@bike4mind/cli 3.2.0 → 3.3.0

package/dist/{WorkItemsClient-BZL44N12.mjs → WorkItemsClient-BSoOblGp.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { Mt as tokenEstimateMultiplier } from "./ConfigStore-v0wgf0_j.mjs";
+import { Pt as tokenEstimateMultiplier } from "./ConfigStore-DUATzLxB.mjs";
 import { v4 } from "uuid";
 import { get_encoding } from "tiktoken";
 //#region ../../b4m-core/utils/dist/calibratedTokenizer.mjs

package/dist/{buildAgent-BZnmDQIr.mjs → buildAgent-DyZWK0LW.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { F as generateCliTools, G as setWebSocketToolExecutor, J as DeferredToolRegistry, U as wrapTools, V as buildSystemPrompt, Y as ReActAgent, a as loadProjectContext, c as createSseBackend, i as buildProjectAgentStore, l as ServerLlmBackend, n as BackgroundAgentManager, o as McpManager, q as getPlanModeFilePath, r as SubagentOrchestrator, t as AgentHistoryStore, ut as Logger } from "./AgentHistoryStore-BWko6txx.mjs";
-import { $ as PermissionDeniedError, At as stripToolArtifactMarkup, F as CONTEXT_WINDOW_SAFETY_BUFFER_TOKENS, J as ModelBackend, K as MODEL_INFO_FIELD_GROUP_OF, L as ChatModels, O as ARTIFACT_DELIVERED_PLACEHOLDER, R as CompletionReasoningEffortSchema, _t as hasDeliverablePinnedArtifact, dt as escapeThinkMarkers, ft as filterToolArtifactMarkup, ht as getQuestErrorCode, k as ARTIFACT_REMOVED_PLACEHOLDER, kt as stripDeliveredArtifactBlocks, ut as createThinkMarkerEscaper, xt as isUserInitiatedAbort, y as logger } from "./ConfigStore-v0wgf0_j.mjs";
+import { F as generateCliTools, G as setWebSocketToolExecutor, J as DeferredToolRegistry, U as wrapTools, V as buildSystemPrompt, Y as ReActAgent, a as loadProjectContext, c as createSseBackend, i as buildProjectAgentStore, l as ServerLlmBackend, n as BackgroundAgentManager, o as McpManager, q as getPlanModeFilePath, r as SubagentOrchestrator, t as AgentHistoryStore, ut as Logger } from "./AgentHistoryStore-CLidbOHG.mjs";
+import { A as ARTIFACT_REMOVED_PLACEHOLDER, Ct as isUserInitiatedAbort, I as CONTEXT_WINDOW_SAFETY_BUFFER_TOKENS, Mt as stripToolArtifactMarkup, R as ChatModels, Y as ModelBackend, _t as getQuestErrorCode, b as logger, et as PermissionDeniedError, ft as createThinkMarkerEscaper, jt as stripDeliveredArtifactBlocks, k as ARTIFACT_DELIVERED_PLACEHOLDER, mt as filterToolArtifactMarkup, pt as escapeThinkMarkers, q as MODEL_INFO_FIELD_GROUP_OF, yt as hasDeliverablePinnedArtifact, z as CompletionReasoningEffortSchema } from "./ConfigStore-DUATzLxB.mjs";
 import "crypto";
 import { v4 } from "uuid";
 import "axios";
@@ -366,7 +366,8 @@ var AnthropicCachingAdapter = class {
 		const messagesParam = modifiedParams.messages;
 		if (strategy.cacheConversationHistory && Array.isArray(messagesParam) && messagesParam.length > 0) {
 			const messages = [...messagesParam];
-			const anchorIndex = messages.length - 1 - (strategy.historyCacheExcludeTrailingCount ?? 0);
+			let anchorIndex = messages.length - 1 - (strategy.historyCacheExcludeTrailingCount ?? 0);
+			while (anchorIndex >= 0 && messages[anchorIndex].role === "system") anchorIndex--;
 			if (anchorIndex >= 0) {
 				const anchorMsg = messages[anchorIndex];
 				const msgContent = anchorMsg.content;
@@ -669,6 +670,7 @@ var NoOpCachingAdapter = class {
 ModelBackend.Anthropic, new AnthropicCachingAdapter(), ModelBackend.OpenAI, new OpenAICachingAdapter(), ModelBackend.Gemini, new GeminiCachingAdapter(), ModelBackend.Bedrock, new AnthropicCachingAdapter(), ModelBackend.XAI, new XAICachingAdapter(), ModelBackend.Kimi, new KimiCachingAdapter(), ModelBackend.DeepSeek, new DeepSeekCachingAdapter(), ModelBackend.Ollama, new NoOpCachingAdapter(), ModelBackend.BFL, new NoOpCachingAdapter(), ModelBackend.VoyageAI, new NoOpCachingAdapter(), ModelBackend.AWS, new NoOpCachingAdapter(), ModelBackend.LocalImage, new NoOpCachingAdapter();
 ChatModels.KIMI_K2_THINKING_BEDROCK, ChatModels.KIMI_K2_5_BEDROCK, ChatModels.DEEPSEEK_R1_BEDROCK, ChatModels.DEEPSEEK_FLASH, ChatModels.DEEPSEEK_V4_PRO, ChatModels.KIMI_K3;
 ChatModels.CLAUDE_4_7_OPUS, ChatModels.CLAUDE_4_7_OPUS_BEDROCK, ChatModels.CLAUDE_4_8_OPUS, ChatModels.CLAUDE_4_8_OPUS_BEDROCK, ChatModels.CLAUDE_5_SONNET, ChatModels.CLAUDE_5_SONNET_BEDROCK, ChatModels.CLAUDE_5_OPUS, ChatModels.CLAUDE_5_OPUS_BEDROCK, ChatModels.CLAUDE_5_5_HAIKU, ChatModels.CLAUDE_5_5_HAIKU_BEDROCK, ChatModels.CLAUDE_5_5_SONNET_BEDROCK;
+ChatModels.CLAUDE_5_SONNET, ChatModels.CLAUDE_5_SONNET_BEDROCK, ChatModels.CLAUDE_5_5_SONNET_BEDROCK, ChatModels.CLAUDE_FABLE_5, ChatModels.CLAUDE_FABLE_5_BEDROCK, ChatModels.CLAUDE_FABLE_5_1_BEDROCK, ChatModels.CLAUDE_5_OPUS, ChatModels.CLAUDE_5_OPUS_BEDROCK, ChatModels.CLAUDE_5_5_OPUS, ChatModels.CLAUDE_5_5_OPUS_BEDROCK, ChatModels.CLAUDE_5_5_HAIKU, ChatModels.CLAUDE_5_5_HAIKU_BEDROCK;
 new Logger();
 ChatModels.CLAUDE_4_5_SONNET, ChatModels.CLAUDE_4_1_OPUS, ChatModels.CLAUDE_4_5_HAIKU, ChatModels.CLAUDE_4_5_OPUS, ChatModels.CLAUDE_4_6_SONNET, ChatModels.CLAUDE_4_6_OPUS;
 ChatModels.CLAUDE_4_5_SONNET_BEDROCK, ChatModels.CLAUDE_4_5_HAIKU_BEDROCK, ChatModels.CLAUDE_4_5_OPUS_BEDROCK, ChatModels.CLAUDE_4_6_SONNET_BEDROCK, ChatModels.CLAUDE_4_6_OPUS_BEDROCK;
@@ -757,6 +759,19 @@ ChatModels.KIMI_K2_7_CODE, ChatModels.KIMI_K2_7_CODE_HIGHSPEED, ChatModels.KIMI_
 ChatModels.KIMI_K2_7_CODE, ChatModels.KIMI_K2_7_CODE_HIGHSPEED;
 ChatModels.KIMI_K2_7_CODE, ChatModels.KIMI_K2_7_CODE_HIGHSPEED, ChatModels.KIMI_K2_6;
 ChatModels.KIMI_K3, ChatModels.KIMI_K2_7_CODE, ChatModels.KIMI_K2_7_CODE_HIGHSPEED, ChatModels.KIMI_K2_6, ChatModels.KIMI_K2_5;
+/**
+* Ollama's native /api/chat requires tool-call arguments as an object and rejects a JSON string
+* with a 400. Unparseable or non-object input is kept under `_raw` rather than dropped.
+*/
+function toOllamaToolArguments(args) {
+	if (args !== null && typeof args === "object" && !Array.isArray(args)) return args;
+	if (typeof args !== "string" || args.trim() === "") return {};
+	try {
+		const parsed = JSON.parse(args);
+		if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) return parsed;
+	} catch {}
+	return { _raw: args };
+}
 var OllamaBackend = class OllamaBackend {
 	_host;
 	_api;
@@ -1298,18 +1313,12 @@ var OllamaBackend = class OllamaBackend {
 		};
 	}
 	pushToolMessages(messages, tool, result, _thinkingBlocks) {
-		let argumentsObj;
-		try {
-			argumentsObj = JSON.parse(tool.parameters);
-		} catch {
-			argumentsObj = { _raw: tool.parameters };
-		}
 		messages.push({
 			content: "",
 			role: "assistant",
 			tool_calls: [{ function: {
 				name: tool.name,
-				arguments: argumentsObj
+				arguments: toOllamaToolArguments(tool.parameters)
 			} }]
 		});
 		messages.push({
@@ -1361,7 +1370,13 @@ var OllamaBackend = class OllamaBackend {
 				mapped.content = texts.join("\n");
 				if (images.length > 0) mapped.images = images;
 			} else mapped.content = msg.content != null ? String(msg.content) : "";
-			if (Array.isArray(raw.tool_calls)) mapped.tool_calls = raw.tool_calls;
+			if (Array.isArray(raw.tool_calls)) mapped.tool_calls = raw.tool_calls.map((call) => ({
+				...call,
+				function: {
+					...call.function,
+					arguments: toOllamaToolArguments(call.function?.arguments)
+				}
+			}));
 			if (typeof raw.tool_name === "string") mapped.tool_name = raw.tool_name;
 			return mapped;
 		});
@@ -1383,7 +1398,7 @@ ChatModels.O1_PREVIEW, ChatModels.O1_MINI, ChatModels.O1, ChatModels.O3_MINI, Ch
 ChatModels.GPT5, ChatModels.GPT5_MINI, ChatModels.GPT5_NANO, ChatModels.GPT5_CHAT_LATEST;
 ChatModels.GPT5_1, ChatModels.GPT5_1_CHAT_LATEST;
 ChatModels.GPT5_2, ChatModels.GPT5_2_CHAT_LATEST;
-ChatModels.GPT5_4, ChatModels.GPT5_4_MINI, ChatModels.GPT5_4_NANO;
+ChatModels.GPT5_4, ChatModels.GPT5_4_MINI, ChatModels.GPT5_4_MINI_2026_03_17, ChatModels.GPT5_4_NANO;
 ChatModels.GPT5_5;
 ChatModels.GPT5_6_SOL, ChatModels.GPT5_6_LUNA, ChatModels.GPT5_6_TERRA;
 ModelBackend.Bedrock, ModelBackend.AWS, ModelBackend.OpenAI, ModelBackend.Anthropic, ModelBackend.Gemini, ModelBackend.Ollama, ModelBackend.BFL, ModelBackend.XAI, ModelBackend.Kimi, ModelBackend.DeepSeek, ModelBackend.LocalImage, ModelBackend.VoyageAI;

package/dist/commands/acpCommand.mjs

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { $ as CustomCommandStore, A as createAgentDelegateTool, C as createTodoStore, D as createCoordinateTaskTool, G as setWebSocketToolExecutor, N as PermissionManager, O as createResumeAgentTool, P as buildCliToolList, Q as RemoteSkillSource, S as createFindDefinitionTool, T as createSkillTool, X as createToolSearchTool, b as createGetFileStructureTool, j as FallbackLlmBackend, k as createBackgroundAgentTools, nt as CheckpointStore, rt as SessionStore, s as buildSandbox, w as createWriteTodosTool } from "../AgentHistoryStore-BWko6txx.mjs";
-import { f as requireApiUrl, i as ToolCatalog, t as ConfigStore, y as logger } from "../ConfigStore-v0wgf0_j.mjs";
-import { a as NotifyingLlmBackend, i as deferredToolRegistry, n as buildSupportingStores, r as buildLlmBackend, t as buildAgent } from "../buildAgent-BZnmDQIr.mjs";
-import { a as ApiClient } from "../dist-5DDaX8tB.mjs";
+import { $ as CustomCommandStore, A as createAgentDelegateTool, C as createTodoStore, D as createCoordinateTaskTool, G as setWebSocketToolExecutor, N as PermissionManager, O as createResumeAgentTool, P as buildCliToolList, Q as RemoteSkillSource, S as createFindDefinitionTool, T as createSkillTool, X as createToolSearchTool, b as createGetFileStructureTool, j as FallbackLlmBackend, k as createBackgroundAgentTools, nt as CheckpointStore, rt as SessionStore, s as buildSandbox, w as createWriteTodosTool } from "../AgentHistoryStore-CLidbOHG.mjs";
+import { b as logger, i as ToolCatalog, p as requireApiUrl, t as ConfigStore } from "../ConfigStore-DUATzLxB.mjs";
+import { a as NotifyingLlmBackend, i as deferredToolRegistry, n as buildSupportingStores, r as buildLlmBackend, t as buildAgent } from "../buildAgent-DyZWK0LW.mjs";
+import { a as ApiClient } from "../dist-DPP7UmK9.mjs";
 import { randomUUID } from "crypto";
 import { existsSync, realpathSync, statSync } from "fs";
 import { isAbsolute } from "path";
@@ -92,18 +92,19 @@ function truncate(text, max) {
 const PERMISSION_OPTION_ALLOW_ONCE = "allow-once";
 const PERMISSION_OPTION_ALLOW_ALWAYS = "allow-always";
 const PERMISSION_OPTION_REJECT = "deny";
-function buildPermissionOptions() {
+function buildPermissionOptions(options = {}) {
+	const { allowAlways = true } = options;
 	return [
 		{
 			optionId: PERMISSION_OPTION_ALLOW_ONCE,
 			name: "Allow once",
 			kind: "allow_once"
 		},
-		{
+		...allowAlways ? [{
 			optionId: PERMISSION_OPTION_ALLOW_ALWAYS,
 			name: "Always allow",
 			kind: "allow_always"
-		},
+		}] : [],
 		{
 			optionId: PERMISSION_OPTION_REJECT,
 			name: "Reject",
@@ -271,12 +272,13 @@ var AcpServer = class {
 		this.stackPromise = null;
 		this.stack = null;
 		this.activeTurn = null;
-		this.promptFn = async (toolName, args, preview) => {
+		this.promptFn = async (toolName, args, preview, kind) => {
+			const isSandboxEscalation = kind === "sandbox-escalation";
 			const turn = this.activeTurn;
 			if (!turn) return { action: "deny" };
 			const toolCall = {
 				toolCallId: `perm-${randomUUID()}`,
-				title: toolCallTitle(toolName, args),
+				title: `${isSandboxEscalation ? "Run outside sandbox: " : ""}${toolCallTitle(toolName, args)}`,
 				kind: toolKind(toolName),
 				status: "pending",
 				rawInput: args,
@@ -294,13 +296,15 @@ var AcpServer = class {
 			turn.signal.addEventListener("abort", onClose);
 			this.connectionSignal.addEventListener("abort", onClose);
 			try {
-				return { action: await Promise.race([turn.client.request(methods.client.session.requestPermission, {
+				const action = await Promise.race([turn.client.request(methods.client.session.requestPermission, {
 					sessionId: turn.sessionId,
 					toolCall,
-					options: buildPermissionOptions()
+					options: buildPermissionOptions({ allowAlways: !isSandboxEscalation })
 				}, { cancellationSignal: decisionController.signal }).then((res) => permissionResponseFromOutcome(res?.outcome)).catch(() => "deny"), new Promise((resolve) => {
 					decisionController.signal.addEventListener("abort", () => resolve("deny"), { once: true });
-				})]) };
+				})]);
+				if (isSandboxEscalation && action === "allow-always") return { action: "deny" };
+				return { action };
 			} finally {
 				clearTimeout(timer);
 				turn.signal.removeEventListener("abort", onClose);

package/dist/commands/apiCommand.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { p as resolveApiEndpoint, t as ConfigStore, v as parseApiUrl } from "../ConfigStore-v0wgf0_j.mjs";
+import { m as resolveApiEndpoint, t as ConfigStore, y as parseApiUrl } from "../ConfigStore-DUATzLxB.mjs";
 //#region src/commands/apiCommand.ts
 /**
 * External API config command (--api-url / --reset-api)

package/dist/commands/doctorCommand.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as version } from "../package-COr17yKT.mjs";
+import { t as version } from "../package-DYPVrada.mjs";
 import { c as isNpmPrefixWritable, i as fetchLatestVersion, r as compareSemver } from "../updateChecker-CCLVVdH0.mjs";
 import { t as checkRipgrep } from "../ripgrepCheck-BmkyTK2i.mjs";
 import { existsSync } from "fs";

package/dist/commands/envCommand.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as ConfigStore } from "../ConfigStore-v0wgf0_j.mjs";
+import { t as ConfigStore } from "../ConfigStore-DUATzLxB.mjs";
 //#region src/commands/envCommand.ts
 /**
 * Environment switching for the `--dev` / `--prod` launch flags.

package/dist/commands/headlessCommand.mjs

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { $ as CustomCommandStore, A as createAgentDelegateTool, C as createTodoStore, D as createCoordinateTaskTool, F as generateCliTools, G as setWebSocketToolExecutor, K as classifyCommandRisk, N as PermissionManager, O as createResumeAgentTool, P as buildCliToolList, Q as RemoteSkillSource, S as createFindDefinitionTool, T as createSkillTool, U as wrapTools, V as buildSystemPrompt, Y as ReActAgent, a as loadProjectContext, b as createGetFileStructureTool, c as createSseBackend, i as buildProjectAgentStore, j as FallbackLlmBackend, k as createBackgroundAgentTools, n as BackgroundAgentManager, nt as CheckpointStore, o as McpManager, r as SubagentOrchestrator, rt as SessionStore, s as buildSandbox, t as AgentHistoryStore, w as createWriteTodosTool, x as createWorkItemTools } from "../AgentHistoryStore-BWko6txx.mjs";
-import { a as commandTextOf, f as requireApiUrl, i as ToolCatalog, s as toolCategory, t as ConfigStore, y as logger } from "../ConfigStore-v0wgf0_j.mjs";
-import { r as reconstructTurnBlocks, t as WorkItemsClient } from "../WorkItemsClient-BZL44N12.mjs";
-import { a as ApiClient } from "../dist-5DDaX8tB.mjs";
+import { $ as CustomCommandStore, A as createAgentDelegateTool, C as createTodoStore, D as createCoordinateTaskTool, F as generateCliTools, G as setWebSocketToolExecutor, K as classifyCommandRisk, N as PermissionManager, O as createResumeAgentTool, P as buildCliToolList, Q as RemoteSkillSource, S as createFindDefinitionTool, T as createSkillTool, U as wrapTools, V as buildSystemPrompt, Y as ReActAgent, a as loadProjectContext, b as createGetFileStructureTool, c as createSseBackend, i as buildProjectAgentStore, j as FallbackLlmBackend, k as createBackgroundAgentTools, n as BackgroundAgentManager, nt as CheckpointStore, o as McpManager, r as SubagentOrchestrator, rt as SessionStore, s as buildSandbox, t as AgentHistoryStore, w as createWriteTodosTool, x as createWorkItemTools } from "../AgentHistoryStore-CLidbOHG.mjs";
+import { a as commandTextOf, b as logger, c as toolCategory, i as ToolCatalog, p as requireApiUrl, t as ConfigStore } from "../ConfigStore-DUATzLxB.mjs";
+import { r as reconstructTurnBlocks, t as WorkItemsClient } from "../WorkItemsClient-BSoOblGp.mjs";
+import { a as ApiClient } from "../dist-DPP7UmK9.mjs";
 import { randomBytes } from "crypto";
 import { v4 } from "uuid";
 import { readFile } from "fs/promises";
@@ -24,7 +24,7 @@ import { readFile } from "fs/promises";
 * field or a new event type (backward-compatible). Consumers should reject a
 * MAJOR they do not understand.
 */
-const HEADLESS_SCHEMA_VERSION = "1.0.0";
+const HEADLESS_SCHEMA_VERSION = "1.1.0";
 /** Serialize an event with the protocol envelope stamped on. Exposed for tests. */
 function stampEvent(runId, event) {
 	return {
@@ -172,9 +172,21 @@ function evaluatePermissionPolicy(policy, toolName, riskLevel) {
 		reason: `policy default (${policy.defaultAction})`
 	};
 }
+/** The permission_request event for a gated tool call; `kind` tells a consumer what is being asked. */
+function buildPermissionRequestEvent(toolName, risk, kind = "tool") {
+	return {
+		type: "permission_request",
+		toolName,
+		risk,
+		kind
+	};
+}
 /**
 * Resolve a headless permission decision from the fixed precedence ladder:
 *   --dangerously-skip-permissions -> allow-once (explicit blanket override)
+*   a sandbox-escalation request    -> deny (running outside the OS sandbox is its own
+*                                       decision; no policy allow-list or risk threshold
+*                                       approves it)
 *   a directory-grant request       -> deny (widening the filesystem allow-list is
 *                                       its own decision; headless has no human to
 *                                       grant it, so fail closed - never inherit the
@@ -184,11 +196,15 @@ function evaluatePermissionPolicy(policy, toolName, riskLevel) {
 * Extracted from the headless prompt closure so the ladder is unit-testable.
 */
 function resolveHeadlessPermissionDecision(params) {
-	const { dangerouslySkipPermissions, isDirectoryGrant, toolName, riskLevel, permissionPolicy } = params;
+	const { dangerouslySkipPermissions, isDirectoryGrant, isSandboxEscalation, toolName, riskLevel, permissionPolicy } = params;
 	if (dangerouslySkipPermissions) return {
 		action: "allow-once",
 		reason: "dangerously-skip-permissions"
 	};
+	if (isSandboxEscalation) return {
+		action: "deny",
+		reason: "running outside the sandbox not approved in headless mode"
+	};
 	if (isDirectoryGrant) return {
 		action: "deny",
 		reason: "directory access not granted in headless mode"
@@ -206,6 +222,39 @@ function resolveHeadlessPermissionDecision(params) {
 	};
 }
 //#endregion
+//#region src/commands/headlessPermissionPrompt.ts
+/**
+* The headless permission prompt. Every gated tool surfaces a structured permission_request +
+* permission_decision pair on the stream (so decisions are never silent), then resolves the
+* decision from resolveHeadlessPermissionDecision's precedence ladder.
+*/
+function createHeadlessPromptFn(deps) {
+	const { catalog, dangerouslySkipPermissions, permissionPolicy, emit, warn } = deps;
+	return (toolName, args, _preview, kind) => {
+		const risk = classifyToolRisk(catalog.resolve(toolName), args);
+		emit?.(buildPermissionRequestEvent(toolName, risk, kind));
+		const decision = resolveHeadlessPermissionDecision({
+			dangerouslySkipPermissions,
+			isDirectoryGrant: kind === "directory-grant",
+			isSandboxEscalation: kind === "sandbox-escalation",
+			toolName,
+			riskLevel: risk.level,
+			permissionPolicy
+		});
+		if (emit) emit({
+			type: "permission_decision",
+			toolName,
+			action: decision.action,
+			reason: decision.reason,
+			risk: risk.level,
+			kind: kind ?? "tool"
+		});
+		else if (decision.action === "deny") warn(kind === "sandbox-escalation" ? `Warning: Tool "${toolName}" was denied by the OS sandbox, and retrying it outside the sandbox needs approval that headless mode cannot grant. Use --dangerously-skip-permissions to allow it.\n` : `Warning: Tool "${toolName}" requires permission and was denied (${decision.reason}). Grant it via --permission-policy, or --dangerously-skip-permissions to allow all tools.\n`);
+		if (decision.action === "allow-once") logger.debug(`[headless] Auto-allowing tool: ${toolName}`);
+		return Promise.resolve({ action: decision.action });
+	};
+}
+//#endregion
 //#region src/commands/headlessCommand.ts
 /**
 * Headless/programmatic mode command (b4m -p "query")
@@ -323,31 +372,13 @@ async function handleHeadlessCommand(options) {
 		const permissionManager = new PermissionManager(new ToolCatalog(), config.trustedTools ?? [], config.tools.disabled);
 		const emit = createHeadlessEmitter(runId, (line) => process.stdout.write(line));
 		const streaming = outputFormat === "stream-json";
-		const promptFn = (toolName, args, _preview, kind) => {
-			const risk = classifyToolRisk(permissionManager.catalog.resolve(toolName), args);
-			if (streaming) emit({
-				type: "permission_request",
-				toolName,
-				risk
-			});
-			const decision = resolveHeadlessPermissionDecision({
-				dangerouslySkipPermissions,
-				isDirectoryGrant: kind === "directory-grant",
-				toolName,
-				riskLevel: risk.level,
-				permissionPolicy
-			});
-			if (streaming) emit({
-				type: "permission_decision",
-				toolName,
-				action: decision.action,
-				reason: decision.reason,
-				risk: risk.level
-			});
-			else if (decision.action === "deny") process.stderr.write(`Warning: Tool "${toolName}" requires permission and was denied (${decision.reason}). Grant it via --permission-policy, or --dangerously-skip-permissions to allow all tools.\n`);
-			if (decision.action === "allow-once") logger.debug(`[headless] Auto-allowing tool: ${toolName}`);
-			return Promise.resolve({ action: decision.action });
-		};
+		const promptFn = createHeadlessPromptFn({
+			catalog: permissionManager.catalog,
+			dangerouslySkipPermissions,
+			permissionPolicy,
+			emit: streaming ? emit : null,
+			warn: (message) => process.stderr.write(message)
+		});
 		const userQuestionFn = (_payload) => {
 			process.stderr.write("Warning: Agent requested user input; headless mode cannot respond interactively. Answering with empty response.\n");
 			return Promise.resolve({ answers: [] });

package/dist/commands/mcpCommand.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { t as ConfigStore } from "../ConfigStore-v0wgf0_j.mjs";
-import { t as version } from "../package-COr17yKT.mjs";
+import { t as ConfigStore } from "../ConfigStore-DUATzLxB.mjs";
+import { t as version } from "../package-DYPVrada.mjs";
 //#region src/commands/mcpCommand.ts
 /**
 * External MCP commands (b4m mcp list, b4m mcp add, etc.)
@@ -70,7 +70,7 @@ async function handleMcpCommand(subcommand, argv) {
 			await handleDisable(config, argv.name, configStore);
 			break;
 		case "serve": {
-			const { handleMcpServeCommand } = await import("../serve-D6Eu3oXv.mjs");
+			const { handleMcpServeCommand } = await import("../serve-w6v3rZiR.mjs");
 			await handleMcpServeCommand({
 				http: Boolean(argv.http),
 				port: typeof argv.port === "number" ? argv.port : void 0,

package/dist/commands/pluginCommand.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as ConfigStore } from "../ConfigStore-v0wgf0_j.mjs";
+import { t as ConfigStore } from "../ConfigStore-DUATzLxB.mjs";
 import { n as getDefaultPluginsDir, r as isFeatureEnabled, t as PluginStore } from "../PluginStore-DwvOJ-G3.mjs";
 import { promises } from "fs";
 import path from "path";

package/dist/commands/updateCommand.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as version } from "../package-COr17yKT.mjs";
+import { t as version } from "../package-DYPVrada.mjs";
 import { a as forceCheckForUpdate, c as isNpmPrefixWritable, d as shouldAttemptAutoUpdate, l as readCachedUpdate, n as REEXEC_GUARD_ENV, o as getAutoUpdatePreference, t as INSTALL_CMD, u as setAutoUpdatePreference } from "../updateChecker-CCLVVdH0.mjs";
 import { t as checkRipgrep } from "../ripgrepCheck-BmkyTK2i.mjs";
 import { execSync, spawnSync } from "child_process";

package/dist/{dist-5DDaX8tB.mjs → dist-DPP7UmK9.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { h as DeviceFlowClient, m as AuthenticatedApiClient, t as ConfigStore, y as logger } from "./ConfigStore-v0wgf0_j.mjs";
-import { t as version } from "./package-COr17yKT.mjs";
+import { b as logger, g as DeviceFlowClient, h as AuthenticatedApiClient, t as ConfigStore } from "./ConfigStore-DUATzLxB.mjs";
+import { t as version } from "./package-DYPVrada.mjs";
 import { isAxiosError } from "axios";
 import { Readable } from "node:stream";
 import { createParser } from "eventsource-parser";

package/dist/index.mjs

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
-import { $ as CustomCommandStore, A as createAgentDelegateTool, B as DEFAULT_THOROUGHNESS, C as createTodoStore, D as createCoordinateTaskTool, E as parseAgentConfig, G as setWebSocketToolExecutor, H as buildSkillsPromptSection, I as ALWAYS_DENIED_FOR_AGENTS, L as DEFAULT_AGENT_MODEL, M as substituteArguments, N as PermissionManager, O as createResumeAgentTool, P as buildCliToolList, Q as RemoteSkillSource, R as DEFAULT_MAX_ITERATIONS, S as createFindDefinitionTool, T as createSkillTool, V as buildSystemPrompt, W as getProcessHooks, X as createToolSearchTool, Z as findIterationBoundary, _ as createDecisionLogTool, at as mergeCommands, b as createGetFileStructureTool, ct as searchFiles, d as createReviewGateStore, dt as COMPACTION_SUMMARY_MARKER, et as processFileReferences, f as createReviewGateTool, g as formatBlockersOutput, h as createBlockerTools, it as searchCommands, j as FallbackLlmBackend, k as createBackgroundAgentTools, lt as warmFileCache, m as createBlockerStore, nt as CheckpointStore, ot as rewireReservedNames, p as formatReviewGatesOutput, pt as MAX_PASTE_SIZE, q as getPlanModeFilePath, rt as SessionStore, s as buildSandbox, st as formatFileSize, tt as hasFileReferences, u as isConnectionDrop, v as createDecisionStore, w as createWriteTodosTool, x as createWorkItemTools, y as formatDecisionsOutput, z as DEFAULT_RETRY_CONFIG } from "./AgentHistoryStore-BWko6txx.mjs";
+import { $ as CustomCommandStore, A as createAgentDelegateTool, B as DEFAULT_THOROUGHNESS, C as createTodoStore, D as createCoordinateTaskTool, E as parseAgentConfig, G as setWebSocketToolExecutor, H as buildSkillsPromptSection, I as ALWAYS_DENIED_FOR_AGENTS, L as DEFAULT_AGENT_MODEL, M as substituteArguments, N as PermissionManager, O as createResumeAgentTool, P as buildCliToolList, Q as RemoteSkillSource, R as DEFAULT_MAX_ITERATIONS, S as createFindDefinitionTool, T as createSkillTool, V as buildSystemPrompt, W as getProcessHooks, X as createToolSearchTool, Z as findIterationBoundary, _ as createDecisionLogTool, at as mergeCommands, b as createGetFileStructureTool, ct as searchFiles, d as createReviewGateStore, dt as COMPACTION_SUMMARY_MARKER, et as processFileReferences, f as createReviewGateTool, g as formatBlockersOutput, h as createBlockerTools, it as searchCommands, j as FallbackLlmBackend, k as createBackgroundAgentTools, lt as warmFileCache, m as createBlockerStore, nt as CheckpointStore, ot as rewireReservedNames, p as formatReviewGatesOutput, pt as MAX_PASTE_SIZE, q as getPlanModeFilePath, rt as SessionStore, s as buildSandbox, st as formatFileSize, tt as hasFileReferences, u as isConnectionDrop, v as createDecisionStore, w as createWriteTodosTool, x as createWorkItemTools, y as formatDecisionsOutput, z as DEFAULT_RETRY_CONFIG } from "./AgentHistoryStore-CLidbOHG.mjs";
 import { a as selectLiveSubagentTokens, i as selectLiveSubagentCredits, n as selectActiveBackgroundShells, o as useCliStore, r as selectCompletedBackgroundShells, t as selectActiveBackgroundAgents } from "./store-BxmPEI3v.mjs";
-import { Bt as actorKindMarker, Ht as delegationPayloadSchema, I as CREDIT_DEDUCT_TRANSACTION_TYPES, L as ChatModels, Lt as ACTOR_COLOR_SLOTS, Mt as tokenEstimateMultiplier, Rt as DELEGATION_PAYLOAD_SCHEMA_NAME, Ut as selfClaimedActorKindSchema, Vt as actorKindSchema, b as SESSION_ID_PATTERN, d as getEnvironmentName, et as REVIEW_GATE_STATUS_VALUES, f as requireApiUrl, g as LOCAL_DEV_URL, i as ToolCatalog, l as ApiEndpointUnconfiguredError, n as extractCompactInstructions, p as resolveApiEndpoint, rt as SUBQUEST_STATUS_VALUES, t as ConfigStore, u as getCreditsUrl, v as parseApiUrl, vt as isEarlyStop, x as isValidSessionId, y as logger, zt as actorColorIndex } from "./ConfigStore-v0wgf0_j.mjs";
+import { Bt as DELEGATION_PAYLOAD_SCHEMA_NAME, Gt as selfClaimedActorKindSchema, Ht as actorKindMarker, L as CREDIT_DEDUCT_TRANSACTION_TYPES, Pt as tokenEstimateMultiplier, R as ChatModels, S as isValidSessionId, Ut as actorKindSchema, Vt as actorColorIndex, Wt as delegationPayloadSchema, _ as LOCAL_DEV_URL, b as logger, bt as isEarlyStop, d as getCreditsUrl, f as getEnvironmentName, i as ToolCatalog, it as SUBQUEST_STATUS_VALUES, m as resolveApiEndpoint, n as extractCompactInstructions, p as requireApiUrl, t as ConfigStore, tt as REVIEW_GATE_STATUS_VALUES, u as ApiEndpointUnconfiguredError, x as SESSION_ID_PATTERN, y as parseApiUrl, zt as ACTOR_COLOR_SLOTS } from "./ConfigStore-DUATzLxB.mjs";
 import { r as isFeatureEnabled, t as PluginStore } from "./PluginStore-DwvOJ-G3.mjs";
-import { i as getTokenCounter, n as ConversationContext, r as reconstructTurnBlocks, t as WorkItemsClient } from "./WorkItemsClient-BZL44N12.mjs";
-import { a as NotifyingLlmBackend, i as deferredToolRegistry, n as buildSupportingStores, r as buildLlmBackend, t as buildAgent } from "./buildAgent-BZnmDQIr.mjs";
+import { i as getTokenCounter, n as ConversationContext, r as reconstructTurnBlocks, t as WorkItemsClient } from "./WorkItemsClient-BSoOblGp.mjs";
+import { a as NotifyingLlmBackend, i as deferredToolRegistry, n as buildSupportingStores, r as buildLlmBackend, t as buildAgent } from "./buildAgent-DyZWK0LW.mjs";
 import { t as getShellSessionManager } from "./ShellSessionManager-6o8KZzl1-vrbPAUTq.mjs";
-import { a as ApiClient, s as OAuthClient } from "./dist-5DDaX8tB.mjs";
-import { t as version } from "./package-COr17yKT.mjs";
+import { a as ApiClient, s as OAuthClient } from "./dist-DPP7UmK9.mjs";
+import { t as version } from "./package-DYPVrada.mjs";
 import { s as getStartupUpdateStatus } from "./updateChecker-CCLVVdH0.mjs";
 import React, { useCallback, useEffect, useLayoutEffect, useMemo, useReducer, useRef, useState, useSyncExternalStore } from "react";
 import { Box, Static, Text, measureElement, render, useApp, useInput, usePaste, useStdout } from "ink";
@@ -1145,9 +1145,23 @@ const TOOLS_WITH_HIDDEN_ARGS$1 = /* @__PURE__ */ new Set(["edit_local_file", "ba
 * Displays when a tool needs permission before execution.
 * Waits indefinitely for user response (like Claude Code).
 */
-function PermissionPrompt({ toolName, toolDescription, args, preview, canBeTrusted, onResponse }) {
+function PermissionPrompt({ toolName, toolDescription, args, preview, canBeTrusted, kind, onResponse }) {
+	const isSandboxEscalation = kind === "sandbox-escalation";
 	const hideArgs = TOOLS_WITH_HIDDEN_ARGS$1.has(toolName);
-	const items = canBeTrusted ? [
+	const items = isSandboxEscalation ? [
+		{
+			label: "✓ Retry once without sandbox",
+			value: "allow-once"
+		},
+		{
+			label: "✓ Allow this command unsandboxed for the session",
+			value: "allow-session"
+		},
+		{
+			label: "✗ Deny",
+			value: "deny"
+		}
+	] : canBeTrusted ? [
 		{
 			label: "✓ Allow once",
 			value: "allow-once"
@@ -1251,7 +1265,7 @@ function PermissionPrompt({ toolName, toolDescription, args, preview, canBeTrust
 		borderColor: "gray",
 		paddingX: 1,
 		flexDirection: "column"
-	}, renderDiffPreview(preview))), !canBeTrusted && /* @__PURE__ */ React.createElement(Box, { marginTop: 1 }, /* @__PURE__ */ React.createElement(Text, {
+	}, renderDiffPreview(preview))), !canBeTrusted && !isSandboxEscalation && /* @__PURE__ */ React.createElement(Box, { marginTop: 1 }, /* @__PURE__ */ React.createElement(Text, {
 		color: "red",
 		dimColor: true
 	}, "Note: This tool cannot be trusted due to its dangerous nature.")), /* @__PURE__ */ React.createElement(Box, {
@@ -2834,6 +2848,7 @@ function App({ onMessage, onBackgroundCompletion, onCommand, onBashCommand, onPe
 		args: permissionPrompt.args,
 		preview: permissionPrompt.preview,
 		canBeTrusted: permissionPrompt.canBeTrusted,
+		kind: permissionPrompt.kind,
 		onResponse: (response) => onPermissionResponse(response, permissionPrompt.id)
 	})), userQuestionPrompt && /* @__PURE__ */ React.createElement(Box, {
 		key: userQuestionPrompt.id,
@@ -9225,7 +9240,7 @@ function CliApp() {
 				checkpointStore
 			});
 			let permissionPromptCounter = 0;
-			const promptFn = (toolName, args, preview) => {
+			const promptFn = (toolName, args, preview, kind) => {
 				return new Promise((resolve) => {
 					getProcessHooks()?.fireNotificationPermissionPrompt(toolName);
 					const canBeTrusted = permissionManager.canBeTrusted(toolName);
@@ -9236,6 +9251,7 @@ function CliApp() {
 						args,
 						preview,
 						canBeTrusted,
+						kind,
 						resolve
 					};
 					setState((prev) => ({

package/dist/{package-COr17yKT.mjs → package-DYPVrada.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
 //#region package.json
-var version = "3.2.0";
+var version = "3.3.0";
 //#endregion
 export { version as t };

package/dist/{serve-D6Eu3oXv.mjs → serve-w6v3rZiR.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { B as DEFAULT_TTS_PROVIDER, D as AGENT_QUEST_MCP_URI, E as AGENT_QUEST_MANIFEST, Ft as ttsResponseTooLargeSchema, H as GENERATED_IMAGE_EXTENSION_RE, M as BRIEFCASE_CATALOG_QUERIES, Nt as ttsBase64ResponseSchema, P as BriefcasePromptIdSchema, Pt as ttsRequestSchema, Q as PROMPT_TEXT_MAX, St as joinReplySlots, T as AGENT_QUEST_ID, Tt as replacePromptVariables, U as ImageModels, W as ImagePromptResolutionSchema, _ as NotAuthenticatedError, at as VisibilitySchema, f as requireApiUrl, j as ArtifactTypeSchema, jt as supportedVoiceGenerationVendor, lt as buildPromptContext, pt as generatedAudioResponseSchema, t as ConfigStore, v as parseApiUrl, wt as questReplyText, y as logger, z as CreateArtifactRequestSchema } from "./ConfigStore-v0wgf0_j.mjs";
-import { a as ApiClient, i as parseRetryAfterSeconds, o as isProviderKeyFailure, r as createClient, t as B4mApiError } from "./dist-5DDaX8tB.mjs";
+import { $ as PROMPT_TEXT_MAX, B as CreateArtifactRequestSchema, D as AGENT_QUEST_MANIFEST, Dt as replacePromptVariables, E as AGENT_QUEST_ID, Et as questReplyText, F as BriefcasePromptIdSchema, Ft as ttsBase64ResponseSchema, G as ImagePromptResolutionSchema, It as ttsRequestSchema, Lt as ttsResponseTooLargeSchema, M as ArtifactTypeSchema, N as BRIEFCASE_CATALOG_QUERIES, Nt as supportedVoiceGenerationVendor, O as AGENT_QUEST_MCP_URI, U as GENERATED_IMAGE_EXTENSION_RE, V as DEFAULT_TTS_PROVIDER, W as ImageModels, b as logger, dt as buildPromptContext, ht as generatedAudioResponseSchema, p as requireApiUrl, st as VisibilitySchema, t as ConfigStore, v as NotAuthenticatedError, wt as joinReplySlots, y as parseApiUrl } from "./ConfigStore-DUATzLxB.mjs";
+import { a as ApiClient, i as parseRetryAfterSeconds, o as isProviderKeyFailure, r as createClient, t as B4mApiError } from "./dist-DPP7UmK9.mjs";
 import { z as z$1 } from "zod";
 import { isAxiosError } from "axios";
 import { createHash, randomUUID } from "node:crypto";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bike4mind/cli",
-  "version": "3.2.0",
+  "version": "3.3.0",
   "mcpName": "io.github.Bike4Mind/bike4mind",
   "type": "module",
   "description": "Interactive CLI tool for Bike4Mind with ReAct agents",
@@ -124,17 +124,17 @@
     "tsx": "^4.23.0",
     "typescript": "^5.9.3",
     "vitest": "^4.1.11",
-    "@bike4mind/agents": "0.0.0-snapshot-gh-readonly-queue-main-pr-5009-e421f9aab9-20261019120015",
-    "@bike4mind/common": "0.0.0-snapshot-gh-readonly-queue-main-pr-5009-e421f9aab9-20261019120015",
-    "@bike4mind/client-auth": "0.2.0",
-    "@bike4mind/fab-pipeline": "0.0.0-snapshot-gh-readonly-queue-main-pr-5009-e421f9aab9-20261019120015",
+    "@bike4mind/agents": "1.2.8",
+    "@bike4mind/client-auth": "0.2.1",
+    "@bike4mind/common": "18.0.0",
+    "@bike4mind/fab-pipeline": "2.1.8",
     "@bike4mind/hearth": "0.3.1",
-    "@bike4mind/mcp": "0.0.0-snapshot-gh-readonly-queue-main-pr-5009-e421f9aab9-20261019120015",
+    "@bike4mind/llm-adapters": "1.5.0",
+    "@bike4mind/mcp": "2.1.8",
     "@bike4mind/observability": "0.2.3",
-    "@bike4mind/sdk": "1.1.0",
-    "@bike4mind/llm-adapters": "0.0.0-snapshot-gh-readonly-queue-main-pr-5009-e421f9aab9-20261019120015",
-    "@bike4mind/utils": "0.0.0-snapshot-gh-readonly-queue-main-pr-5009-e421f9aab9-20261019120015",
-    "@bike4mind/services": "0.0.0-snapshot-gh-readonly-queue-main-pr-5009-e421f9aab9-20261019120015"
+    "@bike4mind/sdk": "1.2.0",
+    "@bike4mind/services": "19.2.0",
+    "@bike4mind/utils": "8.1.3"
   },
   "optionalDependencies": {
     "@vscode/ripgrep": "^1.18.0"