@nexrall/code-core 1.4.22 → 1.4.24

package/dist/agent/loop.js

@@ -35,9 +35,14 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.VERIFY_CMD_RE = exports.WRITE_TOOL_NAMES = void 0;
 exports.resolveMaxIterations = resolveMaxIterations;
+exports.createLimiter = createLimiter;
+exports.extractSubTaskText = extractSubTaskText;
+exports.capSubTaskText = capSubTaskText;
+exports.summariseSubTaskProgress = summariseSubTaskProgress;
 exports.contextWindowFor = contextWindowFor;
 exports.compactionThresholds = compactionThresholds;
 exports.estimateBodyBytes = estimateBodyBytes;
+exports.allowsTestOnlyWrite = allowsTestOnlyWrite;
 exports.findSafeCutIndex = findSafeCutIndex;
 exports.transcriptOf = transcriptOf;
 exports.createLedger = createLedger;
@@ -241,6 +246,58 @@ async function withFileLock(absPath, fn) {
             _fileLocks.delete(absPath);
     }
 }
+// ─── Sub-agent fan-out limiter ────────────────────────────────────────────────
+//
+// Tool calls in one turn run via Promise.all with no ceiling. For ordinary tools
+// that is right — they're cheap and mostly I/O — but a `task` call spawns a WHOLE
+// nested agent loop: its own model stream, its own tool executions, its own
+// sub-process spawns. A model that emits ten `task` blocks in one turn therefore
+// starts ten concurrent agents, each billing tokens and competing for the same
+// CPU, file handles and API rate limit. The practical symptoms are the ones users
+// report as "it got slow and then stalled": every sub-agent's stream slows, some
+// trip their own stall watchdog, and one shared rate limit is spread across ten
+// callers.
+//
+// Anthropic hit the same wall and capped Claude Code's concurrent subagents at 20
+// (v2.1.217, July 2026); community guidance settles far lower, around 3-5, because
+// past that the synthesis overhead cancels the parallelism. We default to 4:
+// enough for genuine fan-out (the case sub-agents exist for), low enough that a
+// runaway `task` burst degrades into a queue instead of a thundering herd.
+//
+// This is a QUEUE, not a rejection: every sub-task still runs, just at most N at a
+// time. Failing the excess would be worse than serialising it.
+const MAX_CONCURRENT_SUBTASKS = (() => {
+    const raw = Number(process.env.NEXRALL_MAX_CONCURRENT_SUBTASKS);
+    return Number.isFinite(raw) && raw > 0 ? Math.floor(raw) : 4;
+})();
+/**
+ * Minimal concurrency gate. Hand-rolled rather than pulling in `p-limit` because
+ * the CLI ships as a single esbuild bundle with no node_modules, and this is a
+ * dozen lines.
+ */
+function createLimiter(max) {
+    let active = 0;
+    const queue = [];
+    const release = () => {
+        active--;
+        queue.shift()?.();
+    };
+    return async (fn) => {
+        if (active >= max)
+            await new Promise((resolve) => queue.push(resolve));
+        active++;
+        try {
+            return await fn();
+        }
+        finally {
+            release();
+        }
+    };
+}
+// Process-wide, deliberately: the limit exists to protect shared resources (CPU,
+// the API rate limit, file handles), and those are shared across every concurrent
+// turn in this process, not just the tool calls of one message.
+const _subTaskLimit = createLimiter(MAX_CONCURRENT_SUBTASKS);
 // ─── Human-readable tool descriptions ────────────────────────────────────────
 function humanDescription(name, input) {
     switch (name) {
@@ -326,7 +383,15 @@ function humanDescription(name, input) {
     }
 }
 // ─── Sub-task runner ──────────────────────────────────────────────────────────
-const MAX_TASK_DEPTH = 2; // main agent (0) can spawn sub-agents (1) — sub-agents cannot spawn further
+// Deepest nesting level allowed to spawn a sub-agent. The main agent runs at
+// depth 0 and the sub-agents it spawns at depth 1.
+//
+// This is 1, not 2. With 2 the guard below (`depth >= MAX_TASK_DEPTH`) let a
+// depth-1 sub-agent spawn depth-2 grandchildren — contradicting both the constant's
+// own comment and the system prompt's promise that "sub-agents cannot spawn further
+// sub-agents", and quietly making the worst-case fan-out quadratic. The value and
+// the documented behaviour now agree.
+const MAX_TASK_DEPTH = 1;
 let _subTaskCounter = 0; // unique per-process id → per-sub-agent todo scope
 // A sub-agent that stalls (hung tool, model provider stuck, infinite tool-call
 // loop bypassing the iteration budget somehow) used to have NO ceiling of its
@@ -338,13 +403,112 @@ let _subTaskCounter = 0; // unique per-process id → per-sub-agent todo scope
 const SUBTASK_TIMEOUT_MS = Number(process.env.NEXRALL_SUBTASK_TIMEOUT_MS) > 0
     ? Number(process.env.NEXRALL_SUBTASK_TIMEOUT_MS)
     : 10 * 60 * 1000; // 10 minutes, matching the general industry norm for a stalled-agent cutoff
+/** Cap on the text a sub-task hands back, so one verbose sub-agent can't blow up
+ *  the PARENT's context in a single tool_result. */
+const SUBTASK_MAX = 48000; // chars (~12k tokens)
+/**
+ * Slice `s` to at most `max` UTF-16 units without splitting a surrogate pair.
+ *
+ * A bare `slice()` can cut between the high and low half of a non-BMP character
+ * (emoji, many CJK extension glyphs), producing a lone surrogate — invalid UTF-16
+ * that the Anthropic API rejects outright with "no low surrogate in string". That
+ * exact failure has already been shipped and fixed once in this codebase; every
+ * new cap on model-facing text has to be surrogate-aware from the start.
+ */
+function sliceSafeEnd(s, max) {
+    if (s.length <= max)
+        return s;
+    let end = max;
+    const code = s.charCodeAt(end - 1);
+    if (code >= 0xd800 && code <= 0xdbff)
+        end--; // trailing high surrogate — drop it
+    return s.slice(0, end);
+}
+/** Mirror of sliceSafeEnd for a tail slice: never START on a low surrogate. */
+function sliceSafeStart(s, from) {
+    if (from <= 0)
+        return s;
+    let start = from;
+    const code = s.charCodeAt(start);
+    if (code >= 0xdc00 && code <= 0xdfff)
+        start++; // leading low surrogate — drop it
+    return s.slice(start);
+}
+/**
+ * Reduce a sub-agent's message history to the text its parent should receive.
+ *
+ * Pure + exported so the salvage rules can be tested without running a real
+ * sub-agent (which needs a live model stream and, for the timeout path, ten
+ * minutes of wall clock).
+ *
+ * `preferLast` — the normal completion path — returns the final assistant
+ * message, which is the sub-agent's actual answer.
+ *
+ * `preferLast: false` is the SALVAGE path, used when the sub-agent was cut off.
+ * A stopped sub-agent usually has no closing summary at all (it was killed
+ * mid-tool-round), so the last assistant message is frequently empty or a
+ * fragment. Concatenating what it did produce is far more useful to the parent
+ * model than nothing: it can build on the work instead of redoing it.
+ */
+function extractSubTaskText(messages, preferLast = true) {
+    const assistants = messages.filter((m) => m.role === 'assistant');
+    const textOf = (m) => (m?.content ?? [])
+        .filter((b) => b.type === 'text' && typeof b.text === 'string')
+        .map((b) => b.text)
+        .join('')
+        .trim();
+    if (preferLast)
+        return textOf(assistants[assistants.length - 1]);
+    return assistants.map(textOf).filter(Boolean).join('\n\n').trim();
+}
+/** Apply the parent-context cap to a sub-task's text, keeping head + tail. */
+function capSubTaskText(text, max = SUBTASK_MAX) {
+    if (text.length <= max)
+        return text;
+    const head = sliceSafeEnd(text, Math.floor(max * 0.6));
+    const tail = sliceSafeStart(text, text.length - Math.floor(max * 0.4));
+    return `${head}\n\n[… sub-task output truncated (${text.length} chars) — kept the beginning and end …]\n\n${tail}`;
+}
+/**
+ * Summarise what a cut-short sub-agent actually accomplished, so the parent model
+ * can continue from it rather than starting over.
+ *
+ * This is the whole point of the salvage path. Previously a timed-out sub-agent
+ * returned ONLY an error string: ten minutes of work, dozens of tool calls and
+ * any files it wrote were invisible to the parent, which typically responded by
+ * re-running the same work from scratch — while the tokens for the discarded run
+ * had already been billed in full.
+ */
+function summariseSubTaskProgress(messages) {
+    const toolNames = [];
+    for (const m of messages) {
+        if (m.role !== 'assistant' || !Array.isArray(m.content))
+            continue;
+        for (const b of m.content) {
+            if (b?.type === 'tool_use' && typeof b.name === 'string')
+                toolNames.push(b.name);
+        }
+    }
+    if (toolNames.length === 0)
+        return '';
+    // Collapse to "name ×N" so a 40-call run reads as a short inventory rather
+    // than forty repeated lines of the same tool name.
+    const counts = new Map();
+    for (const n of toolNames)
+        counts.set(n, (counts.get(n) ?? 0) + 1);
+    const inventory = [...counts.entries()]
+        .sort((a, b) => b[1] - a[1])
+        .map(([name, n]) => (n > 1 ? `${name} ×${n}` : name))
+        .join(', ');
+    return `Tool calls completed before it was stopped (${toolNames.length} total): ${inventory}.`;
+}
 async function runSubTask(input, options, agentTypes) {
     const prompt = typeof input.prompt === 'string' ? input.prompt.trim() : '';
     if (!prompt)
         return { error: 'task tool requires a non-empty prompt' };
     const depth = options._depth ?? 0;
     if (depth >= MAX_TASK_DEPTH) {
-        return { error: `Sub-task depth limit (${MAX_TASK_DEPTH}) reached — sub-agents cannot spawn further sub-agents.` };
+        return { error: 'Sub-agents cannot spawn further sub-agents. Do this work directly, or report back so the main agent can delegate it.' };
     }
     // Resolve an optional custom agent type (subagent_type).
     const requestedType = typeof input.subagent_type === 'string' ? input.subagent_type : '';
@@ -365,6 +529,10 @@ async function runSubTask(input, options, agentTypes) {
     const gatedPermission = async (req) => {
         if (allowed && !allowed.has(req.tool))
             return false;
+        // Path-scoped write restriction (agent.testFilesOnly) — see
+        // allowsTestOnlyWrite for the reasoning and its known limit.
+        if (agent?.testFilesOnly && !allowsTestOnlyWrite(req.tool, req.input))
+            return false;
         return options.requestPermission(req);
     };
     const subMessages = [
@@ -423,32 +591,57 @@ async function runSubTask(input, options, agentTypes) {
             onThinkingDelta: (text) => options.onThinkingDelta?.(text),
             onThinkingProgress: (tok) => options.onThinkingProgress?.(tok),
         });
-        // The sub-agent stopped because it hit the stall timeout (not because it
-        // finished or the parent aborted) — report this distinctly so the model
-        // (and the user, via the tool_result) understands WHY it got cut short,
-        // instead of silently receiving whatever partial text happened to exist.
+        // ── Stall timeout: SALVAGE, don't discard ────────────────────────────────
+        //
+        // The sub-agent hit its wall-clock cap (rather than finishing, or the parent
+        // aborting). This used to return ONLY an error string — throwing away
+        // everything the sub-agent had produced in up to ten minutes of work. The
+        // tokens were billed in full either way, and the parent model, told merely
+        // that "it stalled", would routinely re-run the identical work from scratch.
+        //
+        // The timeout still has to be reported unmistakably (the parent must not
+        // mistake a truncated run for a complete answer), but it is reported ALONGSIDE
+        // whatever was actually accomplished, not instead of it. `preferLast: false`
+        // because a killed sub-agent rarely has a closing summary — its useful output
+        // is spread across the assistant turns it did manage to produce.
         if (subAbort.aborted && !options.abortSignal?.aborted) {
-            return { error: `Sub-task stalled and was stopped after ${Math.round(SUBTASK_TIMEOUT_MS / 60000)} minutes with no completion. Consider breaking it into smaller sub-tasks or investigating what it may have been stuck on (a hung command, an unresponsive MCP/tool call, or a very large scope).` };
-        }
-        // Extract final assistant text as the task output
-        const lastAssistant = [...result].reverse().find((m) => m.role === 'assistant');
-        let text = (lastAssistant?.content ?? [])
-            .filter((b) => b.type === 'text')
-            .map((b) => b.text)
-            .join('')
-            .trim();
-        // Cap the sub-agent's returned text so a verbose sub-task (e.g. "list every
-        // usage") can't blow up the PARENT's context in a single tool_result. Keep
-        // the head + tail — the conclusion is usually at the end.
-        const SUBTASK_MAX = 48000; // chars (~12k tokens)
-        if (text.length > SUBTASK_MAX) {
-            const head = text.slice(0, Math.floor(SUBTASK_MAX * 0.6));
-            const tail = text.slice(text.length - Math.floor(SUBTASK_MAX * 0.4));
-            text = `${head}\n\n[… sub-task output truncated (${text.length} chars) — kept the beginning and end …]\n\n${tail}`;
+            const mins = Math.round(SUBTASK_TIMEOUT_MS / 60000);
+            const partial = capSubTaskText(extractSubTaskText(result, false));
+            const progress = summariseSubTaskProgress(result);
+            const sections = [
+                `Sub-task STOPPED after ${mins} minutes without completing — treat the following as PARTIAL, unverified work, not a finished answer.`,
+                progress,
+                partial ? `Partial output before it was stopped:\n\n${partial}` : '',
+                'Do NOT simply re-run the same sub-task: build on what is above, or split the remaining work into smaller, more focused sub-tasks.',
+            ].filter(Boolean);
+            // Returned as `error` (not `output`) on purpose: the loop's ledger counts an
+            // errored call as a non-effect, which is right — nothing here is verified —
+            // and the STALL_LIMIT runaway guard must still see repeated timeouts as
+            // failures so a permanently stuck sub-task can't loop forever.
+            return { error: sections.join('\n\n') };
         }
+        // Normal completion: the final assistant message is the sub-agent's answer.
+        const text = capSubTaskText(extractSubTaskText(result, true));
         return { output: text || '(sub-task completed with no text output)' };
     }
     catch (err) {
+        // Same salvage rule as the timeout path above, for the other way a sub-agent
+        // dies: runAgentLoop throws AgentTurnError when its stream fails, and that
+        // error CARRIES the history completed up to the failure precisely so callers
+        // don't lose it (see types.ts). Discarding it here — as this catch used to —
+        // reproduced the exact waste that class was written to prevent, one level down.
+        const salvaged = (0, types_1.salvageHistory)(err);
+        if (salvaged) {
+            const partial = capSubTaskText(extractSubTaskText(salvaged, false));
+            const progress = summariseSubTaskProgress(salvaged);
+            const sections = [
+                `Sub-task FAILED before completing: ${err.message}`,
+                progress,
+                partial ? `Partial output before the failure:\n\n${partial}` : '',
+                'Treat the above as PARTIAL, unverified work. Build on it rather than re-running the whole sub-task.',
+            ].filter(Boolean);
+            return { error: sections.join('\n\n') };
+        }
         return { error: `Sub-task failed: ${err.message}` };
     }
     finally {
@@ -569,6 +762,56 @@ function resolveVerificationNudge(rawSettings) {
 }
 /** Tools that mutate the filesystem — used by the verification nudge (GAP D). */
 exports.WRITE_TOOL_NAMES = new Set(['write_file', 'edit_file', 'multi_edit', 'delete_file', 'move_file', 'copy_file', 'notebook_edit']);
+/**
+ * May an agent restricted to `testFilesOnly` perform this tool call?
+ *
+ * A tool allowlist is all-or-nothing per tool: granting `edit_file` grants it for
+ * every path in the repo. The `test-writer` agent needs write access to produce
+ * tests, but must NOT be able to "fix" production source so a failing test goes
+ * green — the single most common way a test-writing agent destroys the signal it
+ * was asked to create. Its prompt says so; this makes it a refusal rather than a
+ * request.
+ *
+ * Pure + exported so the rules are testable directly, without running a real
+ * sub-agent.
+ *
+ * KNOWN LIMIT, stated rather than hidden: this gates the file TOOLS, not `bash`.
+ * A determined model could still write source via `bash: echo ... > src/x.ts`.
+ * Closing that means parsing shell redirection, which is not reliably doable — so
+ * this is a strong guardrail against the realistic failure mode, not a sandbox.
+ * Real isolation is the sandbox config (tools/sandbox.ts), a separate mechanism.
+ */
+function allowsTestOnlyWrite(tool, input) {
+    // Non-write tools are unaffected: reading, searching and running tests are all
+    // essential to writing a test.
+    //
+    // WRITE_TOOL_NAMES deliberately excludes `create_directory`: isTestFile matches
+    // FILE paths, so a legitimate `create_directory('test/helpers')` would be
+    // refused and the agent could not scaffold the tree it needs — while an empty
+    // directory cannot damage production code, and files placed in it are still
+    // checked individually.
+    if (!exports.WRITE_TOOL_NAMES.has(tool))
+        return true;
+    // EVERY path the call could affect must be a test file, not just `path`:
+    // move_file takes {source, dest} and copy_file {source, destination}, so
+    // checking `path` alone would let `move_file src/index.ts -> /tmp/x` through and
+    // remove production code by relocating it.
+    //
+    // `source` is skipped for notebook_edit specifically, where it is the CELL
+    // CONTENT rather than a path — treating a blob of code as a path would refuse
+    // every legitimate notebook edit.
+    const pathKeys = tool === 'notebook_edit'
+        ? ['path']
+        : ['path', 'source', 'dest', 'destination'];
+    const candidates = pathKeys
+        .map((k) => input?.[k])
+        .filter((v) => typeof v === 'string' && v.length > 0);
+    // An unrecognised write shape (no path-like argument at all) is refused rather
+    // than allowed through, so a future tool cannot silently become a hole here.
+    if (candidates.length === 0)
+        return false;
+    return candidates.every((p) => (0, testIntegrity_1.isTestFile)(p));
+}
 /** Heuristic: does a bash command look like it's running tests/build/lint/typecheck? (GAP D) */
 exports.VERIFY_CMD_RE = /\b(npm|yarn|pnpm)\s+(run\s+)?(test|build|lint|typecheck|tsc)\b|\bpytest\b|\bgo\s+(test|vet|build)\b|\btsc\b|\beslint\b|\bcargo\s+(test|build|check)\b/i;
 /**
@@ -1515,7 +1758,26 @@ async function runAgentLoop(initialMessages, options) {
                     result = { error: 'Permission denied by user' };
                 }
                 else if (name === 'task') {
-                    result = await runSubTask(input, options, agentTypes);
+                    // Gated so a burst of `task` blocks in one message becomes a QUEUE
+                    // rather than N concurrent agent loops (see MAX_CONCURRENT_SUBTASKS).
+                    //
+                    // The gate wraps the CALL, not the inside of runSubTask, and that
+                    // placement is the whole trick: runSubTask arms its own 10-minute stall
+                    // timeout as its first act, so acquiring the slot inside it would start
+                    // that clock while the sub-task was still sitting in the queue. A
+                    // sub-task queued behind three long-running siblings could then be
+                    // "stopped for stalling" having never executed a single step.
+                    //
+                    // Only TOP-LEVEL fan-out is gated (`depth === 0`) — a deliberate
+                    // deadlock guard, kept even though MAX_TASK_DEPTH currently makes a
+                    // nested spawn impossible anyway. A nested spawn would request a slot
+                    // while its parent still holds one; if every slot were held by a parent
+                    // waiting on a child that can never be scheduled, the run would wedge
+                    // permanently. Keeping the limiter acyclic (a holder never re-enters it)
+                    // means raising MAX_TASK_DEPTH later can't silently reintroduce that.
+                    result = depth === 0
+                        ? await _subTaskLimit(() => runSubTask(input, options, agentTypes))
+                        : await runSubTask(input, options, agentTypes);
                 }
                 else {
                     const pre = runToolHooks(hooks.PreToolUse, 'PreToolUse', name, input, options.workDir);

package/dist/agent/securityLint.d.ts

@@ -0,0 +1,27 @@
+export interface SecurityFinding {
+    /** Machine-readable class, e.g. 'hardcoded-secret'. */
+    kind: string;
+    /** One-line explanation aimed at the model, phrased as what to do. */
+    message: string;
+    /** 1-based line number within the written content. */
+    line: number;
+    /** The offending line, truncated and with any secret value redacted. */
+    sample: string;
+}
+/**
+ * Scan file content for flagrant security problems.
+ *
+ * Returns at most `max` findings (default 5) — enough to be useful, few enough
+ * that the note appended to a tool result stays readable and cheap.
+ */
+export declare function checkSecurity(content: string, max?: number): SecurityFinding[];
+/**
+ * Render findings as a note to append to a successful write's tool result.
+ *
+ * Phrased as a review comment rather than an error: the write HAS happened, and
+ * the model is being asked to look again. Deliberately explicit that it may be a
+ * false positive — otherwise the model tends to "fix" flagged-but-correct code,
+ * which is its own kind of damage.
+ */
+export declare function securityNoteText(findings: SecurityFinding[]): string;
+//# sourceMappingURL=securityLint.d.ts.map

package/dist/agent/securityLint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityLint.d.ts","sourceRoot":"","sources":["../../src/agent/securityLint.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,eAAe;IAC9B,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;CAChB;AA6GD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,SAAI,GAAG,eAAe,EAAE,CA6CzE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,CAepE"}

package/dist/agent/securityLint.js

@@ -0,0 +1,195 @@
+"use strict";
+// ─── Inline security lint ─────────────────────────────────────────────────────
+//
+// The gap this closes: six checks already run automatically on every write —
+// editCompleteness, crossFile, testIntegrity, claimEvidence, flaky, destructive —
+// and not one of them is about security. For an agent that WRITES production code,
+// nothing stopped it committing a hardcoded credential, an `eval` over
+// user-controlled input, or a SQL string built by concatenation. The only security
+// review available was an agent the user had to know to ask for.
+//
+// DESIGN: WARN, NEVER BLOCK.
+//
+// This runs on every single write, so a false positive is expensive — it would
+// train the model (and the user) to ignore the channel, or worse, stall a
+// legitimate edit. `editCompleteness` can afford to refuse outright because
+// "// ... rest unchanged" is unambiguous; "this looks like SQL injection" is not.
+// So findings are appended to the tool RESULT as a note the model sees and can act
+// on, and the write still succeeds.
+//
+// Consequently every pattern here is tuned for PRECISION over recall. A check that
+// fires on ordinary code was removed rather than loosened. Deep analysis is the
+// `security-auditor` agent's job; this only catches the flagrant cases at the
+// moment they are written.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkSecurity = checkSecurity;
+exports.securityNoteText = securityNoteText;
+/** Max characters of the offending line to echo back. */
+const SAMPLE_MAX = 160;
+/**
+ * Redact anything that looks like a literal secret value before echoing a line.
+ *
+ * The whole point of flagging a hardcoded credential is to get it removed — so
+ * this must not copy the value into the transcript (and from there into logs, or
+ * the next request's context) on the way to reporting it.
+ */
+function redact(line) {
+    const masked = line
+        // key = "value" / key: 'value' → keep the key, mask the value
+        .replace(/(['"`]?[\w.-]*(?:secret|password|passwd|token|api[_-]?key|apikey|auth|credential|private[_-]?key)[\w.-]*['"`]?\s*[:=]\s*)(['"`])([^'"`]{4,})\2/gi, (_m, head, q) => `${head}${q}[REDACTED]${q}`)
+        // Bare high-entropy provider tokens appearing anywhere on the line
+        .replace(/\b(sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|AKIA[0-9A-Z]{16}|xox[baprs]-[A-Za-z0-9-]{10,})\b/g, '[REDACTED]');
+    return masked.length > SAMPLE_MAX ? masked.slice(0, SAMPLE_MAX) + '…' : masked;
+}
+/** Strip string/comment noise that causes false positives, keeping length stable. */
+function isLikelyCommentLine(line) {
+    return /^\s*(\/\/|\*|#|--|<!--)/.test(line);
+}
+const RULES = [
+    // ── Hardcoded credentials ───────────────────────────────────────────────────
+    // Provider-prefixed tokens are near-zero false positive: the prefixes are
+    // registered formats, not something that occurs naturally in source. Checked
+    // inside comments too — a key commented out is still a committed key.
+    {
+        kind: 'hardcoded-secret',
+        re: /\b(sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|AKIA[0-9A-Z]{16}|xox[baprs]-[A-Za-z0-9-]{10,}|AIza[0-9A-Za-z_-]{30,})\b/,
+        message: 'Looks like a real API key/token committed to source. Move it to an environment variable and rotate the exposed key.',
+        includeComments: true,
+    },
+    // NOTE: the `private-key` check is NOT here — it needs to span multiple lines
+    // (BEGIN header on one, base64 body on the next), which this per-line loop
+    // cannot express. It runs separately in checkSecurity below.
+    {
+        kind: 'hardcoded-password',
+        // An ASSIGNMENT of a credential-ish name to a non-trivial literal.
+        //
+        // Tightened after measuring against the real backend, where the looser version
+        // fired on `missingSecret:'FIREBASE_TOKEN'` — code that NAMES a secret in an
+        // error message, the opposite of leaking one. So a value that is itself just a
+        // SCREAMING_SNAKE identifier (an env-var name) is excluded, along with the
+        // usual placeholder vocabulary. The value must also look like actual secret
+        // material: mixed case or digits, not a lone lowercase word.
+        re: /(?:password|passwd|secret|api[_-]?key|apikey|access[_-]?token)['"`]?\s*[:=]\s*['"`](?![A-Z0-9_]+['"`])(?!.*(?:\$\{|process\.env|os\.environ|example|changeme|placeholder|redacted|xxx|test|dummy|fake|sample|your[_-]?|<|\*{3}))(?=[^'"`]*[0-9A-Z])[^'"`\s]{10,}['"`]/,
+        message: 'Hardcoded credential literal. Read it from the environment/secret store instead, and rotate the exposed value.',
+        includeComments: true,
+    },
+    // ── Injection ───────────────────────────────────────────────────────────────
+    {
+        kind: 'dynamic-eval',
+        // The negative lookbehind for `.` is what makes this usable: `redisClient.eval`
+        // (a Redis Lua script), `page.eval` (Playwright), `vm.eval` and friends are
+        // METHOD calls on an object and have nothing to do with JavaScript's global
+        // eval. Without it, the real backend's Redis idempotency script was flagged.
+        // Only a bare `eval(` / `new Function(` with a non-literal argument counts.
+        re: /(?<![.\w$])(?:eval|new\s+Function)\s*\(\s*(?!['"`][^'"`]*['"`]\s*\))[^)]*[a-zA-Z_$][\w$]*/,
+        message: 'eval / new Function on a non-literal value executes arbitrary code if that value is ever user-controlled. Use an explicit parser or a lookup table.',
+    },
+    {
+        kind: 'sql-injection',
+        // Only fires when the interpolated expression is plausibly REQUEST-DERIVED.
+        //
+        // The obvious pattern — any `${...}` inside a SQL string — was measured
+        // against the real backend and flagged 15 of 183 files, essentially all of
+        // them safe and idiomatic: `${sets.join(', ')}` for a dynamic UPDATE, `${field}`
+        // for a server-chosen column, `${CONSUMPTION}` for a module constant. At that
+        // hit rate the warning is pure noise, and noise is worse than silence because
+        // it teaches everyone to skip the channel.
+        //
+        // So the interpolation must name something that plausibly came from the
+        // outside: req/request/params/query/body/input/user/args, or a bare
+        // `'...' + ident`. This trades recall for precision on purpose — thorough SQL
+        // review is the security-auditor agent's job, not an inline regex's.
+        re: /\b(?:SELECT|INSERT\s+INTO|UPDATE|DELETE\s+FROM)\b[^;'"`]{0,160}(?:\$\{\s*(?:req|request|params?|query|body|input|user|args|ctx)\b|['"`]\s*\+\s*(?:req|request|params?|query|body|input|user|args|ctx)\b|%\s*\(\s*(?:request|params?|query|body|input|user)\b)/i,
+        message: 'SQL built by interpolating a request-derived value. Use a parameterised query ($1 / ? placeholders) — this is the classic injection sink.',
+    },
+    {
+        kind: 'command-injection',
+        // Shell execution with an interpolated or concatenated argument.
+        re: /\b(?:exec|execSync|spawnSync?|system|popen|os\.system|subprocess\.(?:call|run|Popen))\s*\(\s*(?:[`'"][^`'"]*(?:\$\{|['"]\s*\+)|[a-zA-Z_$][\w$]*\s*\+)/,
+        message: 'Shell command built from a variable. Pass arguments as an array (no shell), or validate against an allowlist — a value containing ; or $() becomes command execution.',
+    },
+    // ── Transport / verification ────────────────────────────────────────────────
+    {
+        kind: 'tls-verification-disabled',
+        re: /(?:rejectUnauthorized\s*:\s*false|NODE_TLS_REJECT_UNAUTHORIZED\s*=\s*['"]?0|verify\s*=\s*False|InsecureSkipVerify\s*:\s*true)/,
+        message: 'TLS certificate verification is disabled, which removes protection against man-in-the-middle attacks. Trust a specific CA instead if the cert is self-signed.',
+    },
+];
+/**
+ * Scan file content for flagrant security problems.
+ *
+ * Returns at most `max` findings (default 5) — enough to be useful, few enough
+ * that the note appended to a tool result stays readable and cheap.
+ */
+function checkSecurity(content, max = 5) {
+    if (!content)
+        return [];
+    const findings = [];
+    const lines = content.split(/\r?\n/);
+    // Private keys are matched across lines, unlike every other rule.
+    //
+    // A real PEM block is inherently multi-line: the BEGIN header sits on one line
+    // and the base64 body on the next. Requiring both on ONE line (which the
+    // line-by-line loop below does) meant the single highest-severity finding here
+    // only fired for keys embedded in a "\n"-escaped string literal, and missed the
+    // far more common case of a key pasted in verbatim.
+    const pemIdx = lines.findIndex((l) => /-----BEGIN\s+(?:RSA|EC|DSA|OPENSSH|PGP)?\s*PRIVATE KEY-----/.test(l));
+    if (pemIdx !== -1) {
+        // Require actual key material nearby, so a bare header — placeholder text in a
+        // config UI, documentation, a PEM parser — does not trip it.
+        const following = lines.slice(pemIdx, pemIdx + 4).join('\n');
+        if (/[A-Za-z0-9+/]{40,}/.test(following.replace(/-----[^-]+-----/g, ''))) {
+            findings.push({
+                kind: 'private-key',
+                message: 'A private key with real key material is being written into source. Store it outside the repo (secret manager / env var) and rotate it.',
+                line: pemIdx + 1,
+                sample: '-----BEGIN PRIVATE KEY----- [REDACTED]',
+            });
+        }
+    }
+    // One finding per (kind, line) at most, and one finding per kind overall —
+    // a file with fifty interpolated queries should say "SQL injection" once, not
+    // fill the model's context with fifty copies of the same advice.
+    const seenKinds = new Set();
+    for (let i = 0; i < lines.length && findings.length < max; i++) {
+        const line = lines[i];
+        if (!line || line.length > 2000)
+            continue; // minified/bundled — not hand-written source
+        const commentish = isLikelyCommentLine(line);
+        for (const rule of RULES) {
+            if (seenKinds.has(rule.kind))
+                continue;
+            if (commentish && !rule.includeComments)
+                continue;
+            if (!rule.re.test(line))
+                continue;
+            seenKinds.add(rule.kind);
+            findings.push({ kind: rule.kind, message: rule.message, line: i + 1, sample: redact(line.trim()) });
+            break; // at most one rule per line
+        }
+    }
+    return findings;
+}
+/**
+ * Render findings as a note to append to a successful write's tool result.
+ *
+ * Phrased as a review comment rather than an error: the write HAS happened, and
+ * the model is being asked to look again. Deliberately explicit that it may be a
+ * false positive — otherwise the model tends to "fix" flagged-but-correct code,
+ * which is its own kind of damage.
+ */
+function securityNoteText(findings) {
+    // Opt-out, mirroring NEXRALL_ALLOW_ELIDED_WRITE. Someone working in a codebase
+    // that trips a rule constantly (a SQL-builder library, a crypto implementation,
+    // a test-fixture directory full of fake keys) needs a way to silence this
+    // without disabling the write path itself.
+    if (process.env.NEXRALL_SECURITY_LINT === 'off')
+        return '';
+    if (!findings.length)
+        return '';
+    const lines = findings.map((f) => `  • line ${f.line} [${f.kind}]: ${f.message}\n    ${f.sample}`);
+    return (`\n\n⚠ SECURITY REVIEW (${findings.length} finding${findings.length > 1 ? 's' : ''}) — the write succeeded; check these before moving on:\n` +
+        lines.join('\n') +
+        `\nIf a finding is a false positive (test fixture, placeholder, intentionally dynamic), say so and continue — do NOT rewrite correct code to silence it.`);
+}
+//# sourceMappingURL=securityLint.js.map

package/dist/api/client.d.ts

@@ -76,6 +76,18 @@ export declare function streamChat(messages: Message[], options: StreamChatOptio
  * bounds the cost if this request never lands.
  */
 export declare function cancelTurn(turnId: string): Promise<void>;
+/**
+ * Revoke the stored refresh token server-side.
+ *
+ * Deleting the local config alone is NOT a logout once refresh tokens exist: the
+ * token stays valid for its full 60-day life and can keep minting access tokens
+ * for anyone who recovered it (a synced dotfile, a backup, a shared machine).
+ * The backend already exposes /api/auth/logout for exactly this.
+ *
+ * Best-effort and never throws — a failed revoke must not stop the local
+ * credentials from being cleared, which is the part the user can see.
+ */
+export declare function revokeRefreshToken(): Promise<void>;
 export declare function getBalance(): Promise<number>;
 export declare function exchangeVscodeCode(code: string): Promise<AuthConfig>;
 export declare function login(email: string, password: string): Promise<AuthConfig>;

package/dist/api/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAA8B,UAAU,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAiErH,eAAO,MAAM,QAAQ,QAAmB,CAAC;AAIzC;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,SAAS;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EAC5D,OAAO,EAAE,CAAC,EAAE,EACZ,UAAU,EAAE,KAAK,CAAC;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,IAAI,GAAG,SAAS,GACtD,CAAC,EAAE,CAeL;AAeD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IACnC,oFAAoF;IACpF,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IACjG,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6IAA6I;IAC7I,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;;;;;;OAeG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AAiDD,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,CAAC,CAAC,EAAE,QAAQ,KAAK,IAAI,GAC7B,OAAO,CAAC,OAAO,CAAC,CAu7BlB;AAID;;;;;;;;;;;GAWG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAU9D;AAID,wBAAsB,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,CAalD;AAID,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAgB1E;AAID,wBAAsB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAkBhF"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAA8B,UAAU,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAiErH,eAAO,MAAM,QAAQ,QAAmB,CAAC;AAIzC;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,SAAS;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EAC5D,OAAO,EAAE,CAAC,EAAE,EACZ,UAAU,EAAE,KAAK,CAAC;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,IAAI,GAAG,SAAS,GACtD,CAAC,EAAE,CAeL;AAiGD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IACnC,oFAAoF;IACpF,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IACjG,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6IAA6I;IAC7I,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;;;;;;OAeG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AAiDD,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,CAAC,CAAC,EAAE,QAAQ,KAAK,IAAI,GAC7B,OAAO,CAAC,OAAO,CAAC,CA6jClB;AAID;;;;;;;;;;;GAWG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAU9D;AAID;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAYxD;AAID,wBAAsB,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,CA0BlD;AAID,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA+B1E;AAID,wBAAsB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA0BhF"}