@wrongstack/core 0.284.0 → 0.285.0

package/dist/security/index.js

@@ -1,8 +1,3 @@
-import { randomBytes, createCipheriv, createDecipheriv, scryptSync } from 'crypto';
-import * as fs2 from 'fs';
-import * as fs from 'fs/promises';
-import * as path from 'path';
-
 // src/security/secret-scrubber.ts
 var PATTERNS = [
   // Anchored at the start where possible so partial matches inside larger
@@ -191,6 +186,17 @@ var DefaultSecretScrubber = class {
     return visit(obj);
   }
 };
+
+// src/security/secret-vault.ts
+import { createCipheriv, createDecipheriv, randomBytes as randomBytes2, scryptSync } from "node:crypto";
+import * as fs2 from "node:fs";
+import * as fsp from "node:fs/promises";
+import * as path2 from "node:path";
+
+// src/utils/atomic-write.ts
+import { randomBytes } from "node:crypto";
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
 async function atomicWrite(targetPath, content, opts = {}) {
   const dir = path.dirname(targetPath);
   await fs.mkdir(dir, { recursive: true });
@@ -253,7 +259,7 @@ async function renameWithRetry(from, to) {
       if (!code || !TRANSIENT_RENAME_CODES.has(code) || i === delays.length) {
         throw err;
       }
-      await new Promise((resolve2) => setTimeout(resolve2, delays[i]));
+      await new Promise((resolve) => setTimeout(resolve, delays[i]));
     }
   }
   throw lastErr;
@@ -326,7 +332,7 @@ function toErrorMessage(err) {
 // src/utils/expect-defined.ts
 function expectDefined(value, label) {
   if (value === null || value === void 0) {
-    const err = new Error("Expected value to be defined");
+    const err = new Error(label ? `Expected ${label} to be defined` : "Expected value to be defined");
     err.name = "ExpectDefinedError";
     throw err;
   }
@@ -571,6 +577,49 @@ function encryptedPrefixForVersion(version) {
   return `enc:v${version}:`;
 }
 
+// src/security/config-secrets.ts
+function decryptConfigSecrets(cfg, vault, opts) {
+  const warn = opts?.warn ?? ((msg) => console.warn(msg));
+  return walk(cfg, vault, (v, key) => {
+    try {
+      return vault.decrypt(v);
+    } catch (err) {
+      warn(
+        `[secret-vault] Failed to decrypt "${key}": ${err instanceof Error ? err.message : err}`
+      );
+      return "";
+    }
+  });
+}
+function encryptConfigSecrets(cfg, vault, _opts) {
+  return walk(cfg, vault, (v) => vault.encrypt(v));
+}
+function walk(node, vault, transform) {
+  if (node === null || node === void 0) return node;
+  if (typeof node !== "object") return node;
+  if (Array.isArray(node)) {
+    return node.map((item) => walk(item, vault, transform));
+  }
+  const out = /* @__PURE__ */ Object.create(null);
+  for (const [k, v] of Object.entries(node)) {
+    if (typeof v === "string" && isSecretField(k)) {
+      out[k] = transform(v, k);
+    } else if (typeof v === "object" && v !== null) {
+      out[k] = walk(v, vault, transform);
+    } else {
+      out[k] = v;
+    }
+  }
+  return out;
+}
+var SECRET_KEY_PATTERN = /(?:apikey|api_key|authtoken|auth_token|bearer|secret|password|passwd|pwd|refreshtoken|refresh_token|sessionkey|session_key|access[_-]?token|private[_-]?key)/i;
+var NON_SECRET_OVERRIDES = /* @__PURE__ */ new Set(["publickey", "public_key"]);
+function isSecretField(name) {
+  const lc = name.toLowerCase();
+  if (NON_SECRET_OVERRIDES.has(lc)) return false;
+  return SECRET_KEY_PATTERN.test(lc);
+}
+
 // src/security/secret-vault.ts
 var KEY_BYTES = 32;
 var IV_BYTES = 12;
@@ -602,8 +651,8 @@ function deriveKEK(passphrase, salt) {
   });
 }
 function wrapDataKey(dataKey, keyVersion, passphrase) {
-  const salt = randomBytes(KEK_SALT_BYTES);
-  const iv = randomBytes(IV_BYTES);
+  const salt = randomBytes2(KEK_SALT_BYTES);
+  const iv = randomBytes2(IV_BYTES);
   const kek = deriveKEK(passphrase, salt);
   const cipher = createCipheriv(ALGO, kek, iv);
   const ct = Buffer.concat([cipher.update(dataKey), cipher.final()]);
@@ -693,7 +742,7 @@ var DefaultSecretVault = class {
   encrypt(plaintext) {
     if (this.isEncrypted(plaintext)) return plaintext;
     const key = this.loadOrCreateKey();
-    const iv = randomBytes(IV_BYTES);
+    const iv = randomBytes2(IV_BYTES);
     const cipher = createCipheriv(ALGO, key, iv);
     const ct = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
     const tag = cipher.getAuthTag();
@@ -746,9 +795,9 @@ var DefaultSecretVault = class {
    */
   rotateKey() {
     const oldVersion = this._keyVersion;
-    const newKey = randomBytes(KEY_BYTES);
+    const newKey = randomBytes2(KEY_BYTES);
     const newVersion = oldVersion + 1;
-    fs2.mkdirSync(path.dirname(this.keyFile), { recursive: true });
+    fs2.mkdirSync(path2.dirname(this.keyFile), { recursive: true });
     const passphrase = getVaultPassphrase();
     if (passphrase) {
       fs2.writeFileSync(this.keyFile, wrapDataKey(newKey, newVersion, passphrase), { mode: 384 });
@@ -832,8 +881,8 @@ var DefaultSecretVault = class {
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
     }
-    fs2.mkdirSync(path.dirname(this.keyFile), { recursive: true });
-    const key = randomBytes(KEY_BYTES);
+    fs2.mkdirSync(path2.dirname(this.keyFile), { recursive: true });
+    const key = randomBytes2(KEY_BYTES);
     const passphrase = getVaultPassphrase();
     const initialBytes = passphrase ? wrapDataKey(key, 1, passphrase) : key;
     try {
@@ -881,64 +930,23 @@ var DefaultSecretVault = class {
     return key;
   }
 };
-function decryptConfigSecrets(cfg, vault, opts) {
-  const warn = opts?.warn ?? ((msg) => console.warn(msg));
-  return walk(cfg, vault, (v, key) => {
-    try {
-      return vault.decrypt(v);
-    } catch (err) {
-      warn(
-        `[secret-vault] Failed to decrypt "${key}": ${err instanceof Error ? err.message : err}`
-      );
-      return "";
-    }
-  });
-}
-function encryptConfigSecrets(cfg, vault, _opts) {
-  return walk(cfg, vault, (v) => vault.encrypt(v));
-}
-function walk(node, vault, transform) {
-  if (node === null || node === void 0) return node;
-  if (typeof node !== "object") return node;
-  if (Array.isArray(node)) {
-    return node.map((item) => walk(item, vault, transform));
-  }
-  const out = /* @__PURE__ */ Object.create(null);
-  for (const [k, v] of Object.entries(node)) {
-    if (typeof v === "string" && isSecretField(k)) {
-      out[k] = transform(v, k);
-    } else if (typeof v === "object" && v !== null) {
-      out[k] = walk(v, vault, transform);
-    } else {
-      out[k] = v;
-    }
-  }
-  return out;
-}
-var SECRET_KEY_PATTERN = /(?:apikey|api_key|authtoken|auth_token|bearer|secret|password|passwd|pwd|refreshtoken|refresh_token|sessionkey|session_key|access[_-]?token|private[_-]?key)/i;
-var NON_SECRET_OVERRIDES = /* @__PURE__ */ new Set(["publickey", "public_key"]);
-function isSecretField(name) {
-  const lc = name.toLowerCase();
-  if (NON_SECRET_OVERRIDES.has(lc)) return false;
-  return SECRET_KEY_PATTERN.test(lc);
-}
 async function rewriteConfigEncrypted(configPath, vault, patch) {
   let current = {};
   try {
-    const raw = await fs.readFile(configPath, "utf8");
+    const raw = await fsp.readFile(configPath, "utf8");
     current = JSON.parse(raw);
   } catch {
   }
   const merged = deepMerge(current, patch ?? {});
   const encrypted = encryptConfigSecrets(merged, vault);
-  await fs.mkdir(path.dirname(configPath), { recursive: true });
+  await fsp.mkdir(path2.dirname(configPath), { recursive: true });
   await atomicWrite(configPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
   await restrictFilePermissions(configPath);
 }
 async function migratePlaintextSecrets(configPath, vault, logger) {
   let raw;
   try {
-    raw = await fs.readFile(configPath, "utf8");
+    raw = await fsp.readFile(configPath, "utf8");
   } catch {
     return { migrated: 0, file: configPath };
   }
@@ -964,7 +972,7 @@ async function rotateConfigKeys(configPath, vault, logger) {
   const warn = logger?.warn ?? ((msg) => console.warn(msg));
   let raw;
   try {
-    raw = await fs.readFile(configPath, "utf8");
+    raw = await fsp.readFile(configPath, "utf8");
   } catch {
     const { oldVersion: oldVersion2, newVersion: newVersion2 } = vault.rotateKey();
     log(`[secret-vault] Key rotated (v${oldVersion2} \u2192 v${newVersion2}) \u2014 no config file to re-encrypt`);
@@ -1045,8 +1053,8 @@ async function restrictFilePermissions(filePath, opts) {
   const warn = opts?.warn ?? ((msg) => console.warn(msg));
   if (process.platform === "win32") {
     try {
-      const { execFile } = await import('child_process');
-      const { promisify } = await import('util');
+      const { execFile } = await import("node:child_process");
+      const { promisify } = await import("node:util");
       const execFileAsync = promisify(execFile);
       const user = windowsAccountName();
       if (!user) {
@@ -1063,7 +1071,7 @@ async function restrictFilePermissions(filePath, opts) {
     }
   } else {
     try {
-      await fs.chmod(filePath, 384);
+      await fsp.chmod(filePath, 384);
     } catch {
     }
   }
@@ -1095,6 +1103,9 @@ function walkCount(node, vault, counter) {
   return out;
 }
 
+// src/security/permission-policy.ts
+import * as fs3 from "node:fs/promises";
+
 // src/security/capabilities.ts
 var ToolCapabilities = {
   /** Can execute arbitrary commands in the user's shell (the `bash` tool). */
@@ -1158,7 +1169,7 @@ var DANGEROUS_FOR_SUBAGENTS = [
   ToolCapabilities.CONFIG_MUTATE,
   ToolCapabilities.PACKAGE_INSTALL
 ];
-[
+var WIDE_SUBAGENT_CAPABILITIES = [
   ToolCapabilities.FS_READ,
   ToolCapabilities.FS_WRITE,
   ToolCapabilities.NET_OUTBOUND,
@@ -1230,253 +1241,13 @@ var LruCache = class {
     return this.store.size;
   }
 };
-var CATASTROPHIC_PATTERNS = [
-  /\b(?:mkfs(?:\.[a-z0-9]+)?|mke2fs|newfs)\b/i,
-  // make a filesystem — wipes a partition
-  /\bformat\s+[A-Za-z]:/i,
-  // format C: — wipes a Windows volume
-  /\bdiskpart\b/i,
-  // Windows partition editor
-  /\bdd\b[^|]*\bof=(?:\/dev\/|\\\\[.?]\\)/i,
-  // dd writing straight to a raw device
-  />\s*\/dev\/(?:sd|hd|nvme|disk|mapper|vd)/i,
-  // redirect into a raw block device
-  /:\(\)\s*\{\s*:\|:&\s*\}\s*;/
-  // classic fork bomb
-];
-var HIGH_IMPACT_PATTERNS = [
-  /\b(?:curl|wget|fetch|httpie|http|irm|iwr|Invoke-WebRequest|Invoke-RestMethod)\b[\s\S]{0,300}\|\s*(?:sudo\s+)?(?:sh|bash|zsh|fish|pwsh|powershell|iex|Invoke-Expression)\b/i,
-  /\b(?:powershell|pwsh)(?:\.exe)?\b[\s\S]{0,120}-(?:enc|encodedcommand)\b/i,
-  /\b(?:shutdown|reboot)\b/i
-];
-var CATASTROPHIC_POSIX_ROOTS = /* @__PURE__ */ new Set([
-  "/etc",
-  "/usr",
-  "/bin",
-  "/sbin",
-  "/lib",
-  "/lib64",
-  "/var",
-  "/boot",
-  "/dev",
-  "/sys",
-  "/proc",
-  "/opt",
-  "/root",
-  "/home",
-  "/srv",
-  "/run",
-  "/system",
-  "/library",
-  "/applications",
-  "/users"
-]);
-var CATASTROPHIC_WIN_SUBDIRS = /* @__PURE__ */ new Set([
-  "windows",
-  "system32",
-  "winnt",
-  "program files",
-  "program files (x86)",
-  "programdata",
-  "users"
-]);
-var SHELL_OPERATORS = /* @__PURE__ */ new Set(["&&", "||", "|", ";", ">", ">>", "<", "2>", "2>>"]);
+
+// src/security/yolo-risk.ts
 function getInputString(input, key) {
   if (!input || typeof input !== "object") return void 0;
   const value = input[key];
   return typeof value === "string" ? value : void 0;
 }
-function pathLooksInsideProject(rawPath, projectRoot) {
-  if (!projectRoot) return false;
-  if (rawPath === "~" || rawPath.startsWith("~/") || rawPath.startsWith("~\\")) return false;
-  const resolved = path.resolve(projectRoot, rawPath);
-  const relative2 = path.relative(projectRoot, resolved);
-  return !!relative2 && !relative2.startsWith("..") && !path.isAbsolute(relative2);
-}
-function tokenizeShell(command) {
-  return command.match(/"[^"]*"|'[^']*'|\S+/g)?.map((token) => token.replace(/^['"]|['"]$/g, "")) ?? [];
-}
-function commandSegment(tokens, start) {
-  const out = [];
-  for (let i = start; i < tokens.length; i++) {
-    const token = tokens[i];
-    if (token === void 0 || SHELL_OPERATORS.has(token)) break;
-    out.push(token);
-  }
-  return out;
-}
-function hasShortFlag(args, letters) {
-  const seen = /* @__PURE__ */ new Set();
-  for (const arg of args) {
-    if (!arg.startsWith("-") || arg.startsWith("--")) continue;
-    for (const ch of arg.replace(/^-+/, "")) seen.add(ch.toLowerCase());
-  }
-  return letters.split("").every((letter) => seen.has(letter));
-}
-function hasRecursiveForceDelete(command, projectRoot) {
-  const tokens = tokenizeShell(command);
-  for (let i = 0; i < tokens.length; i++) {
-    const token = tokens[i]?.toLowerCase();
-    if (!token) continue;
-    if (token === "rm" || token === "rmdir") {
-      const args = commandSegment(tokens, i + 1);
-      const recursiveForce = hasShortFlag(args, "rf") || args.some((arg) => arg === "--recursive") && args.some((arg) => arg === "--force");
-      if (recursiveForce) {
-        const targets = args.filter((arg) => !arg.startsWith("-") && !SHELL_OPERATORS.has(arg));
-        if (targets.length > 0 && targets.every((target) => target.trim().length === 0)) {
-          continue;
-        }
-        if (targets.length === 0) return true;
-        if (targets.some(isCatastrophicDeleteTarget)) return true;
-        if (targets.some((target) => !pathLooksInsideProject(target, projectRoot))) return true;
-      }
-    }
-    if (token === "remove-item" || token === "ri") {
-      const args = commandSegment(tokens, i + 1).map((arg) => arg.toLowerCase());
-      const recurse = args.some((arg) => arg === "-recurse" || arg === "-r");
-      const force = args.some((arg) => arg === "-force" || arg === "-f");
-      if (recurse && force && !args.includes("-whatif")) {
-        const targets = args.filter((arg) => !arg.startsWith("-") && !SHELL_OPERATORS.has(arg));
-        if (targets.length === 0) return true;
-        if (targets.some(isCatastrophicDeleteTarget)) return true;
-        if (targets.some((target) => !pathLooksInsideProject(target, projectRoot))) return true;
-      }
-    }
-    if (token === "rd" || token === "rmdir") {
-      const args = commandSegment(tokens, i + 1).map((arg) => arg.toLowerCase());
-      if (args.includes("/s")) {
-        const targets = args.filter((arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg));
-        if (targets.length === 0) return true;
-        if (targets.some(isCatastrophicDeleteTarget)) return true;
-        if (targets.some((target) => !pathLooksInsideProject(target, projectRoot))) return true;
-      }
-    }
-  }
-  return false;
-}
-function hasGitHistoryRewrite(command) {
-  const tokens = tokenizeShell(command).map((token) => token.toLowerCase());
-  for (let i = 0; i < tokens.length; i++) {
-    if (tokens[i] !== "git") continue;
-    const args = commandSegment(tokens, i + 1);
-    if (args.includes("reset") && args.some((arg) => arg === "--hard" || arg.startsWith("--hard="))) {
-      return true;
-    }
-    const cleanIdx = args.indexOf("clean");
-    if (cleanIdx >= 0) {
-      const cleanArgs = args.slice(cleanIdx + 1);
-      if (cleanArgs.some((arg) => arg === "-f" || arg === "--force" || /^-[a-z]*f[a-z]*$/i.test(arg))) {
-        return true;
-      }
-    }
-    const pushIdx = args.indexOf("push");
-    if (pushIdx >= 0) {
-      const pushArgs = args.slice(pushIdx + 1);
-      if (pushArgs.some(
-        (arg) => arg === "-f" || arg === "--force" || arg === "--force-with-lease" || arg.startsWith("--force=") || arg.startsWith("--force-with-lease=")
-      )) {
-        return true;
-      }
-    }
-  }
-  return false;
-}
-function hasExternalPublish(command) {
-  const tokens = tokenizeShell(command).map((token) => token.toLowerCase());
-  for (let i = 0; i < tokens.length; i++) {
-    const cmd = tokens[i];
-    if (!cmd) continue;
-    const args = commandSegment(tokens, i + 1);
-    if (["npm", "pnpm", "yarn", "bun"].includes(cmd) && (args.includes("publish") || args.includes("deploy"))) {
-      return true;
-    }
-    if (cmd === "cargo" && (args.includes("publish") || args.includes("yank"))) return true;
-    if ((cmd === "docker" || cmd === "podman") && args.includes("push")) return true;
-    if (cmd === "kubectl") {
-      const deleteIdx = args.indexOf("delete");
-      if (deleteIdx >= 0 && (args[deleteIdx + 1] === "namespace" || args[deleteIdx + 1] === "ns")) {
-        return true;
-      }
-      if (args.includes("drain")) return true;
-    }
-  }
-  return false;
-}
-function hasFindExec(command) {
-  const tokens = tokenizeShell(command).map((token) => token.toLowerCase());
-  for (let i = 0; i < tokens.length; i++) {
-    if (tokens[i] !== "find") continue;
-    const args = commandSegment(tokens, i + 1);
-    if (args.some((arg) => arg === "-exec" || arg === "-ok" || arg === "-execdir")) return true;
-  }
-  return false;
-}
-function isCatastrophicDeleteTarget(rawTarget) {
-  const t = rawTarget.replace(/^['"]|['"]$/g, "").trim();
-  if (!t) return false;
-  if (t === "*" || t === "." || t === "./" || t === ".\\" || t === "./*" || t === ".\\*") return true;
-  const s = t.replace(/[\\/]\*+$/, "").replace(/[\\/]+$/, "");
-  if (s === "") return true;
-  if (s === "~" || /^\$HOME$/i.test(s) || /^%USERPROFILE%$/i.test(s)) return true;
-  if (/^[A-Za-z]:$/.test(s)) return true;
-  const norm = s.toLowerCase().replace(/\\/g, "/");
-  if (CATASTROPHIC_POSIX_ROOTS.has(norm)) return true;
-  const win = norm.match(/^[a-z]:\/([^/]+)$/);
-  if (win?.[1] && CATASTROPHIC_WIN_SUBDIRS.has(win[1])) return true;
-  return false;
-}
-function hasCatastrophicDelete(command) {
-  const tokens = tokenizeShell(command);
-  for (let i = 0; i < tokens.length; i++) {
-    const token = tokens[i]?.toLowerCase();
-    if (!token) continue;
-    if (token === "rm") {
-      const args = tokens.slice(i + 1);
-      const recursiveOrForce = args.some(
-        (arg) => /^-[^-]*[rf]/i.test(arg) || arg === "--recursive" || arg === "--force" || arg === "--no-preserve-root"
-      );
-      if (!recursiveOrForce) continue;
-      const targets = args.filter((arg) => !arg.startsWith("-") && !SHELL_OPERATORS.has(arg));
-      if (targets.length === 0) return true;
-      if (targets.some(isCatastrophicDeleteTarget)) return true;
-    }
-    if (token === "remove-item" || token === "ri") {
-      const args = tokens.slice(i + 1);
-      const recursive = args.some((arg) => {
-        const a = arg.toLowerCase();
-        return a === "-recurse" || a === "-force";
-      });
-      if (!recursive) continue;
-      const targets = args.filter((arg) => !arg.startsWith("-") && !SHELL_OPERATORS.has(arg));
-      if (targets.some(isCatastrophicDeleteTarget)) return true;
-    }
-    if (token === "rmdir" || token === "rd") {
-      const args = tokens.slice(i + 1);
-      const recursive = args.some((arg) => arg.toLowerCase() === "/s");
-      if (!recursive) continue;
-      const targets = args.filter((arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg));
-      if (targets.some(isCatastrophicDeleteTarget)) return true;
-    }
-    if (token === "del" || token === "erase") {
-      const args = tokens.slice(i + 1);
-      const targets = args.filter((arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg));
-      if (targets.some(isCatastrophicDeleteTarget)) return true;
-    }
-  }
-  return false;
-}
-function isClearlyDestructiveBashCommand(command, projectRoot) {
-  const trimmed = command.trim();
-  if (!trimmed) return false;
-  if (hasRecursiveForceDelete(trimmed, projectRoot)) return true;
-  if (hasGitHistoryRewrite(trimmed)) return true;
-  if (hasExternalPublish(trimmed)) return true;
-  if (hasFindExec(trimmed)) return true;
-  if (hasCatastrophicDelete(trimmed)) return true;
-  if (CATASTROPHIC_PATTERNS.some((pattern) => pattern.test(trimmed))) return true;
-  if (HIGH_IMPACT_PATTERNS.some((pattern) => pattern.test(trimmed))) return true;
-  return false;
-}
 
 // src/security/permission-policy.ts
 function matchesTrust(patterns, subject) {
@@ -1555,7 +1326,7 @@ var DefaultPermissionPolicy = class {
   trustFile;
   yolo;
   yoloDestructive;
-  /** When true, destructive ops still require confirmation even in YOLO mode. */
+  /** Deprecated compatibility flag; no longer gates YOLO calls. */
   confirmDestructive;
   /**
    * Session-scoped "soft deny" map. When the user presses 'n' (block once),
@@ -1590,7 +1361,7 @@ var DefaultPermissionPolicy = class {
   /**
    * Evaluate-result cache. Keyed by `tool.name::subject` so repeated calls
    * with the same tool+input skip namespace matching, subject computation,
-   * pattern matching (matchAny), and YOLO destructive gating.
+   * and pattern matching (matchAny).
    *
    * Cleared on any state change (reload, trust, deny, yolo toggle) because
    * the result depends on the full policy state. The write-tool smart-bypass
@@ -1608,7 +1379,7 @@ var DefaultPermissionPolicy = class {
     this.trustFile = opts.trustFile;
     this.yolo = opts.yolo ?? false;
     this.yoloDestructive = opts.yoloDestructive ?? opts.forceAllYolo ?? false;
-    this.confirmDestructive = true;
+    this.confirmDestructive = opts.confirmDestructive ?? false;
     this.promptDelegate = opts.promptDelegate;
   }
   /**
@@ -1638,18 +1409,18 @@ var DefaultPermissionPolicy = class {
   getYoloDestructive() {
     return this.yoloDestructive;
   }
-  /** Toggle destructive confirmation gate (only meaningful when yolo is active). */
-  setConfirmDestructive(_enabled) {
-    if (!this.confirmDestructive) this._evalCache.clear();
-    this.confirmDestructive = true;
+  /** Toggle deprecated destructive confirmation compatibility flag. */
+  setConfirmDestructive(enabled) {
+    if (this.confirmDestructive !== enabled) this._evalCache.clear();
+    this.confirmDestructive = enabled;
   }
-  /** Check whether destructive confirmation gate is active. */
+  /** Check deprecated destructive confirmation compatibility flag. */
   getConfirmDestructive() {
     return this.confirmDestructive;
   }
   async reload() {
     try {
-      const raw = await fs.readFile(this.trustFile, "utf8");
+      const raw = await fs3.readFile(this.trustFile, "utf8");
       const parsed = safeParse(raw);
       if (parsed.ok && parsed.value) this.policy = parsed.value;
     } catch {
@@ -1698,29 +1469,6 @@ var DefaultPermissionPolicy = class {
       this._evalCache.set(cacheKey, decision);
       return decision;
     }
-    if (this.yolo) {
-      const destructive = this.isDestructiveYoloCall(tool, input, ctx);
-      if (destructive) {
-        if (this.promptDelegate) {
-          const decision = await this.promptDelegate(tool, input, subject ?? tool.name);
-          if (decision === "deny") {
-            await this.deny({ tool: tool.name, pattern: subject ?? tool.name });
-            return { permission: "deny", source: "user", reason: "user denied destructive yolo" };
-          }
-          return {
-            permission: decision === "yes" || decision === "always" ? "auto" : "deny",
-            source: "user",
-            reason: "destructive yolo approved for this call"
-          };
-        }
-        return {
-          permission: "confirm",
-          source: "yolo_destructive",
-          riskTier: "destructive",
-          reason: "destructive tool needs explicit approval in YOLO mode"
-        };
-      }
-    }
     if (entry?.allow && subject && matchesTrust(entry.allow, subject)) {
       const decision = { permission: "auto", source: "trust", reason: "matched allow pattern" };
       this._evalCache.set(cacheKey, decision);
@@ -1802,47 +1550,6 @@ var DefaultPermissionPolicy = class {
     }
     return { permission: "confirm", source: "default" };
   }
-  // Capability-based destructive check (preferred over name-based)
-  isDestructiveByCapability(tool) {
-    const caps = tool.capabilities ?? [];
-    if (caps.includes(ToolCapabilities.SHELL_ARBITRARY)) return true;
-    if (caps.includes(ToolCapabilities.SHELL_RESTRICTED)) return true;
-    if (caps.includes(ToolCapabilities.SHELL_EXEC)) return true;
-    if (caps.includes(ToolCapabilities.FS_WRITE)) return true;
-    if (caps.includes(ToolCapabilities.FS_WRITE_OUTSIDE_PROJECT)) return true;
-    return false;
-  }
-  isDestructiveYoloCall(tool, input, ctx) {
-    if (tool.name === "mcp_control") {
-      const action = getInputString(input, "action");
-      if (action === "list" || action === "search" || action === "activate" || action === "deactivate") {
-        return false;
-      }
-    }
-    if (this.isDestructiveByCapability(tool)) {
-      const caps = tool.capabilities ?? [];
-      if (caps.includes(ToolCapabilities.SHELL_ARBITRARY) || caps.includes(ToolCapabilities.SHELL_RESTRICTED) || caps.includes(ToolCapabilities.SHELL_EXEC)) {
-        const command = shellCommandLineFromInput(input);
-        return command ? isClearlyDestructiveBashCommand(command, ctx.projectRoot) : tool.riskTier === "destructive";
-      }
-      if (caps.includes(ToolCapabilities.FS_WRITE_OUTSIDE_PROJECT)) return true;
-      if (caps.includes(ToolCapabilities.FS_WRITE)) {
-        const targetPath = getInputString(input, "path") ?? getInputString(input, "file");
-        if (!targetPath || !ctx.projectRoot) return false;
-        return !pathLooksInsideProject(targetPath, ctx.projectRoot);
-      }
-    }
-    if (tool.name === "bash" || tool.name === "shell" || tool.name === "exec") {
-      const command = shellCommandLineFromInput(input);
-      return command ? isClearlyDestructiveBashCommand(command, ctx.projectRoot) : tool.riskTier === "destructive";
-    }
-    if (tool.name === "write" || tool.name === "edit" || tool.name === "replace" || tool.name === "patch") {
-      const targetPath = getInputString(input, "path") ?? getInputString(input, "file");
-      if (!targetPath || !ctx.projectRoot) return false;
-      return !pathLooksInsideProject(targetPath, ctx.projectRoot);
-    }
-    return tool.riskTier === "destructive";
-  }
   isSensitiveReadCall(tool, input) {
     const isReadTool = hasCapability(tool, ToolCapabilities.FS_READ) || tool.name === "read" || tool.name === "grep" || tool.name === "glob" || tool.name === "tree";
     if (isReadTool && inputPathLooksSensitive(input)) return true;
@@ -1950,7 +1657,21 @@ var AutoApprovePermissionPolicy = class _AutoApprovePermissionPolicy {
   async reload() {
   }
 };
-
-export { AutoApprovePermissionPolicy, DANGEROUS_FOR_SUBAGENTS, DefaultPermissionPolicy, DefaultSecretScrubber, DefaultSecretVault, ToolCapabilities, decryptConfigSecrets, encryptConfigSecrets, getDangerousCapabilities, hasCapability, hasDangerousCapabilityForSubagents, isSecretField, migratePlaintextSecrets, rewriteConfigEncrypted, rotateConfigKeys };
+export {
+  AutoApprovePermissionPolicy,
+  DANGEROUS_FOR_SUBAGENTS,
+  DefaultPermissionPolicy,
+  DefaultSecretScrubber,
+  DefaultSecretVault,
+  ToolCapabilities,
+  decryptConfigSecrets,
+  encryptConfigSecrets,
+  getDangerousCapabilities,
+  hasCapability,
+  hasDangerousCapabilityForSubagents,
+  isSecretField,
+  migratePlaintextSecrets,
+  rewriteConfigEncrypted,
+  rotateConfigKeys
+};
 //# sourceMappingURL=index.js.map
-//# sourceMappingURL=index.js.map