@wrongstack/core 0.5.3 → 0.5.5

package/dist/{agent-bridge-EiUFe3if.d.ts → agent-bridge-B07AYFBk.d.ts}

@@ -1,4 +1,4 @@
-import { B as BridgeTransport, l as BridgeMessage, A as AgentBridge, m as AgentBridgeConfig } from './multi-agent-D6S4Z7H8.js';
+import { B as BridgeTransport, l as BridgeMessage, A as AgentBridge, m as AgentBridgeConfig } from './multi-agent-Cv8wk47i.js';
 
 /**
  * In-memory pub/sub transport for agent-to-agent messaging.

package/dist/{compactor-BP4xhKVi.d.ts → compactor-BWhJXxsW.d.ts}

@@ -1,4 +1,4 @@
-import { a1 as Context } from './context-PH4DvBZV.js';
+import { a2 as Context } from './context-CLZXPPYk.js';
 
 interface CompactRepairReport {
     removedToolUses: string[];

package/dist/{config-BOD_HQBw.d.ts → config-BgM0BIpz.d.ts}

@@ -1,5 +1,5 @@
 import { W as WireFamily } from './models-registry-Y2xbog0E.js';
-import { P as Permission } from './context-PH4DvBZV.js';
+import { P as Permission } from './context-CLZXPPYk.js';
 
 type ContextWindowModeId = 'balanced' | 'frugal' | 'deep' | 'archival';
 type ContextWindowAggressiveOn = 'hard' | 'soft' | 'warn';

package/dist/{context-PH4DvBZV.d.ts → context-CLZXPPYk.d.ts}

@@ -194,6 +194,16 @@ declare function isSessionError(err: unknown): err is SessionError;
 declare function isAgentError(err: unknown): err is AgentError;
 
 type Permission = 'auto' | 'confirm' | 'deny';
+/**
+ * Risk tier for tools in YOLO mode. Even in YOLO, tools classified as
+ * `destructive` still prompt for confirmation unless `--force-all-yolo`
+ * is set.
+ *
+ * - `safe`       — read-only, no side effects (read, glob, grep, etc.)
+ * - `standard`   — non-destructive writes and mutations (write, edit, bash with safe commands)
+ * - `destructive` — irreversible or broadside effects (recursive deletes, db drops, etc.)
+ */
+type RiskTier = 'safe' | 'standard' | 'destructive';
 interface JSONSchema {
     type?: string;
     properties?: Record<string, JSONSchema>;
@@ -243,6 +253,13 @@ interface Tool<I = unknown, O = unknown> {
     inputSchema: JSONSchema;
     permission: Permission;
     mutating: boolean;
+    /**
+     * Risk tier for selective YOLO gating. When YOLO is active, `destructive`
+     * tools still emit `confirm` unless `forceAllYolo` is set. Defaults to
+     * `standard` when omitted — callers should always check `riskTier` after
+     * the basic permission decision.
+     */
+    riskTier?: RiskTier;
     /**
      * Input-field name that the permission policy should match trust rules
      * against. Without this, the policy falls back to a heuristic
@@ -937,4 +954,4 @@ declare class Context implements RunEnv {
     usage(): Usage;
 }
 
-export { isWrongStackError as $, AgentError as A, type ToolStreamEvent as B, type Capabilities as C, type ToolUseBlock as D, type ErrorCode as E, type FileSnapshot as F, asBlocks as G, asText as H, type ImageBlock as I, type JSONSchema as J, isAgentError as K, isConfigError as L, type Message as M, isImageBlock as N, isPluginError as O, type Permission as P, isSessionError as Q, type Request as R, type SessionData as S, type TextBlock as T, type Usage as U, isTextBlock as V, WrongStackError as W, isThinkingBlock as X, isToolError as Y, isToolResultBlock as Z, isToolUseBlock as _, ConfigError as a, toWrongStackError as a0, Context as a1, type TokenCounter as a2, type CacheStats as a3, type ContextInit as a4, ConversationState as a5, type ReadonlyConversationState as a6, type RunEnv as a7, type RunOptions as a8, type StateChange as a9, type StateChangeHandler as aa, type TodoItem as ab, extractRunEnv as ac, wrapAsState as ad, type ContentBlock as b, type ErrorSeverity as c, type ErrorSubsystem as d, type MessageRole as e, PluginError as f, type Provider as g, ProviderError as h, type ProviderErrorBody as i, type Response as j, type ResumedSession as k, SessionError as l, type SessionEvent as m, type SessionMetadata as n, type SessionStore as o, type SessionSummary as p, type SessionWriter as q, type StopReason as r, type StreamEvent as s, type ThinkingBlock as t, type Tool as u, type ToolCallContext as v, ToolError as w, type ToolFinalEvent as x, type ToolProgressEvent as y, type ToolResultBlock as z };
+export { isToolUseBlock as $, AgentError as A, type ToolResultBlock as B, type Capabilities as C, type ToolStreamEvent as D, type ErrorCode as E, type FileSnapshot as F, type ToolUseBlock as G, asBlocks as H, type ImageBlock as I, type JSONSchema as J, asText as K, isAgentError as L, type Message as M, isConfigError as N, isImageBlock as O, type Permission as P, isPluginError as Q, type Request as R, type SessionData as S, type TextBlock as T, type Usage as U, isSessionError as V, WrongStackError as W, isTextBlock as X, isThinkingBlock as Y, isToolError as Z, isToolResultBlock as _, ConfigError as a, isWrongStackError as a0, toWrongStackError as a1, Context as a2, type TokenCounter as a3, type CacheStats as a4, type TodoItem as a5, ConversationState as a6, type ContextInit as a7, type ReadonlyConversationState as a8, type RunEnv as a9, type RunOptions as aa, type StateChange as ab, type StateChangeHandler as ac, extractRunEnv as ad, wrapAsState as ae, type ContentBlock as b, type ErrorSeverity as c, type ErrorSubsystem as d, type MessageRole as e, PluginError as f, type Provider as g, ProviderError as h, type ProviderErrorBody as i, type Response as j, type ResumedSession as k, type RiskTier as l, SessionError as m, type SessionEvent as n, type SessionMetadata as o, type SessionStore as p, type SessionSummary as q, type SessionWriter as r, type StopReason as s, type StreamEvent as t, type ThinkingBlock as u, type Tool as v, type ToolCallContext as w, ToolError as x, type ToolFinalEvent as y, type ToolProgressEvent as z };

package/dist/coordination/index.d.ts

@@ -1,13 +1,13 @@
-export { A as ALL_FLEET_AGENTS, a as AUDIT_LOG_AGENT, b as AgentFactory, c as AgentFactoryResult, d as AgentRunnerOptions, B as BUG_HUNTER_AGENT, C as CreateDelegateToolOptions, D as DEFAULT_DIRECTOR_PREAMBLE, e as DEFAULT_SUBAGENT_BASELINE, f as DefaultMultiAgentCoordinator, g as DelegateHost, h as Director, i as DirectorBudgetError, j as DirectorPromptParts, k as DirectorSessionFactory, l as DirectorSessionFactoryOptions, F as FLEET_ROSTER, n as FleetBus, o as FleetEvent, p as FleetHandler, q as FleetUsage, r as FleetUsageAggregator, M as MultiAgentCoordinatorOptions, R as REFACTOR_PLANNER_AGENT, S as SECURITY_SCANNER_AGENT, s as SubagentPromptParts, t as SubagentUsageSnapshot, v as composeDirectorPrompt, w as composeSubagentPrompt, x as createDelegateTool, y as makeAgentSubagentRunner, z as makeDirectorSessionFactory, E as rosterSummaryFromConfigs } from '../index-CcbWbcpy.js';
-export { n as BudgetExceededError, o as BudgetKind, p as BudgetLimits, s as BudgetThresholdDecision, t as BudgetThresholdHandler, u as BudgetThresholdSignal, q as BudgetUsage, r as SubagentBudget } from '../multi-agent-D6S4Z7H8.js';
-export { I as InMemoryAgentBridge, a as InMemoryBridgeTransport, c as createMessage } from '../agent-bridge-EiUFe3if.js';
-import '../context-PH4DvBZV.js';
-import '../events-oxn-Wkub.js';
+export { A as ALL_FLEET_AGENTS, a as AUDIT_LOG_AGENT, b as AgentFactory, c as AgentFactoryResult, d as AgentRunnerOptions, B as BUG_HUNTER_AGENT, C as CreateDelegateToolOptions, D as DEFAULT_DIRECTOR_PREAMBLE, e as DEFAULT_SUBAGENT_BASELINE, f as DefaultMultiAgentCoordinator, g as DelegateHost, h as Director, i as DirectorBudgetError, j as DirectorPromptParts, k as DirectorSessionFactory, l as DirectorSessionFactoryOptions, F as FLEET_ROSTER, n as FleetBus, o as FleetEvent, p as FleetHandler, q as FleetUsage, r as FleetUsageAggregator, M as MultiAgentCoordinatorOptions, R as REFACTOR_PLANNER_AGENT, S as SECURITY_SCANNER_AGENT, s as SubagentPromptParts, t as SubagentUsageSnapshot, v as composeDirectorPrompt, w as composeSubagentPrompt, x as createDelegateTool, y as makeAgentSubagentRunner, z as makeDirectorSessionFactory, E as rosterSummaryFromConfigs } from '../index-De4R4rQ7.js';
+export { n as BudgetExceededError, o as BudgetKind, p as BudgetLimits, s as BudgetThresholdDecision, t as BudgetThresholdHandler, u as BudgetThresholdSignal, q as BudgetUsage, r as SubagentBudget } from '../multi-agent-Cv8wk47i.js';
+export { I as InMemoryAgentBridge, a as InMemoryBridgeTransport, c as createMessage } from '../agent-bridge-B07AYFBk.js';
+import '../context-CLZXPPYk.js';
+import '../events-qnDZbrtb.js';
 import 'node:events';
-import '../index-a12jc7-r.js';
+import '../index-DPLJw_ZI.js';
 import '../logger-BMQgxvdy.js';
-import '../system-prompt-BJlzKGO6.js';
+import '../system-prompt-DI4Dtc1I.js';
 import '../observability-BhnVLBLS.js';
-import '../secret-scrubber-CB11A2P7.js';
-import '../config-BOD_HQBw.js';
+import '../secret-scrubber-BhJTNr9v.js';
+import '../config-BgM0BIpz.js';
 import '../models-registry-Y2xbog0E.js';

package/dist/defaults/index.d.ts

@@ -1,35 +1,35 @@
 export { D as DefaultLogger, a as DefaultLoggerOptions } from '../logger-BH6AE0W9.js';
-export { A as AbandonedSession, a as AttachmentStoreOptions, C as ConfigLoaderOptions, b as ConfigMigration, c as ConfigMigrationError, d as ConfigSource, D as DEFAULT_CONFIG_MIGRATIONS, e as DefaultAttachmentStore, f as DefaultConfigLoader, g as DefaultConfigStore, h as DefaultMemoryStore, i as DefaultSessionStore, j as DirectorStateCheckpoint, k as DirectorStateSnapshot, l as DirectorSubagentState, m as DirectorTaskState, M as MemoryStoreOptions, n as MigrationContext, o as MigrationResult, P as PersistedQueueItem, p as PlanFile, q as PlanItem, Q as QueueStore, R as RecoveryLock, r as RecoveryLockOptions, S as SessionAnalyzer, s as SessionStoreOptions, T as TodosCheckpointFile, t as addPlanItem, u as attachPlanCheckpoint, v as attachTodosCheckpoint, w as clearPlan, x as emptyPlan, y as formatPlan, z as loadDirectorState, B as loadPlan, E as loadTodosCheckpoint, F as removePlanItem, G as runConfigMigrations, H as savePlan, I as saveTodosCheckpoint, J as setPlanItemStatus } from '../director-state-CVzkjKRZ.js';
-export { D as DefaultSessionReader } from '../session-reader-1tOyoY1s.js';
-export { D as DefaultSecretScrubber, a as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, m as migratePlaintextSecrets, r as rewriteConfigEncrypted } from '../secret-scrubber-EqFa0SyI.js';
+export { A as AbandonedSession, a as AttachmentStoreOptions, C as ConfigLoaderOptions, b as ConfigMigration, c as ConfigMigrationError, d as ConfigSource, D as DEFAULT_CONFIG_MIGRATIONS, e as DefaultAttachmentStore, f as DefaultConfigLoader, g as DefaultConfigStore, h as DefaultMemoryStore, i as DefaultSessionStore, j as DirectorStateCheckpoint, k as DirectorStateSnapshot, l as DirectorSubagentState, m as DirectorTaskState, M as MemoryStoreOptions, n as MigrationContext, o as MigrationResult, P as PersistedQueueItem, p as PlanFile, q as PlanItem, Q as QueueStore, R as RecoveryLock, r as RecoveryLockOptions, S as SessionAnalyzer, s as SessionStoreOptions, T as TodosCheckpointFile, t as addPlanItem, u as attachPlanCheckpoint, v as attachTodosCheckpoint, w as clearPlan, x as emptyPlan, y as formatPlan, z as loadDirectorState, B as loadPlan, E as loadTodosCheckpoint, F as removePlanItem, G as runConfigMigrations, H as savePlan, I as saveTodosCheckpoint, J as setPlanItemStatus } from '../director-state-BUxlqkOa.js';
+export { D as DefaultSessionReader } from '../session-reader-4jxsYLZ8.js';
+export { D as DefaultSecretScrubber, a as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, m as migratePlaintextSecrets, r as rewriteConfigEncrypted } from '../secret-scrubber-Z_VXuXQT.js';
 export { AutoApprovePermissionPolicy, DefaultPermissionPolicy, PermissionPolicyOptions } from '../security/index.js';
-export { C as CompactorOptions, a as DefaultErrorHandler, b as DefaultRetryPolicy, H as HybridCompactor, T as ToolExecutor } from '../tool-executor-B6kRcWeF.js';
+export { C as CompactorOptions, a as DefaultErrorHandler, b as DefaultRetryPolicy, H as HybridCompactor, T as ToolExecutor } from '../tool-executor-DSvmOBe6.js';
 export { AutoCompactionMiddleware, AutonomousRunner, AutonomousRunnerOptions, DefaultSkillLoader, DoneCheckResult, DoneConditionChecker, IntelligentCompactor, IntelligentCompactorOptions, SelectiveCompactor, SelectiveCompactorOptions, SkillLoaderOptions } from '../execution/index.js';
-import { P as ProviderRunner, R as RunProviderOptions } from '../provider-runner-DGisz_lG.js';
-import { j as Response } from '../context-PH4DvBZV.js';
-export { A as ALL_FLEET_AGENTS, a as AUDIT_LOG_AGENT, b as AgentFactory, c as AgentFactoryResult, d as AgentRunnerOptions, B as BUG_HUNTER_AGENT, C as CreateDelegateToolOptions, D as DEFAULT_DIRECTOR_PREAMBLE, e as DEFAULT_SUBAGENT_BASELINE, f as DefaultMultiAgentCoordinator, g as DelegateHost, h as Director, i as DirectorBudgetError, j as DirectorPromptParts, k as DirectorSessionFactory, l as DirectorSessionFactoryOptions, F as FLEET_ROSTER, m as FLEET_ROSTER_BUDGETS, n as FleetBus, o as FleetEvent, p as FleetHandler, q as FleetUsage, r as FleetUsageAggregator, M as MultiAgentCoordinatorOptions, R as REFACTOR_PLANNER_AGENT, S as SECURITY_SCANNER_AGENT, s as SubagentPromptParts, t as SubagentUsageSnapshot, u as applyRosterBudget, v as composeDirectorPrompt, w as composeSubagentPrompt, x as createDelegateTool, y as makeAgentSubagentRunner, z as makeDirectorSessionFactory, E as rosterSummaryFromConfigs } from '../index-CcbWbcpy.js';
-export { n as BudgetExceededError, o as BudgetKind, p as BudgetLimits, q as BudgetUsage, r as SubagentBudget } from '../multi-agent-D6S4Z7H8.js';
-export { I as InMemoryAgentBridge, a as InMemoryBridgeTransport, c as createMessage } from '../agent-bridge-EiUFe3if.js';
+import { P as ProviderRunner, R as RunProviderOptions } from '../provider-runner-3SHqk9zB.js';
+import { j as Response } from '../context-CLZXPPYk.js';
+export { A as ALL_FLEET_AGENTS, a as AUDIT_LOG_AGENT, b as AgentFactory, c as AgentFactoryResult, d as AgentRunnerOptions, B as BUG_HUNTER_AGENT, C as CreateDelegateToolOptions, D as DEFAULT_DIRECTOR_PREAMBLE, e as DEFAULT_SUBAGENT_BASELINE, f as DefaultMultiAgentCoordinator, g as DelegateHost, h as Director, i as DirectorBudgetError, j as DirectorPromptParts, k as DirectorSessionFactory, l as DirectorSessionFactoryOptions, F as FLEET_ROSTER, m as FLEET_ROSTER_BUDGETS, n as FleetBus, o as FleetEvent, p as FleetHandler, q as FleetUsage, r as FleetUsageAggregator, M as MultiAgentCoordinatorOptions, R as REFACTOR_PLANNER_AGENT, S as SECURITY_SCANNER_AGENT, s as SubagentPromptParts, t as SubagentUsageSnapshot, u as applyRosterBudget, v as composeDirectorPrompt, w as composeSubagentPrompt, x as createDelegateTool, y as makeAgentSubagentRunner, z as makeDirectorSessionFactory, E as rosterSummaryFromConfigs } from '../index-De4R4rQ7.js';
+export { n as BudgetExceededError, o as BudgetKind, p as BudgetLimits, q as BudgetUsage, r as SubagentBudget } from '../multi-agent-Cv8wk47i.js';
+export { I as InMemoryAgentBridge, a as InMemoryBridgeTransport, c as createMessage } from '../agent-bridge-B07AYFBk.js';
 export { D as DefaultModelsRegistry, a as DefaultModelsRegistryOptions, c as classifyFamily } from '../models-registry-DqzwpBQy.js';
 export { DefaultModeStore, LLMSelector, LLMSelectorOptions, ModeLoaderOptions, loadProjectModes, loadUserModes } from '../models/index.js';
 export { AISpecBuilder, AISpecBuilderOptions, AISpecPhase, AISpecSession, AutoExecutor, AutoExecutorOptions, BottleneckTask, CollectedAnswer, CriticalPathAnalysis, DefaultTaskStore, ExecutionSummary, GeneratedTask, SPEC_TEMPLATES, SpecDiff, SpecDrivenDev, SpecDrivenDevOptions, SpecIndexEntry, SpecParser, SpecStore, SpecStoreOptions, SpecVersion, SpecVersioning, TaskExecutionContext, TaskExecutionResult, TaskFlow, TaskFlowEventMap, TaskFlowEventName, TaskFlowExecutionContext, TaskFlowOptions, TaskFlowPhase, TaskGenerator, TaskGeneratorOptions, TaskGraphIndexEntry, TaskGraphStore, TaskGraphStoreOptions, TaskStore, TaskTracker, TaskTrackerOptions, TaskTransition, analyzeCriticalPath, createAutoExecutor, getTemplate, listTemplates, renderProgress, renderSpecAnalysis, renderTaskGraph, renderTaskList, templateToMarkdown } from '../sdd/index.js';
 export { DefaultHealthRegistry, InMemoryMetricsSink, MetricsServerHandle, MetricsServerOptions, NoopMetricsSink, NoopTracer, OTelTracer, OtlpMetricsExporterHandle, OtlpMetricsExporterOptions, OtlpTraceExporterHandle, OtlpTraceExporterOptions, PROMETHEUS_CONTENT_TYPE, buildOtlpMetricsRequest, buildOtlpTracesRequest, renderPrometheus, startMetricsServer, startOtlpMetricsExporter, startOtlpTraceExporter, wireMetricsToEvents } from '../observability/index.js';
-export { C as ContextManagerAction, a as ContextManagerInput, b as ContextManagerResult, c as ContextManagerToolOptions, d as allServers, e as awsServer, f as blockServer, g as braveSearchServer, h as context7Server, i as contextManagerTool, j as createContextManagerTool, k as everArtServer, l as filesystemServer, m as githubServer, n as googleMapsServer, o as miniMaxVisionServer, s as sentinelServer, p as slackServer, z as zaiVisionServer } from '../mcp-servers-uPmBxZ1B.js';
+export { C as ContextManagerAction, a as ContextManagerInput, b as ContextManagerResult, c as ContextManagerToolOptions, d as allServers, e as awsServer, f as blockServer, g as braveSearchServer, h as context7Server, i as contextManagerTool, j as createContextManagerTool, k as everArtServer, l as filesystemServer, m as githubServer, n as googleMapsServer, o as miniMaxVisionServer, s as sentinelServer, p as slackServer, z as zaiVisionServer } from '../mcp-servers-CSMfaBuL.js';
 import '../logger-BMQgxvdy.js';
-import '../events-oxn-Wkub.js';
+import '../events-qnDZbrtb.js';
 import '../memory-CEXuo7sz.js';
-import '../wstack-paths-BGu2INTm.js';
-import '../config-BOD_HQBw.js';
+import '../wstack-paths-86YPFktR.js';
+import '../config-BgM0BIpz.js';
 import '../models-registry-Y2xbog0E.js';
 import '../secret-vault-DoISxaKO.js';
-import '../secret-scrubber-CB11A2P7.js';
+import '../secret-scrubber-BhJTNr9v.js';
 import '../input-reader-E-ffP2ee.js';
-import '../compactor-BP4xhKVi.js';
-import '../retry-policy-DUJ8-Qc_.js';
-import '../index-a12jc7-r.js';
-import '../system-prompt-BJlzKGO6.js';
+import '../compactor-BWhJXxsW.js';
+import '../retry-policy-LLUxJmYY.js';
+import '../index-DPLJw_ZI.js';
+import '../system-prompt-DI4Dtc1I.js';
 import '../observability-BhnVLBLS.js';
-import '../selector-yqyxt-Ii.js';
+import '../selector-DB2-byKH.js';
 import '../skill-CxuWrsKK.js';
 import 'node:events';
 import '../mode-CV077NjV.js';

package/dist/defaults/index.js

@@ -1052,6 +1052,16 @@ function labelOf(scope) {
 }
 
 // src/storage/config-store.ts
+function stripEphemeralFields(cfg) {
+  const env = cfg._envSource;
+  if (!env?.size) return cfg;
+  const out = { ...cfg };
+  for (const field of env) {
+    delete out[field];
+  }
+  delete out._envSource;
+  return out;
+}
 var DefaultConfigStore = class {
   current;
   watchers = /* @__PURE__ */ new Set();
@@ -1069,7 +1079,8 @@ var DefaultConfigStore = class {
     return ext ? ext : FROZEN_EMPTY;
   }
   update(partial) {
-    const next = deepFreeze(structuredClone({ ...this.current, ...partial }));
+    const scrubbed = stripEphemeralFields(partial);
+    const next = deepFreeze(structuredClone({ ...this.current, ...scrubbed }));
     if (next.version !== 1) {
       throw new Error(`ConfigStore.update: version must remain 1, got ${String(next.version)}`);
     }
@@ -1240,15 +1251,19 @@ var BEHAVIOR_DEFAULTS = {
 var ENV_MAP = {
   WRONGSTACK_PROVIDER: (c, v) => {
     c.provider = v;
+    (c._envSource ??= /* @__PURE__ */ new Set()).add("provider");
   },
   WRONGSTACK_MODEL: (c, v) => {
     c.model = v;
+    (c._envSource ??= /* @__PURE__ */ new Set()).add("model");
   },
   WRONGSTACK_API_KEY: (c, v) => {
     c.apiKey = v;
+    (c._envSource ??= /* @__PURE__ */ new Set()).add("apiKey");
   },
   WRONGSTACK_BASE_URL: (c, v) => {
     c.baseUrl = v;
+    (c._envSource ??= /* @__PURE__ */ new Set()).add("baseUrl");
   },
   WRONGSTACK_LOG_LEVEL: (c, v) => {
     if (!c.log) c.log = { level: "info" };
@@ -2279,7 +2294,15 @@ var PATTERNS = [
     type: "stripe_key",
     regex: /(?<![A-Za-z0-9])sk_(?:live|test)_[A-Za-z0-9]{24,}(?![A-Za-z0-9])/g
   },
-  { type: "twilio_sid", regex: /(?<![A-Za-z0-9])AC[a-f0-9]{32}(?![A-Za-z0-9])/g },
+  {
+    type: "twilio_sid",
+    regex: /(?<![A-Za-z0-9])AC[a-f0-9]{32}(?![A-Za-z0-9])/g
+  },
+  {
+    type: "telegram_bot_token",
+    // Telegram tokens are of the form  bot<digits>:<alphanum>  in URL paths
+    regex: /\/bot\d+:[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g
+  },
   {
     type: "jwt",
     // Anchored: look for literal "eyJ" which is unambiguous for JWT header
@@ -2635,6 +2658,7 @@ var DefaultPermissionPolicy = class {
   loaded = false;
   trustFile;
   yolo;
+  forceAllYolo;
   /**
    * Session-scoped "soft deny" map. When the user presses 'n' (block once),
    * the tool+pattern is added here. If the LLM retries in the same session,
@@ -2667,6 +2691,7 @@ var DefaultPermissionPolicy = class {
   constructor(opts) {
     this.trustFile = opts.trustFile;
     this.yolo = opts.yolo ?? false;
+    this.forceAllYolo = opts.forceAllYolo ?? false;
     this.promptDelegate = opts.promptDelegate;
   }
   /**
@@ -2686,6 +2711,14 @@ var DefaultPermissionPolicy = class {
   getYolo() {
     return this.yolo;
   }
+  /** Toggle force-all-YOLO at runtime. */
+  setForceAllYolo(enabled) {
+    this.forceAllYolo = enabled;
+  }
+  /** Check whether force-all-YOLO is active. */
+  getForceAllYolo() {
+    return this.forceAllYolo;
+  }
   async reload() {
     try {
       const raw = await fsp.readFile(this.trustFile, "utf8");
@@ -2727,6 +2760,21 @@ var DefaultPermissionPolicy = class {
       return { permission: "auto", source: "trust" };
     }
     if (this.yolo) {
+      if (tool.riskTier === "destructive" && !this.forceAllYolo) {
+        if (this.promptDelegate) {
+          const decision = await this.promptDelegate(tool, input, subject ?? tool.name);
+          if (decision === "always") {
+            await this.trust({ tool: tool.name, pattern: subject ?? tool.name });
+            return { permission: "auto", source: "user", reason: "destructive yolo always-allowed" };
+          }
+          if (decision === "deny") {
+            await this.deny({ tool: tool.name, pattern: subject ?? tool.name });
+            return { permission: "deny", source: "user", reason: "user denied destructive yolo" };
+          }
+          return { permission: decision === "yes" ? "auto" : "deny", source: "user" };
+        }
+        return { permission: "confirm", source: "yolo_destructive", riskTier: "destructive", reason: "destructive tool needs explicit approval even in yolo mode" };
+      }
       return { permission: "auto", source: "yolo" };
     }
     if (tool.name === "write" && subject) {