@wrongstack/core 0.276.3 → 0.277.0

package/dist/kernel/index.d.ts

@@ -1,20 +1,20 @@
-import { T as Token, a as Renderer, S as SystemPromptBuilder, H as HookRegistry } from '../pipeline-Dl6XbfE7.js';
-export { d as BindOptions, C as Container, D as Decorator, F as Factory, b as Middleware, M as MiddlewareHandler, N as NextFn, P as Pipeline, e as PipelineOptions } from '../pipeline-Dl6XbfE7.js';
-import { c as MemoryStore, B as BrainArbiter } from '../brain-BLOyN5ZP.js';
-export { E as EventBus, m as EventLogger, n as EventMap, a as EventName, L as Listener, v as ScopedEventBus } from '../brain-BLOyN5ZP.js';
-import { C as Compactor } from '../compactor-DcBpaJsI.js';
-import { j as ConfigLoader, l as ConfigStore, M as ModelsRegistry } from '../config-Bf5mj-ad.js';
-import { E as ErrorHandler, R as RetryPolicy } from '../retry-policy-Dt3_z8Aj.js';
+import { T as Token, a as Renderer, S as SystemPromptBuilder, H as HookRegistry } from '../pipeline-CEjBjzVA.js';
+export { d as BindOptions, C as Container, D as Decorator, F as Factory, b as Middleware, M as MiddlewareHandler, N as NextFn, P as Pipeline, e as PipelineOptions } from '../pipeline-CEjBjzVA.js';
+import { c as MemoryStore, B as BrainArbiter } from '../brain-CCfuEOdp.js';
+export { E as EventBus, m as EventLogger, n as EventMap, a as EventName, L as Listener, v as ScopedEventBus } from '../brain-CCfuEOdp.js';
+import { C as Compactor } from '../compactor-D3BGw26y.js';
+import { j as ConfigLoader, l as ConfigStore, M as ModelsRegistry } from '../config-DAOjriz9.js';
+import { E as ErrorHandler, R as RetryPolicy } from '../retry-policy-Git9WF6d.js';
 import { I as InputReader } from '../input-reader-E-ffP2ee.js';
 import { L as Logger } from '../logger-B63L5bTg.js';
 import { M as ModeStore } from '../mode-CZlO9iU1.js';
 import { P as PathResolver } from '../path-resolver-CPRj4bFY.js';
-import { P as PermissionPolicy, S as SecretScrubber } from '../permission-BCbQDR2s.js';
-import { P as ProviderRunner } from '../provider-runner-DZ808MSM.js';
-import { e as TokenCounter, k as SessionStore } from '../context-CLnUMW5g.js';
+import { P as PermissionPolicy, S as SecretScrubber } from '../permission-DbsGOA1C.js';
+import { P as ProviderRunner } from '../provider-runner-CnOSr5BN.js';
+import { e as TokenCounter, k as SessionStore } from '../context-DPlA6kid.js';
 import { P as PromptLoader } from '../prompt-DLd35n4Q.js';
 import { S as SkillLoader } from '../skill-DGIXCtdv.js';
-import { W as WorktreeManager } from '../worktree-manager-DBdl_5rs.js';
+import { W as WorktreeManager } from '../worktree-manager-C4YIf1Fa.js';
 import '../mailbox-types-DTl7bRH3.js';
 import '../observability-D-HZN_mF.js';
 

package/dist/{mcp-servers-CuZGf9fI.d.ts → mcp-servers-CFb60-pH.d.ts}

@@ -1,6 +1,6 @@
-import { C as Compactor } from './compactor-DcBpaJsI.js';
-import { M as Message, T as Tool } from './context-CLnUMW5g.js';
-import { c as MCPServerConfig } from './config-Bf5mj-ad.js';
+import { C as Compactor } from './compactor-D3BGw26y.js';
+import { M as Message, T as Tool } from './context-DPlA6kid.js';
+import { c as MCPServerConfig } from './config-DAOjriz9.js';
 
 type ContextManagerAction = 'check' | 'summary' | 'prune' | 'add_note' | 'compact' | 'repair';
 interface ContextManagerInput {

package/dist/models/index.d.ts

@@ -1,8 +1,8 @@
-export { D as DefaultModelsRegistry, a as DefaultModelsRegistryOptions, c as classifyFamily } from '../models-registry-8XOdxWQu.js';
-export { C as CODEX_MODELS, a as CodexModelMeta, D as DefaultModeStore, L as LLMSelector, b as LLMSelectorOptions, M as ModeLoaderOptions, P as ProviderModelDescriptor, c as codexModelMeta, d as describeCatalogModel, l as loadProjectModes, e as loadUserModes, r as resolveProviderModelList } from '../provider-model-resolve-B70epO19.js';
-import { d as ModelMatrixEntry, P as ProviderConfig } from '../config-Bf5mj-ad.js';
-import '../context-CLnUMW5g.js';
-import '../selector-BCkWgdwy.js';
+export { D as DefaultModelsRegistry, a as DefaultModelsRegistryOptions, c as classifyFamily } from '../models-registry-5Ufn7f2m.js';
+export { C as CODEX_MODELS, a as CodexModelMeta, D as DefaultModeStore, L as LLMSelector, b as LLMSelectorOptions, M as ModeLoaderOptions, P as ProviderModelDescriptor, c as codexModelMeta, d as describeCatalogModel, l as loadProjectModes, e as loadUserModes, r as resolveProviderModelList } from '../provider-model-resolve-BpfXp3Jj.js';
+import { d as ModelMatrixEntry, P as ProviderConfig } from '../config-DAOjriz9.js';
+import '../context-DPlA6kid.js';
+import '../selector-Cq72C0Oy.js';
 import '../mode-CZlO9iU1.js';
 
 /**

package/dist/{models-registry-8XOdxWQu.d.ts → models-registry-5Ufn7f2m.d.ts}

@@ -1,4 +1,4 @@
-import { M as ModelsRegistry, a as ModelsDevPayload, R as ResolvedProvider, b as ResolvedModel, W as WireFamily } from './config-Bf5mj-ad.js';
+import { M as ModelsRegistry, a as ModelsDevPayload, R as ResolvedProvider, b as ResolvedModel, W as WireFamily } from './config-DAOjriz9.js';
 
 interface DefaultModelsRegistryOptions {
     cacheFile: string;

package/dist/{multi-agent-coordinator-CiRtKVTk.d.ts → multi-agent-coordinator-CcrcncvG.d.ts}

@@ -1,4 +1,4 @@
-import { S as SubagentConfig, M as MultiAgentCoordinator, c as MultiAgentConfig, d as SubagentRunner, e as BudgetSessionIdSource, F as FleetBus, f as SpawnResult, T as TaskSpec, a as BridgeMessage, A as AgentBridge, C as CoordinatorStatus, g as TaskResult } from './agent-subagent-runner-CEuw4ATz.js';
+import { S as SubagentConfig, M as MultiAgentCoordinator, c as MultiAgentConfig, d as SubagentRunner, e as BudgetSessionIdSource, F as FleetBus, f as SpawnResult, T as TaskSpec, a as BridgeMessage, A as AgentBridge, C as CoordinatorStatus, g as TaskResult } from './agent-subagent-runner-BimKihiC.js';
 import { EventEmitter } from 'node:events';
 
 /**

package/dist/{null-fleet-bus-d9G-bVy9.d.ts → null-fleet-bus-C9KsYyrI.d.ts}

@@ -1,12 +1,12 @@
-import { A as AgentPhase, b as AgentDefinition, a as DefaultMultiAgentCoordinator, D as DispatchClassifier } from './multi-agent-coordinator-CiRtKVTk.js';
-import { F as FleetBus, j as FleetUsage, S as SubagentConfig, k as FleetUsageAggregator, g as TaskResult, C as CoordinatorStatus, T as TaskSpec, c as MultiAgentConfig, d as SubagentRunner } from './agent-subagent-runner-CEuw4ATz.js';
-import { b as SessionWriter, T as Tool, k as SessionStore } from './context-CLnUMW5g.js';
-import { B as BrainArbiter, E as EventBus } from './brain-BLOyN5ZP.js';
+import { A as AgentPhase, b as AgentDefinition, a as DefaultMultiAgentCoordinator, D as DispatchClassifier } from './multi-agent-coordinator-CcrcncvG.js';
+import { F as FleetBus, j as FleetUsage, S as SubagentConfig, k as FleetUsageAggregator, g as TaskResult, C as CoordinatorStatus, T as TaskSpec, c as MultiAgentConfig, d as SubagentRunner } from './agent-subagent-runner-BimKihiC.js';
+import { b as SessionWriter, T as Tool, k as SessionStore } from './context-DPlA6kid.js';
+import { B as BrainArbiter, E as EventBus } from './brain-CCfuEOdp.js';
 import { EventEmitter } from 'node:events';
 import { L as Logger } from './logger-B63L5bTg.js';
 import { D as DirectorStateSnapshot } from './director-state-BfeCUbmk.js';
-import { d as ModelMatrixEntry } from './config-Bf5mj-ad.js';
-import { I as InMemoryAgentBridge } from './agent-bridge-D7A-eu3C.js';
+import { d as ModelMatrixEntry } from './config-DAOjriz9.js';
+import { I as InMemoryAgentBridge } from './agent-bridge-BFJ2ODzI.js';
 
 /**
  * Alert levels the Director can emit when a collab session needs attention.
@@ -518,6 +518,8 @@ declare class FleetManager implements IFleetManager {
     private readonly stateCheckpoint;
     private readonly sessionWriter;
     private manifestTimer;
+    private manifestWriteChain;
+    private disposed;
     private readonly manifestDebounceMs;
     /** Fleet-wide cost cap. Infinity = no cap. Distinct from SubagentBudget limits,
      *  which track per-subagent spend — this field caps the entire fleet total. */
@@ -600,6 +602,7 @@ declare class FleetManager implements IFleetManager {
         cacheWrite?: number | undefined;
     }): void;
     writeManifest(): Promise<string | null>;
+    private writeManifestNow;
     /**
      * Attach task ids to an already-spawned subagent. Called by
      * `Director.assign()` after the coordinator assigns a task.
@@ -616,6 +619,7 @@ declare class FleetManager implements IFleetManager {
      * Clears any pending debounce timer before writing.
      */
     flushManifest(): Promise<void>;
+    private clearManifestTimer;
     /** Best-effort session event writer. Swallows failures. */
     private appendSessionEvent;
     addPendingTask(taskId: string, subagentId: string, description: string): void;
@@ -1110,6 +1114,7 @@ declare class Director implements ICoordinator {
     private readonly sessionIdSource;
     /** Debounce timer for periodic manifest writes. */
     private manifestTimer;
+    private manifestWriteChain;
     private readonly manifestDebounceMs;
     /** Fleet-wide cost cap (entire fleet total, distinct from SubagentBudget limits). Infinity means no cap. */
     private readonly maxFleetCostUsd;
@@ -1264,6 +1269,7 @@ declare class Director implements ICoordinator {
      *  collapses into one write. Set `manifestDebounceMs` to 0 to write
      *  synchronously (no debounce); set to negative to disable entirely. */
     private scheduleManifest;
+    private clearManifestTimer;
     /**
      * Spawn a subagent. Identical to the coordinator's `spawn()` but
      * captures provider/model metadata for the usage aggregator and
@@ -1312,6 +1318,7 @@ declare class Director implements ICoordinator {
      * replay an entire director run.
      */
     writeManifest(): Promise<string | null>;
+    private writeManifestNow;
     /**
      * Tear down the director: stop every subagent, close every bridge
      * endpoint, and (when configured) write the final manifest. Idempotent

package/dist/observability/index.d.ts

@@ -1,6 +1,6 @@
 import { M as MetricsSink, d as MetricLabels, f as MetricsSnapshot, H as HealthRegistry, a as HealthCheck, A as AggregateHealth, T as Tracer, S as Span } from '../observability-D-HZN_mF.js';
-import { E as EventBus } from '../brain-BLOyN5ZP.js';
-import '../context-CLnUMW5g.js';
+import { E as EventBus } from '../brain-CCfuEOdp.js';
+import '../context-DPlA6kid.js';
 
 /**
  * In-memory metrics sink. Suitable for embedded use, tests, and /metrics

package/dist/{path-resolver-BhIb6mtd.d.ts → path-resolver-CEeX9I7O.d.ts}

@@ -1,6 +1,6 @@
-import { E as EventBus } from './brain-BLOyN5ZP.js';
-import { M as ModelsRegistry, b as ResolvedModel } from './config-Bf5mj-ad.js';
-import { e as TokenCounter, U as Usage, f as CacheStats } from './context-CLnUMW5g.js';
+import { E as EventBus } from './brain-CCfuEOdp.js';
+import { M as ModelsRegistry, b as ResolvedModel } from './config-DAOjriz9.js';
+import { e as TokenCounter, U as Usage, f as CacheStats } from './context-DPlA6kid.js';
 import { P as PathResolver } from './path-resolver-CPRj4bFY.js';
 
 /**

package/dist/{permission-BCbQDR2s.d.ts → permission-DbsGOA1C.d.ts}

@@ -1,4 +1,4 @@
-import { T as Tool, C as Context, h as Permission } from './context-CLnUMW5g.js';
+import { T as Tool, C as Context, h as Permission } from './context-DPlA6kid.js';
 
 interface SecretScrubber {
     scrub(text: string): string;
@@ -43,8 +43,9 @@ interface PermissionPolicy {
         pattern: string;
     }): void;
     /**
-     * Auto-approve this tool+pattern for the remainder of the session (no persistence).
-     * Used when user presses 'y' — prevents LLM retry from re-triggering confirm.
+     * Auto-approve this tool+pattern once (no persistence). Used when user
+     * presses 'y' so the immediate confirmed re-run can proceed without making
+     * future destructive calls silent.
      */
     allowOnce(rule: {
         tool: string;
@@ -55,13 +56,13 @@ interface PermissionPolicy {
     getYolo?(): boolean;
     /** Optional runtime setter for policies that support leader YOLO toggling. */
     setYolo?(enabled: boolean): void;
-    /** Optional runtime query for the destructive YOLO override. */
+    /** Optional runtime query for the deprecated destructive YOLO override. */
     getYoloDestructive?(): boolean;
-    /** Optional runtime setter for the destructive YOLO override. */
+    /** Optional runtime setter for the deprecated destructive YOLO override. */
     setYoloDestructive?(enabled: boolean): void;
     /** Query whether destructive-operation confirmation gate is active. */
     getConfirmDestructive?(): boolean;
-    /** Enable/disable destructive-operation confirmation (only meaningful in yolo mode). */
+    /** Compatibility setter; current default policy keeps the gate enabled in YOLO mode. */
     setConfirmDestructive?(enabled: boolean): void;
     /** Set the prompt delegate (optional). */
     setPromptDelegate?(delegate: ((tool: Tool, input: unknown, suggestedPattern: string) => Promise<'yes' | 'no' | 'always' | 'deny'>) | undefined): void;

package/dist/{permission-policy-C0ikndX_.d.ts → permission-policy-BpEea3r7.d.ts}

@@ -1,23 +1,20 @@
-import { T as Tool, C as Context } from './context-CLnUMW5g.js';
+import { T as Tool, C as Context } from './context-DPlA6kid.js';
 import { I as InputReader } from './input-reader-E-ffP2ee.js';
-import { P as PermissionPolicy, a as PermissionDecision } from './permission-BCbQDR2s.js';
+import { P as PermissionPolicy, a as PermissionDecision } from './permission-DbsGOA1C.js';
 
 interface PermissionPolicyOptions {
     trustFile: string;
     yolo?: boolean | undefined;
     /**
-     * When true, YOLO mode auto-approves even destructive calls without confirm.
-     * @deprecated YOLO now auto-approves everything by default. Use `confirmDestructive`
-     *   to opt back into destructive-operation confirmation prompts.
+     * @deprecated Kept for CLI compatibility only. YOLO no longer bypasses
+     *   destructive-operation confirmation.
      */
     yoloDestructive?: boolean | undefined;
     /** @deprecated Use `yoloDestructive`. */
     forceAllYolo?: boolean | undefined;
     /**
-     * When true AND yolo is true, destructive operations still require confirmation.
-     * This is the opt-in safety net: set this if you want YOLO for normal work but
-     * explicit approval for `rm -rf`, project-escaping writes, etc.
-     * Has no effect when yolo is false (normal permission flow applies).
+     * @deprecated Destructive confirmation is always enabled in YOLO mode.
+     * Kept for compatibility with older callers.
      */
     confirmDestructive?: boolean | undefined;
     promptDelegate?: (tool: Tool, input: unknown, suggestedPattern: string) => Promise<'yes' | 'no' | 'always' | 'deny'>;
@@ -40,9 +37,10 @@ declare class DefaultPermissionPolicy implements PermissionPolicy {
      */
     private sessionDenied;
     /**
-     * Session-scoped "soft trust" map. When the user presses 'a' (allow once),
-     * the tool+pattern is added here. If the LLM retries in the same session,
-     * we return auto directly without asking again.
+     * Session-scoped one-shot "soft trust" map. When the user presses 'y', the
+     * tool+pattern is added here so the immediate confirm re-run can proceed.
+     * The entry is consumed on first use; future calls must ask again unless the
+     * user chose persistent trust.
      *
      * Cleared on reload().
      */
@@ -94,7 +92,7 @@ declare class DefaultPermissionPolicy implements PermissionPolicy {
     /** Check whether the destructive YOLO override is active. */
     getYoloDestructive(): boolean;
     /** Toggle destructive confirmation gate (only meaningful when yolo is active). */
-    setConfirmDestructive(enabled: boolean): void;
+    setConfirmDestructive(_enabled: boolean): void;
     /** Check whether destructive confirmation gate is active. */
     getConfirmDestructive(): boolean;
     reload(): Promise<void>;
@@ -115,7 +113,7 @@ declare class DefaultPermissionPolicy implements PermissionPolicy {
         tool: string;
         pattern: string;
     }): void;
-    /** Auto-approve this tool+pattern for the rest of this session (no trust file). */
+    /** Auto-approve this tool+pattern once (no trust file). */
     allowOnce(rule: {
         tool: string;
         pattern: string;

package/dist/{pipeline-Dl6XbfE7.d.ts → pipeline-CEjBjzVA.d.ts}

@@ -1,6 +1,6 @@
-import { T as Tool, r as TextBlock, i as ContentBlock } from './context-CLnUMW5g.js';
+import { T as Tool, r as TextBlock, i as ContentBlock } from './context-DPlA6kid.js';
 import { a as MailboxAgentStatus } from './mailbox-types-DTl7bRH3.js';
-import { H as HookEvent, f as HookMatcher, I as InProcessHook, S as ShellHook, g as HookEntry, T as ToolResultRenderMode } from './config-Bf5mj-ad.js';
+import { H as HookEvent, f as HookMatcher, I as InProcessHook, S as ShellHook, g as HookEntry, T as ToolResultRenderMode } from './config-DAOjriz9.js';
 
 /** Model capabilities relevant to prompt composition. */
 interface ModelCapabilities {

package/dist/{provider-model-resolve-B70epO19.d.ts → provider-model-resolve-BpfXp3Jj.d.ts}

@@ -1,7 +1,7 @@
-import { P as Provider, M as Message } from './context-CLnUMW5g.js';
-import { M as MessageSelector, S as SelectorResult } from './selector-BCkWgdwy.js';
+import { P as Provider, M as Message } from './context-DPlA6kid.js';
+import { M as MessageSelector, S as SelectorResult } from './selector-Cq72C0Oy.js';
 import { M as ModeStore, a as ModeConfig, b as Mode } from './mode-CZlO9iU1.js';
-import { e as ModelsDevModel, R as ResolvedProvider } from './config-Bf5mj-ad.js';
+import { e as ModelsDevModel, R as ResolvedProvider } from './config-DAOjriz9.js';
 
 /**
  * Offline **floor** for the ChatGPT "Sign in with ChatGPT" (`openai-codex`)

package/dist/{provider-runner-DZ808MSM.d.ts → provider-runner-CnOSr5BN.d.ts}

@@ -1,8 +1,8 @@
-import { E as EventBus } from './brain-BLOyN5ZP.js';
+import { E as EventBus } from './brain-CCfuEOdp.js';
 import { L as Logger } from './logger-B63L5bTg.js';
 import { T as Tracer } from './observability-D-HZN_mF.js';
-import { P as Provider, c as Request, C as Context, d as Response } from './context-CLnUMW5g.js';
-import { R as RetryPolicy } from './retry-policy-Dt3_z8Aj.js';
+import { P as Provider, c as Request, C as Context, d as Response } from './context-DPlA6kid.js';
+import { R as RetryPolicy } from './retry-policy-Git9WF6d.js';
 
 /**
  * Options passed to a ProviderRunner when calling the provider.

package/dist/{retry-policy-Dt3_z8Aj.d.ts → retry-policy-Git9WF6d.d.ts}

@@ -1,4 +1,4 @@
-import { C as Context, d as Response, g as ProviderError } from './context-CLnUMW5g.js';
+import { C as Context, d as Response, g as ProviderError } from './context-DPlA6kid.js';
 
 type RecoveryDecision = {
     /**

package/dist/sdd/index.d.ts

@@ -1,17 +1,17 @@
 import { h as Specification, e as SpecStatus, S as SpecAnalysis, g as SpecValidationResult, f as SpecTemplate, b as SpecRequirement } from '../spec-TBi3Jr6T.js';
 import { d as TaskGraph, e as TaskNode, i as TaskFilter, j as TaskSort, c as TaskProgress, T as TaskType, a as TaskPriority } from '../task-graph-u1q9Jkyk.js';
-import { E as EventBus, B as BrainArbiter } from '../brain-BLOyN5ZP.js';
-import { h as Agent, i as AgentFactory, g as TaskResult, D as DoneCondition } from '../agent-subagent-runner-CEuw4ATz.js';
-import { W as WorktreeManager } from '../worktree-manager-DBdl_5rs.js';
-import '../context-CLnUMW5g.js';
-import '../index-Cn0NOshr.js';
+import { E as EventBus, B as BrainArbiter } from '../brain-CCfuEOdp.js';
+import { h as Agent, i as AgentFactory, g as TaskResult, D as DoneCondition } from '../agent-subagent-runner-BimKihiC.js';
+import { W as WorktreeManager } from '../worktree-manager-C4YIf1Fa.js';
+import '../context-DPlA6kid.js';
+import '../index-DJXj-dcr.js';
 import '../logger-B63L5bTg.js';
-import '../pipeline-Dl6XbfE7.js';
+import '../pipeline-CEjBjzVA.js';
 import '../mailbox-types-DTl7bRH3.js';
-import '../config-Bf5mj-ad.js';
+import '../config-DAOjriz9.js';
 import '../observability-D-HZN_mF.js';
-import '../permission-BCbQDR2s.js';
-import '../retry-policy-Dt3_z8Aj.js';
+import '../permission-DbsGOA1C.js';
+import '../retry-policy-Git9WF6d.js';
 
 interface TaskStore {
     saveGraph(graph: TaskGraph): Promise<void>;

package/dist/{secret-vault-BUJ2d1gB.d.ts → secret-vault-DDSMHqIm.d.ts}

@@ -1,4 +1,4 @@
-import { S as SecretScrubber } from './permission-BCbQDR2s.js';
+import { S as SecretScrubber } from './permission-DbsGOA1C.js';
 import { L as Logger } from './logger-B63L5bTg.js';
 import { R as RotatableSecretVault, S as SecretVault } from './secret-vault-BAKpgFw_.js';
 

package/dist/security/index.d.ts

@@ -1,8 +1,8 @@
-export { a as DefaultSecretScrubber, D as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, i as isSecretField, m as migratePlaintextSecrets, r as rewriteConfigEncrypted, b as rotateConfigKeys } from '../secret-vault-BUJ2d1gB.js';
-export { A as AutoApprovePermissionPolicy, D as DefaultPermissionPolicy, P as PermissionPolicyOptions } from '../permission-policy-C0ikndX_.js';
-export { D as DANGEROUS_FOR_SUBAGENTS, T as ToolCapabilities, a as ToolCapability, g as getDangerousCapabilities, h as hasCapability, b as hasDangerousCapabilityForSubagents } from '../index-L4RZN9jJ.js';
-import '../permission-BCbQDR2s.js';
-import '../context-CLnUMW5g.js';
+export { a as DefaultSecretScrubber, D as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, i as isSecretField, m as migratePlaintextSecrets, r as rewriteConfigEncrypted, b as rotateConfigKeys } from '../secret-vault-DDSMHqIm.js';
+export { A as AutoApprovePermissionPolicy, D as DefaultPermissionPolicy, P as PermissionPolicyOptions } from '../permission-policy-BpEea3r7.js';
+export { D as DANGEROUS_FOR_SUBAGENTS, T as ToolCapabilities, a as ToolCapability, g as getDangerousCapabilities, h as hasCapability, b as hasDangerousCapabilityForSubagents } from '../index-cMEmzCVN.js';
+import '../permission-DbsGOA1C.js';
+import '../context-DPlA6kid.js';
 import '../logger-B63L5bTg.js';
 import '../secret-vault-BAKpgFw_.js';
 import '../input-reader-E-ffP2ee.js';

package/dist/security/index.js

@@ -1101,6 +1101,8 @@ var ToolCapabilities = {
   SHELL_ARBITRARY: "shell.arbitrary",
   /** Can execute a restricted set of commands (the `exec` tool). */
   SHELL_RESTRICTED: "shell.restricted",
+  /** Can run a restricted project formatter/linter-style command. */
+  SHELL_EXEC: "shell.exec",
   /** Can read files inside the project (and possibly outside via symlinks if not guarded). */
   FS_READ: "fs.read",
   /** Can write / modify / delete files inside the project. */
@@ -1109,6 +1111,20 @@ var ToolCapabilities = {
   FS_WRITE_OUTSIDE_PROJECT: "fs.write.outside-project",
   /** Can perform outbound network requests. */
   NET_OUTBOUND: "net.outbound",
+  /** Can mutate in-memory session todos only. */
+  SESSION_TODO: "session.todo",
+  /** Can mutate in-memory session mode only. */
+  SESSION_MODE: "session.mode",
+  /** Can inspect registered tool metadata. */
+  TOOL_META: "tool.meta",
+  /** Can invoke arbitrary registered tools through a meta-tool. */
+  TOOL_MUTATE_ANY: "tool.mutate.any",
+  /** Can read persistent memory. */
+  MEMORY_READ: "memory.read",
+  /** Can write persistent memory. */
+  MEMORY_WRITE: "memory.write",
+  /** Can delete persistent memory. */
+  MEMORY_DELETE: "memory.delete",
   /** Proxies tools from external MCP servers (unknown capability). */
   MCP_PROXY: "mcp.proxy",
   /** Can spawn or manage subagents / multi-agent tasks. */
@@ -1127,8 +1143,12 @@ var ToolCapabilities = {
 var DANGEROUS_FOR_SUBAGENTS = [
   ToolCapabilities.SHELL_ARBITRARY,
   ToolCapabilities.SHELL_RESTRICTED,
+  ToolCapabilities.SHELL_EXEC,
   ToolCapabilities.FS_WRITE,
   ToolCapabilities.FS_WRITE_OUTSIDE_PROJECT,
+  ToolCapabilities.TOOL_MUTATE_ANY,
+  ToolCapabilities.MEMORY_WRITE,
+  ToolCapabilities.MEMORY_DELETE,
   ToolCapabilities.MCP_PROXY,
   ToolCapabilities.SUBAGENT_SPAWN,
   ToolCapabilities.CONFIG_MUTATE,
@@ -1138,8 +1158,12 @@ var DANGEROUS_FOR_SUBAGENTS = [
   ToolCapabilities.FS_READ,
   ToolCapabilities.FS_WRITE,
   ToolCapabilities.NET_OUTBOUND,
+  ToolCapabilities.SESSION_TODO,
+  ToolCapabilities.TOOL_META,
+  ToolCapabilities.MEMORY_READ,
   ToolCapabilities.SHELL_ARBITRARY,
   ToolCapabilities.SHELL_RESTRICTED,
+  ToolCapabilities.SHELL_EXEC,
   ToolCapabilities.PACKAGE_INSTALL
 ];
 function hasDangerousCapabilityForSubagents(toolOrCaps) {
@@ -1284,6 +1308,15 @@ function isClearlyDestructiveBashCommand(command, projectRoot) {
 function matchesTrust(patterns, subject) {
   return patterns.includes(subject) || matchAny(patterns, subject);
 }
+function shellCommandLineFromInput(input) {
+  const command = getInputString(input, "command") ?? getInputString(input, "cmd") ?? getInputString(input, "script");
+  if (!command) return void 0;
+  if (!input || typeof input !== "object") return command;
+  const args = input["args"];
+  if (!Array.isArray(args) || args.length === 0) return command;
+  const renderedArgs = args.filter((arg) => typeof arg === "string").map((arg) => /\s/.test(arg) ? `"${arg.replace(/"/g, '\\"')}"` : arg);
+  return [command, ...renderedArgs].join(" ");
+}
 var DefaultPermissionPolicy = class {
   policy = {};
   loaded = false;
@@ -1301,9 +1334,10 @@ var DefaultPermissionPolicy = class {
    */
   sessionDenied = /* @__PURE__ */ new Map();
   /**
-   * Session-scoped "soft trust" map. When the user presses 'a' (allow once),
-   * the tool+pattern is added here. If the LLM retries in the same session,
-   * we return auto directly without asking again.
+   * Session-scoped one-shot "soft trust" map. When the user presses 'y', the
+   * tool+pattern is added here so the immediate confirm re-run can proceed.
+   * The entry is consumed on first use; future calls must ask again unless the
+   * user chose persistent trust.
    *
    * Cleared on reload().
    */
@@ -1342,7 +1376,7 @@ var DefaultPermissionPolicy = class {
     this.trustFile = opts.trustFile;
     this.yolo = opts.yolo ?? false;
     this.yoloDestructive = opts.yoloDestructive ?? opts.forceAllYolo ?? false;
-    this.confirmDestructive = opts.confirmDestructive ?? false;
+    this.confirmDestructive = true;
     this.promptDelegate = opts.promptDelegate;
   }
   /**
@@ -1373,9 +1407,9 @@ var DefaultPermissionPolicy = class {
     return this.yoloDestructive;
   }
   /** Toggle destructive confirmation gate (only meaningful when yolo is active). */
-  setConfirmDestructive(enabled) {
-    if (this.confirmDestructive !== enabled) this._evalCache.clear();
-    this.confirmDestructive = enabled;
+  setConfirmDestructive(_enabled) {
+    if (!this.confirmDestructive) this._evalCache.clear();
+    this.confirmDestructive = true;
   }
   /** Check whether destructive confirmation gate is active. */
   getConfirmDestructive() {
@@ -1414,12 +1448,12 @@ var DefaultPermissionPolicy = class {
       return decision;
     }
     if (this.sessionAllowed.has(cacheKey)) {
+      this.sessionAllowed.delete(cacheKey);
       const decision = {
         permission: "auto",
         source: "trust",
-        reason: "session soft allow (user pressed yes)"
+        reason: "session one-shot allow (user pressed yes)"
       };
-      this._evalCache.set(cacheKey, decision);
       return decision;
     }
     if (entry?.deny && subject && matchesTrust(entry.deny, subject)) {
@@ -1432,6 +1466,29 @@ var DefaultPermissionPolicy = class {
       this._evalCache.set(cacheKey, decision);
       return decision;
     }
+    if (this.yolo) {
+      const destructive = this.isDestructiveYoloCall(tool, input, ctx);
+      if (destructive) {
+        if (this.promptDelegate) {
+          const decision = await this.promptDelegate(tool, input, subject ?? tool.name);
+          if (decision === "deny") {
+            await this.deny({ tool: tool.name, pattern: subject ?? tool.name });
+            return { permission: "deny", source: "user", reason: "user denied destructive yolo" };
+          }
+          return {
+            permission: decision === "yes" || decision === "always" ? "auto" : "deny",
+            source: "user",
+            reason: "destructive yolo approved for this call"
+          };
+        }
+        return {
+          permission: "confirm",
+          source: "yolo_destructive",
+          riskTier: "destructive",
+          reason: "destructive tool needs explicit approval in YOLO mode"
+        };
+      }
+    }
     if (entry?.allow && subject && matchesTrust(entry.allow, subject)) {
       const decision = { permission: "auto", source: "trust", reason: "matched allow pattern" };
       this._evalCache.set(cacheKey, decision);
@@ -1443,29 +1500,6 @@ var DefaultPermissionPolicy = class {
       return decision;
     }
     if (this.yolo) {
-      if (this.confirmDestructive) {
-        const destructive = this.isDestructiveYoloCall(tool, input, ctx);
-        if (destructive) {
-          if (this.promptDelegate) {
-            const decision2 = await this.promptDelegate(tool, input, subject ?? tool.name);
-            if (decision2 === "always") {
-              await this.trust({ tool: tool.name, pattern: subject ?? tool.name });
-              return { permission: "auto", source: "user", reason: "destructive yolo always-allowed" };
-            }
-            if (decision2 === "deny") {
-              await this.deny({ tool: tool.name, pattern: subject ?? tool.name });
-              return { permission: "deny", source: "user", reason: "user denied destructive yolo" };
-            }
-            return { permission: decision2 === "yes" ? "auto" : "deny", source: "user" };
-          }
-          return {
-            permission: "confirm",
-            source: "yolo_destructive",
-            riskTier: "destructive",
-            reason: "destructive tool needs explicit approval (confirmDestructive is on)"
-          };
-        }
-      }
       const decision = { permission: "auto", source: "yolo" };
       this._evalCache.set(cacheKey, decision);
       return decision;
@@ -1482,7 +1516,8 @@ var DefaultPermissionPolicy = class {
     const hasWriteCap = hasCapability(tool, ToolCapabilities.FS_WRITE);
     const hasShellCap = hasCapability(tool, [
       ToolCapabilities.SHELL_ARBITRARY,
-      ToolCapabilities.SHELL_RESTRICTED
+      ToolCapabilities.SHELL_RESTRICTED,
+      ToolCapabilities.SHELL_EXEC
     ]);
     const hasInstallCap = hasCapability(tool, ToolCapabilities.PACKAGE_INSTALL);
     const hasConfigCap = hasCapability(tool, ToolCapabilities.CONFIG_MUTATE);
@@ -1510,27 +1545,30 @@ var DefaultPermissionPolicy = class {
   // Capability-based destructive check (preferred over name-based)
   isDestructiveByCapability(tool) {
     const caps = tool.capabilities ?? [];
-    if (caps.includes("shell.arbitrary")) return true;
-    if (caps.includes("fs.write")) return true;
-    if (caps.includes("fs.write.outside-project")) return true;
+    if (caps.includes(ToolCapabilities.SHELL_ARBITRARY)) return true;
+    if (caps.includes(ToolCapabilities.SHELL_RESTRICTED)) return true;
+    if (caps.includes(ToolCapabilities.SHELL_EXEC)) return true;
+    if (caps.includes(ToolCapabilities.FS_WRITE)) return true;
+    if (caps.includes(ToolCapabilities.FS_WRITE_OUTSIDE_PROJECT)) return true;
     return false;
   }
   isDestructiveYoloCall(tool, input, ctx) {
     if (this.isDestructiveByCapability(tool)) {
-      if (tool.name === "bash") {
-        const command = getInputString(input, "command");
-        return command ? isClearlyDestructiveBashCommand(command, ctx.projectRoot) : true;
+      const caps = tool.capabilities ?? [];
+      if (caps.includes(ToolCapabilities.SHELL_ARBITRARY) || caps.includes(ToolCapabilities.SHELL_RESTRICTED) || caps.includes(ToolCapabilities.SHELL_EXEC)) {
+        const command = shellCommandLineFromInput(input);
+        return command ? isClearlyDestructiveBashCommand(command, ctx.projectRoot) : tool.riskTier === "destructive";
       }
-      if (tool.name === "write" || tool.name === "edit" || tool.name === "replace" || tool.name === "patch") {
+      if (caps.includes(ToolCapabilities.FS_WRITE_OUTSIDE_PROJECT)) return true;
+      if (caps.includes(ToolCapabilities.FS_WRITE)) {
         const targetPath = getInputString(input, "path") ?? getInputString(input, "file");
         if (!targetPath || !ctx.projectRoot) return false;
         return !pathLooksInsideProject(targetPath, ctx.projectRoot);
       }
-      return true;
     }
-    if (tool.name === "bash") {
-      const command = getInputString(input, "command");
-      return command ? isClearlyDestructiveBashCommand(command, ctx.projectRoot) : true;
+    if (tool.name === "bash" || tool.name === "shell" || tool.name === "exec") {
+      const command = shellCommandLineFromInput(input);
+      return command ? isClearlyDestructiveBashCommand(command, ctx.projectRoot) : tool.riskTier === "destructive";
     }
     if (tool.name === "write" || tool.name === "edit" || tool.name === "replace" || tool.name === "patch") {
       const targetPath = getInputString(input, "path") ?? getInputString(input, "file");
@@ -1579,7 +1617,7 @@ var DefaultPermissionPolicy = class {
     this.sessionDenied.set(`${rule.tool}::${rule.pattern}`, true);
     this._evalCache.clear();
   }
-  /** Auto-approve this tool+pattern for the rest of this session (no trust file). */
+  /** Auto-approve this tool+pattern once (no trust file). */
   allowOnce(rule) {
     this.sessionAllowed.set(`${rule.tool}::${rule.pattern}`, true);
     this._evalCache.clear();