@vibeframe/cli 0.84.0 → 0.86.0

package/dist/index.js

@@ -51503,22 +51503,30 @@ var init_key_live_test = __esm({
           signal
         )
       },
-      // The three below still have no cheap authenticated GET as of v0.83:
-      // fal lacks a documented validation endpoint, Kling auth is per-
-      // request HMAC-signed, ImgBB's only authenticated route is image
-      // upload. Surface them as `skipped` so the user knows we didn't
-      // blank-check.
+      // The three below still have no cheap authenticated GET as of
+      // 2026-04-30 (re-checked while shipping v0.85). Surface them as
+      // `skipped` so the user knows we didn't blank-check; revisit when a
+      // provider publishes an account/me endpoint.
       fal: {
+        // Probed: /api/account, /v1/account, /v1/me, /queue/health, /v1/users/me,
+        // /api/users/me, /v1/billing — all 404 with the standard `Authorization:
+        // Key <key>` header. The platform docs reference an "Accounts API" but
+        // its endpoint paths are unpublished as of this check.
         name: "fal.ai",
-        test: async () => ({ ok: false, skipped: true, message: "no auth-only endpoint published" })
+        test: async () => ({ ok: false, skipped: true, message: "no auth-only endpoint (checked 2026-04-30)" })
       },
       kling: {
+        // Per-request HMAC signing means we'd need to sign every probe with the
+        // key's secret half plus a timestamp — possible, but the cheapest
+        // signed endpoint is also a generation request. Not worth the code.
         name: "Kling",
-        test: async () => ({ ok: false, skipped: true, message: "per-request HMAC; can't test cheaply" })
+        test: async () => ({ ok: false, skipped: true, message: "HMAC-signed per request (checked 2026-04-30)" })
       },
       imgbb: {
+        // Only documented route is POST /1/upload. Probing it would consume an
+        // upload quota even if we send a 1×1 PNG, so SKIP is the right call.
         name: "ImgBB",
-        test: async () => ({ ok: false, skipped: true, message: "only auth route is image upload" })
+        test: async () => ({ ok: false, skipped: true, message: "only route is upload (checked 2026-04-30)" })
       }
     };
   }
@@ -52669,14 +52677,14 @@ __export(ai_audio_exports, {
 });
 import { resolve as resolve54, dirname as dirname19, basename as basename18, extname as extname12 } from "node:path";
 import { readFile as readFile36, writeFile as writeFile40 } from "node:fs/promises";
-import { existsSync as existsSync37 } from "node:fs";
+import { existsSync as existsSync38 } from "node:fs";
 async function executeTranscribe(options) {
   const { audioPath, language, output, format, apiKey } = options;
   try {
     const key = apiKey || process.env.OPENAI_API_KEY;
     if (!key) return { success: false, error: "OPENAI_API_KEY required" };
     const absPath = resolve54(process.cwd(), audioPath);
-    if (!existsSync37(absPath)) return { success: false, error: `File not found: ${absPath}` };
+    if (!existsSync38(absPath)) return { success: false, error: `File not found: ${absPath}` };
     const whisper = new WhisperProvider();
     await whisper.initialize({ apiKey: key });
     const audioBuffer = await readFile36(absPath);
@@ -52709,7 +52717,7 @@ async function executeIsolate(options) {
     const key = apiKey || process.env.ELEVENLABS_API_KEY;
     if (!key) return { success: false, error: "ELEVENLABS_API_KEY required" };
     const absPath = resolve54(process.cwd(), audioPath);
-    if (!existsSync37(absPath)) return { success: false, error: `File not found: ${absPath}` };
+    if (!existsSync38(absPath)) return { success: false, error: `File not found: ${absPath}` };
     const audioBuffer = await readFile36(absPath);
     const elevenlabs = new ElevenLabsProvider();
     await elevenlabs.initialize({ apiKey: key });
@@ -52735,7 +52743,7 @@ async function executeVoiceClone(options) {
     const audioBuffers = [];
     for (const samplePath of samplePaths) {
       const absPath = resolve54(process.cwd(), samplePath);
-      if (!existsSync37(absPath)) return { success: false, error: `File not found: ${samplePath}` };
+      if (!existsSync38(absPath)) return { success: false, error: `File not found: ${samplePath}` };
       const buffer = await readFile36(absPath);
       audioBuffers.push(buffer);
     }
@@ -52757,7 +52765,7 @@ async function executeDub(options) {
   const { mediaPath, language, source, voice, analyzeOnly, output } = options;
   try {
     const absPath = resolve54(process.cwd(), mediaPath);
-    if (!existsSync37(absPath)) return { success: false, error: `File not found: ${absPath}` };
+    if (!existsSync38(absPath)) return { success: false, error: `File not found: ${absPath}` };
     const openaiKey = process.env.OPENAI_API_KEY;
     const anthropicKey = process.env.ANTHROPIC_API_KEY;
     const elevenlabsKey = process.env.ELEVENLABS_API_KEY;
@@ -52885,8 +52893,8 @@ async function executeDuck(options) {
     if (!commandExists("ffmpeg")) return { success: false, error: "FFmpeg not found" };
     const absMusicPath = resolve54(process.cwd(), musicPath);
     const absVoicePath = resolve54(process.cwd(), voicePath);
-    if (!existsSync37(absMusicPath)) return { success: false, error: `Music file not found: ${absMusicPath}` };
-    if (!existsSync37(absVoicePath)) return { success: false, error: `Voice file not found: ${absVoicePath}` };
+    if (!existsSync38(absMusicPath)) return { success: false, error: `Music file not found: ${absMusicPath}` };
+    if (!existsSync38(absVoicePath)) return { success: false, error: `Voice file not found: ${absVoicePath}` };
     const defaultOutput = resolve54(dirname19(absMusicPath), `${basename18(absMusicPath, extname12(absMusicPath))}-ducked${extname12(absMusicPath)}`);
     const outputPath = resolve54(process.cwd(), output || defaultOutput);
     const filter = `[1:a]asplit=2[sc][mix];[0:a][sc]sidechaincompress=threshold=${threshold}dB:ratio=${ratio}:attack=${attack}:release=${release}[ducked];[ducked][mix]amix=inputs=2:duration=longest`;
@@ -52900,7 +52908,7 @@ async function executeDuck(options) {
       "-y",
       outputPath
     ], { timeout: 12e4, maxBuffer: 50 * 1024 * 1024 });
-    if (!existsSync37(outputPath)) return { success: false, error: "FFmpeg failed to create output" };
+    if (!existsSync38(outputPath)) return { success: false, error: "FFmpeg failed to create output" };
     return { success: true, outputPath };
   } catch (error) {
     return { success: false, error: `Audio ducking failed: ${error instanceof Error ? error.message : String(error)}` };
@@ -52918,7 +52926,7 @@ var init_ai_audio = __esm({
 // src/pipeline/executor.ts
 import { resolve as resolve55 } from "node:path";
 import { readFile as readFile37, writeFile as writeFile41, mkdir as mkdir22 } from "node:fs/promises";
-import { existsSync as existsSync38 } from "node:fs";
+import { existsSync as existsSync39 } from "node:fs";
 function maxCostFor(action) {
   const cmd = ACTION_METADATA[action]?.command;
   if (!cmd) return 0;
@@ -53135,7 +53143,7 @@ async function ensureActionsRegistered() {
 }
 async function loadPipeline(filePath) {
   const absPath = resolve55(process.cwd(), filePath);
-  if (!existsSync38(absPath)) {
+  if (!existsSync39(absPath)) {
     throw new Error(`Pipeline file not found: ${absPath}`);
   }
   const content = await readFile37(absPath, "utf-8");
@@ -53160,7 +53168,7 @@ async function executePipeline(manifest2, options = {}) {
   const startTime = Date.now();
   if (options.resume) {
     const checkpointPath = resolve55(outputDir, CHECKPOINT_FILE);
-    if (existsSync38(checkpointPath)) {
+    if (existsSync39(checkpointPath)) {
       const checkpointContent = await readFile37(checkpointPath, "utf-8");
       const checkpoint = (0, import_yaml8.parse)(checkpointContent);
       for (const cs of checkpoint.completedSteps) {
@@ -59763,7 +59771,7 @@ var init_generate2 = __esm({
 // src/tools/manifest/remix.ts
 import { writeFile as writeFile43 } from "node:fs/promises";
 import { tmpdir as tmpdir3 } from "node:os";
-import { join as join13 } from "node:path";
+import { join as join14 } from "node:path";
 var pipelineHighlightsTool, pipelineAutoShortsTool, pipelineRunTool, pipelineRegenerateSceneTool, remixTools;
 var init_remix = __esm({
   "src/tools/manifest/remix.ts"() {
@@ -59871,7 +59879,7 @@ var init_remix = __esm({
         let resolvedPath = args.pipelinePath;
         let tempPath;
         if (args.pipelineYaml) {
-          tempPath = join13(tmpdir3(), `vibe-mcp-pipeline-${Date.now()}.yaml`);
+          tempPath = join14(tmpdir3(), `vibe-mcp-pipeline-${Date.now()}.yaml`);
           await writeFile43(tempPath, args.pipelineYaml, "utf-8");
           resolvedPath = tempPath;
         }
@@ -60628,7 +60636,7 @@ __export(project_builder_exports, {
   resolveSourceUrl: () => resolveSourceUrl
 });
 import { mkdtemp, mkdir as mkdir24, copyFile as copyFile3, writeFile as writeFile47, rm as rm4, readdir as readdir3 } from "node:fs/promises";
-import { existsSync as existsSync39 } from "node:fs";
+import { existsSync as existsSync40 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
 import { createRequire } from "node:module";
 import * as path from "node:path";
@@ -60640,7 +60648,7 @@ async function buildTempProject(state, projectFileDir) {
   for (const source of state.sources) {
     if (copied.has(source.id)) continue;
     const resolved = resolveSourceUrl(source.url, projectFileDir);
-    if (!existsSync39(resolved)) {
+    if (!existsSync40(resolved)) {
       throw new Error(`Source file not found: ${resolved} (from source id=${source.id})`);
     }
     const dest = path.join(assetsDir, path.basename(resolved));
@@ -61669,7 +61677,7 @@ var init_export2 = __esm({
 
 // src/tools/manifest/agent-only.ts
 import { readFile as readFile41, writeFile as writeFile48, readdir as readdir4, stat as stat6, access as access9, unlink as unlink4 } from "node:fs/promises";
-import { resolve as resolve63, join as join15, basename as basename22, extname as extname13 } from "node:path";
+import { resolve as resolve63, join as join16, basename as basename22, extname as extname13 } from "node:path";
 function matchPattern(filename, pattern) {
   const regex2 = new RegExp(
     "^" + pattern.replace(/\./g, "\\.").replace(/\*/g, ".*").replace(/\?/g, ".") + "$",
@@ -61752,7 +61760,7 @@ var init_agent_only = __esm({
           const results = [];
           for (const entry of entries) {
             if (args.pattern && !matchPattern(entry.name, args.pattern)) continue;
-            const fullPath = join15(absPath, entry.name);
+            const fullPath = join16(absPath, entry.name);
             const stats = await stat6(fullPath);
             if (entry.isDirectory()) {
               results.push(`[DIR]  ${entry.name}/`);
@@ -61857,7 +61865,7 @@ var init_agent_only = __esm({
           const scanDir = async (dir) => {
             const entries = await readdir4(dir, { withFileTypes: true });
             for (const entry of entries) {
-              const entryPath = join15(dir, entry.name);
+              const entryPath = join16(dir, entry.name);
               if (entry.isDirectory() && recursive) {
                 await scanDir(entryPath);
               } else if (entry.isFile()) {
@@ -62757,6 +62765,10 @@ function toAgentDefinition(t) {
   return {
     name: t.name,
     description: t.description,
+    // Propagate the manifest's cost tier so the agent's executor can
+    // mandate a confirm prompt for high-spend tools without needing a
+    // parallel SSOT.
+    cost: t.cost,
     parameters: {
       type: "object",
       properties,
@@ -62825,7 +62837,7 @@ init_source();
 // package.json
 var package_default = {
   name: "@vibeframe/cli",
-  version: "0.84.0",
+  version: "0.86.0",
   description: "VibeFrame CLI - natural language video editing from the terminal",
   private: false,
   license: "MIT",
@@ -70948,8 +70960,10 @@ init_esm();
 init_source();
 init_ora();
 init_scene_build();
+init_storyboard_parse();
 init_output();
-import { resolve as resolve48 } from "node:path";
+import { resolve as resolve48, join as join13 } from "node:path";
+import { readFileSync as readFileSync2, existsSync as existsSync35 } from "node:fs";
 var VALID_MODES = ["agent", "batch", "auto"];
 var buildCommand = new Command("build").description("Build a VibeFrame video project from STORYBOARD.md").argument("[project-dir]", "Video project directory", ".").option("--mode <mode>", "Build mode: agent|batch|auto", "auto").option("--effort <level>", "Compose effort tier (batch mode only): low|medium|high", "medium").option("--composer <provider>", "Batch composer: claude|openai|gemini").option("--skip-narration", "Don't dispatch TTS even when beats declare narration cues").option("--skip-backdrop", "Don't dispatch image-gen even when beats declare backdrop cues").option("--skip-render", "Compose only \u2014 don't render to MP4").option("--tts <provider>", "TTS provider: auto|elevenlabs|kokoro").option("--voice <id>", "Voice id").option("--image-provider <name>", "Image provider: openai").option("--quality <q>", "Image quality: standard|hd", "hd").option("--image-size <s>", "Image size: 1024x1024|1536x1024|1024x1536", "1536x1024").option("--force", "Re-dispatch primitives even when assets already exist").option("--dry-run", "Preview parameters without dispatching").addHelpText("after", `
 Examples:
@@ -71043,9 +71057,53 @@ function printBuildDryRun(projectDirArg, params) {
   console.log(`  Image:         ${source_default.bold(String(params.imageProvider ?? "openai"))} ${source_default.dim(`${params.imageQuality} ${params.imageSize}`)}${params.skipBackdrop ? source_default.dim(" (skipped)") : ""}`);
   console.log(`  Render:        ${source_default.bold(params.skipRender ? "skip" : "yes")}`);
   console.log(`  Regenerate:    ${source_default.bold(params.force ? "yes" : "cache when possible")}`);
+  const estimate = estimateBuildCost(params);
+  if (estimate) {
+    console.log();
+    console.log(source_default.bold.cyan("Estimated cost (tier-derived, conservative)"));
+    console.log(source_default.dim("-".repeat(60)));
+    console.log(`  Beats:         ${source_default.bold(estimate.beats)}`);
+    if (!params.skipNarration) {
+      console.log(`  Narration:     ${source_default.cyan(`$${estimate.narrationUsd.toFixed(2)}`)} ${source_default.dim(`(${estimate.beats} \xD7 low)`)}`);
+    }
+    if (!params.skipBackdrop) {
+      console.log(`  Backdrops:     ${source_default.yellow(`$${estimate.backdropUsd.toFixed(2)}`)} ${source_default.dim(`(${estimate.beats} \xD7 high)`)}`);
+    }
+    if (params.mode !== "agent") {
+      console.log(`  Compose (LLM): ${source_default.cyan(`$${estimate.composeUsd.toFixed(2)}`)} ${source_default.dim(`(${estimate.beats} \xD7 ~$0.06 batch mode)`)}`);
+    } else {
+      console.log(`  Compose:       ${source_default.dim(`$0.00 (agent mode \u2014 host LLM does composition)`)}`);
+    }
+    console.log(`  ${source_default.bold("Total:")}         ${source_default.bold(`$${estimate.totalUsd.toFixed(2)}`)}`);
+  }
   console.log();
   console.log(source_default.dim("No assets, provider calls, or video files were created."));
 }
+function estimateBuildCost(params) {
+  const storyboardPath = join13(params.projectDir, "STORYBOARD.md");
+  if (!existsSync35(storyboardPath)) return null;
+  let beats = 0;
+  try {
+    const md = readFileSync2(storyboardPath, "utf-8");
+    beats = parseStoryboard(md).beats.length;
+  } catch {
+    return null;
+  }
+  if (beats === 0) return null;
+  const TTS_PER_BEAT = 0.05;
+  const IMAGE_PER_BEAT = 3;
+  const COMPOSE_PER_BEAT_BATCH = 0.06;
+  const narrationUsd = params.skipNarration ? 0 : beats * TTS_PER_BEAT;
+  const backdropUsd = params.skipBackdrop ? 0 : beats * IMAGE_PER_BEAT;
+  const composeUsd = params.mode === "agent" ? 0 : beats * COMPOSE_PER_BEAT_BATCH;
+  return {
+    beats,
+    narrationUsd,
+    backdropUsd,
+    composeUsd,
+    totalUsd: narrationUsd + backdropUsd + composeUsd
+  };
+}
 function printNeedsAuthor(result) {
   console.log(source_default.cyan("Agent authoring required"));
   console.log();
@@ -71254,10 +71312,11 @@ init_exec_safe();
 init_api_key();
 init_agent_host_detect();
 init_composer_resolve();
+init_cost_tier();
 init_scene_build();
 init_output();
 import { access as access7 } from "node:fs/promises";
-import { existsSync as existsSync35 } from "node:fs";
+import { existsSync as existsSync36 } from "node:fs";
 import { resolve as resolve50 } from "node:path";
 var COMMAND_KEY_MAP = getCommandKeyMap();
 var FREE_COMMANDS = [
@@ -71295,7 +71354,10 @@ Examples:
     });
     return;
   }
-  printReport(results, { verbose: Boolean(options.verbose) });
+  printReport(results, {
+    verbose: Boolean(options.verbose),
+    program: doctorCommand.parent
+  });
   if (options.testKeys) {
     await runLiveKeyTests(results);
   }
@@ -71376,20 +71438,20 @@ async function runDiagnostics() {
         installed = false;
       }
     } else if (toolName === "chrome") {
-      const { existsSync: existsSync40 } = await import("node:fs");
+      const { existsSync: existsSync41 } = await import("node:fs");
       const { homedir: homedir6 } = await import("node:os");
-      const { join: join16 } = await import("node:path");
+      const { join: join17 } = await import("node:path");
       const chromePaths = [
         process.env.HYPERFRAMES_CHROME_PATH,
         process.env.CHROME_PATH,
-        join16(homedir6(), ".cache", "puppeteer", "chrome-headless-shell", "mac_arm-147.0.7727.56", "chrome-headless-shell-mac_arm", "chrome-headless-shell"),
+        join17(homedir6(), ".cache", "puppeteer", "chrome-headless-shell", "mac_arm-147.0.7727.56", "chrome-headless-shell-mac_arm", "chrome-headless-shell"),
         "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
         "/Applications/Chromium.app/Contents/MacOS/Chromium",
         "/usr/bin/google-chrome",
         "/usr/bin/chromium",
         "/usr/bin/chromium-browser"
       ];
-      installed = chromePaths.some((p) => p && existsSync40(p));
+      installed = chromePaths.some((p) => p && existsSync41(p));
     } else {
       installed = commandExists(toolName);
     }
@@ -71420,7 +71482,7 @@ async function runDiagnostics() {
   const cwd = process.cwd();
   const projectFiles = ["AGENTS.md", "CLAUDE.md", "vibe.project.yaml"].map((rel) => ({
     path: rel,
-    exists: existsSync35(resolve50(cwd, rel))
+    exists: existsSync36(resolve50(cwd, rel))
   }));
   const projectInitialized = projectFiles.some((f) => f.exists);
   const hosts = detectAgentHosts();
@@ -71435,8 +71497,8 @@ async function runDiagnostics() {
   } catch (err) {
     if (!(err instanceof ComposerResolveError)) throw err;
   }
-  const sceneProjectInCwd = existsSync35(resolve50(cwd, "STORYBOARD.md"));
-  const skillInstalled = existsSync35(resolve50(cwd, "SKILL.md"));
+  const sceneProjectInCwd = existsSync36(resolve50(cwd, "STORYBOARD.md"));
+  const skillInstalled = existsSync36(resolve50(cwd, "SKILL.md"));
   return {
     system: {
       node: { version: nodeVersion, ok: true },
@@ -71462,7 +71524,7 @@ async function runDiagnostics() {
   };
 }
 function printReport(results, opts = { verbose: false }) {
-  const { verbose } = opts;
+  const { verbose, program: program3 } = opts;
   console.log();
   console.log(source_default.bold("  System"));
   const nodeIcon = results.system.node.ok ? source_default.green("OK") : source_default.red("MISSING");
@@ -71599,12 +71661,40 @@ function printReport(results, opts = { verbose: false }) {
   console.log(
     source_default.dim(`    Full command catalog: vibe schema --list`)
   );
+  if (program3) {
+    const tierCounts = countCostTiers(program3);
+    const total = tierCounts.free + tierCounts.low + tierCounts.high + tierCounts["very-high"];
+    if (total > 0) {
+      const parts = [
+        `${TIER_COLOR.free(`${tierCounts.free} free`)}`,
+        `${TIER_COLOR.low(`${tierCounts.low} low`)}`,
+        `${TIER_COLOR.high(`${tierCounts.high} high`)}`,
+        `${TIER_COLOR["very-high"](`${tierCounts["very-high"]} very-high`)}`
+      ];
+      console.log(source_default.dim(`    Cost mix:`) + ` ${parts.join(source_default.dim(", "))}`);
+    }
+  }
   const nextStep = pickNextStep(results, missing.length > 0);
   if (nextStep) {
     console.log(source_default.dim(`  ${nextStep}`));
   }
   console.log();
 }
+function countCostTiers(program3) {
+  const counts = {
+    "free": 0,
+    "low": 0,
+    "high": 0,
+    "very-high": 0
+  };
+  const walk = (cmd) => {
+    const tier = getCostTier(cmd);
+    if (tier) counts[tier]++;
+    for (const child of cmd.commands) walk(child);
+  };
+  for (const top of program3.commands) walk(top);
+  return counts;
+}
 async function runLiveKeyTests(results) {
   console.log();
   console.log(source_default.bold("  Live key tests"));
@@ -71657,7 +71747,7 @@ init_detect();
 init_ai_edit();
 init_output();
 import { resolve as resolve51 } from "node:path";
-import { existsSync as existsSync36 } from "node:fs";
+import { existsSync as existsSync37 } from "node:fs";
 import { mkdir as mkdir21, rm as rm3 } from "node:fs/promises";
 var DEMO_DIR = resolve51(process.cwd(), ".vibeframe-demo");
 async function generateTestVideo(outputPath) {
@@ -71688,7 +71778,7 @@ async function generateTestVideo(outputPath) {
       "-y",
       outputPath
     ], { timeout: 3e4, maxBuffer: 50 * 1024 * 1024 });
-    return existsSync36(outputPath);
+    return existsSync37(outputPath);
   } catch {
     try {
       await execSafe("ffmpeg", [
@@ -71714,7 +71804,7 @@ async function generateTestVideo(outputPath) {
         "-y",
         outputPath
       ], { timeout: 3e4, maxBuffer: 50 * 1024 * 1024 });
-      return existsSync36(outputPath);
+      return existsSync37(outputPath);
     } catch {
       return false;
     }
@@ -72448,10 +72538,26 @@ function maskSensitiveArgs(args) {
   }
   return masked;
 }
+function estimateToolCost(cost) {
+  if (!cost) return 0;
+  switch (cost) {
+    case "free":
+      return 0;
+    case "low":
+      return 0.05;
+    case "medium":
+      return 0.5;
+    case "high":
+      return 3;
+    case "very-high":
+      return 25;
+  }
+}
 var AgentExecutor = class {
   adapter = null;
   registry;
   memory;
+  cumulativeUsd = 0;
   context;
   config;
   initialized = false;
@@ -72539,12 +72645,39 @@ var AgentExecutor = class {
   }
   /**
    * Execute a single tool
+   *
+   * Confirm-prompt logic:
+   *   - `noConfirm: true`               → never prompt (automation / CI)
+   *   - `confirmAlways: true`           → prompt for every tool call
+   *   - default                         → prompt only when the tool's
+   *                                       cost is high/very-high (the
+   *                                       `costGate`)
+   *
+   * The two non-trivial cases require `confirmCallback` to be set; if
+   * it isn't, no prompt fires and the tool runs.
    */
   async executeTool(toolCall) {
-    if (this.config.confirmCallback) {
+    const def = this.registry.getDefinition(toolCall.name);
+    const cost = def?.cost;
+    const isExpensive = cost === "high" || cost === "very-high";
+    if (this.config.budgetUsd !== void 0) {
+      const estimate = estimateToolCost(cost);
+      if (this.cumulativeUsd + estimate > this.config.budgetUsd) {
+        const remaining = (this.config.budgetUsd - this.cumulativeUsd).toFixed(2);
+        return {
+          toolCallId: toolCall.id,
+          success: false,
+          output: "",
+          error: `Budget exceeded: ${toolCall.name} estimated at $${estimate.toFixed(2)} but only $${remaining} remains of $${this.config.budgetUsd.toFixed(2)} cap.`
+        };
+      }
+    }
+    const shouldConfirm = !this.config.noConfirm && this.config.confirmCallback && (this.config.confirmAlways || isExpensive);
+    if (shouldConfirm && this.config.confirmCallback) {
       const confirmed = await this.config.confirmCallback(
         toolCall.name,
-        toolCall.arguments
+        toolCall.arguments,
+        cost
       );
       if (!confirmed) {
         return {
@@ -72560,8 +72693,18 @@ var AgentExecutor = class {
       this.context
     );
     result.toolCallId = toolCall.id;
+    if (result.success) {
+      this.cumulativeUsd += estimateToolCost(cost);
+    }
     return result;
   }
+  /**
+   * Cumulative tier-estimated USD spent in this session. Updates after
+   * every successful tool call. Useful for status output / `tools` REPL.
+   */
+  getCumulativeUsd() {
+    return this.cumulativeUsd;
+  }
   /**
    * Update context (e.g., when project changes)
    */
@@ -72601,7 +72744,7 @@ init_config();
 init_tty();
 init_api_key();
 init_output();
-async function promptConfirm2(toolName, args) {
+async function promptConfirm2(toolName, args, cost) {
   const { createInterface: createInterface4 } = await import("node:readline");
   const rl = createInterface4({
     input: process.stdin,
@@ -72611,7 +72754,15 @@ async function promptConfirm2(toolName, args) {
   return new Promise((resolve64) => {
     const argsStr = JSON.stringify(args, null, 2);
     console.log();
-    console.log(source_default.yellow(`Execute ${source_default.bold(toolName)}?`));
+    const tierColor = {
+      "free": source_default.green,
+      "low": source_default.cyan,
+      "medium": source_default.yellow,
+      "high": source_default.yellow,
+      "very-high": source_default.red
+    };
+    const costBadge = cost ? ` ${tierColor[cost](`[${cost.toUpperCase()}]`)}` : "";
+    console.log(source_default.yellow(`Execute ${source_default.bold(toolName)}?${costBadge}`));
     console.log(source_default.dim(argsStr));
     rl.question(source_default.cyan("(y/n): "), (answer) => {
       rl.close();
@@ -72621,7 +72772,12 @@ async function promptConfirm2(toolName, args) {
 }
 async function startAgent(options = {}) {
   const isNonInteractive = !!options.input;
-  const confirmMode = options.confirm || false;
+  const confirmAlways = options.confirm || false;
+  const noConfirm = options.noConfirm || false;
+  const budgetUsd = options.budgetUsd ? parseFloat(options.budgetUsd) : void 0;
+  if (budgetUsd !== void 0 && (Number.isNaN(budgetUsd) || budgetUsd < 0)) {
+    exitWithError(generalError(`Invalid --budget-usd: ${options.budgetUsd}`, "Must be a non-negative number (e.g., --budget-usd 5)"));
+  }
   if (!isNonInteractive && !hasTTY()) {
     exitWithError(generalError("Agent mode requires a terminal.", "Run 'vibe agent' directly from your terminal, or use --input <query> for non-interactive mode."));
   }
@@ -72658,7 +72814,13 @@ async function startAgent(options = {}) {
       maxTurns,
       verbose,
       projectPath: options.project,
-      confirmCallback: confirmMode ? promptConfirm2 : void 0
+      // Always supply the callback so the cost gate (high/very-high
+      // tools) can prompt even without `--confirm`. The executor
+      // decides whether to invoke based on `confirmAlways` / `noConfirm`.
+      confirmCallback: noConfirm ? void 0 : promptConfirm2,
+      confirmAlways,
+      noConfirm,
+      budgetUsd
     });
     await agent.initialize();
     spinner2.succeed(source_default.green("Agent initialized"));
@@ -72695,9 +72857,11 @@ async function startAgent(options = {}) {
   console.log();
   console.log(source_default.dim(`  v${version} \xB7 ${provider}${options.model ? ` \xB7 ${options.model}` : ""} \xB7 ${cwd}`));
   console.log();
+  const confirmStatus = noConfirm ? source_default.dim("no-confirm") : confirmAlways ? source_default.yellow("confirm mode") : source_default.dim("cost gate (high/very-high)");
   const statusParts = [
     source_default.green(`${toolCount} tools`),
-    confirmMode ? source_default.yellow("confirm mode") : null,
+    confirmStatus,
+    budgetUsd !== void 0 ? source_default.magenta(`budget: $${budgetUsd.toFixed(2)}`) : null,
     options.project ? source_default.blue(`project: ${options.project}`) : null
   ].filter(Boolean);
   console.log(source_default.dim("  ") + statusParts.join(source_default.dim(" \xB7 ")));
@@ -72750,6 +72914,11 @@ async function startAgent(options = {}) {
         }
         console.log();
         console.log(source_default.dim(`Total: ${tools.length} tools`));
+        const spent = agent.getCumulativeUsd();
+        if (spent > 0 || budgetUsd !== void 0) {
+          const budgetStr = budgetUsd !== void 0 ? ` / $${budgetUsd.toFixed(2)} cap` : "";
+          console.log(source_default.dim(`Spent (tier-estimated): $${spent.toFixed(2)}${budgetStr}`));
+        }
         console.log();
         rl.prompt();
         return;
@@ -72811,7 +72980,7 @@ async function startAgent(options = {}) {
     rl.prompt();
   });
 }
-var agentCommand = new Command("agent").description("Start the AI agent with natural language interface").option("-p, --provider <provider>", "LLM provider (openai, claude, gemini, ollama, xai, openrouter)", "openai").option("-m, --model <model>", "Model to use (provider-specific)").option("--project <path>", "Timeline file or directory to load").option("-v, --verbose", "Show verbose output including tool calls").option("--max-turns <n>", "Maximum turns per request", "10").option("-i, --input <query>", "Run a single query and exit (non-interactive)").option("-c, --confirm", "Confirm before each tool execution").action(async (options) => {
+var agentCommand = new Command("agent").description("Start the AI agent with natural language interface").option("-p, --provider <provider>", "LLM provider (openai, claude, gemini, ollama, xai, openrouter)", "openai").option("-m, --model <model>", "Model to use (provider-specific)").option("--project <path>", "Timeline file or directory to load").option("-v, --verbose", "Show verbose output including tool calls").option("--max-turns <n>", "Maximum turns per request", "10").option("-i, --input <query>", "Run a single query and exit (non-interactive)").option("-c, --confirm", "Confirm before EVERY tool execution (overrides cost gate)").option("--no-confirm", "Disable all confirm prompts including the high/very-high cost gate (CI / automation)").option("--budget-usd <usd>", "Reject tool calls past this cumulative USD ceiling (tier-estimated, conservative)").action(async (options) => {
   await startAgent(options);
 });
 function getEnvVar(provider) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibeframe/cli",
-  "version": "0.84.0",
+  "version": "0.86.0",
   "description": "VibeFrame CLI - natural language video editing from the terminal",
   "private": false,
   "license": "MIT",
@@ -183,8 +183,8 @@
     "tsx": "^4.21.0",
     "typescript": "^5.3.3",
     "vitest": "^1.2.2",
-    "@vibeframe/ai-providers": "0.84.0",
-    "@vibeframe/core": "0.84.0"
+    "@vibeframe/ai-providers": "0.86.0",
+    "@vibeframe/core": "0.86.0"
   },
   "engines": {
     "node": ">=20"