@nexrall/code-core 1.2.0 → 1.3.1

package/dist/agent/loop.d.ts

@@ -1,3 +1,18 @@
 import type { Message, AgentLoopOptions } from '../types';
+export declare function resolveMaxIterations(optionValue: number | undefined, settingsRaw: Record<string, unknown>): number;
+/**
+ * Find the latest index ≤ maxIdx where history can be cut safely.
+ *
+ * A safe cut point is a **turn boundary**: an assistant message (which always
+ * begins a fresh turn after a user message). Cutting there guarantees that
+ * `messages[cut..]` starts with an assistant whose `tool_use` blocks are all
+ * answered by `tool_result`s that remain in the kept slice — so we never orphan
+ * a tool_result (which the API rejects). We deliberately allow cutting across
+ * tool_result-bearing user messages: the OLD implementation only cut at a
+ * *non*-tool_result user message, which never exists inside a single long
+ * agentic run (every user turn is a tool_result), so compaction was a no-op
+ * exactly when a long task needs it most.
+ */
+export declare function findSafeCutIndex(messages: Message[], maxIdx: number): number;
 export declare function runAgentLoop(initialMessages: Message[], options: AgentLoopOptions): Promise<Message[]>;
 //# sourceMappingURL=loop.d.ts.map

package/dist/agent/loop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loop.d.ts","sourceRoot":"","sources":["../../src/agent/loop.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,OAAO,EAMP,gBAAgB,EACjB,MAAM,UAAU,CAAC;AAuflB,wBAAsB,YAAY,CAChC,eAAe,EAAE,OAAO,EAAE,EAC1B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,OAAO,EAAE,CAAC,CAuWpB"}
+{"version":3,"file":"loop.d.ts","sourceRoot":"","sources":["../../src/agent/loop.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,OAAO,EAMP,gBAAgB,EACjB,MAAM,UAAU,CAAC;AAmKlB,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,MAAM,CAWR;AAgRD;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAK5E;AA6ED,wBAAsB,YAAY,CAChC,eAAe,EAAE,OAAO,EAAE,EAC1B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,OAAO,EAAE,CAAC,CA+WpB"}

package/dist/agent/loop.js

@@ -33,6 +33,8 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveMaxIterations = resolveMaxIterations;
+exports.findSafeCutIndex = findSafeCutIndex;
 exports.runAgentLoop = runAgentLoop;
 const client_1 = require("../api/client");
 const executor_1 = require("../tools/executor");
@@ -89,13 +91,20 @@ function runToolHooks(entries, phase, toolName, input, workDir, result) {
         for (const hook of entry.hooks ?? []) {
             if (hook.type !== 'command' || !hook.command)
                 continue;
+            // Per-hook timeout. Default 60s (was a hard 10s that made the canonical
+            // "auto-run tests on PostToolUse" use-case useless — any real suite is
+            // slower). Configurable via `timeout_ms` on the hook, capped at 10min.
+            const hookTimeout = typeof hook.timeout_ms === 'number' && hook.timeout_ms > 0
+                ? Math.min(hook.timeout_ms, 600000)
+                : 60000;
             let r;
             try {
                 r = (0, child_process_1.spawnSync)(hook.command, {
                     shell: true,
                     cwd: workDir,
-                    timeout: 10000,
+                    timeout: hookTimeout,
                     encoding: 'utf-8',
+                    maxBuffer: 16 * 1024 * 1024,
                     input: payload,
                     env: {
                         ...process.env,
@@ -152,18 +161,29 @@ function runSimpleHooks(defs, workDir) {
 // fix → …). A too-low cap makes the agent appear to "freeze" mid-task. Keep the
 // default high and let projects raise it further via settings / env.
 const DEFAULT_MAX_ITERATIONS = 500;
-const MAX_ITERATIONS_CEILING = 2000; // absolute backstop — auto-continue never goes past this
+const MAX_ITERATIONS_CEILING = 2000; // default auto-continue backstop (no explicit opt-in)
+const HARD_ITERATIONS_CAP = 100000; // absolute safety cap — even explicit opt-in can't exceed this
 const STALL_LIMIT = 8; // consecutive all-failed tool rounds → give up (runaway guard)
 // Resolve the soft iteration budget. Precedence:
 //   options.maxIterations  →  env NEXRALL_MAX_ITERATIONS  →  settings.maxIterations  →  default
+//
+// The DEFAULT (nothing set) is clamped to MAX_ITERATIONS_CEILING so an ordinary
+// run can never spin past 2000 rounds by accident. But an EXPLICIT value from
+// any of the three opt-in channels is honoured up to HARD_ITERATIONS_CAP — this
+// is what lets a genuinely long task (thousands of rounds) run when the user has
+// deliberately asked for it, instead of dying at a hidden 2000 wall while the
+// error message misleadingly tells them to "raise the limit".
 function resolveMaxIterations(optionValue, settingsRaw) {
     const fromEnv = Number(process.env.NEXRALL_MAX_ITERATIONS);
     const fromSettings = Number(settingsRaw.maxIterations);
-    const candidate = (typeof optionValue === 'number' && optionValue > 0) ? optionValue
+    const explicit = (typeof optionValue === 'number' && optionValue > 0) ? optionValue
         : Number.isFinite(fromEnv) && fromEnv > 0 ? fromEnv
             : Number.isFinite(fromSettings) && fromSettings > 0 ? fromSettings
-                : DEFAULT_MAX_ITERATIONS;
-    return Math.min(Math.floor(candidate), MAX_ITERATIONS_CEILING);
+                : undefined;
+    if (explicit === undefined)
+        return DEFAULT_MAX_ITERATIONS;
+    // Explicit opt-in: honour it, only bounded by the absolute safety cap.
+    return Math.min(Math.floor(explicit), HARD_ITERATIONS_CAP);
 }
 // When the soft budget is exhausted with work still pending, keep going instead
 // of stopping. Precedence: options.autoContinue → env NEXRALL_AUTO_CONTINUE →
@@ -342,11 +362,20 @@ async function runSubTask(input, options, agentTypes) {
         });
         // Extract final assistant text as the task output
         const lastAssistant = [...result].reverse().find((m) => m.role === 'assistant');
-        const text = (lastAssistant?.content ?? [])
+        let text = (lastAssistant?.content ?? [])
             .filter((b) => b.type === 'text')
             .map((b) => b.text)
             .join('')
             .trim();
+        // Cap the sub-agent's returned text so a verbose sub-task (e.g. "list every
+        // usage") can't blow up the PARENT's context in a single tool_result. Keep
+        // the head + tail — the conclusion is usually at the end.
+        const SUBTASK_MAX = 48000; // chars (~12k tokens)
+        if (text.length > SUBTASK_MAX) {
+            const head = text.slice(0, Math.floor(SUBTASK_MAX * 0.6));
+            const tail = text.slice(text.length - Math.floor(SUBTASK_MAX * 0.4));
+            text = `${head}\n\n[… sub-task output truncated (${text.length} chars) — kept the beginning and end …]\n\n${tail}`;
+        }
         return { output: text || '(sub-task completed with no text output)' };
     }
     catch (err) {
@@ -382,14 +411,22 @@ function resolveAutoCompact(fromOptions, rawSettings) {
         return s;
     return true;
 }
-/** Find the latest index ≤ maxIdx where history can be cut safely (user msg, no tool_results). */
+/**
+ * Find the latest index ≤ maxIdx where history can be cut safely.
+ *
+ * A safe cut point is a **turn boundary**: an assistant message (which always
+ * begins a fresh turn after a user message). Cutting there guarantees that
+ * `messages[cut..]` starts with an assistant whose `tool_use` blocks are all
+ * answered by `tool_result`s that remain in the kept slice — so we never orphan
+ * a tool_result (which the API rejects). We deliberately allow cutting across
+ * tool_result-bearing user messages: the OLD implementation only cut at a
+ * *non*-tool_result user message, which never exists inside a single long
+ * agentic run (every user turn is a tool_result), so compaction was a no-op
+ * exactly when a long task needs it most.
+ */
 function findSafeCutIndex(messages, maxIdx) {
-    for (let i = Math.min(maxIdx, messages.length - 1); i > 0; i--) {
-        const m = messages[i];
-        if (m.role !== 'user')
-            continue;
-        const hasToolResult = m.content.some((b) => b.type === 'tool_result');
-        if (!hasToolResult)
+    for (let i = Math.min(maxIdx, messages.length - 1); i >= 2; i--) {
+        if (messages[i].role === 'assistant')
             return i;
     }
     return -1;
@@ -445,7 +482,13 @@ async function autoCompactMessages(messages, options) {
     }
     if (!summary)
         return false;
-    messages.splice(0, cut, { role: 'user', content: [{ type: 'text', text: `[Auto-compacted ${toSummarize.length} earlier messages]\n\nSummary of the earlier conversation:\n${summary}` }] }, { role: 'assistant', content: [{ type: 'text', text: 'Understood — I have the summary of our earlier work and will continue from there.' }] });
+    // Replace the summarized head with a single user summary message. The cut is
+    // at a turn boundary (kept[0] is an assistant message — see findSafeCutIndex),
+    // so `user(summary) → assistant(kept[0])` is a valid, well-ordered sequence
+    // and no orphaned tool_result is left behind. We intentionally do NOT insert
+    // an assistant-ack here: that would put two assistant messages back-to-back
+    // (kept[0] is already an assistant), which the API rejects.
+    messages.splice(0, cut, { role: 'user', content: [{ type: 'text', text: `[Auto-compacted ${toSummarize.length} earlier messages]\n\nSummary of the earlier conversation so far:\n${summary}\n\nContinue the work from here.` }] });
     // `kept` follows automatically since splice only replaced the head.
     void kept;
     return true;
@@ -710,8 +753,11 @@ async function runAgentLoop(initialMessages, options) {
             const toolResultBlocks = toolResults.map(({ block, result }) => ({
                 type: 'tool_result',
                 tool_use_id: block.id,
+                // When a tool returns BOTH an error and partial output (e.g. a bash
+                // command that timed out mid-test-run), surface both so the model can
+                // see WHY it hung — the failure detail is usually in the output tail.
                 content: result.error
-                    ? `Error: ${result.error}`
+                    ? (result.output ? `Error: ${result.error}\n\n${result.output}` : `Error: ${result.error}`)
                     : result.output ?? '',
                 is_error: result.error !== undefined,
             }));
@@ -731,6 +777,10 @@ async function runAgentLoop(initialMessages, options) {
                 content: toolResultContent,
             };
             messages.push(toolResultMessage);
+            // Incremental persistence hook: history is valid here (ends on a
+            // tool_result user turn). Let the caller checkpoint progress so a crash
+            // mid-run loses only the in-flight step, not the whole session.
+            options.onProgress?.(messages);
             // Runaway guard: if every tool call in this round failed, count it. Enough
             // consecutive all-failed rounds (e.g. a command that always errors, or the
             // user denying every permission) means we're stuck — stop instead of

package/dist/api/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAA8B,UAAU,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAKrH,eAAO,MAAM,QAAQ,4BAA4B,CAAC;AAiBlD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IACnC,oFAAoF;IACpF,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IACjG,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAWD,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,CAAC,CAAC,EAAE,QAAQ,KAAK,IAAI,GAC7B,OAAO,CAAC,OAAO,CAAC,CAkVlB;AAID,wBAAsB,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,CAalD;AAID,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAgB1E;AAID,wBAAsB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAkBhF"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAA8B,UAAU,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAKrH,eAAO,MAAM,QAAQ,4BAA4B,CAAC;AAiBlD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IACnC,oFAAoF;IACpF,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IACjG,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAWD,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,CAAC,CAAC,EAAE,QAAQ,KAAK,IAAI,GAC7B,OAAO,CAAC,OAAO,CAAC,CA0WlB;AAID,wBAAsB,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,CAalD;AAID,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAgB1E;AAID,wBAAsB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAkBhF"}

package/dist/api/client.js

@@ -316,7 +316,19 @@ async function streamChat(messages, options, onEvent) {
                 }
                 parser.feed(chunk.toString('utf-8'));
             });
-            stream.on('end', () => { clearInterval(heartbeatWatchdog); resolve(); });
+            stream.on('end', () => {
+                clearInterval(heartbeatWatchdog);
+                // A clean 'end' with ZERO model events means the connection was dropped before
+                // the backend produced anything (deploy restart, proxy reset). Without this,
+                // the fallback below returns an EMPTY assistant message and the agent loop
+                // treats it as a silent no-op — the turn just vanishes. Nothing was emitted,
+                // so a retry cannot duplicate output → tag retryable.
+                if (!sawModelEvent && !completedMessage) {
+                    reject(Object.assign(new Error('Connection closed before the model responded. Retrying…'), { retryable: true }));
+                    return;
+                }
+                resolve();
+            });
             // Treat stream destruction from abort as a clean exit, not an error
             stream.on('error', (err) => {
                 clearInterval(heartbeatWatchdog);
@@ -324,6 +336,15 @@ async function streamChat(messages, options, onEvent) {
                     resolve();
                     return;
                 }
+                // Transport-level failures ("Premature close" / ECONNRESET / socket hang up)
+                // happen whenever the backend restarts mid-deploy or a proxy drops the socket.
+                // They are exactly as transient as an overloaded_error — if nothing has been
+                // emitted to the caller yet, retry the attempt transparently instead of
+                // surfacing "Stream failed: Premature close" and killing the whole turn.
+                if (!emittedToCaller) {
+                    reject(Object.assign(err, { retryable: true }));
+                    return;
+                }
                 reject(err);
             });
         });

package/dist/permissions/rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/permissions/rules.ts"],"names":[],"mappings":"AAwBA,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,eAAe,CAAC;IAC7B,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B;AAsBD,oEAAoE;AACpE,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CAoB5D;AAqHD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,EAAE,MAAM,GACd,kBAAkB,GAAG,IAAI,CAK3B"}
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/permissions/rules.ts"],"names":[],"mappings":"AAwBA,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,eAAe,CAAC;IAC7B,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B;AAsBD,oEAAoE;AACpE,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CAoB5D;AAgID;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,EAAE,MAAM,GACd,kBAAkB,GAAG,IAAI,CAK3B"}

package/dist/permissions/rules.js

@@ -118,7 +118,17 @@ function matchPattern(pattern, value) {
     // "name:*" → prefix match (Claude Bash semantics)
     if (pattern.endsWith(':*')) {
         const prefix = pattern.slice(0, -2);
-        return value === prefix || value.startsWith(prefix);
+        if (value === prefix)
+            return true;
+        // Token-boundary prefix: "npm run test:*" must match "npm run test foo"
+        // but NOT "npm run testify-malware". The char right after the prefix has
+        // to be a shell token boundary (whitespace / end), otherwise it's a
+        // different command that merely shares a textual prefix.
+        if (value.startsWith(prefix)) {
+            const next = value.charAt(prefix.length);
+            return next === '' || /\s/.test(next);
+        }
+        return false;
     }
     if (pattern.includes('*') || pattern.includes('?')) {
         try {
@@ -186,15 +196,17 @@ function ruleMatches(rule, tool, input, workDir, opts) {
         (aliases[ruleTool]?.includes(tool) ?? false);
     if (!matchesTool)
         return false;
-    // Multi-line guard for ALLOW rules on bash: a patterned allow rule
-    // (prefix or glob) must never auto-approve a multi-line command — a newline
-    // acts like `;`, so "npm run test\nrm -rf ~" would otherwise ride an
+    // Chaining guard for ALLOW rules on bash: a patterned allow rule (prefix or
+    // glob) must never auto-approve a command that chains a SECOND command onto
+    // the matched one. A newline acts like `;`, and `;`, `&&`, `||`, `|`, `&`,
+    // `$(...)`, `` `...` `` all let "npm run test; rm -rf ~" ride an
     // "Bash(npm run test:*)" allow rule straight past the user prompt.
-    // Deny rules stay aggressive (they SHOULD match multi-line commands), and a
+    // Deny rules stay aggressive (they SHOULD match chained commands), and a
     // bare "Bash" allow (pattern === null) is an explicit "allow everything".
     if (opts?.forAllow && tool === 'bash' && pattern !== null && pattern !== '' && pattern !== '*') {
         const cmd = typeof input.command === 'string' ? input.command : '';
-        if (/[\r\n]/.test(cmd))
+        // newline / ; / && / || / | / trailing & / command-substitution / backtick
+        if (/[\r\n;`]|&&|\|\||\||&\s*$|\$\(/.test(cmd))
             return false;
     }
     if (pattern === null || pattern === '' || pattern === '*')

package/dist/tools/executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../src/tools/executor.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAyB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AA46CtE,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,WAAW,CAAC,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,EAClC,OAAO,CAAC,EAAE,aAAa,EACvB,OAAO,CAAC,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,UAAU,CAAC,CAiBrB"}
+{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../src/tools/executor.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAyB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAkrDtE,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,WAAW,CAAC,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,EAClC,OAAO,CAAC,EAAE,aAAa,EACvB,OAAO,CAAC,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,UAAU,CAAC,CAiBrB"}

package/dist/tools/executor.js

@@ -39,6 +39,7 @@ const path = __importStar(require("path"));
 const os = __importStar(require("os"));
 const https = __importStar(require("https"));
 const http = __importStar(require("http"));
+const dns = __importStar(require("dns"));
 const child_process_1 = require("child_process");
 const sandbox_1 = require("./sandbox");
 const auth_1 = require("../auth");
@@ -58,10 +59,15 @@ const MAX_OUTPUT_CHARS = 100000; // bash / grep output cap (~100 KB)
 // hidden in a fake heredoc/quote (e.g. `echo "<<EOF"\nrm -rf /\nEOF`) is still
 // caught.
 const BLOCKED_REGEXES = [
-    // Filesystem destruction — match rm/chmod with any whitespace between flags
-    /rm\s+-rf\s+\//, // rm -rf /… (any path under /)
-    /rm\s+-rf\s+~/, // rm -rf ~
-    /rm\s+-rf\s+\*/, // rm -rf *
+    // Filesystem destruction — match rm/chmod with any whitespace between flags.
+    // Only root itself and BARE top-level system dirs are blocked; ordinary
+    // absolute subpaths (/tmp/x, /var/folders/x, /Users/me/proj/node_modules)
+    // must stay allowed — the old /rm\s+-rf\s+\// matched every absolute path.
+    // `-[a-z]*(?:rf|fr)[a-z]*` accepts -rf, -fr, -rfv, -vrf … (combined flag).
+    /rm\s+-[a-z]*(?:rf|fr)[a-z]*\s+\/(?:\*|\s|;|&|\||$)/, // rm -rf /  ·  / *  ·  root, bare
+    /rm\s+-[a-z]*(?:rf|fr)[a-z]*\s+\/(?:bin|sbin|etc|usr|var|lib|lib64|boot|sys|proc|dev|root|home|system|library|applications|opt|users)(?:\/)?(?:\*|\s|;|&|\||$)/, // rm -rf /etc … bare system dir
+    /rm\s+-[a-z]*(?:rf|fr)[a-z]*\s+~(?:\/)?(?:\*|\s|;|&|\||$)/, // rm -rf ~  ·  ~/  ·  ~/*
+    /rm\s+-[a-z]*(?:rf|fr)[a-z]*\s+\*/, // rm -rf *
     /rm\s+--no-preserve-root/,
     /chmod\s+-[rr]\s+777\s+\//,
     /chown\s+-[rr]/,
@@ -69,15 +75,31 @@ const BLOCKED_REGEXES = [
     /dd\s+if=\/dev\/(zero|random|urandom)/,
     // Fork bomb
     /:\(\)\s*\{.*:\|:&/,
-    // Pipe execution from network. [^|\n]* between the fetcher and the pipe
-    // covers the URL/flags ("curl https://x.sh | sh"), which the old \s*-only
-    // version missed entirely; no-space variants (curl|bash) are still caught.
-    /curl[^|\n]*\|\s*(bash|sh|python\d*|node|perl|ruby)\b/,
-    /wget[^|\n]*\|\s*(bash|sh|python\d*|node|perl|ruby)\b/,
-    /curl\s+.*-[oO]\s*-.*\|\s*(bash|sh)/, // curl -o - … | bash
     // Credential theft
     /cat\s+\/etc\/(shadow|passwd)/,
 ];
+// Network-pipe rules (curl … | sh) get their own tier. Testing them against the
+// FULL string caused constant false positives: the pattern showing up as DATA —
+// a heredoc'd README (`cat > README.md <<EOF … install.sh | sh … EOF`), a
+// commit message (`git commit -m "docs: explain curl … | sh risk"`), an echo —
+// is never executed by this bash invocation. So these run against the command
+// with heredoc bodies AND quoted strings stripped (stripDataSections).
+// The one real execution path that lives INSIDE quotes — `bash -c "curl … |
+// sh"` — is covered by the dedicated SHELL_DASH_C rule below, which only fires
+// when the quoted pipe is the argument of an interpreter's -c flag.
+// [^|\n]* between the fetcher and the pipe covers the URL/flags ("curl
+// https://x.sh | sh"); no-space variants (curl|bash) are still caught.
+// python is exempted for `-m json.tool` (harmless pretty-printer: the
+// downloaded bytes are parsed as JSON, never executed).
+const NETWORK_PIPE_REGEXES = [
+    /curl[^|\n]*\|\s*(bash|sh|python\d*(?!\s+-m\s+json\.tool)|node|perl|ruby)\b/,
+    /wget[^|\n]*\|\s*(bash|sh|python\d*(?!\s+-m\s+json\.tool)|node|perl|ruby)\b/,
+    /curl\s+.*-[oO]\s*-.*\|\s*(bash|sh)\b/, // curl -o - … | bash
+];
+// `bash -c "curl … | sh"` / `sh -c 'wget … | bash'` — quoted, but executed for
+// real. Matched at a command position on the raw (heredoc-stripped) string so
+// the quotes are still visible to the regex.
+const SHELL_DASH_C_PIPE = /(?:^|[;&|`\n(]|\$\(|\bsudo\s+|\bexec\s+)\s*(?:bash|sh|zsh|dash)\s+(?:-\w+\s+)*-c\s+(["'])[^"']*(?:curl|wget)[^"']*\|[^"']*\1?/;
 // Tier 2 — words that are dangerous only when INVOKED as a command. A plain
 // \b-word match caused constant false positives once heredocs were allowed:
 // `grep reboot README.md`, `git log --grep shutdown`, or a heredoc body that
@@ -90,11 +112,13 @@ const BLOCKED_COMMAND_WORDS = /(?:^|[;&|`\n(]|\$\(|\bsudo\s+|\bdoas\s+|\bexec\s+
 // Heredoc bodies first (<<TAG / <<-TAG / <<'TAG' / <<"TAG" … up to the line
 // that equals TAG), then double- and single-quoted strings. Intentionally
 // naive — this feeds a blocklist heuristic, not an executor.
+function stripHeredocs(command) {
+    // Heredoc: the (['"]?) quote group always participates, so the \2 tag
+    // backreference is safe (JS backrefs to non-participating groups match "").
+    return command.replace(/<<-?\s*(['"]?)(\w+)\1[\s\S]*?\n\2(?=\s|;|&|$)/g, ' ');
+}
 function stripDataSections(command) {
-    return command
-        // Heredoc: the (['"]?) quote group always participates, so the \2 tag
-        // backreference is safe (JS backrefs to non-participating groups match "").
-        .replace(/<<-?\s*(['"]?)(\w+)\1[\s\S]*?\n\2(?=\s|;|&|$)/g, ' ')
+    return stripHeredocs(command)
         .replace(/"(?:[^"\\]|\\[\s\S])*"/g, '""')
         .replace(/'[^']*'/g, "''");
 }
@@ -104,6 +128,19 @@ function isCommandBlocked(command) {
         if (re.test(lower))
             return re.toString();
     }
+    // Network-pipe rules see the command with data sections (heredoc bodies,
+    // quoted strings) removed — mentions in docs/commit messages are data, not
+    // something this invocation executes.
+    const noData = stripDataSections(lower);
+    for (const re of NETWORK_PIPE_REGEXES) {
+        if (re.test(noData))
+            return re.toString();
+    }
+    // …but an interpreter -c argument IS executed: check it on the raw string
+    // (heredoc-stripped only, quotes intact).
+    if (SHELL_DASH_C_PIPE.test(stripHeredocs(lower))) {
+        return SHELL_DASH_C_PIPE.toString();
+    }
     if (BLOCKED_COMMAND_WORDS.test(stripDataSections(lower))) {
         return BLOCKED_COMMAND_WORDS.toString();
     }
@@ -297,21 +334,26 @@ const _bgShells = new Map();
 let _bgCounter = 0;
 function startBackgroundShell(command, displayCommand, workDir, note) {
     const id = `bg_${++_bgCounter}`;
-    const child = (0, child_process_1.spawn)(command, { shell: true, cwd: workDir ?? process.cwd(), env: process.env });
+    // detached:true → own process group so kill_shell can signal the whole tree
+    // (a background dev server usually spawns children that must die with it).
+    const child = (0, child_process_1.spawn)(command, { shell: true, cwd: workDir ?? process.cwd(), env: process.env, detached: true });
     const shell = {
         id, command: displayCommand, child, output: '', readCursor: 0, truncated: false,
         status: 'running', exitCode: null,
     };
+    // Rolling buffer: keep the LAST MAX_OUTPUT_CHARS instead of the first, so a
+    // long-lived watcher/dev-server's recent output (the useful part) is never
+    // permanently lost behind an early cap.
     const append = (chunk) => {
-        if (shell.truncated)
-            return;
-        const remaining = MAX_OUTPUT_CHARS - shell.output.length;
-        if (chunk.length >= remaining) {
-            shell.output += chunk.slice(0, remaining);
+        shell.output += chunk;
+        if (shell.output.length > MAX_OUTPUT_CHARS) {
+            // Drop from the front but never behind the read cursor's logical position;
+            // readCursor is an absolute offset so we track how much we've discarded.
+            const overflow = shell.output.length - MAX_OUTPUT_CHARS;
+            shell.output = shell.output.slice(overflow);
+            shell.readCursor = Math.max(0, shell.readCursor - overflow);
             shell.truncated = true;
         }
-        else
-            shell.output += chunk;
     };
     child.stdout?.on('data', (c) => append(c.toString('utf-8')));
     child.stderr?.on('data', (c) => append(c.toString('utf-8')));
@@ -357,18 +399,22 @@ async function killShell(input) {
         return { error: `No background shell with id "${id}".` };
     if (shell.status === 'running') {
         shell.status = 'killed';
-        try {
-            shell.child.kill('SIGTERM');
-        }
-        catch { /* ignore */ }
-        // Escalate to SIGKILL after 3 s if process is still alive
-        setTimeout(() => {
+        const killTree = (sig) => {
             try {
-                if (shell.status === 'killed')
-                    shell.child.kill('SIGKILL');
+                if (shell.child.pid)
+                    process.kill(-shell.child.pid, sig);
             }
-            catch { /* ignore */ }
-        }, 3000);
+            catch {
+                try {
+                    shell.child.kill(sig);
+                }
+                catch { /* already dead */ }
+            }
+        };
+        killTree('SIGTERM');
+        // Escalate to SIGKILL after 3 s if process group is still alive
+        setTimeout(() => { if (shell.status === 'killed')
+            killTree('SIGKILL'); }, 3000);
     }
     return { output: `Background shell ${id} ${shell.status}.` };
 }
@@ -416,43 +462,80 @@ async function bash(input, abortSignal, sandbox, workDir) {
                 r.output = `[${sandboxNote}]\n${r.output}`;
             return r;
         };
+        // detached:true puts the child in its own process group so we can signal the
+        // WHOLE tree (shell + its children — dev servers, test runners) on timeout /
+        // abort. Without it, kill() only hits the /bin/sh wrapper and leaves orphaned
+        // grandchildren holding ports (→ EADDRINUSE on the next run).
         const child = (0, child_process_1.spawn)(effectiveCommand, {
             shell: true,
             cwd: workDir ?? process.cwd(),
             env: process.env,
+            detached: true,
         });
-        let output = '';
+        // Kill the child's entire process group (negative pid). Falls back to a
+        // plain kill if the group signal fails (e.g. process already gone).
+        const killTree = (sig) => {
+            try {
+                if (child.pid)
+                    process.kill(-child.pid, sig);
+            }
+            catch {
+                try {
+                    child.kill(sig);
+                }
+                catch { /* already dead */ }
+            }
+        };
+        // Keep HEAD + TAIL rather than head-only: test runners print the failure
+        // summary at the END, so a large passing-then-failing suite must not lose its
+        // tail. We retain the first HEAD_CHARS and the last TAIL_CHARS.
+        const HEAD_CHARS = Math.floor(MAX_OUTPUT_CHARS * 0.25);
+        const TAIL_CHARS = MAX_OUTPUT_CHARS - HEAD_CHARS;
+        let head = '';
+        let tail = '';
+        let totalLen = 0;
         let truncated = false;
         let settled = false;
-        // Cap output in the data handler so we never accumulate more than MAX_OUTPUT_CHARS in RAM
         const appendOutput = (chunk) => {
-            if (truncated)
-                return;
-            const remaining = MAX_OUTPUT_CHARS - output.length;
-            if (chunk.length >= remaining) {
-                output += chunk.slice(0, remaining);
-                truncated = true;
+            totalLen += chunk.length;
+            if (head.length < HEAD_CHARS) {
+                const room = HEAD_CHARS - head.length;
+                head += chunk.slice(0, room);
+                chunk = chunk.slice(room);
+                if (!chunk)
+                    return;
             }
-            else {
-                output += chunk;
+            // Remaining goes into a rolling tail buffer.
+            tail += chunk;
+            if (tail.length > TAIL_CHARS) {
+                tail = tail.slice(tail.length - TAIL_CHARS);
+                truncated = true;
             }
         };
+        const collect = () => {
+            if (!truncated)
+                return head + tail;
+            const omitted = totalLen - head.length - tail.length;
+            return `${head}\n\n[… ${omitted} chars omitted (kept first ${HEAD_CHARS / 1024}KB + last ${Math.round(TAIL_CHARS / 1024)}KB) …]\n\n${tail}`;
+        };
         const done = (code, signal, timedOut = false) => {
             if (settled)
                 return;
             settled = true;
-            const truncNote = truncated ? '\n[Output truncated at 100KB]' : '';
+            const body = collect();
             if (timedOut) {
-                resolve({ error: `Command timed out after ${timeoutMs}ms`, interrupted: true });
+                // Return the partial output alongside the error — it usually holds the
+                // reason the command hung (a stuck test, a prompt, a slow step).
+                resolve(prependNote({ error: `Command timed out after ${timeoutMs}ms`, interrupted: true, output: body ? `Partial output before timeout:\n${body}` : undefined }));
             }
             else if (abortSignal?.aborted) {
-                resolve({ error: 'Command stopped by user', interrupted: true });
+                resolve({ error: 'Command stopped by user', interrupted: true, output: body || undefined });
             }
             else if (code !== 0) {
-                resolve(prependNote({ output: output + `\n[Exit code: ${code ?? signal ?? 'unknown'}]` + truncNote }));
+                resolve(prependNote({ output: body + `\n[Exit code: ${code ?? signal ?? 'unknown'}]` }));
             }
             else {
-                resolve(prependNote({ output: output + truncNote }));
+                resolve(prependNote({ output: body }));
             }
         };
         child.stdout?.on('data', (chunk) => appendOutput(chunk.toString('utf-8')));
@@ -464,13 +547,13 @@ async function bash(input, abortSignal, sandbox, workDir) {
             clearTimeout(timer);
             resolve({ error: err.message });
         });
-        // Timeout kill: SIGTERM first, escalate to SIGKILL after 3 s if still alive
+        // Timeout kill: SIGTERM the whole group, escalate to SIGKILL after 3 s
         const timer = setTimeout(() => {
             if (settled)
                 return;
-            child.kill('SIGTERM');
+            killTree('SIGTERM');
             setTimeout(() => { if (!settled)
-                child.kill('SIGKILL'); }, 3000);
+                killTree('SIGKILL'); }, 3000);
             done(null, null, true);
         }, timeoutMs);
         child.on('close', () => clearTimeout(timer));
@@ -478,7 +561,7 @@ async function bash(input, abortSignal, sandbox, workDir) {
         const pollAbort = setInterval(() => {
             if (abortSignal?.aborted && !settled) {
                 clearInterval(pollAbort);
-                child.kill('SIGTERM');
+                killTree('SIGTERM');
                 done(null, null, false);
             }
         }, 200);
@@ -528,6 +611,11 @@ async function searchFiles(input, workDir) {
         else {
             // Content search — prefer ripgrep (faster, .gitignore-aware) when
             // installed, fall back to plain grep with hardcoded excludes otherwise.
+            // maxBuffer is raised well past the default 1 MB: on a large repo a common
+            // pattern can emit tens of MB and the default silently truncates + sets
+            // status:null (ENOBUFS), which used to surface as an empty "search failed".
+            const SEARCH_MAX_BUFFER = 64 * 1024 * 1024; // 64 MB
+            const spawnOpts = { encoding: 'utf-8', timeout: DEFAULT_TIMEOUT_MS, maxBuffer: SEARCH_MAX_BUFFER };
             let result;
             if (ripgrepAvailable()) {
                 const args = ['--line-number', '--no-heading', '--color=never', '--hidden', '--glob', '!.git'];
@@ -537,8 +625,10 @@ async function searchFiles(input, workDir) {
                     args.push(`-C${contextLines}`);
                 if (include)
                     args.push('--glob', include);
+                // -m is PER-FILE in rg/grep; the real global cap is applied on the
+                // output below. Keep a generous per-file cap so no single file floods.
                 args.push('-m', '200', '--regexp', pattern, resolved);
-                result = (0, child_process_1.spawnSync)('rg', args, { encoding: 'utf-8', timeout: DEFAULT_TIMEOUT_MS });
+                result = (0, child_process_1.spawnSync)('rg', args, spawnOpts);
             }
             else {
                 const args = ['-rn', '--binary-files=without-match', '--color=never'];
@@ -549,17 +639,31 @@ async function searchFiles(input, workDir) {
                 if (include)
                     args.push(`--include=${include}`);
                 args.push('--exclude-dir=.git', '--exclude-dir=node_modules', '--exclude-dir=dist', '--exclude-dir=.next', '--exclude-dir=__pycache__', '--exclude-dir=.turbo', '--exclude-dir=coverage', '--exclude-dir=.cache', '-m', '200', pattern, resolved);
-                result = (0, child_process_1.spawnSync)('grep', args, { encoding: 'utf-8', timeout: DEFAULT_TIMEOUT_MS });
+                result = (0, child_process_1.spawnSync)('grep', args, spawnOpts);
             }
             let output = result.stdout ?? '';
             const stderr = result.stderr ?? '';
+            // Distinguish real failure modes. spawnSync sets `.error` (not `.status`)
+            // for timeout (ETIMEDOUT), buffer overflow (ENOBUFS) and spawn failures.
+            const spawnErr = result.error;
+            if (spawnErr) {
+                if (spawnErr.code === 'ETIMEDOUT' || result.signal === 'SIGTERM') {
+                    const partial = output ? `\n\nPartial results before timeout:\n${globalCapMatches(output)}` : '';
+                    return { error: `Search timed out after ${Math.round(DEFAULT_TIMEOUT_MS / 1000)}s — narrow the path or pattern (or add an "include" filter).${partial}` };
+                }
+                if (spawnErr.code === 'ENOBUFS') {
+                    // We still captured up to maxBuffer of output — return the capped head
+                    // instead of failing blind.
+                    return { output: `${globalCapMatches(output)}\n[Too many matches — output exceeded ${SEARCH_MAX_BUFFER / (1024 * 1024)}MB and was capped. Narrow the pattern/path.]` };
+                }
+                return { error: `search failed: ${spawnErr.message}` };
+            }
             // Both rg and grep use exit code 1 = "no matches", 2 = error.
             if (result.status === 1 && !output)
                 return { output: 'No matches found.' };
             if (result.status !== 0 && result.status !== 1)
                 return { error: stderr || 'search failed' };
-            if (output.length > MAX_OUTPUT_CHARS)
-                output = output.slice(0, MAX_OUTPUT_CHARS) + '\n[Output truncated at 100KB]';
+            output = globalCapMatches(output);
             return { output: output || 'No matches found.' };
         }
     }
@@ -567,6 +671,29 @@ async function searchFiles(input, workDir) {
         return { error: err.message };
     }
 }
+/**
+ * Enforce the documented global cap on grep/rg output: at most 200 matched
+ * lines (the tool contract) AND at most MAX_OUTPUT_CHARS bytes. The `-m 200`
+ * flag on rg/grep is PER-FILE, so a large repo can blow well past 200 total —
+ * this applies the real global ceiling after the fact.
+ */
+function globalCapMatches(output) {
+    if (!output)
+        return output;
+    const GLOBAL_MATCH_CAP = 200;
+    const lines = output.split('\n');
+    let capped = output;
+    let note = '';
+    if (lines.length > GLOBAL_MATCH_CAP) {
+        capped = lines.slice(0, GLOBAL_MATCH_CAP).join('\n');
+        note = `\n[Showing first ${GLOBAL_MATCH_CAP} of ${lines.length} matched lines — narrow the pattern/path for the rest.]`;
+    }
+    if (capped.length > MAX_OUTPUT_CHARS) {
+        capped = capped.slice(0, MAX_OUTPUT_CHARS);
+        note = `\n[Output truncated at ${MAX_OUTPUT_CHARS / 1024}KB.]`;
+    }
+    return capped + note;
+}
 function matchesGlob(name, pattern) {
     // Convert simple glob (* → .*, ? → .) to regex
     try {
@@ -694,6 +821,42 @@ function literalReplace(haystack, needle, replacement) {
         return haystack;
     return haystack.slice(0, idx) + replacement + haystack.slice(idx + needle.length);
 }
+// Max size an edit tool will load into memory. Guards against OOM on a huge file
+// and mirrors read_file's cap (edits target source, not multi-MB assets).
+const MAX_EDIT_BYTES = 10 * 1024 * 1024; // 10 MB
+/**
+ * Guard a path for in-place editing: reject missing files, oversize files, and
+ * binaries (a text edit on a binary corrupts it, and CRLF-normalize mangles
+ * embedded \r\n). Returns an error string, or the file's mode + content.
+ */
+function preflightEdit(resolved) {
+    let stat;
+    try {
+        stat = fs.statSync(resolved);
+    }
+    catch {
+        return { error: `File not found: ${resolved}. Read the file first to verify the path.` };
+    }
+    if (stat.isDirectory())
+        return { error: `Path is a directory, not a file: ${resolved}.` };
+    if (stat.size > MAX_EDIT_BYTES) {
+        return { error: `File too large to edit (${(stat.size / 1024 / 1024).toFixed(1)} MB, max ${MAX_EDIT_BYTES / 1024 / 1024} MB). Use bash (sed/awk) for very large files.` };
+    }
+    if (isBinaryFile(resolved)) {
+        return { error: `Refusing to edit binary file ${resolved} — a text replace would corrupt it.` };
+    }
+    return { mode: stat.mode, content: fs.readFileSync(resolved, 'utf-8') };
+}
+/** Atomic write that preserves the original file's permission bits (mode). */
+function atomicWritePreservingMode(resolved, data, mode) {
+    const tmp = resolved + '.nexrall_tmp';
+    fs.writeFileSync(tmp, data, 'utf-8');
+    try {
+        fs.chmodSync(tmp, mode);
+    }
+    catch { /* non-fatal — keep going */ }
+    fs.renameSync(tmp, resolved);
+}
 // Normalize CRLF → LF so Windows files match LF old_strings.
 function normalizeLF(s) {
     return s.replace(/\r\n/g, '\n');
@@ -708,7 +871,10 @@ async function editFile(input, workDir) {
         return { error: 'Missing required parameter: old_string' };
     try {
         const resolved = resolvePath(filePath, workDir);
-        const original = fs.readFileSync(resolved, 'utf-8');
+        const pre = preflightEdit(resolved);
+        if ('error' in pre)
+            return { error: pre.error };
+        const original = pre.content;
         // Normalize CRLF → LF for matching; restore on write if needed
         const wasCRLF = original.includes('\r\n');
         const origNorm = normalizeLF(original);
@@ -724,11 +890,9 @@ async function editFile(input, workDir) {
         let updated = literalReplace(origNorm, oldNorm, newNorm);
         if (wasCRLF)
             updated = updated.replace(/\n/g, '\r\n');
-        // Atomic write: write to a temp file then rename so a crash mid-write never
-        // leaves the original file truncated or partially overwritten.
-        const tmp = resolved + '.nexrall_tmp';
-        fs.writeFileSync(tmp, updated, 'utf-8');
-        fs.renameSync(tmp, resolved);
+        // Atomic write (temp + rename) so a crash mid-write never leaves the file
+        // truncated, AND preserve the original mode bits (+x on scripts etc.).
+        atomicWritePreservingMode(resolved, updated, pre.mode);
         const diff = buildDiff(filePath, oldNorm, newNorm, origNorm);
         const linesBefore = origNorm.split('\n').length;
         const linesAfter = updated.split('\n').length;
@@ -802,6 +966,95 @@ function stripHtml(html) {
 }
 const MAX_REDIRECTS = 10;
 const FETCH_USER_AGENT = 'Nexrall-Code/1.0 (+https://nexrall.com)';
+/** True if an IP literal is loopback / private / link-local / unique-local. */
+function isPrivateIp(ip) {
+    const v4 = ip.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+    if (v4) {
+        const [a, b] = [Number(v4[1]), Number(v4[2])];
+        if (a === 10)
+            return true; // 10.0.0.0/8
+        if (a === 127)
+            return true; // loopback
+        if (a === 0)
+            return true; // 0.0.0.0/8
+        if (a === 172 && b >= 16 && b <= 31)
+            return true; // 172.16.0.0/12
+        if (a === 192 && b === 168)
+            return true; // 192.168.0.0/16
+        if (a === 169 && b === 254)
+            return true; // link-local (cloud metadata!)
+        if (a === 100 && b >= 64 && b <= 127)
+            return true; // CGNAT 100.64.0.0/10
+        return false;
+    }
+    const low = ip.toLowerCase().replace(/^\[|\]$/g, '');
+    if (low === '::1' || low === '::')
+        return true; // IPv6 loopback / unspecified
+    if (low.startsWith('fe80'))
+        return true; // link-local
+    if (low.startsWith('fc') || low.startsWith('fd'))
+        return true; // unique-local fc00::/7
+    if (low.startsWith('::ffff:'))
+        return isPrivateIp(low.slice(7)); // IPv4-mapped
+    return false;
+}
+/**
+ * SSRF guard: reject a URL whose host is (or resolves to) a private / internal
+ * address. Blocks the classic prompt-injection → cloud-metadata exfiltration
+ * (http://169.254.169.254/…) and internal-service probing. Returns an error
+ * string when the host is unsafe, or null when it's OK to fetch.
+ */
+async function ssrfCheck(parsedUrl) {
+    // Escape hatch for local dev-server previews (fetch_url http://localhost:3000):
+    // opt-in only, since it re-opens the SSRF surface.
+    const env = (process.env.NEXRALL_ALLOW_LOCAL_FETCH ?? '').toLowerCase();
+    if (env === '1' || env === 'true' || env === 'on')
+        return null;
+    const host = parsedUrl.hostname.replace(/^\[|\]$/g, '');
+    const lower = host.toLowerCase();
+    if (lower === 'localhost' || lower.endsWith('.localhost') || lower === 'metadata.google.internal') {
+        return `Refusing to fetch internal host "${host}" (SSRF guard).`;
+    }
+    // Only SHORT-CIRCUIT on a form we can evaluate exactly: a valid dotted-quad
+    // IPv4 or an IPv6 literal. Numeric shorthands like decimal (2130706433) or
+    // octal (0177.0.0.1) must NOT be checked with isPrivateIp — they'd read as
+    // "not private" and slip through, yet getaddrinfo expands them to 127.0.0.1 /
+    // 169.254.169.254 at connect time. Those fall through to DNS below, which
+    // canonicalizes them via the same resolver the real request uses.
+    if (isValidDottedQuad(host) || host.includes(':')) {
+        return isPrivateIp(host) ? `Refusing to fetch private/internal address "${host}" (SSRF guard).` : null;
+    }
+    // Hostname (or numeric shorthand) → resolve and reject if ANY resolved
+    // address is private. getaddrinfo handles inet_aton forms (decimal/octal/hex),
+    // so a disguised metadata IP resolves to its real address here and is caught.
+    try {
+        const addrs = await new Promise((res, rej) => {
+            dns.lookup(host, { all: true }, (err, a) => (err ? rej(err) : res(a)));
+        });
+        if (!addrs.length)
+            return null;
+        for (const { address } of addrs) {
+            if (isPrivateIp(address))
+                return `Refusing to fetch "${host}" — it resolves to a private/internal address (${address}) (SSRF guard).`;
+        }
+    }
+    catch {
+        // DNS failure. For a plain hostname, let the real request surface the network
+        // error. But for a NUMERIC shorthand we couldn't resolve, fail closed — we
+        // can't prove it's public and it might be a disguised private literal.
+        if (/^[\d.]+$|^0[xX]/.test(host)) {
+            return `Refusing to fetch numeric host "${host}" — could not verify it is a public address (SSRF guard).`;
+        }
+    }
+    return null;
+}
+/** True only for a canonical dotted-quad IPv4 (4 octets, each 0–255). */
+function isValidDottedQuad(host) {
+    const m = host.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+    if (!m)
+        return false;
+    return m.slice(1).every((o) => Number(o) <= 255);
+}
 async function fetchUrl(input, _workDir, _redirectCount = 0) {
     const url = typeof input.url === 'string' ? input.url : '';
     if (!url)
@@ -819,10 +1072,33 @@ async function fetchUrl(input, _workDir, _redirectCount = 0) {
     if (parsedUrl.protocol !== 'http:' && parsedUrl.protocol !== 'https:') {
         return { error: `Unsupported protocol: ${parsedUrl.protocol}. Only http and https are supported.` };
     }
+    // SSRF guard — runs on every hop (redirects recurse through fetchUrl), so a
+    // public URL that 302-redirects to 169.254.169.254 is still blocked.
+    const ssrfError = await ssrfCheck(parsedUrl);
+    if (ssrfError)
+        return { error: ssrfError };
+    const allowLocal = ['1', 'true', 'on'].includes((process.env.NEXRALL_ALLOW_LOCAL_FETCH ?? '').toLowerCase());
     return new Promise((resolve) => {
         const transport = parsedUrl.protocol === 'https:' ? https : http;
+        // Re-validate the address the socket ACTUALLY connects to. ssrfCheck() above
+        // resolves at check-time; this closes the TOCTOU / DNS-rebinding window where
+        // a hostname flips to a private IP between the check and the connect.
+        const guardedLookup = ((hostname, opts, cb) => {
+            const callback = (typeof opts === 'function' ? opts : cb);
+            const options = (typeof opts === 'function' ? {} : opts);
+            return dns.lookup(hostname, options, (err, address, family) => {
+                if (err)
+                    return callback(err, address, family);
+                const addrs = Array.isArray(address) ? address.map((a) => a.address) : [address];
+                if (!allowLocal && addrs.some((a) => isPrivateIp(a))) {
+                    return callback(Object.assign(new Error('SSRF guard: host resolved to a private address at connect time'), { code: 'ESSRFBLOCKED' }), address, family);
+                }
+                return callback(null, address, family);
+            });
+        });
         const req = transport.get(url, {
             timeout: DEFAULT_TIMEOUT_MS,
+            lookup: guardedLookup,
             headers: {
                 'User-Agent': FETCH_USER_AGENT,
                 'Accept-Encoding': 'identity', // opt-out of gzip/deflate — we read raw Buffer as UTF-8
@@ -919,7 +1195,10 @@ async function multiEdit(input, workDir) {
         return { error: 'Missing required parameter: edits (must be a non-empty array)' };
     try {
         const resolved = resolvePath(filePath, workDir);
-        const rawFile = fs.readFileSync(resolved, 'utf-8');
+        const pre = preflightEdit(resolved);
+        if ('error' in pre)
+            return { error: pre.error };
+        const rawFile = pre.content;
         // Work in LF-normalised space so CRLF files match LF old_strings
         const wasCRLF = rawFile.includes('\r\n');
         let content = normalizeLF(rawFile);
@@ -945,11 +1224,10 @@ async function multiEdit(input, workDir) {
             diffs.push(buildDiff(filePath, oldStr, newStr, content));
             content = literalReplace(content, oldStr, newStr);
         }
-        // Restore original line endings before writing (atomic temp+rename)
+        // Restore original line endings before writing (atomic temp+rename),
+        // preserving the original mode bits (+x on scripts etc.).
         const finalContent = wasCRLF ? content.replace(/\n/g, '\r\n') : content;
-        const tmp = resolved + '.nexrall_tmp';
-        fs.writeFileSync(tmp, finalContent, 'utf-8');
-        fs.renameSync(tmp, resolved);
+        atomicWritePreservingMode(resolved, finalContent, pre.mode);
         return {
             output: `Applied ${edits.length} edit(s) to ${resolved}:\n` +
                 diffs.map((d, i) => `\n--- edit #${i + 1} ---\n${d}`).join('\n'),

package/dist/types.d.ts

@@ -151,6 +151,14 @@ export interface AgentLoopOptions {
     takePendingInput?: () => string[];
     /** Notify that a queued follow-up was injected into the conversation (for UI echo/logging). */
     onInjectedInput?: (text: string) => void;
+    /**
+     * Fired at every turn boundary inside the loop with a snapshot of the current
+     * message history. Lets the caller persist progress INCREMENTALLY so a crash
+     * (or `kill`) hours into a long run doesn't lose the whole session — only the
+     * in-flight step. The array is a live reference; treat it as read-only and
+     * copy if you need to retain it. Cheap: callers should debounce heavy writes.
+     */
+    onProgress?: (messages: Message[]) => void;
     /**
      * Max agent iterations (model response + tool round) before the runaway-loop
      * backstop trips. Overrides the NEXRALL_MAX_ITERATIONS env var and the

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,UAAU,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,aAAa,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,YAAY,GAAG,eAAe,CAAC;AAItE,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;IAC3B,OAAO,EAAE,YAAY,EAAE,CAAC;CACzB;AAID,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,UAAU,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,SAAS,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,gBAAgB,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,QAAQ,GAChB,YAAY,GACZ,eAAe,GACf,uBAAuB,GACvB,aAAa,GACb,YAAY,GACZ,aAAa,GACb,gBAAgB,GAChB,wBAAwB,GACxB,qBAAqB,CAAC;AAI1B,MAAM,WAAW,SAAS;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,gEAAgE;IAChE,WAAW,CAAC,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvF,8DAA8D;IAC9D,oBAAoB,CAAC,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChH,4DAA4D;IAC5D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,kBAAkB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9C,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IACvF,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9E,OAAO,EAAE,CAAC,CAAC,EAAE,SAAS,KAAK,IAAI,CAAC;IAChC,KAAK,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAChE,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACnG,+EAA+E;IAC/E,UAAU,CAAC,EAAE,OAAO,eAAe,EAAE,UAAU,CAAC;IAChD,qFAAqF;IACrF,iBAAiB,CAAC,EAAE,OAAO,sBAAsB,EAAE,iBAAiB,CAAC;IACrE;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,MAAM,EAAE,CAAC;IAClC,+FAA+F;IAC/F,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,UAAU,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,aAAa,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,YAAY,GAAG,eAAe,CAAC;AAItE,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;IAC3B,OAAO,EAAE,YAAY,EAAE,CAAC;CACzB;AAID,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,UAAU,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,SAAS,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,gBAAgB,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,QAAQ,GAChB,YAAY,GACZ,eAAe,GACf,uBAAuB,GACvB,aAAa,GACb,YAAY,GACZ,aAAa,GACb,gBAAgB,GAChB,wBAAwB,GACxB,qBAAqB,CAAC;AAI1B,MAAM,WAAW,SAAS;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,gEAAgE;IAChE,WAAW,CAAC,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvF,8DAA8D;IAC9D,oBAAoB,CAAC,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChH,4DAA4D;IAC5D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,kBAAkB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9C,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IACvF,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9E,OAAO,EAAE,CAAC,CAAC,EAAE,SAAS,KAAK,IAAI,CAAC;IAChC,KAAK,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAChE,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACnG,+EAA+E;IAC/E,UAAU,CAAC,EAAE,OAAO,eAAe,EAAE,UAAU,CAAC;IAChD,qFAAqF;IACrF,iBAAiB,CAAC,EAAE,OAAO,sBAAsB,EAAE,iBAAiB,CAAC;IACrE;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,MAAM,EAAE,CAAC;IAClC,+FAA+F;IAC/F,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IAC3C;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nexrall/code-core",
-  "version": "1.2.0",
+  "version": "1.3.1",
   "description": "Core agent loop, tools, and extension primitives for Nexrall Code — embed an AI coding agent in any Node.js application.",
   "license": "MIT",
   "author": "Nexrall <support@nexrall.com> (https://nexrall.com)",