@bike4mind/cli 0.18.3 → 0.18.4

package/dist/{ConfigStore-DL7p3ZiY.mjs → ConfigStore-Cq20962p.mjs}

@@ -476,6 +476,25 @@ z.enum({
 	...SpeechToTextModels,
 	...VideoModels
 });
+/**
+* Integer credits charged per $1 of provider cost. Derived once with rounding
+* because the raw division carries float noise (0.0006 is inexact in binary):
+* naive ceil((usd * 3) / 0.0006) charges a phantom credit on exact multiples.
+*/
+const CREDITS_PER_USD_COST = Math.round(3 / 6e-4);
+/**
+* Converts a USD cost to credits, including markup
+* @param usd - The raw provider cost in USD to convert
+* @returns The number of credits with markup, rounded up to the nearest whole number (minimum 1)
+*
+* Examples:
+* $1 USD = 5000 credits (3× markup at $0.0006/credit)
+* $0.001 USD = 5 credits
+* $0.0001 USD = 1 credit (minimum)
+*/
+const usdToCredits = (usd) => {
+	return Math.max(1, Math.ceil(usd * CREDITS_PER_USD_COST));
+};
 z$1.enum([
 	"openai",
 	"test",
@@ -3574,14 +3593,27 @@ z$1.object({
 	prefix: z$1.string().optional()
 });
 /**
-* Constants for BFL safety tolerance settings
+* Constants for BFL safety tolerance settings.
+*
+* BFL scale: 0 = strictest filtering, 6 = effectively unfiltered. MAX is a
+* hard cap (#9776, 18 U.S.C. §2258A exposure) — enforced in the zod schemas
+* here AND clamped last-mile in BFLImageService, so no caller can raise it.
+* BFL itself caps its editing endpoints at 2.
 */
 const BFL_SAFETY_TOLERANCE = {
 	MIN: 0,
-	MAX: 6,
-	DEFAULT: 4
+	MAX: 2,
+	DEFAULT: 2,
+	/** Pre-cap sessions may have stored up to 6 — accepted as input, clamped to MAX on parse. */
+	LEGACY_INPUT_MAX: 6
 };
 /**
+* Shared safety_tolerance schema: accepts the legacy 0-6 stored range but
+* clamps the parsed output to the hard cap (coerce, not reject — rejecting
+* would break image generation for sessions saved before the cap existed).
+*/
+const BFLSafetyToleranceSchema = z.number().min(BFL_SAFETY_TOLERANCE.MIN).max(BFL_SAFETY_TOLERANCE.LEGACY_INPUT_MAX).optional().prefault(BFL_SAFETY_TOLERANCE.DEFAULT).transform((value) => Math.min(value, BFL_SAFETY_TOLERANCE.MAX));
+/**
 * List of image models supported by BlackForest Labs
 */
 const BFL_IMAGE_MODELS = [
@@ -3594,7 +3626,7 @@ const BFL_IMAGE_MODELS = [
 ];
 const CommonBFLParams = z.object({
 	prompt: z.string().nullable().optional(),
-	safety_tolerance: z.number().min(BFL_SAFETY_TOLERANCE.MIN).max(BFL_SAFETY_TOLERANCE.MAX).optional().prefault(BFL_SAFETY_TOLERANCE.DEFAULT),
+	safety_tolerance: BFLSafetyToleranceSchema,
 	output_format: z.enum(["jpeg", "png"]).nullable().optional().prefault("jpeg"),
 	image_prompt: z.string().nullable().optional(),
 	webhook_url: z.string().min(1).max(2083).nullable().optional(),
@@ -3966,6 +3998,7 @@ z.enum([
 	"EnableInertArtifactRender",
 	"pricePerCredit",
 	"ModerationEnabled",
+	"ImageModerationEnabled",
 	"tagLineMain",
 	"tagLineSub",
 	"defaultTags",
@@ -4025,6 +4058,7 @@ z.enum([
 	"enforceCredits",
 	"enableTeamPlan",
 	"allowOpenRegistration",
+	"blockDisposableEmails",
 	"defaultFreeCredits",
 	"enableGoogleCalendar",
 	"googleCalendarServiceAccountEmail",
@@ -4081,6 +4115,9 @@ z.enum([
 	"contextTelemetryAlerts",
 	"sreAgentConfig",
 	"secopsTriageConfig",
+	"apiRateLimitFreePerMin",
+	"apiRateLimitBasicPerMin",
+	"apiRateLimitProPerMin",
 	"overwatchRollupSync",
 	"orchestrationDefaults"
 ]);
@@ -5413,13 +5450,33 @@ const API_SERVICE_GROUPS = {
 				order: 3
 			}
 		]
+	},
+	RATE_LIMITING: {
+		id: "rateLimitingService",
+		name: "API Rate Limiting",
+		description: "Per-user request rate limits on /chat and /opti, tunable per subscription tier (#9780)",
+		icon: "Speed",
+		settings: [
+			{
+				key: "apiRateLimitFreePerMin",
+				order: 1
+			},
+			{
+				key: "apiRateLimitBasicPerMin",
+				order: 2
+			},
+			{
+				key: "apiRateLimitProPerMin",
+				order: 3
+			}
+		]
 	}
 };
 const settingsMap = {
 	DefaultAPIModel: makeStringSetting({
 		key: "DefaultAPIModel",
 		name: "Default API Model",
-		defaultValue: "claude-sonnet-5",
+		defaultValue: "global.anthropic.claude-sonnet-5",
 		description: "The default AI model to use for API requests when no model is specified.",
 		options: CHAT_MODELS,
 		category: "AI",
@@ -5699,6 +5756,13 @@ const settingsMap = {
 		description: "Whether to enable moderation for LLM prompts.",
 		category: "AI Moderation"
 	}),
+	ImageModerationEnabled: makeBooleanSetting({
+		key: "ImageModerationEnabled",
+		name: "Image Moderation Enabled",
+		defaultValue: true,
+		description: "Whether to run generated images through content moderation (Rekognition) and block explicit content. Legal-safety control (#9776) — default ON.",
+		category: "AI Moderation"
+	}),
 	FormatPromptTemplate: makeStringSetting({
 		key: "FormatPromptTemplate",
 		name: "Format Prompt Template",
@@ -5748,6 +5812,39 @@ const settingsMap = {
 		group: API_SERVICE_GROUPS.CREDITS.id,
 		order: 1
 	}),
+	apiRateLimitFreePerMin: makeNumberSetting({
+		key: "apiRateLimitFreePerMin",
+		name: "API Rate Limit — Free (requests/min)",
+		defaultValue: 10,
+		min: 1,
+		max: 1e5,
+		description: "Max /chat and /opti requests per minute for users with no active paid subscription.",
+		category: "SecOps",
+		group: API_SERVICE_GROUPS.RATE_LIMITING.id,
+		order: 1
+	}),
+	apiRateLimitBasicPerMin: makeNumberSetting({
+		key: "apiRateLimitBasicPerMin",
+		name: "API Rate Limit — Basic (requests/min)",
+		defaultValue: 30,
+		min: 1,
+		max: 1e5,
+		description: "Max /chat and /opti requests per minute for Basic-tier subscribers (e.g. Professional plan).",
+		category: "SecOps",
+		group: API_SERVICE_GROUPS.RATE_LIMITING.id,
+		order: 2
+	}),
+	apiRateLimitProPerMin: makeNumberSetting({
+		key: "apiRateLimitProPerMin",
+		name: "API Rate Limit — Pro (requests/min)",
+		defaultValue: 60,
+		min: 1,
+		max: 1e5,
+		description: "Max /chat and /opti requests per minute for Pro-tier subscribers.",
+		category: "SecOps",
+		group: API_SERVICE_GROUPS.RATE_LIMITING.id,
+		order: 3
+	}),
 	tagLineMain: makeStringSetting({
 		key: "tagLineMain",
 		name: "Tag Line Main",
@@ -6075,6 +6172,14 @@ const settingsMap = {
 		group: API_SERVICE_GROUPS.CREDITS.id,
 		category: "Users"
 	}),
+	blockDisposableEmails: makeBooleanSetting({
+		key: "blockDisposableEmails",
+		name: "Block Disposable Emails",
+		defaultValue: true,
+		description: "Rejects new registrations whose email domain (or any parent domain) is a known disposable/burner provider — free credits cannot be farmed with throwaway inboxes (#9779). Applies at registration only; existing accounts on such domains can still sign in. Turn OFF only to work around a false positive.",
+		group: API_SERVICE_GROUPS.CREDITS.id,
+		category: "Users"
+	}),
 	defaultFreeCredits: makeNumberSetting({
 		key: "defaultFreeCredits",
 		name: "Default Free Credits",
@@ -8314,7 +8419,8 @@ z$1.object({
 	description: z$1.string().max(2e3).optional(),
 	fileTagPrefix: z$1.string().min(2).max(30).refine((s) => s.endsWith(":"), "Tag prefix must end with \":\" (e.g. \"acme:\")"),
 	requiredUserTag: z$1.string().min(1).max(100).optional(),
-	requiredEntitlement: z$1.string().min(3).max(100).refine((s) => s.includes(":") && s.split(":").every((part) => part.length > 0), "Entitlement key must be namespaced with non-empty parts (e.g. \"product:pro\")").optional()
+	requiredEntitlement: z$1.string().min(3).max(100).refine((s) => s.includes(":") && s.split(":").every((part) => part.length > 0), "Entitlement key must be namespaced with non-empty parts (e.g. \"product:pro\")").optional(),
+	organizationId: z$1.string().optional()
 });
 z$1.object({
 	name: z$1.string().min(1).max(200).optional(),
@@ -8516,7 +8622,8 @@ function toDataLakeConfig(dl) {
 		requiredEntitlement: dl.requiredEntitlement,
 		fileTagPrefix: dl.fileTagPrefix,
 		datalakeTag: dl.datalakeTag,
-		organizationId: dl.organizationId
+		organizationId: dl.organizationId,
+		description: dl.description
 	};
 }
 /**
@@ -8773,7 +8880,8 @@ z.object({
 			"classifier",
 			"mention",
 			"user-default",
-			"agent_literal"
+			"agent_literal",
+			"complexity"
 		])
 	}).optional()
 }).extend({
@@ -9425,6 +9533,26 @@ z.object({
 	/** Custom notebook name (optional, defaults to curated-notebook-{sessionId}) */
 	customNotebookName: z.string().optional()
 });
+/**
+* ImageModerationIncident — audit record for a generated image blocked by
+* auto-moderation (#9776 Q2a). Metadata-only (no image bytes); byte
+* preservation for §2258A retention is a later quest.
+*/
+const ModerationLabelHitSchema = z.object({
+	name: z.string(),
+	parentName: z.string(),
+	confidence: z.number()
+});
+z.object({
+	userId: z.string(),
+	sessionId: z.string().optional(),
+	questId: z.string().optional(),
+	provider: z.string(),
+	model: z.string(),
+	labels: z.array(ModerationLabelHitSchema),
+	createdAt: z.union([z.string(), z.date()]).optional(),
+	updatedAt: z.union([z.string(), z.date()]).optional()
+});
 function isGPTImageModel(model) {
 	if (!model) return false;
 	return OPENAI_IMAGE_MODELS.includes(model) || model.startsWith("gpt-image-");
@@ -9597,7 +9725,7 @@ z.array(triggerWordSchema).max(20, "Up to 20 trigger words allowed.").transform(
 *   - `$1`, `$2`, ... — individual positional args
 *
 * Why a shared helper: the CLI already implemented this in
-* `apps/cli/src/utils/argumentSubstitution.ts`. Centralizing here avoids a
+* `packages/cli/src/utils/argumentSubstitution.ts`. Centralizing here avoids a
 * second drift surface — a skill body authored on the web and run in the CLI
 * (or vice versa) must expand identically.
 */
@@ -10693,7 +10821,7 @@ QWORK_PROVIDERS.filter((p) => QWORK_PROVIDER_CAPABILITIES[p].enabled);
 //#region src/utils/apiUrl.ts
 /**
 * Default service endpoint, baked in at build time via tsdown's `env` option
-* (see `apps/cli/tsdown.config.ts`). The hosted publisher builds with its own
+* (see `packages/cli/tsdown.config.ts`). The hosted publisher builds with its own
 * service as the default; a fork sets `B4M_DEFAULT_API_URL` to publish under a
 * different brand, so a fork's bundle never embeds the upstream brand literal.
 * Empty when unset — the user then supplies an endpoint via `/set-api` or the
@@ -11130,7 +11258,7 @@ const CliConfigSchema = z.object({
 		enableCoordinatorMode: z.boolean().optional().prefault(false),
 		/**
 		* System-prompt variant. 'current' uses the elaborate behavioral-scaffolding
-		* prompt; 'minimal' uses a pi-style short prompt. See apps/cli/src/core/prompts.ts.
+		* prompt; 'minimal' uses a pi-style short prompt. See packages/cli/src/core/prompts.ts.
 		* Defaults to 'current' for backward compatibility; switch via /config or by
 		* editing the config file directly.
 		*/
@@ -11884,4 +12012,4 @@ var ConfigStore = class {
 	}
 };
 //#endregion
-export { PermissionDeniedError as $, wrapUntrustedSkillBody as $t, FriendshipEvents as A, XAI_IMAGE_MODELS as At, InboxEvents as B, isSupportedEmbeddingModel as Bt, CorruptedFileError as C, TransferCreditTransaction as Ct, FeedbackEvents as D, VIDEO_SIZE_CONSTRAINTS as Dt, FavoriteDocumentType as E, UnprocessableEntityError as Et, HTTPError as F, getViewById as Ft, LLMEvents as G, resolveNavigationIntents as Gt, InviteEvents as H, mapMimeTypeToArtifactType as Ht, HttpStatus as I, intersectAllowedTools as It, ModelBackend as J, settingsMap as Jt, MiscEvents as K, sanitizeTelemetryError as Kt, ImageEditUsageTransaction as L, isGPTImage2Model as Lt, GenerateImageToolCallSchema as M, dayjsConfig_default as Mt, GenericCreditAddTransaction as N, getAccessibleDataLakes as Nt, FileEvents as O, VideoGenerationUsageTransaction as Ot, GenericCreditDeductTransaction as P, getMcpProviderMetadata as Pt, Permission as Q, validateNotebookPath as Qt, ImageGenerationUsageTransaction as R, isGPTImageModel as Rt, CompletionApiUsageTransaction as S, ToolUsageTransaction as St, ElabsEvents as T, UnauthorizedError as Tt, InviteType as U, obfuscateApiKey as Ut, InternalServerError as V, isZodError as Vt, KnowledgeType as W, parseSkillArguments as Wt, OpenAIEmbeddingModel as X, toDataLakeConfig as Xt, NotFoundError as Y, substituteArguments as Yt, OpenAIImageGenerationInput as Z, validateJupyterKernelName as Zt, BadRequestError as _, SupportedFabFileMimeTypes as _t, getDefaultApiUrl as a, QuestMasterParamsSchema as at, ChatModels as b, TextGenerationUsageTransaction as bt, AiEvents as c, RechartsChartTypeList as ct, ApiKeyType as d, ResearchTaskExecutionType as dt, buildRateLimitLogEntry as en, ProfileEvents as et, AppFileEvents as f, ResearchTaskPeriodicFrequencyType as ft, BFL_SAFETY_TOLERANCE as g, SubscriptionCreditTransaction as gt, BFL_IMAGE_MODELS as h, SpeechToTextUsageTransaction as ht, getCreditsUrl as i, CollectionType as in, PurchaseTransaction as it, GEMINI_IMAGE_MODELS as j, b4mLLMTools as jt, ForbiddenError as k, VideoModels as kt, ApiKeyEvents as l, RegInviteEvents as lt, AuthEvents as m, SessionEvents as mt, logger as n, isNearLimit as nn, PromptIntentSchema as nt, getEnvironmentName as o, RealtimeVoiceUsageTransaction as ot, ArtifactTypeSchema as p, ResearchTaskType as pt, ModalEvents as q, secureParameters as qt, getApiUrl as r, parseRateLimitHeaders as rn, PromptMetaZodSchema as rt, ALERT_THRESHOLDS as s, ReceivedCreditTransaction as st, ConfigStore as t, extractSnippetMeta as tn, ProjectEvents as tt, ApiKeyScope as u, ResearchModeParamsSchema as ut, CREDIT_DEDUCT_TRANSACTION_TYPES as v, TagType as vt, DashboardParamsSchema as w, UiNavigationEvents as wt, ClaudeArtifactMimeTypes as x, TooManyRequestsError as xt, ChatCompletionCreateInputSchema as y, TaskScheduleHandler as yt, ImageModels as z, isModelAccessible as zt };
+export { Permission as $, validateJupyterKernelName as $t, ForbiddenError as A, VideoModels as At, ImageModels as B, isModelAccessible as Bt, CompletionApiUsageTransaction as C, ToolUsageTransaction as Ct, FavoriteDocumentType as D, UnprocessableEntityError as Dt, ElabsEvents as E, UnauthorizedError as Et, GenericCreditDeductTransaction as F, getMcpProviderMetadata as Ft, KnowledgeType as G, parseSkillArguments as Gt, InternalServerError as H, isZodError as Ht, HTTPError as I, getViewById as It, ModalEvents as J, secureParameters as Jt, LLMEvents as K, resolveNavigationIntents as Kt, HttpStatus as L, intersectAllowedTools as Lt, GEMINI_IMAGE_MODELS as M, b4mLLMTools as Mt, GenerateImageToolCallSchema as N, dayjsConfig_default as Nt, FeedbackEvents as O, VIDEO_SIZE_CONSTRAINTS as Ot, GenericCreditAddTransaction as P, getAccessibleDataLakes as Pt, OpenAIImageGenerationInput as Q, usdToCredits as Qt, ImageEditUsageTransaction as R, isGPTImage2Model as Rt, ClaudeArtifactMimeTypes as S, TooManyRequestsError as St, DashboardParamsSchema as T, UiNavigationEvents as Tt, InviteEvents as U, mapMimeTypeToArtifactType as Ut, InboxEvents as V, isSupportedEmbeddingModel as Vt, InviteType as W, obfuscateApiKey as Wt, NotFoundError as X, substituteArguments as Xt, ModelBackend as Y, settingsMap as Yt, OpenAIEmbeddingModel as Z, toDataLakeConfig as Zt, BFL_SAFETY_TOLERANCE as _, SubscriptionCreditTransaction as _t, getDefaultApiUrl as a, parseRateLimitHeaders as an, PurchaseTransaction as at, ChatCompletionCreateInputSchema as b, TaskScheduleHandler as bt, AiEvents as c, ReceivedCreditTransaction as ct, ApiKeyType as d, ResearchModeParamsSchema as dt, validateNotebookPath as en, PermissionDeniedError as et, AppFileEvents as f, ResearchTaskExecutionType as ft, BFL_IMAGE_MODELS as g, SpeechToTextUsageTransaction as gt, BFLSafetyToleranceSchema as h, SessionEvents as ht, getCreditsUrl as i, isNearLimit as in, PromptMetaZodSchema as it, FriendshipEvents as j, XAI_IMAGE_MODELS as jt, FileEvents as k, VideoGenerationUsageTransaction as kt, ApiKeyEvents as l, RechartsChartTypeList as lt, AuthEvents as m, ResearchTaskType as mt, logger as n, buildRateLimitLogEntry as nn, ProjectEvents as nt, getEnvironmentName as o, CollectionType as on, QuestMasterParamsSchema as ot, ArtifactTypeSchema as p, ResearchTaskPeriodicFrequencyType as pt, MiscEvents as q, sanitizeTelemetryError as qt, getApiUrl as r, extractSnippetMeta as rn, PromptIntentSchema as rt, ALERT_THRESHOLDS as s, RealtimeVoiceUsageTransaction as st, ConfigStore as t, wrapUntrustedSkillBody as tn, ProfileEvents as tt, ApiKeyScope as u, RegInviteEvents as ut, BadRequestError as v, SupportedFabFileMimeTypes as vt, CorruptedFileError as w, TransferCreditTransaction as wt, ChatModels as x, TextGenerationUsageTransaction as xt, CREDIT_DEDUCT_TRANSACTION_TYPES as y, TagType as yt, ImageGenerationUsageTransaction as z, isGPTImageModel as zt };

package/dist/commands/apiCommand.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { a as getDefaultApiUrl, t as ConfigStore } from "../ConfigStore-DL7p3ZiY.mjs";
+import { a as getDefaultApiUrl, t as ConfigStore } from "../ConfigStore-Cq20962p.mjs";
 //#region src/commands/apiCommand.ts
 /**
 * External API config command (--api-url / --reset-api)

package/dist/commands/doctorCommand.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as version } from "../package-B-ONmxJ7.mjs";
+import { t as version } from "../package-CBaK53NX.mjs";
 import { a as fetchLatestVersion, c as isNpmPrefixWritable, i as compareSemver } from "../updateChecker-C8xsNY2L.mjs";
 import { t as checkRipgrep } from "../ripgrepCheck-BmkyTK2i.mjs";
 import { execSync } from "child_process";

package/dist/commands/envCommand.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as ConfigStore } from "../ConfigStore-DL7p3ZiY.mjs";
+import { t as ConfigStore } from "../ConfigStore-Cq20962p.mjs";
 //#region src/commands/envCommand.ts
 /**
 * Environment switching for the `--dev` / `--prod` launch flags.

package/dist/commands/headlessCommand.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { C as createCoordinateTaskTool, D as FallbackLlmBackend, E as ApiClient, F as generateCliTools, G as ReActAgent, N as loadContextFiles, O as ServerLlmBackend, P as PermissionManager, Q as CheckpointStore, T as createAgentDelegateTool, W as setWebSocketToolExecutor, X as RemoteSkillSource, Y as isReadOnlyTool, Z as CustomCommandStore, _ as createGetFileStructureTool, a as WebSocketToolExecutor, b as createWriteTodosTool, et as SessionStore, i as McpManager, n as SubagentOrchestrator, o as WebSocketConnectionManager, q as buildSystemPrompt, r as AgentStore, s as WebSocketLlmBackend, t as BackgroundAgentManager, v as createFindDefinitionTool, w as createBackgroundAgentTools, x as createSkillTool, y as createTodoStore } from "../BackgroundAgentManager-H_MnlEXz.mjs";
-import { n as logger, r as getApiUrl, t as ConfigStore } from "../ConfigStore-DL7p3ZiY.mjs";
+import { C as createCoordinateTaskTool, D as FallbackLlmBackend, E as ApiClient, F as generateCliTools, G as ReActAgent, N as loadContextFiles, O as ServerLlmBackend, P as PermissionManager, Q as CheckpointStore, T as createAgentDelegateTool, W as setWebSocketToolExecutor, X as RemoteSkillSource, Y as isReadOnlyTool, Z as CustomCommandStore, _ as createGetFileStructureTool, a as WebSocketToolExecutor, b as createWriteTodosTool, et as SessionStore, i as McpManager, n as SubagentOrchestrator, o as WebSocketConnectionManager, q as buildSystemPrompt, r as AgentStore, s as WebSocketLlmBackend, t as BackgroundAgentManager, v as createFindDefinitionTool, w as createBackgroundAgentTools, x as createSkillTool, y as createTodoStore } from "../BackgroundAgentManager-DOesheMD.mjs";
+import { n as logger, r as getApiUrl, t as ConfigStore } from "../ConfigStore-Cq20962p.mjs";
 import { t as DEFAULT_SANDBOX_CONFIG } from "../types-LyRNHOiS.mjs";
 import { t as createSandboxRuntime } from "../SandboxRuntimeAdapter-ChGlxSGQ.mjs";
 import { t as SandboxOrchestrator } from "../SandboxOrchestrator-BoINxbX4.mjs";

package/dist/commands/mcpCommand.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as ConfigStore } from "../ConfigStore-DL7p3ZiY.mjs";
+import { t as ConfigStore } from "../ConfigStore-Cq20962p.mjs";
 //#region src/commands/mcpCommand.ts
 /**
 * External MCP commands (b4m mcp list, b4m mcp add, etc.)

package/dist/commands/updateCommand.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as version } from "../package-B-ONmxJ7.mjs";
+import { t as version } from "../package-CBaK53NX.mjs";
 import { c as isNpmPrefixWritable, l as setAutoUpdatePreference, n as REEXEC_GUARD_ENV, o as forceCheckForUpdate, r as checkForUpdate, s as getAutoUpdatePreference, t as INSTALL_CMD, u as shouldAttemptAutoUpdate } from "../updateChecker-C8xsNY2L.mjs";
 import { t as checkRipgrep } from "../ripgrepCheck-BmkyTK2i.mjs";
 import { execSync, spawnSync } from "child_process";

package/dist/index.mjs

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { $ as CommandHistoryStore, A as substituteArguments, B as DEFAULT_RETRY_CONFIG, C as createCoordinateTaskTool, D as FallbackLlmBackend, E as ApiClient, F as generateCliTools, G as ReActAgent, H as clearFeatureModuleTools, I as getProcessHooks, J as buildSkillsPromptSection, K as getPlanModeFilePath, L as ALWAYS_DENIED_FOR_AGENTS, M as extractCompactInstructions, N as loadContextFiles, O as ServerLlmBackend, P as PermissionManager, Q as CheckpointStore, R as DEFAULT_AGENT_MODEL, S as parseAgentConfig, T as createAgentDelegateTool, U as registerFeatureModuleTools, V as DEFAULT_THOROUGHNESS, W as setWebSocketToolExecutor, X as RemoteSkillSource, Y as isReadOnlyTool, Z as CustomCommandStore, _ as createGetFileStructureTool, a as WebSocketToolExecutor, at as mergeCommands, b as createWriteTodosTool, c as createReviewGateStore, ct as warmFileCache, d as createBlockerStore, et as SessionStore, f as createBlockerTools, g as formatDecisionsOutput, h as createDecisionStore, i as McpManager, it as searchCommands, j as formatStep, k as isTransientNetworkError, l as createReviewGateTool, m as createDecisionLogTool, n as SubagentOrchestrator, nt as hasFileReferences, o as WebSocketConnectionManager, ot as formatFileSize, p as formatBlockersOutput, q as buildSystemPrompt, r as AgentStore, rt as processFileReferences, s as WebSocketLlmBackend, st as searchFiles, t as BackgroundAgentManager, tt as OAuthClient, u as formatReviewGatesOutput, v as createFindDefinitionTool, w as createBackgroundAgentTools, x as createSkillTool, y as createTodoStore, z as DEFAULT_MAX_ITERATIONS } from "./BackgroundAgentManager-H_MnlEXz.mjs";
+import { $ as CommandHistoryStore, A as substituteArguments, B as DEFAULT_RETRY_CONFIG, C as createCoordinateTaskTool, D as FallbackLlmBackend, E as ApiClient, F as generateCliTools, G as ReActAgent, H as clearFeatureModuleTools, I as getProcessHooks, J as buildSkillsPromptSection, K as getPlanModeFilePath, L as ALWAYS_DENIED_FOR_AGENTS, M as extractCompactInstructions, N as loadContextFiles, O as ServerLlmBackend, P as PermissionManager, Q as CheckpointStore, R as DEFAULT_AGENT_MODEL, S as parseAgentConfig, T as createAgentDelegateTool, U as registerFeatureModuleTools, V as DEFAULT_THOROUGHNESS, W as setWebSocketToolExecutor, X as RemoteSkillSource, Y as isReadOnlyTool, Z as CustomCommandStore, _ as createGetFileStructureTool, a as WebSocketToolExecutor, at as mergeCommands, b as createWriteTodosTool, c as createReviewGateStore, ct as warmFileCache, d as createBlockerStore, et as SessionStore, f as createBlockerTools, g as formatDecisionsOutput, h as createDecisionStore, i as McpManager, it as searchCommands, j as formatStep, k as isTransientNetworkError, l as createReviewGateTool, m as createDecisionLogTool, n as SubagentOrchestrator, nt as hasFileReferences, o as WebSocketConnectionManager, ot as formatFileSize, p as formatBlockersOutput, q as buildSystemPrompt, r as AgentStore, rt as processFileReferences, s as WebSocketLlmBackend, st as searchFiles, t as BackgroundAgentManager, tt as OAuthClient, u as formatReviewGatesOutput, v as createFindDefinitionTool, w as createBackgroundAgentTools, x as createSkillTool, y as createTodoStore, z as DEFAULT_MAX_ITERATIONS } from "./BackgroundAgentManager-DOesheMD.mjs";
 import { n as useCliStore, t as selectActiveBackgroundAgents } from "./store-DV5s-qni.mjs";
-import { Qt as validateNotebookPath$1, Zt as validateJupyterKernelName, b as ChatModels, i as getCreditsUrl, n as logger, o as getEnvironmentName, r as getApiUrl, t as ConfigStore, v as CREDIT_DEDUCT_TRANSACTION_TYPES } from "./ConfigStore-DL7p3ZiY.mjs";
-import { t as version } from "./package-B-ONmxJ7.mjs";
+import { $t as validateJupyterKernelName, en as validateNotebookPath$1, i as getCreditsUrl, n as logger, o as getEnvironmentName, r as getApiUrl, t as ConfigStore, x as ChatModels, y as CREDIT_DEDUCT_TRANSACTION_TYPES } from "./ConfigStore-Cq20962p.mjs";
+import { t as version } from "./package-CBaK53NX.mjs";
 import { r as checkForUpdate } from "./updateChecker-C8xsNY2L.mjs";
 import React, { useCallback, useEffect, useMemo, useReducer, useRef, useState } from "react";
 import { Box, Static, Text, render, useApp, useInput, usePaste, useStdout } from "ink";
@@ -3005,7 +3005,7 @@ async function writeLocalHandoffFile(session, options = {}) {
 * and falling back would mask a real bug.
 *
 * Keep the substring matches below in sync with the error strings thrown by
-* `apps/cli/src/llm/ServerLlmBackend.ts` (see its catch block around the
+* `packages/cli/src/llm/ServerLlmBackend.ts` (see its catch block around the
 * `Request failed with status` / `Authentication ...` / `Cannot connect ...`
 * / `Failed to complete LLM request` throws). Renames there will silently
 * break the auto-fallback — a typed error hierarchy would be a more robust

package/dist/{package-B-ONmxJ7.mjs → package-CBaK53NX.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
 //#region package.json
-var version = "0.18.3";
+var version = "0.18.4";
 //#endregion
 export { version as t };

package/dist/{utils-fqhJmuB8.mjs → utils-Cdktpk_k.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { timingSafeEqual } from "crypto";
+import { createHash, timingSafeEqual } from "crypto";
 import speakeasy from "speakeasy";
 import QRCode from "qrcode";
 //#region ../../b4m-core/auth/dist/mfaService/utils.mjs
@@ -35,8 +35,18 @@ function verifyTOTPToken(secret, token, window = 1) {
 	});
 }
 /**
-* Generate cryptographically secure backup codes for MFA
-* Using speakeasy's secure random generation to be consistent with TOTP secrets
+* Hash a backup code for at-rest storage.
+* Codes are high-entropy random strings (speakeasy base32, ~50 bits), so a
+* fast SHA-256 is appropriate — no dictionary attack risk, and the migration
+* backfill over thousands of users stays instantaneous.
+*/
+function hashBackupCode(code) {
+	return createHash("sha256").update(code.trim().toUpperCase()).digest("hex");
+}
+/**
+* Generate cryptographically secure backup codes for MFA.
+* Returns plaintext codes for display to the user; callers are responsible for
+* hashing them (via hashBackupCode) before storing in the database.
 */
 function generateBackupCodes(count = 10) {
 	return Array.from({ length: count }, () => {
@@ -44,15 +54,17 @@ function generateBackupCodes(count = 10) {
 	});
 }
 /**
-* Verify a backup code against the user's backup codes
+* Verify a backup code against stored hashes.
+* Hashes the provided code and compares against stored SHA-256 hashes using
+* constant-time comparison to prevent timing attacks.
 */
 function verifyBackupCode(userBackupCodes, providedCode) {
 	if (!userBackupCodes || !providedCode) return { isValid: false };
-	const cleanProvidedCode = providedCode.trim().toUpperCase();
-	const providedBuf = Buffer.from(cleanProvidedCode, "utf8");
+	const providedHash = hashBackupCode(providedCode);
+	const providedBuf = Buffer.from(providedHash, "utf8");
 	let matchIdx = -1;
 	for (let i = 0; i < userBackupCodes.length; i++) {
-		const storedBuf = Buffer.from(userBackupCodes[i].trim().toUpperCase(), "utf8");
+		const storedBuf = Buffer.from(userBackupCodes[i], "utf8");
 		if (storedBuf.length === providedBuf.length && timingSafeEqual(storedBuf, providedBuf)) {
 			matchIdx = i;
 			break;
@@ -75,7 +87,7 @@ function userRequiresMFA(user, enforceMFASetting) {
 * Check if a user has MFA configured
 */
 function userHasMFAConfigured(user) {
-	return !!(user.mfa && user.mfa.totpEnabled && user.mfa.totpSecret);
+	return !!(user.mfa && user.mfa.totpEnabled);
 }
 /**
 * Server-side attempt tracking to prevent bypass via refresh/cancel
@@ -143,4 +155,4 @@ function userCanDisableMFA(user, enforceMFASetting) {
 	return !enforceMFASetting;
 }
 //#endregion
-export { isUserLockedOut as a, userCanDisableMFA as c, userRequiresMFA as d, verifyBackupCode as f, getLockoutTimeRemaining as i, userEligibleForMFA as l, generateBackupCodes as n, recordFailedAttempt as o, verifyTOTPToken as p, generateTOTPSetup as r, shouldResetFailedAttempts as s, clearFailedAttempts as t, userHasMFAConfigured as u };
+export { hashBackupCode as a, shouldResetFailedAttempts as c, userHasMFAConfigured as d, userRequiresMFA as f, getLockoutTimeRemaining as i, userCanDisableMFA as l, verifyTOTPToken as m, generateBackupCodes as n, isUserLockedOut as o, verifyBackupCode as p, generateTOTPSetup as r, recordFailedAttempt as s, clearFailedAttempts as t, userEligibleForMFA as u };

package/dist/utils-DEizxshI.mjs

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import { m as verifyTOTPToken } from "./utils-Cdktpk_k.mjs";
+export { verifyTOTPToken };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bike4mind/cli",
-  "version": "0.18.3",
+  "version": "0.18.4",
   "type": "module",
   "description": "Interactive CLI tool for Bike4Mind with ReAct agents",
   "license": "UNLICENSED",
@@ -96,7 +96,7 @@
     "tree-sitter-wasms": "^0.1.13",
     "turndown": "^7.2.4",
     "undici": "^7.28.0",
-    "unpdf": "^0.10.0",
+    "unpdf": "^1.6.2",
     "uuid": "^13.0.2",
     "voyageai": "^0.4.0",
     "web-tree-sitter": "0.25.10",
@@ -107,8 +107,8 @@
     "zod": "^4.4.3",
     "zod-validation-error": "^5.0.0",
     "zustand": "^5.0.13",
-    "@bike4mind/fab-pipeline": "0.4.7",
-    "@bike4mind/llm-adapters": "0.8.0",
+    "@bike4mind/fab-pipeline": "0.4.8",
+    "@bike4mind/llm-adapters": "0.9.0",
     "@bike4mind/observability": "0.2.0"
   },
   "devDependencies": {
@@ -124,11 +124,11 @@
     "tsx": "^4.22.3",
     "typescript": "^5.9.3",
     "vitest": "^4.1.9",
-    "@bike4mind/agents": "0.18.1",
-    "@bike4mind/common": "2.118.1",
-    "@bike4mind/mcp": "1.40.1",
-    "@bike4mind/services": "2.102.0",
-    "@bike4mind/utils": "2.26.1"
+    "@bike4mind/agents": "0.18.2",
+    "@bike4mind/common": "2.119.0",
+    "@bike4mind/mcp": "1.40.2",
+    "@bike4mind/services": "2.103.0",
+    "@bike4mind/utils": "2.27.0"
   },
   "optionalDependencies": {
     "@vscode/ripgrep": "^1.18.0"

package/dist/utils-CLjLKvqQ.mjs

@@ -1,3 +0,0 @@
-#!/usr/bin/env node
-import { p as verifyTOTPToken } from "./utils-fqhJmuB8.mjs";
-export { verifyTOTPToken };