@bike4mind/cli 2.0.0 → 3.0.0

package/dist/store-BkMur6uk.mjs

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export { o as useCliStore } from "./store-BxmPEI3v.mjs";

package/dist/{store-CvjTpQPs.mjs → store-BxmPEI3v.mjs}

@@ -75,6 +75,16 @@ const useCliStore = create((set) => ({
 			}
 		};
 	}),
+	sessionHolds: 0,
+	holdSession: () => {
+		set((state) => ({ sessionHolds: state.sessionHolds + 1 }));
+		let released = false;
+		return () => {
+			if (released) return;
+			released = true;
+			set((state) => ({ sessionHolds: state.sessionHolds - 1 }));
+		};
+	},
 	messageQueue: [],
 	enqueueMessage: (message) => set((state) => ({ messageQueue: [...state.messageQueue, message] })),
 	dequeueAllMessages: () => {

package/dist/types-I45lMh7Q.mjs

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export { t as DEFAULT_SANDBOX_CONFIG } from "./types-F61_hxmG.mjs";

package/dist/{updateChecker-CQW8bxo6.mjs → updateChecker-CCLVVdH0.mjs}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { execSync } from "child_process";
 import { constants, promises } from "fs";
 import { homedir } from "os";
 import path from "path";
 import axios from "axios";
+import { execSync } from "child_process";
 //#region src/utils/updateChecker.ts
 /**
 * Update checker utility for B4M CLI
@@ -163,9 +163,40 @@ async function readCache() {
 async function writeCache(cache) {
 	try {
 		await promises.mkdir(path.dirname(CACHE_FILE), { recursive: true });
-		await promises.writeFile(CACHE_FILE, JSON.stringify(cache, null, 2), "utf-8");
+		const tempFile = `${CACHE_FILE}.${process.pid}.tmp`;
+		await promises.writeFile(tempFile, JSON.stringify(cache, null, 2), "utf-8");
+		await promises.rename(tempFile, CACHE_FILE);
 	} catch {}
 }
+function toResult(currentVersion, latestVersion) {
+	return {
+		currentVersion,
+		latestVersion,
+		updateAvailable: compareSemver(latestVersion, currentVersion) > 0
+	};
+}
+/**
+* The last known update status, from the cache alone. Never touches the network,
+* so it is safe to await before first paint. A cache of any age is used: a newer
+* published version stays newer, and checkForUpdate() refreshes the cache for the
+* next launch. Null when nothing is cached for this version.
+*/
+async function readCachedUpdate(currentVersion) {
+	const cache = await readCache();
+	if (!cache || cache.currentVersion !== currentVersion) return null;
+	return toResult(currentVersion, cache.latestVersion);
+}
+/**
+* Startup update status: the cached result now, plus a background refresh of
+* the cache (registry fetch only when it is stale) for the next launch. This
+* refresh is the only automatic writer of the cache, which both the banner and
+* the launch auto-update prompt read.
+*/
+async function getStartupUpdateStatus(currentVersion) {
+	const cached = await readCachedUpdate(currentVersion);
+	checkForUpdate(currentVersion);
+	return cached;
+}
 /**
 * Check for updates using cache when fresh.
 * Non-throwing - returns null on any error.
@@ -174,11 +205,7 @@ async function checkForUpdate(currentVersion) {
 	try {
 		const cache = await readCache();
 		if (cache && cache.currentVersion === currentVersion) {
-			if (Date.now() - new Date(cache.lastChecked).getTime() < CACHE_TTL_MS) return {
-				currentVersion,
-				latestVersion: cache.latestVersion,
-				updateAvailable: compareSemver(cache.latestVersion, currentVersion) > 0
-			};
+			if (Date.now() - new Date(cache.lastChecked).getTime() < CACHE_TTL_MS) return toResult(currentVersion, cache.latestVersion);
 		}
 		const latestVersion = await fetchLatestVersion();
 		if (!latestVersion) return null;
@@ -187,11 +214,7 @@ async function checkForUpdate(currentVersion) {
 			latestVersion,
 			currentVersion
 		});
-		return {
-			currentVersion,
-			latestVersion,
-			updateAvailable: compareSemver(latestVersion, currentVersion) > 0
-		};
+		return toResult(currentVersion, latestVersion);
 	} catch {
 		return null;
 	}
@@ -215,4 +238,4 @@ async function forceCheckForUpdate(currentVersion) {
 	};
 }
 //#endregion
-export { fetchLatestVersion as a, isNpmPrefixWritable as c, compareSemver as i, setAutoUpdatePreference as l, REEXEC_GUARD_ENV as n, forceCheckForUpdate as o, checkForUpdate as r, getAutoUpdatePreference as s, INSTALL_CMD as t, shouldAttemptAutoUpdate as u };
+export { forceCheckForUpdate as a, isNpmPrefixWritable as c, shouldAttemptAutoUpdate as d, fetchLatestVersion as i, readCachedUpdate as l, REEXEC_GUARD_ENV as n, getAutoUpdatePreference as o, compareSemver as r, getStartupUpdateStatus as s, INSTALL_CMD as t, setAutoUpdatePreference as u };

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@bike4mind/cli",
-  "version": "2.0.0",
+  "version": "3.0.0",
   "mcpName": "io.github.bike4mind/bike4mind",
   "type": "module",
   "description": "Interactive CLI tool for Bike4Mind with ReAct agents",
-  "license": "UNLICENSED",
+  "license": "BUSL-1.1",
   "author": "Bike4Mind",
   "repository": {
     "type": "git",
@@ -37,23 +37,23 @@
   "dependencies": {
     "@agentclientprotocol/sdk": "1.2.1",
     "@anthropic-ai/sdk": "^0.111.0",
-    "@aws-sdk/client-apigatewaymanagementapi": "^3.1080.0",
-    "@aws-sdk/client-bedrock-runtime": "^3.1080.0",
-    "@aws-sdk/client-cloudwatch": "^3.1080.0",
-    "@aws-sdk/client-lambda": "^3.1080.0",
-    "@aws-sdk/client-s3": "^3.1080.0",
-    "@aws-sdk/client-sqs": "^3.1080.0",
-    "@aws-sdk/client-transcribe": "^3.1080.0",
-    "@aws-sdk/credential-provider-node": "^3.972.63",
-    "@aws-sdk/s3-request-presigner": "^3.1080.0",
+    "@aws-sdk/client-apigatewaymanagementapi": "^3.1150.0",
+    "@aws-sdk/client-bedrock-runtime": "^3.1150.0",
+    "@aws-sdk/client-cloudwatch": "^3.1150.0",
+    "@aws-sdk/client-lambda": "^3.1150.0",
+    "@aws-sdk/client-s3": "^3.1150.0",
+    "@aws-sdk/client-sqs": "^3.1150.0",
+    "@aws-sdk/client-transcribe": "^3.1150.0",
+    "@aws-sdk/credential-provider-node": "^3.972.86",
+    "@aws-sdk/s3-request-presigner": "^3.1150.0",
     "@casl/ability": "^6.8.1",
     "@google/genai": "^1.46.0",
     "@joplin/turndown-plugin-gfm": "^1.0.67",
     "@mendable/firecrawl-js": "^1.29.3",
-    "@modelcontextprotocol/sdk": "1.29.0",
+    "@modelcontextprotocol/sdk": "1.32.1",
     "@octokit/rest": "^22.0.1",
     "@opensearch-project/opensearch": "2.11.0",
-    "@smithy/node-http-handler": "^4.9.3",
+    "@smithy/node-http-handler": "^4.12.1",
     "async-mutex": "^0.5.0",
     "axios": "1.20.0",
     "bcryptjs": "^3.0.3",
@@ -65,7 +65,6 @@
     "dayjs": "^1.11.23",
     "diff": "^9.0.0",
     "eventsource-parser": "^3.1.0",
-    "fdir": "^6.5.0",
     "file-type": "^22.1.0",
     "fuse.js": "^7.5.0",
     "fzf": "^0.5.2",
@@ -90,9 +89,9 @@
     "p-limit": "^7.3.2",
     "picomatch": "^4.0.7",
     "qrcode": "^1.5.4",
-    "react": "^19.2.7",
+    "react": "^19.3.0",
     "sharp": "^0.35.4",
-    "shell-quote": "^1.10.0",
+    "shell-quote": "^1.12.0",
     "speakeasy": "^2.0.0",
     "tiktoken": "^1.0.22",
     "tldts": "^7.4.13",
@@ -107,7 +106,7 @@
     "xlsx": "https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz",
     "yargs": "^18.1.0",
     "yauzl": "^3.4.0",
-    "zod": "^4.4.3",
+    "zod": "^4.6.6",
     "zod-validation-error": "^5.0.0",
     "zustand": "^5.0.13"
   },
@@ -116,7 +115,7 @@
     "@types/jsonwebtoken": "^9.0.4",
     "@types/node": "^24.0.0",
     "@types/picomatch": "^4.0.3",
-    "@types/react": "^19.2.17",
+    "@types/react": "^19.3.0",
     "@types/shell-quote": "^1.7.5",
     "@types/ws": "^8.18.1",
     "@types/yargs": "^17.0.35",
@@ -125,15 +124,17 @@
     "tsx": "^4.23.0",
     "typescript": "^5.9.3",
     "vitest": "^4.1.11",
-    "@bike4mind/agents": "1.1.1",
-    "@bike4mind/common": "13.0.0",
-    "@bike4mind/hearth": "0.3.0",
-    "@bike4mind/fab-pipeline": "1.5.3",
-    "@bike4mind/llm-adapters": "0.16.1",
-    "@bike4mind/mcp": "2.0.17",
+    "@bike4mind/agents": "1.2.0",
+    "@bike4mind/client-auth": "0.2.0",
+    "@bike4mind/common": "15.0.0",
+    "@bike4mind/fab-pipeline": "2.1.0",
+    "@bike4mind/hearth": "0.3.1",
+    "@bike4mind/llm-adapters": "1.1.0",
+    "@bike4mind/mcp": "2.1.0",
     "@bike4mind/observability": "0.2.3",
-    "@bike4mind/utils": "6.5.1",
-    "@bike4mind/services": "15.0.0"
+    "@bike4mind/sdk": "1.0.0",
+    "@bike4mind/services": "17.0.0",
+    "@bike4mind/utils": "7.1.0"
   },
   "optionalDependencies": {
     "@vscode/ripgrep": "^1.18.0"

package/dist/ApiClient-BTI0-m0g.mjs

@@ -1,316 +0,0 @@
-#!/usr/bin/env node
-import { n as logger, t as ConfigStore } from "./ConfigStore-DIs-K9oD.mjs";
-import { t as version } from "./package-Dl_F2Fah.mjs";
-import axios, { isAxiosError } from "axios";
-//#region src/auth/OAuthClient.ts
-/**
-* OAuth 2.0 Device Authorization Flow client
-* Implements RFC 8628 for CLI authentication
-*/
-var OAuthClient = class {
-	constructor(baseURL = "http://localhost:3000") {
-		this.clientId = "b4m-cli";
-		this.apiClient = axios.create({
-			baseURL,
-			headers: { "Content-Type": "application/json" }
-		});
-	}
-	/**
-	* Initiate device authorization flow
-	* Returns device code, user code, and verification URL
-	*/
-	async initiateDeviceFlow() {
-		return (await this.apiClient.post("/api/oauth/device/initiate", { client_id: this.clientId })).data;
-	}
-	/**
-	* Poll for access token
-	* Returns token response if approved, or throws error with status
-	*/
-	async pollForToken(deviceCode) {
-		try {
-			const response = await this.apiClient.post("/api/oauth/device/token", {
-				grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-				device_code: deviceCode,
-				client_id: this.clientId
-			}, { validateStatus: () => true });
-			if ("error" in response.data) throw new Error(response.data.error);
-			return response.data;
-		} catch (error) {
-			if (axios.isAxiosError(error) && error.response?.data?.error) throw new Error(error.response.data.error);
-			throw error;
-		}
-	}
-	/**
-	* Wait for user authorization with automatic polling
-	* Implements exponential backoff and respects server's interval
-	*/
-	async waitForAuthorization(deviceCode, interval, onStatus) {
-		let pollInterval = interval * 1e3;
-		const maxInterval = 3e4;
-		onStatus?.("Waiting for user authorization...");
-		await this.sleep(pollInterval);
-		while (true) try {
-			return await this.pollForToken(deviceCode);
-		} catch (error) {
-			if (error instanceof Error) {
-				const errorMessage = error.message;
-				if (errorMessage === "authorization_pending") {
-					onStatus?.("Waiting for user authorization...");
-					await this.sleep(pollInterval);
-					continue;
-				}
-				if (errorMessage === "slow_down") {
-					pollInterval = Math.min(pollInterval + 5e3, maxInterval);
-					onStatus?.("Slowing down polling...");
-					await this.sleep(pollInterval);
-					continue;
-				}
-				if (errorMessage === "access_denied") throw new Error("User denied the authorization request");
-				if (errorMessage === "expired_token") throw new Error("Authorization code has expired");
-				throw error;
-			}
-			throw error;
-		}
-	}
-	/**
-	* Refresh an expired access token
-	*/
-	async refreshToken(refreshToken) {
-		return (await this.apiClient.post("/api/oauth/refresh", {
-			grant_type: "refresh_token",
-			refresh_token: refreshToken,
-			client_id: this.clientId
-		})).data;
-	}
-	/**
-	* Sleep for specified milliseconds
-	*/
-	sleep(ms) {
-		return new Promise((resolve) => setTimeout(resolve, ms));
-	}
-};
-//#endregion
-//#region src/auth/providerKeyFailure.ts
-const PROVIDER_KEY_ERROR_CODES = /* @__PURE__ */ new Set(["provider_not_configured", "provider_rejected"]);
-/**
-* A 401 whose body names a missing or rejected AI-provider key (e.g. /api/ai/tts). The
-* Bike4Mind credential was accepted, so refreshing or re-authenticating cannot fix it.
-* Shared by the ApiClient refresh interceptor and mapApiError in mcp/b4mApiClient.ts.
-*/
-function isProviderKeyFailure(data) {
-	const body = decodeBinaryBody(data);
-	if (!body || typeof body !== "object") return false;
-	const { errorCode } = body;
-	return typeof errorCode === "string" && PROVIDER_KEY_ERROR_CODES.has(errorCode);
-}
-/**
-* An arraybuffer-typed request (the generated-audio calls) gets its error body as raw
-* bytes, and the refresh interceptor sees it before any caller can decode it.
-*/
-function decodeBinaryBody(data) {
-	const bytes = data instanceof ArrayBuffer ? Buffer.from(data) : ArrayBuffer.isView(data) ? Buffer.from(data.buffer, data.byteOffset, data.byteLength) : void 0;
-	if (!bytes) return data;
-	try {
-		return JSON.parse(bytes.toString("utf8"));
-	} catch {
-		return;
-	}
-}
-//#endregion
-//#region src/auth/ApiClient.ts
-const USER_AGENT = `b4m-cli/${version}`;
-/**
-* Per-request timeout. Generous by design: a waited chat (POST /api/chat with wait:true)
-* runs a full server-side quest, so the bound only exists to stop a hung backend from
-* wedging a caller forever, not to cap a normal long quest. Override with B4M_API_TIMEOUT_MS
-* (0 disables the timeout entirely).
-*/
-const DEFAULT_API_TIMEOUT_MS = 6e5;
-function resolveTimeoutMs() {
-	const raw = process.env.B4M_API_TIMEOUT_MS;
-	if (raw === void 0 || raw.trim() === "") return DEFAULT_API_TIMEOUT_MS;
-	const parsed = Number(raw);
-	return Number.isFinite(parsed) && parsed >= 0 ? parsed : DEFAULT_API_TIMEOUT_MS;
-}
-/**
-* Thrown by the response interceptor only when the session is DEFINITIVELY revoked - the
-* refresh token was rejected (400/401 invalid_grant), or a request still 401s after a
-* successful refresh. A transient refresh outage (5xx / network / timeout) throws a plain
-* Error instead, so callers that must distinguish "log out" from "retry" (e.g.
-* checkSessionValid / the WS reconnect loop) can key on the type. The human-readable
-* message is preserved on both paths so existing `error.message.includes(...)` callers are
-* unaffected.
-*/
-var SessionRevokedError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "SessionRevokedError";
-	}
-};
-/**
-* 401 with no credential at all (no API key, no stored tokens): a config gap, not an expiry.
-* Not a SessionRevokedError, so checkSessionValid still reports "not revoked". The message keeps
-* `Authentication failed` for string-matching callers (turnController, handoff, ServerLlmBackend).
-*/
-var NotAuthenticatedError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "NotAuthenticatedError";
-	}
-};
-/**
-* Authenticated API client for B4M services
-* Automatically injects access tokens from ConfigStore
-*/
-var ApiClient = class {
-	/**
-	* @param apiKey - When set, requests authenticate with this instance API key via
-	*   the `x-api-key` header and the OAuth-JWT path (Bearer injection + refresh-on-401)
-	*   is bypassed entirely. Omit to keep the default stored-JWT behavior unchanged.
-	*/
-	constructor(baseURL = "http://localhost:3000", configStore, apiKey) {
-		this.configStore = configStore || new ConfigStore();
-		this.oauthClient = new OAuthClient(baseURL);
-		this.apiKey = apiKey;
-		this.client = axios.create({
-			baseURL,
-			timeout: resolveTimeoutMs(),
-			headers: {
-				"Content-Type": "application/json",
-				"User-Agent": USER_AGENT,
-				"X-B4M-Client": USER_AGENT
-			}
-		});
-		this.client.interceptors.request.use(async (config) => {
-			if (this.apiKey) {
-				config.headers["x-api-key"] = this.apiKey;
-				return config;
-			}
-			const tokens = await this.configStore.getAuthTokens();
-			if (tokens) config.headers.Authorization = `Bearer ${tokens.accessToken}`;
-			return config;
-		}, (error) => Promise.reject(error));
-		this.client.interceptors.response.use((response) => response, async (error) => {
-			const originalRequest = error.config;
-			if (error.response?.status === 401) logger.debug("AUTH: Received 401 Unauthorized");
-			else if (error.response?.status === 403) logger.error("403 Forbidden", error);
-			if (this.apiKey) return Promise.reject(error);
-			if (error.response?.status === 401 && isProviderKeyFailure(error.response.data)) return Promise.reject(error);
-			if (error.response?.status === 401 && !originalRequest._retry) {
-				originalRequest._retry = true;
-				const tokens = await this.configStore.getAuthTokens();
-				if (!tokens) throw new NotAuthenticatedError("Authentication failed: not logged in. Please run `b4m login` to authenticate.");
-				try {
-					if (new Date(tokens.expiresAt).getTime() > Date.now()) {
-						logger.debug("AUTH: Access token has not expired, skipping refresh - 401 is likely transient");
-						return Promise.reject(error);
-					}
-					logger.debug("AUTH: Attempting token refresh");
-					const newTokens = await this.oauthClient.refreshToken(tokens.refreshToken);
-					logger.debug("AUTH: Token refresh successful");
-					const expiresAt = new Date(Date.now() + newTokens.expires_in * 1e3).toISOString();
-					await this.configStore.setAuthTokens({
-						accessToken: newTokens.access_token,
-						refreshToken: newTokens.refresh_token ?? tokens.refreshToken,
-						expiresAt,
-						userId: tokens.userId
-					});
-					originalRequest.headers.Authorization = `Bearer ${newTokens.access_token}`;
-					logger.debug("AUTH: Retrying request with new token");
-					return this.client(originalRequest);
-				} catch (refreshError) {
-					const refreshMsg = refreshError instanceof Error ? refreshError.message : "Unknown error";
-					logger.warn(`AUTH: Token refresh failed: ${refreshMsg}`);
-					const tokens = await this.configStore.getAuthTokens();
-					if (tokens && new Date(tokens.expiresAt) <= /* @__PURE__ */ new Date()) await this.configStore.clearAuthTokens();
-					const msg = "Authentication expired. Please run `b4m login` again.";
-					const refreshStatus = isAxiosError(refreshError) ? refreshError.response?.status : void 0;
-					if (refreshStatus === 400 || refreshStatus === 401) throw new SessionRevokedError(msg);
-					throw new Error(msg);
-				}
-			}
-			if (error.response?.status === 401 && originalRequest._retry) {
-				logger.debug("AUTH: Token refresh retry failed");
-				const tokens = await this.configStore.getAuthTokens();
-				if (tokens && new Date(tokens.expiresAt) <= /* @__PURE__ */ new Date()) await this.configStore.clearAuthTokens();
-				throw new SessionRevokedError("Authentication failed. Please run /login to authenticate.");
-			}
-			return Promise.reject(error);
-		});
-	}
-	/**
-	* Make a GET request
-	*/
-	async get(url, config) {
-		return (await this.client.get(url, config)).data;
-	}
-	/**
-	* Make a POST request
-	*/
-	async post(url, data, config) {
-		logger.debug(`[ApiClient] POST ${this.client.defaults.baseURL}${url}`);
-		logger.debug(`[ApiClient] Request body: ${JSON.stringify(data)}`);
-		const response = await this.client.post(url, data, config);
-		logger.debug(`[ApiClient] Response status: ${response.status}`);
-		return response.data;
-	}
-	/**
-	* Make a PUT request
-	*/
-	async put(url, data, config) {
-		return (await this.client.put(url, data, config)).data;
-	}
-	/**
-	* Make a DELETE request
-	*/
-	async delete(url, config) {
-		return (await this.client.delete(url, config)).data;
-	}
-	/**
-	* Get the underlying axios instance for advanced use cases (e.g., streaming)
-	*/
-	getAxiosInstance() {
-		return this.client;
-	}
-	/**
-	* Check if user is authenticated
-	*/
-	async isAuthenticated() {
-		return this.configStore.isAuthenticated();
-	}
-	/**
-	* Get current user information
-	*/
-	async getCurrentUser() {
-		try {
-			const tokens = await this.configStore.getAuthTokens();
-			if (!tokens) return null;
-			return { id: tokens.userId };
-		} catch {
-			return null;
-		}
-	}
-	/**
-	* Verifies the session is still valid via a cheap authed GET. The response interceptor
-	* above already attempts a token refresh and retries on 401, so a resolved call means the
-	* session is valid (fresh or transparently refreshed). Returns false ONLY on a
-	* `SessionRevokedError` (the refresh token was rejected, or a 401 survived a refresh);
-	* every other outcome - a transient refresh outage, a network blip, or the interceptor's
-	* fresh-token 401 skip - is treated as transient and returns true, so callers keep
-	* retrying rather than tearing down on a blip.
-	*
-	* Used by WebSocketConnectionManager to distinguish "session revoked" from "transient
-	* network issue" when a WS connect attempt fails to open - a WS close event carries no
-	* HTTP status, so this is the only way to tell the two apart.
-	*/
-	async checkSessionValid() {
-		try {
-			await this.get("/api/identify");
-			return true;
-		} catch (err) {
-			return !(err instanceof SessionRevokedError);
-		}
-	}
-};
-//#endregion
-export { OAuthClient as i, NotAuthenticatedError as n, isProviderKeyFailure as r, ApiClient as t };

package/dist/SandboxRuntimeAdapter-BmHELLuM.mjs

@@ -1,3 +0,0 @@
-#!/usr/bin/env node
-import { i as isBinaryAvailable, n as detectPlatform, r as expandPath, t as createSandboxRuntime } from "./SandboxRuntimeAdapter-BgLUVTJL.mjs";
-export { createSandboxRuntime, detectPlatform, expandPath, isBinaryAvailable };