Wrench keeps product state with the operator.

The CLI stores state on the operator's machine

The default state home is ~/.local/share/wrench. An operator can select a dedicated path with WRENCH_STATE_HOME. Wrench restricts its owned state directories to the current operating-system account and rejects shared, symbolic-link, or unexpectedly replaced state paths before trusted state is read.

State can include auth locators, managed OAuth credentials, encrypted exact-query snapshots, normalized read projections, provider and plugin state, plans, receipts, journals, recovery evidence, session material, locally installed tools, and capture working state. Durable page captures and media archives live in the vault or output path selected by the operator.

Local custody does not mean that every stored byte is encrypted. Exact provider-read snapshots and normalized projections use authenticated local encryption. A Wrench-managed Gmail OAuth JSON file, for example, is mode-restricted private state, but it is not an operating-system keychain and is not encrypted at rest. Protect the local account, disk, state home, selected output paths, and backups.

Selected work determines which third parties receive data

A page read or capture contacts the requested source through its selected acquisition method. URL metadata work can perform read-only Archive.today discovery. A media command contacts the selected source and may run operator-selected local tools. An authenticated capability sends only the checked request and credential material required by its exact provider, origin, transport, account realm, and contract.

Those sites and providers can observe ordinary request information such as the source IP address, request timing, their own account identifier, and the bounded action or query. A signed-in browser page can also emit telemetry owned by that provider. Wrench does not turn those interactions into a claim that third parties retain nothing.

The CLI and SDK do not send wrench.rip analytics. They do make the network requests required by the operation the caller selected. Wrench does not include a hosted relay, model, planner, or tool loop. A calling agent, application, terminal, logging system, or model service can receive whatever output the operator gives it; that downstream handling is outside Wrench.

Credentials stay bound to one declared use

An auth locator can point to an explicit cookie source or file, browser profile, OAuth token file, Wrench-managed OAuth credential, or linked-device store. The caller selects the locator by name. Wrench binds it to one provider account and transport, keeps credential values out of normal outputs and receipts, and does not silently fall back to another transport.

A successful subject-bound R1 read can store the validated input and bounded provider output as authenticated local ciphertext. A later --cache-only read can return that exact snapshot without a provider connection. Exact inputs, account subjects, cursors, private identifiers, and provider output remain inside the encrypted snapshot instead of entering its public diagnostic reason.

R2 and R3 mutations retain local plan, dispatch, receipt, and recovery evidence so Wrench can avoid a blind retry. Some evidence must remain available while a dispatch is indeterminate. The remote provider controls any server-side records produced or retained by an accepted request under that provider's policy.

Captures and archives contain source material

A durable page capture stores the selected page content and source metadata in the operator's Markdown vault. A completed media archive can contain acquired encoded media, privacy-projected provider metadata, requested derivatives and transcripts, a versioned manifest, and SHA-256 records. Anyone with access to those output paths can read that retained material.

Wrench does not persist media cookies, request headers, signed media URLs, raw yt-dlp metadata, or transport fragments in the completed archive. It cannot remove personal or confidential information already present in the source content. Use Wrench only with material and accounts you are authorized to access, and choose output and backup locations that match the content's sensitivity.

Trusted plugins and native tools share the local account boundary

Bundled source plugins run as trusted in-process code. A portable plugin requires an explicit trust decision for one verified, content-addressed bundle and receives denied-by-default host capabilities. Its child process contains ordinary failures, but it is not a hostile native-code sandbox. Plugin code still runs with the ambient authority of the current operating-system account.

Operator-selected browser executables, media tools, transcription tools, models, linked-device clients, and other native dependencies have their own provenance and behavior. Wrench checks the boundaries documented for each integration, but continuity and content hashes do not prove that third-party native code is safe.

The operator controls retention and provider revocation

Wrench sets no hosted retention period because it does not receive CLI state through a Wrench service. Captures and archives remain until the operator removes them from their selected output paths and any backups. Provider-side records remain until the provider removes them under its own controls and policy.

wrench auth remove ID --yes removes the locator, any Wrench-managed OAuth credential, session secrets, and auth-bound local read caches. It does not revoke a browser session, linked device, externally managed token, or provider-side grant. Revoke those separately with the provider. Do not discard run, receipt, journal, or recovery evidence for an unsettled mutation; inspect and reconcile it first.

wrench.rip measures pages, not people

wrench.rip is a static documentation site. On the canonical production host only, an optional PostHog bootstrap can record page view, page leave, Core Web Vitals, and the two explicit GitHub repository links on the home page. The runtime is cookieless, personless, memory-only, DNT-aware, query-free, and restricted to that host.

URL query strings, fragments, and common attribution parameters are stripped before an event can leave the browser. The site does not use replay, identity, feature flags, broad autocapture, console capture, or person profiles. It does not record form input, local file paths, CLI state, or provider account material. JavaScript is optional, and every public page remains readable without it.

The documentation works without JavaScript

Agents can request Accept: text/markdown on a public content URL and receive a Markdown body with Vary: Accept. A Do Not Track signal disables the optional analytics bootstrap. The site content, install commands, privacy information, and support links remain available when JavaScript does not run.