@bike4mind/cli 0.2.30-subagent-delegation.19188 → 0.2.31-b4m-cli-undo-command.19493

package/dist/{chunk-FLA4PWXB.js → chunk-RI45VJW3.js}

@@ -7,6 +7,7 @@ import {
   ModelBackend,
   OpenAIEmbeddingModel,
   PermissionDeniedError,
+  REASONING_SUPPORTED_MODELS,
   SpeechToTextModels,
   SupportedFabFileMimeTypes,
   VIDEO_SIZE_CONSTRAINTS,
@@ -15,7 +16,7 @@ import {
   dayjsConfig_default,
   extractSnippetMeta,
   settingsMap
-} from "./chunk-ICLEQOH6.js";
+} from "./chunk-GE7Q64MS.js";
 import {
   Logger
 } from "./chunk-OCYRD7D6.js";
@@ -590,6 +591,125 @@ function getSettingsCacheStats() {
 // ../../b4m-core/packages/utils/dist/src/ingest.js
 import axios from "axios";
 import mime2 from "mime-types";
+
+// ../../b4m-core/packages/utils/dist/src/ssrfProtection.js
+import dns from "dns";
+import { promisify } from "util";
+var dnsResolve4 = promisify(dns.resolve4);
+var dnsResolve6 = promisify(dns.resolve6);
+function isPrivateIPv4(ip) {
+  const ipv4Match = ip.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (!ipv4Match)
+    return false;
+  const [, a, b, c] = ipv4Match.map(Number);
+  if (a === 10)
+    return true;
+  if (a === 172 && b >= 16 && b <= 31)
+    return true;
+  if (a === 192 && b === 168)
+    return true;
+  if (a === 127)
+    return true;
+  if (a === 169 && b === 254)
+    return true;
+  if (a === 0)
+    return true;
+  if (a === 100 && b >= 64 && b <= 127)
+    return true;
+  if (a === 192 && b === 0 && c === 0)
+    return true;
+  if (a === 192 && b === 0 && c === 2 || a === 198 && b === 51 && c === 100 || a === 203 && b === 0 && c === 113)
+    return true;
+  if (a >= 224 && a <= 239)
+    return true;
+  if (a >= 240)
+    return true;
+  return false;
+}
+function isPrivateIPv6(ip) {
+  const normalized = ip.toLowerCase();
+  if (normalized === "::1" || normalized === "0:0:0:0:0:0:0:1")
+    return true;
+  if (normalized === "::" || normalized === "0:0:0:0:0:0:0:0")
+    return true;
+  if (normalized.startsWith("fe8") || normalized.startsWith("fe9") || normalized.startsWith("fea") || normalized.startsWith("feb"))
+    return true;
+  if (normalized.startsWith("fc") || normalized.startsWith("fd"))
+    return true;
+  if (normalized.startsWith("ff"))
+    return true;
+  const ipv4MappedMatch = normalized.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
+  if (ipv4MappedMatch) {
+    return isPrivateIPv4(ipv4MappedMatch[1]);
+  }
+  if (normalized.startsWith("2001:db8:") || normalized.startsWith("2001:0db8:"))
+    return true;
+  if (normalized.startsWith("100::") || normalized.startsWith("0100::"))
+    return true;
+  if (normalized.startsWith("64:ff9b:") || normalized.startsWith("0064:ff9b:"))
+    return true;
+  return false;
+}
+function isPrivateIP(ip) {
+  if (/^(\d{1,3}\.){3}\d{1,3}$/.test(ip)) {
+    return isPrivateIPv4(ip);
+  }
+  return isPrivateIPv6(ip);
+}
+function isPrivateOrInternalHostname(hostname) {
+  const normalized = hostname.toLowerCase();
+  if (normalized === "localhost" || normalized === "127.0.0.1" || normalized === "::1" || normalized === "0.0.0.0" || normalized.endsWith(".localhost") || normalized.endsWith(".local")) {
+    return true;
+  }
+  if (normalized === "169.254.169.254" || normalized === "instance-data" || normalized === "metadata.google.internal" || normalized === "metadata.internal") {
+    return true;
+  }
+  if (normalized.endsWith(".cluster.local") || normalized.endsWith(".svc.cluster.local") || normalized.endsWith(".pod.cluster.local")) {
+    return true;
+  }
+  if (/^(\d{1,3}\.){3}\d{1,3}$/.test(normalized)) {
+    return isPrivateIPv4(normalized);
+  }
+  if (normalized.includes(":")) {
+    return isPrivateIPv6(normalized);
+  }
+  return false;
+}
+async function validateUrlForFetch(url) {
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      return { valid: false, error: "URL must use HTTP or HTTPS protocol" };
+    }
+    if (isPrivateOrInternalHostname(parsed.hostname)) {
+      return { valid: false, error: "URL points to a private or internal network" };
+    }
+    const isIPv4Address = /^(\d{1,3}\.){3}\d{1,3}$/.test(parsed.hostname);
+    const isIPv6Address = parsed.hostname.includes(":");
+    if (!isIPv4Address && !isIPv6Address) {
+      try {
+        const ipv4Addresses = await dnsResolve4(parsed.hostname).catch(() => []);
+        const ipv6Addresses = await dnsResolve6(parsed.hostname).catch(() => []);
+        const allAddresses = [...ipv4Addresses, ...ipv6Addresses];
+        if (allAddresses.length === 0) {
+          return { valid: false, error: "Could not resolve hostname" };
+        }
+        for (const ip of allAddresses) {
+          if (isPrivateIP(ip)) {
+            return { valid: false, error: `Hostname resolves to private IP address (${ip})` };
+          }
+        }
+      } catch {
+        return { valid: false, error: "Could not resolve hostname" };
+      }
+    }
+    return { valid: true };
+  } catch {
+    return { valid: false, error: "Invalid URL format" };
+  }
+}
+
+// ../../b4m-core/packages/utils/dist/src/ingest.js
 var URL_REGEX = /https?:\/\/(?:[-\w.])+(?:\:[0-9]+)?(?:\/(?:[\w\/_.])*(?:\?(?:[\w&=%.])*)?(?:\#(?:[\w.])*)?)?/gi;
 function detectURLs(string) {
   const urlsFound = string.match(URL_REGEX) || [];
@@ -602,15 +722,22 @@ function urlExists(stringWithPossibleUrl) {
   const cleanString = stringWithPossibleUrl.replace(/\n/g, " ").replace(/,/g, " ");
   return detectURLs(cleanString);
 }
+var URL_FETCH_TIMEOUT_MS = 1e4;
 async function fetchAndParseURL(url, { logger }) {
   logger.updateMetadata({ failedUrl: null });
   try {
+    const ssrfValidation = await validateUrlForFetch(url);
+    if (!ssrfValidation.valid) {
+      throw new Error(`URL blocked for security reasons: ${ssrfValidation.error}`);
+    }
     let urlMimeType = "text/plain";
     if (url.split(".")?.pop()?.startsWith("pdf")) {
       urlMimeType = "application/pdf";
     }
     const response = await axios.get(url, {
-      responseType: ["application/pdf"].includes(urlMimeType) ? "arraybuffer" : "text"
+      responseType: ["application/pdf"].includes(urlMimeType) ? "arraybuffer" : "text",
+      timeout: URL_FETCH_TIMEOUT_MS
+      // Prevent Lambda timeout exhaustion
     });
     const cheerio = await import("cheerio");
     const htmlContent = response.data;
@@ -618,17 +745,19 @@ async function fetchAndParseURL(url, { logger }) {
     const title = $("title").text() || url.split("/")?.pop();
     let urlContent = null;
     switch (urlMimeType) {
-      case "application/pdf":
+      case "application/pdf": {
         const pdfbuffer = Buffer.from(response.data);
         urlContent = pdfbuffer;
         break;
-      default:
+      }
+      default: {
         let textContent = "";
         $("body").find("p").each((index, element) => {
           textContent += $(element).text() + "\n";
         });
         urlContent = textContent || htmlContent;
         break;
+      }
     }
     logger.log(`Fetched ${title} with mimetype ${urlMimeType} and parsed ${url}`);
     return { title, textContent: urlContent, mimeType: urlMimeType, ext: mime2.extension(urlMimeType) || null };
@@ -1154,8 +1283,30 @@ function separateUrls(urls) {
   const nonImageUrls = urls.filter((url) => !imageExtensions.some((ext) => url.toLowerCase().endsWith(ext)));
   return { imageUrls, nonImageUrls };
 }
-var urlContentCache = /* @__PURE__ */ new Map();
-var CACHE_TTL_MS = 5 * 60 * 1e3;
+function sanitizeUrlForLogging(url) {
+  try {
+    const parsed = new URL(url);
+    const sensitiveParams = [
+      "token",
+      "key",
+      "api_key",
+      "apikey",
+      "secret",
+      "password",
+      "session",
+      "auth",
+      "access_token"
+    ];
+    sensitiveParams.forEach((param) => {
+      if (parsed.searchParams.has(param)) {
+        parsed.searchParams.set(param, "[REDACTED]");
+      }
+    });
+    return parsed.toString();
+  } catch {
+    return url.substring(0, 100) + (url.length > 100 ? "..." : "");
+  }
+}
 async function processUrlsFromPrompt(userPrompt, maxContentBuffer, userId, sendStatusUpdate, logger, options = { verbose: false }) {
   if (!hasURLs(userPrompt)) {
     if (options?.verbose) {
@@ -1163,6 +1314,7 @@ async function processUrlsFromPrompt(userPrompt, maxContentBuffer, userId, sendS
     }
     return { userMessages: [], remainingPrompt: userPrompt };
   }
+  const urlContentCache = /* @__PURE__ */ new Map();
   sendStatusUpdate("Processing URLs from user prompt...");
   const userMessages = [];
   const promptMeta = extractSnippetMeta(userPrompt);
@@ -1190,20 +1342,26 @@ async function processUrlsFromPrompt(userPrompt, maxContentBuffer, userId, sendS
     try {
       const cached = urlContentCache.get(url);
       let textContent;
-      if (cached && Date.now() - cached.timestamp < CACHE_TTL_MS) {
-        if (options?.verbose) {
-          logger.log(`Using cached content for URL: ${url}`);
-        }
-        textContent = cached.content;
+      if (cached) {
+        logger.info("URL_FETCH", {
+          userId,
+          url: sanitizeUrlForLogging(url),
+          cacheHit: true,
+          source: "same-request-dedup"
+        });
+        textContent = cached;
       } else {
         const result = await fetchAndParseURL(url, { logger });
         if (typeof result.textContent !== "string")
           throw new Error("textContent is not a string");
         textContent = result.textContent;
-        urlContentCache.set(url, {
-          content: textContent,
-          timestamp: Date.now()
+        logger.info("URL_FETCH", {
+          userId,
+          url: sanitizeUrlForLogging(url),
+          cacheHit: false,
+          contentLength: textContent.length
         });
+        urlContentCache.set(url, textContent);
       }
       const message = {
         role: "user",
@@ -2492,7 +2650,13 @@ var AnthropicBackend = class {
     const rawTools = options.tools;
     const normalizedTools = Array.isArray(rawTools) ? rawTools : rawTools ? [rawTools] : void 0;
     options.tools = normalizedTools;
-    const system = this.consolidateSystemMessages(messages);
+    let system = this.consolidateSystemMessages(messages);
+    if (system) {
+      system += `
+IMPORTANT! Only when someone asks, remember that you are specifically the ${model} model.`;
+    } else {
+      system = `IMPORTANT! Only when someone asks, remember that you are specifically the ${model} model.`;
+    }
     let filteredMessages = ensureToolPairingIntegrity(this.filterRelevantMessages(messages), this.logger);
     const countToolBlocks = (msgs) => {
       let useCount = 0;
@@ -3851,7 +4015,10 @@ var AnthropicBedrockBackend = class extends BaseBedrockBackend {
       }
       return { ...m, content: "" };
     }).filter((m) => m.content !== "" && (Array.isArray(m.content) ? m.content.length > 0 : true));
-    const systemMessage = messages.filter((m) => m.role === "system" && m.content).map((m) => typeof m.content === "string" ? m.content : JSON.stringify(m.content)).join("\n");
+    let systemMessage = messages.filter((m) => m.role === "system" && m.content).map((m) => typeof m.content === "string" ? m.content : JSON.stringify(m.content)).join("\n");
+    const modelIdentity = `IMPORTANT! Only when someone asks, remember that you are specifically the ${model} model.`;
+    systemMessage = systemMessage ? `${systemMessage}
+${modelIdentity}` : modelIdentity;
     console.log(`[AnthropicBedrockBackend] Preparing payload for model: ${model}`);
     const hasVendorPrefix = model.includes(":") || model.startsWith("global.") || model.startsWith("us.");
     const modelId = hasVendorPrefix ? model : `anthropic.${model}`;
@@ -5912,12 +6079,12 @@ var GPT5_MODELS = [
 var GPT5_1_MODELS = [ChatModels.GPT5_1, ChatModels.GPT5_1_CHAT_LATEST];
 var GPT5_2_MODELS = [ChatModels.GPT5_2, ChatModels.GPT5_2_CHAT_LATEST];
 var effortMap = {
-  simple: "minimal",
+  simple: "low",
   contextual: "low",
   complex: "medium"
 };
 var effortMap_GPT5_1_2 = {
-  simple: "none",
+  simple: "low",
   contextual: "low",
   complex: "medium"
 };
@@ -6567,20 +6734,20 @@ var OpenAIBackend = class {
         stream: true,
         ...options.maxTokens && { max_completion_tokens: options.maxTokens }
       });
-      let reasoningEffort;
-      if (options.reasoningEffort) {
-        reasoningEffort = options.reasoningEffort;
-        this.logger.debug(`Using explicit reasoning effort: ${reasoningEffort}`);
-      } else if (options.complexity && effortMap[options.complexity]) {
-        reasoningEffort = isGPT5_1Model || isGPT5_2Model ? effortMap_GPT5_1_2[options.complexity] : effortMap[options.complexity];
-        this.logger.debug(`Auto-classified reasoning effort from complexity '${options.complexity}': ${reasoningEffort}`);
-      }
-      if (reasoningEffort) {
-        Object.assign(parameters, {
-          reasoning: {
-            effort: reasoningEffort
-          }
-        });
+      if (REASONING_SUPPORTED_MODELS.has(model)) {
+        let reasoningEffort;
+        if (options.reasoningEffort) {
+          reasoningEffort = options.reasoningEffort;
+          this.logger.debug(`Using explicit reasoning effort: ${reasoningEffort}`);
+        } else if (options.complexity && effortMap[options.complexity]) {
+          reasoningEffort = isGPT5_1Model || isGPT5_2Model ? effortMap_GPT5_1_2[options.complexity] : effortMap[options.complexity];
+          this.logger.debug(`Auto-classified reasoning effort from complexity '${options.complexity}': ${reasoningEffort}`);
+        }
+        if (reasoningEffort) {
+          Object.assign(parameters, {
+            reasoning_effort: reasoningEffort
+          });
+        }
       }
     } else {
       const useStreaming = options.stream && (!options.n || options.n === 1);
@@ -11590,6 +11757,9 @@ function findAutomaticFallback(originalModel, availableModels, apiKeyTable, logg
     "gemini-2.5-flash-preview-05-20": ["claude-3-5-haiku-20241022", "gpt-4o-mini", "claude-3-haiku-20240307"],
     "gemini-1.5-pro": ["claude-3-5-sonnet-20241022", "gpt-4o", "claude-3-opus-20240229"],
     "gemini-1.5-flash": ["claude-3-5-haiku-20241022", "gpt-4o-mini", "claude-3-haiku-20240307"],
+    // Claude 4.5/4.6 Opus models fallback to Sonnet 4.5
+    "claude-opus-4-5-20251101": ["claude-sonnet-4-5-20250929", "gpt-5", "claude-haiku-4-5-20251001"],
+    "claude-opus-4-6": ["claude-sonnet-4-5-20250929", "gpt-5", "claude-haiku-4-5-20251001"],
     // Claude models fallback to other Claude models or GPT
     "claude-3-5-sonnet-20241022": ["claude-3-opus-20240229", "gpt-4o", "claude-3-sonnet-20240229"],
     "claude-3-opus-20240229": ["claude-3-5-sonnet-20241022", "gpt-4o", "claude-3-sonnet-20240229"],
@@ -11599,7 +11769,7 @@ function findAutomaticFallback(originalModel, availableModels, apiKeyTable, logg
   };
   const preferences = fallbackPreferences[originalModel.id] || [];
   if (preferences.length === 0) {
-    preferences.push("claude-3-5-sonnet-20241022", "gpt-4o", "claude-3-haiku-20240307");
+    preferences.push("claude-sonnet-4-5-20250929", "gpt-5", "claude-haiku-4-5-20251001");
   }
   for (const modelId of preferences) {
     const fallbackModel = availableModels.find((m) => m.id === modelId);
@@ -11988,6 +12158,59 @@ function buildVoiceInstructions(baseInstructions, historyContext) {
   return `${baseInstructions}${historyContext}`;
 }
 
+// ../../b4m-core/packages/utils/dist/src/lambdaErrorHandler.js
+var isRegistered = false;
+function classifyError(error) {
+  if (error instanceof TypeError) {
+    if (error.message === "terminated" || error.message.includes("fetch failed")) {
+      return "network_terminated";
+    }
+  }
+  if (error instanceof Error) {
+    if (error.name === "AbortError") {
+      return "network_timeout";
+    }
+    const connectionErrors = ["ECONNRESET", "ETIMEDOUT", "ECONNREFUSED", "EPIPE", "ENOTFOUND"];
+    if (connectionErrors.some((code) => error.message.includes(code))) {
+      return "network_connection";
+    }
+  }
+  return "unhandled_rejection";
+}
+function buildLogEntry(error, category) {
+  return {
+    error: error instanceof Error ? error.message : String(error),
+    stack: error instanceof Error ? error.stack : void 0,
+    category,
+    functionName: process.env.AWS_LAMBDA_FUNCTION_NAME,
+    stage: process.env.SEED_STAGE_NAME,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function registerLambdaErrorHandlers(logger) {
+  if (isRegistered)
+    return;
+  isRegistered = true;
+  const log = logger || console;
+  process.on("unhandledRejection", (reason) => {
+    const category = classifyError(reason);
+    const isNetworkError = category.startsWith("network_");
+    const logEntry = buildLogEntry(reason, category);
+    if (isNetworkError) {
+      log.warn("[Lambda] Network error (unhandled rejection)", logEntry);
+    } else {
+      log.error("[Lambda] Unhandled promise rejection", logEntry);
+    }
+  });
+  process.on("uncaughtException", (error) => {
+    const logEntry = buildLogEntry(error, "uncaught_exception");
+    log.error("[Lambda] Uncaught exception", logEntry);
+  });
+}
+function _resetLambdaErrorHandlers() {
+  isRegistered = false;
+}
+
 export {
   BaseStorage,
   S3Storage,
@@ -12005,6 +12228,9 @@ export {
   warmUpSettingsCache,
   shutdownSettingsCache,
   getSettingsCacheStats,
+  isPrivateIP,
+  isPrivateOrInternalHostname,
+  validateUrlForFetch,
   URL_REGEX,
   detectURLs,
   hasURLs,
@@ -12122,5 +12348,7 @@ export {
   calculateRetryDelay,
   withRetry,
   formatVoiceHistory,
-  buildVoiceInstructions
+  buildVoiceInstructions,
+  registerLambdaErrorHandlers,
+  _resetLambdaErrorHandlers
 };

package/dist/{chunk-YNQB2RM7.js → chunk-T67NGQW6.js}

@@ -6,12 +6,12 @@ import {
   getSettingsByNames,
   obfuscateApiKey,
   secureParameters
-} from "./chunk-FLA4PWXB.js";
+} from "./chunk-RI45VJW3.js";
 import {
   ApiKeyType,
   MementoTier,
   isSupportedEmbeddingModel
-} from "./chunk-ICLEQOH6.js";
+} from "./chunk-GE7Q64MS.js";
 
 // ../../b4m-core/packages/services/dist/src/apiKeyService/get.js
 import { z } from "zod";

package/dist/{chunk-PP5WVA27.js → chunk-ZOWCX4MQ.js}

@@ -7,11 +7,11 @@ import {
   getSettingsMap,
   getSettingsValue,
   secureParameters
-} from "./chunk-FLA4PWXB.js";
+} from "./chunk-RI45VJW3.js";
 import {
   KnowledgeType,
   SupportedFabFileMimeTypes
-} from "./chunk-ICLEQOH6.js";
+} from "./chunk-GE7Q64MS.js";
 
 // ../../b4m-core/packages/services/dist/src/fabFileService/create.js
 import { z } from "zod";

package/dist/{create-NX7AO3LR.js → create-JNUW7ICC.js}

@@ -2,9 +2,9 @@
 import {
   createFabFile,
   createFabFileSchema
-} from "./chunk-PP5WVA27.js";
-import "./chunk-FLA4PWXB.js";
-import "./chunk-ICLEQOH6.js";
+} from "./chunk-ZOWCX4MQ.js";
+import "./chunk-RI45VJW3.js";
+import "./chunk-GE7Q64MS.js";
 import "./chunk-OCYRD7D6.js";
 export {
   createFabFile,