@bike4mind/cli 3.2.0 → 3.4.0

package/dist/{AgentHistoryStore-BWko6txx.mjs → AgentHistoryStore-ClO2zOn6.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { $ as PermissionDeniedError, A as ApiKeyType, C as htmlFirstH1, Ct as obfuscateApiKey, Dt as signImageUrl, Et as secureParameters, G as LOCATION_MAP_LANGUAGE, Gt as WEBSITE_URL, It as withRetry, L as ChatModels, N as BedrockEmbeddingModel, Ot as splitEquals, S as htmlErrorTitle, Wt as APP_NAME, X as OllamaEmbeddingModel, Y as NotFoundError, Z as OpenAIEmbeddingModel, a as commandTextOf, b as SESSION_ID_PATTERN, bt as isRetryableError, c as writePathOf, ct as assertAuthOriginMatchesApiKey, gt as googleMapsSearchUrl, it as SupportedFabFileMimeTypes, mt as getMcpProviderMetadata, o as isReadOnlyTool, ot as VoyageAIEmbeddingModel, q as McpServerName, r as loadContextFiles, st as WORK_ITEM_STATUSES, tt as SEARCH_RESULT_CARDS_LANGUAGE, w as escapeArtifactBodyJson, x as isValidSessionId, y as logger, yt as isPlaceholderImageSigningSecret } from "./ConfigStore-v0wgf0_j.mjs";
+import { $ as OllamaEmbeddingModel, At as secureParameters, Bt as withRetry, C as htmlErrorTitle, Ct as isPlaceholderImageSigningSecret, Dt as obfuscateApiKey, J as LOCATION_MAP_LANGUAGE, Jt as frontmatterHasSourceStamp, Mt as splitEquals, P as BedrockEmbeddingModel, Q as NotFoundError, R as ChatModels, S as isValidSessionId, T as escapeArtifactBodyJson, U as DecisionTextPartSchema, W as DecisionsRequestSchema, X as McpServerName, Xt as WEBSITE_URL, Yt as APP_NAME, a as commandTextOf, b as logger, bt as googleMapsSearchUrl, ct as UnprocessableEntityError, dt as WORK_ITEM_STATUSES, et as OpenAIEmbeddingModel, ft as assertAuthOriginMatchesApiKey, it as SEARCH_RESULT_CARDS_LANGUAGE, j as ApiKeyType, jt as signImageUrl, l as writePathOf, nt as PermissionDeniedError, o as isReadOnlyTool, r as loadContextFiles, s as sandboxedCommandArg, st as SupportedFabFileMimeTypes, ut as VoyageAIEmbeddingModel, vt as getMcpProviderMetadata, w as htmlFirstH1, wt as isRetryableError, x as SESSION_ID_PATTERN } from "./ConfigStore-CbVFLXMH.mjs";
 import { n as isPathAllowed, t as assertPathAllowed } from "./pathValidation-BRqf4HFX-CHwtwp3O.mjs";
 import { n as isTerminalShellStatus, t as getShellSessionManager } from "./ShellSessionManager-6o8KZzl1-vrbPAUTq.mjs";
-import { n as B4mStreamEndedError, r as createClient, t as B4mApiError } from "./dist-5DDaX8tB.mjs";
+import { n as B4mStreamEndedError, r as createClient, t as B4mApiError } from "./dist-DlBq3wHu.mjs";
 import { createHash, randomBytes } from "crypto";
 import { existsSync, lstatSync, promises, readdirSync, realpathSync, rmSync, statSync } from "fs";
 import os, { homedir } from "os";
@@ -2363,7 +2363,7 @@ new Map([
 	...Object.values(OLLAMA_EMBEDDING_MODEL_MAP)
 ].map((info) => [info.model, info.dimensions[0]]));
 //#endregion
-//#region ../../b4m-core/services/dist/webfetch-D2pxGurU.mjs
+//#region ../../b4m-core/services/dist/webfetch-BDmPyiMm.mjs
 const htmlToMarkdown = (html, _isArxiv = false) => {
 	const turndownService = new turndown({
 		headingStyle: "atx",
@@ -2655,6 +2655,13 @@ function webFetchBody(result) {
 	if (result.extractedChars === 0 && result.offset > 0) return `[web_fetch: offset ${result.offset} is at or beyond the end of the content (~${result.originalChars} chars); nothing further to read.]`;
 	return result.truncated ? result.markdown + truncationMarker(result) : result.markdown;
 }
+/**
+* Leads an indexed turn's fetched page with the number the turn gave it (ToolContext.numberCitables).
+* A directive for the same reason as INDEXED_TOOL_CITATION_RULE.
+*/
+function webFetchCitationLine(citationIndex) {
+	return `This page is source [${citationIndex}]. Cite content from it ONLY as [${citationIndex}], placed immediately after the claim it supports.\n\n`;
+}
 function isPdfUrl(url) {
 	try {
 		const { pathname } = new URL(url);
@@ -2704,6 +2711,35 @@ async function probeLlmsTxt(pageUrl) {
 	return full ?? index;
 }
 /**
+* Firecrawl refused the target site itself (its 403 "we do not support this site"). A property of
+* the URL, not a fault of ours, so it is a 422: /api/tools/web-fetch logs it at warn instead of
+* paging, and the web_fetch tool turns it into a hint to use web_search. Only 403 - Firecrawl's
+* 401/402/429 are our key, credits or rate limit and must keep surfacing as server errors.
+*/
+var UnsupportedScrapeTargetError = class extends UnprocessableEntityError {
+	constructor(url, cause) {
+		super(`This site can't be fetched: the web scraper does not support ${new URL(url).hostname}.`);
+		this.name = "UnsupportedScrapeTargetError";
+		this.cause = cause;
+	}
+};
+/** Scrape after a 1s wait for client-side rendering, retrying without the action where Firecrawl rejects actions. */
+async function scrapeAfterRenderWait(app, url, params) {
+	try {
+		return await app.scrapeUrl(url, {
+			...params,
+			actions: [{
+				type: "wait",
+				milliseconds: 1e3
+			}]
+		});
+	} catch (scrapeError) {
+		if (!(scrapeError instanceof Error ? scrapeError.message : "").includes("Actions are not supported")) throw scrapeError;
+		Logger.globalInstance.log("📥 WebFetch Tool: Actions not supported, retrying without actions...");
+		return app.scrapeUrl(url, params);
+	}
+}
+/**
 * Fetch URL content using Firecrawl (shared function, no ToolContext)
 * Pattern follows serpApiSearch from websearch tool
 *
@@ -2742,20 +2778,11 @@ async function firecrawlFetch(adapters, url, options) {
 	};
 	const startedAt = Date.now();
 	let result;
-	if (isPdf) result = await app.scrapeUrl(url, baseParams);
-	else try {
-		result = await app.scrapeUrl(url, {
-			...baseParams,
-			actions: [{
-				type: "wait",
-				milliseconds: 1e3
-			}]
-		});
+	try {
+		result = isPdf ? await app.scrapeUrl(url, baseParams) : await scrapeAfterRenderWait(app, url, baseParams);
 	} catch (scrapeError) {
-		if ((scrapeError instanceof Error ? scrapeError.message : "").includes("Actions are not supported")) {
-			Logger.globalInstance.log("📥 WebFetch Tool: Actions not supported, retrying without actions...");
-			result = await app.scrapeUrl(url, baseParams);
-		} else throw scrapeError;
+		if (scrapeError instanceof FirecrawlError && scrapeError.statusCode === 403) throw new UnsupportedScrapeTargetError(url, scrapeError);
+		throw scrapeError;
 	}
 	const durationMs = Date.now() - startedAt;
 	if (!result || result.error) {
@@ -2830,19 +2857,27 @@ const webFetchTool = {
 						cap: result.cap
 					}
 				};
-				await context.statusUpdate({ promptMeta: { citables: [citable] } }, "WebFetch completed successfully");
+				const citationIndex = context.numberCitables?.([citable])?.[0].metadata?.citationIndex;
+				await context.statusUpdate({ promptMeta: { citables: [citationIndex === void 0 ? citable : {
+					...citable,
+					metadata: {
+						...citable.metadata,
+						citationIndex
+					}
+				}] } }, "WebFetch completed successfully");
 				Logger.globalInstance.log(`📚 WebFetch Tool: Stored citable source for ${params.url}`);
-				return webFetchBody(result);
+				return (citationIndex === void 0 ? "" : webFetchCitationLine(citationIndex)) + webFetchBody(result);
 			} catch (error) {
 				const errorMessage = error instanceof Error ? error.message : "Unknown error";
-				if (error instanceof FirecrawlError && [
+				const firecrawlStatus = error instanceof UnsupportedScrapeTargetError ? 403 : error instanceof FirecrawlError ? error.statusCode : void 0;
+				if (firecrawlStatus !== void 0 && [
 					400,
 					403,
 					408,
 					502,
 					503,
 					504
-				].includes(error.statusCode)) {
+				].includes(firecrawlStatus)) {
 					const { userMessage, statusLabel } = {
 						400: {
 							userMessage: `This site requires advanced browser features that are not available. Try using web_search to find the information instead.`,
@@ -2868,10 +2903,10 @@ const webFetchTool = {
 							userMessage: `The website took too long to respond (Gateway Timeout). Try again later or use web_search to find the information instead.`,
 							statusLabel: "gateway timeout"
 						}
-					}[error.statusCode];
+					}[firecrawlStatus];
 					context.logger.warn("WebFetch expected Firecrawl failure", {
 						url: params.url,
-						statusCode: error.statusCode,
+						statusCode: firecrawlStatus,
 						error: errorMessage
 					});
 					await context.statusUpdate({}, `WebFetch: ${statusLabel}`);
@@ -2987,7 +3022,16 @@ const WEB_SEARCH_MAP_PROMPT = [
 	"explanation or citations. Omit it only if none of the places actually answer the question."
 ].join("\n");
 //#endregion
-//#region ../../b4m-core/services/dist/websearch-Cak_rViw.mjs
+//#region ../../b4m-core/services/dist/websearch-Dm7iz09B.mjs
+/**
+* Shown to the model under tool results that carry the turn's shared numbers, so it cites them the
+* way forced retrieval's header asks it to cite the documents numbered before them. Keep it a directive:
+* on a tool-only turn there is no forced-retrieval header, and a purely descriptive label here was
+* tried and the model mostly stopped writing [N] markers at all.
+*/
+const INDEXED_TOOL_CITATION_RULE = "Cite each of these sources ONLY by the bracketed number it is labelled with, placed immediately after the claim it supports. These numbers continue the sources already numbered this turn.";
+/** Each stamped citable's number, keyed by citable id, for labelling results that point at it. */
+const citationNumbersById = (citables) => new Map(citables.flatMap((citable) => citable.metadata?.citationIndex === void 0 ? [] : [[citable.id, citable.metadata.citationIndex]]));
 /**
 * Per-process cache for web-search results. Keyed on normalized query + result count, with a
 * short TTL so repeated/similar searches within a turn or across back-to-back turns reuse the
@@ -3667,15 +3711,19 @@ function describePlace(place) {
 		place.address
 	].filter((part) => !!part).map(stripNewlines).join(" - ");
 }
-function formatPlaceResults(places, anchor) {
+function formatPlaceResults(places, anchor, citationNumbers) {
+	const numberOf = (place) => citationNumbers?.get(`place:${place.id}`);
 	return [
 		"Places found for this search (each has a map location; refer to it by its id):",
 		"",
-		...places.map((place, index) => `${index + 1}. ${describePlace(place)}\n   id: ${stripNewlines(place.id)}`),
+		...places.map((place, index) => {
+			const n = numberOf(place);
+			return `${n !== void 0 ? `[${n}]` : `${index + 1}.`} ${describePlace(place)}\n   id: ${stripNewlines(place.id)}`;
+		}),
 		...anchor ? [
 			"",
 			"Anchor location (the place the user named):",
-			`${describePlace(anchor)}\n   id: ${stripNewlines(anchor.id)}`
+			`${numberOf(anchor) !== void 0 ? `[${numberOf(anchor)}] ` : ""}${describePlace(anchor)}\n   id: ${stripNewlines(anchor.id)}`
 		] : []
 	].join("\n");
 }
@@ -3781,7 +3829,7 @@ async function searchWithHedge(lead, backup, query, numResults, searchOptions) {
 		throw new Error(`Web search failed on both providers. ${lead.name}: ${errorMessage$1(leadError)}; ${backup.name}: ${errorMessage$1(backupError)}`);
 	}
 }
-async function performWebSearch(adapters, params, imageUrlSigningSecret = "", resolvedProviders) {
+async function performWebSearch(adapters, params, imageUrlSigningSecret = "", resolvedProviders, numberCitables) {
 	Logger.globalInstance.log("🔍 WebSearch Tool: Starting search for query:", params.query);
 	const [provider, backup] = await (resolvedProviders ?? resolveWebSearchProviders(adapters));
 	if (!provider) {
@@ -3820,7 +3868,7 @@ async function performWebSearch(adapters, params, imageUrlSigningSecret = "", re
 		if (placeResults.length) Logger.globalInstance.log(`WebSearch Tool: ${servedBy.name} found ${placeResults.length} places`);
 		if (imageResults.length) Logger.globalInstance.log(`🖼️ WebSearch Tool: ${servedBy.name} found ${imageResults.length} images`);
 		const withImages = shouldIncludeImages(results, wantsImages, imageResults);
-		const citables = results.map((result, index) => ({
+		const unnumberedCitables = results.map((result, index) => ({
 			id: result.url,
 			type: "web_url",
 			title: result.title,
@@ -3838,15 +3886,18 @@ async function performWebSearch(adapters, params, imageUrlSigningSecret = "", re
 				} : {}
 			}
 		}));
-		if (withPlaces) for (const place of anchor ? [anchor, ...places] : places) citables.push(placeCitable(place, imageUrlSigningSecret, canSignImages));
+		if (withPlaces) for (const place of anchor ? [anchor, ...places] : places) unnumberedCitables.push(placeCitable(place, imageUrlSigningSecret, canSignImages));
+		const numberedCitables = numberCitables?.(unnumberedCitables);
+		const citables = numberedCitables ?? unnumberedCitables;
+		const resultLabel = (index) => numberedCitables ? `[${numberedCitables[index].metadata?.citationIndex}]` : `${index + 1}.`;
 		const formattedResults = results.map((result, index) => {
 			const imageLine = withImages && result.images?.length ? `Images: ${result.images.map((url) => signImageUrl(url, imageUrlSigningSecret)).join(" | ")}\n` : "";
-			return `${index + 1}. **${stripNewlines(result.title)}**\n${stripNewlines(result.snippet)}\n` + imageLine + `Source: [${safeHostname(result.url)}](${result.url})\n`;
+			return `${resultLabel(index)} **${stripNewlines(result.title)}**\n${stripNewlines(result.snippet)}\n` + imageLine + `Source: [${safeHostname(result.url)}](${result.url})\n`;
 		}).join("\n");
 		const imageSection = withImages && imageResults.length ? `\n${formatImageResults(imageResults, imageUrlSigningSecret)}\n` : "";
-		const placeSection = withPlaces ? `\n${formatPlaceResults(places, anchor)}\n` : "";
+		const placeSection = withPlaces ? `\n${formatPlaceResults(places, anchor, numberedCitables ? citationNumbersById(numberedCitables) : void 0)}\n` : "";
 		return {
-			formattedResults: (formattedResults ? `Here's what I found from searching the web:\n\n${formattedResults}` : imageSection || placeSection ? "Here's what I found from searching the web:\n" : "No results found from web search.") + imageSection + placeSection + (withImages ? `\n${WEB_SEARCH_CARDS_PROMPT}` : "") + (withPlaces ? `\n${WEB_SEARCH_MAP_PROMPT}` : ""),
+			formattedResults: (formattedResults ? `Here's what I found from searching the web:\n\n${formattedResults}` + (numberedCitables ? `\n${INDEXED_TOOL_CITATION_RULE}\n` : "") : imageSection || placeSection ? "Here's what I found from searching the web:\n" : "No results found from web search.") + imageSection + placeSection + (withImages ? `\n${WEB_SEARCH_CARDS_PROMPT}` : "") + (withPlaces ? `\n${WEB_SEARCH_MAP_PROMPT}` : ""),
 			citables
 		};
 	} catch (error) {
@@ -3869,7 +3920,7 @@ const webSearchTool = {
 					throw error;
 				});
 				const startedAt = Date.now();
-				const { formattedResults, citables } = await performWebSearch({ db: context.db }, params, config?.imageUrlSigningSecret, providersPromise);
+				const { formattedResults, citables } = await performWebSearch({ db: context.db }, params, config?.imageUrlSigningSecret, providersPromise, context.numberCitables);
 				context.logger.log("🔍 WebSearch Tool: search timing", {
 					callNumber,
 					query: params.query,
@@ -4130,7 +4181,7 @@ async function getModelForWrite(user, modelId, deps) {
 	return isModelOwner(model, user) ? model : null;
 }
 //#endregion
-//#region ../../b4m-core/services/dist/toolGenerators-BE8RB3Ga.mjs
+//#region ../../b4m-core/services/dist/toolGenerators-Ce9EJurs.mjs
 const diceRoll = async (parameters) => {
 	if (!parameters?.sides || !parameters?.times) throw new Error("Tool dice roll: Missing required parameters");
 	return sum(times(parameters.times, () => random(1, parameters.sides))).toString();
@@ -4725,6 +4776,119 @@ const promptEnhancementTool = {
 		}
 	})
 };
+const DecisionToolRequestSchema = DecisionsRequestSchema.pick({
+	input: true,
+	questions: true,
+	model: true
+}).extend({
+	input: DecisionTextPartSchema.shape.text,
+	model: DecisionsRequestSchema.shape.model.optional()
+});
+/**
+* Typed decision checks (predicate / choice / score) answered with calibrated probabilities,
+* without spending a generation turn. Execution is host-injected (see `ToolContext.decide`): the
+* runner, its credit hold and provider retry live in the app tier, so this tool only forwards.
+*/
+const decideTool = {
+	name: "decide",
+	implementation: (context) => ({
+		toolFn: async (value) => {
+			const run = context.decide;
+			if (!run) throw new Error("decide is not available on this surface");
+			const { input, questions, model } = DecisionToolRequestSchema.parse(value);
+			const result = await run({
+				userId: context.userId,
+				user: context.user,
+				logger: context.logger,
+				authOrigin: context.authOrigin,
+				apiKeyId: context.apiKeyId,
+				organizationId: context.organizationId,
+				request: {
+					model,
+					input,
+					questions
+				}
+			});
+			return JSON.stringify({
+				id: result.id,
+				model: result.model,
+				answers: result.answers
+			});
+		},
+		toolSchema: {
+			name: "decide",
+			description: "Answer typed questions about text with calibrated probabilities: classify, route or score without spending a full answer. Types are predicate (probability), choice (probabilities over values) and score (probabilities over an ordered scale). Answers return in question order; a declined question is a `refusal`, not an error.",
+			parameters: {
+				type: "object",
+				properties: {
+					input: {
+						type: "string",
+						description: "Text to judge."
+					},
+					questions: {
+						type: "array",
+						description: "One to twenty, each judged independently.",
+						items: {
+							type: "object",
+							properties: {
+								type: {
+									type: "string",
+									enum: [
+										"predicate",
+										"choice",
+										"score"
+									]
+								},
+								name: {
+									type: "string",
+									description: "Unique within the call."
+								},
+								instructions: {
+									type: "string",
+									description: "What to judge."
+								},
+								choices: {
+									type: "array",
+									description: "Required for `choice`.",
+									items: {
+										type: "object",
+										properties: {
+											value: { type: "string" },
+											description: { type: "string" }
+										},
+										required: ["value"]
+									}
+								},
+								levels: {
+									type: "array",
+									description: "Required for `score`: lowest first.",
+									items: {
+										type: "object",
+										properties: {
+											label: { type: "string" },
+											description: { type: "string" }
+										},
+										required: ["label"]
+									}
+								}
+							},
+							required: [
+								"type",
+								"name",
+								"instructions"
+							]
+						}
+					},
+					model: {
+						type: "string",
+						description: "Optional model id; omit for the deployment default."
+					}
+				},
+				required: ["input", "questions"]
+			}
+		}
+	})
+};
 let _showUserQuestion = null;
 /**
 * Inject the CLI callback that displays the question UI.
@@ -4844,7 +5008,7 @@ const askUserQuestionTool = {
 * re-export them without pulling the full tool graph. `index.ts` re-exports them
 * so the server barrel's public API is unchanged.
 */
-const generateTools = (userId, user, logger, { db, retrievalFilter, kbScope, inlinedAttachmentIds, attachedFileIds, fullyInlinedAttachmentIds, suppressLakeArms, sessionRetrievalTags, sessionReaderConsentDatalakeTags, sessionLakeScopeExplicit, sessionIncludeLibraryFiles, sessionPreauthorizedLakeIds, organizationId, authOrigin, apiKeyId, questId, getAbortSignal }, storage, imageGenerateStorage, statusUpdate, onStart, onFinish, llm, config, model, imageProcessorLambdaName, tools, allowedDirectories, entitlementKeys = [], sessionId, codeMinifier, availableModels, onToolLlmUsage) => {
+const generateTools = (userId, user, logger, { db, retrievalFilter, kbScope, inlinedAttachmentIds, attachedFileIds, fullyInlinedAttachmentIds, suppressLakeArms, sessionRetrievalTags, sessionReaderConsentDatalakeTags, sessionLakeScopeExplicit, sessionIncludeLibraryFiles, sessionPreauthorizedLakeIds, organizationId, authOrigin, apiKeyId, questId, numberCitables, decide, getAbortSignal }, storage, imageGenerateStorage, statusUpdate, onStart, onFinish, llm, config, model, imageProcessorLambdaName, tools, allowedDirectories, entitlementKeys = [], sessionId, codeMinifier, availableModels, onToolLlmUsage) => {
 	assertAuthOriginMatchesApiKey(authOrigin, apiKeyId);
 	const context = {
 		userId,
@@ -4880,7 +5044,9 @@ const generateTools = (userId, user, logger, { db, retrievalFilter, kbScope, inl
 		codeMinifier,
 		availableModels,
 		onToolLlmUsage,
-		getAbortSignal
+		decide,
+		getAbortSignal,
+		numberCitables
 	};
 	return Object.entries(tools).reduce((acc, [key, tool]) => {
 		const built = tool.implementation(context, config[key]);
@@ -7075,7 +7241,8 @@ const cliSharedTools = {
 	prompt_enhancement: promptEnhancementTool,
 	weather_info: weatherTool,
 	web_search: webSearchTool,
-	web_fetch: webFetchTool
+	web_fetch: webFetchTool,
+	decide: decideTool
 };
 /**
 * The 6 Lattice tool implementations as a resolvable map keyed by tool name.
@@ -7734,7 +7901,8 @@ var CustomCommandStore = class {
 	*/
 	async loadCommandFile(filePath, source) {
 		const filename = path.basename(filePath);
-		const commandName = filename.toLowerCase() === "skill.md" ? this.extractSkillName(filePath) : extractCommandName(filename);
+		const isSkillFile = filename.toLowerCase() === "skill.md";
+		const commandName = isSkillFile ? this.extractSkillName(filePath) : extractCommandName(filename);
 		if (!commandName) {
 			console.warn(`Invalid command filename: ${filename} (must end with .md and have valid name)`);
 			return;
@@ -7743,7 +7911,12 @@ var CustomCommandStore = class {
 			console.warn(`Ignoring project command "${commandName}": name is reserved (built-in or feature command)`);
 			return;
 		}
-		const command = parseCommandFile(await fs.readFile(filePath, "utf-8"), filePath, commandName, source);
+		const fileContent = await fs.readFile(filePath, "utf-8");
+		if (isSkillFile && frontmatterHasSourceStamp(fileContent)) {
+			logger.debug(`Skipping ${filePath}: exported from Bike4Mind; the account skill is used instead`);
+			return;
+		}
+		const command = parseCommandFile(fileContent, filePath, commandName, source);
 		this.commands.set(commandName, command);
 	}
 	/**
@@ -7868,9 +8041,16 @@ const DEFAULT_PAGE_LIMIT = 100;
 var RemoteSkillSource = class {
 	constructor(apiClient, options = {}) {
 		this.apiClient = apiClient;
+		this.forceNext = false;
 		this.cacheFilePath = options.cacheFilePath ?? path.join(os.homedir(), ".bike4mind", "cache", "remote-skills.json");
 		this.freshTtlMs = options.freshTtlMs ?? DEFAULT_FRESH_TTL_MS;
 		this.pageLimit = options.pageLimit ?? DEFAULT_PAGE_LIMIT;
+		this.includeImports = options.includeImports ?? false;
+	}
+	/** Make the next `fetchSkills` go to the network even inside the TTL. The cache stays as the
+	*  offline fallback. For a host that just changed the account's skills itself. */
+	invalidate() {
+		this.forceNext = true;
 	}
 	/**
 	* Returns the user's remote skills mapped to `CustomCommand`. Uses an
@@ -7879,7 +8059,9 @@ var RemoteSkillSource = class {
 	*/
 	async fetchSkills() {
 		const cached = await this.readCache();
-		if (cached && this.isFresh(cached)) return this.mapAndFilter(cached.skills);
+		const forced = this.forceNext;
+		this.forceNext = false;
+		if (cached && !forced && this.isFresh(cached)) return this.mapAndFilter(cached.skills);
 		try {
 			const skills = (await this.apiClient.get(`/api/skills?limit=${this.pageLimit}`))?.data ?? [];
 			if (skills.length > 0 || !cached || cached.skills.length === 0) await this.writeCache({
@@ -7901,6 +8083,7 @@ var RemoteSkillSource = class {
 	*   only visible cross-account via `isGlobalRead`, and
 	* - a Skill Market import: the user owns the copy but someone else wrote it, and local commands run
 	*   as trusted instructions next to shell/file tools (the web app wraps it as untrusted instead).
+	*   With `includeImports` it is kept as `untrusted: true`, for a host that wraps it the same way.
 	* Own, system (no `userId`), and org-scoped (server-gated, no `userId`) skills pass.
 	*
 	* Unauthenticated contract (fail-closed, intentional): when getCurrentUser()
@@ -7914,7 +8097,7 @@ var RemoteSkillSource = class {
 		return skills.filter((skill) => {
 			if (isReservedCommandName(skill.name)) return false;
 			if (skill.userId && skill.userId !== currentUserId) return false;
-			if (skill.importedFrom) return false;
+			if (skill.importedFrom && !this.includeImports) return false;
 			return true;
 		}).map((skill) => this.toCustomCommand(skill));
 	}
@@ -7965,6 +8148,7 @@ var RemoteSkillSource = class {
 			argumentHint: skill.argumentHint,
 			allowedTools: skill.allowedTools,
 			disableModelInvocation: skill.disableModelInvocation,
+			...skill.importedFrom ? { untrusted: true } : {},
 			source: "remote",
 			filePath: `b4m:/api/skills/${skill.id}`
 		};
@@ -11427,12 +11611,15 @@ z$1.object({
 //#endregion
 //#region src/tools/gateway/stages/sandbox.ts
 /**
-* Decide whether a bash_execute call runs inside the OS sandbox, and rewrite its args to do so.
-* Any other tool, or a call with no command or no orchestrator, is left unchanged.
+* Decide whether a call runs inside the OS sandbox, and rewrite its args to do so. Only a tool
+* whose descriptor declares `sandbox` is wrapped; any other tool, or a call with no command or
+* no orchestrator, is left unchanged.
 */
-function prepareSandbox(toolName, args, sandboxOrchestrator, allowedDirectories) {
-	if (toolName !== "bash_execute" || !args?.command || !sandboxOrchestrator) return { kind: "unchanged" };
-	const command = args.command;
+function prepareSandbox(descriptor, args, sandboxOrchestrator, allowedDirectories) {
+	const commandArg = sandboxedCommandArg(descriptor);
+	if (!commandArg || !args || !sandboxOrchestrator) return { kind: "unchanged" };
+	const command = args[commandArg];
+	if (typeof command !== "string" || !command) return { kind: "unchanged" };
 	let cwd = args.cwd ? path.resolve(process.cwd(), args.cwd) : process.cwd();
 	try {
 		cwd = realpathSync(cwd);
@@ -11451,15 +11638,13 @@ function prepareSandbox(toolName, args, sandboxOrchestrator, allowedDirectories)
 			};
 		}
 		sandboxOrchestrator.recordSandboxed();
-		const cleanupPaths = decision.wrappedCommand.cleanupPaths;
 		return {
 			kind: "sandboxed",
-			cleanupPaths,
+			cleanupPaths: decision.wrappedCommand.cleanupPaths,
 			args: {
 				...args,
 				cwd,
-				command: decision.wrappedCommand.commandString,
-				_sandboxCleanup: cleanupPaths
+				[commandArg]: decision.wrappedCommand.commandString
 			}
 		};
 	}
@@ -11493,23 +11678,6 @@ function cleanupSandboxFiles(paths) {
 	} catch {}
 }
 /**
-* Detect whether a tool result indicates a sandbox-specific runtime failure
-* worth offering an unsandboxed retry for. Matches the sandbox markers
-* (`sandbox-exec:`, `bwrap:`) AND a bare "Operation not permitted": on macOS a
-* real Seatbelt denial is the denied syscall's own EPERM, printed by the tool
-* that hit it with NO `sandbox-exec:` prefix (that prefix only appears when the
-* profile fails to load) - a write denial reads `touch: <path>: Operation not
-* permitted`, and a blocked connect surfaces the same EPERM. Matching only the
-* markers would never fire for those, silently dropping the recovery offer and
-* the `/sandbox:network on` tip. The known false positive (e.g. `kill` on a
-* foreign pid) is accepted: it only costs a deniable retry prompt, whereas a
-* false negative removes the recovery path entirely.
-*/
-function isSandboxFailure(isSandboxed, result) {
-	if (!isSandboxed) return false;
-	return result.includes("sandbox-exec:") || result.includes("bwrap:") || result.includes("Operation not permitted");
-}
-/**
 * Parse sandbox runtime stderr for violations and record them.
 * Fire-and-forget - errors are silently swallowed.
 */
@@ -12529,11 +12697,12 @@ function setWebSocketToolExecutor(executor) {
 const SERVER_TOOLS = [
 	"weather_info",
 	"web_search",
-	"web_fetch"
+	"web_fetch",
+	"decide"
 ];
 /**
-* Server-side tools (weather, web_search, web_fetch) run on B4M's API with company keys; every
-* other tool runs locally through the implementation its caller passes in.
+* Server-side tools (weather, web_search, web_fetch, decide) run on B4M's API with company keys;
+* every other tool runs locally through the implementation its caller passes in.
 */
 function isServerTool(toolName) {
 	return SERVER_TOOLS.includes(toolName);
@@ -13045,25 +13214,119 @@ function getProcessHooks() {
 	return cached;
 }
 //#endregion
+//#region src/tools/gateway/stages/sandboxEscalation.ts
+const SNIPPET_LENGTH = 200;
+const EXIT_CODE_LINE = /^Exit code:\s*(-?\d+)\s*$/gm;
+const LAUNCHER_MARKER = /^(?:sandbox-exec|bwrap):/m;
+const EPERM_TEXT = "Operation not permitted";
+const NETWORK_TIP = "If this was a network call, prefer '/sandbox:network on' to allow filtered egress.";
+/**
+* Detect a sandbox denial in a tool result. Both evidence kinds - a launcher marker
+* (`sandbox-exec:`, `bwrap:` at the start of a line) and the EPERM text a Seatbelt denial
+* surfaces on macOS - require a non-zero exit: a command that printed either and still exited
+* 0 (e.g. a tolerated `kill`, or output that merely quotes the launcher) was not stopped.
+*/
+function detectSandboxDenial(sandboxed, result) {
+	if (!sandboxed || !exitedNonZero(result)) return null;
+	const marker = LAUNCHER_MARKER.exec(result);
+	if (marker) return {
+		reason: "launcher",
+		snippet: snippetAt(result, marker.index)
+	};
+	const epermIndex = result.indexOf(EPERM_TEXT);
+	if (epermIndex === -1) return null;
+	return {
+		reason: "eperm",
+		snippet: snippetAt(result, epermIndex)
+	};
+}
+/**
+* The tool's exit code is non-zero. The last "Exit code:" line is the tool's own (the command
+* may have printed earlier ones); a command that ends its own output with such a line can still
+* be mistaken for a failure, which costs an extra question, never a silent unsandboxed run.
+*/
+function exitedNonZero(result) {
+	const exitCodes = [...result.matchAll(EXIT_CODE_LINE)];
+	const exitCode = exitCodes[exitCodes.length - 1]?.[1];
+	return exitCode !== void 0 && Number(exitCode) !== 0;
+}
+/** The error text from the start of the line holding `index`, so long stdout never hides it. */
+function snippetAt(result, index) {
+	const lineStart = result.lastIndexOf("\n", index) + 1;
+	return result.slice(lineStart, lineStart + SNIPPET_LENGTH);
+}
+/** A bash session (background, or promoted after yield_time_ms) may still be running. */
+function isSessionRun(args) {
+	return args.run_in_background === true || typeof args.yield_time_ms === "number";
+}
+/**
+* The sandbox stage of execution: run the attempt, record violations, and if the OS sandbox
+* denied it, ask before retrying outside the sandbox. The question is its own prompt: auto-accept,
+* session trust, trusted tools and the host allowlist never approve it, and when nobody can
+* answer, the model gets the sandbox error back. Session runs (background or yield_time_ms) are
+* never escalated: the sandboxed process may still be running.
+*/
+async function runSandboxed(input) {
+	const { descriptor, rawArgs, execArgs, isSandboxed, attempt, permissionManager, sandboxOrchestrator } = input;
+	const result = await attempt(execArgs);
+	await captureViolations(isSandboxed, result, commandTextOf(descriptor, rawArgs), sandboxOrchestrator);
+	const commandArg = sandboxedCommandArg(descriptor);
+	const command = commandTextOf(descriptor, rawArgs);
+	if (!commandArg || command === void 0 || isSessionRun(execArgs)) return result;
+	const denial = detectSandboxDenial(isSandboxed, result);
+	if (!denial) return result;
+	if (sandboxOrchestrator?.getConfig().allowUnsandboxedCommands === false) return `${result}\n\nThe command was denied by the OS sandbox and running it outside the sandbox is disabled. ${NETWORK_TIP}`;
+	const cwd = typeof execArgs.cwd === "string" ? execArgs.cwd : process.cwd();
+	const isHighRisk = assessCommandRisk(descriptor, rawArgs)?.level === "high";
+	const approvalKey = JSON.stringify([cwd, command]);
+	if (isHighRisk || !permissionManager.isSandboxEscalationApproved(approvalKey)) {
+		const response = await input.showPermissionPrompt(input.toolName, rawArgs, escalationPreview(denial, isHighRisk), "sandbox-escalation");
+		if (response.action === "deny") return `${result}\n\n${NETWORK_TIP}`;
+		if (response.action === "allow-session" && !isHighRisk) permissionManager.approveSandboxEscalation(approvalKey);
+	}
+	sandboxOrchestrator?.recordUnsandboxed();
+	return attempt({
+		...execArgs,
+		[commandArg]: command,
+		cwd
+	});
+}
+function escalationPreview(denial, isHighRisk) {
+	return `🛑 SANDBOX BLOCKED - This command was denied by the OS sandbox.
+
+- The sandbox prevented this operation because it violates filesystem or network restrictions.
+- ${NETWORK_TIP}\n- You can retry without the sandbox, but the command will run with full system access.\n` + (isHighRisk ? `- This command is high risk, so a session approval is not remembered: you will be asked again.\n` : "") + `\n@@Error Details@@\n${denial.snippet}`;
+}
+//#endregion
 //#region src/tools/gateway/stages/execution.ts
 /**
-* Run an approved call: checkpoint, execute (ToolRouter redacts and caps the output), capture
-* sandbox violations, offer retry on a sandbox failure or a path denial, then fire the
-* post-tool signals.
+* Run an approved call: checkpoint, execute through the sandbox stage (ToolRouter redacts and
+* caps the output; a sandbox denial asks before retrying unsandboxed), offer retry on a path
+* denial, then fire the post-tool signals.
 */
 async function executeAndRecord(input) {
 	const { toolName, descriptor, rawArgs, execArgs, isSandboxed, originalFn, apiClient, showPermissionPrompt } = input;
 	await checkpointBeforeWrite(input.checkpointStore, toolName, writePathOf(descriptor, rawArgs));
-	let result;
-	try {
-		result = await executeWithFuzzyConfirmation(toolName, execArgs, apiClient, originalFn, showPermissionPrompt);
-	} catch (err) {
-		const msg = err instanceof Error ? err.message : String(err);
-		if (!isPathAccessDenial(msg)) throw err;
-		result = msg;
-	}
-	await captureViolations(isSandboxed, result, rawArgs?.command, input.sandboxOrchestrator);
-	result = await retrySandboxFailure(isSandboxed, result, toolName, rawArgs, apiClient, originalFn, showPermissionPrompt);
+	const attempt = async (args) => {
+		try {
+			return await executeWithFuzzyConfirmation(toolName, args, apiClient, originalFn, showPermissionPrompt);
+		} catch (err) {
+			const msg = err instanceof Error ? err.message : String(err);
+			if (!isPathAccessDenial(msg)) throw err;
+			return msg;
+		}
+	};
+	let result = await runSandboxed({
+		toolName,
+		descriptor,
+		rawArgs,
+		execArgs,
+		isSandboxed,
+		attempt,
+		permissionManager: input.permissionManager,
+		showPermissionPrompt,
+		sandboxOrchestrator: input.sandboxOrchestrator
+	});
 	result = await retryPathAccessDenial(result, toolName, execArgs, input.allowedDirectories, input.configStore, apiClient, originalFn, showPermissionPrompt);
 	notifyFileChanged(input.agentContext, writePathOf(descriptor, execArgs), result);
 	getProcessHooks()?.firePostToolUse(toolName);
@@ -13087,21 +13350,6 @@ function notifyFileChanged(agentContext, writePath, result) {
 	agentContext.onFileChanged(writePath);
 }
 /**
-* If the result looks like a sandbox runtime failure, prompt the user to retry
-* the command unsandboxed. Returns the retry result or the original result.
-*/
-async function retrySandboxFailure(isSandboxed, result, toolName, originalArgs, apiClient, originalFn, showPermissionPrompt) {
-	if (!isSandboxFailure(isSandboxed, result)) return result;
-	if ((await showPermissionPrompt(toolName, originalArgs, `🛑 SANDBOX BLOCKED - This command was denied by the OS sandbox.
-
-- The sandbox prevented this operation because it violates filesystem or network restrictions.
-- If this was a network call, prefer '/sandbox:network on' to allow filtered egress instead of full access.
-- You can retry without the sandbox, but the command will run with full system access.
-
-@@Error Details@@\n${result.slice(0, 200)}`)).action !== "deny") return executeTool(toolName, originalArgs, apiClient, originalFn);
-	return result;
-}
-/**
 * Matches the three shapes of filesystem allow-list denial emitted by core:
 *  - file tools:  `Access denied: Cannot <op> files outside allowed directories.`
 *  - glob_files:  `Access denied: Cannot search outside allowed directories.` (no "files")
@@ -13194,7 +13442,7 @@ function wrapToolWithPermission(tool, deps) {
 		toolFn: async (input) => {
 			const args = input;
 			const descriptor = permissionManager.catalog.resolve(toolName);
-			const sandbox = prepareSandbox(toolName, args, deps.sandboxOrchestrator, allowedDirectories);
+			const sandbox = prepareSandbox(descriptor, args, deps.sandboxOrchestrator, allowedDirectories);
 			if (sandbox.kind === "blocked") return sandbox.message;
 			const isSandboxed = sandbox.kind === "sandboxed";
 			const effectiveArgs = isSandboxed ? sandbox.args : args;
@@ -13209,6 +13457,7 @@ function wrapToolWithPermission(tool, deps) {
 				originalFn,
 				apiClient: deps.apiClient,
 				showPermissionPrompt,
+				permissionManager,
 				agentContext: deps.agentContext,
 				configStore: deps.configStore,
 				sandboxOrchestrator: deps.sandboxOrchestrator,
@@ -13364,7 +13613,7 @@ The user has cycled into plan mode (Shift+Tab). Plan mode restricts WRITING, not
 - \`get_file_structure\` — AST overview of a file
 - \`agent_delegate\` — delegate to read-only subagents (e.g. 'explore', 'plan')
 - \`ask_user_question\` — ask the user clarifying questions
-- \`current_datetime\`, \`math_evaluate\`, \`web_search\`, \`web_fetch\` — also fine
+- \`current_datetime\`, \`math_evaluate\`, \`web_search\`, \`web_fetch\`, \`decide\` - also fine
 
 **Tools blocked in plan mode:**
 - \`bash_execute\`, \`edit_local_file\`, \`create_file\`, \`delete_file\` — and any other tool that mutates state.
@@ -13937,6 +14186,28 @@ const DEFAULT_AGENT_MODEL = ChatModels.CLAUDE_4_5_HAIKU;
 */
 const DEFAULT_THOROUGHNESS = "medium";
 //#endregion
+//#region src/utils/decisionModelProbe.ts
+const probeDecisionModels = async (apiClient) => {
+	try {
+		const body = await apiClient.get("/api/v1/decision-models");
+		return Array.isArray(body?.models) && body.models.length > 0;
+	} catch {
+		logger.debug("[decide] Decision-model availability lookup failed; hiding the tool until the next build.");
+		return false;
+	}
+};
+let decisionModelsProbe;
+/**
+* Whether this deployment serves a decision model this caller can call. The CLI holds no key
+* table of its own - the server resolves the key - so one request is the only honest signal;
+* a failed probe hides the tool rather than offering one that would only 503. A yes is cached
+* for the process (keys rarely appear mid-run); a no is not, so a later build re-checks.
+*/
+const hasDecisionModels = (apiClient) => decisionModelsProbe ??= probeDecisionModels(apiClient).then((available) => {
+	if (!available) decisionModelsProbe = void 0;
+	return available;
+});
+//#endregion
 //#region src/utils/toolsAdapter.ts
 /**
 * Simple CLI-friendly storage adapter
@@ -14124,7 +14395,7 @@ async function generateCliTools(userId, llm, model, permissionManager, showPermi
 		},
 		authOrigin: "session"
 	};
-	const filteredB4mTools = Object.fromEntries([
+	const enabledB4mToolNames = [
 		"dice_roll",
 		"math_evaluate",
 		"current_datetime",
@@ -14132,7 +14403,11 @@ async function generateCliTools(userId, llm, model, permissionManager, showPermi
 		"weather_info",
 		"web_search",
 		"web_fetch"
-	].filter((name) => name in cliSharedTools).map((name) => [name, cliSharedTools[name]]));
+	];
+	const normalizedAllowed = toolFilter?.allowedTools?.map(normalizeToolName);
+	const normalizedDenied = toolFilter?.deniedTools?.map(normalizeToolName);
+	if (!normalizedDenied?.includes("decide") && (!normalizedAllowed?.length || normalizedAllowed.includes("decide")) && await hasDecisionModels(apiClient)) enabledB4mToolNames.push("decide");
+	const filteredB4mTools = Object.fromEntries(enabledB4mToolNames.filter((name) => name in cliSharedTools).map((name) => [name, cliSharedTools[name]]));
 	const cliOnlyTools = await getCliOnlyTools();
 	const tools_to_generate = {
 		...filteredB4mTools,
@@ -14156,17 +14431,12 @@ async function generateCliTools(userId, llm, model, permissionManager, showPermi
 		checkpointStore
 	};
 	let tools = wrapTools(Object.values(toolsMap), wrapDeps);
-	if (toolFilter) {
-		const { allowedTools, deniedTools } = toolFilter;
-		const normalizedAllowed = allowedTools?.map(normalizeToolName);
-		const normalizedDenied = deniedTools?.map(normalizeToolName);
-		tools = tools.filter((tool) => {
-			const toolName = tool.toolSchema.name;
-			if (normalizedDenied && normalizedDenied.includes(toolName)) return false;
-			if (normalizedAllowed && normalizedAllowed.length > 0) return normalizedAllowed.includes(toolName);
-			return true;
-		});
-	}
+	if (toolFilter) tools = tools.filter((tool) => {
+		const toolName = tool.toolSchema.name;
+		if (normalizedDenied && normalizedDenied.includes(toolName)) return false;
+		if (normalizedAllowed && normalizedAllowed.length > 0) return normalizedAllowed.includes(toolName);
+		return true;
+	});
 	return {
 		tools,
 		agentContext
@@ -14195,6 +14465,7 @@ var PermissionManager = class {
 		this.deniedTools = /* @__PURE__ */ new Set();
 		this._sandboxMode = "disabled";
 		this._sandboxActive = false;
+		this.sandboxEscalationApprovals = /* @__PURE__ */ new Set();
 		this.trustedTools = new Set(trustedTools);
 		this.deniedTools = new Set(deniedTools);
 	}
@@ -14220,14 +14491,14 @@ var PermissionManager = class {
 	*
 	* @param toolName - The tool being checked
 	* @param options.isSandboxed - If true, the command will run inside the OS-level sandbox.
-	*   In auto-allow mode, sandboxed bash_execute commands skip the permission prompt
+	*   In auto-allow mode, sandboxed commands (a core tool whose descriptor declares `sandbox`) skip the permission prompt
 	*   because the sandbox provides the security boundary.
 	*/
 	needsPermission(toolName, options) {
 		const category = this.catalog.category(toolName);
 		if (this.deniedTools.has(toolName)) return true;
 		if (category === "auto_approve") return false;
-		if (options?.isSandboxed && toolName === "bash_execute" && this.isSandboxAutoAllow()) return false;
+		if (options?.isSandboxed && sandboxedCommandArg(this.catalog.resolve(toolName)) !== void 0 && this.isSandboxAutoAllow()) return false;
 		if (this.sessionTrustedTools.has(toolName)) return false;
 		if (category === "prompt_always") return true;
 		return !this.trustedTools.has(toolName);
@@ -14300,11 +14571,19 @@ var PermissionManager = class {
 	isSessionTrusted(toolName) {
 		return this.sessionTrustedTools.has(toolName);
 	}
+	/** Remember a session-scoped approval to run one command outside the sandbox. Never persisted. */
+	approveSandboxEscalation(key) {
+		this.sandboxEscalationApprovals.add(key);
+	}
+	isSandboxEscalationApproved(key) {
+		return this.sandboxEscalationApprovals.has(key);
+	}
 	/**
 	* Clear all session-scoped trust (called on exit or session reset)
 	*/
 	clearSessionTrust() {
 		this.sessionTrustedTools.clear();
+		this.sandboxEscalationApprovals.clear();
 	}
 	/**
 	* Clear all trusted tools