vgxness 1.10.0 → 1.10.1

package/dist/cli/commands/setup-dispatcher.js

@@ -121,7 +121,7 @@ export function runSetupBackupCommand(parsed, environment) {
 }
 export async function runSetupApplyCommand(parsed, environment) {
     if (parsed.flags.yes !== true)
-        return usageFailure('setup apply writes provider config and requires --yes');
+        return usageFailure('setup apply writes provider config and requires explicit confirmation with --yes. No provider config was written.');
     const input = setupPlanInputFromFlags(parsed, environment);
     if (!input.ok)
         return resultFailure(input);
@@ -365,7 +365,7 @@ export async function runInitCommandWithSetupTui(parsed, environment, setupTui)
 }
 export async function runSetupTuiCommand(environment, input) {
     if (!canRunInteractiveTui(environment.stdin, environment.stdout))
-        return okText('Setup TUI requires an interactive TTY; no provider config was written. Run `vgxness init --plan` or `vgxness setup plan` for read-only output.\n');
+        return okText('Setup TUI requires an interactive TTY. [read-only] No provider config was written. Run `vgxness init --plan` or `vgxness setup plan` for read-only preview output; apply later with `vgxness setup apply --yes` only after review.\n');
     const selectedDatabasePath = databasePathSelectionFor({}, environment);
     if (!selectedDatabasePath.ok)
         return resultFailure(selectedDatabasePath);

package/dist/cli/doctor-renderer.js

@@ -21,6 +21,6 @@ export function renderDoctorReport(input) {
         if (check.status !== 'pass' && check.remediation !== undefined)
             lines.push(`  Fix: ${check.remediation}`);
     }
-    lines.push('', 'Safety: read-only; provider config was not written.', `Next: ${next}`);
+    lines.push('', 'Safety: [read-only] No provider config was written. This diagnostic does not install or repair provider config.', `Next: ${next}`);
     return `${lines.join('\n')}\n`;
 }

package/dist/cli/setup-plan-renderer.js

@@ -1,6 +1,6 @@
 export function renderSetupPlan(plan) {
     return [
-        'Setup Plan',
+        'Setup Plan [read-only] [preview]',
         `Project: ${plan.project}`,
         `Workspace root: ${plan.workspaceRoot}`,
         `Database: ${plan.db.mode} — ${plan.db.path} (source: ${plan.db.source})`,
@@ -10,7 +10,7 @@ export function renderSetupPlan(plan) {
         ...renderBackups(plan),
         ...renderConflicts(plan),
         ...renderNextCommands(plan),
-        'Safety: read-only plan; provider config was not written. Apply requires --yes.',
+        'Safety: [read-only] preview only. No provider config was written. Explicit confirmation is required before writing provider config; apply with --yes only after review.',
     ].join('\n');
 }
 function renderOpenCode(plan) {

package/dist/cli/setup-status-renderer.js

@@ -1,6 +1,6 @@
 export function renderSetupStatus(status) {
     return [
-        'Setup Status',
+        'Setup Status [read-only]',
         `- Environment: ${status.environment.status} — ${status.environment.summary}`,
         `- Project: ${status.projectState.status} — ${status.projectState.summary}`,
         `- Store: ${status.store.status}${status.store.path === '' ? '' : ` — ${status.store.path}`}${status.store.blocker === undefined ? '' : ` (${status.store.blocker})`}`,
@@ -10,7 +10,7 @@ export function renderSetupStatus(status) {
         `- Verification: ${status.verification.status} — ${status.verification.summary}`,
         `- Next setup action: ${status.nextAction.command} — ${status.nextAction.reason}`,
         `- Provider writes: ${status.safety.writesProviderConfig} · provider execution: ${status.safety.executesProvider}`,
-        'Safety: read-only status; provider config was not written; providers were not executed.',
+        'Safety: [read-only] status only. No provider config was written; providers were not executed. Mutating setup commands require explicit confirmation.',
     ].join('\n');
 }
 export function setupNeedsAction(status) {

package/dist/cli/tui/main-menu/main-menu-read-model.js

@@ -8,7 +8,7 @@ const dashboardHero = {
     badges: [tuiBadges.readOnly, tuiBadges.noProviderWrites],
 };
 const statCards = [
-    { label: 'actions', value: '5', badge: '', description: 'safe routes' },
+    { label: 'routes', value: '5', badge: '', description: 'setup diagnostics preview manual exit' },
     { label: 'provider', value: '1', badge: '', description: 'OpenCode' },
     { label: 'writes', value: '0', badge: '', description: 'dashboard render' },
     { label: 'SDD', value: 'OpenCode', badge: '', description: 'daily surface' },
@@ -19,39 +19,39 @@ const statusSnapshotLines = [
 ];
 const optionCopy = {
     setup: {
-        label: 'Setup OpenCode',
-        description: 'guided install; confirm before writes',
-        badges: [tuiBadges.requiresConfirmation],
-        detailTitle: 'Setup OpenCode',
-        detailLines: ['Guided install opens in review mode; provider writes require final confirmation.'],
+        label: 'Setup / install OpenCode',
+        description: 'guided setup; writes only after final confirmation',
+        badges: ['[confirm required]'],
+        detailTitle: 'Setup / install OpenCode',
+        detailLines: ['Opens the guided setup flow. Provider config writes require final confirmation; review screens stay preview-only.'],
     },
     doctor: {
-        label: 'Doctor / recovery',
-        description: 'health and repair commands',
-        badges: [tuiBadges.previewOnly],
-        detailTitle: 'Doctor / recovery',
-        detailLines: ['Shows status and recovery guidance only; it does not call providers.'],
+        label: 'Diagnostics / doctor',
+        description: 'status and recovery guidance only',
+        badges: ['[read-only]'],
+        detailTitle: 'Diagnostics / doctor',
+        detailLines: ['Shows status and recovery guidance only. This route does not install, repair, or call providers.'],
     },
     sdd: {
-        label: 'SDD workflow',
-        description: 'diagnostics, recovery, fallback',
-        badges: [tuiBadges.previewOnly],
-        detailTitle: 'SDD workflow',
-        detailLines: ['Use OpenCode conversation plus VGXNESS MCP and hidden SDD subagents for daily progression; this TUI stays read-only for setup, diagnostics, recovery, and fallback commands.'],
+        label: 'Provider plan / preview',
+        description: 'read-only setup plan and SDD guidance',
+        badges: ['[preview]', '[read-only]'],
+        detailTitle: 'Provider plan / preview',
+        detailLines: ['Use preview/status commands to inspect provider setup. Daily SDD progression remains in OpenCode with VGXNESS MCP; this menu does not write provider config.'],
     },
     'advanced-cli': {
-        label: 'Advanced CLI',
-        description: 'fallback scripts, no automation',
-        badges: [tuiBadges.manual],
+        label: 'Advanced / manual CLI',
+        description: 'manual fallback commands and scripts',
+        badges: ['[manual]', '[read-only]'],
         detailTitle: 'Advanced CLI',
         detailLines: ['Prints explicit diagnostic, recovery, fallback, and scripting command references; no provider config is written.'],
     },
     exit: {
-        label: 'Quit',
-        description: 'leave cleanly',
-        badges: [tuiBadges.exit, tuiBadges.noProviderWrites],
-        detailTitle: 'Quit',
-        detailLines: ['Close the dashboard; no provider config was written.'],
+        label: 'Exit / cancel',
+        description: 'leave cleanly without writes',
+        badges: ['[manual]', tuiBadges.noProviderWrites],
+        detailTitle: 'Exit / cancel',
+        detailLines: ['Close the dashboard or cancel navigation; no provider config was written.'],
     },
 };
 export function buildMainMenuViewModel(state) {
@@ -62,14 +62,14 @@ export function buildMainMenuViewModel(state) {
         subtitle: dashboardHero.subtitle,
         hero: dashboardHero,
         statCards,
-        contextLines: ['Pick a route. Dashboard render stays passive/read-only; daily SDD continues in OpenCode.'],
+        contextLines: ['Pick a route: setup, diagnostics, provider preview, advanced/manual, or exit. Dashboard render stays passive/read-only.'],
         options,
         detail: { title: focused.detailTitle, lines: focused.detailLines, badges: focused.badges },
         statusSnapshot: { title: 'Signal', lines: statusSnapshotLines, badges: [tuiBadges.readOnly] },
-        safetyLines: ['read-only • no provider writes • explicit confirmation'],
+        safetyLines: ['[read-only] dashboard • [preview] plans • [confirm required] provider writes • [manual] advanced/exit'],
         helpLines: state.helpVisible
-            ? ['Keys: ↑/↓ or j/k move, Enter open, ?/h help, q/Esc quit.', 'Guidance entries print fallback/diagnostic commands only; setup writes still require confirmation.']
+            ? ['Keys: ↑/↓ or j/k move, Enter open, b/back cancel, ?/h help, q/Esc exit.', 'Diagnostics and previews are read-only; setup writes still require final confirmation.']
             : [],
-        footer: state.viewport.mode === 'narrow' ? 'no provider writes • explicit confirmation' : 'j/k • enter • q • no provider writes • explicit confirmation',
+        footer: state.viewport.mode === 'narrow' ? 'enter open • q/Esc exit • [confirm required]' : 'j/k move • enter open • b back • q/Esc exit • no provider writes without confirmation',
     };
 }

package/dist/cli/tui/main-menu/main-menu-render-shape.js

@@ -34,6 +34,10 @@ function clampLine(line, width) {
         'read-only',
         'quit without writes',
         'provider config writes',
+        '[confirm required]',
+        '[read-only]',
+        '[preview]',
+        '[manual]',
     ];
     const phrase = protectedPhrases.find((candidate) => line.includes(candidate));
     if (phrase !== undefined)
@@ -41,6 +45,6 @@ function clampLine(line, width) {
     return `${line.slice(0, Math.max(0, width - 1)).trim()}…`;
 }
 function choiceLine(choice) {
-    const badges = formatBadges(choice.focused === true ? [tuiBadges.focused] : []);
+    const badges = formatBadges([...(choice.focused === true ? [tuiBadges.focused] : []), ...choice.badges]);
     return `${choice.focused === true ? '›' : ' '} ${choice.label}${badges.length === 0 ? '' : ` ${badges}`} — ${choice.description}`;
 }

package/dist/cli/tui/opentui/main-menu/view.js

@@ -3,6 +3,6 @@ export function formatMainMenuOptions(options) {
     return options.map(formatMainMenuOption).join('\n');
 }
 function formatMainMenuOption(option) {
-    const badges = formatBadges(option.focused ? [tuiBadges.focused] : []);
+    const badges = formatBadges([...(option.focused ? [tuiBadges.focused] : []), ...option.badges]);
     return `${option.focused ? '›' : ' '} ${option.label}${badges.length === 0 ? '' : ` ${badges}`} — ${option.description}`;
 }

package/dist/cli/tui/setup/setup-tui-read-model.js

@@ -21,10 +21,10 @@ export function setupTuiViewModelFromPlan(plan, status, state) {
     const warnings = plan?.conflicts.filter((conflict) => conflict.severity === 'warning').map((conflict) => conflict.message) ?? [];
     const backups = plan?.backupsPlanned.map((backup) => `${backup.targetPath} (${backup.reason})`) ?? [];
     const previewLabel = state?.previewRefresh === 'refreshing'
-        ? 'Preview: refreshing plan from current choices [read-only]'
+        ? `Preview: refreshing plan from current choices ${badgeLabels.preview} ${badgeLabels.readOnly} ${badgeLabels.noFilesWritten}`
         : state?.previewRefresh === 'failed'
-            ? 'Preview: refresh failed [warning]'
-            : 'Preview: current choices are reflected in the read-only plan';
+            ? `Preview: refresh failed ${badgeLabels.warning} ${badgeLabels.noFilesWritten}`
+            : `Preview: current choices are reflected in the read-only plan ${badgeLabels.preview} ${badgeLabels.readOnly} ${badgeLabels.noFilesWritten}`;
     return {
         title: 'VGXNESS Setup Assistant',
         projectLabel: project,
@@ -63,15 +63,15 @@ export function setupTuiViewModelFromPlan(plan, status, state) {
         nextCommands: plan?.nextCommands ?? ['vgxness setup plan'],
         canAutoApply: plan?.provider === 'opencode' && plan.status === 'ready' && state?.selections.provider !== 'none' && plan.opencode !== undefined,
         safetyWarning: isOpenCode && (selections?.overwriteVgxness === true || opencode?.overwriteVgxness === true)
-            ? 'Final confirmation is required. Reinstall is enabled: user-global VGXNESS OpenCode entries will be overwritten after a managed backup when the target exists; unrelated config is preserved. Project-local provider files are external/manual diagnostics and will not be modified.'
-            : 'Final confirmation is required before any provider config write. VGXNESS will manage user-global provider configuration. Project-local provider files are external/manual diagnostics and will not be modified.',
+            ? `${badgeLabels.confirmRequired} Final confirmation remains required. Explicit confirmation is required before writing provider config. Reinstall is enabled: user-global VGXNESS OpenCode entries will be overwritten after a managed backup when the target exists; unrelated config is preserved. Project-local provider files are external/manual diagnostics and will not be modified.`
+            : `${badgeLabels.confirmRequired} Final confirmation remains required. Explicit confirmation is required before writing provider config. VGXNESS will manage user-global provider configuration. Project-local provider files are external/manual diagnostics and will not be modified.`,
         frameLabel: 'VGXNESS Setup Assistant workspace',
         progressLabel: progressLabel(state?.screen),
         previewLabel,
         previewDetailLines: previewDetailLines({ plan, provider, databasePath, databaseSource, blockers, warnings, backups, isOpenCode }),
         helpVisible: state?.helpVisible ?? false,
         helpLines: helpLines(state?.screen),
-        footerSafetyLabel: 'Safety: plan review is read-only; final confirmation is the first write-capable screen.',
+        footerSafetyLabel: `Safety: plan review is ${badgeLabels.readOnly} ${badgeLabels.noFilesWritten}; final confirmation is ${badgeLabels.confirmRequired} and is the first write-capable screen.`,
         databaseChoices: [
             choice('database:global', 'Global database', 'Use the OS-level VGXNESS database. Recommended for normal local use.', selections?.databaseMode === 'global' || (selections === undefined && plan?.db.mode === 'global'), state?.focusedChoiceId, [badgeLabels.recommended]),
             choice('database:project-local', 'Project-local database', 'Preview a workspace-scoped database path. No file is created here.', selections?.databaseMode === 'project-local' || (selections === undefined && plan?.db.mode === 'project-local'), state?.focusedChoiceId, [badgeLabels.readOnly]),
@@ -114,7 +114,7 @@ function previewDetailLines(input) {
         `Provider installability: ${input.isOpenCode ? 'OpenCode installable after final confirmation. VGXNESS will manage user-global provider configuration. Claude first-class support requires guarded mcp install claude --yes --run-id <id>. Project-local provider files are external/manual diagnostics and will not be modified.' : 'No guided provider install from this selection; Claude uses guarded explicit user-global apply.'}`,
         `Agent readiness: ${agentReadinessFromPlan(plan)}`,
         `Target config: ${input.isOpenCode && opencode?.targetPath !== undefined ? compactPath(opencode.targetPath, 72) : 'none; no provider config will be written'}`,
-        `Safety: ${input.isOpenCode ? '[will write after confirm] only on final confirmation' : '[read-only] manual/no-provider-write mode'}`,
+        `Safety: ${input.isOpenCode ? `${badgeLabels.confirmRequired} only on final confirmation; ${badgeLabels.noFilesWritten} during preview` : `${badgeLabels.readOnly} ${badgeLabels.noFilesWritten} manual/no-provider-write mode`}`,
         ...actions,
         input.backups.length === 0 ? 'Backups: none planned' : `Backups: ${input.backups.join('; ')}`,
         ...(input.warnings.length === 0 ? ['Warnings: none'] : input.warnings.map((warning) => `Warning: ${warning}`)),
@@ -201,7 +201,7 @@ function readinessBadge(status) {
     if (status === 'manual-required')
         return badgeLabels.warning;
     if (status === 'conflict' || status === 'blocked')
-        return badgeLabels.error;
+        return badgeLabels.blocked;
     return badgeLabels.warning;
 }
 function opencodeActionLabel(action) {

package/dist/cli/tui/setup/setup-tui-render-shape.js

@@ -12,8 +12,8 @@ function screenLines(input, width) {
                 'Guided installation sequence',
                 'Setup welcome: global memory → provider → OpenCode details → agent readiness → preview → final confirmation → doctor/restart.',
                 'VGXNESS Setup Assistant',
-                'Configure local storage and OpenCode integration with read-only previews first.',
-                'No provider config is written until the final confirmation.',
+                `Configure local storage and OpenCode integration with read-only previews first ${badgeLabels.readOnly} ${badgeLabels.preview}.`,
+                `No provider config is written until the final confirmation ${badgeLabels.noFilesWritten}.`,
             ], width, [setupFooterHints.continue, setupFooterHints.help, setupFooterHints.cancel]);
         case 'project-database':
             return workspaceLines(vm, [
@@ -32,12 +32,12 @@ function screenLines(input, width) {
                 'Provider selection',
                 ...choiceLines(vm.providerChoices),
                 vm.providerInstallabilityLabel,
-                'OpenCode setup remains gated by final confirmation. Manual / none has no automatic install and no provider config will be written.',
+                `OpenCode setup remains gated by final confirmation ${badgeLabels.confirmRequired}. Manual / none has no automatic install and no provider config will be written.`,
             ], width, choiceFooter());
         case 'opencode-details':
             return workspaceLines(vm, vm.providerLabel === 'OpenCode'
                 ? [
-                    'OpenCode plan ' + badgeLabels.writeAfterConfirm,
+                    'OpenCode plan ' + badgeLabels.confirmRequired,
                     ...choiceLines(vm.scopeChoices),
                     ...choiceLines(vm.installModeChoices),
                     ...choiceLines(vm.overwriteChoices),
@@ -47,7 +47,7 @@ function screenLines(input, width) {
                     `Action: ${vm.opencodeActionLabel}`,
                     `Agent readiness: ${vm.agentReadinessLabel}`,
                     vm.agentReadinessDetail,
-                    'Details are preview-only here; writes require final confirmation.',
+                    `Details are preview-only here ${badgeLabels.preview} ${badgeLabels.noFilesWritten}; writes require final confirmation.`,
                 ]
                 : [
                     'Manual / no-provider-write mode ' + badgeLabels.manual,
@@ -57,19 +57,22 @@ function screenLines(input, width) {
                 ], width, vm.providerLabel === 'OpenCode' ? choiceFooter() : [setupFooterHints.continue, setupFooterHints.back, setupFooterHints.cancel]);
         case 'plan-review':
             return workspaceLines(vm, [
-                'Read-only plan review',
-                'Plan summary ' + badgeLabels.readOnly,
+                `Read-only plan review ${badgeLabels.preview}`,
+                `Plan summary ${badgeLabels.readOnly} ${badgeLabels.noFilesWritten}`,
+                'Plan generated. No files were written.',
                 ...planLines(vm, width),
                 ...nextCommandLines(vm),
-                'Review only: this screen does not write provider config.',
+                `Review only: this screen does not write provider config ${badgeLabels.noFilesWritten}.`,
                 vm.canAutoApply ? 'Press Enter to continue to final confirmation.' : 'Press Enter to show manual next steps; no automatic apply is available.',
             ], width, vm.canAutoApply ? [setupFooterHints.finalConfirmation, setupFooterHints.back, setupFooterHints.cancel] : [setupFooterHints.continue, setupFooterHints.back, setupFooterHints.cancel]);
         case 'final-confirmation':
             return workspaceLines(vm, [
                 'Final confirmation',
-                badgeLabels.warning,
+                `${badgeLabels.warning} ${badgeLabels.confirmRequired}`,
                 'Confirm OpenCode setup',
                 ...planLines(vm, width),
+                'Explicit confirmation is required before writing provider config.',
+                'This is the first write-capable screen; earlier wizard steps were preview/read-only only.',
                 'WARNING: OpenCode provider config may be modified at the target path above. Existing config is backed up when planned.',
                 vm.safetyWarning,
                 'After confirmation: run doctor, then restart OpenCode to reload MCP configuration.',
@@ -84,12 +87,12 @@ function screenLines(input, width) {
                 'Setup recovery',
                 badgeLabels.error,
                 `Error: ${input.error ?? 'Unknown setup error'}`,
-                'No unconfirmed provider config write was performed.',
+                `No unconfirmed provider config write was performed ${badgeLabels.noFilesWritten}.`,
                 'Next: inspect `vgxness setup plan`, resolve blockers, then retry.',
                 footer([setupFooterHints.close], width),
             ];
         case 'cancelled':
-            return ['Setup cancelled', badgeLabels.cancelled, 'Setup was not completed.', 'No provider config was written.', 'No agent seeding was performed.', footer([setupFooterHints.close], width)];
+            return ['Setup cancelled', `${badgeLabels.cancelled} ${badgeLabels.noFilesWritten}`, 'Cancelled. No changes were applied.', 'No provider config was written.', 'No agent seeding was performed.', footer([setupFooterHints.close], width)];
     }
 }
 function planLines(vm, width) {
@@ -153,7 +156,7 @@ function resultLines(result, vm, width) {
             ...vm.nextCommands.map((command) => `Next: ${command}`),
             footer([setupFooterHints.close], width),
         ];
-    return ['Setup result', 'No provider config write occurred.', footer([setupFooterHints.close], width)];
+    return ['Setup result', `${badgeLabels.noFilesWritten} No provider config write occurred.`, footer([setupFooterHints.close], width)];
 }
 function resultNextCommands(vm) {
     const filtered = vm.nextCommands.filter((command) => !/^vgx(?:ness)? setup apply\b/.test(command));

package/dist/cli/tui/setup/setup-tui-view-helpers.js

@@ -3,10 +3,14 @@ export const badgeLabels = {
     recommended: '[recommended]',
     selected: '[selected]',
     focused: '[focused]',
+    preview: '[preview]',
     warning: '[warning]',
     error: '[error]',
-    writeAfterConfirm: '[will write after confirm]',
+    confirmRequired: '[confirm required]',
+    writeAfterConfirm: '[confirm required]',
+    blocked: '[blocked]',
     readOnly: '[read-only]',
+    noFilesWritten: '[no files written]',
     manual: '[manual]',
     deferred: '[deferred]',
     cancelled: '[cancelled]',
@@ -35,7 +39,19 @@ export function compactPath(path, width) {
 export function wrapLabel(value, width) {
     if (width <= 0 || value.length <= width)
         return value;
-    const protectedPhrases = ['final confirmation', 'confirm and apply', 'not installable', 'read-only', 'requires confirmation', 'will write after confirm', 'error', 'cancelled'];
+    const protectedPhrases = [
+        'final confirmation',
+        'confirm and apply',
+        'not installable',
+        'unrelated config is preserved',
+        'read-only',
+        'confirm required',
+        'no files written',
+        'requires confirmation',
+        'will write after confirm',
+        'error',
+        'cancelled',
+    ];
     const phrase = protectedPhrases.find((candidate) => value.includes(candidate));
     if (phrase !== undefined)
         return `${value.slice(0, Math.max(0, width - phrase.length - 5)).trim()} ... ${phrase}`.trim();

package/dist/mcp/provider-change-plan.js

@@ -100,7 +100,7 @@ function unsupportedProviderEnvelope(input) {
         supported: false,
         status: 'unsupported',
         code: 'UNSUPPORTED_PROVIDER',
-        summary: `${input.provider} is a recognized provider value, but read-only provider change planning currently supports OpenCode and Claude.`,
+        summary: `[read-only] ${input.provider} is a recognized provider value, but provider change planning currently supports OpenCode and Claude. No provider config was written. This diagnostic does not install or repair provider config.`,
         providerIdentity: {
             provider: input.provider,
             adapter: input.provider,
@@ -114,7 +114,7 @@ function unsupportedProviderEnvelope(input) {
         backupRollback: descriptiveBackupPolicy(false),
         confirmations: confirmationPolicy(),
         risks: ['No provider-specific change preview is available for this provider yet.'],
-        warnings: ['Known provider enum value is unsupported by this read-only planner.'],
+        warnings: ['Known provider enum value is unsupported by this read-only planner. No files were written.'],
     };
 }
 function blockedPlanEnvelope(input, status, doctor, message) {
@@ -124,7 +124,7 @@ function blockedPlanEnvelope(input, status, doctor, message) {
         supported: true,
         status: 'blocked',
         code: 'PLAN_UNAVAILABLE',
-        summary: `${providerName} change planning could not resolve the future MCP server command: ${message}`,
+        summary: `[read-only] ${providerName} change planning could not resolve the future MCP server command: ${message}. No provider config was written. This diagnostic does not install or repair provider config.`,
         providerIdentity: {
             provider: input.provider,
             adapter: input.provider,
@@ -143,7 +143,7 @@ function blockedPlanEnvelope(input, status, doctor, message) {
         backupRollback: descriptiveBackupPolicy(false),
         confirmations: confirmationPolicy(),
         risks: ['Future write planning requires a resolvable VGXNESS database path.'],
-        warnings: [message],
+        warnings: [message, 'No files were written.'],
     };
 }
 function opencodeEnvelope(input, status, doctor, installPlan, source) {
@@ -185,7 +185,7 @@ function claudeEnvelope(input, status, doctor, installPlan, source) {
         supported: true,
         status: installPlan.status === 'refused' ? 'blocked' : 'planned',
         ...(installPlan.status === 'refused' ? { code: 'PLAN_UNAVAILABLE' } : {}),
-        summary: installPlan.status === 'refused' ? `Read-only Claude ${input.changeType} planning completed; future install is currently refused: ${installPlan.message}` : 'Read-only Claude planning completed; future confirmed write would update ~/.claude.json, user agents, and ~/.claude/CLAUDE.md as needed. Project/local Claude files are diagnostics only.',
+        summary: installPlan.status === 'refused' ? `[read-only] Claude ${input.changeType} planning completed; future install is currently refused: ${installPlan.message}. No provider config was written. This diagnostic does not install or repair provider config.` : '[read-only] Claude planning completed. No provider config was written. This diagnostic does not install or repair provider config. A future confirmed write would update ~/.claude.json, user agents, and ~/.claude/CLAUDE.md as needed. Project/local Claude files are diagnostics only.',
         providerIdentity: { provider: 'claude', adapter: 'claude', support: 'supported' },
         statusSummary: statusSummary(status),
         statusFindings: status.config,
@@ -307,7 +307,7 @@ function confirmationPolicy() {
         requiredNow: false,
         requiredBeforeFutureWrite: true,
         acceptedMutationInputs: false,
-        message: 'This response is read-only; any future provider config write must be requested and confirmed separately.',
+        message: '[read-only] No provider config was written. Any future provider config write must be requested and confirmed separately.',
     };
 }
 function statusWarnings(status) {
@@ -339,6 +339,6 @@ function risksForClaude(status, doctor, plan, source) {
 }
 function summaryForOpenCode(input, plan) {
     if (plan.status === 'refused')
-        return `Read-only OpenCode ${input.changeType} planning completed; future install is currently refused: ${plan.message}`;
-    return `Read-only OpenCode ${input.changeType} planning completed; future confirmed write would ${plan.action} ${plan.targetPath}.`;
+        return `[read-only] OpenCode ${input.changeType} planning completed; future install is currently refused: ${plan.message}. No provider config was written. This diagnostic does not install or repair provider config.`;
+    return `[read-only] OpenCode ${input.changeType} planning completed. No provider config was written. This diagnostic does not install or repair provider config. A future confirmed write would ${plan.action} ${plan.targetPath}.`;
 }

package/dist/mcp/provider-doctor.js

@@ -174,15 +174,16 @@ function managedUserGlobalClassification(paths) {
     return { managedUserGlobalConfig: [...paths], detectedExternalProjectConfig: [], detectedExternalUserConfig: [] };
 }
 function summarizeDoctor(status, failedCount, recommendationCount) {
+    const suffix = '[read-only] No provider config was written. This diagnostic does not install or repair provider config.';
     if (status === 'healthy')
-        return 'Provider doctor checks passed; no configuration was changed.';
+        return `Provider doctor checks passed. ${suffix}`;
     if (status === 'degraded')
-        return `Provider doctor found warnings and ${recommendationCount} recommendation(s); no configuration was changed.`;
+        return `Provider doctor found warnings and ${recommendationCount} recommendation(s). ${suffix}`;
     if (status === 'failed')
-        return `Provider doctor found ${failedCount} failed check(s); no configuration was changed.`;
+        return `Provider doctor found ${failedCount} failed check(s). ${suffix}`;
     if (status === 'skipped')
-        return 'Provider doctor checks were skipped.';
-    return 'Provider doctor status is unknown; review checks before continuing.';
+        return `Provider doctor checks were skipped. ${suffix}`;
+    return `Provider doctor status is unknown; review checks before continuing. ${suffix}`;
 }
 function compactChecks(checks, mode) {
     if (mode === 'verbose')
@@ -280,7 +281,7 @@ function readonlySafetyCheck(before, after) {
         ? {
             id: 'provider-config-readonly-safety',
             status: 'pass',
-            detail: 'Provider config path existence and mtimes were unchanged; no repair/install/write occurred.',
+            detail: '[read-only] Provider config path existence and mtimes were unchanged. No files were written. This diagnostic does not install or repair provider config.',
         }
         : { id: 'provider-config-readonly-safety', status: 'fail', detail: 'Provider config path existence or mtimes changed during read-only doctor.' };
 }

package/dist/mcp/provider-status.js

@@ -354,22 +354,24 @@ function hasProjectConfigAlongsideUser(paths) {
     return paths.some((path) => path.label.startsWith('user ') && path.exists) && paths.some((path) => !path.label.startsWith('user ') && path.exists);
 }
 function summarizeStatus(status, mcpEntry) {
+    const suffix = '[read-only] No provider config was written. This diagnostic does not install or repair provider config.';
     if (status === 'ready')
-        return 'OpenCode provider config is readable and the vgxness MCP entry is present.';
+        return `OpenCode provider config is readable and the vgxness MCP entry is present. ${suffix}`;
     if (status === 'not-configured')
-        return mcpEntry.detail;
+        return `${mcpEntry.detail} ${suffix}`;
     if (status === 'warning')
-        return 'OpenCode provider config has warnings; no changes were made.';
-    return 'OpenCode provider status check found a blocking issue; no changes were made.';
+        return `OpenCode provider config has warnings. ${suffix}`;
+    return `OpenCode provider status check found a blocking issue. ${suffix}`;
 }
 function summarizeClaudeStatus(status, mcpEntry) {
+    const suffix = '[read-only] No provider config was written. This diagnostic does not install or repair provider config.';
     if (status === 'ready')
-        return 'Claude project .mcp.json and VGXNESS agent files are readable and configured.';
+        return `Claude provider files were inspected and VGXNESS entries are readable. ${suffix}`;
     if (status === 'not-configured')
-        return mcpEntry.detail;
+        return `${mcpEntry.detail} ${suffix}`;
     if (status === 'warning')
-        return 'Claude provider project config has warnings; no changes were made.';
-    return 'Claude provider status check found a blocking issue; no changes were made.';
+        return `Claude provider project config has warnings. ${suffix}`;
+    return `Claude provider status check found a blocking issue. ${suffix}`;
 }
 function nextActionFor(status, mcpEntry, sddNext) {
     if (sddNext !== undefined)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vgxness",
-  "version": "1.10.0",
+  "version": "1.10.1",
   "description": "CLI and MCP control plane for guided AI-agent workflows, SDD, memory, and OpenCode setup.",
   "license": "SEE LICENSE IN LICENSE",
   "repository": {