@wrongstack/core 0.297.0 → 0.298.1

package/dist/storage/provider-config-watcher.d.ts

@@ -22,6 +22,7 @@ export interface ProviderConfigSnapshot {
     /** Live routing fields — surfaced so a cross-process WebUI /setmodel or
      *  profile-reorder propagates to running workers without restart. */
     fallbackModels?: string[];
+    fallbackBridge?: string;
     fallbackProfiles?: Record<string, string[]>;
     favoriteModels?: string[];
     favoriteModelsOnly?: boolean;

package/dist/storage/session-helpers.d.ts

@@ -1,4 +1,5 @@
 import type { ContentBlock } from '../types/blocks.js';
+export { captureCheckpoint, materializeCheckpoint } from './session-workspace-checkpoints.js';
 /**
  * Derive a short title from a user_input event's content. Used by both
  * `DefaultSessionStore.summarize()` (offline summary rebuild) and

package/dist/storage/session-store.d.ts

@@ -1,4 +1,4 @@
-import type { ForkedSession, ResumedSession, SessionData, SessionEvent, SessionForkOptions, SessionMetadata, SessionStore, SessionSummary, SessionWriter, WorkspaceCheckpointRef, WorkspaceMaterializationResult } from '../types/session.js';
+import type { ForkedSession, ResumedSession, SessionData, SessionEvent, SessionForkOptions, SessionMetadata, SessionStore, SessionSummary, SessionWriter, WorkspaceCheckpointRef } from '../types/session.js';
 import type { SessionStoreOptions } from './session-store/types.js';
 export type { SessionStoreOptions } from './session-store/types.js';
 export declare class DefaultSessionStore implements SessionStore {
@@ -53,7 +53,14 @@ export declare class DefaultSessionStore implements SessionStore {
     private ensureShardDir;
     create(meta: Omit<SessionMetadata, 'startedAt'>): Promise<SessionWriter>;
     fork(id: string, opts?: SessionForkOptions): Promise<ForkedSession>;
-    materializeWorkspaceCheckpoint(checkpoint: WorkspaceCheckpointRef, targetRoot: string): Promise<WorkspaceMaterializationResult>;
+    /**
+     * Capture the deterministic post-tool workspace identity through the store-owned CAS.
+     */
+    captureWorkspaceCheckpoint(sessionId: string, promptIndex: number): Promise<WorkspaceCheckpointRef | undefined>;
+    /**
+     * Materialize a store-owned checkpoint into an already isolated workspace.
+     */
+    materializeWorkspaceCheckpoint(checkpoint: WorkspaceCheckpointRef, targetRoot: string): Promise<import("../types/session.js").WorkspaceMaterializationResult>;
     resolveId(query: string): Promise<string>;
     resume(id: string): Promise<ResumedSession>;
     load(id: string): Promise<SessionData>;

package/dist/storage/session-workspace-checkpoints.d.ts

@@ -0,0 +1,5 @@
+import type { WorkspaceCheckpointRef, WorkspaceMaterializationResult } from '../types/session.js';
+import type { SessionCheckpointCas } from './session-checkpoint-cas.js';
+export declare function captureCheckpoint(checkpointCas: SessionCheckpointCas | undefined, sessionId: string, promptIndex: number): Promise<WorkspaceCheckpointRef | undefined>;
+export declare function materializeCheckpoint(checkpointCas: SessionCheckpointCas | undefined, checkpoint: WorkspaceCheckpointRef, targetRoot: string): Promise<WorkspaceMaterializationResult>;
+//# sourceMappingURL=session-workspace-checkpoints.d.ts.map

package/dist/tools/fallback-manage-tools.d.ts

@@ -44,6 +44,12 @@ export { FAVORITE_MANAGE_TOOL_NAME } from './fallback-favorite-manage-tool.js';
 export * from './fallback-system-config-view-tool.js';
 export type { FallbackManageToolOptions } from './fallback-manage-tool-options.js';
 export declare const PROVIDER_MANAGE_TOOL_NAME = "provider_manage";
+/**
+ * Reject provider base URLs that are malformed, non-HTTP, or carry embedded
+ * credentials (WS-013). Private and loopback hosts stay allowed on purpose —
+ * Ollama, LM Studio and omniroute are first-class local providers.
+ */
+export declare function validateProviderBaseUrl(raw: string): string | null;
 export declare const PROVIDER_KEY_SET_TOOL_NAME = "provider_key_set";
 export declare const LEADER_MODEL_SET_TOOL_NAME = "leader_model_set";
 /**

package/dist/tools/index.js

@@ -1745,30 +1745,6 @@ function estimateRequestTokens(messages, systemPrompt, tools, calibrationKey = C
   };
 }
 
-// src/core/model-ref.ts
-function parseModelRef(ref) {
-  const trimmed = ref.trim();
-  const slash = trimmed.indexOf("/");
-  if (slash !== -1) {
-    return {
-      provider: trimmed.slice(0, slash) || void 0,
-      model: trimmed.slice(slash + 1).trim()
-    };
-  }
-  const parts = trimmed.split(/\s+/);
-  if (parts.length >= 2) {
-    return { provider: parts[0], model: parts.slice(1).join(" ") };
-  }
-  return { model: trimmed };
-}
-function formatModelRef(ref, defaultProvider) {
-  const provider = ref.provider ?? defaultProvider;
-  return provider ? `${provider}/${ref.model}` : ref.model;
-}
-function normalizeModelRef(ref, defaultProvider) {
-  return formatModelRef(parseModelRef(ref), defaultProvider);
-}
-
 // src/core/model-availability-calendar.ts
 function logicalCalendarTarget(providerId, model) {
   if (providerId !== "omniroute") return { providerId, model };
@@ -1847,6 +1823,30 @@ function evaluateModelCalendar(rules, providerId, model, at = /* @__PURE__ */ ne
   return { allowed: true };
 }
 
+// src/core/model-ref.ts
+function parseModelRef(ref) {
+  const trimmed = ref.trim();
+  const slash = trimmed.indexOf("/");
+  if (slash !== -1) {
+    return {
+      provider: trimmed.slice(0, slash) || void 0,
+      model: trimmed.slice(slash + 1).trim()
+    };
+  }
+  const parts = trimmed.split(/\s+/);
+  if (parts.length >= 2) {
+    return { provider: parts[0], model: parts.slice(1).join(" ") };
+  }
+  return { model: trimmed };
+}
+function formatModelRef(ref, defaultProvider) {
+  const provider = ref.provider ?? defaultProvider;
+  return provider ? `${provider}/${ref.model}` : ref.model;
+}
+function normalizeModelRef(ref, defaultProvider) {
+  return formatModelRef(parseModelRef(ref), defaultProvider);
+}
+
 // src/core/fallback-profile-manager.ts
 function hasText(value) {
   return typeof value === "string" && value.trim().length > 0;
@@ -1947,18 +1947,42 @@ var FallbackProfileManager = class {
    * Mirrors the previous `effectiveFallbackChain()` logic but centralized.
    */
   resolveEffective(opts = {}) {
+    const bridge = this.resolveBridge(opts.exclude);
+    let selected = FREEZER_EMPTY;
     if (opts.fallbackModels && opts.fallbackModels.length > 0) {
       const resolved = this.resolveRefs(opts.fallbackModels, opts.exclude);
-      if (resolved.length > 0) return resolved;
+      if (resolved.length > 0) selected = resolved;
     }
-    if (opts.fallbackProfile) {
+    if (selected.length === 0 && opts.fallbackProfile) {
       const resolved = this.resolve(opts.fallbackProfile, { exclude: opts.exclude });
-      if (resolved.length > 0) return resolved;
+      if (resolved.length > 0) selected = resolved;
     }
-    if (opts.fallbackAuto !== false) {
-      return this.smartDefault(opts.exclude);
+    if (selected.length === 0 && opts.fallbackAuto !== false) {
+      selected = this.smartDefault(opts.exclude);
     }
-    return FREEZER_EMPTY;
+    if (bridge.length === 0) return selected;
+    if (selected.length === 0) return bridge;
+    const seen = new Set(bridge.map((entry) => `${entry.providerId}/${entry.model}`));
+    return Object.freeze([
+      ...bridge,
+      ...selected.filter((entry) => !seen.has(`${entry.providerId}/${entry.model}`))
+    ]);
+  }
+  /** Resolve the optional, fully-qualified emergency continuity route. */
+  resolveBridge(exclude) {
+    const ref = this.config.fallbackBridge?.trim();
+    if (!ref) return FREEZER_EMPTY;
+    const parsed = parseModelRef(ref);
+    if (!parsed.provider || !parsed.model) return FREEZER_EMPTY;
+    return this.resolveRefs([ref], exclude);
+  }
+  /**
+   * Resolve every usable configured target as an uncapped last-resort chain.
+   * Normal smart defaults stay bounded; callers append this only after the
+   * preferred chain and only when automatic fallback is enabled.
+   */
+  resolveAllConfigured(exclude) {
+    return this.smartDefault(exclude, Number.POSITIVE_INFINITY);
   }
   // ── Provider availability (read-only) ──────────────────────────────────
   checkProvider(providerId) {
@@ -2017,7 +2041,7 @@ var FallbackProfileManager = class {
    * explicit is set. Same-provider alternatives first, then cross-provider.
    * Limited to 4 entries to avoid burning through models on a transient blip.
    */
-  smartDefault(exclude) {
+  smartDefault(exclude, maxCandidates = 4) {
     const leaderProvider = this.config.provider;
     const leaderModel = this.config.model;
     const providers = this.config.providers ?? {};
@@ -2058,8 +2082,18 @@ var FallbackProfileManager = class {
         (id === leaderProvider ? sameProvider : crossProvider).push(ref);
       }
     }
-    const MAX = 4;
-    const all = [...favorites, ...sameProvider, ...crossProvider].slice(0, MAX);
+    const ordered = [...favorites, ...sameProvider, ...crossProvider];
+    const all = Number.isFinite(maxCandidates) ? ordered.slice(0, Math.max(0, maxCandidates)) : [...ordered];
+    const firstCrossProvider = ordered.find((ref) => {
+      const parsed = parseModelRef(ref);
+      return (parsed.provider ?? leaderProvider) !== leaderProvider;
+    });
+    if (all.length > 0 && firstCrossProvider && !all.some((ref) => {
+      const parsed = parseModelRef(ref);
+      return (parsed.provider ?? leaderProvider) !== leaderProvider;
+    })) {
+      all[all.length - 1] = firstCrossProvider;
+    }
     return Object.freeze(
       all.map((ref) => {
         const p = parseModelRef(ref);
@@ -2272,6 +2306,105 @@ function resolveWstackPaths(opts) {
 import { existsSync as existsSync2, readFileSync as readFileSync5 } from "node:fs";
 import * as path5 from "node:path";
 
+// src/security/capabilities.ts
+var ToolCapabilities = {
+  /** Can execute arbitrary commands in the user's shell (the `bash` tool). */
+  SHELL_ARBITRARY: "shell.arbitrary",
+  /**
+   * Can execute the `exec` tool's allowlisted commands.
+   *
+   * "Restricted" describes the command NAME check, not the resulting power.
+   * Treat this as equivalent to {@link SHELL_ARBITRARY} when deciding what to
+   * grant: the allowlist includes general-purpose interpreters (`node`,
+   * `python`, `perl`, `ruby`) and, on Windows, the platform shells (`cmd`,
+   * `powershell`, `pwsh`) — deliberately, since without them `exec` cannot run
+   * `dir`/`type`/any cmdlet. `node -e …` or `cmd /c …` therefore reaches
+   * arbitrary execution, and per-argument denylisting cannot close that while
+   * the shells remain (blocking `node -e` still leaves `cmd /c node -e`).
+   *
+   * What actually bounds this is downstream, not the name check: the permission
+   * policy reconstructs the full command line and runs it through the
+   * destructive classifier, so destructive calls still require confirmation.
+   *
+   * Granting `shell.restricted` while withholding `shell.arbitrary` therefore
+   * buys no meaningful reduction in blast radius. Documented rather than
+   * silently implied, because the two read as a narrow/wide pair (WS-083).
+   */
+  SHELL_RESTRICTED: "shell.restricted",
+  /** Can run a restricted project formatter/linter-style command. */
+  SHELL_EXEC: "shell.exec",
+  /** Can read files inside the project (and possibly outside via symlinks if not guarded). */
+  FS_READ: "fs.read",
+  /** Can write / modify / delete files inside the project. */
+  FS_WRITE: "fs.write",
+  /** Can write files outside the current project root (very high risk). */
+  FS_WRITE_OUTSIDE_PROJECT: "fs.write.outside-project",
+  /** Can perform outbound network requests. */
+  NET_OUTBOUND: "net.outbound",
+  /** Can mutate in-memory session todos only. */
+  SESSION_TODO: "session.todo",
+  /** Can mutate in-memory session mode only. */
+  SESSION_MODE: "session.mode",
+  /** Can inspect registered tool metadata. */
+  TOOL_META: "tool.meta",
+  /** Can invoke arbitrary registered tools through a meta-tool. */
+  TOOL_MUTATE_ANY: "tool.mutate.any",
+  /** Can read persistent memory. */
+  MEMORY_READ: "memory.read",
+  /** Can write persistent memory. */
+  MEMORY_WRITE: "memory.write",
+  /** Can delete persistent memory. */
+  MEMORY_DELETE: "memory.delete",
+  /** Proxies tools from external MCP servers (unknown capability). */
+  MCP_PROXY: "mcp.proxy",
+  /** Can spawn or manage subagents / multi-agent tasks. */
+  SUBAGENT_SPAWN: "subagent.spawn",
+  /** Can inspect fleet/subagent coordination state without mutating it. */
+  COORDINATION_FLEET_READ: "coordination.fleet.read",
+  /** Can publish attributed, schema-checked events onto the fleet bus. */
+  COORDINATION_FLEET_EMIT: "coordination.fleet.emit",
+  /** Can submit a task-local structured result to the parent Director. */
+  COORDINATION_RESULT_SUBMIT: "coordination.result.submit",
+  /** Can read or write inter-agent mailbox messages. */
+  COORDINATION_MAIL: "coordination.mail",
+  /** Can schedule, inspect, or cancel in-session cron jobs. */
+  COORDINATION_CRON: "coordination.cron",
+  /** Can mutate global or session configuration / trust state. */
+  CONFIG_MUTATE: "config.mutate",
+  /** Can install packages or run package managers with side effects. */
+  PACKAGE_INSTALL: "package.install"
+};
+var DANGEROUS_FOR_SUBAGENTS = [
+  ToolCapabilities.SHELL_ARBITRARY,
+  ToolCapabilities.SHELL_RESTRICTED,
+  ToolCapabilities.SHELL_EXEC,
+  ToolCapabilities.FS_WRITE,
+  ToolCapabilities.FS_WRITE_OUTSIDE_PROJECT,
+  ToolCapabilities.TOOL_MUTATE_ANY,
+  ToolCapabilities.MEMORY_WRITE,
+  ToolCapabilities.MEMORY_DELETE,
+  ToolCapabilities.MCP_PROXY,
+  ToolCapabilities.SUBAGENT_SPAWN,
+  ToolCapabilities.CONFIG_MUTATE,
+  ToolCapabilities.PACKAGE_INSTALL
+];
+var WIDE_SUBAGENT_CAPABILITIES = [
+  ToolCapabilities.FS_READ,
+  ToolCapabilities.FS_WRITE,
+  ToolCapabilities.NET_OUTBOUND,
+  ToolCapabilities.SESSION_TODO,
+  ToolCapabilities.TOOL_META,
+  ToolCapabilities.MEMORY_READ,
+  ToolCapabilities.SHELL_ARBITRARY,
+  ToolCapabilities.SHELL_RESTRICTED,
+  ToolCapabilities.SHELL_EXEC,
+  ToolCapabilities.PACKAGE_INSTALL,
+  // Read-only fleet visibility (fleet_status) — peer awareness has no blast
+  // radius and every fleet worker should coordinate around its peers.
+  ToolCapabilities.COORDINATION_FLEET_READ,
+  ToolCapabilities.COORDINATION_RESULT_SUBMIT
+];
+
 // src/coordination/agents/project-agent-knowledge-manifests.ts
 var BUILT_IN_KNOWLEDGE_MANIFESTS = {
   android: {
@@ -6084,6 +6217,7 @@ ${content}`);
       if (section === "all" || section === "fallbacks") {
         const fallbackModels = config.fallbackModels ?? [];
         const profiles = config.fallbackProfiles ?? {};
+        addSection("Continuity Bridge", `  ${config.fallbackBridge?.trim() || "(disabled)"}`);
         addSection(
           "Fallback Chain",
           fallbackModels.length > 0 ? fallbackModels.map((f, i) => `  ${i + 1}. ${f}`).join("\n") : "  (empty \u2014 auto fallback applies when fallbackAuto is on)"
@@ -6126,6 +6260,19 @@ ${content}`);
         const profiles = config.fallbackProfiles ?? {};
         const chain = config.fallbackModels ?? [];
         const matrix = config.modelMatrix ?? {};
+        const bridge = config.fallbackBridge?.trim();
+        if (bridge) {
+          const parsed = parseModelRef(bridge);
+          if (!parsed.provider || !parsed.model) {
+            issues.push(`Continuity bridge "${bridge}" must be a full provider/model reference`);
+          } else if (!providers[parsed.provider] && parsed.provider !== config.provider) {
+            issues.push(
+              `Continuity bridge "${bridge}" references unknown provider "${parsed.provider}"`
+            );
+          } else {
+            ok.push(`Continuity bridge "${bridge}" \u2014 provider OK`);
+          }
+        }
         for (const fav of favorites) {
           const p = parseModelRef(fav);
           if (!p.model) {
@@ -6504,6 +6651,21 @@ var PROVIDER_MANAGE_SCHEMA = {
   required: ["action"],
   additionalProperties: false
 };
+function validateProviderBaseUrl(raw) {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return `Invalid baseUrl: ${raw} is not a valid URL.`;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    return `Invalid baseUrl: ${url.protocol} is not supported \u2014 use http: or https:.`;
+  }
+  if (url.username || url.password) {
+    return "Invalid baseUrl: credentials embedded in the URL are not accepted.";
+  }
+  return null;
+}
 function createProviderManageTool(opts) {
   return {
     name: PROVIDER_MANAGE_TOOL_NAME,
@@ -6513,6 +6675,11 @@ function createProviderManageTool(opts) {
     inputSchema: PROVIDER_MANAGE_SCHEMA,
     permission: "auto",
     mutating: true,
+    // WS-013: without a subjectKey the approval subject collapses to the bare
+    // tool name, so one "always allow" answered for `list` also authorised any
+    // future call with any baseUrl. Bind it to the endpoint, mirroring
+    // packages/tools/src/fetch.ts:74.
+    subjectKey: "baseUrl",
     riskTier: "standard",
     icon: "settings",
     async execute(input) {
@@ -6550,6 +6717,10 @@ ${msg}`,
         if (providers[input.provider]) {
           return { status: "error", message: `Provider "${input.provider}" already exists. Use "configure" to update.` };
         }
+        if (input.baseUrl) {
+          const invalid = validateProviderBaseUrl(input.baseUrl);
+          if (invalid) return { status: "error", message: invalid };
+        }
         const entry = { type: input.type };
         if (input.models) entry.models = input.models;
         if (input.baseUrl) entry.baseUrl = input.baseUrl;
@@ -6570,19 +6741,28 @@ ${msg}`,
         if (!providers[input.provider]) {
           return { status: "error", message: `Provider "${input.provider}" not found. Use "add" first or check "list".` };
         }
-        const entry = { ...providers[input.provider] };
+        if (input.baseUrl) {
+          const invalid = validateProviderBaseUrl(input.baseUrl);
+          if (invalid) return { status: "error", message: invalid };
+        }
+        const previous = { ...providers[input.provider] };
+        const entry = { ...previous };
         if (input.models !== void 0) entry.models = input.models;
         if (input.baseUrl !== void 0) entry.baseUrl = input.baseUrl || void 0;
         if (input.family !== void 0) entry.family = input.family || void 0;
         if (input.envVars !== void 0) entry.envVars = input.envVars;
         if (input.autoDiscoverModels !== void 0) entry.autoDiscoverModels = input.autoDiscoverModels;
         if (input.apiKey !== void 0) entry.apiKey = input.apiKey || void 0;
+        const endpointChanged = input.baseUrl !== void 0 && (entry.baseUrl ?? void 0) !== (previous.baseUrl ?? void 0);
+        const keyDropped = endpointChanged && input.apiKey === void 0 && previous.apiKey !== void 0;
+        if (keyDropped) entry.apiKey = void 0;
         providers[input.provider] = entry;
         await opts.updateConfig((cfg) => {
           cfg.providers = providers;
         });
         const updated = Object.keys({ ...entry }).filter((k) => k !== "apiKey").join(", ");
-        return { status: "ok", message: `\u2713 Updated ${input.provider}: ${updated}` };
+        const keyNote = keyDropped ? " \u2014 stored API key cleared because the base URL changed; set it again with provider_key_set" : "";
+        return { status: "ok", message: `\u2713 Updated ${input.provider}: ${updated}${keyNote}` };
       }
       if (input.action === "remove") {
         if (!input.provider) {
@@ -6839,86 +7019,6 @@ function expectDefined(value, label) {
   return value;
 }
 
-// src/security/capabilities.ts
-var ToolCapabilities = {
-  /** Can execute arbitrary commands in the user's shell (the `bash` tool). */
-  SHELL_ARBITRARY: "shell.arbitrary",
-  /** Can execute a restricted set of commands (the `exec` tool). */
-  SHELL_RESTRICTED: "shell.restricted",
-  /** Can run a restricted project formatter/linter-style command. */
-  SHELL_EXEC: "shell.exec",
-  /** Can read files inside the project (and possibly outside via symlinks if not guarded). */
-  FS_READ: "fs.read",
-  /** Can write / modify / delete files inside the project. */
-  FS_WRITE: "fs.write",
-  /** Can write files outside the current project root (very high risk). */
-  FS_WRITE_OUTSIDE_PROJECT: "fs.write.outside-project",
-  /** Can perform outbound network requests. */
-  NET_OUTBOUND: "net.outbound",
-  /** Can mutate in-memory session todos only. */
-  SESSION_TODO: "session.todo",
-  /** Can mutate in-memory session mode only. */
-  SESSION_MODE: "session.mode",
-  /** Can inspect registered tool metadata. */
-  TOOL_META: "tool.meta",
-  /** Can invoke arbitrary registered tools through a meta-tool. */
-  TOOL_MUTATE_ANY: "tool.mutate.any",
-  /** Can read persistent memory. */
-  MEMORY_READ: "memory.read",
-  /** Can write persistent memory. */
-  MEMORY_WRITE: "memory.write",
-  /** Can delete persistent memory. */
-  MEMORY_DELETE: "memory.delete",
-  /** Proxies tools from external MCP servers (unknown capability). */
-  MCP_PROXY: "mcp.proxy",
-  /** Can spawn or manage subagents / multi-agent tasks. */
-  SUBAGENT_SPAWN: "subagent.spawn",
-  /** Can inspect fleet/subagent coordination state without mutating it. */
-  COORDINATION_FLEET_READ: "coordination.fleet.read",
-  /** Can publish attributed, schema-checked events onto the fleet bus. */
-  COORDINATION_FLEET_EMIT: "coordination.fleet.emit",
-  /** Can submit a task-local structured result to the parent Director. */
-  COORDINATION_RESULT_SUBMIT: "coordination.result.submit",
-  /** Can read or write inter-agent mailbox messages. */
-  COORDINATION_MAIL: "coordination.mail",
-  /** Can schedule, inspect, or cancel in-session cron jobs. */
-  COORDINATION_CRON: "coordination.cron",
-  /** Can mutate global or session configuration / trust state. */
-  CONFIG_MUTATE: "config.mutate",
-  /** Can install packages or run package managers with side effects. */
-  PACKAGE_INSTALL: "package.install"
-};
-var DANGEROUS_FOR_SUBAGENTS = [
-  ToolCapabilities.SHELL_ARBITRARY,
-  ToolCapabilities.SHELL_RESTRICTED,
-  ToolCapabilities.SHELL_EXEC,
-  ToolCapabilities.FS_WRITE,
-  ToolCapabilities.FS_WRITE_OUTSIDE_PROJECT,
-  ToolCapabilities.TOOL_MUTATE_ANY,
-  ToolCapabilities.MEMORY_WRITE,
-  ToolCapabilities.MEMORY_DELETE,
-  ToolCapabilities.MCP_PROXY,
-  ToolCapabilities.SUBAGENT_SPAWN,
-  ToolCapabilities.CONFIG_MUTATE,
-  ToolCapabilities.PACKAGE_INSTALL
-];
-var WIDE_SUBAGENT_CAPABILITIES = [
-  ToolCapabilities.FS_READ,
-  ToolCapabilities.FS_WRITE,
-  ToolCapabilities.NET_OUTBOUND,
-  ToolCapabilities.SESSION_TODO,
-  ToolCapabilities.TOOL_META,
-  ToolCapabilities.MEMORY_READ,
-  ToolCapabilities.SHELL_ARBITRARY,
-  ToolCapabilities.SHELL_RESTRICTED,
-  ToolCapabilities.SHELL_EXEC,
-  ToolCapabilities.PACKAGE_INSTALL,
-  // Read-only fleet visibility (fleet_status) — peer awareness has no blast
-  // radius and every fleet worker should coordinate around its peers.
-  ToolCapabilities.COORDINATION_FLEET_READ,
-  ToolCapabilities.COORDINATION_RESULT_SUBMIT
-];
-
 // src/infrastructure/mcp-servers.ts
 var filesystemServer = () => ({
   name: "filesystem",
@@ -7096,6 +7196,17 @@ var atomicReplaceWithWriter = primitives.atomicReplaceWithWriter;
 var ensureDir = primitives.ensureDir;
 var withFileLock = primitives.withFileLock;
 
+// src/utils/deep-merge.ts
+var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype",
+  "__defineGetter__",
+  "__defineSetter__",
+  "__lookupGetter__",
+  "__lookupSetter__"
+]);
+
 // src/utils/config-json.ts
 async function readJsonObjectFile(filePath) {
   try {
@@ -7115,7 +7226,18 @@ async function updateJsonObjectFile(filePath, mutator) {
   await writeJsonObjectFile(filePath, next);
   return next;
 }
+function isForbiddenSegment(segment) {
+  return typeof segment === "string" && FORBIDDEN_PROTO_KEYS.has(segment);
+}
+function assertSafePath(path7) {
+  for (const segment of path7) {
+    if (isForbiddenSegment(segment)) {
+      throw new Error(`Refusing to use reserved key "${String(segment)}" in a JSON path`);
+    }
+  }
+}
 function setJsonPath(root, path7, value) {
+  assertSafePath(path7);
   if (path7.length === 0) {
     if (!isJsonObject(value)) throw new Error("Root config value must be an object");
     return value;
@@ -7123,7 +7245,8 @@ function setJsonPath(root, path7, value) {
   const parent = ensureJsonParent(root, path7);
   const leaf = lastPathSegment(path7);
   if (typeof leaf === "number") {
-    if (!Array.isArray(parent)) throw new Error(`Cannot set numeric segment ${leaf} on non-array parent`);
+    if (!Array.isArray(parent))
+      throw new Error(`Cannot set numeric segment ${leaf} on non-array parent`);
     parent[leaf] = value;
   } else {
     if (!isJsonObject(parent)) throw new Error(`Cannot set property ${leaf} on non-object parent`);
@@ -7140,6 +7263,7 @@ function lastPathSegment(path7) {
   return segment;
 }
 function ensureJsonParent(root, path7) {
+  assertSafePath(path7);
   let current = root;
   for (let i = 0; i < path7.length - 1; i += 1) {
     const segment = path7[i];
@@ -7147,12 +7271,16 @@ function ensureJsonParent(root, path7) {
     if (segment === void 0) throw new Error("Invalid empty JSON path segment");
     const nextContainer = typeof nextSegment === "number" ? [] : {};
     if (typeof segment === "number") {
-      if (!Array.isArray(current)) throw new Error(`Cannot traverse numeric segment ${segment} on non-array parent`);
-      if (!isJsonObject(current[segment]) && !Array.isArray(current[segment])) current[segment] = nextContainer;
+      if (!Array.isArray(current))
+        throw new Error(`Cannot traverse numeric segment ${segment} on non-array parent`);
+      if (!isJsonObject(current[segment]) && !Array.isArray(current[segment]))
+        current[segment] = nextContainer;
       current = current[segment];
     } else {
-      if (!isJsonObject(current)) throw new Error(`Cannot traverse property ${segment} on non-object parent`);
-      if (!isJsonObject(current[segment]) && !Array.isArray(current[segment])) current[segment] = nextContainer;
+      if (!isJsonObject(current))
+        throw new Error(`Cannot traverse property ${segment} on non-object parent`);
+      if (!isJsonObject(current[segment]) && !Array.isArray(current[segment]))
+        current[segment] = nextContainer;
       current = current[segment];
     }
   }
@@ -7411,6 +7539,9 @@ function badge(state) {
   }
 }
 
+// src/types/tool-executor.ts
+var GOVERNED_TOOL_EXECUTOR_META_KEY = "toolExecutor.executeGoverned";
+
 // src/utils/tool-name.ts
 var WIRE_TOOL_NAME_MAX_LENGTH = 128;
 function sanitizeWireToolName(name) {
@@ -7459,7 +7590,7 @@ function createMcpUseTool(opts) {
     riskTier: "standard",
     capabilities: [ToolCapabilities.MCP_PROXY],
     inputSchema,
-    async execute(raw) {
+    async execute(raw, ctx) {
       const input = raw;
       const { server: serverName, tool: toolName, input: toolInput } = input;
       const servers = registry.describe();
@@ -7481,8 +7612,13 @@ function createMcpUseTool(opts) {
           const hint = allTools.length > 0 ? `Available tools on "${serverName}": ${allTools.join(", ")}.` : `No tools found on "${serverName}". The server may not have published any tools.`;
           return `Tool "${toolName}" not found on server "${serverName}". ${hint}`;
         }
-        const result = await mcpTool.execute(toolInput ?? {}, {}, {});
-        return result;
+        const governedExecute = ctx.meta[GOVERNED_TOOL_EXECUTOR_META_KEY];
+        if (typeof governedExecute !== "function") {
+          throw new Error("mcp_use: governed nested execution is unavailable");
+        }
+        const result = await governedExecute(qualifiedName, toolInput ?? {});
+        if (!result.success) throw new Error(result.error ?? "MCP tool execution failed");
+        return result.result;
       } finally {
         if (registry.deactivateServer) {
           registry.deactivateServer(serverName);
@@ -7677,19 +7813,39 @@ var OneShotOrchestrator = class {
    */
   resolveFallbackChain(input, config, target) {
     const mgr = this.opts.fallbackProfileManager;
+    let selected = mgr.resolveEffective({
+      fallbackAuto: false,
+      exclude: target
+    });
     if (input.fallbackModels && input.fallbackModels.length > 0) {
-      return mgr.resolveRefs(input.fallbackModels, target);
-    }
-    if (config.fallbackModels && config.fallbackModels.length > 0) {
-      return mgr.resolveRefs(config.fallbackModels, target);
-    }
-    if (config.fallbackAuto !== false) {
-      return mgr.resolveEffective({
+      selected = mgr.resolveEffective({
+        fallbackModels: input.fallbackModels,
+        fallbackAuto: false,
+        exclude: target
+      });
+    } else if (config.fallbackModels && config.fallbackModels.length > 0) {
+      selected = mgr.resolveEffective({
+        fallbackModels: config.fallbackModels,
+        fallbackAuto: false,
+        exclude: target
+      });
+    } else if (config.fallbackAuto !== false) {
+      selected = mgr.resolveEffective({
         fallbackAuto: true,
         exclude: target
       });
     }
-    return Object.freeze([]);
+    if (config.fallbackAuto === false) return selected;
+    const combined = [...selected, ...mgr.resolveAllConfigured(target)];
+    const seen = /* @__PURE__ */ new Set();
+    return Object.freeze(
+      combined.filter((entry) => {
+        const key = `${entry.providerId}/${entry.model}`;
+        if (seen.has(key)) return false;
+        seen.add(key);
+        return true;
+      })
+    );
   }
   /** Attempt a provider call while preserving the actual failure for callers. */
   async tryCall(provider, request, signal, providerId, model) {

package/dist/tools/mcp-use.d.ts

@@ -1,6 +1,6 @@
 import type { ToolRegistry } from '../index.js';
-import type { MCPRegistryHandle } from './mcp-control.js';
 import type { Tool } from '../types/tool.js';
+import type { MCPRegistryHandle } from './mcp-control.js';
 /**
  * `mcp_use` — meta-tool for ephemeral MCP tool calls in token-saving mode.
  *

package/dist/types/blocks.d.ts

@@ -36,6 +36,13 @@ export interface ToolResultBlock {
     name?: string | undefined;
     content: string;
     is_error?: boolean | undefined;
+    /**
+     * Structured tool error information. Present on error results produced
+     * by the unified tool error taxonomy (tool-error-taxonomy.ts). Consumed
+     * by retry logic, audit log, and observability. Stripped before sending
+     * to the provider (it's an internal extension, not part of the wire format).
+     */
+    _toolErrorInfo?: import('./tool.js').ToolErrorInfo | undefined;
 }
 export interface ImageBlock {
     type: 'image';