@wrongstack/core 0.276.4 → 0.277.1

package/dist/defaults/index.d.ts

@@ -1,45 +1,45 @@
-export { I as InMemoryAgentBridge, a as InMemoryBridgeTransport, c as createMessage } from '../agent-bridge-D7A-eu3C.js';
-export { i as AgentFactory, w as AgentFactoryResult, x as AgentRunnerOptions, y as BudgetExceededError, z as BudgetKind, E as BudgetLimits, K as BudgetUsage, F as FleetBus, O as FleetEvent, Q as FleetHandler, j as FleetUsage, k as FleetUsageAggregator, R as SubagentBudget, Z as SubagentUsageSnapshot, a0 as makeAgentSubagentRunner } from '../agent-subagent-runner-CEuw4ATz.js';
-export { a as AGENTS_BY_PHASE, b as AGENT_CATALOG, c as ALL_AGENT_DEFINITIONS, d as ALL_FLEET_AGENTS, e as AUDIT_LOG_AGENT, f as AutoExtendCeiling, g as AutoExtendPolicy, B as BUG_HUNTER_AGENT, n as CreateDelegateToolOptions, D as DEFAULT_DIRECTOR_PREAMBLE, q as DEFAULT_SUBAGENT_BASELINE, r as DelegateHost, s as Director, w as DirectorPromptParts, x as DirectorSessionFactory, y as DirectorSessionFactoryOptions, F as FLEET_ROSTER, z as FLEET_ROSTER_BUDGETS, J as FleetRosterBudget, K as FleetSpawnBudgetError, L as ICoordinator, M as IFleetManager, O as NULL_FLEET_BUS, R as REFACTOR_PLANNER_AGENT, S as SECURITY_SCANNER_AGENT, V as SubagentPromptParts, W as applyRosterBudget, X as attachAutoExtend, Y as composeDirectorPrompt, Z as composeSubagentPrompt, _ as createDelegateTool, $ as getAgentDefinition, a1 as makeAskTool, a2 as makeAssignTool, a3 as makeAwaitTasksTool, a4 as makeCollabDebugTool, a5 as makeDirectorSessionFactory, a6 as makeFleetEmitTool, a7 as makeFleetTool, a8 as makeRollUpTool, a9 as makeSpawnTool, ab as makeTerminateTool, ad as rosterSummaryFromConfigs } from '../null-fleet-bus-d9G-bVy9.js';
-export { c as AgentBudgetTier, d as AgentCapability, b as AgentDefinition, A as AgentPhase, e as DEFAULT_DISPATCH_ROLE, a as DefaultMultiAgentCoordinator, f as DispatchCandidate, D as DispatchClassifier, g as DispatchMethod, h as DispatchOptions, i as DispatchResult, j as MultiAgentCoordinatorOptions, k as dispatchAgent, m as makeLLMClassifier, s as scoreAgents } from '../multi-agent-coordinator-CiRtKVTk.js';
-export { A as AutoCompactionMiddleware, a as AutonomousRunner, b as AutonomousRunnerOptions, c as AutonomyPromptContributorOptions, C as CompactorStrategy, D as DefaultDesignKitLoader, d as DefaultPromptLoader, e as DefaultSkillLoader, f as DesignKitLoaderOptions, g as DesignOverrides, h as DoneCheckResult, i as DoneConditionChecker, I as IntelligentCompactor, j as IntelligentCompactorOptions, P as PersistedActiveKit, k as PromptLoaderOptions, S as SelectiveCompactor, l as SelectiveCompactorOptions, m as SkillLoaderOptions, n as StrategyCompactorOptions, _ as _resetDesignKitLoaderMemo, o as _resetDesignRulesCache, p as activateDesign, q as applyTokenOverrides, r as buildGoalPreamble, s as clearActiveKit, t as clearPersistedActiveKit, u as createStrategyCompactor, v as designProjectDir, w as detectFrontendFile, x as detectFrontendIntent, y as getDesignKitLoader, z as getDesignState, B as installDesignStudioMiddleware, E as loadActiveKit, F as loadProjectDesignRules, G as makeAutonomyPromptContributor, H as makeDesignDetectToolCallMiddleware, J as makeDesignDetectUserInputMiddleware, K as makeDesignStudioRequestMiddleware, L as makeDesignVerifyToolCallMiddleware, M as recordKitChoice, N as recordOverrides, O as renderPrompt, Q as resolveBundledDesignKitsDir, R as setActiveKit, T as setDesignOverrides } from '../strategy-compactor-DI1OHVbB.js';
-import { e as DesignKitTokens, D as DesignStack } from '../tool-executor-Bmd5Ygoo.js';
-export { C as CompactorOptions, h as DefaultErrorHandler, i as DefaultRetryPolicy, E as EternalAutonomyEngine, k as EternalAutonomyOptions, l as EternalEngineState, H as HybridCompactor, I as IterationStage, P as ParallelEngineState, m as ParallelEternalEngine, n as ParallelEternalOptions, o as ParallelIterationStage, T as ToolExecutor } from '../tool-executor-Bmd5Ygoo.js';
-import { P as ProviderRunner, R as RunProviderOptions } from '../provider-runner-DZ808MSM.js';
-import { d as Response } from '../context-CLnUMW5g.js';
-export { C as ContextManagerAction, a as ContextManagerInput, b as ContextManagerResult, c as ContextManagerToolOptions, d as allServers, e as awsServer, f as blockServer, g as braveSearchServer, h as context7Server, i as contextManagerTool, j as createContextManagerTool, k as everArtServer, l as filesystemServer, m as githubServer, n as googleMapsServer, o as miniMaxVisionServer, p as playwrightServer, s as sentinelServer, q as slackServer, r as sshManagerServer, z as zaiVisionServer } from '../mcp-servers-CuZGf9fI.js';
+export { I as InMemoryAgentBridge, a as InMemoryBridgeTransport, c as createMessage } from '../agent-bridge-BFJ2ODzI.js';
+export { i as AgentFactory, w as AgentFactoryResult, x as AgentRunnerOptions, y as BudgetExceededError, z as BudgetKind, E as BudgetLimits, K as BudgetUsage, F as FleetBus, O as FleetEvent, Q as FleetHandler, j as FleetUsage, k as FleetUsageAggregator, R as SubagentBudget, Z as SubagentUsageSnapshot, a0 as makeAgentSubagentRunner } from '../agent-subagent-runner-BimKihiC.js';
+export { a as AGENTS_BY_PHASE, b as AGENT_CATALOG, c as ALL_AGENT_DEFINITIONS, d as ALL_FLEET_AGENTS, e as AUDIT_LOG_AGENT, f as AutoExtendCeiling, g as AutoExtendPolicy, B as BUG_HUNTER_AGENT, n as CreateDelegateToolOptions, D as DEFAULT_DIRECTOR_PREAMBLE, q as DEFAULT_SUBAGENT_BASELINE, r as DelegateHost, s as Director, w as DirectorPromptParts, x as DirectorSessionFactory, y as DirectorSessionFactoryOptions, F as FLEET_ROSTER, z as FLEET_ROSTER_BUDGETS, J as FleetRosterBudget, K as FleetSpawnBudgetError, L as ICoordinator, M as IFleetManager, O as NULL_FLEET_BUS, R as REFACTOR_PLANNER_AGENT, S as SECURITY_SCANNER_AGENT, V as SubagentPromptParts, W as applyRosterBudget, X as attachAutoExtend, Y as composeDirectorPrompt, Z as composeSubagentPrompt, _ as createDelegateTool, $ as getAgentDefinition, a1 as makeAskTool, a2 as makeAssignTool, a3 as makeAwaitTasksTool, a4 as makeCollabDebugTool, a5 as makeDirectorSessionFactory, a6 as makeFleetEmitTool, a7 as makeFleetTool, a8 as makeRollUpTool, a9 as makeSpawnTool, ab as makeTerminateTool, ad as rosterSummaryFromConfigs } from '../null-fleet-bus-C9KsYyrI.js';
+export { c as AgentBudgetTier, d as AgentCapability, b as AgentDefinition, A as AgentPhase, e as DEFAULT_DISPATCH_ROLE, a as DefaultMultiAgentCoordinator, f as DispatchCandidate, D as DispatchClassifier, g as DispatchMethod, h as DispatchOptions, i as DispatchResult, j as MultiAgentCoordinatorOptions, k as dispatchAgent, m as makeLLMClassifier, s as scoreAgents } from '../multi-agent-coordinator-CcrcncvG.js';
+export { A as AutoCompactionMiddleware, a as AutonomousRunner, b as AutonomousRunnerOptions, c as AutonomyPromptContributorOptions, C as CompactorStrategy, D as DefaultDesignKitLoader, d as DefaultPromptLoader, e as DefaultSkillLoader, f as DesignKitLoaderOptions, g as DesignOverrides, h as DoneCheckResult, i as DoneConditionChecker, I as IntelligentCompactor, j as IntelligentCompactorOptions, P as PersistedActiveKit, k as PromptLoaderOptions, S as SelectiveCompactor, l as SelectiveCompactorOptions, m as SkillLoaderOptions, n as StrategyCompactorOptions, _ as _resetDesignKitLoaderMemo, o as _resetDesignRulesCache, p as activateDesign, q as applyTokenOverrides, r as buildGoalPreamble, s as clearActiveKit, t as clearPersistedActiveKit, u as createStrategyCompactor, v as designProjectDir, w as detectFrontendFile, x as detectFrontendIntent, y as getDesignKitLoader, z as getDesignState, B as installDesignStudioMiddleware, E as loadActiveKit, F as loadProjectDesignRules, G as makeAutonomyPromptContributor, H as makeDesignDetectToolCallMiddleware, J as makeDesignDetectUserInputMiddleware, K as makeDesignStudioRequestMiddleware, L as makeDesignVerifyToolCallMiddleware, M as recordKitChoice, N as recordOverrides, O as renderPrompt, Q as resolveBundledDesignKitsDir, R as setActiveKit, T as setDesignOverrides } from '../strategy-compactor-Bt_ZH6R0.js';
+import { e as DesignKitTokens, D as DesignStack } from '../tool-executor-SVFq7IOR.js';
+export { C as CompactorOptions, h as DefaultErrorHandler, i as DefaultRetryPolicy, E as EternalAutonomyEngine, k as EternalAutonomyOptions, l as EternalEngineState, H as HybridCompactor, I as IterationStage, P as ParallelEngineState, m as ParallelEternalEngine, n as ParallelEternalOptions, o as ParallelIterationStage, T as ToolExecutor } from '../tool-executor-SVFq7IOR.js';
+import { P as ProviderRunner, R as RunProviderOptions } from '../provider-runner-CnOSr5BN.js';
+import { d as Response } from '../context-DPlA6kid.js';
+export { C as ContextManagerAction, a as ContextManagerInput, b as ContextManagerResult, c as ContextManagerToolOptions, d as allServers, e as awsServer, f as blockServer, g as braveSearchServer, h as context7Server, i as contextManagerTool, j as createContextManagerTool, k as everArtServer, l as filesystemServer, m as githubServer, n as googleMapsServer, o as miniMaxVisionServer, p as playwrightServer, s as sentinelServer, q as slackServer, r as sshManagerServer, z as zaiVisionServer } from '../mcp-servers-CFb60-pH.js';
 export { D as DefaultLogger, a as DefaultLoggerOptions, L as LogFormat } from '../logger-D3lV0cUZ.js';
-export { C as CODEX_MODELS, a as CodexModelMeta, D as DefaultModeStore, L as LLMSelector, b as LLMSelectorOptions, M as ModeLoaderOptions, P as ProviderModelDescriptor, c as codexModelMeta, d as describeCatalogModel, l as loadProjectModes, e as loadUserModes, r as resolveProviderModelList } from '../provider-model-resolve-B70epO19.js';
-export { D as DefaultModelsRegistry, a as DefaultModelsRegistryOptions, c as classifyFamily } from '../models-registry-8XOdxWQu.js';
+export { C as CODEX_MODELS, a as CodexModelMeta, D as DefaultModeStore, L as LLMSelector, b as LLMSelectorOptions, M as ModeLoaderOptions, P as ProviderModelDescriptor, c as codexModelMeta, d as describeCatalogModel, l as loadProjectModes, e as loadUserModes, r as resolveProviderModelList } from '../provider-model-resolve-BpfXp3Jj.js';
+export { D as DefaultModelsRegistry, a as DefaultModelsRegistryOptions, c as classifyFamily } from '../models-registry-5Ufn7f2m.js';
 export { DefaultHealthRegistry, InMemoryMetricsSink, MetricsServerHandle, MetricsServerOptions, NoopMetricsSink, NoopTracer, OTelTracer, OtlpMetricsExporterHandle, OtlpMetricsExporterOptions, OtlpTraceExporterHandle, OtlpTraceExporterOptions, PROMETHEUS_CONTENT_TYPE, buildOtlpMetricsRequest, buildOtlpTracesRequest, renderPrometheus, startMetricsServer, startOtlpMetricsExporter, startOtlpTraceExporter, wireMetricsToEvents } from '../observability/index.js';
 export { AISpecBuilder, AISpecBuilderOptions, AISpecPhase, AISpecSession, AutoExecutor, AutoExecutorOptions, BottleneckTask, CleanupStaleSddOptions, CleanupStaleSddResult, CollectedAnswer, CommandVerifierOptions, ConflictSide, CriticalPathAnalysis, DefaultTaskStore, DestroySddProjectOptions, DestroySddProjectResult, ExecutionSummary, GeneratedTask, LlmConflictResolverOptions, RollbackFromDiskOptions, RunResult, SPEC_TEMPLATES, SddBoardColumn, SddBoardEvent, SddBoardFeedEntry, SddBoardIndexEntry, SddBoardProjector, SddBoardProjectorOptions, SddBoardSnapshot, SddBoardStatus, SddBoardStore, SddBoardStoreOptions, SddBoardTask, SddDeadlockChain, SddIngestResult, SddInterviewDriver, SddInterviewDriverOptions, SddInterviewSnapshot, SddLifecycleOp, SddLifecycleOptions, SddLifecycleResult, SddParallelRun, SddParallelRunOptions, SddProgress, SddRunControl, SddRunHandle, SddRunRegistry, SddSubtaskSpec, SddSupervisor, SddSupervisorOptions, SddSupervisorVerdict, SddTaskDecomposer, SddTaskDecomposerOptions, SddTaskDisplayStatus, SpecDiff, SpecDrivenDev, SpecDrivenDevOptions, SpecIndexEntry, SpecParser, SpecStore, SpecStoreOptions, SpecVersion, SpecVersioning, StartSddRunOptions, SubtaskGeneratorOptions, TaskBatch, TaskExecutionContext, TaskExecutionResult, TaskFlow, TaskFlowEventMap, TaskFlowEventName, TaskFlowExecutionContext, TaskFlowOptions, TaskFlowPhase, TaskGenerator, TaskGeneratorOptions, TaskGraphIndexEntry, TaskGraphStore, TaskGraphStoreOptions, TaskStore, TaskTracker, TaskTrackerOptions, TaskTransition, WaveResult, analyzeCriticalPath, applySddLifecycle, buildBoardSnapshot, buildBoardTasks, cleanupSddWorktrees, cleanupStaleSddWorktrees, createAutoExecutor, destroySddProject, extractVerificationCommand, getTemplate, hasConflictMarkers, isExplanatoryText, listTemplates, makeCommandVerifier, makeLlmConflictResolver, makeLlmSubtaskGenerator, makePreferSideConflictResolver, renderProgress, renderSpecAnalysis, renderTaskGraph, renderTaskList, resolveConflictText, rollbackSddRunFromDisk, shortIdMap, startSddRun, templateToMarkdown } from '../sdd/index.js';
-export { A as AutoApprovePermissionPolicy, D as DefaultPermissionPolicy, P as PermissionPolicyOptions } from '../permission-policy-C0ikndX_.js';
-export { a as DefaultSecretScrubber, D as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, m as migratePlaintextSecrets, r as rewriteConfigEncrypted } from '../secret-vault-BUJ2d1gB.js';
-export { A as AbandonedSession, a as AttachmentStoreOptions, C as ConfigLoaderOptions, b as ConfigMigration, c as ConfigMigrationError, d as ConfigSource, D as DEFAULT_CONFIG_MIGRATIONS, e as DefaultAttachmentStore, f as DefaultConfigLoader, g as DefaultConfigStore, h as DefaultMemoryStore, i as DefaultSessionStore, k as MemoryStoreOptions, l as MigrationContext, m as MigrationResult, P as PersistedQueueItem, n as PlanFile, o as PlanItem, p as PlanTemplate, Q as QueueStore, R as RecoveryLock, q as RecoveryLockOptions, S as SessionAnalyzer, r as SessionStoreOptions, T as TodosCheckpointFile, s as addPlanItem, t as attachPlanCheckpoint, u as attachTodosCheckpoint, v as clearPlan, w as deriveTodosFromPlanItem, x as emptyPlan, y as formatPlan, z as formatPlanTemplates, B as getPlanTemplate, E as listPlanTemplates, G as loadPlan, H as loadTodosCheckpoint, K as removePlanItem, L as runConfigMigrations, N as savePlan, O as saveTodosCheckpoint, U as setPlanItemStatus } from '../todos-checkpoint-Ddd2CGr0.js';
+export { A as AutoApprovePermissionPolicy, D as DefaultPermissionPolicy, P as PermissionPolicyOptions } from '../permission-policy-BpEea3r7.js';
+export { a as DefaultSecretScrubber, D as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, m as migratePlaintextSecrets, r as rewriteConfigEncrypted } from '../secret-vault-DDSMHqIm.js';
+export { A as AbandonedSession, a as AttachmentStoreOptions, C as ConfigLoaderOptions, b as ConfigMigration, c as ConfigMigrationError, d as ConfigSource, D as DEFAULT_CONFIG_MIGRATIONS, e as DefaultAttachmentStore, f as DefaultConfigLoader, g as DefaultConfigStore, h as DefaultMemoryStore, i as DefaultSessionStore, k as MemoryStoreOptions, l as MigrationContext, m as MigrationResult, P as PersistedQueueItem, n as PlanFile, o as PlanItem, p as PlanTemplate, Q as QueueStore, R as RecoveryLock, q as RecoveryLockOptions, S as SessionAnalyzer, r as SessionStoreOptions, T as TodosCheckpointFile, s as addPlanItem, t as attachPlanCheckpoint, u as attachTodosCheckpoint, v as clearPlan, w as deriveTodosFromPlanItem, x as emptyPlan, y as formatPlan, z as formatPlanTemplates, B as getPlanTemplate, E as listPlanTemplates, G as loadPlan, H as loadTodosCheckpoint, K as removePlanItem, L as runConfigMigrations, N as savePlan, O as saveTodosCheckpoint, U as setPlanItemStatus } from '../todos-checkpoint-CH1pcua9.js';
 export { a as DirectorStateCheckpoint, D as DirectorStateSnapshot, b as DirectorSubagentState, c as DirectorTaskState, l as loadDirectorState } from '../director-state-BfeCUbmk.js';
-export { A as AuditLevel, S as SessionEventBridge, b as SessionEventBridgeOptions, c as SessionSamplingOptions, T as ToolProgressSamplingOptions, d as createSessionEventBridge, r as resolveAuditLevel, e as resolveSessionLoggingConfig } from '../session-event-bridge-CMvIO59_.js';
-export { D as DefaultSessionReader } from '../session-reader-C8aiChUu.js';
+export { A as AuditLevel, S as SessionEventBridge, b as SessionEventBridgeOptions, c as SessionSamplingOptions, T as ToolProgressSamplingOptions, d as createSessionEventBridge, r as resolveAuditLevel, e as resolveSessionLoggingConfig } from '../session-event-bridge-DG94B3Bk.js';
+export { D as DefaultSessionReader } from '../session-reader-BzT-iMQT.js';
 export { D as DEFAULT_AUTONOMY_CONFIG, b as DEFAULT_CONTEXT_CONFIG, e as DEFAULT_TOOLS_CONFIG } from '../default-config-azFprTB3.js';
-import '../index-Cn0NOshr.js';
+import '../index-DJXj-dcr.js';
 import '../logger-B63L5bTg.js';
-import '../pipeline-Dl6XbfE7.js';
+import '../pipeline-CEjBjzVA.js';
 import '../mailbox-types-DTl7bRH3.js';
-import '../config-Bf5mj-ad.js';
+import '../config-DAOjriz9.js';
 import '../observability-D-HZN_mF.js';
-import '../brain-BLOyN5ZP.js';
-import '../permission-BCbQDR2s.js';
-import '../retry-policy-Dt3_z8Aj.js';
+import '../brain-CCfuEOdp.js';
+import '../permission-DbsGOA1C.js';
+import '../retry-policy-Git9WF6d.js';
 import 'node:events';
-import '../compactor-DcBpaJsI.js';
-import '../selector-BCkWgdwy.js';
+import '../compactor-D3BGw26y.js';
+import '../selector-Cq72C0Oy.js';
 import '../skill-DGIXCtdv.js';
 import '../wstack-paths-_NrRovdr.js';
 import '../prompt-DLd35n4Q.js';
-import '../goal-store-DGb6b5Ed.js';
+import '../goal-store-C1uH4srH.js';
 import '../mode-CZlO9iU1.js';
 import '../spec-TBi3Jr6T.js';
 import '../task-graph-u1q9Jkyk.js';
-import '../worktree-manager-DBdl_5rs.js';
+import '../worktree-manager-C4YIf1Fa.js';
 import '../input-reader-E-ffP2ee.js';
 import '../secret-vault-BAKpgFw_.js';
 

package/dist/defaults/index.js

@@ -6546,6 +6546,8 @@ var ToolCapabilities = {
   SHELL_ARBITRARY: "shell.arbitrary",
   /** Can execute a restricted set of commands (the `exec` tool). */
   SHELL_RESTRICTED: "shell.restricted",
+  /** Can run a restricted project formatter/linter-style command. */
+  SHELL_EXEC: "shell.exec",
   /** Can read files inside the project (and possibly outside via symlinks if not guarded). */
   FS_READ: "fs.read",
   /** Can write / modify / delete files inside the project. */
@@ -6554,6 +6556,12 @@ var ToolCapabilities = {
   FS_WRITE_OUTSIDE_PROJECT: "fs.write.outside-project",
   /** Can perform outbound network requests. */
   NET_OUTBOUND: "net.outbound",
+  /** Can invoke arbitrary registered tools through a meta-tool. */
+  TOOL_MUTATE_ANY: "tool.mutate.any",
+  /** Can write persistent memory. */
+  MEMORY_WRITE: "memory.write",
+  /** Can delete persistent memory. */
+  MEMORY_DELETE: "memory.delete",
   /** Proxies tools from external MCP servers (unknown capability). */
   MCP_PROXY: "mcp.proxy",
   /** Can spawn or manage subagents / multi-agent tasks. */
@@ -6568,8 +6576,12 @@ var ToolCapabilities = {
 var DANGEROUS_FOR_SUBAGENTS = [
   ToolCapabilities.SHELL_ARBITRARY,
   ToolCapabilities.SHELL_RESTRICTED,
+  ToolCapabilities.SHELL_EXEC,
   ToolCapabilities.FS_WRITE,
   ToolCapabilities.FS_WRITE_OUTSIDE_PROJECT,
+  ToolCapabilities.TOOL_MUTATE_ANY,
+  ToolCapabilities.MEMORY_WRITE,
+  ToolCapabilities.MEMORY_DELETE,
   ToolCapabilities.MCP_PROXY,
   ToolCapabilities.SUBAGENT_SPAWN,
   ToolCapabilities.CONFIG_MUTATE,
@@ -8520,6 +8532,7 @@ var Director = class _Director {
   sessionIdSource;
   /** Debounce timer for periodic manifest writes. */
   manifestTimer = null;
+  manifestWriteChain = Promise.resolve();
   manifestDebounceMs;
   /** Fleet-wide cost cap (entire fleet total, distinct from SubagentBudget limits). Infinity means no cap. */
   maxFleetCostUsd;
@@ -8696,7 +8709,7 @@ var Director = class _Director {
         }
       );
       if (this.fleetManager) {
-        this.fleetManager.flushManifest();
+        void this.fleetManager.flushManifest();
       } else {
         this.scheduleManifest();
       }
@@ -8975,6 +8988,7 @@ var Director = class _Director {
       return;
     }
     if (this.manifestDebounceMs < 0) return;
+    if (this.manifestTimer) return;
     this.manifestTimer = setTimeout(() => {
       this.manifestTimer = null;
       void this.writeManifest().catch(
@@ -8982,6 +8996,11 @@ var Director = class _Director {
       );
     }, this.manifestDebounceMs);
   }
+  clearManifestTimer() {
+    if (!this.manifestTimer) return;
+    clearTimeout(this.manifestTimer);
+    this.manifestTimer = null;
+  }
   /**
    * Spawn a subagent. Identical to the coordinator's `spawn()` but
    * captures provider/model metadata for the usage aggregator and
@@ -9204,6 +9223,13 @@ var Director = class _Director {
    * replay an entire director run.
    */
   async writeManifest() {
+    if (!this.manifestPath) return null;
+    this.clearManifestTimer();
+    const write = this.manifestWriteChain.catch(() => void 0).then(() => this.writeManifestNow());
+    this.manifestWriteChain = write.catch(() => void 0);
+    return write;
+  }
+  async writeManifestNow() {
     if (!this.manifestPath) return null;
     const manifest = {
       directorRunId: this.id,
@@ -9236,10 +9262,7 @@ var Director = class _Director {
    * — calling shutdown twice is a no-op on the second invocation.
    */
   async shutdown() {
-    if (this.manifestTimer) {
-      clearTimeout(this.manifestTimer);
-      this.manifestTimer = null;
-    }
+    this.clearManifestTimer();
     if (this.taskCompletedListener) {
       this.coordinator.off("task.completed", this.taskCompletedListener);
       this.taskCompletedListener = null;
@@ -9258,8 +9281,11 @@ var Director = class _Director {
     }
     this.subagentBridges.clear();
     await this.bridge.stop().catch((err) => this.logShutdownError("director_bridge_stop", err));
-    if (this.manifestPath)
+    if (this.fleetManager) {
+      await this.fleetManager.flushManifest().catch((err) => this.logShutdownError("fleet_manifest_flush", err));
+    } else if (this.manifestPath) {
       await this.writeManifest().catch((err) => this.logShutdownError("manifest_write", err));
+    }
     if (this.stateCheckpoint) {
       this.stateCheckpoint.setUsage(this.usage.snapshot());
       await this.stateCheckpoint.flush().catch((err) => this.logShutdownError("state_checkpoint_flush", err));
@@ -16756,7 +16782,7 @@ ${errorDetails}`,
       const decision = await this.opts.permissionPolicy.evaluate(tool, use.input, ctx);
       let effectivePermission = decision.permission;
       const policy = this.opts.permissionPolicy;
-      const yolo = policy.getYolo?.() === true || policy.getYoloDestructive?.() === true;
+      const yolo = policy.getYolo?.() === true;
       const authoritativeAuto = decision.source === "yolo";
       if (toolDangerousCaps.length > 0 && effectivePermission === "auto" && !yolo && !authoritativeAuto) {
         effectivePermission = "confirm";
@@ -17295,7 +17321,10 @@ function createContextManagerTool(opts = {}) {
       required: ["action"]
     },
     permission: "auto",
-    mutating: true,
+    // Mutates only the in-memory conversation context, like the todo tool.
+    // It must stay auto-runnable so the model can inspect/repair/compact its
+    // own context without hitting a permission prompt loop.
+    mutating: false,
     async execute(input, ctx) {
       const messages = ctx.messages;
       const beforeTokens = roughEstimate(messages);
@@ -24718,19 +24747,51 @@ var LruCache = class {
 // src/security/permission-policy.ts
 init_safe_json();
 init_tool_subject();
-var DESTRUCTIVE_BASH_PATTERNS = [
-  /\bgit\s+(?:clean\s+-[^\s]*[xdf]|reset\s+--hard)\b/i,
-  /\b(?:drop|truncate)\s+(?:table|database|schema)\b/i,
-  /\bdelete\s+from\b/i,
-  /\b(?:mkfs|format|diskpart|shutdown|reboot)\b/i,
-  /\bchmod\s+-R\s+777\b/i,
-  /\bchown\s+-R\b/i,
-  /\b(?:curl|wget)\b.*\|\s*(?:sh|bash|zsh|pwsh|powershell)\b/i,
-  /\b(?:powershell|pwsh)\b.*(?:-encodedcommand|-enc)\b/i,
-  /:\(\)\s*\{\s*:\|:&\s*}\s*;/
+var CATASTROPHIC_PATTERNS = [
+  /\b(?:mkfs(?:\.[a-z0-9]+)?|mke2fs|newfs)\b/i,
+  // make a filesystem — wipes a partition
+  /\bformat\s+[A-Za-z]:/i,
+  // format C: — wipes a Windows volume
+  /\bdiskpart\b/i,
+  // Windows partition editor
+  /\bdd\b[^|]*\bof=(?:\/dev\/|\\\\[.?]\\)/i,
+  // dd writing straight to a raw device
+  />\s*\/dev\/(?:sd|hd|nvme|disk|mapper|vd)/i,
+  // redirect into a raw block device
+  /:\(\)\s*\{\s*:\|:&\s*\}\s*;/
+  // classic fork bomb
 ];
-var PROJECT_ESCAPE_PATTERN = /(?:^|[\s"'])\.\.(?:[\\/]|$)/;
-var ABSOLUTE_PATH_PATTERN = /(?:^|[\s"'])(?:~[\\/]|\/[A-Za-z0-9_.-]|[A-Za-z]:[\\/])/;
+var CATASTROPHIC_POSIX_ROOTS = /* @__PURE__ */ new Set([
+  "/etc",
+  "/usr",
+  "/bin",
+  "/sbin",
+  "/lib",
+  "/lib64",
+  "/var",
+  "/boot",
+  "/dev",
+  "/sys",
+  "/proc",
+  "/opt",
+  "/root",
+  "/home",
+  "/srv",
+  "/run",
+  "/system",
+  "/library",
+  "/applications",
+  "/users"
+]);
+var CATASTROPHIC_WIN_SUBDIRS = /* @__PURE__ */ new Set([
+  "windows",
+  "system32",
+  "winnt",
+  "program files",
+  "program files (x86)",
+  "programdata",
+  "users"
+]);
 var SHELL_OPERATORS = /* @__PURE__ */ new Set(["&&", "||", "|", ";", ">", ">>", "<", "2>", "2>>"]);
 function getInputString(input, key) {
   if (!input || typeof input !== "object") return void 0;
@@ -24747,20 +24808,21 @@ function pathLooksInsideProject(rawPath, projectRoot) {
 function tokenizeShell(command) {
   return command.match(/"[^"]*"|'[^']*'|\S+/g)?.map((token) => token.replace(/^['"]|['"]$/g, "")) ?? [];
 }
-function pathTokenIsOutsideProject(token, projectRoot) {
-  if (!token || SHELL_OPERATORS.has(token) || token.startsWith("-")) return false;
-  if (token === "/" || token === "~" || token === "." || token === "..") return token !== ".";
-  if (token.includes("*")) return true;
-  if (token.startsWith("..") || token.includes("../") || token.includes("..\\")) return true;
-  if (path4.isAbsolute(token) || token.startsWith("~/")) return !pathLooksInsideProject(token, projectRoot);
+function isCatastrophicDeleteTarget(rawTarget) {
+  const t = rawTarget.replace(/^['"]|['"]$/g, "").trim();
+  if (!t) return false;
+  if (t === "*" || t === "." || t === "./" || t === ".\\" || t === "./*" || t === ".\\*") return true;
+  const s = t.replace(/[\\/]\*+$/, "").replace(/[\\/]+$/, "");
+  if (s === "") return true;
+  if (s === "~" || /^\$HOME$/i.test(s) || /^%USERPROFILE%$/i.test(s)) return true;
+  if (/^[A-Za-z]:$/.test(s)) return true;
+  const norm = s.toLowerCase().replace(/\\/g, "/");
+  if (CATASTROPHIC_POSIX_ROOTS.has(norm)) return true;
+  const win = norm.match(/^[a-z]:\/([^/]+)$/);
+  if (win?.[1] && CATASTROPHIC_WIN_SUBDIRS.has(win[1])) return true;
   return false;
 }
-function hasDangerousDeleteTarget(tokens, start, projectRoot) {
-  const targets = tokens.slice(start).filter((token) => !token.startsWith("-") && !SHELL_OPERATORS.has(token));
-  if (targets.length === 0) return true;
-  return targets.some((target) => pathTokenIsOutsideProject(target, projectRoot));
-}
-function hasDestructiveDelete(command, projectRoot) {
+function hasCatastrophicDelete(command) {
   const tokens = tokenizeShell(command);
   for (let i = 0; i < tokens.length; i++) {
     const token = tokens[i]?.toLowerCase();
@@ -24768,35 +24830,43 @@ function hasDestructiveDelete(command, projectRoot) {
     if (token === "rm") {
       const args = tokens.slice(i + 1);
       const recursiveOrForce = args.some(
-        (arg) => /^-[^-]*[rf]/i.test(arg) || arg === "--recursive" || arg === "--force"
+        (arg) => /^-[^-]*[rf]/i.test(arg) || arg === "--recursive" || arg === "--force" || arg === "--no-preserve-root"
       );
-      if (recursiveOrForce && hasDangerousDeleteTarget(tokens, i + 1, projectRoot)) return true;
+      if (!recursiveOrForce) continue;
+      const targets = args.filter((arg) => !arg.startsWith("-") && !SHELL_OPERATORS.has(arg));
+      if (targets.length === 0) return true;
+      if (targets.some(isCatastrophicDeleteTarget)) return true;
+    }
+    if (token === "remove-item" || token === "ri") {
+      const args = tokens.slice(i + 1);
+      const recursive = args.some((arg) => {
+        const a = arg.toLowerCase();
+        return a === "-recurse" || a === "-force";
+      });
+      if (!recursive) continue;
+      const targets = args.filter((arg) => !arg.startsWith("-") && !SHELL_OPERATORS.has(arg));
+      if (targets.some(isCatastrophicDeleteTarget)) return true;
     }
     if (token === "rmdir" || token === "rd") {
       const args = tokens.slice(i + 1);
       const recursive = args.some((arg) => arg.toLowerCase() === "/s");
-      if (recursive && hasDangerousDeleteTarget(tokens, i + 1, projectRoot)) return true;
+      if (!recursive) continue;
+      const targets = args.filter((arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg));
+      if (targets.some(isCatastrophicDeleteTarget)) return true;
     }
     if (token === "del" || token === "erase") {
-      if (hasDangerousDeleteTarget(tokens, i + 1, projectRoot)) return true;
-    }
-    if (token === "remove-item") {
-      const args = tokens.slice(i + 1).map((arg) => arg.toLowerCase());
-      const recursiveOrForce = args.includes("-recurse") || args.includes("-force");
-      if (recursiveOrForce && hasDangerousDeleteTarget(tokens, i + 1, projectRoot)) return true;
+      const args = tokens.slice(i + 1);
+      const targets = args.filter((arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg));
+      if (targets.some(isCatastrophicDeleteTarget)) return true;
     }
   }
   return false;
 }
-function isClearlyDestructiveBashCommand(command, projectRoot) {
+function isClearlyDestructiveBashCommand(command, _projectRoot) {
   const trimmed = command.trim();
   if (!trimmed) return false;
-  if (hasDestructiveDelete(trimmed, projectRoot)) return true;
-  if (DESTRUCTIVE_BASH_PATTERNS.some((pattern) => pattern.test(trimmed))) return true;
-  if (/\bcd\s+(?:\.\.|~|\/|[A-Za-z]:[\\/])/i.test(trimmed)) return true;
-  if (PROJECT_ESCAPE_PATTERN.test(trimmed)) return true;
-  const absolute = trimmed.match(ABSOLUTE_PATH_PATTERN)?.[0]?.trim().replace(/^['"]|['"]$/g, "");
-  if (absolute && !pathLooksInsideProject(absolute, projectRoot)) return true;
+  if (hasCatastrophicDelete(trimmed)) return true;
+  if (CATASTROPHIC_PATTERNS.some((pattern) => pattern.test(trimmed))) return true;
   return false;
 }
 
@@ -24804,6 +24874,15 @@ function isClearlyDestructiveBashCommand(command, projectRoot) {
 function matchesTrust(patterns, subject) {
   return patterns.includes(subject) || matchAny(patterns, subject);
 }
+function shellCommandLineFromInput(input) {
+  const command = getInputString(input, "command") ?? getInputString(input, "cmd") ?? getInputString(input, "script");
+  if (!command) return void 0;
+  if (!input || typeof input !== "object") return command;
+  const args = input["args"];
+  if (!Array.isArray(args) || args.length === 0) return command;
+  const renderedArgs = args.filter((arg) => typeof arg === "string").map((arg) => /\s/.test(arg) ? `"${arg.replace(/"/g, '\\"')}"` : arg);
+  return [command, ...renderedArgs].join(" ");
+}
 var DefaultPermissionPolicy = class {
   policy = {};
   loaded = false;
@@ -24821,9 +24900,10 @@ var DefaultPermissionPolicy = class {
    */
   sessionDenied = /* @__PURE__ */ new Map();
   /**
-   * Session-scoped "soft trust" map. When the user presses 'a' (allow once),
-   * the tool+pattern is added here. If the LLM retries in the same session,
-   * we return auto directly without asking again.
+   * Session-scoped one-shot "soft trust" map. When the user presses 'y', the
+   * tool+pattern is added here so the immediate confirm re-run can proceed.
+   * The entry is consumed on first use; future calls must ask again unless the
+   * user chose persistent trust.
    *
    * Cleared on reload().
    */
@@ -24862,7 +24942,7 @@ var DefaultPermissionPolicy = class {
     this.trustFile = opts.trustFile;
     this.yolo = opts.yolo ?? false;
     this.yoloDestructive = opts.yoloDestructive ?? opts.forceAllYolo ?? false;
-    this.confirmDestructive = opts.confirmDestructive ?? false;
+    this.confirmDestructive = true;
     this.promptDelegate = opts.promptDelegate;
   }
   /**
@@ -24893,9 +24973,9 @@ var DefaultPermissionPolicy = class {
     return this.yoloDestructive;
   }
   /** Toggle destructive confirmation gate (only meaningful when yolo is active). */
-  setConfirmDestructive(enabled) {
-    if (this.confirmDestructive !== enabled) this._evalCache.clear();
-    this.confirmDestructive = enabled;
+  setConfirmDestructive(_enabled) {
+    if (!this.confirmDestructive) this._evalCache.clear();
+    this.confirmDestructive = true;
   }
   /** Check whether destructive confirmation gate is active. */
   getConfirmDestructive() {
@@ -24934,12 +25014,12 @@ var DefaultPermissionPolicy = class {
       return decision;
     }
     if (this.sessionAllowed.has(cacheKey)) {
+      this.sessionAllowed.delete(cacheKey);
       const decision = {
         permission: "auto",
         source: "trust",
-        reason: "session soft allow (user pressed yes)"
+        reason: "session one-shot allow (user pressed yes)"
       };
-      this._evalCache.set(cacheKey, decision);
       return decision;
     }
     if (entry?.deny && subject && matchesTrust(entry.deny, subject)) {
@@ -24952,6 +25032,29 @@ var DefaultPermissionPolicy = class {
       this._evalCache.set(cacheKey, decision);
       return decision;
     }
+    if (this.yolo) {
+      const destructive = this.isDestructiveYoloCall(tool, input, ctx);
+      if (destructive) {
+        if (this.promptDelegate) {
+          const decision = await this.promptDelegate(tool, input, subject ?? tool.name);
+          if (decision === "deny") {
+            await this.deny({ tool: tool.name, pattern: subject ?? tool.name });
+            return { permission: "deny", source: "user", reason: "user denied destructive yolo" };
+          }
+          return {
+            permission: decision === "yes" || decision === "always" ? "auto" : "deny",
+            source: "user",
+            reason: "destructive yolo approved for this call"
+          };
+        }
+        return {
+          permission: "confirm",
+          source: "yolo_destructive",
+          riskTier: "destructive",
+          reason: "destructive tool needs explicit approval in YOLO mode"
+        };
+      }
+    }
     if (entry?.allow && subject && matchesTrust(entry.allow, subject)) {
       const decision = { permission: "auto", source: "trust", reason: "matched allow pattern" };
       this._evalCache.set(cacheKey, decision);
@@ -24963,29 +25066,6 @@ var DefaultPermissionPolicy = class {
       return decision;
     }
     if (this.yolo) {
-      if (this.confirmDestructive) {
-        const destructive = this.isDestructiveYoloCall(tool, input, ctx);
-        if (destructive) {
-          if (this.promptDelegate) {
-            const decision2 = await this.promptDelegate(tool, input, subject ?? tool.name);
-            if (decision2 === "always") {
-              await this.trust({ tool: tool.name, pattern: subject ?? tool.name });
-              return { permission: "auto", source: "user", reason: "destructive yolo always-allowed" };
-            }
-            if (decision2 === "deny") {
-              await this.deny({ tool: tool.name, pattern: subject ?? tool.name });
-              return { permission: "deny", source: "user", reason: "user denied destructive yolo" };
-            }
-            return { permission: decision2 === "yes" ? "auto" : "deny", source: "user" };
-          }
-          return {
-            permission: "confirm",
-            source: "yolo_destructive",
-            riskTier: "destructive",
-            reason: "destructive tool needs explicit approval (confirmDestructive is on)"
-          };
-        }
-      }
       const decision = { permission: "auto", source: "yolo" };
       this._evalCache.set(cacheKey, decision);
       return decision;
@@ -25002,7 +25082,8 @@ var DefaultPermissionPolicy = class {
     const hasWriteCap = hasCapability(tool, ToolCapabilities.FS_WRITE);
     const hasShellCap = hasCapability(tool, [
       ToolCapabilities.SHELL_ARBITRARY,
-      ToolCapabilities.SHELL_RESTRICTED
+      ToolCapabilities.SHELL_RESTRICTED,
+      ToolCapabilities.SHELL_EXEC
     ]);
     const hasInstallCap = hasCapability(tool, ToolCapabilities.PACKAGE_INSTALL);
     const hasConfigCap = hasCapability(tool, ToolCapabilities.CONFIG_MUTATE);
@@ -25030,27 +25111,30 @@ var DefaultPermissionPolicy = class {
   // Capability-based destructive check (preferred over name-based)
   isDestructiveByCapability(tool) {
     const caps = tool.capabilities ?? [];
-    if (caps.includes("shell.arbitrary")) return true;
-    if (caps.includes("fs.write")) return true;
-    if (caps.includes("fs.write.outside-project")) return true;
+    if (caps.includes(ToolCapabilities.SHELL_ARBITRARY)) return true;
+    if (caps.includes(ToolCapabilities.SHELL_RESTRICTED)) return true;
+    if (caps.includes(ToolCapabilities.SHELL_EXEC)) return true;
+    if (caps.includes(ToolCapabilities.FS_WRITE)) return true;
+    if (caps.includes(ToolCapabilities.FS_WRITE_OUTSIDE_PROJECT)) return true;
     return false;
   }
   isDestructiveYoloCall(tool, input, ctx) {
     if (this.isDestructiveByCapability(tool)) {
-      if (tool.name === "bash") {
-        const command = getInputString(input, "command");
-        return command ? isClearlyDestructiveBashCommand(command, ctx.projectRoot) : true;
+      const caps = tool.capabilities ?? [];
+      if (caps.includes(ToolCapabilities.SHELL_ARBITRARY) || caps.includes(ToolCapabilities.SHELL_RESTRICTED) || caps.includes(ToolCapabilities.SHELL_EXEC)) {
+        const command = shellCommandLineFromInput(input);
+        return command ? isClearlyDestructiveBashCommand(command, ctx.projectRoot) : tool.riskTier === "destructive";
       }
-      if (tool.name === "write" || tool.name === "edit" || tool.name === "replace" || tool.name === "patch") {
+      if (caps.includes(ToolCapabilities.FS_WRITE_OUTSIDE_PROJECT)) return true;
+      if (caps.includes(ToolCapabilities.FS_WRITE)) {
         const targetPath = getInputString(input, "path") ?? getInputString(input, "file");
         if (!targetPath || !ctx.projectRoot) return false;
         return !pathLooksInsideProject(targetPath, ctx.projectRoot);
       }
-      return true;
     }
-    if (tool.name === "bash") {
-      const command = getInputString(input, "command");
-      return command ? isClearlyDestructiveBashCommand(command, ctx.projectRoot) : true;
+    if (tool.name === "bash" || tool.name === "shell" || tool.name === "exec") {
+      const command = shellCommandLineFromInput(input);
+      return command ? isClearlyDestructiveBashCommand(command, ctx.projectRoot) : tool.riskTier === "destructive";
     }
     if (tool.name === "write" || tool.name === "edit" || tool.name === "replace" || tool.name === "patch") {
       const targetPath = getInputString(input, "path") ?? getInputString(input, "file");
@@ -25099,7 +25183,7 @@ var DefaultPermissionPolicy = class {
     this.sessionDenied.set(`${rule.tool}::${rule.pattern}`, true);
     this._evalCache.clear();
   }
-  /** Auto-approve this tool+pattern for the rest of this session (no trust file). */
+  /** Auto-approve this tool+pattern once (no trust file). */
   allowOnce(rule) {
     this.sessionAllowed.set(`${rule.tool}::${rule.pattern}`, true);
     this._evalCache.clear();