@superblocksteam/cli 2.0.79 → 2.0.80

package/dist/index.js

@@ -1,7 +1,7 @@
 if (typeof process === 'object' && process !== null &&
     process.env !== null && typeof process.env === 'object') {
   process.env.DD_GIT_REPOSITORY_URL = 'https://token@github.com/superblocksteam/superblocks.git';
-  process.env.DD_GIT_COMMIT_SHA = 'e33d1aaf9795a7f1c28268f6b69b198f6ee97cf4';
+  process.env.DD_GIT_COMMIT_SHA = '85aea01c8ed1a6da4927ceb1ed71e667f68b4bd3';
 }
 import { createRequire as $dd_createRequire } from 'module';
 import { fileURLToPath as $dd_fileURLToPath } from 'url';
@@ -23,10 +23,10 @@ import {
   require_re,
   require_semver,
   require_valid
-} from "./chunk-AUEMW22E.js";
+} from "./chunk-Y4WGEUR7.js";
 import {
   require_enquirer
-} from "./chunk-W56A5OTP.js";
+} from "./chunk-VRQ5TOM4.js";
 import {
   debounce_default,
   get_default,
@@ -40,7 +40,7 @@ import {
   require_dist,
   require_lib,
   require_slugify
-} from "./chunk-7666LLVD.js";
+} from "./chunk-V6CSYTZV.js";
 import {
   SpanKind,
   SpanStatusCode,
@@ -48,7 +48,7 @@ import {
   esm_exports,
   init_esm,
   trace
-} from "./chunk-XTDAYSPV.js";
+} from "./chunk-3LSQZAOC.js";
 import {
   require_agent_info_exporter,
   require_base,
@@ -77,7 +77,7 @@ import {
   require_utils,
   require_writer,
   require_writers
-} from "./chunk-5CFCELBW.js";
+} from "./chunk-WLDSUX2U.js";
 import {
   __commonJS,
   __esm,
@@ -86,7 +86,7 @@ import {
   __toCommonJS,
   __toESM,
   init_cjs_shims
-} from "./chunk-5YKSZFXG.js";
+} from "./chunk-3PBLXNC7.js";
 
 // ../../../../node_modules/.pnpm/common-tags@1.8.2/node_modules/common-tags/lib/TemplateTag/TemplateTag.js
 var require_TemplateTag = __commonJS({
@@ -68519,19 +68519,19 @@ var require_getMachineId = __commonJS({
       if (!getMachineIdImpl) {
         switch (process5.platform) {
           case "darwin":
-            getMachineIdImpl = (await import("./getMachineId-darwin-NDVE6SAZ.js")).getMachineId;
+            getMachineIdImpl = (await import("./getMachineId-darwin-LQQH4VEK.js")).getMachineId;
             break;
           case "linux":
-            getMachineIdImpl = (await import("./getMachineId-linux-3ND2EEB3.js")).getMachineId;
+            getMachineIdImpl = (await import("./getMachineId-linux-Y47SDQD5.js")).getMachineId;
             break;
           case "freebsd":
-            getMachineIdImpl = (await import("./getMachineId-bsd-KP2FQDPV.js")).getMachineId;
+            getMachineIdImpl = (await import("./getMachineId-bsd-APHSMI5B.js")).getMachineId;
             break;
           case "win32":
-            getMachineIdImpl = (await import("./getMachineId-win-NWQS4FCL.js")).getMachineId;
+            getMachineIdImpl = (await import("./getMachineId-win-QETDSGO2.js")).getMachineId;
             break;
           default:
-            getMachineIdImpl = (await import("./getMachineId-unsupported-57PJA7UB.js")).getMachineId;
+            getMachineIdImpl = (await import("./getMachineId-unsupported-NJFBX26Y.js")).getMachineId;
             break;
         }
       }
@@ -304088,15 +304088,15 @@ var require_api_files = __commonJS({
     exports2.readAppApiYamlFile = readAppApiYamlFile4;
     exports2.resolveLanguageSpecificStepContentFromBlocks = resolveLanguageSpecificStepContentFromBlocks2;
     async function writeApiFiles3(...args) {
-      const esmFunction = await import("./api-IYURAM57.js");
+      const esmFunction = await import("./api-LFKG7KGP.js");
       return esmFunction.writeApiFiles(...args);
     }
     async function readAppApiYamlFile4(...args) {
-      const esmFunction = await import("./api-IYURAM57.js");
+      const esmFunction = await import("./api-LFKG7KGP.js");
       return esmFunction.readAppApiYamlFile(...args);
     }
     async function resolveLanguageSpecificStepContentFromBlocks2(...args) {
-      const esmFunction = await import("./api-IYURAM57.js");
+      const esmFunction = await import("./api-LFKG7KGP.js");
       return esmFunction.resolveLanguageSpecificStepContentFromBlocks(...args);
     }
   }
@@ -451403,7 +451403,7 @@ var require_config_loader = __commonJS({
        * @returns {Promise<{createJiti: Function|undefined, version: string;}>} A promise that fulfills with an object containing the jiti module's createJiti function and version.
        */
       static async loadJiti() {
-        const { createJiti } = await import("./jiti-BTQ6BTPJ.js");
+        const { createJiti } = await import("./jiti-W4MWM6SL.js");
         const version5 = require_package7().version;
         return { createJiti, version: version5 };
       }
@@ -451732,7 +451732,7 @@ var require_eslint_helpers = __commonJS({
     }
     async function globMatch({ basePath, pattern }) {
       let found = false;
-      const { hfs } = await import("./src-HFPN4XIF.js");
+      const { hfs } = await import("./src-5FAXQQTX.js");
       const patternToUse = normalizeToPosix(path84.relative(basePath, pattern));
       const matcher = new Minimatch2(patternToUse, MINIMATCH_OPTIONS);
       const walkSettings = {
@@ -451772,7 +451772,7 @@ var require_eslint_helpers = __commonJS({
         return new Minimatch2(patternToUse, MINIMATCH_OPTIONS);
       });
       const unmatchedPatterns = /* @__PURE__ */ new Set([...relativeToPatterns.keys()]);
-      const { hfs } = await import("./src-HFPN4XIF.js");
+      const { hfs } = await import("./src-5FAXQQTX.js");
       const walk2 = hfs.walk(basePath, {
         async directoryFilter(entry) {
           if (!matchers.some((matcher) => matcher.match(entry.path, true))) {
@@ -580101,8 +580101,6 @@ function registerLogListener(listener) {
     logListeners.delete(listener);
   };
 }
-var wrappedLoggers = /* @__PURE__ */ new WeakSet();
-var wrappedLoggerMap = /* @__PURE__ */ new WeakMap();
 function notifyListeners(level, messages3, meta2) {
   if (logListeners.size === 0) {
     return;
@@ -580121,13 +580119,15 @@ function notifyListeners(level, messages3, meta2) {
     }
   }
 }
+var WRAPPED_MARKER = Symbol("wrappedLogger");
+var wrappedLoggerCache = /* @__PURE__ */ new WeakMap();
 function wrapLogger(logger12) {
-  if (wrappedLoggers.has(logger12)) {
+  if (logger12[WRAPPED_MARKER]) {
     return logger12;
   }
-  const existing = wrappedLoggerMap.get(logger12);
-  if (existing) {
-    return existing;
+  const cached2 = wrappedLoggerCache.get(logger12);
+  if (cached2) {
+    return cached2;
   }
   const wrapped = {
     debug: (...messages3) => {
@@ -580147,26 +580147,27 @@ function wrapLogger(logger12) {
       logger12.error(message, meta2);
     }
   };
-  wrappedLoggers.add(wrapped);
-  wrappedLoggerMap.set(logger12, wrapped);
+  wrapped[WRAPPED_MARKER] = true;
+  wrappedLoggerCache.set(logger12, wrapped);
   return wrapped;
 }
 var _defaultLogger;
 function setDefaultLogger(logger12) {
   _defaultLogger = wrapLogger(logger12);
 }
+var consoleLogger = wrapLogger({
+  debug: (...messages3) => console.debug(...messages3),
+  info: (...messages3) => console.info(...messages3),
+  warn: (...messages3) => console.warn(...messages3),
+  error: (message, meta2) => console.error(message, meta2)
+});
 function getLogger() {
-  if (!_defaultLogger) {
-    setDefaultLogger({
-      debug: (...messages3) => console.debug(...messages3),
-      info: (...messages3) => console.info(...messages3),
-      warn: (...messages3) => console.warn(...messages3),
-      error: (message, meta2) => {
-        console.error(message, meta2 ?? "");
-      }
-    });
-  }
-  return _defaultLogger;
+  return {
+    debug: (...messages3) => (_defaultLogger ?? consoleLogger).debug(...messages3),
+    info: (...messages3) => (_defaultLogger ?? consoleLogger).info(...messages3),
+    warn: (...messages3) => (_defaultLogger ?? consoleLogger).warn(...messages3),
+    error: (message, meta2) => (_defaultLogger ?? consoleLogger).error(message, meta2)
+  };
 }
 function getErrorMeta(error40) {
   if (import_ai.APICallError.isInstance(error40)) {
@@ -583951,7 +583952,7 @@ import os2 from "node:os";
 // ../sdk/package.json
 var package_default = {
   name: "@superblocksteam/sdk",
-  version: "2.0.79",
+  version: "2.0.80",
   type: "module",
   description: "Superblocks JS SDK",
   homepage: "https://www.superblocks.com",
@@ -584358,7 +584359,7 @@ var AiEntityType;
   AiEntityType2["USER"] = "user";
   AiEntityType2["BLOCK"] = "block";
 })(AiEntityType || (AiEntityType = {}));
-var MAX_OUTPUT_TOKENS = 64e3;
+var MAX_OUTPUT_TOKENS = 48e3;
 var DEFAULT_CONTEXT_OPTIONS_V2 = {
   contextLimit: 17e4,
   contextBufferTokens: 4e3,
@@ -637407,7 +637408,7 @@ init_esm();
 var LLMObsSpanWriter = null;
 async function loadLLMObsSpanWriter() {
   if (!LLMObsSpanWriter) {
-    const module2 = await import("./spans-75IAOHS2.js");
+    const module2 = await import("./spans-X7MEIA5C.js");
     LLMObsSpanWriter = module2.default;
   }
   return LLMObsSpanWriter;
@@ -641242,7 +641243,7 @@ var execAsync = promisify(exec);
 async function searchGronWithRipgrep(gronPath, pattern) {
   const logger12 = getLogger();
   try {
-    const { stdout } = await execAsync(`rg --no-heading --no-line-number '${pattern.replace(/'/g, "'\\''")}' '${gronPath}'`, { maxBuffer: 50 * 1024 * 1024 });
+    const { stdout } = await execAsync(`rg -i --no-heading --no-line-number '${pattern.replace(/'/g, "'\\''")}' '${gronPath}'`, { maxBuffer: 50 * 1024 * 1024 });
     const lines = stdout.trim().split("\n").filter((line3) => line3.length > 0);
     logger12.debug(`[ripgrep] Found ${lines.length} matches in ${gronPath} for pattern: ${pattern}`);
     if (lines.length > 1e4) {
@@ -657282,6 +657283,11 @@ A request is **SAFE** if it:
 - Only classify as UNSAFE if there is clear attempt to extract system internals or clear malicious intent
 
 Analyze the following user request and provide your classification.`;
+var FAIL_CLOSED_RESULT = {
+  safe: false,
+  justification: "Classification failed, blocking request (fail-closed policy).",
+  categories: ["other"]
+};
 async function classifyPromptSafety(prompt3, options8) {
   const { model, timeout = 5e3, abortSignal } = options8;
   const logger12 = getLogger();
@@ -657313,6 +657319,14 @@ async function classifyPromptSafety(prompt3, options8) {
     clearTimeout(timeoutId);
   }
 }
+function createBlockedUserMessage(_originalUser, classification) {
+  const categoryStr = classification.categories && classification.categories.length > 0 ? ` Categories: ${classification.categories.join(", ")}.` : "";
+  const blockedContent = `[BLOCKED] User prompt was blocked because it was classified as unsafe. Reason: ${classification.justification}${categoryStr}`;
+  return {
+    role: "user",
+    content: blockedContent
+  };
+}
 
 // ../../../vite-plugin-file-sync/dist/ai-service/llm/context-v2/index.js
 init_cjs_shims();
@@ -657875,31 +657889,71 @@ function getProviderId(model) {
   return model.provider ?? "unknown";
 }
 var logger3 = getPrefixedLogger("[phase2-session-summarizer]");
-function stripImagesFromMessages(messages3) {
-  return messages3.map((msg) => {
-    if (!Array.isArray(msg.content)) {
-      return msg;
+function getMediaType(value2) {
+  if (value2.mediaType) {
+    return value2.mediaType;
+  }
+  if (value2.type === "media" && value2.data?.startsWith("data:")) {
+    const match2 = value2.data.match(/^data:([^;,]+)/);
+    return match2?.[1] ?? null;
+  }
+  return null;
+}
+function formatMediaTag(mediaType) {
+  if (!mediaType)
+    return "[media]";
+  if (mediaType.startsWith("image/"))
+    return "[image]";
+  if (mediaType.startsWith("video/"))
+    return "[video]";
+  if (mediaType.startsWith("audio/"))
+    return "[audio]";
+  if (mediaType === "application/pdf")
+    return "[pdf]";
+  return `[media: ${mediaType}]`;
+}
+function stripMedia(msg) {
+  if (!Array.isArray(msg.content)) {
+    return msg;
+  }
+  const strippedContent = msg.content.map((part) => {
+    if (typeof part === "object" && part !== null && "type" in part && part.type === "image") {
+      return { type: "text", text: "[image]" };
     }
-    const strippedContent = msg.content.map((part) => {
-      if (typeof part === "object" && part !== null && "type" in part && part.type === "image") {
-        return { type: "text", text: "[image]" };
+    if (part.type === "tool-result" && part.output?.type === "content" && Array.isArray(part.output.value)) {
+      const firstMediaType = part.output.value.map(getMediaType).find((t16) => t16 !== null);
+      if (firstMediaType) {
+        const tag = formatMediaTag(firstMediaType);
+        return { type: "text", text: tag };
       }
-      if (part.type === "tool-result" && part.output?.type === "content" && part.output.value?.some((value2) => value2.type === "media" && value2.data?.startsWith("data:image/"))) {
-        return { type: "text", text: "[image]" };
-      }
-      return part;
-    });
-    return { ...msg, content: strippedContent };
+    }
+    return part;
   });
+  return { ...msg, content: strippedContent };
+}
+function stripProviderOptions(msg) {
+  if (!Array.isArray(msg.content)) {
+    return msg;
+  }
+  const strippedContent = msg.content.map((part) => {
+    if (part.type === "reasoning") {
+      const { providerOptions, ...rest } = part;
+      return rest;
+    }
+    return part;
+  });
+  return { ...msg, content: strippedContent };
+}
+function stripSuperblocksMeta({ _superblocks, ...msg }) {
+  return msg;
 }
 async function summarizeSession(options8) {
   const { messages: messages3, model, targetTokens, abortSignal, tracer: tracer4 = LLMObsTracer.instance } = options8;
   return tracer4.trace({ name: "session.summarize", kind: "task" }, async (summarizeSpan) => {
     async function callLLM(msgs) {
       return tracer4.trace({ name: "session.summarize.llm", kind: "task" }, async (llmSpan) => {
-        const strippedMessages = stripImagesFromMessages(msgs);
-        const cleanMessages = strippedMessages.map(({ _superblocks, ...msg }) => msg);
-        const messagesJson = JSON.stringify(cleanMessages, null, 2);
+        const cleanedMessages = msgs.map(stripMedia).map(stripProviderOptions).map(stripSuperblocksMeta);
+        const messagesJson = JSON.stringify(cleanedMessages, null, 2);
         const userMessage = formatCompactionRequest(messagesJson);
         let capturedError = null;
         const inputMetadata = {
@@ -658979,15 +659033,26 @@ var VercelStreamTextAdapter = class {
       onError: rest.onError ? (event) => handleOnError(event.error) : void 0,
       onAbort: rest.onAbort
     });
-    rawResult.steps.catch(() => {
+    rawResult.steps.catch((error40) => {
+      getLogger().error("Stream steps promise rejected", getErrorMeta(error40));
     });
     rawResult.response?.catch((error40) => {
-      getLogger().error("Error in stream response", getErrorMeta(error40));
+      getLogger().error("Stream response promise rejected", getErrorMeta(error40));
+    });
+    rawResult.text?.catch((error40) => {
+      getLogger().error("Stream text promise rejected", getErrorMeta(error40));
+    });
+    rawResult.finishReason?.catch((error40) => {
+      getLogger().error("Stream finishReason promise rejected", getErrorMeta(error40));
+    });
+    rawResult.usage?.catch((error40) => {
+      getLogger().error("Stream usage promise rejected", getErrorMeta(error40));
     });
     const result = {
       textStream: rawResult.textStream,
       fullStream: rawResult.fullStream,
       steps: rawResult.steps
+      // Use original promise - rejection is now suppressed
     };
     return onFinally ? withStreamLifecycle(result, onFinally) : result;
   }
@@ -660785,6 +660850,9 @@ var ContextObserver = class {
     });
   }
   async onStepComplete(step, _session) {
+    if (step.finishReason === "unknown") {
+      return;
+    }
     if (step.response?.messages) {
       await this.contextHandle.context.endStep(step.response.messages, step.usage);
     }
@@ -660915,38 +660983,156 @@ var LLMClient = class {
     this.getJwt = params.getJwt;
     this.onUsageRecorded = params.onUsageRecorded;
   }
+  /**
+   * Applies safety classification to a user message.
+   *
+   * @param user - The user message to classify
+   * @param userText - The extracted text to classify
+   * @param config - Safety classification configuration
+   * @returns Object containing the processed message and classification result
+   */
+  async applySafetyClassification(user, userText, config4) {
+    const failOpen = config4.failOpen ?? true;
+    if (!config4.model) {
+      this.logger.warn("[safety-classifier] No model configured, skipping classification");
+      return {
+        message: user,
+        classification: {
+          safe: true,
+          justification: "No model configured, skipped classification"
+        }
+      };
+    }
+    try {
+      this.logger.info("[safety-classifier] Running safety classification");
+      const classification = await classifyPromptSafety(userText, {
+        model: config4.model,
+        timeout: config4.timeout ?? 5e3
+      });
+      if (!classification.safe) {
+        this.logger.warn("[safety-classifier] Prompt classified as unsafe", {
+          justification: classification.justification,
+          categories: classification.categories
+        });
+        return {
+          message: createBlockedUserMessage(user, classification),
+          classification: {
+            safe: false,
+            justification: classification.justification,
+            categories: classification.categories
+          }
+        };
+      }
+      this.logger.info("[safety-classifier] Prompt classified as safe");
+      return {
+        message: user,
+        classification: {
+          safe: true,
+          justification: classification.justification
+        }
+      };
+    } catch (error40) {
+      this.logger.error("[safety-classifier] Classification failed", getErrorMeta(error40));
+      if (failOpen) {
+        this.logger.info("[safety-classifier] Failing open, allowing request to proceed");
+        return {
+          message: user,
+          classification: {
+            safe: true,
+            justification: "Classification error, failed open",
+            error: error40 instanceof Error ? error40.message : String(error40)
+          }
+        };
+      } else {
+        this.logger.warn("[safety-classifier] Failing closed, blocking request");
+        return {
+          message: createBlockedUserMessage(user, FAIL_CLOSED_RESULT),
+          classification: {
+            safe: false,
+            justification: FAIL_CLOSED_RESULT.justification,
+            categories: FAIL_CLOSED_RESULT.categories,
+            error: error40 instanceof Error ? error40.message : String(error40)
+          }
+        };
+      }
+    }
+  }
   async streamText(options8, logger12 = getLogger(), tracer4 = LLMObsTracer.instance) {
     const { model, user, system, context: contextConfig, logging: loggingConfig, retry: retryConfig, providerConfig, enableFallback, fallbackStrategy, peer, observers: customObservers, prepareStep, onStepFinish, onFinish, onChunk, onError: onError2, useContextV2, summarizationModel, safety: safetyConfig, ...streamOptions } = options8;
     if (!user) {
       throw new Error("user message is required");
     }
-    const userText = extractTextFromMessage(user);
     let safeUser = user;
     let safetySpan;
-    if (safetyConfig) {
+    const hasSecretRedaction = safetyConfig?.secretRedaction?.enabled === true;
+    const hasClassification = safetyConfig?.classification?.enabled === true;
+    if (safetyConfig && (hasSecretRedaction || hasClassification)) {
       safetySpan = tracer4.startActiveSpan({
         name: "llmclient.safety",
         kind: "task"
       });
-    }
-    if (safetyConfig?.secretRedaction?.enabled) {
-      await tracer4.trace({
-        name: "llmclient.safety.secretRedaction",
-        kind: "task"
-      }, async () => {
-        const scanResult = await scanContentForSecrets(userText);
-        const secretRedactor = new SecretRedactor(scanResult.findings);
-        if (scanResult.hasSecrets) {
-          this.logger.warn(`[secret-scan] Found ${scanResult.findings.length} potential secret(s) in user message`, {
-            findingCount: scanResult.findings.length,
-            hasVerified: scanResult.hasVerifiedSecrets,
-            detectorTypes: scanResult.findings.map((f) => f.detectorType)
+      const scope = safetyConfig.scope ?? "all";
+      const userText = extractTextFromMessage(user, scope);
+      if (hasSecretRedaction) {
+        await tracer4.trace({
+          name: "llmclient.safety.secretRedaction",
+          kind: "task"
+        }, async () => {
+          try {
+            const scanResult = await scanContentForSecrets(userText);
+            if (!scanResult.success) {
+              this.logger.error(`[secret-scan] Secret scanning failed, cannot verify if prompt contains secrets: ${scanResult.error ?? "unknown error"}`);
+              return;
+            }
+            const secretRedactor = new SecretRedactor(scanResult.findings);
+            if (scanResult.hasSecrets) {
+              this.logger.warn(`[secret-scan] Found ${scanResult.findings.length} potential secret(s)`, {
+                findingCount: scanResult.findings.length,
+                hasVerified: scanResult.hasVerifiedSecrets,
+                detectorTypes: scanResult.findings.map((f) => f.detectorType)
+              });
+            }
+            safeUser = redactUserMessage(safeUser, secretRedactor);
+          } catch (error40) {
+            this.logger.error("[secret-scan] Secret scanning threw an exception, proceeding without redaction", getErrorMeta(error40));
+          }
+        });
+      }
+      if (hasClassification && safetyConfig.classification) {
+        const config4 = safetyConfig.classification;
+        if (!config4.model) {
+          this.logger.warn("[safety-classifier] No model configured, skipping classification");
+        } else {
+          await tracer4.trace({
+            name: "llmclient.safety.classification",
+            kind: "task"
+          }, async () => {
+            const textToClassify = extractTextFromMessage(safeUser, scope);
+            const result = await this.applySafetyClassification(safeUser, textToClassify, config4);
+            safeUser = result.message;
+            tracer4.annotate({
+              tags: {
+                "safety.classification.safe": result.classification.safe,
+                "safety.classification.blocked": !result.classification.safe
+              },
+              metadata: {
+                classification: {
+                  safe: result.classification.safe,
+                  justification: result.classification.justification,
+                  ...result.classification.categories && {
+                    categories: result.classification.categories
+                  },
+                  ...result.classification.error && {
+                    error: result.classification.error
+                  }
+                }
+              }
+            });
           });
         }
-        safeUser = redactUserMessage(user, secretRedactor);
-      });
+      }
+      safetySpan?.finish();
     }
-    safetySpan?.finish();
     if (!providerConfig?.provider || !providerConfig?.model) {
       throw new Error("providerConfig with provider and model is required. This should be populated from llmConfig sent by the UI.");
     }
@@ -661056,7 +661242,7 @@ var LLMClient = class {
             id: messageId,
             type: "control",
             group: `context-compaction-${phase}`,
-            text: "Summarizing previous messages",
+            text: "Summarizing conversation",
             status: "pending"
           });
         },
@@ -661067,7 +661253,7 @@ var LLMClient = class {
             id: messageId,
             type: "control",
             group: `context-compaction-${phase}`,
-            text: "Summarized previous messages",
+            text: "Summarized past conversation",
             status: "validated"
           });
         }
@@ -677463,16 +677649,14 @@ var jwtMiddleware = (getJwt, getAttributes) => {
 };
 var prioritySettingsMiddleware = ({ settings }) => {
   return {
-    transformParams: async ({ params }) => {
-      return {
-        ...settings,
-        ...params,
-        providerMetadata: {
-          ...params.providerOptions,
-          ...settings.providerOptions
-        }
-      };
-    }
+    transformParams: async ({ params }) => ({
+      ...params,
+      ...settings,
+      providerMetadata: {
+        ...params.providerOptions,
+        ...settings.providerOptions
+      }
+    })
   };
 };
 
@@ -678084,7 +678268,7 @@ var PlaywrightMcpServerManager = class {
       this.logger.info(`Starting embedded Playwright MCP server: browser=${options8?.browser || "chromium"}, headless=${options8?.headless !== false}`);
     }
     try {
-      const { startEmbeddedPlaywrightMcpServer } = await import("./embedded-playwright-mcp-server-JIR3LNSE.js");
+      const { startEmbeddedPlaywrightMcpServer } = await import("./embedded-playwright-mcp-server-RBP5W453.js");
       this.server = await startEmbeddedPlaywrightMcpServer({
         storageStatePath: options8?.storageStatePath,
         jwt: options8?.jwt,
@@ -679134,7 +679318,14 @@ var Clark = class extends TracedFSM {
       peer: this.context.peer,
       useContextV2: this.context.llmConfig?.flags?.isContextV2Enabled,
       summarizationModel: services.llmProvider.modelForTask("summarizeMessages"),
-      safety: {
+      safety: streamOptions.safety ? {
+        scope: streamOptions.safety.scope,
+        // Pass through unified scope
+        classification: streamOptions.safety.classification,
+        // Pass through
+        secretRedaction: streamOptions.safety.secretRedaction
+        // Pass through
+      } : {
         secretRedaction: {
           enabled: services.features.secretRedactionEnabled ?? false
         }
@@ -679383,7 +679574,9 @@ Address the errors and return the fixed code.`;
       void transitionTo({
         type: AGENT_PLANNED,
         userPrompt: debuggingPrompt,
-        debugging: true
+        debugging: true,
+        isUserPrompt: false
+        // Debugging prompts are system-generated
       });
     });
   });
@@ -679558,7 +679751,10 @@ Address the errors and return the fixed code.`;
         void transitionTo({
           type: AGENT_PLANNED,
           userPrompt: request3.prompt,
-          promptContext: request3.promptContext
+          promptContext: request3.promptContext,
+          // Skip safety features if this is a response to an interactive message
+          // (not an original user prompt)
+          isUserPrompt: !request3.responseMetadata
         });
         break;
       }
@@ -690135,7 +690331,7 @@ var VERSION_SPECIFIC_TYPE_DEFINITIONS = [
     integrationId: string,
     config: {
       statement: Binding<string>;
-      /** SQL parameters array - use "[]" for queries without parameters */
+      /** SQL parameters array - use "" for queries without parameters */
       parameters: Binding<string>;
     }
   );
@@ -690217,7 +690413,7 @@ new PostgreSQL("SortedUsers", postgresIntegrationId, {
     integrationId: string,
     config: {
       statement: Binding<string>;
-      /** SQL parameters array - use "[]" for queries without parameters */
+      /** SQL parameters array - use "" for queries without parameters */
       parameters: Binding<string>;
     }
   );
@@ -690287,7 +690483,7 @@ new MySQL("SortedUsers", mysqlIntegrationId, {
     integrationId: string,
     config: {
       statement: Binding<string>;
-      /** SQL parameters array - use "[]" for queries without parameters */
+      /** SQL parameters array - use "" for queries without parameters */
       parameters: Binding<string>;
     }
   );
@@ -690357,7 +690553,7 @@ new MariaDB("SortedUsers", mariadbIntegrationId, {
     integrationId: string,
     config: {
       statement: Binding<string>;
-      /** SQL parameters array - use "[]" for queries without parameters */
+      /** SQL parameters array - use "" for queries without parameters */
       parameters: Binding<string>;
     }
   );
@@ -690427,7 +690623,7 @@ new MicrosoftSql("SortedUsers", mssqlIntegrationId, {
     integrationId: string,
     config: {
       statement: Binding<string>;
-      /** SQL parameters array - use "[]" for queries without parameters */
+      /** SQL parameters array - use "" for queries without parameters */
       parameters: Binding<string>;
     }
   );
@@ -690497,7 +690693,7 @@ new Snowflake("SortedUsers", snowflakeIntegrationId, {
     integrationId: string,
     config: {
       statement: Binding<string>;
-      /** SQL parameters array - use "[]" for queries without parameters */
+      /** SQL parameters array - use "" for queries without parameters */
       parameters: Binding<string>;
     }
   );
@@ -690567,7 +690763,7 @@ new Redshift("SortedUsers", redshiftIntegrationId, {
     integrationId: string,
     config: {
       sqlBody: Binding<string>;
-      /** SQL parameters array - use "[]" for queries without parameters */
+      /** SQL parameters array - use "" for queries without parameters */
       parameters: Binding<string>;
     }
   );
@@ -690637,7 +690833,7 @@ new BigQuery("SortedUsers", bigqueryIntegrationId, {
     integrationId: string,
     config: {
       sqlBody: Binding<string>;
-      /** SQL parameters array - use "[]" for queries without parameters */
+      /** SQL parameters array - use "" for queries without parameters */
       parameters: Binding<string>;
     }
   );
@@ -690700,7 +690896,7 @@ new Athena("SortedLogs", athenaIntegrationId, {
     integrationId: string,
     config: {
       statement: Binding<string>;
-      /** SQL parameters array - use "[]" for queries without parameters */
+      /** SQL parameters array - use "" for queries without parameters */
       parameters: Binding<string>;
     }
   );
@@ -690770,7 +690966,7 @@ new Databricks("SortedUsers", databricksIntegrationId, {
     integrationId: string,
     config: {
       statement: Binding<string>;
-      /** SQL parameters array - use "[]" for queries without parameters */
+      /** SQL parameters array - use "" for queries without parameters */
       parameters: Binding<string>;
     }
   );
@@ -690840,7 +691036,7 @@ new CockroachDB("SortedUsers", cockroachdbIntegrationId, {
     integrationId: string,
     config: {
       statement: Binding<string>;
-      /** SQL parameters array - use "[]" for queries without parameters */
+      /** SQL parameters array - use "" for queries without parameters */
       parameters: Binding<string>;
     }
   );
@@ -710144,46 +710340,18 @@ Do NOT call \`build_finalize\` until testing is complete.
     content: content2
   };
 };
-async function classifyUserPrompt(userPrompt, services) {
-  const logger12 = getLogger();
-  if (!services.features.safetyClassificationEnabled) {
-    logger12.debug("[llm-generating] Safety classification disabled by flag");
-    return userPrompt;
-  }
-  logger12.info("[llm-generating] Running safety classification on user prompt");
-  const model = services.llmProvider.modelForTask("fast");
-  try {
-    const classification = await classifyPromptSafety(userPrompt, {
-      model,
-      timeout: 5e3
-    });
-    if (!classification.safe) {
-      logger12.warn("[llm-generating] Prompt classified as unsafe", {
-        justification: classification.justification,
-        categories: classification.categories
-      });
-      return `[BLOCKED] User prompt was blocked because it was classified as unsafe. Reason: ${classification.justification}. Categories: ${classification.categories}`;
-    }
-    logger12.info("[llm-generating] Prompt classified as safe");
-    return userPrompt;
-  } catch (error40) {
-    logger12.error("[llm-generating] Safety classification failed", getErrorMeta(error40));
-    return userPrompt;
-  }
-}
 var doLLMGenerating = (clark2, services) => {
   const transitionTo = transitionFrom(clark2);
   return async ({ event }) => {
     switch (event.type) {
       case AGENT_PLANNED: {
-        const { userPrompt, promptContext } = event;
+        const { userPrompt, promptContext, isUserPrompt = true } = event;
         const provider = services.llmProvider.name;
         const mode = clark2.context.currentMode;
         const planContext = clark2.context.planContext;
         const planApproved = planContext?.approved;
         const system = buildBaseSystemPrompt(services, mode);
-        const safeUserPrompt = await classifyUserPrompt(userPrompt, services);
-        const user = buildUserMessage(safeUserPrompt, promptContext, planContext, mode, services, clark2.context.userChanges);
+        const user = buildUserMessage(userPrompt, promptContext, planContext, mode, services, clark2.context.userChanges);
         const tools = await buildTools(clark2, services);
         const result = await clark2.streamText(services, {
           user,
@@ -710201,6 +710369,31 @@ var doLLMGenerating = (clark2, services) => {
           ],
           onError: (error40) => {
             clark2.logger.error("LLM stream processing failed", getErrorMeta(error40));
+          },
+          // Only apply safety features for original user prompts, not responses to interactive messages
+          safety: isUserPrompt ? {
+            scope: "last",
+            // Unified scope: only scan user prompt, not context parts
+            classification: {
+              enabled: services.features.safetyClassificationEnabled ?? false,
+              // Only resolve model if classification is enabled to avoid unnecessary work
+              model: services.features.safetyClassificationEnabled ? services.llmProvider.modelForTask("fast") : void 0,
+              failOpen: true
+            },
+            secretRedaction: {
+              enabled: services.features.secretRedactionEnabled ?? false
+            }
+          } : {
+            // Explicitly disable all safety features for non-user prompts
+            // to prevent fallback default behavior in Clark.streamText
+            scope: "last",
+            classification: {
+              enabled: false,
+              failOpen: true
+            },
+            secretRedaction: {
+              enabled: false
+            }
           }
         });
         let shouldTransitionToAwaitingUser;
@@ -744112,7 +744305,7 @@ var parseYaml;
 async function loadYaml(file2) {
   const content2 = await read_file_default(file2);
   if (!parseYaml) {
-    ({ __parsePrettierYamlConfig: parseYaml } = await import("./yaml-RP6JYFAX.js"));
+    ({ __parsePrettierYamlConfig: parseYaml } = await import("./yaml-JWJN3TFP.js"));
   }
   try {
     return parseYaml(content2);
@@ -749506,7 +749699,7 @@ function createParsersAndPrinters(modules) {
 }
 var estreePlugin = createParsersAndPrinters([
   {
-    importPlugin: () => import("./estree-YBSNREFN.js"),
+    importPlugin: () => import("./estree-653E3JDU.js"),
     printers: ["estree", "estree-json"]
   }
 ]);
@@ -749530,11 +749723,11 @@ var languages = [
 ];
 var { parsers, printers } = createParsersAndPrinters([
   {
-    importPlugin: () => import("./acorn-5BVD2MBI.js"),
+    importPlugin: () => import("./acorn-5YKSPFSL.js"),
     parsers: ["acorn", "espree"]
   },
   {
-    importPlugin: () => import("./angular-AKTXRTYL.js"),
+    importPlugin: () => import("./angular-N3PTHHOT.js"),
     parsers: [
       "__ng_action",
       "__ng_binding",
@@ -749543,7 +749736,7 @@ var { parsers, printers } = createParsersAndPrinters([
     ]
   },
   {
-    importPlugin: () => import("./babel-7EIP2RM3.js"),
+    importPlugin: () => import("./babel-LUSBYK6Y.js"),
     parsers: [
       "babel",
       "babel-flow",
@@ -749562,44 +749755,44 @@ var { parsers, printers } = createParsersAndPrinters([
     ]
   },
   {
-    importPlugin: () => import("./flow-65D2PXWQ.js"),
+    importPlugin: () => import("./flow-5CTHDHJA.js"),
     parsers: ["flow"]
   },
   {
-    importPlugin: () => import("./glimmer-WF4OLSFG.js"),
+    importPlugin: () => import("./glimmer-PSBEO7DF.js"),
     parsers: ["glimmer"],
     printers: ["glimmer"]
   },
   {
-    importPlugin: () => import("./graphql-4UBRRHHW.js"),
+    importPlugin: () => import("./graphql-GLT6YKMV.js"),
     parsers: ["graphql"],
     printers: ["graphql"]
   },
   {
-    importPlugin: () => import("./html-F3SBPR2W.js"),
+    importPlugin: () => import("./html-BRLFARU7.js"),
     parsers: ["html", "angular", "vue", "lwc", "mjml"],
     printers: ["html"]
   },
   {
-    importPlugin: () => import("./markdown-MHZ742S4.js"),
+    importPlugin: () => import("./markdown-PLC7Y56M.js"),
     parsers: ["markdown", "mdx", "remark"],
     printers: ["mdast"]
   },
   {
-    importPlugin: () => import("./meriyah-BECPVJIU.js"),
+    importPlugin: () => import("./meriyah-VT7Q7N3K.js"),
     parsers: ["meriyah"]
   },
   {
-    importPlugin: () => import("./postcss-6Y76CR33.js"),
+    importPlugin: () => import("./postcss-EXOI3LER.js"),
     parsers: ["css", "less", "scss"],
     printers: ["postcss"]
   },
   {
-    importPlugin: () => import("./typescript-QAZVMTAG.js"),
+    importPlugin: () => import("./typescript-XI67VOZZ.js"),
     parsers: ["typescript"]
   },
   {
-    importPlugin: () => import("./yaml-RP6JYFAX.js"),
+    importPlugin: () => import("./yaml-JWJN3TFP.js"),
     parsers: ["yaml"],
     printers: ["yaml"]
   }
@@ -765228,7 +765421,7 @@ async function handleLockConflict(error40, lockSvc, span, logger12) {
 }
 async function readPkgJson(cwd) {
   try {
-    const { readPackage } = await import("./read-pkg-EXO5TTY4.js");
+    const { readPackage } = await import("./read-pkg-2F34HOUF.js");
     return await readPackage({ cwd });
   } catch {
     return null;
@@ -766365,7 +766558,7 @@ async function createPrompt(options8, settings) {
     enquirer3 = settings.enquirer;
   } else {
     try {
-      enquirer3 = await import("./enquirer-BYFQ4ICA.js").then((imported) => imported.default ? new imported.default() : new imported());
+      enquirer3 = await import("./enquirer-5N3HDXXX.js").then((imported) => imported.default ? new imported.default() : new imported());
     } catch (e) {
       if (this instanceof TaskWrapper) {
         this.task.prompt = new PromptError("Enquirer is a peer dependency that must be installed separately.");
@@ -766573,9 +766766,9 @@ var _DefaultRenderer = class {
     return typeof bottomBar === "number" && bottomBar !== 0 || typeof bottomBar === "boolean" && bottomBar !== false || !task.hasTitle();
   }
   async render() {
-    const { createLogUpdate } = await import("./log-update-E5XLCIWL.js");
-    const { default: truncate } = await import("./cli-truncate-DCIVPUGV.js");
-    const { default: wrap2 } = await import("./wrap-ansi-COGQIJ3E.js");
+    const { createLogUpdate } = await import("./log-update-D33FLZ5L.js");
+    const { default: truncate } = await import("./cli-truncate-36YCOWW2.js");
+    const { default: wrap2 } = await import("./wrap-ansi-DZY23R2I.js");
     this.updater = createLogUpdate(this.logger.process.stdout);
     this.truncate = truncate;
     this.wrap = wrap2;