jorgex-stack 1.9.54 → 1.9.56

package/dist/cli.d.ts

@@ -27,6 +27,7 @@ interface Flags {
     removePlaywright: boolean;
     devtools: boolean;
     noDevtools: boolean;
+    upgradePermissions: boolean;
     receipt?: string;
     positional: string[];
     unknownFlags: string[];

package/dist/cli.js

@@ -359,6 +359,7 @@ function findTomlSection(lines, section) {
 }
 function upsertTomlSection(existing, section, body) {
   const header = `[${section}]`;
+  const target = headerName(header) ?? section;
   const block = `${header}
 ${body.trim()}
 `;
@@ -372,7 +373,7 @@ ${body.trim()}
     offset += rawLines[index].length;
     if (index < rawLines.length - 1) offset++;
   }
-  const found = findTomlSection(lines, section);
+  const found = findTomlSection(lines, target);
   if (found === null) {
     const sep = existing.endsWith("\n") ? "\n" : "\n\n";
     return existing + sep + block;
@@ -1203,11 +1204,22 @@ ${gitReadCommands.map((command) => `- \`${command}\``).join("\n")}
         }
       }
       const defaults = loadCanonicalDefaults(ctx.stackDir)["opencode"];
-      if (isFreshConfig && defaults?.["permission"] !== void 0) {
-        root["permission"] = defaults["permission"];
-        ctx.warnings.push(
-          "OpenCode: fresh config allows ordinary reads, edits, web access and Bash; sensitive operations ask, while protected paths and obvious destruction are denied. Native matching is not a universal filesystem sandbox."
-        );
+      const canonicalPermission = defaults?.["permission"];
+      if (isFreshConfig) {
+        if (canonicalPermission !== void 0) {
+          root["permission"] = canonicalPermission;
+          ctx.warnings.push(
+            "OpenCode: fresh config allows ordinary reads, edits, web access and Bash; sensitive operations ask, while protected paths and obvious destruction are denied. Native matching is not a universal filesystem sandbox."
+          );
+        }
+      } else if (canonicalPermission !== void 0 && !isDeepStrictEqual(root["permission"], canonicalPermission)) {
+        if (ctx.upgradePermissions === true) {
+          root["permission"] = canonicalPermission;
+        } else {
+          ctx.warnings.push(
+            "OpenCode: permission block differs from the stack default and was left untouched; re-run with --upgrade-permissions to replace it (a backup is created first), or edit it by hand. Overwriting discards your own permission changes, including any extra hardenings."
+          );
+        }
       }
       const mcp = root["mcp"] ??= {};
       for (const [name, server] of Object.entries(canonical.servers)) {
@@ -1568,12 +1580,26 @@ ${agent.body}`,
     const settingsFile = path10.join(ctx.configDir, "settings.json");
     let content = upsertNativeHooks(contentSource, canonical, scriptsDir);
     const defaults = loadCanonicalDefaults(ctx.stackDir)["claude-code"];
-    if (contentSource === null && defaults?.["permissions"] !== void 0) {
+    const canonicalPermissions = defaults?.["permissions"];
+    if (contentSource === null) {
+      if (canonicalPermissions !== void 0) {
+        content = upsertJson(content, (root) => {
+          if (root["permissions"] === void 0) {
+            root["permissions"] = canonicalPermissions;
+            ctx.warnings.push(
+              "Claude Code: fresh config enables read-anywhere via Read/Grep/Glob allow rules; shell, writes and web egress remain approval-gated, but broad local reads can expose secrets not covered by deny rules."
+            );
+          }
+        });
+      }
+    } else if (canonicalPermissions !== void 0) {
       content = upsertJson(content, (root) => {
-        if (root["permissions"] === void 0) {
-          root["permissions"] = defaults["permissions"];
+        if (isDeepStrictEqual2(root["permissions"], canonicalPermissions)) return;
+        if (ctx.upgradePermissions === true) {
+          root["permissions"] = canonicalPermissions;
+        } else {
           ctx.warnings.push(
-            "Claude Code: fresh config enables read-anywhere via Read/Grep/Glob allow rules; shell, writes and web egress remain approval-gated, but broad local reads can expose secrets not covered by deny rules."
+            "Claude Code: permissions block differs from the stack default and was left untouched; re-run with --upgrade-permissions to replace it (a backup is created first), or edit it by hand. Overwriting discards your own permission changes, including any extra hardenings."
           );
         }
       });
@@ -1867,6 +1893,61 @@ var CODEX_PERMISSION_SECTIONS = [
 function renderCodexPermissionEntries(entries, quoteKeys) {
   return entries.map(([key, value]) => `${quoteKeys ? JSON.stringify(key) : key} = ${JSON.stringify(value)}`).join("\n");
 }
+var CODEX_STALE_PERMISSIONS_WARNING = "Codex: permission profile differs from the stack default and was left untouched; re-run with --upgrade-permissions to replace it (a backup is created first), or edit it by hand. Overwriting discards your own permission changes, including any extra hardenings.";
+function codexNormalizedHeader(header) {
+  return headerName(`[${header}]`) ?? header;
+}
+function readCodexRootValue(config, key) {
+  const lines = config.replace(/\r\n/g, "\n").split("\n");
+  const mask = multilineStringMask(lines);
+  const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const keyPattern = new RegExp(`^\\s*(?:${escaped}|"${escaped}"|'${escaped}')\\s*=`);
+  for (const [index, line] of lines.entries()) {
+    if (mask[index]) continue;
+    if (line.trim().startsWith("[")) break;
+    if (!keyPattern.test(line)) continue;
+    const match = CODEX_ASSIGNMENT.exec(line.trim());
+    return match === null ? void 0 : parseTomlString(match[2]);
+  }
+  return void 0;
+}
+function setCodexRootKey(config, key, value) {
+  const eol = config.includes("\r\n") ? "\r\n" : "\n";
+  const lines = config.replace(/\r\n/g, "\n").split("\n");
+  const mask = multilineStringMask(lines);
+  const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const keyPattern = new RegExp(`^\\s*(?:${escaped}|"${escaped}"|'${escaped}')\\s*=`);
+  const assignment = new RegExp(
+    `^(\\s*(?:${escaped}|"${escaped}"|'${escaped}')\\s*=\\s*)(${CODEX_JSON_STRING_ARRAY}|${CODEX_JSON_VALUE})(\\s*(?:#.*)?)$`
+  );
+  for (const [index, line] of lines.entries()) {
+    if (mask[index]) continue;
+    if (line.trim().startsWith("[")) break;
+    if (!keyPattern.test(line)) continue;
+    const match = assignment.exec(line);
+    lines[index] = match === null ? `${key} = ${value}` : `${match[1]}${value}${match[3]}`;
+    return lines.join(eol);
+  }
+  return upsertTomlRootKeyIfMissing(config, key, value);
+}
+function isCodexPermissionBlockCurrent(config, defaults) {
+  const expectedApproval = defaults["approval_policy"];
+  const expectedDefault = defaults["default_permissions"];
+  if (typeof expectedApproval !== "string" || typeof expectedDefault !== "string") return true;
+  if (readCodexRootValue(config, "approval_policy") !== expectedApproval) return false;
+  if (readCodexRootValue(config, "default_permissions") !== expectedDefault) return false;
+  return CODEX_PERMISSION_SECTIONS.every(
+    ({ header, entries, quoteKeys }) => (readTomlSection(config, codexNormalizedHeader(header)) ?? "").trim() === renderCodexPermissionEntries(entries, quoteKeys).trim()
+  );
+}
+function reseedCodexPermissionBlock(config, defaults) {
+  let out = setCodexRootKey(config, "approval_policy", tomlString(String(defaults["approval_policy"])));
+  out = setCodexRootKey(out, "default_permissions", tomlString(String(defaults["default_permissions"])));
+  for (const { header, entries, quoteKeys } of CODEX_PERMISSION_SECTIONS) {
+    out = upsertTomlSection(out, header, renderCodexPermissionEntries(entries, quoteKeys));
+  }
+  return out;
+}
 function parseCodexKey(raw) {
   if (!raw.startsWith('"')) return raw;
   try {
@@ -2100,6 +2181,16 @@ ${body}`
         ""
       ].join("\n");
     }
+    if (contentSource !== null) {
+      const codexDefaults = loadCanonicalDefaults(ctx.stackDir)["codex"];
+      if (codexDefaults !== void 0 && !isCodexPermissionBlockCurrent(contentSource, codexDefaults)) {
+        if (ctx.upgradePermissions === true) {
+          content = reseedCodexPermissionBlock(content, codexDefaults);
+        } else {
+          ctx.warnings.push(CODEX_STALE_PERMISSIONS_WARNING);
+        }
+      }
+    }
     if (!hasTomlRootKey(content, PRIMARY_MODEL_FIELD2)) {
       content = upsertTomlRootKeyIfMissing(content, PRIMARY_MODEL_FIELD2, PRIMARY_MODEL2);
       if (ctx.ownedPrimaryModelFields?.has(PRIMARY_MODEL_FIELD2) !== true) {
@@ -3229,6 +3320,7 @@ async function runInstall(opts) {
       engramBin,
       models,
       warnings: [],
+      upgradePermissions: opts.upgradePermissions === true,
       enabledMcpServers: enabledMcpServers(id, opts.devtoolsMcpSelection?.[id], useManifest),
       playwrightCliEnabled: projectPlaywrightPrompt ? opts.playwrightToolConsent?.runtimeSelection?.[id] ?? true : useManifest && loadPlaywrightCliPreference(playwrightCliPreferenceFile(), id) === true && (plannedPlaywright ?? true),
       ownedMcpServers: ownedMcpServers(id, useManifest),
@@ -3483,6 +3575,10 @@ var REQUIRED_CAPABILITIES = /* @__PURE__ */ new Set([
   "runner-json-v1",
   "managed-primary-model-v1"
 ]);
+var PERMISSIONS_UPGRADE_CAPABILITY = "permissions-upgrade-v1";
+function supportsPermissionsUpgrade(capabilities) {
+  return Array.isArray(capabilities) && capabilities.includes(PERMISSIONS_UPGRADE_CAPABILITY);
+}
 var ALLOWED_EXTERNAL_WRITES = /* @__PURE__ */ new Set([
   "settings.json",
   "models.json",
@@ -3506,6 +3602,7 @@ function managedExternalWritesAreSafe(writes, capabilities) {
   const permissions = capabilities.includes("permissions-policy-v1");
   const experience = capabilities.includes("experience-defaults-v1");
   if (experience && !permissions) return false;
+  if (supportsPermissionsUpgrade(capabilities) && !permissions) return false;
   const allowed = experience ? EXPERIENCE_EXTERNAL_WRITES : permissions ? PERMISSIONS_EXTERNAL_WRITES : ALLOWED_EXTERNAL_WRITES;
   if (writes.length !== allowed.size) return false;
   const seen = /* @__PURE__ */ new Set();
@@ -3728,6 +3825,43 @@ function runPackageCommand(input, deps, command) {
   if (result.exitCode !== 0) return { kind: "blocked", reason: "runner-unhealthy" };
   return parseRunnerRecord(result.stdout, result.stderr, command, input.candidate, input.packageRunner) ?? { kind: "blocked", reason: "runner-output" };
 }
+var CONFIG_LOCKED_SIGNAL = "CONFIG_LOCKED";
+var UPGRADE_LOCK_RETRIES = 2;
+function stdoutHasConfigLockedSignal(stdout) {
+  const body = stdout.endsWith("\n") ? stdout.slice(0, -1) : stdout;
+  if (body === "" || body.includes("\n") || body.includes("\r")) return false;
+  try {
+    const parsed = JSON.parse(body);
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return false;
+    const error = Reflect.get(parsed, "error");
+    if (error === null || typeof error !== "object" || Array.isArray(error)) return false;
+    return Reflect.get(error, "code") === CONFIG_LOCKED_SIGNAL;
+  } catch {
+    return false;
+  }
+}
+function isConfigLockedFailure(result) {
+  if (result.exitCode !== 1) return false;
+  return stdoutHasConfigLockedSignal(result.stdout) || result.stderr.includes(CONFIG_LOCKED_SIGNAL);
+}
+function runUpgradeWithLockRetry(input, deps) {
+  let retries = 0;
+  for (; ; ) {
+    const raw = deps.run({
+      executable: input.packageRunner,
+      args: ["upgrade", "--json"],
+      environment: input.environment
+    });
+    if (raw.exitCode !== 0) {
+      if (isConfigLockedFailure(raw) && retries < UPGRADE_LOCK_RETRIES) {
+        retries += 1;
+        continue;
+      }
+      return { kind: "blocked", reason: "runner-unhealthy" };
+    }
+    return parseRunnerRecord(raw.stdout, raw.stderr, "upgrade", input.candidate, input.packageRunner) ?? { kind: "blocked", reason: "runner-output" };
+  }
+}
 function isBlockedResult(value) {
   return "kind" in value;
 }
@@ -3760,7 +3894,32 @@ function executePiPackageLifecycle(input, deps) {
     if (result === null || typeof result !== "object" || Reflect.get(result, "changed") !== true && Reflect.get(result, "changed") !== false || !Array.isArray(Reflect.get(result, "actions"))) {
       return { kind: "blocked", reason: "runner-unhealthy" };
     }
-    return { kind: "synced", actions: Reflect.get(result, "actions") };
+    const syncActions = Reflect.get(result, "actions");
+    if (input.upgradePermissions !== true || !supportsPermissionsUpgrade(input.candidate.contract.capabilities)) {
+      return { kind: "synced", actions: syncActions };
+    }
+    const upgrade = runUpgradeWithLockRetry(input, deps);
+    if (isBlockedResult(upgrade)) return upgrade;
+    const upgraded = upgrade.result;
+    if (upgraded === null || typeof upgraded !== "object" || Array.isArray(upgraded)) {
+      return { kind: "blocked", reason: "runner-output" };
+    }
+    const changed = Reflect.get(upgraded, "changed");
+    const actions = Reflect.get(upgraded, "actions");
+    if (changed !== true && changed !== false || !Array.isArray(actions)) {
+      return { kind: "blocked", reason: "runner-unhealthy" };
+    }
+    if (typeof Reflect.get(upgraded, "policy") === "string" || typeof Reflect.get(upgraded, "config") === "string") {
+      return { kind: "blocked", reason: "runner-output" };
+    }
+    if (changed === true) {
+      const policySha256 = Reflect.get(upgraded, "policySha256");
+      if (typeof policySha256 !== "string" || !/^[a-f0-9]{64}$/.test(policySha256)) {
+        return { kind: "blocked", reason: "runner-output" };
+      }
+      return { kind: "synced", actions: [...syncActions, ...actions], upgraded: true, policySha256 };
+    }
+    return { kind: "synced", actions: [...syncActions, ...actions], upgraded: false };
   }
   const models = command.result;
   if (models === null || typeof models !== "object" || Reflect.get(models, "mode") !== "inherit-session" || !sameRecord(Reflect.get(models, "tiers"), ["strong", "standard", "cheap"])) {
@@ -4695,6 +4854,37 @@ function readDoctorTextIfExists(file) {
     throw error;
   }
 }
+var STALE_PERMISSIONS_MARKER = "differs from the stack default and was left untouched";
+var UPGRADE_PERMISSIONS_REMEDY = "jorgex-stack sync --upgrade-permissions --dry-run";
+function piAgentDir(targetDir) {
+  return targetDir === void 0 ? process.env.PI_CODING_AGENT_DIR ?? path27.join(HOME, ".pi", "agent") : path27.join(targetDir, "pi-agent");
+}
+function reportPiPermissions(targetDir) {
+  const agentDir = piAgentDir(targetDir);
+  const configFile = path27.join(agentDir, "extensions", "pi-permission-system", "config.json");
+  const receiptFile = path27.join(agentDir, "jorgex-pi", "permissions-lifecycle.v1.json");
+  let config;
+  let receipt;
+  try {
+    config = readDoctorTextIfExists(configFile);
+    receipt = readDoctorTextIfExists(receiptFile);
+  } catch {
+    p3.log.error(`Pi: cannot read permission state in ${agentDir}; check files and permissions.`);
+    return 1;
+  }
+  if (config === null) return 0;
+  try {
+    JSON.parse(config);
+  } catch {
+    p3.log.error(`Pi: permission policy at ${configFile} is not valid JSON and was left untouched; the Pi package doctor reports it as an error.`);
+    return 1;
+  }
+  if (receipt !== null) return 0;
+  p3.log.warn(
+    `Pi: permission policy present without package ownership (${configFile}) and left untouched; Stack never rewrites Pi state \u2014 align it by hand or remove it so a later 'jorgex-stack sync --agents pi' can seed the package default.`
+  );
+  return 1;
+}
 function engramVersion(bin) {
   const out = runDetectedBin(bin, ["--version"], 5e3);
   if (out === null) return null;
@@ -4775,6 +4965,9 @@ async function runDoctor(options = {}) {
     return 1;
   }
   let problems = reportWritingStyle(options, writingStyle, modePreference);
+  if (options.runtimes === void 0 || options.runtimes.includes("pi")) {
+    problems += reportPiPermissions(options.targetDir);
+  }
   if (options.targetDir !== void 0 || options.runtimes !== void 0 && options.runtimes.length > 0 && options.runtimes.every((id) => id === "pi")) {
     p3.outro(problems > 0 ? `Doctor (alcance: estilo): ${problems} problema(s) \u2014 revisa arriba.` : "Doctor (alcance: estilo): todo sano.");
     return problems > 0 ? 1 : 0;
@@ -4867,8 +5060,11 @@ async function runDoctor(options = {}) {
     if (!ctx) continue;
     ctx.writingStyle = writingStyle;
     let pending;
+    let stalePermissions = false;
     try {
-      pending = diffPlan(buildPlan(adapter, ctx)).filter((d) => d.status !== "unchanged").length;
+      const plan = buildPlan(adapter, ctx);
+      pending = diffPlan(plan).filter((d) => d.status !== "unchanged").length;
+      stalePermissions = ctx.warnings.some((warning) => warning.includes(STALE_PERMISSIONS_MARKER));
     } catch (err) {
       p3.log.error(
         `${adapter.name}: configuraci\xF3n incompatible o ilegible en ${detection.configDir} \u2014 ${err instanceof Error ? err.message : err}`
@@ -4876,10 +5072,16 @@ async function runDoctor(options = {}) {
       problems++;
       continue;
     }
+    if (stalePermissions) {
+      p3.log.warn(
+        `${adapter.name}: permission block differs from the stack default and was left untouched; preview the upgrade with '${UPGRADE_PERMISSIONS_REMEDY}'. Overwriting discards your own permission changes, including any extra hardenings.`
+      );
+      problems++;
+    }
     if (pending > 0) {
       p3.log.warn(`${adapter.name}: ${pending} archivos gestionados desactualizados o ausentes \u2192 ejecuta 'sync'.`);
       problems++;
-    } else {
+    } else if (!stalePermissions) {
       p3.log.success(`${adapter.name}: config del stack al d\xEDa (${detection.configDir}).`);
     }
     const prev = manifest.runtimes[adapter.id];
@@ -6212,16 +6414,16 @@ import { createHash as createHash2 } from "crypto";
 var pi_runtime_pin_default = {
   package: {
     name: "jorgex-pi",
-    version: "0.8.25",
-    source: "npm:jorgex-pi@0.8.25"
+    version: "0.8.26",
+    source: "npm:jorgex-pi@0.8.26"
   },
   provenance: {
-    commit: "f8ae7ab58456d542e0cfe98232f20072d59b4966"
+    commit: "7d976c949e7a68d591ac01fb0f92ba83332ba291"
   },
   tarball: {
-    bytes: 89140483,
-    sha256: "5477605d129100f0b793d9055959439af5c4a15497ff5dc44223fe8150e3ac19",
-    sha512: "5d86567237f295bd383e8e52c72d4fa96f20b5f8ed38487e2b72ee83c22acab8f0fe65041ed27be80fb4ffa6f170efd20dbb937b51aab162073b0e958c9ddd2f"
+    bytes: 89140420,
+    sha256: "fadac8c16ae63585db2a3bd7109ab413e24f8df076f2f79fe8e3e2c404bc8324",
+    sha512: "a508b39b6327eef6a371c8835ab957b838779a50e102c54e24c3a205342215a302bf1056b08571d9ea6c4fb79aa93978477c68be39aea4cd3da0e7995c78a6a6"
   }
 };
 
@@ -6246,6 +6448,7 @@ var PI_RUNTIME_CANDIDATE = {
       "engram-runtime-tools-v1",
       "context7-http-v1",
       "permissions-policy-v1",
+      "permissions-upgrade-v1",
       "experience-defaults-v1",
       "chrome-devtools-handoff-v1",
       "playwright-handoff-v1",
@@ -6258,7 +6461,7 @@ var PI_RUNTIME_CANDIDATE = {
     ],
     runner: {
       bin: "jorgex-pi",
-      commands: ["status", "doctor", "models", "sync", "cleanup"],
+      commands: ["status", "doctor", "models", "sync", "upgrade", "cleanup"],
       schemaVersion: 1,
       maxStdoutBytes: 65536
     },
@@ -6589,7 +6792,8 @@ function runPiRuntime(input, deps) {
       plan,
       candidate: PI_RUNTIME_CANDIDATE,
       packageRunner: paths.packageRunner,
-      environment: paths.environment
+      environment: paths.environment,
+      ...input.upgradePermissions === true ? { upgradePermissions: true } : {}
     });
     persistReturnedReceipt(result2, paths, deps);
     return result2;
@@ -6930,8 +7134,11 @@ async function runManagedPiSystem(input) {
     packageOnly,
     writingStyle: suppliedStyle,
     writingStyleMode,
+    upgradePermissions: requestedUpgrade,
     ...runtimeInput
   } = input;
+  const supportsPermissionsUpgrade2 = PI_RUNTIME_CANDIDATE.contract.capabilities.includes("permissions-upgrade-v1");
+  const upgradePermissions = requestedUpgrade === true && supportsPermissionsUpgrade2;
   if (input.operation === "doctor" && packageOnly) {
     const result2 = managedPackageResult(await runPiRuntimeSystem(runtimeInput));
     return result2.kind === "manual-existing" ? manualExistingResult(result2) : result2;
@@ -6970,7 +7177,11 @@ async function runManagedPiSystem(input) {
   const result = await runManagedPiOperation(input.operation, {
     installInitRemedy: input.targetDir === void 0 ? void 0 : INSTALL_INIT_TARGET_REMEDY,
     async runPackage(operation) {
-      return managedPackageResult(await runPiRuntimeSystem({ ...runtimeInput, operation }));
+      return managedPackageResult(await runPiRuntimeSystem({
+        ...runtimeInput,
+        operation,
+        ...upgradePermissions ? { upgradePermissions: true } : {}
+      }));
     },
     runProjection(operation) {
       const result2 = runPiProjectionLifecycleSystem({
@@ -7527,6 +7738,7 @@ function parseFlags(args, allowReceipt = false) {
     removePlaywright: false,
     devtools: false,
     noDevtools: false,
+    upgradePermissions: false,
     receipt: void 0,
     positional: [],
     unknownFlags: []
@@ -7596,6 +7808,7 @@ function parseFlags(args, allowReceipt = false) {
     else if (arg === "--remove-playwright") flags.removePlaywright = true;
     else if (arg === "--devtools") flags.devtools = true;
     else if (arg === "--no-devtools") flags.noDevtools = true;
+    else if (arg === "--upgrade-permissions") flags.upgradePermissions = true;
     else if (arg.startsWith("-")) flags.unknownFlags.push(arg);
     else flags.positional.push(arg);
   }
@@ -7886,7 +8099,16 @@ async function runSelectedPi(options) {
     engramBin,
     ...devtoolsMcpEnabled === void 0 ? {} : { devtoolsMcpEnabled },
     ...playwrightCliEnabled === void 0 ? {} : { playwrightCliEnabled },
-    ...playwrightCapability === void 0 ? {} : { playwrightCapability }
+    ...playwrightCapability === void 0 ? {} : { playwrightCapability },
+    ...(() => {
+      if (options.upgradePermissions !== true) return {};
+      const supports = PI_RUNTIME_CANDIDATE.contract.capabilities.includes("permissions-upgrade-v1");
+      if (!supports) {
+        p6.log.info("Pi: --upgrade-permissions requiere un paquete con permissions-upgrade-v1; se contin\xFAa en modo seed-only.");
+        return {};
+      }
+      return { upgradePermissions: true };
+    })()
   });
   if (result.kind === "blocked") {
     const paths = "paths" in result ? `: ${result.paths.join(", ")}` : "";
@@ -7929,6 +8151,7 @@ Opciones:
   --engram              (install) autoriza instalar el binario Engram si falta
   --devtools            (install/sync) activa Chrome DevTools MCP para los runtimes destino (opt-in)
   --no-devtools         (install/sync) desactiva Chrome DevTools MCP (incompatible con --devtools)
+  --upgrade-permissions (install/sync) re-aplica permisos gestionados sobre config existente (opt-in)
   --remove-engram       (uninstall) desregistra Engram de los runtimes;
                         memorias y binario quedan intactos igualmente
   --playwright-runtimes <csv>  Activa su gu\xEDa s\xF3lo en estos runtimes de --agents (con --playwright)
@@ -7978,7 +8201,7 @@ Flags disponibles: jorgex-stack --help`
   }
   switch (command) {
     case "quality": {
-      if (flags.targetDir !== void 0 || flags.agents.length > 0 || flags.dryRun || flags.yes || flags.mode !== void 0 || flags.subagentConcurrency !== void 0 || flags.list || flags.check || flags.removeEngram || flags.engram || flags.playwright || flags.removePlaywright || flags.devtools || flags.noDevtools) {
+      if (flags.targetDir !== void 0 || flags.agents.length > 0 || flags.dryRun || flags.yes || flags.mode !== void 0 || flags.subagentConcurrency !== void 0 || flags.list || flags.check || flags.removeEngram || flags.engram || flags.playwright || flags.removePlaywright || flags.devtools || flags.noDevtools || flags.upgradePermissions) {
         console.error("quality solo admite <plan.json> y, opcionalmente, --receipt <path>.");
         process.exitCode = 1;
         return;
@@ -8081,6 +8304,7 @@ Flags disponibles: jorgex-stack --help`
             playwrightToolConsent,
             devtoolsMcpSelection,
             engramBin,
+            upgradePermissions: flags.upgradePermissions,
             ...playwrightCapability === void 0 ? {} : { playwrightCapability },
             ...playwrightToolPlan.actions.length === 0 ? {} : { onPlaywrightCapability: capturePlaywrightCapability },
             showSummary: false
@@ -8119,7 +8343,8 @@ Flags disponibles: jorgex-stack --help`
               writingStyle,
               modePreference: mode,
               playwrightCliEnabled: flags.targetDir === void 0 && exitCode === 0 && playwrightToolPlan.actions.length > 0 ? playwrightToolConsent.runtimeSelection?.pi : void 0,
-              playwrightCapability
+              playwrightCapability,
+              ...flags.upgradePermissions ? { upgradePermissions: true } : {}
             });
             exitCode = Math.max(exitCode, piExitCode);
             piStatus = piExitCode === 0 ? "ok" : "failed";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jorgex-stack",
-  "version": "1.9.54",
+  "version": "1.9.56",
   "description": "Harness multi-agente portable: instala la config JorgeX (agentes, skills, hooks, Engram, MCPs) en Claude Code, Codex CLI, OpenCode y Pi",
   "type": "module",
   "license": "MIT",