@bike4mind/cli 0.2.11-feat-secops-packages-check.17324 → 0.2.11-feat-api-key-rate-limiting.17328

package/bin/bike4mind-cli.mjs

@@ -36,16 +36,24 @@ const argv = yargs(hideBin(process.argv))
     description: 'Show debug logs in console',
     default: false,
   })
+  .option('no-project-config', {
+    type: 'boolean',
+    description: 'Disable loading project-specific configuration (.bike4mind/)',
+    default: false,
+  })
   .help()
   .alias('help', 'h')
   .version()
   .alias('version', 'V')
   .parse();
 
-// Set environment variable for verbose mode
+// Set environment variables from CLI flags
 if (argv.verbose) {
   process.env.B4M_VERBOSE = '1';
 }
+if (argv['no-project-config']) {
+  process.env.B4M_NO_PROJECT_CONFIG = '1';
+}
 
 // Auto-detect environment: prefer production mode when dist exists
 const distPath = join(__dirname, '../dist/index.js');

package/dist/{artifactExtractor-3KB44W7B.js → artifactExtractor-NKJ7ZTCP.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   CurationArtifactType
-} from "./chunk-3OX632TE.js";
+} from "./chunk-332RE6EY.js";
 import "./chunk-PDX44BCA.js";
 
 // ../../b4m-core/packages/services/dist/src/notebookCurationService/artifactExtractor.js

package/dist/{chunk-3OX632TE.js → chunk-332RE6EY.js}

@@ -228,6 +228,7 @@ var b4mLLMTools = z3.enum([
   // File operation tools
   "file_read",
   "create_file",
+  "edit_local_file",
   "glob_files",
   "grep_search",
   "delete_file",
@@ -672,6 +673,14 @@ var RealtimeVoiceUsageTransaction = BaseCreditTransaction.extend({
   model: z7.string(),
   sessionId: z7.string()
 });
+var CompletionApiUsageTransaction = BaseCreditTransaction.extend({
+  type: z7.literal("completion_api_usage"),
+  model: z7.string(),
+  apiKeyId: z7.string().optional(),
+  // Optional - present for API key auth, undefined for JWT
+  inputTokens: z7.number(),
+  outputTokens: z7.number()
+});
 var TransferCreditTransaction = BaseCreditTransaction.extend({
   type: z7.literal("transfer_credit"),
   recipientId: z7.string(),
@@ -686,6 +695,7 @@ var CreditTransaction = z7.discriminatedUnion("type", [
   ImageGenerationUsageTransaction,
   ImageEditUsageTransaction,
   RealtimeVoiceUsageTransaction,
+  CompletionApiUsageTransaction,
   TransferCreditTransaction,
   ReceivedCreditTransaction
 ]);
@@ -700,6 +710,7 @@ var CREDIT_DEDUCT_TRANSACTION_TYPES = [
   "image_generation_usage",
   "image_edit_usage",
   "realtime_voice_usage",
+  "completion_api_usage",
   "transfer_credit",
   "generic_deduct"
 ];
@@ -3830,6 +3841,8 @@ var AiEvents;
   AiEvents2["NOTEBOOK_SUMMARIZATION"] = "Notebook Summarization Completed";
   AiEvents2["AI_VOICE_SESSION_STARTED"] = "AI Voice Session Started";
   AiEvents2["WHATS_NEW_MODAL_GENERATED"] = "What's New Modal Generated";
+  AiEvents2["COMPLETION_API_COMPLETED"] = "Completion API Completed";
+  AiEvents2["COMPLETION_API_FAILED"] = "Completion API Failed";
 })(AiEvents || (AiEvents = {}));
 
 // ../../b4m-core/packages/common/dist/src/schemas/analytics/events/apiKeys.js
@@ -6001,6 +6014,7 @@ export {
   ImageGenerationUsageTransaction,
   ImageEditUsageTransaction,
   RealtimeVoiceUsageTransaction,
+  CompletionApiUsageTransaction,
   TransferCreditTransaction,
   CreditTransaction,
   CREDIT_ADD_TRANSACTION_TYPES,

package/dist/{chunk-HPYQM2B7.js → chunk-A6NFKGUG.js}

@@ -7,11 +7,11 @@ import {
   getSettingsMap,
   getSettingsValue,
   secureParameters
-} from "./chunk-JYH72REB.js";
+} from "./chunk-XYK5DZUN.js";
 import {
   KnowledgeType,
   SupportedFabFileMimeTypes
-} from "./chunk-3OX632TE.js";
+} from "./chunk-332RE6EY.js";
 
 // ../../b4m-core/packages/services/dist/src/fabFileService/create.js
 import { z } from "zod";

package/dist/{chunk-7JR6VASX.js → chunk-BFO3VHFZ.js}

@@ -6,12 +6,12 @@ import {
   getSettingsByNames,
   obfuscateApiKey,
   secureParameters
-} from "./chunk-JYH72REB.js";
+} from "./chunk-XYK5DZUN.js";
 import {
   ApiKeyType,
   MementoTier,
   isSupportedEmbeddingModel
-} from "./chunk-3OX632TE.js";
+} from "./chunk-332RE6EY.js";
 
 // ../../b4m-core/packages/services/dist/src/apiKeyService/get.js
 import { z } from "zod";

package/dist/{chunk-7ORA6KGN.js → chunk-IEDWDSMG.js}

@@ -2,15 +2,16 @@
 import {
   BadRequestError,
   secureParameters
-} from "./chunk-JYH72REB.js";
+} from "./chunk-XYK5DZUN.js";
 import {
+  CompletionApiUsageTransaction,
   GenericCreditDeductTransaction,
   ImageEditUsageTransaction,
   ImageGenerationUsageTransaction,
   RealtimeVoiceUsageTransaction,
   TextGenerationUsageTransaction,
   TransferCreditTransaction
-} from "./chunk-3OX632TE.js";
+} from "./chunk-332RE6EY.js";
 
 // ../../b4m-core/packages/services/dist/src/creditService/subtractCredits.js
 import { z } from "zod";
@@ -20,6 +21,7 @@ var SubtractCreditsSchema = z.discriminatedUnion("type", [
   ImageGenerationUsageTransaction.omit({ createdAt: true, updatedAt: true }),
   RealtimeVoiceUsageTransaction.omit({ createdAt: true, updatedAt: true }),
   ImageEditUsageTransaction.omit({ createdAt: true, updatedAt: true }),
+  CompletionApiUsageTransaction.omit({ createdAt: true, updatedAt: true }),
   TransferCreditTransaction.omit({ createdAt: true, updatedAt: true })
 ]);
 async function subtractCredits(parameters, { db, creditHolderMethods, skipBalanceUpdate, currentCreditHolder }) {
@@ -63,6 +65,20 @@ async function subtractCredits(parameters, { db, creditHolderMethods, skipBalanc
       inputTokens: params.inputTokens,
       outputTokens: params.outputTokens
     });
+  } else if (type === "completion_api_usage") {
+    await db.creditTransactions.createTransaction("completion_api_usage", {
+      ownerId,
+      ownerType,
+      credits: -Math.abs(credits),
+      // Negative for usage
+      description: description || "Completion API usage",
+      metadata,
+      model: params.model,
+      apiKeyId: params.apiKeyId,
+      // Optional - present for API key auth, undefined for JWT
+      inputTokens: params.inputTokens,
+      outputTokens: params.outputTokens
+    });
   } else if (type === "image_generation_usage") {
     await db.creditTransactions.createTransaction("image_generation_usage", {
       ownerId,

package/dist/{chunk-JYH72REB.js → chunk-XYK5DZUN.js}

@@ -16,7 +16,7 @@ import {
   dayjsConfig_default,
   extractSnippetMeta,
   settingsMap
-} from "./chunk-3OX632TE.js";
+} from "./chunk-332RE6EY.js";
 
 // ../../b4m-core/packages/utils/dist/src/storage/S3Storage.js
 import { S3Client, PutObjectCommand, DeleteObjectCommand, GetObjectCommand, HeadObjectCommand } from "@aws-sdk/client-s3";

package/dist/{create-MSSVWSVO.js → create-B2CIQXWC.js}

@@ -2,10 +2,10 @@
 import {
   createFabFile,
   createFabFileSchema
-} from "./chunk-HPYQM2B7.js";
-import "./chunk-JYH72REB.js";
+} from "./chunk-A6NFKGUG.js";
+import "./chunk-XYK5DZUN.js";
 import "./chunk-AMDXHL6S.js";
-import "./chunk-3OX632TE.js";
+import "./chunk-332RE6EY.js";
 import "./chunk-PDX44BCA.js";
 export {
   createFabFile,

package/dist/index.js

@@ -4,9 +4,9 @@ import {
   getEffectiveApiKey,
   getOpenWeatherKey,
   getSerperKey
-} from "./chunk-7JR6VASX.js";
-import "./chunk-7ORA6KGN.js";
-import "./chunk-HPYQM2B7.js";
+} from "./chunk-BFO3VHFZ.js";
+import "./chunk-IEDWDSMG.js";
+import "./chunk-A6NFKGUG.js";
 import {
   BFLImageService,
   BaseStorage,
@@ -15,7 +15,7 @@ import {
   OpenAIBackend,
   OpenAIImageService,
   XAIImageService
-} from "./chunk-JYH72REB.js";
+} from "./chunk-XYK5DZUN.js";
 import {
   Logger
 } from "./chunk-AMDXHL6S.js";
@@ -73,7 +73,7 @@ import {
   XAI_IMAGE_MODELS,
   b4mLLMTools,
   getMcpProviderMetadata
-} from "./chunk-3OX632TE.js";
+} from "./chunk-332RE6EY.js";
 import {
   __require
 } from "./chunk-PDX44BCA.js";
@@ -988,8 +988,8 @@ import { Box as Box6 } from "ink";
 import React6 from "react";
 import { Box as Box5, Text as Text6 } from "ink";
 import Spinner from "ink-spinner";
-var ThoughtStream = React6.memo(function ThoughtStream2({ steps }) {
-  return /* @__PURE__ */ React6.createElement(Box5, { flexDirection: "column", gap: 1 }, steps.map((step, index) => /* @__PURE__ */ React6.createElement(Box5, { key: index, flexDirection: "column" }, step.type === "thought" && /* @__PURE__ */ React6.createElement(Box5, null, /* @__PURE__ */ React6.createElement(Text6, { color: "magenta" }, "\u{1F914} Thought: "), /* @__PURE__ */ React6.createElement(Text6, null, step.content)), step.type === "action" && /* @__PURE__ */ React6.createElement(Box5, { flexDirection: "column" }, /* @__PURE__ */ React6.createElement(Box5, null, /* @__PURE__ */ React6.createElement(Text6, { color: "yellow" }, "\u26A1 Action: "), /* @__PURE__ */ React6.createElement(Text6, { bold: true }, step.metadata?.toolName || "unknown")), step.metadata?.toolInput && /* @__PURE__ */ React6.createElement(Box5, { paddingLeft: 2 }, /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, JSON.stringify(step.metadata.toolInput, null, 2)))), step.type === "observation" && /* @__PURE__ */ React6.createElement(Box5, { flexDirection: "column" }, /* @__PURE__ */ React6.createElement(Box5, null, /* @__PURE__ */ React6.createElement(Text6, { color: "blue" }, "\u{1F4CA} Observation: ")), /* @__PURE__ */ React6.createElement(Box5, { paddingLeft: 2 }, /* @__PURE__ */ React6.createElement(Text6, null, step.content))), step.type === "final_answer" && /* @__PURE__ */ React6.createElement(Box5, { flexDirection: "column" }, /* @__PURE__ */ React6.createElement(Box5, null, /* @__PURE__ */ React6.createElement(Text6, { color: "green", bold: true }, "\u2705 Final Answer:", " ")), /* @__PURE__ */ React6.createElement(Box5, { paddingLeft: 2 }, /* @__PURE__ */ React6.createElement(Text6, null, step.content)), step.metadata?.tokenUsage && /* @__PURE__ */ React6.createElement(Box5, { paddingLeft: 2 }, /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, "(", step.metadata.tokenUsage.total, " tokens)"))))), !steps.some((s) => s.type === "final_answer") && /* @__PURE__ */ React6.createElement(Box5, null, /* @__PURE__ */ React6.createElement(Text6, { color: "yellow" }, /* @__PURE__ */ React6.createElement(Spinner, { type: "dots" })), /* @__PURE__ */ React6.createElement(Text6, null, " ", steps.length === 0 ? "Thinking..." : "Processing...")));
+var ThoughtStream = React6.memo(function ThoughtStream2({ isThinking }) {
+  return /* @__PURE__ */ React6.createElement(Box5, { flexDirection: "column", gap: 1 }, isThinking && /* @__PURE__ */ React6.createElement(Box5, null, /* @__PURE__ */ React6.createElement(Text6, { color: "yellow" }, /* @__PURE__ */ React6.createElement(Spinner, { type: "dots" })), /* @__PURE__ */ React6.createElement(Text6, null, " Thinking...")));
 });
 
 // src/store/index.ts
@@ -1034,12 +1034,6 @@ var useCliStore = create((set) => ({
   // UI state
   isThinking: false,
   setIsThinking: (thinking) => set({ isThinking: thinking }),
-  agentSteps: [],
-  addAgentStep: (step) => set((state) => ({
-    agentSteps: [...state.agentSteps, step]
-  })),
-  setAgentSteps: (steps) => set({ agentSteps: steps }),
-  clearAgentSteps: () => set({ agentSteps: [] }),
   // Permission prompt
   permissionPrompt: null,
   setPermissionPrompt: (prompt) => set({ permissionPrompt: prompt }),
@@ -1054,11 +1048,10 @@ var useCliStore = create((set) => ({
 // src/components/AgentThinking.tsx
 var AgentThinking = React7.memo(function AgentThinking2() {
   const isThinking = useCliStore((state) => state.isThinking);
-  const agentSteps = useCliStore((state) => state.agentSteps);
   if (!isThinking) {
     return null;
   }
-  return /* @__PURE__ */ React7.createElement(Box6, { paddingX: 1, marginBottom: 1 }, /* @__PURE__ */ React7.createElement(ThoughtStream, { steps: agentSteps }));
+  return /* @__PURE__ */ React7.createElement(Box6, { paddingX: 1, marginBottom: 1 }, /* @__PURE__ */ React7.createElement(ThoughtStream, { isThinking }));
 });
 
 // src/components/PermissionPrompt.tsx
@@ -1096,7 +1089,10 @@ function PermissionPrompt({
     { label: "\u2713 Allow once", value: "allow-once" },
     { label: "\u2717 Deny", value: "deny" }
   ];
-  const argsString = typeof args === "string" ? args : JSON.stringify(args, null, 2);
+  const MAX_ARGS_LENGTH = 500;
+  const rawArgsString = typeof args === "string" ? args : JSON.stringify(args, null, 2);
+  const argsString = rawArgsString.length > MAX_ARGS_LENGTH ? rawArgsString.slice(0, MAX_ARGS_LENGTH) + `
+... (${rawArgsString.length - MAX_ARGS_LENGTH} more chars)` : rawArgsString;
   return /* @__PURE__ */ React8.createElement(Box7, { flexDirection: "column", borderStyle: "bold", borderColor: "yellow", padding: 1, marginY: 1 }, /* @__PURE__ */ React8.createElement(Box7, null, /* @__PURE__ */ React8.createElement(Text7, { bold: true, color: "yellow" }, "\u26A0\uFE0F Permission Required")), /* @__PURE__ */ React8.createElement(Box7, { marginTop: 1 }, /* @__PURE__ */ React8.createElement(Text7, { dimColor: true }, "Tool: "), /* @__PURE__ */ React8.createElement(Text7, { bold: true, color: "cyan" }, toolName)), toolDescription && /* @__PURE__ */ React8.createElement(Box7, null, /* @__PURE__ */ React8.createElement(Text7, { dimColor: true }, "Action: "), /* @__PURE__ */ React8.createElement(Text7, null, toolDescription)), /* @__PURE__ */ React8.createElement(Box7, { marginTop: 1, flexDirection: "column" }, /* @__PURE__ */ React8.createElement(Text7, { bold: true }, "Arguments:"), /* @__PURE__ */ React8.createElement(Box7, { paddingLeft: 2, flexDirection: "column" }, /* @__PURE__ */ React8.createElement(Text7, { dimColor: true }, argsString))), preview && /* @__PURE__ */ React8.createElement(Box7, { marginTop: 1, flexDirection: "column" }, /* @__PURE__ */ React8.createElement(Text7, { bold: true }, "Preview:"), /* @__PURE__ */ React8.createElement(Box7, { borderStyle: "single", borderColor: "gray", paddingX: 1, flexDirection: "column" }, renderDiffPreview(preview))), !canBeTrusted && /* @__PURE__ */ React8.createElement(Box7, { marginTop: 1 }, /* @__PURE__ */ React8.createElement(Text7, { color: "red", dimColor: true }, "Note: This tool cannot be trusted due to its dangerous nature.")), /* @__PURE__ */ React8.createElement(Box7, { marginTop: 1 }, /* @__PURE__ */ React8.createElement(SelectInput, { items, onSelect: (item) => onResponse(item.value) })));
 }
 
@@ -2381,15 +2377,19 @@ var ConfigStore = class {
           throw error;
         }
       }
-      this.projectConfigDir = findProjectConfigDir();
       let projectConfig = null;
       let projectLocalConfig = null;
-      if (this.projectConfigDir) {
-        projectConfig = await loadProjectConfig(this.projectConfigDir);
-        projectLocalConfig = await loadProjectLocalConfig(this.projectConfigDir);
-        if (projectConfig) {
-          console.log(`\u{1F4C1} Project config loaded from: ${this.projectConfigDir}/.bike4mind/`);
+      if (process.env.B4M_NO_PROJECT_CONFIG !== "1") {
+        this.projectConfigDir = findProjectConfigDir();
+        if (this.projectConfigDir) {
+          projectConfig = await loadProjectConfig(this.projectConfigDir);
+          projectLocalConfig = await loadProjectLocalConfig(this.projectConfigDir);
+          if (projectConfig) {
+            console.log(`\u{1F4C1} Project config loaded from: ${this.projectConfigDir}/.bike4mind/`);
+          }
         }
+      } else {
+        this.projectConfigDir = null;
       }
       this.config = mergeConfigs(globalConfig, projectConfig, projectLocalConfig);
       return this.config;
@@ -5489,8 +5489,8 @@ async function processAndStoreImages(images, context) {
     const buffer = await downloadImage(image);
     const fileType = await fileTypeFromBuffer2(buffer);
     const filename = `${uuidv46()}.${fileType?.ext}`;
-    const path16 = await context.imageGenerateStorage.upload(buffer, filename, {});
-    return path16;
+    const path17 = await context.imageGenerateStorage.upload(buffer, filename, {});
+    return path17;
   }));
 }
 async function updateQuestAndReturnMarkdown(storedImageUrls, context) {
@@ -6702,8 +6702,8 @@ async function processAndStoreImage(imageUrl, context) {
   const buffer = await downloadImage2(imageUrl);
   const fileType = await fileTypeFromBuffer3(buffer);
   const filename = `${uuidv47()}.${fileType?.ext}`;
-  const path16 = await context.imageGenerateStorage.upload(buffer, filename, {});
-  return path16;
+  const path17 = await context.imageGenerateStorage.upload(buffer, filename, {});
+  return path17;
 }
 async function updateQuestAndReturnMarkdown2(storedImagePath, context) {
   await context.onFinish?.("edit_image", storedImagePath);
@@ -9491,6 +9491,104 @@ BLOCKED OPERATIONS:
   })
 };
 
+// ../../b4m-core/packages/services/dist/src/llm/tools/implementation/editLocalFile/index.js
+import { promises as fs11 } from "fs";
+import { existsSync as existsSync7 } from "fs";
+import path13 from "path";
+import { diffLines as diffLines3 } from "diff";
+function generateDiff(original, modified) {
+  const differences = diffLines3(original, modified);
+  let diffString = "";
+  let additions = 0;
+  let deletions = 0;
+  differences.forEach((part) => {
+    if (part.added) {
+      additions += part.count || 0;
+      diffString += part.value.split("\n").filter((line) => line).map((line) => `+ ${line}`).join("\n");
+      if (diffString && !diffString.endsWith("\n"))
+        diffString += "\n";
+    } else if (part.removed) {
+      deletions += part.count || 0;
+      diffString += part.value.split("\n").filter((line) => line).map((line) => `- ${line}`).join("\n");
+      if (diffString && !diffString.endsWith("\n"))
+        diffString += "\n";
+    }
+  });
+  return { additions, deletions, diff: diffString.trim() };
+}
+async function editLocalFile(params) {
+  const { path: filePath, old_string, new_string } = params;
+  const normalizedPath = path13.normalize(filePath);
+  const resolvedPath = path13.resolve(process.cwd(), normalizedPath);
+  const cwd = path13.resolve(process.cwd());
+  if (!resolvedPath.startsWith(cwd)) {
+    throw new Error(`Access denied: Cannot edit files outside of current working directory`);
+  }
+  if (!existsSync7(resolvedPath)) {
+    throw new Error(`File not found: ${filePath}`);
+  }
+  const currentContent = await fs11.readFile(resolvedPath, "utf-8");
+  if (!currentContent.includes(old_string)) {
+    const preview = old_string.length > 100 ? old_string.substring(0, 100) + "..." : old_string;
+    throw new Error(`String to replace not found in file. Make sure the old_string matches exactly (including whitespace and line endings). Searched for: "${preview}"`);
+  }
+  const occurrences = currentContent.split(old_string).length - 1;
+  if (occurrences > 1) {
+    throw new Error(`Found ${occurrences} occurrences of the string to replace. Please provide a more specific old_string that matches exactly one location.`);
+  }
+  const newContent = currentContent.replace(old_string, new_string);
+  await fs11.writeFile(resolvedPath, newContent, "utf-8");
+  const diffResult = generateDiff(old_string, new_string);
+  return `File edited successfully: ${filePath}
+Changes: +${diffResult.additions} lines, -${diffResult.deletions} lines
+
+Diff:
+${diffResult.diff}`;
+}
+var editLocalFileTool = {
+  name: "edit_local_file",
+  implementation: (context) => ({
+    toolFn: async (value) => {
+      const params = value;
+      context.logger.info(`\u{1F4DD} EditLocalFile: Editing file`, {
+        path: params.path,
+        oldStringLength: params.old_string.length,
+        newStringLength: params.new_string.length
+      });
+      try {
+        const result = await editLocalFile(params);
+        context.logger.info("\u2705 EditLocalFile: Success", { path: params.path });
+        return result;
+      } catch (error) {
+        context.logger.error("\u274C EditLocalFile: Failed", error);
+        throw error;
+      }
+    },
+    toolSchema: {
+      name: "edit_local_file",
+      description: "Edit a file by replacing a specific string with new content. The old_string must match exactly one location in the file (including whitespace). Use this for precise edits to existing files. For creating new files or complete rewrites, use create_file instead.",
+      parameters: {
+        type: "object",
+        properties: {
+          path: {
+            type: "string",
+            description: "Path to the file to edit (relative to current working directory)"
+          },
+          old_string: {
+            type: "string",
+            description: "The exact string to find and replace. Must match exactly one location in the file, including all whitespace and line endings."
+          },
+          new_string: {
+            type: "string",
+            description: "The string to replace old_string with. Can be empty to delete the old_string."
+          }
+        },
+        required: ["path", "old_string", "new_string"]
+      }
+    }
+  })
+};
+
 // ../../b4m-core/packages/services/dist/src/llm/tools/index.js
 var tools = {
   dice_roll: diceRollTool,
@@ -9516,6 +9614,7 @@ var tools = {
   planet_visibility: planetVisibilityTool,
   file_read: fileReadTool,
   create_file: createFileTool,
+  edit_local_file: editLocalFileTool,
   glob_files: globFilesTool,
   grep_search: grepSearchTool,
   delete_file: deleteFileTool,
@@ -9759,10 +9858,10 @@ var ToolErrorType;
 // src/utils/diffPreview.ts
 import * as Diff from "diff";
 import { readFile } from "fs/promises";
-import { existsSync as existsSync7 } from "fs";
+import { existsSync as existsSync8 } from "fs";
 async function generateFileDiffPreview(args) {
   try {
-    if (!existsSync7(args.path)) {
+    if (!existsSync8(args.path)) {
       const lines2 = args.content.split("\n");
       const preview = lines2.slice(0, 20).join("\n");
       const hasMore = lines2.length > 20;
@@ -9784,18 +9883,26 @@ ${preview}${hasMore ? `
       // Show 3 lines of context around changes
     );
     const lines = patch.split("\n");
-    const diffLines3 = lines.slice(4);
-    return diffLines3.join("\n");
+    const diffLines4 = lines.slice(4);
+    return diffLines4.join("\n");
   } catch (error) {
     return `[Error generating diff preview: ${error instanceof Error ? error.message : "Unknown error"}]`;
   }
 }
+function generateEditLocalFilePreview(args) {
+  const patch = Diff.createPatch(args.path, args.old_string, args.new_string, "Current", "Proposed", { context: 3 });
+  const lines = patch.split("\n");
+  const diffLines4 = lines.slice(4);
+  return `[Edit in: ${args.path}]
+
+${diffLines4.join("\n")}`;
+}
 async function generateFileDeletePreview(args) {
   try {
-    if (!existsSync7(args.path)) {
+    if (!existsSync8(args.path)) {
       return `[File does not exist: ${args.path}]`;
     }
-    const stats = await import("fs/promises").then((fs13) => fs13.stat(args.path));
+    const stats = await import("fs/promises").then((fs14) => fs14.stat(args.path));
     return `[File will be deleted]
 
 Path: ${args.path}
@@ -9807,8 +9914,8 @@ Last modified: ${stats.mtime.toLocaleString()}`;
 }
 
 // src/utils/Logger.ts
-import fs11 from "fs/promises";
-import path13 from "path";
+import fs12 from "fs/promises";
+import path14 from "path";
 import os2 from "os";
 var Logger2 = class _Logger {
   constructor() {
@@ -9831,9 +9938,9 @@ var Logger2 = class _Logger {
    */
   async initialize(sessionId) {
     this.sessionId = sessionId;
-    const debugDir = path13.join(os2.homedir(), ".bike4mind", "debug");
-    await fs11.mkdir(debugDir, { recursive: true });
-    this.logFilePath = path13.join(debugDir, `${sessionId}.txt`);
+    const debugDir = path14.join(os2.homedir(), ".bike4mind", "debug");
+    await fs12.mkdir(debugDir, { recursive: true });
+    this.logFilePath = path14.join(debugDir, `${sessionId}.txt`);
     await this.writeToFile("INFO", "=== CLI SESSION START ===");
   }
   /**
@@ -9897,7 +10004,7 @@ var Logger2 = class _Logger {
       const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace("T", " ").substring(0, 19);
       const logEntry = `[${timestamp}] [${level}] ${message}
 `;
-      await fs11.appendFile(this.logFilePath, logEntry, "utf-8");
+      await fs12.appendFile(this.logFilePath, logEntry, "utf-8");
     } catch (error) {
       console.error("File logging failed:", error);
     }
@@ -10043,15 +10150,15 @@ var Logger2 = class _Logger {
   async cleanupOldLogs() {
     if (!this.fileLoggingEnabled) return;
     try {
-      const debugDir = path13.join(os2.homedir(), ".bike4mind", "debug");
-      const files = await fs11.readdir(debugDir);
+      const debugDir = path14.join(os2.homedir(), ".bike4mind", "debug");
+      const files = await fs12.readdir(debugDir);
       const now = Date.now();
       const thirtyDaysAgo = now - 30 * 24 * 60 * 60 * 1e3;
       for (const file of files) {
-        const filePath = path13.join(debugDir, file);
-        const stats = await fs11.stat(filePath);
+        const filePath = path14.join(debugDir, file);
+        const stats = await fs12.stat(filePath);
         if (stats.mtime.getTime() < thirtyDaysAgo) {
-          await fs11.unlink(filePath);
+          await fs12.unlink(filePath);
         }
       }
     } catch (error) {
@@ -10108,10 +10215,10 @@ var SERVER_TOOLS = ["weather_info", "web_search"];
 var LOCAL_TOOLS = [
   "file_read",
   "create_file",
+  "edit_local_file",
   "glob_files",
   "grep_search",
   "delete_file",
-  "edit_file",
   "dice_roll",
   "math_evaluate",
   "current_datetime",
@@ -10145,21 +10252,21 @@ var NoOpStorage = class extends BaseStorage {
   async upload(input, destination, options) {
     return `/tmp/${destination}`;
   }
-  async download(path16) {
+  async download(path17) {
     throw new Error("Download not supported in CLI");
   }
-  async delete(path16) {
+  async delete(path17) {
   }
-  async getSignedUrl(path16) {
-    return `/tmp/${path16}`;
+  async getSignedUrl(path17) {
+    return `/tmp/${path17}`;
   }
-  getPublicUrl(path16) {
-    return `/tmp/${path16}`;
+  getPublicUrl(path17) {
+    return `/tmp/${path17}`;
   }
-  async getPreview(path16) {
-    return `/tmp/${path16}`;
+  async getPreview(path17) {
+    return `/tmp/${path17}`;
   }
-  async getMetadata(path16) {
+  async getMetadata(path17) {
     return { size: 0, contentType: "application/octet-stream" };
   }
 };
@@ -10191,11 +10298,12 @@ function wrapToolWithPermission(tool, permissionManager, showPermissionPrompt, a
         return result2;
       }
       let preview;
-      if (toolName === "edit_file" && args?.path && args?.content) {
+      if (toolName === "edit_local_file" && args?.path && args?.old_string && typeof args?.new_string === "string") {
         try {
-          preview = await generateFileDiffPreview({
+          preview = generateEditLocalFilePreview({
             path: args.path,
-            content: args.content
+            old_string: args.old_string,
+            new_string: args.new_string
           });
         } catch (error) {
           preview = `[Could not generate preview: ${error instanceof Error ? error.message : "Unknown error"}]`;
@@ -10312,6 +10420,7 @@ function generateCliTools(userId, llm, model, permissionManager, showPermissionP
     // File operation tools (CLI-specific, local execution)
     file_read: {},
     create_file: {},
+    edit_local_file: {},
     glob_files: {},
     grep_search: {},
     delete_file: {},
@@ -10394,6 +10503,7 @@ var DEFAULT_TOOL_CATEGORIES = {
   // These tools can modify files, execute code, or have other dangerous side effects
   // They ALWAYS require permission and cannot be trusted automatically
   edit_file: "prompt_always",
+  edit_local_file: "prompt_always",
   create_file: "prompt_always",
   delete_file: "prompt_always",
   shell_execute: "prompt_always",
@@ -10560,8 +10670,8 @@ function getEnvironmentName(configApiConfig) {
 }
 
 // src/utils/contextLoader.ts
-import * as fs12 from "fs";
-import * as path14 from "path";
+import * as fs13 from "fs";
+import * as path15 from "path";
 import { homedir as homedir4 } from "os";
 var CONTEXT_FILE_SIZE_LIMIT = 100 * 1024;
 var PROJECT_CONTEXT_FILES = [
@@ -10582,9 +10692,9 @@ function formatFileSize2(bytes) {
   return `${(bytes / (1024 * 1024)).toFixed(1)}MB`;
 }
 function tryReadContextFile(dir, filename, source) {
-  const filePath = path14.join(dir, filename);
+  const filePath = path15.join(dir, filename);
   try {
-    const stats = fs12.lstatSync(filePath);
+    const stats = fs13.lstatSync(filePath);
     if (stats.isDirectory()) {
       return null;
     }
@@ -10598,7 +10708,7 @@ function tryReadContextFile(dir, filename, source) {
         error: `${source === "global" ? "Global" : "Project"} ${filename} exceeds 100KB limit (${formatFileSize2(stats.size)})`
       };
     }
-    const content = fs12.readFileSync(filePath, "utf-8");
+    const content = fs13.readFileSync(filePath, "utf-8");
     return {
       filename,
       content,
@@ -10650,7 +10760,7 @@ ${project.content}`;
 }
 async function loadContextFiles(projectDir) {
   const errors = [];
-  const globalDir = path14.join(homedir4(), ".bike4mind");
+  const globalDir = path15.join(homedir4(), ".bike4mind");
   const projectDirectory = projectDir || process.cwd();
   const [globalResult, projectResult] = await Promise.all([
     Promise.resolve(findContextFile(globalDir, GLOBAL_CONTEXT_FILES, "global")),
@@ -10686,8 +10796,8 @@ function substituteArguments(template, args) {
 // ../../b4m-core/packages/mcp/dist/src/client.js
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { Client as Client2 } from "@modelcontextprotocol/sdk/client/index.js";
-import path15 from "path";
-import { existsSync as existsSync8, readdirSync as readdirSync3 } from "fs";
+import path16 from "path";
+import { existsSync as existsSync9, readdirSync as readdirSync3 } from "fs";
 var MCPClient = class {
   // Note: This class handles MCP server communication with repository filtering
   mcp;
@@ -10727,18 +10837,18 @@ var MCPClient = class {
         const root = process.env.INIT_CWD || process.cwd();
         const candidatePaths = [
           // When running from SST Lambda with node_modules structure (copyFiles)
-          path15.join(root, `node_modules/@bike4mind/mcp/dist/src/${this.serverName}/index.js`),
+          path16.join(root, `node_modules/@bike4mind/mcp/dist/src/${this.serverName}/index.js`),
           // When running from SST Lambda deployed environment (/var/task)
-          path15.join(root, `b4m-core/packages/mcp/dist/src/${this.serverName}/index.js`),
+          path16.join(root, `b4m-core/packages/mcp/dist/src/${this.serverName}/index.js`),
           // When running from SST Lambda (.sst/artifacts/mcpHandler-dev), navigate to monorepo root (3 levels up)
-          path15.join(root, `../../../b4m-core/packages/mcp/dist/src/${this.serverName}/index.js`),
+          path16.join(root, `../../../b4m-core/packages/mcp/dist/src/${this.serverName}/index.js`),
           // When running from packages/client (Next.js app), navigate to monorepo root (2 levels up)
-          path15.join(root, `../../b4m-core/packages/mcp/dist/src/${this.serverName}/index.js`),
+          path16.join(root, `../../b4m-core/packages/mcp/dist/src/${this.serverName}/index.js`),
           // Original paths (backward compatibility)
-          path15.join(root, `/b4m-core/packages/mcp/dist/src/${this.serverName}/index.js`),
-          path15.join(root, "core", "mcp", "servers", this.serverName, "dist", "index.js")
+          path16.join(root, `/b4m-core/packages/mcp/dist/src/${this.serverName}/index.js`),
+          path16.join(root, "core", "mcp", "servers", this.serverName, "dist", "index.js")
         ];
-        const serverScriptPath = candidatePaths.find((p) => existsSync8(p));
+        const serverScriptPath = candidatePaths.find((p) => existsSync9(p));
         if (!serverScriptPath) {
           const getDirectories = (source) => readdirSync3(source, { withFileTypes: true }).filter((dirent) => dirent.isDirectory()).map((dirent) => dirent.name);
           console.error(`[MCP] Server script not found. Tried paths:`, candidatePaths);
@@ -11548,7 +11658,7 @@ import { isAxiosError as isAxiosError2 } from "axios";
 // package.json
 var package_default = {
   name: "@bike4mind/cli",
-  version: "0.2.11-feat-secops-packages-check.17324+a30b7d649",
+  version: "0.2.11-feat-api-key-rate-limiting.17328+476e364c5",
   type: "module",
   description: "Interactive CLI tool for Bike4Mind with ReAct agents",
   license: "UNLICENSED",
@@ -11652,10 +11762,10 @@ var package_default = {
   },
   devDependencies: {
     "@bike4mind/agents": "0.1.0",
-    "@bike4mind/common": "2.40.1-feat-secops-packages-check.17324+a30b7d649",
-    "@bike4mind/mcp": "1.20.5-feat-secops-packages-check.17324+a30b7d649",
-    "@bike4mind/services": "2.35.1-feat-secops-packages-check.17324+a30b7d649",
-    "@bike4mind/utils": "2.1.5-feat-secops-packages-check.17324+a30b7d649",
+    "@bike4mind/common": "2.40.1-feat-api-key-rate-limiting.17328+476e364c5",
+    "@bike4mind/mcp": "1.20.5-feat-api-key-rate-limiting.17328+476e364c5",
+    "@bike4mind/services": "2.35.1-feat-api-key-rate-limiting.17328+476e364c5",
+    "@bike4mind/utils": "2.1.5-feat-api-key-rate-limiting.17328+476e364c5",
     "@types/better-sqlite3": "^7.6.13",
     "@types/diff": "^5.0.9",
     "@types/jsonwebtoken": "^9.0.4",
@@ -11668,7 +11778,7 @@ var package_default = {
     typescript: "^5.9.3",
     vitest: "^3.2.4"
   },
-  gitHead: "a30b7d6498f01e216154845b33550563e8dc85df"
+  gitHead: "476e364c5486a9f154f1b3fb67d4dc77cbcc34ee"
 };
 
 // src/config/constants.ts
@@ -11910,6 +12020,7 @@ Focus on:
 - Creating logical sequence of steps
 - Estimating scope and priorities
 
+You have read-only access to analyze code.
 You can explore the codebase to understand the current architecture before planning.
 
 Provide a structured plan that the main agent can execute.`,
@@ -12376,20 +12487,38 @@ Remember: Use context from previous messages to understand follow-up questions.$
         const lastIdx = pendingMessages.length - 1;
         if (lastIdx >= 0 && pendingMessages[lastIdx].role === "assistant") {
           const existingSteps = pendingMessages[lastIdx].metadata?.steps || [];
+          const MAX_INPUT_LENGTH = 500;
+          let truncatedStep = step;
+          if (step.type === "action" && step.metadata?.toolInput) {
+            const inputStr = typeof step.metadata.toolInput === "string" ? step.metadata.toolInput : JSON.stringify(step.metadata.toolInput);
+            if (inputStr.length > MAX_INPUT_LENGTH) {
+              const truncatedInput = inputStr.slice(0, MAX_INPUT_LENGTH) + `... (${inputStr.length - MAX_INPUT_LENGTH} more chars)`;
+              truncatedStep = {
+                ...step,
+                metadata: {
+                  ...step.metadata,
+                  toolInput: truncatedInput
+                }
+              };
+            }
+          }
           updatePendingMessage(lastIdx, {
             ...pendingMessages[lastIdx],
             metadata: {
               ...pendingMessages[lastIdx].metadata,
-              steps: [...existingSteps, step]
+              steps: [...existingSteps, truncatedStep]
             }
           });
         }
       };
+      agent.on("thought", stepHandler);
       agent.on("action", stepHandler);
       orchestrator.setBeforeRunCallback((subagent, _subagentType) => {
+        subagent.on("thought", stepHandler);
         subagent.on("action", stepHandler);
       });
       orchestrator.setAfterRunCallback((subagent, _subagentType) => {
+        subagent.off("thought", stepHandler);
         subagent.off("action", stepHandler);
       });
       setState((prev) => ({
@@ -12458,6 +12587,7 @@ Remember: Use context from previous messages to understand follow-up questions.$
         }
       }
     };
+    state.agent.on("thought", stepHandler);
     state.agent.on("action", stepHandler);
     try {
       let messageContent = fullTemplate;
@@ -12579,6 +12709,7 @@ Remember: Use context from previous messages to understand follow-up questions.$
       setState((prev) => ({ ...prev, session: sessionWithError }));
       setStoreSession(sessionWithError);
     } finally {
+      state.agent.off("thought", stepHandler);
       state.agent.off("action", stepHandler);
     }
   };
@@ -12900,7 +13031,6 @@ Custom Commands:
           logger.debug("=== Session Resumed ===");
           setState((prev) => ({ ...prev, session: loadedSession }));
           setStoreSession(loadedSession);
-          useCliStore.getState().clearAgentSteps();
           useCliStore.getState().clearPendingMessages();
           usageCache = null;
           console.log(`
@@ -13136,7 +13266,6 @@ Custom Commands:
         logger.debug("=== New Session Started via /clear ===");
         setState((prev) => ({ ...prev, session: newSession }));
         setStoreSession(newSession);
-        useCliStore.getState().clearAgentSteps();
         useCliStore.getState().clearPendingMessages();
         usageCache = null;
         console.log("New session started.");

package/dist/{llmMarkdownGenerator-LCCZ76BQ.js → llmMarkdownGenerator-JTY6SG2M.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   CurationArtifactType
-} from "./chunk-3OX632TE.js";
+} from "./chunk-332RE6EY.js";
 import "./chunk-PDX44BCA.js";
 
 // ../../b4m-core/packages/services/dist/src/notebookCurationService/llmMarkdownGenerator.js

package/dist/{markdownGenerator-4OF7GEBT.js → markdownGenerator-67TIJVUF.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   CurationArtifactType
-} from "./chunk-3OX632TE.js";
+} from "./chunk-332RE6EY.js";
 import "./chunk-PDX44BCA.js";
 
 // ../../b4m-core/packages/services/dist/src/notebookCurationService/markdownGenerator.js

package/dist/{mementoService-A6UR5AZY.js → mementoService-LR2J4UL6.js}

@@ -2,10 +2,10 @@
 import {
   findMostSimilarMemento,
   getRelevantMementos
-} from "./chunk-7JR6VASX.js";
-import "./chunk-JYH72REB.js";
+} from "./chunk-BFO3VHFZ.js";
+import "./chunk-XYK5DZUN.js";
 import "./chunk-AMDXHL6S.js";
-import "./chunk-3OX632TE.js";
+import "./chunk-332RE6EY.js";
 import "./chunk-PDX44BCA.js";
 export {
   findMostSimilarMemento,

package/dist/{src-GFWGZLJE.js → src-JWYWDHAI.js}

@@ -120,7 +120,7 @@ import {
   validateMermaidSyntax,
   warmUpSettingsCache,
   withRetry
-} from "./chunk-JYH72REB.js";
+} from "./chunk-XYK5DZUN.js";
 import {
   Logger,
   NotificationDeduplicator,
@@ -129,7 +129,7 @@ import {
   postLowCreditsNotificationToSlack,
   postMessageToSlack
 } from "./chunk-AMDXHL6S.js";
-import "./chunk-3OX632TE.js";
+import "./chunk-332RE6EY.js";
 import "./chunk-PDX44BCA.js";
 export {
   AWSBackend,

package/dist/{src-7UYCXFTE.js → src-V6NVCEIV.js}

@@ -40,6 +40,7 @@ import {
   CitableSourceSchema,
   ClaudeArtifactMimeTypes,
   CollectionType,
+  CompletionApiUsageTransaction,
   CompletionRequestSchema,
   ConfluenceApi,
   CreateFabFileRequestInput,
@@ -293,7 +294,7 @@ import {
   validateQuestMasterArtifactV2,
   validateReactArtifactV2,
   validateSvgArtifactV2
-} from "./chunk-3OX632TE.js";
+} from "./chunk-332RE6EY.js";
 import "./chunk-PDX44BCA.js";
 export {
   ALL_IMAGE_MODELS,
@@ -336,6 +337,7 @@ export {
   CitableSourceSchema,
   ClaudeArtifactMimeTypes,
   CollectionType,
+  CompletionApiUsageTransaction,
   CompletionRequestSchema,
   ConfluenceApi,
   CreateFabFileRequestInput,

package/dist/{subtractCredits-L52DZ3SP.js → subtractCredits-R2CRBVHW.js}

@@ -2,10 +2,10 @@
 import {
   SubtractCreditsSchema,
   subtractCredits
-} from "./chunk-7ORA6KGN.js";
-import "./chunk-JYH72REB.js";
+} from "./chunk-IEDWDSMG.js";
+import "./chunk-XYK5DZUN.js";
 import "./chunk-AMDXHL6S.js";
-import "./chunk-3OX632TE.js";
+import "./chunk-332RE6EY.js";
 import "./chunk-PDX44BCA.js";
 export {
   SubtractCreditsSchema,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bike4mind/cli",
-  "version": "0.2.11-feat-secops-packages-check.17324+a30b7d649",
+  "version": "0.2.11-feat-api-key-rate-limiting.17328+476e364c5",
   "type": "module",
   "description": "Interactive CLI tool for Bike4Mind with ReAct agents",
   "license": "UNLICENSED",
@@ -104,10 +104,10 @@
   },
   "devDependencies": {
     "@bike4mind/agents": "0.1.0",
-    "@bike4mind/common": "2.40.1-feat-secops-packages-check.17324+a30b7d649",
-    "@bike4mind/mcp": "1.20.5-feat-secops-packages-check.17324+a30b7d649",
-    "@bike4mind/services": "2.35.1-feat-secops-packages-check.17324+a30b7d649",
-    "@bike4mind/utils": "2.1.5-feat-secops-packages-check.17324+a30b7d649",
+    "@bike4mind/common": "2.40.1-feat-api-key-rate-limiting.17328+476e364c5",
+    "@bike4mind/mcp": "1.20.5-feat-api-key-rate-limiting.17328+476e364c5",
+    "@bike4mind/services": "2.35.1-feat-api-key-rate-limiting.17328+476e364c5",
+    "@bike4mind/utils": "2.1.5-feat-api-key-rate-limiting.17328+476e364c5",
     "@types/better-sqlite3": "^7.6.13",
     "@types/diff": "^5.0.9",
     "@types/jsonwebtoken": "^9.0.4",
@@ -120,5 +120,5 @@
     "typescript": "^5.9.3",
     "vitest": "^3.2.4"
   },
-  "gitHead": "a30b7d6498f01e216154845b33550563e8dc85df"
+  "gitHead": "476e364c5486a9f154f1b3fb67d4dc77cbcc34ee"
 }