@bubblebrain-ai/bubble 0.0.14 → 0.0.16

package/dist/cli.d.ts

@@ -2,7 +2,7 @@
  * CLI argument parsing.
  */
 import type { PermissionMode, ThinkingLevel } from "./types.js";
-export type CliCommand = "default" | "serve";
+export type CliCommand = "default" | "serve" | "update";
 export interface CliArgs {
     command: CliCommand;
     model?: string;
@@ -22,6 +22,8 @@ export interface CliArgs {
     killOld?: boolean;
     /** `serve` subcommand: connect then exit. */
     dryRun?: boolean;
+    /** `update` subcommand: only report whether an update exists, don't install. */
+    checkOnly?: boolean;
 }
 export declare function parseArgs(argv: string[]): CliArgs;
 export declare function printHelp(): void;

package/dist/cli.js

@@ -14,6 +14,10 @@ export function parseArgs(argv) {
             args.command = "serve";
             startIndex = 1;
         }
+        else if (argv[0] === "update" || argv[0] === "upgrade") {
+            args.command = "update";
+            startIndex = 1;
+        }
     }
     for (let i = startIndex; i < argv.length; i++) {
         const arg = argv[i];
@@ -72,6 +76,9 @@ export function parseArgs(argv) {
             case "--dry-run":
                 args.dryRun = true;
                 break;
+            case "--check":
+                args.checkOnly = true;
+                break;
             default:
                 if (!arg.startsWith("-") && !args.prompt) {
                     args.prompt = arg;
@@ -85,6 +92,7 @@ export function printHelp() {
     console.log(`
 Usage:
   bubble [options] [prompt]              Start interactive TUI
+  bubble update [--check]                Update to the latest version (alias: upgrade)
   bubble serve --feishu [options]        Run as a Feishu bot host
 
 Options (default):
@@ -99,8 +107,12 @@ Options (default):
   --dangerously-skip-permissions
                            Enable bypass mode (auto-approve EVERY tool; disables all safety prompts)
   -p, --print              Non-interactive mode (single prompt)
+  -v, --version            Print the installed version and exit
   -h, --help               Show this help
 
+Options (update):
+  --check                  Only report whether a newer version exists
+
 Options (serve --feishu):
   --setup                  Force the wizard (scan QR + bind first scope)
   --kill-old               Kill any conflicting bubble instance for the same App ID

package/dist/context/projector.js

@@ -1,6 +1,7 @@
 import { getContextBudget } from "./budget.js";
 import { compactCurrentTurnToolGroups, compactMessages } from "./compact.js";
 import { pruneMessages } from "./prune.js";
+import { formatInternalContextBlock, formatInternalReminderBlock } from "../agent/internal-reminder-sanitizer.js";
 // Prefix-cache invariant: only the leading static system prompt is promoted to
 // the first provider message. Runtime meta reminders stay in the conversational
 // body at their original relative position, so a new per-turn reminder does not
@@ -166,14 +167,14 @@ function isEmptyAssistantMessage(message) {
 function formatMetaMessage(message) {
     switch (message.kind) {
         case "system-reminder":
-            return `Runtime reminder:\n${message.content}`;
+            return formatInternalReminderBlock(message.kind, message.content);
         case "runtime-context":
         default:
-            return `Runtime context:\n${message.content}`;
+            return formatInternalContextBlock(message.kind, message.content);
     }
 }
 function formatRuntimeSystemMessage(message) {
-    return `Runtime context:\n${message.content}`;
+    return formatInternalContextBlock("runtime-system", message.content);
 }
 function cloneMessage(message) {
     if (message.role === "assistant") {

package/dist/main.js

@@ -34,6 +34,16 @@ async function main() {
         printHelp();
         process.exit(0);
     }
+    if (process.argv.includes("-v") || process.argv.includes("--version")) {
+        const { getCurrentVersion } = await import("./update/index.js");
+        console.log(`v${getCurrentVersion()}`);
+        process.exit(0);
+    }
+    if (args.command === "update") {
+        const { runUpdateCommand } = await import("./update/index.js");
+        const code = await runUpdateCommand({ checkOnly: args.checkOnly });
+        process.exit(code);
+    }
     if (args.command === "serve") {
         if (args.serveHost !== "feishu") {
             console.error(chalk.red("Usage: bubble serve --feishu [--setup | --kill-old | --dry-run]"));
@@ -475,6 +485,8 @@ async function main() {
             runMemorySummary,
             runMemoryRefresh,
         };
+        const { getStartupUpdateNotice } = await import("./update/index.js");
+        const updateNotice = await getStartupUpdateNotice();
         const { runTui } = await import("./tui/run.js");
         await runTui(agent, args, {
             ...commonOptions,
@@ -482,6 +494,7 @@ async function main() {
             themeOverrides: themeConfig.overrides,
             detectedTheme,
             onThemeModeChange: (mode) => userConfig.setThemeMode(mode),
+            updateNotice: updateNotice ?? undefined,
         });
         if (sessionManager) {
             printOpenTuiExitSummary(sessionManager, {

package/dist/model-catalog.js

@@ -9,6 +9,7 @@ export const BUILTIN_PROVIDERS = [
     { id: "zai", name: "Z.AI", baseURL: "https://api.z.ai/api/paas/v4" },
     { id: "zai-coding-plan", name: "Z.AI Coding Plan", baseURL: "https://api.z.ai/api/coding/paas/v4" },
     { id: "alibaba", name: "Alibaba DashScope", baseURL: "https://dashscope.aliyuncs.com/compatible-mode/v1" },
+    { id: "stepfun", name: "StepFun Step Plan", baseURL: "https://api.stepfun.com/step_plan/v1" },
     { id: "moonshot-cn", name: "Moonshot (国内 platform.moonshot.cn)", baseURL: "https://api.moonshot.cn/v1" },
     { id: "moonshot-intl", name: "Moonshot (海外 platform.moonshot.ai)", baseURL: "https://api.moonshot.ai/v1" },
     { id: "kimi-for-coding", name: "Kimi for Coding", baseURL: "https://api.kimi.com/coding/v1" },
@@ -24,6 +25,7 @@ const GPT51_CODEX_MINI_LEVELS = ["off", "medium", "high"];
 const OPENAI_CHAT_LEVELS = ["off"];
 const TOGGLE_THINKING_LEVELS = ["off", "medium"];
 const DEEPSEEK_V4_LEVELS = ["high", "max"];
+const STEPFUN_REASONING_LEVELS = ["off", "low", "medium", "high"];
 export const BUILTIN_MODELS = [
     { id: "gpt-5.5", name: "gpt-5.5", providerId: "openai-codex", reasoningLevels: ALL_OPENAI_LEVELS, contextWindow: 272000, toolOutputTokenLimit: 10000 },
     { id: "gpt-5.4", name: "gpt-5.4", providerId: "openai-codex", reasoningLevels: ALL_OPENAI_LEVELS, contextWindow: 272000 },
@@ -59,6 +61,10 @@ export const BUILTIN_MODELS = [
     { id: "glm-4.6", name: "GLM-4.6", providerId: "zai-coding-plan", reasoningLevels: TOGGLE_THINKING_LEVELS, contextWindow: 200000 },
     { id: "qwen3.6-plus", name: "Qwen3.6 Plus", providerId: "alibaba", reasoningLevels: ["off"], contextWindow: 1048576 },
     { id: "qwen3.7-max", name: "Qwen3.7 Max", providerId: "alibaba", reasoningLevels: ["off"], contextWindow: 1048576 },
+    { id: "step-3.7-flash", name: "Step 3.7 Flash", providerId: "stepfun", reasoningLevels: STEPFUN_REASONING_LEVELS, contextWindow: 256000 },
+    { id: "step-3.5-flash-2603", name: "Step 3.5 Flash 2603", providerId: "stepfun", reasoningLevels: STEPFUN_REASONING_LEVELS },
+    { id: "step-3.5-flash", name: "Step 3.5 Flash", providerId: "stepfun", reasoningLevels: STEPFUN_REASONING_LEVELS },
+    { id: "step-router-v1", name: "Step Router V1", providerId: "stepfun", reasoningLevels: STEPFUN_REASONING_LEVELS },
     { id: "kimi-k2.6", name: "Kimi K2.6", providerId: "moonshot-cn", reasoningLevels: TOGGLE_THINKING_LEVELS, contextWindow: 256000 },
     { id: "k2.6-code-preview", name: "Kimi K2.6 Code Preview", providerId: "moonshot-cn", reasoningLevels: TOGGLE_THINKING_LEVELS, contextWindow: 256000 },
     { id: "kimi-k2.5", name: "Kimi K2.5", providerId: "moonshot-cn", reasoningLevels: TOGGLE_THINKING_LEVELS, contextWindow: 256000 },

package/dist/model-pricing.d.ts

@@ -1,8 +1,9 @@
 import type { TokenUsage } from "./types.js";
+export type PricingCurrency = "USD" | "CNY";
 export interface ModelPricing {
     providerId: string;
     modelId: string;
-    currency: "USD";
+    currency: PricingCurrency;
     inputCacheHitPerMillion: number;
     inputCacheMissPerMillion: number;
     outputPerMillion: number;
@@ -14,7 +15,7 @@ export interface ModelPricing {
     };
 }
 export interface UsageCost {
-    currency: "USD";
+    currency: PricingCurrency;
     cost: number;
     estimated: boolean;
 }

package/dist/model-pricing.js

@@ -21,6 +21,14 @@ export const MODEL_PRICING = [
             outputPerMillion: 3.48,
         },
     },
+    {
+        providerId: "stepfun",
+        modelId: "step-3.7-flash",
+        currency: "CNY",
+        inputCacheHitPerMillion: 0.27,
+        inputCacheMissPerMillion: 1.35,
+        outputPerMillion: 8.1,
+    },
 ];
 export function getModelPricing(providerId, modelId) {
     return MODEL_PRICING.find((item) => item.providerId === providerId && item.modelId === modelId);

package/dist/network/chatgpt-transport.d.ts

@@ -0,0 +1,16 @@
+import { type Dispatcher } from "undici";
+export type ChatGptFetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+export interface ChatGptFetchOptions {
+    fetch?: ChatGptFetch;
+    env?: NodeJS.ProcessEnv;
+}
+type RequestInitWithDispatcher = RequestInit & {
+    dispatcher?: Dispatcher;
+};
+export declare function chatGptFetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+export declare function getChatGptFetch(env?: NodeJS.ProcessEnv): ChatGptFetch;
+export declare function createChatGptFetch(options?: ChatGptFetchOptions): ChatGptFetch;
+export declare function createChatGptDispatcher(env?: NodeJS.ProcessEnv, input?: RequestInfo | URL): Dispatcher | undefined;
+export declare function withChatGptNetworkOptions(input: RequestInfo | URL, init: RequestInit | undefined, env?: NodeJS.ProcessEnv, dispatcher?: Dispatcher | undefined): RequestInitWithDispatcher;
+export declare function normalizeChatGptNetworkError(error: unknown, env?: NodeJS.ProcessEnv): Error;
+export {};

package/dist/network/chatgpt-transport.js

@@ -0,0 +1,240 @@
+import { readFileSync } from "node:fs";
+import { delimiter } from "node:path";
+import { rootCertificates } from "node:tls";
+import { Agent, ProxyAgent } from "undici";
+let cachedDefaultFetch;
+export function chatGptFetch(input, init) {
+    return getChatGptFetch()(input, init);
+}
+export function getChatGptFetch(env = process.env) {
+    const signature = networkEnvSignature(env);
+    if (!cachedDefaultFetch || cachedDefaultFetch.signature !== signature) {
+        cachedDefaultFetch = {
+            signature,
+            fetch: createChatGptFetch({ env }),
+        };
+    }
+    return cachedDefaultFetch.fetch;
+}
+export function createChatGptFetch(options = {}) {
+    const env = options.env ?? process.env;
+    const fetchImpl = options.fetch ?? ((input, init) => globalThis.fetch(input, init));
+    const dispatcher = createChatGptDispatcher(env);
+    return async (input, init) => {
+        const requestInit = withChatGptNetworkOptions(input, init, env, dispatcher);
+        try {
+            return await fetchImpl(input, requestInit);
+        }
+        catch (error) {
+            throw normalizeChatGptNetworkError(error, env);
+        }
+    };
+}
+export function createChatGptDispatcher(env = process.env, input) {
+    if (isBunRuntime())
+        return undefined;
+    const ca = loadExtraCaCertificates(env);
+    if (!hasProxyEnv(env) && ca.length === 0)
+        return undefined;
+    const proxy = input ? nodeProxyForUrl(input, env) : defaultNodeProxy(env);
+    const caOptions = ca.length > 0 ? { ca: [...rootCertificates, ...ca] } : undefined;
+    if (proxy) {
+        return new ProxyAgent({
+            uri: proxy,
+            ...(caOptions ? { requestTls: caOptions, proxyTls: caOptions } : {}),
+        });
+    }
+    return caOptions ? new Agent({ connect: caOptions }) : undefined;
+}
+export function withChatGptNetworkOptions(input, init, env = process.env, dispatcher = createChatGptDispatcher(env, input)) {
+    const next = { ...(init ?? {}) };
+    if (isBunRuntime()) {
+        const proxy = bunProxyForUrl(input, env);
+        if (proxy)
+            next.proxy = proxy;
+        const ca = bunExtraCaFiles(env);
+        if (ca.length > 0)
+            next.tls = { ...(next.tls ?? {}), ca };
+        return next;
+    }
+    if (dispatcher)
+        next.dispatcher = dispatcher;
+    return next;
+}
+export function normalizeChatGptNetworkError(error, env = process.env) {
+    const text = errorMessageChain(error).join("\n");
+    if (!isChatGptNetworkErrorText(text)) {
+        return error instanceof Error ? error : new Error(String(error));
+    }
+    const message = [
+        "ChatGPT connection failed before Bubble received a response.",
+        isCertificateErrorText(text)
+            ? "TLS certificate verification failed. If you are on a corporate proxy, VPN, or HTTPS inspection network, start Bubble with NODE_EXTRA_CA_CERTS=/absolute/path/to/ca.pem or BUBBLE_EXTRA_CA_CERTS=/absolute/path/to/ca.pem."
+            : "This looks like a proxy or network transport failure.",
+        hasProxyEnv(env)
+            ? "Bubble is using proxy environment variables for ChatGPT requests. Make sure NO_PROXY includes localhost,127.0.0.1."
+            : "If your network requires a proxy, set HTTPS_PROXY or HTTP_PROXY, and set NO_PROXY=localhost,127.0.0.1.",
+        "Do not disable TLS verification with NODE_TLS_REJECT_UNAUTHORIZED=0.",
+        `Original error: ${firstMeaningfulErrorMessage(error) || "unknown network error"}`,
+    ].join(" ");
+    return new Error(message, { cause: error });
+}
+function hasProxyEnv(env) {
+    return Boolean(env.HTTPS_PROXY || env.https_proxy || env.HTTP_PROXY || env.http_proxy || env.ALL_PROXY || env.all_proxy);
+}
+function isBunRuntime() {
+    return typeof globalThis.Bun !== "undefined";
+}
+function bunProxyForUrl(input, env) {
+    const url = urlFromInput(input);
+    if (!url || shouldBypassProxy(url, env))
+        return undefined;
+    const allProxy = env.ALL_PROXY ?? env.all_proxy;
+    if (url.protocol === "https:")
+        return env.HTTPS_PROXY ?? env.https_proxy ?? allProxy;
+    if (url.protocol === "http:")
+        return env.HTTP_PROXY ?? env.http_proxy ?? allProxy;
+    return undefined;
+}
+function nodeProxyForUrl(input, env) {
+    const url = urlFromInput(input);
+    if (!url || shouldBypassProxy(url, env))
+        return undefined;
+    if (url.protocol === "https:")
+        return env.HTTPS_PROXY ?? env.https_proxy ?? env.ALL_PROXY ?? env.all_proxy;
+    if (url.protocol === "http:")
+        return env.HTTP_PROXY ?? env.http_proxy ?? env.ALL_PROXY ?? env.all_proxy;
+    return defaultNodeProxy(env);
+}
+function defaultNodeProxy(env) {
+    return env.HTTPS_PROXY ?? env.https_proxy ?? env.HTTP_PROXY ?? env.http_proxy ?? env.ALL_PROXY ?? env.all_proxy;
+}
+function bunExtraCaFiles(env) {
+    const bun = globalThis.Bun;
+    if (!bun?.file)
+        return [];
+    return extraCaCertificatePaths(env).map((path) => bun.file(path));
+}
+function urlFromInput(input) {
+    if (input instanceof URL)
+        return input;
+    if (typeof input === "string")
+        return URL.canParse(input) ? new URL(input) : undefined;
+    const url = input.url;
+    return URL.canParse(url) ? new URL(url) : undefined;
+}
+function shouldBypassProxy(url, env) {
+    const noProxy = (env.NO_PROXY ?? env.no_proxy ?? "").trim();
+    if (!noProxy)
+        return false;
+    if (noProxy === "*")
+        return true;
+    const hostname = url.hostname.toLowerCase();
+    const port = url.port;
+    return noProxy
+        .split(/[,\s]+/)
+        .filter(Boolean)
+        .some((entry) => noProxyEntryMatches(entry.toLowerCase(), hostname, port));
+}
+function noProxyEntryMatches(entry, hostname, port) {
+    const [entryHost, entryPort] = entry.includes(":") ? entry.split(":") : [entry, ""];
+    if (entryPort && entryPort !== port)
+        return false;
+    if (entryHost === hostname)
+        return true;
+    if (entryHost.startsWith("*."))
+        return hostname.endsWith(entryHost.slice(1));
+    if (entryHost.startsWith("."))
+        return hostname.endsWith(entryHost);
+    return false;
+}
+function loadExtraCaCertificates(env) {
+    const paths = extraCaCertificatePaths(env);
+    return paths.map((path) => {
+        try {
+            return readFileSync(path, "utf-8");
+        }
+        catch (error) {
+            throw new Error(`Failed to read ChatGPT custom CA certificate at ${path}. Check NODE_EXTRA_CA_CERTS or BUBBLE_EXTRA_CA_CERTS.`, {
+                cause: error,
+            });
+        }
+    });
+}
+function extraCaCertificatePaths(env) {
+    const bubbleValue = env.BUBBLE_EXTRA_CA_CERTS?.trim();
+    if (bubbleValue) {
+        return bubbleValue.split(delimiter).map((item) => item.trim()).filter(Boolean);
+    }
+    const nodeValue = env.NODE_EXTRA_CA_CERTS?.trim();
+    return nodeValue ? [nodeValue] : [];
+}
+function networkEnvSignature(env) {
+    return [
+        env.HTTP_PROXY,
+        env.http_proxy,
+        env.HTTPS_PROXY,
+        env.https_proxy,
+        env.ALL_PROXY,
+        env.all_proxy,
+        env.NO_PROXY,
+        env.no_proxy,
+        env.NODE_EXTRA_CA_CERTS,
+        env.BUBBLE_EXTRA_CA_CERTS,
+    ].join("\0");
+}
+function isChatGptNetworkErrorText(text) {
+    return [
+        /fetch failed/i,
+        /network.*failed/i,
+        /socket connection was closed unexpectedly/i,
+        /\bConnectionClosed\b/i,
+        /\bECONNRESET\b/i,
+        /\bECONNREFUSED\b/i,
+        /\bETIMEDOUT\b/i,
+        /\bEPIPE\b/i,
+        /\bUND_ERR_/i,
+        /socket hang up/i,
+        /certificate/i,
+        /unable to verify/i,
+        /self[- ]signed/i,
+    ].some((pattern) => pattern.test(text));
+}
+function isCertificateErrorText(text) {
+    return [
+        /unknown certificate verification error/i,
+        /certificate (?:verify|verification) (?:failed|error)/i,
+        /unable to verify (?:the )?(?:first )?certificate/i,
+        /UNABLE_TO_(?:VERIFY_LEAF_SIGNATURE|GET_ISSUER_CERT_LOCALLY)/i,
+        /SELF_SIGNED_CERT_IN_CHAIN/i,
+        /DEPTH_ZERO_SELF_SIGNED_CERT/i,
+        /CERT_(?:HAS_EXPIRED|UNTRUSTED|INVALID)/i,
+        /self[- ]signed certificate/i,
+    ].some((pattern) => pattern.test(text));
+}
+function firstMeaningfulErrorMessage(error) {
+    return errorMessageChain(error).find((item) => item && item !== "Error");
+}
+function errorMessageChain(error) {
+    const messages = [];
+    let current = error;
+    for (let depth = 0; current && depth < 8; depth++) {
+        if (current instanceof Error) {
+            messages.push(current.name, current.message);
+            current = current.cause;
+            continue;
+        }
+        if (typeof current === "object") {
+            const record = current;
+            for (const key of ["name", "code", "message"]) {
+                if (typeof record[key] === "string")
+                    messages.push(record[key]);
+            }
+            current = record.cause;
+            continue;
+        }
+        messages.push(String(current));
+        break;
+    }
+    return messages;
+}

package/dist/oauth/openai-codex.d.ts

@@ -2,8 +2,13 @@
  * OpenAI Codex OAuth login (PKCE + local callback).
  */
 import type { OAuthTokens } from "./types.js";
+import { type ChatGptFetch } from "../network/chatgpt-transport.js";
 export interface OpenAICodexLoginCallbacks {
     onStatus: (message: string) => void;
 }
-export declare function loginOpenAICodex(callbacks?: OpenAICodexLoginCallbacks): Promise<OAuthTokens>;
-export declare function refreshOpenAICodex(refreshToken: string): Promise<OAuthTokens>;
+export declare function loginOpenAICodex(callbacks?: OpenAICodexLoginCallbacks, options?: {
+    fetch?: ChatGptFetch;
+}): Promise<OAuthTokens>;
+export declare function refreshOpenAICodex(refreshToken: string, options?: {
+    fetch?: ChatGptFetch;
+}): Promise<OAuthTokens>;

package/dist/oauth/openai-codex.js

@@ -4,6 +4,7 @@
 import { createServer } from "node:http";
 import { exec } from "node:child_process";
 import { randomBytes, createHash } from "node:crypto";
+import { chatGptFetch } from "../network/chatgpt-transport.js";
 const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 const AUTH_URL = "https://auth.openai.com/oauth/authorize";
 const TOKEN_URL = "https://auth.openai.com/oauth/token";
@@ -92,7 +93,8 @@ function extractAccountId(idToken) {
     const auth = claims?.["https://api.openai.com/auth"];
     return auth?.chatgpt_account_id || auth?.account_id || claims?.sub;
 }
-export async function loginOpenAICodex(callbacks) {
+export async function loginOpenAICodex(callbacks, options = {}) {
+    const fetchImpl = options.fetch ?? chatGptFetch;
     callbacks?.onStatus("Starting OpenAI Codex OAuth login...");
     const pkce = generatePKCE();
     const state = generateState();
@@ -119,7 +121,7 @@ export async function loginOpenAICodex(callbacks) {
         throw new Error("OAuth state mismatch. Possible CSRF attack.");
     }
     callbacks?.onStatus("Exchanging authorization code for tokens...");
-    const response = await fetch(TOKEN_URL, {
+    const response = await fetchImpl(TOKEN_URL, {
         method: "POST",
         headers: { "Content-Type": "application/x-www-form-urlencoded" },
         body: new URLSearchParams({
@@ -146,8 +148,9 @@ export async function loginOpenAICodex(callbacks) {
         accountId,
     };
 }
-export async function refreshOpenAICodex(refreshToken) {
-    const response = await fetch(TOKEN_URL, {
+export async function refreshOpenAICodex(refreshToken, options = {}) {
+    const fetchImpl = options.fetch ?? chatGptFetch;
+    const response = await fetchImpl(TOKEN_URL, {
         method: "POST",
         headers: { "Content-Type": "application/x-www-form-urlencoded" },
         body: new URLSearchParams({

package/dist/orchestrator/default-hooks.js

@@ -2,6 +2,7 @@ import { classifyTask } from "../agent/task-classifier.js";
 import { classifyTaskSize } from "../agent/task-size.js";
 import { EvidenceTracker } from "../agent/evidence-tracker.js";
 import { ExecutionGovernor } from "../agent/execution-governor.js";
+import { DiscoveryBarrier } from "../agent/discovery-barrier.js";
 import { arbitrateToolCall } from "../agent/tool-arbiter.js";
 import { buildEditRetryEscalationReminder, buildSmallTaskHint, buildTaskSummaryReminder, buildWorkflowPhaseReminder, } from "../prompt/reminders.js";
 import { reminderForTaskType } from "../prompt/task-reminders.js";
@@ -14,6 +15,11 @@ export function createDefaultHooks() {
                 const taskType = classifyTask(ctx.input);
                 ctx.state.taskType = taskType;
                 ctx.state.governor = new ExecutionGovernor(taskType);
+                ctx.state.discoveryBarrier = new DiscoveryBarrier({
+                    cwd: ctx.cwd,
+                    input: ctx.input,
+                    enabled: taskType === "repo_orientation",
+                });
                 const taskReminder = reminderForTaskType(taskType);
                 if (taskReminder) {
                     ctx.queueReminder(taskReminder);
@@ -63,8 +69,12 @@ export function createDefaultHooks() {
         {
             beforeToolCall(ctx) {
                 const arbitration = arbitrateToolCall(ctx.toolCall);
-                ctx.replaceToolCall({ ...arbitration.toolCall, ...(arbitration.note ? { arbiterNote: arbitration.note } : {}) });
-                ctx.state.governor?.beforeToolCall(ctx.toolCall);
+                const toolCall = { ...arbitration.toolCall, ...(arbitration.note ? { arbiterNote: arbitration.note } : {}) };
+                ctx.replaceToolCall(toolCall);
+                ctx.state.governor?.beforeToolCall(toolCall);
+                const blockedResult = ctx.state.discoveryBarrier?.beforeToolCall(toolCall);
+                if (blockedResult)
+                    ctx.blockToolCall(blockedResult);
             },
             afterToolCall(ctx) {
                 if (ctx.toolCall.arbiterNote) {
@@ -78,6 +88,7 @@ export function createDefaultHooks() {
                 }
                 ctx.state.evidenceTracker?.observe(ctx.toolCall, ctx.result);
                 ctx.state.governor?.afterToolResult(ctx.toolCall, ctx.result);
+                ctx.state.discoveryBarrier?.afterToolCall(ctx.toolCall, ctx.result);
                 // Edit/write retry-escalation: models can spiral on "identical content"
                 // or "not found" errors. Nudge them to re-ground or switch strategy.
                 if (isMutationTool(ctx.toolCall.name) && ctx.result.isError) {

package/dist/orchestrator/hooks.d.ts

@@ -3,10 +3,12 @@ import type { ContentPart, ParsedToolCall, ToolRegistryEntry, ToolResult } from
 import type { TaskType } from "../agent/task-classifier.js";
 import type { ExecutionGovernor } from "../agent/execution-governor.js";
 import type { EvidenceTracker } from "../agent/evidence-tracker.js";
+import type { DiscoveryBarrier } from "../agent/discovery-barrier.js";
 import type { WorkflowPhase } from "./workflow.js";
 export interface TurnHookState {
     taskType?: TaskType;
     governor?: ExecutionGovernor;
+    discoveryBarrier?: DiscoveryBarrier;
     evidenceTracker?: EvidenceTracker;
     workflowPhase?: WorkflowPhase;
     workflowKey?: string;

package/dist/provider-openai-codex.d.ts

@@ -1,5 +1,6 @@
 import type { Provider, ReasoningEffort, ThinkingLevel, TokenUsage } from "./types.js";
 import type { OAuthCredentials } from "./oauth/types.js";
+import { type ChatGptFetch } from "./network/chatgpt-transport.js";
 export interface CodexModelDescriptor {
     id: string;
     displayName?: string;
@@ -25,6 +26,7 @@ export declare function createOpenAICodexProvider(options: {
     thinkingLevel?: ThinkingLevel;
     promptCacheKey?: string;
     auth?: OpenAICodexAuthAdapter;
+    fetch?: ChatGptFetch;
 }): Provider;
 export declare function normalizeOpenAICodexUsage(usage: any): TokenUsage;
 export declare function buildOpenAICodexPromptCacheKey(input: {
@@ -35,5 +37,6 @@ export declare function buildOpenAICodexPromptCacheKey(input: {
 export declare function fetchOpenAICodexModels(options: {
     baseURL: string;
     accessToken: string;
+    fetch?: ChatGptFetch;
 }): Promise<CodexModelDescriptor[]>;
 export declare function sortCodexModelDescriptors(descriptors: CodexModelDescriptor[]): CodexModelDescriptor[];

package/dist/provider-openai-codex.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import { listBuiltinModels } from "./model-catalog.js";
 import { resolveProviderRequestConfig } from "./provider-transform.js";
+import { chatGptFetch } from "./network/chatgpt-transport.js";
 const DEFAULT_CODEX_BASE_URL = "https://chatgpt.com/backend-api";
 const OPENAI_BETA_RESPONSES = "responses=experimental";
 const TOKEN_REFRESH_GRACE_MS = 5 * 60 * 1000;
@@ -42,6 +43,7 @@ export function extractChatGptAccountId(accessToken) {
 }
 export function createOpenAICodexProvider(options) {
     const sessionId = globalThis.crypto?.randomUUID?.() ?? `bubble_${Date.now()}`;
+    const fetchImpl = options.fetch ?? chatGptFetch;
     let refreshPromise;
     async function resolveRequestAuth(forceRefresh = false) {
         let credentials = await options.auth?.getCredentials();
@@ -77,7 +79,7 @@ export function createOpenAICodexProvider(options) {
         }));
         const sendRequest = async (forceRefresh = false) => {
             const { accessToken, accountId } = await resolveRequestAuth(forceRefresh);
-            return fetch(resolveCodexUrl(options.baseURL), buildCodexRequestInit({
+            return fetchImpl(resolveCodexUrl(options.baseURL), buildCodexRequestInit({
                 accessToken,
                 accountId,
                 sessionId,
@@ -278,8 +280,9 @@ export async function fetchOpenAICodexModels(options) {
     if (!accountId) {
         return [];
     }
+    const fetchImpl = options.fetch ?? chatGptFetch;
     for (const path of MODEL_DISCOVERY_PATHS) {
-        const response = await fetch(resolveRelativeUrl(options.baseURL, path), {
+        const response = await fetchImpl(resolveRelativeUrl(options.baseURL, path), {
             method: "GET",
             headers: buildBaseHeaders(options.accessToken, accountId, globalThis.crypto?.randomUUID?.() ?? `bubble_${Date.now()}`, { accept: "application/json" }),
         }).catch(() => undefined);
@@ -451,6 +454,12 @@ function isTransientCodexTransportError(error) {
         /\bEPIPE\b/i,
         /socket hang up/i,
         /fetch failed/i,
+        /unknown certificate verification error/i,
+        /certificate (?:verify|verification) (?:failed|error)/i,
+        /unable to verify (?:the )?(?:first )?certificate/i,
+        /UNABLE_TO_(?:VERIFY_LEAF_SIGNATURE|GET_ISSUER_CERT_LOCALLY)/i,
+        /SELF_SIGNED_CERT_IN_CHAIN/i,
+        /CERT_(?:HAS_EXPIRED|UNTRUSTED|INVALID)/i,
     ].some((pattern) => pattern.test(text));
 }
 function errorMessageChain(error) {

package/dist/provider-transform.js

@@ -36,6 +36,15 @@ export function resolveProviderRequestConfig(providerId, modelId, requestedLevel
             },
         };
     }
+    if (providerId === "stepfun") {
+        return {
+            effectiveThinkingLevel,
+            reasoningContentEcho: "none",
+            extraBody: effectiveThinkingLevel === "off"
+                ? undefined
+                : { reasoning_effort: effectiveThinkingLevel },
+        };
+    }
     // Zhipu/Z.AI OpenAI-compatible endpoints expose reasoning via a provider-specific
     // `thinking` block rather than OpenAI's `reasoning_effort` shape.
     if (["zhipuai", "zhipuai-coding-plan", "zai", "zai-coding-plan"].includes(providerId)) {

package/dist/reasoning-debug.js

@@ -1,8 +1,10 @@
 import { createHash } from "node:crypto";
 import { appendFileSync, mkdirSync } from "node:fs";
 import { dirname } from "node:path";
+import { sanitizeInternalReminderBlocks } from "./agent/internal-reminder-sanitizer.js";
 const DEBUG_PATH = process.env.BUBBLE_DEBUG_REASONING_STREAM?.trim();
 const INCLUDE_PREVIEW = process.env.BUBBLE_DEBUG_REASONING_PREVIEW !== "0";
+const INCLUDE_RAW_PREVIEW = ["1", "true", "yes", "on"].includes(process.env.BUBBLE_DEBUG_REASONING_RAW?.trim().toLowerCase() ?? "");
 const PREVIEW_CHARS = 180;
 let sequence = 0;
 export function summarizeDebugText(value) {
@@ -13,7 +15,8 @@ export function summarizeDebugText(value) {
     const hash = createHash("sha256").update(value).digest("hex").slice(0, 16);
     const summary = { length: value.length, hash };
     if (INCLUDE_PREVIEW) {
-        summary.preview = value.replace(/\s+/g, " ").slice(0, PREVIEW_CHARS);
+        const previewValue = INCLUDE_RAW_PREVIEW ? value : sanitizeInternalReminderBlocks(value);
+        summary.preview = previewValue.replace(/\s+/g, " ").slice(0, PREVIEW_CHARS);
     }
     return summary;
 }