@nexrall/code-core 1.4.23 → 1.4.24

package/dist/agent/agentTypes.d.ts

@@ -8,10 +8,43 @@ export interface AgentType {
     /** System instructions (the markdown body below the frontmatter). */
     prompt: string;
     source: 'project' | 'global' | 'builtin' | 'plugin';
+    /**
+     * When true, this agent's write tools may only target TEST files.
+     *
+     * Needed because a tool allowlist is all-or-nothing per tool: granting
+     * `edit_file` grants it for every path. The `test-writer` agent must be able to
+     * write tests while being unable to "fix" production source to make a test
+     * pass — the single most common way a test-writing agent destroys signal — and
+     * a prompt instruction alone cannot guarantee that. Enforced in loop.ts's
+     * permission gate, where it is a real refusal rather than a request.
+     */
+    testFilesOnly?: boolean;
 }
-/** Discover all custom agent types (project overrides global overrides builtin). */
+/**
+ * Discover all agent types. Precedence: project > global > plugin > builtin.
+ *
+ * Results are returned in a STABLE order (builtins in declared order, then
+ * user-supplied ones alphabetically) rather than in discovery order. The
+ * system-prompt catalogue is built from this, and a set that reshuffles between
+ * runs would silently bust the prompt cache on the block it lives in — filesystem
+ * readdir order is not guaranteed to be stable across machines or platforms.
+ */
 export declare function loadAgentTypes(workDir: string): AgentType[];
-/** A compact catalogue injected into the system prompt so the model can pick a type. */
+/**
+ * One line per agent for the system prompt's <available_subagents> block.
+ *
+ * Reports each agent's CAPABILITY CLASS rather than enumerating its allowlist.
+ * The full lists (~15 tool names each) went into every single request while
+ * telling the model nothing it needs in order to choose: what matters when
+ * delegating is "can this one edit files?" and "what is it for?", not whether
+ * `get_hover` happens to be included. With six builtins the verbatim lists cost
+ * ~670 tokens per request, most of it near-identical boilerplate that also
+ * weakens the signal it was meant to carry.
+ *
+ * The per-agent description already states its own restrictions in prose, and the
+ * allowlist is enforced at the permission gate regardless of what is advertised
+ * here — so this is purely a summary, never the mechanism.
+ */
 export declare function summariseAgents(types: AgentType[]): string;
 export declare function findAgentType(types: AgentType[], name: string | undefined): AgentType | undefined;
 //# sourceMappingURL=agentTypes.d.ts.map

package/dist/agent/agentTypes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agentTypes.d.ts","sourceRoot":"","sources":["../../src/agent/agentTypes.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,iDAAiD;IACjD,KAAK,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;IAClC,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;CACrD;AAoFD,oFAAoF;AACpF,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,CAS3D;AAED,wFAAwF;AACxF,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,CAQ1D;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAIjG"}
+{"version":3,"file":"agentTypes.d.ts","sourceRoot":"","sources":["../../src/agent/agentTypes.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,iDAAiD;IACjD,KAAK,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;IAClC,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;IACpD;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AA4RD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,CAmB3D;AACD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,CAY1D;AAQD,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAIjG"}

package/dist/agent/agentTypes.js

@@ -43,11 +43,37 @@ const index_1 = require("../plugins/index");
 // ── Built-in agent types ──────────────────────────────────────────────────────
 // Shipped defaults; lowest precedence (project > global > builtin), so a user
 // can override any of them with a same-name .nexrall/agents/<name>.md file.
+// Shared read-only tool set.
+//
+// An allowlist only ever GRANTS — a name that doesn't exist on the current client
+// is simply never offered to the model, so listing the VS Code language-server
+// tools alongside the CLI ones is safe and gives each agent the best available
+// capability on whichever client it runs.
+//
+// This exists because it was previously inlined per agent, and the one agent that
+// had it (`reviewer`) listed five VS Code-only tools, leaving it with just five
+// usable tools when run from the CLI — a silent capability gap that is very easy
+// to reintroduce by copy-pasting a list.
+const READ_ONLY_TOOLS = [
+    // Universal
+    'read_file', 'search_files', 'glob', 'list_directory', 'bash', 'bash_output',
+    'notebook_read', 'todo_write', 'todo_read',
+    // VS Code language server (ignored on the CLI)
+    'get_symbols', 'get_workspace_symbols', 'find_references', 'go_to_definition',
+    'get_hover', 'get_diagnostics',
+];
+/** Read-only + the network, for agents that must consult external sources. */
+const RESEARCH_TOOLS = [...READ_ONLY_TOOLS, 'web_search', 'fetch_url'];
+/** Read-only + the write tools, for agents that produce code. */
+const WRITE_TOOLS = [
+    ...READ_ONLY_TOOLS,
+    'write_file', 'edit_file', 'multi_edit', 'create_directory', 'move_file', 'copy_file',
+];
 const BUILTIN_AGENTS = [
     {
         name: 'reviewer',
         description: 'Read-only code reviewer — finds correctness bugs, edge cases, and security issues in a diff or file set. Cannot modify files.',
-        tools: ['read_file', 'search_files', 'glob', 'list_directory', 'bash', 'get_symbols', 'get_workspace_symbols', 'find_references', 'go_to_definition', 'get_diagnostics'],
+        tools: READ_ONLY_TOOLS,
         source: 'builtin',
         prompt: [
             'You are a meticulous senior code reviewer. You NEVER modify files — you only read, search, and report.',
@@ -64,6 +90,162 @@ const BUILTIN_AGENTS = [
             'then a final verdict (APPROVE or REQUEST CHANGES) with a one-paragraph rationale.',
         ].join('\n'),
     },
+    // Promoted from the security-audit plugin to a builtin.
+    //
+    // Leaving it plugin-only was indefensible next to `reviewer` being builtin:
+    // reviewer's own prompt already tells it to look for security issues, so
+    // security IS treated as default work — yet the specialist agent for it was
+    // invisible unless the user happened to know the plugin existed. For an agent
+    // that WRITES code, "you only get a security review if you knew to install
+    // something" is the wrong default.
+    {
+        name: 'security-auditor',
+        description: 'Read-only security auditor — hunts injection, authz, secrets, and validation flaws in a path or diff. Cannot modify files.',
+        tools: READ_ONLY_TOOLS,
+        model: 'pro',
+        source: 'builtin',
+        prompt: [
+            'You are a security auditor. You find real, exploitable flaws — not style issues.',
+            '',
+            'Method:',
+            '1. Map the attack surface FIRST: entry points (HTTP routes, message handlers, CLI args, file/network',
+            '   input, deserialization), then trace user-controlled data inward to where it is used.',
+            '2. For each finding: file:line, the flaw class, a one-line exploit scenario, and the concrete fix.',
+            '3. Grade severity honestly: Critical = remote compromise or data breach; High = auth bypass/IDOR;',
+            '   Medium = needs unusual preconditions; Low = hardening.',
+            '',
+            'Classes worth the most attention, in order: injection (SQL/command/template/prototype), broken',
+            'authz (missing ownership checks, IDOR, trusting client-supplied ids), secrets committed to source,',
+            'path traversal, SSRF, unsafe deserialization, missing rate limits on expensive or auth endpoints,',
+            'and crypto misuse (hand-rolled comparison, predictable randomness).',
+            '',
+            'Hard rules:',
+            '- READ-ONLY: never modify, create or delete files. bash only for read-only inspection.',
+            '- NEVER print a discovered secret\'s value. Report its location and advise rotation.',
+            '- Distinguish EXPLOITABLE from theoretical, and say which one each finding is.',
+            '- "No issues found in scope X" is a valid, useful result. Do not pad the report to look thorough.',
+        ].join('\n'),
+    },
+    // The gap Claude Code fills with its built-in `Explore`: read-heavy codebase
+    // search that would otherwise flood the parent's context. Defaults to the
+    // cheapest model on purpose — "find every caller of X" has no need of a
+    // frontier model, and this is the agent most likely to be spawned in bulk.
+    {
+        name: 'explorer',
+        description: 'Fast read-only codebase explorer — locates files, symbols, and call sites and reports concise findings. Use to keep bulk searching out of the main context. Cannot modify files.',
+        tools: READ_ONLY_TOOLS,
+        model: 'turbo',
+        source: 'builtin',
+        prompt: [
+            'You map code. You NEVER modify anything.',
+            '',
+            'Method:',
+            '1. Prefer structural search over text search where available (get_workspace_symbols, find_references,',
+            '   go_to_definition); fall back to search_files/glob otherwise.',
+            '2. Read only the sections you need — use read_file with offset/limit on large files instead of',
+            '   pulling in thousands of lines.',
+            '3. Follow the real call graph rather than guessing from names.',
+            '',
+            'Your ONLY output is a compact report: the file:line locations that matter, how they relate, and the',
+            'direct answer to the question you were given. This exists to keep bulk search OUT of the parent\'s',
+            'context, so do not paste large file contents back — cite locations and summarise. Say plainly when',
+            'something does not exist; a confident wrong answer is far worse than "not found".',
+        ].join('\n'),
+    },
+    // Matches Claude Code's built-in `Plan`: research a change and return a
+    // strategy, deliberately WITHOUT write access so "make a plan" can never
+    // quietly become "start editing".
+    {
+        name: 'planner',
+        description: 'Read-only planning agent — researches a change and returns a concrete step-by-step implementation plan with risks and affected files. Cannot modify files.',
+        tools: RESEARCH_TOOLS,
+        model: 'pro',
+        source: 'builtin',
+        prompt: [
+            'You produce implementation plans. You NEVER modify files — planning and doing are separate steps,',
+            'and this agent exists so "plan it" cannot silently turn into "change it".',
+            '',
+            'Method:',
+            '1. Read the actual code before proposing anything. No plan may rest on an assumed API shape.',
+            '2. Find every affected call site (find_references / search_files) and list them.',
+            '3. Order the steps so the tree stays working after each one — types, then implementation, then',
+            '   tests, then exports/registration.',
+            '',
+            'Output:',
+            '- Goal, in one sentence.',
+            '- Numbered steps, each with the exact files touched and what changes in them.',
+            '- Risks + the specific thing that could break, and how it would be detected.',
+            '- How to verify (the exact test/build command for THIS project, taken from package.json/Makefile).',
+            '- Anything genuinely ambiguous, stated as an open question rather than a silent assumption.',
+        ].join('\n'),
+    },
+    // Promoted from the test-gen plugin. Needs write access — it produces test
+    // files — but is deliberately forbidden from touching source, because "make the
+    // tests pass" is the single most common way an agent destroys signal.
+    {
+        name: 'test-writer',
+        description: 'Writes tests that follow the project\'s existing conventions. May create/edit TEST files only — never production source.',
+        tools: WRITE_TOOLS,
+        // Enforced, not merely requested: the permission gate refuses a write whose
+        // path is not a test file. Without this the allowlist would grant edit_file
+        // for every path and the rule below would be a suggestion the model is free
+        // to rationalise its way past.
+        testFilesOnly: true,
+        source: 'builtin',
+        prompt: [
+            'You write tests. You may create and edit TEST files only.',
+            '',
+            'Hard rules — these are the ways test-writing agents destroy value, so they are non-negotiable:',
+            '- NEVER modify production source to make a test pass. If the code looks wrong, REPORT it and stop.',
+            '- NEVER weaken, delete or skip an existing assertion or test.',
+            '- A test that cannot fail is worse than no test. Every test must be able to fail for one clear reason.',
+            '',
+            'Method:',
+            '1. Read the existing tests FIRST and copy their conventions exactly — runner, file naming, layout,',
+            '   assertion style, fixture/helper patterns. Never introduce a new framework.',
+            '2. Test observable behaviour and the contract, not private internals.',
+            '3. Cover the boring-but-real cases: empty input, null/undefined, unicode and non-BMP characters,',
+            '   boundaries, error paths, concurrency where it applies.',
+            '4. No sleeps or wall-clock dependence — those produce the flaky tests that get deleted later.',
+            '5. RUN the tests you wrote and report the real output. Never claim a test passes without running it.',
+        ].join('\n'),
+    },
+    // The DevOps gap — answered with a READ-ONLY advisor, not an operator.
+    //
+    // A "DevOps agent" with write/apply access is a genuinely different risk class
+    // from the others here: its mistakes are `kubectl delete`, a bad `terraform
+    // apply`, a broken deploy pipeline — often not revertible and affecting
+    // production rather than a working tree. So this one diagnoses and proposes a
+    // diff; a human applies it. That asymmetry is the whole design.
+    {
+        name: 'devops-advisor',
+        description: 'Read-only CI/CD, container, and infrastructure advisor — diagnoses pipelines, Dockerfiles, and k8s manifests and proposes concrete fixes as a diff. Never applies changes.',
+        tools: RESEARCH_TOOLS,
+        model: 'pro',
+        source: 'builtin',
+        prompt: [
+            'You are an infrastructure and delivery advisor. You DIAGNOSE and PROPOSE. You never apply changes.',
+            '',
+            'Hard rules:',
+            '- READ-ONLY, and stricter than the other read-only agents: bash is for INSPECTION only',
+            '  (git log/diff, cat, grep, `kubectl get/describe`, `docker images`, `terraform plan`).',
+            '  NEVER run anything that mutates infrastructure — no apply/delete/scale/rollout/restart/push,',
+            '  no `terraform apply`, no `helm upgrade`. If a fix needs such a command, WRITE IT OUT for a human.',
+            '- Never print secret values from env files, k8s Secrets or CI variables. Reference them by name.',
+            '',
+            'Method:',
+            '1. Read what actually exists — workflow files, Dockerfiles, manifests, kustomize overlays, the',
+            '   deploy scripts — before drawing any conclusion. Never reason from what a stack "usually" looks like.',
+            '2. Follow the real path a change takes to production, and name the step that is broken or missing.',
+            '3. Check the failure modes that bite hardest: CI path filters that skip files a workload actually',
+            '   needs, image tags that do not match what is deployed, missing health probes, absent resource',
+            '   limits, secrets baked into images, ports/timeouts inconsistent between proxy and app, and',
+            '   migrations that must run before the new image is live.',
+            '',
+            'Output: the diagnosis, the evidence (file:line or command output), the proposed change as a diff or',
+            'exact file content, and the command a human should run to apply and verify it.',
+        ].join('\n'),
+    },
 ];
 function parseFrontmatter(raw) {
     const m = /^\s*---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/.exec(raw);
@@ -81,6 +263,10 @@ function parseModel(v) {
     const s = (v ?? '').toLowerCase();
     return s === 'turbo' || s === 'pro' || s === 'ultra' ? s : undefined;
 }
+/** Parse a frontmatter boolean, accepting the usual truthy spellings. */
+function parseBool(v) {
+    return /^(true|yes|1|on)$/i.test((v ?? '').trim());
+}
 function parseToolList(v) {
     if (!v)
         return undefined;
@@ -116,6 +302,11 @@ function loadDir(dir, source, into) {
                 model: parseModel(meta.model),
                 prompt: body,
                 source,
+                // Exposed to user/plugin definitions too — `test_files_only: true` (or
+                // `testFilesOnly`) lets anyone build a test-writing agent that genuinely
+                // cannot touch production source, rather than only the builtin getting
+                // that guarantee.
+                ...(parseBool(meta.test_files_only ?? meta.testfilesonly) ? { testFilesOnly: true } : {}),
             });
         }
         catch {
@@ -123,7 +314,15 @@ function loadDir(dir, source, into) {
         }
     }
 }
-/** Discover all custom agent types (project overrides global overrides builtin). */
+/**
+ * Discover all agent types. Precedence: project > global > plugin > builtin.
+ *
+ * Results are returned in a STABLE order (builtins in declared order, then
+ * user-supplied ones alphabetically) rather than in discovery order. The
+ * system-prompt catalogue is built from this, and a set that reshuffles between
+ * runs would silently bust the prompt cache on the block it lives in — filesystem
+ * readdir order is not guaranteed to be stable across machines or platforms.
+ */
 function loadAgentTypes(workDir) {
     const out = new Map();
     loadDir(path.join(workDir, '.nexrall', 'agents'), 'project', out);
@@ -134,19 +333,55 @@ function loadAgentTypes(workDir) {
         if (!out.has(agent.name))
             out.set(agent.name, agent);
     }
-    return [...out.values()];
+    // Builtins first in their declared order (the common, cache-friendly case), then
+    // everything user-supplied alphabetically.
+    const builtinOrder = new Map(BUILTIN_AGENTS.map((a, i) => [a.name, i]));
+    return [...out.values()].sort((a, b) => {
+        const ai = builtinOrder.get(a.name);
+        const bi = builtinOrder.get(b.name);
+        if (ai !== undefined && bi !== undefined)
+            return ai - bi;
+        if (ai !== undefined)
+            return -1;
+        if (bi !== undefined)
+            return 1;
+        return a.name.localeCompare(b.name);
+    });
 }
-/** A compact catalogue injected into the system prompt so the model can pick a type. */
+/**
+ * One line per agent for the system prompt's <available_subagents> block.
+ *
+ * Reports each agent's CAPABILITY CLASS rather than enumerating its allowlist.
+ * The full lists (~15 tool names each) went into every single request while
+ * telling the model nothing it needs in order to choose: what matters when
+ * delegating is "can this one edit files?" and "what is it for?", not whether
+ * `get_hover` happens to be included. With six builtins the verbatim lists cost
+ * ~670 tokens per request, most of it near-identical boilerplate that also
+ * weakens the signal it was meant to carry.
+ *
+ * The per-agent description already states its own restrictions in prose, and the
+ * allowlist is enforced at the permission gate regardless of what is advertised
+ * here — so this is purely a summary, never the mechanism.
+ */
 function summariseAgents(types) {
     if (!types.length)
         return '';
     return types
         .map((t) => {
-        const tools = t.tools ? ` (tools: ${t.tools.join(', ')})` : '';
-        return `- ${t.name}: ${t.description}${tools}`;
+        const canWrite = !t.tools || t.tools.some((x) => WRITE_TOOL_HINTS.has(x));
+        const access = t.testFilesOnly
+            ? 'writes TEST files only'
+            : canWrite ? 'can modify files' : 'read-only';
+        const model = t.model ? `, ${t.model} model` : '';
+        return `- ${t.name} (${access}${model}): ${t.description}`;
     })
         .join('\n');
 }
+/** Tool names that imply write access, for the summary line above. */
+const WRITE_TOOL_HINTS = new Set([
+    'write_file', 'edit_file', 'multi_edit', 'notebook_edit',
+    'delete_file', 'move_file', 'copy_file',
+]);
 function findAgentType(types, name) {
     if (!name)
         return undefined;

package/dist/agent/loop.d.ts

@@ -47,6 +47,26 @@ export declare function compactionThresholds(): {
 export declare function estimateBodyBytes(messages: Message[]): number;
 /** Tools that mutate the filesystem — used by the verification nudge (GAP D). */
 export declare const WRITE_TOOL_NAMES: Set<string>;
+/**
+ * May an agent restricted to `testFilesOnly` perform this tool call?
+ *
+ * A tool allowlist is all-or-nothing per tool: granting `edit_file` grants it for
+ * every path in the repo. The `test-writer` agent needs write access to produce
+ * tests, but must NOT be able to "fix" production source so a failing test goes
+ * green — the single most common way a test-writing agent destroys the signal it
+ * was asked to create. Its prompt says so; this makes it a refusal rather than a
+ * request.
+ *
+ * Pure + exported so the rules are testable directly, without running a real
+ * sub-agent.
+ *
+ * KNOWN LIMIT, stated rather than hidden: this gates the file TOOLS, not `bash`.
+ * A determined model could still write source via `bash: echo ... > src/x.ts`.
+ * Closing that means parsing shell redirection, which is not reliably doable — so
+ * this is a strong guardrail against the realistic failure mode, not a sandbox.
+ * Real isolation is the sandbox config (tools/sandbox.ts), a separate mechanism.
+ */
+export declare function allowsTestOnlyWrite(tool: string, input: Record<string, unknown> | undefined): boolean;
 /** Heuristic: does a bash command look like it's running tests/build/lint/typecheck? (GAP D) */
 export declare const VERIFY_CMD_RE: RegExp;
 /**

package/dist/agent/loop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loop.d.ts","sourceRoot":"","sources":["../../src/agent/loop.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,OAAO,EAMP,gBAAgB,EAChB,UAAU,EACX,MAAM,UAAU,CAAC;AAyKlB,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,MAAM,CAWR;AAkED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAgBlF;AAiLD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,UAAU,UAAO,GAAG,MAAM,CAYjF;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,SAAc,GAAG,MAAM,CAKtE;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAoBpE;AAqLD,oGAAoG;AACpG,wBAAgB,gBAAgB,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,CAE1E;AA8BD,kHAAkH;AAClH,wBAAgB,oBAAoB,IAAI;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAEzE;AAuBD,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAM7D;AAsBD,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,aAA+G,CAAC;AAC7I,gGAAgG;AAChG,eAAO,MAAM,aAAa,QAA2J,CAAC;AAEtL;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAK5E;AAUD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAwBxD;AAoBD,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3D,aAAa,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClE,qFAAqF;IACrF,aAAa,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvD;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,YAAY,IAAI,cAAc,CAE7C;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAC1B,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC1C,EAAE,EAAE,OAAO,EACX,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,IAAI,CAoDN;AAED,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CA6B5D;AAmBD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,eAAe,SAAI,GAAG,MAAM,CAgCpF;AAsKD,gFAAgF;AAChF,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAE/D;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,OAAO,EAAE,EACnB,IAAI,EAAE;IACJ,KAAK,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC,GACA,OAAO,CAAC,OAAO,CAAC,CAqElB;AAID,wBAAsB,YAAY,CAChC,eAAe,EAAE,OAAO,EAAE,EAC1B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,OAAO,EAAE,CAAC,CAquBpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAqCtE"}
+{"version":3,"file":"loop.d.ts","sourceRoot":"","sources":["../../src/agent/loop.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,OAAO,EAMP,gBAAgB,EAChB,UAAU,EACX,MAAM,UAAU,CAAC;AAyKlB,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,MAAM,CAWR;AAkED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAgBlF;AAiLD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,UAAU,UAAO,GAAG,MAAM,CAYjF;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,SAAc,GAAG,MAAM,CAKtE;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAoBpE;AAwLD,oGAAoG;AACpG,wBAAgB,gBAAgB,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,CAE1E;AA8BD,kHAAkH;AAClH,wBAAgB,oBAAoB,IAAI;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAEzE;AAuBD,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAM7D;AAsBD,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,aAA+G,CAAC;AAC7I;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,OAAO,CA8BrG;AAED,gGAAgG;AAChG,eAAO,MAAM,aAAa,QAA2J,CAAC;AAEtL;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAK5E;AAUD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAwBxD;AAoBD,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3D,aAAa,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClE,qFAAqF;IACrF,aAAa,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvD;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,YAAY,IAAI,cAAc,CAE7C;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAC1B,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC1C,EAAE,EAAE,OAAO,EACX,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,IAAI,CAoDN;AAED,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CA6B5D;AAmBD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,eAAe,SAAI,GAAG,MAAM,CAgCpF;AAsKD,gFAAgF;AAChF,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAE/D;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,OAAO,EAAE,EACnB,IAAI,EAAE;IACJ,KAAK,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC,GACA,OAAO,CAAC,OAAO,CAAC,CAqElB;AAID,wBAAsB,YAAY,CAChC,eAAe,EAAE,OAAO,EAAE,EAC1B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,OAAO,EAAE,CAAC,CAquBpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAqCtE"}

package/dist/agent/loop.js

@@ -42,6 +42,7 @@ exports.summariseSubTaskProgress = summariseSubTaskProgress;
 exports.contextWindowFor = contextWindowFor;
 exports.compactionThresholds = compactionThresholds;
 exports.estimateBodyBytes = estimateBodyBytes;
+exports.allowsTestOnlyWrite = allowsTestOnlyWrite;
 exports.findSafeCutIndex = findSafeCutIndex;
 exports.transcriptOf = transcriptOf;
 exports.createLedger = createLedger;
@@ -528,6 +529,10 @@ async function runSubTask(input, options, agentTypes) {
     const gatedPermission = async (req) => {
         if (allowed && !allowed.has(req.tool))
             return false;
+        // Path-scoped write restriction (agent.testFilesOnly) — see
+        // allowsTestOnlyWrite for the reasoning and its known limit.
+        if (agent?.testFilesOnly && !allowsTestOnlyWrite(req.tool, req.input))
+            return false;
         return options.requestPermission(req);
     };
     const subMessages = [
@@ -757,6 +762,56 @@ function resolveVerificationNudge(rawSettings) {
 }
 /** Tools that mutate the filesystem — used by the verification nudge (GAP D). */
 exports.WRITE_TOOL_NAMES = new Set(['write_file', 'edit_file', 'multi_edit', 'delete_file', 'move_file', 'copy_file', 'notebook_edit']);
+/**
+ * May an agent restricted to `testFilesOnly` perform this tool call?
+ *
+ * A tool allowlist is all-or-nothing per tool: granting `edit_file` grants it for
+ * every path in the repo. The `test-writer` agent needs write access to produce
+ * tests, but must NOT be able to "fix" production source so a failing test goes
+ * green — the single most common way a test-writing agent destroys the signal it
+ * was asked to create. Its prompt says so; this makes it a refusal rather than a
+ * request.
+ *
+ * Pure + exported so the rules are testable directly, without running a real
+ * sub-agent.
+ *
+ * KNOWN LIMIT, stated rather than hidden: this gates the file TOOLS, not `bash`.
+ * A determined model could still write source via `bash: echo ... > src/x.ts`.
+ * Closing that means parsing shell redirection, which is not reliably doable — so
+ * this is a strong guardrail against the realistic failure mode, not a sandbox.
+ * Real isolation is the sandbox config (tools/sandbox.ts), a separate mechanism.
+ */
+function allowsTestOnlyWrite(tool, input) {
+    // Non-write tools are unaffected: reading, searching and running tests are all
+    // essential to writing a test.
+    //
+    // WRITE_TOOL_NAMES deliberately excludes `create_directory`: isTestFile matches
+    // FILE paths, so a legitimate `create_directory('test/helpers')` would be
+    // refused and the agent could not scaffold the tree it needs — while an empty
+    // directory cannot damage production code, and files placed in it are still
+    // checked individually.
+    if (!exports.WRITE_TOOL_NAMES.has(tool))
+        return true;
+    // EVERY path the call could affect must be a test file, not just `path`:
+    // move_file takes {source, dest} and copy_file {source, destination}, so
+    // checking `path` alone would let `move_file src/index.ts -> /tmp/x` through and
+    // remove production code by relocating it.
+    //
+    // `source` is skipped for notebook_edit specifically, where it is the CELL
+    // CONTENT rather than a path — treating a blob of code as a path would refuse
+    // every legitimate notebook edit.
+    const pathKeys = tool === 'notebook_edit'
+        ? ['path']
+        : ['path', 'source', 'dest', 'destination'];
+    const candidates = pathKeys
+        .map((k) => input?.[k])
+        .filter((v) => typeof v === 'string' && v.length > 0);
+    // An unrecognised write shape (no path-like argument at all) is refused rather
+    // than allowed through, so a future tool cannot silently become a hole here.
+    if (candidates.length === 0)
+        return false;
+    return candidates.every((p) => (0, testIntegrity_1.isTestFile)(p));
+}
 /** Heuristic: does a bash command look like it's running tests/build/lint/typecheck? (GAP D) */
 exports.VERIFY_CMD_RE = /\b(npm|yarn|pnpm)\s+(run\s+)?(test|build|lint|typecheck|tsc)\b|\bpytest\b|\bgo\s+(test|vet|build)\b|\btsc\b|\beslint\b|\bcargo\s+(test|build|check)\b/i;
 /**

package/dist/agent/securityLint.d.ts

@@ -0,0 +1,27 @@
+export interface SecurityFinding {
+    /** Machine-readable class, e.g. 'hardcoded-secret'. */
+    kind: string;
+    /** One-line explanation aimed at the model, phrased as what to do. */
+    message: string;
+    /** 1-based line number within the written content. */
+    line: number;
+    /** The offending line, truncated and with any secret value redacted. */
+    sample: string;
+}
+/**
+ * Scan file content for flagrant security problems.
+ *
+ * Returns at most `max` findings (default 5) — enough to be useful, few enough
+ * that the note appended to a tool result stays readable and cheap.
+ */
+export declare function checkSecurity(content: string, max?: number): SecurityFinding[];
+/**
+ * Render findings as a note to append to a successful write's tool result.
+ *
+ * Phrased as a review comment rather than an error: the write HAS happened, and
+ * the model is being asked to look again. Deliberately explicit that it may be a
+ * false positive — otherwise the model tends to "fix" flagged-but-correct code,
+ * which is its own kind of damage.
+ */
+export declare function securityNoteText(findings: SecurityFinding[]): string;
+//# sourceMappingURL=securityLint.d.ts.map

package/dist/agent/securityLint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityLint.d.ts","sourceRoot":"","sources":["../../src/agent/securityLint.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,eAAe;IAC9B,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;CAChB;AA6GD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,SAAI,GAAG,eAAe,EAAE,CA6CzE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,CAepE"}

package/dist/agent/securityLint.js

@@ -0,0 +1,195 @@
+"use strict";
+// ─── Inline security lint ─────────────────────────────────────────────────────
+//
+// The gap this closes: six checks already run automatically on every write —
+// editCompleteness, crossFile, testIntegrity, claimEvidence, flaky, destructive —
+// and not one of them is about security. For an agent that WRITES production code,
+// nothing stopped it committing a hardcoded credential, an `eval` over
+// user-controlled input, or a SQL string built by concatenation. The only security
+// review available was an agent the user had to know to ask for.
+//
+// DESIGN: WARN, NEVER BLOCK.
+//
+// This runs on every single write, so a false positive is expensive — it would
+// train the model (and the user) to ignore the channel, or worse, stall a
+// legitimate edit. `editCompleteness` can afford to refuse outright because
+// "// ... rest unchanged" is unambiguous; "this looks like SQL injection" is not.
+// So findings are appended to the tool RESULT as a note the model sees and can act
+// on, and the write still succeeds.
+//
+// Consequently every pattern here is tuned for PRECISION over recall. A check that
+// fires on ordinary code was removed rather than loosened. Deep analysis is the
+// `security-auditor` agent's job; this only catches the flagrant cases at the
+// moment they are written.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkSecurity = checkSecurity;
+exports.securityNoteText = securityNoteText;
+/** Max characters of the offending line to echo back. */
+const SAMPLE_MAX = 160;
+/**
+ * Redact anything that looks like a literal secret value before echoing a line.
+ *
+ * The whole point of flagging a hardcoded credential is to get it removed — so
+ * this must not copy the value into the transcript (and from there into logs, or
+ * the next request's context) on the way to reporting it.
+ */
+function redact(line) {
+    const masked = line
+        // key = "value" / key: 'value' → keep the key, mask the value
+        .replace(/(['"`]?[\w.-]*(?:secret|password|passwd|token|api[_-]?key|apikey|auth|credential|private[_-]?key)[\w.-]*['"`]?\s*[:=]\s*)(['"`])([^'"`]{4,})\2/gi, (_m, head, q) => `${head}${q}[REDACTED]${q}`)
+        // Bare high-entropy provider tokens appearing anywhere on the line
+        .replace(/\b(sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|AKIA[0-9A-Z]{16}|xox[baprs]-[A-Za-z0-9-]{10,})\b/g, '[REDACTED]');
+    return masked.length > SAMPLE_MAX ? masked.slice(0, SAMPLE_MAX) + '…' : masked;
+}
+/** Strip string/comment noise that causes false positives, keeping length stable. */
+function isLikelyCommentLine(line) {
+    return /^\s*(\/\/|\*|#|--|<!--)/.test(line);
+}
+const RULES = [
+    // ── Hardcoded credentials ───────────────────────────────────────────────────
+    // Provider-prefixed tokens are near-zero false positive: the prefixes are
+    // registered formats, not something that occurs naturally in source. Checked
+    // inside comments too — a key commented out is still a committed key.
+    {
+        kind: 'hardcoded-secret',
+        re: /\b(sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|AKIA[0-9A-Z]{16}|xox[baprs]-[A-Za-z0-9-]{10,}|AIza[0-9A-Za-z_-]{30,})\b/,
+        message: 'Looks like a real API key/token committed to source. Move it to an environment variable and rotate the exposed key.',
+        includeComments: true,
+    },
+    // NOTE: the `private-key` check is NOT here — it needs to span multiple lines
+    // (BEGIN header on one, base64 body on the next), which this per-line loop
+    // cannot express. It runs separately in checkSecurity below.
+    {
+        kind: 'hardcoded-password',
+        // An ASSIGNMENT of a credential-ish name to a non-trivial literal.
+        //
+        // Tightened after measuring against the real backend, where the looser version
+        // fired on `missingSecret:'FIREBASE_TOKEN'` — code that NAMES a secret in an
+        // error message, the opposite of leaking one. So a value that is itself just a
+        // SCREAMING_SNAKE identifier (an env-var name) is excluded, along with the
+        // usual placeholder vocabulary. The value must also look like actual secret
+        // material: mixed case or digits, not a lone lowercase word.
+        re: /(?:password|passwd|secret|api[_-]?key|apikey|access[_-]?token)['"`]?\s*[:=]\s*['"`](?![A-Z0-9_]+['"`])(?!.*(?:\$\{|process\.env|os\.environ|example|changeme|placeholder|redacted|xxx|test|dummy|fake|sample|your[_-]?|<|\*{3}))(?=[^'"`]*[0-9A-Z])[^'"`\s]{10,}['"`]/,
+        message: 'Hardcoded credential literal. Read it from the environment/secret store instead, and rotate the exposed value.',
+        includeComments: true,
+    },
+    // ── Injection ───────────────────────────────────────────────────────────────
+    {
+        kind: 'dynamic-eval',
+        // The negative lookbehind for `.` is what makes this usable: `redisClient.eval`
+        // (a Redis Lua script), `page.eval` (Playwright), `vm.eval` and friends are
+        // METHOD calls on an object and have nothing to do with JavaScript's global
+        // eval. Without it, the real backend's Redis idempotency script was flagged.
+        // Only a bare `eval(` / `new Function(` with a non-literal argument counts.
+        re: /(?<![.\w$])(?:eval|new\s+Function)\s*\(\s*(?!['"`][^'"`]*['"`]\s*\))[^)]*[a-zA-Z_$][\w$]*/,
+        message: 'eval / new Function on a non-literal value executes arbitrary code if that value is ever user-controlled. Use an explicit parser or a lookup table.',
+    },
+    {
+        kind: 'sql-injection',
+        // Only fires when the interpolated expression is plausibly REQUEST-DERIVED.
+        //
+        // The obvious pattern — any `${...}` inside a SQL string — was measured
+        // against the real backend and flagged 15 of 183 files, essentially all of
+        // them safe and idiomatic: `${sets.join(', ')}` for a dynamic UPDATE, `${field}`
+        // for a server-chosen column, `${CONSUMPTION}` for a module constant. At that
+        // hit rate the warning is pure noise, and noise is worse than silence because
+        // it teaches everyone to skip the channel.
+        //
+        // So the interpolation must name something that plausibly came from the
+        // outside: req/request/params/query/body/input/user/args, or a bare
+        // `'...' + ident`. This trades recall for precision on purpose — thorough SQL
+        // review is the security-auditor agent's job, not an inline regex's.
+        re: /\b(?:SELECT|INSERT\s+INTO|UPDATE|DELETE\s+FROM)\b[^;'"`]{0,160}(?:\$\{\s*(?:req|request|params?|query|body|input|user|args|ctx)\b|['"`]\s*\+\s*(?:req|request|params?|query|body|input|user|args|ctx)\b|%\s*\(\s*(?:request|params?|query|body|input|user)\b)/i,
+        message: 'SQL built by interpolating a request-derived value. Use a parameterised query ($1 / ? placeholders) — this is the classic injection sink.',
+    },
+    {
+        kind: 'command-injection',
+        // Shell execution with an interpolated or concatenated argument.
+        re: /\b(?:exec|execSync|spawnSync?|system|popen|os\.system|subprocess\.(?:call|run|Popen))\s*\(\s*(?:[`'"][^`'"]*(?:\$\{|['"]\s*\+)|[a-zA-Z_$][\w$]*\s*\+)/,
+        message: 'Shell command built from a variable. Pass arguments as an array (no shell), or validate against an allowlist — a value containing ; or $() becomes command execution.',
+    },
+    // ── Transport / verification ────────────────────────────────────────────────
+    {
+        kind: 'tls-verification-disabled',
+        re: /(?:rejectUnauthorized\s*:\s*false|NODE_TLS_REJECT_UNAUTHORIZED\s*=\s*['"]?0|verify\s*=\s*False|InsecureSkipVerify\s*:\s*true)/,
+        message: 'TLS certificate verification is disabled, which removes protection against man-in-the-middle attacks. Trust a specific CA instead if the cert is self-signed.',
+    },
+];
+/**
+ * Scan file content for flagrant security problems.
+ *
+ * Returns at most `max` findings (default 5) — enough to be useful, few enough
+ * that the note appended to a tool result stays readable and cheap.
+ */
+function checkSecurity(content, max = 5) {
+    if (!content)
+        return [];
+    const findings = [];
+    const lines = content.split(/\r?\n/);
+    // Private keys are matched across lines, unlike every other rule.
+    //
+    // A real PEM block is inherently multi-line: the BEGIN header sits on one line
+    // and the base64 body on the next. Requiring both on ONE line (which the
+    // line-by-line loop below does) meant the single highest-severity finding here
+    // only fired for keys embedded in a "\n"-escaped string literal, and missed the
+    // far more common case of a key pasted in verbatim.
+    const pemIdx = lines.findIndex((l) => /-----BEGIN\s+(?:RSA|EC|DSA|OPENSSH|PGP)?\s*PRIVATE KEY-----/.test(l));
+    if (pemIdx !== -1) {
+        // Require actual key material nearby, so a bare header — placeholder text in a
+        // config UI, documentation, a PEM parser — does not trip it.
+        const following = lines.slice(pemIdx, pemIdx + 4).join('\n');
+        if (/[A-Za-z0-9+/]{40,}/.test(following.replace(/-----[^-]+-----/g, ''))) {
+            findings.push({
+                kind: 'private-key',
+                message: 'A private key with real key material is being written into source. Store it outside the repo (secret manager / env var) and rotate it.',
+                line: pemIdx + 1,
+                sample: '-----BEGIN PRIVATE KEY----- [REDACTED]',
+            });
+        }
+    }
+    // One finding per (kind, line) at most, and one finding per kind overall —
+    // a file with fifty interpolated queries should say "SQL injection" once, not
+    // fill the model's context with fifty copies of the same advice.
+    const seenKinds = new Set();
+    for (let i = 0; i < lines.length && findings.length < max; i++) {
+        const line = lines[i];
+        if (!line || line.length > 2000)
+            continue; // minified/bundled — not hand-written source
+        const commentish = isLikelyCommentLine(line);
+        for (const rule of RULES) {
+            if (seenKinds.has(rule.kind))
+                continue;
+            if (commentish && !rule.includeComments)
+                continue;
+            if (!rule.re.test(line))
+                continue;
+            seenKinds.add(rule.kind);
+            findings.push({ kind: rule.kind, message: rule.message, line: i + 1, sample: redact(line.trim()) });
+            break; // at most one rule per line
+        }
+    }
+    return findings;
+}
+/**
+ * Render findings as a note to append to a successful write's tool result.
+ *
+ * Phrased as a review comment rather than an error: the write HAS happened, and
+ * the model is being asked to look again. Deliberately explicit that it may be a
+ * false positive — otherwise the model tends to "fix" flagged-but-correct code,
+ * which is its own kind of damage.
+ */
+function securityNoteText(findings) {
+    // Opt-out, mirroring NEXRALL_ALLOW_ELIDED_WRITE. Someone working in a codebase
+    // that trips a rule constantly (a SQL-builder library, a crypto implementation,
+    // a test-fixture directory full of fake keys) needs a way to silence this
+    // without disabling the write path itself.
+    if (process.env.NEXRALL_SECURITY_LINT === 'off')
+        return '';
+    if (!findings.length)
+        return '';
+    const lines = findings.map((f) => `  • line ${f.line} [${f.kind}]: ${f.message}\n    ${f.sample}`);
+    return (`\n\n⚠ SECURITY REVIEW (${findings.length} finding${findings.length > 1 ? 's' : ''}) — the write succeeded; check these before moving on:\n` +
+        lines.join('\n') +
+        `\nIf a finding is a false positive (test fixture, placeholder, intentionally dynamic), say so and continue — do NOT rewrite correct code to silence it.`);
+}
+//# sourceMappingURL=securityLint.js.map

package/dist/index.d.ts

@@ -5,6 +5,7 @@ export * from './tools/executor';
 export * from './agent/loop';
 export * from './agent/testIntegrity';
 export * from './agent/editCompleteness';
+export * from './agent/securityLint';
 export * from './agent/crossFile';
 export * from './agent/flaky';
 export * from './agent/claimEvidence';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC"}

package/dist/index.js

@@ -21,6 +21,7 @@ __exportStar(require("./tools/executor"), exports);
 __exportStar(require("./agent/loop"), exports);
 __exportStar(require("./agent/testIntegrity"), exports);
 __exportStar(require("./agent/editCompleteness"), exports);
+__exportStar(require("./agent/securityLint"), exports);
 __exportStar(require("./agent/crossFile"), exports);
 __exportStar(require("./agent/flaky"), exports);
 __exportStar(require("./agent/claimEvidence"), exports);

package/dist/tools/executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../src/tools/executor.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAyB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AA4sEtE,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,WAAW,CAAC,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,EAClC,OAAO,CAAC,EAAE,aAAa,EACvB,OAAO,CAAC,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GACjC,OAAO,CAAC,UAAU,CAAC,CAoBrB"}
+{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../src/tools/executor.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAyB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAiuEtE,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,WAAW,CAAC,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,EAClC,OAAO,CAAC,EAAE,aAAa,EACvB,OAAO,CAAC,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GACjC,OAAO,CAAC,UAAU,CAAC,CAoBrB"}

package/dist/tools/executor.js

@@ -44,6 +44,7 @@ const child_process_1 = require("child_process");
 const sandbox_1 = require("./sandbox");
 const auth_1 = require("../auth");
 const editCompleteness_1 = require("../agent/editCompleteness");
+const securityLint_1 = require("../agent/securityLint");
 const memory_1 = require("../agent/memory");
 const skills_1 = require("../agent/skills");
 const testIntegrity_1 = require("../agent/testIntegrity");
@@ -413,8 +414,16 @@ async function writeFile(input, workDir) {
         atomicWrite(resolved, content, existingMode);
         const bytes = Buffer.byteLength(content, 'utf-8');
         const lines = content.split('\n').length;
+        // Inline security review of what was just written.
+        //
+        // Six gates already run automatically on every write (elision, cross-file
+        // breakage, test integrity, claim evidence, flaky tests, destructive commands)
+        // and none of them was about security — so an agent that writes production code
+        // could commit a hardcoded credential or an injection sink with nothing to say
+        // otherwise. This warns; it never blocks (see securityLint.ts for why).
+        const sec = (0, securityLint_1.securityNoteText)((0, securityLint_1.checkSecurity)(content));
         if (isNew) {
-            return { output: `Created ${resolved} (${lines} lines, ${bytes} bytes)` };
+            return { output: `Created ${resolved} (${lines} lines, ${bytes} bytes)${sec}` };
         }
         const xfile = crossFileBreakageWarning(resolved, normalizeLF(priorContent), normalizeLF(content), workDir ?? process.cwd());
         // Reward-hacking guard: a write_file that OVERWRITES an existing test file can
@@ -426,7 +435,7 @@ async function writeFile(input, workDir) {
         const ti = (0, testIntegrity_1.analyzeTestEdit)(resolved, normalizeLF(priorContent), normalizeLF(content));
         if (ti.suspicious)
             tiMarker = (0, testIntegrity_1.encodeTestIntegrityMarker)(ti.findings);
-        return { output: `Overwrote ${resolved} (${lines} lines, ${bytes} bytes)${xfile}${tiMarker}` };
+        return { output: `Overwrote ${resolved} (${lines} lines, ${bytes} bytes)${xfile}${sec}${tiMarker}` };
     }
     catch (err) {
         return { error: err.message };
@@ -1408,7 +1417,12 @@ async function editFile(input, workDir) {
         const linesBefore = origNorm.split('\n').length;
         const linesAfter = updated.split('\n').length;
         const xfile = crossFileBreakageWarning(resolved, origNorm, normalizeLF(updated), workDir ?? process.cwd());
-        return { output: `Edited ${resolved} (${linesBefore} → ${linesAfter} lines)\n\n${diff}${xfile}` };
+        // Security-lint only the NEWLY INSERTED text, not the whole file. Scanning the
+        // full file would re-report pre-existing findings on every unrelated edit —
+        // noise that has nothing to do with the change being made, and the fastest way
+        // to teach everyone to ignore the warning.
+        const sec = (0, securityLint_1.securityNoteText)((0, securityLint_1.checkSecurity)(newNorm));
+        return { output: `Edited ${resolved} (${linesBefore} → ${linesAfter} lines)\n\n${diff}${xfile}${sec}` };
     }
     catch (err) {
         return { error: err.message };
@@ -1747,6 +1761,9 @@ async function multiEdit(input, workDir) {
         let content = normalizeLF(rawFile);
         const originalNorm = content; // captured before edits mutate `content`
         const diffs = [];
+        // Inserted text from every edit, collected for the security lint below so it
+        // scans only what this call ADDED rather than the whole file.
+        const insertedText = [];
         for (let i = 0; i < edits.length; i++) {
             const edit = edits[i];
             // Normalize incoming old/new strings too
@@ -1766,6 +1783,7 @@ async function multiEdit(input, workDir) {
             // Pass the pre-replace content so line numbers reflect the file state at
             // the point this edit was applied (not the final state after all edits).
             diffs.push(buildDiff(filePath, oldStr, newStr, content));
+            insertedText.push(newStr);
             content = literalReplace(content, oldStr, newStr);
         }
         // Restore original line endings before writing (atomic temp+rename),
@@ -1773,9 +1791,11 @@ async function multiEdit(input, workDir) {
         const finalContent = wasCRLF ? content.replace(/\n/g, '\r\n') : content;
         atomicWritePreservingMode(resolved, finalContent, pre.mode);
         const xfile = crossFileBreakageWarning(resolved, originalNorm, content, workDir ?? process.cwd());
+        // Lint only the newly inserted text (see the same reasoning in editFile).
+        const sec = (0, securityLint_1.securityNoteText)((0, securityLint_1.checkSecurity)(insertedText.join('\n')));
         return {
             output: `Applied ${edits.length} edit(s) to ${resolved}:\n` +
-                diffs.map((d, i) => `\n--- edit #${i + 1} ---\n${d}`).join('\n') + xfile,
+                diffs.map((d, i) => `\n--- edit #${i + 1} ---\n${d}`).join('\n') + xfile + sec,
         };
     }
     catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nexrall/code-core",
-  "version": "1.4.23",
+  "version": "1.4.24",
   "description": "Core agent loop, tools, and extension primitives for Nexrall Code — embed an AI coding agent in any Node.js application.",
   "license": "MIT",
   "author": "Nexrall <support@nexrall.com> (https://nexrall.com)",