@wrongstack/cli 1.0.32 → 1.0.35

package/dist/{auth-SUHKFFO4.js → auth-M6LXZTDA.js}

@@ -20,12 +20,12 @@ import {
   runOAuthLoginKind,
   runOAuthLoginMenu,
   validateFamily
-} from "./chunk-P3GRLV47.js";
+} from "./chunk-GZSKLXYG.js";
 import {
   renderAuthLocalHelpToString,
   wantsLocalHelp
 } from "./chunk-YTEOAWOJ.js";
-import "./chunk-5UZBUV2H.js";
+import "./chunk-RKU66D2O.js";
 import {
   loadConfigProviders,
   maskedKey,
@@ -44,7 +44,7 @@ import {
 import "./chunk-DAKVBMD4.js";
 import {
   parseAuthFlags
-} from "./chunk-MPQCHBDJ.js";
+} from "./chunk-CJSHS2K7.js";
 
 // src/subcommands/handlers/auth.ts
 import { color as color6 } from "@wrongstack/core/utils";
@@ -748,4 +748,4 @@ async function runAuthRemove(deps, providerId) {
 export {
   authCmd
 };
-//# sourceMappingURL=auth-SUHKFFO4.js.map
+//# sourceMappingURL=auth-M6LXZTDA.js.map

package/dist/auth-menu/openai-codex-oauth.d.ts

@@ -31,7 +31,7 @@
 import { buildCodexAuthorizeUrl, exchangeCodexAuthorizationCode, refreshCodexTokens } from '@wrongstack/providers/oauth';
 import { type LoopbackServer } from './loopback-server.js';
 import type { AuthMenuDeps } from './types.js';
-export { CODEX_BASE_URL, CODEX_CATALOG_FAMILIES, CODEX_PROVIDER_ID, type CodexTokens, extractAccountId, FALLBACK_CODEX_MODELS, fallbackCodexModelIds, fallbackCodexProviderModels, fetchCodexModels, filterCurrentCodexModelIds, generatePkce, isCodexCatalogModel, type Pkce, parseAuthorizationInput, resolveCodexModels, } from '@wrongstack/providers/oauth';
+export { CODEX_BASE_URL, CODEX_CATALOG_FAMILIES, CODEX_PROVIDER_ID, type CodexTokens, extractAccountId, FALLBACK_CODEX_MODELS, fallbackCodexModelIds, fallbackCodexProviderModels, fetchCodexModels, filterCurrentCodexModelIds, generatePkce, isCodexCatalogModel, parseAuthorizationInput, resolveCodexModels, } from '@wrongstack/providers/oauth';
 /** Build the Codex authorize URL. Alias kept for the historical local name. */
 export declare const buildAuthorizeUrl: typeof buildCodexAuthorizeUrl;
 /** Exchange an authorization code (+ PKCE verifier) for tokens. */

package/dist/auth-menu/panel-provider-edits.d.ts

@@ -0,0 +1,15 @@
+import type { AuthModelEdit, AuthProviderEdit, AuthProviderSetup } from '@wrongstack/tui';
+import type { AuthPanelServiceDeps } from './panel-flow-bridge.js';
+interface CreateProviderEditsInput {
+    deps: AuthPanelServiceDeps;
+    mutate: (mutator: (providers: Record<string, import('@wrongstack/core/types').ProviderConfig>, config: Record<string, unknown>) => string | null) => Promise<string | null>;
+    loadProviders: () => Promise<Record<string, import('@wrongstack/core/types').ProviderConfig>>;
+}
+export declare function createProviderEdits({ deps, mutate, loadProviders }: CreateProviderEditsInput): {
+    saveProviderSetup(setup: AuthProviderSetup): Promise<string | null>;
+    saveProviderEdit(edit: AuthProviderEdit): Promise<string | null>;
+    getModelEdit(providerId: string, modelId: string): Promise<AuthModelEdit | null>;
+    saveModelEdit(edit: AuthModelEdit): Promise<string | null>;
+};
+export {};
+//# sourceMappingURL=panel-provider-edits.d.ts.map

package/dist/auth-menu/panel-service.d.ts

@@ -1,6 +1,6 @@
+import type { AuthPanelHost } from '@wrongstack/tui';
 import type { AuthPanelServiceDeps } from './panel-flow-bridge.js';
 export type { AuthPanelServiceDeps } from './panel-flow-bridge.js';
 export { plainMaskedKey } from './panel-flow-bridge.js';
-import type { AuthPanelHost } from '@wrongstack/tui';
 export declare function createAuthPanelHost(deps: AuthPanelServiceDeps): AuthPanelHost;
 //# sourceMappingURL=panel-service.d.ts.map

package/dist/auto-discover-providers-JX346GOM.js

@@ -0,0 +1,7 @@
+import {
+  discoverAndMergeProviders
+} from "./chunk-PA4VBCXS.js";
+export {
+  discoverAndMergeProviders
+};
+//# sourceMappingURL=auto-discover-providers-JX346GOM.js.map

package/dist/boot/governance-evidence-candidate.d.ts

@@ -1,3 +1,2 @@
-export type { GovernanceEvidenceCandidate, GovernanceEvidenceCandidateMissingBinding, GovernanceEvidenceTraceSnapshot, GovernanceToolOutcomeMetadata, } from '@wrongstack/runtime/governance-bootstrap';
-export { createGovernanceEvidenceCandidate, GOVERNANCE_EVIDENCE_CANDIDATE_SCHEMA_VERSION, } from '@wrongstack/runtime/governance-bootstrap';
+export { createGovernanceEvidenceCandidate, } from '@wrongstack/runtime/governance-bootstrap';
 //# sourceMappingURL=governance-evidence-candidate.d.ts.map

package/dist/boot/system-prompt-builder.d.ts

@@ -35,7 +35,6 @@ interface PathJoiner {
  * is typed against.
  */
 import type { DomainGlossaryListProvider as DomainGlossaryAdapter } from '../wiring/domain-glossary.js';
-export type { DomainGlossaryListProvider } from '../wiring/domain-glossary.js';
 interface BindSystemPromptBuilderDeps {
     /**
      * The `container` from main(). The helper only calls
@@ -124,4 +123,5 @@ interface BindSystemPromptBuilderDeps {
  * matches the pre-refactor inline behavior exactly.
  */
 export declare function bindSystemPromptBuilder(deps: BindSystemPromptBuilderDeps): void;
+export {};
 //# sourceMappingURL=system-prompt-builder.d.ts.map

package/dist/boot/tui-project-spawn.d.ts

@@ -1,4 +1,3 @@
-export declare const PROJECT_SWITCH_EXIT_CODE = 42;
 export interface PendingProjectSwitch {
     root: string;
     name: string;

package/dist/boot/tui-session-resume-contracts.d.ts

@@ -0,0 +1,95 @@
+import type { Agent } from '@wrongstack/core/agent';
+import type { EventBus } from '@wrongstack/core/kernel';
+import type { ContextSnapshot, SessionLoadProgress, TokenCounter } from '@wrongstack/core/types';
+import type { TuiRuntimeState } from './tui-runtime-state.js';
+export interface SessionResumeContext {
+    state: TuiRuntimeState;
+    agent: Agent;
+    tokenCounter: TokenCounter;
+    switchProviderAndModel: ((providerId: string, modelId: string) => string | null | void | Promise<unknown>) | undefined;
+    /** App EventBus — forwarded to the re-pointed todos checkpoint for storage.* events. */
+    events?: EventBus | undefined;
+    /**
+     * Byte-level parse progress sink for large journals. When provided, the
+     * store's JSONL loader throttles it to ~4 updates/sec so the TUI picker
+     * hint can stream load progress instead of a static line.
+     */
+    onLoadProgress?: ((progress: SessionLoadProgress) => void) | undefined;
+    /**
+     * Why a resume returned `null`.
+     *
+     * `resumeSession` deliberately keeps returning `null` on failure — every
+     * rollback test pins that contract, and a throw escaping mid-rollback would
+     * be worse than a clean `null`. But `null` alone reaches the user as a bare
+     * "Failed to resume session <id>." with no reason, on every surface, which
+     * makes a broken resume undiagnosable. This sink carries the reason (and the
+     * STAGE it died at) out to the caller, which turns it into the message the
+     * user actually reads.
+     */
+    onFailure?: ((failure: SessionResumeFailure) => void) | undefined;
+    /**
+     * Live stage reporter.
+     *
+     * The same `stage` string the failure sink reports, but emitted as each step
+     * BEGINS rather than only when one fails. The TUI turns it into the rolling
+     * "what is happening right now" rows of the resume block — without it the
+     * only honest thing that surface could show during a multi-second journal
+     * parse was a spinner.
+     */
+    onStage?: ((stage: string) => void) | undefined;
+}
+/** The stage a failed resume died at, plus the underlying error text. */
+export interface SessionResumeFailure {
+    /** Machine-readable step name, e.g. `resolve_id`, `open_writer`, `hydrate`. */
+    stage: string;
+    /** Error text from the failing step — never empty. */
+    message: string;
+}
+export interface SessionResumeResult {
+    entries: unknown[];
+    nextId: number;
+    sessionId: string;
+    /**
+     * Whether the agent is now WRITING to this session.
+     *
+     * `false` means the transcript is on screen but ownership was never taken:
+     * the session stays read-only and the next prompt continues the session the
+     * user was already in. Showing the transcript anyway is deliberate — the
+     * expensive, safe half of a resume (read the journal, render the timeline)
+     * has no reason to be discarded because the risky half (claim the journal
+     * for writing) failed.
+     */
+    attached: boolean;
+    /**
+     * Non-fatal problems the user should see, e.g. a sidecar that could not be
+     * re-pointed or a provider that is no longer configured. These used to abort
+     * the whole resume and roll back a transcript that had already loaded.
+     */
+    warnings: string[];
+    /**
+     * Optional context-window snapshot for the resumed session. `tokens` is a
+     * flat `number` — the prompt size of the session's LAST request, read from
+     * its journal by `projectLastRequestTokens`. The TUI consumer
+     * (`packages/tui/src/reducers/composer.ts:561-577`) reads it as a flat
+     * number and gates on `snap.tokens > 0`, so a session that never reached the
+     * model reports 0 and simply leaves the chip alone.
+     */
+    contextSnapshot?: ContextSnapshot | undefined;
+    /**
+     * Text of the LAST assistant message in the resumed transcript.
+     *
+     * The caller parses `<nextsteps>` out of it. Deterministic by construction —
+     * the TUI's per-entry parser fires on whichever assistant entry happens to
+     * mount last during a replay, which is not necessarily the final turn, so a
+     * resume needs the authoritative one from the transcript itself.
+     */
+    lastAssistantText?: string | undefined;
+}
+/** Flatten a message's content to plain text (string form or text blocks). */
+export declare function messageText(content: unknown): string;
+/** Text of the final assistant turn, or undefined when the session has none. */
+export declare function lastAssistantTextOf(messages: readonly {
+    role: string;
+    content: unknown;
+}[]): string | undefined;
+//# sourceMappingURL=tui-session-resume-contracts.d.ts.map

package/dist/boot/tui-session-resume.d.ts

@@ -1,90 +1,5 @@
-import type { Agent } from '@wrongstack/core/agent';
-import { type EventBus } from '@wrongstack/core/kernel';
-import type { ContextSnapshot, SessionLoadProgress, TokenCounter } from '@wrongstack/core/types';
-import type { TuiRuntimeState } from './tui-runtime-state.js';
-interface SessionResumeContext {
-    state: TuiRuntimeState;
-    agent: Agent;
-    tokenCounter: TokenCounter;
-    switchProviderAndModel: ((providerId: string, modelId: string) => string | null | void | Promise<unknown>) | undefined;
-    /** App EventBus — forwarded to the re-pointed todos checkpoint for storage.* events. */
-    events?: EventBus | undefined;
-    /**
-     * Byte-level parse progress sink for large journals. When provided, the
-     * store's JSONL loader throttles it to ~4 updates/sec so the TUI picker
-     * hint can stream load progress instead of a static line.
-     */
-    onLoadProgress?: ((progress: SessionLoadProgress) => void) | undefined;
-    /**
-     * Why a resume returned `null`.
-     *
-     * `resumeSession` deliberately keeps returning `null` on failure — every
-     * rollback test pins that contract, and a throw escaping mid-rollback would
-     * be worse than a clean `null`. But `null` alone reaches the user as a bare
-     * "Failed to resume session <id>." with no reason, on every surface, which
-     * makes a broken resume undiagnosable. This sink carries the reason (and the
-     * STAGE it died at) out to the caller, which turns it into the message the
-     * user actually reads.
-     */
-    onFailure?: ((failure: SessionResumeFailure) => void) | undefined;
-    /**
-     * Live stage reporter.
-     *
-     * The same `stage` string the failure sink reports, but emitted as each step
-     * BEGINS rather than only when one fails. The TUI turns it into the rolling
-     * "what is happening right now" rows of the resume block — without it the
-     * only honest thing that surface could show during a multi-second journal
-     * parse was a spinner.
-     */
-    onStage?: ((stage: string) => void) | undefined;
-}
-/** The stage a failed resume died at, plus the underlying error text. */
-export interface SessionResumeFailure {
-    /** Machine-readable step name, e.g. `resolve_id`, `open_writer`, `hydrate`. */
-    stage: string;
-    /** Error text from the failing step — never empty. */
-    message: string;
-}
-interface SessionResumeResult {
-    entries: unknown[];
-    nextId: number;
-    sessionId: string;
-    /**
-     * Whether the agent is now WRITING to this session.
-     *
-     * `false` means the transcript is on screen but ownership was never taken:
-     * the session stays read-only and the next prompt continues the session the
-     * user was already in. Showing the transcript anyway is deliberate — the
-     * expensive, safe half of a resume (read the journal, render the timeline)
-     * has no reason to be discarded because the risky half (claim the journal
-     * for writing) failed.
-     */
-    attached: boolean;
-    /**
-     * Non-fatal problems the user should see, e.g. a sidecar that could not be
-     * re-pointed or a provider that is no longer configured. These used to abort
-     * the whole resume and roll back a transcript that had already loaded.
-     */
-    warnings: string[];
-    /**
-     * Optional context-window snapshot for the resumed session. `tokens` is a
-     * flat `number` — the prompt size of the session's LAST request, read from
-     * its journal by `projectLastRequestTokens`. The TUI consumer
-     * (`packages/tui/src/reducers/composer.ts:561-577`) reads it as a flat
-     * number and gates on `snap.tokens > 0`, so a session that never reached the
-     * model reports 0 and simply leaves the chip alone.
-     */
-    contextSnapshot?: ContextSnapshot | undefined;
-    /**
-     * Text of the LAST assistant message in the resumed transcript.
-     *
-     * The caller parses `<nextsteps>` out of it. Deterministic by construction —
-     * the TUI's per-entry parser fires on whichever assistant entry happens to
-     * mount last during a replay, which is not necessarily the final turn, so a
-     * resume needs the authoritative one from the transcript itself.
-     */
-    lastAssistantText?: string | undefined;
-}
+import { type SessionResumeContext, type SessionResumeResult } from './tui-session-resume-contracts.js';
+export type { SessionResumeFailure } from './tui-session-resume-contracts.js';
 /**
  * Resume a past session by id.
  *
@@ -102,5 +17,4 @@ interface SessionResumeResult {
  *    stage and reason.
  */
 export declare function resumeSession(ctx: SessionResumeContext, sessionId: string): Promise<SessionResumeResult | null>;
-export {};
 //# sourceMappingURL=tui-session-resume.d.ts.map

package/dist/boot/tui-settings-read.d.ts

@@ -0,0 +1,3 @@
+import type { ConfigStore } from '@wrongstack/core/types';
+export declare function readTuiSettings(configStore: ConfigStore): Record<string, unknown>;
+//# sourceMappingURL=tui-settings-read.d.ts.map

package/dist/{boot-auto-thin-K2DHHYIW.js → boot-auto-thin-YMAZI3QL.js}

@@ -1,6 +1,6 @@
 import {
   persistConfigSetting
-} from "./chunk-4MDRHMX4.js";
+} from "./chunk-KMU7GF7X.js";
 import {
   activeProfileConfigPath
 } from "./chunk-YMXXOOFN.js";
@@ -99,4 +99,4 @@ async function runBootAutoThin(deps) {
 export {
   runBootAutoThin
 };
-//# sourceMappingURL=boot-auto-thin-K2DHHYIW.js.map
+//# sourceMappingURL=boot-auto-thin-YMAZI3QL.js.map

package/dist/boot-launch-choices.d.ts

@@ -0,0 +1,22 @@
+/** Boot-time launch choices: system-prompt variant, mode, YOLO and autonomy (prompted or defaulted). */
+import type { Config } from '@wrongstack/core/types';
+import { type WstackPaths } from '@wrongstack/core/utils';
+import type { BootPhaseExit } from './boot-provider-gate.js';
+import type { ReadlineInputReader } from './input-reader.js';
+import type { TerminalRenderer } from './renderer.js';
+export interface BootLaunchInput {
+    isInteractiveTTY: boolean;
+    simpleUiFullAuto: boolean;
+    flags: Record<string, string | boolean>;
+    config: Config;
+    renderer: TerminalRenderer;
+    reader: ReadlineInputReader;
+    profileConfigPath: string;
+    wpaths: WstackPaths;
+    projectRoot: string;
+}
+export declare function applyBootLaunchChoices(input: BootLaunchInput): Promise<BootPhaseExit | {
+    kind: 'ok';
+    config: Config;
+}>;
+//# sourceMappingURL=boot-launch-choices.d.ts.map

package/dist/boot-provider-gate.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Boot-time provider + model selection: flags, saved defaults, the first-run
+ * credential gate, the "continue with these?" summary and the picker.
+ */
+import type { Config, ModelsRegistry } from '@wrongstack/core/types';
+import { type BootConfigResult } from './boot-config.js';
+import type { ReadlineInputReader } from './input-reader.js';
+import type { TerminalRenderer } from './renderer.js';
+export interface BootProviderInput {
+    flags: Record<string, string | boolean>;
+    config: Config;
+    vault: BootConfigResult['vault'];
+    modelsRegistry: ModelsRegistry;
+    renderer: TerminalRenderer;
+    reader: ReadlineInputReader;
+    profileConfigPath: string;
+    noInteractiveMode: string | boolean | undefined;
+}
+export type BootPhaseExit = {
+    kind: 'exit';
+    code: number;
+};
+export declare function resolveBootProviderModel(input: BootProviderInput): Promise<BootPhaseExit | {
+    kind: 'ok';
+    config: Config;
+    vault: BootConfigResult['vault'];
+}>;
+//# sourceMappingURL=boot-provider-gate.d.ts.map

package/dist/boot-subcommand-dispatch.d.ts

@@ -0,0 +1,24 @@
+import type { DefaultLogger } from '@wrongstack/core/infrastructure';
+import type { DefaultModelsRegistry } from '@wrongstack/core/models';
+import type { Config, SecretVault } from '@wrongstack/core/types';
+import type { WstackPaths } from '@wrongstack/core/utils';
+import type { ReadlineInputReader } from './input-reader.js';
+import type { TerminalRenderer } from './renderer.js';
+export interface BootSubcommandInput {
+    first: string | undefined;
+    positional: string[];
+    flags: Record<string, string | boolean>;
+    config: Config;
+    vault: SecretVault;
+    wpaths: WstackPaths;
+    cwd: string;
+    projectRoot: string;
+    userHome: string;
+    renderer: TerminalRenderer;
+    reader: ReadlineInputReader;
+    logger: DefaultLogger;
+    modelsRegistry: DefaultModelsRegistry;
+}
+/** Run the matching subcommand and return its exit code; undefined when none matches. */
+export declare function dispatchBootSubcommand(input: BootSubcommandInput): Promise<number | undefined>;
+//# sourceMappingURL=boot-subcommand-dispatch.d.ts.map

package/dist/boot.d.ts

@@ -1,10 +1,10 @@
-export { autoSelectSavedProvider, isHomeDirectory, shouldPrintYoloNotice, } from './boot-provider-selection.js';
 import { DefaultLogger } from '@wrongstack/core/infrastructure';
 import type { Config, ModelsRegistry, SecretVault } from '@wrongstack/core/types';
 import { type WstackPaths } from '@wrongstack/core/utils';
 import { ReadlineInputReader } from './input-reader.js';
 import { TerminalRenderer } from './renderer.js';
 import type { UpdateInfo } from './update-check.js';
+export { autoSelectSavedProvider, isHomeDirectory, shouldPrintYoloNotice, } from './boot-provider-selection.js';
 export interface BootContext {
     config: Config;
     vault: SecretVault;

package/dist/chimera-cascade-evidence.d.ts

@@ -24,7 +24,6 @@
  * @module chimera-cascade-evidence
  */
 import type { CascadeEvidenceCheckResult, CascadeEvidenceStatus } from '@wrongstack/core/plugin';
-export type { CascadeEvidenceCheckResult, CascadeEvidenceStatus, } from '@wrongstack/core/plugin';
 /** One claimed verification check: the exact command and its observed exit code. */
 interface CascadeEvidenceCheck {
     command: string;
@@ -82,4 +81,5 @@ type RunCommandFn = (command: string, cwd: string, timeoutMs: number) => Promise
  * block.
  */
 export declare function verifyCascadeEvidence(evidence: CascadeEvidence | null | undefined, cwd: string, runCommand?: RunCommandFn, timeoutMs?: number): Promise<CascadeEvidenceVerification>;
+export {};
 //# sourceMappingURL=chimera-cascade-evidence.d.ts.map

package/dist/{chunk-TI7KLHYX.js → chunk-2CMMWRQH.js}

@@ -32,85 +32,6 @@ function unknownRestrictedToolNames(restriction, isRegistered) {
   );
 }
 
-// src/boot/restricted-mode.ts
-import { lockToProjectRoot, lockYoloOff, ToolCapabilities } from "@wrongstack/core/security";
-var RESTRICTED_ENV = "WRONGSTACK_RESTRICTED";
-var RESTRICTED_DENY_CAPABILITIES = [
-  ToolCapabilities.SHELL_ARBITRARY,
-  ToolCapabilities.SHELL_RESTRICTED,
-  ToolCapabilities.SHELL_EXEC,
-  ToolCapabilities.NET_OUTBOUND,
-  ToolCapabilities.PACKAGE_INSTALL,
-  ToolCapabilities.CONFIG_MUTATE,
-  ToolCapabilities.FS_WRITE_OUTSIDE_PROJECT,
-  ToolCapabilities.TOOL_MUTATE_ANY,
-  ToolCapabilities.MCP_PROXY
-];
-var CONFLICTING_FLAGS = [
-  "yolo",
-  "yolo-destructive",
-  "full-auto",
-  "mcp-config",
-  // Pre-approving a tool would let writes skip the prompt this mode promises.
-  "allowed-tools"
-];
-function isRestrictedMode(flags) {
-  return flags["restricted"] === true || process.env[RESTRICTED_ENV] === "1";
-}
-function validateRestrictedMode(flags) {
-  if (!isRestrictedMode(flags)) return false;
-  const conflict = CONFLICTING_FLAGS.find(
-    (name) => flags[name] !== void 0 && flags[name] !== false
-  );
-  if (conflict) throw new Error(`--${conflict} cannot be combined with --restricted`);
-  return true;
-}
-function withRestrictedTools(restriction, restricted) {
-  if (!restricted) return restriction;
-  return {
-    ...restriction?.only ? { only: restriction.only } : {},
-    deny: [...restriction?.deny ?? [], "mcp__*"],
-    denyCapabilities: RESTRICTED_DENY_CAPABILITIES,
-    requireDeclaredCapabilities: true
-  };
-}
-var RESTRICTED_NOTICE = "Restricted mode: no shell, network, installs or MCP tools; files stay inside the project; YOLO is off.";
-var announced = false;
-function activateRestrictedMode(flags, write) {
-  if (!validateRestrictedMode(flags)) return false;
-  lockToProjectRoot();
-  lockYoloOff();
-  process.env[RESTRICTED_ENV] = "1";
-  if (!announced) {
-    announced = true;
-    write(`${RESTRICTED_NOTICE}
-`);
-  }
-  return true;
-}
-
-// src/boot/safe-mode.ts
-var SAFE_MODE_ENV = "WRONGSTACK_SAFE_MODE";
-function isSafeMode(flags) {
-  return flags["safe-mode"] === true || process.env[SAFE_MODE_ENV] === "1";
-}
-function propagateSafeMode(flags) {
-  const on = isSafeMode(flags);
-  if (on) process.env[SAFE_MODE_ENV] = "1";
-  return on;
-}
-var SAFE_MODE_NOTICE = "Safe mode: third-party plugins, hooks, configured MCP servers, skills and instruction overrides are off.";
-var announced2 = false;
-function announceSafeMode(flags, write) {
-  const on = propagateSafeMode(flags);
-  if (on && !announced2) {
-    announced2 = true;
-    write(`${SAFE_MODE_NOTICE}
-`);
-  }
-  return on;
-}
-
 // src/diff-renderer.ts
 import { color, sanitizeTerminalText } from "@wrongstack/core/utils";
 function diffLineStyle(line) {
@@ -226,6 +147,86 @@ function renderPayloadPreview(input) {
   return typeof diff === "string" && diff ? clipPreview(diff, diffLineStyle) : "";
 }
 
+// src/boot/restricted-mode.ts
+import { lockToProjectRoot, lockYoloOff, ToolCapabilities } from "@wrongstack/core/security";
+var RESTRICTED_ENV = "WRONGSTACK_RESTRICTED";
+var RESTRICTED_DENY_CAPABILITIES = [
+  ToolCapabilities.SHELL_ARBITRARY,
+  ToolCapabilities.SHELL_RESTRICTED,
+  ToolCapabilities.SHELL_EXEC,
+  ToolCapabilities.NET_OUTBOUND,
+  ToolCapabilities.PACKAGE_INSTALL,
+  ToolCapabilities.CONFIG_MUTATE,
+  ToolCapabilities.FS_WRITE_OUTSIDE_PROJECT,
+  ToolCapabilities.TOOL_MUTATE_ANY,
+  ToolCapabilities.MCP_PROXY
+];
+var CONFLICTING_FLAGS = [
+  "yolo",
+  "yolo-plus",
+  "yolo-destructive",
+  "full-auto",
+  "mcp-config",
+  // Pre-approving a tool would let writes skip the prompt this mode promises.
+  "allowed-tools"
+];
+function isRestrictedMode(flags) {
+  return flags["restricted"] === true || process.env[RESTRICTED_ENV] === "1";
+}
+function validateRestrictedMode(flags) {
+  if (!isRestrictedMode(flags)) return false;
+  const conflict = CONFLICTING_FLAGS.find(
+    (name) => flags[name] !== void 0 && flags[name] !== false
+  );
+  if (conflict) throw new Error(`--${conflict} cannot be combined with --restricted`);
+  return true;
+}
+function withRestrictedTools(restriction, restricted) {
+  if (!restricted) return restriction;
+  return {
+    ...restriction?.only ? { only: restriction.only } : {},
+    deny: [...restriction?.deny ?? [], "mcp__*"],
+    denyCapabilities: RESTRICTED_DENY_CAPABILITIES,
+    requireDeclaredCapabilities: true
+  };
+}
+var RESTRICTED_NOTICE = "Restricted mode: no shell, network, installs or MCP tools; files stay inside the project; YOLO is off.";
+var announced = false;
+function activateRestrictedMode(flags, write) {
+  if (!validateRestrictedMode(flags)) return false;
+  lockToProjectRoot();
+  lockYoloOff();
+  process.env[RESTRICTED_ENV] = "1";
+  if (!announced) {
+    announced = true;
+    write(`${RESTRICTED_NOTICE}
+`);
+  }
+  return true;
+}
+
+// src/boot/safe-mode.ts
+var SAFE_MODE_ENV = "WRONGSTACK_SAFE_MODE";
+function isSafeMode(flags) {
+  return flags["safe-mode"] === true || process.env[SAFE_MODE_ENV] === "1";
+}
+function propagateSafeMode(flags) {
+  const on = isSafeMode(flags);
+  if (on) process.env[SAFE_MODE_ENV] = "1";
+  return on;
+}
+var SAFE_MODE_NOTICE = "Safe mode: third-party plugins, hooks, configured MCP servers, skills and instruction overrides are off.";
+var announced2 = false;
+function announceSafeMode(flags, write) {
+  const on = propagateSafeMode(flags);
+  if (on && !announced2) {
+    announced2 = true;
+    write(`${SAFE_MODE_NOTICE}
+`);
+  }
+  return on;
+}
+
 // src/boot/simpleui-full-auto.ts
 function isSimpleUiFullAuto(flags) {
   return flags["simpleui"] === true && flags["full-auto"] === true;
@@ -607,4 +608,4 @@ export {
   detectProjectFacts,
   renderAgentsTemplate
 };
-//# sourceMappingURL=chunk-TI7KLHYX.js.map
+//# sourceMappingURL=chunk-2CMMWRQH.js.map