@wrongstack/cli 1.1.2 → 1.1.5

package/dist/{chunk-3EXRPTAU.js → chunk-5TQ65PXQ.js}

@@ -1,19 +1,7 @@
 
-// src/hq-server/audit-actor.ts
-import * as os from "node:os";
-function resolveAuditActor() {
-  const user = (process.env.USERNAME ?? process.env.USER ?? "").toString();
-  try {
-    const host = os.hostname();
-    return user ? `${user}@${host}` : `cli@${host}`;
-  } catch {
-    return user ? `${user}@unknown` : "cli";
-  }
-}
-
 // src/hq-server/utils.ts
 import * as fs from "node:fs/promises";
-import * as os2 from "node:os";
+import * as os from "node:os";
 import * as path from "node:path";
 import { resolveHqDataDir } from "@wrongstack/core/hq";
 import { isSafeSessionId as coreIsSafeSessionId } from "@wrongstack/core/utils";
@@ -166,7 +154,7 @@ function hqRuntimeMarkerPath(dataDir) {
 function lanIPv4Addresses() {
   const out = [];
   try {
-    const ifaces = os2.networkInterfaces();
+    const ifaces = os.networkInterfaces();
     for (const name of Object.keys(ifaces)) {
       for (const ni of ifaces[name] ?? []) {
         if (ni.family === "IPv4" && !ni.internal) out.push(ni.address);
@@ -212,8 +200,19 @@ function recordTimeseriesSignal(persistence, event) {
   }
 }
 
+// src/hq-server/audit-actor.ts
+import * as os2 from "node:os";
+function resolveAuditActor() {
+  const user = (process.env.USERNAME ?? process.env.USER ?? "").toString();
+  try {
+    const host = os2.hostname();
+    return user ? `${user}@${host}` : `cli@${host}`;
+  } catch {
+    return user ? `${user}@unknown` : "cli";
+  }
+}
+
 export {
-  resolveAuditActor,
   TRANSCRIPT_RING_MAX,
   MAX_TRANSCRIPT_SESSIONS,
   MAX_AGENT_RINGS,
@@ -234,6 +233,7 @@ export {
   truncateHqSummary,
   hqMachineKey,
   recordTimeseriesSignal,
-  sanitizeApiError
+  sanitizeApiError,
+  resolveAuditActor
 };
-//# sourceMappingURL=chunk-3EXRPTAU.js.map
+//# sourceMappingURL=chunk-5TQ65PXQ.js.map

package/dist/{chunk-GRAGMA4B.js → chunk-7BM4LGKQ.js}

@@ -3,40 +3,40 @@
 var loaders = {
   automation: async () => (await import("./automation-O7ZRZSFS.js")).automationCmd,
   sandbox: async () => (await import("./sandbox-EZQ76MNY.js")).sandboxCmd,
-  acp: async () => (await import("./acp-HCGUTFNE.js")).acpCmd,
+  acp: async () => (await import("./acp-NKUEYJDZ.js")).acpCmd,
   init: async () => (await import("./init-5PLABNLR.js")).initCmd,
-  auth: async () => (await import("./auth-ANOVZVHE.js")).authCmd,
+  auth: async () => (await import("./auth-2ZG5DBHS.js")).authCmd,
   update: async () => (await import("./update-54W7GUS5.js")).updateCmd,
   remote: async () => (await import("./remote-AKKRJEHK.js")).remoteCmd,
-  sessions: async () => (await import("./sessions-config-SJVQXCIE.js")).sessionsCmd,
-  config: async () => (await import("./sessions-config-SJVQXCIE.js")).configCmd,
-  "config-export": async () => (await import("./config-transfer-Y7XJMJRN.js")).configExportCmd,
-  "config-import": async () => (await import("./config-transfer-Y7XJMJRN.js")).configImportCmd,
+  sessions: async () => (await import("./sessions-config-7MK742OW.js")).sessionsCmd,
+  config: async () => (await import("./sessions-config-7MK742OW.js")).configCmd,
+  "config-export": async () => (await import("./config-transfer-B4GOZTFC.js")).configExportCmd,
+  "config-import": async () => (await import("./config-transfer-B4GOZTFC.js")).configImportCmd,
   rewind: async () => (await import("./rewind-GAUXWSTU.js")).rewindCmd,
   replay: async () => (await import("./replay-URJFMQCU.js")).replayCmd,
   audit: async () => (await import("./audit-NH7NUKBV.js")).auditCmd,
-  tools: async () => (await import("./tools-skills-55QVTMSK.js")).toolsCmd,
-  skills: async () => (await import("./tools-skills-55QVTMSK.js")).skillsCmd,
+  tools: async () => (await import("./tools-skills-WDTMCE46.js")).toolsCmd,
+  skills: async () => (await import("./tools-skills-WDTMCE46.js")).skillsCmd,
   "skill-suggest": async () => (await import("./skill-suggest-LZV2TIPQ.js")).skillSuggestCmd,
-  typesafe: async () => (await import("./typesafe-YBEADNAH.js")).typesafeCmd,
+  typesafe: async () => (await import("./typesafe-QLSMFU7J.js")).typesafeCmd,
   providers: async () => (await import("./providers-models-CDI5GVBX.js")).providersCmd,
   models: async () => (await import("./providers-models-CDI5GVBX.js")).modelsCmd,
-  mcp: async () => (await import("./mcp-2XWBJEQN.js")).mcpCmd,
-  plugin: async () => (await import("./plugin-usage-TYF5HY4K.js")).pluginCmd,
-  plugins: async () => (await import("./plugin-usage-TYF5HY4K.js")).pluginCmd,
+  mcp: async () => (await import("./mcp-22CFBX4H.js")).mcpCmd,
+  plugin: async () => (await import("./plugin-usage-UWKYMNQU.js")).pluginCmd,
+  plugins: async () => (await import("./plugin-usage-UWKYMNQU.js")).pluginCmd,
   diag: async () => (await import("./diag-doctor-5SVYK2DR.js")).diagCmd,
   doctor: async () => (await import("./diag-doctor-5SVYK2DR.js")).doctorCmd,
   "proxy-status": async () => (await import("./diag-doctor-5SVYK2DR.js")).proxyCmd,
   export: async () => (await import("./export-W27PTU6Y.js")).exportCmd,
-  usage: async () => (await import("./plugin-usage-TYF5HY4K.js")).usageCmd,
-  version: async () => (await import("./version-help-RBZC5GZZ.js")).versionCmd,
-  help: async () => (await import("./version-help-RBZC5GZZ.js")).helpCmd,
+  usage: async () => (await import("./plugin-usage-UWKYMNQU.js")).usageCmd,
+  version: async () => (await import("./version-help-X6CC4CFY.js")).versionCmd,
+  help: async () => (await import("./version-help-X6CC4CFY.js")).helpCmd,
   projects: async () => (await import("./projects-FWRJHW3S.js")).projectsCmd,
-  modeldiag: async () => (await import("./modeldiag-HDIKG37X.js")).modeldiagCmd,
+  modeldiag: async () => (await import("./modeldiag-5PBB777J.js")).modeldiagCmd,
   quick: async () => (await import("./quick-NPC3N3ZX.js")).quickCmd,
   bench: async () => (await import("./bench-NDYES33Y.js")).benchCmd,
   chronicle: async () => (await import("./chronicle-WBK3TJRB.js")).chronicleCmd,
-  hq: async () => (await import("./hq-JD5AZVMG.js")).hqCmd,
+  hq: async () => (await import("./hq-54PQYR5O.js")).hqCmd,
   mailbox: async () => (await import("./mailbox-serve-MMQCHOHI.js")).mailboxServeCmd,
   permissions: async () => (await import("./permissions-6YJ64W65.js")).permissionsCmd,
   project: async () => (await import("./project-V5KNTLV4.js")).projectCmd,
@@ -58,4 +58,4 @@ export {
   subcommands,
   subcommandNames
 };
-//# sourceMappingURL=chunk-GRAGMA4B.js.map
+//# sourceMappingURL=chunk-7BM4LGKQ.js.map

package/dist/{chunk-VAQXOZKP.js → chunk-AJM4EFCM.js}

@@ -1,6 +1,6 @@
 import {
   backupCurrent
-} from "./chunk-BIGSVBPI.js";
+} from "./chunk-KNYIEQAY.js";
 
 // src/wiring/external-plugins.ts
 import { isAbsolute, join, resolve } from "node:path";
@@ -345,7 +345,7 @@ import {
   resolvePluginTarget as resolvePluginTarget2,
   unpinPluginTrust
 } from "@wrongstack/core/plugin";
-import { atomicWrite } from "@wrongstack/core/utils";
+import { atomicWrite as atomicWrite2 } from "@wrongstack/core/utils";
 import {
   PLUGIN_AUDIT_ENTRIES
 } from "@wrongstack/plugins/plugin-audit-catalog";
@@ -420,6 +420,139 @@ function isRecord(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 
+// src/plugin-llm-command.ts
+import { atomicWrite } from "@wrongstack/core/utils";
+var PLUGIN_LLM_USAGE = [
+  "Usage:",
+  "  wstack plugin llm                               List every per-plugin LLM override.",
+  "  wstack plugin llm <plugin>                      Show one plugin's LLM override.",
+  "  wstack plugin llm <plugin> <provider> [model]   Route this plugin through a provider (and model).",
+  "  wstack plugin llm <plugin> - <model>            Keep the session provider, override only the model.",
+  "  wstack plugin llm <plugin> --clear              Remove the override (back to the session default).",
+  "",
+  "The override is stored as config.extensions.<plugin>.llm and is used by",
+  "every api.llm call the plugin makes. Without an override, plugins follow",
+  "the active session provider/model (the chat leader)."
+].join("\n");
+function renderPluginLlmOverviews(config, sessionDefault) {
+  const rows = [];
+  for (const [pluginName2, ext] of Object.entries(config.extensions ?? {})) {
+    const llm = ext?.["llm"];
+    if (llm && typeof llm === "object") {
+      const o = llm;
+      rows.push({
+        name: pluginName2,
+        provider: o.provider ?? "(session)",
+        model: o.model ?? "(session)"
+      });
+    }
+  }
+  const lines = [`Per-plugin LLM routing (session default: ${sessionDefault}):`];
+  if (rows.length === 0) {
+    lines.push(
+      "  No plugin overrides \u2014 every plugin follows the session default.",
+      "  Set one with: wstack plugin llm <plugin> <provider> [model]"
+    );
+  } else {
+    rows.sort((a, b) => a.name.localeCompare(b.name));
+    for (const r of rows) {
+      lines.push(`  ${r.name.padEnd(24)} provider=${r.provider.padEnd(16)} model=${r.model}`);
+    }
+    lines.push("", "Clear one with: wstack plugin llm <plugin> --clear");
+  }
+  return lines.join("\n");
+}
+async function runPluginLlmCommand(args, deps) {
+  const sessionDefault = `${deps.config.provider ?? "?"} / ${deps.config.model ?? "?"}`;
+  if (args.length === 0 || args[0] === "list") {
+    return {
+      code: 0,
+      level: "output",
+      message: renderPluginLlmOverviews(deps.config, sessionDefault)
+    };
+  }
+  const name = args[0];
+  if (!name || name.startsWith("-")) return errorResult(PLUGIN_LLM_USAGE);
+  const currentOverride = deps.config.extensions?.[name]?.["llm"];
+  if (args.length === 1) {
+    const lines = [`LLM routing for plugin "${name}":`];
+    if (currentOverride && typeof currentOverride === "object") {
+      const o = currentOverride;
+      lines.push(
+        `  override: provider=${o.provider ?? "(session)"} model=${o.model ?? "(session)"}`,
+        `  session default: ${sessionDefault}`
+      );
+    } else {
+      lines.push(
+        `  no override \u2014 follows the session default (${sessionDefault}).`,
+        `  Set one with: wstack plugin llm ${name} <provider> [model]`
+      );
+    }
+    return { code: 0, level: "output", message: lines.join("\n") };
+  }
+  const existing = await readConfig(deps.configPath);
+  const fileExtensions = isRecord(existing.extensions) ? existing.extensions : {};
+  const pluginExt = isRecord(fileExtensions[name]) ? { ...fileExtensions[name] } : {};
+  if (args[1] === "--clear" || args[1] === "clear") {
+    if (!("llm" in pluginExt) && !currentOverride) {
+      return { code: 0, level: "info", message: `Plugin "${name}" has no LLM override.` };
+    }
+    delete pluginExt["llm"];
+    if (Object.keys(pluginExt).length === 0) delete fileExtensions[name];
+    else fileExtensions[name] = pluginExt;
+    existing.extensions = fileExtensions;
+    await atomicWrite(deps.configPath, JSON.stringify(existing, null, 2), { mode: 384 });
+    const merged2 = mergeExtensionsForPatch(deps.config, fileExtensions);
+    const mergedEntry = merged2[name];
+    if (mergedEntry) {
+      delete mergedEntry["llm"];
+      if (Object.keys(mergedEntry).length === 0) delete merged2[name];
+    }
+    return {
+      code: 0,
+      level: "info",
+      message: `Cleared LLM override for "${name}" \u2014 it now follows the session default (${sessionDefault}). Takes effect immediately for api.llm calls.`,
+      patch: { extensions: merged2 }
+    };
+  }
+  const providerArg = args[1];
+  const modelArg = args[2];
+  if (!providerArg || providerArg.startsWith("--")) return errorResult(PLUGIN_LLM_USAGE);
+  const provider = providerArg === "-" ? void 0 : providerArg;
+  const model = modelArg && modelArg !== "-" ? modelArg : void 0;
+  if (!provider && !model) return errorResult(PLUGIN_LLM_USAGE);
+  const llm = {};
+  if (provider) llm["provider"] = provider;
+  if (model) llm["model"] = model;
+  pluginExt["llm"] = llm;
+  fileExtensions[name] = pluginExt;
+  existing.extensions = fileExtensions;
+  await atomicWrite(deps.configPath, JSON.stringify(existing, null, 2), { mode: 384 });
+  const configured = Object.keys(deps.config.providers ?? {});
+  const note = provider && configured.length > 0 && !configured.includes(provider) ? `
+Note: "${provider}" is not in config.providers (configured: ${configured.join(", ")}). Catalog providers (anthropic, openai, \u2026) still resolve if credentials are available.` : "";
+  const merged = mergeExtensionsForPatch(deps.config, fileExtensions);
+  return {
+    code: 0,
+    level: "info",
+    message: `Plugin "${name}" now routes api.llm calls via provider=${provider ?? "(session)"} model=${model ?? "(session)"}. Session default stays ${sessionDefault}. Takes effect immediately for api.llm calls.${note}`,
+    patch: { extensions: merged }
+  };
+}
+function mergeExtensionsForPatch(config, fileExtensions) {
+  const merged = {};
+  for (const [k, v] of Object.entries(config.extensions ?? {})) {
+    merged[k] = { ...v };
+  }
+  for (const [k, v] of Object.entries(fileExtensions)) {
+    if (isRecord(v)) merged[k] = { ...merged[k] ?? {}, ...v };
+  }
+  for (const k of Object.keys(merged)) {
+    if (!(k in fileExtensions) && !(k in (config.extensions ?? {}))) delete merged[k];
+  }
+  return merged;
+}
+
 // src/plugin-package-install.ts
 import { execFile } from "node:child_process";
 import * as fs2 from "node:fs/promises";
@@ -710,7 +843,7 @@ ${locked.map((name2) => `  ${name2}`).join("\n")}`
   const next = action === "lock" ? current.some((entry) => canonicalPolicyName(entry) === canonical) ? current : [...current, name] : current.filter((entry) => canonicalPolicyName(entry) !== canonical);
   const pluginManager = { locked: next };
   existing.pluginManager = { ...filePolicy ?? {}, ...pluginManager };
-  await atomicWrite(deps.configPath, JSON.stringify(existing, null, 2), { mode: 384 });
+  await atomicWrite2(deps.configPath, JSON.stringify(existing, null, 2), { mode: 384 });
   return {
     code: 0,
     level: "info",
@@ -722,136 +855,6 @@ function canonicalPolicyName(name) {
   if (name === "*") return name;
   return resolvePluginToggleSpecifier(name).trim().toLowerCase();
 }
-var PLUGIN_LLM_USAGE = [
-  "Usage:",
-  "  wstack plugin llm                               List every per-plugin LLM override.",
-  "  wstack plugin llm <plugin>                      Show one plugin's LLM override.",
-  "  wstack plugin llm <plugin> <provider> [model]   Route this plugin through a provider (and model).",
-  "  wstack plugin llm <plugin> - <model>            Keep the session provider, override only the model.",
-  "  wstack plugin llm <plugin> --clear              Remove the override (back to the session default).",
-  "",
-  "The override is stored as config.extensions.<plugin>.llm and is used by",
-  "every api.llm call the plugin makes. Without an override, plugins follow",
-  "the active session provider/model (the chat leader)."
-].join("\n");
-function renderPluginLlmOverviews(config, sessionDefault) {
-  const rows = [];
-  for (const [pluginName2, ext] of Object.entries(config.extensions ?? {})) {
-    const llm = ext?.["llm"];
-    if (llm && typeof llm === "object") {
-      const o = llm;
-      rows.push({
-        name: pluginName2,
-        provider: o.provider ?? "(session)",
-        model: o.model ?? "(session)"
-      });
-    }
-  }
-  const lines = [`Per-plugin LLM routing (session default: ${sessionDefault}):`];
-  if (rows.length === 0) {
-    lines.push(
-      "  No plugin overrides \u2014 every plugin follows the session default.",
-      "  Set one with: wstack plugin llm <plugin> <provider> [model]"
-    );
-  } else {
-    rows.sort((a, b) => a.name.localeCompare(b.name));
-    for (const r of rows) {
-      lines.push(`  ${r.name.padEnd(24)} provider=${r.provider.padEnd(16)} model=${r.model}`);
-    }
-    lines.push("", "Clear one with: wstack plugin llm <plugin> --clear");
-  }
-  return lines.join("\n");
-}
-async function runPluginLlmCommand(args, deps) {
-  const sessionDefault = `${deps.config.provider ?? "?"} / ${deps.config.model ?? "?"}`;
-  if (args.length === 0 || args[0] === "list") {
-    return {
-      code: 0,
-      level: "output",
-      message: renderPluginLlmOverviews(deps.config, sessionDefault)
-    };
-  }
-  const name = args[0];
-  if (!name || name.startsWith("-")) return errorResult(PLUGIN_LLM_USAGE);
-  const currentOverride = deps.config.extensions?.[name]?.["llm"];
-  if (args.length === 1) {
-    const lines = [`LLM routing for plugin "${name}":`];
-    if (currentOverride && typeof currentOverride === "object") {
-      const o = currentOverride;
-      lines.push(
-        `  override: provider=${o.provider ?? "(session)"} model=${o.model ?? "(session)"}`,
-        `  session default: ${sessionDefault}`
-      );
-    } else {
-      lines.push(
-        `  no override \u2014 follows the session default (${sessionDefault}).`,
-        `  Set one with: wstack plugin llm ${name} <provider> [model]`
-      );
-    }
-    return { code: 0, level: "output", message: lines.join("\n") };
-  }
-  const existing = await readConfig(deps.configPath);
-  const fileExtensions = isRecord(existing.extensions) ? existing.extensions : {};
-  const pluginExt = isRecord(fileExtensions[name]) ? { ...fileExtensions[name] } : {};
-  if (args[1] === "--clear" || args[1] === "clear") {
-    if (!("llm" in pluginExt) && !currentOverride) {
-      return { code: 0, level: "info", message: `Plugin "${name}" has no LLM override.` };
-    }
-    delete pluginExt["llm"];
-    if (Object.keys(pluginExt).length === 0) delete fileExtensions[name];
-    else fileExtensions[name] = pluginExt;
-    existing.extensions = fileExtensions;
-    await atomicWrite(deps.configPath, JSON.stringify(existing, null, 2), { mode: 384 });
-    const merged2 = mergeExtensionsForPatch(deps.config, fileExtensions);
-    const mergedEntry = merged2[name];
-    if (mergedEntry) {
-      delete mergedEntry["llm"];
-      if (Object.keys(mergedEntry).length === 0) delete merged2[name];
-    }
-    return {
-      code: 0,
-      level: "info",
-      message: `Cleared LLM override for "${name}" \u2014 it now follows the session default (${sessionDefault}). Takes effect immediately for api.llm calls.`,
-      patch: { extensions: merged2 }
-    };
-  }
-  const providerArg = args[1];
-  const modelArg = args[2];
-  if (!providerArg || providerArg.startsWith("--")) return errorResult(PLUGIN_LLM_USAGE);
-  const provider = providerArg === "-" ? void 0 : providerArg;
-  const model = modelArg && modelArg !== "-" ? modelArg : void 0;
-  if (!provider && !model) return errorResult(PLUGIN_LLM_USAGE);
-  const llm = {};
-  if (provider) llm["provider"] = provider;
-  if (model) llm["model"] = model;
-  pluginExt["llm"] = llm;
-  fileExtensions[name] = pluginExt;
-  existing.extensions = fileExtensions;
-  await atomicWrite(deps.configPath, JSON.stringify(existing, null, 2), { mode: 384 });
-  const configured = Object.keys(deps.config.providers ?? {});
-  const note = provider && configured.length > 0 && !configured.includes(provider) ? `
-Note: "${provider}" is not in config.providers (configured: ${configured.join(", ")}). Catalog providers (anthropic, openai, \u2026) still resolve if credentials are available.` : "";
-  const merged = mergeExtensionsForPatch(deps.config, fileExtensions);
-  return {
-    code: 0,
-    level: "info",
-    message: `Plugin "${name}" now routes api.llm calls via provider=${provider ?? "(session)"} model=${model ?? "(session)"}. Session default stays ${sessionDefault}. Takes effect immediately for api.llm calls.${note}`,
-    patch: { extensions: merged }
-  };
-}
-function mergeExtensionsForPatch(config, fileExtensions) {
-  const merged = {};
-  for (const [k, v] of Object.entries(config.extensions ?? {})) {
-    merged[k] = { ...v };
-  }
-  for (const [k, v] of Object.entries(fileExtensions)) {
-    if (isRecord(v)) merged[k] = { ...merged[k] ?? {}, ...v };
-  }
-  for (const k of Object.keys(merged)) {
-    if (!(k in fileExtensions) && !(k in (config.extensions ?? {}))) delete merged[k];
-  }
-  return merged;
-}
 function resolvePluginSpecifier(input) {
   return OFFICIAL_ALIASES.get(input.toLowerCase()) ?? input;
 }
@@ -1014,7 +1017,7 @@ async function togglePlugin(spec, deps) {
   };
   existing.plugins = nextPlugins;
   existing.features = features;
-  await atomicWrite(deps.configPath, JSON.stringify(existing, null, 2), { mode: 384 });
+  await atomicWrite2(deps.configPath, JSON.stringify(existing, null, 2), { mode: 384 });
   const restartRequired = spec === "branch-guard" && !nextEnabled ? void 0 : true;
   return {
     code: 0,
@@ -1032,7 +1035,7 @@ async function removePlugin(spec, deps) {
     return errorResult(`Plugin "${spec}" not in config.`);
   }
   existing.plugins = next;
-  await atomicWrite(deps.configPath, JSON.stringify(existing, null, 2), { mode: 384 });
+  await atomicWrite2(deps.configPath, JSON.stringify(existing, null, 2), { mode: 384 });
   return {
     code: 0,
     level: "info",
@@ -1136,4 +1139,4 @@ export {
   PLUGIN_AUDIT_ENTRIES,
   runPluginManagementCommand
 };
-//# sourceMappingURL=chunk-VAQXOZKP.js.map
+//# sourceMappingURL=chunk-AJM4EFCM.js.map

package/dist/{chunk-C2BBH4S4.js → chunk-E3MJFAFR.js}

@@ -1,7 +1,7 @@
 import {
   appendHistory,
   backupCurrent
-} from "./chunk-BIGSVBPI.js";
+} from "./chunk-KNYIEQAY.js";
 
 // src/settings-menu.ts
 import * as fs from "node:fs/promises";
@@ -246,4 +246,4 @@ export {
   persistTelegramConfig,
   deriveFsAccessPair
 };
-//# sourceMappingURL=chunk-C2BBH4S4.js.map
+//# sourceMappingURL=chunk-E3MJFAFR.js.map

package/dist/{chunk-5TRZZHMN.js → chunk-JCZ2D3VV.js}

@@ -147,64 +147,6 @@ function renderPayloadPreview(input) {
   return typeof diff === "string" && diff ? clipPreview(diff, diffLineStyle) : "";
 }
 
-// src/boot/restricted-mode.ts
-import { lockToProjectRoot, lockYoloOff, ToolCapabilities } from "@wrongstack/core/security";
-var RESTRICTED_ENV = "WRONGSTACK_RESTRICTED";
-var RESTRICTED_DENY_CAPABILITIES = [
-  ToolCapabilities.SHELL_ARBITRARY,
-  ToolCapabilities.SHELL_RESTRICTED,
-  ToolCapabilities.SHELL_EXEC,
-  ToolCapabilities.NET_OUTBOUND,
-  ToolCapabilities.PACKAGE_INSTALL,
-  ToolCapabilities.CONFIG_MUTATE,
-  ToolCapabilities.FS_WRITE_OUTSIDE_PROJECT,
-  ToolCapabilities.TOOL_MUTATE_ANY,
-  ToolCapabilities.MCP_PROXY
-];
-var CONFLICTING_FLAGS = [
-  "yolo",
-  "yolo-plus",
-  "yolo-destructive",
-  "full-auto",
-  "mcp-config",
-  // Pre-approving a tool would let writes skip the prompt this mode promises.
-  "allowed-tools"
-];
-function isRestrictedMode(flags) {
-  return flags["restricted"] === true || process.env[RESTRICTED_ENV] === "1";
-}
-function validateRestrictedMode(flags) {
-  if (!isRestrictedMode(flags)) return false;
-  const conflict = CONFLICTING_FLAGS.find(
-    (name) => flags[name] !== void 0 && flags[name] !== false
-  );
-  if (conflict) throw new Error(`--${conflict} cannot be combined with --restricted`);
-  return true;
-}
-function withRestrictedTools(restriction, restricted) {
-  if (!restricted) return restriction;
-  return {
-    ...restriction?.only ? { only: restriction.only } : {},
-    deny: [...restriction?.deny ?? [], "mcp__*"],
-    denyCapabilities: RESTRICTED_DENY_CAPABILITIES,
-    requireDeclaredCapabilities: true
-  };
-}
-var RESTRICTED_NOTICE = "Restricted mode: no shell, network, installs or MCP tools; files stay inside the project; YOLO is off.";
-var announced = false;
-function activateRestrictedMode(flags, write) {
-  if (!validateRestrictedMode(flags)) return false;
-  lockToProjectRoot();
-  lockYoloOff();
-  process.env[RESTRICTED_ENV] = "1";
-  if (!announced) {
-    announced = true;
-    write(`${RESTRICTED_NOTICE}
-`);
-  }
-  return true;
-}
-
 // src/boot/safe-mode.ts
 var SAFE_MODE_ENV = "WRONGSTACK_SAFE_MODE";
 function isSafeMode(flags) {
@@ -216,11 +158,11 @@ function propagateSafeMode(flags) {
   return on;
 }
 var SAFE_MODE_NOTICE = "Safe mode: third-party plugins, hooks, configured MCP servers, skills and instruction overrides are off.";
-var announced2 = false;
+var announced = false;
 function announceSafeMode(flags, write) {
   const on = propagateSafeMode(flags);
-  if (on && !announced2) {
-    announced2 = true;
+  if (on && !announced) {
+    announced = true;
     write(`${SAFE_MODE_NOTICE}
 `);
   }
@@ -597,9 +539,6 @@ export {
   resolveLaunchAllowedTools,
   resolveToolRestriction,
   unknownRestrictedToolNames,
-  isRestrictedMode,
-  withRestrictedTools,
-  activateRestrictedMode,
   isSafeMode,
   announceSafeMode,
   isSimpleUiFullAuto,
@@ -608,4 +547,4 @@ export {
   detectProjectFacts,
   renderAgentsTemplate
 };
-//# sourceMappingURL=chunk-5TRZZHMN.js.map
+//# sourceMappingURL=chunk-JCZ2D3VV.js.map