@wrongstack/cli 1.0.4 → 1.0.6

package/dist/{execution-RAZDDQFC.js → execution-Z6A26EG6.js}

@@ -1258,7 +1258,7 @@ import * as path7 from "node:path";
 import { restoreSessionSubagentPolicy } from "@wrongstack/core/coordination";
 import { attachTodosCheckpoint, loadTodosCheckpoint } from "@wrongstack/core/storage";
 import { projectLastRequestTokens } from "@wrongstack/core/types/session-timeline";
-import { sessionScopedPath as sessionScopedPath2 } from "@wrongstack/core/utils";
+import { sessionScopedPath as sessionScopedPath2, toErrorMessage } from "@wrongstack/core/utils";
 var RESERVATION_WINDOW_MS = 6e4;
 var RESERVATION_RENEW_MS = 2e4;
 function messageText(content) {
@@ -1288,7 +1288,7 @@ async function resumeSession(ctx, sessionId) {
   };
   const warnings = [];
   const warn = (label, err) => {
-    warnings.push(`${label}: ${err instanceof Error ? err.message : String(err)}`);
+    warnings.push(`${label}: ${toErrorMessage(err)}`);
   };
   let stage = "start";
   const setStage = (next) => {
@@ -1309,7 +1309,7 @@ async function resumeSession(ctx, sessionId) {
       throw new TypeError("@wrongstack/tui does not export replaySessionMessages");
     }
   } catch (err) {
-    return fail(stage, err instanceof Error ? err.message : String(err));
+    return fail(stage, toErrorMessage(err));
   }
   setStage("resolve_id");
   let canonicalSessionId = sessionId;
@@ -1323,11 +1323,11 @@ async function resumeSession(ctx, sessionId) {
         level: "error",
         event: "execution.resume_id_resolve_failed",
         sessionId,
-        message: err instanceof Error ? err.message : String(err),
+        message: toErrorMessage(err),
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       })
     );
-    return fail(stage, err instanceof Error ? err.message : String(err));
+    return fail(stage, toErrorMessage(err));
   }
   const previousSessionId = agent.ctx.session?.id;
   let hydrated;
@@ -1369,7 +1369,7 @@ async function resumeSession(ctx, sessionId) {
             level: "warn",
             event: "execution.resume_reservation_renew_failed",
             sessionId: canonicalSessionId,
-            message: err instanceof Error ? err.message : String(err),
+            message: toErrorMessage(err),
             timestamp: (/* @__PURE__ */ new Date()).toISOString()
           })
         );
@@ -1441,7 +1441,7 @@ async function resumeSession(ctx, sessionId) {
         JSON.stringify({
           level: "error",
           event: "execution.resume_journal_flush_failed",
-          message: err instanceof Error ? err.message : String(err),
+          message: toErrorMessage(err),
           timestamp: (/* @__PURE__ */ new Date()).toISOString()
         })
       );
@@ -1498,7 +1498,7 @@ async function resumeSession(ctx, sessionId) {
             event: "execution.resume_model_restore_failed",
             provider: targetProviderId,
             model: targetModel,
-            message: err instanceof Error ? err.message : String(err),
+            message: toErrorMessage(err),
             timestamp: (/* @__PURE__ */ new Date()).toISOString()
           })
         );
@@ -1526,7 +1526,7 @@ async function resumeSession(ctx, sessionId) {
             JSON.stringify({
               level: "error",
               event: "execution.session_end_append_failed",
-              message: err instanceof Error ? err.message : String(err),
+              message: toErrorMessage(err),
               timestamp: (/* @__PURE__ */ new Date()).toISOString()
             })
           );
@@ -1539,7 +1539,7 @@ async function resumeSession(ctx, sessionId) {
               JSON.stringify({
                 level: "error",
                 event: "execution.session_close_failed",
-                message: err instanceof Error ? err.message : String(err),
+                message: toErrorMessage(err),
                 timestamp: (/* @__PURE__ */ new Date()).toISOString()
               })
             );
@@ -1580,7 +1580,7 @@ async function resumeSession(ctx, sessionId) {
             level: "error",
             event: "execution.resume_identity_rollback_failed",
             sessionId: previousSessionId,
-            message: rollbackErr instanceof Error ? rollbackErr.message : String(rollbackErr),
+            message: toErrorMessage(rollbackErr),
             timestamp: (/* @__PURE__ */ new Date()).toISOString()
           })
         );
@@ -1602,7 +1602,7 @@ async function resumeSession(ctx, sessionId) {
           JSON.stringify({
             level: "error",
             event: "execution.resume_post_swap_rollback_failed",
-            message: rollbackErr instanceof Error ? rollbackErr.message : String(rollbackErr),
+            message: toErrorMessage(rollbackErr),
             timestamp: (/* @__PURE__ */ new Date()).toISOString()
           })
         );
@@ -1613,7 +1613,7 @@ async function resumeSession(ctx, sessionId) {
             JSON.stringify({
               level: "error",
               event: "execution.resume_opened_writer_close_failed",
-              message: closeErr instanceof Error ? closeErr.message : String(closeErr),
+              message: toErrorMessage(closeErr),
               timestamp: (/* @__PURE__ */ new Date()).toISOString()
             })
           );
@@ -1631,7 +1631,7 @@ async function resumeSession(ctx, sessionId) {
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       })
     );
-    const message = err instanceof Error ? err.message : String(err);
+    const message = toErrorMessage(err);
     if (err instanceof Error && err.name === "SessionOwnershipConflictError") {
       return fail(stage, message);
     }
@@ -1670,7 +1670,7 @@ async function resumeSession(ctx, sessionId) {
             level: "error",
             event: "execution.resume_readonly_render_failed",
             sessionId: canonicalSessionId,
-            message: renderErr instanceof Error ? renderErr.message : String(renderErr),
+            message: toErrorMessage(renderErr),
             timestamp: (/* @__PURE__ */ new Date()).toISOString()
           })
         );
@@ -4592,7 +4592,7 @@ import {
   color as color11,
   estimateRequestTokensCalibrated as estimateRequestTokensCalibrated2,
   hasOpenTodos as hasOpenTodos2,
-  toErrorMessage as toErrorMessage3
+  toErrorMessage as toErrorMessage4
 } from "@wrongstack/core/utils";
 import { readClipboardImage, routeImagesForModel } from "@wrongstack/runtime";
 import { createAutoProceedLoopGuard } from "@wrongstack/tools/auto-proceed-loop-guard";
@@ -4820,11 +4820,11 @@ function registerReplClient(opts) {
 
 // src/repl-eternal-loop.ts
 import { goalFilePath as goalFilePath2, summarizeUsage } from "@wrongstack/core/goal";
-import { color as color8, toErrorMessage as toErrorMessage2 } from "@wrongstack/core/utils";
+import { color as color8, toErrorMessage as toErrorMessage3 } from "@wrongstack/core/utils";
 
 // src/repl-goal-banner.ts
 import { goalFilePath, loadGoal } from "@wrongstack/core/goal";
-import { color as color7, expectDefined, toErrorMessage } from "@wrongstack/core/utils";
+import { color as color7, expectDefined, toErrorMessage as toErrorMessage2 } from "@wrongstack/core/utils";
 async function loadGoalSafe(opts) {
   if (!opts.projectRoot) return null;
   try {
@@ -4858,7 +4858,7 @@ async function renderGoalBanner(opts) {
         try {
           await opts.slashRegistry.dispatch("/autonomy eternal", opts.agent.ctx);
         } catch (err) {
-          opts.renderer.writeError(`Auto-resume failed: ${toErrorMessage(err)}`);
+          opts.renderer.writeError(`Auto-resume failed: ${toErrorMessage2(err)}`);
         }
       } else {
         opts.renderer.write(
@@ -4934,7 +4934,7 @@ async function runReplEternalLoop(opts, onInterruptsReset) {
         return true;
       }
     } catch (err) {
-      opts.renderer.writeError(`[eternal] ${toErrorMessage2(err)}`);
+      opts.renderer.writeError(`[eternal] ${toErrorMessage3(err)}`);
     }
     await new Promise((resolve4) => setTimeout(resolve4, 250));
     return true;
@@ -5005,7 +5005,7 @@ async function runReplEternalLoop(opts, onInterruptsReset) {
         return true;
       }
     } catch (err) {
-      opts.renderer.writeError(`[parallel] ${toErrorMessage2(err)}`);
+      opts.renderer.writeError(`[parallel] ${toErrorMessage3(err)}`);
     }
     await new Promise((resolve4) => setTimeout(resolve4, 250));
     return true;
@@ -5245,7 +5245,7 @@ ${lines.join("\n")}
           if (res?.message) opts.renderer.write(`${res.message}
 `);
         } catch (err) {
-          opts.renderer.writeError(toErrorMessage3(err));
+          opts.renderer.writeError(toErrorMessage4(err));
         }
         continue;
       }
@@ -5337,7 +5337,7 @@ ${color11.dim(taskList2)}
             }
           }
         } catch (err) {
-          opts.renderer.writeError(toErrorMessage3(err));
+          opts.renderer.writeError(toErrorMessage4(err));
         }
         continue;
       }
@@ -5616,7 +5616,7 @@ ${color11.dim(lines)}
           }
         }
       } catch (err) {
-        opts.renderer.writeError(toErrorMessage3(err));
+        opts.renderer.writeError(toErrorMessage4(err));
       } finally {
         activeCtrl = void 0;
       }
@@ -5642,7 +5642,7 @@ async function pasteClipboardImage(builder, opts) {
     opts.renderer.write(color11.dim(`  \u21B3 ${placeholder} (PNG ${kb}KB)
 `));
   } catch (err) {
-    opts.renderer.writeError(`Clipboard image error: ${toErrorMessage3(err)}`);
+    opts.renderer.writeError(`Clipboard image error: ${toErrorMessage4(err)}`);
   }
 }
 
@@ -6840,4 +6840,4 @@ export {
   execute,
   resolveReviewerFallbackModels
 };
-//# sourceMappingURL=execution-RAZDDQFC.js.map
+//# sourceMappingURL=execution-Z6A26EG6.js.map

package/dist/{hq-5XHEIIH6.js → hq-V4PHEETW.js}

@@ -7,7 +7,7 @@ import {
 import {
   normalizeHqPublicOrigin,
   resolveAuditActor
-} from "./chunk-I7V2OYVH.js";
+} from "./chunk-5EA6OTLJ.js";
 import {
   parseHqIpAllowlist
 } from "./chunk-Q7E3BPDU.js";
@@ -62,7 +62,7 @@ var hqCmd = async (args, deps) => {
   return 1;
 };
 async function startServer(deps) {
-  const { startHqServer } = await import("./hq-server-CNUTBWTK.js");
+  const { startHqServer } = await import("./hq-server-MZ7DV6X7.js");
   const dataDir = resolveDataDir(deps);
   const flags = deps.flags ?? {};
   const rawPublicUrl = typeof flags["hq-public-url"] === "string" ? flags["hq-public-url"] : process.env.WRONGSTACK_HQ_PUBLIC_URL;
@@ -827,4 +827,4 @@ export {
   hqCmd,
   resolveAuditActor
 };
-//# sourceMappingURL=hq-5XHEIIH6.js.map
+//# sourceMappingURL=hq-V4PHEETW.js.map

package/dist/hq-server/auth-state.d.ts

@@ -6,6 +6,12 @@ export interface HqAuthState {
     tokenStats(): NonNullable<HqSnapshot['totals']['tokenStats']>;
 }
 interface HqAuthStateOptions {
+    /**
+     * The server's `requireBrowserAuth` option, stamped onto the state so every
+     * `hqAuthRequired(mutableAuth)` gate observes it without having to be handed
+     * it separately. See the field's doc on `HqRouterMutableAuth`.
+     */
+    requireBrowserAuth?: boolean | undefined;
     /**
      * Invoked after every {@link HqAuthState.apply}, with the freshly projected
      * `mutableAuth`. The server wires this to the WS-010 exposure re-assessment

package/dist/hq-server/auth.d.ts

@@ -38,7 +38,16 @@ export type HqBrowserAuthResult = HqBrowserAuthContext | HqCookieAuthContext | u
  * inline style is not script execution.
  */
 export declare function setHqSecurityHeaders(res: http.ServerResponse): void;
-export declare function hasTrustedBrowserOrigin(req: http.IncomingMessage, boundHost?: string, boundPort?: number, trustedPublicOrigins?: ReadonlySet<string>, allowFileOrigin?: boolean): boolean;
+export declare function hasTrustedBrowserOrigin(req: http.IncomingMessage, boundHost?: string, boundPort?: number, trustedPublicOrigins?: ReadonlySet<string>, allowFileOrigin?: boolean, 
+/**
+ * Whether this surface has any credential configured — pass
+ * `hqAuthRequired(mutableAuth, requireBrowserAuth)`.
+ *
+ * Defaults to `false`, the STRICT side, deliberately: a caller that forgets
+ * to wire it gets the tighter rule rather than the looser one. That is the
+ * opposite of how the WS-077 gates drifted.
+ */
+credentialedSurface?: boolean): boolean;
 export declare function serializeHqSessionCookie(sessionId: string, secret: string): string;
 export declare function parseHqSessionCookie(value: string, secret: string): string | undefined;
 export declare function parseCookieHeader(cookieHeader: string | undefined): Record<string, string>;

package/dist/hq-server/routes/auth/common.d.ts

@@ -1,7 +1,41 @@
 import type * as http from 'node:http';
 import { type HqAuthFile } from '@wrongstack/core/hq';
 import { type HqBrowserAuthResult } from '../../auth.js';
+import type { LoginAttemptStore } from '../../login-attempt-store.js';
 import type { HqRouterMutableAuth, HqSessionEntry } from '../../types.js';
+/**
+ * Record a failed second-factor confirmation and return the new failure count.
+ *
+ * Shared by every route that verifies a factor outside `/api/login`
+ * (totp/disable, password change). Kept here rather than copied per route: the
+ * whole point is that each of those routes feeds the SAME per-IP counter, so a
+ * attacker cannot get a fresh budget by switching endpoints.
+ */
+export declare function recordVerifyFailure(loginAttempts: LoginAttemptStore, clientIp: string): number;
+/** Outcome of {@link consumeTotpCode}. */
+export type TotpConsumeResult = 'ok' | 'invalid' | 'replayed';
+/**
+ * Verify a TOTP code AND burn it, so it cannot be presented a second time.
+ *
+ * A TOTP code stays valid for its whole time step plus the verification
+ * window — roughly 90 seconds. Without a single-use record, one observed code
+ * can be replayed at a *different* endpoint for as long as that window lasts.
+ * That is not theoretical here: `/api/login/verify` advanced
+ * `totpLastUsedCounter` and the other two verification sites
+ * (`totp/disable`, `auth/password`) called the counter-less `verifyTotp`, so a
+ * code already spent on a login replayed into removing 2FA outright or
+ * rotating the password and cookie secret.
+ *
+ * Kept in this module for the same reason as {@link recordVerifyFailure}: the
+ * property only holds if EVERY site that verifies a code shares one counter.
+ * A route that verifies a TOTP code by any other means is a bug —
+ * `hq-totp-single-use.test.ts` enumerates the call sites to keep it that way.
+ *
+ * The counter is advanced in memory first and persisted best-effort, matching
+ * the pre-existing behaviour at `/api/login/verify`: a failed write must not
+ * turn a consumed code back into an unconsumed one for this process.
+ */
+export declare function consumeTotpCode(code: string, mutableAuth: HqRouterMutableAuth, dataDir: string, applyAuthFile: ApplyHqAuthFile): Promise<TotpConsumeResult>;
 export declare function isLoopbackRequest(req: http.IncomingMessage): boolean;
 export declare const HQ_AUTH_ADMIN_CAPABILITY = "auth.admin";
 export declare function callerCanAdministerAuth(auth: HqBrowserAuthResult): boolean;

package/dist/hq-server/routes/auth/password-routes.d.ts

@@ -3,7 +3,9 @@ import type { LoginAttemptStore } from '../../login-attempt-store.js';
 import type { HqRouterMutableAuth, HqSessionEntry } from '../../types.js';
 import { type ApplyHqAuthFile } from './common.js';
 export declare function handleApiAuthStatus(req: http.IncomingMessage, res: http.ServerResponse, url: URL, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, requireBrowserAuth: boolean | undefined, trustedPublicOrigins: Set<string>, secureCookies: boolean | undefined): Promise<void>;
-export declare function handleApiLogin(req: http.IncomingMessage, res: http.ServerResponse, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, loginAttempts: LoginAttemptStore, secureCookies: boolean | undefined, trustedProxyHops: number, sessionCapabilities?: string[]): Promise<void>;
+export declare function handleApiLogin(req: http.IncomingMessage, res: http.ServerResponse, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, loginAttempts: LoginAttemptStore, secureCookies: boolean | undefined, trustedProxyHops: number, 
+/** Where `auth.json` lives — needed to persist a transparent KDF upgrade. */
+dataDir: string, sessionCapabilities?: string[]): Promise<void>;
 export declare function handleApiLogout(req: http.IncomingMessage, res: http.ServerResponse, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, secureCookies: boolean | undefined): Promise<void>;
-export declare function handleApiPassword(req: http.IncomingMessage, res: http.ServerResponse, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, dataDir: string, secureCookies: boolean | undefined, requireBrowserAuth: boolean | undefined, applyAuthFile: ApplyHqAuthFile): Promise<void>;
+export declare function handleApiPassword(req: http.IncomingMessage, res: http.ServerResponse, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, dataDir: string, secureCookies: boolean | undefined, requireBrowserAuth: boolean | undefined, applyAuthFile: ApplyHqAuthFile, loginAttempts: LoginAttemptStore, trustedProxyHops: number): Promise<void>;
 //# sourceMappingURL=password-routes.d.ts.map

package/dist/hq-server/types.d.ts

@@ -103,6 +103,24 @@ export interface HqRouterMutableAuth {
      * the surface fails closed instead of opening up.
      */
     requireAuthFloor?: boolean | undefined;
+    /**
+     * The server's `requireBrowserAuth` option, carried on the state rather than
+     * passed to every gate.
+     *
+     * `hqAuthRequired` takes it as an optional second argument, and five gates
+     * called it with one — `command-handlers`, three in `mailbox-handlers`, and
+     * `mailbox-gateway-manager` — so a public relay did not raise the auth
+     * requirement on those routes. That is the WS-077 drift class the helper's
+     * own docstring warns about, recurring on the same routes. Holding the value
+     * on the state makes the one-argument call correct instead of incomplete.
+     *
+     * Required, not optional, and deliberately so. Optional would mean a second
+     * construction site could omit it and every one-argument gate would silently
+     * read `undefined` — the same drift this field exists to end, one level down.
+     * With `exactOptionalPropertyTypes` the compiler now makes every builder say
+     * what it means, including `undefined`.
+     */
+    requireBrowserAuth: boolean | undefined;
 }
 /**
  * Session record stored in the server-side `sessions` Map.

package/dist/{hq-server-CNUTBWTK.js → hq-server-MZ7DV6X7.js}

@@ -10,9 +10,9 @@ import {
   readLocalSubagentTranscript,
   sanitizeApiError,
   startHqServer
-} from "./chunk-3I5ZJXM5.js";
+} from "./chunk-PQZPHGGD.js";
 import "./chunk-HXJYHAR4.js";
-import "./chunk-I7V2OYVH.js";
+import "./chunk-5EA6OTLJ.js";
 import "./chunk-Q7E3BPDU.js";
 export {
   DEFAULT_HOST,
@@ -27,4 +27,4 @@ export {
   sanitizeApiError,
   startHqServer
 };
-//# sourceMappingURL=hq-server-CNUTBWTK.js.map
+//# sourceMappingURL=hq-server-MZ7DV6X7.js.map

package/dist/index.js

@@ -2,7 +2,7 @@
 import {
   applyNodeEnvDefault,
   applySessionShellDefault
-} from "./chunk-O4A3HHKD.js";
+} from "./chunk-672UXYL3.js";
 import {
   CLI_VERSION
 } from "./chunk-XJXDOF63.js";
@@ -16,20 +16,21 @@ async function main(argv) {
   applySessionShellDefault();
   const earlyFlags = parseArgs(argv).flags;
   if (earlyFlags["help"] === true || earlyFlags["version"] === true) {
-    const { handleHelpVersionShortCircuit } = await import("./short-circuit-flags-YDMLAQ5R.js");
+    const { handleHelpVersionShortCircuit } = await import("./short-circuit-flags-KBTYSJTW.js");
     const earlyExit = await handleHelpVersionShortCircuit(argv);
     if (earlyExit !== null) return earlyExit;
   }
-  const { initializeCli } = await import("./cli-context-WFC3BNGM.js");
+  const { initializeCli } = await import("./cli-context-BYKJDAFF.js");
   const cliCtx = await initializeCli(argv);
   if (typeof cliCtx === "number") return cliCtx;
-  const { runInteractive } = await import("./cli-main-GU3YZLMO.js");
+  const { runInteractive } = await import("./cli-main-5WZBH3WA.js");
   return runInteractive(cliCtx);
 }
 
 // src/cli-entry-point.ts
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
+import { scrubErrorText } from "@wrongstack/core/security";
 import { installCrashShield, runFatalSalvageSync, writeErr } from "@wrongstack/core/utils";
 var SQLITE_WARNING_RE = /sqlite is an experimental feature/i;
 function installSqliteWarningFilter() {
@@ -128,7 +129,9 @@ function runAsMain(mainFn) {
     },
     (err) => {
       runFatalSalvageSync();
-      writeErr((err instanceof Error ? err.stack : String(err)) + "\n");
+      writeErr(
+        scrubErrorText(err instanceof Error ? err.stack ?? err.message : String(err)) + "\n"
+      );
       process.exitCode = 1;
       scheduleForcedExit(1);
     }

package/dist/{mcp-HOMLC4WE.js → mcp-FX7TKPTV.js}

@@ -23,7 +23,11 @@ import { pathToFileURL } from "node:url";
 import { Context } from "@wrongstack/core/agent";
 import { ToolExecutor } from "@wrongstack/core/execution";
 import { ToolRegistry } from "@wrongstack/core/registry";
-import { AutoApprovePermissionPolicy, DefaultSecretScrubber } from "@wrongstack/core/security";
+import {
+  AutoApprovePermissionPolicy,
+  DefaultSecretScrubber,
+  ToolCapabilities
+} from "@wrongstack/core/security";
 import { normalizeTokenSavingTier } from "@wrongstack/core/types";
 import {
   DEFAULT_MCP_INSERTION_MAX_BYTES,
@@ -33,11 +37,9 @@ import {
 } from "@wrongstack/mcp";
 import { registerBuiltinToolTier } from "@wrongstack/tools/tool-tier";
 import { wireKanbanPorts } from "@wrongstack/runtime";
-var AllowAllPermissionPolicy = class extends AutoApprovePermissionPolicy {
-  async evaluate() {
-    return { permission: "auto", source: "default" };
-  }
-};
+function yoloServePolicy() {
+  return new AutoApprovePermissionPolicy(Object.values(ToolCapabilities));
+}
 function parseToolsFlag(flags, positional) {
   const raw = flags["tools"];
   const csv = typeof raw === "string" ? raw : raw === true ? positional?.[0] ?? "" : "";
@@ -226,7 +228,7 @@ async function serveMcpStdio(deps, positional) {
     controller.signal,
     resolveServeFsRestriction(deps.config)
   );
-  const permissionPolicy = yolo ? new AllowAllPermissionPolicy() : new AutoApprovePermissionPolicy();
+  const permissionPolicy = yolo ? yoloServePolicy() : new AutoApprovePermissionPolicy();
   const executor = new ToolExecutor(registry, {
     permissionPolicy,
     secretScrubber: new DefaultSecretScrubber(),
@@ -440,4 +442,4 @@ function isRecord(value) {
 export {
   mcpCmd
 };
-//# sourceMappingURL=mcp-HOMLC4WE.js.map
+//# sourceMappingURL=mcp-FX7TKPTV.js.map

package/dist/mcp-serve.d.ts

@@ -1,8 +1,39 @@
 import { Context } from '@wrongstack/core/agent';
 import { ToolRegistry } from '@wrongstack/core/registry';
+import { AutoApprovePermissionPolicy } from '@wrongstack/core/security';
 import type { PermissionPolicy, Tool } from '@wrongstack/core/types';
 import { type MCPServerPrompt, type MCPServerResource } from '@wrongstack/mcp';
 import type { SubcommandDeps } from './subcommands/contracts.js';
+/**
+ * `--yolo` for `mcp serve`: widen the CAPABILITY allowlist, keep every guard.
+ *
+ * This replaced an `AllowAllPermissionPolicy extends AutoApprovePermissionPolicy`
+ * whose `evaluate()` returned `{ permission: 'auto' }` unconditionally. That
+ * override skipped the whole base implementation — the sensitive-read denial,
+ * the leader deny rules, the destructive-command classifier, the agent-state
+ * write guard, and `LOCKED_DESTRUCTIVE_KINDS`. It was the only place in the
+ * codebase where `agent-state` and `credential-bind` could be un-gated, so a
+ * third-party MCP client could have written `hooks` into config.json (boot-time
+ * RCE) or `auto: true` into trust.json.
+ *
+ * It did not actually get there — but only by accident, and the accident is the
+ * reason this is a rewrite rather than a patch. The override returned
+ * `source: 'default'` where the base class returns `source: 'yolo'`, so
+ * `ToolExecutor.capabilityDowngraded` re-armed and forced `confirm`; `mcp serve`
+ * has no confirmAwaiter, so the call hard-errored. Changing that one string
+ * literal to `'yolo'` — which reads as a trivial consistency cleanup — would
+ * have made the bypass live. Safety must not rest on a string nobody knows is
+ * load-bearing.
+ *
+ * Granting every capability is what `--yolo` actually means, and it is what
+ * lets `ToolExecutor` trust an `auto` instead of downgrading it (see the
+ * `dangerousNotAllowed` reasoning in `auto-approve-policy.ts`). The destructive
+ * classifier is deliberately NOT relaxed: `yoloConfirmKinds` is left at its
+ * default, which gates every destructive kind. Destructive calls therefore
+ * still require a confirmation this surface cannot answer, exactly as before —
+ * this change removes a latent bypass without widening anything.
+ */
+export declare function yoloServePolicy(): AutoApprovePermissionPolicy;
 /**
  * Resolve the `--tools` whitelist for `mcp serve`.
  *

package/dist/{short-circuit-flags-YDMLAQ5R.js → short-circuit-flags-KBTYSJTW.js}

@@ -1,10 +1,10 @@
 import {
   handleHelpVersionShortCircuit
-} from "./chunk-U6PGWDMZ.js";
+} from "./chunk-NR7BD73C.js";
 import "./chunk-6WRKAACA.js";
 import "./chunk-XJXDOF63.js";
 import "./chunk-EK2P53GL.js";
 export {
   handleHelpVersionShortCircuit
 };
-//# sourceMappingURL=short-circuit-flags-YDMLAQ5R.js.map
+//# sourceMappingURL=short-circuit-flags-KBTYSJTW.js.map

package/dist/{subcommands-7N4RIK6H.js → subcommands-DEYSYHIM.js}

@@ -1,9 +1,9 @@
 import {
   subcommandNames,
   subcommands
-} from "./chunk-BIWE22O5.js";
+} from "./chunk-QDQPF4PB.js";
 export {
   subcommandNames,
   subcommands
 };
-//# sourceMappingURL=subcommands-7N4RIK6H.js.map
+//# sourceMappingURL=subcommands-DEYSYHIM.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/cli",
-  "version": "1.0.4",
+  "version": "1.0.6",
   "license": "MIT",
   "description": "WrongStack CLI — terminal AI coding agent with provider catalog from models.dev. Provides `wrongstack` and `wstack` binaries.",
   "keywords": [
@@ -41,36 +41,36 @@
     "data"
   ],
   "dependencies": {
-    "@wrongstack/acp": "1.0.4",
-    "@wrongstack/bench": "1.0.4",
-    "@wrongstack/core": "1.0.4",
-    "@wrongstack/primitives": "1.0.4",
-    "@wrongstack/kanban": "1.0.4",
-    "@wrongstack/mcp": "1.0.4",
-    "@wrongstack/persistence": "1.0.4",
-    "@wrongstack/plug-lsp": "1.0.4",
-    "@wrongstack/plugins": "1.0.4",
-    "@wrongstack/providers": "1.0.4",
-    "@wrongstack/requirement-intake": "1.0.4",
-    "@wrongstack/runtime": "1.0.4",
-    "@wrongstack/sage": "1.0.4",
-    "@wrongstack/sdd": "1.0.4",
-    "@wrongstack/security-scanner": "1.0.4",
-    "@wrongstack/simpleui": "1.0.4",
-    "@wrongstack/techstack": "1.0.4",
-    "@wrongstack/telegram": "1.0.4",
-    "@wrongstack/tools": "1.0.4",
-    "@wrongstack/tui": "1.0.4",
-    "@wrongstack/vector-memory": "1.0.4",
-    "@wrongstack/webui": "1.0.4",
-    "@wrongstack/webui-hq": "1.0.4",
-    "@wrongstack/webui-protocol": "1.0.4",
-    "@wrongstack/wrongtrace": "1.0.4",
-    "@wrongstack/webui-server": "1.0.4",
+    "@wrongstack/acp": "1.0.6",
+    "@wrongstack/bench": "1.0.6",
+    "@wrongstack/core": "1.0.6",
+    "@wrongstack/primitives": "1.0.6",
+    "@wrongstack/kanban": "1.0.6",
+    "@wrongstack/mcp": "1.0.6",
+    "@wrongstack/persistence": "1.0.6",
+    "@wrongstack/plug-lsp": "1.0.6",
+    "@wrongstack/plugins": "1.0.6",
+    "@wrongstack/providers": "1.0.6",
+    "@wrongstack/requirement-intake": "1.0.6",
+    "@wrongstack/runtime": "1.0.6",
+    "@wrongstack/sage": "1.0.6",
+    "@wrongstack/sdd": "1.0.6",
+    "@wrongstack/security-scanner": "1.0.6",
+    "@wrongstack/simpleui": "1.0.6",
+    "@wrongstack/techstack": "1.0.6",
+    "@wrongstack/telegram": "1.0.6",
+    "@wrongstack/tools": "1.0.6",
+    "@wrongstack/tui": "1.0.6",
+    "@wrongstack/vector-memory": "1.0.6",
+    "@wrongstack/webui": "1.0.6",
+    "@wrongstack/webui-hq": "1.0.6",
+    "@wrongstack/webui-protocol": "1.0.6",
+    "@wrongstack/wrongtrace": "1.0.6",
+    "@wrongstack/webui-server": "1.0.6",
     "ws": "^8.21.3"
   },
   "optionalDependencies": {
-    "@wrongstack/desktop": "1.0.4"
+    "@wrongstack/desktop": "1.0.6"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",