@wrongstack/core 0.276.4 → 0.277.1

package/dist/index.js

@@ -2199,6 +2199,10 @@ function formatTodosList(todos) {
   });
   return lines.join("\n");
 }
+function hasOpenTodos(todos) {
+  if (!Array.isArray(todos) || todos.length === 0) return false;
+  return todos.some((t2) => t2.status === "pending" || t2.status === "in_progress");
+}
 var init_todos_format = __esm({
   "src/utils/todos-format.ts"() {
     init_color();
@@ -7920,6 +7924,8 @@ var ToolCapabilities = {
   SHELL_ARBITRARY: "shell.arbitrary",
   /** Can execute a restricted set of commands (the `exec` tool). */
   SHELL_RESTRICTED: "shell.restricted",
+  /** Can run a restricted project formatter/linter-style command. */
+  SHELL_EXEC: "shell.exec",
   /** Can read files inside the project (and possibly outside via symlinks if not guarded). */
   FS_READ: "fs.read",
   /** Can write / modify / delete files inside the project. */
@@ -7928,6 +7934,20 @@ var ToolCapabilities = {
   FS_WRITE_OUTSIDE_PROJECT: "fs.write.outside-project",
   /** Can perform outbound network requests. */
   NET_OUTBOUND: "net.outbound",
+  /** Can mutate in-memory session todos only. */
+  SESSION_TODO: "session.todo",
+  /** Can mutate in-memory session mode only. */
+  SESSION_MODE: "session.mode",
+  /** Can inspect registered tool metadata. */
+  TOOL_META: "tool.meta",
+  /** Can invoke arbitrary registered tools through a meta-tool. */
+  TOOL_MUTATE_ANY: "tool.mutate.any",
+  /** Can read persistent memory. */
+  MEMORY_READ: "memory.read",
+  /** Can write persistent memory. */
+  MEMORY_WRITE: "memory.write",
+  /** Can delete persistent memory. */
+  MEMORY_DELETE: "memory.delete",
   /** Proxies tools from external MCP servers (unknown capability). */
   MCP_PROXY: "mcp.proxy",
   /** Can spawn or manage subagents / multi-agent tasks. */
@@ -7946,8 +7966,12 @@ var ToolCapabilities = {
 var DANGEROUS_FOR_SUBAGENTS = [
   ToolCapabilities.SHELL_ARBITRARY,
   ToolCapabilities.SHELL_RESTRICTED,
+  ToolCapabilities.SHELL_EXEC,
   ToolCapabilities.FS_WRITE,
   ToolCapabilities.FS_WRITE_OUTSIDE_PROJECT,
+  ToolCapabilities.TOOL_MUTATE_ANY,
+  ToolCapabilities.MEMORY_WRITE,
+  ToolCapabilities.MEMORY_DELETE,
   ToolCapabilities.MCP_PROXY,
   ToolCapabilities.SUBAGENT_SPAWN,
   ToolCapabilities.CONFIG_MUTATE,
@@ -7957,8 +7981,12 @@ var WIDE_SUBAGENT_CAPABILITIES = [
   ToolCapabilities.FS_READ,
   ToolCapabilities.FS_WRITE,
   ToolCapabilities.NET_OUTBOUND,
+  ToolCapabilities.SESSION_TODO,
+  ToolCapabilities.TOOL_META,
+  ToolCapabilities.MEMORY_READ,
   ToolCapabilities.SHELL_ARBITRARY,
   ToolCapabilities.SHELL_RESTRICTED,
+  ToolCapabilities.SHELL_EXEC,
   ToolCapabilities.PACKAGE_INSTALL
 ];
 function hasDangerousCapabilityForSubagents(toolOrCaps) {
@@ -8185,7 +8213,7 @@ ${errorDetails}`,
       const decision = await this.opts.permissionPolicy.evaluate(tool, use.input, ctx);
       let effectivePermission = decision.permission;
       const policy = this.opts.permissionPolicy;
-      const yolo = policy.getYolo?.() === true || policy.getYoloDestructive?.() === true;
+      const yolo = policy.getYolo?.() === true;
       const authoritativeAuto = decision.source === "yolo";
       if (toolDangerousCaps.length > 0 && effectivePermission === "auto" && !yolo && !authoritativeAuto) {
         effectivePermission = "confirm";
@@ -15311,6 +15339,7 @@ var Director = class _Director {
   sessionIdSource;
   /** Debounce timer for periodic manifest writes. */
   manifestTimer = null;
+  manifestWriteChain = Promise.resolve();
   manifestDebounceMs;
   /** Fleet-wide cost cap (entire fleet total, distinct from SubagentBudget limits). Infinity means no cap. */
   maxFleetCostUsd;
@@ -15487,7 +15516,7 @@ var Director = class _Director {
         }
       );
       if (this.fleetManager) {
-        this.fleetManager.flushManifest();
+        void this.fleetManager.flushManifest();
       } else {
         this.scheduleManifest();
       }
@@ -15766,6 +15795,7 @@ var Director = class _Director {
       return;
     }
     if (this.manifestDebounceMs < 0) return;
+    if (this.manifestTimer) return;
     this.manifestTimer = setTimeout(() => {
       this.manifestTimer = null;
       void this.writeManifest().catch(
@@ -15773,6 +15803,11 @@ var Director = class _Director {
       );
     }, this.manifestDebounceMs);
   }
+  clearManifestTimer() {
+    if (!this.manifestTimer) return;
+    clearTimeout(this.manifestTimer);
+    this.manifestTimer = null;
+  }
   /**
    * Spawn a subagent. Identical to the coordinator's `spawn()` but
    * captures provider/model metadata for the usage aggregator and
@@ -15995,6 +16030,13 @@ var Director = class _Director {
    * replay an entire director run.
    */
   async writeManifest() {
+    if (!this.manifestPath) return null;
+    this.clearManifestTimer();
+    const write = this.manifestWriteChain.catch(() => void 0).then(() => this.writeManifestNow());
+    this.manifestWriteChain = write.catch(() => void 0);
+    return write;
+  }
+  async writeManifestNow() {
     if (!this.manifestPath) return null;
     const manifest = {
       directorRunId: this.id,
@@ -16027,10 +16069,7 @@ var Director = class _Director {
    * — calling shutdown twice is a no-op on the second invocation.
    */
   async shutdown() {
-    if (this.manifestTimer) {
-      clearTimeout(this.manifestTimer);
-      this.manifestTimer = null;
-    }
+    this.clearManifestTimer();
     if (this.taskCompletedListener) {
       this.coordinator.off("task.completed", this.taskCompletedListener);
       this.taskCompletedListener = null;
@@ -16049,8 +16088,11 @@ var Director = class _Director {
     }
     this.subagentBridges.clear();
     await this.bridge.stop().catch((err) => this.logShutdownError("director_bridge_stop", err));
-    if (this.manifestPath)
+    if (this.fleetManager) {
+      await this.fleetManager.flushManifest().catch((err) => this.logShutdownError("fleet_manifest_flush", err));
+    } else if (this.manifestPath) {
       await this.writeManifest().catch((err) => this.logShutdownError("manifest_write", err));
+    }
     if (this.stateCheckpoint) {
       this.stateCheckpoint.setUsage(this.usage.snapshot());
       await this.stateCheckpoint.flush().catch((err) => this.logShutdownError("state_checkpoint_flush", err));
@@ -22861,7 +22903,10 @@ function createContextManagerTool(opts = {}) {
       required: ["action"]
     },
     permission: "auto",
-    mutating: true,
+    // Mutates only the in-memory conversation context, like the todo tool.
+    // It must stay auto-runnable so the model can inspect/repair/compact its
+    // own context without hitting a permission prompt loop.
+    mutating: false,
     async execute(input, ctx) {
       const messages = ctx.messages;
       const beforeTokens = roughEstimate(messages);
@@ -29561,19 +29606,51 @@ var LruCache = class {
 // src/security/permission-policy.ts
 init_safe_json();
 init_tool_subject();
-var DESTRUCTIVE_BASH_PATTERNS = [
-  /\bgit\s+(?:clean\s+-[^\s]*[xdf]|reset\s+--hard)\b/i,
-  /\b(?:drop|truncate)\s+(?:table|database|schema)\b/i,
-  /\bdelete\s+from\b/i,
-  /\b(?:mkfs|format|diskpart|shutdown|reboot)\b/i,
-  /\bchmod\s+-R\s+777\b/i,
-  /\bchown\s+-R\b/i,
-  /\b(?:curl|wget)\b.*\|\s*(?:sh|bash|zsh|pwsh|powershell)\b/i,
-  /\b(?:powershell|pwsh)\b.*(?:-encodedcommand|-enc)\b/i,
-  /:\(\)\s*\{\s*:\|:&\s*}\s*;/
+var CATASTROPHIC_PATTERNS = [
+  /\b(?:mkfs(?:\.[a-z0-9]+)?|mke2fs|newfs)\b/i,
+  // make a filesystem — wipes a partition
+  /\bformat\s+[A-Za-z]:/i,
+  // format C: — wipes a Windows volume
+  /\bdiskpart\b/i,
+  // Windows partition editor
+  /\bdd\b[^|]*\bof=(?:\/dev\/|\\\\[.?]\\)/i,
+  // dd writing straight to a raw device
+  />\s*\/dev\/(?:sd|hd|nvme|disk|mapper|vd)/i,
+  // redirect into a raw block device
+  /:\(\)\s*\{\s*:\|:&\s*\}\s*;/
+  // classic fork bomb
 ];
-var PROJECT_ESCAPE_PATTERN = /(?:^|[\s"'])\.\.(?:[\\/]|$)/;
-var ABSOLUTE_PATH_PATTERN = /(?:^|[\s"'])(?:~[\\/]|\/[A-Za-z0-9_.-]|[A-Za-z]:[\\/])/;
+var CATASTROPHIC_POSIX_ROOTS = /* @__PURE__ */ new Set([
+  "/etc",
+  "/usr",
+  "/bin",
+  "/sbin",
+  "/lib",
+  "/lib64",
+  "/var",
+  "/boot",
+  "/dev",
+  "/sys",
+  "/proc",
+  "/opt",
+  "/root",
+  "/home",
+  "/srv",
+  "/run",
+  "/system",
+  "/library",
+  "/applications",
+  "/users"
+]);
+var CATASTROPHIC_WIN_SUBDIRS = /* @__PURE__ */ new Set([
+  "windows",
+  "system32",
+  "winnt",
+  "program files",
+  "program files (x86)",
+  "programdata",
+  "users"
+]);
 var SHELL_OPERATORS = /* @__PURE__ */ new Set(["&&", "||", "|", ";", ">", ">>", "<", "2>", "2>>"]);
 function getInputString(input, key) {
   if (!input || typeof input !== "object") return void 0;
@@ -29590,20 +29667,21 @@ function pathLooksInsideProject(rawPath, projectRoot) {
 function tokenizeShell(command) {
   return command.match(/"[^"]*"|'[^']*'|\S+/g)?.map((token) => token.replace(/^['"]|['"]$/g, "")) ?? [];
 }
-function pathTokenIsOutsideProject(token, projectRoot) {
-  if (!token || SHELL_OPERATORS.has(token) || token.startsWith("-")) return false;
-  if (token === "/" || token === "~" || token === "." || token === "..") return token !== ".";
-  if (token.includes("*")) return true;
-  if (token.startsWith("..") || token.includes("../") || token.includes("..\\")) return true;
-  if (path4.isAbsolute(token) || token.startsWith("~/")) return !pathLooksInsideProject(token, projectRoot);
+function isCatastrophicDeleteTarget(rawTarget) {
+  const t2 = rawTarget.replace(/^['"]|['"]$/g, "").trim();
+  if (!t2) return false;
+  if (t2 === "*" || t2 === "." || t2 === "./" || t2 === ".\\" || t2 === "./*" || t2 === ".\\*") return true;
+  const s = t2.replace(/[\\/]\*+$/, "").replace(/[\\/]+$/, "");
+  if (s === "") return true;
+  if (s === "~" || /^\$HOME$/i.test(s) || /^%USERPROFILE%$/i.test(s)) return true;
+  if (/^[A-Za-z]:$/.test(s)) return true;
+  const norm = s.toLowerCase().replace(/\\/g, "/");
+  if (CATASTROPHIC_POSIX_ROOTS.has(norm)) return true;
+  const win = norm.match(/^[a-z]:\/([^/]+)$/);
+  if (win?.[1] && CATASTROPHIC_WIN_SUBDIRS.has(win[1])) return true;
   return false;
 }
-function hasDangerousDeleteTarget(tokens, start, projectRoot) {
-  const targets = tokens.slice(start).filter((token) => !token.startsWith("-") && !SHELL_OPERATORS.has(token));
-  if (targets.length === 0) return true;
-  return targets.some((target) => pathTokenIsOutsideProject(target, projectRoot));
-}
-function hasDestructiveDelete(command, projectRoot) {
+function hasCatastrophicDelete(command) {
   const tokens = tokenizeShell(command);
   for (let i = 0; i < tokens.length; i++) {
     const token = tokens[i]?.toLowerCase();
@@ -29611,35 +29689,43 @@ function hasDestructiveDelete(command, projectRoot) {
     if (token === "rm") {
       const args = tokens.slice(i + 1);
       const recursiveOrForce = args.some(
-        (arg) => /^-[^-]*[rf]/i.test(arg) || arg === "--recursive" || arg === "--force"
+        (arg) => /^-[^-]*[rf]/i.test(arg) || arg === "--recursive" || arg === "--force" || arg === "--no-preserve-root"
       );
-      if (recursiveOrForce && hasDangerousDeleteTarget(tokens, i + 1, projectRoot)) return true;
+      if (!recursiveOrForce) continue;
+      const targets = args.filter((arg) => !arg.startsWith("-") && !SHELL_OPERATORS.has(arg));
+      if (targets.length === 0) return true;
+      if (targets.some(isCatastrophicDeleteTarget)) return true;
+    }
+    if (token === "remove-item" || token === "ri") {
+      const args = tokens.slice(i + 1);
+      const recursive = args.some((arg) => {
+        const a = arg.toLowerCase();
+        return a === "-recurse" || a === "-force";
+      });
+      if (!recursive) continue;
+      const targets = args.filter((arg) => !arg.startsWith("-") && !SHELL_OPERATORS.has(arg));
+      if (targets.some(isCatastrophicDeleteTarget)) return true;
     }
     if (token === "rmdir" || token === "rd") {
       const args = tokens.slice(i + 1);
       const recursive = args.some((arg) => arg.toLowerCase() === "/s");
-      if (recursive && hasDangerousDeleteTarget(tokens, i + 1, projectRoot)) return true;
+      if (!recursive) continue;
+      const targets = args.filter((arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg));
+      if (targets.some(isCatastrophicDeleteTarget)) return true;
     }
     if (token === "del" || token === "erase") {
-      if (hasDangerousDeleteTarget(tokens, i + 1, projectRoot)) return true;
-    }
-    if (token === "remove-item") {
-      const args = tokens.slice(i + 1).map((arg) => arg.toLowerCase());
-      const recursiveOrForce = args.includes("-recurse") || args.includes("-force");
-      if (recursiveOrForce && hasDangerousDeleteTarget(tokens, i + 1, projectRoot)) return true;
+      const args = tokens.slice(i + 1);
+      const targets = args.filter((arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg));
+      if (targets.some(isCatastrophicDeleteTarget)) return true;
     }
   }
   return false;
 }
-function isClearlyDestructiveBashCommand(command, projectRoot) {
+function isClearlyDestructiveBashCommand(command, _projectRoot) {
   const trimmed = command.trim();
   if (!trimmed) return false;
-  if (hasDestructiveDelete(trimmed, projectRoot)) return true;
-  if (DESTRUCTIVE_BASH_PATTERNS.some((pattern) => pattern.test(trimmed))) return true;
-  if (/\bcd\s+(?:\.\.|~|\/|[A-Za-z]:[\\/])/i.test(trimmed)) return true;
-  if (PROJECT_ESCAPE_PATTERN.test(trimmed)) return true;
-  const absolute = trimmed.match(ABSOLUTE_PATH_PATTERN)?.[0]?.trim().replace(/^['"]|['"]$/g, "");
-  if (absolute && !pathLooksInsideProject(absolute, projectRoot)) return true;
+  if (hasCatastrophicDelete(trimmed)) return true;
+  if (CATASTROPHIC_PATTERNS.some((pattern) => pattern.test(trimmed))) return true;
   return false;
 }
 
@@ -29647,6 +29733,15 @@ function isClearlyDestructiveBashCommand(command, projectRoot) {
 function matchesTrust(patterns, subject) {
   return patterns.includes(subject) || matchAny(patterns, subject);
 }
+function shellCommandLineFromInput(input) {
+  const command = getInputString(input, "command") ?? getInputString(input, "cmd") ?? getInputString(input, "script");
+  if (!command) return void 0;
+  if (!input || typeof input !== "object") return command;
+  const args = input["args"];
+  if (!Array.isArray(args) || args.length === 0) return command;
+  const renderedArgs = args.filter((arg) => typeof arg === "string").map((arg) => /\s/.test(arg) ? `"${arg.replace(/"/g, '\\"')}"` : arg);
+  return [command, ...renderedArgs].join(" ");
+}
 var DefaultPermissionPolicy = class {
   policy = {};
   loaded = false;
@@ -29664,9 +29759,10 @@ var DefaultPermissionPolicy = class {
    */
   sessionDenied = /* @__PURE__ */ new Map();
   /**
-   * Session-scoped "soft trust" map. When the user presses 'a' (allow once),
-   * the tool+pattern is added here. If the LLM retries in the same session,
-   * we return auto directly without asking again.
+   * Session-scoped one-shot "soft trust" map. When the user presses 'y', the
+   * tool+pattern is added here so the immediate confirm re-run can proceed.
+   * The entry is consumed on first use; future calls must ask again unless the
+   * user chose persistent trust.
    *
    * Cleared on reload().
    */
@@ -29705,7 +29801,7 @@ var DefaultPermissionPolicy = class {
     this.trustFile = opts.trustFile;
     this.yolo = opts.yolo ?? false;
     this.yoloDestructive = opts.yoloDestructive ?? opts.forceAllYolo ?? false;
-    this.confirmDestructive = opts.confirmDestructive ?? false;
+    this.confirmDestructive = true;
     this.promptDelegate = opts.promptDelegate;
   }
   /**
@@ -29736,9 +29832,9 @@ var DefaultPermissionPolicy = class {
     return this.yoloDestructive;
   }
   /** Toggle destructive confirmation gate (only meaningful when yolo is active). */
-  setConfirmDestructive(enabled) {
-    if (this.confirmDestructive !== enabled) this._evalCache.clear();
-    this.confirmDestructive = enabled;
+  setConfirmDestructive(_enabled) {
+    if (!this.confirmDestructive) this._evalCache.clear();
+    this.confirmDestructive = true;
   }
   /** Check whether destructive confirmation gate is active. */
   getConfirmDestructive() {
@@ -29777,12 +29873,12 @@ var DefaultPermissionPolicy = class {
       return decision;
     }
     if (this.sessionAllowed.has(cacheKey)) {
+      this.sessionAllowed.delete(cacheKey);
       const decision = {
         permission: "auto",
         source: "trust",
-        reason: "session soft allow (user pressed yes)"
+        reason: "session one-shot allow (user pressed yes)"
       };
-      this._evalCache.set(cacheKey, decision);
       return decision;
     }
     if (entry?.deny && subject && matchesTrust(entry.deny, subject)) {
@@ -29795,6 +29891,29 @@ var DefaultPermissionPolicy = class {
       this._evalCache.set(cacheKey, decision);
       return decision;
     }
+    if (this.yolo) {
+      const destructive = this.isDestructiveYoloCall(tool, input, ctx);
+      if (destructive) {
+        if (this.promptDelegate) {
+          const decision = await this.promptDelegate(tool, input, subject ?? tool.name);
+          if (decision === "deny") {
+            await this.deny({ tool: tool.name, pattern: subject ?? tool.name });
+            return { permission: "deny", source: "user", reason: "user denied destructive yolo" };
+          }
+          return {
+            permission: decision === "yes" || decision === "always" ? "auto" : "deny",
+            source: "user",
+            reason: "destructive yolo approved for this call"
+          };
+        }
+        return {
+          permission: "confirm",
+          source: "yolo_destructive",
+          riskTier: "destructive",
+          reason: "destructive tool needs explicit approval in YOLO mode"
+        };
+      }
+    }
     if (entry?.allow && subject && matchesTrust(entry.allow, subject)) {
       const decision = { permission: "auto", source: "trust", reason: "matched allow pattern" };
       this._evalCache.set(cacheKey, decision);
@@ -29806,29 +29925,6 @@ var DefaultPermissionPolicy = class {
       return decision;
     }
     if (this.yolo) {
-      if (this.confirmDestructive) {
-        const destructive = this.isDestructiveYoloCall(tool, input, ctx);
-        if (destructive) {
-          if (this.promptDelegate) {
-            const decision2 = await this.promptDelegate(tool, input, subject ?? tool.name);
-            if (decision2 === "always") {
-              await this.trust({ tool: tool.name, pattern: subject ?? tool.name });
-              return { permission: "auto", source: "user", reason: "destructive yolo always-allowed" };
-            }
-            if (decision2 === "deny") {
-              await this.deny({ tool: tool.name, pattern: subject ?? tool.name });
-              return { permission: "deny", source: "user", reason: "user denied destructive yolo" };
-            }
-            return { permission: decision2 === "yes" ? "auto" : "deny", source: "user" };
-          }
-          return {
-            permission: "confirm",
-            source: "yolo_destructive",
-            riskTier: "destructive",
-            reason: "destructive tool needs explicit approval (confirmDestructive is on)"
-          };
-        }
-      }
       const decision = { permission: "auto", source: "yolo" };
       this._evalCache.set(cacheKey, decision);
       return decision;
@@ -29845,7 +29941,8 @@ var DefaultPermissionPolicy = class {
     const hasWriteCap = hasCapability(tool, ToolCapabilities.FS_WRITE);
     const hasShellCap = hasCapability(tool, [
       ToolCapabilities.SHELL_ARBITRARY,
-      ToolCapabilities.SHELL_RESTRICTED
+      ToolCapabilities.SHELL_RESTRICTED,
+      ToolCapabilities.SHELL_EXEC
     ]);
     const hasInstallCap = hasCapability(tool, ToolCapabilities.PACKAGE_INSTALL);
     const hasConfigCap = hasCapability(tool, ToolCapabilities.CONFIG_MUTATE);
@@ -29873,27 +29970,30 @@ var DefaultPermissionPolicy = class {
   // Capability-based destructive check (preferred over name-based)
   isDestructiveByCapability(tool) {
     const caps = tool.capabilities ?? [];
-    if (caps.includes("shell.arbitrary")) return true;
-    if (caps.includes("fs.write")) return true;
-    if (caps.includes("fs.write.outside-project")) return true;
+    if (caps.includes(ToolCapabilities.SHELL_ARBITRARY)) return true;
+    if (caps.includes(ToolCapabilities.SHELL_RESTRICTED)) return true;
+    if (caps.includes(ToolCapabilities.SHELL_EXEC)) return true;
+    if (caps.includes(ToolCapabilities.FS_WRITE)) return true;
+    if (caps.includes(ToolCapabilities.FS_WRITE_OUTSIDE_PROJECT)) return true;
     return false;
   }
   isDestructiveYoloCall(tool, input, ctx) {
     if (this.isDestructiveByCapability(tool)) {
-      if (tool.name === "bash") {
-        const command = getInputString(input, "command");
-        return command ? isClearlyDestructiveBashCommand(command, ctx.projectRoot) : true;
+      const caps = tool.capabilities ?? [];
+      if (caps.includes(ToolCapabilities.SHELL_ARBITRARY) || caps.includes(ToolCapabilities.SHELL_RESTRICTED) || caps.includes(ToolCapabilities.SHELL_EXEC)) {
+        const command = shellCommandLineFromInput(input);
+        return command ? isClearlyDestructiveBashCommand(command, ctx.projectRoot) : tool.riskTier === "destructive";
       }
-      if (tool.name === "write" || tool.name === "edit" || tool.name === "replace" || tool.name === "patch") {
+      if (caps.includes(ToolCapabilities.FS_WRITE_OUTSIDE_PROJECT)) return true;
+      if (caps.includes(ToolCapabilities.FS_WRITE)) {
         const targetPath = getInputString(input, "path") ?? getInputString(input, "file");
         if (!targetPath || !ctx.projectRoot) return false;
         return !pathLooksInsideProject(targetPath, ctx.projectRoot);
       }
-      return true;
     }
-    if (tool.name === "bash") {
-      const command = getInputString(input, "command");
-      return command ? isClearlyDestructiveBashCommand(command, ctx.projectRoot) : true;
+    if (tool.name === "bash" || tool.name === "shell" || tool.name === "exec") {
+      const command = shellCommandLineFromInput(input);
+      return command ? isClearlyDestructiveBashCommand(command, ctx.projectRoot) : tool.riskTier === "destructive";
     }
     if (tool.name === "write" || tool.name === "edit" || tool.name === "replace" || tool.name === "patch") {
       const targetPath = getInputString(input, "path") ?? getInputString(input, "file");
@@ -29942,7 +30042,7 @@ var DefaultPermissionPolicy = class {
     this.sessionDenied.set(`${rule.tool}::${rule.pattern}`, true);
     this._evalCache.clear();
   }
-  /** Auto-approve this tool+pattern for the rest of this session (no trust file). */
+  /** Auto-approve this tool+pattern once (no trust file). */
   allowOnce(rule) {
     this.sessionAllowed.set(`${rule.tool}::${rule.pattern}`, true);
     this._evalCache.clear();
@@ -40437,6 +40537,8 @@ var FleetManager = class {
   stateCheckpoint;
   sessionWriter;
   manifestTimer = null;
+  manifestWriteChain = Promise.resolve();
+  disposed = false;
   manifestDebounceMs;
   /** Fleet-wide cost cap. Infinity = no cap. Distinct from SubagentBudget limits,
    *  which track per-subagent spend — this field caps the entire fleet total. */
@@ -40625,6 +40727,13 @@ var FleetManager = class {
     this.scheduleManifest();
   }
   async writeManifest() {
+    if (!this.manifestPath) return null;
+    this.clearManifestTimer();
+    const write = this.manifestWriteChain.catch(() => void 0).then(() => this.writeManifestNow());
+    this.manifestWriteChain = write.catch(() => void 0);
+    return write;
+  }
+  async writeManifestNow() {
     if (!this.manifestPath) return null;
     const manifest = {
       version: 1,
@@ -40658,6 +40767,7 @@ var FleetManager = class {
    * When `manifestDebounceMs` is 0, writes are synchronous (no debounce).
    */
   scheduleManifest() {
+    if (this.disposed) return;
     if (!this.manifestPath) return;
     if (this.manifestDebounceMs === 0) {
       void this.writeManifest().catch((err) => {
@@ -40688,10 +40798,7 @@ var FleetManager = class {
    */
   async flushManifest() {
     if (!this.manifestPath) return;
-    if (this.manifestTimer) {
-      clearTimeout(this.manifestTimer);
-      this.manifestTimer = null;
-    }
+    this.clearManifestTimer();
     await this.writeManifest().catch((err) => {
       const detail = toErrorMessage(err);
       process.emitWarning(
@@ -40700,6 +40807,11 @@ var FleetManager = class {
       );
     });
   }
+  clearManifestTimer() {
+    if (!this.manifestTimer) return;
+    clearTimeout(this.manifestTimer);
+    this.manifestTimer = null;
+  }
   /** Best-effort session event writer. Swallows failures. */
   async appendSessionEvent(event) {
     if (!this.sessionWriter) return;
@@ -40769,10 +40881,8 @@ var FleetManager = class {
   }
   /** Release all resources: clear the manifest debounce timer and dispose the usage aggregator. */
   dispose() {
-    if (this.manifestTimer) {
-      clearTimeout(this.manifestTimer);
-      this.manifestTimer = null;
-    }
+    this.disposed = true;
+    this.clearManifestTimer();
     this.usage.dispose();
   }
 };
@@ -45626,15 +45736,14 @@ function createMcpControlTool(opts) {
     name: "mcp_control",
     description: "Manage MCP server lifecycle: list available servers, search by name or capability, enable or disable servers at runtime, restart running servers. Use activate/deactivate to ephemerally toggle tool registration without disconnecting \u2014 ideal for token-saving mode where MCP tools are lazy-loaded on demand. NOTE: `enable`/`restart` start a server process, which for the built-in stdio presets runs `npx -y <package>` \u2014 i.e. it fetches and executes an npm package from the network. Treat it as code execution.",
     category: "mcp",
-    permission: "auto",
+    permission: "confirm",
     mutating: true,
     // `enable`/`restart` spawn a server process that, for the stdio presets,
     // fetches and runs an npm package (`npx -y <pkg>`) — effectively remote
-    // code execution. Marking the tool destructive means the YOLO
-    // `confirmDestructive` safety net still prompts before it runs (plain
-    // non-YOLO already confirms via the CONFIG_MUTATE dangerous-capability
-    // net in the executor). Read-only actions (list/search) ride the same
-    // tool but are cheap to confirm/trust once.
+    // code execution. Marking the tool destructive means YOLO still prompts
+    // before it runs (plain non-YOLO already confirms via the CONFIG_MUTATE
+    // dangerous-capability net in the executor). Read-only actions
+    // (list/search) ride the same tool but are cheap to confirm/trust once.
     riskTier: "destructive",
     capabilities: [ToolCapabilities.CONFIG_MUTATE],
     inputSchema,
@@ -45878,7 +45987,7 @@ function createMcpUseTool(opts) {
     name: "mcp_use",
     description: "Call an MCP tool on a lazy-loaded server. Activates the server temporarily, calls the tool, returns the result, and deactivates. Use this instead of the manual activate\u2192use\u2192deactivate cycle. First call mcp_control list/search to find the right server and tool name.",
     category: "mcp",
-    permission: "auto",
+    permission: "confirm",
     mutating: true,
     riskTier: "standard",
     capabilities: [ToolCapabilities.MCP_PROXY],
@@ -47875,7 +47984,7 @@ var HookRunner = class {
 // src/hooks/shell-hooks-equal.ts
 function shellHooksEqual(a, b) {
   if (a === b) return true;
-  if (!a || !b) return !a && !b ? true : false;
+  if (!a || !b) return !a && !b;
   const aKeys = Object.keys(a);
   const bKeys = Object.keys(b);
   if (aKeys.length !== bKeys.length) return false;
@@ -47889,7 +47998,7 @@ function shellHooksEqual(a, b) {
     for (let i = 0; i < aList.length; i++) {
       const x = aList[i];
       const y = bList[i];
-      if (!x || !y) return !x && !y ? true : false;
+      if (!x || !y) return !x && !y;
       if (x.command !== y.command) return false;
       if ((x.matcher ?? "*") !== (y.matcher ?? "*")) return false;
       if ((x.timeoutMs ?? void 0) !== (y.timeoutMs ?? void 0)) return false;
@@ -54355,6 +54464,6 @@ function createChimeraPlugin() {
   };
 }
 
-export { ACP_AGENTS, AGENTS_BY_PHASE, AGENT_CATALOG, TOOLS as AGENT_TOOL_PRESETS, AISpecBuilder, ALL_AGENT_DEFINITIONS, ALL_FLEET_AGENTS, ALL_SYNC_CATEGORIES, AUDIT_LOG_AGENT, AdaptiveConcurrencyController, Agent, AgentError, AgentMonitorService, AgentStatusTracker, AnnotationsStore, AutoApprovePermissionPolicy, AutoCompactionMiddleware, AutoExecutor, AutoPhasePlanner, AutoPhaseRunner, AutonomousBrain, AutonomousCoordinator, AutonomousRunner, BUG_HUNTER_AGENT, BUILD_AGENTS, BUILTIN_PROMPT_CATEGORIES, BrainDecisionQueue, BrainMonitor, BudgetExceededError, BudgetThresholdSignal, CHIMERA_REVIEW_PROMPT, CODEX_MODELS, CONTEXT_WINDOW_MODES, CORE_RECONSTRUCT_EVENTS, ChangeManager, CheckpointManager, CloudSync, CollabSession, CollaborationBus, ConfigError, ConfigMigrationError, ConsensusProtocol, Container, Context, ConversationState, DANGEROUS_FOR_SUBAGENTS, DECISION_TIMEOUT_MS, DEFAULT_AUTONOMY_CONFIG, DEFAULT_CIRCUIT_BREAKER_CONFIG, DEFAULT_CONFIG_MIGRATIONS, DEFAULT_CONTEXT_CONFIG, DEFAULT_CONTEXT_WINDOW_MODE_ID, DEFAULT_DIRECTOR_PREAMBLE, DEFAULT_DISPATCH_ROLE, DEFAULT_HQ_REDACTION_POLICY, DEFAULT_MAX_ITERATIONS, DEFAULT_MODES, DEFAULT_QUALITY_CHECKS, DEFAULT_RECOVERY_STRATEGIES, DEFAULT_SESSION_LOGGING_CONFIG, DEFAULT_SESSION_PRUNE_DAYS, DEFAULT_SPEC_TEMPLATE, DEFAULT_SUBAGENT_BASELINE, DEFAULT_TOOLS_CONFIG, DEFAULT_TOOL_DESCRIPTION_MODE, DEFAULT_TOOL_RESULT_RENDER_MODE, DEFAULT_TUI_THINKING_WORD, DELIVERY_AGENTS, DEPENDENCY_FILE_PATTERNS, DESIGN_STACKS, DISCOVERY_AGENTS, DOMAIN_AGENTS, DefaultAttachmentStore, DefaultBrainArbiter, DefaultConfigLoader, DefaultConfigStore, DefaultDesignKitLoader, DefaultErrorHandler, DefaultHealthRegistry, DefaultLogger, DefaultMailbox, DefaultMemoryStore, DefaultModeStore, DefaultModelsRegistry, DefaultMultiAgentCoordinator, DefaultPathResolver, DefaultPermissionPolicy, DefaultPluginAPI, DefaultPromptLoader, DefaultPromptStore, DefaultProviderRunner, DefaultRetryPolicy, DefaultSecretScrubber, DefaultSecretVault, DefaultSessionReader, DefaultSessionRewinder, DefaultSessionStore, DefaultSkillLoader, DefaultSystemPromptBuilder, DefaultTaskStore, DefaultTokenCounter, Director, DirectorAlertLevel, DirectorStateCheckpoint, DoneConditionChecker, ENHANCER_SYSTEM_PROMPT, ERROR_CODES, EternalAutonomyEngine, EventBus, ExtensionRegistry, FLEET_ROSTER, FLEET_ROSTER_BUDGETS, FLEET_ROSTER_WITHACP, FORBIDDEN_PROTO_KEYS, FetchError, FileMemoryBackend, FleetBus, FleetCostCapError, FleetManager, FleetNotifier, FleetSpawnBudgetError, FleetUsageAggregator, FsError, GitignoreUpdater, GlobalMailbox, GraphMemoryBackend, HEAVY_BUDGET, HQ_AUTH_FILE_VERSION, HQ_PROTOCOL_VERSION, HookRegistry, HookRunner, HqPublisher, HumanEscalatingBrainArbiter, HybridCompactor, InMemoryAgentBridge, InMemoryBridgeTransport, InMemoryMetricsSink, InputBuilder, IntelligentCompactor, KERNEL_API_VERSION, KNOWLEDGE_AGENTS, KnowledgeGraph, LAYER_1_IDENTITY, LIGHT_BUDGET, LLMSelector, LargeAnswerStore, MAILBOX_BRIDGE_LOCK_FILENAME, MAILBOX_BRIDGE_TOKEN_FILENAME, MAILBOX_HEALTH_DEFAULT_FAILURE_THRESHOLD, MAILBOX_HEALTH_DEFAULT_FROM, MAILBOX_HEALTH_DEFAULT_INTERVAL_MS, MAILBOX_HEALTH_DEFAULT_TIMEOUT_MS, MALFORMED_ARG_MARKERS, MATRIX_PHASE_KEYS, MAX_JOURNAL_ENTRIES, MAX_PROGRESS_HISTORY, MAX_TUI_THINKING_WORD_LENGTH, MEDIUM_BUDGET, MEMORY_TYPE_LABELS, META_AGENTS, MailboxHealthWatchdog, NULL_FLEET_BUS, NoopMetricsSink, NoopTracer, OTelTracer, ObservableBrainArbiter, PLANNING_AGENTS, PROMETHEUS_CONTENT_TYPE, PROMPT_CATEGORY_LABELS, ParallelEternalEngine, ParseError, PhaseGraphBuilder, PhaseOrchestrator, PhaseStore, Pipeline, PluginError, PromptInstaller, PromptManifestStore, PromptUsageStore, ProviderError, ProviderRegistry, QueueStore, REFACTOR_PLANNER_AGENT, REVIEW_AGENTS, RecoveryLock, ReplayLogStore, ReplayProviderRunner, ReportGenerator, RunController, SECURITY_SCANNER_AGENT, SPEC_TEMPLATES, STANDARD_AUDIT_EVENTS, ScopedEventBus, SddBoardProjector, SddBoardStore, SddError, SddInterviewDriver, SddParallelRun, SddRunRegistry, SddSupervisor, SddTaskDecomposer, SecurityScanner, SecurityScannerOrchestrator, SelectiveCompactor, SessionAnalyzer, SessionError, SessionMemoryConsolidator, SessionRecovery, SessionRegistry, SkillGenerator, SkillInstaller, SkillManifestStore, SlashCommandRegistry, SpecDrivenDev, SpecParser, SpecStore, SpecVersioning, StreamHangError, SubagentBudget, TIMEOUT_PREEMPT_FRACTION, TOKENS, TaskAuctioneer, TaskDAG, TaskFlow, TaskGenerator, TaskGraphStore, TaskTracker, TechStackDetector, ToolAuditLog, ToolCapabilities, ToolError, ToolErrorCategory, ToolExecutor, ToolRegistry, ToolValidationError, VERIFY_AGENTS, WIDE_SUBAGENT_CAPABILITIES, WorktreeManager, WrongStackError, _resetDesignKitLoaderMemo, _resetDesignRulesCache, acquireOrJoin, activateDesign, addPlanItem, allServers, analyzeCriticalPath, appendJournal, applyModelRuntime, applyRosterBudget, applySddLifecycle, applyTokenOverrides, applyToolDescriptionModeToTool, applyToolDescriptionModes, applyToolResultRenderModes, asBlocks, asText, assertNever, assertNotPrivateHost, assertSafePath, assessCommitSafety, assignNickname, atomicWrite, attachAutoExtend, attachDepWatcherBridge, attachMailboxChecker, attachPlanCheckpoint, attachTodosCheckpoint, awsServer, blockServer, bootConfig, braveSearchServer, buildBoardSnapshot, buildBoardTasks, buildBtwBlock, buildChildEnv, buildContextEvidenceDigest, buildDownAlert, buildGoalPreamble, buildLosslessDigest, buildMailboxBlock, buildOtlpMetricsRequest, buildOtlpTracesRequest, buildQueuedMessagesBlock, buildRecoveryAlert, buildRecoveryStrategies, buildSmartDigest, buildTranscriptFromEvents, classifyFamily, classifyToolError, cleanupSddWorktrees, cleanupStaleSddWorktrees, clearActiveKit, clearPersistedActiveKit, clearPlan, codexModelMeta, collabInjectMiddleware, collabPauseMiddleware, color, colorToHex, compactLog, compactSchemaDescriptions, compactToolDefinitionForWire, compileGlob, compileUserRegex, completePartialObject, composeDirectorPrompt, composeSubagentPrompt, computeMessageTokens, computeTaskItemProgress, computeTaskProgress, consumeBtwNotes, consumeQueuedMessagesUpdate, context7Server, contextManagerTool, countShellHooks, createAgentMonitorService, createAutoExecutor, createAutoPhaseFromTaskGraph, createAutonomyBrain, createChimeraPlugin, createContextEvidenceState, createContextManagerTool, createDefaultPipelines, createDelegateTool, createFallbackModelExtension, createGitPlugin, createGlobalMailbox, createHqEventEnvelope, createHqPublisherFromEnv, createMailboxChecker, createMailboxEventPayload, createMailboxHooks, createMailboxSnapshotPayload, createMailboxSnapshotPayloadFromMailbox, createMcpControlTool, createMcpUseTool, createMessage, createObservabilityPlugin, createPlanPlugin, createPromptsPlugin, createSecurityPlugin, createSecuritySlashCommand, createSessionEventBridge, createSkillsPlugin, createStrategyCompactor, createSyncPlugin, createTieredBrainArbiter, createToolOutputSerializer, decryptConfigSecrets, deepMerge, defaultGitignoreUpdater, defaultHqDataDir, defaultOrchestrator, defaultReportGenerator, defaultSecurityScanner, defaultSkillGenerator, defaultTechStackDetector, definePlugin, deriveTodosFromPlanItem, describeCatalogModel, designProjectDir, destroySddProject, detectEcosystem, detectFrontendFile, detectFrontendIntent, detectNewlineStyle, detectEcosystem as detectPackageEcosystem, diffRegistry, dispatchAgent, downloadGitHubTarball, effectiveFallbackChain, eliseOldToolResults, emptyGoal, emptyHqAuthFile, emptyPlan, emptyTaskFile, encryptConfigSecrets, encryptedPrefixForVersion, enhanceUserPrompt, ensureDir, ensureHqFirstRunAuthFile, escapeGlobSubject, estimateMessageTokens, estimateMessages, estimateRequestTokens, estimateRequestTokensCalibrated, estimateTextTokens, estimateToolDefTokens, estimateToolInputTokens, estimateToolResultTokens, everArtServer, expandGlob, expandIPv6, expectDefined, extractRunEnv, extractText, extractVerificationCommand, fallbackProfileChain, filesystemServer, finalize, findCriticalPath, findPreserveStart, flagsToConfigPatch, formatContextWindowModeList, formatDecisionSummary, formatGoal, formatHumanPrompt, formatModelRef, formatPlan, formatPlanTemplates, formatTaskList, formatTaskProgress, formatTodosList, gatedEnhancerReasoning, generateSessionId, getAgentDefinition, getCalibrationState, getContextWindowMode, getDangerousCapabilities, getDesignKitLoader, getDesignState, getFileHistory, getFilesByAgent, getFullLog, getFullPackageLog, getJsonPath, getLastAuthor, getManifestPackages, getPackageAuthor, getPackagesByAgent, getPlanTemplate, getSessionRegistry, getTemplate, getTermSize, getToolDescriptionMode, getToolResultRenderMode, githubServer, goalFilePath, googleMapsServer, hasCapability, hasConflictMarkers, hasDangerousCapabilityForSubagents, hasSessionRegistry, hasTextContent, hashRequest, hookMatcherMatches, hqAuthFilePath, hqRuntimeFilePath, injectPendingMailboxMessages, installDesignStudioMiddleware, isAgentError, isBuiltinCategory, isColorToken, isConfigError, isContextWindowModeId, isDesignStack, isExplanatoryText, isFetchError, isFsError, isImageBlock, isInteractive, isJsonObject, isParseError, isPathSubjectKey, isPluginError, isPrimitiveArray, isPrivateIPv4, isPrivateIPv6, isSddError, isSecretField, isSessionError, isStdinTTY, isStdoutTTY, isTextBlock, isThinkingBlock, isToolError, isToolResultBlock, isToolUseBlock, isToolValidationError, isUlid, isValidMatrixKey, isWrongStackError, jsonObjectFileExists, listContextWindowModes, listPlanTemplates, listTemplates, loadActiveKit, loadDirectorState, loadGoal, loadInstructionBundle, loadPlan, loadPlugins, loadProjectDesignRules, loadProjectModes, loadTasks, loadTodosCheckpoint, loadUserModes, mailboxSessionTag, makeAgentSubagentRunner, makeAskResultTool, makeAskTool, makeAssignTool, makeAutonomyPromptContributor, makeAwaitTasksTool, makeCollabDebugTool, makeCommandVerifier, makeContinueToNextIterationTool, makeDependencyWatcherConfig, makeDesignDetectToolCallMiddleware, makeDesignDetectUserInputMiddleware, makeDesignStudioRequestMiddleware, makeDesignVerifyToolCallMiddleware, makeDirectorSessionFactory, makeFleetEmitTool, makeFleetTool as makeFleetHealthTool, makeFleetTool as makeFleetSessionTool, makeFleetTool as makeFleetStatusTool, makeFleetTool, makeFleetTool as makeFleetUsageTool, makeLLMClassifier, makeLlmConflictResolver, makeLlmSubtaskGenerator, makeMailInboxTool, makeMailSendTool, makeMailboxTool, makePreferSideConflictResolver, makeRollUpTool, makeSpawnTool, makeTerminateAllTool, makeTerminateTool, makeWorkCompleteTool, mapMailboxAgentToHqSummary, mapMailboxMessageToHqSummary, mapSessionEventToEntries, markAssistantReferencedEvidence, matchAny, matchGlob, materializeTokens, matrixKeyKind, mergeCustomModelDefs, mergeInstructionBundle, mergeModelsPayload, mergeToolResults, migratePlaintextSecrets, migratePromptEntry, miniMaxVisionServer, mintHqBrowserToken, mintHqToken, mutateHqAuthFile, mutatePlan, mutateTasks, nicknameKeyFromDisplay, noOpLogger, noOpVault, normalizeModelRef, normalizePathSubject, normalizeRecipient, normalizeToLf, normalizeTokenSavingTier, normalizeToolDescriptionMode, normalizeToolResultRenderMode, normalizeTuiThinkingWord, normalizedEqual, oklchToHex, onResize, parseContinueDirective, parseEncryptedVersion, parseEntries, parseHqEventPayload, parseHqFrame, parseModelRef, parseOklch, parseProgressFromText, parseSkillRef, peekQueuedMessages, pendingBtwCount, phaseForRole, playwrightServer, projectHash, projectSlug, promptChecksum, readBundledInstructionText, readHqAuthFile, readHqRuntimeFileSync, readJsonObjectFile, readLiveLock, recentTextTurns, recordActualUsage, recordFileAction, recordKitChoice, recordOverrides, recordPackageAction, recordProgress, recordToolOutputEvidence, recordUserIntentEvidence, redactHqEvent, redactHqValue, release, removeJsonPath, removeJsonPathInFile, removePlanItem, renderInstructionTemplate, renderProgress, renderPrometheus, renderPrompt, renderSpecAnalysis, renderTaskGraph, renderTaskList, repairToolUseAdjacency, repeatedReadPressure, resetCalibration, resolveAuditLevel, resolveBundledDesignKitsDir, resolveCacheForRequest, resolveChimeraConfig, resolveConflictText, resolveContextWindowPolicy, resolveHqConfig, resolveHqConfigFromEnv, resolveHqDataDir, resolveMailboxIdentity, resolveModelMatrix, resolveModelRuntime, resolveModelTargetFromEntry, resolveProjectDir, resolveProviderModelList, resolveReasoningForRequest, resolveSessionLoggingConfig, resolveToolDescriptionMode, resolveToolResultRenderMode, resolveWstackPaths, rewriteConfigEncrypted, rollbackSddRunFromDisk, rosterSummaryFromConfigs, rotateConfigKeys, runConfigMigrations, runDesignVerify, runProviderWithRetry, runShellHook, safeParse, safeStringify, sanitizeJsonString, sanitizeModel, sanitizeNodeOptions, saveGoal, savePlan, saveTasks, saveTodosCheckpoint, scoreAgents, scoreMessage, scrubAndTruncateHqPreview, securitySlashCommand, sentinelServer, sessionScopedPath, setActiveKit, setBtwNote, setDesignOverrides, setJsonPath, setJsonPathInFile, setOutputLineGuard, setPlanItemStatus, setProgress, setQueuedMessagesSnapshot, setRawMode, setToolDescriptionMode, setToolResultRenderMode, shellHooksEqual, shortIdMap, shouldEnhance, simplifyToolDescription, slackServer, sleep, slugify, smartDefaultFallbackChain, sshManagerServer, stableStringify, startAgentMonitorEventBridge, startMetricsServer, startOtlpMetricsExporter, startOtlpTraceExporter, startPackageOutdatedWatcher, startSddRun, startSessionTelemetryBridge, startTechStackConsumer, stripAnsi, subjectForToolInput, summarizeHqToolArgs, summarizeUsage, templateToMarkdown, toErrorMessage, toStyle, toWrongStackError, topologicalSort, truncate, ulid, unifiedDiff, unloadPlugins, updateJsonObjectFile, updatePackageOutdatedStatus, validateAgainstSchema, validateRegistryManifest, validateWatchdogOptions, verifyFiles, watchHqAuthFile, watchProviderConfig, wireMetricsToEvents, withDisabledToolFiltering, withFileLock, wrapAsState, writeErr, writeHqAuthFile, writeHqRuntimeFile, writeJsonObjectFile, writeOut, wstackGlobalRoot, zaiVisionServer };
+export { ACP_AGENTS, AGENTS_BY_PHASE, AGENT_CATALOG, TOOLS as AGENT_TOOL_PRESETS, AISpecBuilder, ALL_AGENT_DEFINITIONS, ALL_FLEET_AGENTS, ALL_SYNC_CATEGORIES, AUDIT_LOG_AGENT, AdaptiveConcurrencyController, Agent, AgentError, AgentMonitorService, AgentStatusTracker, AnnotationsStore, AutoApprovePermissionPolicy, AutoCompactionMiddleware, AutoExecutor, AutoPhasePlanner, AutoPhaseRunner, AutonomousBrain, AutonomousCoordinator, AutonomousRunner, BUG_HUNTER_AGENT, BUILD_AGENTS, BUILTIN_PROMPT_CATEGORIES, BrainDecisionQueue, BrainMonitor, BudgetExceededError, BudgetThresholdSignal, CHIMERA_REVIEW_PROMPT, CODEX_MODELS, CONTEXT_WINDOW_MODES, CORE_RECONSTRUCT_EVENTS, ChangeManager, CheckpointManager, CloudSync, CollabSession, CollaborationBus, ConfigError, ConfigMigrationError, ConsensusProtocol, Container, Context, ConversationState, DANGEROUS_FOR_SUBAGENTS, DECISION_TIMEOUT_MS, DEFAULT_AUTONOMY_CONFIG, DEFAULT_CIRCUIT_BREAKER_CONFIG, DEFAULT_CONFIG_MIGRATIONS, DEFAULT_CONTEXT_CONFIG, DEFAULT_CONTEXT_WINDOW_MODE_ID, DEFAULT_DIRECTOR_PREAMBLE, DEFAULT_DISPATCH_ROLE, DEFAULT_HQ_REDACTION_POLICY, DEFAULT_MAX_ITERATIONS, DEFAULT_MODES, DEFAULT_QUALITY_CHECKS, DEFAULT_RECOVERY_STRATEGIES, DEFAULT_SESSION_LOGGING_CONFIG, DEFAULT_SESSION_PRUNE_DAYS, DEFAULT_SPEC_TEMPLATE, DEFAULT_SUBAGENT_BASELINE, DEFAULT_TOOLS_CONFIG, DEFAULT_TOOL_DESCRIPTION_MODE, DEFAULT_TOOL_RESULT_RENDER_MODE, DEFAULT_TUI_THINKING_WORD, DELIVERY_AGENTS, DEPENDENCY_FILE_PATTERNS, DESIGN_STACKS, DISCOVERY_AGENTS, DOMAIN_AGENTS, DefaultAttachmentStore, DefaultBrainArbiter, DefaultConfigLoader, DefaultConfigStore, DefaultDesignKitLoader, DefaultErrorHandler, DefaultHealthRegistry, DefaultLogger, DefaultMailbox, DefaultMemoryStore, DefaultModeStore, DefaultModelsRegistry, DefaultMultiAgentCoordinator, DefaultPathResolver, DefaultPermissionPolicy, DefaultPluginAPI, DefaultPromptLoader, DefaultPromptStore, DefaultProviderRunner, DefaultRetryPolicy, DefaultSecretScrubber, DefaultSecretVault, DefaultSessionReader, DefaultSessionRewinder, DefaultSessionStore, DefaultSkillLoader, DefaultSystemPromptBuilder, DefaultTaskStore, DefaultTokenCounter, Director, DirectorAlertLevel, DirectorStateCheckpoint, DoneConditionChecker, ENHANCER_SYSTEM_PROMPT, ERROR_CODES, EternalAutonomyEngine, EventBus, ExtensionRegistry, FLEET_ROSTER, FLEET_ROSTER_BUDGETS, FLEET_ROSTER_WITHACP, FORBIDDEN_PROTO_KEYS, FetchError, FileMemoryBackend, FleetBus, FleetCostCapError, FleetManager, FleetNotifier, FleetSpawnBudgetError, FleetUsageAggregator, FsError, GitignoreUpdater, GlobalMailbox, GraphMemoryBackend, HEAVY_BUDGET, HQ_AUTH_FILE_VERSION, HQ_PROTOCOL_VERSION, HookRegistry, HookRunner, HqPublisher, HumanEscalatingBrainArbiter, HybridCompactor, InMemoryAgentBridge, InMemoryBridgeTransport, InMemoryMetricsSink, InputBuilder, IntelligentCompactor, KERNEL_API_VERSION, KNOWLEDGE_AGENTS, KnowledgeGraph, LAYER_1_IDENTITY, LIGHT_BUDGET, LLMSelector, LargeAnswerStore, MAILBOX_BRIDGE_LOCK_FILENAME, MAILBOX_BRIDGE_TOKEN_FILENAME, MAILBOX_HEALTH_DEFAULT_FAILURE_THRESHOLD, MAILBOX_HEALTH_DEFAULT_FROM, MAILBOX_HEALTH_DEFAULT_INTERVAL_MS, MAILBOX_HEALTH_DEFAULT_TIMEOUT_MS, MALFORMED_ARG_MARKERS, MATRIX_PHASE_KEYS, MAX_JOURNAL_ENTRIES, MAX_PROGRESS_HISTORY, MAX_TUI_THINKING_WORD_LENGTH, MEDIUM_BUDGET, MEMORY_TYPE_LABELS, META_AGENTS, MailboxHealthWatchdog, NULL_FLEET_BUS, NoopMetricsSink, NoopTracer, OTelTracer, ObservableBrainArbiter, PLANNING_AGENTS, PROMETHEUS_CONTENT_TYPE, PROMPT_CATEGORY_LABELS, ParallelEternalEngine, ParseError, PhaseGraphBuilder, PhaseOrchestrator, PhaseStore, Pipeline, PluginError, PromptInstaller, PromptManifestStore, PromptUsageStore, ProviderError, ProviderRegistry, QueueStore, REFACTOR_PLANNER_AGENT, REVIEW_AGENTS, RecoveryLock, ReplayLogStore, ReplayProviderRunner, ReportGenerator, RunController, SECURITY_SCANNER_AGENT, SPEC_TEMPLATES, STANDARD_AUDIT_EVENTS, ScopedEventBus, SddBoardProjector, SddBoardStore, SddError, SddInterviewDriver, SddParallelRun, SddRunRegistry, SddSupervisor, SddTaskDecomposer, SecurityScanner, SecurityScannerOrchestrator, SelectiveCompactor, SessionAnalyzer, SessionError, SessionMemoryConsolidator, SessionRecovery, SessionRegistry, SkillGenerator, SkillInstaller, SkillManifestStore, SlashCommandRegistry, SpecDrivenDev, SpecParser, SpecStore, SpecVersioning, StreamHangError, SubagentBudget, TIMEOUT_PREEMPT_FRACTION, TOKENS, TaskAuctioneer, TaskDAG, TaskFlow, TaskGenerator, TaskGraphStore, TaskTracker, TechStackDetector, ToolAuditLog, ToolCapabilities, ToolError, ToolErrorCategory, ToolExecutor, ToolRegistry, ToolValidationError, VERIFY_AGENTS, WIDE_SUBAGENT_CAPABILITIES, WorktreeManager, WrongStackError, _resetDesignKitLoaderMemo, _resetDesignRulesCache, acquireOrJoin, activateDesign, addPlanItem, allServers, analyzeCriticalPath, appendJournal, applyModelRuntime, applyRosterBudget, applySddLifecycle, applyTokenOverrides, applyToolDescriptionModeToTool, applyToolDescriptionModes, applyToolResultRenderModes, asBlocks, asText, assertNever, assertNotPrivateHost, assertSafePath, assessCommitSafety, assignNickname, atomicWrite, attachAutoExtend, attachDepWatcherBridge, attachMailboxChecker, attachPlanCheckpoint, attachTodosCheckpoint, awsServer, blockServer, bootConfig, braveSearchServer, buildBoardSnapshot, buildBoardTasks, buildBtwBlock, buildChildEnv, buildContextEvidenceDigest, buildDownAlert, buildGoalPreamble, buildLosslessDigest, buildMailboxBlock, buildOtlpMetricsRequest, buildOtlpTracesRequest, buildQueuedMessagesBlock, buildRecoveryAlert, buildRecoveryStrategies, buildSmartDigest, buildTranscriptFromEvents, classifyFamily, classifyToolError, cleanupSddWorktrees, cleanupStaleSddWorktrees, clearActiveKit, clearPersistedActiveKit, clearPlan, codexModelMeta, collabInjectMiddleware, collabPauseMiddleware, color, colorToHex, compactLog, compactSchemaDescriptions, compactToolDefinitionForWire, compileGlob, compileUserRegex, completePartialObject, composeDirectorPrompt, composeSubagentPrompt, computeMessageTokens, computeTaskItemProgress, computeTaskProgress, consumeBtwNotes, consumeQueuedMessagesUpdate, context7Server, contextManagerTool, countShellHooks, createAgentMonitorService, createAutoExecutor, createAutoPhaseFromTaskGraph, createAutonomyBrain, createChimeraPlugin, createContextEvidenceState, createContextManagerTool, createDefaultPipelines, createDelegateTool, createFallbackModelExtension, createGitPlugin, createGlobalMailbox, createHqEventEnvelope, createHqPublisherFromEnv, createMailboxChecker, createMailboxEventPayload, createMailboxHooks, createMailboxSnapshotPayload, createMailboxSnapshotPayloadFromMailbox, createMcpControlTool, createMcpUseTool, createMessage, createObservabilityPlugin, createPlanPlugin, createPromptsPlugin, createSecurityPlugin, createSecuritySlashCommand, createSessionEventBridge, createSkillsPlugin, createStrategyCompactor, createSyncPlugin, createTieredBrainArbiter, createToolOutputSerializer, decryptConfigSecrets, deepMerge, defaultGitignoreUpdater, defaultHqDataDir, defaultOrchestrator, defaultReportGenerator, defaultSecurityScanner, defaultSkillGenerator, defaultTechStackDetector, definePlugin, deriveTodosFromPlanItem, describeCatalogModel, designProjectDir, destroySddProject, detectEcosystem, detectFrontendFile, detectFrontendIntent, detectNewlineStyle, detectEcosystem as detectPackageEcosystem, diffRegistry, dispatchAgent, downloadGitHubTarball, effectiveFallbackChain, eliseOldToolResults, emptyGoal, emptyHqAuthFile, emptyPlan, emptyTaskFile, encryptConfigSecrets, encryptedPrefixForVersion, enhanceUserPrompt, ensureDir, ensureHqFirstRunAuthFile, escapeGlobSubject, estimateMessageTokens, estimateMessages, estimateRequestTokens, estimateRequestTokensCalibrated, estimateTextTokens, estimateToolDefTokens, estimateToolInputTokens, estimateToolResultTokens, everArtServer, expandGlob, expandIPv6, expectDefined, extractRunEnv, extractText, extractVerificationCommand, fallbackProfileChain, filesystemServer, finalize, findCriticalPath, findPreserveStart, flagsToConfigPatch, formatContextWindowModeList, formatDecisionSummary, formatGoal, formatHumanPrompt, formatModelRef, formatPlan, formatPlanTemplates, formatTaskList, formatTaskProgress, formatTodosList, gatedEnhancerReasoning, generateSessionId, getAgentDefinition, getCalibrationState, getContextWindowMode, getDangerousCapabilities, getDesignKitLoader, getDesignState, getFileHistory, getFilesByAgent, getFullLog, getFullPackageLog, getJsonPath, getLastAuthor, getManifestPackages, getPackageAuthor, getPackagesByAgent, getPlanTemplate, getSessionRegistry, getTemplate, getTermSize, getToolDescriptionMode, getToolResultRenderMode, githubServer, goalFilePath, googleMapsServer, hasCapability, hasConflictMarkers, hasDangerousCapabilityForSubagents, hasOpenTodos, hasSessionRegistry, hasTextContent, hashRequest, hookMatcherMatches, hqAuthFilePath, hqRuntimeFilePath, injectPendingMailboxMessages, installDesignStudioMiddleware, isAgentError, isBuiltinCategory, isColorToken, isConfigError, isContextWindowModeId, isDesignStack, isExplanatoryText, isFetchError, isFsError, isImageBlock, isInteractive, isJsonObject, isParseError, isPathSubjectKey, isPluginError, isPrimitiveArray, isPrivateIPv4, isPrivateIPv6, isSddError, isSecretField, isSessionError, isStdinTTY, isStdoutTTY, isTextBlock, isThinkingBlock, isToolError, isToolResultBlock, isToolUseBlock, isToolValidationError, isUlid, isValidMatrixKey, isWrongStackError, jsonObjectFileExists, listContextWindowModes, listPlanTemplates, listTemplates, loadActiveKit, loadDirectorState, loadGoal, loadInstructionBundle, loadPlan, loadPlugins, loadProjectDesignRules, loadProjectModes, loadTasks, loadTodosCheckpoint, loadUserModes, mailboxSessionTag, makeAgentSubagentRunner, makeAskResultTool, makeAskTool, makeAssignTool, makeAutonomyPromptContributor, makeAwaitTasksTool, makeCollabDebugTool, makeCommandVerifier, makeContinueToNextIterationTool, makeDependencyWatcherConfig, makeDesignDetectToolCallMiddleware, makeDesignDetectUserInputMiddleware, makeDesignStudioRequestMiddleware, makeDesignVerifyToolCallMiddleware, makeDirectorSessionFactory, makeFleetEmitTool, makeFleetTool as makeFleetHealthTool, makeFleetTool as makeFleetSessionTool, makeFleetTool as makeFleetStatusTool, makeFleetTool, makeFleetTool as makeFleetUsageTool, makeLLMClassifier, makeLlmConflictResolver, makeLlmSubtaskGenerator, makeMailInboxTool, makeMailSendTool, makeMailboxTool, makePreferSideConflictResolver, makeRollUpTool, makeSpawnTool, makeTerminateAllTool, makeTerminateTool, makeWorkCompleteTool, mapMailboxAgentToHqSummary, mapMailboxMessageToHqSummary, mapSessionEventToEntries, markAssistantReferencedEvidence, matchAny, matchGlob, materializeTokens, matrixKeyKind, mergeCustomModelDefs, mergeInstructionBundle, mergeModelsPayload, mergeToolResults, migratePlaintextSecrets, migratePromptEntry, miniMaxVisionServer, mintHqBrowserToken, mintHqToken, mutateHqAuthFile, mutatePlan, mutateTasks, nicknameKeyFromDisplay, noOpLogger, noOpVault, normalizeModelRef, normalizePathSubject, normalizeRecipient, normalizeToLf, normalizeTokenSavingTier, normalizeToolDescriptionMode, normalizeToolResultRenderMode, normalizeTuiThinkingWord, normalizedEqual, oklchToHex, onResize, parseContinueDirective, parseEncryptedVersion, parseEntries, parseHqEventPayload, parseHqFrame, parseModelRef, parseOklch, parseProgressFromText, parseSkillRef, peekQueuedMessages, pendingBtwCount, phaseForRole, playwrightServer, projectHash, projectSlug, promptChecksum, readBundledInstructionText, readHqAuthFile, readHqRuntimeFileSync, readJsonObjectFile, readLiveLock, recentTextTurns, recordActualUsage, recordFileAction, recordKitChoice, recordOverrides, recordPackageAction, recordProgress, recordToolOutputEvidence, recordUserIntentEvidence, redactHqEvent, redactHqValue, release, removeJsonPath, removeJsonPathInFile, removePlanItem, renderInstructionTemplate, renderProgress, renderPrometheus, renderPrompt, renderSpecAnalysis, renderTaskGraph, renderTaskList, repairToolUseAdjacency, repeatedReadPressure, resetCalibration, resolveAuditLevel, resolveBundledDesignKitsDir, resolveCacheForRequest, resolveChimeraConfig, resolveConflictText, resolveContextWindowPolicy, resolveHqConfig, resolveHqConfigFromEnv, resolveHqDataDir, resolveMailboxIdentity, resolveModelMatrix, resolveModelRuntime, resolveModelTargetFromEntry, resolveProjectDir, resolveProviderModelList, resolveReasoningForRequest, resolveSessionLoggingConfig, resolveToolDescriptionMode, resolveToolResultRenderMode, resolveWstackPaths, rewriteConfigEncrypted, rollbackSddRunFromDisk, rosterSummaryFromConfigs, rotateConfigKeys, runConfigMigrations, runDesignVerify, runProviderWithRetry, runShellHook, safeParse, safeStringify, sanitizeJsonString, sanitizeModel, sanitizeNodeOptions, saveGoal, savePlan, saveTasks, saveTodosCheckpoint, scoreAgents, scoreMessage, scrubAndTruncateHqPreview, securitySlashCommand, sentinelServer, sessionScopedPath, setActiveKit, setBtwNote, setDesignOverrides, setJsonPath, setJsonPathInFile, setOutputLineGuard, setPlanItemStatus, setProgress, setQueuedMessagesSnapshot, setRawMode, setToolDescriptionMode, setToolResultRenderMode, shellHooksEqual, shortIdMap, shouldEnhance, simplifyToolDescription, slackServer, sleep, slugify, smartDefaultFallbackChain, sshManagerServer, stableStringify, startAgentMonitorEventBridge, startMetricsServer, startOtlpMetricsExporter, startOtlpTraceExporter, startPackageOutdatedWatcher, startSddRun, startSessionTelemetryBridge, startTechStackConsumer, stripAnsi, subjectForToolInput, summarizeHqToolArgs, summarizeUsage, templateToMarkdown, toErrorMessage, toStyle, toWrongStackError, topologicalSort, truncate, ulid, unifiedDiff, unloadPlugins, updateJsonObjectFile, updatePackageOutdatedStatus, validateAgainstSchema, validateRegistryManifest, validateWatchdogOptions, verifyFiles, watchHqAuthFile, watchProviderConfig, wireMetricsToEvents, withDisabledToolFiltering, withFileLock, wrapAsState, writeErr, writeHqAuthFile, writeHqRuntimeFile, writeJsonObjectFile, writeOut, wstackGlobalRoot, zaiVisionServer };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map