@bike4mind/cli 0.12.1 → 0.14.0

package/bin/bike4mind-cli.mjs

@@ -387,6 +387,19 @@ if (isDev) {
 } else {
   // Production: run compiled JavaScript
   try {
+    // Auto-update on launch (consent-first): when a newer version is available
+    // on a writable global prefix, install + re-exec into it BEFORE importing
+    // the code-split app — running an install while dist/index.mjs is loaded
+    // would crash it. On the default 'ask' preference this prompts the user
+    // (Update once / Always / Skip / Never); 'auto' installs silently, 'never'
+    // does nothing. Wrapped so the updater can never block launching the CLI.
+    try {
+      const { maybeAutoUpdateOnLaunch } = await import('../dist/commands/updateCommand.mjs');
+      await maybeAutoUpdateOnLaunch();
+    } catch {
+      // Updater is best-effort — fall through to the current version.
+    }
+
     await import(join(__dirname, '../dist/index.mjs'));
   } catch (error) {
     console.error('Failed to start CLI:', error);

package/dist/{ConfigStore-C3tokQej.mjs → ConfigStore-B9I7UHuG.mjs}

@@ -1493,6 +1493,27 @@ let SupportedFabFileMimeTypes = /* @__PURE__ */ function(SupportedFabFileMimeTyp
 	return SupportedFabFileMimeTypes;
 }({});
 /**
+* Canonical agent execution status tuple. Shared between the database model
+* (`AgentExecutionModel`), the client store (`useAgentExecutionStore`), and
+* wire schemas (`ChildExecutionSnapshotSchema`, etc.) so the value space can't
+* drift across boundaries. Previously declared in two places — moving it here
+* lets the Zod schemas type `status` as `z.enum(AGENT_EXECUTION_STATUSES)`
+* instead of `z.string()`, removing the runtime narrowing the client used to
+* compensate for the loose contract.
+*/
+const AGENT_EXECUTION_STATUSES = [
+	"pending",
+	"running",
+	"continuing",
+	"awaiting_permission",
+	"awaiting_subagent",
+	"awaiting_dag_children",
+	"paused",
+	"completed",
+	"failed",
+	"aborted"
+];
+/**
 * ========================================
 * Client to Server Actions
 * ========================================
@@ -2690,11 +2711,36 @@ const PermissionRequestAction = z.object({
 	toolInput: z.unknown(),
 	iteration: z.number()
 });
+/**
+* Persisted snapshot of a non-background child subagent execution. Replayed on
+* reconnect (#8695) so `SubagentStepNest` can re-render the nested iteration
+* trace under the parent's `delegate_to_agent` action step after a hard refresh
+* or once the parent run has terminated. Background children are excluded —
+* they surface via the header badge + completion toast (#8341), not inline
+* nesting.
+*
+* `agentName` is sourced from the child doc's `subagentConfig` (now persisted
+* at creation time for every subagent — see `agentExecutor.ts` `onStart`). A
+* generic fallback ("Subagent") is used for legacy docs without it. Empty
+* `steps` is valid for an in-flight in-process child whose terminal write
+* hasn't landed yet — the nest renders the agent header alone in that case.
+*/
+const ChildExecutionSnapshotSchema = z.object({
+	executionId: z.string(),
+	agentName: z.string(),
+	model: z.string().optional(),
+	status: z.enum(AGENT_EXECUTION_STATUSES),
+	steps: z.array(AgentStepSchema),
+	totalCredits: z.number().optional(),
+	finalAnswer: z.string().optional(),
+	error: z.string().optional(),
+	isTimeout: z.boolean().optional()
+});
 const ReconnectResultAction = z.object({
 	action: z.literal("reconnect_result"),
 	found: z.boolean(),
 	executionId: z.string().optional(),
-	status: z.string().optional(),
+	status: z.enum(AGENT_EXECUTION_STATUSES).optional(),
 	pendingPermission: z.object({
 		toolName: z.string(),
 		toolInput: z.unknown(),
@@ -2703,7 +2749,9 @@ const ReconnectResultAction = z.object({
 	totalCreditsUsed: z.number().optional(),
 	iterationCount: z.number().optional(),
 	steps: z.array(AgentStepSchema).optional(),
-	stepsTruncated: z.boolean().optional()
+	stepsTruncated: z.boolean().optional(),
+	children: z.array(ChildExecutionSnapshotSchema).optional(),
+	childrenTruncated: z.boolean().optional()
 });
 z.discriminatedUnion("action", [
 	DataSubscribeRequestAction,
@@ -10025,6 +10073,7 @@ const CliConfigSchema = z.object({
 		temperature: z.number(),
 		autoSave: z.boolean(),
 		autoCompact: z.boolean().optional().prefault(true),
+		autoUpdate: z.boolean().optional(),
 		theme: z.enum(["light", "dark"]),
 		exportFormat: z.enum(["markdown", "json"]),
 		maxIterations: z.number().nullable().prefault(10),

package/dist/commands/apiCommand.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as ConfigStore } from "../ConfigStore-C3tokQej.mjs";
+import { t as ConfigStore } from "../ConfigStore-B9I7UHuG.mjs";
 //#region src/commands/apiCommand.ts
 /**
 * External API config command (--api-url / --reset-api)

package/dist/commands/doctorCommand.mjs

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { t as version } from "../package-CMkVxGGC.mjs";
-import { n as compareSemver, r as fetchLatestVersion } from "../updateChecker-D67NPlS5.mjs";
+import { t as version } from "../package-uvIC6spW.mjs";
+import { a as fetchLatestVersion, c as isNpmPrefixWritable, i as compareSemver } from "../updateChecker-C8xsNY2L.mjs";
 import { t as checkRipgrep } from "../ripgrepCheck-BmkyTK2i.mjs";
 import { execSync } from "child_process";
-import { constants, existsSync, promises } from "fs";
+import { existsSync } from "fs";
 import { homedir } from "os";
 import path from "path";
 //#region src/commands/doctorCommand.ts
@@ -55,20 +55,16 @@ async function handleDoctorCommand() {
 			encoding: "utf-8",
 			timeout: 1e4
 		}).trim();
-		try {
-			await promises.access(npmPrefix, constants.W_OK);
-			results.push({
-				name: "Global npm path",
-				status: "pass",
-				message: `${npmPrefix} (writable)`
-			});
-		} catch {
-			results.push({
-				name: "Global npm path",
-				status: "warn",
-				message: `${npmPrefix} (not writable — may need sudo for updates)`
-			});
-		}
+		if (await isNpmPrefixWritable(npmPrefix)) results.push({
+			name: "Global npm path",
+			status: "pass",
+			message: `${npmPrefix} (writable)`
+		});
+		else results.push({
+			name: "Global npm path",
+			status: "warn",
+			message: `${npmPrefix} (not writable — may need sudo for updates)`
+		});
 	} catch {
 		results.push({
 			name: "Global npm path",

package/dist/commands/envCommand.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as ConfigStore } from "../ConfigStore-C3tokQej.mjs";
+import { t as ConfigStore } from "../ConfigStore-B9I7UHuG.mjs";
 //#region src/commands/envCommand.ts
 /**
 * Environment switching for the `--dev` / `--prod` launch flags.

package/dist/commands/headlessCommand.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { C as WebSocketToolExecutor, D as ServerLlmBackend, E as WebSocketLlmBackend, F as generateCliTools, G as buildSystemPrompt, J as ReActAgent, N as loadContextFiles, P as PermissionManager, Q as SessionStore, S as ApiClient, T as FallbackLlmBackend, U as setWebSocketToolExecutor, X as CheckpointStore, Y as CustomCommandStore, _ as createAgentDelegateTool, b as createSkillTool, d as createFindDefinitionTool, f as createTodoStore, g as BackgroundAgentManager, h as createBackgroundAgentTools, k as McpManager, m as createCoordinateTaskTool, p as createWriteTodosTool, q as isReadOnlyTool, u as createGetFileStructureTool, v as AgentStore, w as WebSocketConnectionManager, y as SubagentOrchestrator } from "../tools-QQ6ibgPF.mjs";
-import { n as logger, r as getApiUrl, t as ConfigStore } from "../ConfigStore-C3tokQej.mjs";
+import { C as WebSocketToolExecutor, D as ServerLlmBackend, E as WebSocketLlmBackend, F as generateCliTools, G as buildSystemPrompt, J as ReActAgent, N as loadContextFiles, P as PermissionManager, Q as SessionStore, S as ApiClient, T as FallbackLlmBackend, U as setWebSocketToolExecutor, X as CheckpointStore, Y as CustomCommandStore, _ as createAgentDelegateTool, b as createSkillTool, d as createFindDefinitionTool, f as createTodoStore, g as BackgroundAgentManager, h as createBackgroundAgentTools, k as McpManager, m as createCoordinateTaskTool, p as createWriteTodosTool, q as isReadOnlyTool, u as createGetFileStructureTool, v as AgentStore, w as WebSocketConnectionManager, y as SubagentOrchestrator } from "../tools-BTPUXUNS.mjs";
+import { n as logger, r as getApiUrl, t as ConfigStore } from "../ConfigStore-B9I7UHuG.mjs";
 import { t as DEFAULT_SANDBOX_CONFIG } from "../types-LyRNHOiS.mjs";
 import { t as createSandboxRuntime } from "../SandboxRuntimeAdapter-ChGlxSGQ.mjs";
 import { t as SandboxOrchestrator } from "../SandboxOrchestrator-BoINxbX4.mjs";

package/dist/commands/mcpCommand.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as ConfigStore } from "../ConfigStore-C3tokQej.mjs";
+import { t as ConfigStore } from "../ConfigStore-B9I7UHuG.mjs";
 //#region src/commands/mcpCommand.ts
 /**
 * External MCP commands (b4m mcp list, b4m mcp add, etc.)

package/dist/commands/updateCommand.mjs

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
-import { t as version } from "../package-CMkVxGGC.mjs";
-import { i as forceCheckForUpdate } from "../updateChecker-D67NPlS5.mjs";
+import { t as version } from "../package-uvIC6spW.mjs";
+import { c as isNpmPrefixWritable, l as setAutoUpdatePreference, n as REEXEC_GUARD_ENV, o as forceCheckForUpdate, r as checkForUpdate, s as getAutoUpdatePreference, t as INSTALL_CMD, u as shouldAttemptAutoUpdate } from "../updateChecker-C8xsNY2L.mjs";
 import { t as checkRipgrep } from "../ripgrepCheck-BmkyTK2i.mjs";
-import { execSync } from "child_process";
+import { execSync, spawnSync } from "child_process";
+import { createInterface } from "readline";
 //#region src/commands/updateCommand.ts
 /**
 * External update command (b4m update)
 * Checks for and installs CLI updates.
 * Runs outside the interactive CLI session.
 */
-const INSTALL_CMD = "npm install -g @bike4mind/cli@latest";
 function runGlobalInstall() {
 	try {
 		execSync(INSTALL_CMD, {
@@ -25,6 +25,121 @@ function runGlobalInstall() {
 		return false;
 	}
 }
+/**
+* Ask the user how to handle an available update (the `'ask'` preference).
+* Plain readline (not Ink) because this runs in the bin bootstrap before the
+* code-split app loads — the only window in which it's safe to install.
+*
+* Maps the [U/a/s/n] keys to a choice; an empty line defaults to `'update'`
+* (capital `U` in the prompt is the default). The interface is fully torn down
+* before returning so a Skip/Never fall-through leaves stdin clean for Ink.
+*/
+async function promptUpdateChoice(currentVersion, latestVersion) {
+	if (!process.stdin.isTTY) return "skip";
+	console.log(`\n\x1b[33m  ⬆ Update available: v${currentVersion} → v${latestVersion}\x1b[0m\n`);
+	console.log("  How would you like to handle updates?");
+	console.log("    [U] Update once   (install now)");
+	console.log("    [A] Always        (auto-update silently from now on)");
+	console.log("    [S] Skip          (not now — ask again next launch)");
+	console.log("    [N] Never         (manual `b4m update` only)\n");
+	const rl = createInterface({
+		input: process.stdin,
+		output: process.stdout
+	});
+	let answer;
+	try {
+		answer = await new Promise((resolve) => {
+			rl.on("close", () => resolve(null));
+			rl.question("  Choose [U/a/s/n]: ", resolve);
+		});
+	} finally {
+		rl.close();
+	}
+	if (answer === null) return "skip";
+	switch (answer.trim().toLowerCase()) {
+		case "a": return "always";
+		case "s": return "skip";
+		case "n": return "never";
+		default: return "update";
+	}
+}
+/**
+* Install the latest version and re-exec into it so the session the user just
+* opened runs the new code — zero version skew, no mid-session file-swap risk.
+*
+* spawnSync inherits the TTY so Ink renders normally in the child; the guard
+* env prevents an update loop. npm install overwrites the global package in
+* place, so re-running the same argv[1] bin path picks up the new code. On a
+* successful spawn this never returns (it calls process.exit); it only returns
+* when the install itself fails, so the caller falls through to the current
+* version.
+*/
+function installAndReexec(currentVersion, latestVersion) {
+	console.log(`\x1b[33m  ⬆ Updating v${currentVersion} → v${latestVersion}…\x1b[0m`);
+	if (!runGlobalInstall()) return;
+	const child = spawnSync(process.argv[0], process.argv.slice(1), {
+		stdio: "inherit",
+		env: {
+			...process.env,
+			[REEXEC_GUARD_ENV]: "1"
+		}
+	});
+	if (child.error) {
+		console.error(`\n  Failed to launch the updated version: ${child.error.message}`);
+		console.error("  Re-run b4m to use the newly installed version.");
+		process.exit(1);
+	}
+	process.exit(child.status ?? (child.signal ? 1 : 0));
+}
+/**
+* Auto-update on launch (Claude-Code-style), consent-first.
+*
+* Called from the bin bootstrap on the interactive path *before* the
+* code-split app (`dist/index.mjs`) is imported — the only safe install window
+* (running an install while dist chunks are loaded would crash them).
+*
+* Behaviour by `autoUpdate` preference once an update is available on a
+* writable prefix:
+* - `'auto'`  → install silently and re-exec into the new version.
+* - `'never'` → do nothing (the startup notify banner still informs).
+* - `'ask'`   → prompt the user: Update once / Always (persist `auto`) /
+*               Skip (ask again next launch) / Never (persist `never`).
+*
+* It is a safe no-op (returns without installing) when: already re-exec'd this
+* launch, disabled via `B4M_AUTO_UPDATE=0`, not attached to a TTY, no update is
+* available, the prefix needs sudo (notify banner informs instead), or the
+* user declines the prompt. Any install/network failure is swallowed so the
+* user is never blocked from launching the current version.
+*/
+async function maybeAutoUpdateOnLaunch() {
+	if (!shouldAttemptAutoUpdate({ isTTY: Boolean(process.stdin.isTTY && process.stdout.isTTY) })) return;
+	const preference = await getAutoUpdatePreference();
+	if (preference === "never") return;
+	const currentVersion = version;
+	let result;
+	let timeoutHandle;
+	try {
+		result = await Promise.race([checkForUpdate(currentVersion), new Promise((resolve) => {
+			timeoutHandle = setTimeout(() => resolve(null), 3e3);
+		})]);
+	} catch {
+		return;
+	} finally {
+		if (timeoutHandle) clearTimeout(timeoutHandle);
+	}
+	if (!result?.updateAvailable) return;
+	if (!await isNpmPrefixWritable()) return;
+	if (preference === "ask") {
+		const choice = await promptUpdateChoice(currentVersion, result.latestVersion);
+		if (choice === "skip") return;
+		if (choice === "never") {
+			await setAutoUpdatePreference(false);
+			return;
+		}
+		if (choice === "always") await setAutoUpdatePreference(true);
+	}
+	installAndReexec(currentVersion, result.latestVersion);
+}
 async function handleUpdateCommand() {
 	const currentVersion = version;
 	console.log(`Current version: v${currentVersion}`);
@@ -56,4 +171,4 @@ async function handleUpdateCommand() {
 	else console.log("\nRipgrep restored.");
 }
 //#endregion
-export { handleUpdateCommand };
+export { handleUpdateCommand, maybeAutoUpdateOnLaunch, promptUpdateChoice };

package/dist/index.mjs

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { $ as OAuthClient, A as substituteArguments, B as DEFAULT_THOROUGHNESS, C as WebSocketToolExecutor, D as ServerLlmBackend, E as WebSocketLlmBackend, F as generateCliTools, G as buildSystemPrompt, H as registerFeatureModuleTools, I as ALWAYS_DENIED_FOR_AGENTS, J as ReActAgent, K as buildSkillsPromptSection, L as DEFAULT_AGENT_MODEL, M as extractCompactInstructions, N as loadContextFiles, O as isTransientNetworkError, P as PermissionManager, Q as SessionStore, R as DEFAULT_MAX_ITERATIONS, S as ApiClient, T as FallbackLlmBackend, U as setWebSocketToolExecutor, V as clearFeatureModuleTools, W as getPlanModeFilePath, X as CheckpointStore, Y as CustomCommandStore, Z as CommandHistoryStore, _ as createAgentDelegateTool, a as createBlockerTools, at as searchFiles, b as createSkillTool, c as createDecisionStore, d as createFindDefinitionTool, et as hasFileReferences, f as createTodoStore, g as BackgroundAgentManager, h as createBackgroundAgentTools, i as createBlockerStore, it as formatFileSize, j as formatStep, k as McpManager, l as formatDecisionsOutput, m as createCoordinateTaskTool, n as createReviewGateTool, nt as searchCommands, o as formatBlockersOutput, ot as warmFileCache, p as createWriteTodosTool, q as isReadOnlyTool, r as formatReviewGatesOutput, rt as mergeCommands, s as createDecisionLogTool, t as createReviewGateStore, tt as processFileReferences, u as createGetFileStructureTool, v as AgentStore, w as WebSocketConnectionManager, x as parseAgentConfig, y as SubagentOrchestrator, z as DEFAULT_RETRY_CONFIG } from "./tools-QQ6ibgPF.mjs";
+import { $ as OAuthClient, A as substituteArguments, B as DEFAULT_THOROUGHNESS, C as WebSocketToolExecutor, D as ServerLlmBackend, E as WebSocketLlmBackend, F as generateCliTools, G as buildSystemPrompt, H as registerFeatureModuleTools, I as ALWAYS_DENIED_FOR_AGENTS, J as ReActAgent, K as buildSkillsPromptSection, L as DEFAULT_AGENT_MODEL, M as extractCompactInstructions, N as loadContextFiles, O as isTransientNetworkError, P as PermissionManager, Q as SessionStore, R as DEFAULT_MAX_ITERATIONS, S as ApiClient, T as FallbackLlmBackend, U as setWebSocketToolExecutor, V as clearFeatureModuleTools, W as getPlanModeFilePath, X as CheckpointStore, Y as CustomCommandStore, Z as CommandHistoryStore, _ as createAgentDelegateTool, a as createBlockerTools, at as searchFiles, b as createSkillTool, c as createDecisionStore, d as createFindDefinitionTool, et as hasFileReferences, f as createTodoStore, g as BackgroundAgentManager, h as createBackgroundAgentTools, i as createBlockerStore, it as formatFileSize, j as formatStep, k as McpManager, l as formatDecisionsOutput, m as createCoordinateTaskTool, n as createReviewGateTool, nt as searchCommands, o as formatBlockersOutput, ot as warmFileCache, p as createWriteTodosTool, q as isReadOnlyTool, r as formatReviewGatesOutput, rt as mergeCommands, s as createDecisionLogTool, t as createReviewGateStore, tt as processFileReferences, u as createGetFileStructureTool, v as AgentStore, w as WebSocketConnectionManager, x as parseAgentConfig, y as SubagentOrchestrator, z as DEFAULT_RETRY_CONFIG } from "./tools-BTPUXUNS.mjs";
 import { n as useCliStore, t as selectActiveBackgroundAgents } from "./store-DV5s-qni.mjs";
-import { Ut as validateJupyterKernelName, Wt as validateNotebookPath$1, g as CREDIT_DEDUCT_TRANSACTION_TYPES, i as getEnvironmentName, n as logger, r as getApiUrl, t as ConfigStore, v as ChatModels } from "./ConfigStore-C3tokQej.mjs";
-import { t as version } from "./package-CMkVxGGC.mjs";
-import { t as checkForUpdate } from "./updateChecker-D67NPlS5.mjs";
+import { Ut as validateJupyterKernelName, Wt as validateNotebookPath$1, g as CREDIT_DEDUCT_TRANSACTION_TYPES, i as getEnvironmentName, n as logger, r as getApiUrl, t as ConfigStore, v as ChatModels } from "./ConfigStore-B9I7UHuG.mjs";
+import { t as version } from "./package-uvIC6spW.mjs";
+import { r as checkForUpdate } from "./updateChecker-C8xsNY2L.mjs";
 import React, { useCallback, useEffect, useMemo, useReducer, useRef, useState } from "react";
 import { Box, Static, Text, render, useApp, useInput, usePaste, useStdout } from "ink";
 import { execSync } from "child_process";

package/dist/{package-CMkVxGGC.mjs → package-uvIC6spW.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
 //#region package.json
-var version = "0.12.1";
+var version = "0.14.0";
 //#endregion
 export { version as t };

package/dist/{tools-QQ6ibgPF.mjs → tools-BTPUXUNS.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { $ as ProjectEvents, A as GenerateImageToolCallSchema, At as dayjsConfig_default, B as InviteEvents, Bt as sanitizeTelemetryError, C as ElabsEvents, Ct as UnauthorizedError, D as ForbiddenError, Dt as VideoModels, E as FileEvents, Et as VideoGenerationUsageTransaction, F as ImageEditUsageTransaction, Ft as isGPTImage2Model, G as ModalEvents, Gt as buildRateLimitLogEntry, H as KnowledgeType, Ht as settingsMap, I as ImageGenerationUsageTransaction, It as isGPTImageModel, J as OpenAIEmbeddingModel, Jt as parseRateLimitHeaders, K as ModelBackend, Kt as extractSnippetMeta, L as ImageModels, Lt as isZodError, M as GenericCreditDeductTransaction, Mt as getDataLakeTags, N as HTTPError, Nt as getMcpProviderMetadata, O as FriendshipEvents, Ot as XAI_IMAGE_MODELS, P as HttpStatus, Pt as getViewById, Q as ProfileEvents, R as InboxEvents, Rt as obfuscateApiKey, S as DashboardParamsSchema, St as UiNavigationEvents, T as FeedbackEvents, Tt as VIDEO_SIZE_CONSTRAINTS, U as LLMEvents, V as InviteType, Vt as secureParameters, W as MiscEvents, X as Permission, Y as OpenAIImageGenerationInput, Yt as CollectionType, Z as PermissionDeniedError, _ as ChatCompletionCreateInputSchema, _t as TaskScheduleHandler, a as ALERT_THRESHOLDS, at as ReceivedCreditTransaction, b as CompletionApiUsageTransaction, bt as ToolUsageTransaction, c as ApiKeyScope, ct as ResearchModeParamsSchema, d as ArtifactTypeSchema, dt as ResearchTaskType, et as PromptIntentSchema, f as AuthEvents, ft as SessionEvents, gt as TagType, h as BadRequestError, ht as SupportedFabFileMimeTypes, it as RealtimeVoiceUsageTransaction, j as GenericCreditAddTransaction, jt as getAccessibleDataLakes, k as GEMINI_IMAGE_MODELS, kt as b4mLLMTools, l as ApiKeyType, lt as ResearchTaskExecutionType, m as BFL_SAFETY_TOLERANCE, mt as SubscriptionCreditTransaction, n as logger, nt as PurchaseTransaction, o as AiEvents, ot as RechartsChartTypeList, p as BFL_IMAGE_MODELS, pt as SpeechToTextUsageTransaction, q as NotFoundError, qt as isNearLimit, rt as QuestMasterParamsSchema, s as ApiKeyEvents, st as RegInviteEvents, t as ConfigStore, tt as PromptMetaZodSchema, u as AppFileEvents, ut as ResearchTaskPeriodicFrequencyType, v as ChatModels, vt as TextGenerationUsageTransaction, w as FavoriteDocumentType, wt as UnprocessableEntityError, x as CorruptedFileError, xt as TransferCreditTransaction, y as ClaudeArtifactMimeTypes, yt as TooManyRequestsError, z as InternalServerError, zt as resolveNavigationIntents } from "./ConfigStore-C3tokQej.mjs";
+import { $ as ProjectEvents, A as GenerateImageToolCallSchema, At as dayjsConfig_default, B as InviteEvents, Bt as sanitizeTelemetryError, C as ElabsEvents, Ct as UnauthorizedError, D as ForbiddenError, Dt as VideoModels, E as FileEvents, Et as VideoGenerationUsageTransaction, F as ImageEditUsageTransaction, Ft as isGPTImage2Model, G as ModalEvents, Gt as buildRateLimitLogEntry, H as KnowledgeType, Ht as settingsMap, I as ImageGenerationUsageTransaction, It as isGPTImageModel, J as OpenAIEmbeddingModel, Jt as parseRateLimitHeaders, K as ModelBackend, Kt as extractSnippetMeta, L as ImageModels, Lt as isZodError, M as GenericCreditDeductTransaction, Mt as getDataLakeTags, N as HTTPError, Nt as getMcpProviderMetadata, O as FriendshipEvents, Ot as XAI_IMAGE_MODELS, P as HttpStatus, Pt as getViewById, Q as ProfileEvents, R as InboxEvents, Rt as obfuscateApiKey, S as DashboardParamsSchema, St as UiNavigationEvents, T as FeedbackEvents, Tt as VIDEO_SIZE_CONSTRAINTS, U as LLMEvents, V as InviteType, Vt as secureParameters, W as MiscEvents, X as Permission, Y as OpenAIImageGenerationInput, Yt as CollectionType, Z as PermissionDeniedError, _ as ChatCompletionCreateInputSchema, _t as TaskScheduleHandler, a as ALERT_THRESHOLDS, at as ReceivedCreditTransaction, b as CompletionApiUsageTransaction, bt as ToolUsageTransaction, c as ApiKeyScope, ct as ResearchModeParamsSchema, d as ArtifactTypeSchema, dt as ResearchTaskType, et as PromptIntentSchema, f as AuthEvents, ft as SessionEvents, gt as TagType, h as BadRequestError, ht as SupportedFabFileMimeTypes, it as RealtimeVoiceUsageTransaction, j as GenericCreditAddTransaction, jt as getAccessibleDataLakes, k as GEMINI_IMAGE_MODELS, kt as b4mLLMTools, l as ApiKeyType, lt as ResearchTaskExecutionType, m as BFL_SAFETY_TOLERANCE, mt as SubscriptionCreditTransaction, n as logger, nt as PurchaseTransaction, o as AiEvents, ot as RechartsChartTypeList, p as BFL_IMAGE_MODELS, pt as SpeechToTextUsageTransaction, q as NotFoundError, qt as isNearLimit, rt as QuestMasterParamsSchema, s as ApiKeyEvents, st as RegInviteEvents, t as ConfigStore, tt as PromptMetaZodSchema, u as AppFileEvents, ut as ResearchTaskPeriodicFrequencyType, v as ChatModels, vt as TextGenerationUsageTransaction, w as FavoriteDocumentType, wt as UnprocessableEntityError, x as CorruptedFileError, xt as TransferCreditTransaction, y as ClaudeArtifactMimeTypes, yt as TooManyRequestsError, z as InternalServerError, zt as resolveNavigationIntents } from "./ConfigStore-B9I7UHuG.mjs";
 import { a as isUserLockedOut, c as userCanDisableMFA, d as userRequiresMFA, f as verifyBackupCode, i as getLockoutTimeRemaining, l as userEligibleForMFA, n as generateBackupCodes, o as recordFailedAttempt, p as verifyTOTPToken, r as generateTOTPSetup, s as shouldResetFailedAttempts, t as clearFailedAttempts, u as userHasMFAConfigured } from "./utils-PpNti-tY.mjs";
 import { n as isPathAllowed, t as assertPathAllowed } from "./pathValidation-D8tjkQXE-1HwvsuYT.mjs";
-import { t as version } from "./package-CMkVxGGC.mjs";
+import { t as version } from "./package-uvIC6spW.mjs";
 import { execFile, execFileSync, spawn } from "child_process";
 import crypto, { createHash, randomBytes } from "crypto";
 import { existsSync, promises, readFileSync, readdirSync, rmSync, statSync, unlinkSync, writeFileSync } from "fs";
@@ -2994,6 +2994,168 @@ function trimConversationHistory(messages, maxIterations, protectedPrefixCount)
 	const keepFrom = dynamicStart + nudgeIndices[nudgeIndices.length - maxIterations];
 	messages.splice(dynamicStart, keepFrom - dynamicStart);
 }
+/**
+* Per-node failure policy.
+*
+* `cascade`: if this node fails, all transitive dependents are marked
+* `cascade_failed` and skipped. (Default.)
+*
+* `isolate`: if this node fails, dependents proceed; their dependency
+* context for this node is null/missing. Used for fan-out research nodes
+* where one branch failing shouldn't poison the synthesis.
+*/
+const FailurePolicySchema = z.enum(["cascade", "isolate"]);
+const DecomposedTaskSchema = z.object({
+	id: z.string().min(1),
+	description: z.string().min(1),
+	agentType: z.enum([
+		"explore",
+		"plan",
+		"general-purpose",
+		"review",
+		"test"
+	]),
+	dependsOn: z.array(z.string()).default([]),
+	onFailure: FailurePolicySchema.default("cascade")
+});
+const DecomposeTaskInputSchema = z.object({ tasks: z.array(DecomposedTaskSchema).min(1, "At least one task is required") });
+/**
+* Validate the task graph and return the topological execution levels.
+*
+* - All dependency references must point to existing tasks
+* - No task can depend on itself
+* - No circular dependencies
+* - No duplicate task ids
+*
+* Throws on any violation. Returns levels (each level's tasks have no
+* inter-dependencies and can run concurrently).
+*/
+function validateAndSort(input) {
+	const tasks = /* @__PURE__ */ new Map();
+	for (const task of input.tasks) {
+		if (tasks.has(task.id)) throw new Error(`Duplicate task id: "${task.id}"`);
+		tasks.set(task.id, task);
+	}
+	for (const [taskId, task] of tasks) for (const depId of task.dependsOn) {
+		if (!tasks.has(depId)) throw new Error(`Task "${taskId}" depends on unknown task "${depId}"`);
+		if (depId === taskId) throw new Error(`Task "${taskId}" cannot depend on itself`);
+	}
+	detectCycles(tasks);
+	return topologicalSort(tasks);
+}
+function detectCycles(tasks) {
+	const visited = /* @__PURE__ */ new Set();
+	const inStack = /* @__PURE__ */ new Set();
+	for (const taskId of tasks.keys()) {
+		if (visited.has(taskId)) continue;
+		const stack = [{
+			id: taskId,
+			phase: "enter"
+		}];
+		while (stack.length > 0) {
+			const { id, phase } = stack.pop();
+			if (phase === "exit") {
+				inStack.delete(id);
+				continue;
+			}
+			if (inStack.has(id)) throw new Error(`Circular dependency detected involving task "${id}"`);
+			if (visited.has(id)) continue;
+			visited.add(id);
+			inStack.add(id);
+			stack.push({
+				id,
+				phase: "exit"
+			});
+			const task = tasks.get(id);
+			for (const depId of task.dependsOn) {
+				if (inStack.has(depId)) throw new Error(`Circular dependency detected: "${id}" → "${depId}"`);
+				if (!visited.has(depId)) stack.push({
+					id: depId,
+					phase: "enter"
+				});
+			}
+		}
+	}
+}
+/**
+* Kahn's algorithm — group tasks into execution levels.
+* Tasks within a level have no inter-dependencies.
+*/
+function topologicalSort(tasks) {
+	const inDegree = /* @__PURE__ */ new Map();
+	const dependents = /* @__PURE__ */ new Map();
+	for (const [taskId, task] of tasks) {
+		inDegree.set(taskId, task.dependsOn.length);
+		for (const depId of task.dependsOn) {
+			const deps = dependents.get(depId) || [];
+			deps.push(taskId);
+			dependents.set(depId, deps);
+		}
+	}
+	const levels = [];
+	let currentLevel = [...tasks.keys()].filter((id) => inDegree.get(id) === 0);
+	while (currentLevel.length > 0) {
+		levels.push(currentLevel);
+		const nextLevel = [];
+		for (const taskId of currentLevel) for (const dependent of dependents.get(taskId) || []) {
+			const newDegree = inDegree.get(dependent) - 1;
+			inDegree.set(dependent, newDegree);
+			if (newDegree === 0) nextLevel.push(dependent);
+		}
+		currentLevel = nextLevel;
+	}
+	return levels;
+}
+const DEFAULT_MAX_RESULT_CHARS = 800;
+/**
+* Build the final markdown summary + structured result for a DAG execution.
+*
+* Shared between the CLI's in-process executor and the web's Lambda-fan-out
+* executor so the synthesized tool_result that the parent agent sees has
+* consistent shape across surfaces.
+*/
+function buildPipelineResult(taskResults, options = {}) {
+	const maxLen = options.maxResultChars ?? DEFAULT_MAX_RESULT_CHARS;
+	const completed = taskResults.filter((t) => t.status === "completed");
+	const failed = taskResults.filter((t) => t.status === "failed");
+	const cascadeFailed = taskResults.filter((t) => t.status === "cascade_failed");
+	const pending = taskResults.filter((t) => t.status === "pending" || t.status === "running");
+	const success = failed.length === 0 && cascadeFailed.length === 0 && pending.length === 0;
+	const summaryParts = [];
+	if (completed.length > 0) {
+		summaryParts.push(`## Completed Tasks (${completed.length}/${taskResults.length})\n`);
+		for (const task of completed) {
+			summaryParts.push(`### ${task.id}: ${task.description}\n`);
+			summaryParts.push(`*Agent: ${task.agentType}*\n`);
+			if (task.result) {
+				const truncated = task.result.length > maxLen ? task.result.slice(0, maxLen) + "\n...(truncated)" : task.result;
+				summaryParts.push(truncated);
+			}
+			summaryParts.push("");
+		}
+	}
+	if (failed.length > 0) {
+		summaryParts.push(`## Failed Tasks (${failed.length})\n`);
+		for (const task of failed) {
+			summaryParts.push(`### ${task.id}: ${task.description}\n`);
+			summaryParts.push(`*Agent: ${task.agentType}*\n`);
+			summaryParts.push(`**Error:** ${task.error}\n`);
+		}
+	}
+	if (cascadeFailed.length > 0) {
+		summaryParts.push(`## Cascade-Failed Tasks (${cascadeFailed.length})\n`);
+		for (const task of cascadeFailed) summaryParts.push(`- ${task.id}: ${task.description} — ${task.error}\n`);
+	}
+	if (pending.length > 0) {
+		summaryParts.push(`## Skipped Tasks (${pending.length})\n`);
+		for (const task of pending) summaryParts.push(`- ${task.id}: ${task.description}\n`);
+	}
+	return {
+		success,
+		taskResults,
+		summary: summaryParts.join("\n")
+	};
+}
 String.raw`
 const { parentPort } = require('node:worker_threads');
 const vm = require('node:vm');
@@ -12071,8 +12233,8 @@ No markdown, no explanation, no code blocks — just the raw JSON object.`;
 	"Minimize: sum(error^2)"
 ].join("\n");
 //#endregion
-//#region ../../b4m-core/services/dist/tools-CfgqEx0g.mjs
-async function performDeepResearch(context, params, config) {
+//#region ../../b4m-core/services/dist/tools-CTdKqJPY.mjs
+async function performDeepResearch(context, params, config = {}) {
 	const maxDepth = config.maxDepth || 7;
 	const duration = config.duration || 4.5;
 	const startTime = Date.now();
@@ -12400,7 +12562,7 @@ const deepResearchTool = {
 		toolFn: async (value) => {
 			const params = value;
 			await context.onStart?.("deep_research", params);
-			const result = await performDeepResearch(context, { topic: params.topic }, config);
+			const result = await performDeepResearch(context, { topic: params.topic }, config ?? {});
 			return JSON.stringify(result);
 		},
 		toolSchema: {
@@ -26154,249 +26316,6 @@ function createBackgroundAgentTools(manager) {
 	];
 }
 //#endregion
-//#region src/agents/TaskPipeline.ts
-/**
-* Schema for a single decomposed task in the pipeline
-*/
-const DecomposedTaskSchema = z.object({
-	/** Unique identifier for this task within the pipeline */
-	id: z.string().min(1),
-	/** Human-readable description of what needs to be done */
-	description: z.string().min(1),
-	/** Which agent type should handle this task */
-	agentType: z.enum([
-		"explore",
-		"plan",
-		"general-purpose",
-		"review",
-		"test"
-	]),
-	/** IDs of tasks that must complete before this one can start */
-	dependsOn: z.array(z.string()).default([])
-});
-/**
-* Schema for the decompose_task tool input
-*/
-const DecomposeTaskInputSchema = z.object({ tasks: z.array(DecomposedTaskSchema).min(1, "At least one task is required") });
-/**
-* TaskPipeline builds and executes a DAG of tasks with dependency ordering.
-*
-* Tasks are executed in topological order. Independent tasks at the same
-* level can be executed in parallel via the executor callback.
-*/
-var TaskPipeline = class {
-	constructor(input) {
-		this.tasks = /* @__PURE__ */ new Map();
-		for (const task of input.tasks) this.tasks.set(task.id, {
-			...task,
-			status: "pending"
-		});
-		this.validate();
-		this.executionOrder = this.topologicalSort();
-	}
-	/**
-	* Get the number of tasks in the pipeline
-	*/
-	get size() {
-		return this.tasks.size;
-	}
-	/**
-	* Get the execution levels (groups of tasks that can run in parallel)
-	*/
-	getExecutionLevels() {
-		return this.executionOrder;
-	}
-	/**
-	* Check if this pipeline contains a single task (skip pipeline overhead)
-	*/
-	isSingleTask() {
-		return this.tasks.size === 1;
-	}
-	/**
-	* Get the single task (for fallback when pipeline has only one task)
-	*/
-	getSingleTask() {
-		if (!this.isSingleTask()) throw new Error("Pipeline has more than one task");
-		return [...this.tasks.values()][0];
-	}
-	/**
-	* Execute all tasks in dependency order.
-	*
-	* Tasks within the same level are executed in parallel.
-	* Each level must complete before the next level starts.
-	* If a task fails, all transitive dependents are cascade-failed.
-	*/
-	async execute(executor) {
-		const results = /* @__PURE__ */ new Map();
-		const failedTaskIds = /* @__PURE__ */ new Set();
-		for (const level of this.executionOrder) {
-			const levelPromises = level.map(async (taskId) => {
-				const task = this.tasks.get(taskId);
-				const failedDep = task.dependsOn.find((depId) => failedTaskIds.has(depId));
-				if (failedDep) {
-					task.status = "cascade_failed";
-					task.error = `Blocked by failed dependency "${failedDep}"`;
-					failedTaskIds.add(taskId);
-					return;
-				}
-				task.status = "running";
-				const depResults = /* @__PURE__ */ new Map();
-				for (const depId of task.dependsOn) {
-					const depResult = results.get(depId);
-					if (depResult) depResults.set(depId, depResult);
-				}
-				try {
-					const result = await executor(task, depResults);
-					task.status = "completed";
-					task.result = result;
-					results.set(taskId, result);
-				} catch (error) {
-					task.status = "failed";
-					task.error = error instanceof Error ? error.message : String(error);
-					failedTaskIds.add(taskId);
-				}
-			});
-			await Promise.all(levelPromises);
-		}
-		return this.buildResult();
-	}
-	/**
-	* Validate the task graph:
-	* - All dependency references point to existing tasks
-	* - No circular dependencies
-	*/
-	validate() {
-		for (const [taskId, task] of this.tasks) for (const depId of task.dependsOn) {
-			if (!this.tasks.has(depId)) throw new Error(`Task "${taskId}" depends on unknown task "${depId}"`);
-			if (depId === taskId) throw new Error(`Task "${taskId}" cannot depend on itself`);
-		}
-		this.detectCycles();
-	}
-	/**
-	* Detect cycles in the dependency graph using iterative DFS
-	*/
-	detectCycles() {
-		const visited = /* @__PURE__ */ new Set();
-		const inStack = /* @__PURE__ */ new Set();
-		for (const taskId of this.tasks.keys()) {
-			if (visited.has(taskId)) continue;
-			const stack = [{
-				id: taskId,
-				phase: "enter"
-			}];
-			while (stack.length > 0) {
-				const { id, phase } = stack.pop();
-				if (phase === "exit") {
-					inStack.delete(id);
-					continue;
-				}
-				if (inStack.has(id)) throw new Error(`Circular dependency detected involving task "${id}"`);
-				if (visited.has(id)) continue;
-				visited.add(id);
-				inStack.add(id);
-				stack.push({
-					id,
-					phase: "exit"
-				});
-				const task = this.tasks.get(id);
-				for (const depId of task.dependsOn) {
-					if (inStack.has(depId)) throw new Error(`Circular dependency detected: "${id}" → "${depId}"`);
-					if (!visited.has(depId)) stack.push({
-						id: depId,
-						phase: "enter"
-					});
-				}
-			}
-		}
-	}
-	/**
-	* Topological sort that groups tasks into execution levels.
-	*
-	* Each level contains tasks whose dependencies are all in earlier levels.
-	* Tasks within a level can be executed in parallel.
-	*
-	* Uses Kahn's algorithm (BFS-based) for level detection.
-	*/
-	topologicalSort() {
-		const inDegree = /* @__PURE__ */ new Map();
-		const dependents = /* @__PURE__ */ new Map();
-		for (const [taskId, task] of this.tasks) {
-			inDegree.set(taskId, task.dependsOn.length);
-			for (const depId of task.dependsOn) {
-				const deps = dependents.get(depId) || [];
-				deps.push(taskId);
-				dependents.set(depId, deps);
-			}
-		}
-		const levels = [];
-		let currentLevel = [...this.tasks.keys()].filter((id) => inDegree.get(id) === 0);
-		while (currentLevel.length > 0) {
-			levels.push(currentLevel);
-			const nextLevel = [];
-			for (const taskId of currentLevel) for (const dependent of dependents.get(taskId) || []) {
-				const newDegree = inDegree.get(dependent) - 1;
-				inDegree.set(dependent, newDegree);
-				if (newDegree === 0) nextLevel.push(dependent);
-			}
-			currentLevel = nextLevel;
-		}
-		return levels;
-	}
-	/**
-	* Build the final execution result
-	*/
-	buildResult() {
-		const taskResults = [...this.tasks.values()].map((task) => ({
-			id: task.id,
-			description: task.description,
-			agentType: task.agentType,
-			status: task.status,
-			result: task.result,
-			error: task.error
-		}));
-		const completed = taskResults.filter((t) => t.status === "completed");
-		const failed = taskResults.filter((t) => t.status === "failed");
-		const cascadeFailed = taskResults.filter((t) => t.status === "cascade_failed");
-		const pending = taskResults.filter((t) => t.status === "pending");
-		const success = failed.length === 0 && cascadeFailed.length === 0 && pending.length === 0;
-		const summaryParts = [];
-		if (completed.length > 0) {
-			summaryParts.push(`## Completed Tasks (${completed.length}/${taskResults.length})\n`);
-			for (const task of completed) {
-				summaryParts.push(`### ${task.id}: ${task.description}\n`);
-				summaryParts.push(`*Agent: ${task.agentType}*\n`);
-				if (task.result) {
-					const maxLen = 800;
-					const truncated = task.result.length > maxLen ? task.result.slice(0, maxLen) + "\n...(truncated)" : task.result;
-					summaryParts.push(truncated);
-				}
-				summaryParts.push("");
-			}
-		}
-		if (failed.length > 0) {
-			summaryParts.push(`## Failed Tasks (${failed.length})\n`);
-			for (const task of failed) {
-				summaryParts.push(`### ${task.id}: ${task.description}\n`);
-				summaryParts.push(`*Agent: ${task.agentType}*\n`);
-				summaryParts.push(`**Error:** ${task.error}\n`);
-			}
-		}
-		if (cascadeFailed.length > 0) {
-			summaryParts.push(`## Cascade-Failed Tasks (${cascadeFailed.length})\n`);
-			for (const task of cascadeFailed) summaryParts.push(`- ${task.id}: ${task.description} — ${task.error}\n`);
-		}
-		if (pending.length > 0) {
-			summaryParts.push(`## Skipped Tasks (${pending.length})\n`);
-			for (const task of pending) summaryParts.push(`- ${task.id}: ${task.description}\n`);
-		}
-		return {
-			success,
-			taskResults,
-			summary: summaryParts.join("\n")
-		};
-	}
-};
-//#endregion
 //#region src/agents/decomposeTaskTool.ts
 /**
 * Create the decompose_task tool for the coordinator agent.
@@ -26499,6 +26418,87 @@ Tasks at the same dependency level run in parallel.
 	};
 }
 //#endregion
+//#region src/agents/TaskPipeline.ts
+/**
+* In-process DAG executor for the CLI.
+*
+* Validates the DAG via the shared validator, then runs each level
+* concurrently with `Promise.all`. The web's equivalent dispatches
+* each node to its own Lambda — see `coordinateTask.ts` for that path.
+*
+* Note: this executor honors `cascade` only; an `isolate` task that fails
+* still cascades in the CLI today. The web executor implements both.
+*/
+var TaskPipeline = class {
+	constructor(input) {
+		this.tasks = /* @__PURE__ */ new Map();
+		for (const task of input.tasks) this.tasks.set(task.id, {
+			...task,
+			status: "pending"
+		});
+		this.executionOrder = validateAndSort(input);
+	}
+	get size() {
+		return this.tasks.size;
+	}
+	getExecutionLevels() {
+		return this.executionOrder;
+	}
+	isSingleTask() {
+		return this.tasks.size === 1;
+	}
+	getSingleTask() {
+		if (!this.isSingleTask()) throw new Error("Pipeline has more than one task");
+		return [...this.tasks.values()][0];
+	}
+	/**
+	* Execute all tasks in dependency order.
+	* Tasks within the same level run in parallel; failed dependencies
+	* cascade to dependents.
+	*/
+	async execute(executor) {
+		const results = /* @__PURE__ */ new Map();
+		const failedTaskIds = /* @__PURE__ */ new Set();
+		for (const level of this.executionOrder) {
+			const levelPromises = level.map(async (taskId) => {
+				const task = this.tasks.get(taskId);
+				const failedDep = task.dependsOn.find((depId) => failedTaskIds.has(depId));
+				if (failedDep) {
+					task.status = "cascade_failed";
+					task.error = `Blocked by failed dependency "${failedDep}"`;
+					failedTaskIds.add(taskId);
+					return;
+				}
+				task.status = "running";
+				const depResults = /* @__PURE__ */ new Map();
+				for (const depId of task.dependsOn) {
+					const depResult = results.get(depId);
+					if (depResult) depResults.set(depId, depResult);
+				}
+				try {
+					const result = await executor(task, depResults);
+					task.status = "completed";
+					task.result = result;
+					results.set(taskId, result);
+				} catch (error) {
+					task.status = "failed";
+					task.error = error instanceof Error ? error.message : String(error);
+					failedTaskIds.add(taskId);
+				}
+			});
+			await Promise.all(levelPromises);
+		}
+		return buildPipelineResult([...this.tasks.values()].map((t) => ({
+			id: t.id,
+			description: t.description,
+			agentType: t.agentType,
+			status: t.status,
+			result: t.result,
+			error: t.error
+		})));
+	}
+};
+//#endregion
 //#region src/agents/SharedAgentContext.ts
 /**
 * SharedAgentContext — a namespaced key-value store for inter-agent communication.

package/dist/updateChecker-C8xsNY2L.mjs

@@ -0,0 +1,218 @@
+#!/usr/bin/env node
+import { execSync } from "child_process";
+import { constants, promises } from "fs";
+import { homedir } from "os";
+import path from "path";
+import axios from "axios";
+//#region src/utils/updateChecker.ts
+/**
+* Update checker utility for B4M CLI
+* Checks the NPM registry for newer versions and caches results.
+* Used by the startup banner, `b4m update`, and `b4m doctor` commands.
+*/
+const CACHE_FILE = path.join(homedir(), ".bike4mind", "update-check.json");
+const CACHE_TTL_MS = 1440 * 60 * 1e3;
+const NPM_REGISTRY_URL = "https://registry.npmjs.org/@bike4mind/cli/latest";
+const FETCH_TIMEOUT_MS = 5e3;
+/**
+* Canonical global-install command for the CLI.
+* Single source of truth shared by the manual `b4m update` path and the
+* auto-update-on-launch bootstrap so they can never drift.
+*/
+const INSTALL_CMD = "npm install -g @bike4mind/cli@latest";
+/**
+* Env var set on the re-exec'd child after an auto-update so it skips the
+* update block and can't loop. Single source of truth for both the reader
+* (shouldAttemptAutoUpdate) and the writer (maybeAutoUpdateOnLaunch).
+*/
+const REEXEC_GUARD_ENV = "B4M_UPDATED_REEXEC";
+/**
+* Check whether the global npm prefix is writable by the current user.
+* When it isn't (e.g. Homebrew/system node), `npm install -g` needs sudo —
+* which an unattended auto-updater cannot provide — so callers should fall
+* back to a manual-update notice instead of attempting a silent install.
+* Non-throwing — returns false on any error.
+*
+* Pass `prefix` to reuse an already-resolved `npm config get prefix` (each
+* `execSync` is ~50-200ms); omit it and the prefix is resolved internally.
+*/
+async function isNpmPrefixWritable(prefix) {
+	try {
+		const resolved = prefix ?? execSync("npm config get prefix", {
+			encoding: "utf-8",
+			timeout: 1e4
+		}).trim();
+		if (!resolved) return false;
+		await promises.access(resolved, constants.W_OK);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Cheap, synchronous pre-checks gating auto-update-on-launch. Excludes the
+* async config-file and network lookups so it stays easy to unit-test.
+* Returns false (skip the update) when already re-exec'd this launch, opted
+* out via env, or not attached to an interactive TTY.
+*/
+function shouldAttemptAutoUpdate(opts) {
+	const env = opts.env ?? process.env;
+	if (env["B4M_UPDATED_REEXEC"] === "1") return false;
+	if (env.B4M_AUTO_UPDATE === "0") return false;
+	if (!opts.isTTY) return false;
+	return true;
+}
+const CONFIG_FILE = path.join(homedir(), ".bike4mind", "config.json");
+/**
+* Read the user's tri-state `autoUpdate` preference from the global config.
+* Kept deliberately lightweight (no Zod / ConfigStore) because it runs in the
+* bin bootstrap before the app loads. Defaults to `'ask'` (consent-first) when
+* the file or flag is absent/unreadable.
+*/
+async function getAutoUpdatePreference() {
+	try {
+		const raw = await promises.readFile(CONFIG_FILE, "utf-8");
+		const value = JSON.parse(raw)?.preferences?.autoUpdate;
+		if (value === true) return "auto";
+		if (value === false) return "never";
+		return "ask";
+	} catch {
+		return "ask";
+	}
+}
+/**
+* Persist the user's `autoUpdate` choice (`true` = always, `false` = never).
+*
+* Writes the **global** config file directly — the mirror of how
+* `getAutoUpdatePreference()` reads it — rather than routing through
+* `ConfigStore.save()`. `ConfigStore.load()` merges global → project → local,
+* and `ConfigStore.save()` writes that merged result back to the global path;
+* answering "Always"/"Never" inside a project would therefore bake the
+* project's other overrides (model, theme, temperature, …) into the user's
+* global config as a silent side effect. This call fires during the bin
+* bootstrap any time an update is available, so that blast radius is
+* unacceptable. A direct read-merge-write of only `preferences.autoUpdate`
+* avoids it. If the on-disk file is schema-incomplete, the next
+* `ConfigStore.load()` backfills defaults harmlessly — exactly as
+* `getAutoUpdatePreference` already tolerates a partial file. Best-effort:
+* a failure is swallowed (we simply ask again next launch rather than blocking).
+*/
+async function setAutoUpdatePreference(value) {
+	try {
+		let raw = {};
+		try {
+			const parsed = JSON.parse(await promises.readFile(CONFIG_FILE, "utf-8"));
+			if (parsed && typeof parsed === "object") raw = parsed;
+		} catch {}
+		const prefs = raw.preferences && typeof raw.preferences === "object" ? raw.preferences : {};
+		raw.preferences = {
+			...prefs,
+			autoUpdate: value
+		};
+		await promises.mkdir(path.dirname(CONFIG_FILE), { recursive: true });
+		await promises.writeFile(CONFIG_FILE, JSON.stringify(raw, null, 2), "utf-8");
+		await promises.chmod(CONFIG_FILE, 384);
+	} catch {}
+}
+/**
+* Compare two semver strings (MAJOR.MINOR.PATCH).
+* Returns -1 if a < b, 0 if equal, 1 if a > b.
+*/
+function compareSemver(a, b) {
+	const partsA = a.split(".").map(Number);
+	const partsB = b.split(".").map(Number);
+	for (let i = 0; i < 3; i++) {
+		const segA = partsA[i] ?? 0;
+		const segB = partsB[i] ?? 0;
+		if (segA < segB) return -1;
+		if (segA > segB) return 1;
+	}
+	return 0;
+}
+/**
+* Fetch the latest published version from the NPM registry.
+* Returns the version string or null on any error.
+*/
+async function fetchLatestVersion() {
+	try {
+		const version = (await axios.get(NPM_REGISTRY_URL, {
+			timeout: FETCH_TIMEOUT_MS,
+			headers: { Accept: "application/json" }
+		})).data?.version;
+		return typeof version === "string" ? version : null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Read the cached update check result.
+*/
+async function readCache() {
+	try {
+		const data = await promises.readFile(CACHE_FILE, "utf-8");
+		const parsed = JSON.parse(data);
+		if (parsed && typeof parsed.lastChecked === "string" && typeof parsed.latestVersion === "string" && typeof parsed.currentVersion === "string") return parsed;
+		return null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Write the update check result to cache.
+*/
+async function writeCache(cache) {
+	try {
+		await promises.mkdir(path.dirname(CACHE_FILE), { recursive: true });
+		await promises.writeFile(CACHE_FILE, JSON.stringify(cache, null, 2), "utf-8");
+	} catch {}
+}
+/**
+* Check for updates using cache when fresh.
+* Non-throwing — returns null on any error.
+*/
+async function checkForUpdate(currentVersion) {
+	try {
+		const cache = await readCache();
+		if (cache && cache.currentVersion === currentVersion) {
+			if (Date.now() - new Date(cache.lastChecked).getTime() < CACHE_TTL_MS) return {
+				currentVersion,
+				latestVersion: cache.latestVersion,
+				updateAvailable: compareSemver(cache.latestVersion, currentVersion) > 0
+			};
+		}
+		const latestVersion = await fetchLatestVersion();
+		if (!latestVersion) return null;
+		await writeCache({
+			lastChecked: (/* @__PURE__ */ new Date()).toISOString(),
+			latestVersion,
+			currentVersion
+		});
+		return {
+			currentVersion,
+			latestVersion,
+			updateAvailable: compareSemver(latestVersion, currentVersion) > 0
+		};
+	} catch {
+		return null;
+	}
+}
+/**
+* Force-check for updates (ignores cache).
+* Used by `b4m update` and `b4m doctor`.
+*/
+async function forceCheckForUpdate(currentVersion) {
+	const latestVersion = await fetchLatestVersion();
+	if (!latestVersion) return null;
+	await writeCache({
+		lastChecked: (/* @__PURE__ */ new Date()).toISOString(),
+		latestVersion,
+		currentVersion
+	});
+	return {
+		currentVersion,
+		latestVersion,
+		updateAvailable: compareSemver(latestVersion, currentVersion) > 0
+	};
+}
+//#endregion
+export { fetchLatestVersion as a, isNpmPrefixWritable as c, compareSemver as i, setAutoUpdatePreference as l, REEXEC_GUARD_ENV as n, forceCheckForUpdate as o, checkForUpdate as r, getAutoUpdatePreference as s, INSTALL_CMD as t, shouldAttemptAutoUpdate as u };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bike4mind/cli",
-  "version": "0.12.1",
+  "version": "0.14.0",
   "type": "module",
   "description": "Interactive CLI tool for Bike4Mind with ReAct agents",
   "license": "UNLICENSED",
@@ -107,8 +107,8 @@
     "zod": "^4.4.3",
     "zod-validation-error": "^5.0.0",
     "zustand": "^5.0.13",
-    "@bike4mind/fab-pipeline": "0.2.9",
-    "@bike4mind/llm-adapters": "0.3.4",
+    "@bike4mind/fab-pipeline": "0.2.10",
+    "@bike4mind/llm-adapters": "0.3.5",
     "@bike4mind/observability": "0.1.0"
   },
   "devDependencies": {
@@ -124,11 +124,11 @@
     "tsx": "^4.22.3",
     "typescript": "^5.9.3",
     "vitest": "^4.1.7",
-    "@bike4mind/agents": "0.11.8",
-    "@bike4mind/common": "2.107.0",
-    "@bike4mind/mcp": "1.37.22",
-    "@bike4mind/services": "2.92.2",
-    "@bike4mind/utils": "2.23.10"
+    "@bike4mind/agents": "0.13.0",
+    "@bike4mind/common": "2.107.1",
+    "@bike4mind/mcp": "1.37.23",
+    "@bike4mind/services": "0.0.0-changeset-release-main-20260609021710",
+    "@bike4mind/utils": "2.23.11"
   },
   "optionalDependencies": {
     "@vscode/ripgrep": "^1.18.0"

package/dist/updateChecker-D67NPlS5.mjs

@@ -1,117 +0,0 @@
-#!/usr/bin/env node
-import { promises } from "fs";
-import { homedir } from "os";
-import path from "path";
-import axios from "axios";
-//#region src/utils/updateChecker.ts
-/**
-* Update checker utility for B4M CLI
-* Checks the NPM registry for newer versions and caches results.
-* Used by the startup banner, `b4m update`, and `b4m doctor` commands.
-*/
-const CACHE_FILE = path.join(homedir(), ".bike4mind", "update-check.json");
-const CACHE_TTL_MS = 1440 * 60 * 1e3;
-const NPM_REGISTRY_URL = "https://registry.npmjs.org/@bike4mind/cli/latest";
-const FETCH_TIMEOUT_MS = 5e3;
-/**
-* Compare two semver strings (MAJOR.MINOR.PATCH).
-* Returns -1 if a < b, 0 if equal, 1 if a > b.
-*/
-function compareSemver(a, b) {
-	const partsA = a.split(".").map(Number);
-	const partsB = b.split(".").map(Number);
-	for (let i = 0; i < 3; i++) {
-		const segA = partsA[i] ?? 0;
-		const segB = partsB[i] ?? 0;
-		if (segA < segB) return -1;
-		if (segA > segB) return 1;
-	}
-	return 0;
-}
-/**
-* Fetch the latest published version from the NPM registry.
-* Returns the version string or null on any error.
-*/
-async function fetchLatestVersion() {
-	try {
-		const version = (await axios.get(NPM_REGISTRY_URL, {
-			timeout: FETCH_TIMEOUT_MS,
-			headers: { Accept: "application/json" }
-		})).data?.version;
-		return typeof version === "string" ? version : null;
-	} catch {
-		return null;
-	}
-}
-/**
-* Read the cached update check result.
-*/
-async function readCache() {
-	try {
-		const data = await promises.readFile(CACHE_FILE, "utf-8");
-		const parsed = JSON.parse(data);
-		if (parsed && typeof parsed.lastChecked === "string" && typeof parsed.latestVersion === "string" && typeof parsed.currentVersion === "string") return parsed;
-		return null;
-	} catch {
-		return null;
-	}
-}
-/**
-* Write the update check result to cache.
-*/
-async function writeCache(cache) {
-	try {
-		await promises.mkdir(path.dirname(CACHE_FILE), { recursive: true });
-		await promises.writeFile(CACHE_FILE, JSON.stringify(cache, null, 2), "utf-8");
-	} catch {}
-}
-/**
-* Check for updates using cache when fresh.
-* Non-throwing — returns null on any error.
-*/
-async function checkForUpdate(currentVersion) {
-	try {
-		const cache = await readCache();
-		if (cache && cache.currentVersion === currentVersion) {
-			if (Date.now() - new Date(cache.lastChecked).getTime() < CACHE_TTL_MS) return {
-				currentVersion,
-				latestVersion: cache.latestVersion,
-				updateAvailable: compareSemver(cache.latestVersion, currentVersion) > 0
-			};
-		}
-		const latestVersion = await fetchLatestVersion();
-		if (!latestVersion) return null;
-		await writeCache({
-			lastChecked: (/* @__PURE__ */ new Date()).toISOString(),
-			latestVersion,
-			currentVersion
-		});
-		return {
-			currentVersion,
-			latestVersion,
-			updateAvailable: compareSemver(latestVersion, currentVersion) > 0
-		};
-	} catch {
-		return null;
-	}
-}
-/**
-* Force-check for updates (ignores cache).
-* Used by `b4m update` and `b4m doctor`.
-*/
-async function forceCheckForUpdate(currentVersion) {
-	const latestVersion = await fetchLatestVersion();
-	if (!latestVersion) return null;
-	await writeCache({
-		lastChecked: (/* @__PURE__ */ new Date()).toISOString(),
-		latestVersion,
-		currentVersion
-	});
-	return {
-		currentVersion,
-		latestVersion,
-		updateAvailable: compareSemver(latestVersion, currentVersion) > 0
-	};
-}
-//#endregion
-export { forceCheckForUpdate as i, compareSemver as n, fetchLatestVersion as r, checkForUpdate as t };