@bike4mind/cli 3.2.0 → 3.3.0

package/dist/{AgentHistoryStore-BWko6txx.mjs → AgentHistoryStore-CLidbOHG.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { $ as PermissionDeniedError, A as ApiKeyType, C as htmlFirstH1, Ct as obfuscateApiKey, Dt as signImageUrl, Et as secureParameters, G as LOCATION_MAP_LANGUAGE, Gt as WEBSITE_URL, It as withRetry, L as ChatModels, N as BedrockEmbeddingModel, Ot as splitEquals, S as htmlErrorTitle, Wt as APP_NAME, X as OllamaEmbeddingModel, Y as NotFoundError, Z as OpenAIEmbeddingModel, a as commandTextOf, b as SESSION_ID_PATTERN, bt as isRetryableError, c as writePathOf, ct as assertAuthOriginMatchesApiKey, gt as googleMapsSearchUrl, it as SupportedFabFileMimeTypes, mt as getMcpProviderMetadata, o as isReadOnlyTool, ot as VoyageAIEmbeddingModel, q as McpServerName, r as loadContextFiles, st as WORK_ITEM_STATUSES, tt as SEARCH_RESULT_CARDS_LANGUAGE, w as escapeArtifactBodyJson, x as isValidSessionId, y as logger, yt as isPlaceholderImageSigningSecret } from "./ConfigStore-v0wgf0_j.mjs";
+import { At as splitEquals, C as htmlErrorTitle, J as McpServerName, K as LOCATION_MAP_LANGUAGE, Kt as APP_NAME, Ot as secureParameters, P as BedrockEmbeddingModel, Q as OpenAIEmbeddingModel, R as ChatModels, Rt as withRetry, S as isValidSessionId, St as isRetryableError, T as escapeArtifactBodyJson, Tt as obfuscateApiKey, X as NotFoundError, Z as OllamaEmbeddingModel, a as commandTextOf, at as SupportedFabFileMimeTypes, b as logger, ct as VoyageAIEmbeddingModel, et as PermissionDeniedError, gt as getMcpProviderMetadata, j as ApiKeyType, kt as signImageUrl, l as writePathOf, lt as WORK_ITEM_STATUSES, nt as SEARCH_RESULT_CARDS_LANGUAGE, o as isReadOnlyTool, ot as UnprocessableEntityError, qt as WEBSITE_URL, r as loadContextFiles, s as sandboxedCommandArg, ut as assertAuthOriginMatchesApiKey, vt as googleMapsSearchUrl, w as htmlFirstH1, x as SESSION_ID_PATTERN, xt as isPlaceholderImageSigningSecret } from "./ConfigStore-DUATzLxB.mjs";
 import { n as isPathAllowed, t as assertPathAllowed } from "./pathValidation-BRqf4HFX-CHwtwp3O.mjs";
 import { n as isTerminalShellStatus, t as getShellSessionManager } from "./ShellSessionManager-6o8KZzl1-vrbPAUTq.mjs";
-import { n as B4mStreamEndedError, r as createClient, t as B4mApiError } from "./dist-5DDaX8tB.mjs";
+import { n as B4mStreamEndedError, r as createClient, t as B4mApiError } from "./dist-DPP7UmK9.mjs";
 import { createHash, randomBytes } from "crypto";
 import { existsSync, lstatSync, promises, readdirSync, realpathSync, rmSync, statSync } from "fs";
 import os, { homedir } from "os";
@@ -2363,7 +2363,7 @@ new Map([
 	...Object.values(OLLAMA_EMBEDDING_MODEL_MAP)
 ].map((info) => [info.model, info.dimensions[0]]));
 //#endregion
-//#region ../../b4m-core/services/dist/webfetch-D2pxGurU.mjs
+//#region ../../b4m-core/services/dist/webfetch-BDmPyiMm.mjs
 const htmlToMarkdown = (html, _isArxiv = false) => {
 	const turndownService = new turndown({
 		headingStyle: "atx",
@@ -2655,6 +2655,13 @@ function webFetchBody(result) {
 	if (result.extractedChars === 0 && result.offset > 0) return `[web_fetch: offset ${result.offset} is at or beyond the end of the content (~${result.originalChars} chars); nothing further to read.]`;
 	return result.truncated ? result.markdown + truncationMarker(result) : result.markdown;
 }
+/**
+* Leads an indexed turn's fetched page with the number the turn gave it (ToolContext.numberCitables).
+* A directive for the same reason as INDEXED_TOOL_CITATION_RULE.
+*/
+function webFetchCitationLine(citationIndex) {
+	return `This page is source [${citationIndex}]. Cite content from it ONLY as [${citationIndex}], placed immediately after the claim it supports.\n\n`;
+}
 function isPdfUrl(url) {
 	try {
 		const { pathname } = new URL(url);
@@ -2704,6 +2711,35 @@ async function probeLlmsTxt(pageUrl) {
 	return full ?? index;
 }
 /**
+* Firecrawl refused the target site itself (its 403 "we do not support this site"). A property of
+* the URL, not a fault of ours, so it is a 422: /api/tools/web-fetch logs it at warn instead of
+* paging, and the web_fetch tool turns it into a hint to use web_search. Only 403 - Firecrawl's
+* 401/402/429 are our key, credits or rate limit and must keep surfacing as server errors.
+*/
+var UnsupportedScrapeTargetError = class extends UnprocessableEntityError {
+	constructor(url, cause) {
+		super(`This site can't be fetched: the web scraper does not support ${new URL(url).hostname}.`);
+		this.name = "UnsupportedScrapeTargetError";
+		this.cause = cause;
+	}
+};
+/** Scrape after a 1s wait for client-side rendering, retrying without the action where Firecrawl rejects actions. */
+async function scrapeAfterRenderWait(app, url, params) {
+	try {
+		return await app.scrapeUrl(url, {
+			...params,
+			actions: [{
+				type: "wait",
+				milliseconds: 1e3
+			}]
+		});
+	} catch (scrapeError) {
+		if (!(scrapeError instanceof Error ? scrapeError.message : "").includes("Actions are not supported")) throw scrapeError;
+		Logger.globalInstance.log("📥 WebFetch Tool: Actions not supported, retrying without actions...");
+		return app.scrapeUrl(url, params);
+	}
+}
+/**
 * Fetch URL content using Firecrawl (shared function, no ToolContext)
 * Pattern follows serpApiSearch from websearch tool
 *
@@ -2742,20 +2778,11 @@ async function firecrawlFetch(adapters, url, options) {
 	};
 	const startedAt = Date.now();
 	let result;
-	if (isPdf) result = await app.scrapeUrl(url, baseParams);
-	else try {
-		result = await app.scrapeUrl(url, {
-			...baseParams,
-			actions: [{
-				type: "wait",
-				milliseconds: 1e3
-			}]
-		});
+	try {
+		result = isPdf ? await app.scrapeUrl(url, baseParams) : await scrapeAfterRenderWait(app, url, baseParams);
 	} catch (scrapeError) {
-		if ((scrapeError instanceof Error ? scrapeError.message : "").includes("Actions are not supported")) {
-			Logger.globalInstance.log("📥 WebFetch Tool: Actions not supported, retrying without actions...");
-			result = await app.scrapeUrl(url, baseParams);
-		} else throw scrapeError;
+		if (scrapeError instanceof FirecrawlError && scrapeError.statusCode === 403) throw new UnsupportedScrapeTargetError(url, scrapeError);
+		throw scrapeError;
 	}
 	const durationMs = Date.now() - startedAt;
 	if (!result || result.error) {
@@ -2830,19 +2857,27 @@ const webFetchTool = {
 						cap: result.cap
 					}
 				};
-				await context.statusUpdate({ promptMeta: { citables: [citable] } }, "WebFetch completed successfully");
+				const citationIndex = context.numberCitables?.([citable])?.[0].metadata?.citationIndex;
+				await context.statusUpdate({ promptMeta: { citables: [citationIndex === void 0 ? citable : {
+					...citable,
+					metadata: {
+						...citable.metadata,
+						citationIndex
+					}
+				}] } }, "WebFetch completed successfully");
 				Logger.globalInstance.log(`📚 WebFetch Tool: Stored citable source for ${params.url}`);
-				return webFetchBody(result);
+				return (citationIndex === void 0 ? "" : webFetchCitationLine(citationIndex)) + webFetchBody(result);
 			} catch (error) {
 				const errorMessage = error instanceof Error ? error.message : "Unknown error";
-				if (error instanceof FirecrawlError && [
+				const firecrawlStatus = error instanceof UnsupportedScrapeTargetError ? 403 : error instanceof FirecrawlError ? error.statusCode : void 0;
+				if (firecrawlStatus !== void 0 && [
 					400,
 					403,
 					408,
 					502,
 					503,
 					504
-				].includes(error.statusCode)) {
+				].includes(firecrawlStatus)) {
 					const { userMessage, statusLabel } = {
 						400: {
 							userMessage: `This site requires advanced browser features that are not available. Try using web_search to find the information instead.`,
@@ -2868,10 +2903,10 @@ const webFetchTool = {
 							userMessage: `The website took too long to respond (Gateway Timeout). Try again later or use web_search to find the information instead.`,
 							statusLabel: "gateway timeout"
 						}
-					}[error.statusCode];
+					}[firecrawlStatus];
 					context.logger.warn("WebFetch expected Firecrawl failure", {
 						url: params.url,
-						statusCode: error.statusCode,
+						statusCode: firecrawlStatus,
 						error: errorMessage
 					});
 					await context.statusUpdate({}, `WebFetch: ${statusLabel}`);
@@ -2987,7 +3022,16 @@ const WEB_SEARCH_MAP_PROMPT = [
 	"explanation or citations. Omit it only if none of the places actually answer the question."
 ].join("\n");
 //#endregion
-//#region ../../b4m-core/services/dist/websearch-Cak_rViw.mjs
+//#region ../../b4m-core/services/dist/websearch-Dm7iz09B.mjs
+/**
+* Shown to the model under tool results that carry the turn's shared numbers, so it cites them the
+* way forced retrieval's header asks it to cite the documents numbered before them. Keep it a directive:
+* on a tool-only turn there is no forced-retrieval header, and a purely descriptive label here was
+* tried and the model mostly stopped writing [N] markers at all.
+*/
+const INDEXED_TOOL_CITATION_RULE = "Cite each of these sources ONLY by the bracketed number it is labelled with, placed immediately after the claim it supports. These numbers continue the sources already numbered this turn.";
+/** Each stamped citable's number, keyed by citable id, for labelling results that point at it. */
+const citationNumbersById = (citables) => new Map(citables.flatMap((citable) => citable.metadata?.citationIndex === void 0 ? [] : [[citable.id, citable.metadata.citationIndex]]));
 /**
 * Per-process cache for web-search results. Keyed on normalized query + result count, with a
 * short TTL so repeated/similar searches within a turn or across back-to-back turns reuse the
@@ -3667,15 +3711,19 @@ function describePlace(place) {
 		place.address
 	].filter((part) => !!part).map(stripNewlines).join(" - ");
 }
-function formatPlaceResults(places, anchor) {
+function formatPlaceResults(places, anchor, citationNumbers) {
+	const numberOf = (place) => citationNumbers?.get(`place:${place.id}`);
 	return [
 		"Places found for this search (each has a map location; refer to it by its id):",
 		"",
-		...places.map((place, index) => `${index + 1}. ${describePlace(place)}\n   id: ${stripNewlines(place.id)}`),
+		...places.map((place, index) => {
+			const n = numberOf(place);
+			return `${n !== void 0 ? `[${n}]` : `${index + 1}.`} ${describePlace(place)}\n   id: ${stripNewlines(place.id)}`;
+		}),
 		...anchor ? [
 			"",
 			"Anchor location (the place the user named):",
-			`${describePlace(anchor)}\n   id: ${stripNewlines(anchor.id)}`
+			`${numberOf(anchor) !== void 0 ? `[${numberOf(anchor)}] ` : ""}${describePlace(anchor)}\n   id: ${stripNewlines(anchor.id)}`
 		] : []
 	].join("\n");
 }
@@ -3781,7 +3829,7 @@ async function searchWithHedge(lead, backup, query, numResults, searchOptions) {
 		throw new Error(`Web search failed on both providers. ${lead.name}: ${errorMessage$1(leadError)}; ${backup.name}: ${errorMessage$1(backupError)}`);
 	}
 }
-async function performWebSearch(adapters, params, imageUrlSigningSecret = "", resolvedProviders) {
+async function performWebSearch(adapters, params, imageUrlSigningSecret = "", resolvedProviders, numberCitables) {
 	Logger.globalInstance.log("🔍 WebSearch Tool: Starting search for query:", params.query);
 	const [provider, backup] = await (resolvedProviders ?? resolveWebSearchProviders(adapters));
 	if (!provider) {
@@ -3820,7 +3868,7 @@ async function performWebSearch(adapters, params, imageUrlSigningSecret = "", re
 		if (placeResults.length) Logger.globalInstance.log(`WebSearch Tool: ${servedBy.name} found ${placeResults.length} places`);
 		if (imageResults.length) Logger.globalInstance.log(`🖼️ WebSearch Tool: ${servedBy.name} found ${imageResults.length} images`);
 		const withImages = shouldIncludeImages(results, wantsImages, imageResults);
-		const citables = results.map((result, index) => ({
+		const unnumberedCitables = results.map((result, index) => ({
 			id: result.url,
 			type: "web_url",
 			title: result.title,
@@ -3838,15 +3886,18 @@ async function performWebSearch(adapters, params, imageUrlSigningSecret = "", re
 				} : {}
 			}
 		}));
-		if (withPlaces) for (const place of anchor ? [anchor, ...places] : places) citables.push(placeCitable(place, imageUrlSigningSecret, canSignImages));
+		if (withPlaces) for (const place of anchor ? [anchor, ...places] : places) unnumberedCitables.push(placeCitable(place, imageUrlSigningSecret, canSignImages));
+		const numberedCitables = numberCitables?.(unnumberedCitables);
+		const citables = numberedCitables ?? unnumberedCitables;
+		const resultLabel = (index) => numberedCitables ? `[${numberedCitables[index].metadata?.citationIndex}]` : `${index + 1}.`;
 		const formattedResults = results.map((result, index) => {
 			const imageLine = withImages && result.images?.length ? `Images: ${result.images.map((url) => signImageUrl(url, imageUrlSigningSecret)).join(" | ")}\n` : "";
-			return `${index + 1}. **${stripNewlines(result.title)}**\n${stripNewlines(result.snippet)}\n` + imageLine + `Source: [${safeHostname(result.url)}](${result.url})\n`;
+			return `${resultLabel(index)} **${stripNewlines(result.title)}**\n${stripNewlines(result.snippet)}\n` + imageLine + `Source: [${safeHostname(result.url)}](${result.url})\n`;
 		}).join("\n");
 		const imageSection = withImages && imageResults.length ? `\n${formatImageResults(imageResults, imageUrlSigningSecret)}\n` : "";
-		const placeSection = withPlaces ? `\n${formatPlaceResults(places, anchor)}\n` : "";
+		const placeSection = withPlaces ? `\n${formatPlaceResults(places, anchor, numberedCitables ? citationNumbersById(numberedCitables) : void 0)}\n` : "";
 		return {
-			formattedResults: (formattedResults ? `Here's what I found from searching the web:\n\n${formattedResults}` : imageSection || placeSection ? "Here's what I found from searching the web:\n" : "No results found from web search.") + imageSection + placeSection + (withImages ? `\n${WEB_SEARCH_CARDS_PROMPT}` : "") + (withPlaces ? `\n${WEB_SEARCH_MAP_PROMPT}` : ""),
+			formattedResults: (formattedResults ? `Here's what I found from searching the web:\n\n${formattedResults}` + (numberedCitables ? `\n${INDEXED_TOOL_CITATION_RULE}\n` : "") : imageSection || placeSection ? "Here's what I found from searching the web:\n" : "No results found from web search.") + imageSection + placeSection + (withImages ? `\n${WEB_SEARCH_CARDS_PROMPT}` : "") + (withPlaces ? `\n${WEB_SEARCH_MAP_PROMPT}` : ""),
 			citables
 		};
 	} catch (error) {
@@ -3869,7 +3920,7 @@ const webSearchTool = {
 					throw error;
 				});
 				const startedAt = Date.now();
-				const { formattedResults, citables } = await performWebSearch({ db: context.db }, params, config?.imageUrlSigningSecret, providersPromise);
+				const { formattedResults, citables } = await performWebSearch({ db: context.db }, params, config?.imageUrlSigningSecret, providersPromise, context.numberCitables);
 				context.logger.log("🔍 WebSearch Tool: search timing", {
 					callNumber,
 					query: params.query,
@@ -4130,7 +4181,7 @@ async function getModelForWrite(user, modelId, deps) {
 	return isModelOwner(model, user) ? model : null;
 }
 //#endregion
-//#region ../../b4m-core/services/dist/toolGenerators-BE8RB3Ga.mjs
+//#region ../../b4m-core/services/dist/toolGenerators-BVxSjEv_.mjs
 const diceRoll = async (parameters) => {
 	if (!parameters?.sides || !parameters?.times) throw new Error("Tool dice roll: Missing required parameters");
 	return sum(times(parameters.times, () => random(1, parameters.sides))).toString();
@@ -4844,7 +4895,7 @@ const askUserQuestionTool = {
 * re-export them without pulling the full tool graph. `index.ts` re-exports them
 * so the server barrel's public API is unchanged.
 */
-const generateTools = (userId, user, logger, { db, retrievalFilter, kbScope, inlinedAttachmentIds, attachedFileIds, fullyInlinedAttachmentIds, suppressLakeArms, sessionRetrievalTags, sessionReaderConsentDatalakeTags, sessionLakeScopeExplicit, sessionIncludeLibraryFiles, sessionPreauthorizedLakeIds, organizationId, authOrigin, apiKeyId, questId, getAbortSignal }, storage, imageGenerateStorage, statusUpdate, onStart, onFinish, llm, config, model, imageProcessorLambdaName, tools, allowedDirectories, entitlementKeys = [], sessionId, codeMinifier, availableModels, onToolLlmUsage) => {
+const generateTools = (userId, user, logger, { db, retrievalFilter, kbScope, inlinedAttachmentIds, attachedFileIds, fullyInlinedAttachmentIds, suppressLakeArms, sessionRetrievalTags, sessionReaderConsentDatalakeTags, sessionLakeScopeExplicit, sessionIncludeLibraryFiles, sessionPreauthorizedLakeIds, organizationId, authOrigin, apiKeyId, questId, numberCitables, getAbortSignal }, storage, imageGenerateStorage, statusUpdate, onStart, onFinish, llm, config, model, imageProcessorLambdaName, tools, allowedDirectories, entitlementKeys = [], sessionId, codeMinifier, availableModels, onToolLlmUsage) => {
 	assertAuthOriginMatchesApiKey(authOrigin, apiKeyId);
 	const context = {
 		userId,
@@ -4880,7 +4931,8 @@ const generateTools = (userId, user, logger, { db, retrievalFilter, kbScope, inl
 		codeMinifier,
 		availableModels,
 		onToolLlmUsage,
-		getAbortSignal
+		getAbortSignal,
+		numberCitables
 	};
 	return Object.entries(tools).reduce((acc, [key, tool]) => {
 		const built = tool.implementation(context, config[key]);
@@ -7868,9 +7920,16 @@ const DEFAULT_PAGE_LIMIT = 100;
 var RemoteSkillSource = class {
 	constructor(apiClient, options = {}) {
 		this.apiClient = apiClient;
+		this.forceNext = false;
 		this.cacheFilePath = options.cacheFilePath ?? path.join(os.homedir(), ".bike4mind", "cache", "remote-skills.json");
 		this.freshTtlMs = options.freshTtlMs ?? DEFAULT_FRESH_TTL_MS;
 		this.pageLimit = options.pageLimit ?? DEFAULT_PAGE_LIMIT;
+		this.includeImports = options.includeImports ?? false;
+	}
+	/** Make the next `fetchSkills` go to the network even inside the TTL. The cache stays as the
+	*  offline fallback. For a host that just changed the account's skills itself. */
+	invalidate() {
+		this.forceNext = true;
 	}
 	/**
 	* Returns the user's remote skills mapped to `CustomCommand`. Uses an
@@ -7879,7 +7938,9 @@ var RemoteSkillSource = class {
 	*/
 	async fetchSkills() {
 		const cached = await this.readCache();
-		if (cached && this.isFresh(cached)) return this.mapAndFilter(cached.skills);
+		const forced = this.forceNext;
+		this.forceNext = false;
+		if (cached && !forced && this.isFresh(cached)) return this.mapAndFilter(cached.skills);
 		try {
 			const skills = (await this.apiClient.get(`/api/skills?limit=${this.pageLimit}`))?.data ?? [];
 			if (skills.length > 0 || !cached || cached.skills.length === 0) await this.writeCache({
@@ -7901,6 +7962,7 @@ var RemoteSkillSource = class {
 	*   only visible cross-account via `isGlobalRead`, and
 	* - a Skill Market import: the user owns the copy but someone else wrote it, and local commands run
 	*   as trusted instructions next to shell/file tools (the web app wraps it as untrusted instead).
+	*   With `includeImports` it is kept as `untrusted: true`, for a host that wraps it the same way.
 	* Own, system (no `userId`), and org-scoped (server-gated, no `userId`) skills pass.
 	*
 	* Unauthenticated contract (fail-closed, intentional): when getCurrentUser()
@@ -7914,7 +7976,7 @@ var RemoteSkillSource = class {
 		return skills.filter((skill) => {
 			if (isReservedCommandName(skill.name)) return false;
 			if (skill.userId && skill.userId !== currentUserId) return false;
-			if (skill.importedFrom) return false;
+			if (skill.importedFrom && !this.includeImports) return false;
 			return true;
 		}).map((skill) => this.toCustomCommand(skill));
 	}
@@ -7965,6 +8027,7 @@ var RemoteSkillSource = class {
 			argumentHint: skill.argumentHint,
 			allowedTools: skill.allowedTools,
 			disableModelInvocation: skill.disableModelInvocation,
+			...skill.importedFrom ? { untrusted: true } : {},
 			source: "remote",
 			filePath: `b4m:/api/skills/${skill.id}`
 		};
@@ -11427,12 +11490,15 @@ z$1.object({
 //#endregion
 //#region src/tools/gateway/stages/sandbox.ts
 /**
-* Decide whether a bash_execute call runs inside the OS sandbox, and rewrite its args to do so.
-* Any other tool, or a call with no command or no orchestrator, is left unchanged.
+* Decide whether a call runs inside the OS sandbox, and rewrite its args to do so. Only a tool
+* whose descriptor declares `sandbox` is wrapped; any other tool, or a call with no command or
+* no orchestrator, is left unchanged.
 */
-function prepareSandbox(toolName, args, sandboxOrchestrator, allowedDirectories) {
-	if (toolName !== "bash_execute" || !args?.command || !sandboxOrchestrator) return { kind: "unchanged" };
-	const command = args.command;
+function prepareSandbox(descriptor, args, sandboxOrchestrator, allowedDirectories) {
+	const commandArg = sandboxedCommandArg(descriptor);
+	if (!commandArg || !args || !sandboxOrchestrator) return { kind: "unchanged" };
+	const command = args[commandArg];
+	if (typeof command !== "string" || !command) return { kind: "unchanged" };
 	let cwd = args.cwd ? path.resolve(process.cwd(), args.cwd) : process.cwd();
 	try {
 		cwd = realpathSync(cwd);
@@ -11451,15 +11517,13 @@ function prepareSandbox(toolName, args, sandboxOrchestrator, allowedDirectories)
 			};
 		}
 		sandboxOrchestrator.recordSandboxed();
-		const cleanupPaths = decision.wrappedCommand.cleanupPaths;
 		return {
 			kind: "sandboxed",
-			cleanupPaths,
+			cleanupPaths: decision.wrappedCommand.cleanupPaths,
 			args: {
 				...args,
 				cwd,
-				command: decision.wrappedCommand.commandString,
-				_sandboxCleanup: cleanupPaths
+				[commandArg]: decision.wrappedCommand.commandString
 			}
 		};
 	}
@@ -11493,23 +11557,6 @@ function cleanupSandboxFiles(paths) {
 	} catch {}
 }
 /**
-* Detect whether a tool result indicates a sandbox-specific runtime failure
-* worth offering an unsandboxed retry for. Matches the sandbox markers
-* (`sandbox-exec:`, `bwrap:`) AND a bare "Operation not permitted": on macOS a
-* real Seatbelt denial is the denied syscall's own EPERM, printed by the tool
-* that hit it with NO `sandbox-exec:` prefix (that prefix only appears when the
-* profile fails to load) - a write denial reads `touch: <path>: Operation not
-* permitted`, and a blocked connect surfaces the same EPERM. Matching only the
-* markers would never fire for those, silently dropping the recovery offer and
-* the `/sandbox:network on` tip. The known false positive (e.g. `kill` on a
-* foreign pid) is accepted: it only costs a deniable retry prompt, whereas a
-* false negative removes the recovery path entirely.
-*/
-function isSandboxFailure(isSandboxed, result) {
-	if (!isSandboxed) return false;
-	return result.includes("sandbox-exec:") || result.includes("bwrap:") || result.includes("Operation not permitted");
-}
-/**
 * Parse sandbox runtime stderr for violations and record them.
 * Fire-and-forget - errors are silently swallowed.
 */
@@ -13045,25 +13092,119 @@ function getProcessHooks() {
 	return cached;
 }
 //#endregion
+//#region src/tools/gateway/stages/sandboxEscalation.ts
+const SNIPPET_LENGTH = 200;
+const EXIT_CODE_LINE = /^Exit code:\s*(-?\d+)\s*$/gm;
+const LAUNCHER_MARKER = /^(?:sandbox-exec|bwrap):/m;
+const EPERM_TEXT = "Operation not permitted";
+const NETWORK_TIP = "If this was a network call, prefer '/sandbox:network on' to allow filtered egress.";
+/**
+* Detect a sandbox denial in a tool result. Both evidence kinds - a launcher marker
+* (`sandbox-exec:`, `bwrap:` at the start of a line) and the EPERM text a Seatbelt denial
+* surfaces on macOS - require a non-zero exit: a command that printed either and still exited
+* 0 (e.g. a tolerated `kill`, or output that merely quotes the launcher) was not stopped.
+*/
+function detectSandboxDenial(sandboxed, result) {
+	if (!sandboxed || !exitedNonZero(result)) return null;
+	const marker = LAUNCHER_MARKER.exec(result);
+	if (marker) return {
+		reason: "launcher",
+		snippet: snippetAt(result, marker.index)
+	};
+	const epermIndex = result.indexOf(EPERM_TEXT);
+	if (epermIndex === -1) return null;
+	return {
+		reason: "eperm",
+		snippet: snippetAt(result, epermIndex)
+	};
+}
+/**
+* The tool's exit code is non-zero. The last "Exit code:" line is the tool's own (the command
+* may have printed earlier ones); a command that ends its own output with such a line can still
+* be mistaken for a failure, which costs an extra question, never a silent unsandboxed run.
+*/
+function exitedNonZero(result) {
+	const exitCodes = [...result.matchAll(EXIT_CODE_LINE)];
+	const exitCode = exitCodes[exitCodes.length - 1]?.[1];
+	return exitCode !== void 0 && Number(exitCode) !== 0;
+}
+/** The error text from the start of the line holding `index`, so long stdout never hides it. */
+function snippetAt(result, index) {
+	const lineStart = result.lastIndexOf("\n", index) + 1;
+	return result.slice(lineStart, lineStart + SNIPPET_LENGTH);
+}
+/** A bash session (background, or promoted after yield_time_ms) may still be running. */
+function isSessionRun(args) {
+	return args.run_in_background === true || typeof args.yield_time_ms === "number";
+}
+/**
+* The sandbox stage of execution: run the attempt, record violations, and if the OS sandbox
+* denied it, ask before retrying outside the sandbox. The question is its own prompt: auto-accept,
+* session trust, trusted tools and the host allowlist never approve it, and when nobody can
+* answer, the model gets the sandbox error back. Session runs (background or yield_time_ms) are
+* never escalated: the sandboxed process may still be running.
+*/
+async function runSandboxed(input) {
+	const { descriptor, rawArgs, execArgs, isSandboxed, attempt, permissionManager, sandboxOrchestrator } = input;
+	const result = await attempt(execArgs);
+	await captureViolations(isSandboxed, result, commandTextOf(descriptor, rawArgs), sandboxOrchestrator);
+	const commandArg = sandboxedCommandArg(descriptor);
+	const command = commandTextOf(descriptor, rawArgs);
+	if (!commandArg || command === void 0 || isSessionRun(execArgs)) return result;
+	const denial = detectSandboxDenial(isSandboxed, result);
+	if (!denial) return result;
+	if (sandboxOrchestrator?.getConfig().allowUnsandboxedCommands === false) return `${result}\n\nThe command was denied by the OS sandbox and running it outside the sandbox is disabled. ${NETWORK_TIP}`;
+	const cwd = typeof execArgs.cwd === "string" ? execArgs.cwd : process.cwd();
+	const isHighRisk = assessCommandRisk(descriptor, rawArgs)?.level === "high";
+	const approvalKey = JSON.stringify([cwd, command]);
+	if (isHighRisk || !permissionManager.isSandboxEscalationApproved(approvalKey)) {
+		const response = await input.showPermissionPrompt(input.toolName, rawArgs, escalationPreview(denial, isHighRisk), "sandbox-escalation");
+		if (response.action === "deny") return `${result}\n\n${NETWORK_TIP}`;
+		if (response.action === "allow-session" && !isHighRisk) permissionManager.approveSandboxEscalation(approvalKey);
+	}
+	sandboxOrchestrator?.recordUnsandboxed();
+	return attempt({
+		...execArgs,
+		[commandArg]: command,
+		cwd
+	});
+}
+function escalationPreview(denial, isHighRisk) {
+	return `🛑 SANDBOX BLOCKED - This command was denied by the OS sandbox.
+
+- The sandbox prevented this operation because it violates filesystem or network restrictions.
+- ${NETWORK_TIP}\n- You can retry without the sandbox, but the command will run with full system access.\n` + (isHighRisk ? `- This command is high risk, so a session approval is not remembered: you will be asked again.\n` : "") + `\n@@Error Details@@\n${denial.snippet}`;
+}
+//#endregion
 //#region src/tools/gateway/stages/execution.ts
 /**
-* Run an approved call: checkpoint, execute (ToolRouter redacts and caps the output), capture
-* sandbox violations, offer retry on a sandbox failure or a path denial, then fire the
-* post-tool signals.
+* Run an approved call: checkpoint, execute through the sandbox stage (ToolRouter redacts and
+* caps the output; a sandbox denial asks before retrying unsandboxed), offer retry on a path
+* denial, then fire the post-tool signals.
 */
 async function executeAndRecord(input) {
 	const { toolName, descriptor, rawArgs, execArgs, isSandboxed, originalFn, apiClient, showPermissionPrompt } = input;
 	await checkpointBeforeWrite(input.checkpointStore, toolName, writePathOf(descriptor, rawArgs));
-	let result;
-	try {
-		result = await executeWithFuzzyConfirmation(toolName, execArgs, apiClient, originalFn, showPermissionPrompt);
-	} catch (err) {
-		const msg = err instanceof Error ? err.message : String(err);
-		if (!isPathAccessDenial(msg)) throw err;
-		result = msg;
-	}
-	await captureViolations(isSandboxed, result, rawArgs?.command, input.sandboxOrchestrator);
-	result = await retrySandboxFailure(isSandboxed, result, toolName, rawArgs, apiClient, originalFn, showPermissionPrompt);
+	const attempt = async (args) => {
+		try {
+			return await executeWithFuzzyConfirmation(toolName, args, apiClient, originalFn, showPermissionPrompt);
+		} catch (err) {
+			const msg = err instanceof Error ? err.message : String(err);
+			if (!isPathAccessDenial(msg)) throw err;
+			return msg;
+		}
+	};
+	let result = await runSandboxed({
+		toolName,
+		descriptor,
+		rawArgs,
+		execArgs,
+		isSandboxed,
+		attempt,
+		permissionManager: input.permissionManager,
+		showPermissionPrompt,
+		sandboxOrchestrator: input.sandboxOrchestrator
+	});
 	result = await retryPathAccessDenial(result, toolName, execArgs, input.allowedDirectories, input.configStore, apiClient, originalFn, showPermissionPrompt);
 	notifyFileChanged(input.agentContext, writePathOf(descriptor, execArgs), result);
 	getProcessHooks()?.firePostToolUse(toolName);
@@ -13087,21 +13228,6 @@ function notifyFileChanged(agentContext, writePath, result) {
 	agentContext.onFileChanged(writePath);
 }
 /**
-* If the result looks like a sandbox runtime failure, prompt the user to retry
-* the command unsandboxed. Returns the retry result or the original result.
-*/
-async function retrySandboxFailure(isSandboxed, result, toolName, originalArgs, apiClient, originalFn, showPermissionPrompt) {
-	if (!isSandboxFailure(isSandboxed, result)) return result;
-	if ((await showPermissionPrompt(toolName, originalArgs, `🛑 SANDBOX BLOCKED - This command was denied by the OS sandbox.
-
-- The sandbox prevented this operation because it violates filesystem or network restrictions.
-- If this was a network call, prefer '/sandbox:network on' to allow filtered egress instead of full access.
-- You can retry without the sandbox, but the command will run with full system access.
-
-@@Error Details@@\n${result.slice(0, 200)}`)).action !== "deny") return executeTool(toolName, originalArgs, apiClient, originalFn);
-	return result;
-}
-/**
 * Matches the three shapes of filesystem allow-list denial emitted by core:
 *  - file tools:  `Access denied: Cannot <op> files outside allowed directories.`
 *  - glob_files:  `Access denied: Cannot search outside allowed directories.` (no "files")
@@ -13194,7 +13320,7 @@ function wrapToolWithPermission(tool, deps) {
 		toolFn: async (input) => {
 			const args = input;
 			const descriptor = permissionManager.catalog.resolve(toolName);
-			const sandbox = prepareSandbox(toolName, args, deps.sandboxOrchestrator, allowedDirectories);
+			const sandbox = prepareSandbox(descriptor, args, deps.sandboxOrchestrator, allowedDirectories);
 			if (sandbox.kind === "blocked") return sandbox.message;
 			const isSandboxed = sandbox.kind === "sandboxed";
 			const effectiveArgs = isSandboxed ? sandbox.args : args;
@@ -13209,6 +13335,7 @@ function wrapToolWithPermission(tool, deps) {
 				originalFn,
 				apiClient: deps.apiClient,
 				showPermissionPrompt,
+				permissionManager,
 				agentContext: deps.agentContext,
 				configStore: deps.configStore,
 				sandboxOrchestrator: deps.sandboxOrchestrator,
@@ -14195,6 +14322,7 @@ var PermissionManager = class {
 		this.deniedTools = /* @__PURE__ */ new Set();
 		this._sandboxMode = "disabled";
 		this._sandboxActive = false;
+		this.sandboxEscalationApprovals = /* @__PURE__ */ new Set();
 		this.trustedTools = new Set(trustedTools);
 		this.deniedTools = new Set(deniedTools);
 	}
@@ -14220,14 +14348,14 @@ var PermissionManager = class {
 	*
 	* @param toolName - The tool being checked
 	* @param options.isSandboxed - If true, the command will run inside the OS-level sandbox.
-	*   In auto-allow mode, sandboxed bash_execute commands skip the permission prompt
+	*   In auto-allow mode, sandboxed commands (a core tool whose descriptor declares `sandbox`) skip the permission prompt
 	*   because the sandbox provides the security boundary.
 	*/
 	needsPermission(toolName, options) {
 		const category = this.catalog.category(toolName);
 		if (this.deniedTools.has(toolName)) return true;
 		if (category === "auto_approve") return false;
-		if (options?.isSandboxed && toolName === "bash_execute" && this.isSandboxAutoAllow()) return false;
+		if (options?.isSandboxed && sandboxedCommandArg(this.catalog.resolve(toolName)) !== void 0 && this.isSandboxAutoAllow()) return false;
 		if (this.sessionTrustedTools.has(toolName)) return false;
 		if (category === "prompt_always") return true;
 		return !this.trustedTools.has(toolName);
@@ -14300,11 +14428,19 @@ var PermissionManager = class {
 	isSessionTrusted(toolName) {
 		return this.sessionTrustedTools.has(toolName);
 	}
+	/** Remember a session-scoped approval to run one command outside the sandbox. Never persisted. */
+	approveSandboxEscalation(key) {
+		this.sandboxEscalationApprovals.add(key);
+	}
+	isSandboxEscalationApproved(key) {
+		return this.sandboxEscalationApprovals.has(key);
+	}
 	/**
 	* Clear all session-scoped trust (called on exit or session reset)
 	*/
 	clearSessionTrust() {
 		this.sessionTrustedTools.clear();
+		this.sandboxEscalationApprovals.clear();
 	}
 	/**
 	* Clear all trusted tools