@bike4mind/cli 1.0.0 → 1.2.0

package/dist/index.mjs

@@ -1,19 +1,19 @@
 #!/usr/bin/env node
-import { $ as RemoteSkillSource, A as FallbackLlmBackend, C as createWriteTodosTool, D as createResumeAgentTool, E as createCoordinateTaskTool, G as DEFAULT_THOROUGHNESS, H as DEFAULT_AGENT_MODEL, I as PermissionManager, J as setWebSocketToolExecutor, K as clearFeatureModuleTools, N as findIterationBoundary, O as createBackgroundAgentTools, P as extractCompactInstructions, Q as isReadOnlyTool, R as getProcessHooks, S as createTodoStore, T as parseAgentConfig, U as DEFAULT_MAX_ITERATIONS, V as ALWAYS_DENIED_FOR_AGENTS, W as DEFAULT_RETRY_CONFIG, X as buildSystemPrompt, Y as getPlanModeFilePath, Z as buildSkillsPromptSection, _ as createDecisionStore, at as searchCommands, b as createWorkItemTools, c as isTransientNetworkError, ct as searchFiles, d as createReviewGateTool, et as CustomCommandStore, f as formatReviewGatesOutput, ft as MAX_PASTE_SIZE, g as createDecisionLogTool, h as formatBlockersOutput, it as processFileReferences, j as substituteArguments, k as createAgentDelegateTool, lt as warmFileCache, m as createBlockerTools, nt as SessionStore, ot as mergeCommands, p as createBlockerStore, q as registerFeatureModuleTools, rt as hasFileReferences, st as formatFileSize, tt as CheckpointStore, u as createReviewGateStore, ut as COMPACTION_SUMMARY_MARKER, v as formatDecisionsOutput, w as createSkillTool, x as createFindDefinitionTool, y as createGetFileStructureTool } from "./AgentHistoryStore-CrRb8cMt.mjs";
+import { $ as CustomCommandStore, A as createAgentDelegateTool, B as ALWAYS_DENIED_FOR_AGENTS, C as createTodoStore, D as createCoordinateTaskTool, E as parseAgentConfig, F as PermissionManager, H as DEFAULT_MAX_ITERATIONS, J as setWebSocketToolExecutor, K as clearFeatureModuleTools, L as wrapTools, M as substituteArguments, O as createResumeAgentTool, P as findIterationBoundary, Q as RemoteSkillSource, R as getProcessHooks, S as createFindDefinitionTool, T as createSkillTool, U as DEFAULT_RETRY_CONFIG, V as DEFAULT_AGENT_MODEL, W as DEFAULT_THOROUGHNESS, X as buildSystemPrompt, Y as getPlanModeFilePath, Z as buildSkillsPromptSection, _ as createDecisionLogTool, at as searchCommands, b as createGetFileStructureTool, ct as formatFileSize, d as createReviewGateStore, dt as COMPACTION_SUMMARY_MARKER, et as CheckpointStore, f as createReviewGateTool, g as formatBlockersOutput, h as createBlockerTools, j as FallbackLlmBackend, k as createBackgroundAgentTools, lt as searchFiles, m as createBlockerStore, nt as hasFileReferences, ot as mergeCommands, p as formatReviewGatesOutput, pt as MAX_PASTE_SIZE, q as registerFeatureModuleTools, rt as processFileReferences, s as buildSandbox, st as rewireReservedNames, tt as SessionStore, u as isTransientNetworkError, ut as warmFileCache, v as createDecisionStore, w as createWriteTodosTool, x as createWorkItemTools, y as formatDecisionsOutput } from "./AgentHistoryStore-B2NEOvSW.mjs";
 import { a as selectLiveSubagentTokens, i as selectLiveSubagentCredits, n as selectActiveBackgroundShells, o as useCliStore, r as selectCompletedBackgroundShells, t as selectActiveBackgroundAgents } from "./store-CvjTpQPs.mjs";
 import { r as isFeatureEnabled, t as PluginStore } from "./PluginStore-DwvOJ-G3.mjs";
-import { $t as actorKindSchema, Qt as actorKindMarker, X as REVIEW_GATE_STATUS_VALUES, Xt as ACTOR_COLOR_SLOTS, Z as SUBQUEST_STATUS_VALUES, Zt as actorColorIndex, a as getCreditsUrl, b as CREDIT_DEDUCT_TRANSACTION_TYPES, c as requireApiUrl, en as selfClaimedActorKindSchema, i as LOCAL_DEV_URL, l as resolveApiEndpoint, n as logger, o as getEnvironmentName, r as ApiEndpointUnconfiguredError, s as parseApiUrl, t as ConfigStore, x as ChatModels, xt as isEarlyStop } from "./ConfigStore-DHNgFdOu.mjs";
+import { C as CREDIT_DEDUCT_TRANSACTION_TYPES, F as REVIEW_GATE_STATUS_VALUES, K as isEarlyStop, L as SUBQUEST_STATUS_VALUES, c as SESSION_ID_PATTERN, d as LOCAL_DEV_URL, et as ACTOR_COLOR_SLOTS, f as getCreditsUrl, g as resolveApiEndpoint, h as requireApiUrl, it as selfClaimedActorKindSchema, l as isValidSessionId, m as parseApiUrl, n as logger, nt as actorKindMarker, p as getEnvironmentName, r as extractCompactInstructions, rt as actorKindSchema, s as isReadOnlyTool, t as ConfigStore, tt as actorColorIndex, u as ApiEndpointUnconfiguredError, w as ChatModels } from "./ConfigStore-qV7NrCgZ.mjs";
+import { a as deferredToolRegistry, i as createToolSearchTool, n as buildSupportingStores, o as NotifyingLlmBackend, r as buildLlmBackend, t as buildAgent } from "./buildAgent-C-C-VGff.mjs";
 import { t as getShellSessionManager } from "./ShellSessionManager-6o8KZzl1-vrbPAUTq.mjs";
-import { n as OAuthClient, t as ApiClient } from "./ApiClient-EUTyn5yu.mjs";
+import { n as OAuthClient, t as ApiClient } from "./ApiClient-D0fQ2FT6.mjs";
 import { i as getTokenCounter, n as ConversationContext, r as reconstructTurnBlocks, t as WorkItemsClient } from "./WorkItemsClient-Cow6nXx7.mjs";
-import { a as createToolSearchTool, i as buildLlmBackend, n as buildSupportingStores, o as deferredToolRegistry, r as buildSandbox, s as NotifyingLlmBackend, t as buildAgent } from "./buildAgent-CJrkEG0M.mjs";
-import { t as version } from "./package-7a45-Svr.mjs";
+import { t as version } from "./package-CGZIoxcs.mjs";
 import { r as checkForUpdate } from "./updateChecker-CQW8bxo6.mjs";
 import React, { useCallback, useEffect, useMemo, useReducer, useRef, useState, useSyncExternalStore } from "react";
 import { Box, Static, Text, render, useApp, useInput, usePaste, useStdout } from "ink";
-import { execSync, spawn } from "child_process";
+import { execFile, execSync, spawn } from "child_process";
 import { randomBytes } from "crypto";
-import { existsSync, promises, readFileSync, statSync } from "fs";
+import { constants, existsSync, promises, readFileSync, statSync } from "fs";
 import { homedir } from "os";
 import path, { basename, extname, join } from "path";
 import { v4 } from "uuid";
@@ -25,6 +25,7 @@ import { z as z$1 } from "zod";
 import axios, { isAxiosError } from "axios";
 import { marked } from "marked";
 import { highlight } from "cli-highlight";
+import { promisify } from "util";
 import SelectInput from "ink-select-input";
 import jwt from "jsonwebtoken";
 import open from "open";
@@ -1083,9 +1084,28 @@ function CompletedGroupNotification() {
 }
 //#endregion
 //#region src/components/PermissionPrompt.tsx
+/**
+* Escape characters that let model-authored text render differently from what
+* actually runs, into a visible escape form. The preview and arguments are
+* model-authored, so the approved text could otherwise differ from what runs.
+* Two ranges are covered, deliberately and no wider:
+*   - C0 controls (minus tab/newline) and DEL -> `\xHH`: a raw `\r` or ESC
+*     sequence could rewrite the line the user is approving.
+*   - Unicode bidi overrides U+202A..U+202E and isolates U+2066..U+2069
+*     -> `\uXXXX`: these reorder displayed glyphs without changing the
+*     underlying code points, spoofing the same way.
+* Tab and newline are left intact (newline is already the line delimiter).
+* Widen the scope here, so both call sites gain it at once.
+*/
+function escapeTerminalControlChars(text) {
+	return text.replace(/[\x00-\x08\x0b-\x1f\x7f\u202a-\u202e\u2066-\u2069]/g, (ch) => {
+		const code = ch.charCodeAt(0);
+		return code > 255 ? `\\u${code.toString(16).padStart(4, "0")}` : `\\x${code.toString(16).padStart(2, "0")}`;
+	});
+}
 /** Render a diff/preview string, color-coding each line by its prefix (see per-branch comments below). */
 function renderDiffPreview(preview) {
-	return preview.split("\n").map((line, index) => {
+	return escapeTerminalControlChars(preview).split("\n").map((line, index) => {
 		if (line.startsWith("🛑")) return /* @__PURE__ */ React.createElement(Text, {
 			key: index,
 			bold: true,
@@ -1218,7 +1238,7 @@ function PermissionPrompt({ toolName, toolDescription, args, preview, canBeTrust
 	}, /* @__PURE__ */ React.createElement(Text, { bold: true }, "Arguments:"), /* @__PURE__ */ React.createElement(Box, {
 		paddingLeft: 2,
 		flexDirection: "column"
-	}, /* @__PURE__ */ React.createElement(Text, { dimColor: true }, argsString))), preview && /* @__PURE__ */ React.createElement(Box, {
+	}, /* @__PURE__ */ React.createElement(Text, { dimColor: true }, escapeTerminalControlChars(argsString)))), preview && /* @__PURE__ */ React.createElement(Box, {
 		marginTop: 1,
 		flexDirection: "column"
 	}, /* @__PURE__ */ React.createElement(Text, { bold: true }, "Preview:"), /* @__PURE__ */ React.createElement(Box, {
@@ -2656,6 +2676,40 @@ function TrustLocationSelector({ inProject, onSelect, onCancel }) {
 	}), /* @__PURE__ */ React.createElement(Box, { marginTop: 1 }, /* @__PURE__ */ React.createElement(Text, { dimColor: true }, "Use ↑↓ arrows to navigate, Enter to select, Ctrl+C to cancel")));
 }
 //#endregion
+//#region src/components/FolderTrustPrompt.tsx
+/**
+* One-time startup prompt shown when the current project root ships repo-committed
+* b4m files (config, .mcp.json, agents, skills, commands) but has not been
+* trusted. Until trusted, those files are inert - no config merge, no MCP spawn,
+* no agent/skill/command load. "Trust this folder" persists the decision; "Not
+* now" keeps the project untrusted for this session (re-prompts next launch).
+*
+* "Not now" is listed first so it is the preselected default: Enter-through on a
+* freshly cloned repo must not grant trust.
+*/
+function FolderTrustPrompt({ projectRoot, onSelect }) {
+	return /* @__PURE__ */ React.createElement(Box, {
+		flexDirection: "column",
+		marginY: 1
+	}, /* @__PURE__ */ React.createElement(Box, {
+		marginBottom: 1,
+		flexDirection: "column"
+	}, /* @__PURE__ */ React.createElement(Text, {
+		bold: true,
+		color: "yellow"
+	}, "This project ships Bike4Mind config that can run code."), /* @__PURE__ */ React.createElement(Text, { dimColor: true }, projectRoot), /* @__PURE__ */ React.createElement(Text, null, "Repo-committed config, MCP servers, agents and skills stay inert until you trust this folder. Only trust folders you would run code from.")), /* @__PURE__ */ React.createElement(SelectInput, {
+		items: [{
+			label: "Not now - keep repo config inert this session",
+			value: "not-now"
+		}, {
+			label: "Trust this folder - load its config, agents, skills and MCP servers",
+			value: "trust"
+		}],
+		onSelect: (item) => onSelect(item.value),
+		itemComponent: ({ isSelected, label }) => /* @__PURE__ */ React.createElement(Box, null, /* @__PURE__ */ React.createElement(Text, { color: isSelected ? "cyan" : void 0 }, isSelected ? "❯ " : "  ", label))
+	}), /* @__PURE__ */ React.createElement(Box, { marginTop: 1 }, /* @__PURE__ */ React.createElement(Text, { dimColor: true }, "Use ↑↓ arrows to navigate, Enter to select. You can change this later with /trust folder.")));
+}
+//#endregion
 //#region src/components/RewindSelector.tsx
 function RewindSelector({ messages, onSelect, onCancel }) {
 	const [step, setStep] = useState("selection");
@@ -2882,6 +2936,22 @@ function EnvironmentPicker({ onSelect }) {
 }
 //#endregion
 //#region src/components/LoginFlow.tsx
+/**
+* Only https URLs (and http on localhost for dev) may be handed to the OS opener.
+* The device-flow response is server-controlled, so a hostile/compromised server
+* could return `file:///...`, `javascript:...` or similar and have the OS launch
+* it. Reject anything that isn't a plain web URL.
+*/
+function isBrowserOpenableUrl(raw) {
+	let url;
+	try {
+		url = new URL(raw);
+	} catch {
+		return false;
+	}
+	if (url.protocol === "https:") return true;
+	return url.protocol === "http:" && (url.hostname === "localhost" || url.hostname === "127.0.0.1");
+}
 function extractErrorMessage(err) {
 	if (axios.isAxiosError(err)) {
 		if (err.response?.data) {
@@ -2939,9 +3009,10 @@ function LoginFlow({ apiUrl = "http://localhost:3000", configStore, onSuccess, o
 		onError
 	]);
 	useEffect(() => {
-		if (deviceFlow && status === "waiting") open(deviceFlow.verification_uri_complete).catch((err) => {
+		if (deviceFlow && status === "waiting") if (isBrowserOpenableUrl(deviceFlow.verification_uri_complete)) open(deviceFlow.verification_uri_complete).catch((err) => {
 			console.error("Failed to auto-open browser:", err);
 		});
+		else console.error("Refusing to auto-open untrusted verification URL:", deviceFlow.verification_uri_complete);
 	}, [deviceFlow, status]);
 	if (status === "initiating") return /* @__PURE__ */ React.createElement(Box, {
 		flexDirection: "column",
@@ -3087,6 +3158,35 @@ var CommandHistoryStore = class {
 	}
 };
 //#endregion
+//#region src/storage/buildGlobalConfigPatch.ts
+/**
+* Compute the minimal global-config patch for a /config editor save: only the
+* editor-owned fields (defaultModel, preferences, features) that the user
+* actually changed vs the current effective (merged) config. Unchanged fields
+* are omitted, so a repo-injected value the user never touched is never
+* laundered into the global layer by a save() that spreads the merged config.
+*
+* defaultModel and preferences diff per key. features stays whole-object when
+* anything changed, on purpose: ConfigStore.save() feeds config.features to
+* mergeFeatures as the caller's COMPLETE desired set (absence of a key means
+* "removed"), so a per-key diff would make save() delete untouched keys. That
+* whole-object features path is only latently launderable today (no repo layer
+* populates features); tightening it needs a coordinated change to save()'s
+* concurrent-writer merge and is tracked separately.
+*/
+function buildGlobalConfigPatch(prev, next) {
+	const patch = {};
+	if (next.defaultModel !== prev?.defaultModel) patch.defaultModel = next.defaultModel;
+	const changedPreferences = {};
+	for (const [key, value] of Object.entries(next.preferences)) {
+		const prevValue = (prev?.preferences)?.[key];
+		if (JSON.stringify(value) !== JSON.stringify(prevValue)) changedPreferences[key] = value;
+	}
+	if (Object.keys(changedPreferences).length > 0) patch.preferences = changedPreferences;
+	if (JSON.stringify(next.features ?? {}) !== JSON.stringify(prev?.features ?? {})) patch.features = next.features;
+	return patch;
+}
+//#endregion
 //#region src/utils/formatStep.ts
 const MAX_INPUT_LENGTH = 500;
 /**
@@ -3476,7 +3576,7 @@ function toStringArray(value) {
 function extractJsonObject(text) {
 	const trimmed = text.trim();
 	if (!trimmed) return null;
-	const fenced = trimmed.match(/```(?:json)?\s*([\s\S]*?)```/i);
+	const fenced = trimmed.match(/```(?:json)?([\s\S]*?)```/i);
 	const candidate = fenced ? fenced[1].trim() : trimmed;
 	const start = candidate.indexOf("{");
 	if (start === -1) return null;
@@ -6668,6 +6768,168 @@ function createBuiltinModules(config, apiClient) {
 	return modules;
 }
 //#endregion
+//#region src/features/bridgePresence/peerOwner.ts
+const execFileAsync = promisify(execFile);
+const LSOF_TIMEOUT_MS = 2e3;
+const LSOF_CANDIDATES = ["/usr/sbin/lsof", "/usr/bin/lsof"];
+/**
+* Resolve the OS owner of the process holding the LISTEN socket on
+* `127.0.0.1:<port>`. This is the only pre-transmission trust signal the CLI
+* has over loopback TCP: the peer is whoever holds the port, so we confirm it
+* is the same UID as this process BEFORE handing it the bridge secret.
+*
+* Pure platform probe: the per-platform helpers classify every EXPECTED failure
+* into `no-listener`/`unknown` themselves. An UNEXPECTED throw (a bug) is left to
+* propagate so the CLI-layer caller can log it and fail closed - this module
+* deliberately does not depend on the CLI logger.
+*/
+async function resolveLoopbackListenerOwner(port) {
+	if (process.platform === "linux") return resolveViaProcNet(port);
+	if (process.platform === "darwin") return resolveViaLsof(port);
+	return { kind: "unknown" };
+}
+/**
+* Whether this platform + process can resolve loopback listener ownership at all:
+* there must be a `getuid` to compare against (Windows has none) AND an owner probe
+* for the platform. When false, the caller latches presence off rather than spinning
+* a retry loop forever on a check that can never pass (a `getuid`-bearing platform
+* with no probe - BSD/SunOS - would otherwise retry indefinitely).
+* MUST stay in sync with `resolveLoopbackListenerOwner`'s platform dispatch above:
+* a platform gains a probe there and a `true` here in the same change.
+*/
+function canResolveLoopbackOwner() {
+	if (typeof process.getuid !== "function") return false;
+	return process.platform === "linux" || process.platform === "darwin";
+}
+async function resolveViaProcNet(port) {
+	const uids = /* @__PURE__ */ new Set();
+	let readAny = false;
+	for (const file of ["/proc/net/tcp", "/proc/net/tcp6"]) {
+		let text;
+		try {
+			text = await promises.readFile(file, "utf8");
+		} catch {
+			continue;
+		}
+		readAny = true;
+		for (const uid of parseProcNetForUid(text, port)) uids.add(uid);
+	}
+	if (!readAny) return { kind: "unknown" };
+	if (uids.size === 0) return { kind: "no-listener" };
+	return uids.size === 1 ? {
+		kind: "owner",
+		uid: [...uids][0]
+	} : { kind: "unknown" };
+}
+/**
+* `local_address` hex (upper-case) of a socket that receives connections to
+* `127.0.0.1`: loopback itself, the v4/v6 wildcard binds (a same-UID process
+* may legitimately hold `0.0.0.0`/`::`), and the v4-mapped-in-v6 forms. A row
+* on any other IP is a different socket that happens to share the port number
+* and must NOT be attributed to the loopback peer.
+*
+* `/proc/net/tcp6` prints each 32-bit word of the address little-endian (no
+* `ntohl`), which is why `127.0.0.1` reads `0100007F` and the mapped third word
+* `00 00 ff ff` reads `FFFF0000`.
+*/
+const LOOPBACK_OR_WILDCARD_HEX = /* @__PURE__ */ new Set([
+	"00000000",
+	"0100007F",
+	"00000000000000000000000000000000",
+	"00000000000000000000000001000000",
+	"0000000000000000FFFF000000000000",
+	"0000000000000000FFFF00000100007F"
+]);
+/**
+* Parse a `/proc/net/tcp`(6) dump for the UIDs of LISTEN sockets on the
+* loopback `port`. Row columns are whitespace-separated: sl(0)
+* local_address(1) rem_address(2) st(3) tx:rx(4) tr:when(5) retrnsmt(6)
+* uid(7). `local_address` is `HEXIP:HEXPORT`; `st` `0A` is TCP_LISTEN. The IP
+* must be loopback or wildcard, else a same-port listener on another interface
+* would be mis-attributed to the loopback peer. Returns every match so the
+* caller can reject an ambiguous set (two distinct owners) rather than
+* silently taking the first.
+*/
+function parseProcNetForUid(text, port) {
+	const uids = [];
+	for (const line of text.split("\n")) {
+		const cols = line.trim().split(/\s+/);
+		if (cols.length < 8) continue;
+		const local = cols[1];
+		const colon = local.lastIndexOf(":");
+		if (colon < 0) continue;
+		if (parseInt(local.slice(colon + 1), 16) !== port) continue;
+		if (cols[3] !== "0A") continue;
+		if (!LOOPBACK_OR_WILDCARD_HEX.has(local.slice(0, colon).toUpperCase())) continue;
+		const uid = Number(cols[7]);
+		if (Number.isInteger(uid)) uids.push(uid);
+	}
+	return uids;
+}
+async function resolveViaLsof(port) {
+	const lsof = await resolveLsofPath();
+	if (!lsof) return { kind: "unknown" };
+	let stdout;
+	try {
+		({stdout} = await execFileAsync(lsof, [
+			"-nP",
+			`-iTCP:${port}`,
+			"-sTCP:LISTEN",
+			"-Fpun"
+		], { timeout: LSOF_TIMEOUT_MS }));
+	} catch (err) {
+		const e = err;
+		if (!e.killed && e.code === 1 && !e.stdout) return { kind: "no-listener" };
+		if (e.killed || typeof e.stdout !== "string") return { kind: "unknown" };
+		stdout = e.stdout;
+	}
+	const uids = new Set(parseLsofForUid(stdout));
+	if (uids.size === 0) return { kind: "no-listener" };
+	return uids.size === 1 ? {
+		kind: "owner",
+		uid: [...uids][0]
+	} : { kind: "unknown" };
+}
+let lsofPathCache;
+async function resolveLsofPath() {
+	if (lsofPathCache !== void 0) return lsofPathCache;
+	for (const candidate of LSOF_CANDIDATES) try {
+		await promises.access(candidate, constants.X_OK);
+		lsofPathCache = candidate;
+		return candidate;
+	} catch {}
+	lsofPathCache = null;
+	return null;
+}
+/** Does an `lsof -nP` numeric socket name (`n` field, host:port) receive
+*  connections to `127.0.0.1`? Loopback, wildcard, or v4-mapped loopback -
+*  exact, to stay symmetric with the linux matcher (the CLI only dials
+*  `127.0.0.1`). */
+function isLoopbackLsofName(name) {
+	return name.startsWith("127.0.0.1:") || name.startsWith("*:") || name.startsWith("[::1]:") || name.startsWith("[::]:") || name.startsWith("[::ffff:127.0.0.1]:");
+}
+/**
+* Parse `lsof -Fpun` output for the UIDs of loopback listeners. `-F` prints
+* one field per line prefixed by its type char; `u<uid>` is a process-level
+* field, `n<host:port>` a file-level one. `uid` resets on each `p<pid>` block
+* so a block without a `u` field can't inherit the prior block's owner. We
+* collect the UID for every loopback/wildcard name so the caller can reject an
+* ambiguous set rather than taking the first.
+*/
+function parseLsofForUid(text) {
+	const uids = [];
+	let uid = null;
+	for (const line of text.split("\n")) {
+		const tag = line[0];
+		if (tag === "p") uid = null;
+		else if (tag === "u") {
+			const parsed = Number(line.slice(1));
+			uid = Number.isInteger(parsed) ? parsed : null;
+		} else if (tag === "n" && uid !== null && isLoopbackLsofName(line.slice(1))) uids.push(uid);
+	}
+	return uids;
+}
+//#endregion
 //#region src/features/bridgePresence/BridgePresence.ts
 const DEFAULT_PORT = Number(process.env.CC_BRIDGE_PORT ?? 48732);
 const CONFIG_PATH = join(homedir(), ".b4m", "cc-bridge.json");
@@ -6693,11 +6955,15 @@ var BridgePresence = class {
 		this.callbacks = {};
 		this.started = false;
 		this.stopped = false;
+		this.generation = 0;
+		this.trusted = false;
+		this.wsConnectingGen = null;
 		this.reconnectTimer = null;
 		this.reconnectAttempts = 0;
 		this.announceRetryTimer = null;
 		this.announceAttempts = 0;
 		this.startOpts = null;
+		this.peerWarned = false;
 		this.pendingWorkspaceName = null;
 		this.pendingCapabilities = null;
 		this.pendingSource = null;
@@ -6706,6 +6972,19 @@ var BridgePresence = class {
 	setCallbacks(cbs) {
 		this.callbacks = cbs;
 	}
+	/** True iff `gen` is still the live connection generation - the single spelling
+	*  of the ABA guard applied after every await (see `generation`). */
+	isCurrent(gen) {
+		return gen === this.generation;
+	}
+	/** Test-only: the generation currently holding the connectCommandWs in-flight
+	*  latch, or null when free. Exposed to pin the `finally` identity guard - a
+	*  stale generation's finally must not clear a live generation's latch (which
+	*  would let a second overlapping connect build an untracked socket). Not part
+	*  of the runtime contract. */
+	get __wsConnectingGenForTests() {
+		return this.wsConnectingGen;
+	}
 	/**
 	* Probe the local bridge and, if present, announce this CLI session.
 	* Returns true iff the announce succeeded (tavern presence is active).
@@ -6719,7 +6998,10 @@ var BridgePresence = class {
 		if (this.started) return this.instanceId !== null;
 		this.stopped = false;
 		this.started = true;
+		this.generation += 1;
+		const gen = this.generation;
 		const config = await readBridgeConfig();
+		if (!this.isCurrent(gen)) return false;
 		if (!config) {
 			logger.debug("[tavern] cc-bridge not configured; CLI runs without tavern presence");
 			return false;
@@ -6731,34 +7013,119 @@ var BridgePresence = class {
 		this.pendingSource = opts.source ?? "b4m-cli";
 		return this.attemptAnnounce();
 	}
+	/**
+	* Classify the process holding the bridge port relative to this CLI, BEFORE
+	* any secret leaves the process. Over loopback TCP the peer is whoever holds
+	* the port; the secret file is plaintext and per-user, so a same-UID peer is
+	* already trusted (it could read the file directly), and a different-UID (or
+	* sandboxed) peer is the adversary this gate stops.
+	*
+	* Four outcomes, so the caller warns only on a real trust failure (a foreign
+	* owner) and stays quiet on the benign ones:
+	*  - `trusted`        - same-UID owner; disclosure is safe.
+	*  - `absent`         - no loopback listener yet (cc-bridge simply not
+	*                       started); fail-closed but quiet - just retry.
+	*  - `foreign`        - a different-UID owner holds the port; fail-closed AND
+	*                       log the security-worded warning (the real adversary).
+	*  - `undeterminable` - ownership can't be resolved: lookup tool missing/hung,
+	*                       a read/spawn error, or an ambiguous owner set.
+	*                       Fail-closed, but a host that can't run the probe is not
+	*                       an attacker - log at debug, not as the security warning.
+	*
+	* A platform that can't resolve ownership (see `canResolveLoopbackOwner`) is
+	* latched off earlier, in `attemptAnnounce`, so this method is only reached
+	* where `getuid` exists and the platform has an owner probe.
+	*/
+	async checkPeerTrust() {
+		const port = this.config?.port ?? DEFAULT_PORT;
+		let owner;
+		try {
+			owner = await resolveLoopbackListenerOwner(port);
+		} catch (err) {
+			logger.debug(`[tavern] loopback owner lookup threw: ${err.message}`);
+			return "undeterminable";
+		}
+		if (owner.kind === "no-listener") return "absent";
+		if (owner.kind === "unknown") return "undeterminable";
+		if (owner.uid !== process.getuid()) return "foreign";
+		this.peerWarned = false;
+		return "trusted";
+	}
+	/** Log the foreign-owner security warning once per untrusted state. */
+	warnUntrustedPeerOnce() {
+		if (this.peerWarned) return;
+		this.peerWarned = true;
+		logger.warn("[tavern] bridge port is held by a different user; not disclosing secret or handling commands");
+	}
 	/** One announce attempt. Schedules a retry on failure; wires up the
 	*  command WS + initial status on success. Idempotent: re-entering after
 	*  a successful announce short-circuits at the instanceId guard. */
 	async attemptAnnounce() {
 		if (this.stopped || !this.config || !this.startOpts) return false;
 		if (this.instanceId) return true;
+		if (!canResolveLoopbackOwner()) {
+			logger.debug("[tavern] ownership unresolvable on this platform; tavern presence disabled");
+			return false;
+		}
+		const gen = this.generation;
+		const startOpts = this.startOpts;
+		if (!await this.gateEgress(gen, "announce")) return false;
 		const instanceId = v4();
 		const workspaceName = this.pendingWorkspaceName;
 		const capabilities = this.pendingCapabilities;
 		const source = this.pendingSource;
-		if (!await this.announce({
+		const announced = await this.announce({
 			instanceId,
 			source,
 			workspaceName,
-			workspacePath: this.startOpts.workspacePath,
+			workspacePath: startOpts.workspacePath,
 			capabilities
-		})) {
+		});
+		if (!this.isCurrent(gen) || this.stopped || !this.config) return false;
+		if (!announced) {
+			this.trusted = false;
 			this.scheduleAnnounceRetry();
 			return false;
 		}
 		this.instanceId = instanceId;
 		this.announceAttempts = 0;
 		logger.info(`[tavern] announced ${workspaceName} to cc-bridge on 127.0.0.1:${this.config.port ?? DEFAULT_PORT}`);
-		this.connectCommandWs();
+		this.connectCommandWs().catch((err) => logger.debug(`[tavern] connectCommandWs threw: ${err.message}`));
 		this.emitEvent({
 			type: "status",
 			status: "idle"
-		});
+		}).catch(() => {});
+		return true;
+	}
+	/** Signal the untrusted condition at the right volume: the security-worded
+	*  warning only for a real foreign owner, and a quiet debug line for the
+	*  benign cases (bridge not started yet, or ownership undeterminable) so we
+	*  don't cry wolf on every backed-off retry. */
+	signalUntrusted(trust, phase) {
+		if (trust === "foreign") this.warnUntrustedPeerOnce();
+		else if (trust === "undeterminable") logger.debug(`[tavern] bridge port owner undeterminable; retrying ${phase}`);
+		else logger.debug(`[tavern] cc-bridge not reachable yet; retrying ${phase}`);
+	}
+	/**
+	* Run the pre-disclosure ownership gate for one egress phase and open or keep
+	* the trust latch closed. The caller passes the connection `generation` it
+	* captured BEFORE this await, so a stop()+start() cycle (or a bare stop())
+	* landing during the probe is detected and this stale continuation bails.
+	* Returns true iff the gate is open (secret disclosure is now permitted for
+	* this generation); false means the caller must return - either the owner is
+	* untrusted (a retry has been scheduled) or the generation moved.
+	*/
+	async gateEgress(gen, phase) {
+		const trust = await this.checkPeerTrust();
+		if (!this.isCurrent(gen) || this.stopped || !this.config) return false;
+		if (trust !== "trusted") {
+			this.trusted = false;
+			this.signalUntrusted(trust, phase);
+			if (phase === "announce") this.scheduleAnnounceRetry();
+			else this.scheduleReconnect();
+			return false;
+		}
+		this.trusted = true;
 		return true;
 	}
 	scheduleAnnounceRetry() {
@@ -6767,17 +7134,22 @@ var BridgePresence = class {
 		const delay = Math.min(1e3 * 2 ** (this.announceAttempts - 1), 3e4);
 		this.announceRetryTimer = setTimeout(() => {
 			this.announceRetryTimer = null;
-			this.attemptAnnounce();
+			this.attemptAnnounce().catch((err) => logger.debug(`[tavern] announce retry threw: ${err.message}`));
 		}, delay);
 	}
 	/** Emit an event for this session. No-op if the bridge isn't up. Events
 	*  leave in strict order - see `emitQueue` comment. */
 	async emitEvent(event) {
 		if (!this.config || !this.instanceId) return;
-		const task = () => this.post("/event", {
-			instanceId: this.instanceId,
-			event
-		}).catch((err) => logger.info(`[tavern] emitEvent ${event.type} failed: ${err.message}`));
+		const instanceId = this.instanceId;
+		const gen = this.generation;
+		const task = () => {
+			if (!this.isCurrent(gen)) return;
+			return this.post("/event", {
+				instanceId,
+				event
+			}).catch((err) => logger.info(`[tavern] emitEvent ${event.type} failed: ${err.message}`));
+		};
 		this.emitQueue = this.emitQueue.then(task, task);
 		return this.emitQueue;
 	}
@@ -6795,6 +7167,7 @@ var BridgePresence = class {
 	async stop(reason = "cli_exit") {
 		if (this.stopped || !this.started) return;
 		this.stopped = true;
+		this.generation += 1;
 		if (this.reconnectTimer) {
 			clearTimeout(this.reconnectTimer);
 			this.reconnectTimer = null;
@@ -6803,13 +7176,14 @@ var BridgePresence = class {
 			clearTimeout(this.announceRetryTimer);
 			this.announceRetryTimer = null;
 		}
+		const wsWasLive = this.ws !== null;
 		if (this.ws) {
 			try {
 				this.ws.close();
 			} catch {}
 			this.ws = null;
 		}
-		if (this.config && this.instanceId) await this.post("/disconnect", {
+		if (this.config && this.instanceId && wsWasLive) await this.post("/disconnect", {
 			instanceId: this.instanceId,
 			reason
 		}).catch(() => {});
@@ -6822,6 +7196,8 @@ var BridgePresence = class {
 		this.pendingSource = null;
 		this.announceAttempts = 0;
 		this.reconnectAttempts = 0;
+		this.peerWarned = false;
+		this.trusted = false;
 		this.emitQueue = Promise.resolve();
 	}
 	async announce(body) {
@@ -6835,6 +7211,7 @@ var BridgePresence = class {
 	}
 	async post(path, body) {
 		if (!this.config) throw new Error("bridge config not loaded");
+		if (!this.trusted) throw new Error("bridge peer not trusted; refusing to disclose secret");
 		const url = `http://127.0.0.1:${this.config.port ?? DEFAULT_PORT}${path}?secret=${encodeURIComponent(this.config.hookSecret)}`;
 		const res = await fetch(url, {
 			method: "POST",
@@ -6844,42 +7221,58 @@ var BridgePresence = class {
 		});
 		if (!res.ok) throw new Error(`bridge ${path} -> ${res.status}`);
 	}
-	connectCommandWs() {
+	async connectCommandWs() {
 		if (this.stopped || !this.config || !this.instanceId) return;
-		const url = `ws://127.0.0.1:${this.config.port ?? DEFAULT_PORT}/commands?instanceId=${encodeURIComponent(this.instanceId)}&secret=${encodeURIComponent(this.config.hookSecret)}`;
-		let ws;
+		const gen = this.generation;
+		if (this.ws || this.wsConnectingGen === gen) return;
+		this.wsConnectingGen = gen;
 		try {
-			ws = new WebSocket(url);
-		} catch (err) {
-			logger.debug(`[tavern] command WS construct failed: ${err.message}`);
-			this.scheduleReconnect();
-			return;
-		}
-		this.ws = ws;
-		ws.on("open", () => {
-			this.reconnectAttempts = 0;
-			logger.debug("[tavern] command WS open");
-		});
-		ws.on("message", (raw) => {
-			let frame = null;
+			if (!await this.gateEgress(gen, "command WS")) return;
+			const config = this.config;
+			const instanceId = this.instanceId;
+			if (!config || !instanceId) return;
+			const url = `ws://127.0.0.1:${config.port ?? DEFAULT_PORT}/commands?instanceId=${encodeURIComponent(instanceId)}&secret=${encodeURIComponent(config.hookSecret)}`;
+			let ws;
 			try {
-				frame = JSON.parse(raw.toString());
-			} catch {
-				logger.debug("[tavern] malformed command frame; ignored");
+				ws = new WebSocket(url);
+			} catch (err) {
+				logger.debug(`[tavern] command WS construct failed: ${err.message}`);
+				this.trusted = false;
+				this.scheduleReconnect();
 				return;
 			}
-			if (!frame?.command) return;
-			this.dispatchCommand(frame.command).catch((err) => logger.warn(`[tavern] command dispatch threw: ${err.message}`));
-		});
-		ws.on("close", () => {
-			this.ws = null;
-			if (this.stopped) return;
-			logger.debug("[tavern] command WS closed; reconnecting");
-			this.scheduleReconnect();
-		});
-		ws.on("error", (err) => {
-			logger.debug(`[tavern] command WS error: ${err.message}`);
-		});
+			this.ws = ws;
+			ws.on("open", () => {
+				if (this.ws !== ws) return;
+				this.reconnectAttempts = 0;
+				logger.debug("[tavern] command WS open");
+			});
+			ws.on("message", (raw) => {
+				if (this.ws !== ws) return;
+				let frame = null;
+				try {
+					frame = JSON.parse(raw.toString());
+				} catch {
+					logger.debug("[tavern] malformed command frame; ignored");
+					return;
+				}
+				if (!frame?.command) return;
+				this.dispatchCommand(frame.command).catch((err) => logger.warn(`[tavern] command dispatch threw: ${err.message}`));
+			});
+			ws.on("close", () => {
+				if (this.ws !== ws) return;
+				this.ws = null;
+				this.trusted = false;
+				if (this.stopped) return;
+				logger.debug("[tavern] command WS closed; reconnecting");
+				this.scheduleReconnect();
+			});
+			ws.on("error", (err) => {
+				logger.debug(`[tavern] command WS error: ${err.message}`);
+			});
+		} finally {
+			if (this.wsConnectingGen === gen) this.wsConnectingGen = null;
+		}
 	}
 	scheduleReconnect() {
 		if (this.stopped || this.reconnectTimer) return;
@@ -6887,10 +7280,11 @@ var BridgePresence = class {
 		const delay = Math.min(500 * 2 ** (this.reconnectAttempts - 1), 1e4);
 		this.reconnectTimer = setTimeout(() => {
 			this.reconnectTimer = null;
-			this.connectCommandWs();
+			this.connectCommandWs().catch((err) => logger.debug(`[tavern] command WS reconnect threw: ${err.message}`));
 		}, delay);
 	}
 	async dispatchCommand(command) {
+		if (this.stopped) return;
 		switch (command.type) {
 			case "send_prompt":
 				if (this.callbacks.onSendPrompt) await this.callbacks.onSendPrompt(command.text);
@@ -7040,7 +7434,7 @@ const infoCommands = [
 	{
 		name: "help",
 		run: (_args, ctx) => {
-			const customCommands = ctx.customCommandStore.getAllCommands();
+			const customCommands = ctx.customCommandStore.getModelReachableCommands();
 			const hasCustomCommands = customCommands.length > 0;
 			console.log(`
 Available commands:
@@ -7069,7 +7463,9 @@ API Configuration:
 Tool Permissions:
   /trust <tool-name> - Trust a tool (won't ask permission again)
   /untrust <tool-name> - Remove tool from trusted list
-  /trusted - List all trusted tools
+  /trust folder - Trust this project (load its repo config, agents, skills, MCP)
+  /untrust folder - Revoke trust for this project (repo config goes inert)
+  /trusted - Show folder-trust status and list all trusted tools
 
 Project Configuration:
   /project-config - Show merged project configuration
@@ -7131,8 +7527,16 @@ Multi-line Input:
 	{
 		name: "trusted",
 		run: (_args, ctx) => {
+			const projectRoot = ctx.configStore.getProjectRealPath();
+			console.log("\n📁 Folder Trust:\n");
+			if (!projectRoot) console.log("  No project root discovered.");
+			else {
+				const isTrusted = ctx.configStore.isProjectTrusted();
+				console.log(`  ${isTrusted ? "✅ Trusted" : "⛔ Not trusted"}: ${projectRoot}`);
+				if (!isTrusted) console.log("  Repo config/agents/skills/MCP stay inert. Trust with /trust folder.");
+			}
 			if (!ctx.permissionManager) {
-				console.log("Permission manager not initialized");
+				console.log("\nPermission manager not initialized\n");
 				return;
 			}
 			const trustedTools = ctx.permissionManager.getTrustedTools();
@@ -7221,6 +7625,48 @@ async function dispatch(name, args, ctx) {
 	return true;
 }
 //#endregion
+//#region src/commands/sandboxNetworkCommand.ts
+async function handleSandboxNetworkCommand(deps, arg) {
+	const { orchestrator, configStore, permissionManager } = deps;
+	if (!orchestrator) return "Sandbox not initialized";
+	if (arg !== "on" && arg !== "off") return "Usage: /sandbox:network <on|off>";
+	const enable = arg === "on";
+	if (enable && !orchestrator.isAvailable()) return "Sandbox runtime not available on this platform";
+	const active = await orchestrator.setNetworkEnabled(enable);
+	if (enable && !active) {
+		permissionManager?.setSandboxState(orchestrator.getMode(), orchestrator.isActive());
+		await configStore.saveSandboxConfig(orchestrator.getConfig());
+		return "Failed to start the network proxy; network stays disabled (fail-closed).";
+	}
+	permissionManager?.setSandboxState(orchestrator.getMode(), orchestrator.isActive());
+	await configStore.saveSandboxConfig(orchestrator.getConfig());
+	if (!enable) return "Sandbox network disabled (fail-closed)";
+	const port = orchestrator.getProxyManager()?.getPort();
+	return `Sandbox network egress enabled${port ? ` (proxy-aware clients filtered on port ${port})` : ""}`;
+}
+//#endregion
+//#region src/commands/sandboxTrustDomainCommand.ts
+async function handleSandboxTrustDomainCommand(deps, domains) {
+	const { orchestrator, configStore } = deps;
+	if (!orchestrator) return "Sandbox not initialized";
+	const clean = domains.map((d) => d.trim()).filter(Boolean);
+	if (clean.length === 0) return "Usage: /sandbox:trust-domain <domain> [...]";
+	if (!orchestrator.getProxyManager()) return "Network proxy not initialized";
+	const lines = [];
+	for (const domain of clean) {
+		orchestrator.addAllowedDomain(domain);
+		lines.push(`  Added: ${domain}`);
+	}
+	try {
+		await configStore.saveSandboxConfig(orchestrator.getConfig());
+	} catch (err) {
+		const msg = err instanceof Error ? err.message : String(err);
+		return `${lines.join("\n")}\nWarning: failed to persist the trusted domains (${msg}); they apply for this session only.`;
+	}
+	lines.push(`Trusted ${clean.length} domain(s)`);
+	return lines.join("\n");
+}
+//#endregion
 //#region src/session/turnController.ts
 /**
 * Turn lifecycle (issue #228, phase 2).
@@ -7265,7 +7711,7 @@ async function runTurn(message, ctx) {
 		const systemPrompt = buildSystemPrompt(config?.preferences.promptVariant ?? "current", {
 			contextContent,
 			agentStore: agentStore || void 0,
-			customCommands: customCommandStore.getAllCommands(),
+			customCommands: customCommandStore.getModelReachableCommands(),
 			enableSkillTool: config?.preferences.enableSkillTool !== false,
 			additionalDirectories,
 			featureModulePrompts: featureRegistry?.getSystemPromptSections() || void 0,
@@ -7753,6 +8199,7 @@ function CliApp() {
 		permissionManager: null,
 		permissionPrompt: null,
 		trustLocationSelector: null,
+		folderTrustPrompt: null,
 		rewindSelector: null,
 		sessionSelector: null,
 		orchestrator: null,
@@ -7771,6 +8218,7 @@ function CliApp() {
 	const [initError, setInitError] = useState(null);
 	const [commandHistory, setCommandHistory] = useState([]);
 	const imageStoreInitPromise = useRef(null);
+	const folderTrustResolvedRef = useRef(false);
 	const todoStoreRef = useRef(createTodoStore());
 	const decisionStoreRef = useRef(createDecisionStore());
 	const blockerStoreRef = useRef(createBlockerStore());
@@ -7877,11 +8325,21 @@ function CliApp() {
 		try {
 			const startupLog = [];
 			const config = await state.configStore.load();
+			if (!folderTrustResolvedRef.current && !state.configStore.isProjectTrusted() && state.configStore.projectHasB4mFiles() && Boolean(process.stdin.isTTY) && Boolean(process.stdout.isTTY)) {
+				folderTrustResolvedRef.current = true;
+				setState((prev) => ({
+					...prev,
+					folderTrustPrompt: { projectRoot: state.configStore.getProjectRealPath() ?? process.cwd() },
+					config
+				}));
+				return;
+			}
 			const configDirs = await state.configStore.getAdditionalDirectories();
 			const flagDirs = process.env.B4M_ADDITIONAL_DIRS ? JSON.parse(process.env.B4M_ADDITIONAL_DIRS) : [];
 			const additionalDirectories = [.../* @__PURE__ */ new Set([...configDirs, ...flagDirs])];
 			const history = await state.commandHistoryStore.load();
 			setCommandHistory(history);
+			state.customCommandStore.setProjectTrusted(state.configStore.isProjectTrusted());
 			try {
 				await state.customCommandStore.loadCommands();
 			} catch (error) {
@@ -7938,6 +8396,14 @@ function CliApp() {
 			});
 			const pinnedSessionId = process.env.B4M_SESSION_ID;
 			const resumeSessionId = process.env.B4M_RESUME_ID;
+			if (pinnedSessionId && !isValidSessionId(pinnedSessionId)) {
+				console.error(`Invalid session id (--session-id / B4M_SESSION_ID): must match ${SESSION_ID_PATTERN.source}`);
+				process.exit(1);
+			}
+			if (resumeSessionId && !isValidSessionId(resumeSessionId)) {
+				console.error(`Invalid session id (--resume / B4M_RESUME_ID): must match ${SESSION_ID_PATTERN.source}`);
+				process.exit(1);
+			}
 			let newSession;
 			if (resumeSessionId) {
 				const resumed = await state.sessionStore.load(resumeSessionId);
@@ -8108,14 +8574,28 @@ function CliApp() {
 				blockerStoreRef.current.blockers = [];
 				reviewGateStoreRef.current.reviewGates = [];
 			}
+			const cliWrapDeps = {
+				permissionManager,
+				showPermissionPrompt: promptFn,
+				agentContext,
+				configStore: state.configStore,
+				apiClient,
+				sandboxOrchestrator: sandboxOrchestrator ?? void 0,
+				allowedDirectories: additionalDirectories
+			};
 			const enableSkillTool = config.preferences.enableSkillTool !== false;
-			const skillTool = enableSkillTool ? createSkillTool({
+			const skillTool = enableSkillTool ? wrapTools([createSkillTool({
 				customCommandStore: state.customCommandStore,
 				subagentOrchestrator: orchestrator,
-				sessionId: newSession.id
-			}) : null;
-			const findDefinitionTool = createFindDefinitionTool();
-			const getFileStructureTool = createGetFileStructureTool();
+				sessionId: newSession.id,
+				permission: {
+					permissionManager,
+					promptFn
+				},
+				allowedDirectories: additionalDirectories
+			})], cliWrapDeps)[0] : null;
+			const findDefinitionTool = wrapTools([createFindDefinitionTool(additionalDirectories)], cliWrapDeps)[0];
+			const getFileStructureTool = wrapTools([createGetFileStructureTool(additionalDirectories)], cliWrapDeps)[0];
 			const workItemTools = config.preferences.enableWorkItemTools ? createWorkItemTools(new WorkItemsClient(apiClient)) : [];
 			const cliTools = [
 				agentDelegateTool,
@@ -8143,6 +8623,7 @@ function CliApp() {
 				logger,
 				reservedToolNames: [...loadedB4mTools, ...cliTools].map((t) => t.toolSchema.name).concat("tool_search")
 			});
+			rewireReservedNames(state, featureRegistry);
 			const featureModuleToolNames = featureRegistry.getAllToolNames();
 			if (featureModuleToolNames.length > 0) registerFeatureModuleTools(featureModuleToolNames);
 			if (wsManager && featureRegistry.hasModules) featureRegistry.registerAllWsHandlers(wsManager);
@@ -8985,7 +9466,7 @@ function CliApp() {
 		console.log(fellBack ? "✅ Session saved with local fallback handoff" : "✅ Session saved with refreshed handoff");
 	};
 	const handleCommand = async (command, args) => {
-		const customCommand = state.customCommandStore.getCommand(command);
+		const customCommand = state.customCommandStore.getModelReachableCommand(command);
 		if (customCommand) try {
 			const sourceIcon = customCommand.source === "global" ? "🏠" : "📁";
 			console.log(`${sourceIcon} Executing custom command: /${command}`);
@@ -9142,6 +9623,18 @@ function CliApp() {
 				break;
 			}
 			case "trust": {
+				if (args[0] === "folder") {
+					const root = state.configStore.getProjectRealPath() ?? process.cwd();
+					if (!await state.configStore.trustProject()) {
+						console.log("\n⚠️  No project folder to trust here (no resolvable project root).\n");
+						return;
+					}
+					state.customCommandStore.setProjectTrusted(true);
+					await state.customCommandStore.reloadCommands().catch(() => {});
+					console.log(`\n✅ Trusted project folder: ${root}`);
+					console.log("Project skills are now loaded. Restart b4m to load repo agents and MCP servers.\n");
+					return;
+				}
 				if (!state.permissionManager) {
 					console.log("Permission manager not initialized");
 					return;
@@ -9177,6 +9670,11 @@ function CliApp() {
 								console.log("❌ No project found. Use \"global\" to save to ~/.bike4mind/config.json");
 								return;
 							}
+							if (!state.configStore.isProjectTrusted()) {
+								console.log("❌ This folder is not trusted, so a project-local trust would not take effect.");
+								console.log(`   Run /trust folder first, or choose "global" to trust '${toolToTrust}' everywhere.`);
+								return;
+							}
 							try {
 								await state.configStore.initProjectConfig();
 								const existingLocal = await state.configStore.loadRawProjectLocalConfig() || {};
@@ -9197,6 +9695,11 @@ function CliApp() {
 								console.log("❌ No project found. Use \"global\" to save to ~/.bike4mind/config.json");
 								return;
 							}
+							if (!state.configStore.isProjectTrusted()) {
+								console.log("❌ This folder is not trusted, so a team-project trust would not take effect.");
+								console.log(`   Run /trust folder first, or choose "global" to trust '${toolToTrust}' everywhere.`);
+								return;
+							}
 							try {
 								const existingProject = await state.configStore.loadRawProjectConfig() || {};
 								const updatedProject = {
@@ -9235,6 +9738,15 @@ function CliApp() {
 				break;
 			}
 			case "untrust": {
+				if (args[0] === "folder") {
+					const root = state.configStore.getProjectRealPath() ?? process.cwd();
+					await state.configStore.untrustProject();
+					state.customCommandStore.setProjectTrusted(false);
+					await state.customCommandStore.reloadCommands().catch(() => {});
+					console.log(`\n✅ Untrusted project folder: ${root}`);
+					console.log("Repo config stays inert. Restart b4m to fully unload repo agents and MCP servers.\n");
+					return;
+				}
 				if (!state.permissionManager) {
 					console.log("Permission manager not initialized");
 					return;
@@ -9506,7 +10018,7 @@ function CliApp() {
 				const variantForCount = state.config?.preferences.promptVariant ?? "current";
 				const corePromptTokens = tokenCounter.countTokens(buildSystemPrompt(variantForCount));
 				const projectContextTokens = state.contextContent ? tokenCounter.countTokens(state.contextContent) : 0;
-				const commands = state.customCommandStore.getAllCommands();
+				const commands = state.customCommandStore.getModelReachableCommands();
 				const skillsSection = buildSkillsPromptSection(commands);
 				const skillsTokens = skillsSection ? tokenCounter.countTokens(skillsSection) : 0;
 				const agentDirectoryTokens = state.agentStore ? tokenCounter.countTokens(state.agentStore.getDirectoryContext()) : 0;
@@ -9568,6 +10080,7 @@ function CliApp() {
 				console.log("\n📁 Project Configuration:\n");
 				if (projectDir) {
 					console.log(`Project Directory: ${projectDir}/.bike4mind/`);
+					if (!state.configStore.isProjectTrusted()) console.log("⚠️  Folder not trusted - team/local config below is NOT applied. Run /trust folder.");
 					console.log("");
 					const projectConfig = await state.configStore.loadRawProjectConfig();
 					const localConfig = await state.configStore.loadRawProjectLocalConfig();
@@ -9597,9 +10110,9 @@ function CliApp() {
 				break;
 			}
 			case "commands": {
-				const customCommands = state.customCommandStore.getAllCommands();
-				const globalCommands = state.customCommandStore.getCommandsBySource("global");
-				const projectCommands = state.customCommandStore.getCommandsBySource("project");
+				const customCommands = state.customCommandStore.getModelReachableCommands();
+				const globalCommands = customCommands.filter((cmd) => cmd.source === "global");
+				const projectCommands = customCommands.filter((cmd) => cmd.source === "project");
 				console.log("\n📝 Custom Commands:\n");
 				if (customCommands.length === 0) {
 					console.log("No custom commands found.");
@@ -9769,7 +10282,7 @@ function CliApp() {
 				}
 				break;
 			}
-			case "sandbox:enable": {
+			case "sandbox:enable":
 				if (!state.sandboxOrchestrator) {
 					console.log("Sandbox not initialized");
 					break;
@@ -9781,34 +10294,25 @@ function CliApp() {
 				state.sandboxOrchestrator.setMode("auto-allow");
 				state.permissionManager?.setSandboxState("auto-allow", state.sandboxOrchestrator.isActive());
 				if (state.sandboxOrchestrator.getConfig().network.enabled) {
-					await state.sandboxOrchestrator.startProxy();
+					const on = await state.sandboxOrchestrator.setNetworkEnabled(true);
 					const pm = state.sandboxOrchestrator.getProxyManager();
-					if (pm?.isRunning()) console.log(`🌐 Network proxy started on port ${pm.getPort()}`);
+					if (on && pm?.isRunning()) console.log(`🌐 Network proxy started on port ${pm.getPort()}`);
+					else console.log("⚠️  Network filtering requested but the proxy failed to start; egress disabled");
 				}
-				const config = await state.configStore.get();
-				await state.configStore.save({
-					...config,
-					sandbox: { ...state.sandboxOrchestrator.getConfig() }
-				});
+				await state.configStore.saveSandboxConfig(state.sandboxOrchestrator.getConfig());
 				console.log("Sandbox enabled (auto-allow mode)");
 				break;
-			}
-			case "sandbox:disable": {
+			case "sandbox:disable":
 				if (!state.sandboxOrchestrator) {
 					console.log("Sandbox not initialized");
 					break;
 				}
-				await state.sandboxOrchestrator.stopProxy();
+				await state.sandboxOrchestrator.setNetworkEnabled(false);
 				state.sandboxOrchestrator.setMode("disabled");
 				state.permissionManager?.setSandboxState("disabled", false);
-				const disableConfig = await state.configStore.get();
-				await state.configStore.save({
-					...disableConfig,
-					sandbox: { ...state.sandboxOrchestrator.getConfig() }
-				});
+				await state.configStore.saveSandboxConfig(state.sandboxOrchestrator.getConfig());
 				console.log("Sandbox disabled");
 				break;
-			}
 			case "sandbox:mode": {
 				if (!state.sandboxOrchestrator) {
 					console.log("Sandbox not initialized");
@@ -9825,47 +10329,23 @@ function CliApp() {
 				}
 				state.sandboxOrchestrator.setMode(modeArg);
 				state.permissionManager?.setSandboxState(modeArg, state.sandboxOrchestrator.isActive());
-				const modeConfig = await state.configStore.get();
-				await state.configStore.save({
-					...modeConfig,
-					sandbox: { ...state.sandboxOrchestrator.getConfig() }
-				});
+				await state.configStore.saveSandboxConfig(state.sandboxOrchestrator.getConfig());
 				console.log(`Sandbox mode set to: ${modeArg}`);
 				break;
 			}
-			case "sandbox:trust-domain": {
-				if (!state.sandboxOrchestrator) {
-					console.log("Sandbox not initialized");
-					break;
-				}
-				if (args.length === 0) {
-					console.log("Usage: /sandbox:trust-domain <domain> [...]");
-					break;
-				}
-				const proxyMgr = state.sandboxOrchestrator.getProxyManager();
-				if (!proxyMgr) {
-					console.log("Network proxy not initialized");
-					break;
-				}
-				for (const domain of args) {
-					proxyMgr.addAllowedDomain(domain);
-					console.log(`  Added: ${domain}`);
-				}
-				const trustDomainConfig = await state.configStore.get();
-				const currentSandboxConfig = state.sandboxOrchestrator.getConfig();
-				await state.configStore.save({
-					...trustDomainConfig,
-					sandbox: {
-						...currentSandboxConfig,
-						network: {
-							...currentSandboxConfig.network,
-							allowedDomains: proxyMgr.getAllowedDomains()
-						}
-					}
-				});
-				console.log(`Trusted ${args.length} domain(s)`);
+			case "sandbox:network":
+				console.log(await handleSandboxNetworkCommand({
+					orchestrator: state.sandboxOrchestrator,
+					configStore: state.configStore,
+					permissionManager: state.permissionManager
+				}, args[0]));
+				break;
+			case "sandbox:trust-domain":
+				console.log(await handleSandboxTrustDomainCommand({
+					orchestrator: state.sandboxOrchestrator,
+					configStore: state.configStore
+				}, args));
 				break;
-			}
 			case "sandbox:domains": {
 				if (!state.sandboxOrchestrator) {
 					console.log("Sandbox not initialized");
@@ -10039,7 +10519,8 @@ function CliApp() {
 	* Handle saving config from the interactive editor
 	*/
 	const handleSaveConfig = async (updatedConfig, options) => {
-		await state.configStore.save(updatedConfig);
+		const patch = buildGlobalConfigPatch(state.config, updatedConfig);
+		await state.configStore.save(patch);
 		const modelChanged = state.config?.defaultModel !== updatedConfig.defaultModel;
 		const featuresChanged = JSON.stringify(state.config?.features ?? {}) !== JSON.stringify(updatedConfig.features ?? {});
 		let newFeatureRegistry = state.featureRegistry;
@@ -10056,7 +10537,9 @@ function CliApp() {
 				logger,
 				reservedToolNames: baseTools.map((t) => t.toolSchema.name)
 			});
-			newFeatureRegistry = rebuilt.registry;
+			const rebuiltRegistry = rebuilt.registry;
+			newFeatureRegistry = rebuiltRegistry;
+			rewireReservedNames(state, rebuiltRegistry);
 			for (const skippedPlugin of rebuilt.skipped) console.error(`\n\x1b[33m⚠️ Plugin ${skippedPlugin.name} skipped: ${skippedPlugin.reason}\x1b[0m`);
 			const newToolNames = newFeatureRegistry.getAllToolNames();
 			if (newToolNames.length > 0) registerFeatureModuleTools(newToolNames);
@@ -10070,7 +10553,7 @@ function CliApp() {
 			state.agent.setSystemPrompt(buildSystemPrompt(updatedConfig.preferences.promptVariant ?? "current", {
 				contextContent: state.contextContent,
 				agentStore: state.agentStore || void 0,
-				customCommands: state.customCommandStore.getAllCommands(),
+				customCommands: state.customCommandStore.getModelReachableCommands(),
 				enableSkillTool: updatedConfig.preferences.enableSkillTool !== false,
 				enableDynamicAgentCreation: updatedConfig.preferences.enableDynamicAgentCreation === true,
 				additionalDirectories: state.additionalDirectories,
@@ -10127,10 +10610,14 @@ function CliApp() {
 		isBusy: () => useCliStore.getState().isThinking,
 		saveModel: async (modelId) => {
 			if (!state.config) throw new Error("no CLI config is loaded");
-			await handleSaveConfig({
-				...state.config,
-				defaultModel: modelId
-			}, { skipModelApply: true });
+			await state.configStore.save({ defaultModel: modelId });
+			setState((prev) => prev.config ? {
+				...prev,
+				config: {
+					...prev.config,
+					defaultModel: modelId
+				}
+			} : prev);
 		},
 		applyToSession: applyModelToSession,
 		log: (message) => console.log(message),
@@ -10155,6 +10642,28 @@ function CliApp() {
 			}
 		});
 	}
+	if (state.folderTrustPrompt) return /* @__PURE__ */ React.createElement(FolderTrustPrompt, {
+		projectRoot: state.folderTrustPrompt.projectRoot,
+		onSelect: (choice) => {
+			(async () => {
+				try {
+					if (choice === "trust") {
+						await state.configStore.trustProject();
+						console.log("\n✅ Folder trusted. Loading its config, agents, skills and MCP servers.\n");
+					} else console.log("\nℹ️  Project config stays inert this session. Use /trust folder to trust it later.\n");
+				} finally {
+					setState((prev) => ({
+						...prev,
+						folderTrustPrompt: null
+					}));
+					init().catch((err) => {
+						console.error("\n❌ Initialization failed:", err instanceof Error ? err.message : String(err), "\n");
+						exit();
+					});
+				}
+			})();
+		}
+	});
 	const currentSession = useCliStore.getState().session;
 	if (state.rewindSelector && currentSession) return /* @__PURE__ */ React.createElement(RewindSelector, {
 		messages: currentSession.messages,