@wrongstack/tools 1.0.2 → 1.0.4

package/README.md

@@ -71,8 +71,6 @@ execution remain separate permission-gated steps.
 | `install` | `confirm` | Package manager install |
 | `audit` | `confirm` | Dependency vulnerability audit |
 | `outdated` | `auto` | List outdated dependencies |
-| `scaffold` | `confirm` | Template-based scaffolding |
-| `document` | `auto` | Deprecated read-only documentation-candidate preview; use plugin tool `auto_doc` for generation |
 | `logs` | `auto` | Tail logs with rolling 100k-line window |
 
 ### Agent control
@@ -80,10 +78,6 @@ execution remain separate permission-gated steps.
 | Tool | Notes |
 |------|-------|
 | `todo` | TodoWrite / TodoRead for session task tracking |
-| `tool_search` | Lazy-load deferred tool schemas |
-| `tool_use` | Generic single-tool call |
-| `batch_tool_use` | Parallel multi-tool dispatch |
-| `tool_help` | Show tool usage hint |
 | `remember` / `forget` | Memory-store mutations |
 | `create_mode` | Author a new agent mode |
 

package/dist/_util.d.ts

@@ -130,4 +130,22 @@ export declare function truncateHeadTail(s: string, maxBytes: number): string;
 export declare function normalizeCommandOutput(raw: string, opts?: {
     maxBytes?: number | undefined;
 }): string;
+/**
+ * Build a project-root-relative path shortener for search tool output.
+ *
+ * `grep` and `glob` emit one path per match, and the absolute project prefix
+ * (`D:\long\path\to\project\`) is repeated on every single line — pure token
+ * waste in the model's context, since the agent already works from the project
+ * root. Stripping it makes match lines read like the paths the user and the
+ * other tools use (`packages/tools/src/grep.ts:42:…`).
+ *
+ * Only paths that actually live under `root` are shortened. The search tools
+ * resolve their base through `safeResolveReal`, which also admits
+ * `~/.wrongstack`; turning those into a `../../..` chain would be strictly
+ * worse than the absolute path, so they are returned untouched. Windows path
+ * comparison is case-insensitive (a drive letter can arrive as `d:\` from one
+ * source and `D:\` from another) but the returned suffix always preserves the
+ * original casing.
+ */
+export declare function makeRootRelativizer(root: string): (absPath: string) => string;
 //# sourceMappingURL=_util.d.ts.map

package/dist/_win32-resolve.d.ts

@@ -1,3 +1,4 @@
+export { buildWin32CmdShimInvocation, type Win32CmdShimInvocation, } from '@wrongstack/core/utils';
 /**
  * On Windows, Node.js `spawn()` without a shell does NOT resolve .cmd/.bat
  * extensions through PATHEXT — it only auto-resolves .exe. Most Node.js CLI
@@ -28,15 +29,9 @@ export declare function resolveWin32Command(cmd: string): string;
  * diagnostic. We never throw from here.
  */
 export declare function resolvePowerShell(cmd: string): string;
-export interface Win32CmdShimInvocation {
-    command: string;
-    args: string[];
-    windowsVerbatimArguments: true;
-}
 /**
  * Throw if any argument contains a cmd.exe command-injection metacharacter.
  * Call this ONLY on the Windows `.cmd`/`.bat` shim path. A no-op for safe args.
  */
 export declare function assertSafeWin32ShellArgs(args: readonly unknown[]): void;
-export declare function buildWin32CmdShimInvocation(command: string, args?: readonly string[]): Win32CmdShimInvocation;
 //# sourceMappingURL=_win32-resolve.d.ts.map

package/dist/audit.js

@@ -1,14 +1,14 @@
 import {
   auditTool
-} from "./chunk-WEEVSWQB.js";
-import "./chunk-T3SMFF5Q.js";
-import "./chunk-7N5U2RAU.js";
-import "./chunk-DRRY6SCM.js";
+} from "./chunk-C64UUXTA.js";
+import "./chunk-JQ43NVFU.js";
+import "./chunk-JK5WXW4S.js";
+import "./chunk-EMA2XENR.js";
 import "./chunk-SCMRM6NL.js";
 import "./chunk-HDYUBRMF.js";
 import "./chunk-7JJFC6CT.js";
-import "./chunk-KE7A76VC.js";
-import "./chunk-ZUFHAHTE.js";
+import "./chunk-5U5ULQX2.js";
+import "./chunk-HKR56VNF.js";
 export {
   auditTool
 };

package/dist/bash.js

@@ -1,13 +1,13 @@
 import {
   bashTool
-} from "./chunk-6H4ERJP7.js";
+} from "./chunk-4KI4HHID.js";
 import "./chunk-BTSFTGIL.js";
 import "./chunk-PVCB7RUZ.js";
 import "./chunk-SCMRM6NL.js";
 import "./chunk-HDYUBRMF.js";
 import "./chunk-7JJFC6CT.js";
-import "./chunk-KE7A76VC.js";
-import "./chunk-ZUFHAHTE.js";
+import "./chunk-5U5ULQX2.js";
+import "./chunk-HKR56VNF.js";
 export {
   bashTool
 };

package/dist/browser/index.d.ts

@@ -2,6 +2,6 @@ export { BrowserArtifactStore } from './artifacts.js';
 export { type BrowserLauncher, BrowserSessionManager, browserInstallationDiagnostics, } from './manager.js';
 export { BrowserNetworkGuardProxy } from './network-guard-proxy.js';
 export { assertBrowserUrlAllowed, type BrowserDnsLookup, type BrowserResolvedTarget, parsePrivateOriginAllowlist, redactBrowserText, resolvePinnedBrowserTarget, safeBrowserUrl, } from './security.js';
-export { browserClickTool, browserCloseTool, browserDragTool, browserEvaluateTool, browserHoverTool, browserListTool, browserNavigateTool, browserOpenTool, browserPressTool, browserScreenshotTool, browserSelectTool, browserSnapshotTool, browserStatusTool, browserTools, browserTypeTool, browserUploadTool, browserWaitTool, shutdownBrowserTools, type BrowserCloseInput, type BrowserDragInput, type BrowserEvaluateInput, type BrowserNavigateInput, type BrowserOpenInput, type BrowserPressInput, type BrowserScreenshotInput, type BrowserSelectInput, type BrowserSelectorInput, type BrowserSnapshotInput, type BrowserTypeInput, type BrowserUploadInput, type BrowserWaitInput, } from './tools.js';
+export { browserClickTool, browserCloseTool, browserDragTool, browserEvaluateTool, browserHoverTool, browserListTool, browserNavigateTool, browserOpenTool, browserPressTool, browserScreenshotTool, browserSelectTool, browserSnapshotTool, browserStatusTool, browserTools, BROWSER_TOOL_NAMES, enableBrowserSuite, disableBrowserSuite, isBrowserSuiteEnabled, browserTypeTool, browserUploadTool, browserWaitTool, shutdownBrowserTools, type BrowserCloseInput, type BrowserDragInput, type BrowserEvaluateInput, type BrowserNavigateInput, type BrowserOpenInput, type BrowserPressInput, type BrowserScreenshotInput, type BrowserSelectInput, type BrowserSelectorInput, type BrowserSnapshotInput, type BrowserTypeInput, type BrowserUploadInput, type BrowserWaitInput, } from './tools.js';
 export type { BrowserArtifact, BrowserArtifactKind, BrowserConsoleEntry, BrowserManagerOptions, BrowserNetworkEntry, BrowserOpenOptions, BrowserSessionSummary, BrowserSnapshot, } from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/browser/index.js

@@ -1,5 +1,6 @@
 import "../chunk-Z6DAKQ3U.js";
 import {
+  BROWSER_TOOL_NAMES,
   BrowserArtifactStore,
   BrowserNetworkGuardProxy,
   BrowserSessionManager,
@@ -22,13 +23,17 @@ import {
   browserTypeTool,
   browserUploadTool,
   browserWaitTool,
+  disableBrowserSuite,
+  enableBrowserSuite,
+  isBrowserSuiteEnabled,
   parsePrivateOriginAllowlist,
   redactBrowserText,
   resolvePinnedBrowserTarget,
   safeBrowserUrl,
   shutdownBrowserTools
-} from "../chunk-SOR7OCYP.js";
+} from "../chunk-6XYFYLN7.js";
 export {
+  BROWSER_TOOL_NAMES,
   BrowserArtifactStore,
   BrowserNetworkGuardProxy,
   BrowserSessionManager,
@@ -51,6 +56,9 @@ export {
   browserTypeTool,
   browserUploadTool,
   browserWaitTool,
+  disableBrowserSuite,
+  enableBrowserSuite,
+  isBrowserSuiteEnabled,
   parsePrivateOriginAllowlist,
   redactBrowserText,
   resolvePinnedBrowserTarget,

package/dist/browser/tools.d.ts

@@ -84,5 +84,19 @@ export declare const browserEvaluateTool: Tool<BrowserEvaluateInput>;
 export declare const browserUploadTool: Tool<BrowserUploadInput>;
 export declare const browserCloseTool: Tool<BrowserCloseInput>;
 export declare const browserTools: Tool[];
+export declare const BROWSER_TOOL_NAMES: readonly string[];
+/** Bulk enable all browser automation tools in a ToolRegistry. */
+export declare function enableBrowserSuite(registry: {
+    enable(name: string): boolean;
+}): number;
+/** Bulk disable all browser automation tools in a ToolRegistry so they do not enter context. */
+export declare function disableBrowserSuite(registry: {
+    disable(name: string, reason?: any): boolean;
+}): number;
+/** Check whether all browser tools are currently enabled in the registry. */
+export declare function isBrowserSuiteEnabled(registry: {
+    isDisabled(name: string): boolean;
+    get(name: string): unknown;
+}): boolean;
 export declare function shutdownBrowserTools(): Promise<void>;
 //# sourceMappingURL=tools.d.ts.map

package/dist/builtin.d.ts

@@ -15,8 +15,10 @@ export declare const BUILTIN_TOOL_DESCRIPTIONS: Readonly<Record<string, string>>
  *
  * These tools are useful but not critical for core development flow:
  * package management (install/audit/outdated run once per session at most),
- * meta-tools (toolSearch/toolUse/batchToolUse/toolHelp duplicate built-in
- * model capabilities), scaffolding, logging, and auto-documentation.
+ * browser automation, the E2E planner, and log tailing. The `tool_search` /
+ * `tool_use` gateway is deliberately NOT here — it is what makes everything
+ * omitted below tier `off` reachable, so withholding it would strand the
+ * tools this list exists to withhold.
  */
 export declare const OPTIONAL_TOOLS: Tool[];
 /**
@@ -27,12 +29,12 @@ export declare const OPTIONAL_TOOLS: Tool[];
 export declare const OFF_ONLY_TOOLS: Tool[];
 /**
  * Tier 1 (Token Saving) tool set — the absolute minimum for useful work.
- * 23 tools covering core file ops, indexed project discovery, structured
- * edits, shell, search, and utilities. Codebase index lifecycle tools stay
- * available at every tier so token saving does not force broad filesystem
- * scans. Saves ~3500-5500 tokens vs full mode by omitting specialized
- * schemas from direct provider exposure; hosts may retain those tools in a
- * lazy catalog.
+ * 26 tools covering core file ops, indexed project discovery, structured
+ * edits, shell, search, utilities, and the lazy-catalog gateway. Codebase
+ * index lifecycle tools stay available at every tier so token saving does not
+ * force broad filesystem scans. Saves ~3500-5500 tokens vs full mode by
+ * omitting specialized schemas from direct provider exposure; the withheld
+ * tools stay executable and are reachable through the gateway pair.
  *
  * Tier 1 tools:
  *   read, write, edit, clarify                 — file operations
@@ -42,6 +44,7 @@ export declare const OFF_ONLY_TOOLS: Tool[];
  *   bash, grep, glob                           — shell + exact/path fallback
  *   diff, patch, json                          — utility
  *   search                                     — web research
+ *   tool_search, tool_use                      — reach the withheld catalog
  */
 export declare const TIER1_TOOLS: Tool[];
 /**
@@ -56,12 +59,12 @@ export declare const TIER1_TOOLS: Tool[];
 export declare const TIER2_TOOLS: Tool[];
 /**
  * Tier 3 tool set — specialized, administrative, and exploratory tools.
- * Adds 10 tools: outdated, logs, document, scaffold, dead-code-scan,
- * tool-search, tool-use, batch-tool-use, tool-help, set-working-dir.
+ * Adds 3 tools: outdated, logs, dead-code-scan.
  *
- * These tools are situational (e.g. documentation generation, scaffolding,
- * log tailing, dependency audits). Omitting them in standard tier saves
- * tokens while keeping all core capabilities available.
+ * These tools are situational (log tailing, dependency maintenance, dead-code
+ * sweeps). Omitting their schemas below tier `off` saves tokens; they stay
+ * registered and executable, and the model reaches them through `tool_search`
+ * / `tool_use` — which is why that pair lives in TIER1 rather than here.
  */
 export declare const TIER3_TOOLS: Tool[];
 /** The executable catalog always exposes the reviewed description above. */

package/dist/builtin.js

@@ -6,69 +6,65 @@ import {
   TIER2_TOOLS,
   TIER3_TOOLS,
   builtinTools
-} from "./chunk-UCXFTCAI.js";
-import "./chunk-RV7BVTDG.js";
-import "./chunk-HWXIRVKH.js";
+} from "./chunk-T34DVSAE.js";
+import "./chunk-WKXL5XHU.js";
+import "./chunk-OSXM3O3J.js";
 import "./chunk-XRNN44QY.js";
-import "./chunk-5KS24LTS.js";
-import "./chunk-LQSOU63Z.js";
-import "./chunk-24T5XIJU.js";
-import "./chunk-B3MGJBFI.js";
-import "./chunk-VBF2YXUW.js";
-import "./chunk-7ODZTPCU.js";
 import "./chunk-IXIS7RSG.js";
-import "./chunk-QA6IASYX.js";
-import "./chunk-O6BY43ZB.js";
-import "./chunk-WEEVSWQB.js";
-import "./chunk-6GOZTS6F.js";
-import "./chunk-VU3QBYL4.js";
-import "./chunk-CHEK3ASV.js";
-import "./chunk-KLJZ4WV4.js";
-import "./chunk-AQ5YBURX.js";
-import "./chunk-TU5MTW2S.js";
-import "./chunk-VZGPASGD.js";
-import "./chunk-7HL23T3T.js";
-import "./chunk-JDOO4P6Z.js";
-import "./chunk-3D5DJWOE.js";
-import "./chunk-NJX2RXKJ.js";
-import "./chunk-4WPBS45A.js";
-import "./chunk-T3SMFF5Q.js";
-import "./chunk-7N5U2RAU.js";
-import "./chunk-DRRY6SCM.js";
-import "./chunk-DKHMPKDG.js";
-import "./chunk-ASEXQRA7.js";
-import "./chunk-4ERMPDHV.js";
+import "./chunk-NKOTOW6X.js";
+import "./chunk-OZVGRDCM.js";
+import "./chunk-S6E2AM4U.js";
+import "./chunk-ZETZHHV5.js";
+import "./chunk-C64UUXTA.js";
+import "./chunk-YJQQ5F5J.js";
+import "./chunk-2ZWQIVEW.js";
+import "./chunk-YA2ZYCJY.js";
+import "./chunk-B3MGJBFI.js";
+import "./chunk-2IC5FRD7.js";
+import "./chunk-EMCIC2JA.js";
+import "./chunk-MG7CUN6R.js";
+import "./chunk-BU6VUXWG.js";
+import "./chunk-3F7HQ3KS.js";
+import "./chunk-R36RWYXE.js";
+import "./chunk-OBVXDVLE.js";
+import "./chunk-D4HWMWGE.js";
+import "./chunk-JQ43NVFU.js";
+import "./chunk-JK5WXW4S.js";
+import "./chunk-EMA2XENR.js";
+import "./chunk-WWAXJKX3.js";
+import "./chunk-FEXPWYU7.js";
+import "./chunk-2QY3DC3H.js";
 import "./chunk-YJTXRH5Y.js";
 import "./chunk-ZBMANLYH.js";
-import "./chunk-6H4ERJP7.js";
-import "./chunk-MGPR7VG3.js";
+import "./chunk-4KI4HHID.js";
+import "./chunk-YILT3CSO.js";
 import "./chunk-BTSFTGIL.js";
 import "./chunk-PVCB7RUZ.js";
 import "./chunk-SCMRM6NL.js";
 import "./chunk-HDYUBRMF.js";
 import "./chunk-7JJFC6CT.js";
-import "./chunk-MJSJWXBF.js";
+import "./chunk-47GYABZW.js";
 import "./chunk-62OAECEQ.js";
 import "./chunk-NBDZMMG2.js";
-import "./chunk-FBUP524S.js";
-import "./chunk-SMARDKAC.js";
-import "./chunk-X6KXNHUO.js";
-import "./chunk-SOR7OCYP.js";
-import "./chunk-UOYRAS4J.js";
-import "./chunk-KVTEIUND.js";
-import "./chunk-7XUEPBNT.js";
+import "./chunk-TGVQMKVH.js";
+import "./chunk-5UA4TNJJ.js";
+import "./chunk-5BKQVP56.js";
+import "./chunk-6XYFYLN7.js";
+import "./chunk-VSOVZ5JI.js";
+import "./chunk-A636Z2TG.js";
+import "./chunk-KVEL4EFI.js";
 import "./chunk-MSOAX3GC.js";
-import "./chunk-TI5COGLY.js";
-import "./chunk-MBR5VAB5.js";
-import "./chunk-52UXXQMP.js";
-import "./chunk-DL2ARI4S.js";
-import "./chunk-3AU6CZWL.js";
+import "./chunk-PVQBD3TA.js";
+import "./chunk-VQDSIHAR.js";
+import "./chunk-AX5ZG5O5.js";
+import "./chunk-24Q4O34E.js";
+import "./chunk-REWOZIA4.js";
 import "./chunk-6IEBD27U.js";
 import "./chunk-ZKC5UNGD.js";
 import "./chunk-YOHO4DVT.js";
 import "./chunk-2CTZW6JQ.js";
-import "./chunk-KE7A76VC.js";
-import "./chunk-ZUFHAHTE.js";
+import "./chunk-5U5ULQX2.js";
+import "./chunk-HKR56VNF.js";
 export {
   BUILTIN_TOOL_DESCRIPTIONS,
   OFF_ONLY_TOOLS,

package/dist/{chunk-DL2ARI4S.js → chunk-24Q4O34E.js}

@@ -1,6 +1,6 @@
 import {
   resolvePythonBinary
-} from "./chunk-3AU6CZWL.js";
+} from "./chunk-REWOZIA4.js";
 import {
   parseParserBatchOutput,
   recordParserSubprocess,
@@ -8,7 +8,7 @@ import {
 } from "./chunk-ZKC5UNGD.js";
 import {
   resolveWin32Command
-} from "./chunk-KE7A76VC.js";
+} from "./chunk-5U5ULQX2.js";
 
 // src/codebase-index/import-extractor.ts
 var IMPORT_MAX_FILE_CHARS = 512 * 1024;
@@ -830,11 +830,11 @@ async function dispatch(file, content, lang) {
       return parseSymbols({ file, content, lang });
     }
     case "go": {
-      const { parseSymbols } = await import("./go-parser-QIEXU3P2.js");
+      const { parseSymbols } = await import("./go-parser-EMKTAAD3.js");
       return parseSymbols({ file, content, lang: "go" });
     }
     case "py": {
-      const { parseSymbols } = await import("./py-parser-6GJTGUXK.js");
+      const { parseSymbols } = await import("./py-parser-DDG53RXI.js");
       return parseSymbols({ file, content, lang: "py" });
     }
     case "rs": {
@@ -891,4 +891,4 @@ export {
   parseFileContent,
   parseFilesContent
 };
-//# sourceMappingURL=chunk-DL2ARI4S.js.map
+//# sourceMappingURL=chunk-24Q4O34E.js.map

package/dist/{chunk-AQ5YBURX.js → chunk-2IC5FRD7.js}

@@ -1,7 +1,7 @@
 import {
   COMMAND_OUTPUT_MAX_BYTES,
   normalizeCommandOutput
-} from "./chunk-ZUFHAHTE.js";
+} from "./chunk-HKR56VNF.js";
 
 // src/git.ts
 import { spawn } from "node:child_process";
@@ -373,4 +373,4 @@ function runGit(args, cwd, signal) {
 export {
   gitTool
 };
-//# sourceMappingURL=chunk-AQ5YBURX.js.map
+//# sourceMappingURL=chunk-2IC5FRD7.js.map

package/dist/{chunk-4ERMPDHV.js → chunk-2QY3DC3H.js}

@@ -10,8 +10,9 @@ import {
 } from "./chunk-2CTZW6JQ.js";
 import {
   isBinaryBuffer,
+  makeRootRelativizer,
   safeResolveReal
-} from "./chunk-ZUFHAHTE.js";
+} from "./chunk-HKR56VNF.js";
 
 // src/grep.ts
 import { spawn } from "node:child_process";
@@ -34,7 +35,7 @@ var grepTool = {
   name: "grep",
   category: "Search",
   description: "Search exact file contents using a regular expression. Use index-backed `codebase-search` first for symbol or concept discovery when it is live. Prefers ripgrep for speed and features when available.",
-  usageHint: 'EXACT-TEXT AND REGEX SEARCH:\n\n- When `codebase-search` is live, use it first for symbols and concepts; use `grep` for exact text, regexes, unsupported content, and concrete usage sites.\n- `pattern` is a regular expression.\n- Use `output_mode: "content"` (default) to get matching lines with context.\n- Use `"files_with_matches"` when you only need the list of files.\n- Use `"count"` for quick statistics.\n- `glob` and `path` let you narrow the search scope significantly.\n- Always prefer this over `bash grep` when searching code.',
+  usageHint: 'EXACT-TEXT AND REGEX SEARCH:\n\n- When `codebase-search` is live, use it first for symbols and concepts; use `grep` for exact text, regexes, unsupported content, and concrete usage sites.\n- `pattern` is a regular expression.\n- Use `output_mode: "content"` (default) to get matching lines with context.\n- Use `"files_with_matches"` when you only need the list of files.\n- Use `"count"` for quick statistics.\n- `glob` and `path` let you narrow the search scope significantly.\n- Always prefer this over `bash grep` when searching code.\n- Result paths are relative to the project root.',
   selection: {
     doNotUseWhen: "you only need to locate files by name or path pattern.",
     useInstead: ["glob"]
@@ -109,16 +110,17 @@ var grepTool = {
       });
     }
     const signal = opts?.signal ?? ctx.signal ?? new AbortController().signal;
+    const relativize = makeRootRelativizer(ctx.cwd);
     const rgAvailable = await detectRg();
     if (rgAvailable) {
       try {
-        yield* runRgStream(input, base, mode, limit, signal);
+        yield* runRgStream(input, base, mode, limit, signal, relativize);
         return;
       } catch {
       }
     }
     yield { type: "log", text: "Falling back to native grep\u2026" };
-    const out = await runNative(input, base, mode, limit, signal);
+    const out = await runNative(input, base, mode, limit, signal, relativize);
     yield { type: "final", output: out };
   }
 };
@@ -146,7 +148,7 @@ function detectRg() {
   });
   return rgAvailabilityCache;
 }
-async function* runRgStream(input, base, mode, limit, signal) {
+async function* runRgStream(input, base, mode, limit, signal, relativize) {
   if (signal.aborted) {
     yield {
       type: "final",
@@ -281,8 +283,9 @@ async function* runRgStream(input, base, mode, limit, signal) {
         totalLines++;
         if (mode === "count") totalCount += parseRgCountLine(line);
         if (matches.length < limit) {
-          matches.push(line);
-          pendingBatch.push(line);
+          const shortened = relativize(line);
+          matches.push(shortened);
+          pendingBatch.push(shortened);
           batchSinceFlush++;
         }
       }
@@ -302,8 +305,9 @@ async function* runRgStream(input, base, mode, limit, signal) {
         totalLines++;
         if (mode === "count") totalCount += parseRgCountLine(line);
         if (matches.length < limit) {
-          matches.push(line);
-          pendingBatch.push(line);
+          const shortened = relativize(line);
+          matches.push(shortened);
+          pendingBatch.push(shortened);
         }
       }
     }
@@ -349,7 +353,7 @@ function parseRgCountLine(line) {
   const n = Number.parseInt(line.slice(idx + 1), 10);
   return Number.isFinite(n) ? n : 0;
 }
-async function runNative(input, base, mode, limit, signal) {
+async function runNative(input, base, mode, limit, signal, relativize) {
   if (signal.aborted) {
     return {
       matches: [],
@@ -423,9 +427,9 @@ async function runNative(input, base, mode, limit, signal) {
             fileHits++;
             total++;
             if (mode === "content") {
-              if (matches.length < limit) matches.push(`${full}:${lineNumber}:${ln}`);
+              if (matches.length < limit) matches.push(`${relativize(full)}:${lineNumber}:${ln}`);
             } else if (mode === "files_with_matches") {
-              if (fileHits === 1 && matches.length < limit) matches.push(full);
+              if (fileHits === 1 && matches.length < limit) matches.push(relativize(full));
               break;
             }
             if (countOnlyFirstHit || mode === "content" && matches.length >= limit) {
@@ -443,16 +447,16 @@ async function runNative(input, base, mode, limit, signal) {
             fileHits++;
             total++;
             if (mode === "content") {
-              if (matches.length < limit) matches.push(`${full}:${lineNumber}:${ln}`);
+              if (matches.length < limit) matches.push(`${relativize(full)}:${lineNumber}:${ln}`);
             } else if (mode === "files_with_matches") {
-              if (matches.length < limit) matches.push(full);
+              if (matches.length < limit) matches.push(relativize(full));
             }
           }
         }
         if (fileHits > 0) {
           if (mode === "count") {
             if (matches.length < limit) {
-              matches.push(`${full}:${fileHits}`);
+              matches.push(`${relativize(full)}:${fileHits}`);
             } else {
               countTruncated = true;
             }
@@ -522,4 +526,4 @@ export {
   __resetRgDetectionForTests,
   __setRgAvailableForTests
 };
-//# sourceMappingURL=chunk-4ERMPDHV.js.map
+//# sourceMappingURL=chunk-2QY3DC3H.js.map

package/dist/{chunk-VU3QBYL4.js → chunk-2ZWQIVEW.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-YJTXRH5Y.js";
 import {
   safeResolveReal
-} from "./chunk-ZUFHAHTE.js";
+} from "./chunk-HKR56VNF.js";
 
 // src/logs.ts
 import { spawn } from "node:child_process";
@@ -299,4 +299,4 @@ function parseLine(line) {
 export {
   logsTool
 };
-//# sourceMappingURL=chunk-VU3QBYL4.js.map
+//# sourceMappingURL=chunk-2ZWQIVEW.js.map

package/dist/{chunk-JDOO4P6Z.js → chunk-3F7HQ3KS.js}

@@ -1,6 +1,6 @@
 import {
   safeResolveReal
-} from "./chunk-ZUFHAHTE.js";
+} from "./chunk-HKR56VNF.js";
 
 // src/tree.ts
 import * as fs from "node:fs/promises";
@@ -248,4 +248,4 @@ export {
   MAX_TREE_OUTPUT_BYTES,
   treeTool
 };
-//# sourceMappingURL=chunk-JDOO4P6Z.js.map
+//# sourceMappingURL=chunk-3F7HQ3KS.js.map

package/dist/{chunk-MJSJWXBF.js → chunk-47GYABZW.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-NBDZMMG2.js";
 import {
   truncateMiddle
-} from "./chunk-ZUFHAHTE.js";
+} from "./chunk-HKR56VNF.js";
 
 // src/fetch.ts
 import { FetchError, ToolError, ToolValidationError } from "@wrongstack/core/types";
@@ -30,7 +30,19 @@ var fetchTool = {
   category: "Network",
   description: "Fetch a URL and return its content. HTML pages are automatically converted to clean markdown. This tool has strong SSRF protections (private IPs, localhost, and cloud metadata endpoints are blocked by default).",
   usageHint: "Use this when you need external information (documentation, API responses, web pages, etc.).\n\nSecurity notes:\n- Only HTTPS is allowed by default.\n- Internal/private networks are blocked unless explicitly enabled via environment variable.\n- Redirects are followed but re-validated at each hop.\n- Output is capped (128KB by default) to avoid flooding context.\nPrefer this over raw `bash curl` or `bash wget`.",
-  permission: "auto",
+  // H-9 (AT-02): `fetch` was `permission:'auto'` with `mutating:false`, so
+  // the `tool.permission === 'auto' && !isMutating` branch at
+  // `permission-policy.ts:408-424` returned `{permission:'auto'}` for
+  // every call, in every mode (YOLO or not) — a complete, prompt-free
+  // exfiltration primitive when chained with the equally-unprompted
+  // `read` of `.env`/`~/.ssh/*` (sensitive-read gate is `!effectiveYolo`
+  // and therefore also skipped under the shipped default). Promoting to
+  // `permission:'confirm'` is the narrowest change that closes the
+  // exfiltration path: it prompts the user, and an "always" answer is
+  // persisted to `trust.json` against the URL subject declared below.
+  // The SSRF guard (`guardedFetch`) still constrains where the request
+  // can land; this change just ensures the *whether* is no longer silent.
+  permission: "confirm",
   mutating: false,
   capabilities: ["net.outbound"],
   icon: "web",
@@ -269,4 +281,4 @@ function prettyJson(s) {
 export {
   fetchTool
 };
-//# sourceMappingURL=chunk-MJSJWXBF.js.map
+//# sourceMappingURL=chunk-47GYABZW.js.map

package/dist/{chunk-6H4ERJP7.js → chunk-4KI4HHID.js}

@@ -14,10 +14,10 @@ import {
 } from "./chunk-HDYUBRMF.js";
 import {
   resolvePowerShell
-} from "./chunk-KE7A76VC.js";
+} from "./chunk-5U5ULQX2.js";
 import {
   normalizeCommandOutput
-} from "./chunk-ZUFHAHTE.js";
+} from "./chunk-HKR56VNF.js";
 
 // src/bash.ts
 import { spawn } from "node:child_process";
@@ -1093,4 +1093,4 @@ export {
   checkAndBlockKillCommand,
   bashTool
 };
-//# sourceMappingURL=chunk-6H4ERJP7.js.map
+//# sourceMappingURL=chunk-4KI4HHID.js.map