@wrongstack/cli 1.0.24 → 1.0.26

package/dist/{chunk-U46QR4WR.js → chunk-TI7KLHYX.js}

@@ -2,6 +2,115 @@ import {
   theme
 } from "./chunk-QD544J2B.js";
 
+// src/boot/tool-restriction-flags.ts
+function parseToolList(flag, value) {
+  if (value === void 0) return void 0;
+  if (value === true || typeof value === "string" && !value.trim()) {
+    throw new Error(`--${flag} needs a comma-separated list of tool names`);
+  }
+  const names = String(value).split(/[\s,]+/).map((name) => name.trim()).filter(Boolean);
+  const scoped = names.find((name) => name.includes("("));
+  if (scoped) {
+    throw new Error(
+      `--${flag}: scoped rules like "${scoped}" are not supported; list whole tool names (exec policy lives in config tools.exec)`
+    );
+  }
+  return names;
+}
+function resolveLaunchAllowedTools(flags) {
+  return parseToolList("allowed-tools", flags["allowed-tools"]);
+}
+function resolveToolRestriction(flags) {
+  const only = parseToolList("only-tools", flags["only-tools"]);
+  const deny = parseToolList("disallowed-tools", flags["disallowed-tools"]);
+  if (only === void 0 && deny === void 0) return void 0;
+  return { ...only ? { only } : {}, deny: deny ?? [] };
+}
+function unknownRestrictedToolNames(restriction, isRegistered) {
+  return [...restriction.only ?? [], ...restriction.deny].filter(
+    (name) => !name.endsWith("*") && !name.includes("__") && !isRegistered(name)
+  );
+}
+
+// src/boot/restricted-mode.ts
+import { lockToProjectRoot, lockYoloOff, ToolCapabilities } from "@wrongstack/core/security";
+var RESTRICTED_ENV = "WRONGSTACK_RESTRICTED";
+var RESTRICTED_DENY_CAPABILITIES = [
+  ToolCapabilities.SHELL_ARBITRARY,
+  ToolCapabilities.SHELL_RESTRICTED,
+  ToolCapabilities.SHELL_EXEC,
+  ToolCapabilities.NET_OUTBOUND,
+  ToolCapabilities.PACKAGE_INSTALL,
+  ToolCapabilities.CONFIG_MUTATE,
+  ToolCapabilities.FS_WRITE_OUTSIDE_PROJECT,
+  ToolCapabilities.TOOL_MUTATE_ANY,
+  ToolCapabilities.MCP_PROXY
+];
+var CONFLICTING_FLAGS = [
+  "yolo",
+  "yolo-destructive",
+  "full-auto",
+  "mcp-config",
+  // Pre-approving a tool would let writes skip the prompt this mode promises.
+  "allowed-tools"
+];
+function isRestrictedMode(flags) {
+  return flags["restricted"] === true || process.env[RESTRICTED_ENV] === "1";
+}
+function validateRestrictedMode(flags) {
+  if (!isRestrictedMode(flags)) return false;
+  const conflict = CONFLICTING_FLAGS.find(
+    (name) => flags[name] !== void 0 && flags[name] !== false
+  );
+  if (conflict) throw new Error(`--${conflict} cannot be combined with --restricted`);
+  return true;
+}
+function withRestrictedTools(restriction, restricted) {
+  if (!restricted) return restriction;
+  return {
+    ...restriction?.only ? { only: restriction.only } : {},
+    deny: [...restriction?.deny ?? [], "mcp__*"],
+    denyCapabilities: RESTRICTED_DENY_CAPABILITIES,
+    requireDeclaredCapabilities: true
+  };
+}
+var RESTRICTED_NOTICE = "Restricted mode: no shell, network, installs or MCP tools; files stay inside the project; YOLO is off.";
+var announced = false;
+function activateRestrictedMode(flags, write) {
+  if (!validateRestrictedMode(flags)) return false;
+  lockToProjectRoot();
+  lockYoloOff();
+  process.env[RESTRICTED_ENV] = "1";
+  if (!announced) {
+    announced = true;
+    write(`${RESTRICTED_NOTICE}
+`);
+  }
+  return true;
+}
+
+// src/boot/safe-mode.ts
+var SAFE_MODE_ENV = "WRONGSTACK_SAFE_MODE";
+function isSafeMode(flags) {
+  return flags["safe-mode"] === true || process.env[SAFE_MODE_ENV] === "1";
+}
+function propagateSafeMode(flags) {
+  const on = isSafeMode(flags);
+  if (on) process.env[SAFE_MODE_ENV] = "1";
+  return on;
+}
+var SAFE_MODE_NOTICE = "Safe mode: third-party plugins, hooks, configured MCP servers, skills and instruction overrides are off.";
+var announced2 = false;
+function announceSafeMode(flags, write) {
+  const on = propagateSafeMode(flags);
+  if (on && !announced2) {
+    announced2 = true;
+    write(`${SAFE_MODE_NOTICE}
+`);
+  }
+  return on;
+}
+
 // src/diff-renderer.ts
 import { color, sanitizeTerminalText } from "@wrongstack/core/utils";
 function diffLineStyle(line) {
@@ -25,6 +134,15 @@ import {
   unifiedDiff,
   writeOut
 } from "@wrongstack/core/utils";
+function makeHeadlessPromptDelegate(write = (text) => process.stderr.write(text)) {
+  return async (tool) => {
+    write(
+      `${theme.warn("\u26A0")} ${tool.name} needs approval but no terminal is attached to ask \u2014 denied. Grant it up front with --allowed-tools ${tool.name} or --yolo.
+`
+    );
+    return "no";
+  };
+}
 function makePromptDelegate(reader) {
   return async (tool, input, suggestedPattern, signal) => {
     if (signal?.aborted) return "no";
@@ -57,8 +175,11 @@ ${theme.warn("\u26A0 APPROVAL REQUIRED")} ${theme.primary("\u2502")} ${theme.bol
     return answer;
   };
 }
+function makeStdinPromptDelegate(reader, stdinIsTTY = process.stdin.isTTY === true) {
+  return stdinIsTTY ? makePromptDelegate(reader) : makeHeadlessPromptDelegate();
+}
 function makeConfirmAwaiter(reader) {
-  const delegate = makePromptDelegate(reader);
+  const delegate = makeStdinPromptDelegate(reader);
   return async (tool, input, _toolUseId, suggestedPattern) => {
     const result = await delegate(tool, input, suggestedPattern);
     return result;
@@ -470,12 +591,20 @@ on disconnect with exponential backoff, up to 3 attempts"._
 
 export {
   renderDiff,
-  makePromptDelegate,
+  makeStdinPromptDelegate,
   makeConfirmAwaiter,
+  resolveLaunchAllowedTools,
+  resolveToolRestriction,
+  unknownRestrictedToolNames,
+  isRestrictedMode,
+  withRestrictedTools,
+  activateRestrictedMode,
+  isSafeMode,
+  announceSafeMode,
   isSimpleUiFullAuto,
   applySimpleUiFullAutoProfile,
   configureSimpleUiRuntimeContext,
   detectProjectFacts,
   renderAgentsTemplate
 };
-//# sourceMappingURL=chunk-U46QR4WR.js.map
+//# sourceMappingURL=chunk-TI7KLHYX.js.map

package/dist/{chunk-PGKJ2OQP.js → chunk-WQV2NP57.js}

@@ -1,10 +1,10 @@
 import {
   helpCmd,
   versionCmd
-} from "./chunk-2BKFWIER.js";
+} from "./chunk-5JYDKG5B.js";
 import {
   parseArgs
-} from "./chunk-MHEBWVXL.js";
+} from "./chunk-Q4INH2DG.js";
 
 // src/boot/short-circuit-flags.ts
 async function handleHelpVersionShortCircuit(argv) {
@@ -22,11 +22,11 @@ async function handleHelpVersionShortCircuit(argv) {
   }
   if (earlyFlags["help"] === true) {
     if (positional.length > 0) {
-      const { subcommandNames } = await import("./subcommands-ZTSIN7LG.js");
+      const { subcommandNames } = await import("./subcommands-Q6ORSB2E.js");
       if (subcommandNames.includes(positional[0])) {
         const first = positional[0];
         const deep = positional[1];
-        const { renderDeepHelp, renderFocusedHelp } = await import("./per-subcommand-help-XE77MTGJ.js");
+        const { renderDeepHelp, renderFocusedHelp } = await import("./per-subcommand-help-QDAQASPZ.js");
         if (deep && renderDeepHelp(`${first}:${deep}`, stubRenderer)) {
           return 0;
         }
@@ -43,4 +43,4 @@ async function handleHelpVersionShortCircuit(argv) {
 export {
   handleHelpVersionShortCircuit
 };
-//# sourceMappingURL=chunk-PGKJ2OQP.js.map
+//# sourceMappingURL=chunk-WQV2NP57.js.map

package/dist/chunk-X756ZS72.js

@@ -0,0 +1,329 @@
+import {
+  STANDALONE_TARGET
+} from "./chunk-F5DCFAKI.js";
+
+// src/standalone-update.ts
+import { createHash as createHash2, randomBytes } from "node:crypto";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { FetchError } from "@wrongstack/core/types";
+
+// src/release-asset-download.ts
+import { createHash } from "node:crypto";
+import * as fsp from "node:fs/promises";
+async function downloadReleaseAsset(url, timeoutMs, maxBytes) {
+  const res = await fetch(url, {
+    signal: AbortSignal.timeout(timeoutMs),
+    headers: { "User-Agent": "wrongstack-cli" },
+    redirect: "follow"
+  });
+  if (!res.ok) throw new Error(`download ${url} responded ${res.status}`);
+  const declared = Number(res.headers.get("content-length") ?? "0");
+  if (declared > maxBytes) throw new Error(`download ${url} is too large`);
+  if (!res.body) return Buffer.alloc(0);
+  const chunks = [];
+  let received = 0;
+  const reader = res.body.getReader();
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      received += value.byteLength;
+      if (received > maxBytes) {
+        await reader.cancel();
+        throw new Error(`download ${url} is too large`);
+      }
+      chunks.push(Buffer.from(value.buffer, value.byteOffset, value.byteLength));
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  return Buffer.concat(chunks, received);
+}
+async function downloadReleaseAssetToFile(url, file, options) {
+  const timeout = AbortSignal.timeout(options.timeoutMs);
+  const res = await fetch(url, {
+    signal: options.signal ? AbortSignal.any([options.signal, timeout]) : timeout,
+    headers: { "User-Agent": "wrongstack-cli" },
+    redirect: "follow"
+  });
+  if (!res.ok) throw new Error(`download ${url} responded ${res.status}`);
+  const declared = Number(res.headers.get("content-length") ?? "0");
+  if (declared > options.maxBytes) throw new Error(`download ${url} is too large`);
+  const hash = createHash("sha256");
+  const out = await fsp.open(file, "wx", 384);
+  let received = 0;
+  try {
+    if (res.body) {
+      const reader = res.body.getReader();
+      try {
+        while (true) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          received += value.byteLength;
+          if (received > options.maxBytes) {
+            await reader.cancel();
+            throw new Error(`download ${url} is too large`);
+          }
+          hash.update(value);
+          await out.write(value);
+        }
+      } finally {
+        reader.releaseLock();
+      }
+    }
+    await out.sync();
+  } catch (err) {
+    await out.close().catch(() => void 0);
+    await fsp.rm(file, { force: true });
+    throw err;
+  }
+  await out.close();
+  return hash.digest("hex");
+}
+
+// src/release-attestation.ts
+var RELEASES_REPO = "WrongStack/WrongStack";
+var RELEASES_REPO_ID = 1237163046;
+var REPO_URL = `https://github.com/${RELEASES_REPO}`;
+var IN_TOTO_PAYLOAD = "application/vnd.in-toto+json";
+var IN_TOTO_STATEMENT = "https://in-toto.io/Statement/v1";
+var SLSA_PROVENANCE = "https://slsa.dev/provenance/v1";
+var obj = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+function statementOf(attestation) {
+  const envelope = obj(obj(attestation["bundle"])?.["dsseEnvelope"]);
+  if (envelope?.["payloadType"] !== IN_TOTO_PAYLOAD) return void 0;
+  const payload = envelope["payload"];
+  if (typeof payload !== "string") return void 0;
+  try {
+    return obj(JSON.parse(Buffer.from(payload, "base64").toString("utf8")));
+  } catch {
+    return void 0;
+  }
+}
+function vouches(attestation, subject) {
+  if (attestation["repository_id"] !== RELEASES_REPO_ID) return false;
+  const statement = statementOf(attestation);
+  if (statement?.["_type"] !== IN_TOTO_STATEMENT) return false;
+  if (statement["predicateType"] !== SLSA_PROVENANCE) return false;
+  const subjects = Array.isArray(statement["subject"]) ? statement["subject"] : [];
+  const named = subjects.some((entry) => {
+    const s = obj(entry);
+    return s?.["name"] === subject.assetName && obj(s["digest"])?.["sha256"] === subject.sha256;
+  });
+  if (!named) return false;
+  const tag = `refs/tags/v${subject.version}`;
+  const predicate = obj(statement["predicate"]);
+  const build = obj(predicate?.["buildDefinition"]);
+  const workflow = obj(obj(build?.["externalParameters"])?.["workflow"]);
+  const github = obj(obj(build?.["internalParameters"])?.["github"]);
+  const builder = obj(obj(predicate?.["runDetails"])?.["builder"]);
+  return workflow?.["repository"] === REPO_URL && workflow["path"] === ".github/workflows/release.yml" && workflow["ref"] === tag && builder?.["id"] === `${REPO_URL}/.github/workflows/binaries.yml@${tag}` && github?.["event_name"] === "push" && github["runner_environment"] === "github-hosted";
+}
+function attestationsVouchFor(response, subject) {
+  const list = obj(response)?.["attestations"];
+  if (!Array.isArray(list)) return false;
+  return list.some((entry) => {
+    const attestation = obj(entry);
+    return attestation !== void 0 && vouches(attestation, subject);
+  });
+}
+async function verifyReleaseAttestation(subject, signal) {
+  const url = `https://api.github.com/repos/${RELEASES_REPO}/attestations/sha256:${subject.sha256}`;
+  const timeout = AbortSignal.timeout(3e4);
+  const res = await fetch(url, {
+    signal: signal ? AbortSignal.any([signal, timeout]) : timeout,
+    headers: { Accept: "application/vnd.github+json", "User-Agent": "wrongstack-cli" }
+  });
+  if (res.status === 404) {
+    throw new Error(`no build attestation exists for ${subject.assetName}`);
+  }
+  if (!res.ok) {
+    const limited = res.status === 403 || res.status === 429;
+    throw new Error(
+      limited ? "GitHub API rate limit reached while checking the build attestation; try again later" : `GitHub attestations API responded ${res.status}`
+    );
+  }
+  if (!attestationsVouchFor(await res.json(), subject)) {
+    throw new Error(
+      `${subject.assetName} has no attestation from the v${subject.version} release workflow`
+    );
+  }
+}
+
+// src/standalone-update.ts
+var API_LATEST = `https://api.github.com/repos/${RELEASES_REPO}/releases/latest`;
+var MAX_BINARY_BYTES = 512 * 1024 * 1024;
+var MAX_CHECKSUM_BYTES = 1024 * 1024;
+function standaloneAssetName(target) {
+  const name = `wstack-${target.replace(/^bun-/, "")}`;
+  return target.startsWith("bun-windows") ? `${name}.exe` : name;
+}
+async function fetchLatestRelease(timeoutMs, signal) {
+  const timeoutSignal = AbortSignal.timeout(timeoutMs);
+  const res = await fetch(API_LATEST, {
+    signal: signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal,
+    headers: { Accept: "application/vnd.github+json", "User-Agent": "wrongstack-cli" }
+  });
+  if (!res.ok) {
+    throw new FetchError({
+      message: `GitHub releases responded ${res.status}`,
+      status: res.status,
+      context: { op: "checkForUpdate", registry: "github-releases", url: API_LATEST }
+    });
+  }
+  const data = await res.json();
+  if (typeof data.tag_name !== "string") throw new Error("Latest release has no tag");
+  const assets = Array.isArray(data.assets) ? data.assets.filter(
+    (a) => typeof a?.name === "string" && typeof a?.browser_download_url === "string" && (a.digest === void 0 || a.digest === null || typeof a.digest === "string")
+  ) : [];
+  return { version: data.tag_name.replace(/^v/, ""), assets };
+}
+async function findStandaloneRelease(target, signal) {
+  const release = await fetchLatestRelease(15e3, signal);
+  const assetName = standaloneAssetName(target);
+  const asset = release.assets.find((a) => a.name === assetName);
+  const sums = release.assets.find((a) => a.name === "SHA256SUMS");
+  if (!asset || !sums) throw new Error(`release v${release.version} has no ${assetName} build`);
+  return { version: release.version, assetName, asset, sums };
+}
+async function verifyStandaloneDigest(release, sha256, signal) {
+  const sumsText = (await downloadReleaseAsset(release.sums.browser_download_url, 3e4, MAX_CHECKSUM_BYTES)).toString("utf8");
+  if (parseSha256Sums(sumsText).get(release.assetName) !== sha256) {
+    throw new Error("checksum does not match the release SHA256SUMS");
+  }
+  const digest = release.asset.digest;
+  if (typeof digest === "string" && digest !== `sha256:${sha256}`) {
+    throw new Error("checksum does not match the digest GitHub recorded for the asset");
+  }
+  await verifyReleaseAttestation(
+    { assetName: release.assetName, sha256, version: release.version },
+    signal
+  );
+}
+async function fetchLatestStandaloneVersion(timeoutMs = 3e3, signal) {
+  return (await fetchLatestRelease(timeoutMs, signal)).version;
+}
+function parseSha256Sums(text) {
+  const sums = /* @__PURE__ */ new Map();
+  for (const line of text.split(/\r?\n/)) {
+    const match = line.trim().match(/^([0-9a-f]{64})\s+\*?(.+)$/i);
+    if (match?.[1] && match[2]) {
+      const name = match[2].trim();
+      if (sums.has(name)) throw new Error(`Duplicate SHA256SUMS entry: ${name}`);
+      sums.set(name, match[1].toLowerCase());
+    }
+  }
+  return sums;
+}
+function replaceExecutable(target, bytes, platform = process.platform) {
+  const staged = stagingPath(target);
+  fs.writeFileSync(staged, bytes, { mode: 493, flag: "wx" });
+  swapIntoPlace(target, staged, platform);
+}
+function installExecutableFrom(target, source, sha256, platform = process.platform) {
+  const staged = stagingPath(target);
+  fs.copyFileSync(source, staged, fs.constants.COPYFILE_EXCL);
+  try {
+    if (sha256File(staged) !== sha256) throw new Error("staged update does not match its digest");
+    fs.chmodSync(staged, 493);
+  } catch (error) {
+    fs.rmSync(staged, { force: true });
+    throw error;
+  }
+  swapIntoPlace(target, staged, platform);
+}
+function stagingPath(target) {
+  return `${target}.new-${randomBytes(9).toString("hex")}`;
+}
+function sha256File(file) {
+  const hash = createHash2("sha256");
+  const fd = fs.openSync(file, "r");
+  try {
+    const chunk = Buffer.allocUnsafe(1024 * 1024);
+    let read = fs.readSync(fd, chunk);
+    while (read > 0) {
+      hash.update(chunk.subarray(0, read));
+      read = fs.readSync(fd, chunk);
+    }
+  } finally {
+    fs.closeSync(fd);
+  }
+  return hash.digest("hex");
+}
+function swapIntoPlace(target, staged, platform) {
+  try {
+    if (platform === "win32") {
+      const aside = `${target}.old`;
+      fs.rmSync(aside, { force: true });
+      fs.renameSync(target, aside);
+      try {
+        fs.renameSync(staged, target);
+      } catch (error) {
+        fs.renameSync(aside, target);
+        throw error;
+      }
+    } else {
+      fs.renameSync(staged, target);
+    }
+  } finally {
+    fs.rmSync(staged, { force: true });
+  }
+}
+async function updateStandaloneBinary(options) {
+  const { renderer } = options;
+  if (!STANDALONE_TARGET) {
+    renderer.write("Update failed: this executable does not record its build target.\n");
+    return 1;
+  }
+  try {
+    const release = await findStandaloneRelease(STANDALONE_TARGET);
+    renderer.write(`Updating wrongstack from v${options.current} to v${release.version}...
+`);
+    const executable = fs.realpathSync(process.execPath);
+    const staged = options.staged;
+    if (staged && staged.version === release.version) {
+      renderer.write(`Installing the v${staged.version} build already downloaded
+`);
+      installExecutableFrom(executable, staged.file, staged.sha256);
+    } else {
+      renderer.write(`Downloading ${release.assetName}
+`);
+      const bytes = await downloadReleaseAsset(
+        release.asset.browser_download_url,
+        6e5,
+        MAX_BINARY_BYTES
+      );
+      renderer.write("Verifying the checksum and the build attestation\n");
+      await verifyStandaloneDigest(release, createHash2("sha256").update(bytes).digest("hex"));
+      replaceExecutable(executable, bytes);
+    }
+    renderer.write(
+      `
+Updated ${path.basename(executable)} to v${release.version}. Restart wrongstack to use it.
+`
+    );
+    return 0;
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    const permission = /EACCES|EPERM/.test(msg) ? "\nThe executable is not writable by this user; rerun with the permissions it was installed with." : "";
+    renderer.write(`
+Update failed: ${msg}${permission}
+`);
+    return 1;
+  }
+}
+
+export {
+  downloadReleaseAssetToFile,
+  MAX_BINARY_BYTES,
+  standaloneAssetName,
+  findStandaloneRelease,
+  verifyStandaloneDigest,
+  fetchLatestStandaloneVersion,
+  parseSha256Sums,
+  replaceExecutable,
+  installExecutableFrom,
+  updateStandaloneBinary
+};
+//# sourceMappingURL=chunk-X756ZS72.js.map

package/dist/{chunk-JF2MULWF.js → chunk-YHYINL47.js}

@@ -9,7 +9,10 @@ import {
 // src/wiring/plugins.ts
 import { join } from "node:path";
 import { loadPlugins, resolvePluginConfig, resolvePluginEnablement } from "@wrongstack/core/plugin";
-import { OFFICIAL_PLUGIN_FACTORIES } from "@wrongstack/plugins/factories";
+import {
+  OFFICIAL_PLUGIN_FACTORIES,
+  OFFICIAL_PLUGIN_SPECIFIERS
+} from "@wrongstack/plugins/factories";
 
 // src/plugin-api-factory.ts
 import { DefaultPluginAPI } from "@wrongstack/core/plugin";
@@ -109,6 +112,28 @@ var BUILTIN_PLUGIN_FACTORIES = [
   // ── Telegram plugin ─────────────────────────────────────────────────
   async () => (await import("@wrongstack/telegram")).default
 ];
+var BUILTIN_PLUGIN_NAME_HINTS = [
+  "wstack-prompts",
+  "wstack-sync",
+  "wstack-cloud-config-sync",
+  "wstack-chimera",
+  "wstack-auto-review",
+  "wstack-specialist-triggers",
+  "wstack-skills",
+  ...OFFICIAL_PLUGIN_SPECIFIERS.map((specifier) => specifier.slice("@wrongstack/plugins/".length)),
+  "@wrongstack/plug-lsp",
+  "telegram"
+];
+function builtinEnablement(name, config, aliases) {
+  const auditEntry = PLUGIN_AUDIT_ENTRIES.find((entry) => entry.name === name);
+  return resolvePluginEnablement({
+    name,
+    aliases,
+    defaultState: auditEntry?.defaultState ?? "active",
+    config,
+    matches: (spec) => (builtinPluginNameFromSpec(spec) ?? spec) === name
+  });
+}
 async function setupPlugins(params) {
   const {
     config,
@@ -133,24 +158,30 @@ async function setupPlugins(params) {
     vault,
     pipelines,
     paths,
-    hookRegistry
+    hookRegistry,
+    safeMode
   } = params;
   const builtinPlugins = [];
   if (paths && config.features?.plugins !== false) {
-    for (const factory of BUILTIN_PLUGIN_FACTORIES) {
+    for (const [index, factory] of BUILTIN_PLUGIN_FACTORIES.entries()) {
+      const nameHint = BUILTIN_PLUGIN_NAME_HINTS[index];
+      if (nameHint && BUILTIN_PLUGIN_NAME_HINTS.length === BUILTIN_PLUGIN_FACTORIES.length) {
+        const { enabled, source } = builtinEnablement(
+          nameHint,
+          config,
+          nameHint === "telegram" ? ["@wrongstack/telegram"] : void 0
+        );
+        if (!enabled) {
+          if (source !== "default") {
+            log.info(`[setupPlugins] built-in plugin "${nameHint}" disabled by ${source}`);
+          }
+          continue;
+        }
+      }
       try {
         const plugin = await factory();
         if (!plugin) continue;
-        const auditEntry = PLUGIN_AUDIT_ENTRIES.find((entry) => entry.name === plugin.name);
-        const { enabled, source } = resolvePluginEnablement({
-          name: plugin.name,
-          aliases: plugin.configAliases,
-          // Built-ins outside the audit catalog (prompts, sync, skills, …)
-          // are infrastructure — they run unless explicitly turned off.
-          defaultState: auditEntry?.defaultState ?? "active",
-          config,
-          matches: (spec) => (builtinPluginNameFromSpec(spec) ?? spec) === plugin.name
-        });
+        const { enabled, source } = builtinEnablement(plugin.name, config, plugin.configAliases);
         if (!enabled) {
           if (source !== "default") {
             log.info(`[setupPlugins] built-in plugin "${plugin.name}" disabled by ${source}`);
@@ -164,7 +195,7 @@ async function setupPlugins(params) {
       }
     }
   }
-  const userPlugins = config.features?.plugins === false ? [] : await loadExternalPlugins(
+  const userPlugins = config.features?.plugins === false || safeMode === true ? [] : await loadExternalPlugins(
     {
       config,
       log,
@@ -272,6 +303,7 @@ export {
   pluginNameFromSpec,
   builtinPluginNameFromSpec,
   BUILTIN_PLUGIN_FACTORIES,
+  BUILTIN_PLUGIN_NAME_HINTS,
   setupPlugins
 };
-//# sourceMappingURL=chunk-JF2MULWF.js.map
+//# sourceMappingURL=chunk-YHYINL47.js.map