@nexrall/code-core 1.4.25 → 1.4.26

package/dist/agent/agentRegistry.d.ts

@@ -0,0 +1,45 @@
+import type { Message } from '../types';
+export interface StoredAgent {
+    id: string;
+    /**
+     * The agent type this ran as, or null for an unnamed (general-purpose) run.
+     *
+     * Stored so resumption can be re-authorised against the CURRENT permission
+     * rules. Without it, an id would be a permanent bypass of any deny rule added
+     * after the agent first ran.
+     */
+    agentName: string | null;
+    /** Full conversation: the sub-agent's own user/assistant/tool messages. */
+    messages: Message[];
+    /** The description shown in the UI, for `/agents --resumable` style listings. */
+    description: string;
+    createdAt: number;
+    updatedAt: number;
+    /**
+     * Monotonic touch counter, used for ordering instead of `updatedAt`.
+     *
+     * Date.now() has millisecond resolution and these operations take
+     * microseconds, so two agents touched in the same tick compare EQUAL and a
+     * stable sort silently falls back to insertion order — i.e. "most recent"
+     * would have been wrong exactly when several things happen at once, which is
+     * the normal case for parallel sub-tasks. The timestamps are kept because
+     * they are meaningful to humans; the ordering does not depend on them.
+     */
+    seq: number;
+    /** Rough JSON size, cached so the byte cap doesn't re-serialise on every write. */
+    bytes: number;
+}
+/** Store a finished sub-agent's transcript. Returns its resumable id. */
+export declare function rememberAgent(agentName: string | null, description: string, messages: Message[]): string;
+/** Append a resumed run's new messages to an existing agent. */
+export declare function updateAgent(id: string, messages: Message[]): void;
+export declare function getAgent(id: string): StoredAgent | undefined;
+/** Newest first — the order a "which agents can I resume?" list wants. */
+export declare function listAgents(): StoredAgent[];
+/** Test seam. Not exported through index.ts's public surface by intent. */
+export declare function _resetAgentRegistry(): void;
+export declare const _limits: {
+    MAX_AGENTS: number;
+    MAX_TOTAL_BYTES: number;
+};
+//# sourceMappingURL=agentRegistry.d.ts.map

package/dist/agent/agentRegistry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentRegistry.d.ts","sourceRoot":"","sources":["../../src/agent/agentRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AA8CxC,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,2EAA2E;IAC3E,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,iFAAiF;IACjF,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;;;OASG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,mFAAmF;IACnF,KAAK,EAAE,MAAM,CAAC;CACf;AA4CD,yEAAyE;AACzE,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,OAAO,EAAE,GAClB,MAAM,CAeR;AAED,gEAAgE;AAChE,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,IAAI,CAYjE;AAED,wBAAgB,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAE5D;AAED,0EAA0E;AAC1E,wBAAgB,UAAU,IAAI,WAAW,EAAE,CAE1C;AAED,2EAA2E;AAC3E,wBAAgB,mBAAmB,IAAI,IAAI,CAI1C;AAED,eAAO,MAAM,OAAO;;;CAAkC,CAAC"}

package/dist/agent/agentRegistry.js

@@ -0,0 +1,138 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports._limits = void 0;
+exports.rememberAgent = rememberAgent;
+exports.updateAgent = updateAgent;
+exports.getAgent = getAgent;
+exports.listAgents = listAgents;
+exports._resetAgentRegistry = _resetAgentRegistry;
+// ─── Resumable sub-agents ────────────────────────────────────────────────────
+//
+// A sub-agent normally starts with a blank slate: fresh context, no memory of a
+// previous run. That is the whole point for one-shot research — but it makes
+// follow-up work absurdly expensive. "Now also check the auth path" re-reads
+// every file the last run already read, because the only way to add to a
+// finished sub-task is to describe the whole job again from scratch.
+//
+// This registry keeps a completed sub-agent's transcript in memory so a later
+// `task` call can continue it instead of restarting it. Claude Code does the
+// same thing; the design decisions worth writing down are the ones about what
+// NOT to do:
+//
+//   • IN-MEMORY, process-lifetime only. Deliberately not written to disk. A
+//     transcript is unredacted tool output — file contents, command output,
+//     whatever a repo happens to contain. Persisting it would create a new
+//     durable copy of material the user never asked us to store, in a new place
+//     they would have to know to clean up. Losing resumability when the process
+//     exits is a much smaller cost than that.
+//
+//   • BOUNDED, by entries and by bytes. A transcript is the largest object this
+//     process handles, and an agent loop that spawns sub-agents in a cycle would
+//     otherwise grow the heap until the CLI dies — a leak that shows up only in
+//     the longest sessions, i.e. the ones where losing work hurts most.
+//
+//   • Resumption re-checks permission at the CALL SITE, not here. An id is a
+//     capability: if a rule denies `task(explorer)` after an explorer agent has
+//     already run, resuming by id must not hand that agent back. This module
+//     therefore stores the agent's NAME alongside its history, so the caller can
+//     re-evaluate the current rules against it. See runSubTask.
+/** Max resumable agents kept alive. Oldest is evicted first. */
+const MAX_AGENTS = 20;
+/**
+ * Max total transcript bytes across all stored agents (~8 MB of JSON).
+ *
+ * Sized to comfortably hold a handful of long research runs while staying far
+ * below the point where it competes with the model context for memory. Eviction
+ * is by age, not by size, so one enormous transcript cannot pin out many small
+ * useful ones.
+ */
+const MAX_TOTAL_BYTES = 8 * 1024 * 1024;
+/**
+ * Insertion-ordered store. A Map is enough: Maps iterate in insertion order, so
+ * "oldest" is simply the first key, and re-inserting on update moves an entry to
+ * the back — giving LRU-by-touch for free without a second data structure.
+ */
+const _agents = new Map();
+let _counter = 0;
+let _seq = 0;
+function totalBytes() {
+    let n = 0;
+    for (const a of _agents.values())
+        n += a.bytes;
+    return n;
+}
+function evictUntilWithinLimits() {
+    while (_agents.size > MAX_AGENTS) {
+        const oldest = _agents.keys().next().value;
+        if (oldest === undefined)
+            break;
+        _agents.delete(oldest);
+    }
+    // Byte cap is checked second: an entry that is individually enormous should
+    // still be storable (it is the most expensive thing to recompute), but it
+    // must not drag the total past the cap alongside its neighbours.
+    while (totalBytes() > MAX_TOTAL_BYTES && _agents.size > 1) {
+        const oldest = _agents.keys().next().value;
+        if (oldest === undefined)
+            break;
+        _agents.delete(oldest);
+    }
+}
+function sizeOf(messages) {
+    try {
+        return JSON.stringify(messages).length;
+    }
+    catch {
+        // A transcript that cannot be serialised (cycles shouldn't happen, but a
+        // crash here would take down a completed sub-task's result) is treated as
+        // large so it gets evicted early rather than silently counted as free.
+        return MAX_TOTAL_BYTES;
+    }
+}
+/** Store a finished sub-agent's transcript. Returns its resumable id. */
+function rememberAgent(agentName, description, messages) {
+    const id = `agent_${++_counter}`;
+    const now = Date.now();
+    _agents.set(id, {
+        id,
+        agentName,
+        description,
+        messages,
+        createdAt: now,
+        updatedAt: now,
+        seq: ++_seq,
+        bytes: sizeOf(messages),
+    });
+    evictUntilWithinLimits();
+    return id;
+}
+/** Append a resumed run's new messages to an existing agent. */
+function updateAgent(id, messages) {
+    const existing = _agents.get(id);
+    if (!existing)
+        return;
+    existing.messages = messages;
+    existing.updatedAt = Date.now();
+    existing.seq = ++_seq;
+    existing.bytes = sizeOf(messages);
+    // Re-insert so this becomes the most recently used entry, protecting an
+    // actively-continued agent from being evicted by a burst of new one-shots.
+    _agents.delete(id);
+    _agents.set(id, existing);
+    evictUntilWithinLimits();
+}
+function getAgent(id) {
+    return _agents.get(id);
+}
+/** Newest first — the order a "which agents can I resume?" list wants. */
+function listAgents() {
+    return [..._agents.values()].sort((a, b) => b.seq - a.seq);
+}
+/** Test seam. Not exported through index.ts's public surface by intent. */
+function _resetAgentRegistry() {
+    _agents.clear();
+    _counter = 0;
+    _seq = 0;
+}
+exports._limits = { MAX_AGENTS, MAX_TOTAL_BYTES };
+//# sourceMappingURL=agentRegistry.js.map

package/dist/agent/loop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loop.d.ts","sourceRoot":"","sources":["../../src/agent/loop.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,OAAO,EAMP,gBAAgB,EAChB,UAAU,EACX,MAAM,UAAU,CAAC;AAyKlB,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,MAAM,CAWR;AAkED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAgBlF;AAuJD;;;;;;;;;;GAUG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AA4BD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,UAAU,UAAO,GAAG,MAAM,CAYjF;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,SAAc,GAAG,MAAM,CAKtE;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAoBpE;AA8ND,oGAAoG;AACpG,wBAAgB,gBAAgB,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,CAE1E;AA8BD,kHAAkH;AAClH,wBAAgB,oBAAoB,IAAI;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAEzE;AAuBD,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAM7D;AAsBD,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,aAA+G,CAAC;AAC7I;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,OAAO,CA8BrG;AAED,gGAAgG;AAChG,eAAO,MAAM,aAAa,QAA2J,CAAC;AAEtL;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAK5E;AAUD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAwBxD;AAoBD,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3D,aAAa,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClE,qFAAqF;IACrF,aAAa,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvD;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,YAAY,IAAI,cAAc,CAE7C;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAC1B,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC1C,EAAE,EAAE,OAAO,EACX,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,IAAI,CAoDN;AAED,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CA6B5D;AAmBD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,eAAe,SAAI,GAAG,MAAM,CAgCpF;AAsKD,gFAAgF;AAChF,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAE/D;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,OAAO,EAAE,EACnB,IAAI,EAAE;IACJ,KAAK,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC,GACA,OAAO,CAAC,OAAO,CAAC,CAqElB;AAID,wBAAsB,YAAY,CAChC,eAAe,EAAE,OAAO,EAAE,EAC1B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,OAAO,EAAE,CAAC,CAyuBpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAqCtE"}
+{"version":3,"file":"loop.d.ts","sourceRoot":"","sources":["../../src/agent/loop.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,OAAO,EAMP,gBAAgB,EAChB,UAAU,EACX,MAAM,UAAU,CAAC;AA2KlB,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,MAAM,CAWR;AAkED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAgBlF;AAuJD;;;;;;;;;;GAUG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AA4BD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,UAAU,UAAO,GAAG,MAAM,CAYjF;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,SAAc,GAAG,MAAM,CAKtE;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAoBpE;AAkTD,oGAAoG;AACpG,wBAAgB,gBAAgB,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,CAE1E;AA8BD,kHAAkH;AAClH,wBAAgB,oBAAoB,IAAI;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAEzE;AAuBD,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAM7D;AAsBD,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,aAA+G,CAAC;AAC7I;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,OAAO,CA8BrG;AAED,gGAAgG;AAChG,eAAO,MAAM,aAAa,QAA2J,CAAC;AAEtL;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAK5E;AAUD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAwBxD;AAoBD,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3D,aAAa,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClE,qFAAqF;IACrF,aAAa,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvD;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,YAAY,IAAI,cAAc,CAE7C;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAC1B,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC1C,EAAE,EAAE,OAAO,EACX,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,IAAI,CAoDN;AAED,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CA6B5D;AAmBD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,eAAe,SAAI,GAAG,MAAM,CAgCpF;AAsKD,gFAAgF;AAChF,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAE/D;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,OAAO,EAAE,EACnB,IAAI,EAAE;IACJ,KAAK,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC,GACA,OAAO,CAAC,OAAO,CAAC,CAqElB;AAID,wBAAsB,YAAY,CAChC,eAAe,EAAE,OAAO,EAAE,EAC1B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,OAAO,EAAE,CAAC,CAgxBpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAqCtE"}

package/dist/agent/loop.js

@@ -59,6 +59,8 @@ const executor_1 = require("../tools/executor");
 const agentTypes_1 = require("./agentTypes");
 const skills_1 = require("./skills");
 const rules_1 = require("../permissions/rules");
+const planMode_1 = require("./planMode");
+const agentRegistry_1 = require("./agentRegistry");
 const sandbox_1 = require("../tools/sandbox");
 const index_1 = require("../plugins/index");
 const testIntegrity_1 = require("./testIntegrity");
@@ -541,7 +543,49 @@ async function runSubTask(input, options, agentTypes) {
     // ENOENT stats — against a sub-agent that is about to run for seconds to
     // minutes. Note runAgentLoop re-reads for the sub-agent anyway, so the old
     // behaviour was already inconsistent: fresh for the child, stale for the lookup.
-    const requestedType = typeof input.subagent_type === 'string' ? input.subagent_type : '';
+    // ── Resolve a resume target ─────────────────────────────────────────────────
+    //
+    // `resume_agent_id` continues a previous sub-agent. The stored transcript
+    // carries the agent's NAME, and that name — not the one the model passed — is
+    // what gets authorised below.
+    //
+    // This matters because an id would otherwise be a permanent capability: deny
+    // `task(explorer)` today and a model holding yesterday's explorer id could
+    // still resume it, with the deny rule looking like it was applied. Re-deriving
+    // the name from storage also stops a mismatched `subagent_type` from being
+    // used to launder a denied agent under an allowed name.
+    const resumeId = typeof input.resume_agent_id === 'string' ? input.resume_agent_id.trim() : '';
+    const resumed = resumeId ? (0, agentRegistry_1.getAgent)(resumeId) : undefined;
+    if (resumeId && !resumed) {
+        return {
+            error: `No resumable sub-agent with id "${resumeId}". Ids live only for the current session and the ` +
+                'oldest are dropped when too many accumulate, so this one has expired or never existed. ' +
+                'Start a fresh sub-task with a self-contained prompt instead.',
+        };
+    }
+    const requestedType = resumed
+        ? (resumed.agentName ?? '')
+        : (typeof input.subagent_type === 'string' ? input.subagent_type : '');
+    // ── Enforce `deny: ["task(<name>)"]` ─────────────────────────────────────────
+    //
+    // This is the load-bearing check; filtering the catalogue in runAgentLoop only
+    // stops the agent being SUGGESTED. It must run BEFORE resolution, because the
+    // reload-on-miss path below deliberately re-reads from disk UNFILTERED — a
+    // denied agent is absent from the snapshot, would therefore "miss", and would
+    // then be found by that reload and run. Denying by omission is not denying.
+    //
+    // Phrased as a policy refusal, not "unknown type": the model must not respond
+    // by trying to create the agent file it thinks is missing.
+    if (requestedType) {
+        const decision = (0, rules_1.evaluatePermission)((0, rules_1.loadSettings)(options.workDir).permissions, 'task', { subagent_type: requestedType }, options.workDir);
+        if (decision === 'deny') {
+            return {
+                error: `The sub-agent "${requestedType}" is disabled by a permission rule in this project ` +
+                    `(permissions.deny in settings.json). This is a deliberate policy choice, not a missing file — ` +
+                    'do not create it and do not retry. Do the work yourself, or use a different sub-agent.',
+            };
+        }
+    }
     let agent = (0, agentTypes_1.findAgentType)(agentTypes, requestedType);
     let knownTypes = agentTypes;
     if (requestedType && !agent) {
@@ -584,9 +628,16 @@ async function runSubTask(input, options, agentTypes) {
         }
         return options.requestPermission(req);
     };
-    const subMessages = [
-        { role: 'user', content: [{ type: 'text', text: prompt }] },
-    ];
+    // ── Resume: continue a previous sub-agent instead of starting cold ──────────
+    //
+    // The new prompt is appended as another user turn to the stored transcript, so
+    // the agent keeps every file it read and every conclusion it reached. Without
+    // this, "now also check the auth path" means re-describing the entire job and
+    // re-reading everything — the most common and most expensive kind of waste in
+    // a delegated workflow.
+    const subMessages = resumed
+        ? [...resumed.messages, { role: 'user', content: [{ type: 'text', text: prompt }] }]
+        : [{ role: 'user', content: [{ type: 'text', text: prompt }] }];
     // A dedicated abort signal for this sub-agent, distinct from the parent's own
     // options.abortSignal (user hit Ctrl+C). Set to true either when the parent
     // aborts OR when the stall timeout below fires, whichever happens first —
@@ -609,6 +660,9 @@ async function runSubTask(input, options, agentTypes) {
             _agentScope: `sub_${++_subTaskCounter}`, // isolated todo store per sub-agent
             editorContext: null, // fresh isolated context for sub-agent
             model: agent?.model ?? options.model,
+            // Plan mode is inherited, never relaxed. If the main agent could spawn a
+            // sub-agent that writes, the lock would be one `task` call from useless.
+            planMode: options.planMode,
             nexrallMd: subNexrallMd,
             abortSignal: subAbort,
             requestPermission: gatedPermission,
@@ -671,7 +725,23 @@ async function runSubTask(input, options, agentTypes) {
         }
         // Normal completion: the final assistant message is the sub-agent's answer.
         const text = capSubTaskText(extractSubTaskText(result, true));
-        return { output: text || '(sub-task completed with no text output)' };
+        // Store the transcript so a follow-up can continue this agent rather than
+        // re-running it from scratch, and tell the parent the id.
+        //
+        // Only on NORMAL completion. A timed-out or failed run is deliberately not
+        // resumable: its transcript ends mid-thought, often mid-tool-call, and
+        // resuming from that state invites the model to build on work whose status
+        // it cannot determine. Those paths already salvage their partial output as
+        // TEXT, which is the safe way to carry that information forward.
+        const agentId = resumed
+            ? ((0, agentRegistry_1.updateAgent)(resumed.id, result), resumed.id)
+            : (0, agentRegistry_1.rememberAgent)(agent?.name ?? null, (typeof input.description === 'string' && input.description.trim()) || prompt.slice(0, 80), result);
+        const body = text || '(sub-task completed with no text output)';
+        return {
+            output: `${body}\n\n[resumable: this sub-agent is "${agentId}". To ask IT a follow-up — keeping ` +
+                'everything it already read and concluded — call task again with resume_agent_id="' + agentId +
+                '" instead of writing a new prompt from scratch.]',
+        };
     }
     catch (err) {
         // Same salvage rule as the timeout path above, for the other way a sub-agent
@@ -1342,17 +1412,36 @@ async function runAgentLoop(initialMessages, options) {
     const hooks = loadHooks(options.workDir);
     const depth = options._depth ?? 0;
     const agentScope = options._agentScope ?? 'root';
+    // Settings are read before the agent catalogue because a `deny` rule can
+    // switch a sub-agent off, and an agent that may not run must not be
+    // advertised (see below).
+    const settings = (0, rules_1.loadSettings)(options.workDir);
     // Discover custom sub-agent types. Only the top-level agent is told the
     // catalogue (sub-agents can't spawn further), but every level resolves types.
-    const agentTypes = (0, agentTypes_1.loadAgentTypes)(options.workDir);
+    //
+    // Denied agents are filtered OUT of the catalogue rather than left in it to be
+    // refused on dispatch. Listing an agent you have forbidden trains the model to
+    // spend a tool call discovering the refusal, and "available types: …" on the
+    // error path would name it again. Enforcement still happens at dispatch
+    // (runSubTask) — this is the cosmetic half; that is the load-bearing half.
+    const agentTypes = (0, agentTypes_1.loadAgentTypes)(options.workDir).filter((t) => (0, rules_1.evaluatePermission)(settings.permissions, 'task', { subagent_type: t.name }, options.workDir) !== 'deny');
     const agentsCatalogue = depth === 0 ? (0, agentTypes_1.summariseAgents)(agentTypes) : '';
     // Skills catalogue — unlike agentsCatalogue, available at every depth: a skill is
     // just a reusable prompt template (via use_skill), not another spawn point, so
     // sub-agents benefit from the same playbooks without the recursion concerns that
     // gate agentsCatalogue to the top level.
     const skillsCatalogue = (0, skills_1.summariseSkills)((0, skills_1.loadSkills)(options.workDir));
+    // Plan mode instructions ride the project-instructions channel, which is
+    // authoritative in the system prompt. Prepended rather than appended: the
+    // lock has to be read before the project conventions it overrides.
+    //
+    // Telling the model is not the enforcement (checkPlanMode at the call site is)
+    // — it exists so the model spends the turn planning instead of discovering the
+    // lock one refused tool call at a time.
+    const planAwareNexrallMd = options.planMode
+        ? planMode_1.PLAN_MODE_INSTRUCTIONS + (options.nexrallMd ? `\n\n---\n\n${options.nexrallMd}` : '')
+        : options.nexrallMd;
     // Optional OS-level bash sandbox (opt-in via settings.json "sandbox").
-    const settings = (0, rules_1.loadSettings)(options.workDir);
     const sandboxCfg = (0, sandbox_1.parseSandboxConfig)(settings.raw.sandbox) ?? undefined;
     // Soft iteration budget + optional auto-continue past it (see resolvers above).
     const maxIterations = resolveMaxIterations(options.maxIterations, settings.raw);
@@ -1569,7 +1658,7 @@ async function runAgentLoop(initialMessages, options) {
                     effort: options.effort,
                     env: options.env,
                     editorContext: options.editorContext,
-                    nexrallMd: options.nexrallMd,
+                    nexrallMd: planAwareNexrallMd,
                     clientType: options.clientType,
                     abortSignal: options.abortSignal,
                     extraTools: options.mcpManager?.getAnthropicTools(),
@@ -1794,6 +1883,21 @@ async function runAgentLoop(initialMessages, options) {
                     options.onToolResult(name, result);
                     return { block: { ...block, id }, result };
                 }
+                // ── Plan mode: a session-wide read-only lock ────────────────────────
+                //
+                // Checked BEFORE requestPermission on purpose. Routing it through the
+                // permission prompt would ask the user to approve something that is
+                // not theirs to approve in that moment, and a model told "denied by
+                // user" reliably re-asks. This refusal instead says plainly that no
+                // answer here can unlock it.
+                if (options.planMode) {
+                    const refusal = (0, planMode_1.checkPlanMode)(name, input);
+                    if (refusal) {
+                        result = { error: refusal.message };
+                        options.onToolResult(name, result);
+                        return { block: { ...block, id }, result };
+                    }
+                }
                 // Request permission
                 const description = humanDescription(name, input);
                 let permitted;

package/dist/agent/planMode.d.ts

@@ -0,0 +1,20 @@
+export interface PlanModeRefusal {
+    /** Machine-readable reason, for tests and telemetry. */
+    reason: 'mutating-tool' | 'bash-not-read-only';
+    /** Message shown to the MODEL. Must stop it retrying or asking for approval. */
+    message: string;
+}
+/**
+ * Is this bash command provably read-only?
+ *
+ * "Provably" is doing real work: unknown verbs are refused, not guessed at.
+ */
+export declare function isReadOnlyCommand(command: string): boolean;
+/**
+ * Should this tool call be refused because the session is in plan mode?
+ * Returns null when the call is allowed.
+ */
+export declare function checkPlanMode(tool: string, input: Record<string, unknown>): PlanModeRefusal | null;
+/** Text appended to the system prompt while plan mode is active. */
+export declare const PLAN_MODE_INSTRUCTIONS: string;
+//# sourceMappingURL=planMode.d.ts.map

package/dist/agent/planMode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"planMode.d.ts","sourceRoot":"","sources":["../../src/agent/planMode.ts"],"names":[],"mappings":"AAwHA,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,MAAM,EAAE,eAAe,GAAG,oBAAoB,CAAC;IAC/C,gFAAgF;IAChF,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAgE1D;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,eAAe,GAAG,IAAI,CAoCxB;AAED,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,QAqBvB,CAAC"}

package/dist/agent/planMode.js

@@ -0,0 +1,252 @@
+"use strict";
+// ─── Plan mode ───────────────────────────────────────────────────────────────
+//
+// A session-wide read-only lock. The model may research as deeply as it likes
+// and must finish by PROPOSING a plan; it cannot change anything until a human
+// leaves plan mode. Claude Code ships the same idea, and the reason to copy it
+// is that "read the codebase, then tell me what you'd do" is otherwise
+// unenforceable — you are relying on the model choosing not to edit, which is a
+// promise, not a guarantee.
+//
+// The design rule here is FAIL CLOSED. Everything that is not provably
+// side-effect-free is refused. A false refusal costs the user one message
+// ("this needs plan mode off"); a false permit silently mutates a repo the user
+// believed was frozen. Those are not symmetric, so ambiguity always loses.
+//
+// Note this is a DIFFERENT axis from the sub-agent tool allowlist in
+// agentTypes.ts. That restricts one delegated worker; this restricts the whole
+// session including the main agent and every sub-agent it spawns.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PLAN_MODE_INSTRUCTIONS = void 0;
+exports.isReadOnlyCommand = isReadOnlyCommand;
+exports.checkPlanMode = checkPlanMode;
+/**
+ * Tools that cannot alter anything outside the conversation.
+ *
+ * Deliberately an ALLOWLIST. A denylist would mean every tool added later is
+ * writable-by-default in plan mode, and the person adding it has no reason to
+ * think about plan mode at all — the failure would ship silently. With an
+ * allowlist, a new tool is refused until someone deliberately classifies it,
+ * and the refusal is visible the first time anybody tries it.
+ */
+const READ_ONLY_TOOLS = new Set([
+    'read_file', 'search_files', 'glob', 'list_directory', 'notebook_read',
+    // Planning bookkeeping. todo_write persists only to the session's own todo
+    // list, not the repo, so it stays available — a plan mode that cannot draft
+    // a checklist is missing the point of plan mode.
+    'todo_write', 'todo_read',
+    // Reading memory is fine; memory_write is NOT here on purpose. Memory is
+    // durable state that survives the session, so writing it is a real mutation
+    // even though no file in the repo changes.
+    'memory_read',
+    'use_skill',
+    'fetch_url', 'web_search',
+    // Delegating research is ALLOWED, and this is safe rather than a hole:
+    // runSubTask passes planMode down, so the sub-agent is under the same lock and
+    // its own write tools are refused by this very function one level deeper.
+    //
+    // Worth allowing rather than blanket-refusing, because plan mode exists to
+    // support deep research and the explorer agent is the cheapest way to do bulk
+    // searching without flooding the main context. Blocking `task` would have made
+    // the mode's headline use case worse, for no security gain.
+    'task',
+    // VS Code language server — all pure queries.
+    'get_symbols', 'get_workspace_symbols', 'find_references', 'go_to_definition',
+    'get_hover', 'get_diagnostics',
+    // Reading output from an ALREADY-running background shell. Starting one is
+    // gated with the rest of bash below; draining a buffer is not a new effect.
+    'bash_output',
+]);
+/**
+ * Commands allowed through `bash` in plan mode.
+ *
+ * bash is the hard case: it is one tool that spans `git log` and `rm -rf /`,
+ * so plan mode is only as strong as this list. Hence a strict allowlist of
+ * verbs known to be read-only, plus the argument screening in
+ * `isReadOnlyCommand` for the several that are read-only ONLY in some forms.
+ */
+const READ_ONLY_BASH = new Set([
+    'ls', 'cat', 'head', 'tail', 'wc', 'file', 'stat', 'du', 'df', 'pwd', 'which',
+    'type', 'echo', 'printf', 'basename', 'dirname', 'realpath', 'readlink',
+    'grep', 'egrep', 'fgrep', 'rg', 'ag', 'ack', 'find', 'fd', 'locate',
+    'diff', 'comm', 'cmp', 'sort', 'uniq', 'cut', 'tr', 'column', 'jq', 'yq',
+    'date', 'whoami', 'hostname', 'uname', 'env', 'printenv', 'id', 'groups',
+    'ps', 'top', 'uptime', 'free', 'node', 'python', 'python3',
+    'tree', 'less', 'more', 'nl', 'tac', 'strings', 'md5sum', 'sha256sum',
+    'true', 'false', 'test', 'sleep', 'seq', 'expr',
+]);
+/**
+ * Subcommands that are read-only for tools whose safety depends on the verb.
+ *
+ * `git` is the reason this exists: `git log` and `git push --force` share one
+ * binary, so classifying by executable name alone is useless here.
+ */
+const READ_ONLY_SUBCOMMANDS = {
+    git: new Set([
+        'log', 'show', 'diff', 'status', 'blame', 'branch', 'tag', 'remote',
+        'describe', 'rev-parse', 'rev-list', 'ls-files', 'ls-tree', 'ls-remote',
+        'cat-file', 'shortlog', 'reflog', 'whatchanged', 'grep', 'config',
+        'check-ignore', 'merge-base', 'name-rev', 'count-objects', 'verify-commit',
+    ]),
+    // Package managers: only their query verbs.
+    npm: new Set(['ls', 'list', 'view', 'info', 'outdated', 'why', 'config', 'ping', 'search']),
+    pnpm: new Set(['ls', 'list', 'view', 'info', 'outdated', 'why', 'config']),
+    yarn: new Set(['list', 'info', 'why', 'config']),
+    cargo: new Set(['tree', 'metadata', 'search']),
+    go: new Set(['list', 'version', 'env', 'vet', 'doc']),
+    docker: new Set(['ps', 'images', 'logs', 'inspect', 'version', 'info', 'top', 'port', 'diff', 'stats']),
+    kubectl: new Set(['get', 'describe', 'logs', 'explain', 'top', 'version', 'api-resources', 'api-versions']),
+    // gh: read verbs only. `gh run rerun`, `gh pr merge` etc. are excluded, and
+    // the nested-verb check in isReadOnlyCommand handles `gh pr view` vs `gh pr merge`.
+    gh: new Set(['browse']),
+};
+/** Second-level read verbs for CLIs shaped as `<tool> <noun> <verb>`. */
+const READ_ONLY_NESTED = {
+    gh: new Set(['view', 'list', 'status', 'diff', 'checks']),
+};
+/**
+ * Shell metacharacters that can smuggle a second command past verb inspection.
+ *
+ * We could parse the chain and check each segment — `destructive.ts` does
+ * something like that — but plan mode is a deliberate, temporary restriction:
+ * the honest answer to "can I run this compound pipeline while frozen?" is
+ * "no, and it costs you nothing to wait". Rejecting the whole shape is far
+ * easier to get right than parsing shell grammar, and being wrong here means
+ * writing to a repo the user thinks is locked.
+ *
+ * `|` is included: `cat x | tee y` writes, and so does `... | sh`.
+ */
+const SHELL_CONTROL = /[\n\r;&|`]|\$\(|>>|>|<\(/;
+function firstWords(command) {
+    return command.trim().split(/\s+/).filter(Boolean);
+}
+/**
+ * Is this bash command provably read-only?
+ *
+ * "Provably" is doing real work: unknown verbs are refused, not guessed at.
+ */
+function isReadOnlyCommand(command) {
+    const cmd = command.trim();
+    if (!cmd)
+        return false;
+    // Any chaining/redirection/substitution — refuse the whole thing.
+    if (SHELL_CONTROL.test(cmd))
+        return false;
+    const words = firstWords(cmd);
+    if (!words.length)
+        return false;
+    // `VAR=x cmd` — skip leading environment assignments to find the real verb.
+    let i = 0;
+    while (i < words.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[i]))
+        i++;
+    if (i >= words.length)
+        return false;
+    let verb = words[i];
+    // Strip a path prefix: /usr/bin/git → git
+    const slash = verb.lastIndexOf('/');
+    if (slash >= 0)
+        verb = verb.slice(slash + 1);
+    // `sudo anything` is refused outright regardless of the verb behind it: plan
+    // mode is a promise about this machine, and privilege escalation is exactly
+    // where a mistaken allow is least recoverable.
+    if (verb === 'sudo' || verb === 'doas' || verb === 'su')
+        return false;
+    const rest = words.slice(i + 1).filter((w) => !w.startsWith('-'));
+    const subs = READ_ONLY_SUBCOMMANDS[verb];
+    if (subs) {
+        const sub = rest[0];
+        if (!sub) {
+            // Bare `git` / `npm` just prints help — harmless.
+            return true;
+        }
+        if (subs.has(sub)) {
+            // `git config --global x y` WRITES. Only the read form (no value) passes.
+            if (verb === 'git' && sub === 'config') {
+                const args = words.slice(i + 2).filter((w) => !w.startsWith('-'));
+                return args.length <= 1;
+            }
+            return true;
+        }
+        const nested = READ_ONLY_NESTED[verb];
+        if (nested && rest[1] && nested.has(rest[1]))
+            return true;
+        return false;
+    }
+    if (!READ_ONLY_TOOLS.has(verb) && !READ_ONLY_BASH.has(verb))
+        return false;
+    // Interpreters can execute arbitrary code inline; only allow the trivial
+    // read-only forms (`node --version`). `node -e "fs.rmSync(...)"` must not pass.
+    if (verb === 'node' || verb === 'python' || verb === 'python3') {
+        return words.slice(i + 1).every((w) => w === '--version' || w === '-V' || w === '-v');
+    }
+    // `find` can execute and delete.
+    if (verb === 'find' && words.some((w) => w === '-exec' || w === '-execdir' || w === '-delete')) {
+        return false;
+    }
+    // Reading a file with `test`/`stat` is fine, but `tee` is not in the list at
+    // all, and `echo`/`printf` are only safe because redirection is already
+    // rejected by SHELL_CONTROL above.
+    return true;
+}
+/**
+ * Should this tool call be refused because the session is in plan mode?
+ * Returns null when the call is allowed.
+ */
+function checkPlanMode(tool, input) {
+    if (tool === 'bash') {
+        const command = typeof input.command === 'string' ? input.command : '';
+        // Starting a background process in a "frozen" session is a side effect that
+        // outlives the refusal, so it is refused even for an otherwise-safe verb.
+        if (input.run_in_background === true) {
+            return {
+                reason: 'bash-not-read-only',
+                message: 'Plan mode is ON: background processes cannot be started. Finish researching and propose ' +
+                    'your plan; the user will leave plan mode if they want it carried out.',
+            };
+        }
+        if (isReadOnlyCommand(command))
+            return null;
+        return {
+            reason: 'bash-not-read-only',
+            message: `Plan mode is ON, so \`bash\` is limited to provably read-only commands and this one was not ` +
+                'recognised as such (chained commands, redirection and command substitution are always refused). ' +
+                'Do NOT ask the user to approve it and do NOT try a variation to get around this — it is a ' +
+                'session-wide lock, not a per-call prompt. Use read-only inspection instead, and put the command ' +
+                'in your plan as a step to run once plan mode is off.',
+        };
+    }
+    if (READ_ONLY_TOOLS.has(tool))
+        return null;
+    return {
+        reason: 'mutating-tool',
+        message: `Plan mode is ON, so \`${tool}\` is unavailable — this session may not modify anything yet. ` +
+            'Do NOT ask for approval: no answer the user gives at this prompt can unlock it, because it is a ' +
+            'session-wide lock they control directly. Research with read-only tools and finish by proposing ' +
+            'a concrete plan (files to change, in order, and how to verify). The user will exit plan mode to ' +
+            'let you carry it out.',
+    };
+}
+/** Text appended to the system prompt while plan mode is active. */
+exports.PLAN_MODE_INSTRUCTIONS = [
+    '# PLAN MODE IS ACTIVE',
+    '',
+    'This session is READ-ONLY. You cannot edit files, write files, run mutating commands, or start',
+    'background processes. This is enforced outside your control — it is not a permission prompt, and',
+    'the user cannot approve an exception from inside this turn.',
+    '',
+    'Therefore:',
+    '- NEVER ask "shall I go ahead and make this change?" — you cannot, whatever the answer.',
+    '- NEVER attempt a mutating tool "just to see" — it will be refused and wastes the turn.',
+    '- NEVER try to reach a blocked command another way (a different flag, a script, an interpreter).',
+    '',
+    'Your job is to research thoroughly, then deliver a plan:',
+    '1. What you found — the specific files, functions and line numbers that matter.',
+    '2. What you propose to change — file by file, in dependency order.',
+    '3. Risks and unknowns — what could break, what you could not verify, what you assumed.',
+    '4. How it will be verified — the exact build/test/lint command that proves it works.',
+    '',
+    'Be concrete. "Update the auth logic" is not a plan; "add a `refreshToken` field to AuthConfig in',
+    'auth/index.ts:42, then thread it through client.ts:118" is. The user will review the plan and',
+    'leave plan mode to have it carried out.',
+].join('\n');
+//# sourceMappingURL=planMode.js.map

package/dist/index.d.ts

@@ -17,6 +17,8 @@ export * from './mcp/manager';
 export * from './checkpoint/manager';
 export * from './commands/loader';
 export * from './agent/agentTypes';
+export * from './agent/planMode';
+export * from './agent/agentRegistry';
 export * from './permissions/rules';
 export * from './permissions/destructive';
 export * from './plugins/index';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC"}

package/dist/index.js

@@ -33,6 +33,8 @@ __exportStar(require("./mcp/manager"), exports);
 __exportStar(require("./checkpoint/manager"), exports);
 __exportStar(require("./commands/loader"), exports);
 __exportStar(require("./agent/agentTypes"), exports);
+__exportStar(require("./agent/planMode"), exports);
+__exportStar(require("./agent/agentRegistry"), exports);
 __exportStar(require("./permissions/rules"), exports);
 __exportStar(require("./permissions/destructive"), exports);
 __exportStar(require("./plugins/index"), exports);

package/dist/permissions/rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/permissions/rules.ts"],"names":[],"mappings":"AAwBA,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,eAAe,CAAC;IAC7B,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B;AAsBD,oEAAoE;AACpE,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CAoB5D;AAgID;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,EAAE,MAAM,GACd,kBAAkB,GAAG,IAAI,CAK3B"}
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/permissions/rules.ts"],"names":[],"mappings":"AAwBA,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,eAAe,CAAC;IAC7B,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B;AAsBD,oEAAoE;AACpE,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CAoB5D;AA8ID;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,EAAE,MAAM,GACd,kBAAkB,GAAG,IAAI,CAK3B"}

package/dist/permissions/rules.js

@@ -174,6 +174,20 @@ function matchValues(tool, input, workDir) {
         case 'stock_photo':
             vals.push(str(input.path));
             break;
+        // Sub-agent dispatch. Matching on the agent NAME is what makes
+        // `deny: ["task(explorer)"]` mean "this repo may not use the explorer
+        // agent" — the Claude-Code way of switching off a built-in you don't want.
+        //
+        // Without this case, `task` fell through to `default`, which reads
+        // `input.path` — a key the task tool does not have. Every patterned task
+        // rule therefore matched nothing and silently did nothing, which is the
+        // worst failure mode for a deny rule: it looks configured and isn't.
+        //
+        // A bare `task` rule (no pattern) still matches any dispatch, so
+        // `deny: ["task"]` disables sub-agents wholesale.
+        case 'task':
+            vals.push(str(input.subagent_type));
+            break;
         default:
             pushPath(str(input.path));
             break;

package/dist/types.d.ts

@@ -321,6 +321,15 @@ export interface AgentLoopOptions {
     env?: EnvContext;
     editorContext?: EditorContext | null;
     nexrallMd?: string;
+    /**
+     * Session-wide read-only lock ("plan mode"). When true the loop refuses every
+     * mutating tool BEFORE requestPermission is consulted, so no user answer at a
+     * permission prompt can unlock it — only leaving plan mode can.
+     *
+     * Inherited by every sub-agent: a lock the main agent can delegate its way
+     * out of is not a lock.
+     */
+    planMode?: boolean;
     /** Client type — controls which tools Claude is told about. */
     clientType?: string;
     /**

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,UAAU,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,aAAa,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAKD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9D;AAKD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,UAAU,EAAE,iBAAiB,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACzE;AAED,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,YAAY,GAAG,eAAe,GAAG,UAAU,GAAG,aAAa,CAAC;AAInG,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;IAC3B,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAID,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,UAAU,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,SAAS,CAAC;IACjB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,gBAAgB,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,0HAA0H;AAC1H,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,gBAAgB,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,gBAAgB,CAAC;IACvB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,QAAQ,GAChB,YAAY,GACZ,eAAe,GACf,uBAAuB,GACvB,aAAa,GACb,YAAY,GACZ,aAAa,GACb,gBAAgB,GAChB,wBAAwB,GACxB,qBAAqB,GACrB,aAAa,GACb,qBAAqB,GACrB,qBAAqB,GACrB,qBAAqB,CAAC;AAI1B,MAAM,WAAW,SAAS;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,gEAAgE;IAChE,WAAW,CAAC,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvF,8DAA8D;IAC9D,oBAAoB,CAAC,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChH,4DAA4D;IAC5D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,kBAAkB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9C,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IACvF,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9E;;;;;;;;;OASG;IACH,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC/E;;;;;OAKG;IACH,OAAO,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IACnD;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IACzE,+FAA+F;IAC/F,eAAe,CAAC,EAAE,MAAM,IAAI,CAAC;IAC7B;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,KAAK,IAAI,CAAC;IACnE;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IAClE;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,KAAK,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAChE,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACnG,+EAA+E;IAC/E,UAAU,CAAC,EAAE,OAAO,eAAe,EAAE,UAAU,CAAC;IAChD,qFAAqF;IACrF,iBAAiB,CAAC,EAAE,OAAO,sBAAsB,EAAE,iBAAiB,CAAC;IACrE;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,MAAM,EAAE,CAAC;IAClC,+FAA+F;IAC/F,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IAC3C;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAID;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACvC,iFAAiF;IACjF,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC7B;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;gBAEb,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAOzF;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,cAAc,CAEpE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,EAAE,GAAG,IAAI,CAG7D"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,UAAU,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,aAAa,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAKD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9D;AAKD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,UAAU,EAAE,iBAAiB,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACzE;AAED,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,YAAY,GAAG,eAAe,GAAG,UAAU,GAAG,aAAa,CAAC;AAInG,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;IAC3B,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAID,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,UAAU,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,SAAS,CAAC;IACjB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,gBAAgB,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,0HAA0H;AAC1H,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,gBAAgB,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,gBAAgB,CAAC;IACvB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,QAAQ,GAChB,YAAY,GACZ,eAAe,GACf,uBAAuB,GACvB,aAAa,GACb,YAAY,GACZ,aAAa,GACb,gBAAgB,GAChB,wBAAwB,GACxB,qBAAqB,GACrB,aAAa,GACb,qBAAqB,GACrB,qBAAqB,GACrB,qBAAqB,CAAC;AAI1B,MAAM,WAAW,SAAS;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,gEAAgE;IAChE,WAAW,CAAC,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvF,8DAA8D;IAC9D,oBAAoB,CAAC,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChH,4DAA4D;IAC5D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,kBAAkB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9C,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IACvF,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9E;;;;;;;;;OASG;IACH,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC/E;;;;;OAKG;IACH,OAAO,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IACnD;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IACzE,+FAA+F;IAC/F,eAAe,CAAC,EAAE,MAAM,IAAI,CAAC;IAC7B;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,KAAK,IAAI,CAAC;IACnE;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IAClE;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,KAAK,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAChE,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACnG,+EAA+E;IAC/E,UAAU,CAAC,EAAE,OAAO,eAAe,EAAE,UAAU,CAAC;IAChD,qFAAqF;IACrF,iBAAiB,CAAC,EAAE,OAAO,sBAAsB,EAAE,iBAAiB,CAAC;IACrE;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,MAAM,EAAE,CAAC;IAClC,+FAA+F;IAC/F,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IAC3C;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAID;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACvC,iFAAiF;IACjF,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC7B;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;gBAEb,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAOzF;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,cAAc,CAEpE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,EAAE,GAAG,IAAI,CAG7D"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nexrall/code-core",
-  "version": "1.4.25",
+  "version": "1.4.26",
   "description": "Core agent loop, tools, and extension primitives for Nexrall Code — embed an AI coding agent in any Node.js application.",
   "license": "MIT",
   "author": "Nexrall <support@nexrall.com> (https://nexrall.com)",