@bike4mind/cli 0.2.29-feat-cli-sandbox.18843 → 0.2.29-feat-session-permission.18841

package/dist/{chunk-JWEG53NG.js → chunk-LBTTUQJM.js}

@@ -1,7 +1,4 @@
 #!/usr/bin/env node
-import {
-  DEFAULT_SANDBOX_CONFIG
-} from "./chunk-W4TCH4ZT.js";
 
 // src/utils/Logger.ts
 import fs from "fs/promises";
@@ -265,41 +262,6 @@ import path2 from "path";
 import { homedir } from "os";
 import { v4 as uuidv4 } from "uuid";
 import { z } from "zod";
-var SandboxFilesystemSchema = z.object({
-  allowedReadPaths: z.array(z.string()).default(DEFAULT_SANDBOX_CONFIG.filesystem.allowedReadPaths),
-  deniedPaths: z.array(z.string()).default(DEFAULT_SANDBOX_CONFIG.filesystem.deniedPaths),
-  writeOnlyToWorkingDir: z.boolean().default(true)
-});
-var SandboxPlatformSchema = z.object({
-  linux: z.object({
-    runtime: z.literal("bubblewrap").default("bubblewrap"),
-    seccompProfile: z.string().optional()
-  }).default({ runtime: "bubblewrap" }),
-  macos: z.object({
-    runtime: z.literal("seatbelt").default("seatbelt"),
-    profileTemplate: z.string().default("default")
-  }).default({ runtime: "seatbelt", profileTemplate: "default" })
-});
-var SandboxConfigSchema = z.object({
-  enabled: z.boolean().default(false),
-  mode: z.enum(["disabled", "auto-allow", "permissions"]).default("disabled"),
-  filesystem: SandboxFilesystemSchema.default(DEFAULT_SANDBOX_CONFIG.filesystem),
-  excludedCommands: z.array(z.string()).default(DEFAULT_SANDBOX_CONFIG.excludedCommands),
-  allowUnsandboxedCommands: z.boolean().default(true),
-  platform: SandboxPlatformSchema.default(DEFAULT_SANDBOX_CONFIG.platform)
-});
-var PartialSandboxConfigSchema = z.object({
-  enabled: z.boolean().optional(),
-  mode: z.enum(["disabled", "auto-allow", "permissions"]).optional(),
-  filesystem: z.object({
-    allowedReadPaths: z.array(z.string()).optional(),
-    deniedPaths: z.array(z.string()).optional(),
-    writeOnlyToWorkingDir: z.boolean().optional()
-  }).optional(),
-  excludedCommands: z.array(z.string()).optional(),
-  allowUnsandboxedCommands: z.boolean().optional(),
-  platform: SandboxPlatformSchema.optional()
-}).optional();
 var AuthTokensSchema = z.object({
   accessToken: z.string(),
   refreshToken: z.string(),
@@ -374,8 +336,7 @@ var CliConfigSchema = z.object({
     disabled: z.array(z.string()),
     config: z.record(z.any())
   }),
-  trustedTools: z.array(z.string()).optional().default([]),
-  sandbox: SandboxConfigSchema.optional()
+  trustedTools: z.array(z.string()).optional().default([])
 });
 var ProjectConfigSchema = z.object({
   tools: z.object({
@@ -393,8 +354,7 @@ var ProjectConfigSchema = z.object({
     theme: z.enum(["light", "dark"]).optional(),
     exportFormat: z.enum(["markdown", "json"]).optional(),
     enableSkillTool: z.boolean().optional()
-  }).optional(),
-  sandbox: PartialSandboxConfigSchema
+  }).optional()
 });
 var ProjectLocalConfigSchema = z.object({
   trustedTools: z.array(z.string()).optional(),
@@ -411,8 +371,7 @@ var ProjectLocalConfigSchema = z.object({
     exportFormat: z.enum(["markdown", "json"]).optional(),
     enableSkillTool: z.boolean().optional()
   }).optional(),
-  mcpServers: McpServersSchema.optional(),
-  sandbox: PartialSandboxConfigSchema
+  mcpServers: McpServersSchema.optional()
 });
 var DEFAULT_CONFIG = {
   version: "0.1.0",
@@ -537,21 +496,6 @@ function mergeMcpServers(...serverArrays) {
   }
   return Array.from(serverMap.values());
 }
-function mergeSandboxConfig(base, override) {
-  const resolved = base ?? DEFAULT_SANDBOX_CONFIG;
-  if (!override) return resolved;
-  return {
-    enabled: override.enabled ?? resolved.enabled,
-    mode: override.mode ?? resolved.mode,
-    filesystem: {
-      ...resolved.filesystem,
-      ...override.filesystem ?? {}
-    },
-    excludedCommands: override.excludedCommands ?? resolved.excludedCommands,
-    allowUnsandboxedCommands: override.allowUnsandboxedCommands ?? resolved.allowUnsandboxedCommands,
-    platform: override.platform ?? resolved.platform
-  };
-}
 function mergeConfigs(global, project, local) {
   const merged = { ...global };
   if (project) {
@@ -578,9 +522,6 @@ function mergeConfigs(global, project, local) {
     if (project.mcpServers) {
       merged.mcpServers = mergeMcpServers(merged.mcpServers, project.mcpServers);
     }
-    if (project.sandbox) {
-      merged.sandbox = mergeSandboxConfig(merged.sandbox, project.sandbox);
-    }
   }
   if (local) {
     if (local.trustedTools) {
@@ -602,9 +543,6 @@ function mergeConfigs(global, project, local) {
     if (local.mcpServers) {
       merged.mcpServers = mergeMcpServers(merged.mcpServers, local.mcpServers);
     }
-    if (local.sandbox) {
-      merged.sandbox = mergeSandboxConfig(merged.sandbox, local.sandbox);
-    }
   }
   return merged;
 }

package/dist/commands/mcpCommand.js

@@ -1,8 +1,7 @@
 #!/usr/bin/env node
 import {
   ConfigStore
-} from "../chunk-JWEG53NG.js";
-import "../chunk-W4TCH4ZT.js";
+} from "../chunk-LBTTUQJM.js";
 
 // src/commands/mcpCommand.ts
 async function handleMcpCommand(subcommand, argv) {

package/dist/index.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-import "./chunk-ELTTBWAQ.js";
 import "./chunk-BPFEGDC7.js";
 import "./chunk-BDQBOLYG.js";
 import {
@@ -10,13 +9,13 @@ import {
 import {
   ConfigStore,
   logger
-} from "./chunk-JWEG53NG.js";
+} from "./chunk-LBTTUQJM.js";
 import {
   selectActiveBackgroundAgents,
   useCliStore
 } from "./chunk-TVW4ZESU.js";
-import "./chunk-W4TCH4ZT.js";
 import "./chunk-PKKJ44C5.js";
+import "./chunk-ELTTBWAQ.js";
 import {
   BFLImageService,
   BaseStorage,
@@ -646,24 +645,6 @@ var COMMANDS = [
     name: "compact",
     description: "Compact conversation into new session",
     args: "[instructions]"
-  },
-  // Sandbox commands
-  {
-    name: "sandbox",
-    description: "Show sandbox status and configuration"
-  },
-  {
-    name: "sandbox:enable",
-    description: "Enable OS-level sandbox for bash commands"
-  },
-  {
-    name: "sandbox:disable",
-    description: "Disable sandbox mode"
-  },
-  {
-    name: "sandbox:mode",
-    description: "Set sandbox mode (auto-allow or permissions)",
-    args: "<auto-allow|permissions>"
   }
 ];
 function getAllCommandNames() {
@@ -1279,10 +1260,12 @@ function PermissionPrompt({
 }) {
   const items = canBeTrusted ? [
     { label: "\u2713 Allow once", value: "allow-once" },
+    { label: "\u2713 Allow for this session", value: "allow-session" },
     { label: "\u2713 Always allow (trust this tool)", value: "allow-always" },
     { label: "\u2717 Deny", value: "deny" }
   ] : [
     { label: "\u2713 Allow once", value: "allow-once" },
+    { label: "\u2713 Allow for this session", value: "allow-session" },
     { label: "\u2717 Deny", value: "deny" }
   ];
   const [selectedIndex, setSelectedIndex] = useState3(0);
@@ -3711,9 +3694,6 @@ EXAMPLES:
 Remember: Use context from previous messages to understand follow-up questions.${contextSection}`;
 }
 
-// src/utils/toolsAdapter.ts
-import { rmSync } from "fs";
-
 // ../../b4m-core/packages/services/dist/src/referService/generateCodes.js
 import { randomBytes } from "crypto";
 import range from "lodash/range.js";
@@ -11732,60 +11712,20 @@ var CliLogger = class extends Logger {
   log(...args) {
   }
 };
-function wrapToolWithPermission(tool, permissionManager, showPermissionPrompt, agentContext, configStore, apiClient, sandboxOrchestrator) {
+function wrapToolWithPermission(tool, permissionManager, showPermissionPrompt, agentContext, configStore, apiClient) {
   const originalFn = tool.toolFn;
   const toolName = tool.toolSchema.name;
   return {
     ...tool,
     toolFn: async (args) => {
-      let isSandboxed = false;
-      let sandboxedArgs = args;
-      if (toolName === "bash_execute" && args?.command && sandboxOrchestrator) {
-        const pathMod = await import("path");
-        const cwd = args.cwd ? pathMod.resolve(process.cwd(), args.cwd) : process.cwd();
-        const decision = sandboxOrchestrator.shouldSandbox(args.command, cwd);
-        if (decision.type === "blocked") {
-          return `Command blocked by sandbox: ${decision.reason}`;
-        }
-        if (decision.type === "sandbox") {
-          isSandboxed = true;
-          sandboxedArgs = {
-            ...args,
-            command: decision.wrappedCommand.commandString,
-            // Store cleanup paths for post-execution cleanup
-            _sandboxCleanup: decision.wrappedCommand.cleanupPaths
-          };
-        }
-      }
-      const effectiveArgs = isSandboxed ? sandboxedArgs : args;
-      if (!permissionManager.needsPermission(toolName, { isSandboxed })) {
-        let result2 = await executeTool(toolName, effectiveArgs, apiClient, originalFn);
-        cleanupSandboxFiles(effectiveArgs?._sandboxCleanup);
-        result2 = await retrySandboxFailure(
-          isSandboxed,
-          result2,
-          toolName,
-          args,
-          apiClient,
-          originalFn,
-          showPermissionPrompt
-        );
+      if (!permissionManager.needsPermission(toolName)) {
+        const result2 = await executeTool(toolName, args, apiClient, originalFn);
         agentContext.observationQueue.push({ toolName, result: result2 });
         return result2;
       }
       const { useCliStore: useCliStore2 } = await import("./store-FU6NDC2W.js");
       if (useCliStore2.getState().autoAcceptEdits) {
-        let result2 = await executeTool(toolName, effectiveArgs, apiClient, originalFn);
-        cleanupSandboxFiles(effectiveArgs?._sandboxCleanup);
-        result2 = await retrySandboxFailure(
-          isSandboxed,
-          result2,
-          toolName,
-          args,
-          apiClient,
-          originalFn,
-          showPermissionPrompt
-        );
+        const result2 = await executeTool(toolName, args, apiClient, originalFn);
         agentContext.observationQueue.push({ toolName, result: result2 });
         return result2;
       }
@@ -11820,13 +11760,15 @@ function wrapToolWithPermission(tool, permissionManager, showPermissionPrompt, a
       } else if (toolName === "bash_execute" && args?.command) {
         const cwd = args.cwd ? ` (in ${args.cwd})` : "";
         const timeout = args.timeout ? ` [timeout: ${args.timeout}ms]` : "";
-        const sandboxLabel = isSandboxed ? " [sandboxed]" : "";
-        preview = `$ ${args.command}${cwd}${timeout}${sandboxLabel}`;
+        preview = `$ ${args.command}${cwd}${timeout}`;
       }
-      const response = await showPermissionPrompt(toolName, effectiveArgs, preview);
+      const response = await showPermissionPrompt(toolName, args, preview);
       if (response.action === "deny") {
         throw new PermissionDeniedError(toolName, args);
       }
+      if (response.action === "allow-session") {
+        permissionManager.trustToolForSession(toolName);
+      }
       if (response.action === "allow-always") {
         const canTrust = permissionManager.trustTool(toolName);
         if (canTrust) {
@@ -11848,50 +11790,12 @@ function wrapToolWithPermission(tool, permissionManager, showPermissionPrompt, a
           }
         }
       }
-      let result = await executeTool(toolName, effectiveArgs, apiClient, originalFn);
-      cleanupSandboxFiles(effectiveArgs?._sandboxCleanup);
-      result = await retrySandboxFailure(
-        isSandboxed,
-        result,
-        toolName,
-        args,
-        apiClient,
-        originalFn,
-        showPermissionPrompt
-      );
+      const result = await executeTool(toolName, args, apiClient, originalFn);
       agentContext.observationQueue.push({ toolName, result });
       return result;
     }
   };
 }
-function isSandboxFailure(isSandboxed, result) {
-  if (!isSandboxed) return false;
-  return result.includes("sandbox-exec:") || result.includes("bwrap:") || result.includes("Operation not permitted");
-}
-async function retrySandboxFailure(isSandboxed, result, toolName, originalArgs, apiClient, originalFn, showPermissionPrompt) {
-  if (!isSandboxFailure(isSandboxed, result)) return result;
-  const errorSnippet = result.slice(0, 200);
-  const retryResponse = await showPermissionPrompt(
-    toolName,
-    originalArgs,
-    `Sandbox execution failed. Retry without sandbox?
-
-Error: ${errorSnippet}`
-  );
-  if (retryResponse.action !== "deny") {
-    return executeTool(toolName, originalArgs, apiClient, originalFn);
-  }
-  return result;
-}
-function cleanupSandboxFiles(paths) {
-  if (!paths || paths.length === 0) return;
-  for (const p of paths) {
-    try {
-      rmSync(p, { recursive: true, force: true });
-    } catch {
-    }
-  }
-}
 function wrapToolWithHooks(tool, hooks, hookContext) {
   const hasToolHooks = hooks?.PreToolUse || hooks?.PostToolUse || hooks?.PostToolUseFailure;
   if (!hasToolHooks) {
@@ -11985,7 +11889,7 @@ function normalizeToolName(toolName) {
   }
   return TOOL_NAME_MAPPING[toolName] || toolName;
 }
-function generateCliTools(userId, llm, model, permissionManager, showPermissionPrompt, agentContext, configStore, apiClient, toolFilter, sandboxOrchestrator) {
+function generateCliTools(userId, llm, model, permissionManager, showPermissionPrompt, agentContext, configStore, apiClient, toolFilter) {
   const logger2 = new CliLogger();
   const storage = new NoOpStorage();
   const user = {
@@ -12045,15 +11949,7 @@ function generateCliTools(userId, llm, model, permissionManager, showPermissionP
     tools_to_generate
   );
   let tools = Object.entries(toolsMap).map(
-    ([_, tool]) => wrapToolWithPermission(
-      tool,
-      permissionManager,
-      showPermissionPrompt,
-      agentContext,
-      configStore,
-      apiClient,
-      sandboxOrchestrator
-    )
+    ([_, tool]) => wrapToolWithPermission(tool, permissionManager, showPermissionPrompt, agentContext, configStore, apiClient)
   );
   if (toolFilter) {
     const { allowedTools, deniedTools } = toolFilter;
@@ -12077,22 +11973,12 @@ function generateCliTools(userId, llm, model, permissionManager, showPermissionP
 var PermissionManager = class {
   constructor(trustedTools = [], customCategories, deniedTools) {
     this.trustedTools = /* @__PURE__ */ new Set();
+    this.sessionTrustedTools = /* @__PURE__ */ new Set();
     this.deniedTools = /* @__PURE__ */ new Set();
-    this._sandboxMode = "disabled";
-    this._sandboxActive = false;
     this.trustedTools = new Set(trustedTools);
     this.customCategories = new Map(Object.entries(customCategories || {}));
     this.deniedTools = new Set(deniedTools || []);
   }
-  /** Update sandbox state from the orchestrator */
-  setSandboxState(mode, active) {
-    this._sandboxMode = mode;
-    this._sandboxActive = active;
-  }
-  /** Check if sandbox auto-allow is active */
-  isSandboxAutoAllow() {
-    return this._sandboxMode === "auto-allow" && this._sandboxActive;
-  }
   /**
    * Check if a tool needs permission before execution
    *
@@ -12103,13 +11989,8 @@ var PermissionManager = class {
    *
    * Note: prompt_always tools CANNOT be trusted, so they always need permission
    * Note: denied tools from project config ALWAYS need permission (cannot be overridden locally)
-   *
-   * @param toolName - The tool being checked
-   * @param options.isSandboxed - If true, the command will run inside the OS-level sandbox.
-   *   In auto-allow mode, sandboxed bash_execute commands skip the permission prompt
-   *   because the sandbox provides the security boundary.
    */
-  needsPermission(toolName, options) {
+  needsPermission(toolName) {
     const categoryMap = Object.fromEntries(this.customCategories);
     const category = getToolCategory(toolName, categoryMap);
     if (this.deniedTools.has(toolName)) {
@@ -12118,7 +11999,7 @@ var PermissionManager = class {
     if (category === "auto_approve") {
       return false;
     }
-    if (options?.isSandboxed && toolName === "bash_execute" && this.isSandboxAutoAllow()) {
+    if (this.sessionTrustedTools.has(toolName)) {
       return false;
     }
     if (category === "prompt_always") {
@@ -12188,6 +12069,29 @@ var PermissionManager = class {
   getDeniedTools() {
     return Array.from(this.deniedTools).sort();
   }
+  /**
+   * Trust a tool for the current session only (in-memory, no persistence)
+   * Works for all tool categories including prompt_always, but NOT project-denied tools
+   */
+  trustToolForSession(toolName) {
+    if (this.deniedTools.has(toolName)) {
+      return false;
+    }
+    this.sessionTrustedTools.add(toolName);
+    return true;
+  }
+  /**
+   * Check if a tool is trusted for the current session
+   */
+  isSessionTrusted(toolName) {
+    return this.sessionTrustedTools.has(toolName);
+  }
+  /**
+   * Clear all session-scoped trust (called on exit or session reset)
+   */
+  clearSessionTrust() {
+    this.sessionTrustedTools.clear();
+  }
   /**
    * Clear all trusted tools
    */
@@ -13689,7 +13593,7 @@ import { isAxiosError as isAxiosError2 } from "axios";
 // package.json
 var package_default = {
   name: "@bike4mind/cli",
-  version: "0.2.29-feat-cli-sandbox.18843+467f137bc",
+  version: "0.2.29-feat-session-permission.18841+6d9c4deb5",
   type: "module",
   description: "Interactive CLI tool for Bike4Mind with ReAct agents",
   license: "UNLICENSED",
@@ -13799,10 +13703,10 @@ var package_default = {
   },
   devDependencies: {
     "@bike4mind/agents": "0.1.0",
-    "@bike4mind/common": "2.50.1-feat-cli-sandbox.18843+467f137bc",
-    "@bike4mind/mcp": "1.29.1-feat-cli-sandbox.18843+467f137bc",
-    "@bike4mind/services": "2.48.1-feat-cli-sandbox.18843+467f137bc",
-    "@bike4mind/utils": "2.5.1-feat-cli-sandbox.18843+467f137bc",
+    "@bike4mind/common": "2.50.1-feat-session-permission.18841+6d9c4deb5",
+    "@bike4mind/mcp": "1.29.1-feat-session-permission.18841+6d9c4deb5",
+    "@bike4mind/services": "2.48.1-feat-session-permission.18841+6d9c4deb5",
+    "@bike4mind/utils": "2.5.1-feat-session-permission.18841+6d9c4deb5",
     "@types/better-sqlite3": "^7.6.13",
     "@types/diff": "^5.0.9",
     "@types/jsonwebtoken": "^9.0.4",
@@ -13819,7 +13723,7 @@ var package_default = {
   optionalDependencies: {
     "@vscode/ripgrep": "^1.17.0"
   },
-  gitHead: "467f137bcb738020d1665b78bc7d34de7d846df5"
+  gitHead: "6d9c4deb5a83cfc1087043d22f407d3444a91cca"
 };
 
 // src/config/constants.ts
@@ -15627,8 +15531,7 @@ function CliApp() {
     agentStore: null,
     abortController: null,
     contextContent: "",
-    backgroundManager: null,
-    sandboxOrchestrator: null
+    backgroundManager: null
   });
   const [isInitialized, setIsInitialized] = useState9(false);
   const [initError, setInitError] = useState9(null);
@@ -15825,20 +15728,6 @@ function CliApp() {
         config.tools.disabled || []
         // denied tools from project config
       );
-      const { createSandboxRuntime } = await import("./SandboxRuntimeAdapter-5ZMU25Q3.js");
-      const { SandboxOrchestrator } = await import("./SandboxOrchestrator-Z36SFJ7X.js");
-      const { DEFAULT_SANDBOX_CONFIG } = await import("./types-SMQKWHQK.js");
-      const sandboxRuntime = await createSandboxRuntime();
-      const sandboxConfig = config.sandbox ?? DEFAULT_SANDBOX_CONFIG;
-      const sandboxOrchestrator = new SandboxOrchestrator(sandboxConfig, sandboxRuntime);
-      permissionManager.setSandboxState(sandboxConfig.mode, sandboxOrchestrator.isActive());
-      if (sandboxConfig.enabled && sandboxConfig.mode !== "disabled") {
-        if (sandboxRuntime) {
-          console.log(`\u{1F512} Sandbox: ${sandboxConfig.mode} (${sandboxRuntime.name})`);
-        } else {
-          console.log("\u26A0\uFE0F  Sandbox: enabled but runtime not available on this platform");
-        }
-      }
       let permissionPromptCounter = 0;
       const promptFn = (toolName, args, preview) => {
         return new Promise((resolve3) => {
@@ -15864,10 +15753,7 @@ function CliApp() {
         promptFn,
         agentContext,
         state.configStore,
-        apiClient,
-        void 0,
-        // toolFilter
-        sandboxOrchestrator
+        apiClient
       );
       startupLog.push(`\u{1F6E0}\uFE0F Loaded ${b4mTools2.length} B4M tool(s)`);
       const mcpManager = new McpManager(config);
@@ -16025,10 +15911,8 @@ ${contextResult.mergedContent}` : "";
         // Store agent store for agent management commands
         contextContent: contextResult.mergedContent,
         // Store raw context for compact instructions
-        backgroundManager,
+        backgroundManager
         // Store for grouped notification turn tracking
-        sandboxOrchestrator
-        // Store sandbox orchestrator for /sandbox commands
       }));
       setStoreSession(newSession);
       const bannerLines = [
@@ -17497,86 +17381,6 @@ No usage data available for the last ${USAGE_DAYS} days.`);
         }
         break;
       }
-      // --- Sandbox commands ---
-      case "sandbox": {
-        if (!state.sandboxOrchestrator) {
-          console.log("\nSandbox: Not initialized");
-          break;
-        }
-        const status = state.sandboxOrchestrator.getStatus();
-        console.log("\nSandbox Status:");
-        console.log(`  Enabled:   ${status.enabled ? "Yes" : "No"}`);
-        console.log(`  Mode:      ${status.mode}`);
-        console.log(`  Platform:  ${status.platform ?? "N/A"}`);
-        console.log(`  Runtime:   ${status.runtimeName ?? "N/A"}`);
-        console.log(`  Available: ${status.runtimeAvailable ? "Yes" : "No"}`);
-        console.log("");
-        console.log("Filesystem Config:");
-        console.log(`  Write only to CWD: ${status.config.filesystem.writeOnlyToWorkingDir}`);
-        console.log(`  Allowed reads: ${status.config.filesystem.allowedReadPaths.join(", ") || "(none)"}`);
-        console.log(`  Denied paths:  ${status.config.filesystem.deniedPaths.join(", ") || "(none)"}`);
-        console.log(`  Excluded cmds: ${status.config.excludedCommands.join(", ") || "(none)"}`);
-        console.log("");
-        break;
-      }
-      case "sandbox:enable": {
-        if (!state.sandboxOrchestrator) {
-          console.log("Sandbox not initialized");
-          break;
-        }
-        if (!state.sandboxOrchestrator.isAvailable()) {
-          console.log("Sandbox runtime not available on this platform");
-          break;
-        }
-        state.sandboxOrchestrator.setMode("auto-allow");
-        state.permissionManager?.setSandboxState("auto-allow", true);
-        const config = await state.configStore.get();
-        await state.configStore.save({
-          ...config,
-          sandbox: { ...state.sandboxOrchestrator.getConfig() }
-        });
-        console.log("Sandbox enabled (auto-allow mode)");
-        break;
-      }
-      case "sandbox:disable": {
-        if (!state.sandboxOrchestrator) {
-          console.log("Sandbox not initialized");
-          break;
-        }
-        state.sandboxOrchestrator.setMode("disabled");
-        state.permissionManager?.setSandboxState("disabled", false);
-        const disableConfig = await state.configStore.get();
-        await state.configStore.save({
-          ...disableConfig,
-          sandbox: { ...state.sandboxOrchestrator.getConfig() }
-        });
-        console.log("Sandbox disabled");
-        break;
-      }
-      case "sandbox:mode": {
-        if (!state.sandboxOrchestrator) {
-          console.log("Sandbox not initialized");
-          break;
-        }
-        const modeArg = args[0];
-        if (modeArg !== "auto-allow" && modeArg !== "permissions") {
-          console.log("Usage: /sandbox:mode <auto-allow|permissions>");
-          break;
-        }
-        if (!state.sandboxOrchestrator.isAvailable()) {
-          console.log("Sandbox runtime not available on this platform");
-          break;
-        }
-        state.sandboxOrchestrator.setMode(modeArg);
-        state.permissionManager?.setSandboxState(modeArg, state.sandboxOrchestrator.isActive());
-        const modeConfig = await state.configStore.get();
-        await state.configStore.save({
-          ...modeConfig,
-          sandbox: { ...state.sandboxOrchestrator.getConfig() }
-        });
-        console.log(`Sandbox mode set to: ${modeArg}`);
-        break;
-      }
       default:
         console.log(`Unknown command: /${command}`);
         console.log("Type /help for available commands");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bike4mind/cli",
-  "version": "0.2.29-feat-cli-sandbox.18843+467f137bc",
+  "version": "0.2.29-feat-session-permission.18841+6d9c4deb5",
   "type": "module",
   "description": "Interactive CLI tool for Bike4Mind with ReAct agents",
   "license": "UNLICENSED",
@@ -110,10 +110,10 @@
   },
   "devDependencies": {
     "@bike4mind/agents": "0.1.0",
-    "@bike4mind/common": "2.50.1-feat-cli-sandbox.18843+467f137bc",
-    "@bike4mind/mcp": "1.29.1-feat-cli-sandbox.18843+467f137bc",
-    "@bike4mind/services": "2.48.1-feat-cli-sandbox.18843+467f137bc",
-    "@bike4mind/utils": "2.5.1-feat-cli-sandbox.18843+467f137bc",
+    "@bike4mind/common": "2.50.1-feat-session-permission.18841+6d9c4deb5",
+    "@bike4mind/mcp": "1.29.1-feat-session-permission.18841+6d9c4deb5",
+    "@bike4mind/services": "2.48.1-feat-session-permission.18841+6d9c4deb5",
+    "@bike4mind/utils": "2.5.1-feat-session-permission.18841+6d9c4deb5",
     "@types/better-sqlite3": "^7.6.13",
     "@types/diff": "^5.0.9",
     "@types/jsonwebtoken": "^9.0.4",
@@ -130,5 +130,5 @@
   "optionalDependencies": {
     "@vscode/ripgrep": "^1.17.0"
   },
-  "gitHead": "467f137bcb738020d1665b78bc7d34de7d846df5"
+  "gitHead": "6d9c4deb5a83cfc1087043d22f407d3444a91cca"
 }

package/dist/BubblewrapRuntime-HXTR3NQG.js

@@ -1,68 +0,0 @@
-#!/usr/bin/env node
-import {
-  expandPath,
-  isBinaryAvailable
-} from "./chunk-AVAD2PPK.js";
-
-// src/sandbox/runtime/BubblewrapRuntime.ts
-import os from "os";
-var SYSTEM_RO_BINDS = ["/usr", "/bin", "/lib", "/lib64", "/sbin", "/etc"];
-var SPECIAL_MOUNTS = {
-  dev: "/dev",
-  proc: "/proc",
-  tmp: "/tmp"
-};
-var BubblewrapRuntime = class {
-  constructor() {
-    this.platform = "linux";
-    this.name = "bubblewrap";
-  }
-  isAvailable() {
-    return isBinaryAvailable("bwrap");
-  }
-  wrapCommand(options) {
-    const { command, cwd, filesystemConfig, env } = options;
-    const expandedDenied = filesystemConfig.deniedPaths.map(expandPath);
-    const expandedAllowed = filesystemConfig.allowedReadPaths.map(expandPath);
-    const args = [];
-    for (const sysPath of SYSTEM_RO_BINDS) {
-      args.push("--ro-bind-try", sysPath, sysPath);
-    }
-    args.push("--dev", SPECIAL_MOUNTS.dev);
-    args.push("--proc", SPECIAL_MOUNTS.proc);
-    args.push("--tmpfs", SPECIAL_MOUNTS.tmp);
-    args.push("--bind", cwd, cwd);
-    const homeDir = os.homedir();
-    args.push("--ro-bind", homeDir, homeDir);
-    for (const allowedPath of expandedAllowed) {
-      if (!allowedPath.startsWith(homeDir)) {
-        args.push("--ro-bind-try", allowedPath, allowedPath);
-      }
-    }
-    for (const deniedPath of expandedDenied) {
-      args.push("--tmpfs", deniedPath);
-    }
-    args.push("--unshare-all");
-    args.push("--share-net");
-    args.push("--die-with-parent");
-    if (options.seccompProfile) {
-      args.push("--seccomp", options.seccompProfile);
-    }
-    args.push("--chdir", cwd);
-    args.push("bash", "-c", command);
-    const commandString = ["bwrap", ...args.map(shellEscape)].join(" ");
-    return {
-      executable: "bwrap",
-      args,
-      env: env ?? {},
-      commandString
-    };
-  }
-};
-function shellEscape(str) {
-  if (/^[a-zA-Z0-9._/=:-]+$/.test(str)) return str;
-  return `'${str.replace(/'/g, "'\\''")}'`;
-}
-export {
-  BubblewrapRuntime
-};

package/dist/SandboxOrchestrator-Z36SFJ7X.js

@@ -1,110 +0,0 @@
-#!/usr/bin/env node
-import {
-  DEFAULT_SANDBOX_CONFIG
-} from "./chunk-W4TCH4ZT.js";
-
-// src/sandbox/SandboxOrchestrator.ts
-var SandboxOrchestrator = class {
-  constructor(config, runtime) {
-    this.config = config ?? DEFAULT_SANDBOX_CONFIG;
-    this.runtime = runtime ?? null;
-  }
-  /**
-   * Determine whether a command should be sandboxed.
-   *
-   * Decision logic:
-   * 1. If sandbox is disabled → unsandboxed (no permission change)
-   * 2. If command matches an excluded command → unsandboxed (requires permission)
-   * 3. If runtime is not available → unsandboxed with warning
-   * 4. Otherwise → sandbox the command
-   */
-  shouldSandbox(command, cwd) {
-    if (!this.config.enabled || this.config.mode === "disabled") {
-      return { type: "unsandboxed", requiresPermission: true };
-    }
-    const baseCommand = this.getBaseCommand(command);
-    if (this.isExcludedCommand(baseCommand)) {
-      if (!this.config.allowUnsandboxedCommands) {
-        return {
-          type: "blocked",
-          reason: `Command '${baseCommand}' is excluded from sandboxing and unsandboxed commands are not allowed`
-        };
-      }
-      return {
-        type: "unsandboxed",
-        requiresPermission: true,
-        reason: `Command '${baseCommand}' is excluded from sandboxing`
-      };
-    }
-    if (!this.runtime) {
-      return {
-        type: "unsandboxed",
-        requiresPermission: true,
-        reason: "Sandbox runtime not available on this platform"
-      };
-    }
-    const wrappedCommand = this.runtime.wrapCommand({
-      command,
-      cwd,
-      filesystemConfig: this.config.filesystem,
-      ...this.runtime.platform === "linux" && this.config.platform.linux.seccompProfile && {
-        seccompProfile: this.config.platform.linux.seccompProfile
-      }
-    });
-    return { type: "sandbox", wrappedCommand };
-  }
-  /** Get the current sandbox mode */
-  getMode() {
-    return this.config.mode;
-  }
-  /** Set the sandbox mode (does not persist — caller must save config) */
-  setMode(mode) {
-    this.config.mode = mode;
-    this.config.enabled = mode !== "disabled";
-  }
-  /** Check if sandbox is enabled and runtime is available */
-  isAvailable() {
-    return this.runtime !== null && this.runtime.isAvailable();
-  }
-  /** Check if sandbox is currently active (enabled + available) */
-  isActive() {
-    return this.config.enabled && this.config.mode !== "disabled" && this.isAvailable();
-  }
-  /** Get the current sandbox configuration */
-  getConfig() {
-    return this.config;
-  }
-  /** Update config (does not persist — caller must save) */
-  updateConfig(config) {
-    this.config = config;
-  }
-  /** Get full status information for display */
-  getStatus() {
-    return {
-      mode: this.config.mode,
-      enabled: this.config.enabled,
-      platform: this.runtime?.platform ?? null,
-      runtimeAvailable: this.runtime?.isAvailable() ?? false,
-      runtimeName: this.runtime?.name ?? null,
-      config: this.config
-    };
-  }
-  /**
-   * Extract the base command name from a full command string.
-   * e.g., "docker compose up -d" → "docker"
-   */
-  getBaseCommand(command) {
-    const trimmed = command.trim();
-    const withoutEnv = trimmed.replace(/^(\w+=\S+\s+)*/, "");
-    const parts = withoutEnv.split(/\s+/);
-    const first = parts[0] || "";
-    return first.split("/").pop() || first;
-  }
-  /** Check if a command is in the excluded list */
-  isExcludedCommand(baseCommand) {
-    return this.config.excludedCommands.some((excluded) => baseCommand === excluded);
-  }
-};
-export {
-  SandboxOrchestrator
-};

package/dist/SandboxRuntimeAdapter-5ZMU25Q3.js

@@ -1,13 +0,0 @@
-#!/usr/bin/env node
-import {
-  createSandboxRuntime,
-  detectPlatform,
-  expandPath,
-  isBinaryAvailable
-} from "./chunk-AVAD2PPK.js";
-export {
-  createSandboxRuntime,
-  detectPlatform,
-  expandPath,
-  isBinaryAvailable
-};

package/dist/SeatbeltRuntime-SL7HVS3J.js

@@ -1,96 +0,0 @@
-#!/usr/bin/env node
-import {
-  expandPath,
-  isBinaryAvailable
-} from "./chunk-AVAD2PPK.js";
-
-// src/sandbox/runtime/SeatbeltRuntime.ts
-import { writeFileSync, mkdtempSync } from "fs";
-import path from "path";
-import os from "os";
-function escapeSeatbeltPath(p) {
-  return p.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
-}
-var SeatbeltRuntime = class {
-  constructor() {
-    this.platform = "darwin";
-    this.name = "seatbelt";
-  }
-  isAvailable() {
-    return isBinaryAvailable("sandbox-exec");
-  }
-  /**
-   * Generate a Seatbelt profile string from the filesystem config.
-   *
-   * Strategy:
-   * - Start with (allow default) to permit most operations
-   * - Deny all file writes globally
-   * - Allow file writes only to the working directory
-   * - Deny all access to explicitly denied paths
-   * - Allow read access to explicitly allowed paths
-   */
-  generateProfile(options) {
-    const { cwd, filesystemConfig } = options;
-    const expandedDenied = filesystemConfig.deniedPaths.map(expandPath);
-    const expandedAllowed = filesystemConfig.allowedReadPaths.map(expandPath);
-    const lines = [
-      "(version 1)",
-      "",
-      "; Start with permissive defaults (process exec, network, sysctl, etc.)",
-      "(allow default)",
-      ""
-    ];
-    if (filesystemConfig.writeOnlyToWorkingDir) {
-      lines.push("; Deny all file writes globally");
-      lines.push("(deny file-write*)");
-      lines.push("");
-      lines.push("; Allow writes to working directory");
-      lines.push(`(allow file-write* (subpath "${escapeSeatbeltPath(cwd)}"))`);
-      lines.push("");
-      lines.push("; Allow writes to temp directories");
-      lines.push(`(allow file-write* (subpath "/tmp"))`);
-      lines.push(`(allow file-write* (subpath "/private/tmp"))`);
-      lines.push(`(allow file-write* (subpath "${escapeSeatbeltPath(os.tmpdir())}"))`);
-      lines.push("");
-    }
-    if (expandedDenied.length > 0) {
-      lines.push("; Deny access to sensitive paths");
-      for (const deniedPath of expandedDenied) {
-        lines.push(`(deny file-read* file-write* (subpath "${escapeSeatbeltPath(deniedPath)}"))`);
-      }
-      lines.push("");
-    }
-    if (expandedAllowed.length > 0) {
-      lines.push("; Explicitly allowed read paths");
-      for (const allowedPath of expandedAllowed) {
-        lines.push(`(allow file-read* (subpath "${escapeSeatbeltPath(allowedPath)}"))`);
-      }
-      lines.push("");
-    }
-    return lines.join("\n");
-  }
-  wrapCommand(options) {
-    try {
-      const profile = this.generateProfile(options);
-      const tmpDir = mkdtempSync(path.join(os.tmpdir(), "b4m-sandbox-"));
-      const profilePath = path.join(tmpDir, "sandbox.sb");
-      writeFileSync(profilePath, profile, "utf-8");
-      const args = ["-f", profilePath, "bash", "-c", options.command];
-      return {
-        executable: "sandbox-exec",
-        args,
-        env: options.env ?? {},
-        commandString: `sandbox-exec -f ${profilePath} bash -c ${shellEscape(options.command)}`,
-        cleanupPaths: [profilePath, tmpDir]
-      };
-    } catch (err) {
-      throw new Error(`Failed to create sandbox profile: ${err instanceof Error ? err.message : String(err)}`);
-    }
-  }
-};
-function shellEscape(str) {
-  return `'${str.replace(/'/g, "'\\''")}'`;
-}
-export {
-  SeatbeltRuntime
-};

package/dist/chunk-AVAD2PPK.js

@@ -1,44 +0,0 @@
-#!/usr/bin/env node
-
-// src/sandbox/runtime/SandboxRuntimeAdapter.ts
-import os from "os";
-import { execSync } from "child_process";
-function detectPlatform() {
-  const platform = os.platform();
-  if (platform === "darwin") return "darwin";
-  if (platform === "linux") return "linux";
-  return null;
-}
-function isBinaryAvailable(binary) {
-  try {
-    execSync(`which ${binary}`, { stdio: "ignore" });
-    return true;
-  } catch {
-    return false;
-  }
-}
-function expandPath(pathStr) {
-  return pathStr.replace(/\$HOME/g, os.homedir()).replace(/\$USER/g, os.userInfo().username).replace(/~\//g, `${os.homedir()}/`);
-}
-async function createSandboxRuntime() {
-  const platform = detectPlatform();
-  if (!platform) return null;
-  if (platform === "darwin") {
-    const { SeatbeltRuntime } = await import("./SeatbeltRuntime-SL7HVS3J.js");
-    const runtime = new SeatbeltRuntime();
-    return runtime.isAvailable() ? runtime : null;
-  }
-  if (platform === "linux") {
-    const { BubblewrapRuntime } = await import("./BubblewrapRuntime-HXTR3NQG.js");
-    const runtime = new BubblewrapRuntime();
-    return runtime.isAvailable() ? runtime : null;
-  }
-  return null;
-}
-
-export {
-  detectPlatform,
-  isBinaryAvailable,
-  expandPath,
-  createSandboxRuntime
-};

package/dist/chunk-W4TCH4ZT.js

@@ -1,27 +0,0 @@
-#!/usr/bin/env node
-
-// src/sandbox/types.ts
-var DEFAULT_SANDBOX_CONFIG = {
-  enabled: false,
-  mode: "disabled",
-  filesystem: {
-    writeOnlyToWorkingDir: true,
-    allowedReadPaths: ["$HOME/.gitconfig", "$HOME/.npmrc", "$HOME/.node_modules"],
-    deniedPaths: ["$HOME/.ssh", "$HOME/.aws", "$HOME/.gnupg", "$HOME/.env", "/etc/shadow", "/etc/passwd"]
-  },
-  excludedCommands: ["docker", "watchman", "podman"],
-  allowUnsandboxedCommands: true,
-  platform: {
-    linux: {
-      runtime: "bubblewrap"
-    },
-    macos: {
-      runtime: "seatbelt",
-      profileTemplate: "default"
-    }
-  }
-};
-
-export {
-  DEFAULT_SANDBOX_CONFIG
-};

package/dist/types-SMQKWHQK.js

@@ -1,7 +0,0 @@
-#!/usr/bin/env node
-import {
-  DEFAULT_SANDBOX_CONFIG
-} from "./chunk-W4TCH4ZT.js";
-export {
-  DEFAULT_SANDBOX_CONFIG
-};