From 0c5d9fb1958c21803df32bb5f3733b087b517dbb Mon Sep 17 00:00:00 2001
From: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
Date: Sat, 7 Mar 2026 09:22:12 -0600
Subject: [PATCH] Onboard: reject tools profile on remote wizard path

---
 src/wizard/onboarding.test.ts | 33 +++++++++++++++++++++++++++++++++
 src/wizard/onboarding.ts      |  6 ++++++
 2 files changed, 39 insertions(+)

diff --git a/src/wizard/onboarding.test.ts b/src/wizard/onboarding.test.ts
index 19c7b8c6675..d5993e8436a 100644
--- a/src/wizard/onboarding.test.ts
+++ b/src/wizard/onboarding.test.ts
@@ -646,6 +646,39 @@ describe("runOnboardingWizard", () => {
     );
   });
 
+  it("fails when interactive mode selection resolves to remote with --tools-profile set", async () => {
+    const select = vi.fn(async (params: WizardSelectParams<unknown>) => {
+      if (params.message === "What do you want to set up?") {
+        return "remote";
+      }
+      return "advanced";
+    }) as unknown as WizardPrompter["select"];
+    const prompter = buildWizardPrompter({ select });
+    const runtime = createRuntime({ throwsOnExit: true });
+
+    await expect(
+      runOnboardingWizard(
+        {
+          acceptRisk: true,
+          flow: "advanced",
+          toolsProfile: "coding",
+          authChoice: "skip",
+          installDaemon: false,
+          skipProviders: true,
+          skipSkills: true,
+          skipHealth: true,
+          skipUi: true,
+        },
+        runtime,
+        prompter,
+      ),
+    ).rejects.toThrow("exit:1");
+
+    expect(runtime.error).toHaveBeenCalledWith(
+      '--tools-profile is only supported when --mode is "local".',
+    );
+  });
+
   it("prompts for tool access profile before workspace in local advanced flow", async () => {
     const promptOrder: string[] = [];
     const select = vi.fn(async (params: WizardSelectParams<unknown>) => {
diff --git a/src/wizard/onboarding.ts b/src/wizard/onboarding.ts
index ac87867e5e6..17a6fc2a65c 100644
--- a/src/wizard/onboarding.ts
+++ b/src/wizard/onboarding.ts
@@ -407,6 +407,12 @@ export async function runOnboardingWizard(
           ],
         })) as OnboardMode));
 
+  if (mode === "remote" && opts.toolsProfile !== undefined) {
+    runtime.error('--tools-profile is only supported when --mode is "local".');
+    runtime.exit(1);
+    return;
+  }
+
   if (mode === "remote") {
     const { promptRemoteGatewayConfig } = await import("../commands/onboard-remote.js");
     const { logConfigUpdated } = await import("../config/logging.js");