@wrongstack/cli 0.319.1 → 1.0.1

package/dist/{chunk-635WW3II.js → chunk-TEBMCYZN.js}

@@ -1,7 +1,7 @@
 
 // src/wiring/external-plugins.ts
-import { fileURLToPath, pathToFileURL } from "node:url";
 import { isAbsolute, join, resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import {
   defaultPluginTrustPath,
   discoverExternalPlugins,
@@ -13,6 +13,12 @@ import {
   resolvePluginTarget,
   verifyPluginTrust
 } from "@wrongstack/core/plugin";
+function resolveExternalPluginTrustMode(raw) {
+  if (raw === false) return "off";
+  if (raw === "required") return "required";
+  if (raw === "advisory") return "advisory";
+  return "tofu";
+}
 function normalizeConfigPath(raw, projectRoot) {
   if (raw.startsWith("file:")) return fileURLToPath(raw);
   return isAbsolute(raw) ? raw : resolve(projectRoot, raw);
@@ -50,15 +56,36 @@ async function loadExternalPlugins(ctx, hooks) {
   const { config, log } = ctx;
   if (config.features?.plugins === false) return [];
   const importModule = ctx.importModule ?? ((url) => import(url));
-  const trustEnabled = config.features?.pluginsTrust !== false && (ctx.globalRoot !== void 0 || ctx.trustStorePath !== void 0);
+  const trustMode = resolveExternalPluginTrustMode(config.features?.pluginsTrust);
+  if (trustMode === "required" && ctx.globalRoot === void 0 && ctx.trustStorePath === void 0) {
+    log.error(
+      '[plugins] features.pluginsTrust is "required" but no trust store location is available (no globalRoot) \u2014 refusing all external plugins. Configure a global root, or set features.pluginsTrust to "tofu"/"advisory".'
+    );
+    return [];
+  }
+  const trustEnabled = trustMode !== "off";
   const trustStorePath = ctx.trustStorePath ?? (ctx.globalRoot !== void 0 ? defaultPluginTrustPath(ctx.globalRoot) : void 0);
   let trustStore;
-  if (trustEnabled && trustStorePath !== void 0) {
+  let trustUsable = trustEnabled && trustStorePath !== void 0;
+  if (trustEnabled && !trustUsable) {
+    log.warn(
+      "[plugins] features.pluginsTrust is enabled but no trust store location is available (no globalRoot) \u2014 external plugins load WITHOUT integrity checks. Configure a global root to enable trust-on-first-use."
+    );
+  }
+  if (trustUsable && trustStorePath !== void 0) {
     try {
       trustStore = await readPluginTrustStore(trustStorePath);
     } catch (err) {
-      log.error(`[plugins] ${err instanceof Error ? err.message : String(err)}`);
-      return [];
+      const message = err instanceof Error ? err.message : String(err);
+      if (trustMode === "advisory") {
+        log.warn(
+          `[plugins] trust store unreadable (${message}) \u2014 features.pluginsTrust is 'advisory', loading external plugins WITHOUT integrity checks`
+        );
+        trustUsable = false;
+      } else {
+        log.error(`[plugins] ${message}`);
+        return [];
+      }
     }
   }
   const sources = [];
@@ -141,18 +168,25 @@ async function loadExternalPlugins(ctx, hooks) {
   const seenNames = /* @__PURE__ */ new Set();
   for (const source of sources) {
     const entryPath = source.kind === "spec" ? resolveSpecifierEntry(source.spec) : source.entryPath;
-    if (trustEnabled && trustStorePath !== void 0 && entryPath !== void 0) {
+    if (trustUsable && trustStorePath !== void 0 && entryPath !== void 0) {
       const gate = await gateExternalPluginTrust({
         entryPath,
         spec: source.spec,
         label: source.label,
         store: trustStore,
         storePath: trustStorePath,
+        mode: trustMode,
         log
       });
       if (!gate.ok) continue;
       if (gate.pinned) trustStore = gate.store;
-    } else if (trustEnabled && trustStorePath !== void 0 && entryPath === void 0) {
+    } else if (trustUsable && entryPath === void 0) {
+      if (trustMode === "required") {
+        log.error(
+          `[plugins] REFUSING external plugin "${source.label}" \u2014 features.pluginsTrust is 'required' and its entry file could not be resolved pre-import (spec "${source.spec}"). Install it so its entry file resolves, or load it by explicit path.`
+        );
+        continue;
+      }
       log.warn(
         `[plugins] trust check skipped for "${source.label}" \u2014 entry file could not be resolved pre-import`
       );
@@ -189,16 +223,21 @@ async function loadExternalPlugins(ctx, hooks) {
   return loaded;
 }
 async function gateExternalPluginTrust(args) {
-  const { spec, label, store, storePath, log } = args;
+  const { spec, label, store, storePath, mode, log } = args;
   const entryPath = normalizeTrustKey(args.entryPath);
   if (!store) return { ok: true, pinned: false };
   let integrity;
   try {
     integrity = await hashFileContents(entryPath);
   } catch (err) {
-    log.warn(
-      `[plugins] trust check skipped for "${label}" \u2014 entry could not be read (${err instanceof Error ? err.message : String(err)})`
-    );
+    const message = err instanceof Error ? err.message : String(err);
+    if (mode === "required") {
+      log.error(
+        `[plugins] REFUSING external plugin "${label}" \u2014 features.pluginsTrust is 'required' and its entry file could not be read (${message})`
+      );
+      return { ok: false, pinned: false };
+    }
+    log.warn(`[plugins] trust check skipped for "${label}" \u2014 entry could not be read (${message})`);
     return { ok: true, pinned: false };
   }
   const verification = verifyPluginTrust(entryPath, integrity, store);
@@ -211,15 +250,25 @@ async function gateExternalPluginTrust(args) {
       );
       return { ok: true, pinned: true, store: next };
     } catch (err) {
-      log.warn(
-        `[plugins] could not persist trust pin for "${label}" (${err instanceof Error ? err.message : String(err)})`
-      );
+      const message = err instanceof Error ? err.message : String(err);
+      if (mode === "required") {
+        log.error(
+          `[plugins] REFUSING external plugin "${label}" \u2014 features.pluginsTrust is 'required' and its first-use pin could not be persisted (${message})`
+        );
+        return { ok: false, pinned: false };
+      }
+      log.warn(`[plugins] could not persist trust pin for "${label}" (${message})`);
       return { ok: true, pinned: false };
     }
   }
-  log.error(
-    `[plugins] REFUSING external plugin "${label}" \u2014 its entry file changed since it was first trusted (pinned ${verification.pinnedAt}). If you expected this update, re-pin it: wstack plugin trust ${label}`
-  );
+  const changedMessage = `its entry file changed since it was first trusted (pinned ${verification.pinnedAt}). If you expected this update, re-pin it: wstack plugin trust ${label}`;
+  if (mode === "advisory") {
+    log.warn(
+      `[plugins] external plugin "${label}" \u2014 ${changedMessage} features.pluginsTrust is 'advisory', loading anyway WITHOUT integrity enforcement`
+    );
+    return { ok: true, pinned: false };
+  }
+  log.error(`[plugins] REFUSING external plugin "${label}" \u2014 ${changedMessage}`);
   return { ok: false, pinned: false };
 }
 
@@ -986,4 +1035,4 @@ export {
   PLUGIN_AUDIT_ENTRIES,
   runPluginManagementCommand
 };
-//# sourceMappingURL=chunk-635WW3II.js.map
+//# sourceMappingURL=chunk-TEBMCYZN.js.map

package/dist/{chunk-E4I2TF5S.js → chunk-TNK6237M.js}

@@ -3,7 +3,7 @@ import {
   normalizeKeys,
   nowIso,
   writeKeysBack
-} from "./chunk-XPX432BZ.js";
+} from "./chunk-DR2OXU46.js";
 
 // src/auth-menu/openai-codex-oauth.ts
 import { color } from "@wrongstack/core/utils";
@@ -259,4 +259,4 @@ export {
   filterCurrentCodexModelIds,
   isCodexCatalogModel
 };
-//# sourceMappingURL=chunk-E4I2TF5S.js.map
+//# sourceMappingURL=chunk-TNK6237M.js.map

package/dist/chunk-UQUYBDMG.js

@@ -0,0 +1,51 @@
+
+// src/settings-behavior-sections.ts
+var BEHAVIOR_SECTION_KEYS = [
+  "context",
+  "tools",
+  "log",
+  "features",
+  "session",
+  "indexing",
+  "circuitBreaker",
+  "modelRuntime",
+  "Sage",
+  "skills",
+  "systemPrompt",
+  "autonomy",
+  "maxConcurrent",
+  "yolo",
+  "nextPrediction",
+  "hints",
+  "debugStream"
+];
+function extractBehaviorSettings(config) {
+  const out = {};
+  for (const key of BEHAVIOR_SECTION_KEYS) {
+    const value = config[key];
+    if (value !== void 0) out[key] = structuredClone(value);
+  }
+  return out;
+}
+function mergeBehaviorSettings(target, settings) {
+  const applied = [];
+  for (const key of BEHAVIOR_SECTION_KEYS) {
+    const value = settings[key];
+    if (value === void 0) continue;
+    if (value !== null && typeof value === "object") {
+      const current = target[key] ?? {};
+      target[key] = { ...current, ...value };
+    } else {
+      target[key] = value;
+    }
+    applied.push(key);
+  }
+  return applied;
+}
+
+export {
+  BEHAVIOR_SECTION_KEYS,
+  extractBehaviorSettings,
+  mergeBehaviorSettings
+};
+//# sourceMappingURL=chunk-UQUYBDMG.js.map

package/dist/{chunk-F5GA2QW2.js → chunk-ZSZ3EYWH.js}

@@ -2,7 +2,7 @@ import {
   fallbackCodexProviderModels,
   filterCurrentCodexModelIds,
   isCodexCatalogModel
-} from "./chunk-E4I2TF5S.js";
+} from "./chunk-TNK6237M.js";
 
 // src/acp-registry-cache.ts
 import * as fs from "node:fs/promises";
@@ -307,4 +307,4 @@ export {
   setupProvider,
   createGracefulShutdown
 };
-//# sourceMappingURL=chunk-F5GA2QW2.js.map
+//# sourceMappingURL=chunk-ZSZ3EYWH.js.map