@bike4mind/cli 1.1.0 → 1.2.0

package/dist/index.mjs

@@ -1,19 +1,19 @@
 #!/usr/bin/env node
-import { $ as CustomCommandStore, A as createAgentDelegateTool, B as ALWAYS_DENIED_FOR_AGENTS, C as createTodoStore, D as createCoordinateTaskTool, E as parseAgentConfig, F as PermissionManager, H as DEFAULT_MAX_ITERATIONS, J as setWebSocketToolExecutor, K as clearFeatureModuleTools, L as wrapTools, M as substituteArguments, O as createResumeAgentTool, P as findIterationBoundary, Q as RemoteSkillSource, R as getProcessHooks, S as createFindDefinitionTool, T as createSkillTool, U as DEFAULT_RETRY_CONFIG, V as DEFAULT_AGENT_MODEL, W as DEFAULT_THOROUGHNESS, X as buildSystemPrompt, Y as getPlanModeFilePath, Z as buildSkillsPromptSection, _ as createDecisionLogTool, at as mergeCommands, b as createGetFileStructureTool, ct as warmFileCache, d as createReviewGateStore, dt as MAX_PASTE_SIZE, et as CheckpointStore, f as createReviewGateTool, g as formatBlockersOutput, h as createBlockerTools, it as searchCommands, j as FallbackLlmBackend, k as createBackgroundAgentTools, l as isTransientNetworkError, lt as COMPACTION_SUMMARY_MARKER, m as createBlockerStore, nt as hasFileReferences, ot as formatFileSize, p as formatReviewGatesOutput, q as registerFeatureModuleTools, rt as processFileReferences, st as searchFiles, tt as SessionStore, v as createDecisionStore, w as createWriteTodosTool, x as createWorkItemTools, y as formatDecisionsOutput } from "./AgentHistoryStore-kT9eNMRO.mjs";
+import { $ as CustomCommandStore, A as createAgentDelegateTool, B as ALWAYS_DENIED_FOR_AGENTS, C as createTodoStore, D as createCoordinateTaskTool, E as parseAgentConfig, F as PermissionManager, H as DEFAULT_MAX_ITERATIONS, J as setWebSocketToolExecutor, K as clearFeatureModuleTools, L as wrapTools, M as substituteArguments, O as createResumeAgentTool, P as findIterationBoundary, Q as RemoteSkillSource, R as getProcessHooks, S as createFindDefinitionTool, T as createSkillTool, U as DEFAULT_RETRY_CONFIG, V as DEFAULT_AGENT_MODEL, W as DEFAULT_THOROUGHNESS, X as buildSystemPrompt, Y as getPlanModeFilePath, Z as buildSkillsPromptSection, _ as createDecisionLogTool, at as searchCommands, b as createGetFileStructureTool, ct as formatFileSize, d as createReviewGateStore, dt as COMPACTION_SUMMARY_MARKER, et as CheckpointStore, f as createReviewGateTool, g as formatBlockersOutput, h as createBlockerTools, j as FallbackLlmBackend, k as createBackgroundAgentTools, lt as searchFiles, m as createBlockerStore, nt as hasFileReferences, ot as mergeCommands, p as formatReviewGatesOutput, pt as MAX_PASTE_SIZE, q as registerFeatureModuleTools, rt as processFileReferences, s as buildSandbox, st as rewireReservedNames, tt as SessionStore, u as isTransientNetworkError, ut as warmFileCache, v as createDecisionStore, w as createWriteTodosTool, x as createWorkItemTools, y as formatDecisionsOutput } from "./AgentHistoryStore-B2NEOvSW.mjs";
 import { a as selectLiveSubagentTokens, i as selectLiveSubagentCredits, n as selectActiveBackgroundShells, o as useCliStore, r as selectCompletedBackgroundShells, t as selectActiveBackgroundAgents } from "./store-CvjTpQPs.mjs";
 import { r as isFeatureEnabled, t as PluginStore } from "./PluginStore-DwvOJ-G3.mjs";
-import { D as ChatModels, E as CREDIT_DEDUCT_TRANSACTION_TYPES, Ot as isEarlyStop, c as ApiEndpointUnconfiguredError, cn as actorColorIndex, d as getEnvironmentName, dn as selfClaimedActorKindSchema, et as REVIEW_GATE_STATUS_VALUES, f as parseApiUrl, l as LOCAL_DEV_URL, ln as actorKindMarker, m as resolveApiEndpoint, n as logger, p as requireApiUrl, r as extractCompactInstructions, s as isReadOnlyTool, sn as ACTOR_COLOR_SLOTS, t as ConfigStore, tt as SUBQUEST_STATUS_VALUES, u as getCreditsUrl, un as actorKindSchema } from "./ConfigStore-DdHHCH2t.mjs";
+import { C as CREDIT_DEDUCT_TRANSACTION_TYPES, F as REVIEW_GATE_STATUS_VALUES, K as isEarlyStop, L as SUBQUEST_STATUS_VALUES, c as SESSION_ID_PATTERN, d as LOCAL_DEV_URL, et as ACTOR_COLOR_SLOTS, f as getCreditsUrl, g as resolveApiEndpoint, h as requireApiUrl, it as selfClaimedActorKindSchema, l as isValidSessionId, m as parseApiUrl, n as logger, nt as actorKindMarker, p as getEnvironmentName, r as extractCompactInstructions, rt as actorKindSchema, s as isReadOnlyTool, t as ConfigStore, tt as actorColorIndex, u as ApiEndpointUnconfiguredError, w as ChatModels } from "./ConfigStore-qV7NrCgZ.mjs";
+import { a as deferredToolRegistry, i as createToolSearchTool, n as buildSupportingStores, o as NotifyingLlmBackend, r as buildLlmBackend, t as buildAgent } from "./buildAgent-C-C-VGff.mjs";
 import { t as getShellSessionManager } from "./ShellSessionManager-6o8KZzl1-vrbPAUTq.mjs";
-import { n as OAuthClient, t as ApiClient } from "./ApiClient-BOWpVvTq.mjs";
+import { n as OAuthClient, t as ApiClient } from "./ApiClient-D0fQ2FT6.mjs";
 import { i as getTokenCounter, n as ConversationContext, r as reconstructTurnBlocks, t as WorkItemsClient } from "./WorkItemsClient-Cow6nXx7.mjs";
-import { a as createToolSearchTool, i as buildLlmBackend, n as buildSupportingStores, o as deferredToolRegistry, r as buildSandbox, s as NotifyingLlmBackend, t as buildAgent } from "./buildAgent-B_kArQ_Y.mjs";
-import { t as version } from "./package-Bqg2LSnH.mjs";
+import { t as version } from "./package-CGZIoxcs.mjs";
 import { r as checkForUpdate } from "./updateChecker-CQW8bxo6.mjs";
 import React, { useCallback, useEffect, useMemo, useReducer, useRef, useState, useSyncExternalStore } from "react";
 import { Box, Static, Text, render, useApp, useInput, usePaste, useStdout } from "ink";
-import { execSync, spawn } from "child_process";
+import { execFile, execSync, spawn } from "child_process";
 import { randomBytes } from "crypto";
-import { existsSync, promises, readFileSync, statSync } from "fs";
+import { constants, existsSync, promises, readFileSync, statSync } from "fs";
 import { homedir } from "os";
 import path, { basename, extname, join } from "path";
 import { v4 } from "uuid";
@@ -25,6 +25,7 @@ import { z as z$1 } from "zod";
 import axios, { isAxiosError } from "axios";
 import { marked } from "marked";
 import { highlight } from "cli-highlight";
+import { promisify } from "util";
 import SelectInput from "ink-select-input";
 import jwt from "jsonwebtoken";
 import open from "open";
@@ -1084,14 +1085,23 @@ function CompletedGroupNotification() {
 //#endregion
 //#region src/components/PermissionPrompt.tsx
 /**
-* Escape terminal control characters (carriage return, ESC/ANSI, other C0
-* controls, DEL) into a visible `\xHH` form. The preview is model-authored;
-* rendering it raw would let a `\r` or ESC sequence rewrite what the user sees,
-* so the approved text could differ from what actually runs. Tab and newline are
-* left intact (newline is already the line delimiter).
+* Escape characters that let model-authored text render differently from what
+* actually runs, into a visible escape form. The preview and arguments are
+* model-authored, so the approved text could otherwise differ from what runs.
+* Two ranges are covered, deliberately and no wider:
+*   - C0 controls (minus tab/newline) and DEL -> `\xHH`: a raw `\r` or ESC
+*     sequence could rewrite the line the user is approving.
+*   - Unicode bidi overrides U+202A..U+202E and isolates U+2066..U+2069
+*     -> `\uXXXX`: these reorder displayed glyphs without changing the
+*     underlying code points, spoofing the same way.
+* Tab and newline are left intact (newline is already the line delimiter).
+* Widen the scope here, so both call sites gain it at once.
 */
 function escapeTerminalControlChars(text) {
-	return text.replace(/[\x00-\x08\x0b-\x1f\x7f]/g, (ch) => `\\x${ch.charCodeAt(0).toString(16).padStart(2, "0")}`);
+	return text.replace(/[\x00-\x08\x0b-\x1f\x7f\u202a-\u202e\u2066-\u2069]/g, (ch) => {
+		const code = ch.charCodeAt(0);
+		return code > 255 ? `\\u${code.toString(16).padStart(4, "0")}` : `\\x${code.toString(16).padStart(2, "0")}`;
+	});
 }
 /** Render a diff/preview string, color-coding each line by its prefix (see per-branch comments below). */
 function renderDiffPreview(preview) {
@@ -1228,7 +1238,7 @@ function PermissionPrompt({ toolName, toolDescription, args, preview, canBeTrust
 	}, /* @__PURE__ */ React.createElement(Text, { bold: true }, "Arguments:"), /* @__PURE__ */ React.createElement(Box, {
 		paddingLeft: 2,
 		flexDirection: "column"
-	}, /* @__PURE__ */ React.createElement(Text, { dimColor: true }, argsString))), preview && /* @__PURE__ */ React.createElement(Box, {
+	}, /* @__PURE__ */ React.createElement(Text, { dimColor: true }, escapeTerminalControlChars(argsString)))), preview && /* @__PURE__ */ React.createElement(Box, {
 		marginTop: 1,
 		flexDirection: "column"
 	}, /* @__PURE__ */ React.createElement(Text, { bold: true }, "Preview:"), /* @__PURE__ */ React.createElement(Box, {
@@ -3566,7 +3576,7 @@ function toStringArray(value) {
 function extractJsonObject(text) {
 	const trimmed = text.trim();
 	if (!trimmed) return null;
-	const fenced = trimmed.match(/```(?:json)?\s*([\s\S]*?)```/i);
+	const fenced = trimmed.match(/```(?:json)?([\s\S]*?)```/i);
 	const candidate = fenced ? fenced[1].trim() : trimmed;
 	const start = candidate.indexOf("{");
 	if (start === -1) return null;
@@ -6758,6 +6768,168 @@ function createBuiltinModules(config, apiClient) {
 	return modules;
 }
 //#endregion
+//#region src/features/bridgePresence/peerOwner.ts
+const execFileAsync = promisify(execFile);
+const LSOF_TIMEOUT_MS = 2e3;
+const LSOF_CANDIDATES = ["/usr/sbin/lsof", "/usr/bin/lsof"];
+/**
+* Resolve the OS owner of the process holding the LISTEN socket on
+* `127.0.0.1:<port>`. This is the only pre-transmission trust signal the CLI
+* has over loopback TCP: the peer is whoever holds the port, so we confirm it
+* is the same UID as this process BEFORE handing it the bridge secret.
+*
+* Pure platform probe: the per-platform helpers classify every EXPECTED failure
+* into `no-listener`/`unknown` themselves. An UNEXPECTED throw (a bug) is left to
+* propagate so the CLI-layer caller can log it and fail closed - this module
+* deliberately does not depend on the CLI logger.
+*/
+async function resolveLoopbackListenerOwner(port) {
+	if (process.platform === "linux") return resolveViaProcNet(port);
+	if (process.platform === "darwin") return resolveViaLsof(port);
+	return { kind: "unknown" };
+}
+/**
+* Whether this platform + process can resolve loopback listener ownership at all:
+* there must be a `getuid` to compare against (Windows has none) AND an owner probe
+* for the platform. When false, the caller latches presence off rather than spinning
+* a retry loop forever on a check that can never pass (a `getuid`-bearing platform
+* with no probe - BSD/SunOS - would otherwise retry indefinitely).
+* MUST stay in sync with `resolveLoopbackListenerOwner`'s platform dispatch above:
+* a platform gains a probe there and a `true` here in the same change.
+*/
+function canResolveLoopbackOwner() {
+	if (typeof process.getuid !== "function") return false;
+	return process.platform === "linux" || process.platform === "darwin";
+}
+async function resolveViaProcNet(port) {
+	const uids = /* @__PURE__ */ new Set();
+	let readAny = false;
+	for (const file of ["/proc/net/tcp", "/proc/net/tcp6"]) {
+		let text;
+		try {
+			text = await promises.readFile(file, "utf8");
+		} catch {
+			continue;
+		}
+		readAny = true;
+		for (const uid of parseProcNetForUid(text, port)) uids.add(uid);
+	}
+	if (!readAny) return { kind: "unknown" };
+	if (uids.size === 0) return { kind: "no-listener" };
+	return uids.size === 1 ? {
+		kind: "owner",
+		uid: [...uids][0]
+	} : { kind: "unknown" };
+}
+/**
+* `local_address` hex (upper-case) of a socket that receives connections to
+* `127.0.0.1`: loopback itself, the v4/v6 wildcard binds (a same-UID process
+* may legitimately hold `0.0.0.0`/`::`), and the v4-mapped-in-v6 forms. A row
+* on any other IP is a different socket that happens to share the port number
+* and must NOT be attributed to the loopback peer.
+*
+* `/proc/net/tcp6` prints each 32-bit word of the address little-endian (no
+* `ntohl`), which is why `127.0.0.1` reads `0100007F` and the mapped third word
+* `00 00 ff ff` reads `FFFF0000`.
+*/
+const LOOPBACK_OR_WILDCARD_HEX = /* @__PURE__ */ new Set([
+	"00000000",
+	"0100007F",
+	"00000000000000000000000000000000",
+	"00000000000000000000000001000000",
+	"0000000000000000FFFF000000000000",
+	"0000000000000000FFFF00000100007F"
+]);
+/**
+* Parse a `/proc/net/tcp`(6) dump for the UIDs of LISTEN sockets on the
+* loopback `port`. Row columns are whitespace-separated: sl(0)
+* local_address(1) rem_address(2) st(3) tx:rx(4) tr:when(5) retrnsmt(6)
+* uid(7). `local_address` is `HEXIP:HEXPORT`; `st` `0A` is TCP_LISTEN. The IP
+* must be loopback or wildcard, else a same-port listener on another interface
+* would be mis-attributed to the loopback peer. Returns every match so the
+* caller can reject an ambiguous set (two distinct owners) rather than
+* silently taking the first.
+*/
+function parseProcNetForUid(text, port) {
+	const uids = [];
+	for (const line of text.split("\n")) {
+		const cols = line.trim().split(/\s+/);
+		if (cols.length < 8) continue;
+		const local = cols[1];
+		const colon = local.lastIndexOf(":");
+		if (colon < 0) continue;
+		if (parseInt(local.slice(colon + 1), 16) !== port) continue;
+		if (cols[3] !== "0A") continue;
+		if (!LOOPBACK_OR_WILDCARD_HEX.has(local.slice(0, colon).toUpperCase())) continue;
+		const uid = Number(cols[7]);
+		if (Number.isInteger(uid)) uids.push(uid);
+	}
+	return uids;
+}
+async function resolveViaLsof(port) {
+	const lsof = await resolveLsofPath();
+	if (!lsof) return { kind: "unknown" };
+	let stdout;
+	try {
+		({stdout} = await execFileAsync(lsof, [
+			"-nP",
+			`-iTCP:${port}`,
+			"-sTCP:LISTEN",
+			"-Fpun"
+		], { timeout: LSOF_TIMEOUT_MS }));
+	} catch (err) {
+		const e = err;
+		if (!e.killed && e.code === 1 && !e.stdout) return { kind: "no-listener" };
+		if (e.killed || typeof e.stdout !== "string") return { kind: "unknown" };
+		stdout = e.stdout;
+	}
+	const uids = new Set(parseLsofForUid(stdout));
+	if (uids.size === 0) return { kind: "no-listener" };
+	return uids.size === 1 ? {
+		kind: "owner",
+		uid: [...uids][0]
+	} : { kind: "unknown" };
+}
+let lsofPathCache;
+async function resolveLsofPath() {
+	if (lsofPathCache !== void 0) return lsofPathCache;
+	for (const candidate of LSOF_CANDIDATES) try {
+		await promises.access(candidate, constants.X_OK);
+		lsofPathCache = candidate;
+		return candidate;
+	} catch {}
+	lsofPathCache = null;
+	return null;
+}
+/** Does an `lsof -nP` numeric socket name (`n` field, host:port) receive
+*  connections to `127.0.0.1`? Loopback, wildcard, or v4-mapped loopback -
+*  exact, to stay symmetric with the linux matcher (the CLI only dials
+*  `127.0.0.1`). */
+function isLoopbackLsofName(name) {
+	return name.startsWith("127.0.0.1:") || name.startsWith("*:") || name.startsWith("[::1]:") || name.startsWith("[::]:") || name.startsWith("[::ffff:127.0.0.1]:");
+}
+/**
+* Parse `lsof -Fpun` output for the UIDs of loopback listeners. `-F` prints
+* one field per line prefixed by its type char; `u<uid>` is a process-level
+* field, `n<host:port>` a file-level one. `uid` resets on each `p<pid>` block
+* so a block without a `u` field can't inherit the prior block's owner. We
+* collect the UID for every loopback/wildcard name so the caller can reject an
+* ambiguous set rather than taking the first.
+*/
+function parseLsofForUid(text) {
+	const uids = [];
+	let uid = null;
+	for (const line of text.split("\n")) {
+		const tag = line[0];
+		if (tag === "p") uid = null;
+		else if (tag === "u") {
+			const parsed = Number(line.slice(1));
+			uid = Number.isInteger(parsed) ? parsed : null;
+		} else if (tag === "n" && uid !== null && isLoopbackLsofName(line.slice(1))) uids.push(uid);
+	}
+	return uids;
+}
+//#endregion
 //#region src/features/bridgePresence/BridgePresence.ts
 const DEFAULT_PORT = Number(process.env.CC_BRIDGE_PORT ?? 48732);
 const CONFIG_PATH = join(homedir(), ".b4m", "cc-bridge.json");
@@ -6783,11 +6955,15 @@ var BridgePresence = class {
 		this.callbacks = {};
 		this.started = false;
 		this.stopped = false;
+		this.generation = 0;
+		this.trusted = false;
+		this.wsConnectingGen = null;
 		this.reconnectTimer = null;
 		this.reconnectAttempts = 0;
 		this.announceRetryTimer = null;
 		this.announceAttempts = 0;
 		this.startOpts = null;
+		this.peerWarned = false;
 		this.pendingWorkspaceName = null;
 		this.pendingCapabilities = null;
 		this.pendingSource = null;
@@ -6796,6 +6972,19 @@ var BridgePresence = class {
 	setCallbacks(cbs) {
 		this.callbacks = cbs;
 	}
+	/** True iff `gen` is still the live connection generation - the single spelling
+	*  of the ABA guard applied after every await (see `generation`). */
+	isCurrent(gen) {
+		return gen === this.generation;
+	}
+	/** Test-only: the generation currently holding the connectCommandWs in-flight
+	*  latch, or null when free. Exposed to pin the `finally` identity guard - a
+	*  stale generation's finally must not clear a live generation's latch (which
+	*  would let a second overlapping connect build an untracked socket). Not part
+	*  of the runtime contract. */
+	get __wsConnectingGenForTests() {
+		return this.wsConnectingGen;
+	}
 	/**
 	* Probe the local bridge and, if present, announce this CLI session.
 	* Returns true iff the announce succeeded (tavern presence is active).
@@ -6809,7 +6998,10 @@ var BridgePresence = class {
 		if (this.started) return this.instanceId !== null;
 		this.stopped = false;
 		this.started = true;
+		this.generation += 1;
+		const gen = this.generation;
 		const config = await readBridgeConfig();
+		if (!this.isCurrent(gen)) return false;
 		if (!config) {
 			logger.debug("[tavern] cc-bridge not configured; CLI runs without tavern presence");
 			return false;
@@ -6821,34 +7013,119 @@ var BridgePresence = class {
 		this.pendingSource = opts.source ?? "b4m-cli";
 		return this.attemptAnnounce();
 	}
+	/**
+	* Classify the process holding the bridge port relative to this CLI, BEFORE
+	* any secret leaves the process. Over loopback TCP the peer is whoever holds
+	* the port; the secret file is plaintext and per-user, so a same-UID peer is
+	* already trusted (it could read the file directly), and a different-UID (or
+	* sandboxed) peer is the adversary this gate stops.
+	*
+	* Four outcomes, so the caller warns only on a real trust failure (a foreign
+	* owner) and stays quiet on the benign ones:
+	*  - `trusted`        - same-UID owner; disclosure is safe.
+	*  - `absent`         - no loopback listener yet (cc-bridge simply not
+	*                       started); fail-closed but quiet - just retry.
+	*  - `foreign`        - a different-UID owner holds the port; fail-closed AND
+	*                       log the security-worded warning (the real adversary).
+	*  - `undeterminable` - ownership can't be resolved: lookup tool missing/hung,
+	*                       a read/spawn error, or an ambiguous owner set.
+	*                       Fail-closed, but a host that can't run the probe is not
+	*                       an attacker - log at debug, not as the security warning.
+	*
+	* A platform that can't resolve ownership (see `canResolveLoopbackOwner`) is
+	* latched off earlier, in `attemptAnnounce`, so this method is only reached
+	* where `getuid` exists and the platform has an owner probe.
+	*/
+	async checkPeerTrust() {
+		const port = this.config?.port ?? DEFAULT_PORT;
+		let owner;
+		try {
+			owner = await resolveLoopbackListenerOwner(port);
+		} catch (err) {
+			logger.debug(`[tavern] loopback owner lookup threw: ${err.message}`);
+			return "undeterminable";
+		}
+		if (owner.kind === "no-listener") return "absent";
+		if (owner.kind === "unknown") return "undeterminable";
+		if (owner.uid !== process.getuid()) return "foreign";
+		this.peerWarned = false;
+		return "trusted";
+	}
+	/** Log the foreign-owner security warning once per untrusted state. */
+	warnUntrustedPeerOnce() {
+		if (this.peerWarned) return;
+		this.peerWarned = true;
+		logger.warn("[tavern] bridge port is held by a different user; not disclosing secret or handling commands");
+	}
 	/** One announce attempt. Schedules a retry on failure; wires up the
 	*  command WS + initial status on success. Idempotent: re-entering after
 	*  a successful announce short-circuits at the instanceId guard. */
 	async attemptAnnounce() {
 		if (this.stopped || !this.config || !this.startOpts) return false;
 		if (this.instanceId) return true;
+		if (!canResolveLoopbackOwner()) {
+			logger.debug("[tavern] ownership unresolvable on this platform; tavern presence disabled");
+			return false;
+		}
+		const gen = this.generation;
+		const startOpts = this.startOpts;
+		if (!await this.gateEgress(gen, "announce")) return false;
 		const instanceId = v4();
 		const workspaceName = this.pendingWorkspaceName;
 		const capabilities = this.pendingCapabilities;
 		const source = this.pendingSource;
-		if (!await this.announce({
+		const announced = await this.announce({
 			instanceId,
 			source,
 			workspaceName,
-			workspacePath: this.startOpts.workspacePath,
+			workspacePath: startOpts.workspacePath,
 			capabilities
-		})) {
+		});
+		if (!this.isCurrent(gen) || this.stopped || !this.config) return false;
+		if (!announced) {
+			this.trusted = false;
 			this.scheduleAnnounceRetry();
 			return false;
 		}
 		this.instanceId = instanceId;
 		this.announceAttempts = 0;
 		logger.info(`[tavern] announced ${workspaceName} to cc-bridge on 127.0.0.1:${this.config.port ?? DEFAULT_PORT}`);
-		this.connectCommandWs();
+		this.connectCommandWs().catch((err) => logger.debug(`[tavern] connectCommandWs threw: ${err.message}`));
 		this.emitEvent({
 			type: "status",
 			status: "idle"
-		});
+		}).catch(() => {});
+		return true;
+	}
+	/** Signal the untrusted condition at the right volume: the security-worded
+	*  warning only for a real foreign owner, and a quiet debug line for the
+	*  benign cases (bridge not started yet, or ownership undeterminable) so we
+	*  don't cry wolf on every backed-off retry. */
+	signalUntrusted(trust, phase) {
+		if (trust === "foreign") this.warnUntrustedPeerOnce();
+		else if (trust === "undeterminable") logger.debug(`[tavern] bridge port owner undeterminable; retrying ${phase}`);
+		else logger.debug(`[tavern] cc-bridge not reachable yet; retrying ${phase}`);
+	}
+	/**
+	* Run the pre-disclosure ownership gate for one egress phase and open or keep
+	* the trust latch closed. The caller passes the connection `generation` it
+	* captured BEFORE this await, so a stop()+start() cycle (or a bare stop())
+	* landing during the probe is detected and this stale continuation bails.
+	* Returns true iff the gate is open (secret disclosure is now permitted for
+	* this generation); false means the caller must return - either the owner is
+	* untrusted (a retry has been scheduled) or the generation moved.
+	*/
+	async gateEgress(gen, phase) {
+		const trust = await this.checkPeerTrust();
+		if (!this.isCurrent(gen) || this.stopped || !this.config) return false;
+		if (trust !== "trusted") {
+			this.trusted = false;
+			this.signalUntrusted(trust, phase);
+			if (phase === "announce") this.scheduleAnnounceRetry();
+			else this.scheduleReconnect();
+			return false;
+		}
+		this.trusted = true;
 		return true;
 	}
 	scheduleAnnounceRetry() {
@@ -6857,17 +7134,22 @@ var BridgePresence = class {
 		const delay = Math.min(1e3 * 2 ** (this.announceAttempts - 1), 3e4);
 		this.announceRetryTimer = setTimeout(() => {
 			this.announceRetryTimer = null;
-			this.attemptAnnounce();
+			this.attemptAnnounce().catch((err) => logger.debug(`[tavern] announce retry threw: ${err.message}`));
 		}, delay);
 	}
 	/** Emit an event for this session. No-op if the bridge isn't up. Events
 	*  leave in strict order - see `emitQueue` comment. */
 	async emitEvent(event) {
 		if (!this.config || !this.instanceId) return;
-		const task = () => this.post("/event", {
-			instanceId: this.instanceId,
-			event
-		}).catch((err) => logger.info(`[tavern] emitEvent ${event.type} failed: ${err.message}`));
+		const instanceId = this.instanceId;
+		const gen = this.generation;
+		const task = () => {
+			if (!this.isCurrent(gen)) return;
+			return this.post("/event", {
+				instanceId,
+				event
+			}).catch((err) => logger.info(`[tavern] emitEvent ${event.type} failed: ${err.message}`));
+		};
 		this.emitQueue = this.emitQueue.then(task, task);
 		return this.emitQueue;
 	}
@@ -6885,6 +7167,7 @@ var BridgePresence = class {
 	async stop(reason = "cli_exit") {
 		if (this.stopped || !this.started) return;
 		this.stopped = true;
+		this.generation += 1;
 		if (this.reconnectTimer) {
 			clearTimeout(this.reconnectTimer);
 			this.reconnectTimer = null;
@@ -6893,13 +7176,14 @@ var BridgePresence = class {
 			clearTimeout(this.announceRetryTimer);
 			this.announceRetryTimer = null;
 		}
+		const wsWasLive = this.ws !== null;
 		if (this.ws) {
 			try {
 				this.ws.close();
 			} catch {}
 			this.ws = null;
 		}
-		if (this.config && this.instanceId) await this.post("/disconnect", {
+		if (this.config && this.instanceId && wsWasLive) await this.post("/disconnect", {
 			instanceId: this.instanceId,
 			reason
 		}).catch(() => {});
@@ -6912,6 +7196,8 @@ var BridgePresence = class {
 		this.pendingSource = null;
 		this.announceAttempts = 0;
 		this.reconnectAttempts = 0;
+		this.peerWarned = false;
+		this.trusted = false;
 		this.emitQueue = Promise.resolve();
 	}
 	async announce(body) {
@@ -6925,6 +7211,7 @@ var BridgePresence = class {
 	}
 	async post(path, body) {
 		if (!this.config) throw new Error("bridge config not loaded");
+		if (!this.trusted) throw new Error("bridge peer not trusted; refusing to disclose secret");
 		const url = `http://127.0.0.1:${this.config.port ?? DEFAULT_PORT}${path}?secret=${encodeURIComponent(this.config.hookSecret)}`;
 		const res = await fetch(url, {
 			method: "POST",
@@ -6934,42 +7221,58 @@ var BridgePresence = class {
 		});
 		if (!res.ok) throw new Error(`bridge ${path} -> ${res.status}`);
 	}
-	connectCommandWs() {
+	async connectCommandWs() {
 		if (this.stopped || !this.config || !this.instanceId) return;
-		const url = `ws://127.0.0.1:${this.config.port ?? DEFAULT_PORT}/commands?instanceId=${encodeURIComponent(this.instanceId)}&secret=${encodeURIComponent(this.config.hookSecret)}`;
-		let ws;
+		const gen = this.generation;
+		if (this.ws || this.wsConnectingGen === gen) return;
+		this.wsConnectingGen = gen;
 		try {
-			ws = new WebSocket(url);
-		} catch (err) {
-			logger.debug(`[tavern] command WS construct failed: ${err.message}`);
-			this.scheduleReconnect();
-			return;
-		}
-		this.ws = ws;
-		ws.on("open", () => {
-			this.reconnectAttempts = 0;
-			logger.debug("[tavern] command WS open");
-		});
-		ws.on("message", (raw) => {
-			let frame = null;
+			if (!await this.gateEgress(gen, "command WS")) return;
+			const config = this.config;
+			const instanceId = this.instanceId;
+			if (!config || !instanceId) return;
+			const url = `ws://127.0.0.1:${config.port ?? DEFAULT_PORT}/commands?instanceId=${encodeURIComponent(instanceId)}&secret=${encodeURIComponent(config.hookSecret)}`;
+			let ws;
 			try {
-				frame = JSON.parse(raw.toString());
-			} catch {
-				logger.debug("[tavern] malformed command frame; ignored");
+				ws = new WebSocket(url);
+			} catch (err) {
+				logger.debug(`[tavern] command WS construct failed: ${err.message}`);
+				this.trusted = false;
+				this.scheduleReconnect();
 				return;
 			}
-			if (!frame?.command) return;
-			this.dispatchCommand(frame.command).catch((err) => logger.warn(`[tavern] command dispatch threw: ${err.message}`));
-		});
-		ws.on("close", () => {
-			this.ws = null;
-			if (this.stopped) return;
-			logger.debug("[tavern] command WS closed; reconnecting");
-			this.scheduleReconnect();
-		});
-		ws.on("error", (err) => {
-			logger.debug(`[tavern] command WS error: ${err.message}`);
-		});
+			this.ws = ws;
+			ws.on("open", () => {
+				if (this.ws !== ws) return;
+				this.reconnectAttempts = 0;
+				logger.debug("[tavern] command WS open");
+			});
+			ws.on("message", (raw) => {
+				if (this.ws !== ws) return;
+				let frame = null;
+				try {
+					frame = JSON.parse(raw.toString());
+				} catch {
+					logger.debug("[tavern] malformed command frame; ignored");
+					return;
+				}
+				if (!frame?.command) return;
+				this.dispatchCommand(frame.command).catch((err) => logger.warn(`[tavern] command dispatch threw: ${err.message}`));
+			});
+			ws.on("close", () => {
+				if (this.ws !== ws) return;
+				this.ws = null;
+				this.trusted = false;
+				if (this.stopped) return;
+				logger.debug("[tavern] command WS closed; reconnecting");
+				this.scheduleReconnect();
+			});
+			ws.on("error", (err) => {
+				logger.debug(`[tavern] command WS error: ${err.message}`);
+			});
+		} finally {
+			if (this.wsConnectingGen === gen) this.wsConnectingGen = null;
+		}
 	}
 	scheduleReconnect() {
 		if (this.stopped || this.reconnectTimer) return;
@@ -6977,10 +7280,11 @@ var BridgePresence = class {
 		const delay = Math.min(500 * 2 ** (this.reconnectAttempts - 1), 1e4);
 		this.reconnectTimer = setTimeout(() => {
 			this.reconnectTimer = null;
-			this.connectCommandWs();
+			this.connectCommandWs().catch((err) => logger.debug(`[tavern] command WS reconnect threw: ${err.message}`));
 		}, delay);
 	}
 	async dispatchCommand(command) {
+		if (this.stopped) return;
 		switch (command.type) {
 			case "send_prompt":
 				if (this.callbacks.onSendPrompt) await this.callbacks.onSendPrompt(command.text);
@@ -7130,7 +7434,7 @@ const infoCommands = [
 	{
 		name: "help",
 		run: (_args, ctx) => {
-			const customCommands = ctx.customCommandStore.getAllCommands();
+			const customCommands = ctx.customCommandStore.getModelReachableCommands();
 			const hasCustomCommands = customCommands.length > 0;
 			console.log(`
 Available commands:
@@ -7321,6 +7625,48 @@ async function dispatch(name, args, ctx) {
 	return true;
 }
 //#endregion
+//#region src/commands/sandboxNetworkCommand.ts
+async function handleSandboxNetworkCommand(deps, arg) {
+	const { orchestrator, configStore, permissionManager } = deps;
+	if (!orchestrator) return "Sandbox not initialized";
+	if (arg !== "on" && arg !== "off") return "Usage: /sandbox:network <on|off>";
+	const enable = arg === "on";
+	if (enable && !orchestrator.isAvailable()) return "Sandbox runtime not available on this platform";
+	const active = await orchestrator.setNetworkEnabled(enable);
+	if (enable && !active) {
+		permissionManager?.setSandboxState(orchestrator.getMode(), orchestrator.isActive());
+		await configStore.saveSandboxConfig(orchestrator.getConfig());
+		return "Failed to start the network proxy; network stays disabled (fail-closed).";
+	}
+	permissionManager?.setSandboxState(orchestrator.getMode(), orchestrator.isActive());
+	await configStore.saveSandboxConfig(orchestrator.getConfig());
+	if (!enable) return "Sandbox network disabled (fail-closed)";
+	const port = orchestrator.getProxyManager()?.getPort();
+	return `Sandbox network egress enabled${port ? ` (proxy-aware clients filtered on port ${port})` : ""}`;
+}
+//#endregion
+//#region src/commands/sandboxTrustDomainCommand.ts
+async function handleSandboxTrustDomainCommand(deps, domains) {
+	const { orchestrator, configStore } = deps;
+	if (!orchestrator) return "Sandbox not initialized";
+	const clean = domains.map((d) => d.trim()).filter(Boolean);
+	if (clean.length === 0) return "Usage: /sandbox:trust-domain <domain> [...]";
+	if (!orchestrator.getProxyManager()) return "Network proxy not initialized";
+	const lines = [];
+	for (const domain of clean) {
+		orchestrator.addAllowedDomain(domain);
+		lines.push(`  Added: ${domain}`);
+	}
+	try {
+		await configStore.saveSandboxConfig(orchestrator.getConfig());
+	} catch (err) {
+		const msg = err instanceof Error ? err.message : String(err);
+		return `${lines.join("\n")}\nWarning: failed to persist the trusted domains (${msg}); they apply for this session only.`;
+	}
+	lines.push(`Trusted ${clean.length} domain(s)`);
+	return lines.join("\n");
+}
+//#endregion
 //#region src/session/turnController.ts
 /**
 * Turn lifecycle (issue #228, phase 2).
@@ -7365,7 +7711,7 @@ async function runTurn(message, ctx) {
 		const systemPrompt = buildSystemPrompt(config?.preferences.promptVariant ?? "current", {
 			contextContent,
 			agentStore: agentStore || void 0,
-			customCommands: customCommandStore.getAllCommands(),
+			customCommands: customCommandStore.getModelReachableCommands(),
 			enableSkillTool: config?.preferences.enableSkillTool !== false,
 			additionalDirectories,
 			featureModulePrompts: featureRegistry?.getSystemPromptSections() || void 0,
@@ -8050,6 +8396,14 @@ function CliApp() {
 			});
 			const pinnedSessionId = process.env.B4M_SESSION_ID;
 			const resumeSessionId = process.env.B4M_RESUME_ID;
+			if (pinnedSessionId && !isValidSessionId(pinnedSessionId)) {
+				console.error(`Invalid session id (--session-id / B4M_SESSION_ID): must match ${SESSION_ID_PATTERN.source}`);
+				process.exit(1);
+			}
+			if (resumeSessionId && !isValidSessionId(resumeSessionId)) {
+				console.error(`Invalid session id (--resume / B4M_RESUME_ID): must match ${SESSION_ID_PATTERN.source}`);
+				process.exit(1);
+			}
 			let newSession;
 			if (resumeSessionId) {
 				const resumed = await state.sessionStore.load(resumeSessionId);
@@ -8234,8 +8588,10 @@ function CliApp() {
 				customCommandStore: state.customCommandStore,
 				subagentOrchestrator: orchestrator,
 				sessionId: newSession.id,
-				permissionManager,
-				promptFn,
+				permission: {
+					permissionManager,
+					promptFn
+				},
 				allowedDirectories: additionalDirectories
 			})], cliWrapDeps)[0] : null;
 			const findDefinitionTool = wrapTools([createFindDefinitionTool(additionalDirectories)], cliWrapDeps)[0];
@@ -8267,6 +8623,7 @@ function CliApp() {
 				logger,
 				reservedToolNames: [...loadedB4mTools, ...cliTools].map((t) => t.toolSchema.name).concat("tool_search")
 			});
+			rewireReservedNames(state, featureRegistry);
 			const featureModuleToolNames = featureRegistry.getAllToolNames();
 			if (featureModuleToolNames.length > 0) registerFeatureModuleTools(featureModuleToolNames);
 			if (wsManager && featureRegistry.hasModules) featureRegistry.registerAllWsHandlers(wsManager);
@@ -9109,7 +9466,7 @@ function CliApp() {
 		console.log(fellBack ? "✅ Session saved with local fallback handoff" : "✅ Session saved with refreshed handoff");
 	};
 	const handleCommand = async (command, args) => {
-		const customCommand = state.customCommandStore.getCommand(command);
+		const customCommand = state.customCommandStore.getModelReachableCommand(command);
 		if (customCommand) try {
 			const sourceIcon = customCommand.source === "global" ? "🏠" : "📁";
 			console.log(`${sourceIcon} Executing custom command: /${command}`);
@@ -9661,7 +10018,7 @@ function CliApp() {
 				const variantForCount = state.config?.preferences.promptVariant ?? "current";
 				const corePromptTokens = tokenCounter.countTokens(buildSystemPrompt(variantForCount));
 				const projectContextTokens = state.contextContent ? tokenCounter.countTokens(state.contextContent) : 0;
-				const commands = state.customCommandStore.getAllCommands();
+				const commands = state.customCommandStore.getModelReachableCommands();
 				const skillsSection = buildSkillsPromptSection(commands);
 				const skillsTokens = skillsSection ? tokenCounter.countTokens(skillsSection) : 0;
 				const agentDirectoryTokens = state.agentStore ? tokenCounter.countTokens(state.agentStore.getDirectoryContext()) : 0;
@@ -9753,9 +10110,9 @@ function CliApp() {
 				break;
 			}
 			case "commands": {
-				const customCommands = state.customCommandStore.getAllCommands();
-				const globalCommands = state.customCommandStore.getCommandsBySource("global");
-				const projectCommands = state.customCommandStore.getCommandsBySource("project");
+				const customCommands = state.customCommandStore.getModelReachableCommands();
+				const globalCommands = customCommands.filter((cmd) => cmd.source === "global");
+				const projectCommands = customCommands.filter((cmd) => cmd.source === "project");
 				console.log("\n📝 Custom Commands:\n");
 				if (customCommands.length === 0) {
 					console.log("No custom commands found.");
@@ -9937,9 +10294,10 @@ function CliApp() {
 				state.sandboxOrchestrator.setMode("auto-allow");
 				state.permissionManager?.setSandboxState("auto-allow", state.sandboxOrchestrator.isActive());
 				if (state.sandboxOrchestrator.getConfig().network.enabled) {
-					await state.sandboxOrchestrator.startProxy();
+					const on = await state.sandboxOrchestrator.setNetworkEnabled(true);
 					const pm = state.sandboxOrchestrator.getProxyManager();
-					if (pm?.isRunning()) console.log(`🌐 Network proxy started on port ${pm.getPort()}`);
+					if (on && pm?.isRunning()) console.log(`🌐 Network proxy started on port ${pm.getPort()}`);
+					else console.log("⚠️  Network filtering requested but the proxy failed to start; egress disabled");
 				}
 				await state.configStore.saveSandboxConfig(state.sandboxOrchestrator.getConfig());
 				console.log("Sandbox enabled (auto-allow mode)");
@@ -9949,7 +10307,7 @@ function CliApp() {
 					console.log("Sandbox not initialized");
 					break;
 				}
-				await state.sandboxOrchestrator.stopProxy();
+				await state.sandboxOrchestrator.setNetworkEnabled(false);
 				state.sandboxOrchestrator.setMode("disabled");
 				state.permissionManager?.setSandboxState("disabled", false);
 				await state.configStore.saveSandboxConfig(state.sandboxOrchestrator.getConfig());
@@ -9975,35 +10333,19 @@ function CliApp() {
 				console.log(`Sandbox mode set to: ${modeArg}`);
 				break;
 			}
-			case "sandbox:trust-domain": {
-				if (!state.sandboxOrchestrator) {
-					console.log("Sandbox not initialized");
-					break;
-				}
-				if (args.length === 0) {
-					console.log("Usage: /sandbox:trust-domain <domain> [...]");
-					break;
-				}
-				const proxyMgr = state.sandboxOrchestrator.getProxyManager();
-				if (!proxyMgr) {
-					console.log("Network proxy not initialized");
-					break;
-				}
-				for (const domain of args) {
-					proxyMgr.addAllowedDomain(domain);
-					console.log(`  Added: ${domain}`);
-				}
-				const currentSandboxConfig = state.sandboxOrchestrator.getConfig();
-				await state.configStore.saveSandboxConfig({
-					...currentSandboxConfig,
-					network: {
-						...currentSandboxConfig.network,
-						allowedDomains: proxyMgr.getAllowedDomains()
-					}
-				});
-				console.log(`Trusted ${args.length} domain(s)`);
+			case "sandbox:network":
+				console.log(await handleSandboxNetworkCommand({
+					orchestrator: state.sandboxOrchestrator,
+					configStore: state.configStore,
+					permissionManager: state.permissionManager
+				}, args[0]));
+				break;
+			case "sandbox:trust-domain":
+				console.log(await handleSandboxTrustDomainCommand({
+					orchestrator: state.sandboxOrchestrator,
+					configStore: state.configStore
+				}, args));
 				break;
-			}
 			case "sandbox:domains": {
 				if (!state.sandboxOrchestrator) {
 					console.log("Sandbox not initialized");
@@ -10195,7 +10537,9 @@ function CliApp() {
 				logger,
 				reservedToolNames: baseTools.map((t) => t.toolSchema.name)
 			});
-			newFeatureRegistry = rebuilt.registry;
+			const rebuiltRegistry = rebuilt.registry;
+			newFeatureRegistry = rebuiltRegistry;
+			rewireReservedNames(state, rebuiltRegistry);
 			for (const skippedPlugin of rebuilt.skipped) console.error(`\n\x1b[33m⚠️ Plugin ${skippedPlugin.name} skipped: ${skippedPlugin.reason}\x1b[0m`);
 			const newToolNames = newFeatureRegistry.getAllToolNames();
 			if (newToolNames.length > 0) registerFeatureModuleTools(newToolNames);
@@ -10209,7 +10553,7 @@ function CliApp() {
 			state.agent.setSystemPrompt(buildSystemPrompt(updatedConfig.preferences.promptVariant ?? "current", {
 				contextContent: state.contextContent,
 				agentStore: state.agentStore || void 0,
-				customCommands: state.customCommandStore.getAllCommands(),
+				customCommands: state.customCommandStore.getModelReachableCommands(),
 				enableSkillTool: updatedConfig.preferences.enableSkillTool !== false,
 				enableDynamicAgentCreation: updatedConfig.preferences.enableDynamicAgentCreation === true,
 				additionalDirectories: state.additionalDirectories,