProviderRunner, mergeCustomModelDefs, DefaultSystemPromptBuilder, makeAutonomyPromptContributor, sessionScopedPath as sessionScopedPath$1, createContextManagerTool, makeMailboxTool, makeMailSendTool, makeMailInboxTool, applyToolDescriptionModes, applyToolResultRenderModes, InMemoryMetricsSink, wireMetricsToEvents, DefaultHealthRegistry, startMetricsServer, createHqPublisherFromEnv, DEFAULT_SESSION_PRUNE_DAYS, RecoveryLock, DefaultAttachmentStore, Context, QueueStore, loadTodosCheckpoint, attachTodosCheckpoint, loadDirectorState, loadPlan, createDefaultPipelines, applyModelRuntime, installDesignStudioMiddleware, resolveContextWindowPolicy, resolveAuditLevel, AutoCompactionMiddleware, estimateRequestTokensCalibrated, Agent, FleetManager, makeDirectorSessionFactory, Director, makeFleetEmitTool, AdaptiveConcurrencyController, resolveModelMatrix, resolveModelTargetFromEntry, DEFAULT_SUBAGENT_BASELINE, DefaultTokenCounter, AutoApprovePermissionPolicy, ToolValidationError, WIDE_SUBAGENT_CAPABILITIES, AgentError, PhaseStore, AutoPhasePlanner, PhaseGraphBuilder, WorktreeManager, PhaseOrchestrator, assignNickname, makeLLMClassifier, writeOut, ParallelEternalEngine, EternalAutonomyEngine, allServers as allServers$1, CHIMERA_REVIEW_PROMPT, setQueuedMessagesSnapshot, projectSlug, recentTextTurns, gatedEnhancerReasoning, enhanceUserPrompt, repairToolUseAdjacency, mutateTasks, loadTasks, mutatePlan, setPlanItemStatus, getPlanTemplate, emptyPlan, addPlanItem, savePlan, resolveProviderModelList, bootConfig as bootConfig$1, setOutputLineGuard, setRawMode, DefaultSessionReader, ToolAuditLog, DefaultSessionRewinder, DefaultSessionStore as DefaultSessionStore$1, ProviderRegistry, makeAgentSubagentRunner, NULL_FLEET_BUS, ERROR_CODES, buildChildEnv, formatContextWindowModeList, getContextWindowMode, AGENT_CATALOG, dispatchAgent, normalizeToolDescriptionMode, getToolDescriptionMode, noOpVault, formatTodosList, formatTaskList, formatTaskProgress, formatPlan, SessionRecovery, loadGoal, goalFilePath, summarizeUsage, saveGoal, formatGoal, emptyGoal, buildGoalPreamble, pendingBtwCount, setBtwNote, getDesignKitLoader, getDesignState, clearActiveKit, clearPersistedActiveKit, recordOverrides, setDesignOverrides, loadActiveKit, isDesignStack, applyTokenOverrides, materializeTokens, setActiveKit, readHqRuntimeFileSync, resolveHqConfig, MATRIX_PHASE_KEYS, matrixKeyKind, phaseForRole, fallbackProfileChain, parseModelRef, normalizeModelRef, onResize, InputBuilder, DefaultSecretVault as DefaultSecretVault$1, decryptConfigSecrets as decryptConfigSecrets$1, encryptConfigSecrets as encryptConfigSecrets$1, HQ_AUTH_FILE_VERSION, truncate, estimateMessageTokens, AGENTS_BY_PHASE, validateAgainstSchema, normalizeToolResultRenderMode, getToolResultRenderMode, setToolResultRenderMode, resolveMailboxIdentity, smartDefaultFallbackChain, AutonomousCoordinator, mutateHqAuthFile, mintHqToken, readHqAuthFile, isSecretField as isSecretField$1, renderInstructionTemplate, ParseError, startSessionTelemetryBridge } from '@wrongstack/core';
+import { color, CODEX_MODELS, ToolCapabilities, readBundledInstructionText, writeErr, loadPlugins, renderProgress, SpecStore, TaskGraphStore, analyzeCriticalPath, getTemplate, listTemplates, templateToMarkdown, SpecParser, renderSpecAnalysis, AISpecBuilder, expectDefined, DefaultTaskStore, TaskTracker, renderTaskGraph, withFileLock, ConfigError, resolveHqDataDir, ensureHqFirstRunAuthFile, DEFAULT_HQ_REDACTION_POLICY, watchHqAuthFile, parseHqFrame, HQ_PROTOCOL_VERSION, parseHqEventPayload, scrubAndTruncateHqPreview, FetchError, DefaultSecretScrubber, resolveWstackPaths, watchProviderConfig, projectHash, wstackGlobalRoot, PromptUsageStore, TOKENS, ToolRegistry, GlobalMailbox, resolveSessionLoggingConfig, createSessionEventBridge, HookRegistry, HookRunner, shellHooksEqual, countShellHooks, normalizeTokenSavingTier, SlashCommandRegistry, attachDepWatcherBridge, createFallbackModelExtension, SessionMemoryConsolidator, BrainDecisionQueue, ObservableBrainArbiter, HumanEscalatingBrainArbiter, createTieredBrainArbiter, DefaultBrainArbiter, BrainMonitor, mailboxSessionTag, createDelegateTool, FLEET_ROSTER, createMcpControlTool, startTechStackConsumer, startPackageOutdatedWatcher, SddRunRegistry, recordFileAction, createAutonomyBrain, DefaultPluginAPI, SpecVersioning, buildTranscriptFromEvents, DEFAULT_CONTEXT_WINDOW_MODE_ID, resolveProjectDir, DefaultLogger, DefaultModelsRegistry, isStdinTTY, FsError, atomicWrite, DefaultPathResolver, EventBus, runProviderWithRetry, ReplayLogStore, ReplayProviderRunner, mergeCustomModelDefs, DefaultSystemPromptBuilder, makeAutonomyPromptContributor, sessionScopedPath as sessionScopedPath$1, createContextManagerTool, makeMailboxTool, makeMailSendTool, makeMailInboxTool, applyToolDescriptionModes, applyToolResultRenderModes, InMemoryMetricsSink, wireMetricsToEvents, DefaultHealthRegistry, startMetricsServer, createHqPublisherFromEnv, DEFAULT_SESSION_PRUNE_DAYS, RecoveryLock, DefaultAttachmentStore, Context, QueueStore, loadTodosCheckpoint, attachTodosCheckpoint, loadDirectorState, loadPlan, createDefaultPipelines, applyModelRuntime, installDesignStudioMiddleware, resolveContextWindowPolicy, resolveAuditLevel, AutoCompactionMiddleware, estimateRequestTokensCalibrated, Agent, FleetManager, makeDirectorSessionFactory, Director, makeFleetEmitTool, AdaptiveConcurrencyController, resolveModelMatrix, resolveModelTargetFromEntry, DEFAULT_SUBAGENT_BASELINE, DefaultTokenCounter, AutoApprovePermissionPolicy, ToolValidationError, WIDE_SUBAGENT_CAPABILITIES, AgentError, PhaseStore, AutoPhasePlanner, PhaseGraphBuilder, WorktreeManager, PhaseOrchestrator, assignNickname, makeLLMClassifier, writeOut, ParallelEternalEngine, EternalAutonomyEngine, allServers as allServers$1, CHIMERA_REVIEW_PROMPT, setQueuedMessagesSnapshot, projectSlug, recentTextTurns, gatedEnhancerReasoning, enhanceUserPrompt, repairToolUseAdjacency, mutateTasks, loadTasks, mutatePlan, setPlanItemStatus, getPlanTemplate, emptyPlan, addPlanItem, savePlan, resolveProviderModelList, bootConfig as bootConfig$1, setOutputLineGuard, setRawMode, DefaultSessionReader, ToolAuditLog, DefaultSessionRewinder, DefaultSessionStore as DefaultSessionStore$1, ProviderRegistry, makeAgentSubagentRunner, NULL_FLEET_BUS, ERROR_CODES, buildChildEnv, formatContextWindowModeList, getContextWindowMode, AGENT_CATALOG, dispatchAgent, normalizeToolDescriptionMode, getToolDescriptionMode, noOpVault, formatTodosList, formatTaskList, formatTaskProgress, formatPlan, SessionRecovery, loadGoal, goalFilePath, summarizeUsage, saveGoal, formatGoal, emptyGoal, buildGoalPreamble, pendingBtwCount, setBtwNote, getDesignKitLoader, getDesignState, clearActiveKit, clearPersistedActiveKit, recordOverrides, setDesignOverrides, loadActiveKit, isDesignStack, applyTokenOverrides, materializeTokens, setActiveKit, readHqRuntimeFileSync, resolveHqConfig, MATRIX_PHASE_KEYS, matrixKeyKind, phaseForRole, fallbackProfileChain, parseModelRef, normalizeModelRef, onResize, hasOpenTodos, InputBuilder, DefaultSecretVault as DefaultSecretVault$1, decryptConfigSecrets as decryptConfigSecrets$1, encryptConfigSecrets as encryptConfigSecrets$1, HQ_AUTH_FILE_VERSION, truncate, estimateMessageTokens, AGENTS_BY_PHASE, validateAgainstSchema, normalizeToolResultRenderMode, getToolResultRenderMode, setToolResultRenderMode, resolveMailboxIdentity, smartDefaultFallbackChain, AutonomousCoordinator, mutateHqAuthFile, mintHqToken, readHqAuthFile, isSecretField as isSecretField$1, renderInstructionTemplate, ParseError, startSessionTelemetryBridge } from '@wrongstack/core';
 import * as fs5 from 'fs/promises';
 import { access, readFile } from 'fs/promises';
 import { DefaultSecretVault, decryptConfigSecrets, encryptConfigSecrets, isSecretField } from '@wrongstack/core/security';
@@ -16995,6 +16995,32 @@ function buildMailboxDemoCommand(opts) {
     }
   };
 }
+
+// src/utils/win32-cmd.ts
+var WIN32_CMD_META = /[&|<>"\r\n\0]/;
+function buildWin32CmdShimInvocation(command2, args = []) {
+  assertSafeWin32CmdArgs([command2, ...args]);
+  const line = ["call", quoteWin32CmdArg(command2), ...args.map(quoteWin32CmdArg)].join(" ");
+  return {
+    command: process.env["COMSPEC"] ?? "cmd.exe",
+    args: ["/d", "/c", line],
+    windowsVerbatimArguments: true
+  };
+}
+function assertSafeWin32CmdArgs(args) {
+  for (const arg of args) {
+    if (typeof arg === "string" && WIN32_CMD_META.test(arg)) {
+      throw new Error(
+        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
+      );
+    }
+  }
+}
+function quoteWin32CmdArg(arg) {
+  return `"${arg}"`;
+}
+
+// src/slash-commands/mailbox-serve.ts
 function buildMailboxServeCommand(opts) {
   return {
     name: "mailbox-serve",
@@ -17040,16 +17066,16 @@ function buildMailboxServeCommand(opts) {
       const isWin = process.platform === "win32";
       let wstackCmd;
       let spawnArgs;
-      let useShell = false;
+      let shim = null;
       if (cliEntry && /wstack|wrongstack|index\.(js|ts|mjs|cjs)$/.test(cliEntry)) {
         wstackCmd = process.execPath;
         spawnArgs = [cliEntry, "mailbox", "serve", ...flags];
       } else {
         wstackCmd = "wstack";
         spawnArgs = ["mailbox", "serve", ...flags];
-        useShell = isWin;
+        if (isWin) shim = buildWin32CmdShimInvocation(wstackCmd, spawnArgs);
       }
-      const child = spawn(wstackCmd, spawnArgs, {
+      const child = spawn(shim?.command ?? wstackCmd, shim?.args ?? spawnArgs, {
         cwd,
         // POSIX-only: own process group so the bridge outlives the REPL.
         // On win32 `detached` opens a visible console window (project
@@ -17057,7 +17083,7 @@ function buildMailboxServeCommand(opts) {
         detached: !isWin,
         stdio: ["ignore", "pipe", "pipe"],
         windowsHide: true,
-        shell: useShell,
+        ...shim ? { windowsVerbatimArguments: shim.windowsVerbatimArguments } : {},
         env: process.env
       });
       child.unref();
@@ -23274,12 +23300,12 @@ function buildYoloCommand(opts) {
     help: [
       "Usage:",
       "  /yolo              Show current YOLO status",
-      "  /yolo on           Enable YOLO mode (auto-approve all tool calls)",
+      "  /yolo on           Enable YOLO mode (auto-approve normal project work)",
       "  /yolo off          Disable YOLO mode (restore permission prompts)",
-      "  /yolo destructive  Toggle destructive confirmation gate (YOLO mode only)",
+      "  /yolo destructive  Show destructive confirmation gate status",
       "",
-      "YOLO mode auto-approves everything, including destructive calls.",
-      "Use /yolo destructive to re-enable confirmation for risky operations."
+      "YOLO mode auto-approves normal project work, including shell/build/test/write flows.",
+      "Clearly destructive operations still require explicit confirmation."
     ].join("\n"),
     async run(args) {
       const arg = args.trim().toLowerCase();
@@ -23305,11 +23331,11 @@ function buildYoloCommand(opts) {
       } else if (arg === "destructive") {
         const currentMode = opts.onYolo();
         if (!currentMode) {
-          const msg3 = `${color.amber("YOLO is OFF.")} Enable YOLO first with /yolo on, then /yolo destructive will control the confirmation gate.`;
+          const msg3 = `${color.amber("YOLO is OFF.")} Destructive operations still require confirmation when YOLO is enabled.`;
           opts.renderer.writeWarning(msg3);
           return { message: msg3 };
         }
-        const msg2 = `${color.amber("Destructive gate:")} ${color.dim("YOLO is ON \u2014 destructive operations require confirmation. Use /yolo destructive to toggle this gate.")}`;
+        const msg2 = `${color.amber("Destructive gate:")} ${color.dim("ON \u2014 YOLO is enabled, but clearly destructive operations still require confirmation.")}`;
         opts.renderer.writeWarning(msg2);
         return { message: msg2 };
       } else {
@@ -31653,9 +31679,9 @@ var helpCmd = async (_args, deps) => {
     "  wstack version               Print version",
     "",
     color.bold("Common flags"),
-    "  --yolo                       Auto-approve all tool calls (including destructive)",
-    "  --confirm-destructive         In YOLO mode, still prompt for destructive operations",
-    "  --yolo-destructive            Deprecated \u2014 YOLO now auto-approves everything by default",
+    "  --yolo                       Auto-approve normal project work; destructive calls still prompt",
+    "  --confirm-destructive         Deprecated \u2014 destructive confirmations are always on in YOLO mode",
+    "  --yolo-destructive            Deprecated compatibility flag; destructive calls still prompt",
     "  --tui / --no-tui             Force or disable TUI mode",
     "  --mouse                      Full mouse mode in the TUI (in-app scroll + clickable UI)",
     "  --webui [--host <h>] [--webui-port <n>] [--ws-port <n>] [--webui-token <t>] [--open]",
@@ -32443,6 +32469,67 @@ function bindSystemPromptBuilder(deps) {
   );
 }
 
+// src/boot/brain-decision-log.ts
+var MAX_BRAIN_LOG_ENTRIES = 20;
+function subscribeBrainDecisionLog(events) {
+  const listeners = [];
+  const brainLog = [];
+  const pushBrainLog = (entry) => {
+    brainLog.push(entry);
+    if (brainLog.length > MAX_BRAIN_LOG_ENTRIES) brainLog.shift();
+  };
+  const subscribe = (name, handler) => {
+    events.on(name, handler);
+    listeners.push([name, handler]);
+  };
+  subscribe("brain.decision_answered", (raw) => {
+    const e = raw;
+    pushBrainLog({
+      at: e.at,
+      kind: "answered",
+      question: e.request.question,
+      outcome: e.decision.type === "answer" ? e.decision.optionId ?? e.decision.text ?? "" : ""
+    });
+  });
+  subscribe("brain.decision_ask_human", (raw) => {
+    const e = raw;
+    pushBrainLog({
+      at: e.at,
+      kind: "ask_human",
+      question: e.request.question,
+      outcome: "escalated to human"
+    });
+  });
+  subscribe("brain.decision_denied", (raw) => {
+    const e = raw;
+    pushBrainLog({
+      at: e.at,
+      kind: "denied",
+      question: e.request.question,
+      outcome: e.decision.type === "deny" ? e.decision.reason ?? "" : ""
+    });
+  });
+  subscribe("brain.intervention", (raw) => {
+    const e = raw;
+    pushBrainLog({
+      at: e.at,
+      kind: "intervention",
+      question: e.request.question,
+      outcome: e.intervened ? "steered the agent" : "observed (no action)"
+    });
+  });
+  const dispose = () => {
+    for (const [name, handler] of listeners) {
+      events.off.call(
+        events,
+        name,
+        handler
+      );
+    }
+  };
+  return { brainLog, pushBrainLog, dispose };
+}
+
 // src/boot/short-circuit-flags.ts
 async function handleHelpVersionShortCircuit(argv) {
   const earlyFlags = parseArgs(argv).flags;
@@ -34109,7 +34196,10 @@ init_hq_publisher();
 init_sdd();
 init_utils();
 var DEFAULT_MAX_CONSECUTIVE_AUTO_PROCEED = 50;
-function parseSuggestionsFromOutput(finalText) {
+function parseSuggestionsFromOutput(finalText, todos) {
+  if (hasOpenTodos(todos)) {
+    return null;
+  }
   const { texts, autoTexts } = parseNextSteps(finalText, false);
   if (autoTexts.length > 0) ;
   return texts.length > 0 ? texts : null;
@@ -34467,7 +34557,10 @@ ${color.dim(taskList2)}
                   }
                 }
                 if (opts.onSuggestionsParsed) {
-                  const parsed = parseSuggestionsFromOutput(runResult.finalText);
+                  const parsed = parseSuggestionsFromOutput(
+                    runResult.finalText,
+                    opts.agent.ctx.todos
+                  );
                   opts.onSuggestionsParsed(parsed);
                 }
               }
@@ -34626,7 +34719,7 @@ ${color.dim(taskList2)}
           }
         }
         if (result.status === "done" && result.finalText && opts.onSuggestionsParsed) {
-          const parsed = parseSuggestionsFromOutput(result.finalText);
+          const parsed = parseSuggestionsFromOutput(result.finalText, opts.agent.ctx.todos);
           opts.onSuggestionsParsed(parsed);
         }
         if (opts.tokenCounter && before) {
@@ -34671,7 +34764,7 @@ ${color.dim(
             } finally {
               activeCtrl = void 0;
             }
-          } else if (autonomy === "suggest") {
+          } else if (autonomy === "suggest" && !hasOpenTodos(opts.agent.ctx.todos)) {
             const suggestPrompt = 'Based on what you just did, suggest 3 concrete next steps. Format: numbered list, one line each, no explanation. If there is nothing meaningful left, say "No further steps needed."';
             const suggestBlocks = [{ type: "text", text: suggestPrompt }];
             const suggestCtrl = new AbortController();
@@ -34695,7 +34788,10 @@ ${suggestResult.finalText}
 `
                 );
                 if (opts.onSuggestionsParsed) {
-                  const parsed = parseSuggestionsFromOutput(suggestResult.finalText);
+                  const parsed = parseSuggestionsFromOutput(
+                    suggestResult.finalText,
+                    opts.agent.ctx.todos
+                  );
                   opts.onSuggestionsParsed(parsed);
                 }
               }
@@ -34705,7 +34801,7 @@ ${suggestResult.finalText}
             }
           }
         }
-        if (result.status === "done" && opts.getNextPredict?.()) {
+        if (result.status === "done" && opts.getNextPredict?.() && !hasOpenTodos(opts.agent.ctx.todos)) {
           const autonomy = opts.getAutonomy?.() ?? "off";
           if (autonomy === "off") {
             const predictCtrl = new AbortController();
@@ -34866,7 +34962,7 @@ async function runAutoProceed(opts, suggestion, delayMs, ctrl) {
       ).total
     );
     if (runResult.status === "done" && runResult.finalText && opts.onSuggestionsParsed) {
-      const parsed = parseSuggestionsFromOutput(runResult.finalText);
+      const parsed = parseSuggestionsFromOutput(runResult.finalText, opts.agent.ctx.todos);
       opts.onSuggestionsParsed(parsed);
     }
   } finally {
@@ -35327,9 +35423,13 @@ async function execute(deps) {
           },
           // Parse 💡 Next steps from assistant output and store them in the
           // shared suggestion store so `/next 1`, `/next 1 2 3` work without
-          // requiring `/suggest` first. Called unconditionally on every done turn.
+          // requiring `/suggest` first. Called unconditionally on every done
+          // turn. The live todo list is passed through so we suppress
+          // <next_steps> while the in-flight todo loop is still in progress
+          // — finishing the open todos comes before offering new prompt
+          // options.
           onSuggestionsParsed: (finalText) => {
-            const parsed = parseSuggestionsFromOutput(finalText);
+            const parsed = parseSuggestionsFromOutput(finalText, context.todos);
             setSuggestions(parsed ?? []);
           },
           // Retrieve current suggestions for next-steps auto-submit countdown.
@@ -36503,11 +36603,13 @@ var MultiAgentHost = class _MultiAgentHost {
    *      and `shell.*` are not in the read-only default), silently crippling
    *      every code-writing / build role in the catalog.
    *   3. No tool restriction (full registry) → the WIDE working set
-   *      (`WIDE_SUBAGENT_CAPABILITIES`: read, write, net, shell, install). The
-   *      user authorized full developer work when they invoked the leader, so a
-   *      delegated agent runs the same toolchain end-to-end. The genuinely
-   *      blast-radius-escaping capabilities (fs.write.outside-project, mcp.proxy,
-   *      subagent.spawn, config.mutate) stay off and need an explicit (1) grant.
+   *      (`WIDE_SUBAGENT_CAPABILITIES`: read, write, net, shell, install,
+   *      session todo, tool metadata, read-only memory). The user authorized full
+   *      developer work when they invoked the leader, so a delegated agent runs
+   *      the same toolchain end-to-end. The genuinely blast-radius-escaping
+   *      capabilities (fs.write.outside-project, tool.mutate.any, memory writes,
+   *      mcp.proxy, subagent.spawn, config.mutate) stay off and need an explicit
+   *      (1) grant.
    */
   resolveSubagentCapabilities(subCfg) {
     if (subCfg.allowedCapabilities) return subCfg.allowedCapabilities;
@@ -36801,6 +36903,7 @@ var MultiAgentHost = class _MultiAgentHost {
     if (this.director) {
       await this.getCoordinator().stopAll();
     }
+    await this.fleetManager?.flushManifest();
   }
   /**
    * Current effective concurrent-subagent ceiling. Reads the live
@@ -36861,6 +36964,9 @@ var MultiAgentHost = class _MultiAgentHost {
     if (this.director) {
       await this.director.shutdown();
     }
+    await this.fleetManager?.flushManifest();
+    this.fleetManager?.dispose();
+    this.fleetManager = void 0;
     const monitor = this.opts.agentMonitor;
     if (monitor) {
       monitor.stop();
@@ -37310,16 +37416,16 @@ function defaultSpawn(args, cwd) {
   const isWin = process.platform === "win32";
   let cmd;
   let spawnArgs;
-  let useShell = false;
+  let shim = null;
   if (cliEntry && /wstack|wrongstack|index\.(js|ts|mjs|cjs)$/.test(cliEntry)) {
     cmd = process.execPath;
     spawnArgs = [cliEntry, ...args];
   } else {
     cmd = "wstack";
     spawnArgs = args;
-    useShell = isWin;
+    if (isWin) shim = buildWin32CmdShimInvocation(cmd, spawnArgs);
   }
-  const child = spawn(cmd, spawnArgs, {
+  const child = spawn(shim?.command ?? cmd, shim?.args ?? spawnArgs, {
     cwd,
     // `detached` gives the bridge its own process group on POSIX so it
     // outlives the REPL. On win32 it forces a visible console window
@@ -37328,7 +37434,7 @@ function defaultSpawn(args, cwd) {
     detached: !isWin,
     stdio: ["ignore", "pipe", "pipe"],
     windowsHide: true,
-    shell: useShell,
+    ...shim ? { windowsVerbatimArguments: shim.windowsVerbatimArguments } : {},
     env: process.env
   });
   return {
@@ -38075,7 +38181,7 @@ async function main(argv) {
     renderer,
     modelsRegistry,
     yoloDestructive: flags["yolo-destructive"] === true || flags["force-all-yolo"] === true,
-    confirmDestructive: flags["confirm-destructive"] === true
+    confirmDestructive: true
   });
   const replayFlag = flags["replay"];
   const recordFlag = flags["record"];
@@ -38732,43 +38838,8 @@ async function main(argv) {
     events
   );
   container.bind(TOKENS.BrainArbiter, () => brain);
-  const brainLog = [];
-  const pushBrainLog = (entry) => {
-    brainLog.push(entry);
-    if (brainLog.length > 20) brainLog.shift();
-  };
-  evOn("brain.decision_answered", (e) => {
-    pushBrainLog({
-      at: e.at,
-      kind: "answered",
-      question: e.request.question,
-      outcome: e.decision.type === "answer" ? e.decision.optionId ?? e.decision.text : ""
-    });
-  });
-  evOn("brain.decision_ask_human", (e) => {
-    pushBrainLog({
-      at: e.at,
-      kind: "ask_human",
-      question: e.request.question,
-      outcome: "escalated to human"
-    });
-  });
-  evOn("brain.decision_denied", (e) => {
-    pushBrainLog({
-      at: e.at,
-      kind: "denied",
-      question: e.request.question,
-      outcome: e.decision.type === "deny" ? e.decision.reason : ""
-    });
-  });
-  evOn("brain.intervention", (e) => {
-    pushBrainLog({
-      at: e.at,
-      kind: "intervention",
-      question: e.request.question,
-      outcome: e.intervened ? "steered the agent" : "observed (no action)"
-    });
-  });
+  const { brainLog, dispose: disposeBrainLog } = subscribeBrainDecisionLog(events);
+  teardownHandlers.push(disposeBrainLog);
   let hqPublisher;
   let stopHqSessionBridge;
   const hqConnection = startCliHqConnection({