@bike4mind/cli 0.2.29-feat-cli-websocket-streaming.18881 → 0.2.29-feat-cli-sandbox.18927

package/dist/index.js

@@ -1,21 +1,22 @@
 #!/usr/bin/env node
+import "./chunk-5JTIPGUF.js";
 import "./chunk-BPFEGDC7.js";
 import "./chunk-BDQBOLYG.js";
 import {
   getEffectiveApiKey,
   getOpenWeatherKey,
   getSerperKey
-} from "./chunk-QQL3OBKL.js";
+} from "./chunk-2OADXKGK.js";
 import {
   ConfigStore,
   logger
-} from "./chunk-LBTTUQJM.js";
+} from "./chunk-M2AJGZSX.js";
 import {
   selectActiveBackgroundAgents,
   useCliStore
 } from "./chunk-TVW4ZESU.js";
-import "./chunk-BXCARBUQ.js";
-import "./chunk-EC2VEDD2.js";
+import "./chunk-4BIBE3J7.js";
+import "./chunk-CLA2MUX4.js";
 import {
   BFLImageService,
   BaseStorage,
@@ -27,7 +28,7 @@ import {
   OpenAIBackend,
   OpenAIImageService,
   XAIImageService
-} from "./chunk-TY6Z2UV2.js";
+} from "./chunk-Q7CVAY4M.js";
 import {
   AiEvents,
   ApiKeyEvents,
@@ -83,32 +84,37 @@ import {
   XAI_IMAGE_MODELS,
   b4mLLMTools,
   getMcpProviderMetadata
-} from "./chunk-KPOK6V6E.js";
+} from "./chunk-FKJTU7KU.js";
 import {
   Logger
 } from "./chunk-OCYRD7D6.js";
 
 // src/index.tsx
-import React21, { useState as useState9, useEffect as useEffect6, useCallback as useCallback2, useRef as useRef3 } from "react";
+import React21, { useState as useState10, useEffect as useEffect7, useCallback as useCallback2, useRef as useRef3 } from "react";
 import { render, Box as Box20, Text as Text20, useApp, useInput as useInput9 } from "ink";
 import { execSync } from "child_process";
 import { randomBytes as randomBytes5 } from "crypto";
-import { v4 as uuidv413 } from "uuid";
+import { v4 as uuidv411 } from "uuid";
 
 // src/components/App.tsx
-import React15, { useState as useState5, useEffect as useEffect4 } from "react";
+import React15, { useState as useState6, useEffect as useEffect5 } from "react";
 import { Box as Box14, Text as Text14, Static, useInput as useInput6 } from "ink";
 
 // src/components/StatusBar.tsx
 import React from "react";
 import { Box, Text } from "ink";
-var StatusBar = React.memo(function StatusBar2({ sessionName, model, tokenUsage }) {
+var StatusBar = React.memo(function StatusBar2({
+  sessionName,
+  model,
+  tokenUsage,
+  creditsUsage
+}) {
   const autoAcceptEdits = useCliStore((state) => state.autoAcceptEdits);
-  return /* @__PURE__ */ React.createElement(Box, { flexDirection: "row", justifyContent: "space-between", width: "100%", paddingX: 1 }, /* @__PURE__ */ React.createElement(Text, { dimColor: true }, sessionName), /* @__PURE__ */ React.createElement(Box, { gap: 2 }, autoAcceptEdits && /* @__PURE__ */ React.createElement(Text, { color: "green", bold: true }, "AUTO ACCEPT: Edits"), /* @__PURE__ */ React.createElement(Text, { dimColor: true }, tokenUsage.toLocaleString(), " tokens"), /* @__PURE__ */ React.createElement(Text, { dimColor: true }, model)));
+  return /* @__PURE__ */ React.createElement(Box, { flexDirection: "row", justifyContent: "space-between", width: "100%", paddingX: 1 }, /* @__PURE__ */ React.createElement(Text, { dimColor: true }, sessionName), /* @__PURE__ */ React.createElement(Box, { gap: 2 }, autoAcceptEdits && /* @__PURE__ */ React.createElement(Text, { color: "green", bold: true }, "AUTO ACCEPT: Edits"), tokenUsage > 0 && /* @__PURE__ */ React.createElement(Text, { dimColor: true }, tokenUsage.toLocaleString(), " tokens"), creditsUsage !== void 0 && creditsUsage > 0 && /* @__PURE__ */ React.createElement(Text, { dimColor: true }, creditsUsage.toLocaleString(), " ", creditsUsage === 1 ? "credit" : "credits"), /* @__PURE__ */ React.createElement(Text, { dimColor: true }, model)));
 });
 
 // src/components/InputPrompt.tsx
-import React5, { useState as useState2, useMemo, useEffect as useEffect2, useRef as useRef2 } from "react";
+import React5, { useState as useState3, useMemo, useEffect as useEffect3, useRef as useRef2 } from "react";
 import { Box as Box4, Text as Text5, useInput as useInput2 } from "ink";
 
 // src/components/CustomTextInput.tsx
@@ -321,65 +327,53 @@ function CommandAutocomplete({ commands, selectedIndex }) {
 // src/components/FileAutocomplete.tsx
 import React4 from "react";
 import { Box as Box3, Text as Text4 } from "ink";
+import * as path2 from "path";
 
 // src/utils/fileSearch.ts
 import * as fs from "fs";
 import * as path from "path";
-import Fuse from "fuse.js";
-var DEFAULT_IGNORE_PATTERNS = [
-  "node_modules",
-  ".git",
-  ".next",
-  ".turbo",
-  "dist",
-  "build",
-  ".cache",
-  "coverage",
-  ".DS_Store",
-  ".env",
-  ".env.local",
-  ".env.secrets"
-];
-function walkDirectory(basePath = process.cwd(), maxDepth = 5, ignorePatterns = DEFAULT_IGNORE_PATTERNS) {
-  const results = [];
-  const normalizedBase = path.resolve(basePath);
-  function walk(currentPath, depth) {
-    if (depth > maxDepth) return;
+import { AsyncFzf } from "fzf";
+import { fdir } from "fdir";
+import ignore from "ignore";
+function loadIgnoreRules(projectRoot) {
+  const ig = ignore();
+  ig.add(".git/");
+  const gitignorePath = path.join(projectRoot, ".gitignore");
+  if (fs.existsSync(gitignorePath)) {
     try {
-      const entries = fs.readdirSync(currentPath, { withFileTypes: true });
-      for (const entry of entries) {
-        if (ignorePatterns.some((pattern) => entry.name === pattern || entry.name.startsWith(pattern))) {
-          continue;
-        }
-        const fullPath = path.join(currentPath, entry.name);
-        const relativePath = path.relative(normalizedBase, fullPath);
-        if (entry.isDirectory()) {
-          results.push({
-            path: relativePath,
-            isDirectory: true
-          });
-          walk(fullPath, depth + 1);
-        } else if (entry.isFile()) {
-          try {
-            const stats = fs.statSync(fullPath);
-            results.push({
-              path: relativePath,
-              isDirectory: false,
-              size: stats.size
-            });
-          } catch {
-            results.push({
-              path: relativePath,
-              isDirectory: false
-            });
-          }
-        }
-      }
+      const gitignoreContent = fs.readFileSync(gitignorePath, "utf-8");
+      ig.add(gitignoreContent);
     } catch {
     }
   }
-  walk(normalizedBase, 0);
-  return results;
+  return ig;
+}
+function crawlDirectory(projectRoot, maxDepth = 10, maxFiles = 2e4, ig) {
+  let fileCount = 0;
+  const crawler = new fdir().withRelativePaths().withDirs().withPathSeparator("/").exclude((dirPath) => {
+    const relativePath = path.posix.relative(projectRoot, dirPath);
+    if (!relativePath || relativePath === ".") {
+      return false;
+    }
+    const pathWithSlash = `${relativePath}/`;
+    return ig.ignores(pathWithSlash);
+  }).filter(() => {
+    if (fileCount >= maxFiles) {
+      return false;
+    }
+    fileCount++;
+    return true;
+  });
+  if (maxDepth !== void 0) {
+    crawler.withMaxDepth(maxDepth);
+  }
+  const paths = crawler.crawl(projectRoot).sync();
+  return paths.filter((p) => {
+    if (!p || p === ".") {
+      return true;
+    }
+    return !ig.ignores(p);
+  });
 }
 function formatFileSize(bytes) {
   if (bytes < 1024) return `${bytes} B`;
@@ -390,42 +384,112 @@ function formatFileSize(bytes) {
 var cachedFiles = null;
 var cacheTimestamp = 0;
 var CACHE_TTL_MS = 3e4;
-function getCachedFiles() {
+function getCachedFiles(projectRoot = process.cwd()) {
   const now = Date.now();
   if (!cachedFiles || now - cacheTimestamp > CACHE_TTL_MS) {
-    cachedFiles = walkDirectory();
+    const normalizedBase = path.resolve(projectRoot);
+    const ig = loadIgnoreRules(normalizedBase);
+    cachedFiles = crawlDirectory(normalizedBase, 10, 2e4, ig);
     cacheTimestamp = now;
   }
   return cachedFiles;
 }
-function searchFiles(query) {
-  const files = getCachedFiles();
+function warmFileCache() {
+  if (!cachedFiles || Date.now() - cacheTimestamp > CACHE_TTL_MS) {
+    setImmediate(() => {
+      getCachedFiles();
+    });
+  }
+}
+function listAbsoluteDirectory(absolutePath, filterQuery) {
+  try {
+    const normalizedPath = path.normalize(absolutePath);
+    if (!fs.existsSync(normalizedPath)) {
+      return [];
+    }
+    const stats = fs.statSync(normalizedPath);
+    if (!stats.isDirectory()) {
+      return [];
+    }
+    const entries = fs.readdirSync(normalizedPath, { withFileTypes: true });
+    let filteredEntries = entries;
+    if (filterQuery && filterQuery.length > 0) {
+      const lowerQuery = filterQuery.toLowerCase();
+      filteredEntries = entries.filter((entry) => entry.name.toLowerCase().includes(lowerQuery));
+    }
+    return filteredEntries.slice(0, 15).map((entry) => {
+      const fullPath = path.join(normalizedPath, entry.name);
+      const result = {
+        path: fullPath,
+        isDirectory: entry.isDirectory()
+      };
+      if (entry.isFile()) {
+        try {
+          const fileStats = fs.statSync(fullPath);
+          result.size = fileStats.size;
+        } catch {
+        }
+      }
+      return result;
+    });
+  } catch {
+    return [];
+  }
+}
+async function searchFiles(query, maxResults = 20) {
+  const projectRoot = process.cwd();
+  if (path.isAbsolute(query)) {
+    try {
+      const stats = fs.statSync(query);
+      if (stats.isDirectory()) {
+        return listAbsoluteDirectory(query);
+      }
+    } catch {
+    }
+    let dirToList;
+    let filterQuery;
+    if (query.endsWith("/") || query.endsWith(path.sep)) {
+      dirToList = query;
+      filterQuery = void 0;
+    } else {
+      dirToList = path.dirname(query);
+      filterQuery = path.basename(query);
+    }
+    return listAbsoluteDirectory(dirToList, filterQuery);
+  }
+  const files = getCachedFiles(projectRoot);
   if (!query || query.trim() === "") {
-    return files.filter((f) => !f.path.includes(path.sep)).slice(0, 20);
-  }
-  const queryDir = path.dirname(query);
-  let searchPool = files;
-  if (queryDir && queryDir !== ".") {
-    const normalizedDir = queryDir.replace(/\\/g, "/");
-    searchPool = files.filter((f) => {
-      const normalizedPath = f.path.replace(/\\/g, "/");
-      return normalizedPath.startsWith(normalizedDir + "/") || normalizedPath === normalizedDir;
+    const rootFiles = files.filter((f) => !f.includes("/")).slice(0, maxResults);
+    return rootFiles.map((p) => {
+      const fullPath = path.join(projectRoot, p);
+      try {
+        const stats = fs.statSync(fullPath);
+        return {
+          path: p,
+          isDirectory: stats.isDirectory(),
+          size: stats.isFile() ? stats.size : void 0
+        };
+      } catch {
+        return { path: p, isDirectory: false };
+      }
     });
-    if (searchPool.length === 0) {
-      searchPool = files;
-    }
-  }
-  const fuse = new Fuse(searchPool, {
-    keys: [{ name: "path", weight: 1 }],
-    threshold: 0.4,
-    // Allow some fuzzy matching
-    includeScore: true,
-    minMatchCharLength: 1,
-    // Use extended search for better path matching
-    useExtendedSearch: false
+  }
+  const fzf = new AsyncFzf(files);
+  const results = await fzf.find(query);
+  return results.slice(0, maxResults).map((result) => {
+    const p = result.item;
+    const fullPath = path.join(projectRoot, p);
+    try {
+      const stats = fs.statSync(fullPath);
+      return {
+        path: p,
+        isDirectory: stats.isDirectory(),
+        size: stats.isFile() ? stats.size : void 0
+      };
+    } catch {
+      return { path: p, isDirectory: false };
+    }
   });
-  const results = fuse.search(query);
-  return results.slice(0, 20).map((result) => result.item);
 }
 function isPathWithinCwd(filePath) {
   const cwd = path.resolve(process.cwd());
@@ -509,10 +573,27 @@ var MAX_FILE_SIZE = 10 * 1024 * 1024;
 // src/components/FileAutocomplete.tsx
 function FileAutocomplete({ files, selectedIndex, query }) {
   if (files.length === 0) {
-    return /* @__PURE__ */ React4.createElement(Box3, { marginLeft: 2, marginTop: 1 }, /* @__PURE__ */ React4.createElement(Text4, { dimColor: true }, "No matching files", query ? ` for "${query}"` : ""));
-  }
-  return /* @__PURE__ */ React4.createElement(Box3, { flexDirection: "column", marginLeft: 2, marginTop: 1 }, /* @__PURE__ */ React4.createElement(Box3, { marginBottom: 1 }, /* @__PURE__ */ React4.createElement(Text4, { dimColor: true }, files.length === 1 ? "1 match" : `${files.length} matches`, " - Use up/down to navigate, Tab to select")), files.map((file, index) => {
-    const isSelected = index === selectedIndex;
+    if (path2.isAbsolute(query)) {
+      return /* @__PURE__ */ React4.createElement(Box3, { marginLeft: 2, marginTop: 1 }, /* @__PURE__ */ React4.createElement(Text4, { dimColor: true }, "No items in "), /* @__PURE__ */ React4.createElement(Text4, { color: "cyan" }, query), /* @__PURE__ */ React4.createElement(Text4, { dimColor: true }, " (or path does not exist)"));
+    }
+    return /* @__PURE__ */ React4.createElement(Box3, { marginLeft: 2, marginTop: 1 }, /* @__PURE__ */ React4.createElement(Text4, { dimColor: true }, "No matching files", query ? ` for "${query}"` : " in root directory"));
+  }
+  const VIEWPORT_SIZE = 6;
+  const totalFiles = files.length;
+  let startIndex = 0;
+  let endIndex = Math.min(VIEWPORT_SIZE, totalFiles);
+  if (totalFiles > VIEWPORT_SIZE) {
+    const halfViewport = Math.floor(VIEWPORT_SIZE / 2);
+    startIndex = Math.max(0, selectedIndex - halfViewport);
+    endIndex = Math.min(totalFiles, startIndex + VIEWPORT_SIZE);
+    if (endIndex === totalFiles) {
+      startIndex = Math.max(0, totalFiles - VIEWPORT_SIZE);
+    }
+  }
+  const visibleFiles = files.slice(startIndex, endIndex);
+  return /* @__PURE__ */ React4.createElement(Box3, { flexDirection: "column", marginLeft: 2, marginTop: 1 }, /* @__PURE__ */ React4.createElement(Box3, { marginBottom: 1 }, /* @__PURE__ */ React4.createElement(Text4, { dimColor: true }, totalFiles === 1 ? "1 match" : `${totalFiles} matches`, totalFiles > VIEWPORT_SIZE && ` (${selectedIndex + 1}/${totalFiles})`, " - Use up/down to navigate, Tab to select")), visibleFiles.map((file, viewportIndex) => {
+    const actualIndex = startIndex + viewportIndex;
+    const isSelected = actualIndex === selectedIndex;
     const icon = file.isDirectory ? "[folder]" : "[file]  ";
     const sizeDisplay = file.isDirectory ? "" : file.size !== void 0 ? ` (${formatFileSize(file.size)})` : "";
     const pathDisplay = file.isDirectory ? `${file.path}/` : file.path;
@@ -521,7 +602,7 @@ function FileAutocomplete({ files, selectedIndex, query }) {
 }
 
 // src/utils/fuzzySearch.ts
-import Fuse2 from "fuse.js";
+import Fuse from "fuse.js";
 
 // src/config/commands.ts
 var COMMANDS = [
@@ -645,6 +726,42 @@ var COMMANDS = [
     name: "compact",
     description: "Compact conversation into new session",
     args: "[instructions]"
+  },
+  // Sandbox commands
+  {
+    name: "sandbox",
+    description: "Show sandbox status and configuration"
+  },
+  {
+    name: "sandbox:enable",
+    description: "Enable OS-level sandbox for bash commands"
+  },
+  {
+    name: "sandbox:disable",
+    description: "Disable sandbox mode"
+  },
+  {
+    name: "sandbox:mode",
+    description: "Set sandbox mode (auto-allow or permissions)",
+    args: "<auto-allow|permissions>"
+  },
+  {
+    name: "sandbox:trust-domain",
+    description: "Add domain(s) to the network proxy allowlist",
+    args: "<domain> [...]"
+  },
+  {
+    name: "sandbox:domains",
+    description: "Show network proxy allowed domains"
+  },
+  {
+    name: "sandbox:violations",
+    description: "Show recent sandbox violations",
+    args: "[count]"
+  },
+  {
+    name: "sandbox:violations:clear",
+    description: "Clear all recorded sandbox violations"
   }
 ];
 function getAllCommandNames() {
@@ -698,13 +815,13 @@ function searchCommands(query, commands = COMMANDS) {
   if (!query || query.trim() === "") {
     return commands;
   }
-  const fuse = new Fuse2(commands, fuseOptions);
+  const fuse = new Fuse(commands, fuseOptions);
   const results = fuse.search(query);
   return results.map((result) => result.item);
 }
 
 // src/utils/imageDetector.ts
-import { readFileSync, existsSync, statSync as statSync2 } from "fs";
+import { readFileSync as readFileSync2, existsSync as existsSync2, statSync as statSync2 } from "fs";
 import { extname as extname2 } from "path";
 var ImageInputDetector = class {
   static {
@@ -845,14 +962,14 @@ var ImageInputDetector = class {
     let filepath = input.trim();
     filepath = filepath.replace(/^["']|["']$/g, "");
     filepath = filepath.replace(/\\(.)/g, "$1");
-    if (!existsSync(filepath)) return null;
+    if (!existsSync2(filepath)) return null;
     const stats = statSync2(filepath);
     if (!stats.isFile()) return null;
     const ext = extname2(filepath).toLowerCase();
     if (!this.SUPPORTED_EXTENSIONS.includes(ext)) return null;
     if (stats.size > this.MAX_IMAGE_SIZE) return null;
     try {
-      const data = readFileSync(filepath);
+      const data = readFileSync2(filepath);
       const format = ext.substring(1) === "jpeg" ? "jpg" : ext.substring(1);
       const filename = filepath.split("/").pop() || "image";
       return {
@@ -907,6 +1024,21 @@ var ImageInputDetector = class {
   }
 };
 
+// src/hooks/useDebounce.ts
+import { useEffect as useEffect2, useState as useState2 } from "react";
+function useDebounce(value, delay = 300) {
+  const [debouncedValue, setDebouncedValue] = useState2(value);
+  useEffect2(() => {
+    const timer = setTimeout(() => {
+      setDebouncedValue(value);
+    }, delay);
+    return () => {
+      clearTimeout(timer);
+    };
+  }, [value, delay]);
+  return debouncedValue;
+}
+
 // src/components/InputPrompt.tsx
 function looksLikeFilePath(input) {
   const trimmed = input.trim();
@@ -947,20 +1079,20 @@ function InputPrompt({
   const value = useCliStore((state) => state.inputValue);
   const setInputValue = useCliStore((state) => state.setInputValue);
   const setValue = setInputValue;
-  const [selectedIndex, setSelectedIndex] = useState2(0);
-  const [historyIndex, setHistoryIndex] = useState2(-1);
-  const [tempInput, setTempInput] = useState2("");
+  const [selectedIndex, setSelectedIndex] = useState3(0);
+  const [historyIndex, setHistoryIndex] = useState3(-1);
+  const [tempInput, setTempInput] = useState3("");
   const inputKey = useRef2(0);
-  useEffect2(() => {
+  useEffect3(() => {
     if (prefillInput) {
       setValue(prefillInput);
       onPrefillConsumed?.();
     }
   }, [prefillInput, onPrefillConsumed]);
-  const [fileAutocomplete, setFileAutocomplete] = useState2(null);
-  const [fileSelectedIndex, setFileSelectedIndex] = useState2(0);
+  const [fileAutocomplete, setFileAutocomplete] = useState3(null);
+  const [fileSelectedIndex, setFileSelectedIndex] = useState3(0);
   const isBashMode = value.startsWith("!");
-  useEffect2(() => {
+  useEffect3(() => {
     onBashModeChange?.(isBashMode);
   }, [isBashMode, onBashModeChange]);
   const shouldShowCommandAutocomplete = value.startsWith("/") && !disabled && !fileAutocomplete?.active && !looksLikeFilePath(value);
@@ -969,14 +1101,32 @@ function InputPrompt({
     if (!shouldShowCommandAutocomplete) return [];
     return searchCommands(commandQuery, commands);
   }, [shouldShowCommandAutocomplete, commandQuery, commands]);
-  const filteredFiles = useMemo(() => {
-    if (!fileAutocomplete?.active) return [];
-    return searchFiles(fileAutocomplete.query);
-  }, [fileAutocomplete?.active, fileAutocomplete?.query]);
-  useEffect2(() => {
+  const debouncedFileQuery = useDebounce(fileAutocomplete?.query ?? "", 200);
+  const [filteredFiles, setFilteredFiles] = useState3([]);
+  useEffect3(() => {
+    if (!fileAutocomplete?.active) {
+      setFilteredFiles([]);
+      return;
+    }
+    let cancelled = false;
+    searchFiles(debouncedFileQuery).then((results) => {
+      if (!cancelled) {
+        setFilteredFiles(results);
+      }
+    }).catch((error) => {
+      if (!cancelled) {
+        console.error("File search error:", error);
+        setFilteredFiles([]);
+      }
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, [fileAutocomplete?.active, debouncedFileQuery]);
+  useEffect3(() => {
     setSelectedIndex(0);
   }, [filteredCommands]);
-  useEffect2(() => {
+  useEffect3(() => {
     setFileSelectedIndex(0);
   }, [filteredFiles]);
   useInput2(
@@ -1214,13 +1364,13 @@ function BackgroundAgentStatus() {
 }
 
 // src/components/CompletedGroupNotification.tsx
-import React9, { useEffect as useEffect3 } from "react";
+import React9, { useEffect as useEffect4 } from "react";
 import { Box as Box8, Text as Text8 } from "ink";
 var NOTIFICATION_DISPLAY_DURATION_MS = 3e3;
 function CompletedGroupNotification() {
   const notifications = useCliStore((state) => state.completedGroupNotifications);
   const clearNotifications = useCliStore((state) => state.clearCompletedGroupNotifications);
-  useEffect3(() => {
+  useEffect4(() => {
     if (notifications.length > 0) {
       const timer = setTimeout(() => {
         clearNotifications();
@@ -1233,14 +1383,20 @@ function CompletedGroupNotification() {
 }
 
 // src/components/PermissionPrompt.tsx
-import React10, { useState as useState3, useCallback } from "react";
+import React10, { useState as useState4, useCallback } from "react";
 import { Box as Box9, Text as Text9, useInput as useInput3 } from "ink";
 function renderDiffPreview(preview) {
   const lines = preview.split("\n");
   return lines.map((line, index) => {
+    if (line.startsWith("\u{1F6D1}")) {
+      return /* @__PURE__ */ React10.createElement(Text9, { key: index, bold: true, color: "red" }, line);
+    }
     if (line.startsWith("+")) {
       return /* @__PURE__ */ React10.createElement(Text9, { key: index, color: "green" }, line);
     }
+    if (line.startsWith("- ")) {
+      return /* @__PURE__ */ React10.createElement(Text9, { key: index, color: "yellow" }, line);
+    }
     if (line.startsWith("-")) {
       return /* @__PURE__ */ React10.createElement(Text9, { key: index, color: "red" }, line);
     }
@@ -1260,14 +1416,16 @@ function PermissionPrompt({
 }) {
   const items = canBeTrusted ? [
     { label: "\u2713 Allow once", value: "allow-once" },
+    { label: "\u2713 Allow for this session", value: "allow-session" },
     { label: "\u2713 Always allow (trust this tool)", value: "allow-always" },
     { label: "\u2717 Deny", value: "deny" }
   ] : [
     { label: "\u2713 Allow once", value: "allow-once" },
+    { label: "\u2713 Allow for this session", value: "allow-session" },
     { label: "\u2717 Deny", value: "deny" }
   ];
-  const [selectedIndex, setSelectedIndex] = useState3(0);
-  const [responded, setResponded] = useState3(false);
+  const [selectedIndex, setSelectedIndex] = useState4(0);
+  const [responded, setResponded] = useState4(false);
   const handleSelect = useCallback(() => {
     if (responded) return;
     setResponded(true);
@@ -1311,11 +1469,15 @@ function PermissionPrompt({
   const rawArgsString = typeof args === "string" ? args : JSON.stringify(args, null, 2);
   const argsString = rawArgsString.length > MAX_ARGS_LENGTH ? rawArgsString.slice(0, MAX_ARGS_LENGTH) + `
 ... (${rawArgsString.length - MAX_ARGS_LENGTH} more chars)` : rawArgsString;
-  return /* @__PURE__ */ React10.createElement(Box9, { flexDirection: "column", borderStyle: "bold", borderColor: "yellow", padding: 1, marginY: 1 }, /* @__PURE__ */ React10.createElement(Box9, null, /* @__PURE__ */ React10.createElement(Text9, { bold: true, color: "yellow" }, "\u26A0\uFE0F Permission Required")), /* @__PURE__ */ React10.createElement(Box9, { marginTop: 1 }, /* @__PURE__ */ React10.createElement(Text9, { dimColor: true }, "Tool: "), /* @__PURE__ */ React10.createElement(Text9, { bold: true, color: "cyan" }, toolName)), toolDescription && /* @__PURE__ */ React10.createElement(Box9, null, /* @__PURE__ */ React10.createElement(Text9, { dimColor: true }, "Action: "), /* @__PURE__ */ React10.createElement(Text9, null, toolDescription)), /* @__PURE__ */ React10.createElement(Box9, { marginTop: 1, flexDirection: "column" }, /* @__PURE__ */ React10.createElement(Text9, { bold: true }, "Arguments:"), /* @__PURE__ */ React10.createElement(Box9, { paddingLeft: 2, flexDirection: "column" }, /* @__PURE__ */ React10.createElement(Text9, { dimColor: true }, argsString))), preview && /* @__PURE__ */ React10.createElement(Box9, { marginTop: 1, flexDirection: "column" }, /* @__PURE__ */ React10.createElement(Text9, { bold: true }, "Preview:"), /* @__PURE__ */ React10.createElement(Box9, { borderStyle: "single", borderColor: "gray", paddingX: 1, flexDirection: "column" }, renderDiffPreview(preview))), !canBeTrusted && /* @__PURE__ */ React10.createElement(Box9, { marginTop: 1 }, /* @__PURE__ */ React10.createElement(Text9, { color: "red", dimColor: true }, "Note: This tool cannot be trusted due to its dangerous nature.")), /* @__PURE__ */ React10.createElement(Box9, { marginTop: 1, flexDirection: "column" }, items.map((item, index) => /* @__PURE__ */ React10.createElement(Box9, { key: item.value }, /* @__PURE__ */ React10.createElement(Text9, { color: "cyan" }, index + 1, "."), /* @__PURE__ */ React10.createElement(Text9, { color: index === selectedIndex ? "cyan" : void 0, bold: index === selectedIndex }, index === selectedIndex ? " \u276F " : "   ", item.label)))), /* @__PURE__ */ React10.createElement(Box9, { marginTop: 1 }, /* @__PURE__ */ React10.createElement(Text9, { dimColor: true }, "Press 1-", items.length, ", y/n, or \u2191\u2193 + Enter")));
+  const isSandboxBlock = preview?.startsWith("\u{1F6D1}");
+  const borderColor = isSandboxBlock ? "red" : "yellow";
+  const headerColor = isSandboxBlock ? "red" : "yellow";
+  const headerText = isSandboxBlock ? "\u{1F6D1} Sandbox Blocked" : "\u26A0\uFE0F Permission Required";
+  return /* @__PURE__ */ React10.createElement(Box9, { flexDirection: "column", borderStyle: "bold", borderColor, padding: 1, marginY: 1 }, /* @__PURE__ */ React10.createElement(Box9, null, /* @__PURE__ */ React10.createElement(Text9, { bold: true, color: headerColor }, headerText)), /* @__PURE__ */ React10.createElement(Box9, { marginTop: 1 }, /* @__PURE__ */ React10.createElement(Text9, { dimColor: true }, "Tool: "), /* @__PURE__ */ React10.createElement(Text9, { bold: true, color: "cyan" }, toolName)), toolDescription && /* @__PURE__ */ React10.createElement(Box9, null, /* @__PURE__ */ React10.createElement(Text9, { dimColor: true }, "Action: "), /* @__PURE__ */ React10.createElement(Text9, null, toolDescription)), /* @__PURE__ */ React10.createElement(Box9, { marginTop: 1, flexDirection: "column" }, /* @__PURE__ */ React10.createElement(Text9, { bold: true }, "Arguments:"), /* @__PURE__ */ React10.createElement(Box9, { paddingLeft: 2, flexDirection: "column" }, /* @__PURE__ */ React10.createElement(Text9, { dimColor: true }, argsString))), preview && /* @__PURE__ */ React10.createElement(Box9, { marginTop: 1, flexDirection: "column" }, /* @__PURE__ */ React10.createElement(Text9, { bold: true }, "Preview:"), /* @__PURE__ */ React10.createElement(Box9, { borderStyle: "single", borderColor: "gray", paddingX: 1, flexDirection: "column" }, renderDiffPreview(preview))), !canBeTrusted && /* @__PURE__ */ React10.createElement(Box9, { marginTop: 1 }, /* @__PURE__ */ React10.createElement(Text9, { color: "red", dimColor: true }, "Note: This tool cannot be trusted due to its dangerous nature.")), /* @__PURE__ */ React10.createElement(Box9, { marginTop: 1, flexDirection: "column" }, items.map((item, index) => /* @__PURE__ */ React10.createElement(Box9, { key: item.value }, /* @__PURE__ */ React10.createElement(Text9, { color: "cyan" }, index + 1, "."), /* @__PURE__ */ React10.createElement(Text9, { color: index === selectedIndex ? "cyan" : void 0, bold: index === selectedIndex }, index === selectedIndex ? " \u276F " : "   ", item.label)))), /* @__PURE__ */ React10.createElement(Box9, { marginTop: 1 }, /* @__PURE__ */ React10.createElement(Text9, { dimColor: true }, "Press 1-", items.length, ", y/n, or \u2191\u2193 + Enter")));
 }
 
 // src/components/ConfigEditor.tsx
-import React11, { useState as useState4, useMemo as useMemo3 } from "react";
+import React11, { useState as useState5, useMemo as useMemo3 } from "react";
 import { Box as Box10, Text as Text10, useInput as useInput4 } from "ink";
 var MAX_ITERATIONS_OPTIONS = [
   { label: "10", value: 10 },
@@ -1460,10 +1622,10 @@ function buildConfigItems(availableModels) {
   return items;
 }
 function ConfigEditor({ config, availableModels, onSave, onClose }) {
-  const [selectedIndex, setSelectedIndex] = useState4(0);
-  const [editedConfig, setEditedConfig] = useState4(config);
-  const [saveError, setSaveError] = useState4(null);
-  const [isSaving, setIsSaving] = useState4(false);
+  const [selectedIndex, setSelectedIndex] = useState5(0);
+  const [editedConfig, setEditedConfig] = useState5(config);
+  const [saveError, setSaveError] = useState5(null);
+  const [isSaving, setIsSaving] = useState5(false);
   const configItems = useMemo3(() => buildConfigItems(availableModels), [availableModels]);
   const hasChanges = useMemo3(() => {
     return JSON.stringify(config.preferences) !== JSON.stringify(editedConfig.preferences) || config.defaultModel !== editedConfig.defaultModel;
@@ -1744,12 +1906,12 @@ var MessageItem = React14.memo(function MessageItem2({ message }) {
       return /* @__PURE__ */ React14.createElement(Box13, { key: idx, marginTop: 1, flexDirection: "column" }, /* @__PURE__ */ React14.createElement(Text13, { color: "yellow" }, "\u{1F527} ", toolName), toolInput && /* @__PURE__ */ React14.createElement(Text13, { dimColor: true }, `   Input: ${truncateValue(toolInput, 100)}`), result && /* @__PURE__ */ React14.createElement(Text13, { dimColor: true }, `   Result: ${truncateValue(result, 200)}`));
     }
     return null;
-  }).filter(Boolean)), !isUser && message.content !== "..." && /* @__PURE__ */ React14.createElement(Box13, { paddingLeft: 2, marginBottom: 1 }, message.metadata?.permissionDenied ? /* @__PURE__ */ React14.createElement(Text13, { color: "yellow" }, "\u26A0\uFE0F ", message.content) : /* @__PURE__ */ React14.createElement(MarkdownRenderer, { content: message.content })), message.metadata?.tokenUsage && (!message.metadata.steps || message.metadata.steps.length === 0) && /* @__PURE__ */ React14.createElement(Box13, { paddingLeft: 2 }, /* @__PURE__ */ React14.createElement(Text13, { dimColor: true }, `${message.metadata.tokenUsage.total} tokens`)));
+  }).filter(Boolean)), !isUser && message.content !== "..." && /* @__PURE__ */ React14.createElement(Box13, { paddingLeft: 2, marginBottom: 1 }, message.metadata?.permissionDenied ? /* @__PURE__ */ React14.createElement(Text13, { color: "yellow" }, "\u26A0\uFE0F ", message.content) : /* @__PURE__ */ React14.createElement(MarkdownRenderer, { content: message.content })), !isUser && message.content !== "..." && message.metadata && /* @__PURE__ */ React14.createElement(Box13, { paddingLeft: 2, marginBottom: 1 }, (message.metadata.tokenUsage?.total || message.metadata.creditsUsed) && /* @__PURE__ */ React14.createElement(Text13, { dimColor: true }, "(", message.metadata.tokenUsage?.total ? `${message.metadata.tokenUsage.total.toLocaleString()} tokens` : "", message.metadata.creditsUsed && message.metadata.creditsUsed > 0 ? (message.metadata.tokenUsage?.total ? " \u2022 " : "") + `used ${message.metadata.creditsUsed.toLocaleString()} ${message.metadata.creditsUsed === 1 ? "credit" : "credits"}` : "", ")")));
 });
 
 // src/utils/processFileReferences.ts
 import * as fs2 from "fs";
-import * as path2 from "path";
+import * as path3 from "path";
 
 // src/utils/constants.ts
 var NAME_SUFFIXES = ["jr", "sr", "ii", "iii", "iv", "v", "phd", "md", "esq"];
@@ -1760,7 +1922,7 @@ function isNameSuffix(value) {
 // src/utils/processFileReferences.ts
 var FILE_REFERENCE_REGEX = /(?:^|\s)@([^\s@]+)/g;
 function looksLikeFilePath2(ref) {
-  if (ref.includes("/") || ref.includes(path2.sep)) {
+  if (ref.includes("/") || ref.includes(path3.sep)) {
     return true;
   }
   const extensionMatch = /\.(\w+)$/.exec(ref);
@@ -1790,9 +1952,13 @@ function extractFileReferences(message) {
 }
 function readFileContents(filePath) {
   const cwd = process.cwd();
-  const absolutePath = path2.resolve(cwd, filePath);
-  if (!isPathWithinCwd(filePath)) {
-    return { error: `Security: Path "${filePath}" is outside the current working directory` };
+  const isAbsolutePath = path3.isAbsolute(filePath);
+  if (filePath.includes("..")) {
+    return { error: `Security: Path traversal detected in "${filePath}"` };
+  }
+  const absolutePath = isAbsolutePath ? path3.normalize(filePath) : path3.resolve(cwd, filePath);
+  if (!isAbsolutePath && !isPathWithinCwd(filePath)) {
+    return { error: `Security: Relative path "${filePath}" escapes the current working directory` };
   }
   if (!fs2.existsSync(absolutePath)) {
     return { error: `File not found: "${filePath}"` };
@@ -1883,6 +2049,7 @@ function App({
   const sessionName = useCliStore((state) => state.session?.name || "New Session");
   const currentModel = useCliStore((state) => state.session?.model || "claude-sonnet-4-5-20250929");
   const totalTokens = useCliStore((state) => state.session?.metadata.totalTokens || 0);
+  const totalCredits = useCliStore((state) => state.session?.metadata.totalCredits);
   const isThinking = useCliStore((state) => state.isThinking);
   const permissionPrompt = useCliStore((state) => state.permissionPrompt);
   const showConfigEditor = useCliStore((state) => state.showConfigEditor);
@@ -1893,7 +2060,7 @@ function App({
   const setIsThinking = useCliStore((state) => state.setIsThinking);
   const pendingBackgroundTrigger = useCliStore((state) => state.pendingBackgroundTrigger);
   const setPendingBackgroundTrigger = useCliStore((state) => state.setPendingBackgroundTrigger);
-  useEffect4(() => {
+  useEffect5(() => {
     if (pendingBackgroundTrigger && !isThinking && onBackgroundCompletion) {
       setPendingBackgroundTrigger(false);
       onBackgroundCompletion();
@@ -1905,7 +2072,7 @@ function App({
       toggleAutoAcceptEdits();
     }
   });
-  const [isBashMode, setIsBashMode] = useState5(false);
+  const [isBashMode, setIsBashMode] = useState6(false);
   const handleSubmit = React15.useCallback(
     async (input) => {
       const trimmed = input.trim();
@@ -1968,7 +2135,15 @@ ${errorBlock}`;
       onPrefillConsumed,
       onBashModeChange: setIsBashMode
     }
-  )), /* @__PURE__ */ React15.createElement(StatusBar, { sessionName, model: currentModel, tokenUsage: totalTokens })));
+  )), /* @__PURE__ */ React15.createElement(
+    StatusBar,
+    {
+      sessionName,
+      model: currentModel,
+      tokenUsage: totalTokens,
+      creditsUsage: totalCredits
+    }
+  )));
 }
 
 // src/components/MessageList.tsx
@@ -2044,12 +2219,12 @@ function TrustLocationSelector({ inProject, onSelect, onCancel }) {
 }
 
 // src/components/RewindSelector.tsx
-import React18, { useState as useState6 } from "react";
+import React18, { useState as useState7 } from "react";
 import { Box as Box17, Text as Text17, useInput as useInput7 } from "ink";
 import SelectInput2 from "ink-select-input";
 function RewindSelector({ messages, onSelect, onCancel }) {
-  const [step, setStep] = useState6("selection");
-  const [selectedMessageIndex, setSelectedMessageIndex] = useState6(null);
+  const [step, setStep] = useState7("selection");
+  const [selectedMessageIndex, setSelectedMessageIndex] = useState7(null);
   useInput7((input, key) => {
     if (key.escape) {
       if (step === "confirmation") {
@@ -2113,12 +2288,12 @@ function RewindSelector({ messages, onSelect, onCancel }) {
 }
 
 // src/components/SessionSelector.tsx
-import React19, { useState as useState7 } from "react";
+import React19, { useState as useState8 } from "react";
 import { Box as Box18, Text as Text18, useInput as useInput8 } from "ink";
 import SelectInput3 from "ink-select-input";
 function SessionSelector({ sessions, currentSession, onSelect, onCancel }) {
-  const [step, setStep] = useState7("selection");
-  const [selectedSession, setSelectedSession] = useState7(null);
+  const [step, setStep] = useState8("selection");
+  const [selectedSession, setSelectedSession] = useState8(null);
   useInput8((_input, key) => {
     if (key.escape) {
       if (step === "confirmation") {
@@ -2193,7 +2368,7 @@ function SessionSelector({ sessions, currentSession, onSelect, onCancel }) {
 }
 
 // src/components/LoginFlow.tsx
-import React20, { useState as useState8, useEffect as useEffect5 } from "react";
+import React20, { useState as useState9, useEffect as useEffect6 } from "react";
 import { Box as Box19, Text as Text19 } from "ink";
 import Spinner3 from "ink-spinner";
 import jwt from "jsonwebtoken";
@@ -2310,11 +2485,11 @@ var OAuthClient = class {
 
 // src/components/LoginFlow.tsx
 function LoginFlow({ apiUrl = "http://localhost:3000", configStore, onSuccess, onError }) {
-  const [status, setStatus] = useState8("initiating");
-  const [deviceFlow, setDeviceFlow] = useState8(null);
-  const [statusMessage, setStatusMessage] = useState8("Initiating device authorization...");
-  const [error, setError] = useState8(null);
-  useEffect5(() => {
+  const [status, setStatus] = useState9("initiating");
+  const [deviceFlow, setDeviceFlow] = useState9(null);
+  const [statusMessage, setStatusMessage] = useState9("Initiating device authorization...");
+  const [error, setError] = useState9(null);
+  useEffect6(() => {
     const runLoginFlow = async () => {
       const oauth = new OAuthClient(apiUrl);
       try {
@@ -2349,7 +2524,7 @@ function LoginFlow({ apiUrl = "http://localhost:3000", configStore, onSuccess, o
     };
     runLoginFlow();
   }, [apiUrl, configStore, onSuccess, onError]);
-  useEffect5(() => {
+  useEffect6(() => {
     if (deviceFlow && status === "waiting") {
       open(deviceFlow.verification_uri_complete).catch((err) => {
         console.error("Failed to auto-open browser:", err);
@@ -2370,12 +2545,12 @@ function LoginFlow({ apiUrl = "http://localhost:3000", configStore, onSuccess, o
 
 // src/storage/SessionStore.ts
 import { promises as fs3 } from "fs";
-import path3 from "path";
+import path4 from "path";
 import { homedir } from "os";
 import { v4 as uuidv4 } from "uuid";
 var SessionStore = class {
   constructor(basePath) {
-    this.basePath = basePath || path3.join(homedir(), ".bike4mind", "sessions");
+    this.basePath = basePath || path4.join(homedir(), ".bike4mind", "sessions");
   }
   /**
    * Initialize storage directory
@@ -2396,7 +2571,7 @@ var SessionStore = class {
       throw new Error("Cannot save session with no messages");
     }
     await this.init();
-    const filePath = path3.join(this.basePath, `${session.id}.json`);
+    const filePath = path4.join(this.basePath, `${session.id}.json`);
     try {
       await fs3.writeFile(filePath, JSON.stringify(session, null, 2), "utf-8");
     } catch (error) {
@@ -2408,7 +2583,7 @@ var SessionStore = class {
    * Load a session from disk by ID
    */
   async load(id) {
-    const filePath = path3.join(this.basePath, `${id}.json`);
+    const filePath = path4.join(this.basePath, `${id}.json`);
     try {
       const data = await fs3.readFile(filePath, "utf-8");
       const session = JSON.parse(data);
@@ -2446,7 +2621,7 @@ var SessionStore = class {
       const jsonFiles = files.filter((f) => f.endsWith(".json"));
       const sessionsWithFiles = await Promise.all(
         jsonFiles.map(async (file) => {
-          const filePath = path3.join(this.basePath, file);
+          const filePath = path4.join(this.basePath, file);
           const data = await fs3.readFile(filePath, "utf-8");
           const session = JSON.parse(data);
           session.messages = session.messages.map((msg) => {
@@ -2481,7 +2656,7 @@ var SessionStore = class {
    * Delete a session
    */
   async delete(id) {
-    const filePath = path3.join(this.basePath, `${id}.json`);
+    const filePath = path4.join(this.basePath, `${id}.json`);
     try {
       await fs3.unlink(filePath);
       return true;
@@ -2520,19 +2695,19 @@ var SessionStore = class {
 
 // src/storage/CommandHistoryStore.ts
 import { promises as fs4 } from "fs";
-import path4 from "path";
+import path5 from "path";
 import { homedir as homedir2 } from "os";
 var MAX_HISTORY_ENTRIES = 1e3;
 var CommandHistoryStore = class {
   constructor(historyPath) {
     this.history = null;
-    this.historyPath = historyPath || path4.join(homedir2(), ".bike4mind", "history.jsonl");
+    this.historyPath = historyPath || path5.join(homedir2(), ".bike4mind", "history.jsonl");
   }
   /**
    * Initialize history directory
    */
   async init() {
-    const dir = path4.dirname(this.historyPath);
+    const dir = path5.dirname(this.historyPath);
     try {
       await fs4.mkdir(dir, { recursive: true });
     } catch (error) {
@@ -2635,7 +2810,7 @@ var CommandHistoryStore = class {
 
 // src/storage/CustomCommandStore.ts
 import fs5 from "fs/promises";
-import path5 from "path";
+import path6 from "path";
 import os from "os";
 
 // src/utils/commandParser.ts
@@ -2798,14 +2973,14 @@ var CustomCommandStore = class {
     const home = os.homedir();
     const root = projectRoot || process.cwd();
     this.globalCommandsDirs = [
-      path5.join(home, ".bike4mind", "commands"),
-      path5.join(home, ".claude", "commands"),
-      path5.join(home, ".claude", "skills")
+      path6.join(home, ".bike4mind", "commands"),
+      path6.join(home, ".claude", "commands"),
+      path6.join(home, ".claude", "skills")
     ];
     this.projectCommandsDirs = [
-      path5.join(root, ".bike4mind", "commands"),
-      path5.join(root, ".claude", "commands"),
-      path5.join(root, ".claude", "skills")
+      path6.join(root, ".bike4mind", "commands"),
+      path6.join(root, ".claude", "commands"),
+      path6.join(root, ".claude", "skills")
     ];
   }
   /**
@@ -2865,7 +3040,7 @@ var CustomCommandStore = class {
     try {
       const entries = await fs5.readdir(directory, { withFileTypes: true });
       for (const entry of entries) {
-        const fullPath = path5.join(directory, entry.name);
+        const fullPath = path6.join(directory, entry.name);
         if (entry.isDirectory()) {
           const subFiles = await this.findCommandFiles(fullPath);
           files.push(...subFiles);
@@ -2885,7 +3060,7 @@ var CustomCommandStore = class {
    * @param source - Source identifier ('global' or 'project')
    */
   async loadCommandFile(filePath, source) {
-    const filename = path5.basename(filePath);
+    const filename = path6.basename(filePath);
     const isSkillFile = filename.toLowerCase() === "skill.md";
     const commandName = isSkillFile ? this.extractSkillName(filePath) : extractCommandName(filename);
     if (!commandName) {
@@ -2904,7 +3079,7 @@ var CustomCommandStore = class {
    * @returns Skill name or null if invalid
    */
   extractSkillName(filePath) {
-    const parentDir = path5.basename(path5.dirname(filePath));
+    const parentDir = path6.basename(path6.dirname(filePath));
     return parentDir && parentDir !== "skills" ? parentDir : null;
   }
   /**
@@ -2966,7 +3141,7 @@ var CustomCommandStore = class {
    */
   async createCommandFile(name, isGlobal = false) {
     const targetDir = isGlobal ? this.globalCommandsDirs[0] : this.projectCommandsDirs[0];
-    const filePath = path5.join(targetDir, `${name}.md`);
+    const filePath = path6.join(targetDir, `${name}.md`);
     const fileExists = await fs5.access(filePath).then(
       () => true,
       () => false
@@ -3122,6 +3297,7 @@ var ReActAgent = class extends EventEmitter {
     super();
     this.steps = [];
     this.totalTokens = 0;
+    this.totalCredits = 0;
     this.toolCallCount = 0;
     this.observationQueue = [];
     this.context = {
@@ -3141,6 +3317,7 @@ var ReActAgent = class extends EventEmitter {
   async run(query, options = {}) {
     this.steps = [];
     this.totalTokens = 0;
+    this.totalCredits = 0;
     this.toolCallCount = 0;
     const maxIterations = options.maxIterations ?? this.context.maxIterations ?? 5;
     const temperature = options.temperature ?? this.context.temperature ?? 0.7;
@@ -3177,6 +3354,7 @@ ${options.context}` : this.getSystemPrompt()
             steps: this.steps,
             completionInfo: {
               totalTokens: this.totalTokens,
+              totalCredits: this.totalCredits > 0 ? this.totalCredits : void 0,
               iterations,
               toolCalls: this.toolCallCount,
               reachedMaxIterations: false
@@ -3212,6 +3390,9 @@ ${options.context}` : this.getSystemPrompt()
               const inputTokens = completionInfo.inputTokens || 0;
               const outputTokens = completionInfo.outputTokens || 0;
               this.totalTokens += inputTokens + outputTokens;
+              if (completionInfo.creditsUsed) {
+                this.totalCredits += completionInfo.creditsUsed;
+              }
               if (currentText.trim() && completionInfo.toolsUsed?.length) {
                 const thoughtStep = {
                   type: "thought",
@@ -3325,6 +3506,7 @@ ${options.context}` : this.getSystemPrompt()
         steps: this.steps,
         completionInfo: {
           totalTokens: this.totalTokens,
+          totalCredits: this.totalCredits > 0 ? this.totalCredits : void 0,
           iterations,
           toolCalls: this.toolCallCount,
           reachedMaxIterations
@@ -3342,6 +3524,7 @@ ${options.context}` : this.getSystemPrompt()
           steps: this.steps,
           completionInfo: {
             totalTokens: this.totalTokens,
+            totalCredits: this.totalCredits > 0 ? this.totalCredits : void 0,
             iterations,
             toolCalls: this.toolCallCount,
             reachedMaxIterations: false
@@ -3763,6 +3946,10 @@ EXAMPLES:
 Remember: Use context from previous messages to understand follow-up questions.${projectContextSection}${skillsSection}`;
 }
 
+// src/utils/toolsAdapter.ts
+import { rmSync } from "fs";
+import path14 from "path";
+
 // ../../b4m-core/packages/services/dist/src/referService/generateCodes.js
 import { randomBytes } from "crypto";
 import range from "lodash/range.js";
@@ -5889,8 +6076,8 @@ async function processAndStoreImages(images, context) {
     const buffer = await downloadImage(image);
     const fileType = await fileTypeFromBuffer2(buffer);
     const filename = `${uuidv45()}.${fileType?.ext}`;
-    const path18 = await context.imageGenerateStorage.upload(buffer, filename, {});
-    return path18;
+    const path20 = await context.imageGenerateStorage.upload(buffer, filename, {});
+    return path20;
   }));
 }
 async function updateQuestAndReturnMarkdown(storedImageUrls, context) {
@@ -7216,8 +7403,8 @@ async function processAndStoreImage(imageUrl, context) {
   const buffer = await downloadImage2(imageUrl);
   const fileType = await fileTypeFromBuffer3(buffer);
   const filename = `${uuidv46()}.${fileType?.ext}`;
-  const path18 = await context.imageGenerateStorage.upload(buffer, filename, {});
-  return path18;
+  const path20 = await context.imageGenerateStorage.upload(buffer, filename, {});
+  return path20;
 }
 async function generateFullMask(imageBuffer) {
   const sharp = (await import("sharp")).default;
@@ -9159,18 +9346,18 @@ var planetVisibilityTool = {
 
 // ../../b4m-core/packages/services/dist/src/llm/tools/implementation/fileRead/index.js
 import { promises as fs7 } from "fs";
-import { existsSync as existsSync3, statSync as statSync4 } from "fs";
-import path6 from "path";
+import { existsSync as existsSync4, statSync as statSync4 } from "fs";
+import path7 from "path";
 var MAX_FILE_SIZE2 = 10 * 1024 * 1024;
 async function readFileContent(params) {
   const { path: filePath, encoding = "utf-8", offset = 0, limit } = params;
-  const normalizedPath = path6.normalize(filePath);
-  const resolvedPath = path6.resolve(process.cwd(), normalizedPath);
-  const cwd = path6.resolve(process.cwd());
+  const normalizedPath = path7.normalize(filePath);
+  const resolvedPath = path7.resolve(process.cwd(), normalizedPath);
+  const cwd = path7.resolve(process.cwd());
   if (!resolvedPath.startsWith(cwd)) {
     throw new Error(`Access denied: Cannot read files outside of current working directory`);
   }
-  if (!existsSync3(resolvedPath)) {
+  if (!existsSync4(resolvedPath)) {
     throw new Error(`File not found: ${filePath}`);
   }
   const stats = statSync4(resolvedPath);
@@ -9239,7 +9426,7 @@ var fileReadTool = {
       context.logger.info("\u{1F4C4} FileRead: Reading file", { path: params.path });
       try {
         const content = await readFileContent(params);
-        const stats = statSync4(path6.resolve(process.cwd(), path6.normalize(params.path)));
+        const stats = statSync4(path7.resolve(process.cwd(), path7.normalize(params.path)));
         context.logger.info("\u2705 FileRead: Success", {
           path: params.path,
           size: stats.size,
@@ -9284,20 +9471,20 @@ var fileReadTool = {
 
 // ../../b4m-core/packages/services/dist/src/llm/tools/implementation/createFile/index.js
 import { promises as fs8 } from "fs";
-import { existsSync as existsSync4 } from "fs";
-import path7 from "path";
+import { existsSync as existsSync5 } from "fs";
+import path8 from "path";
 async function createFile(params) {
   const { path: filePath, content, createDirectories = true } = params;
-  const normalizedPath = path7.normalize(filePath);
-  const resolvedPath = path7.resolve(process.cwd(), normalizedPath);
-  const cwd = path7.resolve(process.cwd());
+  const normalizedPath = path8.normalize(filePath);
+  const resolvedPath = path8.resolve(process.cwd(), normalizedPath);
+  const cwd = path8.resolve(process.cwd());
   if (!resolvedPath.startsWith(cwd)) {
     throw new Error(`Access denied: Cannot create files outside of current working directory`);
   }
-  const fileExists = existsSync4(resolvedPath);
+  const fileExists = existsSync5(resolvedPath);
   const action = fileExists ? "overwritten" : "created";
   if (createDirectories) {
-    const dir = path7.dirname(resolvedPath);
+    const dir = path8.dirname(resolvedPath);
     await fs8.mkdir(dir, { recursive: true });
   }
   await fs8.writeFile(resolvedPath, content, "utf-8");
@@ -9312,7 +9499,7 @@ var createFileTool = {
   implementation: (context) => ({
     toolFn: async (value) => {
       const params = value;
-      const fileExists = existsSync4(path7.resolve(process.cwd(), path7.normalize(params.path)));
+      const fileExists = existsSync5(path8.resolve(process.cwd(), path8.normalize(params.path)));
       context.logger.info(`\u{1F4DD} CreateFile: ${fileExists ? "Overwriting" : "Creating"} file`, {
         path: params.path,
         size: params.content.length
@@ -9354,8 +9541,8 @@ var createFileTool = {
 // ../../b4m-core/packages/services/dist/src/llm/tools/implementation/globFiles/index.js
 import { glob } from "glob";
 import { stat } from "fs/promises";
-import path8 from "path";
-var DEFAULT_IGNORE_PATTERNS2 = [
+import path9 from "path";
+var DEFAULT_IGNORE_PATTERNS = [
   "**/node_modules/**",
   "**/.git/**",
   "**/dist/**",
@@ -9370,11 +9557,11 @@ var DEFAULT_IGNORE_PATTERNS2 = [
 async function findFiles(params) {
   const { pattern, dir_path, case_sensitive = true, respect_git_ignore = true } = params;
   const baseCwd = process.cwd();
-  const targetDir = dir_path ? path8.resolve(baseCwd, path8.normalize(dir_path)) : baseCwd;
+  const targetDir = dir_path ? path9.resolve(baseCwd, path9.normalize(dir_path)) : baseCwd;
   if (!targetDir.startsWith(baseCwd)) {
     throw new Error(`Access denied: Cannot search outside of current working directory`);
   }
-  const ignorePatterns = respect_git_ignore ? DEFAULT_IGNORE_PATTERNS2 : [];
+  const ignorePatterns = respect_git_ignore ? DEFAULT_IGNORE_PATTERNS : [];
   const matches = await glob(pattern, {
     cwd: targetDir,
     dot: false,
@@ -9410,7 +9597,7 @@ async function findFiles(params) {
   const summary = `Found ${filesWithStats.length} file(s)${truncated ? ` (showing first ${MAX_RESULTS})` : ""} matching: ${pattern}`;
   const dirInfo = dir_path ? `
 Directory: ${dir_path}` : "";
-  const filesList = results.map((file) => path8.relative(baseCwd, file.path)).join("\n");
+  const filesList = results.map((file) => path9.relative(baseCwd, file.path)).join("\n");
   return `${summary}${dirInfo}
 
 ${filesList}`;
@@ -9464,7 +9651,7 @@ var globFilesTool = {
 
 // ../../b4m-core/packages/services/dist/src/llm/tools/implementation/grepSearch/index.js
 import { stat as stat2 } from "fs/promises";
-import path9 from "path";
+import path10 from "path";
 import { execFile } from "child_process";
 import { promisify } from "util";
 import { createRequire } from "module";
@@ -9473,18 +9660,18 @@ var require2 = createRequire(import.meta.url);
 function getRipgrepPath() {
   try {
     const ripgrepPath = require2.resolve("@vscode/ripgrep");
-    const ripgrepDir = path9.dirname(ripgrepPath);
-    const rgBinary = path9.join(ripgrepDir, "..", "bin", "rg" + (process.platform === "win32" ? ".exe" : ""));
+    const ripgrepDir = path10.dirname(ripgrepPath);
+    const rgBinary = path10.join(ripgrepDir, "..", "bin", "rg" + (process.platform === "win32" ? ".exe" : ""));
     return rgBinary;
   } catch (error) {
     throw new Error("ripgrep is not available. Please install @vscode/ripgrep: pnpm add @vscode/ripgrep --filter @bike4mind/services");
   }
 }
 function isPathWithinWorkspace(targetPath, baseCwd) {
-  const resolvedTarget = path9.resolve(targetPath);
-  const resolvedBase = path9.resolve(baseCwd);
-  const relativePath = path9.relative(resolvedBase, resolvedTarget);
-  return !relativePath.startsWith("..") && !path9.isAbsolute(relativePath);
+  const resolvedTarget = path10.resolve(targetPath);
+  const resolvedBase = path10.resolve(baseCwd);
+  const relativePath = path10.relative(resolvedBase, resolvedTarget);
+  return !relativePath.startsWith("..") && !path10.isAbsolute(relativePath);
 }
 function convertGlobToRipgrepGlobs(globPattern) {
   if (!globPattern || globPattern === "**/*") {
@@ -9500,7 +9687,7 @@ function convertGlobToRipgrepGlobs(globPattern) {
 async function searchFiles2(params) {
   const { pattern, dir_path, include } = params;
   const baseCwd = process.cwd();
-  const targetDir = dir_path ? path9.resolve(baseCwd, dir_path) : baseCwd;
+  const targetDir = dir_path ? path10.resolve(baseCwd, dir_path) : baseCwd;
   if (!isPathWithinWorkspace(targetDir, baseCwd)) {
     throw new Error(`Path validation failed: "${dir_path}" resolves outside the allowed workspace directory`);
   }
@@ -9562,7 +9749,7 @@ async function searchFiles2(params) {
       if (item.type === "match") {
         const match = item;
         allMatches.push({
-          filePath: path9.relative(targetDir, match.data.path.text) || path9.basename(match.data.path.text),
+          filePath: path10.relative(targetDir, match.data.path.text) || path10.basename(match.data.path.text),
           lineNumber: match.data.line_number,
           line: match.data.lines.text.trimEnd()
           // Remove trailing newline
@@ -9656,17 +9843,17 @@ var grepSearchTool = {
 
 // ../../b4m-core/packages/services/dist/src/llm/tools/implementation/deleteFile/index.js
 import { promises as fs9 } from "fs";
-import { existsSync as existsSync5, statSync as statSync5 } from "fs";
-import path10 from "path";
+import { existsSync as existsSync6, statSync as statSync5 } from "fs";
+import path11 from "path";
 async function deleteFile(params) {
   const { path: filePath, recursive = false } = params;
-  const normalizedPath = path10.normalize(filePath);
-  const resolvedPath = path10.resolve(process.cwd(), normalizedPath);
-  const cwd = path10.resolve(process.cwd());
+  const normalizedPath = path11.normalize(filePath);
+  const resolvedPath = path11.resolve(process.cwd(), normalizedPath);
+  const cwd = path11.resolve(process.cwd());
   if (!resolvedPath.startsWith(cwd)) {
     throw new Error(`Access denied: Cannot delete files outside of current working directory`);
   }
-  if (!existsSync5(resolvedPath)) {
+  if (!existsSync6(resolvedPath)) {
     throw new Error(`File or directory not found: ${filePath}`);
   }
   const stats = statSync5(resolvedPath);
@@ -9689,8 +9876,8 @@ var deleteFileTool = {
   implementation: (context) => ({
     toolFn: async (value) => {
       const params = value;
-      const resolvedPath = path10.resolve(process.cwd(), path10.normalize(params.path));
-      const isDirectory = existsSync5(resolvedPath) && statSync5(resolvedPath).isDirectory();
+      const resolvedPath = path11.resolve(process.cwd(), path11.normalize(params.path));
+      const isDirectory = existsSync6(resolvedPath) && statSync5(resolvedPath).isDirectory();
       context.logger.info(`\u{1F5D1}\uFE0F  DeleteFile: Deleting ${isDirectory ? "directory" : "file"}`, {
         path: params.path,
         recursive: params.recursive
@@ -9815,7 +10002,7 @@ var knowledgeBaseSearchTool = {
 
 // ../../b4m-core/packages/services/dist/src/llm/tools/implementation/bashExecute/index.js
 import { spawn } from "child_process";
-import path11 from "path";
+import path12 from "path";
 var DEFAULT_TIMEOUT_MS = 6e4;
 var MAX_OUTPUT_SIZE = 100 * 1024;
 var DANGEROUS_PATTERNS = [
@@ -9999,7 +10186,7 @@ async function executeBashCommand(params) {
     };
   }
   const baseCwd = process.cwd();
-  const targetCwd = relativeCwd ? path11.resolve(baseCwd, relativeCwd) : baseCwd;
+  const targetCwd = relativeCwd ? path12.resolve(baseCwd, relativeCwd) : baseCwd;
   const effectiveTimeout = Math.min(timeout, 5 * 60 * 1e3);
   return new Promise((resolve3) => {
     let stdout = "";
@@ -10190,8 +10377,8 @@ BLOCKED OPERATIONS:
 
 // ../../b4m-core/packages/services/dist/src/llm/tools/implementation/editLocalFile/index.js
 import { promises as fs10 } from "fs";
-import { existsSync as existsSync6 } from "fs";
-import path12 from "path";
+import { existsSync as existsSync7 } from "fs";
+import path13 from "path";
 import { diffLines as diffLines3 } from "diff";
 function generateDiff(original, modified) {
   const differences = diffLines3(original, modified);
@@ -10215,13 +10402,13 @@ function generateDiff(original, modified) {
 }
 async function editLocalFile(params) {
   const { path: filePath, old_string, new_string } = params;
-  const normalizedPath = path12.normalize(filePath);
-  const resolvedPath = path12.resolve(process.cwd(), normalizedPath);
-  const cwd = path12.resolve(process.cwd());
+  const normalizedPath = path13.normalize(filePath);
+  const resolvedPath = path13.resolve(process.cwd(), normalizedPath);
+  const cwd = path13.resolve(process.cwd());
   if (!resolvedPath.startsWith(cwd)) {
     throw new Error(`Access denied: Cannot edit files outside of current working directory`);
   }
-  if (!existsSync6(resolvedPath)) {
+  if (!existsSync7(resolvedPath)) {
     throw new Error(`File not found: ${filePath}`);
   }
   const currentContent = await fs10.readFile(resolvedPath, "utf-8");
@@ -11412,10 +11599,10 @@ var ToolErrorType;
 // src/utils/diffPreview.ts
 import * as Diff from "diff";
 import { readFile } from "fs/promises";
-import { existsSync as existsSync7 } from "fs";
+import { existsSync as existsSync8 } from "fs";
 async function generateFileDiffPreview(args) {
   try {
-    if (!existsSync7(args.path)) {
+    if (!existsSync8(args.path)) {
       const lines2 = args.content.split("\n");
       const preview = lines2.slice(0, 20).join("\n");
       const hasMore = lines2.length > 20;
@@ -11453,7 +11640,7 @@ ${diffLines4.join("\n")}`;
 }
 async function generateFileDeletePreview(args) {
   try {
-    if (!existsSync7(args.path)) {
+    if (!existsSync8(args.path)) {
       return `[File does not exist: ${args.path}]`;
     }
     const stats = await import("fs/promises").then((fs14) => fs14.stat(args.path));
@@ -11509,10 +11696,6 @@ var ServerToolExecutor = class {
 };
 
 // src/llm/ToolRouter.ts
-var wsToolExecutor = null;
-function setWebSocketToolExecutor(executor) {
-  wsToolExecutor = executor;
-}
 var SERVER_TOOLS = ["weather_info", "web_search", "web_fetch"];
 var LOCAL_TOOLS = [
   "file_read",
@@ -11535,15 +11718,7 @@ function isLocalTool(toolName) {
 }
 async function executeTool(toolName, input, apiClient, localToolFn) {
   if (isServerTool(toolName)) {
-    if (wsToolExecutor) {
-      logger.debug(`[ToolRouter] Routing ${toolName} to server via WebSocket`);
-      const result = await wsToolExecutor.execute(toolName, input);
-      if (!result.success) {
-        return `Error executing ${toolName}: ${result.error || "Tool execution failed"}`;
-      }
-      return typeof result.content === "string" ? result.content : JSON.stringify(result.content ?? "");
-    }
-    logger.debug(`[ToolRouter] Routing ${toolName} to server via HTTP`);
+    logger.debug(`[ToolRouter] Routing ${toolName} to server`);
     const executor = new ServerToolExecutor(apiClient);
     return await executor.executeTool(toolName, input);
   } else if (isLocalTool(toolName)) {
@@ -11759,21 +11934,21 @@ var NoOpStorage = class extends BaseStorage {
   async upload(input, destination, options) {
     return `/tmp/${destination}`;
   }
-  async download(path18) {
+  async download(path20) {
     throw new Error("Download not supported in CLI");
   }
-  async delete(path18) {
+  async delete(path20) {
   }
-  async getSignedUrl(path18) {
-    return `/tmp/${path18}`;
+  async getSignedUrl(path20) {
+    return `/tmp/${path20}`;
   }
-  getPublicUrl(path18) {
-    return `/tmp/${path18}`;
+  getPublicUrl(path20) {
+    return `/tmp/${path20}`;
   }
-  async getPreview(path18) {
-    return `/tmp/${path18}`;
+  async getPreview(path20) {
+    return `/tmp/${path20}`;
   }
-  async getMetadata(path18) {
+  async getMetadata(path20) {
     return { size: 0, contentType: "application/octet-stream" };
   }
 };
@@ -11793,87 +11968,179 @@ var CliLogger = class extends Logger {
   log(...args) {
   }
 };
-function wrapToolWithPermission(tool, permissionManager, showPermissionPrompt, agentContext, configStore, apiClient) {
+function wrapToolWithPermission(tool, permissionManager, showPermissionPrompt, agentContext, configStore, apiClient, sandboxOrchestrator) {
   const originalFn = tool.toolFn;
   const toolName = tool.toolSchema.name;
   return {
     ...tool,
     toolFn: async (args) => {
-      if (!permissionManager.needsPermission(toolName)) {
-        const result2 = await executeTool(toolName, args, apiClient, originalFn);
-        agentContext.observationQueue.push({ toolName, result: result2 });
-        return result2;
-      }
-      const { useCliStore: useCliStore2 } = await import("./store-FU6NDC2W.js");
-      if (useCliStore2.getState().autoAcceptEdits) {
-        const result2 = await executeTool(toolName, args, apiClient, originalFn);
-        agentContext.observationQueue.push({ toolName, result: result2 });
-        return result2;
-      }
-      let preview;
-      if (toolName === "edit_local_file" && args?.path && args?.old_string && typeof args?.new_string === "string") {
-        try {
-          preview = generateEditLocalFilePreview({
-            path: args.path,
-            old_string: args.old_string,
-            new_string: args.new_string
-          });
-        } catch (error) {
-          preview = `[Could not generate preview: ${error instanceof Error ? error.message : "Unknown error"}]`;
-        }
-      } else if (toolName === "create_file" && args?.path && args?.content) {
-        try {
-          preview = await generateFileDiffPreview({
-            path: args.path,
-            content: args.content
+      let isSandboxed = false;
+      let sandboxedArgs = args;
+      if (toolName === "bash_execute" && args?.command && sandboxOrchestrator) {
+        const cwd = args.cwd ? path14.resolve(process.cwd(), args.cwd) : process.cwd();
+        const decision = sandboxOrchestrator.shouldSandbox(args.command, cwd);
+        if (decision.type === "blocked") {
+          sandboxOrchestrator.recordBlocked();
+          sandboxOrchestrator.recordViolation({
+            type: "filesystem",
+            command: args.command,
+            blockedBy: "config",
+            timestamp: /* @__PURE__ */ new Date(),
+            detail: decision.reason
+          }).catch(() => {
           });
-        } catch (error) {
-          preview = `[Could not generate preview: ${error instanceof Error ? error.message : "Unknown error"}]`;
+          console.error(
+            `
+\x1B[41m\x1B[97m BLOCKED \x1B[0m \x1B[31mSandbox denied this command:\x1B[0m ${decision.reason}
+`
+          );
+          return `Command blocked by sandbox: ${decision.reason}`;
         }
-      } else if (toolName === "delete_file" && args?.path) {
-        try {
-          preview = await generateFileDeletePreview({
-            path: args.path
-          });
-        } catch (error) {
-          preview = `[Could not generate preview: ${error instanceof Error ? error.message : "Unknown error"}]`;
+        if (decision.type === "sandbox") {
+          sandboxOrchestrator.recordSandboxed();
+          isSandboxed = true;
+          sandboxedArgs = {
+            ...args,
+            command: decision.wrappedCommand.commandString,
+            _sandboxCleanup: decision.wrappedCommand.cleanupPaths
+          };
+        } else if (decision.type === "unsandboxed") {
+          sandboxOrchestrator.recordUnsandboxed();
         }
-      } else if (toolName === "bash_execute" && args?.command) {
-        const cwd = args.cwd ? ` (in ${args.cwd})` : "";
-        const timeout = args.timeout ? ` [timeout: ${args.timeout}ms]` : "";
-        preview = `$ ${args.command}${cwd}${timeout}`;
       }
-      const response = await showPermissionPrompt(toolName, args, preview);
+      const effectiveArgs = isSandboxed ? sandboxedArgs : args;
+      async function executeAndRecord() {
+        let result = await executeTool(toolName, effectiveArgs, apiClient, originalFn);
+        cleanupSandboxFiles(effectiveArgs?._sandboxCleanup);
+        await captureViolations(isSandboxed, result, args?.command, sandboxOrchestrator);
+        result = await retrySandboxFailure(
+          isSandboxed,
+          result,
+          toolName,
+          args,
+          apiClient,
+          originalFn,
+          showPermissionPrompt
+        );
+        agentContext.observationQueue.push({ toolName, result });
+        return result;
+      }
+      if (!permissionManager.needsPermission(toolName, { isSandboxed })) {
+        return executeAndRecord();
+      }
+      const { useCliStore: useCliStore2 } = await import("./store-FU6NDC2W.js");
+      if (useCliStore2.getState().autoAcceptEdits) {
+        return executeAndRecord();
+      }
+      const preview = await generateToolPreview(toolName, args, isSandboxed);
+      const response = await showPermissionPrompt(toolName, effectiveArgs, preview);
       if (response.action === "deny") {
         throw new PermissionDeniedError(toolName, args);
       }
+      if (response.action === "allow-session") {
+        permissionManager.trustToolForSession(toolName);
+      }
       if (response.action === "allow-always") {
-        const canTrust = permissionManager.trustTool(toolName);
-        if (canTrust) {
-          const projectDir = configStore.getProjectConfigDir();
-          if (projectDir) {
-            try {
-              await configStore.initProjectConfig();
-              const existingLocal = await configStore.loadRawProjectLocalConfig() || {};
-              const updatedLocal = {
-                ...existingLocal,
-                trustedTools: [...existingLocal.trustedTools || [], toolName]
-              };
-              await configStore.saveProjectLocalConfig(updatedLocal);
-            } catch (error) {
-              await configStore.trustTool(toolName);
-            }
-          } else {
-            await configStore.trustTool(toolName);
-          }
-        }
+        await persistToolTrust(toolName, permissionManager, configStore);
       }
-      const result = await executeTool(toolName, args, apiClient, originalFn);
-      agentContext.observationQueue.push({ toolName, result });
-      return result;
+      return executeAndRecord();
     }
   };
 }
+function isSandboxFailure(isSandboxed, result) {
+  if (!isSandboxed) return false;
+  return result.includes("sandbox-exec:") || result.includes("bwrap:") || result.includes("Operation not permitted");
+}
+async function retrySandboxFailure(isSandboxed, result, toolName, originalArgs, apiClient, originalFn, showPermissionPrompt) {
+  if (!isSandboxFailure(isSandboxed, result)) return result;
+  const errorSnippet = result.slice(0, 200);
+  const retryResponse = await showPermissionPrompt(
+    toolName,
+    originalArgs,
+    `\u{1F6D1} SANDBOX BLOCKED \u2014 This command was denied by the OS sandbox.
+
+- The sandbox prevented this operation because it violates filesystem restrictions.
+- You can retry without the sandbox, but the command will run with full system access.
+
+@@Error Details@@
+${errorSnippet}`
+  );
+  if (retryResponse.action !== "deny") {
+    return executeTool(toolName, originalArgs, apiClient, originalFn);
+  }
+  return result;
+}
+function cleanupSandboxFiles(paths) {
+  if (!paths || paths.length === 0) return;
+  for (const p of paths) {
+    try {
+      rmSync(p, { recursive: true, force: true });
+    } catch {
+    }
+  }
+}
+async function captureViolations(isSandboxed, result, command, orchestrator) {
+  if (!isSandboxed || !orchestrator || !command) return;
+  const { parseSandboxStderr, toSandboxViolations } = await import("./StderrViolationParser-7OYPM2DJ.js");
+  const parsed = parseSandboxStderr(result);
+  if (parsed.length > 0) {
+    const violations = toSandboxViolations(parsed, command);
+    for (const v of violations) {
+      await orchestrator.recordViolation(v).catch(() => {
+      });
+    }
+  }
+}
+async function generateToolPreview(toolName, args, isSandboxed) {
+  try {
+    if (toolName === "edit_local_file" && args?.path && args?.old_string && typeof args?.new_string === "string") {
+      return generateEditLocalFilePreview({
+        path: args.path,
+        old_string: args.old_string,
+        new_string: args.new_string
+      });
+    }
+    if (toolName === "create_file" && args?.path && args?.content) {
+      return await generateFileDiffPreview({
+        path: args.path,
+        content: args.content
+      });
+    }
+    if (toolName === "delete_file" && args?.path) {
+      return await generateFileDeletePreview({
+        path: args.path
+      });
+    }
+    if (toolName === "bash_execute" && args?.command) {
+      const cwd = args.cwd ? ` (in ${args.cwd})` : "";
+      const timeout = args.timeout ? ` [timeout: ${args.timeout}ms]` : "";
+      const sandboxLabel = isSandboxed ? " [sandboxed]" : "";
+      return `$ ${args.command}${cwd}${timeout}${sandboxLabel}`;
+    }
+  } catch (error) {
+    return `[Could not generate preview: ${error instanceof Error ? error.message : "Unknown error"}]`;
+  }
+  return void 0;
+}
+async function persistToolTrust(toolName, permissionManager, configStore) {
+  const canTrust = permissionManager.trustTool(toolName);
+  if (!canTrust) return;
+  const projectDir = configStore.getProjectConfigDir();
+  if (projectDir) {
+    try {
+      await configStore.initProjectConfig();
+      const existingLocal = await configStore.loadRawProjectLocalConfig() || {};
+      await configStore.saveProjectLocalConfig({
+        ...existingLocal,
+        trustedTools: [...existingLocal.trustedTools || [], toolName]
+      });
+    } catch {
+      await configStore.trustTool(toolName);
+    }
+  } else {
+    await configStore.trustTool(toolName);
+  }
+}
 function wrapToolWithHooks(tool, hooks, hookContext) {
   const hasToolHooks = hooks?.PreToolUse || hooks?.PostToolUse || hooks?.PostToolUseFailure;
   if (!hasToolHooks) {
@@ -11967,7 +12234,7 @@ function normalizeToolName(toolName) {
   }
   return TOOL_NAME_MAPPING[toolName] || toolName;
 }
-function generateCliTools(userId, llm, model, permissionManager, showPermissionPrompt, agentContext, configStore, apiClient, toolFilter) {
+function generateCliTools(userId, llm, model, permissionManager, showPermissionPrompt, agentContext, configStore, apiClient, toolFilter, sandboxOrchestrator) {
   const logger2 = new CliLogger();
   const storage = new NoOpStorage();
   const user = {
@@ -12027,7 +12294,15 @@ function generateCliTools(userId, llm, model, permissionManager, showPermissionP
     tools_to_generate
   );
   let tools = Object.entries(toolsMap).map(
-    ([_, tool]) => wrapToolWithPermission(tool, permissionManager, showPermissionPrompt, agentContext, configStore, apiClient)
+    ([_, tool]) => wrapToolWithPermission(
+      tool,
+      permissionManager,
+      showPermissionPrompt,
+      agentContext,
+      configStore,
+      apiClient,
+      sandboxOrchestrator
+    )
   );
   if (toolFilter) {
     const { allowedTools, deniedTools } = toolFilter;
@@ -12051,11 +12326,23 @@ function generateCliTools(userId, llm, model, permissionManager, showPermissionP
 var PermissionManager = class {
   constructor(trustedTools = [], customCategories, deniedTools) {
     this.trustedTools = /* @__PURE__ */ new Set();
+    this.sessionTrustedTools = /* @__PURE__ */ new Set();
     this.deniedTools = /* @__PURE__ */ new Set();
+    this._sandboxMode = "disabled";
+    this._sandboxActive = false;
     this.trustedTools = new Set(trustedTools);
     this.customCategories = new Map(Object.entries(customCategories || {}));
     this.deniedTools = new Set(deniedTools || []);
   }
+  /** Update sandbox state from the orchestrator */
+  setSandboxState(mode, active) {
+    this._sandboxMode = mode;
+    this._sandboxActive = active;
+  }
+  /** Check if sandbox auto-allow is active */
+  isSandboxAutoAllow() {
+    return this._sandboxMode === "auto-allow" && this._sandboxActive;
+  }
   /**
    * Check if a tool needs permission before execution
    *
@@ -12066,8 +12353,13 @@ var PermissionManager = class {
    *
    * Note: prompt_always tools CANNOT be trusted, so they always need permission
    * Note: denied tools from project config ALWAYS need permission (cannot be overridden locally)
+   *
+   * @param toolName - The tool being checked
+   * @param options.isSandboxed - If true, the command will run inside the OS-level sandbox.
+   *   In auto-allow mode, sandboxed bash_execute commands skip the permission prompt
+   *   because the sandbox provides the security boundary.
    */
-  needsPermission(toolName) {
+  needsPermission(toolName, options) {
     const categoryMap = Object.fromEntries(this.customCategories);
     const category = getToolCategory(toolName, categoryMap);
     if (this.deniedTools.has(toolName)) {
@@ -12076,6 +12368,12 @@ var PermissionManager = class {
     if (category === "auto_approve") {
       return false;
     }
+    if (options?.isSandboxed && toolName === "bash_execute" && this.isSandboxAutoAllow()) {
+      return false;
+    }
+    if (this.sessionTrustedTools.has(toolName)) {
+      return false;
+    }
     if (category === "prompt_always") {
       return true;
     }
@@ -12143,6 +12441,29 @@ var PermissionManager = class {
   getDeniedTools() {
     return Array.from(this.deniedTools).sort();
   }
+  /**
+   * Trust a tool for the current session only (in-memory, no persistence)
+   * Works for all tool categories including prompt_always, but NOT project-denied tools
+   */
+  trustToolForSession(toolName) {
+    if (this.deniedTools.has(toolName)) {
+      return false;
+    }
+    this.sessionTrustedTools.add(toolName);
+    return true;
+  }
+  /**
+   * Check if a tool is trusted for the current session
+   */
+  isSessionTrusted(toolName) {
+    return this.sessionTrustedTools.has(toolName);
+  }
+  /**
+   * Clear all session-scoped trust (called on exit or session reset)
+   */
+  clearSessionTrust() {
+    this.sessionTrustedTools.clear();
+  }
   /**
    * Clear all trusted tools
    */
@@ -12180,7 +12501,7 @@ function getEnvironmentName(configApiConfig) {
 
 // src/utils/contextLoader.ts
 import * as fs11 from "fs";
-import * as path13 from "path";
+import * as path15 from "path";
 import { homedir as homedir3 } from "os";
 var CONTEXT_FILE_SIZE_LIMIT = 100 * 1024;
 var PROJECT_CONTEXT_FILES = [
@@ -12201,7 +12522,7 @@ function formatFileSize2(bytes) {
   return `${(bytes / (1024 * 1024)).toFixed(1)}MB`;
 }
 function tryReadContextFile(dir, filename, source) {
-  const filePath = path13.join(dir, filename);
+  const filePath = path15.join(dir, filename);
   try {
     const stats = fs11.lstatSync(filePath);
     if (stats.isDirectory()) {
@@ -12269,7 +12590,7 @@ ${project.content}`;
 }
 async function loadContextFiles(projectDir) {
   const errors = [];
-  const globalDir = path13.join(homedir3(), ".bike4mind");
+  const globalDir = path15.join(homedir3(), ".bike4mind");
   const projectDirectory = projectDir || process.cwd();
   const [globalResult, projectResult] = await Promise.all([
     Promise.resolve(findContextFile(globalDir, GLOBAL_CONTEXT_FILES, "global")),
@@ -12540,8 +12861,8 @@ function substituteArguments(template, args) {
 // ../../b4m-core/packages/mcp/dist/src/client.js
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { Client as Client2 } from "@modelcontextprotocol/sdk/client/index.js";
-import path14 from "path";
-import { existsSync as existsSync8, readdirSync as readdirSync3 } from "fs";
+import path16 from "path";
+import { existsSync as existsSync9, readdirSync as readdirSync3 } from "fs";
 var MCPClient = class {
   // Note: This class handles MCP server communication with repository filtering
   mcp;
@@ -12582,18 +12903,18 @@ var MCPClient = class {
         const root = process.env.INIT_CWD || process.cwd();
         const candidatePaths = [
           // When running from SST Lambda with node_modules structure (copyFiles)
-          path14.join(root, `node_modules/@bike4mind/mcp/dist/src/${this.serverName}/index.js`),
+          path16.join(root, `node_modules/@bike4mind/mcp/dist/src/${this.serverName}/index.js`),
           // When running from SST Lambda deployed environment (/var/task)
-          path14.join(root, `b4m-core/packages/mcp/dist/src/${this.serverName}/index.js`),
+          path16.join(root, `b4m-core/packages/mcp/dist/src/${this.serverName}/index.js`),
           // When running from SST Lambda (.sst/artifacts/mcpHandler-dev), navigate to monorepo root (3 levels up)
-          path14.join(root, `../../../b4m-core/packages/mcp/dist/src/${this.serverName}/index.js`),
+          path16.join(root, `../../../b4m-core/packages/mcp/dist/src/${this.serverName}/index.js`),
           // When running from packages/client (Next.js app), navigate to monorepo root (2 levels up)
-          path14.join(root, `../../b4m-core/packages/mcp/dist/src/${this.serverName}/index.js`),
+          path16.join(root, `../../b4m-core/packages/mcp/dist/src/${this.serverName}/index.js`),
           // Original paths (backward compatibility)
-          path14.join(root, `/b4m-core/packages/mcp/dist/src/${this.serverName}/index.js`),
-          path14.join(root, "core", "mcp", "servers", this.serverName, "dist", "index.js")
+          path16.join(root, `/b4m-core/packages/mcp/dist/src/${this.serverName}/index.js`),
+          path16.join(root, "core", "mcp", "servers", this.serverName, "dist", "index.js")
         ];
-        const serverScriptPath = candidatePaths.find((p) => existsSync8(p));
+        const serverScriptPath = candidatePaths.find((p) => existsSync9(p));
         if (!serverScriptPath) {
           const getDirectories = (source) => readdirSync3(source, { withFileTypes: true }).filter((dirent) => dirent.isDirectory()).map((dirent) => dirent.name);
           console.error(`[MCP] Server script not found. Tried paths:`, candidatePaths);
@@ -13153,6 +13474,14 @@ ${totalText}`);
 function stripThinkingBlocks(text) {
   return text.replace(/<think>[\s\S]*?<\/think>/g, "").trim();
 }
+function extractUsageInfo(parsed) {
+  return {
+    inputTokens: parsed.usage?.inputTokens,
+    outputTokens: parsed.usage?.outputTokens,
+    creditsUsed: parsed.credits?.used,
+    usdCost: parsed.credits?.usdCost
+  };
+}
 var ServerLlmBackend = class {
   constructor(options) {
     this.completionsEndpoint = "/api/ai/v1/completions";
@@ -13304,11 +13633,8 @@ var ServerLlmBackend = class {
             if (parsed.type === "content") {
               const textChunk = parsed.text || "";
               accumulatedText += textChunk;
-              if (parsed.usage) {
-                lastUsageInfo = {
-                  inputTokens: parsed.usage.inputTokens,
-                  outputTokens: parsed.usage.outputTokens
-                };
+              if (parsed.usage || parsed.credits) {
+                lastUsageInfo = extractUsageInfo(parsed);
               }
               streamLogger.onContent(eventCount, textChunk, accumulatedText);
             } else if (parsed.type === "tool_use") {
@@ -13335,11 +13661,8 @@ var ServerLlmBackend = class {
                 thinkingBlocks = parsed.thinking;
                 streamLogger.onCriticalEvent(eventCount, "THINKING", `${thinkingBlocks.length} thinking blocks`);
               }
-              if (parsed.usage) {
-                lastUsageInfo = {
-                  inputTokens: parsed.usage.inputTokens,
-                  outputTokens: parsed.usage.outputTokens
-                };
+              if (parsed.usage || parsed.credits) {
+                lastUsageInfo = extractUsageInfo(parsed);
               }
             }
           } catch (parseError) {
@@ -13473,173 +13796,6 @@ var ServerLlmBackend = class {
   }
 };
 
-// src/llm/WebSocketLlmBackend.ts
-import { v4 as uuidv411 } from "uuid";
-function stripThinkingBlocks2(text) {
-  return text.replace(/<think>[\s\S]*?<\/think>/g, "").trim();
-}
-var WebSocketLlmBackend = class {
-  constructor(options) {
-    this.wsManager = options.wsManager;
-    this.apiClient = options.apiClient;
-    this.currentModel = options.model;
-    this.tokenGetter = options.tokenGetter;
-    this.wsCompletionUrl = options.wsCompletionUrl;
-  }
-  /**
-   * Send completion request via HTTP POST, receive streaming response via WebSocket.
-   * Collects all streamed chunks, then calls callback once at completion
-   * with the full accumulated content.
-   */
-  async complete(model, messages, options, callback) {
-    logger.debug(`[WebSocketLlmBackend] Starting complete() with model: ${model}`);
-    if (options.abortSignal?.aborted) {
-      logger.debug("[WebSocketLlmBackend] Request aborted before start");
-      return;
-    }
-    if (!this.wsManager.isConnected) {
-      throw new Error("WebSocket is not connected");
-    }
-    const requestId = uuidv411();
-    return new Promise((resolve3, reject) => {
-      const isVerbose = process.env.B4M_VERBOSE === "1";
-      const isUltraVerbose = process.env.B4M_DEBUG_STREAM === "1";
-      const streamLogger = new StreamLogger(logger, "WebSocketLlmBackend", isVerbose, isUltraVerbose);
-      streamLogger.streamStart();
-      let eventCount = 0;
-      let accumulatedText = "";
-      let lastUsageInfo = {};
-      let toolsUsed = [];
-      let thinkingBlocks = [];
-      let settled = false;
-      const settle = (action) => {
-        if (settled) return;
-        settled = true;
-        this.wsManager.offRequest(requestId);
-        this.wsManager.offDisconnect(onDisconnect);
-        action();
-      };
-      const settleResolve = () => settle(() => resolve3());
-      const settleReject = (err) => settle(() => reject(err));
-      const onDisconnect = () => {
-        logger.debug("[WebSocketLlmBackend] Connection dropped during completion");
-        settleReject(new Error("WebSocket connection lost during completion"));
-      };
-      this.wsManager.onDisconnect(onDisconnect);
-      if (options.abortSignal) {
-        if (options.abortSignal.aborted) {
-          settleResolve();
-          return;
-        }
-        options.abortSignal.addEventListener(
-          "abort",
-          () => {
-            logger.debug("[WebSocketLlmBackend] Abort signal received");
-            settleResolve();
-          },
-          { once: true }
-        );
-      }
-      const updateUsage = (usage) => {
-        if (usage) {
-          lastUsageInfo = { inputTokens: usage.inputTokens, outputTokens: usage.outputTokens };
-        }
-      };
-      this.wsManager.onRequest(requestId, (message) => {
-        if (options.abortSignal?.aborted) return;
-        const action = message.action;
-        if (action === "cli_completion_chunk") {
-          eventCount++;
-          const chunk = message.chunk;
-          streamLogger.onEvent(eventCount, JSON.stringify(chunk));
-          const textChunk = chunk.text || "";
-          if (textChunk) accumulatedText += textChunk;
-          updateUsage(chunk.usage);
-          if (chunk.type === "content") {
-            streamLogger.onContent(eventCount, textChunk, accumulatedText);
-          } else if (chunk.type === "tool_use") {
-            streamLogger.onCriticalEvent(eventCount, "TOOL_USE", `tools: ${chunk.tools?.length}`);
-            if (chunk.tools && chunk.tools.length > 0) toolsUsed = chunk.tools;
-            if (chunk.thinking && chunk.thinking.length > 0) thinkingBlocks = chunk.thinking;
-          }
-        } else if (action === "cli_completion_done") {
-          streamLogger.streamComplete(accumulatedText);
-          const cleanedText = stripThinkingBlocks2(accumulatedText);
-          if (!cleanedText && toolsUsed.length === 0) {
-            settleResolve();
-            return;
-          }
-          const info = {
-            ...lastUsageInfo,
-            ...toolsUsed.length > 0 && { toolsUsed },
-            ...thinkingBlocks.length > 0 && { thinking: thinkingBlocks }
-          };
-          callback([cleanedText], info).then(() => settleResolve()).catch((err) => settleReject(err));
-        } else if (action === "cli_completion_error") {
-          const errorMsg = message.error || "Server error";
-          streamLogger.onCriticalEvent(eventCount, "ERROR", errorMsg);
-          settleReject(new Error(errorMsg));
-        }
-      });
-      const axiosInstance = this.apiClient.getAxiosInstance();
-      axiosInstance.post(
-        this.wsCompletionUrl,
-        {
-          requestId,
-          model,
-          messages,
-          options: {
-            temperature: options.temperature,
-            maxTokens: options.maxTokens,
-            stream: true,
-            tools: options.tools || []
-          }
-        },
-        { signal: options.abortSignal }
-      ).catch((err) => {
-        const msg = err instanceof Error ? err.message : String(err);
-        settleReject(new Error(`HTTP request failed: ${msg}`));
-      });
-    });
-  }
-  /**
-   * Get available models from server (REST call, not streaming).
-   * Delegates to ApiClient -- same as ServerLlmBackend.
-   */
-  async getModelInfo() {
-    try {
-      logger.debug("[WebSocketLlmBackend] Fetching models from /api/models");
-      const response = await this.apiClient.get("/api/models");
-      if (!response || typeof response !== "object" || !Array.isArray(response.models)) {
-        logger.warn("[WebSocketLlmBackend] Invalid API response format, using fallback models");
-        return this.getFallbackModels();
-      }
-      const filteredModels = response.models.filter(
-        (model) => model.type === "text" && model.supportsTools === true
-      );
-      if (filteredModels.length === 0) {
-        logger.warn("[WebSocketLlmBackend] No CLI-compatible models found, using fallback");
-        return this.getFallbackModels();
-      }
-      logger.debug(`[WebSocketLlmBackend] Loaded ${filteredModels.length} models`);
-      return filteredModels;
-    } catch (error) {
-      logger.warn(
-        `[WebSocketLlmBackend] Failed to fetch models: ${error instanceof Error ? error.message : String(error)}`
-      );
-      return this.getFallbackModels();
-    }
-  }
-  getFallbackModels() {
-    return [
-      { id: "claude-sonnet-4-5-20250929", name: "Claude 4.5 Sonnet" },
-      { id: "claude-3-5-haiku-20241022", name: "Claude 3.5 Haiku" },
-      { id: "gpt-4o", name: "GPT-4o" },
-      { id: "gpt-4o-mini", name: "GPT-4o Mini" }
-    ];
-  }
-};
-
 // src/llm/NotifyingLlmBackend.ts
 var NotifyingLlmBackend = class {
   constructor(inner, backgroundManager) {
@@ -13674,253 +13830,6 @@ Please acknowledge these background agent results and incorporate them into your
   }
 };
 
-// src/ws/WebSocketConnectionManager.ts
-var WebSocketConnectionManager = class {
-  constructor(wsUrl, getToken) {
-    this.ws = null;
-    this.heartbeatInterval = null;
-    this.reconnectAttempts = 0;
-    this.maxReconnectDelay = 3e4;
-    this.handlers = /* @__PURE__ */ new Map();
-    this.disconnectHandlers = /* @__PURE__ */ new Set();
-    this.reconnectTimer = null;
-    this.connected = false;
-    this.connecting = false;
-    this.closed = false;
-    this.wsUrl = wsUrl;
-    this.getToken = getToken;
-  }
-  /**
-   * Connect to the WebSocket server.
-   * Resolves when connection is established, rejects on failure.
-   */
-  async connect() {
-    if (this.connected || this.connecting) return;
-    this.connecting = true;
-    const token = await this.getToken();
-    if (!token) {
-      this.connecting = false;
-      throw new Error("No access token available for WebSocket connection");
-    }
-    return new Promise((resolve3, reject) => {
-      logger.debug(`[WS] Connecting to ${this.wsUrl}...`);
-      this.ws = new WebSocket(this.wsUrl, [`access_token.${token}`]);
-      this.ws.onopen = () => {
-        logger.debug("[WS] Connected");
-        this.connected = true;
-        this.connecting = false;
-        this.reconnectAttempts = 0;
-        this.startHeartbeat();
-        resolve3();
-      };
-      this.ws.onmessage = (event) => {
-        try {
-          const data = typeof event.data === "string" ? event.data : event.data.toString();
-          const message = JSON.parse(data);
-          const requestId = message.requestId;
-          if (requestId && this.handlers.has(requestId)) {
-            this.handlers.get(requestId)(message);
-          } else {
-            logger.debug(`[WS] Unhandled message: ${message.action || "unknown"}`);
-          }
-        } catch (err) {
-          logger.debug(`[WS] Failed to parse message: ${err}`);
-        }
-      };
-      this.ws.onclose = () => {
-        logger.debug("[WS] Connection closed");
-        this.cleanup();
-        this.notifyDisconnect();
-        if (!this.closed) {
-          this.scheduleReconnect();
-        }
-      };
-      this.ws.onerror = (err) => {
-        logger.debug(`[WS] Error: ${err}`);
-        if (this.connecting) {
-          this.connecting = false;
-          this.connected = false;
-          reject(new Error("WebSocket connection failed"));
-        }
-      };
-    });
-  }
-  /** Whether the connection is currently established */
-  get isConnected() {
-    return this.connected;
-  }
-  /**
-   * Send a JSON message over the WebSocket connection.
-   */
-  send(data) {
-    if (!this.ws || this.ws.readyState !== WebSocket.OPEN) {
-      throw new Error("WebSocket is not connected");
-    }
-    const payload = JSON.stringify(data);
-    const sizeKB = (payload.length / 1024).toFixed(1);
-    logger.debug(`[WS] Sending ${sizeKB} KB (action: ${data.action})`);
-    if (payload.length > 32e3) {
-      logger.warn(`[WS] Payload ${sizeKB} KB exceeds API Gateway 32 KB frame limit \u2014 connection will be closed`);
-    }
-    this.ws.send(payload);
-  }
-  /**
-   * Register a handler for messages matching a specific requestId.
-   */
-  onRequest(requestId, handler) {
-    this.handlers.set(requestId, handler);
-  }
-  /**
-   * Remove a handler for a specific requestId.
-   */
-  offRequest(requestId) {
-    this.handlers.delete(requestId);
-  }
-  /**
-   * Register a handler that fires when the connection drops.
-   */
-  onDisconnect(handler) {
-    this.disconnectHandlers.add(handler);
-  }
-  /**
-   * Remove a disconnect handler.
-   */
-  offDisconnect(handler) {
-    this.disconnectHandlers.delete(handler);
-  }
-  /**
-   * Close the connection and stop all heartbeat/reconnect logic.
-   */
-  disconnect() {
-    this.closed = true;
-    this.cleanup();
-    if (this.ws) {
-      this.ws.close();
-      this.ws = null;
-    }
-    this.handlers.clear();
-    this.disconnectHandlers.clear();
-  }
-  startHeartbeat() {
-    this.stopHeartbeat();
-    this.heartbeatInterval = setInterval(
-      () => {
-        if (this.ws && this.ws.readyState === WebSocket.OPEN) {
-          this.ws.send(JSON.stringify({ action: "heartbeat" }));
-          logger.debug("[WS] Heartbeat sent");
-        }
-      },
-      5 * 60 * 1e3
-    );
-  }
-  stopHeartbeat() {
-    if (this.heartbeatInterval) {
-      clearInterval(this.heartbeatInterval);
-      this.heartbeatInterval = null;
-    }
-  }
-  cleanup() {
-    this.connected = false;
-    this.connecting = false;
-    this.stopHeartbeat();
-    if (this.reconnectTimer) {
-      clearTimeout(this.reconnectTimer);
-      this.reconnectTimer = null;
-    }
-  }
-  notifyDisconnect() {
-    for (const handler of this.disconnectHandlers) {
-      try {
-        handler();
-      } catch {
-      }
-    }
-  }
-  scheduleReconnect() {
-    if (this.closed) return;
-    this.reconnectAttempts++;
-    const delay = Math.min(1e3 * Math.pow(2, this.reconnectAttempts - 1), this.maxReconnectDelay);
-    logger.debug(`[WS] Reconnecting in ${delay}ms (attempt ${this.reconnectAttempts})`);
-    this.reconnectTimer = setTimeout(async () => {
-      this.reconnectTimer = null;
-      if (this.closed) return;
-      try {
-        await this.connect();
-      } catch {
-        logger.debug("[WS] Reconnection failed");
-      }
-    }, delay);
-  }
-};
-
-// src/ws/WebSocketToolExecutor.ts
-import { v4 as uuidv412 } from "uuid";
-var WebSocketToolExecutor = class {
-  constructor(wsManager, tokenGetter) {
-    this.wsManager = wsManager;
-    this.tokenGetter = tokenGetter;
-  }
-  /**
-   * Execute a server-side tool via WebSocket.
-   * Returns the tool result or throws on error.
-   */
-  async execute(toolName, input, abortSignal) {
-    if (!this.wsManager.isConnected) {
-      throw new Error("WebSocket is not connected");
-    }
-    const token = await this.tokenGetter();
-    if (!token) {
-      throw new Error("No access token available");
-    }
-    const requestId = uuidv412();
-    return new Promise((resolve3, reject) => {
-      let settled = false;
-      const settle = (action) => {
-        if (settled) return;
-        settled = true;
-        this.wsManager.offRequest(requestId);
-        this.wsManager.offDisconnect(onDisconnect);
-        action();
-      };
-      const settleResolve = (result) => settle(() => resolve3(result));
-      const settleReject = (err) => settle(() => reject(err));
-      const onDisconnect = () => {
-        settleReject(new Error("WebSocket connection lost during tool execution"));
-      };
-      this.wsManager.onDisconnect(onDisconnect);
-      if (abortSignal) {
-        if (abortSignal.aborted) {
-          settleReject(new Error("Tool execution aborted"));
-          return;
-        }
-        abortSignal.addEventListener("abort", () => settleReject(new Error("Tool execution aborted")), {
-          once: true
-        });
-      }
-      this.wsManager.onRequest(requestId, (message) => {
-        if (message.action === "cli_tool_response") {
-          settleResolve({
-            success: message.success,
-            content: message.content,
-            error: message.error
-          });
-        }
-      });
-      try {
-        this.wsManager.send({
-          action: "cli_tool_request",
-          accessToken: token,
-          requestId,
-          toolName,
-          input
-        });
-      } catch (err) {
-        settleReject(err instanceof Error ? err : new Error(String(err)));
-      }
-    });
-  }
-};
-
 // src/auth/ApiClient.ts
 import axios11 from "axios";
 var ApiClient = class {
@@ -14058,7 +13967,7 @@ import { isAxiosError as isAxiosError2 } from "axios";
 // package.json
 var package_default = {
   name: "@bike4mind/cli",
-  version: "0.2.29-feat-cli-websocket-streaming.18881+1cfcea5f6",
+  version: "0.2.29-feat-cli-sandbox.18927+ef8f5870a",
   type: "module",
   description: "Interactive CLI tool for Bike4Mind with ReAct agents",
   license: "UNLICENSED",
@@ -14129,10 +14038,13 @@ var package_default = {
     diff: "^8.0.2",
     dotenv: "^16.3.1",
     "eventsource-parser": "^3.0.6",
+    fdir: "^6.5.0",
     "file-type": "^18.7.0",
     "fuse.js": "^7.1.0",
+    fzf: "^0.5.2",
     glob: "^13.0.0",
     "gray-matter": "^4.0.3",
+    ignore: "^7.0.5",
     ink: "^6.5.1",
     "ink-select-input": "^6.2.0",
     "ink-spinner": "^5.0.0",
@@ -14148,6 +14060,7 @@ var package_default = {
     open: "^11.0.0",
     openai: "^6.18.0",
     "p-limit": "^6.2.0",
+    picomatch: "^4.0.3",
     qrcode: "^1.5.4",
     react: "^19.2.3",
     sharp: "^0.34.5",
@@ -14168,14 +14081,15 @@ var package_default = {
   },
   devDependencies: {
     "@bike4mind/agents": "0.1.0",
-    "@bike4mind/common": "2.50.1-feat-cli-websocket-streaming.18881+1cfcea5f6",
-    "@bike4mind/mcp": "1.29.1-feat-cli-websocket-streaming.18881+1cfcea5f6",
-    "@bike4mind/services": "2.48.1-feat-cli-websocket-streaming.18881+1cfcea5f6",
-    "@bike4mind/utils": "2.5.1-feat-cli-websocket-streaming.18881+1cfcea5f6",
+    "@bike4mind/common": "2.50.1-feat-cli-sandbox.18927+ef8f5870a",
+    "@bike4mind/mcp": "1.29.1-feat-cli-sandbox.18927+ef8f5870a",
+    "@bike4mind/services": "2.48.1-feat-cli-sandbox.18927+ef8f5870a",
+    "@bike4mind/utils": "2.5.1-feat-cli-sandbox.18927+ef8f5870a",
     "@types/better-sqlite3": "^7.6.13",
     "@types/diff": "^5.0.9",
     "@types/jsonwebtoken": "^9.0.4",
     "@types/node": "^22.9.0",
+    "@types/picomatch": "^4.0.2",
     "@types/react": "^19.2.7",
     "@types/uuid": "^9.0.7",
     "@types/yargs": "^17.0.32",
@@ -14188,7 +14102,7 @@ var package_default = {
   optionalDependencies: {
     "@vscode/ripgrep": "^1.17.0"
   },
-  gitHead: "1cfcea5f6e4c3d36587681e0d276669b66cdcc4e"
+  gitHead: "ef8f5870abfa559f03d5af462d888986a7b6cd31"
 };
 
 // src/config/constants.ts
@@ -14638,7 +14552,7 @@ var SubagentOrchestrator = class {
 
 // src/agents/AgentStore.ts
 import fs12 from "fs/promises";
-import path15 from "path";
+import path17 from "path";
 import os2 from "os";
 import matter2 from "gray-matter";
 var FULL_MODEL_ID_PREFIXES = [
@@ -14787,10 +14701,10 @@ var AgentStore = class {
     const root = projectRoot || process.cwd();
     const home = os2.homedir();
     this.builtinAgentsDir = builtinDir;
-    this.globalB4MAgentsDir = path15.join(home, ".bike4mind", "agents");
-    this.globalClaudeAgentsDir = path15.join(home, ".claude", "agents");
-    this.projectB4MAgentsDir = path15.join(root, ".bike4mind", "agents");
-    this.projectClaudeAgentsDir = path15.join(root, ".claude", "agents");
+    this.globalB4MAgentsDir = path17.join(home, ".bike4mind", "agents");
+    this.globalClaudeAgentsDir = path17.join(home, ".claude", "agents");
+    this.projectB4MAgentsDir = path17.join(root, ".bike4mind", "agents");
+    this.projectClaudeAgentsDir = path17.join(root, ".claude", "agents");
   }
   /**
    * Load all agents from all directories
@@ -14844,7 +14758,7 @@ var AgentStore = class {
     try {
       const entries = await fs12.readdir(directory, { withFileTypes: true });
       for (const entry of entries) {
-        const fullPath = path15.join(directory, entry.name);
+        const fullPath = path17.join(directory, entry.name);
         if (entry.isDirectory()) {
           const subFiles = await this.findAgentFiles(fullPath);
           files.push(...subFiles);
@@ -14864,7 +14778,7 @@ var AgentStore = class {
     const content = await fs12.readFile(filePath, "utf-8");
     const { data: frontmatter, content: body } = matter2(content);
     const parsed = AgentFrontmatterSchema.parse(frontmatter);
-    const name = path15.basename(filePath, ".md");
+    const name = path17.basename(filePath, ".md");
     const modelInput = parsed.model || DEFAULT_AGENT_MODEL;
     const resolution = resolveModelAlias(modelInput, name, filePath);
     if (!resolution.resolved && resolution.warning) {
@@ -14944,7 +14858,7 @@ var AgentStore = class {
    */
   async createAgentFile(name, isGlobal = false, useClaude = true) {
     const targetDir = isGlobal ? useClaude ? this.globalClaudeAgentsDir : this.globalB4MAgentsDir : useClaude ? this.projectClaudeAgentsDir : this.projectB4MAgentsDir;
-    const filePath = path15.join(targetDir, `${name}.md`);
+    const filePath = path17.join(targetDir, `${name}.md`);
     try {
       await fs12.access(filePath);
       throw new Error(`Agent file already exists: ${filePath}`);
@@ -15641,7 +15555,7 @@ function createTodoStore(onUpdate) {
 
 // src/tools/findDefinitionTool.ts
 import { stat as stat3 } from "fs/promises";
-import path16 from "path";
+import path18 from "path";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
 import { createRequire as createRequire2 } from "module";
@@ -15662,8 +15576,8 @@ var ALL_KEYWORDS = Object.values(KIND_KEYWORDS).flat();
 function getRipgrepPath2() {
   try {
     const ripgrepPath = require3.resolve("@vscode/ripgrep");
-    const ripgrepDir = path16.dirname(ripgrepPath);
-    return path16.join(ripgrepDir, "..", "bin", "rg" + (process.platform === "win32" ? ".exe" : ""));
+    const ripgrepDir = path18.dirname(ripgrepPath);
+    return path18.join(ripgrepDir, "..", "bin", "rg" + (process.platform === "win32" ? ".exe" : ""));
   } catch {
     throw new Error(
       "ripgrep is not available. Please install @vscode/ripgrep: pnpm add @vscode/ripgrep --filter @bike4mind/services"
@@ -15671,10 +15585,10 @@ function getRipgrepPath2() {
   }
 }
 function isPathWithinWorkspace2(targetPath, baseCwd) {
-  const resolvedTarget = path16.resolve(targetPath);
-  const resolvedBase = path16.resolve(baseCwd);
-  const relativePath = path16.relative(resolvedBase, resolvedTarget);
-  return !relativePath.startsWith("..") && !path16.isAbsolute(relativePath);
+  const resolvedTarget = path18.resolve(targetPath);
+  const resolvedBase = path18.resolve(baseCwd);
+  const relativePath = path18.relative(resolvedBase, resolvedTarget);
+  return !relativePath.startsWith("..") && !path18.isAbsolute(relativePath);
 }
 function escapeRegex(str) {
   return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -15707,7 +15621,7 @@ async function findDefinitions(params) {
     throw new Error("symbol_name is required");
   }
   const baseCwd = process.cwd();
-  const targetDir = search_path ? path16.resolve(baseCwd, search_path) : baseCwd;
+  const targetDir = search_path ? path18.resolve(baseCwd, search_path) : baseCwd;
   if (!isPathWithinWorkspace2(targetDir, baseCwd)) {
     throw new Error(`Path validation failed: "${search_path}" resolves outside the allowed workspace directory`);
   }
@@ -15762,7 +15676,7 @@ async function findDefinitions(params) {
         const lineText = match.data.lines.text.trimEnd();
         if (isLikelyDefinition(lineText)) {
           allMatches.push({
-            filePath: path16.relative(targetDir, match.data.path.text) || path16.basename(match.data.path.text),
+            filePath: path18.relative(targetDir, match.data.path.text) || path18.basename(match.data.path.text),
             lineNumber: match.data.line_number,
             line: lineText
           });
@@ -15840,8 +15754,8 @@ function createFindDefinitionTool() {
 }
 
 // src/tools/getFileStructure/index.ts
-import { existsSync as existsSync9, promises as fs13, statSync as statSync6 } from "fs";
-import path17 from "path";
+import { existsSync as existsSync10, promises as fs13, statSync as statSync6 } from "fs";
+import path19 from "path";
 
 // src/tools/getFileStructure/formatter.ts
 var SECTIONS = [
@@ -15885,11 +15799,11 @@ function createGetFileStructureTool() {
       const params = value;
       try {
         const cwd = process.cwd();
-        const resolvedPath = path17.resolve(cwd, params.path);
+        const resolvedPath = path19.resolve(cwd, params.path);
         if (!resolvedPath.startsWith(cwd)) {
           return "Error: Access denied - cannot read files outside of current working directory";
         }
-        if (!existsSync9(resolvedPath)) {
+        if (!existsSync10(resolvedPath)) {
           return `Error: File not found: ${params.path}`;
         }
         const stats = statSync6(resolvedPath);
@@ -15899,7 +15813,7 @@ function createGetFileStructureTool() {
         if (stats.size > MAX_FILE_SIZE3) {
           return `Error: File too large (${(stats.size / 1024 / 1024).toFixed(2)}MB). Max: ${MAX_FILE_SIZE3 / 1024 / 1024}MB`;
         }
-        const ext = path17.extname(resolvedPath).toLowerCase();
+        const ext = path19.extname(resolvedPath).toLowerCase();
         const { getLanguageForExtension, parseFileStructure, getSupportedLanguages } = await import("./treeSitterEngine-4SGFQDY3.js");
         const languageId = getLanguageForExtension(ext);
         if (!languageId) {
@@ -15946,7 +15860,7 @@ var usageCache = null;
 function CliApp() {
   const { exit } = useApp();
   const imageRenderer = new ImageRenderer();
-  const [state, setState] = useState9({
+  const [state, setState] = useState10({
     session: null,
     sessionStore: new SessionStore(),
     configStore: new ConfigStore(),
@@ -15968,11 +15882,11 @@ function CliApp() {
     abortController: null,
     contextContent: "",
     backgroundManager: null,
-    wsManager: null
+    sandboxOrchestrator: null
   });
-  const [isInitialized, setIsInitialized] = useState9(false);
-  const [initError, setInitError] = useState9(null);
-  const [commandHistory, setCommandHistory] = useState9([]);
+  const [isInitialized, setIsInitialized] = useState10(false);
+  const [initError, setInitError] = useState10(null);
+  const [commandHistory, setCommandHistory] = useState10([]);
   const imageStoreInitPromise = useRef3(null);
   const setStoreSession = useCliStore((state2) => state2.setSession);
   const enqueuePermissionPrompt = useCliStore((state2) => state2.enqueuePermissionPrompt);
@@ -15996,10 +15910,6 @@ function CliApp() {
         })
       );
     }
-    if (state.wsManager) {
-      state.wsManager.disconnect();
-      setWebSocketToolExecutor(null);
-    }
     if (state.agent) {
       state.agent.removeAllListeners();
     }
@@ -16018,7 +15928,7 @@ function CliApp() {
     setTimeout(() => {
       process.exit(0);
     }, 100);
-  }, [state.session, state.sessionStore, state.mcpManager, state.agent, state.imageStore, state.wsManager]);
+  }, [state.session, state.sessionStore, state.mcpManager, state.agent, state.imageStore]);
   useInput9((input, key) => {
     if (key.escape) {
       if (state.abortController) {
@@ -16088,7 +15998,7 @@ function CliApp() {
       if (!isAuthenticated) {
         console.log("\u2139\uFE0F  AI features disabled. Available commands: /login, /help, /config\n");
         const minimalSession = {
-          id: uuidv413(),
+          id: uuidv411(),
           name: `Session ${(/* @__PURE__ */ new Date()).toLocaleString()}`,
           createdAt: (/* @__PURE__ */ new Date()).toISOString(),
           updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -16116,45 +16026,10 @@ function CliApp() {
         console.log(`\u{1F30D} API Environment: ${envName} (${apiBaseURL})`);
       }
       const apiClient = new ApiClient(apiBaseURL, state.configStore);
-      const tokenGetter = async () => {
-        const tokens = await state.configStore.getAuthTokens();
-        return tokens?.accessToken ?? null;
-      };
-      let wsManager = null;
-      let llm;
-      try {
-        const serverConfig = await apiClient.get(
-          "/api/settings/serverConfig"
-        );
-        const wsUrl = serverConfig?.websocketUrl;
-        const wsCompletionUrl = serverConfig?.wsCompletionUrl;
-        if (wsUrl && wsCompletionUrl) {
-          wsManager = new WebSocketConnectionManager(wsUrl, tokenGetter);
-          await wsManager.connect();
-          const wsToolExecutor2 = new WebSocketToolExecutor(wsManager, tokenGetter);
-          setWebSocketToolExecutor(wsToolExecutor2);
-          llm = new WebSocketLlmBackend({
-            wsManager,
-            apiClient,
-            model: config.defaultModel,
-            tokenGetter,
-            wsCompletionUrl
-          });
-          logger.debug("\u{1F50C} Using WebSocket transport (bypasses CloudFront timeout)");
-        } else {
-          throw new Error("No websocketUrl or wsCompletionUrl in server config");
-        }
-      } catch (wsError) {
-        logger.debug(
-          `[WS] WebSocket unavailable, using SSE fallback: ${wsError instanceof Error ? wsError.message : String(wsError)}`
-        );
-        wsManager = null;
-        setWebSocketToolExecutor(null);
-        llm = new ServerLlmBackend({
-          apiClient,
-          model: config.defaultModel
-        });
-      }
+      const llm = new ServerLlmBackend({
+        apiClient,
+        model: config.defaultModel
+      });
       const models = await llm.getModelInfo();
       if (models.length === 0) {
         throw new Error("No models available from server.");
@@ -16167,7 +16042,7 @@ function CliApp() {
       }
       llm.currentModel = modelInfo.id;
       const newSession = {
-        id: uuidv413(),
+        id: uuidv411(),
         name: `Session ${(/* @__PURE__ */ new Date()).toLocaleString()}`,
         createdAt: (/* @__PURE__ */ new Date()).toISOString(),
         updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -16204,6 +16079,52 @@ function CliApp() {
         config.tools.disabled || []
         // denied tools from project config
       );
+      const { createSandboxRuntime } = await import("./SandboxRuntimeAdapter-FQ56MAB2.js");
+      const { SandboxOrchestrator } = await import("./SandboxOrchestrator-MYBNKKWL.js");
+      const { DEFAULT_SANDBOX_CONFIG } = await import("./types-KB5NP6T4.js");
+      const { ProxyManager } = await import("./ProxyManager-4ZZEYTD6.js");
+      const sandboxRuntime = await createSandboxRuntime();
+      const sandboxConfig = config.sandbox ?? DEFAULT_SANDBOX_CONFIG;
+      const proxyManager = new ProxyManager(sandboxConfig.network);
+      const sandboxOrchestrator = new SandboxOrchestrator(sandboxConfig, sandboxRuntime, proxyManager);
+      proxyManager.onEvent((event) => {
+        if (event.type === "blocked") {
+          console.error(
+            `
+\x1B[41m\x1B[97m BLOCKED \x1B[0m \x1B[31mNetwork proxy denied connection to\x1B[0m \x1B[1m${event.domain}\x1B[0m \x1B[90m(${event.method})\x1B[0m`
+          );
+          console.error(`\x1B[90m  Tip: /sandbox:trust-domain ${event.domain}\x1B[0m
+`);
+          sandboxOrchestrator.recordViolation({
+            type: "network",
+            domain: event.domain,
+            command: `[network] ${event.method} ${event.domain}`,
+            blockedBy: "proxy",
+            timestamp: event.timestamp,
+            detail: `Blocked ${event.method} to ${event.domain}`
+          }).catch(() => {
+          });
+        }
+      });
+      const { ViolationLogStore } = await import("./ViolationLogStore-RIIUVURH.js");
+      const violationStore = new ViolationLogStore();
+      sandboxOrchestrator.setViolationStore(violationStore);
+      permissionManager.setSandboxState(sandboxConfig.mode, sandboxOrchestrator.isActive());
+      if (sandboxConfig.enabled && sandboxConfig.mode !== "disabled") {
+        if (sandboxRuntime) {
+          console.log(`\u{1F512} Sandbox: ${sandboxConfig.mode} (${sandboxRuntime.name})`);
+        } else {
+          console.log("\u26A0\uFE0F  Sandbox: enabled but runtime not available on this platform");
+        }
+        if (sandboxConfig.network.enabled) {
+          await proxyManager.start();
+          if (proxyManager.isRunning()) {
+            console.log(
+              `\u{1F310} Network proxy: filtering on port ${proxyManager.getPort()} (${sandboxConfig.network.allowedDomains.length} domains)`
+            );
+          }
+        }
+      }
       let permissionPromptCounter = 0;
       const promptFn = (toolName, args, preview) => {
         return new Promise((resolve3) => {
@@ -16229,7 +16150,10 @@ function CliApp() {
         promptFn,
         agentContext,
         state.configStore,
-        apiClient
+        apiClient,
+        void 0,
+        // toolFilter
+        sandboxOrchestrator
       );
       startupLog.push(`\u{1F6E0}\uFE0F Loaded ${b4mTools2.length} B4M tool(s)`);
       const mcpManager = new McpManager(config);
@@ -16383,8 +16307,8 @@ function CliApp() {
         // Store raw context for compact instructions
         backgroundManager,
         // Store for grouped notification turn tracking
-        wsManager
-        // WebSocket connection manager (null if using SSE fallback)
+        sandboxOrchestrator
+        // Store sandbox orchestrator for /sandbox commands
       }));
       setStoreSession(newSession);
       const bannerLines = [
@@ -16430,7 +16354,7 @@ function CliApp() {
     setStoreSession,
     setState
   ]);
-  useEffect6(() => {
+  useEffect7(() => {
     init();
   }, [init]);
   const handleCustomCommandMessage = async (fullTemplate, displayMessage) => {
@@ -16479,13 +16403,13 @@ function CliApp() {
         messageContent = multimodalMessage.content;
       }
       const userMessage = {
-        id: uuidv413(),
+        id: uuidv411(),
         role: "user",
         content: userMessageContent,
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       };
       const pendingAssistantMessage = {
-        id: uuidv413(),
+        id: uuidv411(),
         role: "assistant",
         content: "...",
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
@@ -16541,6 +16465,7 @@ function CliApp() {
             completion: 0,
             total: result.completionInfo.totalTokens
           },
+          creditsUsed: result.completionInfo.totalCredits,
           model: state.session.model,
           permissionDenied
         }
@@ -16552,6 +16477,7 @@ function CliApp() {
         metadata: {
           ...currentSession.metadata,
           totalTokens: currentSession.metadata.totalTokens + result.completionInfo.totalTokens,
+          totalCredits: (currentSession.metadata.totalCredits || 0) + (result.completionInfo.totalCredits || 0),
           toolCallCount: currentSession.metadata.toolCallCount + successfulToolCalls
         }
       };
@@ -16696,13 +16622,13 @@ function CliApp() {
         userMessageContent = message;
       }
       const userMessage = {
-        id: uuidv413(),
+        id: uuidv411(),
         role: "user",
         content: userMessageContent,
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       };
       const pendingAssistantMessage = {
-        id: uuidv413(),
+        id: uuidv411(),
         role: "assistant",
         content: "...",
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
@@ -16754,6 +16680,7 @@ function CliApp() {
             completion: 0,
             total: result.completionInfo.totalTokens
           },
+          creditsUsed: result.completionInfo.totalCredits,
           steps: result.steps.map(formatStep),
           // Complete history: thoughts, actions, observations
           permissionDenied
@@ -16767,6 +16694,7 @@ function CliApp() {
         metadata: {
           ...currentSession.metadata,
           totalTokens: currentSession.metadata.totalTokens + result.completionInfo.totalTokens,
+          totalCredits: (currentSession.metadata.totalCredits || 0) + (result.completionInfo.totalCredits || 0),
           toolCallCount: currentSession.metadata.toolCallCount + successfulToolCalls
         }
       };
@@ -16780,7 +16708,7 @@ function CliApp() {
         const currentSession = useCliStore.getState().session;
         if (currentSession) {
           const cancelMessage = {
-            id: uuidv413(),
+            id: uuidv411(),
             role: "assistant",
             content: "\u26A0\uFE0F Operation cancelled by user",
             timestamp: (/* @__PURE__ */ new Date()).toISOString(),
@@ -16825,7 +16753,7 @@ function CliApp() {
     setState((prev) => ({ ...prev, abortController }));
     try {
       const pendingAssistantMessage = {
-        id: uuidv413(),
+        id: uuidv411(),
         role: "assistant",
         content: "...",
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
@@ -16853,7 +16781,7 @@ function CliApp() {
       const currentSession = useCliStore.getState().session;
       if (!currentSession) return;
       const continuationMessage = {
-        id: uuidv413(),
+        id: uuidv411(),
         role: "assistant",
         content: "---\n\n**Background Agent Results:**\n\n" + result.finalAnswer,
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
@@ -16865,7 +16793,8 @@ function CliApp() {
             prompt: 0,
             completion: 0,
             total: result.completionInfo.totalTokens
-          }
+          },
+          creditsUsed: result.completionInfo.totalCredits
         }
       };
       const updatedSession = {
@@ -16875,6 +16804,7 @@ function CliApp() {
         metadata: {
           ...currentSession.metadata,
           totalTokens: currentSession.metadata.totalTokens + result.completionInfo.totalTokens,
+          totalCredits: (currentSession.metadata.totalCredits || 0) + (result.completionInfo.totalCredits || 0),
           toolCallCount: currentSession.metadata.toolCallCount + successfulToolCalls
         }
       };
@@ -16912,13 +16842,13 @@ function CliApp() {
         isError = true;
       }
       const userMessage = {
-        id: uuidv413(),
+        id: uuidv411(),
         role: "user",
         content: `$ ${command}`,
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       };
       const assistantMessage = {
-        id: uuidv413(),
+        id: uuidv411(),
         role: "assistant",
         content: isError ? `\u274C Error:
 ${output}` : output.trim() || "(no output)",
@@ -17387,7 +17317,7 @@ Keyboard Shortcuts:
         console.clear();
         const model = state.session?.model || state.config?.defaultModel || "claude-sonnet";
         const newSession = {
-          id: uuidv413(),
+          id: uuidv411(),
           name: `Session ${(/* @__PURE__ */ new Date()).toLocaleString()}`,
           createdAt: (/* @__PURE__ */ new Date()).toISOString(),
           updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -17868,6 +17798,201 @@ No usage data available for the last ${USAGE_DAYS} days.`);
         }
         break;
       }
+      // --- Sandbox commands ---
+      case "sandbox": {
+        if (!state.sandboxOrchestrator) {
+          console.log("\nSandbox: Not initialized");
+          break;
+        }
+        const status = state.sandboxOrchestrator.getStatus();
+        console.log("\nSandbox Status:");
+        console.log(`  Enabled:   ${status.enabled ? "Yes" : "No"}`);
+        console.log(`  Mode:      ${status.mode}`);
+        console.log(`  Platform:  ${status.platform ?? "N/A"}`);
+        console.log(`  Runtime:   ${status.runtimeName ?? "N/A"}`);
+        console.log(`  Available: ${status.runtimeAvailable ? "Yes" : "No"}`);
+        console.log("");
+        console.log("Filesystem Config:");
+        console.log(`  Write only to CWD: ${status.config.filesystem.writeOnlyToWorkingDir}`);
+        console.log(`  Allowed reads: ${status.config.filesystem.allowedReadPaths.join(", ") || "(none)"}`);
+        console.log(`  Denied paths:  ${status.config.filesystem.deniedPaths.join(", ") || "(none)"}`);
+        console.log(`  Excluded cmds: ${status.config.excludedCommands.join(", ") || "(none)"}`);
+        console.log("");
+        console.log("Network Filtering:");
+        console.log(`  Enabled:  ${status.config.network.enabled ? "Yes" : "No"}`);
+        console.log(`  Proxy:    ${status.proxyRunning ? `running on port ${status.proxyPort}` : "stopped"}`);
+        console.log(`  Domains:  ${status.config.network.allowedDomains.length} allowed`);
+        console.log("");
+        if (status.stats) {
+          const total = status.stats.sandboxed + status.stats.unsandboxed + status.stats.blocked;
+          console.log("Session Stats:");
+          console.log(`  Total commands: ${total}`);
+          console.log(`  Sandboxed:     ${status.stats.sandboxed}`);
+          console.log(`  Unsandboxed:   ${status.stats.unsandboxed}`);
+          console.log(`  Blocked:       ${status.stats.blocked}`);
+          console.log(`  Violations:    ${status.stats.violations}`);
+          console.log("");
+        }
+        break;
+      }
+      case "sandbox:enable": {
+        if (!state.sandboxOrchestrator) {
+          console.log("Sandbox not initialized");
+          break;
+        }
+        if (!state.sandboxOrchestrator.isAvailable()) {
+          console.log("Sandbox runtime not available on this platform");
+          break;
+        }
+        state.sandboxOrchestrator.setMode("auto-allow");
+        state.permissionManager?.setSandboxState("auto-allow", state.sandboxOrchestrator.isActive());
+        const sandboxCfg = state.sandboxOrchestrator.getConfig();
+        if (sandboxCfg.network.enabled) {
+          await state.sandboxOrchestrator.startProxy();
+          const pm = state.sandboxOrchestrator.getProxyManager();
+          if (pm?.isRunning()) {
+            console.log(`\u{1F310} Network proxy started on port ${pm.getPort()}`);
+          }
+        }
+        const config = await state.configStore.get();
+        await state.configStore.save({
+          ...config,
+          sandbox: { ...state.sandboxOrchestrator.getConfig() }
+        });
+        console.log("Sandbox enabled (auto-allow mode)");
+        break;
+      }
+      case "sandbox:disable": {
+        if (!state.sandboxOrchestrator) {
+          console.log("Sandbox not initialized");
+          break;
+        }
+        await state.sandboxOrchestrator.stopProxy();
+        state.sandboxOrchestrator.setMode("disabled");
+        state.permissionManager?.setSandboxState("disabled", false);
+        const disableConfig = await state.configStore.get();
+        await state.configStore.save({
+          ...disableConfig,
+          sandbox: { ...state.sandboxOrchestrator.getConfig() }
+        });
+        console.log("Sandbox disabled");
+        break;
+      }
+      case "sandbox:mode": {
+        if (!state.sandboxOrchestrator) {
+          console.log("Sandbox not initialized");
+          break;
+        }
+        const modeArg = args[0];
+        if (modeArg !== "auto-allow" && modeArg !== "permissions") {
+          console.log("Usage: /sandbox:mode <auto-allow|permissions>");
+          break;
+        }
+        if (!state.sandboxOrchestrator.isAvailable()) {
+          console.log("Sandbox runtime not available on this platform");
+          break;
+        }
+        state.sandboxOrchestrator.setMode(modeArg);
+        state.permissionManager?.setSandboxState(modeArg, state.sandboxOrchestrator.isActive());
+        const modeConfig = await state.configStore.get();
+        await state.configStore.save({
+          ...modeConfig,
+          sandbox: { ...state.sandboxOrchestrator.getConfig() }
+        });
+        console.log(`Sandbox mode set to: ${modeArg}`);
+        break;
+      }
+      case "sandbox:trust-domain": {
+        if (!state.sandboxOrchestrator) {
+          console.log("Sandbox not initialized");
+          break;
+        }
+        if (args.length === 0) {
+          console.log("Usage: /sandbox:trust-domain <domain> [...]");
+          break;
+        }
+        const proxyMgr = state.sandboxOrchestrator.getProxyManager();
+        if (!proxyMgr) {
+          console.log("Network proxy not initialized");
+          break;
+        }
+        for (const domain of args) {
+          proxyMgr.addAllowedDomain(domain);
+          console.log(`  Added: ${domain}`);
+        }
+        const trustDomainConfig = await state.configStore.get();
+        const currentSandboxConfig = state.sandboxOrchestrator.getConfig();
+        await state.configStore.save({
+          ...trustDomainConfig,
+          sandbox: {
+            ...currentSandboxConfig,
+            network: {
+              ...currentSandboxConfig.network,
+              allowedDomains: proxyMgr.getAllowedDomains()
+            }
+          }
+        });
+        console.log(`Trusted ${args.length} domain(s)`);
+        break;
+      }
+      case "sandbox:domains": {
+        if (!state.sandboxOrchestrator) {
+          console.log("Sandbox not initialized");
+          break;
+        }
+        const domainProxyMgr = state.sandboxOrchestrator.getProxyManager();
+        if (!domainProxyMgr) {
+          console.log("Network proxy not initialized");
+          break;
+        }
+        const domains = domainProxyMgr.getAllowedDomains().sort();
+        console.log(`
+Allowed domains (${domains.length}):`);
+        for (const d of domains) {
+          console.log(`  ${d}`);
+        }
+        console.log("");
+        break;
+      }
+      case "sandbox:violations": {
+        const vStore = state.sandboxOrchestrator?.getViolationStore();
+        if (!vStore) {
+          console.log("Violation tracking not initialized");
+          break;
+        }
+        const requestedCount = parseInt(args[0], 10);
+        const violations = await vStore.getRecent(Number.isNaN(requestedCount) ? 20 : requestedCount);
+        if (violations.length === 0) {
+          console.log("\nNo sandbox violations recorded.\n");
+          break;
+        }
+        console.log(`
+\x1B[1mRecent Sandbox Violations\x1B[0m (${violations.length}):
+`);
+        for (const v of violations) {
+          const time = new Date(v.timestamp).toLocaleTimeString();
+          const typeColor = v.type === "filesystem" ? "\x1B[33m" : "\x1B[36m";
+          const typeLabel = v.type === "filesystem" ? "FS " : "NET";
+          const target = v.path ?? v.domain ?? "";
+          console.log(`  ${typeColor}${typeLabel}\x1B[0m ${time} \x1B[90m${v.blockedBy}\x1B[0m ${target}`);
+          if (v.detail) {
+            console.log(`       \x1B[90m${v.detail.slice(0, 120)}\x1B[0m`);
+          }
+        }
+        console.log("");
+        break;
+      }
+      case "sandbox:violations:clear": {
+        const clearStore = state.sandboxOrchestrator?.getViolationStore();
+        if (!clearStore) {
+          console.log("Violation tracking not initialized");
+          break;
+        }
+        await clearStore.clear();
+        state.sandboxOrchestrator?.resetStats();
+        console.log("Violation log cleared.");
+        break;
+      }
       default:
         console.log(`Unknown command: /${command}`);
         console.log("Type /help for available commands");
@@ -17892,9 +18017,9 @@ No usage data available for the last ${USAGE_DAYS} days.`);
       return { ...prev, config: updatedConfig };
     });
     if (modelChanged && state.agent) {
-      const backend = state.agent.context.llm;
-      if (backend) {
-        backend.currentModel = updatedConfig.defaultModel;
+      const llm = state.agent.context.llm;
+      if (llm) {
+        llm.currentModel = updatedConfig.defaultModel;
       }
     }
   };
@@ -18018,6 +18143,7 @@ var isDevMode = import.meta.url.includes("/src/") || process.env.NODE_ENV === "d
 if (isDevMode) {
   logger.debug("\u{1F527} Running in development mode (using TypeScript source)\n");
 }
+warmFileCache();
 render(/* @__PURE__ */ React21.createElement(CliApp, null), {
   exitOnCtrlC: false
 });