@bike4mind/cli 3.1.0 → 3.3.0

package/dist/{WorkItemsClient-cmw7WYBy.mjs → WorkItemsClient-BSoOblGp.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { At as tokenEstimateMultiplier } from "./ConfigStore-RHqyXcSS.mjs";
+import { Pt as tokenEstimateMultiplier } from "./ConfigStore-DUATzLxB.mjs";
 import { v4 } from "uuid";
 import { get_encoding } from "tiktoken";
 //#region ../../b4m-core/utils/dist/calibratedTokenizer.mjs

package/dist/{buildAgent-C0jmyDL4.mjs → buildAgent-DyZWK0LW.mjs}

@@ -1,9 +1,8 @@
 #!/usr/bin/env node
-import { J as getPlanModeFilePath, L as generateCliTools, N as ReActAgent, R as wrapTools, Y as buildSystemPrompt, a as loadProjectContext, c as createSseBackend, i as buildProjectAgentStore, l as ServerLlmBackend, lt as Logger, n as BackgroundAgentManager, o as McpManager, q as setWebSocketToolExecutor, r as SubagentOrchestrator, t as AgentHistoryStore } from "./AgentHistoryStore-O2gKB5YG.mjs";
-import { D as ARTIFACT_REMOVED_PLACEHOLDER, Dt as stripDeliveredArtifactBlocks, E as ARTIFACT_DELIVERED_PLACEHOLDER, F as ChatModels, I as CompletionReasoningEffortSchema, K as ModelBackend, N as CONTEXT_WINDOW_SAFETY_BUFFER_TOKENS, Ot as stripToolArtifactMarkup, W as MODEL_INFO_FIELD_GROUP_OF, Z as PermissionDeniedError, _ as logger, ct as createThinkMarkerEscaper, ht as hasDeliverablePinnedArtifact, lt as escapeThinkMarkers, pt as getQuestErrorCode, ut as filterToolArtifactMarkup, yt as isUserInitiatedAbort } from "./ConfigStore-RHqyXcSS.mjs";
+import { F as generateCliTools, G as setWebSocketToolExecutor, J as DeferredToolRegistry, U as wrapTools, V as buildSystemPrompt, Y as ReActAgent, a as loadProjectContext, c as createSseBackend, i as buildProjectAgentStore, l as ServerLlmBackend, n as BackgroundAgentManager, o as McpManager, q as getPlanModeFilePath, r as SubagentOrchestrator, t as AgentHistoryStore, ut as Logger } from "./AgentHistoryStore-CLidbOHG.mjs";
+import { A as ARTIFACT_REMOVED_PLACEHOLDER, Ct as isUserInitiatedAbort, I as CONTEXT_WINDOW_SAFETY_BUFFER_TOKENS, Mt as stripToolArtifactMarkup, R as ChatModels, Y as ModelBackend, _t as getQuestErrorCode, b as logger, et as PermissionDeniedError, ft as createThinkMarkerEscaper, jt as stripDeliveredArtifactBlocks, k as ARTIFACT_DELIVERED_PLACEHOLDER, mt as filterToolArtifactMarkup, pt as escapeThinkMarkers, q as MODEL_INFO_FIELD_GROUP_OF, yt as hasDeliverablePinnedArtifact, z as CompletionReasoningEffortSchema } from "./ConfigStore-DUATzLxB.mjs";
 import "crypto";
 import { v4 } from "uuid";
-import { z as z$1 } from "zod";
 import "axios";
 import "@aws-sdk/client-bedrock-runtime";
 import "openai";
@@ -367,7 +366,8 @@ var AnthropicCachingAdapter = class {
 		const messagesParam = modifiedParams.messages;
 		if (strategy.cacheConversationHistory && Array.isArray(messagesParam) && messagesParam.length > 0) {
 			const messages = [...messagesParam];
-			const anchorIndex = messages.length - 1 - (strategy.historyCacheExcludeTrailingCount ?? 0);
+			let anchorIndex = messages.length - 1 - (strategy.historyCacheExcludeTrailingCount ?? 0);
+			while (anchorIndex >= 0 && messages[anchorIndex].role === "system") anchorIndex--;
 			if (anchorIndex >= 0) {
 				const anchorMsg = messages[anchorIndex];
 				const msgContent = anchorMsg.content;
@@ -394,12 +394,17 @@ var AnthropicCachingAdapter = class {
 			}
 		}
 		const tools = modifiedParams.tools;
-		if (strategy.cacheTools && Array.isArray(tools) && tools.length > 0) {
+		const markIndex = Array.isArray(tools) ? tools.findLastIndex((t) => {
+			const tool = t;
+			const isServerTool = typeof tool.type === "string" && !("input_schema" in tool);
+			return tool.defer_loading !== true && !isServerTool;
+		}) : -1;
+		if (strategy.cacheTools && Array.isArray(tools) && markIndex >= 0) {
 			const toolsCopy = [...tools];
-			const lastTool = toolsCopy[toolsCopy.length - 1];
-			if (claim("tools", hasMarker(lastTool))) {
-				toolsCopy[toolsCopy.length - 1] = {
-					...lastTool,
+			const markTool = toolsCopy[markIndex];
+			if (claim("tools", hasMarker(markTool))) {
+				toolsCopy[markIndex] = {
+					...markTool,
 					cache_control: cacheControl
 				};
 				modifiedParams.tools = toolsCopy;
@@ -665,6 +670,7 @@ var NoOpCachingAdapter = class {
 ModelBackend.Anthropic, new AnthropicCachingAdapter(), ModelBackend.OpenAI, new OpenAICachingAdapter(), ModelBackend.Gemini, new GeminiCachingAdapter(), ModelBackend.Bedrock, new AnthropicCachingAdapter(), ModelBackend.XAI, new XAICachingAdapter(), ModelBackend.Kimi, new KimiCachingAdapter(), ModelBackend.DeepSeek, new DeepSeekCachingAdapter(), ModelBackend.Ollama, new NoOpCachingAdapter(), ModelBackend.BFL, new NoOpCachingAdapter(), ModelBackend.VoyageAI, new NoOpCachingAdapter(), ModelBackend.AWS, new NoOpCachingAdapter(), ModelBackend.LocalImage, new NoOpCachingAdapter();
 ChatModels.KIMI_K2_THINKING_BEDROCK, ChatModels.KIMI_K2_5_BEDROCK, ChatModels.DEEPSEEK_R1_BEDROCK, ChatModels.DEEPSEEK_FLASH, ChatModels.DEEPSEEK_V4_PRO, ChatModels.KIMI_K3;
 ChatModels.CLAUDE_4_7_OPUS, ChatModels.CLAUDE_4_7_OPUS_BEDROCK, ChatModels.CLAUDE_4_8_OPUS, ChatModels.CLAUDE_4_8_OPUS_BEDROCK, ChatModels.CLAUDE_5_SONNET, ChatModels.CLAUDE_5_SONNET_BEDROCK, ChatModels.CLAUDE_5_OPUS, ChatModels.CLAUDE_5_OPUS_BEDROCK, ChatModels.CLAUDE_5_5_HAIKU, ChatModels.CLAUDE_5_5_HAIKU_BEDROCK, ChatModels.CLAUDE_5_5_SONNET_BEDROCK;
+ChatModels.CLAUDE_5_SONNET, ChatModels.CLAUDE_5_SONNET_BEDROCK, ChatModels.CLAUDE_5_5_SONNET_BEDROCK, ChatModels.CLAUDE_FABLE_5, ChatModels.CLAUDE_FABLE_5_BEDROCK, ChatModels.CLAUDE_FABLE_5_1_BEDROCK, ChatModels.CLAUDE_5_OPUS, ChatModels.CLAUDE_5_OPUS_BEDROCK, ChatModels.CLAUDE_5_5_OPUS, ChatModels.CLAUDE_5_5_OPUS_BEDROCK, ChatModels.CLAUDE_5_5_HAIKU, ChatModels.CLAUDE_5_5_HAIKU_BEDROCK;
 new Logger();
 ChatModels.CLAUDE_4_5_SONNET, ChatModels.CLAUDE_4_1_OPUS, ChatModels.CLAUDE_4_5_HAIKU, ChatModels.CLAUDE_4_5_OPUS, ChatModels.CLAUDE_4_6_SONNET, ChatModels.CLAUDE_4_6_OPUS;
 ChatModels.CLAUDE_4_5_SONNET_BEDROCK, ChatModels.CLAUDE_4_5_HAIKU_BEDROCK, ChatModels.CLAUDE_4_5_OPUS_BEDROCK, ChatModels.CLAUDE_4_6_SONNET_BEDROCK, ChatModels.CLAUDE_4_6_OPUS_BEDROCK;
@@ -753,6 +759,19 @@ ChatModels.KIMI_K2_7_CODE, ChatModels.KIMI_K2_7_CODE_HIGHSPEED, ChatModels.KIMI_
 ChatModels.KIMI_K2_7_CODE, ChatModels.KIMI_K2_7_CODE_HIGHSPEED;
 ChatModels.KIMI_K2_7_CODE, ChatModels.KIMI_K2_7_CODE_HIGHSPEED, ChatModels.KIMI_K2_6;
 ChatModels.KIMI_K3, ChatModels.KIMI_K2_7_CODE, ChatModels.KIMI_K2_7_CODE_HIGHSPEED, ChatModels.KIMI_K2_6, ChatModels.KIMI_K2_5;
+/**
+* Ollama's native /api/chat requires tool-call arguments as an object and rejects a JSON string
+* with a 400. Unparseable or non-object input is kept under `_raw` rather than dropped.
+*/
+function toOllamaToolArguments(args) {
+	if (args !== null && typeof args === "object" && !Array.isArray(args)) return args;
+	if (typeof args !== "string" || args.trim() === "") return {};
+	try {
+		const parsed = JSON.parse(args);
+		if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) return parsed;
+	} catch {}
+	return { _raw: args };
+}
 var OllamaBackend = class OllamaBackend {
 	_host;
 	_api;
@@ -1294,18 +1313,12 @@ var OllamaBackend = class OllamaBackend {
 		};
 	}
 	pushToolMessages(messages, tool, result, _thinkingBlocks) {
-		let argumentsObj;
-		try {
-			argumentsObj = JSON.parse(tool.parameters);
-		} catch {
-			argumentsObj = { _raw: tool.parameters };
-		}
 		messages.push({
 			content: "",
 			role: "assistant",
 			tool_calls: [{ function: {
 				name: tool.name,
-				arguments: argumentsObj
+				arguments: toOllamaToolArguments(tool.parameters)
 			} }]
 		});
 		messages.push({
@@ -1357,7 +1370,13 @@ var OllamaBackend = class OllamaBackend {
 				mapped.content = texts.join("\n");
 				if (images.length > 0) mapped.images = images;
 			} else mapped.content = msg.content != null ? String(msg.content) : "";
-			if (Array.isArray(raw.tool_calls)) mapped.tool_calls = raw.tool_calls;
+			if (Array.isArray(raw.tool_calls)) mapped.tool_calls = raw.tool_calls.map((call) => ({
+				...call,
+				function: {
+					...call.function,
+					arguments: toOllamaToolArguments(call.function?.arguments)
+				}
+			}));
 			if (typeof raw.tool_name === "string") mapped.tool_name = raw.tool_name;
 			return mapped;
 		});
@@ -1379,7 +1398,7 @@ ChatModels.O1_PREVIEW, ChatModels.O1_MINI, ChatModels.O1, ChatModels.O3_MINI, Ch
 ChatModels.GPT5, ChatModels.GPT5_MINI, ChatModels.GPT5_NANO, ChatModels.GPT5_CHAT_LATEST;
 ChatModels.GPT5_1, ChatModels.GPT5_1_CHAT_LATEST;
 ChatModels.GPT5_2, ChatModels.GPT5_2_CHAT_LATEST;
-ChatModels.GPT5_4, ChatModels.GPT5_4_MINI, ChatModels.GPT5_4_NANO;
+ChatModels.GPT5_4, ChatModels.GPT5_4_MINI, ChatModels.GPT5_4_MINI_2026_03_17, ChatModels.GPT5_4_NANO;
 ChatModels.GPT5_5;
 ChatModels.GPT5_6_SOL, ChatModels.GPT5_6_LUNA, ChatModels.GPT5_6_TERRA;
 ModelBackend.Bedrock, ModelBackend.AWS, ModelBackend.OpenAI, ModelBackend.Anthropic, ModelBackend.Gemini, ModelBackend.Ollama, ModelBackend.BFL, ModelBackend.XAI, ModelBackend.Kimi, ModelBackend.DeepSeek, ModelBackend.LocalImage, ModelBackend.VoyageAI;
@@ -1430,203 +1449,7 @@ var NotifyingLlmBackend = class {
 };
 //#endregion
 //#region src/tools/deferredToolRegistry.ts
-/**
-* Registry of tool schemas that are NOT loaded into the model's initial tool
-* list. The model sees only the names (via the system prompt directory) and
-* must call the `tool_search` meta-tool to load schemas on demand.
-*
-* This mirrors Claude Code's deferred-tool pattern. The win is large for
-* heavy MCP integrations (e.g. 41 GitHub MCP tools at ~250-350 tokens of
-* JSONSchema each = ~10-15k tokens per turn that's now ~1-1.5k of names).
-*/
-var DeferredToolRegistry = class {
-	constructor() {
-		this.byName = /* @__PURE__ */ new Map();
-		this.directoryNames = [];
-	}
-	/** Replace registry contents with the supplied tools. Idempotent. */
-	register(tools) {
-		this.byName.clear();
-		for (const tool of tools) this.byName.set(tool.toolSchema.name, tool);
-		this.directoryNames = Object.freeze([...this.byName.keys()].sort());
-		logger.debug(`[DeferredToolRegistry] Registered ${tools.length} deferred tool(s)`);
-	}
-	clear() {
-		this.byName.clear();
-		this.directoryNames = Object.freeze([]);
-	}
-	size() {
-		return this.byName.size;
-	}
-	has(name) {
-		return this.byName.has(name);
-	}
-	get(name) {
-		return this.byName.get(name);
-	}
-	getAll() {
-		return Array.from(this.byName.values());
-	}
-	/** Return tools whose names appear in the supplied list, in input order. */
-	getByNames(names) {
-		const found = [];
-		for (const name of names) {
-			const tool = this.byName.get(name);
-			if (tool) found.push(tool);
-		}
-		return found;
-	}
-	/**
-	* Rank-search deferred tools by query terms. Name matches outrank
-	* description matches; exact substring on name wins ties.
-	*/
-	searchByKeywords(query, maxResults) {
-		const terms = query.toLowerCase().split(/\s+/).filter((t) => t.length > 0);
-		if (terms.length === 0) return [];
-		const scored = [];
-		for (const tool of this.byName.values()) {
-			const name = tool.toolSchema.name.toLowerCase();
-			const desc = (tool.toolSchema.description || "").toLowerCase();
-			let score = 0;
-			for (const term of terms) {
-				if (name.includes(term)) score += 10;
-				if (desc.includes(term)) score += 1;
-			}
-			if (score > 0) scored.push({
-				tool,
-				score
-			});
-		}
-		scored.sort((a, b) => b.score - a.score);
-		return scored.slice(0, maxResults).map((s) => s.tool);
-	}
-	/**
-	* Directory entries rendered into the cache-stamped system-prompt reminder.
-	* Returns the frozen snapshot captured at `register()`, NOT live `byName`
-	* keys, so loading a tool mid-session can never change a byte of the cached
-	* system block (issue #213). A loaded tool remaining listed here is
-	* harmless: re-selecting it via `tool_search` is an idempotent no-op.
-	*/
-	getDirectoryNames() {
-		return [...this.directoryNames];
-	}
-};
-const deferredToolRegistry = new DeferredToolRegistry();
-//#endregion
-//#region src/tools/toolSearchTool.ts
-/**
-* Default number of tools returned for a keyword search. Matches Claude
-* Code's ToolSearch convention. 5 keeps the response payload small while
-* surfacing enough alternatives for the model to refine its query.
-*/
-const DEFAULT_MAX_RESULTS = 5;
-/**
-* Runtime validation for tool_search params. The LLM produces these
-* values, so we validate at this boundary rather than trusting the
-* shape. Coerces `max_results` from string->number for models that emit
-* numeric-looking strings.
-*/
-const ToolSearchParamsSchema = z$1.object({
-	query: z$1.string().min(1, "query must be a non-empty string"),
-	max_results: z$1.coerce.number().int().min(1).max(20).optional()
-});
-/**
-* Parse the query string. Two forms:
-*   - `select:name1,name2,...` - exact-name selection
-*   - free text - keyword search across name + description
-*/
-function parseQuery(query) {
-	const trimmed = query.trim();
-	const selectMatch = trimmed.match(/^select:(.+)$/i);
-	if (selectMatch) return {
-		mode: "select",
-		names: selectMatch[1].split(",").map((n) => n.trim()).filter((n) => n.length > 0)
-	};
-	return {
-		mode: "search",
-		text: trimmed
-	};
-}
-/**
-* Format the loaded-tools response. Mirrors Claude Code's convention:
-* one <function>{...}</function> line per matched tool. The model has
-* already seen this format in its tool-registration system messages, so
-* it parses without additional explanation.
-*
-* Note: the schemas are *also* injected into context.tools by the caller,
-* so on the next iteration the model gets them as native tool definitions.
-* The text response here is for in-turn awareness and audit trail.
-*/
-function renderToolsBlock(tools) {
-	if (tools.length === 0) return "";
-	return `<functions>\n${tools.map((tool) => {
-		const schema = {
-			description: tool.toolSchema.description,
-			name: tool.toolSchema.name,
-			parameters: tool.toolSchema.parameters
-		};
-		return `<function>${JSON.stringify(schema)}</function>`;
-	}).join("\n")}\n</functions>`;
-}
-/**
-* Build the tool_search meta-tool. The returned tool has a closure over
-* the supplied `toolListAccessor`, which it uses to push newly-resolved
-* tool schemas into the live agent context.
-*
-* Idempotent: re-loading a tool that's already in the context is a no-op.
-*/
-function createToolSearchTool(toolListAccessor) {
-	return {
-		toolSchema: {
-			name: "tool_search",
-			description: "Fetches full schema definitions for deferred tools so they can be called. Deferred tools appear by name only in a system reminder; their parameter schemas are NOT loaded by default. Use this tool to load schemas on demand. Query forms: 'select:name1,name2' for exact selection, or free-text keywords to search by name and description. Once a tool's schema is returned, it becomes callable in subsequent turns.",
-			parameters: {
-				type: "object",
-				properties: {
-					query: {
-						type: "string",
-						description: "Either 'select:<comma-separated names>' to fetch specific tools, or free-text keywords (e.g. 'github pull request') to rank-search deferred tools."
-					},
-					max_results: {
-						type: "number",
-						description: `Maximum number of tools to return for keyword search. Defaults to ${DEFAULT_MAX_RESULTS}. Ignored for 'select:' queries.`
-					}
-				},
-				required: ["query"]
-			}
-		},
-		toolFn: async (params) => {
-			const parsedParams = ToolSearchParamsSchema.safeParse(params ?? {});
-			if (!parsedParams.success) {
-				const issue = parsedParams.error.issues[0];
-				return `tool_search: invalid parameters — ${issue.path.join(".") || "params"}: ${issue.message}`;
-			}
-			const { query, max_results } = parsedParams.data;
-			const parsed = parseQuery(query);
-			let matched;
-			let unmatched = [];
-			if (parsed.mode === "select") {
-				matched = deferredToolRegistry.getByNames(parsed.names);
-				const foundNames = new Set(matched.map((t) => t.toolSchema.name));
-				unmatched = parsed.names.filter((n) => !foundNames.has(n));
-			} else {
-				const max = max_results ?? DEFAULT_MAX_RESULTS;
-				matched = deferredToolRegistry.searchByKeywords(parsed.text, max);
-			}
-			if (matched.length === 0) return parsed.mode === "select" ? `tool_search: no deferred tools matched ${parsed.names.join(", ")}. Use a free-text query to search.` : `tool_search: no deferred tools matched query "${parsed.text}".`;
-			const liveTools = toolListAccessor();
-			const liveNames = new Set(liveTools.map((t) => t.toolSchema.name));
-			let added = 0;
-			for (const tool of matched) if (!liveNames.has(tool.toolSchema.name)) {
-				liveTools.push(tool);
-				added++;
-			}
-			logger.debug(`[tool_search] query="${query}" matched=${matched.length} added=${added} alreadyLoaded=${matched.length - added}`);
-			const block = renderToolsBlock(matched);
-			return `${`Loaded ${added} new tool schema(s)${added < matched.length ? ` (${matched.length - added} already loaded)` : ""}. These are now callable in your next message.${unmatched.length > 0 ? `\n\nNot found: ${unmatched.join(", ")}` : ""}`}\n\n${block}`;
-		}
-	};
-}
+const deferredToolRegistry = new DeferredToolRegistry({ logger });
 //#endregion
 //#region src/llm/MultiLlmBackend.ts
 /**
@@ -2166,4 +1989,4 @@ function buildAgent(input) {
 	};
 }
 //#endregion
-export { deferredToolRegistry as a, createToolSearchTool as i, buildSupportingStores as n, NotifyingLlmBackend as o, buildLlmBackend as r, buildAgent as t };
+export { NotifyingLlmBackend as a, deferredToolRegistry as i, buildSupportingStores as n, buildLlmBackend as r, buildAgent as t };

package/dist/commands/acpCommand.mjs

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { A as createAgentDelegateTool, C as createTodoStore, D as createCoordinateTaskTool, F as PermissionManager, I as buildCliToolList, O as createResumeAgentTool, Q as CustomCommandStore, S as createFindDefinitionTool, T as createSkillTool, Z as RemoteSkillSource, b as createGetFileStructureTool, j as FallbackLlmBackend, k as createBackgroundAgentTools, nt as SessionStore, q as setWebSocketToolExecutor, s as buildSandbox, tt as CheckpointStore, w as createWriteTodosTool } from "../AgentHistoryStore-O2gKB5YG.mjs";
-import { _ as logger, o as isReadOnlyTool, t as ConfigStore, u as requireApiUrl } from "../ConfigStore-RHqyXcSS.mjs";
-import { a as deferredToolRegistry, i as createToolSearchTool, n as buildSupportingStores, o as NotifyingLlmBackend, r as buildLlmBackend, t as buildAgent } from "../buildAgent-C0jmyDL4.mjs";
-import { a as ApiClient } from "../dist-B1bGf-yn.mjs";
+import { $ as CustomCommandStore, A as createAgentDelegateTool, C as createTodoStore, D as createCoordinateTaskTool, G as setWebSocketToolExecutor, N as PermissionManager, O as createResumeAgentTool, P as buildCliToolList, Q as RemoteSkillSource, S as createFindDefinitionTool, T as createSkillTool, X as createToolSearchTool, b as createGetFileStructureTool, j as FallbackLlmBackend, k as createBackgroundAgentTools, nt as CheckpointStore, rt as SessionStore, s as buildSandbox, w as createWriteTodosTool } from "../AgentHistoryStore-CLidbOHG.mjs";
+import { b as logger, i as ToolCatalog, p as requireApiUrl, t as ConfigStore } from "../ConfigStore-DUATzLxB.mjs";
+import { a as NotifyingLlmBackend, i as deferredToolRegistry, n as buildSupportingStores, r as buildLlmBackend, t as buildAgent } from "../buildAgent-DyZWK0LW.mjs";
+import { a as ApiClient } from "../dist-DPP7UmK9.mjs";
 import { randomUUID } from "crypto";
 import { existsSync, realpathSync, statSync } from "fs";
 import { isAbsolute } from "path";
@@ -92,18 +92,19 @@ function truncate(text, max) {
 const PERMISSION_OPTION_ALLOW_ONCE = "allow-once";
 const PERMISSION_OPTION_ALLOW_ALWAYS = "allow-always";
 const PERMISSION_OPTION_REJECT = "deny";
-function buildPermissionOptions() {
+function buildPermissionOptions(options = {}) {
+	const { allowAlways = true } = options;
 	return [
 		{
 			optionId: PERMISSION_OPTION_ALLOW_ONCE,
 			name: "Allow once",
 			kind: "allow_once"
 		},
-		{
+		...allowAlways ? [{
 			optionId: PERMISSION_OPTION_ALLOW_ALWAYS,
 			name: "Always allow",
 			kind: "allow_always"
-		},
+		}] : [],
 		{
 			optionId: PERMISSION_OPTION_REJECT,
 			name: "Reject",
@@ -271,12 +272,13 @@ var AcpServer = class {
 		this.stackPromise = null;
 		this.stack = null;
 		this.activeTurn = null;
-		this.promptFn = async (toolName, args, preview) => {
+		this.promptFn = async (toolName, args, preview, kind) => {
+			const isSandboxEscalation = kind === "sandbox-escalation";
 			const turn = this.activeTurn;
 			if (!turn) return { action: "deny" };
 			const toolCall = {
 				toolCallId: `perm-${randomUUID()}`,
-				title: toolCallTitle(toolName, args),
+				title: `${isSandboxEscalation ? "Run outside sandbox: " : ""}${toolCallTitle(toolName, args)}`,
 				kind: toolKind(toolName),
 				status: "pending",
 				rawInput: args,
@@ -294,13 +296,15 @@ var AcpServer = class {
 			turn.signal.addEventListener("abort", onClose);
 			this.connectionSignal.addEventListener("abort", onClose);
 			try {
-				return { action: await Promise.race([turn.client.request(methods.client.session.requestPermission, {
+				const action = await Promise.race([turn.client.request(methods.client.session.requestPermission, {
 					sessionId: turn.sessionId,
 					toolCall,
-					options: buildPermissionOptions()
+					options: buildPermissionOptions({ allowAlways: !isSandboxEscalation })
 				}, { cancellationSignal: decisionController.signal }).then((res) => permissionResponseFromOutcome(res?.outcome)).catch(() => "deny"), new Promise((resolve) => {
 					decisionController.signal.addEventListener("abort", () => resolve("deny"), { once: true });
-				})]) };
+				})]);
+				if (isSandboxEscalation && action === "allow-always") return { action: "deny" };
+				return { action };
 			} finally {
 				clearTimeout(timer);
 				turn.signal.removeEventListener("abort", onClose);
@@ -424,7 +428,7 @@ var AcpServer = class {
 				result = await stack.agent.run(userText, {
 					signal: abortController.signal,
 					previousMessages: session.history,
-					isReadOnlyTool,
+					isReadOnlyTool: (toolName) => stack.permissionManager.catalog.isReadOnly(toolName),
 					maxHistoryIterations: 4
 				});
 			} catch (error) {
@@ -594,7 +598,7 @@ var AcpServer = class {
 			tokenGetter,
 			startupLog
 		});
-		const permissionManager = new PermissionManager(config.trustedTools ?? [], void 0, config.tools.disabled ?? []);
+		const permissionManager = new PermissionManager(new ToolCatalog(), config.trustedTools ?? [], config.tools.disabled ?? []);
 		const checkpointStore = new CheckpointStore(this.configStore.getProjectConfigDir() ?? process.cwd());
 		const stackSessionId = randomUUID();
 		const { sandboxOrchestrator } = await buildSandbox({
@@ -627,9 +631,13 @@ var AcpServer = class {
 		const llmWithFallback = config.fallbackModels && config.fallbackModels.length > 0 ? new FallbackLlmBackend(llm, config.fallbackModels, (from, to, error) => logger.debug(`[acp] Model "${from}" failed (${error.message}); falling back to "${to}"`)) : llm;
 		const notifyingLlm = new NotifyingLlmBackend(llmWithFallback, backgroundManager);
 		const agentToolsRef = { current: null };
-		const toolSearchTool = deferredToolRegistry.size() > 0 ? createToolSearchTool(() => {
-			if (!agentToolsRef.current) throw new Error("tool_search invoked before agent context was wired");
-			return agentToolsRef.current;
+		const toolSearchTool = deferredToolRegistry.size() > 0 ? createToolSearchTool({
+			registry: deferredToolRegistry,
+			logger,
+			toolListAccessor: () => {
+				if (!agentToolsRef.current) throw new Error("tool_search invoked before agent context was wired");
+				return agentToolsRef.current;
+			}
 		}) : null;
 		const cliTools = this.buildCliTools({
 			config,

package/dist/commands/apiCommand.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { d as resolveApiEndpoint, g as parseApiUrl, t as ConfigStore } from "../ConfigStore-RHqyXcSS.mjs";
+import { m as resolveApiEndpoint, t as ConfigStore, y as parseApiUrl } from "../ConfigStore-DUATzLxB.mjs";
 //#region src/commands/apiCommand.ts
 /**
 * External API config command (--api-url / --reset-api)

package/dist/commands/doctorCommand.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as version } from "../package-DsG8Tgvs.mjs";
+import { t as version } from "../package-DYPVrada.mjs";
 import { c as isNpmPrefixWritable, i as fetchLatestVersion, r as compareSemver } from "../updateChecker-CCLVVdH0.mjs";
 import { t as checkRipgrep } from "../ripgrepCheck-BmkyTK2i.mjs";
 import { existsSync } from "fs";

package/dist/commands/envCommand.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as ConfigStore } from "../ConfigStore-RHqyXcSS.mjs";
+import { t as ConfigStore } from "../ConfigStore-DUATzLxB.mjs";
 //#region src/commands/envCommand.ts
 /**
 * Environment switching for the `--dev` / `--prod` launch flags.

package/dist/commands/headlessCommand.mjs

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { A as createAgentDelegateTool, B as SHELL_LIKE_TOOL_COMMAND_FIELDS, C as createTodoStore, D as createCoordinateTaskTool, F as PermissionManager, I as buildCliToolList, K as classifyCommandRisk, L as generateCliTools, N as ReActAgent, O as createResumeAgentTool, Q as CustomCommandStore, R as wrapTools, S as createFindDefinitionTool, T as createSkillTool, Y as buildSystemPrompt, Z as RemoteSkillSource, a as loadProjectContext, b as createGetFileStructureTool, c as createSseBackend, i as buildProjectAgentStore, j as FallbackLlmBackend, k as createBackgroundAgentTools, n as BackgroundAgentManager, nt as SessionStore, o as McpManager, q as setWebSocketToolExecutor, r as SubagentOrchestrator, s as buildSandbox, t as AgentHistoryStore, tt as CheckpointStore, w as createWriteTodosTool, x as createWorkItemTools } from "../AgentHistoryStore-O2gKB5YG.mjs";
-import { _ as logger, o as isReadOnlyTool, t as ConfigStore, u as requireApiUrl } from "../ConfigStore-RHqyXcSS.mjs";
-import { r as reconstructTurnBlocks, t as WorkItemsClient } from "../WorkItemsClient-cmw7WYBy.mjs";
-import { a as ApiClient } from "../dist-B1bGf-yn.mjs";
+import { $ as CustomCommandStore, A as createAgentDelegateTool, C as createTodoStore, D as createCoordinateTaskTool, F as generateCliTools, G as setWebSocketToolExecutor, K as classifyCommandRisk, N as PermissionManager, O as createResumeAgentTool, P as buildCliToolList, Q as RemoteSkillSource, S as createFindDefinitionTool, T as createSkillTool, U as wrapTools, V as buildSystemPrompt, Y as ReActAgent, a as loadProjectContext, b as createGetFileStructureTool, c as createSseBackend, i as buildProjectAgentStore, j as FallbackLlmBackend, k as createBackgroundAgentTools, n as BackgroundAgentManager, nt as CheckpointStore, o as McpManager, r as SubagentOrchestrator, rt as SessionStore, s as buildSandbox, t as AgentHistoryStore, w as createWriteTodosTool, x as createWorkItemTools } from "../AgentHistoryStore-CLidbOHG.mjs";
+import { a as commandTextOf, b as logger, c as toolCategory, i as ToolCatalog, p as requireApiUrl, t as ConfigStore } from "../ConfigStore-DUATzLxB.mjs";
+import { r as reconstructTurnBlocks, t as WorkItemsClient } from "../WorkItemsClient-BSoOblGp.mjs";
+import { a as ApiClient } from "../dist-DPP7UmK9.mjs";
 import { randomBytes } from "crypto";
 import { v4 } from "uuid";
 import { readFile } from "fs/promises";
@@ -24,7 +24,7 @@ import { readFile } from "fs/promises";
 * field or a new event type (backward-compatible). Consumers should reject a
 * MAJOR they do not understand.
 */
-const HEADLESS_SCHEMA_VERSION = "1.0.0";
+const HEADLESS_SCHEMA_VERSION = "1.1.0";
 /** Serialize an event with the protocol envelope stamped on. Exposed for tests. */
 function stampEvent(runId, event) {
 	return {
@@ -87,15 +87,15 @@ function parseStringArray(raw, inputType) {
 }
 /**
 * Classify the risk of a single tool invocation for the permission protocol.
-* Shell-like tools are classified from their actual command text (reusing the
-* shared command-risk tokenizer); every other tool falls back to a level derived
-* from its permission category (auto_approve -> low, prompt_always -> high, else
-* medium). Never throws: a classifier failure fails closed at `high`.
+* Shell-like tools (a descriptor commandArg) are classified from their actual
+* command text, reusing the shared command-risk tokenizer, exactly as the
+* gateway's command-risk stage does; every other tool falls back to a level
+* derived from its permission category (auto_approve -> low, prompt_always ->
+* high, else medium). Never throws: a classifier failure fails closed at `high`.
 */
-function classifyToolRisk(toolName, args, category) {
-	const field = SHELL_LIKE_TOOL_COMMAND_FIELDS[toolName];
-	const command = field && args !== null && typeof args === "object" ? args[field] : void 0;
-	if (typeof command === "string") try {
+function classifyToolRisk(descriptor, args) {
+	const command = commandTextOf(descriptor, args);
+	if (command !== void 0) try {
 		return classifyCommandRisk(command);
 	} catch {
 		return {
@@ -103,6 +103,7 @@ function classifyToolRisk(toolName, args, category) {
 			reasons: ["command risk analysis failed (fail closed)"]
 		};
 	}
+	const category = toolCategory(descriptor);
 	return {
 		level: category === "auto_approve" ? "low" : category === "prompt_always" ? "high" : "medium",
 		reasons: []
@@ -171,9 +172,21 @@ function evaluatePermissionPolicy(policy, toolName, riskLevel) {
 		reason: `policy default (${policy.defaultAction})`
 	};
 }
+/** The permission_request event for a gated tool call; `kind` tells a consumer what is being asked. */
+function buildPermissionRequestEvent(toolName, risk, kind = "tool") {
+	return {
+		type: "permission_request",
+		toolName,
+		risk,
+		kind
+	};
+}
 /**
 * Resolve a headless permission decision from the fixed precedence ladder:
 *   --dangerously-skip-permissions -> allow-once (explicit blanket override)
+*   a sandbox-escalation request    -> deny (running outside the OS sandbox is its own
+*                                       decision; no policy allow-list or risk threshold
+*                                       approves it)
 *   a directory-grant request       -> deny (widening the filesystem allow-list is
 *                                       its own decision; headless has no human to
 *                                       grant it, so fail closed - never inherit the
@@ -183,11 +196,15 @@ function evaluatePermissionPolicy(policy, toolName, riskLevel) {
 * Extracted from the headless prompt closure so the ladder is unit-testable.
 */
 function resolveHeadlessPermissionDecision(params) {
-	const { dangerouslySkipPermissions, isDirectoryGrant, toolName, riskLevel, permissionPolicy } = params;
+	const { dangerouslySkipPermissions, isDirectoryGrant, isSandboxEscalation, toolName, riskLevel, permissionPolicy } = params;
 	if (dangerouslySkipPermissions) return {
 		action: "allow-once",
 		reason: "dangerously-skip-permissions"
 	};
+	if (isSandboxEscalation) return {
+		action: "deny",
+		reason: "running outside the sandbox not approved in headless mode"
+	};
 	if (isDirectoryGrant) return {
 		action: "deny",
 		reason: "directory access not granted in headless mode"
@@ -205,6 +222,39 @@ function resolveHeadlessPermissionDecision(params) {
 	};
 }
 //#endregion
+//#region src/commands/headlessPermissionPrompt.ts
+/**
+* The headless permission prompt. Every gated tool surfaces a structured permission_request +
+* permission_decision pair on the stream (so decisions are never silent), then resolves the
+* decision from resolveHeadlessPermissionDecision's precedence ladder.
+*/
+function createHeadlessPromptFn(deps) {
+	const { catalog, dangerouslySkipPermissions, permissionPolicy, emit, warn } = deps;
+	return (toolName, args, _preview, kind) => {
+		const risk = classifyToolRisk(catalog.resolve(toolName), args);
+		emit?.(buildPermissionRequestEvent(toolName, risk, kind));
+		const decision = resolveHeadlessPermissionDecision({
+			dangerouslySkipPermissions,
+			isDirectoryGrant: kind === "directory-grant",
+			isSandboxEscalation: kind === "sandbox-escalation",
+			toolName,
+			riskLevel: risk.level,
+			permissionPolicy
+		});
+		if (emit) emit({
+			type: "permission_decision",
+			toolName,
+			action: decision.action,
+			reason: decision.reason,
+			risk: risk.level,
+			kind: kind ?? "tool"
+		});
+		else if (decision.action === "deny") warn(kind === "sandbox-escalation" ? `Warning: Tool "${toolName}" was denied by the OS sandbox, and retrying it outside the sandbox needs approval that headless mode cannot grant. Use --dangerously-skip-permissions to allow it.\n` : `Warning: Tool "${toolName}" requires permission and was denied (${decision.reason}). Grant it via --permission-policy, or --dangerously-skip-permissions to allow all tools.\n`);
+		if (decision.action === "allow-once") logger.debug(`[headless] Auto-allowing tool: ${toolName}`);
+		return Promise.resolve({ action: decision.action });
+	};
+}
+//#endregion
 //#region src/commands/headlessCommand.ts
 /**
 * Headless/programmatic mode command (b4m -p "query")
@@ -319,34 +369,16 @@ async function handleHeadlessCommand(options) {
 			}
 		};
 		await logger.initialize(session.id);
-		const permissionManager = new PermissionManager(config.trustedTools ?? [], void 0, config.tools.disabled);
+		const permissionManager = new PermissionManager(new ToolCatalog(), config.trustedTools ?? [], config.tools.disabled);
 		const emit = createHeadlessEmitter(runId, (line) => process.stdout.write(line));
 		const streaming = outputFormat === "stream-json";
-		const promptFn = (toolName, args, _preview, kind) => {
-			const risk = classifyToolRisk(toolName, args, permissionManager.getCategory(toolName));
-			if (streaming) emit({
-				type: "permission_request",
-				toolName,
-				risk
-			});
-			const decision = resolveHeadlessPermissionDecision({
-				dangerouslySkipPermissions,
-				isDirectoryGrant: kind === "directory-grant",
-				toolName,
-				riskLevel: risk.level,
-				permissionPolicy
-			});
-			if (streaming) emit({
-				type: "permission_decision",
-				toolName,
-				action: decision.action,
-				reason: decision.reason,
-				risk: risk.level
-			});
-			else if (decision.action === "deny") process.stderr.write(`Warning: Tool "${toolName}" requires permission and was denied (${decision.reason}). Grant it via --permission-policy, or --dangerously-skip-permissions to allow all tools.\n`);
-			if (decision.action === "allow-once") logger.debug(`[headless] Auto-allowing tool: ${toolName}`);
-			return Promise.resolve({ action: decision.action });
-		};
+		const promptFn = createHeadlessPromptFn({
+			catalog: permissionManager.catalog,
+			dangerouslySkipPermissions,
+			permissionPolicy,
+			emit: streaming ? emit : null,
+			warn: (message) => process.stderr.write(message)
+		});
 		const userQuestionFn = (_payload) => {
 			process.stderr.write("Warning: Agent requested user input; headless mode cannot respond interactively. Answering with empty response.\n");
 			return Promise.resolve({ answers: [] });
@@ -482,7 +514,7 @@ async function handleHeadlessCommand(options) {
 		try {
 			result = await agent.run(fullPrompt, {
 				parallelExecution: config.preferences.enableParallelToolExecution === true,
-				isReadOnlyTool,
+				isReadOnlyTool: (toolName) => permissionManager.catalog.isReadOnly(toolName),
 				maxHistoryIterations: 4
 			});
 		} finally {