@bike4mind/cli 0.15.3 → 0.16.0

package/README.md

@@ -578,6 +578,55 @@ Coming soon:
 ⏳ Session search and management
 ⏳ Tool execution monitoring
 
+## Running as a `claude` engine inside a host app
+
+The CLI can be driven by a host app (e.g. a kanban-style agent pipeline) as a
+drop-in replacement for `claude` — running a pipeline **stage** or a **board AI /
+YAML** pane with full parity (board tools over HTTP MCP, the 3-layer brief
+injected, the spec auto-fired on turn 1, and the live-card `processing` /
+`action_required` / `ready` signal).
+
+A host that only launches an engine whose executable basename is exactly `claude`
+can be pointed at a **symlink** named `claude`:
+
+```bash
+# Create a claude-named symlink to the CLI entry point somewhere on disk:
+ln -s "$(pwd)/apps/cli/bin/bike4mind-cli.mjs" /usr/local/bin/claude-b4m/claude
+
+# In the host, set the engine's `terminal_command` to that symlink path:
+#   /usr/local/bin/claude-b4m/claude
+```
+
+Use a **direct symlink** whose basename is `claude` — not a `package.json` bin
+alias (it would shadow the real `claude`) and not a wrapper shell script (argv
+gets mangled). No other setup is required; the CLI replicates claude's launch-flag
+and lifecycle-hook contract.
+
+### Supported claude-compatible flags
+
+These are parsed in `bin/bike4mind-cli.mjs` into `B4M_*` env vars consumed by the
+runtime. Unknown flags are tolerated (never hard-error) and the interactive TUI is
+preserved (a positional prompt seeds **and** submits turn 1 without switching to
+headless `-p`):
+
+| Flag | Effect |
+| --- | --- |
+| `--mcp-config <file>` | Inject MCP servers from a claude-shape JSON (`{ "mcpServers": {...} }`). Supports HTTP transport (`type: "http"`, `url`, `headers`) with per-launch Bearer auth. |
+| `--strict-mcp-config` | Use ONLY `--mcp-config` servers; ignore file-config and `.mcp.json` (board YAML pane). |
+| `--append-system-prompt <text>` | Append text verbatim to the end of the system prompt (the 3-layer brief). |
+| `--allowedTools <patterns>` | Auto-approve matching tools without a permission prompt (glob `mcp__manifold__*` or a space-separated explicit list). |
+| `--settings <json>` | Inline JSON; the `hooks` subset drives lifecycle hooks (see below). Malformed JSON is ignored, never fatal. |
+| `--session-id <uuid>` / `--resume <uuid>` | Pin / resume a session (board pane). `/clear` and `/compact` keep the pinned uuid; a bad `--resume` prints `No conversation found with session ID <uuid>` and exits non-zero so the host can self-heal the pane. |
+| `<positional prompt>` | Seeds and auto-fires turn 1 while staying interactive. |
+
+### Lifecycle hooks (`--settings.hooks`)
+
+Mirrors claude's hook contract for the host's `action_required` signal: a
+`Notification`/`permission_prompt` command writes a sentinel file while an
+interactive permission prompt blocks; `PostToolUse` / `Stop` / `UserPromptSubmit`
+commands remove it. Each hook command runs via a real shell with its stdin piped
+then closed (EOF), so a blocking `cat > <file>` hook returns immediately.
+
 ## License
 
 Private - Bike4Mind

package/bin/bike4mind-cli.mjs

@@ -111,6 +111,39 @@ const argv = await yargs(hideBin(process.argv))
     type: 'string',
     description: 'Add local Ollama models to the model picker (e.g. http://localhost:11434)',
   })
+  // ─── claude-compatible flags (host drop-in masquerade) ──────────────────────
+  // Declared so a host's claude launch flags parse into named options instead of
+  // leaking into the positional `argv._` task. See apps/cli README "host app".
+  .option('mcp-config', {
+    type: 'string',
+    description: 'Path to a JSON file of MCP servers to inject ({ "mcpServers": {...} })',
+  })
+  .option('strict-mcp-config', {
+    type: 'boolean',
+    description: 'Use ONLY --mcp-config servers; ignore file-config and .mcp.json',
+    default: false,
+  })
+  .option('append-system-prompt', {
+    type: 'string',
+    description: 'Text appended verbatim to the end of the composed system prompt',
+  })
+  .option('allowedTools', {
+    type: 'array',
+    string: true,
+    description: 'Tool names/globs auto-approved without a permission prompt (e.g. mcp__manifold__*)',
+  })
+  .option('settings', {
+    type: 'string',
+    description: 'Inline JSON settings (currently: lifecycle hooks) merged over user config',
+  })
+  .option('session-id', {
+    type: 'string',
+    description: 'Pin this session to a fixed uuid (first launch of a resumable pane)',
+  })
+  .option('resume', {
+    type: 'string',
+    description: 'Resume an existing session by uuid',
+  })
   .option('api-url', {
     type: 'string',
     description: 'Set a custom API URL (self-hosted instance) and clear auth tokens, then exit',
@@ -197,6 +230,39 @@ if (argv['ollama-host']) {
   process.env.B4M_OLLAMA_HOST = argv['ollama-host'];
 }
 
+// ─── claude-compatible flags → B4M_* env (read by src/index.tsx init) ─────────
+// Mirrors the established bin→env→init channel (cf. --add-dir → B4M_ADDITIONAL_DIRS).
+if (argv['mcp-config']) {
+  process.env.B4M_MCP_CONFIG_FILE = resolve(argv['mcp-config']);
+}
+if (argv['strict-mcp-config']) {
+  process.env.B4M_STRICT_MCP_CONFIG = '1';
+}
+if (argv['append-system-prompt']) {
+  process.env.B4M_APPEND_SYSTEM_PROMPT = argv['append-system-prompt'];
+}
+if (argv.allowedTools && argv.allowedTools.length > 0) {
+  // Each element may itself be a space-separated list (the host's board pane passes
+  // "a b c" as a single argv token); flatten on whitespace into discrete patterns.
+  const patterns = argv.allowedTools.flatMap((s) => String(s).split(/\s+/)).filter(Boolean);
+  process.env.B4M_ALLOWED_TOOLS = JSON.stringify(patterns);
+}
+if (argv.settings) {
+  process.env.B4M_SETTINGS_JSON = argv.settings;
+}
+if (argv['session-id']) {
+  process.env.B4M_SESSION_ID = argv['session-id'];
+}
+if (argv.resume) {
+  process.env.B4M_RESUME_ID = argv.resume;
+}
+// Positional task (claude `<prompt>` form): seeds AND submits turn 1, stays interactive.
+// Only when it's not a known subcommand and headless -p wasn't used.
+const KNOWN_SUBCOMMANDS = new Set(['mcp', 'update', 'doctor']);
+if (argv.prompt === undefined && argv._.length > 0 && !KNOWN_SUBCOMMANDS.has(String(argv._[0]))) {
+  process.env.B4M_INITIAL_PROMPT = String(argv._[0]);
+}
+
 // Auto-detect environment: prefer production mode when dist exists
 const distPath = join(__dirname, '../dist/index.mjs');
 const srcPath = join(__dirname, '../src/index.tsx');

package/dist/{ConfigStore-D4gALtkZ.mjs → ConfigStore-CtGc4fF2.mjs}

@@ -291,9 +291,6 @@ let ImageModels = /* @__PURE__ */ function(ImageModels) {
 	ImageModels["FLUX_PRO_1_1"] = "flux-pro-1.1";
 	ImageModels["FLUX_PRO_ULTRA"] = "flux-pro-1.1-ultra";
 	ImageModels["FLUX_PRO_FILL"] = "flux-pro-1.0-fill";
-	ImageModels["FLUX_PRO_CANNY"] = "flux-pro-1.0-canny";
-	ImageModels["FLUX_PRO_DEPTH"] = "flux-pro-1.0-depth";
-	ImageModels["FLUX_DEV"] = "flux-dev";
 	ImageModels["FLUX_KONTEXT_PRO"] = "flux-kontext-pro";
 	ImageModels["FLUX_KONTEXT_MAX"] = "flux-kontext-max";
 	ImageModels["GROK_IMAGINE_IMAGE_QUALITY"] = "grok-imagine-image-quality";
@@ -2663,7 +2660,8 @@ const AgentCompletedAction = z.object({
 	executionId: z.string(),
 	answer: z.string().optional(),
 	totalIterations: z.number(),
-	totalCreditsUsed: z.number()
+	totalCreditsUsed: z.number(),
+	mementoIds: z.array(z.string()).optional()
 });
 const AgentFailedAction = z.object({
 	action: z.literal("failed"),
@@ -3615,10 +3613,26 @@ const OpenAIImageStyleSchema = z.enum(["vivid", "natural"]);
 /**
 * Maps legacy/removed image model IDs to their current replacements.
 * Prevents Zod validation failures when clients send stale persisted model names.
+*
+* Values are constrained to `ALL_IMAGE_MODELS` so a remap target can never point at
+* a model that the schema would itself reject. If a target model is later retired,
+* re-point its entry to the current replacement rather than deleting it — clients may
+* still hold the legacy key in persisted state. When adding an entry, bump the
+* `llm-settings` persist `version` in LLMContext so existing clients re-run the remap.
+*
+* Only `flux-dev` is aliased among the recently removed Flux ids. It was a general
+* text-to-image model with a confirmed stale client (#8853), so remapping to the
+* current BFL standard is safe and faithful. `flux-pro-1.0-canny` and
+* `flux-pro-1.0-depth` are intentionally left as hard validation errors: they were
+* never UI-selectable (nothing persists them, and no alerts show callers sending them)
+* and they are structural-control models — silently remapping them to a plain
+* text-to-image model would drop the control image and return the wrong kind of result,
+* so a clear "unsupported model" error is the more honest response.
 */
 const LEGACY_IMAGE_MODEL_MAP = {
 	"dall-e-3": "gpt-image-1",
-	"dall-e-2": "gpt-image-1"
+	"dall-e-2": "gpt-image-1",
+	"flux-dev": "flux-pro-1.1"
 };
 const OpenAIImageGenerationInput = z.object({
 	prompt: z.string(),
@@ -3829,6 +3843,8 @@ z.enum([
 	"logoSettings",
 	"enforceCredits",
 	"enableTeamPlan",
+	"allowOpenRegistration",
+	"defaultFreeCredits",
 	"enableGoogleCalendar",
 	"googleCalendarServiceAccountEmail",
 	"googleCalendarServiceAccountSecret",
@@ -5765,6 +5781,22 @@ const settingsMap = {
 		group: API_SERVICE_GROUPS.CREDITS.id,
 		category: "Users"
 	}),
+	allowOpenRegistration: makeBooleanSetting({
+		key: "allowOpenRegistration",
+		name: "Allow Open Registration",
+		defaultValue: false,
+		description: "Master switch for self-serve signup. When OFF (default), a valid invite code is required to register. When ON, users may register without an invite code; the Default Free Credits grant is then applied after they verify their email (anti-spam — see Default Free Credits). Safe to enable: the pre-request credit reservation caps every free user at the credits they are granted.",
+		group: API_SERVICE_GROUPS.CREDITS.id,
+		category: "Users"
+	}),
+	defaultFreeCredits: makeNumberSetting({
+		key: "defaultFreeCredits",
+		name: "Default Free Credits",
+		defaultValue: 0,
+		description: "Credits granted to a user who registers WITHOUT an invite code (only applies when Allow Open Registration is ON). Granted after the user verifies their email, NOT at signup — an unverified throwaway account gets 0 credits (anti-spam). A free user can never spend more than this — their hard ceiling of real model cost is roughly credits ÷ 1500 USD.",
+		group: API_SERVICE_GROUPS.CREDITS.id,
+		category: "Users"
+	}),
 	FacebookLink: makeStringSetting({
 		key: "FacebookLink",
 		name: "Facebook Link",
@@ -10238,11 +10270,32 @@ const ApiConfigSchema = z.object({ customUrl: z.url().optional() });
 */
 const McpServerSchema = z.object({
 	name: z.string(),
+	type: z.enum(["stdio", "http"]).optional(),
 	command: z.string().optional(),
 	args: z.array(z.string()).optional(),
+	url: z.string().optional(),
+	headers: z.record(z.string(), z.string()).optional(),
 	env: z.record(z.string(), z.string()).prefault({}),
 	enabled: z.boolean().prefault(true)
-});
+}).superRefine(mcpServerTransportRefine);
+/**
+* A valid MCP server is exactly one of:
+*  - stdio: has `command` (spawned child process)
+*  - http:  has `url` (streamable-HTTP endpoint)
+* Rejecting malformed configs at parse time (not connect time) surfaces errors early.
+*/
+function mcpServerTransportRefine(server, ctx) {
+	const hasCommand = typeof server.command === "string" && server.command.trim() !== "";
+	const hasUrl = typeof server.url === "string" && server.url.trim() !== "";
+	if (hasCommand && hasUrl) ctx.addIssue({
+		code: "custom",
+		message: "MCP server cannot set both \"command\" (stdio) and \"url\" (http)"
+	});
+	else if (!hasCommand && !hasUrl) ctx.addIssue({
+		code: "custom",
+		message: "MCP server must set either \"command\" (stdio) or \"url\" (http)"
+	});
+}
 /**
 * MCP Servers can be specified in two formats:
 * 1. Array format (B4M native): [{ "name": "...", "command": "...", ... }]
@@ -10251,11 +10304,14 @@ const McpServerSchema = z.object({
 * Both formats are supported for maximum flexibility and compatibility.
 */
 const McpServersSchema = z.union([z.array(McpServerSchema), z.record(z.string(), z.object({
+	type: z.enum(["stdio", "http"]).optional(),
 	command: z.string().optional(),
 	args: z.array(z.string()).optional(),
+	url: z.string().optional(),
+	headers: z.record(z.string(), z.string()).optional(),
 	env: z.record(z.string(), z.string()).optional(),
 	enabled: z.boolean().optional()
-}))]);
+}).superRefine(mcpServerTransportRefine))]);
 /**
 * Normalize MCP servers to internal array format
 * Accepts both array and object formats
@@ -10263,15 +10319,21 @@ const McpServersSchema = z.union([z.array(McpServerSchema), z.record(z.string(),
 function normalizeMcpServers(servers) {
 	if (Array.isArray(servers)) return servers.map((server) => ({
 		name: server.name,
+		type: server.type,
 		command: server.command,
 		args: server.args,
+		url: server.url,
+		headers: server.headers,
 		env: server.env || {},
 		enabled: server.enabled ?? true
 	}));
 	else return Object.entries(servers).map(([name, config]) => ({
 		name,
+		type: config.type,
 		command: config.command,
 		args: config.args,
+		url: config.url,
+		headers: config.headers,
 		env: config.env || {},
 		enabled: config.enabled ?? true
 	}));
@@ -10503,6 +10565,29 @@ async function loadMcpJsonConfig(projectDir) {
 	}
 }
 /**
+* Load an explicit `--mcp-config <file>` (claude shape: `{ "mcpServers": {...} }`).
+* Unlike `.mcp.json` this is an absolute path passed at launch, not project-relative.
+* Returns null on missing/malformed file (a bad config must not brick the launch).
+*/
+async function loadMcpConfigFile(filePath) {
+	try {
+		const data = await promises.readFile(filePath, "utf-8");
+		const rawConfig = JSON.parse(data);
+		return normalizeMcpServers(McpJsonConfigSchema.parse(rawConfig).mcpServers);
+	} catch (error) {
+		if (error.code === "ENOENT") {
+			console.error(`--mcp-config file not found: ${filePath}`);
+			return null;
+		}
+		if (error instanceof z.ZodError) {
+			console.error("--mcp-config validation error:", error.issues);
+			return null;
+		}
+		console.error("Failed to load --mcp-config file:", error);
+		return null;
+	}
+}
+/**
 * Merge MCP servers from multiple configs
 * Later configs can override earlier ones by name
 */
@@ -10684,6 +10769,12 @@ var ConfigStore = class {
 			} else this.projectConfigDir = null;
 			const mergedConfig = mergeConfigs(globalConfig, projectConfig, projectLocalConfig);
 			if (mcpJsonServers && mcpJsonServers.length > 0) mergedConfig.mcpServers = mergeMcpServers(mcpJsonServers, mergedConfig.mcpServers);
+			const mcpConfigFile = process.env.B4M_MCP_CONFIG_FILE;
+			if (mcpConfigFile) {
+				const injected = await loadMcpConfigFile(mcpConfigFile);
+				if (process.env.B4M_STRICT_MCP_CONFIG === "1") mergedConfig.mcpServers = injected ?? [];
+				else if (injected) mergedConfig.mcpServers = mergeMcpServers(mergedConfig.mcpServers, injected);
+			}
 			this.config = mergedConfig;
 			return this.config;
 		} catch (error) {

package/dist/commands/apiCommand.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as ConfigStore } from "../ConfigStore-D4gALtkZ.mjs";
+import { t as ConfigStore } from "../ConfigStore-CtGc4fF2.mjs";
 //#region src/commands/apiCommand.ts
 /**
 * External API config command (--api-url / --reset-api)

package/dist/commands/doctorCommand.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as version } from "../package-CfGv2cC5.mjs";
+import { t as version } from "../package-3pouvthv.mjs";
 import { a as fetchLatestVersion, c as isNpmPrefixWritable, i as compareSemver } from "../updateChecker-C8xsNY2L.mjs";
 import { t as checkRipgrep } from "../ripgrepCheck-BmkyTK2i.mjs";
 import { execSync } from "child_process";

package/dist/commands/envCommand.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as ConfigStore } from "../ConfigStore-D4gALtkZ.mjs";
+import { t as ConfigStore } from "../ConfigStore-CtGc4fF2.mjs";
 //#region src/commands/envCommand.ts
 /**
 * Environment switching for the `--dev` / `--prod` launch flags.

package/dist/commands/headlessCommand.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { C as WebSocketToolExecutor, D as ServerLlmBackend, E as WebSocketLlmBackend, F as generateCliTools, G as buildSystemPrompt, J as ReActAgent, N as loadContextFiles, P as PermissionManager, Q as SessionStore, S as ApiClient, T as FallbackLlmBackend, U as setWebSocketToolExecutor, X as CheckpointStore, Y as CustomCommandStore, _ as createAgentDelegateTool, b as createSkillTool, d as createFindDefinitionTool, f as createTodoStore, g as BackgroundAgentManager, h as createBackgroundAgentTools, k as McpManager, m as createCoordinateTaskTool, p as createWriteTodosTool, q as isReadOnlyTool, u as createGetFileStructureTool, v as AgentStore, w as WebSocketConnectionManager, y as SubagentOrchestrator } from "../tools-GgAy5rmD.mjs";
-import { n as logger, r as getApiUrl, t as ConfigStore } from "../ConfigStore-D4gALtkZ.mjs";
+import { $ as SessionStore, C as WebSocketToolExecutor, D as ServerLlmBackend, E as WebSocketLlmBackend, F as generateCliTools, J as isReadOnlyTool, K as buildSystemPrompt, N as loadContextFiles, P as PermissionManager, S as ApiClient, T as FallbackLlmBackend, W as setWebSocketToolExecutor, X as CustomCommandStore, Y as ReActAgent, Z as CheckpointStore, _ as createAgentDelegateTool, b as createSkillTool, d as createFindDefinitionTool, f as createTodoStore, g as BackgroundAgentManager, h as createBackgroundAgentTools, k as McpManager, m as createCoordinateTaskTool, p as createWriteTodosTool, u as createGetFileStructureTool, v as AgentStore, w as WebSocketConnectionManager, y as SubagentOrchestrator } from "../tools-D9eSRR7Q.mjs";
+import { n as logger, r as getApiUrl, t as ConfigStore } from "../ConfigStore-CtGc4fF2.mjs";
 import { t as DEFAULT_SANDBOX_CONFIG } from "../types-LyRNHOiS.mjs";
 import { t as createSandboxRuntime } from "../SandboxRuntimeAdapter-ChGlxSGQ.mjs";
 import { t as SandboxOrchestrator } from "../SandboxOrchestrator-BoINxbX4.mjs";

package/dist/commands/mcpCommand.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as ConfigStore } from "../ConfigStore-D4gALtkZ.mjs";
+import { t as ConfigStore } from "../ConfigStore-CtGc4fF2.mjs";
 //#region src/commands/mcpCommand.ts
 /**
 * External MCP commands (b4m mcp list, b4m mcp add, etc.)

package/dist/commands/updateCommand.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as version } from "../package-CfGv2cC5.mjs";
+import { t as version } from "../package-3pouvthv.mjs";
 import { c as isNpmPrefixWritable, l as setAutoUpdatePreference, n as REEXEC_GUARD_ENV, o as forceCheckForUpdate, r as checkForUpdate, s as getAutoUpdatePreference, t as INSTALL_CMD, u as shouldAttemptAutoUpdate } from "../updateChecker-C8xsNY2L.mjs";
 import { t as checkRipgrep } from "../ripgrepCheck-BmkyTK2i.mjs";
 import { execSync, spawnSync } from "child_process";

package/dist/index.mjs

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { $ as OAuthClient, A as substituteArguments, B as DEFAULT_THOROUGHNESS, C as WebSocketToolExecutor, D as ServerLlmBackend, E as WebSocketLlmBackend, F as generateCliTools, G as buildSystemPrompt, H as registerFeatureModuleTools, I as ALWAYS_DENIED_FOR_AGENTS, J as ReActAgent, K as buildSkillsPromptSection, L as DEFAULT_AGENT_MODEL, M as extractCompactInstructions, N as loadContextFiles, O as isTransientNetworkError, P as PermissionManager, Q as SessionStore, R as DEFAULT_MAX_ITERATIONS, S as ApiClient, T as FallbackLlmBackend, U as setWebSocketToolExecutor, V as clearFeatureModuleTools, W as getPlanModeFilePath, X as CheckpointStore, Y as CustomCommandStore, Z as CommandHistoryStore, _ as createAgentDelegateTool, a as createBlockerTools, at as searchFiles, b as createSkillTool, c as createDecisionStore, d as createFindDefinitionTool, et as hasFileReferences, f as createTodoStore, g as BackgroundAgentManager, h as createBackgroundAgentTools, i as createBlockerStore, it as formatFileSize, j as formatStep, k as McpManager, l as formatDecisionsOutput, m as createCoordinateTaskTool, n as createReviewGateTool, nt as searchCommands, o as formatBlockersOutput, ot as warmFileCache, p as createWriteTodosTool, q as isReadOnlyTool, r as formatReviewGatesOutput, rt as mergeCommands, s as createDecisionLogTool, t as createReviewGateStore, tt as processFileReferences, u as createGetFileStructureTool, v as AgentStore, w as WebSocketConnectionManager, x as parseAgentConfig, y as SubagentOrchestrator, z as DEFAULT_RETRY_CONFIG } from "./tools-GgAy5rmD.mjs";
+import { $ as SessionStore, A as substituteArguments, B as DEFAULT_RETRY_CONFIG, C as WebSocketToolExecutor, D as ServerLlmBackend, E as WebSocketLlmBackend, F as generateCliTools, G as getPlanModeFilePath, H as clearFeatureModuleTools, I as getProcessHooks, J as isReadOnlyTool, K as buildSystemPrompt, L as ALWAYS_DENIED_FOR_AGENTS, M as extractCompactInstructions, N as loadContextFiles, O as isTransientNetworkError, P as PermissionManager, Q as CommandHistoryStore, R as DEFAULT_AGENT_MODEL, S as ApiClient, T as FallbackLlmBackend, U as registerFeatureModuleTools, V as DEFAULT_THOROUGHNESS, W as setWebSocketToolExecutor, X as CustomCommandStore, Y as ReActAgent, Z as CheckpointStore, _ as createAgentDelegateTool, a as createBlockerTools, at as formatFileSize, b as createSkillTool, c as createDecisionStore, d as createFindDefinitionTool, et as OAuthClient, f as createTodoStore, g as BackgroundAgentManager, h as createBackgroundAgentTools, i as createBlockerStore, it as mergeCommands, j as formatStep, k as McpManager, l as formatDecisionsOutput, m as createCoordinateTaskTool, n as createReviewGateTool, nt as processFileReferences, o as formatBlockersOutput, ot as searchFiles, p as createWriteTodosTool, q as buildSkillsPromptSection, r as formatReviewGatesOutput, rt as searchCommands, s as createDecisionLogTool, st as warmFileCache, t as createReviewGateStore, tt as hasFileReferences, u as createGetFileStructureTool, v as AgentStore, w as WebSocketConnectionManager, x as parseAgentConfig, y as SubagentOrchestrator, z as DEFAULT_MAX_ITERATIONS } from "./tools-D9eSRR7Q.mjs";
 import { n as useCliStore, t as selectActiveBackgroundAgents } from "./store-DV5s-qni.mjs";
-import { Gt as validateNotebookPath$1, Wt as validateJupyterKernelName, g as CREDIT_DEDUCT_TRANSACTION_TYPES, i as getEnvironmentName, n as logger, r as getApiUrl, t as ConfigStore, v as ChatModels } from "./ConfigStore-D4gALtkZ.mjs";
-import { t as version } from "./package-CfGv2cC5.mjs";
+import { Gt as validateNotebookPath$1, Wt as validateJupyterKernelName, g as CREDIT_DEDUCT_TRANSACTION_TYPES, i as getEnvironmentName, n as logger, r as getApiUrl, t as ConfigStore, v as ChatModels } from "./ConfigStore-CtGc4fF2.mjs";
+import { t as version } from "./package-3pouvthv.mjs";
 import { r as checkForUpdate } from "./updateChecker-C8xsNY2L.mjs";
 import React, { useCallback, useEffect, useMemo, useReducer, useRef, useState } from "react";
 import { Box, Static, Text, render, useApp, useInput, usePaste, useStdout } from "ink";
@@ -3083,7 +3083,7 @@ function buildCompactionPrompt(messages, options = {}) {
 * @param preservedMessages - Recent messages to keep verbatim
 * @returns A new session with compacted context
 */
-function createCompactedSession(originalSession, summary, preservedMessages) {
+function createCompactedSession(originalSession, summary, preservedMessages, preserveId = false) {
 	const summaryMessage = {
 		id: v4(),
 		role: "user",
@@ -3103,7 +3103,7 @@ function createCompactedSession(originalSession, summary, preservedMessages) {
 		...preservedMessages
 	] : [summaryMessage, ...preservedMessages];
 	return {
-		id: v4(),
+		id: preserveId ? originalSession.id : v4(),
 		name: `${originalSession.name} (compacted)`,
 		createdAt: (/* @__PURE__ */ new Date()).toISOString(),
 		updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -6327,8 +6327,18 @@ function CliApp() {
 				logger.warn(`🤖 Using fallback model: ${modelInfo.id}`);
 			}
 			llm.currentModel = modelInfo.id;
-			const newSession = {
-				id: v4(),
+			const pinnedSessionId = process.env.B4M_SESSION_ID;
+			const resumeSessionId = process.env.B4M_RESUME_ID;
+			let newSession;
+			if (resumeSessionId) {
+				const resumed = await state.sessionStore.load(resumeSessionId);
+				if (!resumed) {
+					console.error(`No conversation found with session ID ${resumeSessionId}`);
+					process.exit(1);
+				}
+				newSession = resumed;
+			} else newSession = {
+				id: pinnedSessionId || v4(),
 				name: `Session ${(/* @__PURE__ */ new Date()).toLocaleString()}`,
 				createdAt: (/* @__PURE__ */ new Date()).toISOString(),
 				updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -6392,6 +6402,7 @@ function CliApp() {
 			let permissionPromptCounter = 0;
 			const promptFn = (toolName, args, preview) => {
 				return new Promise((resolve) => {
+					getProcessHooks()?.fireNotificationPermissionPrompt(toolName);
 					const canBeTrusted = permissionManager.canBeTrusted(toolName);
 					const id = `perm-${++permissionPromptCounter}`;
 					const prompt = {
@@ -6600,6 +6611,7 @@ function CliApp() {
 				additionalDirectories,
 				featureModulePrompts: featureModulePrompts || void 0,
 				planModeFilePath: mode === "plan" ? getPlanModeFilePath(newSession.id) : void 0,
+				appendSystemPrompt: process.env.B4M_APPEND_SYSTEM_PROMPT,
 				deferredToolNames: deferredToolRegistry.getDirectoryNames()
 			});
 			const cliSystemPrompt = buildPromptForMode(useCliStore.getState().interactionMode);
@@ -6778,6 +6790,16 @@ function CliApp() {
 	const handleMessageRef = useRef(null);
 	const abortControllerRef = useRef(state.abortController);
 	abortControllerRef.current = state.abortController;
+	const autoFiredRef = useRef(false);
+	useEffect(() => {
+		if (!isInitialized || autoFiredRef.current) return;
+		const initialPrompt = process.env.B4M_INITIAL_PROMPT;
+		if (!initialPrompt) return;
+		autoFiredRef.current = true;
+		setImmediate(() => {
+			handleMessageRef.current?.(initialPrompt);
+		});
+	}, [isInitialized]);
 	const emitNextAwaitingStatus = () => {
 		const s = useCliStore.getState();
 		if (s.permissionPrompt) {
@@ -7068,6 +7090,7 @@ function CliApp() {
 			console.error("❌ CLI failed to initialize. Try restarting b4m.\n");
 			return;
 		}
+		getProcessHooks()?.fireUserPromptSubmit();
 		bridgePresence.emitEvent({
 			type: "message",
 			role: "user",
@@ -7102,7 +7125,7 @@ function CliApp() {
 					if (compactionPrompt) {
 						const result = await state.agent.run(compactionPrompt, { maxIterations: 1 });
 						await state.sessionStore.save(activeSession);
-						const newSession = createCompactedSession(activeSession, result.finalAnswer, preservedMessages);
+						const newSession = createCompactedSession(activeSession, result.finalAnswer, preservedMessages, !!(process.env.B4M_SESSION_ID || process.env.B4M_RESUME_ID));
 						await logger.initialize(newSession.id);
 						setState((prev) => ({
 							...prev,
@@ -7260,6 +7283,7 @@ function CliApp() {
 				abortController: null
 			}));
 			useCliStore.getState().setIsThinking(false);
+			getProcessHooks()?.fireStop();
 			bridgePresence.emitEvent({
 				type: "status",
 				status: wasAborted ? "idle" : "awaiting_input"
@@ -8118,8 +8142,9 @@ Multi-line Input:
 				console.clear();
 				renderBanner();
 				const model = state.session?.model || state.config?.defaultModel || ChatModels.CLAUDE_4_5_SONNET;
+				const clearPinnedId = process.env.B4M_SESSION_ID || process.env.B4M_RESUME_ID;
 				const newSession = {
-					id: v4(),
+					id: clearPinnedId ? state.session?.id ?? clearPinnedId : v4(),
 					name: `Session ${(/* @__PURE__ */ new Date()).toLocaleString()}`,
 					createdAt: (/* @__PURE__ */ new Date()).toISOString(),
 					updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -8458,7 +8483,7 @@ Multi-line Input:
 					const summary = (await state.agent.run(compactionPrompt, { maxIterations: 1 })).finalAnswer;
 					await state.sessionStore.save(state.session);
 					const oldSessionName = state.session.name;
-					const newSession = createCompactedSession(state.session, summary, preservedMessages);
+					const newSession = createCompactedSession(state.session, summary, preservedMessages, !!(process.env.B4M_SESSION_ID || process.env.B4M_RESUME_ID));
 					await logger.initialize(newSession.id);
 					setState((prev) => ({
 						...prev,
@@ -8975,6 +9000,7 @@ Multi-line Input:
 				additionalDirectories: state.additionalDirectories,
 				featureModulePrompts: newFeaturePrompts || void 0,
 				planModeFilePath: planFilePathForRebuild,
+				appendSystemPrompt: process.env.B4M_APPEND_SYSTEM_PROMPT,
 				deferredToolNames: deferredToolRegistry.getDirectoryNames()
 			}));
 			const moduleNames = newFeatureRegistry.getModuleNames();

package/dist/{package-CfGv2cC5.mjs → package-3pouvthv.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
 //#region package.json
-var version = "0.15.3";
+var version = "0.16.0";
 //#endregion
 export { version as t };

package/dist/{tools-GgAy5rmD.mjs → tools-D9eSRR7Q.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { $ as ProjectEvents, A as GenerateImageToolCallSchema, At as dayjsConfig_default, B as InviteEvents, Bt as resolveNavigationIntents, C as ElabsEvents, Ct as UnauthorizedError, D as ForbiddenError, Dt as VideoModels, E as FileEvents, Et as VideoGenerationUsageTransaction, F as ImageEditUsageTransaction, Ft as isGPTImage2Model, G as ModalEvents, H as KnowledgeType, Ht as secureParameters, I as ImageGenerationUsageTransaction, It as isGPTImageModel, J as OpenAIEmbeddingModel, Jt as isNearLimit, K as ModelBackend, Kt as buildRateLimitLogEntry, L as ImageModels, Lt as isSupportedEmbeddingModel, M as GenericCreditDeductTransaction, Mt as getDataLakeTags, N as HTTPError, Nt as getMcpProviderMetadata, O as FriendshipEvents, Ot as XAI_IMAGE_MODELS, P as HttpStatus, Pt as getViewById, Q as ProfileEvents, R as InboxEvents, Rt as isZodError, S as DashboardParamsSchema, St as UiNavigationEvents, T as FeedbackEvents, Tt as VIDEO_SIZE_CONSTRAINTS, U as LLMEvents, Ut as settingsMap, V as InviteType, Vt as sanitizeTelemetryError, W as MiscEvents, X as Permission, Xt as CollectionType, Y as OpenAIImageGenerationInput, Yt as parseRateLimitHeaders, Z as PermissionDeniedError, _ as ChatCompletionCreateInputSchema, _t as TaskScheduleHandler, a as ALERT_THRESHOLDS, at as ReceivedCreditTransaction, b as CompletionApiUsageTransaction, bt as ToolUsageTransaction, c as ApiKeyScope, ct as ResearchModeParamsSchema, d as ArtifactTypeSchema, dt as ResearchTaskType, et as PromptIntentSchema, f as AuthEvents, ft as SessionEvents, gt as TagType, h as BadRequestError, ht as SupportedFabFileMimeTypes, it as RealtimeVoiceUsageTransaction, j as GenericCreditAddTransaction, jt as getAccessibleDataLakes, k as GEMINI_IMAGE_MODELS, kt as b4mLLMTools, l as ApiKeyType, lt as ResearchTaskExecutionType, m as BFL_SAFETY_TOLERANCE, mt as SubscriptionCreditTransaction, n as logger, nt as PurchaseTransaction, o as AiEvents, ot as RechartsChartTypeList, p as BFL_IMAGE_MODELS, pt as SpeechToTextUsageTransaction, q as NotFoundError, qt as extractSnippetMeta, rt as QuestMasterParamsSchema, s as ApiKeyEvents, st as RegInviteEvents, t as ConfigStore, tt as PromptMetaZodSchema, u as AppFileEvents, ut as ResearchTaskPeriodicFrequencyType, v as ChatModels, vt as TextGenerationUsageTransaction, w as FavoriteDocumentType, wt as UnprocessableEntityError, x as CorruptedFileError, xt as TransferCreditTransaction, y as ClaudeArtifactMimeTypes, yt as TooManyRequestsError, z as InternalServerError, zt as obfuscateApiKey } from "./ConfigStore-D4gALtkZ.mjs";
+import { $ as ProjectEvents, A as GenerateImageToolCallSchema, At as dayjsConfig_default, B as InviteEvents, Bt as resolveNavigationIntents, C as ElabsEvents, Ct as UnauthorizedError, D as ForbiddenError, Dt as VideoModels, E as FileEvents, Et as VideoGenerationUsageTransaction, F as ImageEditUsageTransaction, Ft as isGPTImage2Model, G as ModalEvents, H as KnowledgeType, Ht as secureParameters, I as ImageGenerationUsageTransaction, It as isGPTImageModel, J as OpenAIEmbeddingModel, Jt as isNearLimit, K as ModelBackend, Kt as buildRateLimitLogEntry, L as ImageModels, Lt as isSupportedEmbeddingModel, M as GenericCreditDeductTransaction, Mt as getDataLakeTags, N as HTTPError, Nt as getMcpProviderMetadata, O as FriendshipEvents, Ot as XAI_IMAGE_MODELS, P as HttpStatus, Pt as getViewById, Q as ProfileEvents, R as InboxEvents, Rt as isZodError, S as DashboardParamsSchema, St as UiNavigationEvents, T as FeedbackEvents, Tt as VIDEO_SIZE_CONSTRAINTS, U as LLMEvents, Ut as settingsMap, V as InviteType, Vt as sanitizeTelemetryError, W as MiscEvents, X as Permission, Xt as CollectionType, Y as OpenAIImageGenerationInput, Yt as parseRateLimitHeaders, Z as PermissionDeniedError, _ as ChatCompletionCreateInputSchema, _t as TaskScheduleHandler, a as ALERT_THRESHOLDS, at as ReceivedCreditTransaction, b as CompletionApiUsageTransaction, bt as ToolUsageTransaction, c as ApiKeyScope, ct as ResearchModeParamsSchema, d as ArtifactTypeSchema, dt as ResearchTaskType, et as PromptIntentSchema, f as AuthEvents, ft as SessionEvents, gt as TagType, h as BadRequestError, ht as SupportedFabFileMimeTypes, it as RealtimeVoiceUsageTransaction, j as GenericCreditAddTransaction, jt as getAccessibleDataLakes, k as GEMINI_IMAGE_MODELS, kt as b4mLLMTools, l as ApiKeyType, lt as ResearchTaskExecutionType, m as BFL_SAFETY_TOLERANCE, mt as SubscriptionCreditTransaction, n as logger, nt as PurchaseTransaction, o as AiEvents, ot as RechartsChartTypeList, p as BFL_IMAGE_MODELS, pt as SpeechToTextUsageTransaction, q as NotFoundError, qt as extractSnippetMeta, rt as QuestMasterParamsSchema, s as ApiKeyEvents, st as RegInviteEvents, t as ConfigStore, tt as PromptMetaZodSchema, u as AppFileEvents, ut as ResearchTaskPeriodicFrequencyType, v as ChatModels, vt as TextGenerationUsageTransaction, w as FavoriteDocumentType, wt as UnprocessableEntityError, x as CorruptedFileError, xt as TransferCreditTransaction, y as ClaudeArtifactMimeTypes, yt as TooManyRequestsError, z as InternalServerError, zt as obfuscateApiKey } from "./ConfigStore-CtGc4fF2.mjs";
 import { a as isUserLockedOut, c as userCanDisableMFA, d as userRequiresMFA, f as verifyBackupCode, i as getLockoutTimeRemaining, l as userEligibleForMFA, n as generateBackupCodes, o as recordFailedAttempt, p as verifyTOTPToken, r as generateTOTPSetup, s as shouldResetFailedAttempts, t as clearFailedAttempts, u as userHasMFAConfigured } from "./utils-PpNti-tY.mjs";
 import { n as isPathAllowed, t as assertPathAllowed } from "./pathValidation-D8tjkQXE-1HwvsuYT.mjs";
-import { t as version } from "./package-CfGv2cC5.mjs";
+import { t as version } from "./package-3pouvthv.mjs";
 import { execFile, execFileSync, spawn } from "child_process";
 import crypto, { createHash, randomBytes, randomUUID } from "crypto";
 import { existsSync, promises, readFileSync, readdirSync, rmSync, statSync, unlinkSync, writeFileSync } from "fs";
@@ -70,6 +70,7 @@ import { Mutex } from "async-mutex";
 import "zod-validation-error";
 import { homedir as homedir$1 } from "node:os";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { fileURLToPath } from "url";
 import WsWebSocket from "ws";
@@ -1902,6 +1903,18 @@ function shouldUseParallelExecution(toolsUsed, isReadOnly = defaultIsReadOnlyToo
 	return toolsUsed.filter((tool) => isReadOnly(tool.name)).length >= 2;
 }
 /**
+* True when an error is an abort/cancellation (user stop or execution timeout)
+* rather than a real failure. Aborts are benign and must NOT be logged at error
+* severity — error logs trip the CloudWatch ERROR→LiveOps/Slack alert path and
+* page on routine cancellations (#8947, #8669).
+*/
+function isAbortError(error, signal) {
+	if (signal?.aborted) return true;
+	if (!(error instanceof Error)) return false;
+	if (error.name === "AbortError") return true;
+	return error.message.toLowerCase().includes("aborted");
+}
+/**
 * ReAct (Reasoning and Acting) Agent
 *
 * This agent uses the ReAct pattern to solve problems by:
@@ -2051,6 +2064,9 @@ var ReActAgent = class extends EventEmitter {
 				let currentText = "";
 				const processedToolIds = /* @__PURE__ */ new Set();
 				let hadToolCalls = false;
+				let thoughtEmitted = false;
+				const iterStartInputTokens = this.totalInputTokens;
+				const iterStartOutputTokens = this.totalOutputTokens;
 				if (maxHistoryIterations > 0 && iterations > 1) {
 					trimConversationHistory(messages, maxHistoryIterations, this.initialMessageCount);
 					trimSteps(this.steps, maxHistoryIterations);
@@ -2092,35 +2108,18 @@ var ReActAgent = class extends EventEmitter {
 							this.totalCacheWriteTokens += completionInfo.cacheStats.cacheWriteTokens || 0;
 						}
 						if (completionInfo.creditsUsed) this.totalCredits += completionInfo.creditsUsed;
-						if (currentText.trim() && completionInfo.toolsUsed?.length) {
-							const thoughtStep = {
-								type: "thought",
-								content: currentText.trim(),
-								metadata: { timestamp: Date.now() }
-							};
-							this.steps.push(thoughtStep);
-							this.emit("thought", thoughtStep);
-						}
-						if (!completionInfo.toolsUsed?.length && currentText.trim()) {
-							finalAnswer = currentText.trim();
-							const finalStep = {
-								type: "final_answer",
-								content: finalAnswer,
-								metadata: {
-									timestamp: Date.now(),
-									tokenUsage: {
-										prompt: inputTokens,
-										completion: outputTokens,
-										total: inputTokens + outputTokens
-									}
-								}
-							};
-							this.steps.push(finalStep);
-							this.emit("final_answer", finalStep);
-							iterationComplete = true;
-						}
 						if (completionInfo.toolsUsed && completionInfo.toolsUsed.length > 0) {
 							hadToolCalls = true;
+							if (!thoughtEmitted && currentText.trim()) {
+								const thoughtStep = {
+									type: "thought",
+									content: currentText.trim(),
+									metadata: { timestamp: Date.now() }
+								};
+								this.steps.push(thoughtStep);
+								this.emit("thought", thoughtStep);
+								thoughtEmitted = true;
+							}
 							const thinkingBlocks = completionInfo.thinking || [];
 							const unprocessedTools = [];
 							for (const toolUse of completionInfo.toolsUsed) {
@@ -2159,6 +2158,26 @@ var ReActAgent = class extends EventEmitter {
 						}
 					}
 				});
+				if (!hadToolCalls && currentText.trim()) {
+					finalAnswer = currentText.trim();
+					const iterInputTokens = this.totalInputTokens - iterStartInputTokens;
+					const iterOutputTokens = this.totalOutputTokens - iterStartOutputTokens;
+					const finalStep = {
+						type: "final_answer",
+						content: finalAnswer,
+						metadata: {
+							timestamp: Date.now(),
+							tokenUsage: {
+								prompt: iterInputTokens,
+								completion: iterOutputTokens,
+								total: iterInputTokens + iterOutputTokens
+							}
+						}
+					};
+					this.steps.push(finalStep);
+					this.emit("final_answer", finalStep);
+					iterationComplete = true;
+				}
 				if (iterationComplete && finalAnswer) break;
 				if (hadToolCalls && options.confidenceGate && this.iterationConfidences.length > 0) {
 					const iterAvg = this.iterationConfidences.reduce((a, b) => a + b, 0) / this.iterationConfidences.length;
@@ -2258,7 +2277,8 @@ var ReActAgent = class extends EventEmitter {
 				this.emit("complete", result);
 				return result;
 			}
-			this.context.logger.error("[ReActAgent] Error during execution:", error);
+			if (isAbortError(error, options.signal)) this.context.logger.warn("[ReActAgent] Execution aborted (user cancel or timeout):", error);
+			else this.context.logger.error("[ReActAgent] Error during execution:", error);
 			this.emit("error", error);
 			throw error;
 		}
@@ -2530,6 +2550,9 @@ Remember: You are an autonomous AGENT. Act independently and solve problems proa
 			let finalAnswer = "";
 			const processedToolIds = /* @__PURE__ */ new Set();
 			let hadToolCalls = false;
+			let thoughtEmitted = false;
+			const iterStartInputTokens = this.totalInputTokens;
+			const iterStartOutputTokens = this.totalOutputTokens;
 			const cacheStrategy = options.enableCaching ? {
 				enableCaching: true,
 				cacheSystemPrompt: true,
@@ -2567,41 +2590,22 @@ Remember: You are an autonomous AGENT. Act independently and solve problems proa
 						this.totalCacheWriteTokens += completionInfo.cacheStats.cacheWriteTokens || 0;
 					}
 					if (completionInfo.creditsUsed) this.totalCredits += completionInfo.creditsUsed;
-					if (currentText.trim() && completionInfo.toolsUsed?.length) {
-						const thoughtStep = {
-							type: "thought",
-							content: currentText.trim(),
-							metadata: {
-								timestamp: Date.now(),
-								iteration: this.iterations - 1
-							}
-						};
-						this.steps.push(thoughtStep);
-						iterationSteps.push(thoughtStep);
-						this.emit("thought", thoughtStep);
-					}
-					if (!completionInfo.toolsUsed?.length && currentText.trim()) {
-						finalAnswer = currentText.trim();
-						const finalStep = {
-							type: "final_answer",
-							content: finalAnswer,
-							metadata: {
-								timestamp: Date.now(),
-								iteration: this.iterations - 1,
-								tokenUsage: {
-									prompt: inputTokens,
-									completion: outputTokens,
-									total: inputTokens + outputTokens
-								}
-							}
-						};
-						this.steps.push(finalStep);
-						iterationSteps.push(finalStep);
-						this.emit("final_answer", finalStep);
-						iterationComplete = true;
-					}
 					if (completionInfo.toolsUsed && completionInfo.toolsUsed.length > 0) {
 						hadToolCalls = true;
+						if (!thoughtEmitted && currentText.trim()) {
+							const thoughtStep = {
+								type: "thought",
+								content: currentText.trim(),
+								metadata: {
+									timestamp: Date.now(),
+									iteration: this.iterations - 1
+								}
+							};
+							this.steps.push(thoughtStep);
+							iterationSteps.push(thoughtStep);
+							this.emit("thought", thoughtStep);
+							thoughtEmitted = true;
+						}
 						const thinkingBlocks = completionInfo.thinking || [];
 						const unprocessedTools = [];
 						for (const toolUse of completionInfo.toolsUsed) {
@@ -2645,6 +2649,28 @@ Remember: You are an autonomous AGENT. Act independently and solve problems proa
 					}
 				}
 			});
+			if (!hadToolCalls && currentText.trim()) {
+				finalAnswer = currentText.trim();
+				const iterInputTokens = this.totalInputTokens - iterStartInputTokens;
+				const iterOutputTokens = this.totalOutputTokens - iterStartOutputTokens;
+				const finalStep = {
+					type: "final_answer",
+					content: finalAnswer,
+					metadata: {
+						timestamp: Date.now(),
+						iteration: this.iterations - 1,
+						tokenUsage: {
+							prompt: iterInputTokens,
+							completion: iterOutputTokens,
+							total: iterInputTokens + iterOutputTokens
+						}
+					}
+				};
+				this.steps.push(finalStep);
+				iterationSteps.push(finalStep);
+				this.emit("final_answer", finalStep);
+				iterationComplete = true;
+			}
 			if (hadToolCalls && options.confidenceGate && this.iterationConfidences.length > 0) {
 				const iterAvg = this.iterationConfidences.reduce((a, b) => a + b, 0) / this.iterationConfidences.length;
 				const decision = options.confidenceGate(iterAvg, this.iterations);
@@ -2761,7 +2787,8 @@ Remember: You are an autonomous AGENT. Act independently and solve problems proa
 					checkpoint: this.toCheckpoint()
 				};
 			}
-			this.context.logger.error("[ReActAgent] Error during runIteration:", error);
+			if (isAbortError(error, options.signal)) this.context.logger.warn("[ReActAgent] Iteration aborted (user cancel or timeout):", error);
+			else this.context.logger.error("[ReActAgent] Error during runIteration:", error);
 			this.emit("error", error);
 			throw error;
 		}
@@ -4117,7 +4144,7 @@ These tools are lightweight — use them naturally as part of your work, not as
 
 ## Working Directory
 
-The current working directory is \`${process.cwd()}\`. All relative paths in tool calls resolve from here. When using \`${TOOL_GLOB_FILES}\` or \`${TOOL_GREP_SEARCH}\` without an explicit \`dir_path\`, they search from this directory.${directoriesSection}${projectContextSection}${skillsSection}${featureModulesSection}${planModeSection}${deferredToolSection}`;
+The current working directory is \`${process.cwd()}\`. All relative paths in tool calls resolve from here. When using \`${TOOL_GLOB_FILES}\` or \`${TOOL_GREP_SEARCH}\` without an explicit \`dir_path\`, they search from this directory.${directoriesSection}${projectContextSection}${skillsSection}${featureModulesSection}${planModeSection}${deferredToolSection}${config?.appendSystemPrompt ? `\n\n${config.appendSystemPrompt}` : ""}`;
 }
 /**
 * Build the minimal-variant system prompt. Reuses the project context,
@@ -4147,7 +4174,7 @@ Guidelines:
 
 ## Working Directory
 
-The current working directory is \`${process.cwd()}\`. All relative paths in tool calls resolve from here. When using \`${TOOL_GLOB_FILES}\` or \`${TOOL_GREP_SEARCH}\` without an explicit \`dir_path\`, they search from this directory.${directoriesSection}${projectContextSection}${skillsSection}${featureModulesSection}${planModeSection}${deferredToolSection}`;
+The current working directory is \`${process.cwd()}\`. All relative paths in tool calls resolve from here. When using \`${TOOL_GLOB_FILES}\` or \`${TOOL_GREP_SEARCH}\` without an explicit \`dir_path\`, they search from this directory.${directoriesSection}${projectContextSection}${skillsSection}${featureModulesSection}${planModeSection}${deferredToolSection}${config?.appendSystemPrompt ? `\n\n${config.appendSystemPrompt}` : ""}`;
 }
 /**
 * Pick a system prompt by variant. The dispatch point for the
@@ -8477,7 +8504,8 @@ var GeminiImageService = class extends AIImageService {
 	async generateImageViaContent(prompt, model = ImageModels.GEMINI_2_5_FLASH_IMAGE) {
 		const response = await this.genAI.models.generateContent({
 			model,
-			contents: [{ text: prompt }]
+			contents: [{ text: prompt }],
+			config: { responseModalities: ["IMAGE", "TEXT"] }
 		});
 		if (!response.candidates || response.candidates.length === 0) throw new Error("No candidates returned from Gemini");
 		const candidate = response.candidates[0];
@@ -8568,7 +8596,8 @@ var GeminiImageService = class extends AIImageService {
 			});
 			const response = await this.genAI.models.generateContent({
 				model,
-				contents
+				contents,
+				config: { responseModalities: ["IMAGE", "TEXT"] }
 			});
 			if (!response.candidates || response.candidates.length === 0) throw new Error("No candidates returned from Gemini");
 			const candidate = response.candidates[0];
@@ -9769,8 +9798,9 @@ function registerLambdaErrorHandlers(logger) {
 		} else log.error("[Lambda] Unhandled promise rejection", logEntry);
 	});
 	process.on("uncaughtException", (error) => {
-		const logEntry = buildLogEntry(error, "uncaught_exception");
-		log.error("[Lambda] Uncaught exception", logEntry);
+		const category = classifyError(error);
+		if (category.startsWith("network_")) log.warn("[Lambda] Network error (uncaught exception)", buildLogEntry(error, category));
+		else log.error("[Lambda] Uncaught exception", buildLogEntry(error, "uncaught_exception"));
 	});
 }
 /**
@@ -19745,13 +19775,19 @@ const updateUserSchema = z.object({
 		scrollbarWidth: z.number().optional(),
 		experimentalFeatures: z.record(z.string(), z.boolean()).optional(),
 		rechartsDisplayMode: z.enum(["inline", "artifact"]).optional(),
+		toolsCatalogCollapsed: z.boolean().optional(),
 		docxTemplateFileId: z.string().nullable().optional(),
 		contextTelemetryLevel: z.enum([
 			"none",
 			"basic",
 			"enhanced"
 		]).optional(),
-		contextTelemetryConsentedAt: z.date().optional()
+		contextTelemetryConsentedAt: z.date().optional(),
+		agentModeDefault: z.enum([
+			"off",
+			"auto",
+			"on"
+		]).optional()
 	}).nullable().optional()
 });
 z.object({
@@ -19794,7 +19830,7 @@ z.object({
 	username: z.string(),
 	email: z.string(),
 	name: z.string(),
-	inviteCode: z.string(),
+	inviteCode: z.string().optional(),
 	password: z.string(),
 	metadata: z.object({
 		loginTime: z.date(),
@@ -23523,8 +23559,175 @@ const DEFAULT_AGENT_MODEL = ChatModels.CLAUDE_4_5_HAIKU;
 */
 const DEFAULT_THOROUGHNESS = "medium";
 //#endregion
+//#region src/agents/toolFilter.ts
+/**
+* Check if a tool name matches a pattern
+*
+* Supports wildcards (*) that match any sequence of characters.
+*
+* @param toolName - The actual tool name to check
+* @param pattern - The pattern to match against (may include * wildcards)
+* @returns true if the tool name matches the pattern
+*
+* @example
+* matchesToolPattern('mcp__github__create_issue', 'mcp__github__*') // true
+* matchesToolPattern('mcp__github__delete_repo', 'mcp__*__delete_*') // true
+* matchesToolPattern('file_read', 'file_read') // true
+* matchesToolPattern('file_read', 'file_*') // true
+* matchesToolPattern('file_read', '*_read') // true
+* matchesToolPattern('bash_execute', 'file_*') // false
+*/
+function matchesToolPattern(toolName, pattern) {
+	const regexPattern = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+	return new RegExp(`^${regexPattern}$`).test(toolName);
+}
+/**
+* Check if a tool name matches any pattern in a list
+*
+* @param toolName - The tool name to check
+* @param patterns - Array of patterns to match against
+* @returns true if the tool matches any pattern
+*/
+function matchesAnyPattern(toolName, patterns) {
+	return patterns.some((pattern) => matchesToolPattern(toolName, pattern));
+}
+/**
+* Filter tools based on allowed and denied patterns
+*
+* Rules:
+* 1. Denied patterns take precedence over allowed patterns
+* 2. If no allowed patterns specified, all tools are allowed (minus denied)
+* 3. If allowed patterns specified, only matching tools are allowed
+* 4. Supports wildcards in both allowed and denied patterns
+*
+* @param allTools - Complete list of available tools
+* @param allowedPatterns - Whitelist patterns (optional)
+* @param deniedPatterns - Blacklist patterns (optional)
+* @returns Filtered list of tools
+*
+* @example
+* // Allow only specific tools
+* filterToolsByPatterns(tools, ['file_read', 'grep_search'])
+*
+* // Allow all GitHub MCP tools except delete operations
+* filterToolsByPatterns(tools, ['mcp__github__*'], ['mcp__github__delete_*'])
+*
+* // Deny specific tools, allow everything else
+* filterToolsByPatterns(tools, undefined, ['create_file', 'edit_file'])
+*/
+function filterToolsByPatterns(allTools, allowedPatterns, deniedPatterns) {
+	return allTools.filter((tool) => {
+		const toolName = tool.toolSchema.name;
+		if (deniedPatterns && deniedPatterns.length > 0) {
+			if (matchesAnyPattern(toolName, deniedPatterns)) return false;
+		}
+		if (!allowedPatterns || allowedPatterns.length === 0) return true;
+		return matchesAnyPattern(toolName, allowedPatterns);
+	});
+}
+//#endregion
+//#region src/utils/processHooks.ts
+const HOOK_TIMEOUT_MS = 5e3;
+/** Does a group's matcher match the event's matcher value? `*`/empty/undefined match anything. */
+function matcherMatches(groupMatcher, eventMatcher) {
+	if (groupMatcher === void 0 || groupMatcher === "" || groupMatcher === "*") return true;
+	return groupMatcher === eventMatcher;
+}
+var ProcessHooks = class {
+	constructor(hooks) {
+		this.hooks = hooks;
+	}
+	/**
+	* Run every command registered for `event` whose matcher matches `eventMatcher`.
+	* `payload` is written to each command's stdin (then EOF). Best-effort: a failing
+	* command never throws or blocks the caller's lifecycle.
+	*/
+	async fire(event, eventMatcher, payload) {
+		const groups = this.hooks[event];
+		if (!groups || groups.length === 0) return;
+		const stdin = JSON.stringify({
+			hook_event_name: event,
+			...eventMatcher ? { matcher: eventMatcher } : {},
+			...payload
+		});
+		const runs = [];
+		for (const group of groups) {
+			if (!matcherMatches(group.matcher, eventMatcher)) continue;
+			for (const hook of group.hooks ?? []) {
+				if (hook.type !== "command" || !hook.command) continue;
+				runs.push(runShellCommand({
+					command: hook.command,
+					cwd: process.cwd(),
+					timeoutMs: HOOK_TIMEOUT_MS,
+					stdin
+				}).catch(() => void 0));
+			}
+		}
+		await Promise.all(runs);
+	}
+	/** Fired when an interactive permission prompt begins blocking. */
+	fireNotificationPermissionPrompt(toolName) {
+		return this.fire("Notification", "permission_prompt", { tool_name: toolName });
+	}
+	/** Fired after any tool completes. */
+	firePostToolUse(toolName) {
+		return this.fire("PostToolUse", void 0, { tool_name: toolName });
+	}
+	/** Fired at the end of every agent turn. */
+	fireStop() {
+		return this.fire("Stop");
+	}
+	/** Fired when the user submits a new prompt. */
+	fireUserPromptSubmit() {
+		return this.fire("UserPromptSubmit");
+	}
+};
+/**
+* Parse a `--settings` JSON string into a {@link SettingsHooks}. Defensive:
+* malformed JSON or a missing/!-object `hooks` field yields `null` (no hooks),
+* never throws — a bad `--settings` must not brick the launch.
+*/
+function parseSettingsHooks(settingsJson) {
+	if (!settingsJson) return null;
+	try {
+		const parsed = JSON.parse(settingsJson);
+		if (!parsed || typeof parsed !== "object") return null;
+		const hooks = parsed.hooks;
+		if (!hooks || typeof hooks !== "object") return null;
+		return hooks;
+	} catch {
+		return null;
+	}
+}
+let cached;
+/**
+* Lazily-built process-hook singleton from `B4M_SETTINGS_JSON`. Returns null when
+* no hooks are configured, so call sites can `void getProcessHooks()?.fireStop()`.
+*/
+function getProcessHooks() {
+	if (cached !== void 0) return cached;
+	const hooks = parseSettingsHooks(process.env.B4M_SETTINGS_JSON);
+	cached = hooks ? new ProcessHooks(hooks) : null;
+	return cached;
+}
+//#endregion
 //#region src/utils/toolsAdapter.ts
 /**
+* Tool-name patterns auto-approved without a permission prompt, from `--allowedTools`
+* (claude-compat; e.g. `mcp__manifold__*`). Parsed once from B4M_ALLOWED_TOOLS — set by
+* bin/bike4mind-cli.mjs. Returns [] when unset so behaviour is unchanged off-host.
+*/
+let cachedAllowedTools;
+function getAllowedToolPatterns() {
+	if (cachedAllowedTools === void 0) try {
+		const raw = process.env.B4M_ALLOWED_TOOLS;
+		cachedAllowedTools = raw ? JSON.parse(raw) : [];
+	} catch {
+		cachedAllowedTools = [];
+	}
+	return cachedAllowedTools;
+}
+/**
 * Simple CLI-friendly storage adapter
 * Most methods won't be called for CLI-only tools
 * Silent to avoid interfering with Ink rendering
@@ -23633,6 +23836,7 @@ function wrapToolWithPermission(tool, permissionManager, showPermissionPrompt, a
 					toolName,
 					result
 				});
+				getProcessHooks()?.firePostToolUse(toolName);
 				return result;
 			}
 			const { useCliStore } = await import("./store-DgzCTRkN.mjs");
@@ -23645,6 +23849,8 @@ function wrapToolWithPermission(tool, permissionManager, showPermissionPrompt, a
 				});
 				return result;
 			}
+			const allowedPatterns = getAllowedToolPatterns();
+			if (allowedPatterns.length > 0 && matchesAnyPattern(toolName, allowedPatterns)) return executeAndRecord();
 			if (!permissionManager.needsPermission(toolName, { isSandboxed })) return executeAndRecord();
 			if (interactionMode === "auto-accept") return executeAndRecord();
 			const response = await showPermissionPrompt(toolName, effectiveArgs, await generateToolPreview(toolName, args, isSandboxed));
@@ -24370,9 +24576,11 @@ var MCPClient = class {
 	customArgs;
 	suppressStderr;
 	onStderrLine;
+	url;
+	headers;
 	tools = [];
 	serverName;
-	constructor({ envVariables, name, command, args, suppressStderr = false, onStderrLine }) {
+	constructor({ envVariables, name, command, args, suppressStderr = false, onStderrLine, url, headers }) {
 		this.mcp = new Client({
 			name: "mcp-client-cli",
 			version: "1.0.0"
@@ -24383,9 +24591,26 @@ var MCPClient = class {
 		this.customArgs = args;
 		this.suppressStderr = suppressStderr;
 		this.onStderrLine = onStderrLine;
+		this.url = url;
+		this.headers = headers;
 	}
 	async connectToServer() {
 		try {
+			if (this.url) {
+				const transport = new StreamableHTTPClientTransport(new URL(this.url), { requestInit: this.headers ? { headers: this.headers } : void 0 });
+				transport.onerror = (error) => {
+					console.error(`[MCP] Transport error for ${this.serverName}:`, error);
+				};
+				this.transport = transport;
+				await this.mcp.connect(transport);
+				const toolsResult = await this.mcp.listTools();
+				this.tools = toolsResult.tools.map((tool) => ({
+					name: tool.name,
+					description: tool.description,
+					input_schema: tool.inputSchema
+				}));
+				return;
+			}
 			const envVarsObject = this.envVariables.reduce((acc, env) => ({
 				...acc,
 				[env.key]: env.value
@@ -24410,7 +24635,7 @@ var MCPClient = class {
 				console.log(`[MCP] Using server: ${this.serverName} at ${serverScriptPath}`);
 			}
 			const stderrMode = this.suppressStderr ? "ignore" : this.onStderrLine ? "pipe" : void 0;
-			const transportConfig = {
+			const stdioTransport = new StdioClientTransport({
 				command,
 				args,
 				env: {
@@ -24418,13 +24643,13 @@ var MCPClient = class {
 					...envVarsObject
 				},
 				...stderrMode && { stderr: stderrMode }
-			};
-			this.transport = new StdioClientTransport(transportConfig);
-			this.transport.onerror = (error) => {
+			});
+			this.transport = stdioTransport;
+			stdioTransport.onerror = (error) => {
 				console.error(`[MCP] Transport error for ${this.serverName}:`, error);
 			};
-			await this.mcp.connect(this.transport);
-			if (this.onStderrLine && this.transport.stderr) this.readStderr(this.transport.stderr);
+			await this.mcp.connect(stdioTransport);
+			if (this.onStderrLine && stdioTransport.stderr) this.readStderr(stdioTransport.stderr);
 			await new Promise((resolve) => setTimeout(resolve, 100));
 			const toolsResult = await this.mcp.listTools();
 			this.tools = toolsResult.tools.map((tool) => {
@@ -24646,6 +24871,8 @@ var McpManager = class {
 			name: serverConfig.name,
 			command: serverConfig.command,
 			args: serverConfig.args,
+			url: serverConfig.url,
+			headers: serverConfig.headers,
 			suppressStderr: true
 		});
 		await client.connectToServer();
@@ -24703,6 +24930,7 @@ var McpManager = class {
 		const key = JSON.stringify({
 			command: serverConfig.command,
 			args: serverConfig.args,
+			url: serverConfig.url,
 			env: serverConfig.env
 		});
 		return createHash("sha256").update(key).digest("hex").slice(0, 16);
@@ -25945,73 +26173,6 @@ var ApiClient = class {
 	}
 };
 //#endregion
-//#region src/agents/toolFilter.ts
-/**
-* Check if a tool name matches a pattern
-*
-* Supports wildcards (*) that match any sequence of characters.
-*
-* @param toolName - The actual tool name to check
-* @param pattern - The pattern to match against (may include * wildcards)
-* @returns true if the tool name matches the pattern
-*
-* @example
-* matchesToolPattern('mcp__github__create_issue', 'mcp__github__*') // true
-* matchesToolPattern('mcp__github__delete_repo', 'mcp__*__delete_*') // true
-* matchesToolPattern('file_read', 'file_read') // true
-* matchesToolPattern('file_read', 'file_*') // true
-* matchesToolPattern('file_read', '*_read') // true
-* matchesToolPattern('bash_execute', 'file_*') // false
-*/
-function matchesToolPattern(toolName, pattern) {
-	const regexPattern = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
-	return new RegExp(`^${regexPattern}$`).test(toolName);
-}
-/**
-* Check if a tool name matches any pattern in a list
-*
-* @param toolName - The tool name to check
-* @param patterns - Array of patterns to match against
-* @returns true if the tool matches any pattern
-*/
-function matchesAnyPattern(toolName, patterns) {
-	return patterns.some((pattern) => matchesToolPattern(toolName, pattern));
-}
-/**
-* Filter tools based on allowed and denied patterns
-*
-* Rules:
-* 1. Denied patterns take precedence over allowed patterns
-* 2. If no allowed patterns specified, all tools are allowed (minus denied)
-* 3. If allowed patterns specified, only matching tools are allowed
-* 4. Supports wildcards in both allowed and denied patterns
-*
-* @param allTools - Complete list of available tools
-* @param allowedPatterns - Whitelist patterns (optional)
-* @param deniedPatterns - Blacklist patterns (optional)
-* @returns Filtered list of tools
-*
-* @example
-* // Allow only specific tools
-* filterToolsByPatterns(tools, ['file_read', 'grep_search'])
-*
-* // Allow all GitHub MCP tools except delete operations
-* filterToolsByPatterns(tools, ['mcp__github__*'], ['mcp__github__delete_*'])
-*
-* // Deny specific tools, allow everything else
-* filterToolsByPatterns(tools, undefined, ['create_file', 'edit_file'])
-*/
-function filterToolsByPatterns(allTools, allowedPatterns, deniedPatterns) {
-	return allTools.filter((tool) => {
-		const toolName = tool.toolSchema.name;
-		if (deniedPatterns && deniedPatterns.length > 0) {
-			if (matchesAnyPattern(toolName, deniedPatterns)) return false;
-		}
-		if (!allowedPatterns || allowedPatterns.length === 0) return true;
-		return matchesAnyPattern(toolName, allowedPatterns);
-	});
-}
-//#endregion
 //#region src/tools/skillTool.ts
 /**
 * Execute a lifecycle hook script
@@ -28751,4 +28912,4 @@ function createReviewGateStore(onUpdate) {
 	};
 }
 //#endregion
-export { OAuthClient as $, substituteArguments as A, DEFAULT_THOROUGHNESS as B, WebSocketToolExecutor as C, ServerLlmBackend as D, WebSocketLlmBackend as E, generateCliTools as F, buildSystemPrompt as G, registerFeatureModuleTools as H, ALWAYS_DENIED_FOR_AGENTS as I, ReActAgent as J, buildSkillsPromptSection as K, DEFAULT_AGENT_MODEL as L, extractCompactInstructions as M, loadContextFiles as N, isTransientNetworkError as O, PermissionManager as P, SessionStore as Q, DEFAULT_MAX_ITERATIONS as R, ApiClient as S, FallbackLlmBackend as T, setWebSocketToolExecutor as U, clearFeatureModuleTools as V, getPlanModeFilePath as W, CheckpointStore as X, CustomCommandStore as Y, CommandHistoryStore as Z, createAgentDelegateTool as _, createBlockerTools as a, searchFiles as at, createSkillTool as b, createDecisionStore as c, createFindDefinitionTool as d, hasFileReferences as et, createTodoStore as f, BackgroundAgentManager as g, createBackgroundAgentTools as h, createBlockerStore as i, formatFileSize$1 as it, formatStep as j, McpManager as k, formatDecisionsOutput as l, createCoordinateTaskTool as m, createReviewGateTool as n, searchCommands as nt, formatBlockersOutput as o, warmFileCache as ot, createWriteTodosTool as p, isReadOnlyTool as q, formatReviewGatesOutput as r, mergeCommands as rt, createDecisionLogTool as s, createReviewGateStore as t, processFileReferences as tt, createGetFileStructureTool as u, AgentStore as v, WebSocketConnectionManager as w, parseAgentConfig as x, SubagentOrchestrator as y, DEFAULT_RETRY_CONFIG as z };
+export { SessionStore as $, substituteArguments as A, DEFAULT_RETRY_CONFIG as B, WebSocketToolExecutor as C, ServerLlmBackend as D, WebSocketLlmBackend as E, generateCliTools as F, getPlanModeFilePath as G, clearFeatureModuleTools as H, getProcessHooks as I, isReadOnlyTool as J, buildSystemPrompt as K, ALWAYS_DENIED_FOR_AGENTS as L, extractCompactInstructions as M, loadContextFiles as N, isTransientNetworkError as O, PermissionManager as P, CommandHistoryStore as Q, DEFAULT_AGENT_MODEL as R, ApiClient as S, FallbackLlmBackend as T, registerFeatureModuleTools as U, DEFAULT_THOROUGHNESS as V, setWebSocketToolExecutor as W, CustomCommandStore as X, ReActAgent as Y, CheckpointStore as Z, createAgentDelegateTool as _, createBlockerTools as a, formatFileSize$1 as at, createSkillTool as b, createDecisionStore as c, createFindDefinitionTool as d, OAuthClient as et, createTodoStore as f, BackgroundAgentManager as g, createBackgroundAgentTools as h, createBlockerStore as i, mergeCommands as it, formatStep as j, McpManager as k, formatDecisionsOutput as l, createCoordinateTaskTool as m, createReviewGateTool as n, processFileReferences as nt, formatBlockersOutput as o, searchFiles as ot, createWriteTodosTool as p, buildSkillsPromptSection as q, formatReviewGatesOutput as r, searchCommands as rt, createDecisionLogTool as s, warmFileCache as st, createReviewGateStore as t, hasFileReferences as tt, createGetFileStructureTool as u, AgentStore as v, WebSocketConnectionManager as w, parseAgentConfig as x, SubagentOrchestrator as y, DEFAULT_MAX_ITERATIONS as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bike4mind/cli",
-  "version": "0.15.3",
+  "version": "0.16.0",
   "type": "module",
   "description": "Interactive CLI tool for Bike4Mind with ReAct agents",
   "license": "UNLICENSED",
@@ -107,9 +107,9 @@
     "zod": "^4.4.3",
     "zod-validation-error": "^5.0.0",
     "zustand": "^5.0.13",
-    "@bike4mind/fab-pipeline": "0.3.3",
-    "@bike4mind/llm-adapters": "0.4.3",
-    "@bike4mind/observability": "0.1.0"
+    "@bike4mind/fab-pipeline": "0.3.4",
+    "@bike4mind/llm-adapters": "0.4.4",
+    "@bike4mind/observability": "0.1.1"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.13",
@@ -124,11 +124,11 @@
     "tsx": "^4.22.3",
     "typescript": "^5.9.3",
     "vitest": "^4.1.9",
-    "@bike4mind/agents": "0.15.0",
-    "@bike4mind/common": "2.110.0",
-    "@bike4mind/mcp": "1.37.27",
-    "@bike4mind/services": "2.95.0",
-    "@bike4mind/utils": "2.24.3"
+    "@bike4mind/agents": "0.15.1",
+    "@bike4mind/common": "2.111.0",
+    "@bike4mind/mcp": "1.38.0",
+    "@bike4mind/services": "2.96.0",
+    "@bike4mind/utils": "2.24.4"
   },
   "optionalDependencies": {
     "@vscode/ripgrep": "^1.18.0"