@bike4mind/cli 0.17.1 → 0.17.2

package/LICENSE

@@ -0,0 +1,116 @@
+Business Source License 1.1
+
+License text copyright (c) 2017 MariaDB Corporation Ab, All Rights Reserved.
+"Business Source License" is a trademark of MariaDB Corporation Ab.
+
+-----------------------------------------------------------------------------
+
+Parameters
+
+Licensor:             Bike4Mind, Inc.
+
+Licensed Work:        Bike4Mind (the lumina5 repository and the components
+                      distributed under this License).
+                      The Licensed Work is (c) 2026 Bike4Mind, Inc.
+
+Additional Use Grant: You may make production use of the Licensed Work,
+                      including building, distributing, and commercializing
+                      your own products that incorporate or are built on the
+                      Licensed Work, provided that you may not provide to
+                      third parties a Bike4Mind Service. A "Bike4Mind Service"
+                      is a commercial offering (including a managed, hosted,
+                      or software-as-a-service offering) that allows third
+                      parties — other than your own employees and individual
+                      contractors — to access a substantial portion of the
+                      functionality of the Licensed Work in a manner that
+                      competes with a commercial offering of Bike4Mind, Inc.
+                      For the avoidance of doubt, you may self-host and operate
+                      the Licensed Work on your own hardware or infrastructure
+                      for your own internal purposes (including use by your
+                      organization's employees and individual contractors).
+                      Such internal use — including running it for your own
+                      sovereignty, independent of any hyperscaler or model
+                      provider — is expressly permitted and is not a Bike4Mind
+                      Service.
+
+Change Date:          Four years from the date a given version of the Licensed
+                      Work is first made publicly available. Each version
+                      carries its own Change Date (see Terms). Bike4Mind, Inc.
+                      may, at its discretion, designate an earlier Change Date
+                      for any version.
+
+Change License:       Apache License, Version 2.0
+
+For information about alternative licensing arrangements for the Licensed Work,
+please contact licensing@bike4mind.com.
+
+-----------------------------------------------------------------------------
+
+Notice
+
+Business Source License 1.1
+
+Terms
+
+The Licensor hereby grants you the right to copy, modify, create derivative
+works, redistribute, and make non-production use of the Licensed Work. The
+Licensor may make an Additional Use Grant, above, permitting limited production
+use.
+
+Effective on the Change Date, or the fourth anniversary of the first publicly
+available distribution of a specific version of the Licensed Work under this
+License, whichever comes first, the Licensor hereby grants you rights under
+the terms of the Change License, and the rights granted in the paragraph
+above terminate.
+
+If your use of the Licensed Work does not comply with the requirements
+currently in effect as described in this License, you must purchase a
+commercial license from the Licensor, its affiliated entities, or authorized
+resellers, or you must refrain from using the Licensed Work.
+
+All copies of the original and modified Licensed Work, and derivative works of
+the Licensed Work, are subject to this License. This License applies separately
+for each version of the Licensed Work and the Change Date may vary for each
+version of the Licensed Work released by Licensor.
+
+You must conspicuously display this License on each original or modified copy of
+the Licensed Work. If you receive the Licensed Work in original or modified form
+from a third party, the terms and conditions set forth in this License apply to
+your use of that work.
+
+Any use of the Licensed Work in violation of this License will automatically
+terminate your rights under this License for the current and all other versions
+of the Licensed Work.
+
+This License does not grant you any right in any trademark or logo of Licensor
+or its affiliates (provided that you may use a trademark or logo of Licensor as
+expressly required by this License).
+
+TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON AN
+"AS IS" BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS, EXPRESS
+OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND TITLE.
+
+MariaDB hereby grants you permission to use this License's text to license your
+works, and to refer to it using the trademark "Business Source License", as long
+as you comply with the Covenants of Licensor below.
+
+Covenants of Licensor
+
+In consideration of the right to use this License's text and the "Business Source
+License" name and trademark, Licensor covenants to MariaDB, and to all other
+recipients of the licensed work to be provided by Licensor:
+
+1. To specify as the Change License the GPL Version 2.0 or any later version, or
+   a license that is compatible with GPL Version 2.0 or a later version, where
+   "compatible" means that software provided under the Change License can be
+   included in a program with software provided under GPL Version 2.0 or a later
+   version. Licensor may specify additional Change Licenses without limitation.
+
+2. To either: (a) specify an additional grant of rights to use that does not
+   impose any additional restriction on the right granted in this License, as the
+   Additional Use Grant; or (b) insert the text "None".
+
+3. To specify a Change Date.
+
+4. Not to modify this License in any other way.

package/dist/{BackgroundAgentManager-C5HEirFN.mjs → BackgroundAgentManager-DQjlUwRw.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { $ as ProjectEvents, $t as parseRateLimitHeaders, A as GenerateImageToolCallSchema, At as dayjsConfig_default, B as InviteEvents, Bt as obfuscateApiKey, C as ElabsEvents, Ct as UnauthorizedError, D as ForbiddenError, Dt as VideoModels, E as FileEvents, Et as VideoGenerationUsageTransaction, F as ImageEditUsageTransaction, Ft as isGPTImageModel, G as ModalEvents, Gt as settingsMap, H as KnowledgeType, Ht as resolveNavigationIntents, I as ImageGenerationUsageTransaction, It as isModelAccessible, J as OpenAIEmbeddingModel, K as ModelBackend, Kt as substituteArguments$1, L as ImageModels, Lt as isSupportedEmbeddingModel, M as GenericCreditDeductTransaction, Mt as getMcpProviderMetadata, N as HTTPError, Nt as getViewById, O as FriendshipEvents, Ot as XAI_IMAGE_MODELS, P as HttpStatus, Pt as isGPTImage2Model, Q as ProfileEvents, Qt as isNearLimit, R as InboxEvents, Rt as isZodError, S as DashboardParamsSchema, St as UiNavigationEvents, T as FeedbackEvents, Tt as VIDEO_SIZE_CONSTRAINTS, U as LLMEvents, Ut as sanitizeTelemetryError, V as InviteType, Vt as parseSkillArguments, W as MiscEvents, Wt as secureParameters, X as Permission, Xt as buildRateLimitLogEntry, Y as OpenAIImageGenerationInput, Z as PermissionDeniedError, Zt as extractSnippetMeta, _ as ChatCompletionCreateInputSchema, _t as TaskScheduleHandler, a as ALERT_THRESHOLDS, at as ReceivedCreditTransaction, b as CompletionApiUsageTransaction, bt as ToolUsageTransaction, c as ApiKeyScope, ct as ResearchModeParamsSchema, d as ArtifactTypeSchema, dt as ResearchTaskType, en as CollectionType, et as PromptIntentSchema, f as AuthEvents, ft as SessionEvents, gt as TagType, h as BadRequestError, ht as SupportedFabFileMimeTypes, it as RealtimeVoiceUsageTransaction, j as GenericCreditAddTransaction, jt as getAccessibleDataLakes, k as GEMINI_IMAGE_MODELS, kt as b4mLLMTools, l as ApiKeyType, lt as ResearchTaskExecutionType, m as BFL_SAFETY_TOLERANCE, mt as SubscriptionCreditTransaction, n as logger, nt as PurchaseTransaction, o as AiEvents, ot as RechartsChartTypeList, p as BFL_IMAGE_MODELS, pt as SpeechToTextUsageTransaction, q as NotFoundError, qt as toDataLakeConfig, rt as QuestMasterParamsSchema, s as ApiKeyEvents, st as RegInviteEvents, t as ConfigStore, tt as PromptMetaZodSchema, u as AppFileEvents, ut as ResearchTaskPeriodicFrequencyType, v as ChatModels, vt as TextGenerationUsageTransaction, w as FavoriteDocumentType, wt as UnprocessableEntityError, x as CorruptedFileError, xt as TransferCreditTransaction, y as ClaudeArtifactMimeTypes, yt as TooManyRequestsError, z as InternalServerError, zt as mapMimeTypeToArtifactType } from "./ConfigStore-gV8aHo9b.mjs";
-import { a as isUserLockedOut, c as userCanDisableMFA, d as userRequiresMFA, f as verifyBackupCode, i as getLockoutTimeRemaining, l as userEligibleForMFA, n as generateBackupCodes, o as recordFailedAttempt, p as verifyTOTPToken, r as generateTOTPSetup, s as shouldResetFailedAttempts, t as clearFailedAttempts, u as userHasMFAConfigured } from "./utils-PpNti-tY.mjs";
+import { $ as ProjectEvents, $t as parseRateLimitHeaders, A as GenerateImageToolCallSchema, At as dayjsConfig_default, B as InviteEvents, Bt as obfuscateApiKey, C as ElabsEvents, Ct as UnauthorizedError, D as ForbiddenError, Dt as VideoModels, E as FileEvents, Et as VideoGenerationUsageTransaction, F as ImageEditUsageTransaction, Ft as isGPTImageModel, G as ModalEvents, Gt as settingsMap, H as KnowledgeType, Ht as resolveNavigationIntents, I as ImageGenerationUsageTransaction, It as isModelAccessible, J as OpenAIEmbeddingModel, K as ModelBackend, Kt as substituteArguments$1, L as ImageModels, Lt as isSupportedEmbeddingModel, M as GenericCreditDeductTransaction, Mt as getMcpProviderMetadata, N as HTTPError, Nt as getViewById, O as FriendshipEvents, Ot as XAI_IMAGE_MODELS, P as HttpStatus, Pt as isGPTImage2Model, Q as ProfileEvents, Qt as isNearLimit, R as InboxEvents, Rt as isZodError, S as DashboardParamsSchema, St as UiNavigationEvents, T as FeedbackEvents, Tt as VIDEO_SIZE_CONSTRAINTS, U as LLMEvents, Ut as sanitizeTelemetryError, V as InviteType, Vt as parseSkillArguments, W as MiscEvents, Wt as secureParameters, X as Permission, Xt as buildRateLimitLogEntry, Y as OpenAIImageGenerationInput, Z as PermissionDeniedError, Zt as extractSnippetMeta, _ as ChatCompletionCreateInputSchema, _t as TaskScheduleHandler, a as ALERT_THRESHOLDS, at as ReceivedCreditTransaction, b as CompletionApiUsageTransaction, bt as ToolUsageTransaction, c as ApiKeyScope, ct as ResearchModeParamsSchema, d as ArtifactTypeSchema, dt as ResearchTaskType, en as CollectionType, et as PromptIntentSchema, f as AuthEvents, ft as SessionEvents, gt as TagType, h as BadRequestError, ht as SupportedFabFileMimeTypes, it as RealtimeVoiceUsageTransaction, j as GenericCreditAddTransaction, jt as getAccessibleDataLakes, k as GEMINI_IMAGE_MODELS, kt as b4mLLMTools, l as ApiKeyType, lt as ResearchTaskExecutionType, m as BFL_SAFETY_TOLERANCE, mt as SubscriptionCreditTransaction, n as logger, nt as PurchaseTransaction, o as AiEvents, ot as RechartsChartTypeList, p as BFL_IMAGE_MODELS, pt as SpeechToTextUsageTransaction, q as NotFoundError, qt as toDataLakeConfig, rt as QuestMasterParamsSchema, s as ApiKeyEvents, st as RegInviteEvents, t as ConfigStore, tt as PromptMetaZodSchema, u as AppFileEvents, ut as ResearchTaskPeriodicFrequencyType, v as ChatModels, vt as TextGenerationUsageTransaction, w as FavoriteDocumentType, wt as UnprocessableEntityError, x as CorruptedFileError, xt as TransferCreditTransaction, y as ClaudeArtifactMimeTypes, yt as TooManyRequestsError, z as InternalServerError, zt as mapMimeTypeToArtifactType } from "./ConfigStore-7kcIJ-ux.mjs";
+import { a as isUserLockedOut, c as userCanDisableMFA, d as userRequiresMFA, f as verifyBackupCode, i as getLockoutTimeRemaining, l as userEligibleForMFA, n as generateBackupCodes, o as recordFailedAttempt, p as verifyTOTPToken, r as generateTOTPSetup, s as shouldResetFailedAttempts, t as clearFailedAttempts, u as userHasMFAConfigured } from "./utils-fqhJmuB8.mjs";
 import { n as isPathAllowed, t as assertPathAllowed } from "./pathValidation-D8tjkQXE-1HwvsuYT.mjs";
-import { t as version } from "./package-Dzetdo6D.mjs";
+import { t as version } from "./package-DLM23Ze7.mjs";
 import { execFile, execFileSync, spawn } from "child_process";
 import crypto, { createHash, randomBytes, randomUUID } from "crypto";
 import { existsSync, promises, readFileSync, readdirSync, rmSync, statSync, unlinkSync, writeFileSync } from "fs";
@@ -3300,6 +3300,12 @@ const MIME_TO_EXT = {
 };
 const INFINITE_VALUE = 14;
 const MAX_FILE_SIZE$2 = 6e3;
+/** Cap on generated images surfaced to the model for editing (keeps the context note small). */
+const MAX_RECENT_GENERATED_IMAGES = 6;
+/** Chars of the originating prompt kept per generated image, for context without bloat. */
+const RECENT_IMAGE_PROMPT_PREVIEW_CHARS = 120;
+/** quest.images also holds non-image generated artifacts (e.g. .xlsx); only these extensions are editable. */
+const EDITABLE_IMAGE_KEY_RE = /\.(jpe?g|png|webp|gif)$/i;
 const PREVIEW_CHUNK = 700;
 const CHARS_PER_TOKEN = 3.5;
 const MAX_IMAGE_DIMENSION_PX = 2e3;
@@ -3407,70 +3413,85 @@ async function fetchAndProcessPreviousMessages(session, historyCount = null, { d
 		chatHistoryItems.splice(0, chatHistoryItems.length, ...filtered);
 	}
 	const oldestIncludedQuestId = chatHistoryItems[0]?.id ?? null;
-	return [
-		chatHistoryItems.reduce((acc, cur) => {
-			if (cur.prompt) acc.push({
+	const convertedMessages = chatHistoryItems.reduce((acc, cur) => {
+		if (cur.prompt) acc.push({
+			role: "user",
+			content: cur.prompt
+		});
+		if (cur.structuredReplies && cur.structuredReplies.length > 0) {
+			for (const structuredReply of cur.structuredReplies) acc.push({
+				role: "assistant",
+				content: structuredReply.content
+			});
+			if (cur.toolResults && cur.toolResults.length > 0) acc.push({
 				role: "user",
-				content: cur.prompt
+				content: cur.toolResults.map((tr) => ({
+					type: "tool_result",
+					tool_use_id: tr.tool_use_id,
+					content: tr.content,
+					is_error: tr.is_error
+				}))
 			});
-			if (cur.structuredReplies && cur.structuredReplies.length > 0) {
-				for (const structuredReply of cur.structuredReplies) acc.push({
+		} else if (cur.promptMeta?.functionCalls && cur.promptMeta.functionCalls.length > 0 && cur.promptMeta.functionCalls.some((fc) => fc.id)) {
+			const textReply = cur.replies?.find((reply) => !reply.trim().startsWith("<think>")) || "";
+			const assistantContent = [];
+			if (textReply) assistantContent.push({
+				type: "text",
+				text: textReply
+			});
+			for (const fc of cur.promptMeta.functionCalls) if (fc.id && fc.name) assistantContent.push({
+				type: "tool_use",
+				id: fc.id,
+				name: fc.name,
+				input: fc.parameters || {}
+			});
+			if (assistantContent.length > 0) {
+				acc.push({
 					role: "assistant",
-					content: structuredReply.content
+					content: assistantContent
 				});
-				if (cur.toolResults && cur.toolResults.length > 0) acc.push({
+				const toolResults = cur.promptMeta.functionCalls.filter((fc) => fc.id && fc.name).map((fc) => ({
+					type: "tool_result",
+					tool_use_id: fc.id,
+					content: fc.returnValue ?? (fc.success === false ? "Tool execution failed" : ""),
+					is_error: fc.success === false
+				}));
+				if (toolResults.length > 0) acc.push({
 					role: "user",
-					content: cur.toolResults.map((tr) => ({
-						type: "tool_result",
-						tool_use_id: tr.tool_use_id,
-						content: tr.content,
-						is_error: tr.is_error
-					}))
-				});
-			} else if (cur.promptMeta?.functionCalls && cur.promptMeta.functionCalls.length > 0 && cur.promptMeta.functionCalls.some((fc) => fc.id)) {
-				const textReply = cur.replies?.find((reply) => !reply.trim().startsWith("<think>")) || "";
-				const assistantContent = [];
-				if (textReply) assistantContent.push({
-					type: "text",
-					text: textReply
-				});
-				for (const fc of cur.promptMeta.functionCalls) if (fc.id && fc.name) assistantContent.push({
-					type: "tool_use",
-					id: fc.id,
-					name: fc.name,
-					input: fc.parameters || {}
-				});
-				if (assistantContent.length > 0) {
-					acc.push({
-						role: "assistant",
-						content: assistantContent
-					});
-					const toolResults = cur.promptMeta.functionCalls.filter((fc) => fc.id && fc.name).map((fc) => ({
-						type: "tool_result",
-						tool_use_id: fc.id,
-						content: fc.returnValue ?? (fc.success === false ? "Tool execution failed" : ""),
-						is_error: fc.success === false
-					}));
-					if (toolResults.length > 0) acc.push({
-						role: "user",
-						content: toolResults
-					});
-				}
-			} else if (cur.replies && Array.isArray(cur.replies)) {
-				const validReply = cur.replies.find((reply) => !reply.trim().startsWith("<think>"));
-				if (validReply) acc.push({
-					role: "assistant",
-					content: validReply
+					content: toolResults
 				});
 			}
-			return acc;
-		}, new Array()),
+		} else if (cur.replies && Array.isArray(cur.replies)) {
+			const validReply = cur.replies.find((reply) => !reply.trim().startsWith("<think>"));
+			if (validReply) acc.push({
+				role: "assistant",
+				content: validReply
+			});
+		}
+		return acc;
+	}, new Array());
+	const recentGeneratedImages = [];
+	for (let i = chatHistoryItems.length - 1; i >= 0 && recentGeneratedImages.length < MAX_RECENT_GENERATED_IMAGES; i--) {
+		const item = chatHistoryItems[i];
+		if (!Array.isArray(item.images) || item.images.length === 0) continue;
+		const prompt = (item.prompt ?? "").slice(0, RECENT_IMAGE_PROMPT_PREVIEW_CHARS);
+		for (const key of item.images) {
+			if (recentGeneratedImages.length >= MAX_RECENT_GENERATED_IMAGES) break;
+			if (typeof key === "string" && EDITABLE_IMAGE_KEY_RE.test(key)) recentGeneratedImages.push({
+				key,
+				prompt
+			});
+		}
+	}
+	return [
+		convertedMessages,
 		chatHistoryItems.length,
 		{
 			cacheHit: fetchTime < 50,
 			fetchTime,
 			itemCount: chatHistoryItems.length,
-			oldestIncludedQuestId
+			oldestIncludedQuestId,
+			recentGeneratedImages
 		}
 	];
 }
@@ -11228,7 +11249,7 @@ function continuousToy() {
 }
 schedulingToy(), routingToy(), packingToy(), assignmentToy(), networkToy(), partitioningToy(), selectionToy(), economicToy(), continuousToy();
 //#endregion
-//#region ../../b4m-core/services/dist/tools-Dzibx4fx.mjs
+//#region ../../b4m-core/services/dist/tools-FLVnTwId.mjs
 async function performDeepResearch(context, params, config = {}) {
 	const maxDepth = config.maxDepth || 7;
 	const duration = config.duration || 4.5;
@@ -12966,6 +12987,39 @@ async function getImageFromFileId(fileId, context) {
 	if (fabFile.fileUrl) return fabFile.fileUrl;
 	throw new Error(`File ${fileId} has no accessible URL`);
 }
+/**
+* Resolve a generated-image storage key (the bare key persisted in
+* `quest.images`, e.g. "86cdc650-….jpg") to a downloadable URL.
+*
+* image_generation / edit_image upload their output to `imageGenerateStorage`
+* and persist only the bare key — no fabFile record is created — so a generated
+* image is NOT addressable as a fabFile ObjectId. Resolving it against the image
+* bucket is what lets a follow-up edit ("make it cartoonish") target a
+* previously generated image. The model learns these keys from the "Recently
+* generated images" system note assembled in ChatCompletionProcess.
+*/
+async function getGeneratedImageUrl(storageKey, context) {
+	try {
+		return await context.imageGenerateStorage.getSignedUrl(storageKey);
+	} catch (error) {
+		const detail = error instanceof Error ? error.message : String(error);
+		throw new Error(`Could not resolve generated image "${storageKey}". Use the exact id from the "Recently generated images" system note, a fabFile ID from "Available Files", or a full URL. (${detail})`);
+	}
+}
+/**
+* Resolve an image input (source or mask) to a downloadable URL. Accepts, in
+* priority order:
+*   • an http(s)/data URL — passed straight through
+*   • a fabFile ObjectId (24-char hex) — an uploaded image from "Available Files"
+*   • otherwise a generated-image storage key (the bare key in quest.images,
+*     e.g. "86cdc650-….jpg") — resolved against the image bucket
+* Source and mask share this so a generated-image key works for either.
+*/
+async function resolveImageInputUrl(input, context) {
+	if (input.startsWith("http://") || input.startsWith("https://") || input.startsWith("data:")) return input;
+	if (/^[0-9a-fA-F]{24}$/.test(input)) return getImageFromFileId(input, context);
+	return getGeneratedImageUrl(input, context);
+}
 async function processAndStoreImage(imageUrl, context) {
 	const buffer = await downloadImage(imageUrl);
 	const fileType = await fileTypeFromBuffer(buffer);
@@ -13039,17 +13093,9 @@ Please select a supported edit model in your image settings modal.`;
 				quality: imageConfig?.quality,
 				prompt
 			});
-			let sourceImageUrl;
-			if (toolImage.startsWith("http://") || toolImage.startsWith("https://") || toolImage.startsWith("data:")) sourceImageUrl = toolImage;
-			else sourceImageUrl = await getImageFromFileId(toolImage, context);
-			const sourceBase64Image = await imageUrlToBase64(sourceImageUrl);
+			const sourceBase64Image = await imageUrlToBase64(await resolveImageInputUrl(toolImage, context));
 			let maskBase64Image = null;
-			if (toolMask) {
-				let maskImageUrl;
-				if (toolMask.startsWith("http://") || toolMask.startsWith("https://") || toolMask.startsWith("data:")) maskImageUrl = toolMask;
-				else maskImageUrl = await getImageFromFileId(toolMask, context);
-				maskBase64Image = await imageUrlToBase64(maskImageUrl);
-			}
+			if (toolMask) maskBase64Image = await imageUrlToBase64(await resolveImageInputUrl(toolMask, context));
 			if (isBFLModel) {
 				const service = new BFLImageService(await (0, apiKeyService_exports.getEffectiveApiKey)(context.userId, { type: ApiKeyType.bfl }, { db: context.db }), context.logger, context.imageProcessorLambdaName);
 				let bflModel = editModel;
@@ -13143,13 +13189,13 @@ Please check your BFL API key in settings and ensure it is configured correctly.
 		},
 		toolSchema: {
 			name: "edit_image",
-			description: "Edit an existing image based on a text prompt. Use this when the user wants to modify, change, edit, or transform an image they have uploaded or attached to the conversation. Supports removing backgrounds, changing colors, adding/removing objects, and other visual modifications.",
+			description: "Edit an existing image based on a text prompt. Use this when the user wants to modify, change, edit, or transform an image — whether they uploaded/attached it OR it was generated earlier in this conversation (e.g. \"make the previous image more cartoonish\", \"adjust the angle\"). Supports removing backgrounds, changing colors, adding/removing objects, and other visual modifications.",
 			parameters: {
 				type: "object",
 				properties: {
 					image: {
 						type: "string",
-						description: "The file ID of the image to edit (e.g., \"67abc123def456\"). Look for image file IDs in the \"Available Files\" system message. You can also use an S3 URL or data URL if provided by the user."
+						description: "The image to edit. Provide one of: the exact id of a previously generated image from the \"Recently generated images\" system note (e.g. \"86cdc650-43d2-416e-aca6-23ff4fe23081.jpg\"); a fabFile ID of an uploaded image from the \"Available Files\" system message (e.g. \"67abc123def456\"); or a full http(s)/data URL."
 					},
 					prompt: {
 						type: "string",
@@ -13613,9 +13659,12 @@ const getWikipediaOnThisDay = async (parameters = {}) => {
 	try {
 		const { month, day } = parseMonthDay(date);
 		const url = `https://en.wikipedia.org/api/rest_v1/feed/onthisday/${type}/${month}/${day}`;
+		const brand = process.env.APP_NAME || "";
+		const websiteUrl = process.env.WEBSITE_URL || "";
+		const userAgent = brand ? `${brand}/1.0${websiteUrl ? ` (${websiteUrl})` : ""}` : "App/1.0";
 		const response = await fetch(url, { headers: {
 			Accept: "application/json",
-			"User-Agent": "Bike4Mind/1.0 (https://bike4mind.com; contact@bike4mind.com)"
+			"User-Agent": userAgent
 		} });
 		if (!response.ok) {
 			if (response.status === 404) throw new Error(`No data available for ${month}-${day}. The date may be invalid.`);
@@ -16053,7 +16102,8 @@ function applyCellStyle(cell, style) {
 */
 async function generateExcel(params) {
 	const workbook = new ExcelJS.Workbook();
-	workbook.creator = "Bike4Mind AI";
+	const brand = process.env.APP_NAME || "";
+	workbook.creator = brand ? `${brand} AI` : "AI";
 	workbook.created = /* @__PURE__ */ new Date();
 	for (const sheetData of params.sheets) {
 		const worksheet = workbook.addWorksheet(sheetData.name.slice(0, LIMITS.MAX_SHEET_NAME_LENGTH));
@@ -16118,7 +16168,18 @@ const excelGenerationTool = {
 		},
 		toolSchema: {
 			name: "excel_generation",
-			description: `Generate Excel (.xlsx) files with formatting. Supports: multiple sheets, formulas (SUM, AVERAGE, IF, etc.), styling (bold, colors, borders), number formats, merged cells, frozen panes. Limits: max ${LIMITS.MAX_SHEETS} sheets, ${LIMITS.MAX_CELLS_PER_SHEET} cells/sheet, rows 1-${LIMITS.MAX_ROW}, cols 1-${LIMITS.MAX_COL}.`,
+			description: `Generate a well-formed Excel (.xlsx) workbook. Supports: multiple sheets, formulas (SUM, AVERAGE, IF, VLOOKUP, etc.; only a safe whitelisted subset), styling (bold, colors, borders), number formats, merged cells, frozen panes.
+
+HARD LIMITS (the request is REJECTED if any are exceeded, not truncated, so data is never silently dropped):
+- At most ${LIMITS.MAX_SHEETS} sheets per workbook.
+- At most ${LIMITS.MAX_CELLS_PER_SHEET} populated cells per sheet (count the cell objects you pass in "data", not the grid area).
+- Row numbers 1-${LIMITS.MAX_ROW} and column numbers 1-${LIMITS.MAX_COL} only.
+- Sheet names: 1-${LIMITS.MAX_SHEET_NAME_LENGTH} characters.
+- Formulas may only use whitelisted functions; volatile/external ones (HYPERLINK, WEBSERVICE, CMD, etc.) are blocked.
+
+Addressing is 1-indexed numeric row/col (row 1, col 1 = cell A1); do NOT pass A1-style strings. Provide only the cells you want populated; empty cells need no entry.
+
+Before calling: if the user's request would exceed any limit (e.g. a dataset larger than ${LIMITS.MAX_CELLS_PER_SHEET} cells or more than ${LIMITS.MAX_SHEETS} sheets), do not promise the full result; tell the user what you can deliver within these limits and either split the data across sheets/files or summarize. Only commit to what this tool can actually produce.`,
 			parameters: {
 				type: "object",
 				properties: {
@@ -17695,7 +17756,7 @@ var mfaService_exports$1 = /* @__PURE__ */ __exportAll$3({
 * This generates the secret and backup codes but doesn't enable MFA yet
 * The user must verify the setup before MFA is enabled
 */
-async function setupMFA({ user, appName = "Bike4Mind" }, userRepository) {
+async function setupMFA({ user, appName = process.env.APP_NAME || "" }, userRepository) {
 	if (!userEligibleForMFA(user)) throw new Error("User is not eligible for MFA setup.");
 	if (user.mfa && user.mfa.totpEnabled) throw new Error("MFA is already enabled for this user.");
 	if (user.mfa && user.mfa.totpEnabled === false) user.mfa = null;
@@ -17725,7 +17786,7 @@ async function setupMFA({ user, appName = "Bike4Mind" }, userRepository) {
 async function verifyMFASetup(user, token, userRepository) {
 	if (!user.mfa || !user.mfa.totpSecret) throw new Error("No MFA setup in progress for this user.");
 	if (user.mfa.totpEnabled) throw new Error("MFA is already enabled for this user.");
-	const { verifyTOTPToken } = await import("./utils-BGtSXfce.mjs");
+	const { verifyTOTPToken } = await import("./utils-CLjLKvqQ.mjs");
 	if (!verifyTOTPToken(user.mfa.totpSecret, token)) throw new Error("Invalid TOTP code.");
 	const updatedMFA = { ...user.mfa };
 	updatedMFA.totpEnabled = true;
@@ -20146,6 +20207,7 @@ z.object({
 	surface: z.string().optional(),
 	enabledTools: z.array(z.string()).optional(),
 	disabledTools: z.array(z.string()).optional(),
+	disableUserIntegrations: z.boolean().optional(),
 	forceKnowledgeRetrieval: z.boolean().optional(),
 	retrievalTags: z.array(z.string()).optional(),
 	citationStyle: z.enum(["named", "indexed"]).optional(),
@@ -20160,8 +20222,7 @@ z.object({
 	clonedSourceId: z.string().optional().nullable(),
 	forkedSourceId: z.string().optional().nullable(),
 	projectId: z.string().optional(),
-	lastUsedModel: z.string().optional().nullable(),
-	optiHashi: z.boolean().optional()
+	lastUsedModel: z.string().optional().nullable()
 });
 z.object({ id: z.string() });
 z.object({ id: z.string() });

package/dist/{ConfigStore-gV8aHo9b.mjs → ConfigStore-7kcIJ-ux.mjs}

@@ -21,8 +21,8 @@ let CollectionType = /* @__PURE__ */ function(CollectionType) {
 	CollectionType["AI_IMAGE"] = "ai_image";
 	return CollectionType;
 }({});
-//#endregion
-//#region ../../b4m-core/common/dist/api--fTBBxKG.mjs
+process.env.APP_NAME;
+process.env.WEBSITE_URL;
 const extractSnippetMeta = (content) => {
 	const snippetRegex = /<!--snippet-meta\s*(\{[\s\S]*?\})\s*-->[\n\s]*([\s\S]*?)(?=<!--snippet-meta|$)/g;
 	const sections = [];
@@ -3817,6 +3817,8 @@ z.enum([
 	"EnableArtifactsDefault",
 	"EnableAgents",
 	"EnableAgentsDefault",
+	"EnableAgentMode",
+	"EnableAgentModeDefault",
 	"EnableRapidReply",
 	"EnableRapidReplyDefault",
 	"EnableLattice",
@@ -3978,7 +3980,10 @@ const OrchestrationDefaultsSchema = z.object({
 		"sunrise_sunset",
 		"planet_visibility",
 		"code_execute",
-		"coordinate_task"
+		"coordinate_task",
+		"image_generation",
+		"edit_image",
+		"excel_generation"
 	]),
 	/**
 	* Tool names explicitly forbidden. Enforced as a final subtraction in
@@ -4005,10 +4010,7 @@ const OrchestrationDefaultsSchema = z.object({
 		"lattice_create_model",
 		"lattice_add_entity",
 		"lattice_set_value",
-		"lattice_create_rule",
-		"image_generation",
-		"edit_image",
-		"excel_generation"
+		"lattice_create_rule"
 	]),
 	/** Per-thoroughness iteration ceiling. Matches `IAgent.maxIterations`. */
 	maxIterations: z.object({
@@ -4884,6 +4886,14 @@ const API_SERVICE_GROUPS = {
 				key: "enableAgentProactiveMessages",
 				order: 12
 			},
+			{
+				key: "EnableAgentMode",
+				order: 15
+			},
+			{
+				key: "EnableAgentModeDefault",
+				order: 16
+			},
 			{
 				key: "EnableArtifacts",
 				order: 20
@@ -5446,6 +5456,25 @@ const settingsMap = {
 		order: 11,
 		dependsOn: "EnableAgents"
 	}),
+	EnableAgentMode: makeBooleanSetting({
+		key: "EnableAgentMode",
+		name: "Enable Agent Mode (Smart Routing)",
+		defaultValue: true,
+		description: "Whether the Agent Mode / Smart Routing feature is available to users. When enabled, users can opt in via the Beta Features tab to have complex prompts automatically routed to multi-step agents. Set to off to hide the feature org-wide.",
+		category: "Experimental",
+		group: API_SERVICE_GROUPS.EXPERIMENTAL.id,
+		order: 15
+	}),
+	EnableAgentModeDefault: makeBooleanSetting({
+		key: "EnableAgentModeDefault",
+		name: "Agent Mode: On by default for users",
+		defaultValue: false,
+		description: "When enabled, Agent Mode / Smart Routing is active for users who have never explicitly toggled it. Leave off for an opt-in rollout.",
+		category: "Experimental",
+		group: API_SERVICE_GROUPS.EXPERIMENTAL.id,
+		order: 16,
+		dependsOn: "EnableAgentMode"
+	}),
 	EnableRapidReply: makeBooleanSetting({
 		key: "EnableRapidReply",
 		name: "Enable Rapid Reply",
@@ -5544,7 +5573,7 @@ const settingsMap = {
 	tagLineMain: makeStringSetting({
 		key: "tagLineMain",
 		name: "Tag Line Main",
-		defaultValue: "Bike4Mind",
+		defaultValue: process.env.NEXT_PUBLIC_APP_NAME || process.env.APP_NAME || "",
 		description: "The main tag line to display on the app.",
 		category: "Branding",
 		group: API_SERVICE_GROUPS.BRANDING.id,
@@ -6190,7 +6219,7 @@ const settingsMap = {
 		key: "qWorkUrl",
 		name: "Q/Work URL",
 		defaultValue: "",
-		description: "The base URL for the Q/Work API (for example: https://q.bike4mind.com).",
+		description: "The base URL for the Q/Work API (for example: https://q.your-deployment.example.com).",
 		category: "Tools",
 		group: API_SERVICE_GROUPS.Q_WORK.id,
 		order: 1
@@ -9318,7 +9347,7 @@ z.array(triggerWordSchema).max(20, "Up to 20 trigger words allowed.").transform(
 		const key = word.toLowerCase();
 		if (seen.has(key)) continue;
 		seen.add(key);
-		out.push(word);
+		out.push(key);
 	}
 	return out;
 });

package/dist/commands/apiCommand.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as ConfigStore } from "../ConfigStore-gV8aHo9b.mjs";
+import { t as ConfigStore } from "../ConfigStore-7kcIJ-ux.mjs";
 //#region src/commands/apiCommand.ts
 /**
 * External API config command (--api-url / --reset-api)

package/dist/commands/doctorCommand.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as version } from "../package-Dzetdo6D.mjs";
+import { t as version } from "../package-DLM23Ze7.mjs";
 import { a as fetchLatestVersion, c as isNpmPrefixWritable, i as compareSemver } from "../updateChecker-C8xsNY2L.mjs";
 import { t as checkRipgrep } from "../ripgrepCheck-BmkyTK2i.mjs";
 import { execSync } from "child_process";

package/dist/commands/envCommand.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as ConfigStore } from "../ConfigStore-gV8aHo9b.mjs";
+import { t as ConfigStore } from "../ConfigStore-7kcIJ-ux.mjs";
 //#region src/commands/envCommand.ts
 /**
 * Environment switching for the `--dev` / `--prod` launch flags.

package/dist/commands/headlessCommand.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { C as createCoordinateTaskTool, D as FallbackLlmBackend, E as ApiClient, F as generateCliTools, G as ReActAgent, N as loadContextFiles, O as ServerLlmBackend, P as PermissionManager, Q as CheckpointStore, T as createAgentDelegateTool, W as setWebSocketToolExecutor, X as RemoteSkillSource, Y as isReadOnlyTool, Z as CustomCommandStore, _ as createGetFileStructureTool, a as WebSocketToolExecutor, b as createWriteTodosTool, et as SessionStore, i as McpManager, n as SubagentOrchestrator, o as WebSocketConnectionManager, q as buildSystemPrompt, r as AgentStore, s as WebSocketLlmBackend, t as BackgroundAgentManager, v as createFindDefinitionTool, w as createBackgroundAgentTools, x as createSkillTool, y as createTodoStore } from "../BackgroundAgentManager-C5HEirFN.mjs";
-import { n as logger, r as getApiUrl, t as ConfigStore } from "../ConfigStore-gV8aHo9b.mjs";
+import { C as createCoordinateTaskTool, D as FallbackLlmBackend, E as ApiClient, F as generateCliTools, G as ReActAgent, N as loadContextFiles, O as ServerLlmBackend, P as PermissionManager, Q as CheckpointStore, T as createAgentDelegateTool, W as setWebSocketToolExecutor, X as RemoteSkillSource, Y as isReadOnlyTool, Z as CustomCommandStore, _ as createGetFileStructureTool, a as WebSocketToolExecutor, b as createWriteTodosTool, et as SessionStore, i as McpManager, n as SubagentOrchestrator, o as WebSocketConnectionManager, q as buildSystemPrompt, r as AgentStore, s as WebSocketLlmBackend, t as BackgroundAgentManager, v as createFindDefinitionTool, w as createBackgroundAgentTools, x as createSkillTool, y as createTodoStore } from "../BackgroundAgentManager-DQjlUwRw.mjs";
+import { n as logger, r as getApiUrl, t as ConfigStore } from "../ConfigStore-7kcIJ-ux.mjs";
 import { t as DEFAULT_SANDBOX_CONFIG } from "../types-LyRNHOiS.mjs";
 import { t as createSandboxRuntime } from "../SandboxRuntimeAdapter-ChGlxSGQ.mjs";
 import { t as SandboxOrchestrator } from "../SandboxOrchestrator-BoINxbX4.mjs";

package/dist/commands/mcpCommand.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as ConfigStore } from "../ConfigStore-gV8aHo9b.mjs";
+import { t as ConfigStore } from "../ConfigStore-7kcIJ-ux.mjs";
 //#region src/commands/mcpCommand.ts
 /**
 * External MCP commands (b4m mcp list, b4m mcp add, etc.)

package/dist/commands/updateCommand.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as version } from "../package-Dzetdo6D.mjs";
+import { t as version } from "../package-DLM23Ze7.mjs";
 import { c as isNpmPrefixWritable, l as setAutoUpdatePreference, n as REEXEC_GUARD_ENV, o as forceCheckForUpdate, r as checkForUpdate, s as getAutoUpdatePreference, t as INSTALL_CMD, u as shouldAttemptAutoUpdate } from "../updateChecker-C8xsNY2L.mjs";
 import { t as checkRipgrep } from "../ripgrepCheck-BmkyTK2i.mjs";
 import { execSync, spawnSync } from "child_process";

package/dist/index.mjs

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { $ as CommandHistoryStore, A as substituteArguments, B as DEFAULT_RETRY_CONFIG, C as createCoordinateTaskTool, D as FallbackLlmBackend, E as ApiClient, F as generateCliTools, G as ReActAgent, H as clearFeatureModuleTools, I as getProcessHooks, J as buildSkillsPromptSection, K as getPlanModeFilePath, L as ALWAYS_DENIED_FOR_AGENTS, M as extractCompactInstructions, N as loadContextFiles, O as ServerLlmBackend, P as PermissionManager, Q as CheckpointStore, R as DEFAULT_AGENT_MODEL, S as parseAgentConfig, T as createAgentDelegateTool, U as registerFeatureModuleTools, V as DEFAULT_THOROUGHNESS, W as setWebSocketToolExecutor, X as RemoteSkillSource, Y as isReadOnlyTool, Z as CustomCommandStore, _ as createGetFileStructureTool, a as WebSocketToolExecutor, at as mergeCommands, b as createWriteTodosTool, c as createReviewGateStore, ct as warmFileCache, d as createBlockerStore, et as SessionStore, f as createBlockerTools, g as formatDecisionsOutput, h as createDecisionStore, i as McpManager, it as searchCommands, j as formatStep, k as isTransientNetworkError, l as createReviewGateTool, m as createDecisionLogTool, n as SubagentOrchestrator, nt as hasFileReferences, o as WebSocketConnectionManager, ot as formatFileSize, p as formatBlockersOutput, q as buildSystemPrompt, r as AgentStore, rt as processFileReferences, s as WebSocketLlmBackend, st as searchFiles, t as BackgroundAgentManager, tt as OAuthClient, u as formatReviewGatesOutput, v as createFindDefinitionTool, w as createBackgroundAgentTools, x as createSkillTool, y as createTodoStore, z as DEFAULT_MAX_ITERATIONS } from "./BackgroundAgentManager-C5HEirFN.mjs";
+import { $ as CommandHistoryStore, A as substituteArguments, B as DEFAULT_RETRY_CONFIG, C as createCoordinateTaskTool, D as FallbackLlmBackend, E as ApiClient, F as generateCliTools, G as ReActAgent, H as clearFeatureModuleTools, I as getProcessHooks, J as buildSkillsPromptSection, K as getPlanModeFilePath, L as ALWAYS_DENIED_FOR_AGENTS, M as extractCompactInstructions, N as loadContextFiles, O as ServerLlmBackend, P as PermissionManager, Q as CheckpointStore, R as DEFAULT_AGENT_MODEL, S as parseAgentConfig, T as createAgentDelegateTool, U as registerFeatureModuleTools, V as DEFAULT_THOROUGHNESS, W as setWebSocketToolExecutor, X as RemoteSkillSource, Y as isReadOnlyTool, Z as CustomCommandStore, _ as createGetFileStructureTool, a as WebSocketToolExecutor, at as mergeCommands, b as createWriteTodosTool, c as createReviewGateStore, ct as warmFileCache, d as createBlockerStore, et as SessionStore, f as createBlockerTools, g as formatDecisionsOutput, h as createDecisionStore, i as McpManager, it as searchCommands, j as formatStep, k as isTransientNetworkError, l as createReviewGateTool, m as createDecisionLogTool, n as SubagentOrchestrator, nt as hasFileReferences, o as WebSocketConnectionManager, ot as formatFileSize, p as formatBlockersOutput, q as buildSystemPrompt, r as AgentStore, rt as processFileReferences, s as WebSocketLlmBackend, st as searchFiles, t as BackgroundAgentManager, tt as OAuthClient, u as formatReviewGatesOutput, v as createFindDefinitionTool, w as createBackgroundAgentTools, x as createSkillTool, y as createTodoStore, z as DEFAULT_MAX_ITERATIONS } from "./BackgroundAgentManager-DQjlUwRw.mjs";
 import { n as useCliStore, t as selectActiveBackgroundAgents } from "./store-DV5s-qni.mjs";
-import { Jt as validateJupyterKernelName, Yt as validateNotebookPath$1, g as CREDIT_DEDUCT_TRANSACTION_TYPES, i as getEnvironmentName, n as logger, r as getApiUrl, t as ConfigStore, v as ChatModels } from "./ConfigStore-gV8aHo9b.mjs";
-import { t as version } from "./package-Dzetdo6D.mjs";
+import { Jt as validateJupyterKernelName, Yt as validateNotebookPath$1, g as CREDIT_DEDUCT_TRANSACTION_TYPES, i as getEnvironmentName, n as logger, r as getApiUrl, t as ConfigStore, v as ChatModels } from "./ConfigStore-7kcIJ-ux.mjs";
+import { t as version } from "./package-DLM23Ze7.mjs";
 import { r as checkForUpdate } from "./updateChecker-C8xsNY2L.mjs";
 import React, { useCallback, useEffect, useMemo, useReducer, useRef, useState } from "react";
 import { Box, Static, Text, render, useApp, useInput, usePaste, useStdout } from "ink";

package/dist/{package-Dzetdo6D.mjs → package-DLM23Ze7.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
 //#region package.json
-var version = "0.17.1";
+var version = "0.17.2";
 //#endregion
 export { version as t };

package/dist/utils-CLjLKvqQ.mjs

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import { p as verifyTOTPToken } from "./utils-fqhJmuB8.mjs";
+export { verifyTOTPToken };

package/dist/{utils-PpNti-tY.mjs → utils-fqhJmuB8.mjs}

@@ -13,8 +13,8 @@ process.emitWarning = originalEmitWarning;
 * Generate TOTP setup data including secret and QR code
 * Using the same implementation as polaris
 */
-async function generateTOTPSetup(userEmail, appName = "Bike4Mind") {
-	const secret = speakeasy.generateSecret({ name: `${appName} (${userEmail})` });
+async function generateTOTPSetup(userEmail, appName = process.env.APP_NAME || "") {
+	const secret = speakeasy.generateSecret({ name: appName ? `${appName} (${userEmail})` : userEmail });
 	const qrCodeUrl = await QRCode.toDataURL(secret.otpauth_url);
 	return {
 		secret: secret.base32,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bike4mind/cli",
-  "version": "0.17.1",
+  "version": "0.17.2",
   "type": "module",
   "description": "Interactive CLI tool for Bike4Mind with ReAct agents",
   "license": "UNLICENSED",
@@ -107,8 +107,8 @@
     "zod": "^4.4.3",
     "zod-validation-error": "^5.0.0",
     "zustand": "^5.0.13",
-    "@bike4mind/fab-pipeline": "0.4.1",
-    "@bike4mind/llm-adapters": "0.5.1",
+    "@bike4mind/fab-pipeline": "0.4.2",
+    "@bike4mind/llm-adapters": "0.6.0",
     "@bike4mind/observability": "0.2.0"
   },
   "devDependencies": {
@@ -124,11 +124,11 @@
     "tsx": "^4.22.3",
     "typescript": "^5.9.3",
     "vitest": "^4.1.9",
-    "@bike4mind/agents": "0.16.1",
-    "@bike4mind/common": "2.113.0",
-    "@bike4mind/mcp": "1.39.1",
-    "@bike4mind/services": "2.97.1",
-    "@bike4mind/utils": "2.25.1"
+    "@bike4mind/agents": "0.16.2",
+    "@bike4mind/common": "2.114.0",
+    "@bike4mind/mcp": "1.39.2",
+    "@bike4mind/services": "2.98.0",
+    "@bike4mind/utils": "2.25.2"
   },
   "optionalDependencies": {
     "@vscode/ripgrep": "^1.18.0"

package/dist/utils-BGtSXfce.mjs

@@ -1,3 +0,0 @@
-#!/usr/bin/env node
-import { p as verifyTOTPToken } from "./utils-PpNti-tY.mjs";
-export { verifyTOTPToken };