@vibeframe/cli 0.84.0 → 0.85.0

package/dist/index.js

@@ -51503,22 +51503,30 @@ var init_key_live_test = __esm({
           signal
         )
       },
-      // The three below still have no cheap authenticated GET as of v0.83:
-      // fal lacks a documented validation endpoint, Kling auth is per-
-      // request HMAC-signed, ImgBB's only authenticated route is image
-      // upload. Surface them as `skipped` so the user knows we didn't
-      // blank-check.
+      // The three below still have no cheap authenticated GET as of
+      // 2026-04-30 (re-checked while shipping v0.85). Surface them as
+      // `skipped` so the user knows we didn't blank-check; revisit when a
+      // provider publishes an account/me endpoint.
       fal: {
+        // Probed: /api/account, /v1/account, /v1/me, /queue/health, /v1/users/me,
+        // /api/users/me, /v1/billing — all 404 with the standard `Authorization:
+        // Key <key>` header. The platform docs reference an "Accounts API" but
+        // its endpoint paths are unpublished as of this check.
         name: "fal.ai",
-        test: async () => ({ ok: false, skipped: true, message: "no auth-only endpoint published" })
+        test: async () => ({ ok: false, skipped: true, message: "no auth-only endpoint (checked 2026-04-30)" })
       },
       kling: {
+        // Per-request HMAC signing means we'd need to sign every probe with the
+        // key's secret half plus a timestamp — possible, but the cheapest
+        // signed endpoint is also a generation request. Not worth the code.
         name: "Kling",
-        test: async () => ({ ok: false, skipped: true, message: "per-request HMAC; can't test cheaply" })
+        test: async () => ({ ok: false, skipped: true, message: "HMAC-signed per request (checked 2026-04-30)" })
       },
       imgbb: {
+        // Only documented route is POST /1/upload. Probing it would consume an
+        // upload quota even if we send a 1×1 PNG, so SKIP is the right call.
         name: "ImgBB",
-        test: async () => ({ ok: false, skipped: true, message: "only auth route is image upload" })
+        test: async () => ({ ok: false, skipped: true, message: "only route is upload (checked 2026-04-30)" })
       }
     };
   }
@@ -62757,6 +62765,10 @@ function toAgentDefinition(t) {
   return {
     name: t.name,
     description: t.description,
+    // Propagate the manifest's cost tier so the agent's executor can
+    // mandate a confirm prompt for high-spend tools without needing a
+    // parallel SSOT.
+    cost: t.cost,
     parameters: {
       type: "object",
       properties,
@@ -62825,7 +62837,7 @@ init_source();
 // package.json
 var package_default = {
   name: "@vibeframe/cli",
-  version: "0.84.0",
+  version: "0.85.0",
   description: "VibeFrame CLI - natural language video editing from the terminal",
   private: false,
   license: "MIT",
@@ -72448,10 +72460,26 @@ function maskSensitiveArgs(args) {
   }
   return masked;
 }
+function estimateToolCost(cost) {
+  if (!cost) return 0;
+  switch (cost) {
+    case "free":
+      return 0;
+    case "low":
+      return 0.05;
+    case "medium":
+      return 0.5;
+    case "high":
+      return 3;
+    case "very-high":
+      return 25;
+  }
+}
 var AgentExecutor = class {
   adapter = null;
   registry;
   memory;
+  cumulativeUsd = 0;
   context;
   config;
   initialized = false;
@@ -72539,12 +72567,39 @@ var AgentExecutor = class {
   }
   /**
    * Execute a single tool
+   *
+   * Confirm-prompt logic:
+   *   - `noConfirm: true`               → never prompt (automation / CI)
+   *   - `confirmAlways: true`           → prompt for every tool call
+   *   - default                         → prompt only when the tool's
+   *                                       cost is high/very-high (the
+   *                                       `costGate`)
+   *
+   * The two non-trivial cases require `confirmCallback` to be set; if
+   * it isn't, no prompt fires and the tool runs.
    */
   async executeTool(toolCall) {
-    if (this.config.confirmCallback) {
+    const def = this.registry.getDefinition(toolCall.name);
+    const cost = def?.cost;
+    const isExpensive = cost === "high" || cost === "very-high";
+    if (this.config.budgetUsd !== void 0) {
+      const estimate = estimateToolCost(cost);
+      if (this.cumulativeUsd + estimate > this.config.budgetUsd) {
+        const remaining = (this.config.budgetUsd - this.cumulativeUsd).toFixed(2);
+        return {
+          toolCallId: toolCall.id,
+          success: false,
+          output: "",
+          error: `Budget exceeded: ${toolCall.name} estimated at $${estimate.toFixed(2)} but only $${remaining} remains of $${this.config.budgetUsd.toFixed(2)} cap.`
+        };
+      }
+    }
+    const shouldConfirm = !this.config.noConfirm && this.config.confirmCallback && (this.config.confirmAlways || isExpensive);
+    if (shouldConfirm && this.config.confirmCallback) {
       const confirmed = await this.config.confirmCallback(
         toolCall.name,
-        toolCall.arguments
+        toolCall.arguments,
+        cost
       );
       if (!confirmed) {
         return {
@@ -72560,8 +72615,18 @@ var AgentExecutor = class {
       this.context
     );
     result.toolCallId = toolCall.id;
+    if (result.success) {
+      this.cumulativeUsd += estimateToolCost(cost);
+    }
     return result;
   }
+  /**
+   * Cumulative tier-estimated USD spent in this session. Updates after
+   * every successful tool call. Useful for status output / `tools` REPL.
+   */
+  getCumulativeUsd() {
+    return this.cumulativeUsd;
+  }
   /**
    * Update context (e.g., when project changes)
    */
@@ -72601,7 +72666,7 @@ init_config();
 init_tty();
 init_api_key();
 init_output();
-async function promptConfirm2(toolName, args) {
+async function promptConfirm2(toolName, args, cost) {
   const { createInterface: createInterface4 } = await import("node:readline");
   const rl = createInterface4({
     input: process.stdin,
@@ -72611,7 +72676,15 @@ async function promptConfirm2(toolName, args) {
   return new Promise((resolve64) => {
     const argsStr = JSON.stringify(args, null, 2);
     console.log();
-    console.log(source_default.yellow(`Execute ${source_default.bold(toolName)}?`));
+    const tierColor = {
+      "free": source_default.green,
+      "low": source_default.cyan,
+      "medium": source_default.yellow,
+      "high": source_default.yellow,
+      "very-high": source_default.red
+    };
+    const costBadge = cost ? ` ${tierColor[cost](`[${cost.toUpperCase()}]`)}` : "";
+    console.log(source_default.yellow(`Execute ${source_default.bold(toolName)}?${costBadge}`));
     console.log(source_default.dim(argsStr));
     rl.question(source_default.cyan("(y/n): "), (answer) => {
       rl.close();
@@ -72621,7 +72694,12 @@ async function promptConfirm2(toolName, args) {
 }
 async function startAgent(options = {}) {
   const isNonInteractive = !!options.input;
-  const confirmMode = options.confirm || false;
+  const confirmAlways = options.confirm || false;
+  const noConfirm = options.noConfirm || false;
+  const budgetUsd = options.budgetUsd ? parseFloat(options.budgetUsd) : void 0;
+  if (budgetUsd !== void 0 && (Number.isNaN(budgetUsd) || budgetUsd < 0)) {
+    exitWithError(generalError(`Invalid --budget-usd: ${options.budgetUsd}`, "Must be a non-negative number (e.g., --budget-usd 5)"));
+  }
   if (!isNonInteractive && !hasTTY()) {
     exitWithError(generalError("Agent mode requires a terminal.", "Run 'vibe agent' directly from your terminal, or use --input <query> for non-interactive mode."));
   }
@@ -72658,7 +72736,13 @@ async function startAgent(options = {}) {
       maxTurns,
       verbose,
       projectPath: options.project,
-      confirmCallback: confirmMode ? promptConfirm2 : void 0
+      // Always supply the callback so the cost gate (high/very-high
+      // tools) can prompt even without `--confirm`. The executor
+      // decides whether to invoke based on `confirmAlways` / `noConfirm`.
+      confirmCallback: noConfirm ? void 0 : promptConfirm2,
+      confirmAlways,
+      noConfirm,
+      budgetUsd
     });
     await agent.initialize();
     spinner2.succeed(source_default.green("Agent initialized"));
@@ -72695,9 +72779,11 @@ async function startAgent(options = {}) {
   console.log();
   console.log(source_default.dim(`  v${version} \xB7 ${provider}${options.model ? ` \xB7 ${options.model}` : ""} \xB7 ${cwd}`));
   console.log();
+  const confirmStatus = noConfirm ? source_default.dim("no-confirm") : confirmAlways ? source_default.yellow("confirm mode") : source_default.dim("cost gate (high/very-high)");
   const statusParts = [
     source_default.green(`${toolCount} tools`),
-    confirmMode ? source_default.yellow("confirm mode") : null,
+    confirmStatus,
+    budgetUsd !== void 0 ? source_default.magenta(`budget: $${budgetUsd.toFixed(2)}`) : null,
     options.project ? source_default.blue(`project: ${options.project}`) : null
   ].filter(Boolean);
   console.log(source_default.dim("  ") + statusParts.join(source_default.dim(" \xB7 ")));
@@ -72811,7 +72897,7 @@ async function startAgent(options = {}) {
     rl.prompt();
   });
 }
-var agentCommand = new Command("agent").description("Start the AI agent with natural language interface").option("-p, --provider <provider>", "LLM provider (openai, claude, gemini, ollama, xai, openrouter)", "openai").option("-m, --model <model>", "Model to use (provider-specific)").option("--project <path>", "Timeline file or directory to load").option("-v, --verbose", "Show verbose output including tool calls").option("--max-turns <n>", "Maximum turns per request", "10").option("-i, --input <query>", "Run a single query and exit (non-interactive)").option("-c, --confirm", "Confirm before each tool execution").action(async (options) => {
+var agentCommand = new Command("agent").description("Start the AI agent with natural language interface").option("-p, --provider <provider>", "LLM provider (openai, claude, gemini, ollama, xai, openrouter)", "openai").option("-m, --model <model>", "Model to use (provider-specific)").option("--project <path>", "Timeline file or directory to load").option("-v, --verbose", "Show verbose output including tool calls").option("--max-turns <n>", "Maximum turns per request", "10").option("-i, --input <query>", "Run a single query and exit (non-interactive)").option("-c, --confirm", "Confirm before EVERY tool execution (overrides cost gate)").option("--no-confirm", "Disable all confirm prompts including the high/very-high cost gate (CI / automation)").option("--budget-usd <usd>", "Reject tool calls past this cumulative USD ceiling (tier-estimated, conservative)").action(async (options) => {
   await startAgent(options);
 });
 function getEnvVar(provider) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibeframe/cli",
-  "version": "0.84.0",
+  "version": "0.85.0",
   "description": "VibeFrame CLI - natural language video editing from the terminal",
   "private": false,
   "license": "MIT",
@@ -183,8 +183,8 @@
     "tsx": "^4.21.0",
     "typescript": "^5.3.3",
     "vitest": "^1.2.2",
-    "@vibeframe/ai-providers": "0.84.0",
-    "@vibeframe/core": "0.84.0"
+    "@vibeframe/ai-providers": "0.85.0",
+    "@vibeframe/core": "0.85.0"
   },
   "engines": {
     "node": ">=20"