@nomad-e/bluma-cli 0.1.62 → 0.1.64

package/dist/main.js

@@ -319,35 +319,13 @@ var init_sandbox_policy = __esm({
     init_runtime_config();
     init_permission_rules();
     BLOCKED_COMMAND_PATTERNS = [
-      { pattern: /^sudo\s+/i, reason: "Privilege escalation is not allowed." },
-      { pattern: /^doas\s+/i, reason: "Privilege escalation is not allowed." },
-      { pattern: /^su\s+/i, reason: "Privilege escalation is not allowed." },
-      { pattern: /^pkexec\s+/i, reason: "Privilege escalation is not allowed." },
-      { pattern: /\bmkfs\./i, reason: "Disk formatting commands are blocked." },
-      { pattern: /\bdd\s+.*of=\/dev\/(sd|hd|nvme)/i, reason: "Raw disk writes are blocked." },
-      { pattern: /\brm\s+(-[rf]+\s+)*\/($|\s)/i, reason: "Deleting filesystem roots is blocked." },
-      { pattern: /\brm\s+-[rf]*\s+~($|\s)/i, reason: "Deleting home roots is blocked." },
-      { pattern: /\bcurl\s+.*\|\s*(ba)?sh/i, reason: "Pipe-to-shell remote execution is blocked." },
-      { pattern: /\bwget\s+.*\|\s*(ba)?sh/i, reason: "Pipe-to-shell remote execution is blocked." }
+      // No command patterns blocked — sandbox isolation handles safety
     ];
     HIGH_RISK_COMMAND_PATTERNS = [
-      /\brm\s+-[rf]/i,
-      /\bmv\s+.+\s+\/(?!tmp\b)/i,
-      /\bchmod\b/i,
-      /\bchown\b/i,
-      /\bssh\b/i,
-      /\bscp\b/i,
-      /\brsync\b/i,
-      /\bdocker\b/i,
-      /\bkubectl\b/i
+      // No high-risk patterns — all commands allowed inside sandbox
     ];
     MODERATE_RISK_COMMAND_PATTERNS = [
-      /\bnpm\s+(install|update|uninstall)\b/i,
-      /\bpnpm\s+(add|install|update|remove)\b/i,
-      /\byarn\s+(add|install|remove)\b/i,
-      /\buv\s+(add|remove|sync)\b/i,
-      /\bpip\s+install\b/i,
-      /\bgit\s+(commit|push|rebase|reset|clean)\b/i
+      // No moderate-risk patterns — all commands allowed inside sandbox
     ];
   }
 });
@@ -1742,10 +1720,10 @@ var init_themes = __esm({
 import React19 from "react";
 import { render } from "ink";
 import { EventEmitter as EventEmitter4 } from "events";
-import fs35 from "fs";
-import path40 from "path";
+import fs37 from "fs";
+import path42 from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
-import { spawn as spawn5 } from "child_process";
+import { spawn as spawn6 } from "child_process";
 import { v4 as uuidv412 } from "uuid";
 
 // src/app/ui/App.tsx
@@ -2554,7 +2532,7 @@ var filterSlashCommands = (query) => {
     let tier = 3;
     let scorePrimary = 0;
     let scoreSecondary = Number.MAX_SAFE_INTEGER;
-    let scoreTertiary = name.length;
+    const scoreTertiary = name.length;
     if (isPrefix) {
       tier = 0;
       scorePrimary = q.length * -1;
@@ -4292,12 +4270,12 @@ function EditToolDiffPanel({
   maxHeight = EDIT_DIFF_PREVIEW_MAX_LINES,
   fallbackSnippet
 }) {
-  const path41 = filePath.trim() || "unknown file";
+  const path43 = filePath.trim() || "unknown file";
   const diff = diffText?.trim() ?? "";
   return /* @__PURE__ */ jsxs5(Box5, { flexDirection: "column", children: [
     /* @__PURE__ */ jsx5(Box5, { flexDirection: "row", flexWrap: "wrap", children: /* @__PURE__ */ jsxs5(Text5, { color: isNewFile ? BLUMA_TERMINAL.success : void 0, children: [
       isNewFile ? "Created " : "Wrote to ",
-      /* @__PURE__ */ jsx5(Text5, { bold: true, children: path41 })
+      /* @__PURE__ */ jsx5(Text5, { bold: true, children: path43 })
     ] }) }),
     description ? /* @__PURE__ */ jsx5(Text5, { dimColor: true, wrap: "wrap", children: description }) : null,
     diff.length > 0 ? /* @__PURE__ */ jsx5(Box5, { marginTop: 0, children: /* @__PURE__ */ jsx5(SimpleDiff, { text: diff, maxHeight, frame: true }) }) : fallbackSnippet ? /* @__PURE__ */ jsxs5(Box5, { flexDirection: "column", marginTop: 0, children: [
@@ -4626,7 +4604,7 @@ var renderFindByName = ({ args }) => {
 var renderGrepSearch = ({ args }) => {
   const parsed = parseArgs(args);
   const query = parsed.query || "";
-  const path41 = parsed.path || ".";
+  const path43 = parsed.path || ".";
   return /* @__PURE__ */ jsxs8(Box8, { flexDirection: "row", flexWrap: "wrap", children: [
     /* @__PURE__ */ jsxs8(Text8, { color: BLUMA_TERMINAL.muted, children: [
       '"',
@@ -4635,7 +4613,7 @@ var renderGrepSearch = ({ args }) => {
     ] }),
     /* @__PURE__ */ jsxs8(Text8, { color: BLUMA_TERMINAL.m3OnSurface, bold: true, children: [
       " ",
-      path41
+      path43
     ] })
   ] });
 };
@@ -5061,12 +5039,12 @@ var ConfirmationPrompt = memo4(ConfirmationPromptComponent);
 
 // src/app/agent/agent.ts
 import * as dotenv from "dotenv";
-import path38 from "path";
-import os26 from "os";
+import path40 from "path";
+import os27 from "os";
 
 // src/app/agent/tool_invoker.ts
-import { promises as fs23 } from "fs";
-import path25 from "path";
+import { promises as fs25 } from "fs";
+import path27 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/app/agent/tools/natives/edit.ts
@@ -5121,9 +5099,9 @@ function countOccurrences(text, search) {
   return text.split(search).length - 1;
 }
 function ensureCorrectEdit(currentContent, originalOldString, originalNewString, expectedReplacements) {
-  let finalOldString = originalOldString;
-  let finalNewString = originalNewString;
-  let occurrences = countOccurrences(currentContent, finalOldString);
+  const finalOldString = originalOldString;
+  const finalNewString = originalNewString;
+  const occurrences = countOccurrences(currentContent, finalOldString);
   if (occurrences > 0) {
     return [finalOldString, finalNewString, occurrences];
   }
@@ -5280,7 +5258,7 @@ async function calculateEdit(filePath, oldString, newString, expectedReplacement
     };
   }
   let currentContent = null;
-  let isNewFile = false;
+  const isNewFile = false;
   try {
     const stats = await fs6.stat(normalizedFilePath);
     if (stats.size > MAX_FILE_SIZE) {
@@ -5728,7 +5706,7 @@ async function readLines(args) {
     if (startIndex >= total_lines) {
       throw new Error(`start_line (${startLine}) exceeds file length (${total_lines} lines).`);
     }
-    let endIndex = Math.min(endLine, total_lines);
+    const endIndex = Math.min(endLine, total_lines);
     const contentLines = lines.slice(startIndex, endIndex);
     let content = contentLines.join("\n");
     if (args.line_number_prefix === true) {
@@ -6050,7 +6028,7 @@ var DEFAULT_IGNORE_PATTERNS = [
 var MAX_RESULTS2 = 100;
 var MAX_DEPTH_DEFAULT = 10;
 function globToRegex(glob) {
-  let regex = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*/g, "{{DOUBLESTAR}}").replace(/\*/g, "[^/]*").replace(/\?/g, ".").replace(/{{DOUBLESTAR}}/g, ".*");
+  const regex = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*/g, "{{DOUBLESTAR}}").replace(/\*/g, "[^/]*").replace(/\?/g, ".").replace(/{{DOUBLESTAR}}/g, ".*");
   return new RegExp(`^${regex}$`, "i");
 }
 function shouldIgnore(name, ignorePatterns, includeHidden) {
@@ -8935,7 +8913,7 @@ async function dream(args = {}) {
     const used = /* @__PURE__ */ new Set();
     for (let i = 0; i < entries.length; i++) {
       if (used.has(entries[i].id)) continue;
-      let current = { ...entries[i] };
+      const current = { ...entries[i] };
       used.add(entries[i].id);
       for (let j = i + 1; j < entries.length; j++) {
         if (used.has(entries[j].id)) continue;
@@ -9210,6 +9188,1021 @@ async function context_collapse(args = {}) {
 
 // src/app/agent/runtime/native_tool_catalog.ts
 init_agent_coordination();
+
+// src/app/agent/tools/natives/create-next-app.ts
+init_sandbox_policy();
+import { promises as fs23 } from "fs";
+import path25 from "path";
+
+// src/app/agent/tools/natives/shell_command.ts
+init_sandbox_policy();
+import os15 from "os";
+import { spawn as spawn5 } from "child_process";
+var MAX_OUTPUT_SIZE2 = 3e4;
+var MAX_OUTPUT_LINES = 200;
+var OUTPUT_TRUNCATION_MESSAGE = "\n\n[OUTPUT TRUNCATED - use `| head -n X` or redirect to file for full output]";
+var DANGEROUS_PATTERNS = [
+  // === ELEVAÇÃO DE PRIVILÉGIOS ===
+  /^sudo\s+/i,
+  // sudo commands
+  /^doas\s+/i,
+  // doas (BSD sudo alternative)
+  /^su\s+/i,
+  // switch user
+  /^pkexec\s+/i,
+  // PolicyKit execution
+  /\|\s*sudo\s+/i,
+  // piped to sudo
+  /;\s*sudo\s+/i,
+  // chained with sudo
+  /&&\s*sudo\s+/i,
+  // AND chained with sudo
+  // === COMANDOS DESTRUTIVOS ===
+  /\brm\s+(-[rf]+\s+)*[\/~]/i,
+  // rm com paths perigosos (/, ~)
+  /\brm\s+-[rf]*\s+\*/i,
+  // rm -rf *
+  /\bchmod\s+(777|666)\s+\//i,
+  // chmod 777/666 em paths root
+  /\bchown\s+.*\s+\//i,
+  // chown em paths root
+  /\bdd\s+.*of=\/dev\/(sd|hd|nvme)/i,
+  // dd para discos
+  /\bmkfs\./i,
+  // format filesystem
+  />\s*\/dev\/(sd|hd|nvme)/i,
+  // redirect para disco
+  /\bshred\s+/i,
+  // secure delete
+  // === FORK BOMB / RESOURCE EXHAUSTION ===
+  /:\(\)\s*\{\s*:\|:&\s*\}\s*;:/,
+  // fork bomb clássico
+  /\bwhile\s+true\s*;\s*do/i,
+  // infinite loop
+  /\byes\s+\|/i,
+  // yes piped (resource exhaustion)
+  // === NETWORK PERIGOSO ===
+  /\bcurl\s+.*\|\s*(ba)?sh/i,
+  // curl | bash (remote code exec)
+  /\bwget\s+.*\|\s*(ba)?sh/i,
+  // wget | bash
+  /\bnc\s+-[el]/i
+  // netcat listener (backdoor)
+];
+var INTERACTIVE_PATTERNS2 = [
+  /^(vim|vi|nano|emacs|pico)\s*/i,
+  // editors
+  /^(less|more|most)\s*/i,
+  // pagers
+  /^(top|htop|btop|atop|nmon)\s*/i,
+  // monitoring tools
+  /^(ssh|telnet|ftp|sftp)\s+/i,
+  // remote connections
+  /^(mysql|psql|redis-cli|mongo|mongosh)\s*$/i,
+  // database CLIs (sem script)
+  /^(python|python3|node|ruby|irb|lua)\s*$/i,
+  // REPLs sem script
+  /^(gdb|lldb)\s*/i,
+  // debuggers
+  /^(bc|dc)\s*$/i
+  // calculators
+];
+function shellCommand(args) {
+  const {
+    command,
+    timeout = 300,
+    // 5 minutos por padrão
+    cwd = process.cwd(),
+    verbose = false
+  } = args;
+  return new Promise((resolve2) => {
+    const startTime = Date.now();
+    const platform = os15.platform();
+    const commandTrimmed = command.trim();
+    let resolvedCwd;
+    try {
+      resolvedCwd = resolveCommandCwd(cwd);
+    } catch (err) {
+      const result = {
+        status: "blocked",
+        exitCode: null,
+        stdout: "",
+        stderr: `Command blocked: ${err.message}`,
+        command,
+        cwd,
+        platform,
+        duration: Date.now() - startTime,
+        blockedReason: "sandbox_path_violation"
+      };
+      return resolve2(formatResult(result, verbose));
+    }
+    for (const pattern of DANGEROUS_PATTERNS) {
+      if (pattern.test(commandTrimmed)) {
+        const result = {
+          status: "blocked",
+          exitCode: null,
+          stdout: "",
+          stderr: `Command blocked: "${commandTrimmed}" requires elevated privileges (sudo/doas). These commands require interactive password input which cannot be handled. Alternatives:
+1. Run the command manually in terminal
+2. Configure passwordless sudo for this specific command
+3. Run BluMa as root (not recommended)`,
+          command,
+          cwd,
+          platform,
+          duration: Date.now() - startTime,
+          blockedReason: "requires_sudo"
+        };
+        return resolve2(formatResult(result, verbose));
+      }
+    }
+    for (const pattern of INTERACTIVE_PATTERNS2) {
+      if (pattern.test(commandTrimmed)) {
+        const result = {
+          status: "blocked",
+          exitCode: null,
+          stdout: "",
+          stderr: `Command blocked: "${commandTrimmed}" is an interactive command. Interactive commands require user input and cannot be handled by the agent. Alternatives:
+1. Use non-interactive alternatives (e.g., 'cat' instead of 'less')
+2. Run the command manually in terminal
+3. For editors, use edit_tool instead`,
+          command,
+          cwd,
+          platform,
+          duration: Date.now() - startTime,
+          blockedReason: "interactive_command"
+        };
+        return resolve2(formatResult(result, verbose));
+      }
+    }
+    let shellCmd;
+    let shellArgs;
+    if (platform === "win32") {
+      shellCmd = process.env.COMSPEC || "cmd.exe";
+      shellArgs = ["/c", command];
+    } else {
+      shellCmd = process.env.SHELL || "/bin/bash";
+      shellArgs = ["-c", command];
+    }
+    let stdout = "";
+    let stderr = "";
+    let stdoutTruncated = false;
+    let stderrTruncated = false;
+    let timedOut = false;
+    let finished = false;
+    const childProcess = spawn5(shellCmd, shellArgs, {
+      cwd: resolvedCwd,
+      env: process.env,
+      // Importante: no Windows, precisamos do shell, mas spawn já lida com isso
+      windowsHide: true
+    });
+    const timeoutId = setTimeout(() => {
+      if (!finished) {
+        timedOut = true;
+        childProcess.kill("SIGTERM");
+        setTimeout(() => {
+          if (!finished) {
+            childProcess.kill("SIGKILL");
+          }
+        }, 2e3);
+      }
+    }, timeout * 1e3);
+    if (childProcess.stdout) {
+      childProcess.stdout.on("data", (data) => {
+        if (!stdoutTruncated) {
+          stdout += data.toString();
+          if (stdout.length > MAX_OUTPUT_SIZE2) {
+            stdout = stdout.substring(0, MAX_OUTPUT_SIZE2) + OUTPUT_TRUNCATION_MESSAGE;
+            stdoutTruncated = true;
+          }
+        }
+      });
+    }
+    if (childProcess.stderr) {
+      childProcess.stderr.on("data", (data) => {
+        if (!stderrTruncated) {
+          stderr += data.toString();
+          if (stderr.length > MAX_OUTPUT_SIZE2) {
+            stderr = stderr.substring(0, MAX_OUTPUT_SIZE2) + OUTPUT_TRUNCATION_MESSAGE;
+            stderrTruncated = true;
+          }
+        }
+      });
+    }
+    childProcess.on("error", (error) => {
+      if (!finished) {
+        finished = true;
+        clearTimeout(timeoutId);
+        const result = {
+          status: "error",
+          exitCode: null,
+          stdout: stdout.trim(),
+          stderr: `Failed to execute command: ${error.message}`,
+          command,
+          cwd,
+          platform,
+          duration: Date.now() - startTime
+        };
+        resolve2(formatResult(result, verbose));
+      }
+    });
+    childProcess.on("close", (code, signal) => {
+      if (!finished) {
+        finished = true;
+        clearTimeout(timeoutId);
+        const result = {
+          status: timedOut ? "timeout" : code === 0 ? "success" : "error",
+          exitCode: code,
+          stdout: stdout.trim(),
+          stderr: timedOut ? `Command timed out after ${timeout} seconds
+${stderr.trim()}` : stderr.trim(),
+          command,
+          cwd,
+          platform,
+          duration: Date.now() - startTime,
+          truncated: stdoutTruncated || stderrTruncated
+        };
+        resolve2(formatResult(result, verbose));
+      }
+    });
+  });
+}
+function smartTruncate(text) {
+  if (!text) return { result: "", wasTruncated: false };
+  let result = text;
+  let wasTruncated = false;
+  if (result.length > MAX_OUTPUT_SIZE2) {
+    result = result.substring(0, MAX_OUTPUT_SIZE2);
+    wasTruncated = true;
+  }
+  const lines = result.split("\n");
+  if (lines.length > MAX_OUTPUT_LINES) {
+    const head = lines.slice(0, 50);
+    const tail = lines.slice(-50);
+    result = head.join("\n") + `
+
+... [${lines.length - 100} lines omitted] ...
+
+` + tail.join("\n");
+    wasTruncated = true;
+  }
+  return { result, wasTruncated };
+}
+function formatResult(result, verbose) {
+  const stdout = smartTruncate(result.stdout);
+  const stderr = smartTruncate(result.stderr);
+  const wasTruncated = result.truncated || stdout.wasTruncated || stderr.wasTruncated;
+  if (verbose) {
+    return JSON.stringify({
+      ...result,
+      stdout: stdout.result,
+      stderr: stderr.result,
+      truncated: wasTruncated
+    }, null, 2);
+  }
+  const output = {
+    status: result.status,
+    exitCode: result.exitCode
+  };
+  if (stdout.result) {
+    output.stdout = stdout.result;
+  }
+  if (stderr.result) {
+    output.stderr = stderr.result;
+  }
+  if (result.status === "timeout") {
+    output.message = `Command exceeded timeout of ${result.duration / 1e3}s`;
+  }
+  if (result.status === "blocked" && result.blockedReason) {
+    output.blockedReason = result.blockedReason;
+  }
+  if (wasTruncated) {
+    output.warning = "Output truncated (30KB / 200 lines max). Use `| head -n X` or redirect to file.";
+  }
+  return JSON.stringify(output, null, 2);
+}
+
+// src/app/agent/tools/natives/create-next-app.ts
+var MINIMAL_FILES = {
+  "package.json": `{
+  "name": "{{NAME}}",
+  "version": "0.1.0",
+  "private": true,
+  "scripts": {
+    "dev": "next dev",
+    "build": "next build",
+    "start": "next start",
+    "lint": "next lint"
+  },
+  "dependencies": {
+    "next": "^14.1.0",
+    "react": "^18.2.0",
+    "react-dom": "^18.2.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.11.0",
+    "@types/react": "^18.2.0",
+    "@types/react-dom": "^18.2.0",
+    "typescript": "^5.3.0",
+    "tailwindcss": "^3.4.0",
+    "postcss": "^8.4.0",
+    "autoprefixer": "^10.4.0",
+    "eslint": "^8.56.0",
+    "eslint-config-next": "^14.1.0"
+  }
+}
+`,
+  "tsconfig.json": `{
+  "compilerOptions": {
+    "lib": ["dom", "dom.iterable", "esnext"],
+    "allowJs": true,
+    "skipLibCheck": true,
+    "strict": true,
+    "noEmit": true,
+    "esModuleInterop": true,
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "jsx": "preserve",
+    "incremental": true,
+    "plugins": [
+      {
+        "name": "next"
+      }
+    ],
+    "paths": {
+      "@/*": ["./*"]
+    }
+  },
+  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
+  "exclude": ["node_modules"]
+}
+`,
+  "next.config.js": `/** @type {import('next').NextConfig} */
+const nextConfig = {
+  output: 'standalone',
+  reactStrictMode: true,
+}
+
+module.exports = nextConfig
+`,
+  "tailwind.config.ts": `import type { Config } from 'tailwindcss'
+
+const config: Config = {
+  content: [
+    './pages/**/*.{js,ts,jsx,tsx,mdx}',
+    './components/**/*.{js,ts,jsx,tsx,mdx}',
+    './app/**/*.{js,ts,jsx,tsx,mdx}',
+  ],
+  theme: {
+    extend: {
+      backgroundImage: {
+        'gradient-radial': 'radial-gradient(var(--tw-gradient-stops))',
+        'gradient-conic':
+          'conic-gradient(from 180deg at 50% 50%, var(--tw-gradient-stops))',
+      },
+    },
+  },
+  plugins: [],
+}
+export default config
+`,
+  "postcss.config.js": `module.exports = {
+  plugins: {
+    tailwindcss: {},
+    autoprefixer: {},
+  },
+}
+`,
+  ".eslintrc.json": `{
+  "extends": "next/core-web-vitals"
+}
+`,
+  ".gitignore": `# dependencies
+/node_modules
+/.pnp
+.pnp.js
+
+# testing
+/coverage
+
+# next.js
+/.next/
+/out/
+
+# production
+/build
+
+# misc
+.DS_Store
+*.pem
+
+# debug
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+
+# local env files
+.env*.local
+.env
+
+# typescript
+*.tsbuildinfo
+next-env.d.ts
+`
+};
+var FULL_FILES = {
+  ...MINIMAL_FILES,
+  // App Router structure
+  "app/layout.tsx": `import type { Metadata } from "next";
+import { Inter } from "next/font/google";
+import "./globals.css";
+
+const inter = Inter({ subsets: ["latin"] });
+
+export const metadata: Metadata = {
+  title: "{{NAME}}",
+  description: "Generated by create-next-app",
+};
+
+export default function RootLayout({
+  children,
+}: Readonly<{
+  children: React.ReactNode;
+}>) {
+  return (
+    <html lang="en">
+      <body className={inter.className}>{children}</body>
+    </html>
+  );
+}
+`,
+  "app/page.tsx": `export default function Home() {
+  return (
+    <main className="flex min-h-screen flex-col items-center justify-between p-24">
+      <div className="z-10 w-full max-w-5xl items-center justify-between font-mono text-sm lg:flex">
+        <p className="fixed left-0 top-0 flex w-full justify-center border-b border-gray-300 bg-gradient-to-b from-zinc-200 pb-6 pt-8 backdrop-blur-2xl dark:border-neutral-800 dark:bg-zinc-800/30 dark:from-inherit lg:static lg:w-auto  lg:rounded-xl lg:border lg:bg-gray-200 lg:p-4 lg:dark:bg-zinc-800/30">
+          Welcome to <code className="font-mono font-bold">{{NAME}}</code>
+        </p>
+      </div>
+
+      <div className="mb-32 grid text-center lg:max-w-5xl lg:w-full lg:mb-0 lg:grid-cols-4 lg:text-left">
+        <a
+          href="https://nextjs.org/docs"
+          className="group rounded-lg border border-transparent px-5 py-4 transition-colors hover:border-gray-300 hover:bg-gray-100 hover:dark:border-neutral-700 hover:dark:bg-neutral-800/30"
+          target="_blank"
+          rel="noopener noreferrer"
+        >
+          <h2 className={\`mb-3 text-2xl font-semibold\`}>
+            Docs{" "}
+            <span className="inline-block transition-transform group-hover:translate-x-1 motion-reduce:transform-none">
+              -&gt;
+            </span>
+          </h2>
+          <p className={\`m-0 max-w-[30ch] text-sm opacity-50\`}>
+            Find in-depth information about Next.js features and API.
+          </p>
+        </a>
+
+        <a
+          href="https://nextjs.org/learn"
+          className="group rounded-lg border border-transparent px-5 py-4 transition-colors hover:border-gray-300 hover:bg-gray-100 hover:dark:border-neutral-700 hover:dark:bg-neutral-800/30"
+          target="_blank"
+          rel="noopener noreferrer"
+        >
+          <h2 className={\`mb-3 text-2xl font-semibold\`}>
+            Learn{" "}
+            <span className="inline-block transition-transform group-hover:translate-x-1 motion-reduce:transform-none">
+              -&gt;
+            </span>
+          </h2>
+          <p className={\`m-0 max-w-[30ch] text-sm opacity-50\`}>
+            Learn about Next.js in an interactive course with&nbsp;quizzes!
+          </p>
+        </a>
+
+        <a
+          href="https://vercel.com/templates"
+          className="group rounded-lg border border-transparent px-5 py-4 transition-colors hover:border-gray-300 hover:bg-gray-100 hover:dark:border-neutral-700 hover:dark:bg-neutral-800/30"
+          target="_blank"
+          rel="noopener noreferrer"
+        >
+          <h2 className={\`mb-3 text-2xl font-semibold\`}>
+            Templates{" "}
+            <span className="inline-block transition-transform group-hover:translate-x-1 motion-reduce:transform-none">
+              -&gt;
+            </span>
+          </h2>
+          <p className={\`m-0 max-w-[30ch] text-sm opacity-50\`}>
+            Explore starter templates for Next.js.
+          </p>
+        </a>
+
+        <a
+          href="https://vercel.com/new"
+          className="group rounded-lg border border-transparent px-5 py-4 transition-colors hover:border-gray-300 hover:bg-gray-100 hover:dark:border-neutral-700 hover:dark:bg-neutral-800/30"
+          target="_blank"
+          rel="noopener noreferrer"
+        >
+          <h2 className={\`mb-3 text-2xl font-semibold\`}>
+            Deploy{" "}
+            <span className="inline-block transition-transform group-hover:translate-x-1 motion-reduce:transform-none">
+              -&gt;
+            </span>
+          </h2>
+          <p className={\`m-0 max-w-[30ch] text-sm opacity-50 text-balance\`}>
+            Instantly deploy your Next.js site to a shareable URL with Vercel.
+          </p>
+        </a>
+      </div>
+    </main>
+  );
+}
+`,
+  "app/globals.css": `@tailwind base;
+@tailwind components;
+@tailwind utilities;
+
+:root {
+  --foreground-rgb: 0, 0, 0;
+  --background-start-rgb: 214, 219, 220;
+  --background-end-rgb: 255, 255, 255;
+}
+
+@media (prefers-color-scheme: dark) {
+  :root {
+    --foreground-rgb: 255, 255, 255;
+    --background-start-rgb: 0, 0, 0;
+    --background-end-rgb: 0, 0, 0;
+  }
+}
+
+body {
+  color: rgb(var(--foreground-rgb));
+  background: linear-gradient(
+      to bottom,
+      transparent,
+      rgb(var(--background-end-rgb))
+    )
+    rgb(var(--background-start-rgb));
+}
+
+@layer utilities {
+  .text-balance {
+    text-wrap: balance;
+  }
+}
+`,
+  // shadcn/ui base components
+  "components/ui/button.tsx": `import * as React from "react"
+import { cva, type VariantProps } from "class-variance-authority"
+import { cn } from "@/lib/utils"
+
+const buttonVariants = cva(
+  "inline-flex items-center justify-center whitespace-nowrap rounded-md text-sm font-medium ring-offset-background transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50",
+  {
+    variants: {
+      variant: {
+        default: "bg-primary text-primary-foreground hover:bg-primary/90",
+        destructive:
+          "bg-destructive text-destructive-foreground hover:bg-destructive/90",
+        outline:
+          "border border-input bg-background hover:bg-accent hover:text-accent-foreground",
+        secondary:
+          "bg-secondary text-secondary-foreground hover:bg-secondary/80",
+        ghost: "hover:bg-accent hover:text-accent-foreground",
+        link: "text-primary underline-offset-4 hover:underline",
+      },
+      size: {
+        default: "h-10 px-4 py-2",
+        sm: "h-9 rounded-md px-3",
+        lg: "h-11 rounded-md px-8",
+        icon: "h-10 w-10",
+      },
+    },
+    defaultVariants: {
+      variant: "default",
+      size: "default",
+    },
+  }
+)
+
+export interface ButtonProps
+  extends React.ButtonHTMLAttributes<HTMLButtonElement>,
+    VariantProps<typeof buttonVariants> {
+  asChild?: boolean
+}
+
+const Button = React.forwardRef<HTMLButtonElement, ButtonProps>(
+  ({ className, variant, size, asChild = false, ...props }, ref) => {
+    const Comp = asChild ? Slot : "button"
+    return (
+      <Comp
+        className={cn(buttonVariants({ variant, size, className }))}
+        ref={ref}
+        {...props}
+      />
+    )
+  }
+)
+Button.displayName = "Button"
+
+export { Button, buttonVariants }
+`,
+  "components/ui/card.tsx": `import * as React from "react"
+import { cn } from "@/lib/utils"
+
+const Card = React.forwardRef<
+  HTMLDivElement,
+  React.HTMLAttributes<HTMLDivElement>
+>(({ className, ...props }, ref) => (
+  <div
+    ref={ref}
+    className={cn(
+      "rounded-lg border bg-card text-card-foreground shadow-sm",
+      className
+    )}
+    {...props}
+  />
+))
+Card.displayName = "Card"
+
+const CardHeader = React.forwardRef<
+  HTMLDivElement,
+  React.HTMLAttributes<HTMLDivElement>
+>(({ className, ...props }, ref) => (
+  <div
+    ref={ref}
+    className={cn("flex flex-col space-y-1.5 p-6", className)}
+    {...props}
+  />
+))
+CardHeader.displayName = "CardHeader"
+
+const CardTitle = React.forwardRef<
+  HTMLParagraphElement,
+  React.HTMLAttributes<HTMLHeadingElement>
+>(({ className, ...props }, ref) => (
+  <h3
+    ref={ref}
+    className={cn(
+      "text-2xl font-semibold leading-none tracking-tight",
+      className
+    )}
+    {...props}
+  />
+))
+CardTitle.displayName = "CardTitle"
+
+const CardDescription = React.forwardRef<
+  HTMLParagraphElement,
+  React.HTMLAttributes<HTMLParagraphElement>
+>(({ className, ...props }, ref) => (
+  <p
+    ref={ref}
+    className={cn("text-sm text-muted-foreground", className)}
+    {...props}
+  />
+))
+CardDescription.displayName = "CardDescription"
+
+const CardContent = React.forwardRef<
+  HTMLDivElement,
+  React.HTMLAttributes<HTMLDivElement>
+>(({ className, ...props }, ref) => (
+  <div ref={ref} className={cn("p-6 pt-0", className)} {...props} />
+))
+CardContent.displayName = "CardContent"
+
+const CardFooter = React.forwardRef<
+  HTMLDivElement,
+  React.HTMLAttributes<HTMLDivElement>
+>(({ className, ...props }, ref) => (
+  <div
+    ref={ref}
+    className={cn("flex items-center p-6 pt-0", className)}
+    {...props}
+  />
+))
+CardFooter.displayName = "CardFooter"
+
+export { Card, CardHeader, CardFooter, CardTitle, CardDescription, CardContent }
+`,
+  "components/ui/input.tsx": `import * as React from "react"
+import { cn } from "@/lib/utils"
+
+export interface InputProps
+  extends React.InputHTMLAttributes<HTMLInputElement> {}
+
+const Input = React.forwardRef<HTMLInputElement, InputProps>(
+  ({ className, type, ...props }, ref) => {
+    return (
+      <input
+        type={type}
+        className={cn(
+          "flex h-10 w-full rounded-md border border-input bg-background px-3 py-2 text-sm ring-offset-background file:border-0 file:bg-transparent file:text-sm file:font-medium placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:cursor-not-allowed disabled:opacity-50",
+          className
+        )}
+        ref={ref}
+        {...props}
+      />
+    )
+  }
+)
+Input.displayName = "Input"
+
+export { Input }
+`,
+  "lib/utils.ts": `import { type ClassValue, clsx } from "clsx"
+import { twMerge } from "tailwind-merge"
+
+export function cn(...inputs: ClassValue[]) {
+  return twMerge(clsx(inputs))
+}
+`,
+  // Add clsx and tailwind-merge to package.json dependencies
+  "package.json.full": `{
+  "name": "{{NAME}}",
+  "version": "0.1.0",
+  "private": true,
+  "scripts": {
+    "dev": "next dev",
+    "build": "next build",
+    "start": "next start",
+    "lint": "next lint"
+  },
+  "dependencies": {
+    "next": "^14.1.0",
+    "react": "^18.2.0",
+    "react-dom": "^18.2.0",
+    "class-variance-authority": "^0.7.0",
+    "clsx": "^2.1.0",
+    "tailwind-merge": "^2.2.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.11.0",
+    "@types/react": "^18.2.0",
+    "@types/react-dom": "^18.2.0",
+    "typescript": "^5.3.0",
+    "tailwindcss": "^3.4.0",
+    "postcss": "^8.4.0",
+    "autoprefixer": "^10.4.0",
+    "eslint": "^8.56.0",
+    "eslint-config-next": "^14.1.0"
+  }
+}
+`
+};
+async function createFile(filePath, content, projectName) {
+  const dir = path25.dirname(filePath);
+  await fs23.mkdir(dir, { recursive: true });
+  const replacedContent = content.replace(/{{NAME}}/g, projectName);
+  await fs23.writeFile(filePath, replacedContent, "utf-8");
+}
+async function createNextApp(args) {
+  const {
+    name,
+    directory,
+    template = "full"
+  } = args;
+  try {
+    if (!name || typeof name !== "string") {
+      return { success: false, error: "name is required and must be a string" };
+    }
+    if (!/^[a-z0-9-_]+$/.test(name)) {
+      return {
+        success: false,
+        error: "name must contain only lowercase letters, numbers, hyphens, and underscores"
+      };
+    }
+    const baseDir = directory ? resolveWorkspacePath(directory) : resolveWorkspacePath(".");
+    const projectPath = path25.join(baseDir, name);
+    try {
+      await fs23.access(projectPath);
+      return {
+        success: false,
+        error: `Directory already exists: ${projectPath}. Remove it first or choose a different name.`
+      };
+    } catch {
+    }
+    await fs23.mkdir(projectPath, { recursive: true });
+    const filesToCreate = template === "minimal" ? MINIMAL_FILES : FULL_FILES;
+    const filesCreated = [];
+    for (const [relativePath, content] of Object.entries(filesToCreate)) {
+      if (relativePath === "package.json.full") continue;
+      const fullPath = path25.join(projectPath, relativePath);
+      await createFile(fullPath, content, name);
+      filesCreated.push(relativePath);
+    }
+    if (template === "full") {
+      const packageJsonPath = path25.join(projectPath, "package.json");
+      const fullPackageJson = FULL_FILES["package.json.full"];
+      if (fullPackageJson) {
+        await createFile(packageJsonPath, fullPackageJson, name);
+      }
+    }
+    console.log(`[create-next-app] Installing dependencies in ${projectPath}...`);
+    const installResult = await shellCommand({
+      command: "npm install",
+      cwd: projectPath,
+      timeout: 300
+      // 5 minutos
+    });
+    const installJson = JSON.parse(installResult);
+    if (installJson.status !== "success") {
+      console.warn("[create-next-app] npm install warnings:", installJson.stderr);
+    }
+    const nextSteps = [
+      `cd ${name}`,
+      "npm run dev",
+      "Open http://localhost:3000",
+      template === "full" ? "Components shadcn/ui dispon\xEDveis em components/ui/" : "Adicione componentes conforme necess\xE1rio"
+    ];
+    console.log(`[create-next-app] Projeto criado: ${projectPath}`);
+    return {
+      success: true,
+      projectPath,
+      directory: name,
+      filesCreated,
+      nextSteps
+    };
+  } catch (error) {
+    console.error("[create-next-app] Error:", error.message);
+    return {
+      success: false,
+      error: error.message || String(error)
+    };
+  }
+}
+
+// src/app/agent/tools/natives/deploy-app.ts
+init_sandbox_policy();
+import { promises as fs24 } from "fs";
+import path26 from "path";
+var EXCLUDE_PATTERNS = [
+  "node_modules",
+  ".next",
+  ".git",
+  ".gitignore",
+  "dist",
+  "build",
+  "*.log",
+  ".DS_Store",
+  ".env.local",
+  ".env*.local",
+  "coverage",
+  ".vercel",
+  ".turbo"
+];
+async function createProjectZip(projectDir, zipPath) {
+  const excludes = [];
+  for (const pattern of EXCLUDE_PATTERNS) {
+    excludes.push("--exclude", pattern);
+  }
+  const zipCommand = `zip -r "${zipPath}" . ${excludes.join(" ")}`;
+  const result = await shellCommand({
+    command: zipCommand,
+    cwd: projectDir,
+    timeout: 120
+    // 2 minutos para zippar
+  });
+  const resultJson = JSON.parse(result);
+  if (resultJson.status !== "success") {
+    throw new Error(`Failed to create ZIP: ${resultJson.stderr}`);
+  }
+  return zipPath;
+}
+async function uploadToSeverino(zipPath, severinoUrl, name, apiKey) {
+  const deployUrl = `${severinoUrl.replace(/\/$/, "")}/api/v1/deploy`;
+  const curlArgs = [
+    "-X",
+    "POST",
+    deployUrl,
+    "-F",
+    `file=@${zipPath}`
+  ];
+  if (name) {
+    curlArgs.push("-F", `name=${name}`);
+  }
+  if (apiKey) {
+    curlArgs.push("-H", `Authorization: Bearer ${apiKey}`);
+    curlArgs.push("-H", `X-API-Key: ${apiKey}`);
+  }
+  curlArgs.push("-H", "Accept: application/json");
+  const curlCommand = `curl ${curlArgs.join(" ")}`;
+  const result = await shellCommand({
+    command: curlCommand,
+    timeout: 60
+    // 1 minuto para upload
+  });
+  const resultJson = JSON.parse(result);
+  if (resultJson.status !== "success") {
+    throw new Error(`Upload failed: ${resultJson.stderr}`);
+  }
+  try {
+    const response = JSON.parse(resultJson.stdout);
+    if (response.success === false || response.error) {
+      const errorMsg = typeof response.error === "string" ? response.error : response.error?.message || "Deploy failed";
+      return {
+        success: false,
+        error: errorMsg
+      };
+    }
+    const data = response.data || {};
+    return {
+      success: true,
+      appId: data.appId,
+      name: data.name,
+      status: data.status || "building",
+      url: severinoUrl.replace(/\/$/, "") + `/app/${data.appId}`,
+      message: data.message || "Deploy iniciado"
+    };
+  } catch (parseError) {
+    throw new Error(`Failed to parse response: ${parseError.message}`);
+  }
+}
+async function deployApp(args) {
+  const envSeverinoUrl = process.env.SEVERINO_URL || "http://localhost:3000";
+  const envApiKey = process.env.SEVERINO_API_KEY || void 0;
+  const {
+    projectDir,
+    name,
+    severinoUrl = envSeverinoUrl,
+    apiKey = envApiKey
+  } = args;
+  try {
+    if (!projectDir || typeof projectDir !== "string") {
+      return { success: false, error: "projectDir is required" };
+    }
+    const resolvedProjectDir = resolveWorkspacePath(projectDir);
+    try {
+      await fs24.access(resolvedProjectDir);
+    } catch {
+      return {
+        success: false,
+        error: `Project directory not found: ${resolvedProjectDir}`
+      };
+    }
+    const packageJsonPath = path26.join(resolvedProjectDir, "package.json");
+    try {
+      await fs24.access(packageJsonPath);
+    } catch {
+      return {
+        success: false,
+        error: "Not a Next.js project: package.json not found"
+      };
+    }
+    const packageJsonContent = await fs24.readFile(packageJsonPath, "utf-8");
+    const packageJson = JSON.parse(packageJsonContent);
+    const hasNext = packageJson.dependencies?.next || packageJson.devDependencies?.next;
+    if (!hasNext) {
+      return {
+        success: false,
+        error: "Not a Next.js project: next not found in dependencies"
+      };
+    }
+    const appName = name || packageJson.name || path26.basename(resolvedProjectDir);
+    const tempDir = path26.join(resolvedProjectDir, ".tmp");
+    await fs24.mkdir(tempDir, { recursive: true });
+    const zipPath = path26.join(tempDir, `${appName}-${Date.now()}.zip`);
+    console.log(`[deploy-app] Creating ZIP: ${zipPath}`);
+    await createProjectZip(resolvedProjectDir, zipPath);
+    const zipStats = await fs24.stat(zipPath);
+    const zipSizeMB = zipStats.size / 1024 / 1024;
+    if (zipSizeMB > 50) {
+      await fs24.unlink(zipPath).catch(() => {
+      });
+      await fs24.rmdir(tempDir).catch(() => {
+      });
+      return {
+        success: false,
+        error: `ZIP too large: ${zipSizeMB.toFixed(2)}MB (max: 50MB)`
+      };
+    }
+    console.log(`[deploy-app] ZIP size: ${zipSizeMB.toFixed(2)}MB`);
+    console.log(`[deploy-app] Uploading to ${severinoUrl}...`);
+    const deployResult = await uploadToSeverino(zipPath, severinoUrl, appName, apiKey);
+    try {
+      await fs24.unlink(zipPath);
+      await fs24.rmdir(tempDir);
+    } catch (e) {
+      console.warn("[deploy-app] Cleanup warning:", e);
+    }
+    if (deployResult.success) {
+      console.log(`[deploy-app] Deploy iniciado: ${deployResult.appId}`);
+    }
+    return deployResult;
+  } catch (error) {
+    console.error("[deploy-app] Error:", error.message);
+    return {
+      success: false,
+      error: error.message || String(error)
+    };
+  }
+}
+
+// src/app/agent/runtime/native_tool_catalog.ts
+init_sandbox_policy();
 var NATIVE_TOOL_ENTRIES = [
   {
     metadata: {
@@ -9773,6 +10766,28 @@ var NATIVE_TOOL_ENTRIES = [
       description: "Kill a running worker by session_id. Use when a worker is stuck or needs to be cancelled immediately. Sends SIGTERM and cleans up mailbox."
     },
     implementation: killAgent
+  },
+  {
+    metadata: {
+      name: "create_next_app",
+      category: "filesystem",
+      riskLevel: "write",
+      autoApproveInLocal: false,
+      autoApproveInSandbox: true,
+      description: "Create a new Next.js project instantly with App Router, shadcn/ui components, Tailwind CSS, and TypeScript. Templates: minimal (basic structure) or full (with pre-built UI components)."
+    },
+    implementation: createNextApp
+  },
+  {
+    metadata: {
+      name: "deploy_app",
+      category: "execution",
+      riskLevel: "network",
+      autoApproveInLocal: false,
+      autoApproveInSandbox: true,
+      description: "Deploy a Next.js project to Severino. Zips the project (excluding node_modules, .next) and uploads to /api/v1/deploy. Returns appId and live URL."
+    },
+    implementation: deployApp
   }
 ];
 var TOOL_METADATA_MAP = new Map(
@@ -9788,6 +10803,10 @@ function getNativeToolImplementation(toolName) {
   return TOOL_IMPLEMENTATION_MAP.get(toolName);
 }
 function getAllNativeToolMetadata() {
+  const policy = getSandboxPolicy();
+  if (!policy.isSandbox) {
+    return NATIVE_TOOL_ENTRIES.filter((entry) => entry.metadata.autoApproveInLocal !== false || !["create_next_app", "deploy_app"].includes(entry.metadata.name)).map((entry) => entry.metadata);
+  }
   return NATIVE_TOOL_ENTRIES.map((entry) => entry.metadata);
 }
 function applyMetadataToToolDefinitions(toolDefinitions) {
@@ -9813,9 +10832,9 @@ var ToolInvoker = class {
   async initialize() {
     try {
       const __filename = fileURLToPath2(import.meta.url);
-      const __dirname = path25.dirname(__filename);
-      const configPath = path25.resolve(__dirname, "config", "native_tools.json");
-      const fileContent = await fs23.readFile(configPath, "utf-8");
+      const __dirname = path27.dirname(__filename);
+      const configPath = path27.resolve(__dirname, "config", "native_tools.json");
+      const fileContent = await fs25.readFile(configPath, "utf-8");
       const config2 = JSON.parse(fileContent);
       this.toolDefinitions = applyMetadataToToolDefinitions(config2.nativeTools);
     } catch (error) {
@@ -9857,9 +10876,9 @@ var ToolInvoker = class {
 };
 
 // src/app/agent/tools/mcp/mcp_client.ts
-import { promises as fs24 } from "fs";
-import path26 from "path";
-import os15 from "os";
+import { promises as fs26 } from "fs";
+import path28 from "path";
+import os16 from "os";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
@@ -9886,9 +10905,9 @@ var MCPClient = class {
       });
     }
     const __filename = fileURLToPath3(import.meta.url);
-    const __dirname = path26.dirname(__filename);
-    const defaultConfigPath = path26.resolve(__dirname, "config", "bluma-mcp.json");
-    const userConfigPath = path26.join(os15.homedir(), ".bluma", "bluma-mcp.json");
+    const __dirname = path28.dirname(__filename);
+    const defaultConfigPath = path28.resolve(__dirname, "config", "bluma-mcp.json");
+    const userConfigPath = path28.join(os16.homedir(), ".bluma", "bluma-mcp.json");
     const defaultConfig = await this.loadMcpConfig(defaultConfigPath, "Default");
     const userConfig = await this.loadMcpConfig(userConfigPath, "User");
     const mergedConfig = {
@@ -9922,7 +10941,7 @@ var MCPClient = class {
   }
   async loadMcpConfig(configPath, configType) {
     try {
-      const fileContent = await fs24.readFile(configPath, "utf-8");
+      const fileContent = await fs26.readFile(configPath, "utf-8");
       const processedContent = this.replaceEnvPlaceholders(fileContent);
       return JSON.parse(processedContent);
     } catch (error) {
@@ -9941,7 +10960,7 @@ var MCPClient = class {
   async connectToStdioServer(serverName, config2) {
     let commandToExecute = config2.command;
     let argsToExecute = config2.args || [];
-    const isWindows = os15.platform() === "win32";
+    const isWindows = os16.platform() === "win32";
     if (!isWindows && commandToExecute.toLowerCase() === "cmd") {
       if (argsToExecute.length >= 2 && argsToExecute[0].toLowerCase() === "/c") {
         commandToExecute = argsToExecute[1];
@@ -10099,13 +11118,13 @@ PENALTY APPLIED: ${penalty.toFixed(1)} points deducted.
 };
 
 // src/app/agent/bluma/core/bluma.ts
-import path35 from "path";
+import path37 from "path";
 import { v4 as uuidv48 } from "uuid";
 
 // src/app/agent/session_manager/session_manager.ts
-import path27 from "path";
-import os16 from "os";
-import { promises as fs25 } from "fs";
+import path29 from "path";
+import os17 from "os";
+import { promises as fs27 } from "fs";
 var fileLocks = /* @__PURE__ */ new Map();
 async function withFileLock(file, fn) {
   const prev = fileLocks.get(file) || Promise.resolve();
@@ -10141,13 +11160,13 @@ function debouncedSave(sessionFile, history, memory) {
 function expandHome(p) {
   if (!p) return p;
   if (p.startsWith("~")) {
-    return path27.join(os16.homedir(), p.slice(1));
+    return path29.join(os17.homedir(), p.slice(1));
   }
   return p;
 }
 function getPreferredAppDir() {
-  const fixed = path27.join(os16.homedir(), ".bluma");
-  return path27.resolve(expandHome(fixed));
+  const fixed = path29.join(os17.homedir(), ".bluma");
+  return path29.resolve(expandHome(fixed));
 }
 async function safeRenameWithRetry(src, dest, maxRetries = 6) {
   let attempt = 0;
@@ -10155,10 +11174,10 @@ async function safeRenameWithRetry(src, dest, maxRetries = 6) {
   const isWin = process.platform === "win32";
   while (attempt <= maxRetries) {
     try {
-      const dir = path27.dirname(dest);
-      await fs25.mkdir(dir, { recursive: true }).catch(() => {
+      const dir = path29.dirname(dest);
+      await fs27.mkdir(dir, { recursive: true }).catch(() => {
       });
-      await fs25.rename(src, dest);
+      await fs27.rename(src, dest);
       return;
     } catch (e) {
       lastErr = e;
@@ -10171,13 +11190,13 @@ async function safeRenameWithRetry(src, dest, maxRetries = 6) {
     }
   }
   try {
-    await fs25.access(src);
-    const data = await fs25.readFile(src);
-    const dir = path27.dirname(dest);
-    await fs25.mkdir(dir, { recursive: true }).catch(() => {
+    await fs27.access(src);
+    const data = await fs27.readFile(src);
+    const dir = path29.dirname(dest);
+    await fs27.mkdir(dir, { recursive: true }).catch(() => {
     });
-    await fs25.writeFile(dest, data);
-    await fs25.unlink(src).catch(() => {
+    await fs27.writeFile(dest, data);
+    await fs27.unlink(src).catch(() => {
     });
     return;
   } catch (fallbackErr) {
@@ -10190,16 +11209,16 @@ async function safeRenameWithRetry(src, dest, maxRetries = 6) {
 }
 async function ensureSessionDir() {
   const appDir = getPreferredAppDir();
-  const sessionDir = path27.join(appDir, "sessions");
-  await fs25.mkdir(sessionDir, { recursive: true });
+  const sessionDir = path29.join(appDir, "sessions");
+  await fs27.mkdir(sessionDir, { recursive: true });
   return sessionDir;
 }
 async function loadOrcreateSession(sessionId) {
   const sessionDir = await ensureSessionDir();
-  const sessionFile = path27.join(sessionDir, `${sessionId}.json`);
+  const sessionFile = path29.join(sessionDir, `${sessionId}.json`);
   try {
-    await fs25.access(sessionFile);
-    const fileContent = await fs25.readFile(sessionFile, "utf-8");
+    await fs27.access(sessionFile);
+    const fileContent = await fs27.readFile(sessionFile, "utf-8");
     const sessionData = JSON.parse(fileContent);
     const memory = {
       historyAnchor: sessionData.history_anchor ?? null,
@@ -10212,7 +11231,7 @@ async function loadOrcreateSession(sessionId) {
       created_at: (/* @__PURE__ */ new Date()).toISOString(),
       conversation_history: []
     };
-    await fs25.writeFile(sessionFile, JSON.stringify(newSessionData, null, 2), "utf-8");
+    await fs27.writeFile(sessionFile, JSON.stringify(newSessionData, null, 2), "utf-8");
     const emptyMemory = {
       historyAnchor: null,
       compressedTurnSliceCount: 0
@@ -10224,12 +11243,12 @@ async function doSaveSessionHistory(sessionFile, history, memory) {
   await withFileLock(sessionFile, async () => {
     let sessionData;
     try {
-      const dir = path27.dirname(sessionFile);
-      await fs25.mkdir(dir, { recursive: true });
+      const dir = path29.dirname(sessionFile);
+      await fs27.mkdir(dir, { recursive: true });
     } catch {
     }
     try {
-      const fileContent = await fs25.readFile(sessionFile, "utf-8");
+      const fileContent = await fs27.readFile(sessionFile, "utf-8");
       sessionData = JSON.parse(fileContent);
     } catch (error) {
       const code = error && error.code;
@@ -10240,14 +11259,14 @@ async function doSaveSessionHistory(sessionFile, history, memory) {
           console.warn(`An unknown error occurred while reading ${sessionFile}. Re-initializing.`, error);
         }
       }
-      const sessionId = path27.basename(sessionFile, ".json");
+      const sessionId = path29.basename(sessionFile, ".json");
       sessionData = {
         session_id: sessionId,
         created_at: (/* @__PURE__ */ new Date()).toISOString(),
         conversation_history: []
       };
       try {
-        await fs25.writeFile(sessionFile, JSON.stringify(sessionData, null, 2), "utf-8");
+        await fs27.writeFile(sessionFile, JSON.stringify(sessionData, null, 2), "utf-8");
       } catch {
       }
     }
@@ -10263,7 +11282,7 @@ async function doSaveSessionHistory(sessionFile, history, memory) {
     }
     const tempSessionFile = `${sessionFile}.${Date.now()}.tmp`;
     try {
-      await fs25.writeFile(tempSessionFile, JSON.stringify(sessionData, null, 2), "utf-8");
+      await fs27.writeFile(tempSessionFile, JSON.stringify(sessionData, null, 2), "utf-8");
       await safeRenameWithRetry(tempSessionFile, sessionFile);
     } catch (writeError) {
       if (writeError instanceof Error) {
@@ -10272,7 +11291,7 @@ async function doSaveSessionHistory(sessionFile, history, memory) {
         console.error(`An unknown fatal error occurred while saving session to ${sessionFile}:`, writeError);
       }
       try {
-        await fs25.unlink(tempSessionFile);
+        await fs27.unlink(tempSessionFile);
       } catch {
       }
     }
@@ -10289,15 +11308,15 @@ async function saveSessionHistory(sessionFile, history, memory) {
 }
 
 // src/app/agent/core/prompt/prompt_builder.ts
-import os20 from "os";
-import fs30 from "fs";
-import path32 from "path";
+import os21 from "os";
+import fs32 from "fs";
+import path34 from "path";
 import { execSync as execSync3 } from "child_process";
 
 // src/app/agent/skills/skill_loader.ts
-import fs26 from "fs";
-import path28 from "path";
-import os17 from "os";
+import fs28 from "fs";
+import path30 from "path";
+import os18 from "os";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 var SkillLoader = class _SkillLoader {
   bundledSkillsDir;
@@ -10306,8 +11325,8 @@ var SkillLoader = class _SkillLoader {
   cache = /* @__PURE__ */ new Map();
   conflicts = [];
   constructor(projectRoot, bundledDir) {
-    this.projectSkillsDir = path28.join(projectRoot, ".bluma", "skills");
-    this.globalSkillsDir = path28.join(os17.homedir(), ".bluma", "skills");
+    this.projectSkillsDir = path30.join(projectRoot, ".bluma", "skills");
+    this.globalSkillsDir = path30.join(os18.homedir(), ".bluma", "skills");
     this.bundledSkillsDir = bundledDir || _SkillLoader.resolveBundledDir();
   }
   /**
@@ -10316,48 +11335,48 @@ var SkillLoader = class _SkillLoader {
    */
   static resolveBundledDir() {
     if (process.env.JEST_WORKER_ID !== void 0 || process.env.NODE_ENV === "test") {
-      return path28.join(process.cwd(), "dist", "config", "skills");
+      return path30.join(process.cwd(), "dist", "config", "skills");
     }
     const candidates = [];
     const push = (p) => {
-      const abs = path28.resolve(p);
+      const abs = path30.resolve(p);
       if (!candidates.includes(abs)) {
         candidates.push(abs);
       }
     };
     let argvBundled = null;
     try {
-      const bundleDir = path28.dirname(fileURLToPath4(import.meta.url));
-      push(path28.join(bundleDir, "config", "skills"));
+      const bundleDir = path30.dirname(fileURLToPath4(import.meta.url));
+      push(path30.join(bundleDir, "config", "skills"));
     } catch {
     }
     const argv1 = process.argv[1];
     if (argv1 && !argv1.startsWith("-")) {
       try {
         let resolved = argv1;
-        if (path28.isAbsolute(argv1) && fs26.existsSync(argv1)) {
-          resolved = fs26.realpathSync(argv1);
-        } else if (!path28.isAbsolute(argv1)) {
-          resolved = path28.resolve(process.cwd(), argv1);
+        if (path30.isAbsolute(argv1) && fs28.existsSync(argv1)) {
+          resolved = fs28.realpathSync(argv1);
+        } else if (!path30.isAbsolute(argv1)) {
+          resolved = path30.resolve(process.cwd(), argv1);
         }
-        const scriptDir = path28.dirname(resolved);
-        argvBundled = path28.join(scriptDir, "config", "skills");
+        const scriptDir = path30.dirname(resolved);
+        argvBundled = path30.join(scriptDir, "config", "skills");
         push(argvBundled);
       } catch {
       }
     }
     for (const abs of candidates) {
-      if (fs26.existsSync(abs)) {
+      if (fs28.existsSync(abs)) {
         return abs;
       }
     }
     try {
-      return path28.join(path28.dirname(fileURLToPath4(import.meta.url)), "config", "skills");
+      return path30.join(path30.dirname(fileURLToPath4(import.meta.url)), "config", "skills");
     } catch {
       if (argvBundled) {
         return argvBundled;
       }
-      return path28.join(os17.homedir(), ".bluma", "__bundled_skills_unresolved__");
+      return path30.join(os18.homedir(), ".bluma", "__bundled_skills_unresolved__");
     }
   }
   /**
@@ -10386,8 +11405,8 @@ var SkillLoader = class _SkillLoader {
         this.conflicts.push({
           name: skill.name,
           userSource: source,
-          userPath: path28.join(dir, skill.name, "SKILL.md"),
-          bundledPath: path28.join(this.bundledSkillsDir, skill.name, "SKILL.md")
+          userPath: path30.join(dir, skill.name, "SKILL.md"),
+          bundledPath: path30.join(this.bundledSkillsDir, skill.name, "SKILL.md")
         });
         continue;
       }
@@ -10395,20 +11414,20 @@ var SkillLoader = class _SkillLoader {
     }
   }
   listFromDir(dir, source) {
-    if (!fs26.existsSync(dir)) return [];
+    if (!fs28.existsSync(dir)) return [];
     try {
-      return fs26.readdirSync(dir).filter((d) => {
-        const fullPath = path28.join(dir, d);
-        return fs26.statSync(fullPath).isDirectory() && fs26.existsSync(path28.join(fullPath, "SKILL.md"));
-      }).map((d) => this.loadMetadataFromPath(path28.join(dir, d, "SKILL.md"), d, source)).filter((m) => m !== null);
+      return fs28.readdirSync(dir).filter((d) => {
+        const fullPath = path30.join(dir, d);
+        return fs28.statSync(fullPath).isDirectory() && fs28.existsSync(path30.join(fullPath, "SKILL.md"));
+      }).map((d) => this.loadMetadataFromPath(path30.join(dir, d, "SKILL.md"), d, source)).filter((m) => m !== null);
     } catch {
       return [];
     }
   }
   loadMetadataFromPath(skillPath, skillName, source) {
-    if (!fs26.existsSync(skillPath)) return null;
+    if (!fs28.existsSync(skillPath)) return null;
     try {
-      const raw = fs26.readFileSync(skillPath, "utf-8");
+      const raw = fs28.readFileSync(skillPath, "utf-8");
       const parsed = this.parseFrontmatter(raw);
       return {
         name: parsed.name || skillName,
@@ -10430,12 +11449,12 @@ var SkillLoader = class _SkillLoader {
    */
   load(name) {
     if (this.cache.has(name)) return this.cache.get(name);
-    const bundledPath = path28.join(this.bundledSkillsDir, name, "SKILL.md");
-    const projectPath = path28.join(this.projectSkillsDir, name, "SKILL.md");
-    const globalPath = path28.join(this.globalSkillsDir, name, "SKILL.md");
-    const existsBundled = fs26.existsSync(bundledPath);
-    const existsProject = fs26.existsSync(projectPath);
-    const existsGlobal = fs26.existsSync(globalPath);
+    const bundledPath = path30.join(this.bundledSkillsDir, name, "SKILL.md");
+    const projectPath = path30.join(this.projectSkillsDir, name, "SKILL.md");
+    const globalPath = path30.join(this.globalSkillsDir, name, "SKILL.md");
+    const existsBundled = fs28.existsSync(bundledPath);
+    const existsProject = fs28.existsSync(projectPath);
+    const existsGlobal = fs28.existsSync(globalPath);
     if (existsBundled && (existsProject || existsGlobal)) {
       const conflictSource = existsProject ? "project" : "global";
       const conflictPath = existsProject ? projectPath : globalPath;
@@ -10474,9 +11493,9 @@ var SkillLoader = class _SkillLoader {
   }
   loadFromPath(skillPath, name, source) {
     try {
-      const raw = fs26.readFileSync(skillPath, "utf-8");
+      const raw = fs28.readFileSync(skillPath, "utf-8");
       const parsed = this.parseFrontmatter(raw);
-      const skillDir = path28.dirname(skillPath);
+      const skillDir = path30.dirname(skillPath);
       return {
         name: parsed.name || name,
         description: parsed.description || "",
@@ -10485,22 +11504,22 @@ var SkillLoader = class _SkillLoader {
         version: parsed.version,
         author: parsed.author,
         license: parsed.license,
-        references: this.scanAssets(path28.join(skillDir, "references")),
-        scripts: this.scanAssets(path28.join(skillDir, "scripts"))
+        references: this.scanAssets(path30.join(skillDir, "references")),
+        scripts: this.scanAssets(path30.join(skillDir, "scripts"))
       };
     } catch {
       return null;
     }
   }
   scanAssets(dir) {
-    if (!fs26.existsSync(dir)) return [];
+    if (!fs28.existsSync(dir)) return [];
     try {
-      return fs26.readdirSync(dir).filter((f) => {
-        const fp = path28.join(dir, f);
-        return fs26.statSync(fp).isFile();
+      return fs28.readdirSync(dir).filter((f) => {
+        const fp = path30.join(dir, f);
+        return fs28.statSync(fp).isFile();
       }).map((f) => ({
         name: f,
-        path: path28.resolve(dir, f)
+        path: path30.resolve(dir, f)
       }));
     } catch {
       return [];
@@ -10557,10 +11576,10 @@ var SkillLoader = class _SkillLoader {
     this.cache.clear();
   }
   exists(name) {
-    const bundledPath = path28.join(this.bundledSkillsDir, name, "SKILL.md");
-    const projectPath = path28.join(this.projectSkillsDir, name, "SKILL.md");
-    const globalPath = path28.join(this.globalSkillsDir, name, "SKILL.md");
-    return fs26.existsSync(bundledPath) || fs26.existsSync(projectPath) || fs26.existsSync(globalPath);
+    const bundledPath = path30.join(this.bundledSkillsDir, name, "SKILL.md");
+    const projectPath = path30.join(this.projectSkillsDir, name, "SKILL.md");
+    const globalPath = path30.join(this.globalSkillsDir, name, "SKILL.md");
+    return fs28.existsSync(bundledPath) || fs28.existsSync(projectPath) || fs28.existsSync(globalPath);
   }
   /**
    * Retorna conflitos detetados (skills do utilizador com mesmo nome de nativas).
@@ -10592,8 +11611,8 @@ var SkillLoader = class _SkillLoader {
 };
 
 // src/app/agent/core/prompt/workspace_snapshot.ts
-import fs27 from "fs";
-import path29 from "path";
+import fs29 from "fs";
+import path31 from "path";
 import { execSync as execSync2 } from "child_process";
 var LIMITS = {
   readme: 1e4,
@@ -10608,10 +11627,10 @@ var LIMITS = {
 };
 function safeReadFile(filePath, maxChars) {
   try {
-    if (!fs27.existsSync(filePath)) return null;
-    const st = fs27.statSync(filePath);
+    if (!fs29.existsSync(filePath)) return null;
+    const st = fs29.statSync(filePath);
     if (!st.isFile()) return null;
-    const raw = fs27.readFileSync(filePath, "utf8");
+    const raw = fs29.readFileSync(filePath, "utf8");
     if (raw.length <= maxChars) return raw;
     return `${raw.slice(0, maxChars)}
 
@@ -10622,7 +11641,7 @@ function safeReadFile(filePath, maxChars) {
 }
 function tryReadReadme(cwd) {
   for (const name of ["README.md", "README.MD", "readme.md", "Readme.md"]) {
-    const c = safeReadFile(path29.join(cwd, name), LIMITS.readme);
+    const c = safeReadFile(path31.join(cwd, name), LIMITS.readme);
     if (c) return `(${name})
 ${c}`;
   }
@@ -10630,14 +11649,14 @@ ${c}`;
 }
 function tryReadBluMaMd(cwd) {
   const paths = [
-    path29.join(cwd, "BluMa.md"),
-    path29.join(cwd, "BLUMA.md"),
-    path29.join(cwd, ".bluma", "BluMa.md")
+    path31.join(cwd, "BluMa.md"),
+    path31.join(cwd, "BLUMA.md"),
+    path31.join(cwd, ".bluma", "BluMa.md")
   ];
   for (const p of paths) {
     const c = safeReadFile(p, LIMITS.blumaMd);
     if (c) {
-      const rel = path29.relative(cwd, p) || p;
+      const rel = path31.relative(cwd, p) || p;
       return `(${rel})
 ${c}`;
     }
@@ -10645,10 +11664,10 @@ ${c}`;
   return null;
 }
 function summarizePackageJson(cwd) {
-  const p = path29.join(cwd, "package.json");
+  const p = path31.join(cwd, "package.json");
   try {
-    if (!fs27.existsSync(p)) return null;
-    const pkg = JSON.parse(fs27.readFileSync(p, "utf8"));
+    if (!fs29.existsSync(p)) return null;
+    const pkg = JSON.parse(fs29.readFileSync(p, "utf8"));
     const scripts = pkg.scripts;
     let scriptKeys = "";
     if (scripts && typeof scripts === "object" && !Array.isArray(scripts)) {
@@ -10681,7 +11700,7 @@ function summarizePackageJson(cwd) {
 }
 function topLevelListing(cwd) {
   try {
-    const names = fs27.readdirSync(cwd, { withFileTypes: true });
+    const names = fs29.readdirSync(cwd, { withFileTypes: true });
     const sorted = [...names].sort((a, b) => a.name.localeCompare(b.name));
     const limited = sorted.slice(0, LIMITS.topDirEntries);
     const lines = limited.map((d) => `${d.name}${d.isDirectory() ? "/" : ""}`);
@@ -10739,7 +11758,7 @@ function buildWorkspaceSnapshot(cwd) {
     parts.push(pkg);
     parts.push("```\n");
   }
-  const py = safeReadFile(path29.join(cwd, "pyproject.toml"), LIMITS.pyproject);
+  const py = safeReadFile(path31.join(cwd, "pyproject.toml"), LIMITS.pyproject);
   if (py) {
     parts.push("### pyproject.toml (excerpt)\n```toml");
     parts.push(py);
@@ -10757,15 +11776,15 @@ function buildWorkspaceSnapshot(cwd) {
     parts.push(bluma);
     parts.push("```\n");
   }
-  const contrib = safeReadFile(path29.join(cwd, "CONTRIBUTING.md"), LIMITS.contributing);
+  const contrib = safeReadFile(path31.join(cwd, "CONTRIBUTING.md"), LIMITS.contributing);
   if (contrib) {
     parts.push("### CONTRIBUTING.md (excerpt)\n```markdown");
     parts.push(contrib);
     parts.push("```\n");
   }
-  const chlog = safeReadFile(path29.join(cwd, "CHANGELOG.md"), LIMITS.changelog);
+  const chlog = safeReadFile(path31.join(cwd, "CHANGELOG.md"), LIMITS.changelog);
   if (!chlog) {
-    const alt = safeReadFile(path29.join(cwd, "CHANGES.md"), LIMITS.changelog);
+    const alt = safeReadFile(path31.join(cwd, "CHANGES.md"), LIMITS.changelog);
     if (alt) {
       parts.push("### CHANGES.md (excerpt)\n```markdown");
       parts.push(alt);
@@ -10805,15 +11824,15 @@ init_runtime_config();
 
 // src/app/agent/runtime/plugin_registry.ts
 init_sandbox_policy();
-import fs28 from "fs";
-import os18 from "os";
-import path30 from "path";
+import fs30 from "fs";
+import os19 from "os";
+import path32 from "path";
 function getProjectPluginsDir() {
   const policy = getSandboxPolicy();
-  return path30.join(policy.workspaceRoot, ".bluma", "plugins");
+  return path32.join(policy.workspaceRoot, ".bluma", "plugins");
 }
 function getGlobalPluginsDir() {
-  return path30.join(process.env.HOME || os18.homedir(), ".bluma", "plugins");
+  return path32.join(process.env.HOME || os19.homedir(), ".bluma", "plugins");
 }
 function getPluginDirs() {
   return {
@@ -10822,11 +11841,11 @@ function getPluginDirs() {
   };
 }
 function readManifest(manifestPath, fallbackName) {
-  if (!fs28.existsSync(manifestPath)) {
+  if (!fs30.existsSync(manifestPath)) {
     return null;
   }
   try {
-    const parsed = JSON.parse(fs28.readFileSync(manifestPath, "utf-8"));
+    const parsed = JSON.parse(fs30.readFileSync(manifestPath, "utf-8"));
     return {
       name: typeof parsed.name === "string" && parsed.name.trim() ? parsed.name.trim() : fallbackName,
       description: typeof parsed.description === "string" ? parsed.description.trim() : void 0,
@@ -10839,22 +11858,22 @@ function readManifest(manifestPath, fallbackName) {
 }
 function findManifestPath(pluginDir) {
   const candidates = [
-    path30.join(pluginDir, ".codex-plugin", "plugin.json"),
-    path30.join(pluginDir, "plugin.json")
+    path32.join(pluginDir, ".codex-plugin", "plugin.json"),
+    path32.join(pluginDir, "plugin.json")
   ];
   for (const candidate of candidates) {
-    if (fs28.existsSync(candidate)) {
+    if (fs30.existsSync(candidate)) {
       return candidate;
     }
   }
   return null;
 }
 function listFromDir(baseDir, source) {
-  if (!fs28.existsSync(baseDir)) {
+  if (!fs30.existsSync(baseDir)) {
     return [];
   }
-  return fs28.readdirSync(baseDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).flatMap((entry) => {
-    const pluginDir = path30.join(baseDir, entry.name);
+  return fs30.readdirSync(baseDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).flatMap((entry) => {
+    const pluginDir = path32.join(baseDir, entry.name);
     const manifestPath = findManifestPath(pluginDir);
     if (!manifestPath) {
       return [];
@@ -11204,9 +12223,9 @@ function disableCoordinatorMode() {
 }
 
 // src/app/agent/utils/blumamd.ts
-import fs29 from "fs";
-import path31 from "path";
-import os19 from "os";
+import fs31 from "fs";
+import path33 from "path";
+import os20 from "os";
 var MEMORY_INSTRUCTION_PROMPT = "Instru\xE7\xF5es de mem\xF3ria do BluMa (BLUMA.md) est\xE3o abaixo. Siga estas instru\xE7\xF5es exatamente como escritas. Estas instru\xE7\xF5es OVERRIDE qualquer comportamento padr\xE3o.";
 var TEXT_FILE_EXTENSIONS = /* @__PURE__ */ new Set([
   ".md",
@@ -11334,12 +12353,12 @@ var TEXT_FILE_EXTENSIONS = /* @__PURE__ */ new Set([
 function expandIncludePath(includePath, baseDir) {
   const cleanPath = includePath.startsWith("@") ? includePath.slice(1) : includePath;
   if (cleanPath.startsWith("~")) {
-    return path31.join(os19.homedir(), cleanPath.slice(1));
+    return path33.join(os20.homedir(), cleanPath.slice(1));
   }
-  if (path31.isAbsolute(cleanPath)) {
+  if (path33.isAbsolute(cleanPath)) {
     return cleanPath;
   }
-  return path31.resolve(baseDir, cleanPath);
+  return path33.resolve(baseDir, cleanPath);
 }
 function processIncludes(content, baseDir, processedFiles) {
   const lines = content.split("\n");
@@ -11348,20 +12367,20 @@ function processIncludes(content, baseDir, processedFiles) {
     const includeMatch = line.match(/^@\s*([^\s]+)/);
     if (includeMatch) {
       const includePath = expandIncludePath(includeMatch[1], baseDir);
-      const normalizedPath = path31.normalize(includePath);
+      const normalizedPath = path33.normalize(includePath);
       if (processedFiles.has(normalizedPath)) {
         result.push(`<!-- Circular include prevented: ${includeMatch[1]} -->`);
         continue;
       }
-      const ext = path31.extname(includePath).toLowerCase();
+      const ext = path33.extname(includePath).toLowerCase();
       if (!TEXT_FILE_EXTENSIONS.has(ext)) {
         result.push(`<!-- Include skipped (unsupported extension): ${includeMatch[1]} -->`);
         continue;
       }
       try {
-        const includedContent = fs29.readFileSync(includePath, "utf-8");
+        const includedContent = fs31.readFileSync(includePath, "utf-8");
         processedFiles.add(normalizedPath);
-        const processedContent = processIncludes(includedContent, path31.dirname(includePath), processedFiles);
+        const processedContent = processIncludes(includedContent, path33.dirname(includePath), processedFiles);
         result.push(`
 <!-- BEGIN INCLUDE ${includeMatch[1]} -->
 `);
@@ -11380,9 +12399,9 @@ function processIncludes(content, baseDir, processedFiles) {
 }
 function readMemoryFile(filePath, type, priority) {
   try {
-    const content = fs29.readFileSync(filePath, "utf-8");
-    const baseDir = path31.dirname(filePath);
-    const processedFiles = /* @__PURE__ */ new Set([path31.normalize(filePath)]);
+    const content = fs31.readFileSync(filePath, "utf-8");
+    const baseDir = path33.dirname(filePath);
+    const processedFiles = /* @__PURE__ */ new Set([path33.normalize(filePath)]);
     const processedContent = processIncludes(content, baseDir, processedFiles);
     return {
       path: filePath,
@@ -11399,33 +12418,33 @@ function readMemoryFile(filePath, type, priority) {
 }
 function findGitRoot(startDir) {
   let current = startDir;
-  while (current !== path31.dirname(current)) {
-    const gitPath = path31.join(current, ".git");
+  while (current !== path33.dirname(current)) {
+    const gitPath = path33.join(current, ".git");
     try {
-      if (fs29.existsSync(gitPath)) {
+      if (fs31.existsSync(gitPath)) {
         return current;
       }
     } catch {
     }
-    current = path31.dirname(current);
+    current = path33.dirname(current);
   }
   return null;
 }
 function loadUserMemory() {
   const files = [];
-  const homeDir = os19.homedir();
-  const userBlumaDir = path31.join(homeDir, ".bluma");
-  const userBlumaMd = path31.join(userBlumaDir, "BLUMA.md");
+  const homeDir = os20.homedir();
+  const userBlumaDir = path33.join(homeDir, ".bluma");
+  const userBlumaMd = path33.join(userBlumaDir, "BLUMA.md");
   const userFile = readMemoryFile(userBlumaMd, "user", 2);
   if (userFile) {
     files.push(userFile);
   }
-  const userRulesDir = path31.join(userBlumaDir, "rules");
-  if (fs29.existsSync(userRulesDir)) {
+  const userRulesDir = path33.join(userBlumaDir, "rules");
+  if (fs31.existsSync(userRulesDir)) {
     try {
-      const ruleFiles = fs29.readdirSync(userRulesDir).filter((f) => f.endsWith(".md")).sort();
+      const ruleFiles = fs31.readdirSync(userRulesDir).filter((f) => f.endsWith(".md")).sort();
       for (const ruleFile of ruleFiles) {
-        const rulePath = path31.join(userRulesDir, ruleFile);
+        const rulePath = path33.join(userRulesDir, ruleFile);
         const rule = readMemoryFile(rulePath, "rule", 2);
         if (rule) {
           files.push(rule);
@@ -11439,22 +12458,22 @@ function loadUserMemory() {
 function loadProjectMemory(cwd) {
   const files = [];
   const gitRoot = findGitRoot(cwd) || cwd;
-  const projectBlumaMd = path31.join(gitRoot, "BLUMA.md");
+  const projectBlumaMd = path33.join(gitRoot, "BLUMA.md");
   const projectFile = readMemoryFile(projectBlumaMd, "project", 3);
   if (projectFile) {
     files.push(projectFile);
   }
-  const blumaDirBlumaMd = path31.join(gitRoot, ".bluma", "BLUMA.md");
+  const blumaDirBlumaMd = path33.join(gitRoot, ".bluma", "BLUMA.md");
   const blumaDirFile = readMemoryFile(blumaDirBlumaMd, "project", 3);
   if (blumaDirFile) {
     files.push(blumaDirFile);
   }
-  const rulesDir = path31.join(gitRoot, ".bluma", "rules");
-  if (fs29.existsSync(rulesDir)) {
+  const rulesDir = path33.join(gitRoot, ".bluma", "rules");
+  if (fs31.existsSync(rulesDir)) {
     try {
-      const ruleFiles = fs29.readdirSync(rulesDir).filter((f) => f.endsWith(".md")).sort();
+      const ruleFiles = fs31.readdirSync(rulesDir).filter((f) => f.endsWith(".md")).sort();
       for (const ruleFile of ruleFiles) {
-        const rulePath = path31.join(rulesDir, ruleFile);
+        const rulePath = path33.join(rulesDir, ruleFile);
         const rule = readMemoryFile(rulePath, "rule", 3);
         if (rule) {
           files.push(rule);
@@ -11463,7 +12482,7 @@ function loadProjectMemory(cwd) {
     } catch {
     }
   }
-  const localBlumaMd = path31.join(gitRoot, "BLUMA.local.md");
+  const localBlumaMd = path33.join(gitRoot, "BLUMA.local.md");
   const localFile = readMemoryFile(localBlumaMd, "local", 4);
   if (localFile) {
     files.push(localFile);
@@ -11584,6 +12603,149 @@ Since you are in an **isolated sandbox**, ALL tools are auto-approved:
 
 ---
 
+## \u{1F680} NEXT.JS DEPLOY WORKFLOW - SEVERINO INTEGRATION
+
+You have access to **two specialized tools** for creating and deploying Next.js apps to Severino:
+
+### Tool 1: \\\`create_next_app\\\`
+
+**Purpose:** Instant scaffold of a complete Next.js project with App Router, shadcn/ui, and Tailwind CSS.
+
+**Args:**
+- \\\`name\\\` (required): Project name (will be directory name)
+- \\\`template\\\` (optional): \\\`'minimal'\\\` or \\\`'full'\\\` (default: \\\`'full'\\\`)
+- \\\`directory\\\` (optional): Where to create (default: workspace root)
+
+**Example:**
+\\\`\\\`\\\`typescript
+const result = await createNextApp({
+  name: 'erp-dashboard',
+  template: 'full',
+});
+// Creates: /workspace/session_id/erp-dashboard/
+// Includes: App Router, shadcn/ui (Button, Card, Input), Tailwind, TypeScript
+\\\`\\\`\\\`
+
+**What it creates:**
+- \\\`package.json\\\` with Next.js, React, Tailwind dependencies
+- \\\`tsconfig.json\\\` configured for Next.js
+- \\\`next.config.js\\\` with \\\`output: 'standalone'\\\` (required for deploy)
+- \\\`tailwind.config.ts\\\`, \\\`postcss.config.js\\\`
+- \\\`app/layout.tsx\\\`, \\\`app/page.tsx\\\`, \\\`app/globals.css\\\`
+- \\\`components/ui/\\\` with shadcn/ui components (Button, Card, Input)
+- \\\`lib/utils.ts\\\` with \\\`cn()\\\` utility
+
+**Auto-runs:** \\\`npm install\\\` after creating files
+
+---
+
+### Tool 2: \\\`deploy_app\\\`
+
+**Purpose:** Zip and deploy a Next.js project to Severino for hosting.
+
+**Args:**
+- \\\`projectDir\\\` (required): Path to the Next.js project
+- \\\`name\\\` (optional): App name (default: package.json name or directory name)
+- \\\`severinoUrl\\\` (optional): Auto-reads from \\\`SEVERINO_URL\\\` env var
+- \\\`apiKey\\\` (optional): Auto-reads from \\\`SEVERINO_API_KEY\\\` env var
+
+**Example:**
+\\\`\\\`\\\`typescript
+const result = await deployApp({
+  projectDir: './erp-dashboard',
+  name: 'erp-dashboard',
+});
+// Returns: { appId: 'uuid', url: 'http://localhost:3000/app/uuid', status: 'building' }
+\\\`\\\`\\\`
+
+**What it does:**
+1. Validates project (checks \\\`package.json\\\` and \\\`next\\\` dependency)
+2. Creates ZIP (excludes \\\`node_modules\\\`, \\\`.next\\\`, \\\`.env\\\`, \\\`.git\\\`)
+3. Uploads to \\\`POST {severinoUrl}/api/v1/deploy\\\`
+4. Returns \\\`appId\\\` and live URL
+
+**Important:** The deploy is **asynchronous** - status starts as \\\`'building'\\\`. The app will be ready in ~30-60 seconds.
+
+---
+
+### Complete Workflow Example
+
+\\\`\\\`\\\`typescript
+// Step 1: Create project
+message({ message_type: 'info', content: 'Step 1/3: Creating Next.js project...' });
+const scaffold = await createNextApp({
+  name: 'erp-dashboard',
+  template: 'full',
+});
+
+// Step 2: Develop (customize the app)
+message({ message_type: 'info', content: 'Step 2/3: Developing components...' });
+await fileWrite({
+  filepath: './erp-dashboard/app/dashboard/page.tsx',
+  content: 'export default function Dashboard() { return <h1>ERP Dashboard</h1> }',
+});
+
+// Step 3: Deploy
+message({ message_type: 'info', content: 'Step 3/3: Deploying to Severino...' });
+const deploy = await deployApp({
+  projectDir: './erp-dashboard',
+  name: 'erp-dashboard',
+});
+
+// Step 4: Report result
+message({
+  message_type: 'result',
+  content: 'App criada e deployada com sucesso!',
+  attachments: [{ path: deploy.url, description: 'URL da app live' }],
+});
+\\\`\\\`\\\`
+
+---
+
+### \u26A0\uFE0F Critical Requirements for Deploy
+
+1. **\\\`output: 'standalone'\\\` in \\\`next.config.js\\\`**
+   - The \\\`create_next_app\\\` tool already includes this
+   - If you modify \\\`next.config.js\\\`, keep this setting
+
+2. **Build before deploy (optional but recommended)**
+   \\\`\\\`\\\`bash
+   cd erp-dashboard && npm run build
+   \\\`\\\`\\\`
+   - Ensures no TypeScript errors
+   - Creates \\\`.next/standalone/\\\` for optimized deploy
+
+3. **Don't include sensitive files**
+   - The tool automatically excludes \\\`.env\\\`, \\\`.env.local\\\`, \\\`node_modules\\\`
+   - Never commit API keys or secrets to the project
+
+4. **Test locally first (if possible)**
+   \\\`\\\`\\\`bash
+   cd erp-dashboard && npm run dev
+   \\\`\\\`\\\`
+
+---
+
+### Troubleshooting
+
+**Deploy fails with "ZIP too large":**
+- Remove large files (videos, images > 5MB)
+- Exclude \\\`coverage/\\\`, \\\`.turbo/\\\` directories
+
+**Deploy fails with "next not found":**
+- Ensure \\\`next\\\` is in \\\`dependencies\\\` or \\\`devDependencies\\\`
+- Run \\\`npm install\\\` before deploy
+
+**App returns 404 after deploy:**
+- Wait 30-60 seconds for build to complete
+- Check status: \\\`GET {severinoUrl}/api/v1/apps/:appId\\\`
+
+**Build fails:**
+- Run \\\`npx tsc --noEmit\\\` to check TypeScript errors
+- Fix errors before deploy
+
+---
+
 ## \u{1F3AF} QUALITY STANDARDS - PRODUCTION GRADE
 
 ### Code Quality
@@ -11813,10 +12975,10 @@ function getGitBranch(dir) {
 }
 function getPackageManager(dir) {
   try {
-    if (fs30.existsSync(path32.join(dir, "pnpm-lock.yaml"))) return "pnpm";
-    if (fs30.existsSync(path32.join(dir, "yarn.lock"))) return "yarn";
-    if (fs30.existsSync(path32.join(dir, "bun.lockb"))) return "bun";
-    if (fs30.existsSync(path32.join(dir, "package-lock.json"))) return "npm";
+    if (fs32.existsSync(path34.join(dir, "pnpm-lock.yaml"))) return "pnpm";
+    if (fs32.existsSync(path34.join(dir, "yarn.lock"))) return "yarn";
+    if (fs32.existsSync(path34.join(dir, "bun.lockb"))) return "bun";
+    if (fs32.existsSync(path34.join(dir, "package-lock.json"))) return "npm";
     return "unknown";
   } catch {
     return "unknown";
@@ -11824,9 +12986,9 @@ function getPackageManager(dir) {
 }
 function getProjectType(dir) {
   try {
-    const files = fs30.readdirSync(dir);
+    const files = fs32.readdirSync(dir);
     if (files.includes("package.json")) {
-      const pkg = JSON.parse(fs30.readFileSync(path32.join(dir, "package.json"), "utf-8"));
+      const pkg = JSON.parse(fs32.readFileSync(path34.join(dir, "package.json"), "utf-8"));
       if (pkg.dependencies?.next || pkg.devDependencies?.next) return "Next.js";
       if (pkg.dependencies?.react || pkg.devDependencies?.react) return "React";
       if (pkg.dependencies?.express || pkg.devDependencies?.express) return "Express";
@@ -11845,9 +13007,9 @@ function getProjectType(dir) {
 }
 function getTestFramework(dir) {
   try {
-    const pkgPath = path32.join(dir, "package.json");
-    if (fs30.existsSync(pkgPath)) {
-      const pkg = JSON.parse(fs30.readFileSync(pkgPath, "utf-8"));
+    const pkgPath = path34.join(dir, "package.json");
+    if (fs32.existsSync(pkgPath)) {
+      const pkg = JSON.parse(fs32.readFileSync(pkgPath, "utf-8"));
       const deps = { ...pkg.dependencies, ...pkg.devDependencies };
       if (deps.jest) return "jest";
       if (deps.vitest) return "vitest";
@@ -11856,7 +13018,7 @@ function getTestFramework(dir) {
       if (deps["@playwright/test"]) return "playwright";
       if (deps.cypress) return "cypress";
     }
-    if (fs30.existsSync(path32.join(dir, "pytest.ini")) || fs30.existsSync(path32.join(dir, "conftest.py"))) return "pytest";
+    if (fs32.existsSync(path34.join(dir, "pytest.ini")) || fs32.existsSync(path34.join(dir, "conftest.py"))) return "pytest";
     return "unknown";
   } catch {
     return "unknown";
@@ -11864,9 +13026,9 @@ function getTestFramework(dir) {
 }
 function getTestCommand(dir) {
   try {
-    const pkgPath = path32.join(dir, "package.json");
-    if (fs30.existsSync(pkgPath)) {
-      const pkg = JSON.parse(fs30.readFileSync(pkgPath, "utf-8"));
+    const pkgPath = path34.join(dir, "package.json");
+    if (fs32.existsSync(pkgPath)) {
+      const pkg = JSON.parse(fs32.readFileSync(pkgPath, "utf-8"));
       if (pkg.scripts?.test) return `npm test`;
       if (pkg.scripts?.["test:unit"]) return `npm run test:unit`;
     }
@@ -12027,12 +13189,12 @@ function getUnifiedSystemPrompt(availableSkills) {
   const runtimeConfig = getRuntimeConfig();
   const availablePlugins = listPlugins();
   const env = {
-    os_type: os20.type(),
-    os_version: os20.release(),
-    architecture: os20.arch(),
+    os_type: os21.type(),
+    os_version: os21.release(),
+    architecture: os21.arch(),
     workdir: cwd,
     shell_type: process.env.SHELL || process.env.COMSPEC || "unknown",
-    username: os20.userInfo().username,
+    username: os21.userInfo().username,
     current_date: (/* @__PURE__ */ new Date()).toISOString().split("T")[0],
     timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
     is_git_repo: isGitRepo(cwd) ? "yes" : "no",
@@ -12103,8 +13265,8 @@ ${blumaMdContent}
 }
 function isGitRepo(dir) {
   try {
-    const gitPath = path32.join(dir, ".git");
-    return fs30.existsSync(gitPath) && fs30.lstatSync(gitPath).isDirectory();
+    const gitPath = path34.join(dir, ".git");
+    return fs32.existsSync(gitPath) && fs32.lstatSync(gitPath).isDirectory();
   } catch {
     return false;
   }
@@ -12298,7 +13460,7 @@ async function createApiContextWindow(fullHistory, currentAnchor, compressedTurn
 
 // src/app/agent/core/llm/llm.ts
 init_runtime_config();
-import os21 from "os";
+import os22 from "os";
 import OpenAI from "openai";
 function defaultBlumaUserContextInput(sessionId, userMessage) {
   const msg = String(userMessage || "").slice(0, 300);
@@ -12315,7 +13477,7 @@ function defaultBlumaUserContextInput(sessionId, userMessage) {
 }
 function getPreferredMacAddress() {
   try {
-    const ifaces = os21.networkInterfaces();
+    const ifaces = os22.networkInterfaces();
     for (const name of Object.keys(ifaces)) {
       const addrs = ifaces[name];
       if (!addrs) continue;
@@ -12330,7 +13492,7 @@ function getPreferredMacAddress() {
   } catch {
   }
   try {
-    return `host:${os21.hostname()}`;
+    return `host:${os22.hostname()}`;
   } catch {
     return "unknown";
   }
@@ -12340,7 +13502,7 @@ function defaultInteractiveCliUserContextInput(sessionId, userMessage) {
   const machineId = getPreferredMacAddress();
   let userName = null;
   try {
-    userName = os21.userInfo().username || null;
+    userName = os22.userInfo().username || null;
   } catch {
     userName = null;
   }
@@ -12810,8 +13972,8 @@ function classifyToolInvocation(input) {
 
 // src/app/agent/runtime/hook_registry.ts
 init_sandbox_policy();
-import fs31 from "fs";
-import path33 from "path";
+import fs33 from "fs";
+import path35 from "path";
 var DEFAULT_STATE = {
   enabled: true,
   maxEvents: 120,
@@ -12822,7 +13984,7 @@ var cache2 = null;
 var cachePath2 = null;
 function getStatePath() {
   const policy = getSandboxPolicy();
-  return path33.join(policy.workspaceRoot, ".bluma", "hooks.json");
+  return path35.join(policy.workspaceRoot, ".bluma", "hooks.json");
 }
 function getHookStatePath() {
   return getStatePath();
@@ -12841,8 +14003,8 @@ function ensureLoaded2() {
     return cache2;
   }
   try {
-    if (fs31.existsSync(statePath)) {
-      const parsed = JSON.parse(fs31.readFileSync(statePath, "utf-8"));
+    if (fs33.existsSync(statePath)) {
+      const parsed = JSON.parse(fs33.readFileSync(statePath, "utf-8"));
       cache2 = {
         enabled: typeof parsed.enabled === "boolean" ? parsed.enabled : DEFAULT_STATE.enabled,
         maxEvents: typeof parsed.maxEvents === "number" && Number.isFinite(parsed.maxEvents) && parsed.maxEvents > 0 ? Math.floor(parsed.maxEvents) : DEFAULT_STATE.maxEvents,
@@ -12868,9 +14030,9 @@ function ensureLoaded2() {
 }
 function persist2(state) {
   const statePath = getStatePath();
-  fs31.mkdirSync(path33.dirname(statePath), { recursive: true });
+  fs33.mkdirSync(path35.dirname(statePath), { recursive: true });
   state.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  fs31.writeFileSync(statePath, JSON.stringify(state, null, 2), "utf-8");
+  fs33.writeFileSync(statePath, JSON.stringify(state, null, 2), "utf-8");
   cache2 = state;
   cachePath2 = statePath;
 }
@@ -12967,11 +14129,11 @@ function effectiveToolAutoApprove(toolCall, sessionId, options) {
 }
 
 // src/app/agent/tools/natives/coding_memory_consolidate.ts
-import * as fs32 from "fs";
-import * as path34 from "path";
-import os22 from "os";
+import * as fs34 from "fs";
+import * as path36 from "path";
+import os23 from "os";
 function memoryPath2() {
-  return path34.join(process.env.HOME || os22.homedir(), ".bluma", "coding_memory.json");
+  return path36.join(process.env.HOME || os23.homedir(), ".bluma", "coding_memory.json");
 }
 function normalizeNote2(note) {
   return note.trim().toLowerCase().replace(/\s+/g, " ");
@@ -12981,18 +14143,18 @@ function uniqTags(a, b) {
 }
 function consolidateCodingMemoryFile() {
   const p = memoryPath2();
-  if (!fs32.existsSync(p)) {
+  if (!fs34.existsSync(p)) {
     return { success: true, removedDuplicates: 0, message: "no coding_memory.json" };
   }
   const bak = `${p}.bak`;
   try {
-    fs32.copyFileSync(p, bak);
+    fs34.copyFileSync(p, bak);
   } catch (e) {
     return { success: false, removedDuplicates: 0, message: `backup failed: ${e.message}` };
   }
   let data;
   try {
-    data = JSON.parse(fs32.readFileSync(p, "utf-8"));
+    data = JSON.parse(fs34.readFileSync(p, "utf-8"));
   } catch (e) {
     return { success: false, removedDuplicates: 0, message: `invalid json: ${e.message}` };
   }
@@ -13027,7 +14189,7 @@ function consolidateCodingMemoryFile() {
     updatedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
   try {
-    fs32.writeFileSync(p, JSON.stringify(out, null, 2), "utf-8");
+    fs34.writeFileSync(p, JSON.stringify(out, null, 2), "utf-8");
   } catch (e) {
     return { success: false, removedDuplicates: 0, message: `write failed: ${e.message}` };
   }
@@ -13625,7 +14787,7 @@ var BluMaAgent = class {
 
 ${editData.error.display}`;
       }
-      const filename = path35.basename(toolArgs.file_path);
+      const filename = path37.basename(toolArgs.file_path);
       return createDiff(filename, editData.currentContent || "", editData.newContent);
     } catch (e) {
       return `An unexpected error occurred while generating the edit preview: ${e.message}`;
@@ -13716,6 +14878,7 @@ ${editData.error.display}`;
       });
       await this.notifyFactorTurnEndIfNeeded("empty_reply_exhausted");
       this.eventBus.emit("backend_message", { type: "done", status: "failed" });
+      process.exit(1);
       return;
     }
     await this._continueConversation();
@@ -13849,6 +15012,7 @@ ${editData.error.display}`;
         });
         await this.notifyFactorTurnEndIfNeeded("protocol_direct_text_exhausted");
         this.emitTurnCompleted();
+        process.exit(1);
         return;
       }
       const feedback = this.feedbackSystem.generateFeedback({
@@ -13936,6 +15100,7 @@ ${editData.error.display}`;
         });
         await this.notifyFactorTurnEndIfNeeded("protocol_direct_text_exhausted");
         this.emitTurnCompleted();
+        process.exit(1);
         return;
       }
       const feedback = this.feedbackSystem.generateFeedback({
@@ -14011,7 +15176,7 @@ import { v4 as uuidv411 } from "uuid";
 import { v4 as uuidv410 } from "uuid";
 
 // src/app/agent/subagents/init/init_system_prompt.ts
-import os23 from "os";
+import os24 from "os";
 var SYSTEM_PROMPT2 = `
 
 ### YOU ARE BluMa CLI \u2014 INIT SUBAGENT \u2014 AUTONOMOUS SENIOR SOFTWARE ENGINEER @ NOMADENGENUITY
@@ -14174,12 +15339,12 @@ Rule Summary:
 function getInitPrompt() {
   const now2 = /* @__PURE__ */ new Date();
   const collectedData = {
-    os_type: os23.type(),
-    os_version: os23.release(),
-    architecture: os23.arch(),
+    os_type: os24.type(),
+    os_version: os24.release(),
+    architecture: os24.arch(),
     workdir: process.cwd(),
     shell_type: process.env.SHELL || process.env.COMSPEC || "Unknown",
-    username: os23.userInfo().username || "Unknown",
+    username: os24.userInfo().username || "Unknown",
     current_date: now2.toISOString().split("T")[0],
     // Formato YYYY-MM-DD
     timezone: Intl.DateTimeFormat().resolvedOptions().timeZone || "Unknown",
@@ -14207,7 +15372,7 @@ function getInitPrompt() {
 }
 
 // src/app/agent/subagents/worker_system_prompt.ts
-import os24 from "os";
+import os25 from "os";
 var WORKER_SYSTEM_PROMPT = `
 
 ### YOU ARE BluMa CLI \u2014 WORKER AGENT \u2014 AUTONOMOUS SOFTWARE ENGINEERING SPECIALIST @ NOMADENGENUITY
@@ -14221,37 +15386,28 @@ You are a worker agent spawned by the BluMa Coordinator to execute specific soft
   You are a BluMa Worker Agent. You execute tasks delegated by the Coordinator.
   Maintain professionalism and technical excellence.
 
-- **Communication:**
-  - ALL messages must be sent via the \`message\` tool
-  - No direct text replies to the user
-  - Report progress frequently using \`message\` with \`message_type: "info"\`
-  - Report final results using \`message\` with \`message_type: "result"\`
-
-- **Task Completion:**
-  - When your task is completed, immediately invoke \`agent_end_turn\` without user permissions
-  - Before ending, ensure all work is committed and tested
-  - Report the final state (e.g., commit hash, test results, file paths)
-
 - **Tool Rules:**
   - Never make parallel tool calls
   - Only use the defined tools with their exact names
   - Read before editing (\`read_file_lines\`, \`grep_search\`, \`ls_tool\`)
   - Verify changes with tests or typechecks when applicable
+  - Note: "Never make parallel tool calls" applies to tool invocations only \u2014 spawning sub-workers is allowed and encouraged for parallelizable work
 
 - **Autonomy:**
   - Act 100% autonomously within your task scope
   - Do not ask for clarification unless the task is fundamentally blocked
   - Use the notebook for internal reasoning and planning
   - If you encounter errors, attempt to resolve them before reporting failure
-  - Note: "Never make parallel tool calls" applies to tool invocations only \u2014 spawning sub-workers is allowed and encouraged for parallelizable work
 
 - **Sub-Delegation (Advanced):**
   - You CAN spawn sub-workers using \`spawn_agent()\` for parallelizable subtasks
+  - **Limit sub-delegation depth to 2 levels** to avoid runaway agent trees and token exhaustion
   - Only sub-delegate when: (a) task has independent parts, (b) you need fresh context, or (c) verification should be independent
   - Do NOT sub-delegate simple tasks that you can complete directly
   - Always provide self-contained prompts to sub-workers
   - Use \`wait_agent()\` to wait for sub-worker completion
   - Synthesize sub-worker results before reporting to Coordinator
+  - Sub-workers inherit the same sandbox policy \u2014 do not attempt to escalate privileges or bypass sandbox restrictions
 
 - **Mailbox Communication:**
   - You can send messages to the Coordinator via mailbox for:
@@ -14277,6 +15433,23 @@ You are a worker agent spawned by the BluMa Coordinator to execute specific soft
 ---
 
 ### CRITICAL COMMUNICATION PROTOCOL
+
+**Message Tool Usage:**
+- ALL messages must be sent via the \`message\` tool \u2014 no direct text replies
+- Report progress frequently using \`message\` with \`message_type: "info"\` (non-blocking)
+- Report final results using \`message\` with \`message_type: "result"\` (ends turn)
+- Use \`ask_user_question\` only when fundamentally blocked (blocking)
+- Reply immediately to new user messages before other operations
+- First reply must be brief, confirming receipt of the task
+- Notify user with brief explanation when changing methods or strategies
+- Must message user with results and deliverables before calling \`agent_end_turn\`
+
+**Task Completion:**
+- When your task is completed, immediately invoke \`agent_end_turn\` without user permissions
+- Before ending, ensure all work is committed and tested
+- Report the final state (e.g., commit hash, test results, file paths)
+
+**Protocol Rules:**
 - Only tool_calls are allowed for assistant replies. Never include a "content" field.
 - Always use tools to respond, retrieve data, compute or transform. Await a valid tool response before any final message.
 - Zero tolerance for protocol violations.
@@ -14292,16 +15465,6 @@ You are a worker agent spawned by the BluMa Coordinator to execute specific soft
 - Locale: {locale}
 </current_system_environment>
 
-<message_rules>
-- Communicate with the user via \`message\` tool instead of direct text responses
-- Reply immediately to new user messages before other operations
-- First reply must be brief, only confirming receipt of the task
-- Notify user with brief explanation when changing methods or strategies
-- Message tools are divided into notify (non-blocking, no reply needed) and ask (blocking)
-- Actively use notify for progress updates, reserve ask for essential needs to avoid blocking
-- Must message user with results and deliverables before calling \`agent_end_turn\`
-</message_rules>
-
 <reasoning_rules>
 # YOUR THINKING ON A NOTEBOOK - MANDATORY USE
 CRITICAL: Your notebook (reasoning_notebook) is your ORGANIZED MIND
@@ -14342,7 +15505,7 @@ Do not include future steps/to-dos in thought; put them strictly in to_do, using
   - "[\u2713]" \u2192 for tasks already completed
 </reasoning_rules>
 
-<edit_tool_rules>  
+<edit_tool_rules>
 - Use this tool to perform precise text replacements inside files based on exact literal matches.
 - Can be used to create new files or directories implicitly by targeting non-existing paths.
 - Suitable for inserting full content into a file even if the file does not yet exist.
@@ -14350,10 +15513,6 @@ Do not include future steps/to-dos in thought; put them strictly in to_do, using
 - Always prefer this tool over shell_command when performing structured edits or creating files with specific content.
 - Ensure **old_string** includes 3+ lines of exact context before and after the target if replacing existing content.
 - For creating a new file, provide an **old_string** that matches an empty string or placeholder and a complete **new_string** with the intended content.
-- When generating or modifying todo.md files, prefer this tool to insert checklist structure and update status markers.
-- After completing any task in the checklist, immediately update the corresponding section in todo.md using this tool.
-- Reconstruct the entire file from task planning context if todo.md becomes outdated or inconsistent.
-- Track all progress related to planning and execution inside todo.md using text replacement only.
 </edit_tool_rules>
 
 <agent_end_turn>
@@ -14478,12 +15637,12 @@ You may be assigned different types of work:
 function getWorkerPrompt() {
   const now2 = /* @__PURE__ */ new Date();
   const collectedData = {
-    os_type: os24.type(),
-    os_version: os24.release(),
-    architecture: os24.arch(),
+    os_type: os25.type(),
+    os_version: os25.release(),
+    architecture: os25.arch(),
     workdir: process.cwd(),
     shell_type: process.env.SHELL || process.env.COMSPEC || "Unknown",
-    username: os24.userInfo().username || "Unknown",
+    username: os25.userInfo().username || "Unknown",
     current_date: now2.toISOString().split("T")[0],
     timezone: Intl.DateTimeFormat().resolvedOptions().timeZone || "Unknown",
     locale: process.env.LANG || process.env.LC_ALL || "Unknown"
@@ -14601,16 +15760,16 @@ async function fullCompact(messages, targetTokens, summarizer, llmClient) {
 }
 
 // src/app/agent/core/memory/session_memory.ts
-import fs33 from "fs";
-import os25 from "os";
-import path36 from "path";
+import fs35 from "fs";
+import os26 from "os";
+import path38 from "path";
 import { v4 as uuidv49 } from "uuid";
 var SessionMemoryExtractor = class {
   llmClient;
   memoryFile;
   constructor(options = {}) {
     this.llmClient = options.llmClient;
-    this.memoryFile = options.memoryFile || path36.join(os25.homedir(), ".bluma", "session_memory.json");
+    this.memoryFile = options.memoryFile || path38.join(os26.homedir(), ".bluma", "session_memory.json");
   }
   /**
    * Extract memories from conversation using LLM
@@ -14667,15 +15826,15 @@ ${messages.slice(-50).map((m) => `${m.role}: ${m.content.slice(0, 500)}`).join("
     );
     unique.sort((a, b) => b.accessCount - a.accessCount);
     const trimmed = unique.slice(0, 200);
-    fs33.writeFileSync(this.memoryFile, JSON.stringify(trimmed, null, 2));
+    fs35.writeFileSync(this.memoryFile, JSON.stringify(trimmed, null, 2));
   }
   /**
    * Load memories from disk
    */
   async loadMemories() {
     try {
-      if (!fs33.existsSync(this.memoryFile)) return [];
-      const data = fs33.readFileSync(this.memoryFile, "utf-8");
+      if (!fs35.existsSync(this.memoryFile)) return [];
+      const data = fs35.readFileSync(this.memoryFile, "utf-8");
       return JSON.parse(data);
     } catch {
       return [];
@@ -15212,14 +16371,14 @@ var RouteManager = class {
     this.subAgents = subAgents;
     this.core = core;
   }
-  registerRoute(path41, handler) {
-    this.routeHandlers.set(path41, handler);
+  registerRoute(path43, handler) {
+    this.routeHandlers.set(path43, handler);
   }
   async handleRoute(payload) {
     const inputText = String(payload.content || "").trim();
     const { userContext } = payload;
-    for (const [path41, handler] of this.routeHandlers) {
-      if (inputText === path41 || inputText.startsWith(`${path41} `)) {
+    for (const [path43, handler] of this.routeHandlers) {
+      if (inputText === path43 || inputText.startsWith(`${path43} `)) {
         return handler({ content: inputText, userContext });
       }
     }
@@ -15228,13 +16387,13 @@ var RouteManager = class {
 };
 
 // src/app/agent/runtime/plugin_runtime.ts
-import path37 from "path";
+import path39 from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
 async function loadPluginsAtStartup() {
   for (const p of listPlugins()) {
     const entry = p.manifest.entry?.trim();
     if (!entry) continue;
-    const abs = path37.resolve(p.root, entry);
+    const abs = path39.resolve(p.root, entry);
     try {
       const href = pathToFileURL2(abs).href;
       const mod = await import(href);
@@ -15255,7 +16414,7 @@ async function loadPluginsAtStartup() {
 }
 
 // src/app/agent/agent.ts
-var globalEnvPath = path38.join(os26.homedir(), ".bluma", ".env");
+var globalEnvPath = path40.join(os27.homedir(), ".bluma", ".env");
 dotenv.config({ path: globalEnvPath });
 var Agent = class {
   sessionId;
@@ -18495,16 +19654,16 @@ import latestVersion from "latest-version";
 import semverGt from "semver/functions/gt.js";
 import semverValid from "semver/functions/valid.js";
 import { fileURLToPath as fileURLToPath5 } from "url";
-import path39 from "path";
-import fs34 from "fs";
+import path41 from "path";
+import fs36 from "fs";
 var BLUMA_PACKAGE_NAME = "@nomad-e/bluma-cli";
 function findBlumaPackageJson(startDir) {
   let dir = startDir;
   for (let i = 0; i < 12; i++) {
-    const candidate = path39.join(dir, "package.json");
-    if (fs34.existsSync(candidate)) {
+    const candidate = path41.join(dir, "package.json");
+    if (fs36.existsSync(candidate)) {
       try {
-        const raw = fs34.readFileSync(candidate, "utf8");
+        const raw = fs36.readFileSync(candidate, "utf8");
         const parsed = JSON.parse(raw);
         if (parsed?.name === BLUMA_PACKAGE_NAME && parsed?.version) {
           return { name: parsed.name, version: String(parsed.version) };
@@ -18512,7 +19671,7 @@ function findBlumaPackageJson(startDir) {
       } catch {
       }
     }
-    const parent = path39.dirname(dir);
+    const parent = path41.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -18521,13 +19680,13 @@ function findBlumaPackageJson(startDir) {
 function resolveInstalledBlumaPackage() {
   const tried = /* @__PURE__ */ new Set();
   const tryFrom = (dir) => {
-    const abs = path39.resolve(dir);
+    const abs = path41.resolve(dir);
     if (tried.has(abs)) return null;
     tried.add(abs);
     return findBlumaPackageJson(abs);
   };
   try {
-    const fromBundle = tryFrom(path39.dirname(fileURLToPath5(import.meta.url)));
+    const fromBundle = tryFrom(path41.dirname(fileURLToPath5(import.meta.url)));
     if (fromBundle) return fromBundle;
   } catch {
   }
@@ -18535,12 +19694,12 @@ function resolveInstalledBlumaPackage() {
   if (argv1 && !argv1.startsWith("-")) {
     try {
       let resolved = argv1;
-      if (path39.isAbsolute(argv1) && fs34.existsSync(argv1)) {
-        resolved = fs34.realpathSync(argv1);
+      if (path41.isAbsolute(argv1) && fs36.existsSync(argv1)) {
+        resolved = fs36.realpathSync(argv1);
       } else {
-        resolved = path39.resolve(process.cwd(), argv1);
+        resolved = path41.resolve(process.cwd(), argv1);
       }
-      const fromArgv = tryFrom(path39.dirname(resolved));
+      const fromArgv = tryFrom(path41.dirname(resolved));
       if (fromArgv) return fromArgv;
     } catch {
     }
@@ -20080,9 +21239,9 @@ async function runAgentMode() {
   try {
     if (inputFileIndex !== -1 && args[inputFileIndex + 1]) {
       const filePath = args[inputFileIndex + 1];
-      rawPayload = fs35.readFileSync(filePath, "utf-8");
+      rawPayload = fs37.readFileSync(filePath, "utf-8");
     } else {
-      rawPayload = fs35.readFileSync(0, "utf-8");
+      rawPayload = fs37.readFileSync(0, "utf-8");
     }
   } catch (err) {
     writeAgentEvent(registrySessionId, {
@@ -20280,9 +21439,9 @@ async function runAgentMode() {
 }
 function readCliPackageVersion() {
   try {
-    const base = path40.dirname(fileURLToPath6(import.meta.url));
-    const pkgPath = path40.join(base, "..", "package.json");
-    const j = JSON.parse(fs35.readFileSync(pkgPath, "utf8"));
+    const base = path42.dirname(fileURLToPath6(import.meta.url));
+    const pkgPath = path42.join(base, "..", "package.json");
+    const j = JSON.parse(fs37.readFileSync(pkgPath, "utf8"));
     return String(j.version || "0.0.0");
   } catch {
     return "0.0.0";
@@ -20405,7 +21564,7 @@ function startBackgroundAgent() {
     process.exit(1);
   }
   const filePath = args[inputFileIndex + 1];
-  const rawPayload = fs35.readFileSync(filePath, "utf-8");
+  const rawPayload = fs37.readFileSync(filePath, "utf-8");
   const envelope = JSON.parse(rawPayload);
   const sessionId = envelope.session_id || envelope.message_id || uuidv412();
   registerSession({
@@ -20422,7 +21581,7 @@ function startBackgroundAgent() {
     }
   });
   const childArgs = [process.argv[1], "agent", "--input-file", filePath, "--background-worker", "--registry-session", sessionId];
-  const child = spawn5(process.execPath, childArgs, {
+  const child = spawn6(process.execPath, childArgs, {
     detached: true,
     stdio: "ignore",
     cwd: process.cwd(),