@bike4mind/cli 1.2.0 → 2.0.0

package/dist/index.mjs

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
-import { $ as CustomCommandStore, A as createAgentDelegateTool, B as ALWAYS_DENIED_FOR_AGENTS, C as createTodoStore, D as createCoordinateTaskTool, E as parseAgentConfig, F as PermissionManager, H as DEFAULT_MAX_ITERATIONS, J as setWebSocketToolExecutor, K as clearFeatureModuleTools, L as wrapTools, M as substituteArguments, O as createResumeAgentTool, P as findIterationBoundary, Q as RemoteSkillSource, R as getProcessHooks, S as createFindDefinitionTool, T as createSkillTool, U as DEFAULT_RETRY_CONFIG, V as DEFAULT_AGENT_MODEL, W as DEFAULT_THOROUGHNESS, X as buildSystemPrompt, Y as getPlanModeFilePath, Z as buildSkillsPromptSection, _ as createDecisionLogTool, at as searchCommands, b as createGetFileStructureTool, ct as formatFileSize, d as createReviewGateStore, dt as COMPACTION_SUMMARY_MARKER, et as CheckpointStore, f as createReviewGateTool, g as formatBlockersOutput, h as createBlockerTools, j as FallbackLlmBackend, k as createBackgroundAgentTools, lt as searchFiles, m as createBlockerStore, nt as hasFileReferences, ot as mergeCommands, p as formatReviewGatesOutput, pt as MAX_PASTE_SIZE, q as registerFeatureModuleTools, rt as processFileReferences, s as buildSandbox, st as rewireReservedNames, tt as SessionStore, u as isTransientNetworkError, ut as warmFileCache, v as createDecisionStore, w as createWriteTodosTool, x as createWorkItemTools, y as formatDecisionsOutput } from "./AgentHistoryStore-B2NEOvSW.mjs";
+import { $ as CustomCommandStore, A as createAgentDelegateTool, B as ALWAYS_DENIED_FOR_AGENTS, C as createTodoStore, D as createCoordinateTaskTool, E as parseAgentConfig, F as PermissionManager, H as DEFAULT_MAX_ITERATIONS, J as setWebSocketToolExecutor, K as clearFeatureModuleTools, L as wrapTools, M as substituteArguments, O as createResumeAgentTool, P as findIterationBoundary, Q as RemoteSkillSource, R as getProcessHooks, S as createFindDefinitionTool, T as createSkillTool, U as DEFAULT_RETRY_CONFIG, V as DEFAULT_AGENT_MODEL, W as DEFAULT_THOROUGHNESS, X as buildSystemPrompt, Y as getPlanModeFilePath, Z as buildSkillsPromptSection, _ as createDecisionLogTool, at as searchCommands, b as createGetFileStructureTool, ct as formatFileSize, d as createReviewGateStore, dt as COMPACTION_SUMMARY_MARKER, et as CheckpointStore, f as createReviewGateTool, g as formatBlockersOutput, h as createBlockerTools, j as FallbackLlmBackend, k as createBackgroundAgentTools, lt as searchFiles, m as createBlockerStore, nt as hasFileReferences, ot as mergeCommands, p as formatReviewGatesOutput, pt as MAX_PASTE_SIZE, q as registerFeatureModuleTools, rt as processFileReferences, s as buildSandbox, st as rewireReservedNames, tt as SessionStore, u as isTransientNetworkError, ut as warmFileCache, v as createDecisionStore, w as createWriteTodosTool, x as createWorkItemTools, y as formatDecisionsOutput } from "./AgentHistoryStore-DIMzvf-y.mjs";
 import { a as selectLiveSubagentTokens, i as selectLiveSubagentCredits, n as selectActiveBackgroundShells, o as useCliStore, r as selectCompletedBackgroundShells, t as selectActiveBackgroundAgents } from "./store-CvjTpQPs.mjs";
 import { r as isFeatureEnabled, t as PluginStore } from "./PluginStore-DwvOJ-G3.mjs";
-import { C as CREDIT_DEDUCT_TRANSACTION_TYPES, F as REVIEW_GATE_STATUS_VALUES, K as isEarlyStop, L as SUBQUEST_STATUS_VALUES, c as SESSION_ID_PATTERN, d as LOCAL_DEV_URL, et as ACTOR_COLOR_SLOTS, f as getCreditsUrl, g as resolveApiEndpoint, h as requireApiUrl, it as selfClaimedActorKindSchema, l as isValidSessionId, m as parseApiUrl, n as logger, nt as actorKindMarker, p as getEnvironmentName, r as extractCompactInstructions, rt as actorKindSchema, s as isReadOnlyTool, t as ConfigStore, tt as actorColorIndex, u as ApiEndpointUnconfiguredError, w as ChatModels } from "./ConfigStore-qV7NrCgZ.mjs";
-import { a as deferredToolRegistry, i as createToolSearchTool, n as buildSupportingStores, o as NotifyingLlmBackend, r as buildLlmBackend, t as buildAgent } from "./buildAgent-C-C-VGff.mjs";
+import { B as REVIEW_GATE_STATUS_VALUES, D as CREDIT_DEDUCT_TRANSACTION_TYPES, H as SUBQUEST_STATUS_VALUES, O as ChatModels, _ as requireApiUrl, _t as actorKindMarker, d as isReadOnlyTool, et as isEarlyStop, f as ApiEndpointUnconfiguredError, g as parseApiUrl, gt as actorColorIndex, h as getEnvironmentName, ht as ACTOR_COLOR_SLOTS, i as isValidSessionId, m as getCreditsUrl, n as logger, p as LOCAL_DEV_URL, r as SESSION_ID_PATTERN, s as extractCompactInstructions, t as ConfigStore, v as resolveApiEndpoint, vt as actorKindSchema, yt as selfClaimedActorKindSchema } from "./ConfigStore-DIs-K9oD.mjs";
+import { a as deferredToolRegistry, i as createToolSearchTool, n as buildSupportingStores, o as NotifyingLlmBackend, r as buildLlmBackend, t as buildAgent } from "./buildAgent-DOvEp92a.mjs";
 import { t as getShellSessionManager } from "./ShellSessionManager-6o8KZzl1-vrbPAUTq.mjs";
-import { n as OAuthClient, t as ApiClient } from "./ApiClient-D0fQ2FT6.mjs";
+import { i as OAuthClient, t as ApiClient } from "./ApiClient-BTI0-m0g.mjs";
+import { t as version } from "./package-Dl_F2Fah.mjs";
 import { i as getTokenCounter, n as ConversationContext, r as reconstructTurnBlocks, t as WorkItemsClient } from "./WorkItemsClient-Cow6nXx7.mjs";
-import { t as version } from "./package-CGZIoxcs.mjs";
 import { r as checkForUpdate } from "./updateChecker-CQW8bxo6.mjs";
 import React, { useCallback, useEffect, useMemo, useReducer, useRef, useState, useSyncExternalStore } from "react";
 import { Box, Static, Text, render, useApp, useInput, usePaste, useStdout } from "ink";
@@ -1085,12 +1085,15 @@ function CompletedGroupNotification() {
 //#endregion
 //#region src/components/PermissionPrompt.tsx
 /**
-* Escape characters that let model-authored text render differently from what
-* actually runs, into a visible escape form. The preview and arguments are
-* model-authored, so the approved text could otherwise differ from what runs.
-* Two ranges are covered, deliberately and no wider:
-*   - C0 controls (minus tab/newline) and DEL -> `\xHH`: a raw `\r` or ESC
-*     sequence could rewrite the line the user is approving.
+* Escape characters that let untrusted text render differently from what
+* actually runs, into a visible escape form. Shared by every prompt that shows
+* untrusted text for the user to decide on: tool previews/arguments here,
+* repo-authored MCP definitions (McpApprovalPrompt), the folder-trust path
+* (FolderTrustPrompt), and model-authored ReviewGatePrompt / UserQuestionPrompt text. Display only - never escape the
+* value that is acted on or sent back.
+* These ranges are covered, deliberately and no wider:
+*   - C0 controls (minus tab/newline), DEL and C1 controls -> `\xHH`: a raw
+*     `\r`, ESC or 8-bit CSI (U+009B) could rewrite the line being approved.
 *   - Unicode bidi overrides U+202A..U+202E and isolates U+2066..U+2069
 *     -> `\uXXXX`: these reorder displayed glyphs without changing the
 *     underlying code points, spoofing the same way.
@@ -1098,7 +1101,7 @@ function CompletedGroupNotification() {
 * Widen the scope here, so both call sites gain it at once.
 */
 function escapeTerminalControlChars(text) {
-	return text.replace(/[\x00-\x08\x0b-\x1f\x7f\u202a-\u202e\u2066-\u2069]/g, (ch) => {
+	return text.replace(/[\x00-\x08\x0b-\x1f\x7f-\x9f\u202a-\u202e\u2066-\u2069]/g, (ch) => {
 		const code = ch.charCodeAt(0);
 		return code > 255 ? `\\u${code.toString(16).padStart(4, "0")}` : `\\x${code.toString(16).padStart(2, "0")}`;
 	});
@@ -1232,7 +1235,7 @@ function PermissionPrompt({ toolName, toolDescription, args, preview, canBeTrust
 	}, headerText)), /* @__PURE__ */ React.createElement(Box, { marginTop: 1 }, /* @__PURE__ */ React.createElement(Text, { dimColor: true }, "Tool: "), /* @__PURE__ */ React.createElement(Text, {
 		bold: true,
 		color: "cyan"
-	}, toolName)), toolDescription && /* @__PURE__ */ React.createElement(Box, null, /* @__PURE__ */ React.createElement(Text, { dimColor: true }, "Action: "), /* @__PURE__ */ React.createElement(Text, null, toolDescription)), !hideArgs && /* @__PURE__ */ React.createElement(Box, {
+	}, escapeTerminalControlChars(toolName))), toolDescription && /* @__PURE__ */ React.createElement(Box, null, /* @__PURE__ */ React.createElement(Text, { dimColor: true }, "Action: "), /* @__PURE__ */ React.createElement(Text, null, escapeTerminalControlChars(toolDescription))), !hideArgs && /* @__PURE__ */ React.createElement(Box, {
 		marginTop: 1,
 		flexDirection: "column"
 	}, /* @__PURE__ */ React.createElement(Text, { bold: true }, "Arguments:"), /* @__PURE__ */ React.createElement(Box, {
@@ -1408,7 +1411,7 @@ function UserQuestionPrompt({ payload, onResponse }) {
 	}, /* @__PURE__ */ React.createElement(Box, null, /* @__PURE__ */ React.createElement(Text, {
 		bold: true,
 		color: "cyan"
-	}, "? Question", totalQuestions > 1 ? ` ${questionIndex + 1}/${totalQuestions}` : "")), /* @__PURE__ */ React.createElement(Box, { marginTop: 1 }, /* @__PURE__ */ React.createElement(Text, { bold: true }, currentQuestion.question)), /* @__PURE__ */ React.createElement(Box, {
+	}, "? Question", totalQuestions > 1 ? ` ${questionIndex + 1}/${totalQuestions}` : "")), /* @__PURE__ */ React.createElement(Box, { marginTop: 1 }, /* @__PURE__ */ React.createElement(Text, { bold: true }, escapeTerminalControlChars(currentQuestion.question))), /* @__PURE__ */ React.createElement(Box, {
 		marginTop: 1,
 		flexDirection: "column"
 	}, options.map((opt, idx) => {
@@ -1418,12 +1421,12 @@ function UserQuestionPrompt({ payload, onResponse }) {
 		return /* @__PURE__ */ React.createElement(Box, { key: idx }, /* @__PURE__ */ React.createElement(Text, { color: "cyan" }, idx + 1, "."), /* @__PURE__ */ React.createElement(Text, {
 			color: isHighlighted ? "cyan" : void 0,
 			bold: isHighlighted
-		}, " ", prefix, " ", opt.label), idx === otherIndex && isHighlighted ? /* @__PURE__ */ React.createElement(Box, { marginLeft: 1 }, /* @__PURE__ */ React.createElement(TextInput, {
+		}, " ", prefix, " ", escapeTerminalControlChars(opt.label)), idx === otherIndex && isHighlighted ? /* @__PURE__ */ React.createElement(Box, { marginLeft: 1 }, /* @__PURE__ */ React.createElement(TextInput, {
 			value: otherText,
 			onChange: setOtherText,
 			onSubmit: submitOther,
 			placeholder: "Type your answer..."
-		})) : opt.description && idx !== otherIndex && /* @__PURE__ */ React.createElement(Text, { dimColor: true }, " - ", opt.description));
+		})) : opt.description && idx !== otherIndex && /* @__PURE__ */ React.createElement(Text, { dimColor: true }, " - ", escapeTerminalControlChars(opt.description)));
 	})), /* @__PURE__ */ React.createElement(Box, { marginTop: 1 }, /* @__PURE__ */ React.createElement(Text, { dimColor: true }, isOnOther ? "Type your answer, Enter to submit, or arrow keys to go back" : isMulti ? "Press 1-" + options.length + ", Space to toggle, Enter to confirm" : "Press 1-" + options.length + ", or arrow keys + Enter")));
 }
 //#endregion
@@ -1526,10 +1529,10 @@ function ReviewGatePrompt({ description, options, recommendation, onResponse })
 	}, /* @__PURE__ */ React.createElement(Box, null, /* @__PURE__ */ React.createElement(Text, {
 		bold: true,
 		color: "magenta"
-	}, "🛑 Review Gate")), /* @__PURE__ */ React.createElement(Box, { marginTop: 1 }, /* @__PURE__ */ React.createElement(Text, null, description)), recommendation && /* @__PURE__ */ React.createElement(Box, {
+	}, "🛑 Review Gate")), /* @__PURE__ */ React.createElement(Box, { marginTop: 1 }, /* @__PURE__ */ React.createElement(Text, null, escapeTerminalControlChars(description))), recommendation && /* @__PURE__ */ React.createElement(Box, {
 		marginTop: 1,
 		flexDirection: "column"
-	}, /* @__PURE__ */ React.createElement(Text, { bold: true }, "Recommendation:"), /* @__PURE__ */ React.createElement(Box, { paddingLeft: 2 }, /* @__PURE__ */ React.createElement(Text, { dimColor: true }, recommendation))), options && options.length > 0 && /* @__PURE__ */ React.createElement(Box, {
+	}, /* @__PURE__ */ React.createElement(Text, { bold: true }, "Recommendation:"), /* @__PURE__ */ React.createElement(Box, { paddingLeft: 2 }, /* @__PURE__ */ React.createElement(Text, { dimColor: true }, escapeTerminalControlChars(recommendation)))), options && options.length > 0 && /* @__PURE__ */ React.createElement(Box, {
 		marginTop: 1,
 		flexDirection: "column"
 	}, /* @__PURE__ */ React.createElement(Text, { bold: true }, "Options:"), /* @__PURE__ */ React.createElement(Box, {
@@ -1538,7 +1541,7 @@ function ReviewGatePrompt({ description, options, recommendation, onResponse })
 	}, options.map((opt, idx) => /* @__PURE__ */ React.createElement(Text, {
 		key: idx,
 		dimColor: true
-	}, "• ", opt)))), /* @__PURE__ */ React.createElement(Box, {
+	}, "• ", escapeTerminalControlChars(opt))))), /* @__PURE__ */ React.createElement(Box, {
 		marginTop: 1,
 		flexDirection: "column"
 	}, ITEMS.map((item, index) => {
@@ -1816,6 +1819,18 @@ function buildConfigItems(availableModels, pluginDescriptors = []) {
 				enableCoordinatorMode: value
 			}
 		})
+	}, {
+		key: "postEditDiagnostics",
+		label: "Post-Edit Diagnostics",
+		type: "boolean",
+		getValue: (config) => config.preferences.postEditDiagnostics ?? false,
+		setValue: (config, value) => ({
+			...config,
+			preferences: {
+				...config.preferences,
+				postEditDiagnostics: value
+			}
+		})
 	}, {
 		key: "featuresTavern",
 		label: "Tavern",
@@ -2697,7 +2712,7 @@ function FolderTrustPrompt({ projectRoot, onSelect }) {
 	}, /* @__PURE__ */ React.createElement(Text, {
 		bold: true,
 		color: "yellow"
-	}, "This project ships Bike4Mind config that can run code."), /* @__PURE__ */ React.createElement(Text, { dimColor: true }, projectRoot), /* @__PURE__ */ React.createElement(Text, null, "Repo-committed config, MCP servers, agents and skills stay inert until you trust this folder. Only trust folders you would run code from.")), /* @__PURE__ */ React.createElement(SelectInput, {
+	}, "This project ships Bike4Mind config that can run code."), /* @__PURE__ */ React.createElement(Text, { dimColor: true }, escapeTerminalControlChars(projectRoot)), /* @__PURE__ */ React.createElement(Text, null, "Repo-committed config, MCP servers, agents and skills stay inert until you trust this folder. Only trust folders you would run code from.")), /* @__PURE__ */ React.createElement(SelectInput, {
 		items: [{
 			label: "Not now - keep repo config inert this session",
 			value: "not-now"
@@ -2710,6 +2725,52 @@ function FolderTrustPrompt({ projectRoot, onSelect }) {
 	}), /* @__PURE__ */ React.createElement(Box, { marginTop: 1 }, /* @__PURE__ */ React.createElement(Text, { dimColor: true }, "Use ↑↓ arrows to navigate, Enter to select. You can change this later with /trust folder.")));
 }
 //#endregion
+//#region src/components/McpApprovalPrompt.tsx
+const displaySafe = (s) => escapeTerminalControlChars(s).replace(/[\t\n]/g, (c) => c === "\n" ? "\\x0a" : "\\x09");
+const displayArg = (a) => {
+	const safe = displaySafe(a);
+	return /[\s"']/.test(a) ? `"${safe.replace(/"/g, "\\\"")}"` : safe;
+};
+/**
+* Startup prompt for repo-discovered MCP servers (trusted project) whose exact
+* definition hasn't been approved. Shows env/header KEY names; values only for
+* loader-style env keys (PATH, NODE_OPTIONS, LD_*, ...) that change what runs.
+* "Approve all" persists each definition's fingerprint (a changed definition asks
+* again); "Skip" persists nothing, so they stay off and re-prompt next launch.
+*
+* "Skip" is listed first so Enter-through never starts a server. Sibling of
+* FolderTrustPrompt.
+*/
+function McpApprovalPrompt({ projectRoot, servers, onSelect }) {
+	return /* @__PURE__ */ React.createElement(Box, {
+		flexDirection: "column",
+		marginY: 1
+	}, /* @__PURE__ */ React.createElement(Box, {
+		marginBottom: 1,
+		flexDirection: "column"
+	}, /* @__PURE__ */ React.createElement(Text, {
+		bold: true,
+		color: "yellow"
+	}, "This project defines MCP servers that will run code on your machine."), /* @__PURE__ */ React.createElement(Text, { dimColor: true }, displaySafe(projectRoot))), /* @__PURE__ */ React.createElement(Box, {
+		marginBottom: 1,
+		flexDirection: "column"
+	}, servers.map((s) => /* @__PURE__ */ React.createElement(Box, {
+		key: s.name,
+		flexDirection: "column",
+		marginBottom: 1
+	}, /* @__PURE__ */ React.createElement(Text, { bold: true }, displaySafe(s.name)), /* @__PURE__ */ React.createElement(Text, null, s.url !== void 0 ? displaySafe(s.url) : [s.command, ...s.args ?? []].filter((p) => p !== void 0).map(displayArg).join(" ")), s.envKeys.length > 0 && /* @__PURE__ */ React.createElement(Text, { dimColor: true }, "env:", " ", s.envKeys.map((k) => k in s.envValues ? displaySafe(`${k}=${s.envValues[k]}`) : displaySafe(k)).join(", ")), s.headerKeys.length > 0 && /* @__PURE__ */ React.createElement(Text, { dimColor: true }, "headers: ", s.headerKeys.map(displaySafe).join(", "))))), /* @__PURE__ */ React.createElement(SelectInput, {
+		items: [{
+			label: "Skip - don't start these this session",
+			value: "skip"
+		}, {
+			label: "Approve all - start these servers (asks again if they change)",
+			value: "approve"
+		}],
+		onSelect: (item) => onSelect(item.value),
+		itemComponent: ({ isSelected, label }) => /* @__PURE__ */ React.createElement(Box, null, /* @__PURE__ */ React.createElement(Text, { color: isSelected ? "cyan" : void 0 }, isSelected ? "❯ " : "  ", label))
+	}), /* @__PURE__ */ React.createElement(Box, { marginTop: 1 }, /* @__PURE__ */ React.createElement(Text, { dimColor: true }, "Use ↑↓ arrows to navigate, Enter to select.")));
+}
+//#endregion
 //#region src/components/RewindSelector.tsx
 function RewindSelector({ messages, onSelect, onCancel }) {
 	const [step, setStep] = useState("selection");
@@ -2952,6 +3013,37 @@ function isBrowserOpenableUrl(raw) {
 	if (url.protocol === "https:") return true;
 	return url.protocol === "http:" && (url.hostname === "localhost" || url.hostname === "127.0.0.1");
 }
+/**
+* The device-flow response is server-controlled, so a compromised server could point the
+* verification page at a phishing origin. Only auto-open URLs on the configured API origin.
+* Strict compare: no subdomain aliasing and no localhost/127.0.0.1 equivalence.
+*/
+function isOnApiOrigin(raw, apiUrl) {
+	try {
+		return new URL(raw).origin === new URL(apiUrl).origin;
+	} catch {
+		return false;
+	}
+}
+function originOf(raw) {
+	try {
+		const { origin } = new URL(raw);
+		return origin === "null" ? raw : origin;
+	} catch {
+		return raw;
+	}
+}
+/** Strips C0/C1 control chars so a server-supplied string can't inject terminal escape sequences. */
+function stripControlChars(raw) {
+	return raw === void 0 ? raw : raw.replace(/[\u0000-\u001f\u007f-\u009f]/g, "");
+}
+function hostOf(raw) {
+	try {
+		return new URL(raw).host;
+	} catch {
+		return raw;
+	}
+}
 function extractErrorMessage(err) {
 	if (axios.isAxiosError(err)) {
 		if (err.response?.data) {
@@ -2973,13 +3065,19 @@ function LoginFlow({ apiUrl = "http://localhost:3000", configStore, onSuccess, o
 	const [deviceFlow, setDeviceFlow] = useState(null);
 	const [statusMessage, setStatusMessage] = useState("Initiating device authorization...");
 	const [error, setError] = useState(null);
+	const [account, setAccount] = useState(null);
 	useEffect(() => {
 		const runLoginFlow = async () => {
 			const oauth = new OAuthClient(apiUrl);
 			try {
 				setStatus("initiating");
 				const deviceFlowResponse = await oauth.initiateDeviceFlow();
-				setDeviceFlow(deviceFlowResponse);
+				setDeviceFlow({
+					...deviceFlowResponse,
+					verification_uri: stripControlChars(deviceFlowResponse.verification_uri),
+					verification_uri_complete: stripControlChars(deviceFlowResponse.verification_uri_complete),
+					user_code: stripControlChars(deviceFlowResponse.user_code)
+				});
 				setStatus("waiting");
 				setStatusMessage("Waiting for authorization...");
 				const tokens = await oauth.waitForAuthorization(deviceFlowResponse.device_code, deviceFlowResponse.interval, (message) => setStatusMessage(message));
@@ -2991,12 +3089,18 @@ function LoginFlow({ apiUrl = "http://localhost:3000", configStore, onSuccess, o
 					expiresAt,
 					userId
 				});
+				setAccount({ userId });
 				setStatus("success");
 				setStatusMessage("Successfully authenticated!");
 				setTimeout(() => onSuccess(), 1500);
+				new ApiClient(apiUrl, configStore).get("/api/identify").then((res) => setAccount({
+					userId,
+					email: stripControlChars(res?.user?.email),
+					username: stripControlChars(res?.user?.username)
+				})).catch(() => {});
 			} catch (err) {
 				setStatus("error");
-				const errorMessage = extractErrorMessage(err);
+				const errorMessage = stripControlChars(extractErrorMessage(err));
 				setError(errorMessage);
 				onError(new Error(errorMessage));
 			}
@@ -3008,12 +3112,19 @@ function LoginFlow({ apiUrl = "http://localhost:3000", configStore, onSuccess, o
 		onSuccess,
 		onError
 	]);
+	const uris = deviceFlow ? [deviceFlow.verification_uri, deviceFlow.verification_uri_complete] : [];
+	const isTrustedUri = (u) => isBrowserOpenableUrl(u) && isOnApiOrigin(u, apiUrl);
+	const untrustedUri = uris.find((u) => !isTrustedUri(u));
+	const trusted = uris.length > 0 && uris.every(isTrustedUri);
 	useEffect(() => {
-		if (deviceFlow && status === "waiting") if (isBrowserOpenableUrl(deviceFlow.verification_uri_complete)) open(deviceFlow.verification_uri_complete).catch((err) => {
+		if (deviceFlow && status === "waiting" && trusted) open(deviceFlow.verification_uri_complete).catch((err) => {
 			console.error("Failed to auto-open browser:", err);
 		});
-		else console.error("Refusing to auto-open untrusted verification URL:", deviceFlow.verification_uri_complete);
-	}, [deviceFlow, status]);
+	}, [
+		deviceFlow,
+		status,
+		trusted
+	]);
 	if (status === "initiating") return /* @__PURE__ */ React.createElement(Box, {
 		flexDirection: "column",
 		padding: 1
@@ -3031,7 +3142,7 @@ function LoginFlow({ apiUrl = "http://localhost:3000", configStore, onSuccess, o
 	}, /* @__PURE__ */ React.createElement(Box, { marginBottom: 1 }, /* @__PURE__ */ React.createElement(Text, {
 		color: "green",
 		bold: true
-	}, "✔ Successfully authenticated!")), /* @__PURE__ */ React.createElement(Box, null, /* @__PURE__ */ React.createElement(Text, { dimColor: true }, "You can now use B4M CLI with your account.")));
+	}, "✔ Successfully authenticated!")), /* @__PURE__ */ React.createElement(Box, null, /* @__PURE__ */ React.createElement(Text, null, "Logged in as ", account?.email || account?.username || `user ${account?.userId}`, " on ", hostOf(apiUrl))));
 	return /* @__PURE__ */ React.createElement(Box, {
 		flexDirection: "column",
 		padding: 1,
@@ -3040,7 +3151,10 @@ function LoginFlow({ apiUrl = "http://localhost:3000", configStore, onSuccess, o
 	}, /* @__PURE__ */ React.createElement(Box, { marginBottom: 1 }, /* @__PURE__ */ React.createElement(Text, {
 		color: "cyan",
 		bold: true
-	}, "🔐 Device Authorization")), /* @__PURE__ */ React.createElement(Box, { marginBottom: 1 }, /* @__PURE__ */ React.createElement(Text, null, "Opening browser automatically... If it doesn't open, please visit:")), /* @__PURE__ */ React.createElement(Box, {
+	}, "🔐 Device Authorization")), trusted ? /* @__PURE__ */ React.createElement(Box, { marginBottom: 1 }, /* @__PURE__ */ React.createElement(Text, null, "Opening browser automatically... If it doesn't open, please visit:")) : /* @__PURE__ */ React.createElement(React.Fragment, null, /* @__PURE__ */ React.createElement(Box, { marginBottom: 1 }, /* @__PURE__ */ React.createElement(Text, {
+		color: "red",
+		bold: true
+	}, !untrustedUri ? "Not opening browser: the server did not return a verification URL." : isOnApiOrigin(untrustedUri, apiUrl) ? `Not opening browser: verification URL ${originOf(untrustedUri)} is not https (plain http is only auto-opened on localhost). Only continue if you trust it.` : `Not opening browser: verification URL origin ${originOf(untrustedUri)} does not match the configured server ${originOf(apiUrl)}. Only continue if you trust it.`)), /* @__PURE__ */ React.createElement(Box, { marginBottom: 1 }, /* @__PURE__ */ React.createElement(Text, null, "Please visit:"))), /* @__PURE__ */ React.createElement(Box, {
 		marginBottom: 1,
 		paddingLeft: 2
 	}, /* @__PURE__ */ React.createElement(Text, {
@@ -4517,6 +4631,314 @@ Unlike agent_delegate (which uses pre-defined agents), this tool lets you compos
 	};
 }
 //#endregion
+//#region src/diagnostics/checkers.ts
+const CHECK_TIMEOUT_MS = 12e4;
+const MAX_OUTPUT_BYTES = 16777216;
+const TYPESCRIPT_EXTENSIONS = /* @__PURE__ */ new Set([
+	".ts",
+	".tsx",
+	".mts",
+	".cts"
+]);
+const ESLINT_EXTENSIONS = /* @__PURE__ */ new Set([
+	...TYPESCRIPT_EXTENSIONS,
+	".js",
+	".jsx",
+	".mjs",
+	".cjs"
+]);
+const ESLINT_ERROR_SEVERITY = 2;
+const TSC_ENTRY = path.join("node_modules", "typescript", "bin", "tsc");
+const ESLINT_ENTRY = path.join("node_modules", "eslint", "bin", "eslint.js");
+const TSC_ERROR_LINE = /^(.+?)\((\d+),(\d+)\): error (TS\d+): (.*)$/;
+/**
+* Runs a binary without a shell (paths are passed as argv, never interpolated).
+* A non-zero exit is a normal outcome - tsc/eslint exit non-zero when they find errors.
+*/
+function runProcess(file, args, cwd) {
+	return new Promise((resolve) => {
+		execFile(file, args, {
+			cwd,
+			timeout: CHECK_TIMEOUT_MS,
+			maxBuffer: MAX_OUTPUT_BYTES,
+			killSignal: "SIGKILL",
+			windowsHide: true
+		}, (error, stdout, stderr) => {
+			if (!error) {
+				resolve({
+					kind: "exited",
+					stdout
+				});
+				return;
+			}
+			if (error.killed) {
+				resolve({
+					kind: "failed",
+					reason: `timed out after ${CHECK_TIMEOUT_MS}ms`
+				});
+				return;
+			}
+			if (typeof error.code !== "number") {
+				resolve({
+					kind: "failed",
+					reason: error.message
+				});
+				return;
+			}
+			if (!stdout.trim()) {
+				resolve({
+					kind: "failed",
+					reason: `exit ${error.code}: ${stderr.trim().slice(0, 300)}`
+				});
+				return;
+			}
+			resolve({
+				kind: "exited",
+				stdout
+			});
+		});
+	});
+}
+/**
+* Runs a package's JS entry under the current Node. `node_modules/.bin/*` are sh
+* shims (`.cmd` on Windows) that `execFile` cannot launch without a shell.
+*/
+function runNodeScript(script, args, cwd) {
+	return runProcess(process.execPath, [script, ...args], cwd);
+}
+/** Nearest `relativePath` at or above `startDir`, or null. */
+function findUp(startDir, relativePath) {
+	let dir = path.resolve(startDir);
+	for (;;) {
+		const candidate = path.join(dir, relativePath);
+		if (existsSync(candidate)) return candidate;
+		const parent = path.dirname(dir);
+		if (parent === dir) return null;
+		dir = parent;
+	}
+}
+/** Groups files by a key derived from each; files whose key is null are dropped. */
+function groupBy(filePaths, keyOf) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const filePath of filePaths) {
+		const key = keyOf(filePath);
+		if (!key) continue;
+		groups.set(key, [...groups.get(key) ?? [], filePath]);
+	}
+	return groups;
+}
+const hasExtension = (extensions) => (filePath) => extensions.has(path.extname(filePath));
+function parseTscOutput(stdout, cwd) {
+	return stdout.split("\n").flatMap((line) => {
+		const match = TSC_ERROR_LINE.exec(line.trimEnd());
+		if (!match) return [];
+		const [, file, lineNumber, column, code, message] = match;
+		return [{
+			filePath: path.resolve(cwd, file),
+			line: Number(lineNumber),
+			column: Number(column),
+			code,
+			message
+		}];
+	});
+}
+function isEslintReport(value) {
+	return Array.isArray(value) && value.every((entry) => typeof entry === "object" && entry !== null && typeof entry.filePath === "string" && Array.isArray(entry.messages));
+}
+function parseEslintOutput(stdout) {
+	let report;
+	try {
+		report = JSON.parse(stdout);
+	} catch {
+		logger.debug(`[diagnostics] eslint produced non-JSON output: ${stdout.slice(0, 200)}`);
+		return [];
+	}
+	if (!isEslintReport(report)) return [];
+	return report.flatMap((fileResult) => fileResult.messages.filter((message) => message.severity === ESLINT_ERROR_SEVERITY).map((message) => ({
+		filePath: path.resolve(fileResult.filePath),
+		line: message.line ?? 1,
+		column: message.column ?? 1,
+		code: message.ruleId ?? "eslint",
+		message: message.message
+	})));
+}
+/**
+* Type-checks each changed file's nearest tsconfig project with the project's
+* own `tsc` (never a global one). Project-wide so path aliases and compiler
+* options are honored; output is filtered to the changed files by the caller.
+*/
+const checkTypeScript = async (filePaths) => {
+	const projects = groupBy(filePaths.filter(hasExtension(TYPESCRIPT_EXTENSIONS)), (filePath) => findUp(path.dirname(filePath), "tsconfig.json"));
+	const diagnostics = [];
+	for (const tsconfigPath of projects.keys()) {
+		const projectDir = path.dirname(tsconfigPath);
+		const tsc = findUp(projectDir, TSC_ENTRY);
+		if (!tsc) {
+			logger.debug(`[diagnostics] no local tsc found for ${tsconfigPath}; skipping type check`);
+			continue;
+		}
+		const outcome = await runNodeScript(tsc, [
+			"--noEmit",
+			"--pretty",
+			"false",
+			"-p",
+			tsconfigPath
+		], projectDir);
+		if (outcome.kind === "failed") {
+			logger.debug(`[diagnostics] tsc skipped for ${tsconfigPath}: ${outcome.reason}`);
+			continue;
+		}
+		diagnostics.push(...parseTscOutput(outcome.stdout, projectDir));
+	}
+	return diagnostics;
+};
+/** Lints changed files with the eslint installed nearest to each file, run from that package root. */
+const checkEslint = async (filePaths) => {
+	const groups = groupBy(filePaths.filter(hasExtension(ESLINT_EXTENSIONS)), (filePath) => findUp(path.dirname(filePath), ESLINT_ENTRY));
+	const diagnostics = [];
+	for (const [eslint, files] of groups) {
+		const packageRoot = path.resolve(path.dirname(eslint), "..", "..", "..");
+		const outcome = await runNodeScript(eslint, [
+			"--format",
+			"json",
+			...files
+		], packageRoot);
+		if (outcome.kind === "failed") {
+			logger.debug(`[diagnostics] eslint skipped under ${packageRoot}: ${outcome.reason}`);
+			continue;
+		}
+		diagnostics.push(...parseEslintOutput(outcome.stdout));
+	}
+	return diagnostics;
+};
+/** The default checker: tsc and eslint side by side. */
+const checkTypeScriptAndEslint = async (filePaths) => {
+	const [typeErrors, lintErrors] = await Promise.all([checkTypeScript(filePaths), checkEslint(filePaths)]);
+	return [...typeErrors, ...lintErrors];
+};
+//#endregion
+//#region src/diagnostics/PostEditDiagnostics.ts
+/**
+* How long a drain waits for in-flight checks (ms). Between turns the model
+* will take another turn anyway, so a busy worker just defers to the next
+* one; at finalization there is no later turn, so it waits longer.
+*/
+const DRAIN_BUDGET_MS = {
+	turn: 250,
+	final: 3e4
+};
+const REPORT_HEADER = "[Post-edit diagnostics] Errors in files you changed. Fix them before you finish:";
+const MAX_REPORTED_ERRORS = 20;
+const MAX_MESSAGE_LENGTH = 300;
+/**
+* Background type/lint checking of files the agent edits, drained into the
+* agent loop via AgentRunOptions.drainFeedback. Edits never wait on a check.
+*
+* Queue semantics are re-edit-wins: a file edited again before its check runs
+* is checked once in its final state, and a file edited again after a check
+* started (in flight or already completed but not yet reported) has that stale
+* result discarded in favor of the queued re-check. Each completed result is
+* reported at most once.
+*
+* Only collects between beginTurn() and endTurn(); a no-op otherwise, which is
+* how the per-turn config gate in turnController switches it off.
+*/
+var PostEditDiagnostics = class {
+	constructor({ workspaceRoot, check = checkTypeScriptAndEslint }) {
+		this.pending = /* @__PURE__ */ new Set();
+		this.results = /* @__PURE__ */ new Map();
+		this.worker = null;
+		this.active = false;
+		this.generation = 0;
+		this.workspaceRoot = workspaceRoot;
+		this.check = check;
+	}
+	beginTurn() {
+		this.reset();
+		this.active = true;
+	}
+	endTurn() {
+		this.reset();
+		this.active = false;
+	}
+	enqueue(filePath) {
+		if (!this.active) return;
+		const resolved = path.resolve(this.workspaceRoot, filePath);
+		this.results.delete(resolved);
+		this.pending.add(resolved);
+		this.worker ??= this.processQueue();
+	}
+	/**
+	* Waits up to `budgetMs` (or until `signal` aborts) for queued checks, then
+	* returns the errors found since the last drain, or null when there are none.
+	*/
+	async drain(budgetMs, signal) {
+		if (this.worker) await settleWithin(this.worker, budgetMs, signal);
+		return this.takeReport();
+	}
+	reset() {
+		this.generation++;
+		this.pending.clear();
+		this.results.clear();
+	}
+	async processQueue() {
+		try {
+			while (this.pending.size > 0) {
+				const batch = [...this.pending];
+				this.pending.clear();
+				const generation = this.generation;
+				const diagnostics = await this.runCheck(batch);
+				if (!diagnostics || generation !== this.generation) continue;
+				for (const filePath of batch) {
+					if (this.pending.has(filePath)) continue;
+					this.results.set(filePath, diagnostics.filter((diagnostic) => diagnostic.filePath === filePath));
+				}
+			}
+		} finally {
+			this.worker = null;
+		}
+	}
+	async runCheck(batch) {
+		try {
+			return await this.check(batch);
+		} catch (error) {
+			logger.debug(`[diagnostics] check failed; skipping ${batch.length} file(s): ${String(error)}`);
+			return null;
+		}
+	}
+	takeReport() {
+		const errors = [...this.results.values()].flat();
+		this.results.clear();
+		if (errors.length === 0) return null;
+		const lines = errors.slice(0, MAX_REPORTED_ERRORS).map((error) => this.formatError(error));
+		const omitted = errors.length - lines.length;
+		if (omitted > 0) lines.push(`(+${omitted} more)`);
+		return [REPORT_HEADER, ...lines].join("\n");
+	}
+	formatError({ filePath, line, column, code, message }) {
+		const relativePath = path.relative(this.workspaceRoot, filePath).split(path.sep).join("/");
+		const firstLine = message.split("\n")[0];
+		return `${relativePath}:${line}:${column} - ${code}: ${firstLine.length > MAX_MESSAGE_LENGTH ? `${firstLine.slice(0, MAX_MESSAGE_LENGTH)}...` : firstLine}`;
+	}
+};
+/** Resolves when `work` settles, `budgetMs` elapses, or `signal` aborts - whichever is first. */
+async function settleWithin(work, budgetMs, signal) {
+	if (signal?.aborted) return;
+	let timer;
+	let onAbort;
+	const cutoff = new Promise((resolve) => {
+		timer = setTimeout(resolve, budgetMs);
+		onAbort = resolve;
+		signal?.addEventListener("abort", onAbort, { once: true });
+	});
+	try {
+		await Promise.race([work, cutoff]);
+	} finally {
+		clearTimeout(timer);
+		if (onAbort) signal?.removeEventListener("abort", onAbort);
+	}
+}
+//#endregion
 //#region src/features/FeatureModuleRegistry.ts
 /**
 * Manages the lifecycle of opt-in CLI feature modules.
@@ -7685,7 +8107,7 @@ async function handleSandboxTrustDomainCommand(deps, domains) {
 * recurses with the same context for messages submitted mid-turn.
 */
 async function runTurn(message, ctx) {
-	const { agent, sessionStore, configStore, commandHistoryStore, customCommandStore, messageBuilder, config, availableModels, agentStore, contextContent, additionalDirectories, featureRegistry, backgroundManager, todoStore, decisionStore, blockerStore, workflowStores, setCommandHistory, setAbortController } = ctx;
+	const { agent, sessionStore, configStore, commandHistoryStore, customCommandStore, messageBuilder, config, availableModels, agentStore, contextContent, additionalDirectories, featureRegistry, backgroundManager, todoStore, decisionStore, blockerStore, postEditDiagnostics, workflowStores, setCommandHistory, setAbortController } = ctx;
 	const storeSession = useCliStore.getState().session;
 	if (!agent || !storeSession) {
 		console.error("❌ CLI failed to initialize. Try restarting b4m.\n");
@@ -7790,6 +8212,8 @@ async function runTurn(message, ctx) {
 			if (elided > 0) logger.debug(`[workflowReminder] elided ${elided} item(s) to fit the token cap`);
 			return text;
 		} : void 0;
+		const diagnostics = cliConfig.preferences.postEditDiagnostics === true ? postEditDiagnostics : null;
+		diagnostics?.beginTurn();
 		let result;
 		try {
 			result = await agent.run(messageContent, {
@@ -7798,9 +8222,11 @@ async function runTurn(message, ctx) {
 				parallelExecution: cliConfig.preferences.enableParallelToolExecution === true,
 				isReadOnlyTool,
 				workflowReminder,
+				drainFeedback: diagnostics ? (phase) => diagnostics.drain(DRAIN_BUDGET_MS[phase], abortController.signal) : void 0,
 				onContextLimit: createReactiveCompactionHandler(agent, activeSession, 1 + previousMessages.length + 1)
 			});
 		} finally {
+			diagnostics?.endTurn();
 			backgroundManager?.setCurrentTurn(null);
 		}
 		const permissionDenied = result.finalAnswer.startsWith("Permission denied for tool");
@@ -8101,6 +8527,22 @@ async function rewindSession(ctx, messageIndex) {
 	return { prefill: prefillContent };
 }
 //#endregion
+//#region src/session/modelOverride.ts
+async function runWithModelOverride(ctx, overrideModel, run) {
+	const originalModel = useCliStore.getState().session?.model;
+	ctx.applyModel(overrideModel);
+	try {
+		return await run();
+	} finally {
+		if (originalModel) await restoreModel(ctx, originalModel);
+	}
+}
+async function restoreModel(ctx, originalModel) {
+	ctx.applyModel(originalModel);
+	const restoredSession = useCliStore.getState().session;
+	if (restoredSession) await ctx.sessionStore.save(restoredSession);
+}
+//#endregion
 //#region src/index.tsx
 process.removeAllListeners("warning");
 process.on("warning", (warning) => {
@@ -8200,6 +8642,7 @@ function CliApp() {
 		permissionPrompt: null,
 		trustLocationSelector: null,
 		folderTrustPrompt: null,
+		mcpApprovalPrompt: null,
 		rewindSelector: null,
 		sessionSelector: null,
 		orchestrator: null,
@@ -8219,10 +8662,12 @@ function CliApp() {
 	const [commandHistory, setCommandHistory] = useState([]);
 	const imageStoreInitPromise = useRef(null);
 	const folderTrustResolvedRef = useRef(false);
+	const mcpApprovalResolvedRef = useRef(false);
 	const todoStoreRef = useRef(createTodoStore());
 	const decisionStoreRef = useRef(createDecisionStore());
 	const blockerStoreRef = useRef(createBlockerStore());
 	const reviewGateStoreRef = useRef(createReviewGateStore());
+	const postEditDiagnosticsRef = useRef(new PostEditDiagnostics({ workspaceRoot: process.cwd() }));
 	const setStoreSession = useCliStore((state) => state.setSession);
 	const enqueuePermissionPrompt = useCliStore((state) => state.enqueuePermissionPrompt);
 	const enqueueUserQuestionPrompt = useCliStore((state) => state.enqueueUserQuestionPrompt);
@@ -8334,6 +8779,20 @@ function CliApp() {
 				}));
 				return;
 			}
+			const pendingMcp = state.configStore.getPendingMcpApprovals();
+			if (pendingMcp.length > 0 && !mcpApprovalResolvedRef.current && Boolean(process.stdin.isTTY) && Boolean(process.stdout.isTTY)) {
+				mcpApprovalResolvedRef.current = true;
+				setState((prev) => ({
+					...prev,
+					mcpApprovalPrompt: {
+						projectRoot: state.configStore.getProjectRealPath() ?? process.cwd(),
+						servers: pendingMcp
+					},
+					config
+				}));
+				return;
+			}
+			if (!mcpApprovalResolvedRef.current) state.configStore.warnPendingMcpApprovals();
 			const configDirs = await state.configStore.getAdditionalDirectories();
 			const flagDirs = process.env.B4M_ADDITIONAL_DIRS ? JSON.parse(process.env.B4M_ADDITIONAL_DIRS) : [];
 			const additionalDirectories = [.../* @__PURE__ */ new Set([...configDirs, ...flagDirs])];
@@ -8518,7 +8977,8 @@ function CliApp() {
 			};
 			const agentContext = {
 				currentAgent: null,
-				observationQueue: []
+				observationQueue: [],
+				onFileChanged: (filePath) => postEditDiagnosticsRef.current.enqueue(filePath)
 			};
 			const { mcpManager, agentStore, contextResult, mcpTools, loadedB4mTools, deferredB4mTools, orchestrator, backgroundManager, historyStore } = await buildSupportingStores({
 				config,
@@ -9028,6 +9488,7 @@ function CliApp() {
 		todoStore: todoStoreRef.current,
 		decisionStore: decisionStoreRef.current,
 		blockerStore: blockerStoreRef.current,
+		postEditDiagnostics: postEditDiagnosticsRef.current,
 		workflowStores: {
 			decisionStore: decisionStoreRef.current,
 			blockerStore: blockerStoreRef.current,
@@ -9497,11 +9958,10 @@ function CliApp() {
 			}
 			if (customCommand.model && state.agent) {
 				console.log(`🔄 Using model override: ${customCommand.model}`);
-				const overrideSession = useCliStore.getState().session;
-				const originalModel = overrideSession?.model;
-				if (overrideSession) overrideSession.model = customCommand.model;
-				await handleCustomCommandMessage(substitutedBody, displayMessage);
-				if (overrideSession && originalModel) overrideSession.model = originalModel;
+				await runWithModelOverride({
+					applyModel: applyModelToSession,
+					sessionStore: state.sessionStore
+				}, customCommand.model, () => handleCustomCommandMessage(substitutedBody, displayMessage));
 			} else {
 				console.log("🤖 Sending to agent...\n");
 				await handleCustomCommandMessage(substitutedBody, displayMessage);
@@ -10664,6 +11124,34 @@ function CliApp() {
 			})();
 		}
 	});
+	if (state.mcpApprovalPrompt) {
+		const { projectRoot, servers } = state.mcpApprovalPrompt;
+		return /* @__PURE__ */ React.createElement(McpApprovalPrompt, {
+			projectRoot,
+			servers,
+			onSelect: (choice) => {
+				(async () => {
+					try {
+						if (choice === "approve") {
+							await state.configStore.approveMcpServers(servers);
+							console.log("\nApproved. Starting these MCP servers; a changed definition will ask again.\n");
+						} else console.log("\nThese MCP servers stay off this session. You will be asked again next launch.\n");
+					} catch (err) {
+						console.error("\nCould not save MCP approval:", err instanceof Error ? err.message : String(err), "\n");
+					} finally {
+						setState((prev) => ({
+							...prev,
+							mcpApprovalPrompt: null
+						}));
+						init().catch((err) => {
+							console.error("\nInitialization failed:", err instanceof Error ? err.message : String(err), "\n");
+							exit();
+						});
+					}
+				})();
+			}
+		});
+	}
 	const currentSession = useCliStore.getState().session;
 	if (state.rewindSelector && currentSession) return /* @__PURE__ */ React.createElement(RewindSelector, {
 		messages: currentSession.messages,