@bike4mind/cli 1.0.0 → 1.1.0

package/dist/index.mjs

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
-import { $ as RemoteSkillSource, A as FallbackLlmBackend, C as createWriteTodosTool, D as createResumeAgentTool, E as createCoordinateTaskTool, G as DEFAULT_THOROUGHNESS, H as DEFAULT_AGENT_MODEL, I as PermissionManager, J as setWebSocketToolExecutor, K as clearFeatureModuleTools, N as findIterationBoundary, O as createBackgroundAgentTools, P as extractCompactInstructions, Q as isReadOnlyTool, R as getProcessHooks, S as createTodoStore, T as parseAgentConfig, U as DEFAULT_MAX_ITERATIONS, V as ALWAYS_DENIED_FOR_AGENTS, W as DEFAULT_RETRY_CONFIG, X as buildSystemPrompt, Y as getPlanModeFilePath, Z as buildSkillsPromptSection, _ as createDecisionStore, at as searchCommands, b as createWorkItemTools, c as isTransientNetworkError, ct as searchFiles, d as createReviewGateTool, et as CustomCommandStore, f as formatReviewGatesOutput, ft as MAX_PASTE_SIZE, g as createDecisionLogTool, h as formatBlockersOutput, it as processFileReferences, j as substituteArguments, k as createAgentDelegateTool, lt as warmFileCache, m as createBlockerTools, nt as SessionStore, ot as mergeCommands, p as createBlockerStore, q as registerFeatureModuleTools, rt as hasFileReferences, st as formatFileSize, tt as CheckpointStore, u as createReviewGateStore, ut as COMPACTION_SUMMARY_MARKER, v as formatDecisionsOutput, w as createSkillTool, x as createFindDefinitionTool, y as createGetFileStructureTool } from "./AgentHistoryStore-CrRb8cMt.mjs";
+import { $ as CustomCommandStore, A as createAgentDelegateTool, B as ALWAYS_DENIED_FOR_AGENTS, C as createTodoStore, D as createCoordinateTaskTool, E as parseAgentConfig, F as PermissionManager, H as DEFAULT_MAX_ITERATIONS, J as setWebSocketToolExecutor, K as clearFeatureModuleTools, L as wrapTools, M as substituteArguments, O as createResumeAgentTool, P as findIterationBoundary, Q as RemoteSkillSource, R as getProcessHooks, S as createFindDefinitionTool, T as createSkillTool, U as DEFAULT_RETRY_CONFIG, V as DEFAULT_AGENT_MODEL, W as DEFAULT_THOROUGHNESS, X as buildSystemPrompt, Y as getPlanModeFilePath, Z as buildSkillsPromptSection, _ as createDecisionLogTool, at as mergeCommands, b as createGetFileStructureTool, ct as warmFileCache, d as createReviewGateStore, dt as MAX_PASTE_SIZE, et as CheckpointStore, f as createReviewGateTool, g as formatBlockersOutput, h as createBlockerTools, it as searchCommands, j as FallbackLlmBackend, k as createBackgroundAgentTools, l as isTransientNetworkError, lt as COMPACTION_SUMMARY_MARKER, m as createBlockerStore, nt as hasFileReferences, ot as formatFileSize, p as formatReviewGatesOutput, q as registerFeatureModuleTools, rt as processFileReferences, st as searchFiles, tt as SessionStore, v as createDecisionStore, w as createWriteTodosTool, x as createWorkItemTools, y as formatDecisionsOutput } from "./AgentHistoryStore-kT9eNMRO.mjs";
 import { a as selectLiveSubagentTokens, i as selectLiveSubagentCredits, n as selectActiveBackgroundShells, o as useCliStore, r as selectCompletedBackgroundShells, t as selectActiveBackgroundAgents } from "./store-CvjTpQPs.mjs";
 import { r as isFeatureEnabled, t as PluginStore } from "./PluginStore-DwvOJ-G3.mjs";
-import { $t as actorKindSchema, Qt as actorKindMarker, X as REVIEW_GATE_STATUS_VALUES, Xt as ACTOR_COLOR_SLOTS, Z as SUBQUEST_STATUS_VALUES, Zt as actorColorIndex, a as getCreditsUrl, b as CREDIT_DEDUCT_TRANSACTION_TYPES, c as requireApiUrl, en as selfClaimedActorKindSchema, i as LOCAL_DEV_URL, l as resolveApiEndpoint, n as logger, o as getEnvironmentName, r as ApiEndpointUnconfiguredError, s as parseApiUrl, t as ConfigStore, x as ChatModels, xt as isEarlyStop } from "./ConfigStore-DHNgFdOu.mjs";
+import { D as ChatModels, E as CREDIT_DEDUCT_TRANSACTION_TYPES, Ot as isEarlyStop, c as ApiEndpointUnconfiguredError, cn as actorColorIndex, d as getEnvironmentName, dn as selfClaimedActorKindSchema, et as REVIEW_GATE_STATUS_VALUES, f as parseApiUrl, l as LOCAL_DEV_URL, ln as actorKindMarker, m as resolveApiEndpoint, n as logger, p as requireApiUrl, r as extractCompactInstructions, s as isReadOnlyTool, sn as ACTOR_COLOR_SLOTS, t as ConfigStore, tt as SUBQUEST_STATUS_VALUES, u as getCreditsUrl, un as actorKindSchema } from "./ConfigStore-DdHHCH2t.mjs";
 import { t as getShellSessionManager } from "./ShellSessionManager-6o8KZzl1-vrbPAUTq.mjs";
-import { n as OAuthClient, t as ApiClient } from "./ApiClient-EUTyn5yu.mjs";
+import { n as OAuthClient, t as ApiClient } from "./ApiClient-BOWpVvTq.mjs";
 import { i as getTokenCounter, n as ConversationContext, r as reconstructTurnBlocks, t as WorkItemsClient } from "./WorkItemsClient-Cow6nXx7.mjs";
-import { a as createToolSearchTool, i as buildLlmBackend, n as buildSupportingStores, o as deferredToolRegistry, r as buildSandbox, s as NotifyingLlmBackend, t as buildAgent } from "./buildAgent-CJrkEG0M.mjs";
-import { t as version } from "./package-7a45-Svr.mjs";
+import { a as createToolSearchTool, i as buildLlmBackend, n as buildSupportingStores, o as deferredToolRegistry, r as buildSandbox, s as NotifyingLlmBackend, t as buildAgent } from "./buildAgent-B_kArQ_Y.mjs";
+import { t as version } from "./package-Bqg2LSnH.mjs";
 import { r as checkForUpdate } from "./updateChecker-CQW8bxo6.mjs";
 import React, { useCallback, useEffect, useMemo, useReducer, useRef, useState, useSyncExternalStore } from "react";
 import { Box, Static, Text, render, useApp, useInput, usePaste, useStdout } from "ink";
@@ -1083,9 +1083,19 @@ function CompletedGroupNotification() {
 }
 //#endregion
 //#region src/components/PermissionPrompt.tsx
+/**
+* Escape terminal control characters (carriage return, ESC/ANSI, other C0
+* controls, DEL) into a visible `\xHH` form. The preview is model-authored;
+* rendering it raw would let a `\r` or ESC sequence rewrite what the user sees,
+* so the approved text could differ from what actually runs. Tab and newline are
+* left intact (newline is already the line delimiter).
+*/
+function escapeTerminalControlChars(text) {
+	return text.replace(/[\x00-\x08\x0b-\x1f\x7f]/g, (ch) => `\\x${ch.charCodeAt(0).toString(16).padStart(2, "0")}`);
+}
 /** Render a diff/preview string, color-coding each line by its prefix (see per-branch comments below). */
 function renderDiffPreview(preview) {
-	return preview.split("\n").map((line, index) => {
+	return escapeTerminalControlChars(preview).split("\n").map((line, index) => {
 		if (line.startsWith("🛑")) return /* @__PURE__ */ React.createElement(Text, {
 			key: index,
 			bold: true,
@@ -2656,6 +2666,40 @@ function TrustLocationSelector({ inProject, onSelect, onCancel }) {
 	}), /* @__PURE__ */ React.createElement(Box, { marginTop: 1 }, /* @__PURE__ */ React.createElement(Text, { dimColor: true }, "Use ↑↓ arrows to navigate, Enter to select, Ctrl+C to cancel")));
 }
 //#endregion
+//#region src/components/FolderTrustPrompt.tsx
+/**
+* One-time startup prompt shown when the current project root ships repo-committed
+* b4m files (config, .mcp.json, agents, skills, commands) but has not been
+* trusted. Until trusted, those files are inert - no config merge, no MCP spawn,
+* no agent/skill/command load. "Trust this folder" persists the decision; "Not
+* now" keeps the project untrusted for this session (re-prompts next launch).
+*
+* "Not now" is listed first so it is the preselected default: Enter-through on a
+* freshly cloned repo must not grant trust.
+*/
+function FolderTrustPrompt({ projectRoot, onSelect }) {
+	return /* @__PURE__ */ React.createElement(Box, {
+		flexDirection: "column",
+		marginY: 1
+	}, /* @__PURE__ */ React.createElement(Box, {
+		marginBottom: 1,
+		flexDirection: "column"
+	}, /* @__PURE__ */ React.createElement(Text, {
+		bold: true,
+		color: "yellow"
+	}, "This project ships Bike4Mind config that can run code."), /* @__PURE__ */ React.createElement(Text, { dimColor: true }, projectRoot), /* @__PURE__ */ React.createElement(Text, null, "Repo-committed config, MCP servers, agents and skills stay inert until you trust this folder. Only trust folders you would run code from.")), /* @__PURE__ */ React.createElement(SelectInput, {
+		items: [{
+			label: "Not now - keep repo config inert this session",
+			value: "not-now"
+		}, {
+			label: "Trust this folder - load its config, agents, skills and MCP servers",
+			value: "trust"
+		}],
+		onSelect: (item) => onSelect(item.value),
+		itemComponent: ({ isSelected, label }) => /* @__PURE__ */ React.createElement(Box, null, /* @__PURE__ */ React.createElement(Text, { color: isSelected ? "cyan" : void 0 }, isSelected ? "❯ " : "  ", label))
+	}), /* @__PURE__ */ React.createElement(Box, { marginTop: 1 }, /* @__PURE__ */ React.createElement(Text, { dimColor: true }, "Use ↑↓ arrows to navigate, Enter to select. You can change this later with /trust folder.")));
+}
+//#endregion
 //#region src/components/RewindSelector.tsx
 function RewindSelector({ messages, onSelect, onCancel }) {
 	const [step, setStep] = useState("selection");
@@ -2882,6 +2926,22 @@ function EnvironmentPicker({ onSelect }) {
 }
 //#endregion
 //#region src/components/LoginFlow.tsx
+/**
+* Only https URLs (and http on localhost for dev) may be handed to the OS opener.
+* The device-flow response is server-controlled, so a hostile/compromised server
+* could return `file:///...`, `javascript:...` or similar and have the OS launch
+* it. Reject anything that isn't a plain web URL.
+*/
+function isBrowserOpenableUrl(raw) {
+	let url;
+	try {
+		url = new URL(raw);
+	} catch {
+		return false;
+	}
+	if (url.protocol === "https:") return true;
+	return url.protocol === "http:" && (url.hostname === "localhost" || url.hostname === "127.0.0.1");
+}
 function extractErrorMessage(err) {
 	if (axios.isAxiosError(err)) {
 		if (err.response?.data) {
@@ -2939,9 +2999,10 @@ function LoginFlow({ apiUrl = "http://localhost:3000", configStore, onSuccess, o
 		onError
 	]);
 	useEffect(() => {
-		if (deviceFlow && status === "waiting") open(deviceFlow.verification_uri_complete).catch((err) => {
+		if (deviceFlow && status === "waiting") if (isBrowserOpenableUrl(deviceFlow.verification_uri_complete)) open(deviceFlow.verification_uri_complete).catch((err) => {
 			console.error("Failed to auto-open browser:", err);
 		});
+		else console.error("Refusing to auto-open untrusted verification URL:", deviceFlow.verification_uri_complete);
 	}, [deviceFlow, status]);
 	if (status === "initiating") return /* @__PURE__ */ React.createElement(Box, {
 		flexDirection: "column",
@@ -3087,6 +3148,35 @@ var CommandHistoryStore = class {
 	}
 };
 //#endregion
+//#region src/storage/buildGlobalConfigPatch.ts
+/**
+* Compute the minimal global-config patch for a /config editor save: only the
+* editor-owned fields (defaultModel, preferences, features) that the user
+* actually changed vs the current effective (merged) config. Unchanged fields
+* are omitted, so a repo-injected value the user never touched is never
+* laundered into the global layer by a save() that spreads the merged config.
+*
+* defaultModel and preferences diff per key. features stays whole-object when
+* anything changed, on purpose: ConfigStore.save() feeds config.features to
+* mergeFeatures as the caller's COMPLETE desired set (absence of a key means
+* "removed"), so a per-key diff would make save() delete untouched keys. That
+* whole-object features path is only latently launderable today (no repo layer
+* populates features); tightening it needs a coordinated change to save()'s
+* concurrent-writer merge and is tracked separately.
+*/
+function buildGlobalConfigPatch(prev, next) {
+	const patch = {};
+	if (next.defaultModel !== prev?.defaultModel) patch.defaultModel = next.defaultModel;
+	const changedPreferences = {};
+	for (const [key, value] of Object.entries(next.preferences)) {
+		const prevValue = (prev?.preferences)?.[key];
+		if (JSON.stringify(value) !== JSON.stringify(prevValue)) changedPreferences[key] = value;
+	}
+	if (Object.keys(changedPreferences).length > 0) patch.preferences = changedPreferences;
+	if (JSON.stringify(next.features ?? {}) !== JSON.stringify(prev?.features ?? {})) patch.features = next.features;
+	return patch;
+}
+//#endregion
 //#region src/utils/formatStep.ts
 const MAX_INPUT_LENGTH = 500;
 /**
@@ -7069,7 +7159,9 @@ API Configuration:
 Tool Permissions:
   /trust <tool-name> - Trust a tool (won't ask permission again)
   /untrust <tool-name> - Remove tool from trusted list
-  /trusted - List all trusted tools
+  /trust folder - Trust this project (load its repo config, agents, skills, MCP)
+  /untrust folder - Revoke trust for this project (repo config goes inert)
+  /trusted - Show folder-trust status and list all trusted tools
 
 Project Configuration:
   /project-config - Show merged project configuration
@@ -7131,8 +7223,16 @@ Multi-line Input:
 	{
 		name: "trusted",
 		run: (_args, ctx) => {
+			const projectRoot = ctx.configStore.getProjectRealPath();
+			console.log("\n📁 Folder Trust:\n");
+			if (!projectRoot) console.log("  No project root discovered.");
+			else {
+				const isTrusted = ctx.configStore.isProjectTrusted();
+				console.log(`  ${isTrusted ? "✅ Trusted" : "⛔ Not trusted"}: ${projectRoot}`);
+				if (!isTrusted) console.log("  Repo config/agents/skills/MCP stay inert. Trust with /trust folder.");
+			}
 			if (!ctx.permissionManager) {
-				console.log("Permission manager not initialized");
+				console.log("\nPermission manager not initialized\n");
 				return;
 			}
 			const trustedTools = ctx.permissionManager.getTrustedTools();
@@ -7753,6 +7853,7 @@ function CliApp() {
 		permissionManager: null,
 		permissionPrompt: null,
 		trustLocationSelector: null,
+		folderTrustPrompt: null,
 		rewindSelector: null,
 		sessionSelector: null,
 		orchestrator: null,
@@ -7771,6 +7872,7 @@ function CliApp() {
 	const [initError, setInitError] = useState(null);
 	const [commandHistory, setCommandHistory] = useState([]);
 	const imageStoreInitPromise = useRef(null);
+	const folderTrustResolvedRef = useRef(false);
 	const todoStoreRef = useRef(createTodoStore());
 	const decisionStoreRef = useRef(createDecisionStore());
 	const blockerStoreRef = useRef(createBlockerStore());
@@ -7877,11 +7979,21 @@ function CliApp() {
 		try {
 			const startupLog = [];
 			const config = await state.configStore.load();
+			if (!folderTrustResolvedRef.current && !state.configStore.isProjectTrusted() && state.configStore.projectHasB4mFiles() && Boolean(process.stdin.isTTY) && Boolean(process.stdout.isTTY)) {
+				folderTrustResolvedRef.current = true;
+				setState((prev) => ({
+					...prev,
+					folderTrustPrompt: { projectRoot: state.configStore.getProjectRealPath() ?? process.cwd() },
+					config
+				}));
+				return;
+			}
 			const configDirs = await state.configStore.getAdditionalDirectories();
 			const flagDirs = process.env.B4M_ADDITIONAL_DIRS ? JSON.parse(process.env.B4M_ADDITIONAL_DIRS) : [];
 			const additionalDirectories = [.../* @__PURE__ */ new Set([...configDirs, ...flagDirs])];
 			const history = await state.commandHistoryStore.load();
 			setCommandHistory(history);
+			state.customCommandStore.setProjectTrusted(state.configStore.isProjectTrusted());
 			try {
 				await state.customCommandStore.loadCommands();
 			} catch (error) {
@@ -8108,14 +8220,26 @@ function CliApp() {
 				blockerStoreRef.current.blockers = [];
 				reviewGateStoreRef.current.reviewGates = [];
 			}
+			const cliWrapDeps = {
+				permissionManager,
+				showPermissionPrompt: promptFn,
+				agentContext,
+				configStore: state.configStore,
+				apiClient,
+				sandboxOrchestrator: sandboxOrchestrator ?? void 0,
+				allowedDirectories: additionalDirectories
+			};
 			const enableSkillTool = config.preferences.enableSkillTool !== false;
-			const skillTool = enableSkillTool ? createSkillTool({
+			const skillTool = enableSkillTool ? wrapTools([createSkillTool({
 				customCommandStore: state.customCommandStore,
 				subagentOrchestrator: orchestrator,
-				sessionId: newSession.id
-			}) : null;
-			const findDefinitionTool = createFindDefinitionTool();
-			const getFileStructureTool = createGetFileStructureTool();
+				sessionId: newSession.id,
+				permissionManager,
+				promptFn,
+				allowedDirectories: additionalDirectories
+			})], cliWrapDeps)[0] : null;
+			const findDefinitionTool = wrapTools([createFindDefinitionTool(additionalDirectories)], cliWrapDeps)[0];
+			const getFileStructureTool = wrapTools([createGetFileStructureTool(additionalDirectories)], cliWrapDeps)[0];
 			const workItemTools = config.preferences.enableWorkItemTools ? createWorkItemTools(new WorkItemsClient(apiClient)) : [];
 			const cliTools = [
 				agentDelegateTool,
@@ -9142,6 +9266,18 @@ function CliApp() {
 				break;
 			}
 			case "trust": {
+				if (args[0] === "folder") {
+					const root = state.configStore.getProjectRealPath() ?? process.cwd();
+					if (!await state.configStore.trustProject()) {
+						console.log("\n⚠️  No project folder to trust here (no resolvable project root).\n");
+						return;
+					}
+					state.customCommandStore.setProjectTrusted(true);
+					await state.customCommandStore.reloadCommands().catch(() => {});
+					console.log(`\n✅ Trusted project folder: ${root}`);
+					console.log("Project skills are now loaded. Restart b4m to load repo agents and MCP servers.\n");
+					return;
+				}
 				if (!state.permissionManager) {
 					console.log("Permission manager not initialized");
 					return;
@@ -9177,6 +9313,11 @@ function CliApp() {
 								console.log("❌ No project found. Use \"global\" to save to ~/.bike4mind/config.json");
 								return;
 							}
+							if (!state.configStore.isProjectTrusted()) {
+								console.log("❌ This folder is not trusted, so a project-local trust would not take effect.");
+								console.log(`   Run /trust folder first, or choose "global" to trust '${toolToTrust}' everywhere.`);
+								return;
+							}
 							try {
 								await state.configStore.initProjectConfig();
 								const existingLocal = await state.configStore.loadRawProjectLocalConfig() || {};
@@ -9197,6 +9338,11 @@ function CliApp() {
 								console.log("❌ No project found. Use \"global\" to save to ~/.bike4mind/config.json");
 								return;
 							}
+							if (!state.configStore.isProjectTrusted()) {
+								console.log("❌ This folder is not trusted, so a team-project trust would not take effect.");
+								console.log(`   Run /trust folder first, or choose "global" to trust '${toolToTrust}' everywhere.`);
+								return;
+							}
 							try {
 								const existingProject = await state.configStore.loadRawProjectConfig() || {};
 								const updatedProject = {
@@ -9235,6 +9381,15 @@ function CliApp() {
 				break;
 			}
 			case "untrust": {
+				if (args[0] === "folder") {
+					const root = state.configStore.getProjectRealPath() ?? process.cwd();
+					await state.configStore.untrustProject();
+					state.customCommandStore.setProjectTrusted(false);
+					await state.customCommandStore.reloadCommands().catch(() => {});
+					console.log(`\n✅ Untrusted project folder: ${root}`);
+					console.log("Repo config stays inert. Restart b4m to fully unload repo agents and MCP servers.\n");
+					return;
+				}
 				if (!state.permissionManager) {
 					console.log("Permission manager not initialized");
 					return;
@@ -9568,6 +9723,7 @@ function CliApp() {
 				console.log("\n📁 Project Configuration:\n");
 				if (projectDir) {
 					console.log(`Project Directory: ${projectDir}/.bike4mind/`);
+					if (!state.configStore.isProjectTrusted()) console.log("⚠️  Folder not trusted - team/local config below is NOT applied. Run /trust folder.");
 					console.log("");
 					const projectConfig = await state.configStore.loadRawProjectConfig();
 					const localConfig = await state.configStore.loadRawProjectLocalConfig();
@@ -9769,7 +9925,7 @@ function CliApp() {
 				}
 				break;
 			}
-			case "sandbox:enable": {
+			case "sandbox:enable":
 				if (!state.sandboxOrchestrator) {
 					console.log("Sandbox not initialized");
 					break;
@@ -9785,15 +9941,10 @@ function CliApp() {
 					const pm = state.sandboxOrchestrator.getProxyManager();
 					if (pm?.isRunning()) console.log(`🌐 Network proxy started on port ${pm.getPort()}`);
 				}
-				const config = await state.configStore.get();
-				await state.configStore.save({
-					...config,
-					sandbox: { ...state.sandboxOrchestrator.getConfig() }
-				});
+				await state.configStore.saveSandboxConfig(state.sandboxOrchestrator.getConfig());
 				console.log("Sandbox enabled (auto-allow mode)");
 				break;
-			}
-			case "sandbox:disable": {
+			case "sandbox:disable":
 				if (!state.sandboxOrchestrator) {
 					console.log("Sandbox not initialized");
 					break;
@@ -9801,14 +9952,9 @@ function CliApp() {
 				await state.sandboxOrchestrator.stopProxy();
 				state.sandboxOrchestrator.setMode("disabled");
 				state.permissionManager?.setSandboxState("disabled", false);
-				const disableConfig = await state.configStore.get();
-				await state.configStore.save({
-					...disableConfig,
-					sandbox: { ...state.sandboxOrchestrator.getConfig() }
-				});
+				await state.configStore.saveSandboxConfig(state.sandboxOrchestrator.getConfig());
 				console.log("Sandbox disabled");
 				break;
-			}
 			case "sandbox:mode": {
 				if (!state.sandboxOrchestrator) {
 					console.log("Sandbox not initialized");
@@ -9825,11 +9971,7 @@ function CliApp() {
 				}
 				state.sandboxOrchestrator.setMode(modeArg);
 				state.permissionManager?.setSandboxState(modeArg, state.sandboxOrchestrator.isActive());
-				const modeConfig = await state.configStore.get();
-				await state.configStore.save({
-					...modeConfig,
-					sandbox: { ...state.sandboxOrchestrator.getConfig() }
-				});
+				await state.configStore.saveSandboxConfig(state.sandboxOrchestrator.getConfig());
 				console.log(`Sandbox mode set to: ${modeArg}`);
 				break;
 			}
@@ -9851,16 +9993,12 @@ function CliApp() {
 					proxyMgr.addAllowedDomain(domain);
 					console.log(`  Added: ${domain}`);
 				}
-				const trustDomainConfig = await state.configStore.get();
 				const currentSandboxConfig = state.sandboxOrchestrator.getConfig();
-				await state.configStore.save({
-					...trustDomainConfig,
-					sandbox: {
-						...currentSandboxConfig,
-						network: {
-							...currentSandboxConfig.network,
-							allowedDomains: proxyMgr.getAllowedDomains()
-						}
+				await state.configStore.saveSandboxConfig({
+					...currentSandboxConfig,
+					network: {
+						...currentSandboxConfig.network,
+						allowedDomains: proxyMgr.getAllowedDomains()
 					}
 				});
 				console.log(`Trusted ${args.length} domain(s)`);
@@ -10039,7 +10177,8 @@ function CliApp() {
 	* Handle saving config from the interactive editor
 	*/
 	const handleSaveConfig = async (updatedConfig, options) => {
-		await state.configStore.save(updatedConfig);
+		const patch = buildGlobalConfigPatch(state.config, updatedConfig);
+		await state.configStore.save(patch);
 		const modelChanged = state.config?.defaultModel !== updatedConfig.defaultModel;
 		const featuresChanged = JSON.stringify(state.config?.features ?? {}) !== JSON.stringify(updatedConfig.features ?? {});
 		let newFeatureRegistry = state.featureRegistry;
@@ -10127,10 +10266,14 @@ function CliApp() {
 		isBusy: () => useCliStore.getState().isThinking,
 		saveModel: async (modelId) => {
 			if (!state.config) throw new Error("no CLI config is loaded");
-			await handleSaveConfig({
-				...state.config,
-				defaultModel: modelId
-			}, { skipModelApply: true });
+			await state.configStore.save({ defaultModel: modelId });
+			setState((prev) => prev.config ? {
+				...prev,
+				config: {
+					...prev.config,
+					defaultModel: modelId
+				}
+			} : prev);
 		},
 		applyToSession: applyModelToSession,
 		log: (message) => console.log(message),
@@ -10155,6 +10298,28 @@ function CliApp() {
 			}
 		});
 	}
+	if (state.folderTrustPrompt) return /* @__PURE__ */ React.createElement(FolderTrustPrompt, {
+		projectRoot: state.folderTrustPrompt.projectRoot,
+		onSelect: (choice) => {
+			(async () => {
+				try {
+					if (choice === "trust") {
+						await state.configStore.trustProject();
+						console.log("\n✅ Folder trusted. Loading its config, agents, skills and MCP servers.\n");
+					} else console.log("\nℹ️  Project config stays inert this session. Use /trust folder to trust it later.\n");
+				} finally {
+					setState((prev) => ({
+						...prev,
+						folderTrustPrompt: null
+					}));
+					init().catch((err) => {
+						console.error("\n❌ Initialization failed:", err instanceof Error ? err.message : String(err), "\n");
+						exit();
+					});
+				}
+			})();
+		}
+	});
 	const currentSession = useCliStore.getState().session;
 	if (state.rewindSelector && currentSession) return /* @__PURE__ */ React.createElement(RewindSelector, {
 		messages: currentSession.messages,

package/dist/{package-7a45-Svr.mjs → package-Bqg2LSnH.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
 //#region package.json
-var version = "1.0.0";
+var version = "1.1.0";
 //#endregion
 export { version as t };

package/dist/{pathValidation-D8tjkQXE-1HwvsuYT.mjs → pathValidation-BRqf4HFX-CHwtwp3O.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { realpathSync } from "fs";
+import { readlinkSync, realpathSync } from "fs";
 import path from "path";
-//#region ../../b4m-core/services/dist/pathValidation-D8tjkQXE.mjs
+//#region ../../b4m-core/services/dist/pathValidation-BRqf4HFX.mjs
 /**
 * Resolves a path to its canonical form, following symlinks.
 * If the path doesn't exist (e.g., file being created), resolves the
@@ -10,7 +10,11 @@ import path from "path";
 function resolveRealPath(filePath) {
 	try {
 		return realpathSync(filePath);
-	} catch {
+	} catch (err) {
+		if (err?.code === "ENOENT") try {
+			const linkTarget = readlinkSync(filePath);
+			return resolveRealPath(path.isAbsolute(linkTarget) ? linkTarget : path.resolve(path.dirname(filePath), linkTarget));
+		} catch {}
 		const parentDir = path.dirname(filePath);
 		const basename = path.basename(filePath);
 		if (parentDir === filePath) return filePath;

package/dist/{serve-CavAHPdQ.mjs → serve-DO9Edl5S.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { W as PROMPT_TEXT_MAX, c as requireApiUrl, d as AGENT_QUEST_MANIFEST, f as AGENT_QUEST_MCP_URI, n as logger, s as parseApiUrl, t as ConfigStore, u as AGENT_QUEST_ID } from "./ConfigStore-DHNgFdOu.mjs";
-import { t as ApiClient } from "./ApiClient-EUTyn5yu.mjs";
+import { J as PROMPT_TEXT_MAX, _ as AGENT_QUEST_MCP_URI, f as parseApiUrl, g as AGENT_QUEST_MANIFEST, h as AGENT_QUEST_ID, n as logger, p as requireApiUrl, t as ConfigStore } from "./ConfigStore-DdHHCH2t.mjs";
+import { t as ApiClient } from "./ApiClient-BOWpVvTq.mjs";
 import { z as z$1 } from "zod";
 import { isAxiosError } from "axios";
 import { Writable } from "node:stream";

package/dist/types-CdIKgWWe.mjs

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import { t as DEFAULT_SANDBOX_CONFIG } from "./types-F61_hxmG.mjs";
+export { DEFAULT_SANDBOX_CONFIG };

package/dist/{types-LyRNHOiS.mjs → types-F61_hxmG.mjs}

@@ -16,6 +16,8 @@ const DEFAULT_SANDBOX_CONFIG = {
 			"$HOME/.aws",
 			"$HOME/.gnupg",
 			"$HOME/.env",
+			"$HOME/.claude",
+			"$HOME/.bike4mind",
 			"/etc/shadow",
 			"/etc/passwd"
 		]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bike4mind/cli",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "mcpName": "io.github.bike4mind/bike4mind",
   "type": "module",
   "description": "Interactive CLI tool for Bike4Mind with ReAct agents",
@@ -56,57 +56,57 @@
     "@smithy/node-http-handler": "^4.9.3",
     "async-mutex": "^0.5.0",
     "axios": "1.18.0",
-    "bcryptjs": "^3.0.2",
-    "better-sqlite3": "^13.0.1",
+    "bcryptjs": "^3.0.3",
+    "better-sqlite3": "^13.0.3",
     "cheerio": "1.2.0",
-    "chess.js": "^1.0.0-beta.8",
+    "chess.js": "^1.4.0",
     "cli-highlight": "^2.1.11",
-    "csv-parse": "^7.0.1",
-    "dayjs": "^1.11.21",
+    "csv-parse": "^7.0.2",
+    "dayjs": "^1.11.23",
     "diff": "^9.0.0",
     "dotenv": "^17.4.2",
     "eventsource-parser": "^3.1.0",
     "fdir": "^6.5.0",
-    "file-type": "^22.0.1",
-    "fuse.js": "^7.4.2",
+    "file-type": "^22.1.0",
+    "fuse.js": "^7.5.0",
     "fzf": "^0.5.2",
     "glob": "^13.0.6",
     "gray-matter": "^4.0.3",
-    "ignore": "^7.0.6",
-    "ink": "^7.1.0",
+    "ignore": "^7.0.9",
+    "ink": "^7.1.1",
     "ink-select-input": "^6.2.0",
     "ink-spinner": "^5.0.0",
     "ink-text-input": "^6.0.0",
     "jsonwebtoken": "^9.0.3",
-    "jszip": "^3.10.1",
+    "jszip": "^3.10.2",
     "lodash": "^4.18.1",
-    "mammoth": "^1.12.0",
+    "mammoth": "^1.12.3",
     "marked": "^15.0.11",
     "mathjs": "^15.2.0",
     "mime-types": "^3.0.2",
     "mongoose": "^8.24.1",
     "ollama": "^0.6.3",
-    "open": "^11.0.0",
+    "open": "^11.0.4",
     "openai": "^6.46.0",
-    "p-limit": "^7.3.0",
-    "picomatch": "^4.0.5",
+    "p-limit": "^7.3.2",
+    "picomatch": "^4.0.7",
     "qrcode": "^1.5.4",
     "react": "^19.2.7",
-    "sharp": "^0.35.3",
+    "sharp": "^0.35.4",
     "shell-quote": "^1.10.0",
     "speakeasy": "^2.0.0",
     "tiktoken": "^1.0.22",
-    "tldts": "^7.4.8",
+    "tldts": "^7.4.13",
     "tree-sitter-wasms": "^0.1.13",
     "turndown": "^7.2.4",
     "undici": "^7.29.0",
     "unpdf": "^1.6.2",
-    "uuid": "^14.0.1",
+    "uuid": "^14.0.2",
     "voyageai": "^0.4.0",
     "web-tree-sitter": "0.25.10",
-    "ws": "^8.21.0",
+    "ws": "^8.21.3",
     "xlsx": "https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz",
-    "yargs": "^18.0.0",
+    "yargs": "^18.1.0",
     "yauzl": "^3.4.0",
     "zod": "^4.4.3",
     "zod-validation-error": "^5.0.0",
@@ -126,15 +126,15 @@
     "tsx": "^4.23.0",
     "typescript": "^5.9.3",
     "vitest": "^4.1.10",
-    "@bike4mind/agents": "1.0.6",
-    "@bike4mind/common": "7.3.0",
-    "@bike4mind/fab-pipeline": "1.3.6",
+    "@bike4mind/agents": "0.0.0-snapshot-changeset-release-main-20260922072433",
+    "@bike4mind/common": "0.0.0-snapshot-changeset-release-main-20260922072433",
+    "@bike4mind/fab-pipeline": "0.0.0-snapshot-changeset-release-main-20260922072433",
     "@bike4mind/hearth": "0.3.0",
-    "@bike4mind/llm-adapters": "0.15.0",
-    "@bike4mind/mcp": "2.0.6",
-    "@bike4mind/observability": "0.2.0",
-    "@bike4mind/services": "8.0.0",
-    "@bike4mind/utils": "5.2.0"
+    "@bike4mind/llm-adapters": "0.0.0-snapshot-changeset-release-main-20260922072433",
+    "@bike4mind/mcp": "0.0.0-snapshot-changeset-release-main-20260922072433",
+    "@bike4mind/observability": "0.2.1",
+    "@bike4mind/services": "0.0.0-snapshot-changeset-release-main-20260922072433",
+    "@bike4mind/utils": "0.0.0-snapshot-changeset-release-main-20260922072433"
   },
   "optionalDependencies": {
     "@vscode/ripgrep": "^1.18.0"

package/dist/types-CqscS34o.mjs

@@ -1,3 +0,0 @@
-#!/usr/bin/env node
-import { t as DEFAULT_SANDBOX_CONFIG } from "./types-LyRNHOiS.mjs";
-export { DEFAULT_SANDBOX_CONFIG };