feat(launcher): add safe mode and issue reporting

src/mods/LauncherMods.lua

@@ -291,6 +291,7 @@ function LauncherMods.deriveList(manifests, options, version)
   local ordered = {}
   for _, m in ipairs(manifests) do ordered[#ordered + 1] = m end
   table.sort(ordered, function(a, b) return a.id < b.id end)
+  local safeMode = SaveData.isSafeMode(options)
 
   -- the override is one answer per game (SaveData.modForced), the same scope
   -- the loader resolves it under
@@ -304,17 +305,24 @@ function LauncherMods.deriveList(manifests, options, version)
     -- matching the loader -- except experimental mods, which stay off until
     -- the player opts in.  Scoped through modScope, so this reads exactly what
     -- setEnabled writes and the loader loads for the selected game.
-    local decided = SaveData.modEnabled(options, m.id, SaveData.modScope(version))
-    if decided == nil then decided = not m.experimental end
-    if decided then enabledSet[m.id] = true end
+    if not safeMode then
+      local decided = SaveData.modEnabled(options, m.id, SaveData.modScope(version))
+      if decided == nil then decided = not m.experimental end
+      if decided then enabledSet[m.id] = true end
+    end
   end
 
   local out = {}
   for _, m in ipairs(ordered) do
-    local enabled = enabledSet[m.id] == true
+    local enabled = not safeMode and enabledSet[m.id] == true
     local forced = forcedFor(m.id)
-    local status, detail =
-      statusFor(byId, m.id, enabledSet, enabled, version, forcedFor)
+    local status, detail
+    if safeMode then
+      status, detail = "safe_mode", "Disabled by safe mode"
+    else
+      status, detail =
+        statusFor(byId, m.id, enabledSet, enabled, version, forcedFor)
+    end
     -- nil, not false, when the panel is showing every game at once
     local here = nil
     if version then here = ModTargets.runsHere(m, version, nil, forced) end
@@ -332,7 +340,8 @@ function LauncherMods.deriveList(manifests, options, version)
         local answers = {}
         for _, game in ipairs(GameVersion.ORDER) do
           local answer = SaveData.modEnabled(options, m.id, game)
-          answers[game] = answer == true or (answer == nil and not m.experimental)
+          answers[game] = not safeMode
+            and (answer == true or (answer == nil and not m.experimental))
         end
         return answers
       end)(),
@@ -346,6 +355,7 @@ function LauncherMods.deriveList(manifests, options, version)
       -- panel is showing (src/mods/ModTargets.lua)
       targets = ModTargets.chip(m),
       targetsHere = here,
+      safeMode = safeMode,
     }
   end
   return out
@@ -586,6 +596,7 @@ end
 -- answer.  The loader and the in-game manager use the same scope on next boot.
 function LauncherMods.setEnabled(id, enabled, version)
   local options = SaveData.loadOptions()
+  if SaveData.isSafeMode(options) then return false end
   SaveData.setModEnabled(options, id, enabled, SaveData.modScope(version))
   SaveData.saveOptions(options)
   LauncherMods.syncActiveProfile(options)
@@ -599,6 +610,7 @@ end
 -- and leaves a half-applied state behind if one of them fails.
 function LauncherMods.setAllEnabled(ids, enabled, version)
   local options = SaveData.loadOptions()
+  if SaveData.isSafeMode(options) then return false end
   local scope = SaveData.modScope(version)
   for _, id in ipairs(ids or {}) do
     if scope then
@@ -1184,6 +1196,7 @@ end
 
 function LauncherMods.applyProfile(profileName, options)
   options = options or SaveData.loadOptions()
+  if SaveData.isSafeMode(options) then return false end
   local profiles = options.modProfiles or {}
   local targetProfile
   for _, p in ipairs(profiles) do

src/mods/Loader.lua

@@ -259,6 +259,7 @@ function Loader.new(opts)
     modInput = {}, modEnv = {}, stepsQueues = {},
     fs = (opts and opts.fs) or (love and love.filesystem),
     dev = dev,
+    safeMode = false,
     -- Which generation this boot is (1 or 2).  Fixed at construction: the
     -- active version is set once in main.lua's bootGame before anything
     -- builds a loader, and a run never changes generation underneath one.
@@ -300,6 +301,8 @@ end
 function Loader:_loadState()
   self.disabled = {}
   local options = SaveData.loadOptions(self.fs)
+  self.safeMode = SaveData.isSafeMode(options)
+  Runtime.safeMode = self.safeMode
   local scope = self:_enableScope()
   local ids = {}
   for id in pairs(options.mods or {}) do ids[id] = true end
@@ -415,6 +418,7 @@ function Loader:_writeOptionSchemas()
 end
 
 function Loader:setEnabled(id, enabled)
+  if self.safeMode then return false end
   if not self.mods[id] then return false end
   self.disabled[id] = not enabled
   self.mods[id].enabled = enabled
@@ -427,6 +431,7 @@ end
 -- choice could not be persisted for a game, so the caller does not promise a
 -- restart will honour it.
 function Loader:setGen2Forced(id, forced)
+  if self.safeMode then return false, false end
   if not self.mods[id] then return false, false end
   self.gen2Forced[id] = forced or nil
   self:_saveState()
@@ -1539,6 +1544,9 @@ function Loader:load(data)
   require("src.mods.Builtins").install(self.content, data, self.generation)
   self:_loadState()
   self:_discover()
+  if self.safeMode then
+    for id in pairs(self.mods) do self.disabled[id] = true end
+  end
   -- Existing installs stored one shared answer.  Once their manifests are
   -- known, split that answer across every game before the next launcher/game
   -- toggle can change one independently.  _loadState already used the same
@@ -1574,7 +1582,7 @@ function Loader:load(data)
   -- the one build where its env var is set.
   for id, mod in pairs(self.mods) do
     local envName = mod.manifest.force_enable_env
-    if envName and os.getenv(envName) == "1" then
+    if not self.safeMode and envName and os.getenv(envName) == "1" then
       self.disabled[id] = nil
     end
   end
@@ -1740,6 +1748,7 @@ function Loader:status()
     local manifest = {}
     for key, value in pairs(mod.manifest) do manifest[key] = value end
     manifest.enabled = mod.enabled ~= false
+    manifest.safeMode = self.safeMode == true
     manifest.state = mod.state or (manifest.enabled and "loaded" or "disabled")
     manifest.error = mod.failure
     -- set instead of `error` when the mod was left out for a reason that is

src/mods/ManagerState.lua

@@ -365,9 +365,13 @@ end
 
 function ManagerState:detailRows(m)
   local rows = {}
-  rows[#rows + 1] = { label = m.enabled and "DISABLE" or "ENABLE",
-    action = function() self:beginToggle(m) end }
-  if self:schemaFor(m) then
+  if Runtime.safeMode then
+    rows[#rows + 1] = { label = "SAFE MODE ACTIVE", inert = true }
+  else
+    rows[#rows + 1] = { label = m.enabled and "DISABLE" or "ENABLE",
+      action = function() self:beginToggle(m) end }
+  end
+  if not Runtime.safeMode and self:schemaFor(m) then
     rows[#rows + 1] = { label = Strings("OPTIONS.."),
       action = function() self:openOptions(m) end }
   end
@@ -383,7 +387,8 @@ function ManagerState:detailRows(m)
   -- what this mod does.
   local loader = self.game.mods
   local version, gen = self:targetGame()
-  if loader and loader.setGen2Forced and not ModTargets.supports(m, version, gen) then
+  if loader and loader.setGen2Forced and not Runtime.safeMode
+      and not ModTargets.supports(m, version, gen) then
     rows[#rows + 1] = {
       label = m.gen2Forced and Strings("DON'T TRY HERE") or Strings("TRY HERE ANYWAY"),
       action = function() self:toggleGen2Force(m) end }
@@ -674,6 +679,10 @@ end
 -- ------- the enable/disable flow
 
 function ManagerState:beginToggle(m)
+  if Runtime.safeMode then
+    self:notify("SAFE MODE ACTIVE")
+    return
+  end
   if not m then return end
   local want = not m.enabled
   local loader = self.game.mods
@@ -711,6 +720,10 @@ end
 -- override is scoped to THIS game, and a boot that cannot name one keeps it in
 -- memory only, which the notice says rather than promising a restart.
 function ManagerState:toggleGen2Force(m)
+  if Runtime.safeMode then
+    self:notify("SAFE MODE ACTIVE")
+    return
+  end
   local loader = self.game.mods
   if not (loader and loader.setGen2Forced) then return end
   local want = not m.gen2Forced
@@ -743,6 +756,10 @@ function ManagerState:enableScope()
 end
 
 function ManagerState:commitToggle(apply)
+  if Runtime.safeMode then
+    self:notify("SAFE MODE ACTIVE")
+    return
+  end
   local loader = self.game.mods
   local opts = self:optionsTable()
   local scope = self:enableScope()
@@ -757,6 +774,10 @@ function ManagerState:commitToggle(apply)
 end
 
 function ManagerState:discardChanges()
+  if Runtime.safeMode then
+    self:notify("SAFE MODE ACTIVE")
+    return
+  end
   local loader = self.game.mods
   local opts = self:optionsTable()
   local scope = self:enableScope()
@@ -802,6 +823,10 @@ function ManagerState:persistOptions()
 end
 
 function ManagerState:applyProfile(p)
+  if Runtime.safeMode then
+    self:notify("SAFE MODE ACTIVE")
+    return
+  end
   local mods = self:manifestMap()
   local set = self:enabledSet()
   local combined = {}
@@ -963,6 +988,10 @@ function ManagerState:optionValue(modId, row)
 end
 
 function ManagerState:setOption(modId, key, value)
+  if Runtime.safeMode then
+    self:notify("SAFE MODE ACTIVE")
+    return false
+  end
   local save = self.game.save
   if save and save.options then
     save.options.modOptions = save.options.modOptions or {}
@@ -1123,6 +1152,10 @@ function ManagerState:buildOptionRows(m, schema)
 end
 
 function ManagerState:openOptions(m)
+  if Runtime.safeMode then
+    self:notify("SAFE MODE ACTIVE")
+    return
+  end
   local schema = self:schemaFor(m)
   if not schema then
     self:notify("NO OPTIONS")

src/mods/Runtime.lua

@@ -33,6 +33,8 @@ Runtime.currentMod = nil
 -- currentMod went back to nil (src/mods/Sandbox.lua)
 Runtime.modRequire = nil
 
+Runtime.safeMode = false
+
 function Runtime.install(events, hooks, errors)
   Runtime.events, Runtime.hooks = events, hooks
   Runtime.errors = errors