feat(cli): add --safe-mode flag to disable all customizations for troubleshooting

packages/cli/src/config/config.ts

@@ -132,6 +132,7 @@ export interface CliArgs {
   appendSystemPrompt: string | undefined;
   yolo: boolean | undefined;
   bare: boolean | undefined;
+  safeMode?: boolean | undefined;
   approvalMode: string | undefined;
   telemetry: boolean | undefined;
   telemetryTarget: string | undefined;
@@ -599,6 +600,11 @@ export async function parseArguments(): Promise<CliArgs> {
         'Minimal mode: skip implicit startup auto-discovery and only honor explicitly provided CLI inputs.',
       default: false,
     })
+    .option('safe-mode', {
+      type: 'boolean',
+      description:
+        'Disable all customizations (context files, hooks, extensions, skills, MCP servers) for troubleshooting.',
+    })
     .option('proxy', {
       type: 'string',
       description: 'Proxy for Qwen Code, like schema://user:password@host:port',
@@ -1361,6 +1367,11 @@ export async function loadCliConfig(
 ): Promise<Config> {
   const debugMode = isDebugMode(argv);
   const bareMode = isBareMode(argv.bare);
+  const safeMode =
+    argv.safeMode !== undefined
+      ? argv.safeMode
+      : process.env['QWEN_CODE_SAFE_MODE'] === 'true' ||
+        process.env['QWEN_CODE_SAFE_MODE'] === '1';
 
   // Set runtime output directory from settings (env var QWEN_RUNTIME_DIR
   // is auto-detected inside getRuntimeBaseDir() at each call site).
@@ -1829,18 +1840,20 @@ export async function loadCliConfig(
         currentSettings.setValue(settingScope, key, [...currentRules, rule]);
       }
     },
-    toolDiscoveryCommand: bareMode
-      ? undefined
-      : settings.tools?.discoveryCommand,
-    toolCallCommand: bareMode ? undefined : settings.tools?.callCommand,
-    mcpServerCommand: bareMode ? undefined : settings.mcp?.serverCommand,
-    mcpServers: bareMode
-      ? {}
-      : (() => {
-          const base = settings.mcpServers || {};
-          const cliMcpServers = parseMcpConfig(argv.mcpConfig);
-          return cliMcpServers ? { ...base, ...cliMcpServers } : base;
-        })(),
+    toolDiscoveryCommand:
+      bareMode || safeMode ? undefined : settings.tools?.discoveryCommand,
+    toolCallCommand:
+      bareMode || safeMode ? undefined : settings.tools?.callCommand,
+    mcpServerCommand:
+      bareMode || safeMode ? undefined : settings.mcp?.serverCommand,
+    mcpServers:
+      bareMode || safeMode
+        ? {}
+        : (() => {
+            const base = settings.mcpServers || {};
+            const cliMcpServers = parseMcpConfig(argv.mcpConfig);
+            return cliMcpServers ? { ...base, ...cliMcpServers } : base;
+          })(),
     allowedMcpServers: allowedMcpServers
       ? Array.from(allowedMcpServers)
       : undefined,
@@ -1891,9 +1904,11 @@ export async function loadCliConfig(
     generationConfig: resolvedCliConfig.generationConfig,
     warnings: resolvedCliConfig.warnings,
     bareMode,
-    allowedHttpHookUrls: bareMode
-      ? []
-      : (settings.security?.allowedHttpHookUrls ?? []),
+    safeMode,
+    allowedHttpHookUrls:
+      bareMode || safeMode
+        ? []
+        : (settings.security?.allowedHttpHookUrls ?? []),
     cliVersion: await getCliVersion(),
     ideMode,
     chatCompression: settings.model?.chatCompression,
@@ -1914,24 +1929,28 @@ export async function loadCliConfig(
     output: {
       format: outputSettingsFormat,
     },
-    enableManagedAutoMemory: bareMode
-      ? false
-      : (settings.memory?.enableManagedAutoMemory ?? true),
-    enableManagedAutoDream: bareMode
-      ? false
-      : (settings.memory?.enableManagedAutoDream ?? true),
-    enableAutoSkill: bareMode
-      ? false
-      : (settings.memory?.enableAutoSkill ?? true),
+    enableManagedAutoMemory:
+      bareMode || safeMode
+        ? false
+        : (settings.memory?.enableManagedAutoMemory ?? true),
+    enableManagedAutoDream:
+      bareMode || safeMode
+        ? false
+        : (settings.memory?.enableManagedAutoDream ?? true),
+    enableAutoSkill:
+      bareMode || safeMode ? false : (settings.memory?.enableAutoSkill ?? true),
     fastModel: settings.fastModel || undefined,
     // Use separated hooks if provided, otherwise fall back to merged hooks
-    userHooks: bareMode
-      ? undefined
-      : (hooksConfig?.userHooks ?? settings.hooks),
-    projectHooks: bareMode ? undefined : hooksConfig?.projectHooks,
-    hooks: bareMode ? undefined : settings.hooks, // Keep for backward compatibility
-    disableAllHooks: bareMode ? true : (settings.disableAllHooks ?? false),
-    stopHookBlockingCap: bareMode ? undefined : settings.stopHookBlockingCap,
+    userHooks:
+      bareMode || safeMode
+        ? undefined
+        : (hooksConfig?.userHooks ?? settings.hooks),
+    projectHooks: bareMode || safeMode ? undefined : hooksConfig?.projectHooks,
+    hooks: bareMode || safeMode ? undefined : settings.hooks,
+    disableAllHooks:
+      bareMode || safeMode ? true : (settings.disableAllHooks ?? false),
+    stopHookBlockingCap:
+      bareMode || safeMode ? undefined : settings.stopHookBlockingCap,
     channel: argv.channel,
     // CLI flag wins over settings.json. `--json-fd` is fd-only (no settings
     // equivalent — fd passing is a spawn-time concern). `--json-file` and

packages/cli/src/gemini.test.tsx

@@ -53,6 +53,7 @@ vi.mock('./config/config.js', () => ({
     getQuestion: vi.fn(() => ''),
     isInteractive: () => false,
     getWarnings: vi.fn(() => []),
+    isSafeMode: vi.fn(() => false),
     getModelsConfig: vi.fn(() => ({ getCurrentAuthType: () => null })),
   } as unknown as Config),
   parseArguments: vi.fn().mockResolvedValue({}),
@@ -200,6 +201,7 @@ describe('gemini.tsx main function', () => {
         getProjectRoot: () => '/',
         getOutputFormat: () => OutputFormat.TEXT,
         getWarnings: () => [],
+        isSafeMode: () => false,
         getModelsConfig: () => ({ getCurrentAuthType: () => null }),
         getSessionId: () => 'test-session-id',
       } as unknown as Config;
@@ -326,6 +328,7 @@ describe('gemini.tsx main function', () => {
       getProjectRoot: () => '/',
       getOutputFormat: () => OutputFormat.TEXT,
       getWarnings: () => [],
+      isSafeMode: () => false,
       getModelsConfig: () => ({ getCurrentAuthType: () => null }),
       getSessionId: () => 'test-session-id',
     } as unknown as Config;
@@ -638,6 +641,7 @@ describe('gemini.tsx main function', () => {
       getInputFormat: () => 'stream-json',
       getContentGeneratorConfig: () => ({ authType: 'test-auth' }),
       getWarnings: () => [],
+      isSafeMode: () => false,
       getModelsConfig: () => ({ getCurrentAuthType: () => null }),
       getUsageStatisticsEnabled: () => true,
       getSessionId: () => 'test-session-id',
@@ -768,6 +772,7 @@ describe('gemini.tsx main function kitty protocol', () => {
       getScreenReader: () => false,
       getGeminiMdFileCount: () => 0,
       getWarnings: () => [],
+      isSafeMode: () => false,
       getModelsConfig: () => ({ getCurrentAuthType: () => null }),
       getUsageStatisticsEnabled: () => true,
       getSessionId: () => 'test-session-id',
@@ -878,6 +883,7 @@ describe('gemini.tsx main function kitty protocol', () => {
       getScreenReader: () => false,
       getGeminiMdFileCount: () => 0,
       getWarnings: () => [],
+      isSafeMode: () => false,
       getModelsConfig: () => ({
         getCurrentAuthType: () => null,
         getGenerationConfig: () => ({}),
@@ -964,6 +970,7 @@ describe('gemini.tsx main function kitty protocol', () => {
       getScreenReader: () => false,
       getGeminiMdFileCount: () => 0,
       getWarnings: () => [],
+      isSafeMode: () => false,
       getModelsConfig: () => ({ getCurrentAuthType: () => null }),
       getUsageStatisticsEnabled: () => true,
       getSessionId: () => 'test-session-id',

packages/cli/src/gemini.tsx

@@ -935,6 +935,11 @@ export async function main() {
     let input = config.getQuestion();
     const startupWarnings = [
       ...new Set([
+        ...(config.isSafeMode()
+          ? [
+              '⚠ SAFE MODE — all customizations disabled (hooks, extensions, skills, MCP servers, QWEN.md). Restart without --safe-mode to resume normal operation.',
+            ]
+          : []),
         ...(await getStartupWarnings()),
         ...(await getUserStartupWarnings({
           workspaceRoot: process.cwd(),

packages/cli/src/serve/workspaceAgents.ts

@@ -1289,6 +1289,7 @@ export function createDaemonSubagentManager(
     getSdkMode: () => false,
     getProjectRoot: () => boundWorkspace,
     getActiveExtensions: () => [],
+    isSafeMode: () => false,
   } as unknown as Record<string | symbol, unknown>;
   const guarded = new Proxy(stub, {
     get(target, prop) {

packages/cli/src/ui/components/Footer.test.tsx

@@ -53,6 +53,7 @@ const createMockConfig = (overrides = {}) => ({
   getProjectRoot: vi.fn(() => '/test/project'),
   getSessionId: vi.fn(() => 'test-session'),
   getMemoryManager: vi.fn(createMockMemoryManager),
+  isSafeMode: vi.fn(() => false),
   ...overrides,
 });
 

packages/cli/src/ui/components/Footer.tsx

@@ -110,6 +110,12 @@ export const Footer: React.FC = () => {
       node: <Text color={theme.status.success}>🔒 {sandboxInfo}</Text>,
     });
   }
+  if (config.isSafeMode()) {
+    rightItems.push({
+      key: 'safe-mode',
+      node: <Text color={theme.status.warning}>⚠ Safe Mode</Text>,
+    });
+  }
   if (debugMode) {
     rightItems.push({
       key: 'debug',

packages/cli/src/ui/components/MemoryDialog.test.tsx

@@ -42,6 +42,7 @@ describe('MemoryDialog', () => {
       getWorkingDir: vi.fn(() => '/tmp/project'),
       getProjectRoot: vi.fn(() => '/tmp/project'),
       getBareMode: vi.fn(() => false),
+      isSafeMode: vi.fn(() => false),
       // Stale snapshot getters — the dialog must NOT read its toggle state
       // from these; it reads from the live merged settings instead.
       getManagedAutoMemoryEnabled: vi.fn(() => false),

packages/cli/src/ui/components/MemoryDialog.tsx

@@ -118,8 +118,9 @@ export function MemoryDialog({ onClose }: MemoryDialogProps) {
   // the Config snapshot: Config is frozen at startup and never reflects a
   // setValue() write, so reopening the dialog would otherwise show stale state.
   const bareMode = config.getBareMode();
+  const safeMode = config.isSafeMode();
   const readToggle = (value: boolean | undefined): boolean =>
-    !bareMode && (value ?? true);
+    !bareMode && !safeMode && (value ?? true);
   const [autoMemoryOn, setAutoMemoryOn] = useState(() =>
     readToggle(loadedSettings.merged.memory?.enableManagedAutoMemory),
   );

packages/cli/src/ui/hooks/slashCommandProcessor.test.ts

@@ -60,6 +60,7 @@ vi.mock('node:process', () => {
     exit: mockProcessExit,
     platform: 'sunos',
     cwd: () => '/fake/dir',
+    env: {},
   } as unknown as NodeJS.Process;
   return {
     ...mockProcess,