@bike4mind/cli 1.1.0 → 2.0.0

package/dist/index.mjs

@@ -1,19 +1,19 @@
 #!/usr/bin/env node
-import { $ as CustomCommandStore, A as createAgentDelegateTool, B as ALWAYS_DENIED_FOR_AGENTS, C as createTodoStore, D as createCoordinateTaskTool, E as parseAgentConfig, F as PermissionManager, H as DEFAULT_MAX_ITERATIONS, J as setWebSocketToolExecutor, K as clearFeatureModuleTools, L as wrapTools, M as substituteArguments, O as createResumeAgentTool, P as findIterationBoundary, Q as RemoteSkillSource, R as getProcessHooks, S as createFindDefinitionTool, T as createSkillTool, U as DEFAULT_RETRY_CONFIG, V as DEFAULT_AGENT_MODEL, W as DEFAULT_THOROUGHNESS, X as buildSystemPrompt, Y as getPlanModeFilePath, Z as buildSkillsPromptSection, _ as createDecisionLogTool, at as mergeCommands, b as createGetFileStructureTool, ct as warmFileCache, d as createReviewGateStore, dt as MAX_PASTE_SIZE, et as CheckpointStore, f as createReviewGateTool, g as formatBlockersOutput, h as createBlockerTools, it as searchCommands, j as FallbackLlmBackend, k as createBackgroundAgentTools, l as isTransientNetworkError, lt as COMPACTION_SUMMARY_MARKER, m as createBlockerStore, nt as hasFileReferences, ot as formatFileSize, p as formatReviewGatesOutput, q as registerFeatureModuleTools, rt as processFileReferences, st as searchFiles, tt as SessionStore, v as createDecisionStore, w as createWriteTodosTool, x as createWorkItemTools, y as formatDecisionsOutput } from "./AgentHistoryStore-kT9eNMRO.mjs";
+import { $ as CustomCommandStore, A as createAgentDelegateTool, B as ALWAYS_DENIED_FOR_AGENTS, C as createTodoStore, D as createCoordinateTaskTool, E as parseAgentConfig, F as PermissionManager, H as DEFAULT_MAX_ITERATIONS, J as setWebSocketToolExecutor, K as clearFeatureModuleTools, L as wrapTools, M as substituteArguments, O as createResumeAgentTool, P as findIterationBoundary, Q as RemoteSkillSource, R as getProcessHooks, S as createFindDefinitionTool, T as createSkillTool, U as DEFAULT_RETRY_CONFIG, V as DEFAULT_AGENT_MODEL, W as DEFAULT_THOROUGHNESS, X as buildSystemPrompt, Y as getPlanModeFilePath, Z as buildSkillsPromptSection, _ as createDecisionLogTool, at as searchCommands, b as createGetFileStructureTool, ct as formatFileSize, d as createReviewGateStore, dt as COMPACTION_SUMMARY_MARKER, et as CheckpointStore, f as createReviewGateTool, g as formatBlockersOutput, h as createBlockerTools, j as FallbackLlmBackend, k as createBackgroundAgentTools, lt as searchFiles, m as createBlockerStore, nt as hasFileReferences, ot as mergeCommands, p as formatReviewGatesOutput, pt as MAX_PASTE_SIZE, q as registerFeatureModuleTools, rt as processFileReferences, s as buildSandbox, st as rewireReservedNames, tt as SessionStore, u as isTransientNetworkError, ut as warmFileCache, v as createDecisionStore, w as createWriteTodosTool, x as createWorkItemTools, y as formatDecisionsOutput } from "./AgentHistoryStore-DIMzvf-y.mjs";
 import { a as selectLiveSubagentTokens, i as selectLiveSubagentCredits, n as selectActiveBackgroundShells, o as useCliStore, r as selectCompletedBackgroundShells, t as selectActiveBackgroundAgents } from "./store-CvjTpQPs.mjs";
 import { r as isFeatureEnabled, t as PluginStore } from "./PluginStore-DwvOJ-G3.mjs";
-import { D as ChatModels, E as CREDIT_DEDUCT_TRANSACTION_TYPES, Ot as isEarlyStop, c as ApiEndpointUnconfiguredError, cn as actorColorIndex, d as getEnvironmentName, dn as selfClaimedActorKindSchema, et as REVIEW_GATE_STATUS_VALUES, f as parseApiUrl, l as LOCAL_DEV_URL, ln as actorKindMarker, m as resolveApiEndpoint, n as logger, p as requireApiUrl, r as extractCompactInstructions, s as isReadOnlyTool, sn as ACTOR_COLOR_SLOTS, t as ConfigStore, tt as SUBQUEST_STATUS_VALUES, u as getCreditsUrl, un as actorKindSchema } from "./ConfigStore-DdHHCH2t.mjs";
+import { B as REVIEW_GATE_STATUS_VALUES, D as CREDIT_DEDUCT_TRANSACTION_TYPES, H as SUBQUEST_STATUS_VALUES, O as ChatModels, _ as requireApiUrl, _t as actorKindMarker, d as isReadOnlyTool, et as isEarlyStop, f as ApiEndpointUnconfiguredError, g as parseApiUrl, gt as actorColorIndex, h as getEnvironmentName, ht as ACTOR_COLOR_SLOTS, i as isValidSessionId, m as getCreditsUrl, n as logger, p as LOCAL_DEV_URL, r as SESSION_ID_PATTERN, s as extractCompactInstructions, t as ConfigStore, v as resolveApiEndpoint, vt as actorKindSchema, yt as selfClaimedActorKindSchema } from "./ConfigStore-DIs-K9oD.mjs";
+import { a as deferredToolRegistry, i as createToolSearchTool, n as buildSupportingStores, o as NotifyingLlmBackend, r as buildLlmBackend, t as buildAgent } from "./buildAgent-DOvEp92a.mjs";
 import { t as getShellSessionManager } from "./ShellSessionManager-6o8KZzl1-vrbPAUTq.mjs";
-import { n as OAuthClient, t as ApiClient } from "./ApiClient-BOWpVvTq.mjs";
+import { i as OAuthClient, t as ApiClient } from "./ApiClient-BTI0-m0g.mjs";
+import { t as version } from "./package-Dl_F2Fah.mjs";
 import { i as getTokenCounter, n as ConversationContext, r as reconstructTurnBlocks, t as WorkItemsClient } from "./WorkItemsClient-Cow6nXx7.mjs";
-import { a as createToolSearchTool, i as buildLlmBackend, n as buildSupportingStores, o as deferredToolRegistry, r as buildSandbox, s as NotifyingLlmBackend, t as buildAgent } from "./buildAgent-B_kArQ_Y.mjs";
-import { t as version } from "./package-Bqg2LSnH.mjs";
 import { r as checkForUpdate } from "./updateChecker-CQW8bxo6.mjs";
 import React, { useCallback, useEffect, useMemo, useReducer, useRef, useState, useSyncExternalStore } from "react";
 import { Box, Static, Text, render, useApp, useInput, usePaste, useStdout } from "ink";
-import { execSync, spawn } from "child_process";
+import { execFile, execSync, spawn } from "child_process";
 import { randomBytes } from "crypto";
-import { existsSync, promises, readFileSync, statSync } from "fs";
+import { constants, existsSync, promises, readFileSync, statSync } from "fs";
 import { homedir } from "os";
 import path, { basename, extname, join } from "path";
 import { v4 } from "uuid";
@@ -25,6 +25,7 @@ import { z as z$1 } from "zod";
 import axios, { isAxiosError } from "axios";
 import { marked } from "marked";
 import { highlight } from "cli-highlight";
+import { promisify } from "util";
 import SelectInput from "ink-select-input";
 import jwt from "jsonwebtoken";
 import open from "open";
@@ -1084,14 +1085,26 @@ function CompletedGroupNotification() {
 //#endregion
 //#region src/components/PermissionPrompt.tsx
 /**
-* Escape terminal control characters (carriage return, ESC/ANSI, other C0
-* controls, DEL) into a visible `\xHH` form. The preview is model-authored;
-* rendering it raw would let a `\r` or ESC sequence rewrite what the user sees,
-* so the approved text could differ from what actually runs. Tab and newline are
-* left intact (newline is already the line delimiter).
+* Escape characters that let untrusted text render differently from what
+* actually runs, into a visible escape form. Shared by every prompt that shows
+* untrusted text for the user to decide on: tool previews/arguments here,
+* repo-authored MCP definitions (McpApprovalPrompt), the folder-trust path
+* (FolderTrustPrompt), and model-authored ReviewGatePrompt / UserQuestionPrompt text. Display only - never escape the
+* value that is acted on or sent back.
+* These ranges are covered, deliberately and no wider:
+*   - C0 controls (minus tab/newline), DEL and C1 controls -> `\xHH`: a raw
+*     `\r`, ESC or 8-bit CSI (U+009B) could rewrite the line being approved.
+*   - Unicode bidi overrides U+202A..U+202E and isolates U+2066..U+2069
+*     -> `\uXXXX`: these reorder displayed glyphs without changing the
+*     underlying code points, spoofing the same way.
+* Tab and newline are left intact (newline is already the line delimiter).
+* Widen the scope here, so both call sites gain it at once.
 */
 function escapeTerminalControlChars(text) {
-	return text.replace(/[\x00-\x08\x0b-\x1f\x7f]/g, (ch) => `\\x${ch.charCodeAt(0).toString(16).padStart(2, "0")}`);
+	return text.replace(/[\x00-\x08\x0b-\x1f\x7f-\x9f\u202a-\u202e\u2066-\u2069]/g, (ch) => {
+		const code = ch.charCodeAt(0);
+		return code > 255 ? `\\u${code.toString(16).padStart(4, "0")}` : `\\x${code.toString(16).padStart(2, "0")}`;
+	});
 }
 /** Render a diff/preview string, color-coding each line by its prefix (see per-branch comments below). */
 function renderDiffPreview(preview) {
@@ -1222,13 +1235,13 @@ function PermissionPrompt({ toolName, toolDescription, args, preview, canBeTrust
 	}, headerText)), /* @__PURE__ */ React.createElement(Box, { marginTop: 1 }, /* @__PURE__ */ React.createElement(Text, { dimColor: true }, "Tool: "), /* @__PURE__ */ React.createElement(Text, {
 		bold: true,
 		color: "cyan"
-	}, toolName)), toolDescription && /* @__PURE__ */ React.createElement(Box, null, /* @__PURE__ */ React.createElement(Text, { dimColor: true }, "Action: "), /* @__PURE__ */ React.createElement(Text, null, toolDescription)), !hideArgs && /* @__PURE__ */ React.createElement(Box, {
+	}, escapeTerminalControlChars(toolName))), toolDescription && /* @__PURE__ */ React.createElement(Box, null, /* @__PURE__ */ React.createElement(Text, { dimColor: true }, "Action: "), /* @__PURE__ */ React.createElement(Text, null, escapeTerminalControlChars(toolDescription))), !hideArgs && /* @__PURE__ */ React.createElement(Box, {
 		marginTop: 1,
 		flexDirection: "column"
 	}, /* @__PURE__ */ React.createElement(Text, { bold: true }, "Arguments:"), /* @__PURE__ */ React.createElement(Box, {
 		paddingLeft: 2,
 		flexDirection: "column"
-	}, /* @__PURE__ */ React.createElement(Text, { dimColor: true }, argsString))), preview && /* @__PURE__ */ React.createElement(Box, {
+	}, /* @__PURE__ */ React.createElement(Text, { dimColor: true }, escapeTerminalControlChars(argsString)))), preview && /* @__PURE__ */ React.createElement(Box, {
 		marginTop: 1,
 		flexDirection: "column"
 	}, /* @__PURE__ */ React.createElement(Text, { bold: true }, "Preview:"), /* @__PURE__ */ React.createElement(Box, {
@@ -1398,7 +1411,7 @@ function UserQuestionPrompt({ payload, onResponse }) {
 	}, /* @__PURE__ */ React.createElement(Box, null, /* @__PURE__ */ React.createElement(Text, {
 		bold: true,
 		color: "cyan"
-	}, "? Question", totalQuestions > 1 ? ` ${questionIndex + 1}/${totalQuestions}` : "")), /* @__PURE__ */ React.createElement(Box, { marginTop: 1 }, /* @__PURE__ */ React.createElement(Text, { bold: true }, currentQuestion.question)), /* @__PURE__ */ React.createElement(Box, {
+	}, "? Question", totalQuestions > 1 ? ` ${questionIndex + 1}/${totalQuestions}` : "")), /* @__PURE__ */ React.createElement(Box, { marginTop: 1 }, /* @__PURE__ */ React.createElement(Text, { bold: true }, escapeTerminalControlChars(currentQuestion.question))), /* @__PURE__ */ React.createElement(Box, {
 		marginTop: 1,
 		flexDirection: "column"
 	}, options.map((opt, idx) => {
@@ -1408,12 +1421,12 @@ function UserQuestionPrompt({ payload, onResponse }) {
 		return /* @__PURE__ */ React.createElement(Box, { key: idx }, /* @__PURE__ */ React.createElement(Text, { color: "cyan" }, idx + 1, "."), /* @__PURE__ */ React.createElement(Text, {
 			color: isHighlighted ? "cyan" : void 0,
 			bold: isHighlighted
-		}, " ", prefix, " ", opt.label), idx === otherIndex && isHighlighted ? /* @__PURE__ */ React.createElement(Box, { marginLeft: 1 }, /* @__PURE__ */ React.createElement(TextInput, {
+		}, " ", prefix, " ", escapeTerminalControlChars(opt.label)), idx === otherIndex && isHighlighted ? /* @__PURE__ */ React.createElement(Box, { marginLeft: 1 }, /* @__PURE__ */ React.createElement(TextInput, {
 			value: otherText,
 			onChange: setOtherText,
 			onSubmit: submitOther,
 			placeholder: "Type your answer..."
-		})) : opt.description && idx !== otherIndex && /* @__PURE__ */ React.createElement(Text, { dimColor: true }, " - ", opt.description));
+		})) : opt.description && idx !== otherIndex && /* @__PURE__ */ React.createElement(Text, { dimColor: true }, " - ", escapeTerminalControlChars(opt.description)));
 	})), /* @__PURE__ */ React.createElement(Box, { marginTop: 1 }, /* @__PURE__ */ React.createElement(Text, { dimColor: true }, isOnOther ? "Type your answer, Enter to submit, or arrow keys to go back" : isMulti ? "Press 1-" + options.length + ", Space to toggle, Enter to confirm" : "Press 1-" + options.length + ", or arrow keys + Enter")));
 }
 //#endregion
@@ -1516,10 +1529,10 @@ function ReviewGatePrompt({ description, options, recommendation, onResponse })
 	}, /* @__PURE__ */ React.createElement(Box, null, /* @__PURE__ */ React.createElement(Text, {
 		bold: true,
 		color: "magenta"
-	}, "🛑 Review Gate")), /* @__PURE__ */ React.createElement(Box, { marginTop: 1 }, /* @__PURE__ */ React.createElement(Text, null, description)), recommendation && /* @__PURE__ */ React.createElement(Box, {
+	}, "🛑 Review Gate")), /* @__PURE__ */ React.createElement(Box, { marginTop: 1 }, /* @__PURE__ */ React.createElement(Text, null, escapeTerminalControlChars(description))), recommendation && /* @__PURE__ */ React.createElement(Box, {
 		marginTop: 1,
 		flexDirection: "column"
-	}, /* @__PURE__ */ React.createElement(Text, { bold: true }, "Recommendation:"), /* @__PURE__ */ React.createElement(Box, { paddingLeft: 2 }, /* @__PURE__ */ React.createElement(Text, { dimColor: true }, recommendation))), options && options.length > 0 && /* @__PURE__ */ React.createElement(Box, {
+	}, /* @__PURE__ */ React.createElement(Text, { bold: true }, "Recommendation:"), /* @__PURE__ */ React.createElement(Box, { paddingLeft: 2 }, /* @__PURE__ */ React.createElement(Text, { dimColor: true }, escapeTerminalControlChars(recommendation)))), options && options.length > 0 && /* @__PURE__ */ React.createElement(Box, {
 		marginTop: 1,
 		flexDirection: "column"
 	}, /* @__PURE__ */ React.createElement(Text, { bold: true }, "Options:"), /* @__PURE__ */ React.createElement(Box, {
@@ -1528,7 +1541,7 @@ function ReviewGatePrompt({ description, options, recommendation, onResponse })
 	}, options.map((opt, idx) => /* @__PURE__ */ React.createElement(Text, {
 		key: idx,
 		dimColor: true
-	}, "• ", opt)))), /* @__PURE__ */ React.createElement(Box, {
+	}, "• ", escapeTerminalControlChars(opt))))), /* @__PURE__ */ React.createElement(Box, {
 		marginTop: 1,
 		flexDirection: "column"
 	}, ITEMS.map((item, index) => {
@@ -1806,6 +1819,18 @@ function buildConfigItems(availableModels, pluginDescriptors = []) {
 				enableCoordinatorMode: value
 			}
 		})
+	}, {
+		key: "postEditDiagnostics",
+		label: "Post-Edit Diagnostics",
+		type: "boolean",
+		getValue: (config) => config.preferences.postEditDiagnostics ?? false,
+		setValue: (config, value) => ({
+			...config,
+			preferences: {
+				...config.preferences,
+				postEditDiagnostics: value
+			}
+		})
 	}, {
 		key: "featuresTavern",
 		label: "Tavern",
@@ -2687,7 +2712,7 @@ function FolderTrustPrompt({ projectRoot, onSelect }) {
 	}, /* @__PURE__ */ React.createElement(Text, {
 		bold: true,
 		color: "yellow"
-	}, "This project ships Bike4Mind config that can run code."), /* @__PURE__ */ React.createElement(Text, { dimColor: true }, projectRoot), /* @__PURE__ */ React.createElement(Text, null, "Repo-committed config, MCP servers, agents and skills stay inert until you trust this folder. Only trust folders you would run code from.")), /* @__PURE__ */ React.createElement(SelectInput, {
+	}, "This project ships Bike4Mind config that can run code."), /* @__PURE__ */ React.createElement(Text, { dimColor: true }, escapeTerminalControlChars(projectRoot)), /* @__PURE__ */ React.createElement(Text, null, "Repo-committed config, MCP servers, agents and skills stay inert until you trust this folder. Only trust folders you would run code from.")), /* @__PURE__ */ React.createElement(SelectInput, {
 		items: [{
 			label: "Not now - keep repo config inert this session",
 			value: "not-now"
@@ -2700,6 +2725,52 @@ function FolderTrustPrompt({ projectRoot, onSelect }) {
 	}), /* @__PURE__ */ React.createElement(Box, { marginTop: 1 }, /* @__PURE__ */ React.createElement(Text, { dimColor: true }, "Use ↑↓ arrows to navigate, Enter to select. You can change this later with /trust folder.")));
 }
 //#endregion
+//#region src/components/McpApprovalPrompt.tsx
+const displaySafe = (s) => escapeTerminalControlChars(s).replace(/[\t\n]/g, (c) => c === "\n" ? "\\x0a" : "\\x09");
+const displayArg = (a) => {
+	const safe = displaySafe(a);
+	return /[\s"']/.test(a) ? `"${safe.replace(/"/g, "\\\"")}"` : safe;
+};
+/**
+* Startup prompt for repo-discovered MCP servers (trusted project) whose exact
+* definition hasn't been approved. Shows env/header KEY names; values only for
+* loader-style env keys (PATH, NODE_OPTIONS, LD_*, ...) that change what runs.
+* "Approve all" persists each definition's fingerprint (a changed definition asks
+* again); "Skip" persists nothing, so they stay off and re-prompt next launch.
+*
+* "Skip" is listed first so Enter-through never starts a server. Sibling of
+* FolderTrustPrompt.
+*/
+function McpApprovalPrompt({ projectRoot, servers, onSelect }) {
+	return /* @__PURE__ */ React.createElement(Box, {
+		flexDirection: "column",
+		marginY: 1
+	}, /* @__PURE__ */ React.createElement(Box, {
+		marginBottom: 1,
+		flexDirection: "column"
+	}, /* @__PURE__ */ React.createElement(Text, {
+		bold: true,
+		color: "yellow"
+	}, "This project defines MCP servers that will run code on your machine."), /* @__PURE__ */ React.createElement(Text, { dimColor: true }, displaySafe(projectRoot))), /* @__PURE__ */ React.createElement(Box, {
+		marginBottom: 1,
+		flexDirection: "column"
+	}, servers.map((s) => /* @__PURE__ */ React.createElement(Box, {
+		key: s.name,
+		flexDirection: "column",
+		marginBottom: 1
+	}, /* @__PURE__ */ React.createElement(Text, { bold: true }, displaySafe(s.name)), /* @__PURE__ */ React.createElement(Text, null, s.url !== void 0 ? displaySafe(s.url) : [s.command, ...s.args ?? []].filter((p) => p !== void 0).map(displayArg).join(" ")), s.envKeys.length > 0 && /* @__PURE__ */ React.createElement(Text, { dimColor: true }, "env:", " ", s.envKeys.map((k) => k in s.envValues ? displaySafe(`${k}=${s.envValues[k]}`) : displaySafe(k)).join(", ")), s.headerKeys.length > 0 && /* @__PURE__ */ React.createElement(Text, { dimColor: true }, "headers: ", s.headerKeys.map(displaySafe).join(", "))))), /* @__PURE__ */ React.createElement(SelectInput, {
+		items: [{
+			label: "Skip - don't start these this session",
+			value: "skip"
+		}, {
+			label: "Approve all - start these servers (asks again if they change)",
+			value: "approve"
+		}],
+		onSelect: (item) => onSelect(item.value),
+		itemComponent: ({ isSelected, label }) => /* @__PURE__ */ React.createElement(Box, null, /* @__PURE__ */ React.createElement(Text, { color: isSelected ? "cyan" : void 0 }, isSelected ? "❯ " : "  ", label))
+	}), /* @__PURE__ */ React.createElement(Box, { marginTop: 1 }, /* @__PURE__ */ React.createElement(Text, { dimColor: true }, "Use ↑↓ arrows to navigate, Enter to select.")));
+}
+//#endregion
 //#region src/components/RewindSelector.tsx
 function RewindSelector({ messages, onSelect, onCancel }) {
 	const [step, setStep] = useState("selection");
@@ -2942,6 +3013,37 @@ function isBrowserOpenableUrl(raw) {
 	if (url.protocol === "https:") return true;
 	return url.protocol === "http:" && (url.hostname === "localhost" || url.hostname === "127.0.0.1");
 }
+/**
+* The device-flow response is server-controlled, so a compromised server could point the
+* verification page at a phishing origin. Only auto-open URLs on the configured API origin.
+* Strict compare: no subdomain aliasing and no localhost/127.0.0.1 equivalence.
+*/
+function isOnApiOrigin(raw, apiUrl) {
+	try {
+		return new URL(raw).origin === new URL(apiUrl).origin;
+	} catch {
+		return false;
+	}
+}
+function originOf(raw) {
+	try {
+		const { origin } = new URL(raw);
+		return origin === "null" ? raw : origin;
+	} catch {
+		return raw;
+	}
+}
+/** Strips C0/C1 control chars so a server-supplied string can't inject terminal escape sequences. */
+function stripControlChars(raw) {
+	return raw === void 0 ? raw : raw.replace(/[\u0000-\u001f\u007f-\u009f]/g, "");
+}
+function hostOf(raw) {
+	try {
+		return new URL(raw).host;
+	} catch {
+		return raw;
+	}
+}
 function extractErrorMessage(err) {
 	if (axios.isAxiosError(err)) {
 		if (err.response?.data) {
@@ -2963,13 +3065,19 @@ function LoginFlow({ apiUrl = "http://localhost:3000", configStore, onSuccess, o
 	const [deviceFlow, setDeviceFlow] = useState(null);
 	const [statusMessage, setStatusMessage] = useState("Initiating device authorization...");
 	const [error, setError] = useState(null);
+	const [account, setAccount] = useState(null);
 	useEffect(() => {
 		const runLoginFlow = async () => {
 			const oauth = new OAuthClient(apiUrl);
 			try {
 				setStatus("initiating");
 				const deviceFlowResponse = await oauth.initiateDeviceFlow();
-				setDeviceFlow(deviceFlowResponse);
+				setDeviceFlow({
+					...deviceFlowResponse,
+					verification_uri: stripControlChars(deviceFlowResponse.verification_uri),
+					verification_uri_complete: stripControlChars(deviceFlowResponse.verification_uri_complete),
+					user_code: stripControlChars(deviceFlowResponse.user_code)
+				});
 				setStatus("waiting");
 				setStatusMessage("Waiting for authorization...");
 				const tokens = await oauth.waitForAuthorization(deviceFlowResponse.device_code, deviceFlowResponse.interval, (message) => setStatusMessage(message));
@@ -2981,12 +3089,18 @@ function LoginFlow({ apiUrl = "http://localhost:3000", configStore, onSuccess, o
 					expiresAt,
 					userId
 				});
+				setAccount({ userId });
 				setStatus("success");
 				setStatusMessage("Successfully authenticated!");
 				setTimeout(() => onSuccess(), 1500);
+				new ApiClient(apiUrl, configStore).get("/api/identify").then((res) => setAccount({
+					userId,
+					email: stripControlChars(res?.user?.email),
+					username: stripControlChars(res?.user?.username)
+				})).catch(() => {});
 			} catch (err) {
 				setStatus("error");
-				const errorMessage = extractErrorMessage(err);
+				const errorMessage = stripControlChars(extractErrorMessage(err));
 				setError(errorMessage);
 				onError(new Error(errorMessage));
 			}
@@ -2998,12 +3112,19 @@ function LoginFlow({ apiUrl = "http://localhost:3000", configStore, onSuccess, o
 		onSuccess,
 		onError
 	]);
+	const uris = deviceFlow ? [deviceFlow.verification_uri, deviceFlow.verification_uri_complete] : [];
+	const isTrustedUri = (u) => isBrowserOpenableUrl(u) && isOnApiOrigin(u, apiUrl);
+	const untrustedUri = uris.find((u) => !isTrustedUri(u));
+	const trusted = uris.length > 0 && uris.every(isTrustedUri);
 	useEffect(() => {
-		if (deviceFlow && status === "waiting") if (isBrowserOpenableUrl(deviceFlow.verification_uri_complete)) open(deviceFlow.verification_uri_complete).catch((err) => {
+		if (deviceFlow && status === "waiting" && trusted) open(deviceFlow.verification_uri_complete).catch((err) => {
 			console.error("Failed to auto-open browser:", err);
 		});
-		else console.error("Refusing to auto-open untrusted verification URL:", deviceFlow.verification_uri_complete);
-	}, [deviceFlow, status]);
+	}, [
+		deviceFlow,
+		status,
+		trusted
+	]);
 	if (status === "initiating") return /* @__PURE__ */ React.createElement(Box, {
 		flexDirection: "column",
 		padding: 1
@@ -3021,7 +3142,7 @@ function LoginFlow({ apiUrl = "http://localhost:3000", configStore, onSuccess, o
 	}, /* @__PURE__ */ React.createElement(Box, { marginBottom: 1 }, /* @__PURE__ */ React.createElement(Text, {
 		color: "green",
 		bold: true
-	}, "✔ Successfully authenticated!")), /* @__PURE__ */ React.createElement(Box, null, /* @__PURE__ */ React.createElement(Text, { dimColor: true }, "You can now use B4M CLI with your account.")));
+	}, "✔ Successfully authenticated!")), /* @__PURE__ */ React.createElement(Box, null, /* @__PURE__ */ React.createElement(Text, null, "Logged in as ", account?.email || account?.username || `user ${account?.userId}`, " on ", hostOf(apiUrl))));
 	return /* @__PURE__ */ React.createElement(Box, {
 		flexDirection: "column",
 		padding: 1,
@@ -3030,7 +3151,10 @@ function LoginFlow({ apiUrl = "http://localhost:3000", configStore, onSuccess, o
 	}, /* @__PURE__ */ React.createElement(Box, { marginBottom: 1 }, /* @__PURE__ */ React.createElement(Text, {
 		color: "cyan",
 		bold: true
-	}, "🔐 Device Authorization")), /* @__PURE__ */ React.createElement(Box, { marginBottom: 1 }, /* @__PURE__ */ React.createElement(Text, null, "Opening browser automatically... If it doesn't open, please visit:")), /* @__PURE__ */ React.createElement(Box, {
+	}, "🔐 Device Authorization")), trusted ? /* @__PURE__ */ React.createElement(Box, { marginBottom: 1 }, /* @__PURE__ */ React.createElement(Text, null, "Opening browser automatically... If it doesn't open, please visit:")) : /* @__PURE__ */ React.createElement(React.Fragment, null, /* @__PURE__ */ React.createElement(Box, { marginBottom: 1 }, /* @__PURE__ */ React.createElement(Text, {
+		color: "red",
+		bold: true
+	}, !untrustedUri ? "Not opening browser: the server did not return a verification URL." : isOnApiOrigin(untrustedUri, apiUrl) ? `Not opening browser: verification URL ${originOf(untrustedUri)} is not https (plain http is only auto-opened on localhost). Only continue if you trust it.` : `Not opening browser: verification URL origin ${originOf(untrustedUri)} does not match the configured server ${originOf(apiUrl)}. Only continue if you trust it.`)), /* @__PURE__ */ React.createElement(Box, { marginBottom: 1 }, /* @__PURE__ */ React.createElement(Text, null, "Please visit:"))), /* @__PURE__ */ React.createElement(Box, {
 		marginBottom: 1,
 		paddingLeft: 2
 	}, /* @__PURE__ */ React.createElement(Text, {
@@ -3566,7 +3690,7 @@ function toStringArray(value) {
 function extractJsonObject(text) {
 	const trimmed = text.trim();
 	if (!trimmed) return null;
-	const fenced = trimmed.match(/```(?:json)?\s*([\s\S]*?)```/i);
+	const fenced = trimmed.match(/```(?:json)?([\s\S]*?)```/i);
 	const candidate = fenced ? fenced[1].trim() : trimmed;
 	const start = candidate.indexOf("{");
 	if (start === -1) return null;
@@ -4507,6 +4631,314 @@ Unlike agent_delegate (which uses pre-defined agents), this tool lets you compos
 	};
 }
 //#endregion
+//#region src/diagnostics/checkers.ts
+const CHECK_TIMEOUT_MS = 12e4;
+const MAX_OUTPUT_BYTES = 16777216;
+const TYPESCRIPT_EXTENSIONS = /* @__PURE__ */ new Set([
+	".ts",
+	".tsx",
+	".mts",
+	".cts"
+]);
+const ESLINT_EXTENSIONS = /* @__PURE__ */ new Set([
+	...TYPESCRIPT_EXTENSIONS,
+	".js",
+	".jsx",
+	".mjs",
+	".cjs"
+]);
+const ESLINT_ERROR_SEVERITY = 2;
+const TSC_ENTRY = path.join("node_modules", "typescript", "bin", "tsc");
+const ESLINT_ENTRY = path.join("node_modules", "eslint", "bin", "eslint.js");
+const TSC_ERROR_LINE = /^(.+?)\((\d+),(\d+)\): error (TS\d+): (.*)$/;
+/**
+* Runs a binary without a shell (paths are passed as argv, never interpolated).
+* A non-zero exit is a normal outcome - tsc/eslint exit non-zero when they find errors.
+*/
+function runProcess(file, args, cwd) {
+	return new Promise((resolve) => {
+		execFile(file, args, {
+			cwd,
+			timeout: CHECK_TIMEOUT_MS,
+			maxBuffer: MAX_OUTPUT_BYTES,
+			killSignal: "SIGKILL",
+			windowsHide: true
+		}, (error, stdout, stderr) => {
+			if (!error) {
+				resolve({
+					kind: "exited",
+					stdout
+				});
+				return;
+			}
+			if (error.killed) {
+				resolve({
+					kind: "failed",
+					reason: `timed out after ${CHECK_TIMEOUT_MS}ms`
+				});
+				return;
+			}
+			if (typeof error.code !== "number") {
+				resolve({
+					kind: "failed",
+					reason: error.message
+				});
+				return;
+			}
+			if (!stdout.trim()) {
+				resolve({
+					kind: "failed",
+					reason: `exit ${error.code}: ${stderr.trim().slice(0, 300)}`
+				});
+				return;
+			}
+			resolve({
+				kind: "exited",
+				stdout
+			});
+		});
+	});
+}
+/**
+* Runs a package's JS entry under the current Node. `node_modules/.bin/*` are sh
+* shims (`.cmd` on Windows) that `execFile` cannot launch without a shell.
+*/
+function runNodeScript(script, args, cwd) {
+	return runProcess(process.execPath, [script, ...args], cwd);
+}
+/** Nearest `relativePath` at or above `startDir`, or null. */
+function findUp(startDir, relativePath) {
+	let dir = path.resolve(startDir);
+	for (;;) {
+		const candidate = path.join(dir, relativePath);
+		if (existsSync(candidate)) return candidate;
+		const parent = path.dirname(dir);
+		if (parent === dir) return null;
+		dir = parent;
+	}
+}
+/** Groups files by a key derived from each; files whose key is null are dropped. */
+function groupBy(filePaths, keyOf) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const filePath of filePaths) {
+		const key = keyOf(filePath);
+		if (!key) continue;
+		groups.set(key, [...groups.get(key) ?? [], filePath]);
+	}
+	return groups;
+}
+const hasExtension = (extensions) => (filePath) => extensions.has(path.extname(filePath));
+function parseTscOutput(stdout, cwd) {
+	return stdout.split("\n").flatMap((line) => {
+		const match = TSC_ERROR_LINE.exec(line.trimEnd());
+		if (!match) return [];
+		const [, file, lineNumber, column, code, message] = match;
+		return [{
+			filePath: path.resolve(cwd, file),
+			line: Number(lineNumber),
+			column: Number(column),
+			code,
+			message
+		}];
+	});
+}
+function isEslintReport(value) {
+	return Array.isArray(value) && value.every((entry) => typeof entry === "object" && entry !== null && typeof entry.filePath === "string" && Array.isArray(entry.messages));
+}
+function parseEslintOutput(stdout) {
+	let report;
+	try {
+		report = JSON.parse(stdout);
+	} catch {
+		logger.debug(`[diagnostics] eslint produced non-JSON output: ${stdout.slice(0, 200)}`);
+		return [];
+	}
+	if (!isEslintReport(report)) return [];
+	return report.flatMap((fileResult) => fileResult.messages.filter((message) => message.severity === ESLINT_ERROR_SEVERITY).map((message) => ({
+		filePath: path.resolve(fileResult.filePath),
+		line: message.line ?? 1,
+		column: message.column ?? 1,
+		code: message.ruleId ?? "eslint",
+		message: message.message
+	})));
+}
+/**
+* Type-checks each changed file's nearest tsconfig project with the project's
+* own `tsc` (never a global one). Project-wide so path aliases and compiler
+* options are honored; output is filtered to the changed files by the caller.
+*/
+const checkTypeScript = async (filePaths) => {
+	const projects = groupBy(filePaths.filter(hasExtension(TYPESCRIPT_EXTENSIONS)), (filePath) => findUp(path.dirname(filePath), "tsconfig.json"));
+	const diagnostics = [];
+	for (const tsconfigPath of projects.keys()) {
+		const projectDir = path.dirname(tsconfigPath);
+		const tsc = findUp(projectDir, TSC_ENTRY);
+		if (!tsc) {
+			logger.debug(`[diagnostics] no local tsc found for ${tsconfigPath}; skipping type check`);
+			continue;
+		}
+		const outcome = await runNodeScript(tsc, [
+			"--noEmit",
+			"--pretty",
+			"false",
+			"-p",
+			tsconfigPath
+		], projectDir);
+		if (outcome.kind === "failed") {
+			logger.debug(`[diagnostics] tsc skipped for ${tsconfigPath}: ${outcome.reason}`);
+			continue;
+		}
+		diagnostics.push(...parseTscOutput(outcome.stdout, projectDir));
+	}
+	return diagnostics;
+};
+/** Lints changed files with the eslint installed nearest to each file, run from that package root. */
+const checkEslint = async (filePaths) => {
+	const groups = groupBy(filePaths.filter(hasExtension(ESLINT_EXTENSIONS)), (filePath) => findUp(path.dirname(filePath), ESLINT_ENTRY));
+	const diagnostics = [];
+	for (const [eslint, files] of groups) {
+		const packageRoot = path.resolve(path.dirname(eslint), "..", "..", "..");
+		const outcome = await runNodeScript(eslint, [
+			"--format",
+			"json",
+			...files
+		], packageRoot);
+		if (outcome.kind === "failed") {
+			logger.debug(`[diagnostics] eslint skipped under ${packageRoot}: ${outcome.reason}`);
+			continue;
+		}
+		diagnostics.push(...parseEslintOutput(outcome.stdout));
+	}
+	return diagnostics;
+};
+/** The default checker: tsc and eslint side by side. */
+const checkTypeScriptAndEslint = async (filePaths) => {
+	const [typeErrors, lintErrors] = await Promise.all([checkTypeScript(filePaths), checkEslint(filePaths)]);
+	return [...typeErrors, ...lintErrors];
+};
+//#endregion
+//#region src/diagnostics/PostEditDiagnostics.ts
+/**
+* How long a drain waits for in-flight checks (ms). Between turns the model
+* will take another turn anyway, so a busy worker just defers to the next
+* one; at finalization there is no later turn, so it waits longer.
+*/
+const DRAIN_BUDGET_MS = {
+	turn: 250,
+	final: 3e4
+};
+const REPORT_HEADER = "[Post-edit diagnostics] Errors in files you changed. Fix them before you finish:";
+const MAX_REPORTED_ERRORS = 20;
+const MAX_MESSAGE_LENGTH = 300;
+/**
+* Background type/lint checking of files the agent edits, drained into the
+* agent loop via AgentRunOptions.drainFeedback. Edits never wait on a check.
+*
+* Queue semantics are re-edit-wins: a file edited again before its check runs
+* is checked once in its final state, and a file edited again after a check
+* started (in flight or already completed but not yet reported) has that stale
+* result discarded in favor of the queued re-check. Each completed result is
+* reported at most once.
+*
+* Only collects between beginTurn() and endTurn(); a no-op otherwise, which is
+* how the per-turn config gate in turnController switches it off.
+*/
+var PostEditDiagnostics = class {
+	constructor({ workspaceRoot, check = checkTypeScriptAndEslint }) {
+		this.pending = /* @__PURE__ */ new Set();
+		this.results = /* @__PURE__ */ new Map();
+		this.worker = null;
+		this.active = false;
+		this.generation = 0;
+		this.workspaceRoot = workspaceRoot;
+		this.check = check;
+	}
+	beginTurn() {
+		this.reset();
+		this.active = true;
+	}
+	endTurn() {
+		this.reset();
+		this.active = false;
+	}
+	enqueue(filePath) {
+		if (!this.active) return;
+		const resolved = path.resolve(this.workspaceRoot, filePath);
+		this.results.delete(resolved);
+		this.pending.add(resolved);
+		this.worker ??= this.processQueue();
+	}
+	/**
+	* Waits up to `budgetMs` (or until `signal` aborts) for queued checks, then
+	* returns the errors found since the last drain, or null when there are none.
+	*/
+	async drain(budgetMs, signal) {
+		if (this.worker) await settleWithin(this.worker, budgetMs, signal);
+		return this.takeReport();
+	}
+	reset() {
+		this.generation++;
+		this.pending.clear();
+		this.results.clear();
+	}
+	async processQueue() {
+		try {
+			while (this.pending.size > 0) {
+				const batch = [...this.pending];
+				this.pending.clear();
+				const generation = this.generation;
+				const diagnostics = await this.runCheck(batch);
+				if (!diagnostics || generation !== this.generation) continue;
+				for (const filePath of batch) {
+					if (this.pending.has(filePath)) continue;
+					this.results.set(filePath, diagnostics.filter((diagnostic) => diagnostic.filePath === filePath));
+				}
+			}
+		} finally {
+			this.worker = null;
+		}
+	}
+	async runCheck(batch) {
+		try {
+			return await this.check(batch);
+		} catch (error) {
+			logger.debug(`[diagnostics] check failed; skipping ${batch.length} file(s): ${String(error)}`);
+			return null;
+		}
+	}
+	takeReport() {
+		const errors = [...this.results.values()].flat();
+		this.results.clear();
+		if (errors.length === 0) return null;
+		const lines = errors.slice(0, MAX_REPORTED_ERRORS).map((error) => this.formatError(error));
+		const omitted = errors.length - lines.length;
+		if (omitted > 0) lines.push(`(+${omitted} more)`);
+		return [REPORT_HEADER, ...lines].join("\n");
+	}
+	formatError({ filePath, line, column, code, message }) {
+		const relativePath = path.relative(this.workspaceRoot, filePath).split(path.sep).join("/");
+		const firstLine = message.split("\n")[0];
+		return `${relativePath}:${line}:${column} - ${code}: ${firstLine.length > MAX_MESSAGE_LENGTH ? `${firstLine.slice(0, MAX_MESSAGE_LENGTH)}...` : firstLine}`;
+	}
+};
+/** Resolves when `work` settles, `budgetMs` elapses, or `signal` aborts - whichever is first. */
+async function settleWithin(work, budgetMs, signal) {
+	if (signal?.aborted) return;
+	let timer;
+	let onAbort;
+	const cutoff = new Promise((resolve) => {
+		timer = setTimeout(resolve, budgetMs);
+		onAbort = resolve;
+		signal?.addEventListener("abort", onAbort, { once: true });
+	});
+	try {
+		await Promise.race([work, cutoff]);
+	} finally {
+		clearTimeout(timer);
+		if (onAbort) signal?.removeEventListener("abort", onAbort);
+	}
+}
+//#endregion
 //#region src/features/FeatureModuleRegistry.ts
 /**
 * Manages the lifecycle of opt-in CLI feature modules.
@@ -6758,6 +7190,168 @@ function createBuiltinModules(config, apiClient) {
 	return modules;
 }
 //#endregion
+//#region src/features/bridgePresence/peerOwner.ts
+const execFileAsync = promisify(execFile);
+const LSOF_TIMEOUT_MS = 2e3;
+const LSOF_CANDIDATES = ["/usr/sbin/lsof", "/usr/bin/lsof"];
+/**
+* Resolve the OS owner of the process holding the LISTEN socket on
+* `127.0.0.1:<port>`. This is the only pre-transmission trust signal the CLI
+* has over loopback TCP: the peer is whoever holds the port, so we confirm it
+* is the same UID as this process BEFORE handing it the bridge secret.
+*
+* Pure platform probe: the per-platform helpers classify every EXPECTED failure
+* into `no-listener`/`unknown` themselves. An UNEXPECTED throw (a bug) is left to
+* propagate so the CLI-layer caller can log it and fail closed - this module
+* deliberately does not depend on the CLI logger.
+*/
+async function resolveLoopbackListenerOwner(port) {
+	if (process.platform === "linux") return resolveViaProcNet(port);
+	if (process.platform === "darwin") return resolveViaLsof(port);
+	return { kind: "unknown" };
+}
+/**
+* Whether this platform + process can resolve loopback listener ownership at all:
+* there must be a `getuid` to compare against (Windows has none) AND an owner probe
+* for the platform. When false, the caller latches presence off rather than spinning
+* a retry loop forever on a check that can never pass (a `getuid`-bearing platform
+* with no probe - BSD/SunOS - would otherwise retry indefinitely).
+* MUST stay in sync with `resolveLoopbackListenerOwner`'s platform dispatch above:
+* a platform gains a probe there and a `true` here in the same change.
+*/
+function canResolveLoopbackOwner() {
+	if (typeof process.getuid !== "function") return false;
+	return process.platform === "linux" || process.platform === "darwin";
+}
+async function resolveViaProcNet(port) {
+	const uids = /* @__PURE__ */ new Set();
+	let readAny = false;
+	for (const file of ["/proc/net/tcp", "/proc/net/tcp6"]) {
+		let text;
+		try {
+			text = await promises.readFile(file, "utf8");
+		} catch {
+			continue;
+		}
+		readAny = true;
+		for (const uid of parseProcNetForUid(text, port)) uids.add(uid);
+	}
+	if (!readAny) return { kind: "unknown" };
+	if (uids.size === 0) return { kind: "no-listener" };
+	return uids.size === 1 ? {
+		kind: "owner",
+		uid: [...uids][0]
+	} : { kind: "unknown" };
+}
+/**
+* `local_address` hex (upper-case) of a socket that receives connections to
+* `127.0.0.1`: loopback itself, the v4/v6 wildcard binds (a same-UID process
+* may legitimately hold `0.0.0.0`/`::`), and the v4-mapped-in-v6 forms. A row
+* on any other IP is a different socket that happens to share the port number
+* and must NOT be attributed to the loopback peer.
+*
+* `/proc/net/tcp6` prints each 32-bit word of the address little-endian (no
+* `ntohl`), which is why `127.0.0.1` reads `0100007F` and the mapped third word
+* `00 00 ff ff` reads `FFFF0000`.
+*/
+const LOOPBACK_OR_WILDCARD_HEX = /* @__PURE__ */ new Set([
+	"00000000",
+	"0100007F",
+	"00000000000000000000000000000000",
+	"00000000000000000000000001000000",
+	"0000000000000000FFFF000000000000",
+	"0000000000000000FFFF00000100007F"
+]);
+/**
+* Parse a `/proc/net/tcp`(6) dump for the UIDs of LISTEN sockets on the
+* loopback `port`. Row columns are whitespace-separated: sl(0)
+* local_address(1) rem_address(2) st(3) tx:rx(4) tr:when(5) retrnsmt(6)
+* uid(7). `local_address` is `HEXIP:HEXPORT`; `st` `0A` is TCP_LISTEN. The IP
+* must be loopback or wildcard, else a same-port listener on another interface
+* would be mis-attributed to the loopback peer. Returns every match so the
+* caller can reject an ambiguous set (two distinct owners) rather than
+* silently taking the first.
+*/
+function parseProcNetForUid(text, port) {
+	const uids = [];
+	for (const line of text.split("\n")) {
+		const cols = line.trim().split(/\s+/);
+		if (cols.length < 8) continue;
+		const local = cols[1];
+		const colon = local.lastIndexOf(":");
+		if (colon < 0) continue;
+		if (parseInt(local.slice(colon + 1), 16) !== port) continue;
+		if (cols[3] !== "0A") continue;
+		if (!LOOPBACK_OR_WILDCARD_HEX.has(local.slice(0, colon).toUpperCase())) continue;
+		const uid = Number(cols[7]);
+		if (Number.isInteger(uid)) uids.push(uid);
+	}
+	return uids;
+}
+async function resolveViaLsof(port) {
+	const lsof = await resolveLsofPath();
+	if (!lsof) return { kind: "unknown" };
+	let stdout;
+	try {
+		({stdout} = await execFileAsync(lsof, [
+			"-nP",
+			`-iTCP:${port}`,
+			"-sTCP:LISTEN",
+			"-Fpun"
+		], { timeout: LSOF_TIMEOUT_MS }));
+	} catch (err) {
+		const e = err;
+		if (!e.killed && e.code === 1 && !e.stdout) return { kind: "no-listener" };
+		if (e.killed || typeof e.stdout !== "string") return { kind: "unknown" };
+		stdout = e.stdout;
+	}
+	const uids = new Set(parseLsofForUid(stdout));
+	if (uids.size === 0) return { kind: "no-listener" };
+	return uids.size === 1 ? {
+		kind: "owner",
+		uid: [...uids][0]
+	} : { kind: "unknown" };
+}
+let lsofPathCache;
+async function resolveLsofPath() {
+	if (lsofPathCache !== void 0) return lsofPathCache;
+	for (const candidate of LSOF_CANDIDATES) try {
+		await promises.access(candidate, constants.X_OK);
+		lsofPathCache = candidate;
+		return candidate;
+	} catch {}
+	lsofPathCache = null;
+	return null;
+}
+/** Does an `lsof -nP` numeric socket name (`n` field, host:port) receive
+*  connections to `127.0.0.1`? Loopback, wildcard, or v4-mapped loopback -
+*  exact, to stay symmetric with the linux matcher (the CLI only dials
+*  `127.0.0.1`). */
+function isLoopbackLsofName(name) {
+	return name.startsWith("127.0.0.1:") || name.startsWith("*:") || name.startsWith("[::1]:") || name.startsWith("[::]:") || name.startsWith("[::ffff:127.0.0.1]:");
+}
+/**
+* Parse `lsof -Fpun` output for the UIDs of loopback listeners. `-F` prints
+* one field per line prefixed by its type char; `u<uid>` is a process-level
+* field, `n<host:port>` a file-level one. `uid` resets on each `p<pid>` block
+* so a block without a `u` field can't inherit the prior block's owner. We
+* collect the UID for every loopback/wildcard name so the caller can reject an
+* ambiguous set rather than taking the first.
+*/
+function parseLsofForUid(text) {
+	const uids = [];
+	let uid = null;
+	for (const line of text.split("\n")) {
+		const tag = line[0];
+		if (tag === "p") uid = null;
+		else if (tag === "u") {
+			const parsed = Number(line.slice(1));
+			uid = Number.isInteger(parsed) ? parsed : null;
+		} else if (tag === "n" && uid !== null && isLoopbackLsofName(line.slice(1))) uids.push(uid);
+	}
+	return uids;
+}
+//#endregion
 //#region src/features/bridgePresence/BridgePresence.ts
 const DEFAULT_PORT = Number(process.env.CC_BRIDGE_PORT ?? 48732);
 const CONFIG_PATH = join(homedir(), ".b4m", "cc-bridge.json");
@@ -6783,11 +7377,15 @@ var BridgePresence = class {
 		this.callbacks = {};
 		this.started = false;
 		this.stopped = false;
+		this.generation = 0;
+		this.trusted = false;
+		this.wsConnectingGen = null;
 		this.reconnectTimer = null;
 		this.reconnectAttempts = 0;
 		this.announceRetryTimer = null;
 		this.announceAttempts = 0;
 		this.startOpts = null;
+		this.peerWarned = false;
 		this.pendingWorkspaceName = null;
 		this.pendingCapabilities = null;
 		this.pendingSource = null;
@@ -6796,6 +7394,19 @@ var BridgePresence = class {
 	setCallbacks(cbs) {
 		this.callbacks = cbs;
 	}
+	/** True iff `gen` is still the live connection generation - the single spelling
+	*  of the ABA guard applied after every await (see `generation`). */
+	isCurrent(gen) {
+		return gen === this.generation;
+	}
+	/** Test-only: the generation currently holding the connectCommandWs in-flight
+	*  latch, or null when free. Exposed to pin the `finally` identity guard - a
+	*  stale generation's finally must not clear a live generation's latch (which
+	*  would let a second overlapping connect build an untracked socket). Not part
+	*  of the runtime contract. */
+	get __wsConnectingGenForTests() {
+		return this.wsConnectingGen;
+	}
 	/**
 	* Probe the local bridge and, if present, announce this CLI session.
 	* Returns true iff the announce succeeded (tavern presence is active).
@@ -6809,7 +7420,10 @@ var BridgePresence = class {
 		if (this.started) return this.instanceId !== null;
 		this.stopped = false;
 		this.started = true;
+		this.generation += 1;
+		const gen = this.generation;
 		const config = await readBridgeConfig();
+		if (!this.isCurrent(gen)) return false;
 		if (!config) {
 			logger.debug("[tavern] cc-bridge not configured; CLI runs without tavern presence");
 			return false;
@@ -6821,34 +7435,119 @@ var BridgePresence = class {
 		this.pendingSource = opts.source ?? "b4m-cli";
 		return this.attemptAnnounce();
 	}
+	/**
+	* Classify the process holding the bridge port relative to this CLI, BEFORE
+	* any secret leaves the process. Over loopback TCP the peer is whoever holds
+	* the port; the secret file is plaintext and per-user, so a same-UID peer is
+	* already trusted (it could read the file directly), and a different-UID (or
+	* sandboxed) peer is the adversary this gate stops.
+	*
+	* Four outcomes, so the caller warns only on a real trust failure (a foreign
+	* owner) and stays quiet on the benign ones:
+	*  - `trusted`        - same-UID owner; disclosure is safe.
+	*  - `absent`         - no loopback listener yet (cc-bridge simply not
+	*                       started); fail-closed but quiet - just retry.
+	*  - `foreign`        - a different-UID owner holds the port; fail-closed AND
+	*                       log the security-worded warning (the real adversary).
+	*  - `undeterminable` - ownership can't be resolved: lookup tool missing/hung,
+	*                       a read/spawn error, or an ambiguous owner set.
+	*                       Fail-closed, but a host that can't run the probe is not
+	*                       an attacker - log at debug, not as the security warning.
+	*
+	* A platform that can't resolve ownership (see `canResolveLoopbackOwner`) is
+	* latched off earlier, in `attemptAnnounce`, so this method is only reached
+	* where `getuid` exists and the platform has an owner probe.
+	*/
+	async checkPeerTrust() {
+		const port = this.config?.port ?? DEFAULT_PORT;
+		let owner;
+		try {
+			owner = await resolveLoopbackListenerOwner(port);
+		} catch (err) {
+			logger.debug(`[tavern] loopback owner lookup threw: ${err.message}`);
+			return "undeterminable";
+		}
+		if (owner.kind === "no-listener") return "absent";
+		if (owner.kind === "unknown") return "undeterminable";
+		if (owner.uid !== process.getuid()) return "foreign";
+		this.peerWarned = false;
+		return "trusted";
+	}
+	/** Log the foreign-owner security warning once per untrusted state. */
+	warnUntrustedPeerOnce() {
+		if (this.peerWarned) return;
+		this.peerWarned = true;
+		logger.warn("[tavern] bridge port is held by a different user; not disclosing secret or handling commands");
+	}
 	/** One announce attempt. Schedules a retry on failure; wires up the
 	*  command WS + initial status on success. Idempotent: re-entering after
 	*  a successful announce short-circuits at the instanceId guard. */
 	async attemptAnnounce() {
 		if (this.stopped || !this.config || !this.startOpts) return false;
 		if (this.instanceId) return true;
+		if (!canResolveLoopbackOwner()) {
+			logger.debug("[tavern] ownership unresolvable on this platform; tavern presence disabled");
+			return false;
+		}
+		const gen = this.generation;
+		const startOpts = this.startOpts;
+		if (!await this.gateEgress(gen, "announce")) return false;
 		const instanceId = v4();
 		const workspaceName = this.pendingWorkspaceName;
 		const capabilities = this.pendingCapabilities;
 		const source = this.pendingSource;
-		if (!await this.announce({
+		const announced = await this.announce({
 			instanceId,
 			source,
 			workspaceName,
-			workspacePath: this.startOpts.workspacePath,
+			workspacePath: startOpts.workspacePath,
 			capabilities
-		})) {
+		});
+		if (!this.isCurrent(gen) || this.stopped || !this.config) return false;
+		if (!announced) {
+			this.trusted = false;
 			this.scheduleAnnounceRetry();
 			return false;
 		}
 		this.instanceId = instanceId;
 		this.announceAttempts = 0;
 		logger.info(`[tavern] announced ${workspaceName} to cc-bridge on 127.0.0.1:${this.config.port ?? DEFAULT_PORT}`);
-		this.connectCommandWs();
+		this.connectCommandWs().catch((err) => logger.debug(`[tavern] connectCommandWs threw: ${err.message}`));
 		this.emitEvent({
 			type: "status",
 			status: "idle"
-		});
+		}).catch(() => {});
+		return true;
+	}
+	/** Signal the untrusted condition at the right volume: the security-worded
+	*  warning only for a real foreign owner, and a quiet debug line for the
+	*  benign cases (bridge not started yet, or ownership undeterminable) so we
+	*  don't cry wolf on every backed-off retry. */
+	signalUntrusted(trust, phase) {
+		if (trust === "foreign") this.warnUntrustedPeerOnce();
+		else if (trust === "undeterminable") logger.debug(`[tavern] bridge port owner undeterminable; retrying ${phase}`);
+		else logger.debug(`[tavern] cc-bridge not reachable yet; retrying ${phase}`);
+	}
+	/**
+	* Run the pre-disclosure ownership gate for one egress phase and open or keep
+	* the trust latch closed. The caller passes the connection `generation` it
+	* captured BEFORE this await, so a stop()+start() cycle (or a bare stop())
+	* landing during the probe is detected and this stale continuation bails.
+	* Returns true iff the gate is open (secret disclosure is now permitted for
+	* this generation); false means the caller must return - either the owner is
+	* untrusted (a retry has been scheduled) or the generation moved.
+	*/
+	async gateEgress(gen, phase) {
+		const trust = await this.checkPeerTrust();
+		if (!this.isCurrent(gen) || this.stopped || !this.config) return false;
+		if (trust !== "trusted") {
+			this.trusted = false;
+			this.signalUntrusted(trust, phase);
+			if (phase === "announce") this.scheduleAnnounceRetry();
+			else this.scheduleReconnect();
+			return false;
+		}
+		this.trusted = true;
 		return true;
 	}
 	scheduleAnnounceRetry() {
@@ -6857,17 +7556,22 @@ var BridgePresence = class {
 		const delay = Math.min(1e3 * 2 ** (this.announceAttempts - 1), 3e4);
 		this.announceRetryTimer = setTimeout(() => {
 			this.announceRetryTimer = null;
-			this.attemptAnnounce();
+			this.attemptAnnounce().catch((err) => logger.debug(`[tavern] announce retry threw: ${err.message}`));
 		}, delay);
 	}
 	/** Emit an event for this session. No-op if the bridge isn't up. Events
 	*  leave in strict order - see `emitQueue` comment. */
 	async emitEvent(event) {
 		if (!this.config || !this.instanceId) return;
-		const task = () => this.post("/event", {
-			instanceId: this.instanceId,
-			event
-		}).catch((err) => logger.info(`[tavern] emitEvent ${event.type} failed: ${err.message}`));
+		const instanceId = this.instanceId;
+		const gen = this.generation;
+		const task = () => {
+			if (!this.isCurrent(gen)) return;
+			return this.post("/event", {
+				instanceId,
+				event
+			}).catch((err) => logger.info(`[tavern] emitEvent ${event.type} failed: ${err.message}`));
+		};
 		this.emitQueue = this.emitQueue.then(task, task);
 		return this.emitQueue;
 	}
@@ -6885,6 +7589,7 @@ var BridgePresence = class {
 	async stop(reason = "cli_exit") {
 		if (this.stopped || !this.started) return;
 		this.stopped = true;
+		this.generation += 1;
 		if (this.reconnectTimer) {
 			clearTimeout(this.reconnectTimer);
 			this.reconnectTimer = null;
@@ -6893,13 +7598,14 @@ var BridgePresence = class {
 			clearTimeout(this.announceRetryTimer);
 			this.announceRetryTimer = null;
 		}
+		const wsWasLive = this.ws !== null;
 		if (this.ws) {
 			try {
 				this.ws.close();
 			} catch {}
 			this.ws = null;
 		}
-		if (this.config && this.instanceId) await this.post("/disconnect", {
+		if (this.config && this.instanceId && wsWasLive) await this.post("/disconnect", {
 			instanceId: this.instanceId,
 			reason
 		}).catch(() => {});
@@ -6912,6 +7618,8 @@ var BridgePresence = class {
 		this.pendingSource = null;
 		this.announceAttempts = 0;
 		this.reconnectAttempts = 0;
+		this.peerWarned = false;
+		this.trusted = false;
 		this.emitQueue = Promise.resolve();
 	}
 	async announce(body) {
@@ -6925,6 +7633,7 @@ var BridgePresence = class {
 	}
 	async post(path, body) {
 		if (!this.config) throw new Error("bridge config not loaded");
+		if (!this.trusted) throw new Error("bridge peer not trusted; refusing to disclose secret");
 		const url = `http://127.0.0.1:${this.config.port ?? DEFAULT_PORT}${path}?secret=${encodeURIComponent(this.config.hookSecret)}`;
 		const res = await fetch(url, {
 			method: "POST",
@@ -6934,42 +7643,58 @@ var BridgePresence = class {
 		});
 		if (!res.ok) throw new Error(`bridge ${path} -> ${res.status}`);
 	}
-	connectCommandWs() {
+	async connectCommandWs() {
 		if (this.stopped || !this.config || !this.instanceId) return;
-		const url = `ws://127.0.0.1:${this.config.port ?? DEFAULT_PORT}/commands?instanceId=${encodeURIComponent(this.instanceId)}&secret=${encodeURIComponent(this.config.hookSecret)}`;
-		let ws;
+		const gen = this.generation;
+		if (this.ws || this.wsConnectingGen === gen) return;
+		this.wsConnectingGen = gen;
 		try {
-			ws = new WebSocket(url);
-		} catch (err) {
-			logger.debug(`[tavern] command WS construct failed: ${err.message}`);
-			this.scheduleReconnect();
-			return;
-		}
-		this.ws = ws;
-		ws.on("open", () => {
-			this.reconnectAttempts = 0;
-			logger.debug("[tavern] command WS open");
-		});
-		ws.on("message", (raw) => {
-			let frame = null;
+			if (!await this.gateEgress(gen, "command WS")) return;
+			const config = this.config;
+			const instanceId = this.instanceId;
+			if (!config || !instanceId) return;
+			const url = `ws://127.0.0.1:${config.port ?? DEFAULT_PORT}/commands?instanceId=${encodeURIComponent(instanceId)}&secret=${encodeURIComponent(config.hookSecret)}`;
+			let ws;
 			try {
-				frame = JSON.parse(raw.toString());
-			} catch {
-				logger.debug("[tavern] malformed command frame; ignored");
+				ws = new WebSocket(url);
+			} catch (err) {
+				logger.debug(`[tavern] command WS construct failed: ${err.message}`);
+				this.trusted = false;
+				this.scheduleReconnect();
 				return;
 			}
-			if (!frame?.command) return;
-			this.dispatchCommand(frame.command).catch((err) => logger.warn(`[tavern] command dispatch threw: ${err.message}`));
-		});
-		ws.on("close", () => {
-			this.ws = null;
-			if (this.stopped) return;
-			logger.debug("[tavern] command WS closed; reconnecting");
-			this.scheduleReconnect();
-		});
-		ws.on("error", (err) => {
-			logger.debug(`[tavern] command WS error: ${err.message}`);
-		});
+			this.ws = ws;
+			ws.on("open", () => {
+				if (this.ws !== ws) return;
+				this.reconnectAttempts = 0;
+				logger.debug("[tavern] command WS open");
+			});
+			ws.on("message", (raw) => {
+				if (this.ws !== ws) return;
+				let frame = null;
+				try {
+					frame = JSON.parse(raw.toString());
+				} catch {
+					logger.debug("[tavern] malformed command frame; ignored");
+					return;
+				}
+				if (!frame?.command) return;
+				this.dispatchCommand(frame.command).catch((err) => logger.warn(`[tavern] command dispatch threw: ${err.message}`));
+			});
+			ws.on("close", () => {
+				if (this.ws !== ws) return;
+				this.ws = null;
+				this.trusted = false;
+				if (this.stopped) return;
+				logger.debug("[tavern] command WS closed; reconnecting");
+				this.scheduleReconnect();
+			});
+			ws.on("error", (err) => {
+				logger.debug(`[tavern] command WS error: ${err.message}`);
+			});
+		} finally {
+			if (this.wsConnectingGen === gen) this.wsConnectingGen = null;
+		}
 	}
 	scheduleReconnect() {
 		if (this.stopped || this.reconnectTimer) return;
@@ -6977,10 +7702,11 @@ var BridgePresence = class {
 		const delay = Math.min(500 * 2 ** (this.reconnectAttempts - 1), 1e4);
 		this.reconnectTimer = setTimeout(() => {
 			this.reconnectTimer = null;
-			this.connectCommandWs();
+			this.connectCommandWs().catch((err) => logger.debug(`[tavern] command WS reconnect threw: ${err.message}`));
 		}, delay);
 	}
 	async dispatchCommand(command) {
+		if (this.stopped) return;
 		switch (command.type) {
 			case "send_prompt":
 				if (this.callbacks.onSendPrompt) await this.callbacks.onSendPrompt(command.text);
@@ -7130,7 +7856,7 @@ const infoCommands = [
 	{
 		name: "help",
 		run: (_args, ctx) => {
-			const customCommands = ctx.customCommandStore.getAllCommands();
+			const customCommands = ctx.customCommandStore.getModelReachableCommands();
 			const hasCustomCommands = customCommands.length > 0;
 			console.log(`
 Available commands:
@@ -7321,6 +8047,48 @@ async function dispatch(name, args, ctx) {
 	return true;
 }
 //#endregion
+//#region src/commands/sandboxNetworkCommand.ts
+async function handleSandboxNetworkCommand(deps, arg) {
+	const { orchestrator, configStore, permissionManager } = deps;
+	if (!orchestrator) return "Sandbox not initialized";
+	if (arg !== "on" && arg !== "off") return "Usage: /sandbox:network <on|off>";
+	const enable = arg === "on";
+	if (enable && !orchestrator.isAvailable()) return "Sandbox runtime not available on this platform";
+	const active = await orchestrator.setNetworkEnabled(enable);
+	if (enable && !active) {
+		permissionManager?.setSandboxState(orchestrator.getMode(), orchestrator.isActive());
+		await configStore.saveSandboxConfig(orchestrator.getConfig());
+		return "Failed to start the network proxy; network stays disabled (fail-closed).";
+	}
+	permissionManager?.setSandboxState(orchestrator.getMode(), orchestrator.isActive());
+	await configStore.saveSandboxConfig(orchestrator.getConfig());
+	if (!enable) return "Sandbox network disabled (fail-closed)";
+	const port = orchestrator.getProxyManager()?.getPort();
+	return `Sandbox network egress enabled${port ? ` (proxy-aware clients filtered on port ${port})` : ""}`;
+}
+//#endregion
+//#region src/commands/sandboxTrustDomainCommand.ts
+async function handleSandboxTrustDomainCommand(deps, domains) {
+	const { orchestrator, configStore } = deps;
+	if (!orchestrator) return "Sandbox not initialized";
+	const clean = domains.map((d) => d.trim()).filter(Boolean);
+	if (clean.length === 0) return "Usage: /sandbox:trust-domain <domain> [...]";
+	if (!orchestrator.getProxyManager()) return "Network proxy not initialized";
+	const lines = [];
+	for (const domain of clean) {
+		orchestrator.addAllowedDomain(domain);
+		lines.push(`  Added: ${domain}`);
+	}
+	try {
+		await configStore.saveSandboxConfig(orchestrator.getConfig());
+	} catch (err) {
+		const msg = err instanceof Error ? err.message : String(err);
+		return `${lines.join("\n")}\nWarning: failed to persist the trusted domains (${msg}); they apply for this session only.`;
+	}
+	lines.push(`Trusted ${clean.length} domain(s)`);
+	return lines.join("\n");
+}
+//#endregion
 //#region src/session/turnController.ts
 /**
 * Turn lifecycle (issue #228, phase 2).
@@ -7339,7 +8107,7 @@ async function dispatch(name, args, ctx) {
 * recurses with the same context for messages submitted mid-turn.
 */
 async function runTurn(message, ctx) {
-	const { agent, sessionStore, configStore, commandHistoryStore, customCommandStore, messageBuilder, config, availableModels, agentStore, contextContent, additionalDirectories, featureRegistry, backgroundManager, todoStore, decisionStore, blockerStore, workflowStores, setCommandHistory, setAbortController } = ctx;
+	const { agent, sessionStore, configStore, commandHistoryStore, customCommandStore, messageBuilder, config, availableModels, agentStore, contextContent, additionalDirectories, featureRegistry, backgroundManager, todoStore, decisionStore, blockerStore, postEditDiagnostics, workflowStores, setCommandHistory, setAbortController } = ctx;
 	const storeSession = useCliStore.getState().session;
 	if (!agent || !storeSession) {
 		console.error("❌ CLI failed to initialize. Try restarting b4m.\n");
@@ -7365,7 +8133,7 @@ async function runTurn(message, ctx) {
 		const systemPrompt = buildSystemPrompt(config?.preferences.promptVariant ?? "current", {
 			contextContent,
 			agentStore: agentStore || void 0,
-			customCommands: customCommandStore.getAllCommands(),
+			customCommands: customCommandStore.getModelReachableCommands(),
 			enableSkillTool: config?.preferences.enableSkillTool !== false,
 			additionalDirectories,
 			featureModulePrompts: featureRegistry?.getSystemPromptSections() || void 0,
@@ -7444,6 +8212,8 @@ async function runTurn(message, ctx) {
 			if (elided > 0) logger.debug(`[workflowReminder] elided ${elided} item(s) to fit the token cap`);
 			return text;
 		} : void 0;
+		const diagnostics = cliConfig.preferences.postEditDiagnostics === true ? postEditDiagnostics : null;
+		diagnostics?.beginTurn();
 		let result;
 		try {
 			result = await agent.run(messageContent, {
@@ -7452,9 +8222,11 @@ async function runTurn(message, ctx) {
 				parallelExecution: cliConfig.preferences.enableParallelToolExecution === true,
 				isReadOnlyTool,
 				workflowReminder,
+				drainFeedback: diagnostics ? (phase) => diagnostics.drain(DRAIN_BUDGET_MS[phase], abortController.signal) : void 0,
 				onContextLimit: createReactiveCompactionHandler(agent, activeSession, 1 + previousMessages.length + 1)
 			});
 		} finally {
+			diagnostics?.endTurn();
 			backgroundManager?.setCurrentTurn(null);
 		}
 		const permissionDenied = result.finalAnswer.startsWith("Permission denied for tool");
@@ -7755,6 +8527,22 @@ async function rewindSession(ctx, messageIndex) {
 	return { prefill: prefillContent };
 }
 //#endregion
+//#region src/session/modelOverride.ts
+async function runWithModelOverride(ctx, overrideModel, run) {
+	const originalModel = useCliStore.getState().session?.model;
+	ctx.applyModel(overrideModel);
+	try {
+		return await run();
+	} finally {
+		if (originalModel) await restoreModel(ctx, originalModel);
+	}
+}
+async function restoreModel(ctx, originalModel) {
+	ctx.applyModel(originalModel);
+	const restoredSession = useCliStore.getState().session;
+	if (restoredSession) await ctx.sessionStore.save(restoredSession);
+}
+//#endregion
 //#region src/index.tsx
 process.removeAllListeners("warning");
 process.on("warning", (warning) => {
@@ -7854,6 +8642,7 @@ function CliApp() {
 		permissionPrompt: null,
 		trustLocationSelector: null,
 		folderTrustPrompt: null,
+		mcpApprovalPrompt: null,
 		rewindSelector: null,
 		sessionSelector: null,
 		orchestrator: null,
@@ -7873,10 +8662,12 @@ function CliApp() {
 	const [commandHistory, setCommandHistory] = useState([]);
 	const imageStoreInitPromise = useRef(null);
 	const folderTrustResolvedRef = useRef(false);
+	const mcpApprovalResolvedRef = useRef(false);
 	const todoStoreRef = useRef(createTodoStore());
 	const decisionStoreRef = useRef(createDecisionStore());
 	const blockerStoreRef = useRef(createBlockerStore());
 	const reviewGateStoreRef = useRef(createReviewGateStore());
+	const postEditDiagnosticsRef = useRef(new PostEditDiagnostics({ workspaceRoot: process.cwd() }));
 	const setStoreSession = useCliStore((state) => state.setSession);
 	const enqueuePermissionPrompt = useCliStore((state) => state.enqueuePermissionPrompt);
 	const enqueueUserQuestionPrompt = useCliStore((state) => state.enqueueUserQuestionPrompt);
@@ -7988,6 +8779,20 @@ function CliApp() {
 				}));
 				return;
 			}
+			const pendingMcp = state.configStore.getPendingMcpApprovals();
+			if (pendingMcp.length > 0 && !mcpApprovalResolvedRef.current && Boolean(process.stdin.isTTY) && Boolean(process.stdout.isTTY)) {
+				mcpApprovalResolvedRef.current = true;
+				setState((prev) => ({
+					...prev,
+					mcpApprovalPrompt: {
+						projectRoot: state.configStore.getProjectRealPath() ?? process.cwd(),
+						servers: pendingMcp
+					},
+					config
+				}));
+				return;
+			}
+			if (!mcpApprovalResolvedRef.current) state.configStore.warnPendingMcpApprovals();
 			const configDirs = await state.configStore.getAdditionalDirectories();
 			const flagDirs = process.env.B4M_ADDITIONAL_DIRS ? JSON.parse(process.env.B4M_ADDITIONAL_DIRS) : [];
 			const additionalDirectories = [.../* @__PURE__ */ new Set([...configDirs, ...flagDirs])];
@@ -8050,6 +8855,14 @@ function CliApp() {
 			});
 			const pinnedSessionId = process.env.B4M_SESSION_ID;
 			const resumeSessionId = process.env.B4M_RESUME_ID;
+			if (pinnedSessionId && !isValidSessionId(pinnedSessionId)) {
+				console.error(`Invalid session id (--session-id / B4M_SESSION_ID): must match ${SESSION_ID_PATTERN.source}`);
+				process.exit(1);
+			}
+			if (resumeSessionId && !isValidSessionId(resumeSessionId)) {
+				console.error(`Invalid session id (--resume / B4M_RESUME_ID): must match ${SESSION_ID_PATTERN.source}`);
+				process.exit(1);
+			}
 			let newSession;
 			if (resumeSessionId) {
 				const resumed = await state.sessionStore.load(resumeSessionId);
@@ -8164,7 +8977,8 @@ function CliApp() {
 			};
 			const agentContext = {
 				currentAgent: null,
-				observationQueue: []
+				observationQueue: [],
+				onFileChanged: (filePath) => postEditDiagnosticsRef.current.enqueue(filePath)
 			};
 			const { mcpManager, agentStore, contextResult, mcpTools, loadedB4mTools, deferredB4mTools, orchestrator, backgroundManager, historyStore } = await buildSupportingStores({
 				config,
@@ -8234,8 +9048,10 @@ function CliApp() {
 				customCommandStore: state.customCommandStore,
 				subagentOrchestrator: orchestrator,
 				sessionId: newSession.id,
-				permissionManager,
-				promptFn,
+				permission: {
+					permissionManager,
+					promptFn
+				},
 				allowedDirectories: additionalDirectories
 			})], cliWrapDeps)[0] : null;
 			const findDefinitionTool = wrapTools([createFindDefinitionTool(additionalDirectories)], cliWrapDeps)[0];
@@ -8267,6 +9083,7 @@ function CliApp() {
 				logger,
 				reservedToolNames: [...loadedB4mTools, ...cliTools].map((t) => t.toolSchema.name).concat("tool_search")
 			});
+			rewireReservedNames(state, featureRegistry);
 			const featureModuleToolNames = featureRegistry.getAllToolNames();
 			if (featureModuleToolNames.length > 0) registerFeatureModuleTools(featureModuleToolNames);
 			if (wsManager && featureRegistry.hasModules) featureRegistry.registerAllWsHandlers(wsManager);
@@ -8671,6 +9488,7 @@ function CliApp() {
 		todoStore: todoStoreRef.current,
 		decisionStore: decisionStoreRef.current,
 		blockerStore: blockerStoreRef.current,
+		postEditDiagnostics: postEditDiagnosticsRef.current,
 		workflowStores: {
 			decisionStore: decisionStoreRef.current,
 			blockerStore: blockerStoreRef.current,
@@ -9109,7 +9927,7 @@ function CliApp() {
 		console.log(fellBack ? "✅ Session saved with local fallback handoff" : "✅ Session saved with refreshed handoff");
 	};
 	const handleCommand = async (command, args) => {
-		const customCommand = state.customCommandStore.getCommand(command);
+		const customCommand = state.customCommandStore.getModelReachableCommand(command);
 		if (customCommand) try {
 			const sourceIcon = customCommand.source === "global" ? "🏠" : "📁";
 			console.log(`${sourceIcon} Executing custom command: /${command}`);
@@ -9140,11 +9958,10 @@ function CliApp() {
 			}
 			if (customCommand.model && state.agent) {
 				console.log(`🔄 Using model override: ${customCommand.model}`);
-				const overrideSession = useCliStore.getState().session;
-				const originalModel = overrideSession?.model;
-				if (overrideSession) overrideSession.model = customCommand.model;
-				await handleCustomCommandMessage(substitutedBody, displayMessage);
-				if (overrideSession && originalModel) overrideSession.model = originalModel;
+				await runWithModelOverride({
+					applyModel: applyModelToSession,
+					sessionStore: state.sessionStore
+				}, customCommand.model, () => handleCustomCommandMessage(substitutedBody, displayMessage));
 			} else {
 				console.log("🤖 Sending to agent...\n");
 				await handleCustomCommandMessage(substitutedBody, displayMessage);
@@ -9661,7 +10478,7 @@ function CliApp() {
 				const variantForCount = state.config?.preferences.promptVariant ?? "current";
 				const corePromptTokens = tokenCounter.countTokens(buildSystemPrompt(variantForCount));
 				const projectContextTokens = state.contextContent ? tokenCounter.countTokens(state.contextContent) : 0;
-				const commands = state.customCommandStore.getAllCommands();
+				const commands = state.customCommandStore.getModelReachableCommands();
 				const skillsSection = buildSkillsPromptSection(commands);
 				const skillsTokens = skillsSection ? tokenCounter.countTokens(skillsSection) : 0;
 				const agentDirectoryTokens = state.agentStore ? tokenCounter.countTokens(state.agentStore.getDirectoryContext()) : 0;
@@ -9753,9 +10570,9 @@ function CliApp() {
 				break;
 			}
 			case "commands": {
-				const customCommands = state.customCommandStore.getAllCommands();
-				const globalCommands = state.customCommandStore.getCommandsBySource("global");
-				const projectCommands = state.customCommandStore.getCommandsBySource("project");
+				const customCommands = state.customCommandStore.getModelReachableCommands();
+				const globalCommands = customCommands.filter((cmd) => cmd.source === "global");
+				const projectCommands = customCommands.filter((cmd) => cmd.source === "project");
 				console.log("\n📝 Custom Commands:\n");
 				if (customCommands.length === 0) {
 					console.log("No custom commands found.");
@@ -9937,9 +10754,10 @@ function CliApp() {
 				state.sandboxOrchestrator.setMode("auto-allow");
 				state.permissionManager?.setSandboxState("auto-allow", state.sandboxOrchestrator.isActive());
 				if (state.sandboxOrchestrator.getConfig().network.enabled) {
-					await state.sandboxOrchestrator.startProxy();
+					const on = await state.sandboxOrchestrator.setNetworkEnabled(true);
 					const pm = state.sandboxOrchestrator.getProxyManager();
-					if (pm?.isRunning()) console.log(`🌐 Network proxy started on port ${pm.getPort()}`);
+					if (on && pm?.isRunning()) console.log(`🌐 Network proxy started on port ${pm.getPort()}`);
+					else console.log("⚠️  Network filtering requested but the proxy failed to start; egress disabled");
 				}
 				await state.configStore.saveSandboxConfig(state.sandboxOrchestrator.getConfig());
 				console.log("Sandbox enabled (auto-allow mode)");
@@ -9949,7 +10767,7 @@ function CliApp() {
 					console.log("Sandbox not initialized");
 					break;
 				}
-				await state.sandboxOrchestrator.stopProxy();
+				await state.sandboxOrchestrator.setNetworkEnabled(false);
 				state.sandboxOrchestrator.setMode("disabled");
 				state.permissionManager?.setSandboxState("disabled", false);
 				await state.configStore.saveSandboxConfig(state.sandboxOrchestrator.getConfig());
@@ -9975,35 +10793,19 @@ function CliApp() {
 				console.log(`Sandbox mode set to: ${modeArg}`);
 				break;
 			}
-			case "sandbox:trust-domain": {
-				if (!state.sandboxOrchestrator) {
-					console.log("Sandbox not initialized");
-					break;
-				}
-				if (args.length === 0) {
-					console.log("Usage: /sandbox:trust-domain <domain> [...]");
-					break;
-				}
-				const proxyMgr = state.sandboxOrchestrator.getProxyManager();
-				if (!proxyMgr) {
-					console.log("Network proxy not initialized");
-					break;
-				}
-				for (const domain of args) {
-					proxyMgr.addAllowedDomain(domain);
-					console.log(`  Added: ${domain}`);
-				}
-				const currentSandboxConfig = state.sandboxOrchestrator.getConfig();
-				await state.configStore.saveSandboxConfig({
-					...currentSandboxConfig,
-					network: {
-						...currentSandboxConfig.network,
-						allowedDomains: proxyMgr.getAllowedDomains()
-					}
-				});
-				console.log(`Trusted ${args.length} domain(s)`);
+			case "sandbox:network":
+				console.log(await handleSandboxNetworkCommand({
+					orchestrator: state.sandboxOrchestrator,
+					configStore: state.configStore,
+					permissionManager: state.permissionManager
+				}, args[0]));
+				break;
+			case "sandbox:trust-domain":
+				console.log(await handleSandboxTrustDomainCommand({
+					orchestrator: state.sandboxOrchestrator,
+					configStore: state.configStore
+				}, args));
 				break;
-			}
 			case "sandbox:domains": {
 				if (!state.sandboxOrchestrator) {
 					console.log("Sandbox not initialized");
@@ -10195,7 +10997,9 @@ function CliApp() {
 				logger,
 				reservedToolNames: baseTools.map((t) => t.toolSchema.name)
 			});
-			newFeatureRegistry = rebuilt.registry;
+			const rebuiltRegistry = rebuilt.registry;
+			newFeatureRegistry = rebuiltRegistry;
+			rewireReservedNames(state, rebuiltRegistry);
 			for (const skippedPlugin of rebuilt.skipped) console.error(`\n\x1b[33m⚠️ Plugin ${skippedPlugin.name} skipped: ${skippedPlugin.reason}\x1b[0m`);
 			const newToolNames = newFeatureRegistry.getAllToolNames();
 			if (newToolNames.length > 0) registerFeatureModuleTools(newToolNames);
@@ -10209,7 +11013,7 @@ function CliApp() {
 			state.agent.setSystemPrompt(buildSystemPrompt(updatedConfig.preferences.promptVariant ?? "current", {
 				contextContent: state.contextContent,
 				agentStore: state.agentStore || void 0,
-				customCommands: state.customCommandStore.getAllCommands(),
+				customCommands: state.customCommandStore.getModelReachableCommands(),
 				enableSkillTool: updatedConfig.preferences.enableSkillTool !== false,
 				enableDynamicAgentCreation: updatedConfig.preferences.enableDynamicAgentCreation === true,
 				additionalDirectories: state.additionalDirectories,
@@ -10320,6 +11124,34 @@ function CliApp() {
 			})();
 		}
 	});
+	if (state.mcpApprovalPrompt) {
+		const { projectRoot, servers } = state.mcpApprovalPrompt;
+		return /* @__PURE__ */ React.createElement(McpApprovalPrompt, {
+			projectRoot,
+			servers,
+			onSelect: (choice) => {
+				(async () => {
+					try {
+						if (choice === "approve") {
+							await state.configStore.approveMcpServers(servers);
+							console.log("\nApproved. Starting these MCP servers; a changed definition will ask again.\n");
+						} else console.log("\nThese MCP servers stay off this session. You will be asked again next launch.\n");
+					} catch (err) {
+						console.error("\nCould not save MCP approval:", err instanceof Error ? err.message : String(err), "\n");
+					} finally {
+						setState((prev) => ({
+							...prev,
+							mcpApprovalPrompt: null
+						}));
+						init().catch((err) => {
+							console.error("\nInitialization failed:", err instanceof Error ? err.message : String(err), "\n");
+							exit();
+						});
+					}
+				})();
+			}
+		});
+	}
 	const currentSession = useCliStore.getState().session;
 	if (state.rewindSelector && currentSession) return /* @__PURE__ */ React.createElement(RewindSelector, {
 		messages: currentSession.messages,