@nexrall/code-core 1.4.28 → 1.4.30

package/dist/agent/agentTypes.d.ts

@@ -19,7 +19,39 @@ export interface AgentType {
      * permission gate, where it is a real refusal rather than a request.
      */
     testFilesOnly?: boolean;
+    /**
+     * Opt-in per-agent persistent notes: `memory: project | user | local`.
+     *
+     * Distinct from the SHARED memory store that memory_read/memory_write use. This
+     * gives one named agent its own file that only it reads and writes, so a
+     * repeatedly-invoked agent (a reviewer that keeps meeting the same anti-pattern)
+     * accumulates expertise without polluting — or being drowned out by — the main
+     * agent's memory. The trade-off is deliberate and worth stating: these stores are
+     * ISOLATED, so two agents learn nothing from each other.
+     *
+     * Scopes mirror the shared store's own split plus a not-committed variant:
+     *   project — .nexrall/agent-memory/<name>.md      (shareable via git)
+     *   local   — .nexrall/agent-memory-local/<name>.md (gitignored)
+     *   user    — ~/.nexrall/agent-memory/<name>.md     (follows you everywhere)
+     */
+    memory?: AgentMemoryScope;
+    /**
+     * Skip the project's nexrall.md for this agent, keeping its prompt lean.
+     *
+     * Claude Code does the same for its two research builtins (Explore and Plan skip
+     * CLAUDE.md and git status to stay fast and cheap), and the reasoning transfers: a
+     * search-and-report agent re-reads the entire project instruction file on EVERY
+     * invocation, on the tier chosen for being cheap, to produce output the main agent
+     * then interprets WITH that context anyway. The rules that must reach it belong in the
+     * delegation prompt instead.
+     *
+     * Only for agents that neither write files nor make judgement calls about conventions
+     * — a reviewer or test-writer needs the project's rules, an explorer does not.
+     */
+    lightPrompt?: boolean;
 }
+/** Where a sub-agent's own persistent notes live. */
+export type AgentMemoryScope = 'project' | 'user' | 'local';
 /**
  * A problem found while loading an agent definition.
  *

package/dist/agent/agentTypes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agentTypes.d.ts","sourceRoot":"","sources":["../../src/agent/agentTypes.ts"],"names":[],"mappings":"AAiCA,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,iDAAiD;IACjD,KAAK,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;IAClC,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;IACpD;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AA6QD;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AA0JD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,CAE3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAAC,QAAQ,EAAE,YAAY,EAAE,CAAA;CAAE,CAqB5G;AAED,yFAAyF;AACzF,wBAAgB,cAAc,IAAI,MAAM,EAAE,CAEzC;AAED,2FAA2F;AAC3F,wBAAgB,aAAa,IAAI,SAAS,EAAE,CAE3C;AACD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,CAY1D;AAQD,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAIjG"}
+{"version":3,"file":"agentTypes.d.ts","sourceRoot":"","sources":["../../src/agent/agentTypes.ts"],"names":[],"mappings":"AAiCA,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,iDAAiD;IACjD,KAAK,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;IAClC,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;IACpD;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,qDAAqD;AACrD,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AA4U5D;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAyKD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,CAE3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAAC,QAAQ,EAAE,YAAY,EAAE,CAAA;CAAE,CAqB5G;AAED,yFAAyF;AACzF,wBAAgB,cAAc,IAAI,MAAM,EAAE,CAEzC;AAED,2FAA2F;AAC3F,wBAAgB,aAAa,IAAI,SAAS,EAAE,CAE3C;AACD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,CAY1D;AAQD,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAIjG"}

package/dist/agent/agentTypes.js

@@ -43,6 +43,11 @@ const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const os = __importStar(require("os"));
 const index_1 = require("../plugins/index");
+const VALID_MEMORY_SCOPES = ['project', 'user', 'local'];
+function parseMemoryScope(v) {
+    const s = (v ?? '').trim().toLowerCase();
+    return VALID_MEMORY_SCOPES.includes(s) ? s : undefined;
+}
 // ── Built-in agent types ──────────────────────────────────────────────────────
 // Shipped defaults; lowest precedence (project > global > builtin), so a user
 // can override any of them with a same-name .nexrall/agents/<name>.md file.
@@ -65,6 +70,22 @@ const READ_ONLY_TOOLS = [
     // lifetime. Stopping a shell you started is not a write to the repo.
     'kill_shell',
     'notebook_read', 'todo_write', 'todo_read',
+    // memory_READ, deliberately without memory_write.
+    //
+    // Reading is free capability: a sub-agent that knows "tests run with X" or "never
+    // edit Z directly" does better work, and withholding it meant every sub-agent
+    // rediscovered project conventions from scratch. Writing is a different thing
+    // entirely — memory is durable, cross-session, SHARED state, while sub-agents run
+    // up to 4-wide in parallel with their reasoning hidden from the user. A wrong fact
+    // written there is invisible and permanent, and it competes for a capped, shared
+    // budget that gets periodically condensed.
+    //
+    // So the parent owns writes: a sub-agent that learns something durable says so in
+    // its report, and the main agent — the one actually talking to the user — decides.
+    // A sub-agent that needs its own persistent notes gets the per-agent store instead
+    // (see `memory:` in the frontmatter), which is scoped to itself and cannot pollute
+    // the shared file.
+    'memory_read',
     // Skills are reusable prompt playbooks, and loop.ts advertises the skills
     // catalogue to sub-agents at EVERY depth — so withholding the tool that loads
     // one meant showing every sub-agent a menu it could not order from.
@@ -94,6 +115,37 @@ const WRITE_TOOLS = [
     'notebook_edit',
 ];
 const BUILTIN_AGENTS = [
+    {
+        // The catch-all, matching Claude Code's `general-purpose`.
+        //
+        // This capability already existed — omitting `subagent_type` gives an unrestricted
+        // sub-agent — but it had no NAME, and that had two consequences worth fixing:
+        //
+        //   1. `permissions.deny: ["task(...)"]` matches on the agent name, so the ONE
+        //      sub-agent that can write files and run bash was the one variant a project
+        //      could not disable individually. Only a blanket `deny: ["task"]` reached it.
+        //   2. The model had to infer that leaving the field blank was even an option, so
+        //      it would sometimes pick a specialist that fitted badly (an unrestricted
+        //      explorer) rather than the general worker it actually wanted.
+        //
+        // `tools` is deliberately UNDEFINED, which means "no allowlist" — full access,
+        // inheriting whatever the session permits. That is the same power an unnamed
+        // sub-task always had; naming it changes only who can see and deny it. The safety
+        // properties elsewhere still apply: plan mode is inherited, the user's permission
+        // gate still runs on every call, and it cannot spawn further sub-agents.
+        name: 'general-purpose',
+        description: 'General-purpose worker for a multi-step task that needs BOTH exploration and changes ' +
+            '(edit files, run commands) and that no specialist above fits. Inherits the session model ' +
+            'and full tool access, so prefer a narrower agent when one matches.',
+        prompt: 'You are a general-purpose engineering sub-agent. Work the task end to end: explore what you ' +
+            'need, make the changes, and verify them with the project\'s own build/test commands.\n\n' +
+            'Rules:\n' +
+            '- Mirror existing conventions; make the smallest correct change.\n' +
+            '- Verify before you claim success. If you could not verify, say so explicitly.\n' +
+            '- Your FINAL MESSAGE is the only thing that reaches the main agent: state what you changed ' +
+            '(with file paths), what you ran and its outcome, and anything you deliberately left undone.',
+        source: 'builtin',
+    },
     {
         name: 'reviewer',
         description: 'Read-only code reviewer — finds correctness bugs, edge cases, and security issues in a diff or file set. Cannot modify files.',
@@ -156,6 +208,9 @@ const BUILTIN_AGENTS = [
     // frontier model, and this is the agent most likely to be spawned in bulk.
     {
         name: 'explorer',
+        // Lean prompt: this agent exists to keep bulk searching cheap, and it reports
+        // findings for the MAIN agent to interpret with full project context.
+        lightPrompt: true,
         description: 'Fast read-only codebase explorer — locates files, symbols, and call sites and reports concise findings. Use to keep bulk searching out of the main context. Cannot modify files.',
         tools: READ_ONLY_TOOLS,
         model: 'turbo',
@@ -289,12 +344,16 @@ const KNOWN_TOOL_NAMES = new Set([
     'todo_write', 'todo_read', 'memory_write', 'memory_read', 'use_skill',
     'fetch_url', 'web_search', 'generate_image', 'stock_photo', 'open_in_browser',
     'task',
+    // Granted by a `memory:` scope rather than listed in a `tools:` line, but a user may
+    // still name it explicitly — so it must validate rather than be flagged as a typo.
+    'agent_memory_write',
     'get_symbols', 'get_workspace_symbols', 'find_references', 'go_to_definition',
     'get_hover', 'get_diagnostics',
 ]);
 /** Frontmatter keys this parser understands, for typo detection. */
 const KNOWN_META_KEYS = new Set([
     'name', 'description', 'tools', 'model', 'test_files_only', 'testfilesonly',
+    'memory',
 ]);
 const VALID_MODELS = ['turbo', 'pro', 'ultra'];
 function parseFrontmatter(raw) {
@@ -391,6 +450,15 @@ function loadDir(dir, source, into, warnings) {
                     message: 'has no `description:` — that text is the ONLY thing the model uses to decide when to delegate to this agent, so it will rarely be picked.',
                 });
             }
+            // Same class of mistake as an invalid model: silently ignoring it would leave
+            // the agent with no memory while its prompt tells it to keep notes.
+            if (meta.memory !== undefined && parseMemoryScope(meta.memory) === undefined) {
+                warnings.push({
+                    file: full,
+                    agent: name,
+                    message: `has memory: "${meta.memory}", which is not a valid scope — use one of ${VALID_MEMORY_SCOPES.join(', ')}, or omit the line to give this agent no persistent notes.`,
+                });
+            }
             if (meta.model !== undefined && parseModel(meta.model) === undefined) {
                 warnings.push({
                     file: full,
@@ -438,6 +506,12 @@ function loadDir(dir, source, into, warnings) {
             // cannot touch production source, rather than only the builtin getting
             // that guarantee.
             ...(parseBool(meta.test_files_only ?? meta.testfilesonly) ? { testFilesOnly: true } : {}),
+            // The `ok &&` is defensive, not load-bearing: parseFrontmatter already returns an
+            // EMPTY meta when it cannot find a `---` block, so `meta.memory` is undefined on
+            // that path regardless. It stays because the guarantee we want — an unreadable
+            // definition never receives a writable store — should survive parseFrontmatter
+            // being changed to salvage partial metadata, which is a plausible future edit.
+            ...(ok && parseMemoryScope(meta.memory) ? { memory: parseMemoryScope(meta.memory) } : {}),
         });
     }
 }

package/dist/agent/loop.d.ts

@@ -1,4 +1,5 @@
-import type { Message, AgentLoopOptions, EnvContext } from '../types';
+import type { Message, ToolResult, AgentLoopOptions, EnvContext } from '../types';
+import { type AgentMemoryScope } from './agentTypes';
 /**
  * Fingerprint one round's tool failures, for the repeated-failure runaway guard.
  *
@@ -19,6 +20,47 @@ export declare const _stallLimits: {
     STALL_LIMIT: number;
     REPEAT_STALL_LIMIT: number;
 };
+/**
+ * The single tool granted by a `memory:` frontmatter scope.
+ *
+ * Named distinctly from `memory_write` on purpose: they write to DIFFERENT stores, and
+ * a model that saw one name for both would reasonably assume its notes were visible to
+ * the main agent. They are not.
+ */
+export declare const AGENT_MEMORY_TOOL = "agent_memory_write";
+/**
+ * Schema advertised to the model, only for a sub-agent with a declared memory scope.
+ *
+ * The description does the load-bearing work of keeping the two stores apart in the
+ * model's head: it must not believe these notes reach the user or the main agent.
+ */
+export declare const AGENT_MEMORY_TOOL_SCHEMA: {
+    readonly name: "agent_memory_write";
+    readonly description: string;
+    readonly input_schema: {
+        readonly type: "object";
+        readonly properties: {
+            readonly content: {
+                readonly type: "string";
+                readonly description: "The single fact to remember, 1-2 sentences.";
+            };
+        };
+        readonly required: readonly ["content"];
+    };
+};
+/** Identifies whose notes an agent_memory_write call may touch. */
+export interface AgentMemoryBinding {
+    agentName: string;
+    scope: AgentMemoryScope;
+}
+/**
+ * Execute an `agent_memory_write` call.
+ *
+ * Pure-ish and exported so the refusal paths are testable without spawning a real
+ * sub-agent: the binding is data, so "no binding" and "unsafe agent name" can both be
+ * exercised directly.
+ */
+export declare function executeAgentMemoryWrite(input: Record<string, unknown>, binding: AgentMemoryBinding | undefined, workDir?: string): Promise<ToolResult>;
 /**
  * Why an agent run stopped.
  *
@@ -49,6 +91,18 @@ export declare function resolveMaxIterations(optionValue: number | undefined, se
  * dozen lines.
  */
 export declare function createLimiter(max: number): <T>(fn: () => Promise<T>) => Promise<T>;
+/**
+ * How long a sub-agent may make NO progress before it is stopped.
+ *
+ * Precedence matches every other tunable in this file
+ * (env → settings.json → default) — it used to be env-ONLY, which meant a project that
+ * legitimately needed longer sub-tasks had no way to say so in the file where every
+ * other such preference lives, and the limit was invisible to anyone reading settings.
+ *
+ * Exported for tests: the behaviour that matters (a long-but-productive sub-agent is
+ * NOT killed) takes minutes of wall clock to exercise through the real loop.
+ */
+export declare function resolveSubtaskTimeoutMs(settingsRaw: Record<string, unknown>): number;
 /**
  * Thrown by a sub-agent's permission gate when the AGENT DEFINITION forbids a
  * tool — as opposed to the user declining it.
@@ -93,6 +147,16 @@ export declare function capSubTaskText(text: string, max?: number): string;
  * had already been billed in full.
  */
 export declare function summariseSubTaskProgress(messages: Message[]): string;
+/**
+ * The last N tool results from a transcript, newest last, each truncated.
+ *
+ * Pure + exported so the salvage rules are testable without a real sub-agent.
+ *
+ * Truncation keeps the HEAD of each result: tool output is overwhelmingly
+ * front-loaded (a file starts with its imports, a failing command starts with its
+ * error), and a head slice is the half that identifies what was found.
+ */
+export declare function lastToolResults(messages: Message[], count: number, maxChars: number): string;
 /** The context window (tokens) for a model alias — the same lookup runAgentLoop uses internally. */
 export declare function contextWindowFor(model?: 'turbo' | 'pro' | 'ultra'): number;
 /** Auto-prune / auto-compact thresholds as fractions of the context window — for UI display (e.g. `/context`). */

package/dist/agent/loop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loop.d.ts","sourceRoot":"","sources":["../../src/agent/loop.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,OAAO,EAMP,gBAAgB,EAChB,UAAU,EACX,MAAM,UAAU,CAAC;AAuKlB;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,GAC9C,MAAM,CAKR;AAED,+CAA+C;AAC/C,eAAO,MAAM,YAAY;;;CAAsC,CAAC;AAEhE;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAClB,OAAO,GACP,SAAS,GACT,oBAAoB,GACpB,gBAAgB,GAChB,YAAY,GACZ,SAAS,GACT,gBAAgB,GAChB,QAAQ,GACR,SAAS,CAAC;AAEd;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,UAAU,EAClB,GAAG,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GACzD,MAAM,GAAG,IAAI,CAgCf;AAWD,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,MAAM,CAWR;AAkED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAgBlF;AAuJD;;;;;;;;;;GAUG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AA4BD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,UAAU,UAAO,GAAG,MAAM,CAYjF;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,SAAc,GAAG,MAAM,CAKtE;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAoBpE;AAkTD,oGAAoG;AACpG,wBAAgB,gBAAgB,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,CAE1E;AA8BD,kHAAkH;AAClH,wBAAgB,oBAAoB,IAAI;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAEzE;AA6CD,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAM7D;AAsBD,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,aAA+G,CAAC;AAC7I;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,OAAO,CA8BrG;AAED,gGAAgG;AAChG,eAAO,MAAM,aAAa,QAA2J,CAAC;AAEtL;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAK5E;AAUD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAwBxD;AAoBD,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3D;;;;;;;OAOG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClE,qFAAqF;IACrF,aAAa,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvD;;;;;;;;;;;OAWG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,YAAY,IAAI,cAAc,CAE7C;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAC1B,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC1C,EAAE,EAAE,OAAO,EACX,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,IAAI,CA2EN;AAED,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAgC5D;AAmBD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,eAAe,SAAI,GAAG,MAAM,CAgCpF;AAsKD,gFAAgF;AAChF,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAE/D;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,OAAO,EAAE,EACnB,IAAI,EAAE;IACJ,KAAK,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC,GACA,OAAO,CAAC,OAAO,CAAC,CAqElB;AAID,wBAAsB,YAAY,CAChC,eAAe,EAAE,OAAO,EAAE,EAC1B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,OAAO,EAAE,CAAC,CAg5BpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAqCtE"}
+{"version":3,"file":"loop.d.ts","sourceRoot":"","sources":["../../src/agent/loop.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,OAAO,EAKP,UAAU,EACV,gBAAgB,EAChB,UAAU,EACX,MAAM,UAAU,CAAC;AAIlB,OAAO,EAAkE,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAmKrH;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,GAC9C,MAAM,CAKR;AAED,+CAA+C;AAC/C,eAAO,MAAM,YAAY;;;CAAsC,CAAC;AAEhE;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,uBAAuB,CAAC;AAEtD;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;CAgB3B,CAAC;AAEX,mEAAmE;AACnE,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,gBAAgB,CAAC;CACzB;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,EAAE,kBAAkB,GAAG,SAAS,EACvC,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC,CA8BrB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAClB,OAAO,GACP,SAAS,GACT,oBAAoB,GACpB,gBAAgB,GAChB,YAAY,GACZ,SAAS,GACT,gBAAgB,GAChB,QAAQ,GACR,SAAS,CAAC;AAEd;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,UAAU,EAClB,GAAG,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GACzD,MAAM,GAAG,IAAI,CAgCf;AAWD,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,MAAM,CAWR;AAkED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAgBlF;AAiJD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAOpF;AAMD;;;;;;;;;;GAUG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AA4BD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,UAAU,UAAO,GAAG,MAAM,CAYjF;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,SAAc,GAAG,MAAM,CAKtE;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAgCpE;AAMD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CA6B5F;AAgbD,oGAAoG;AACpG,wBAAgB,gBAAgB,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,CAE1E;AA8BD,kHAAkH;AAClH,wBAAgB,oBAAoB,IAAI;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAEzE;AA6CD,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAM7D;AAsBD,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,aAA+G,CAAC;AAC7I;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,OAAO,CA8BrG;AAED,gGAAgG;AAChG,eAAO,MAAM,aAAa,QAA2J,CAAC;AAEtL;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAK5E;AAUD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAwBxD;AAoBD,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3D;;;;;;;OAOG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClE,qFAAqF;IACrF,aAAa,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvD;;;;;;;;;;;OAWG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,YAAY,IAAI,cAAc,CAE7C;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAC1B,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC1C,EAAE,EAAE,OAAO,EACX,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,IAAI,CA2EN;AAED,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAgC5D;AAmBD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,eAAe,SAAI,GAAG,MAAM,CAgCpF;AAsKD,gFAAgF;AAChF,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAE/D;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,OAAO,EAAE,EACnB,IAAI,EAAE;IACJ,KAAK,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC,GACA,OAAO,CAAC,OAAO,CAAC,CAqElB;AAID,wBAAsB,YAAY,CAChC,eAAe,EAAE,OAAO,EAAE,EAC1B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,OAAO,EAAE,CAAC,CA66BpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAqCtE"}

package/dist/agent/loop.js

@@ -33,14 +33,17 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.VERIFY_CMD_RE = exports.WRITE_TOOL_NAMES = exports.ToolNotAllowedError = exports._stallLimits = void 0;
+exports.VERIFY_CMD_RE = exports.WRITE_TOOL_NAMES = exports.ToolNotAllowedError = exports.AGENT_MEMORY_TOOL_SCHEMA = exports.AGENT_MEMORY_TOOL = exports._stallLimits = void 0;
 exports.errorRoundSignature = errorRoundSignature;
+exports.executeAgentMemoryWrite = executeAgentMemoryWrite;
 exports.stopReasonNotice = stopReasonNotice;
 exports.resolveMaxIterations = resolveMaxIterations;
 exports.createLimiter = createLimiter;
+exports.resolveSubtaskTimeoutMs = resolveSubtaskTimeoutMs;
 exports.extractSubTaskText = extractSubTaskText;
 exports.capSubTaskText = capSubTaskText;
 exports.summariseSubTaskProgress = summariseSubTaskProgress;
+exports.lastToolResults = lastToolResults;
 exports.contextWindowFor = contextWindowFor;
 exports.compactionThresholds = compactionThresholds;
 exports.estimateBodyBytes = estimateBodyBytes;
@@ -215,6 +218,72 @@ function errorRoundSignature(errored) {
 }
 /** Runaway-guard limits, exposed for tests. */
 exports._stallLimits = { STALL_LIMIT, REPEAT_STALL_LIMIT };
+/**
+ * The single tool granted by a `memory:` frontmatter scope.
+ *
+ * Named distinctly from `memory_write` on purpose: they write to DIFFERENT stores, and
+ * a model that saw one name for both would reasonably assume its notes were visible to
+ * the main agent. They are not.
+ */
+exports.AGENT_MEMORY_TOOL = 'agent_memory_write';
+/**
+ * Schema advertised to the model, only for a sub-agent with a declared memory scope.
+ *
+ * The description does the load-bearing work of keeping the two stores apart in the
+ * model's head: it must not believe these notes reach the user or the main agent.
+ */
+exports.AGENT_MEMORY_TOOL_SCHEMA = {
+    name: exports.AGENT_MEMORY_TOOL,
+    description: 'Save a durable note to YOUR OWN persistent notes, which are injected into your prompt on ' +
+        'future runs. Use this for lessons that will still be true next time — a convention this repo ' +
+        'follows, a recurring bug pattern, a command that works, a dead end not worth retrying. ' +
+        'These notes are PRIVATE to you: they are NOT shown to the user and NOT read by the main agent, ' +
+        'so anything the user or the main agent needs to know must still go in your final message. ' +
+        'One self-contained fact per call, a sentence or two. Do not save transient task details.',
+    input_schema: {
+        type: 'object',
+        properties: {
+            content: { type: 'string', description: 'The single fact to remember, 1-2 sentences.' },
+        },
+        required: ['content'],
+    },
+};
+/**
+ * Execute an `agent_memory_write` call.
+ *
+ * Pure-ish and exported so the refusal paths are testable without spawning a real
+ * sub-agent: the binding is data, so "no binding" and "unsafe agent name" can both be
+ * exercised directly.
+ */
+async function executeAgentMemoryWrite(input, binding, workDir) {
+    // Belt-and-braces: the permission gate already refuses this tool without a binding.
+    // Re-checked because this is the function that actually touches the filesystem, and
+    // it must not depend on a caller elsewhere having got the check right.
+    if (!binding) {
+        return {
+            error: `${exports.AGENT_MEMORY_TOOL} is only available to a sub-agent whose definition declares a \`memory:\` ` +
+                'scope. Put anything worth remembering in your final message instead.',
+        };
+    }
+    const content = typeof input.content === 'string' ? input.content.trim() : '';
+    if (!content)
+        return { error: `${exports.AGENT_MEMORY_TOOL} requires a non-empty \`content\` string.` };
+    const res = await (0, memory_1.writeAgentMemory)(binding.agentName, binding.scope, content, workDir);
+    if (!res.ok) {
+        // The realistic cause is a repo-scoped store with no workDir, or an agent name that
+        // is not a safe single path segment. Say which, rather than a bare failure.
+        return {
+            error: `Could not save to the "${binding.agentName}" agent's ${binding.scope} notes. ` +
+                'Either this scope needs a project directory (use `memory: user` for a store that ' +
+                'works anywhere) or the agent name is not usable as a filename.',
+        };
+    }
+    return {
+        output: res.already
+            ? 'Already saved (a near-identical note exists) — nothing added.'
+            : `Saved to your ${binding.scope} notes. It will be in your prompt on your next run.`,
+    };
+}
 /**
  * The message shown when a run ends for any reason other than a clean finish.
  *
@@ -472,9 +541,28 @@ let _subTaskCounter = 0; // unique per-process id → per-sub-agent todo scope
 // pointing at it specifically. Give every sub-task an explicit wall-clock cap:
 // if it hasn't finished by then, fail it clearly instead of hanging the parent
 // turn indefinitely. Overridable via env for slow CI machines / huge sub-tasks.
-const SUBTASK_TIMEOUT_MS = Number(process.env.NEXRALL_SUBTASK_TIMEOUT_MS) > 0
-    ? Number(process.env.NEXRALL_SUBTASK_TIMEOUT_MS)
-    : 10 * 60 * 1000; // 10 minutes, matching the general industry norm for a stalled-agent cutoff
+const DEFAULT_SUBTASK_TIMEOUT_MS = 10 * 60 * 1000; // 10 min of NO PROGRESS (see the watchdog)
+/**
+ * How long a sub-agent may make NO progress before it is stopped.
+ *
+ * Precedence matches every other tunable in this file
+ * (env → settings.json → default) — it used to be env-ONLY, which meant a project that
+ * legitimately needed longer sub-tasks had no way to say so in the file where every
+ * other such preference lives, and the limit was invisible to anyone reading settings.
+ *
+ * Exported for tests: the behaviour that matters (a long-but-productive sub-agent is
+ * NOT killed) takes minutes of wall clock to exercise through the real loop.
+ */
+function resolveSubtaskTimeoutMs(settingsRaw) {
+    const fromEnv = Number(process.env.NEXRALL_SUBTASK_TIMEOUT_MS);
+    if (Number.isFinite(fromEnv) && fromEnv > 0)
+        return Math.floor(fromEnv);
+    const raw = settingsRaw.subtaskTimeoutMs;
+    const fromSettings = Number(raw);
+    if (Number.isFinite(fromSettings) && fromSettings > 0)
+        return Math.floor(fromSettings);
+    return DEFAULT_SUBTASK_TIMEOUT_MS;
+}
 /** Cap on the text a sub-task hands back, so one verbose sub-agent can't blow up
  *  the PARENT's context in a single tool_result. */
 const SUBTASK_MAX = 48000; // chars (~12k tokens)
@@ -581,6 +669,14 @@ function summariseSubTaskProgress(messages) {
     }
     if (toolNames.length === 0)
         return '';
+    // The FINDINGS, not just the activity log.
+    //
+    // An inventory of tool names ("read_file ×9, bash ×14") tells the parent that work
+    // happened but nothing about what was learned, so it re-derives everything. A stalled
+    // research agent's value is almost entirely in what its last few tool calls RETURNED
+    // — the file it had just read, the command output it was about to interpret — because
+    // its own prose summary is exactly the thing it never got to write.
+    const recentFindings = lastToolResults(messages, SALVAGE_RESULT_COUNT, SALVAGE_RESULT_CHARS);
     // Collapse to "name ×N" so a 40-call run reads as a short inventory rather
     // than forty repeated lines of the same tool name.
     const counts = new Map();
@@ -590,7 +686,71 @@ function summariseSubTaskProgress(messages) {
         .sort((a, b) => b[1] - a[1])
         .map(([name, n]) => (n > 1 ? `${name} ×${n}` : name))
         .join(', ');
-    return `Tool calls completed before it was stopped (${toolNames.length} total): ${inventory}.`;
+    const header = `Tool calls completed before it was stopped (${toolNames.length} total): ${inventory}.`;
+    return recentFindings
+        ? `${header}\n\nWhat its most recent tool calls actually returned (use this instead of repeating them):\n${recentFindings}`
+        : header;
+}
+/** How many trailing tool results to salvage, and how much of each. */
+const SALVAGE_RESULT_COUNT = 4;
+const SALVAGE_RESULT_CHARS = 2000;
+/**
+ * The last N tool results from a transcript, newest last, each truncated.
+ *
+ * Pure + exported so the salvage rules are testable without a real sub-agent.
+ *
+ * Truncation keeps the HEAD of each result: tool output is overwhelmingly
+ * front-loaded (a file starts with its imports, a failing command starts with its
+ * error), and a head slice is the half that identifies what was found.
+ */
+function lastToolResults(messages, count, maxChars) {
+    // Map tool_use id → tool name, so a salvaged result can say WHICH tool produced it.
+    const nameById = new Map();
+    for (const m of messages) {
+        if (m.role !== 'assistant' || !Array.isArray(m.content))
+            continue;
+        for (const b of m.content) {
+            if (b?.type === 'tool_use' && b.id && typeof b.name === 'string')
+                nameById.set(b.id, b.name);
+        }
+    }
+    const out = [];
+    // Walk backwards and stop early: only the most recent results are worth the tokens,
+    // and a long research run may hold hundreds.
+    for (let i = messages.length - 1; i >= 0 && out.length < count; i--) {
+        const m = messages[i];
+        if (m.role !== 'user' || !Array.isArray(m.content))
+            continue;
+        for (const b of [...m.content].reverse()) {
+            if (out.length >= count)
+                break;
+            if (b?.type !== 'tool_result')
+                continue;
+            const text = toolResultText(b);
+            if (!text)
+                continue;
+            const name = nameById.get(String(b.tool_use_id ?? '')) ?? 'tool';
+            const body = text.length > maxChars
+                ? `${sliceSafeEnd(text, maxChars)}\n… [truncated]`
+                : text;
+            out.push(`• ${name}:\n${body}`);
+        }
+    }
+    return out.reverse().join('\n\n');
+}
+/** Extract readable text from a tool_result block, whose content may be string or blocks. */
+function toolResultText(block) {
+    const c = block.content;
+    if (typeof c === 'string')
+        return c.trim();
+    if (Array.isArray(c)) {
+        return c
+            .filter((x) => x?.type === 'text' && typeof x.text === 'string')
+            .map((x) => x.text)
+            .join('\n')
+            .trim();
+    }
+    return '';
 }
 async function runSubTask(input, options, agentTypes) {
     const prompt = typeof input.prompt === 'string' ? input.prompt.trim() : '';
@@ -673,9 +833,29 @@ async function runSubTask(input, options, agentTypes) {
     // A custom agent's persona is delivered through the project-instructions
     // channel (authoritative in the system prompt), layered above the project's
     // own nexrall.md so it keeps project conventions.
+    // ── Per-agent memory (`memory:` frontmatter) ────────────────────────────────
+    //
+    // When an agent declares a memory scope, its own notes from previous runs are
+    // injected ahead of its role prompt, and it gains ONE extra tool to append to them.
+    //
+    // Claude Code implements the equivalent by auto-enabling Read/Write/Edit "regardless
+    // of what the tools allowlist says". We deliberately do NOT copy that: silently
+    // widening a declared allowlist is fail-OPEN, and this repo already fixed the
+    // mirror-image bug (an unparseable agent file used to receive FULL access). So the
+    // grant here is a single purpose-built tool that can only ever touch this agent's
+    // own notes file — declaring `memory:` cannot hand anything write access to the repo.
+    const memoryScope = agent?.memory;
+    const agentMemoryNotes = agent && memoryScope
+        ? (0, memory_1.agentMemoryPreamble)(agent.name, memoryScope, options.workDir)
+        : '';
+    // `lightPrompt` agents skip the project's nexrall.md — see AgentType.lightPrompt for
+    // why. The role prompt and any private notes still apply; only the (potentially very
+    // large) project instruction file is dropped.
+    const inheritedMd = agent?.lightPrompt ? '' : (options.nexrallMd ?? '');
     const subNexrallMd = agent
         ? `# Sub-agent role: ${agent.name}\n${agent.prompt}` +
-            (options.nexrallMd ? `\n\n---\n\n${options.nexrallMd}` : '')
+            (agentMemoryNotes ? `\n\n---\n\n${agentMemoryNotes}` : '') +
+            (inheritedMd ? `\n\n---\n\n${inheritedMd}` : '')
         : options.nexrallMd;
     // Optional tool allowlist — deny anything outside it for this sub-agent.
     //
@@ -684,7 +864,19 @@ async function runSubTask(input, options, agentTypes) {
     // nothing, and a model told that will re-ask for approval instead of noticing
     // that the agent's own allowlist (often a typo'd tool name) is what stopped it.
     const allowed = agent?.tools ? new Set(agent.tools) : null;
+    // The ONE capability `memory:` grants. Added to the allowlist rather than bypassing
+    // it, so the allowlist stays the single source of truth for what this agent can do.
+    if (allowed && memoryScope)
+        allowed.add(exports.AGENT_MEMORY_TOOL);
     const gatedPermission = async (req) => {
+        // Guard against the tool being reachable without a declared scope — e.g. an agent
+        // that lists it in `tools:` by hand, or a general-purpose sub-task with no
+        // allowlist at all (`allowed === null` permits everything).
+        if (req.tool === exports.AGENT_MEMORY_TOOL && !(agent && memoryScope)) {
+            throw new ToolNotAllowedError(`\`${exports.AGENT_MEMORY_TOOL}\` is only available to a sub-agent whose definition declares a ` +
+                '`memory:` scope (project, user or local). Report anything worth remembering in your final ' +
+                'message instead — the main agent decides what to persist.');
+        }
         if (allowed && !allowed.has(req.tool)) {
             throw new ToolNotAllowedError(`The "${agent.name}" sub-agent is not allowed to use \`${req.tool}\` — it is not in that agent's ` +
                 'tool allowlist. This is a restriction of the agent definition, NOT a user decision: do not ask ' +
@@ -714,7 +906,34 @@ async function runSubTask(input, options, agentTypes) {
     // runAgentLoop already checks abortSignal.aborted at every iteration boundary,
     // so this is enough to make it stop promptly without a forceful kill.
     const subAbort = { aborted: false };
-    const timer = setTimeout(() => { subAbort.aborted = true; }, SUBTASK_TIMEOUT_MS);
+    const subtaskTimeoutMs = resolveSubtaskTimeoutMs((0, rules_1.loadSettings)(options.workDir).raw);
+    // ── Stall watchdog, NOT a total-runtime deadline ─────────────────────────────
+    //
+    // This used to be a single setTimeout armed once and never refreshed. Its own
+    // comment called it a "stalled-agent cutoff", but it measured TOTAL LIFETIME: a
+    // sub-agent working hard and calling a tool every few seconds was killed at ten
+    // minutes exactly like one that had hung. That is not a hypothetical — auditing a
+    // handful of 600-2800 line files legitimately exceeds it, and when it fired the
+    // parent got back a fragment ("I'll start by reading the files…") after paying for
+    // 23 tool calls, then typically re-ran the whole thing.
+    //
+    // The main loop already draws this distinction correctly (client.ts's heartbeat vs
+    // progress watchdogs, where only real events bump lastProgressAt). Sub-agents now do
+    // too: the clock resets on every completed tool round, so the cap means "no progress
+    // for N minutes" — which is what catches a genuine hang — while useful work can run
+    // as long as it keeps being useful.
+    //
+    // `stalled` is tracked separately from `subAbort.aborted` because the parent's Ctrl+C
+    // also sets the latter, and the two must be reported differently.
+    let lastProgressAt = Date.now();
+    let stalled = false;
+    const bumpProgress = () => { lastProgressAt = Date.now(); };
+    const stallWatchdog = setInterval(() => {
+        if (Date.now() - lastProgressAt > subtaskTimeoutMs) {
+            stalled = true;
+            subAbort.aborted = true;
+        }
+    }, 1000);
     // Mirror the parent's own abort into the sub-agent's signal so Ctrl+C during
     // a running sub-task still stops it (previously this worked implicitly by
     // sharing the same object via `...options` — now that we own a distinct
@@ -728,6 +947,27 @@ async function runSubTask(input, options, agentTypes) {
             ...options,
             _depth: depth + 1,
             _agentScope: `sub_${++_subTaskCounter}`, // isolated todo store per sub-agent
+            // ── Assigned UNCONDITIONALLY, never by conditional spread ────────────────
+            //
+            // These two were previously spread in only when set:
+            //
+            //   ...(agent && memoryScope ? { _agentMemory: … } : {}),
+            //
+            // which does NOT clear the key — it leaves whatever `...options` already had.
+            // So a child WITHOUT its own `memory:` inherited its PARENT's binding and would
+            // have appended to another agent's private notes; likewise an agent with no
+            // `tools:` line inherited the parent's allowlist, making the prompt's capability
+            // claim disagree with its real one.
+            //
+            // MAX_TASK_DEPTH === 1 means no nested spawn can reach this today, so it is
+            // latent rather than live — but the limiter comment below explicitly contemplates
+            // raising that depth, and this is exactly the kind of leak that would come back
+            // as a security bug rather than a visible error. Explicit undefined makes the
+            // child's identity independent of the parent's by construction.
+            _agentMemory: agent && memoryScope ? { agentName: agent.name, scope: memoryScope } : undefined,
+            // The same set `gatedPermission` enforces above, so prompt and permission agree
+            // by construction instead of by two people remembering to update both.
+            _allowedTools: allowed ?? undefined,
             editorContext: null, // fresh isolated context for sub-agent
             model: agent?.model ?? options.model,
             // Plan mode is inherited, never relaxed. If the main agent could spawn a
@@ -756,13 +996,20 @@ async function runSubTask(input, options, agentTypes) {
             // Forward tool events with isSubTask=true so the UI can render a badge
             // instead of prepending "[sub-task]" to the tool name (which caused double-prefix
             // when the name was already labelled, and mixed display concerns into the data layer).
-            onToolUse: (n, i) => options.onToolUse(n, i, true),
-            onToolResult: (n, r) => options.onToolResult(n, r, true),
+            // Every tool event is PROGRESS: it proves the sub-agent is still doing work, which
+            // is what the stall watchdog above measures. Bumping on both use and result means a
+            // single very slow tool (a long test run) resets the clock when it starts AND when
+            // it finishes, so it cannot be mistaken for a hang.
+            onToolUse: (n, i) => { bumpProgress(); options.onToolUse(n, i, true); },
+            onToolResult: (n, r) => { bumpProgress(); options.onToolResult(n, r, true); },
             onToolStreamChunk: (n, c) => options.onToolStreamChunk?.(n, c, true),
             // Forward thinking so the UI shows the indicator while sub-agent reasons
-            onThinking: (text) => options.onThinking?.(text),
-            onThinkingDelta: (text) => options.onThinkingDelta?.(text),
-            onThinkingProgress: (tok) => options.onThinkingProgress?.(tok),
+            // Thinking is progress too — a model reasoning for minutes on a hard problem is
+            // working, not stalled. Without this, deep reasoning on an expensive tier would
+            // trip the watchdog precisely when the sub-agent was most valuable.
+            onThinking: (text) => { bumpProgress(); options.onThinking?.(text); },
+            onThinkingDelta: (text) => { bumpProgress(); options.onThinkingDelta?.(text); },
+            onThinkingProgress: (tok) => { bumpProgress(); options.onThinkingProgress?.(tok); },
         });
         // ── Stall timeout: SALVAGE, don't discard ────────────────────────────────
         //
@@ -777,15 +1024,29 @@ async function runSubTask(input, options, agentTypes) {
         // whatever was actually accomplished, not instead of it. `preferLast: false`
         // because a killed sub-agent rarely has a closing summary — its useful output
         // is spread across the assistant turns it did manage to produce.
-        if (subAbort.aborted && !options.abortSignal?.aborted) {
-            const mins = Math.round(SUBTASK_TIMEOUT_MS / 60000);
+        if (stalled && !options.abortSignal?.aborted) {
+            const mins = Math.round(subtaskTimeoutMs / 60000);
             const partial = capSubTaskText(extractSubTaskText(result, false));
             const progress = summariseSubTaskProgress(result);
+            // Keep the transcript so the parent can CONTINUE this run instead of redoing it.
+            //
+            // Previously only a cleanly-finished sub-agent was remembered, on the reasoning
+            // that a transcript ending mid-thought is unsafe to build on. The reasoning is
+            // sound; the conclusion was too strong. Refusing to store it meant a stalled
+            // sub-agent's entire body of work — dozens of tool calls, already billed — was
+            // unreachable, so the parent's only option was the very thing we tell it not to
+            // do: run the whole task again. Resuming is now POSSIBLE but never implied to be
+            // safe: the text below states plainly that the work is unverified, and resumption
+            // re-authorises against current permissions exactly as it does for a clean run.
+            const partialId = (0, agentRegistry_1.rememberAgent)(agent?.name ?? null, (typeof input.description === 'string' && input.description.trim()) || prompt.slice(0, 80), result);
             const sections = [
-                `Sub-task STOPPED after ${mins} minutes without completing — treat the following as PARTIAL, unverified work, not a finished answer.`,
+                `Sub-task STOPPED after ${mins} minutes with NO PROGRESS (it was not making tool calls or ` +
+                    'producing output) — treat everything below as PARTIAL, unverified work, not a finished answer.',
                 progress,
                 partial ? `Partial output before it was stopped:\n\n${partial}` : '',
-                'Do NOT simply re-run the same sub-task: build on what is above, or split the remaining work into smaller, more focused sub-tasks.',
+                `Do NOT re-run the same sub-task from scratch. Either build on what is above, or continue THIS ` +
+                    `run with resume_agent_id="${partialId}" (it still has everything it read), or split the ` +
+                    'remaining work into smaller, more focused sub-tasks.',
             ].filter(Boolean);
             // Returned as `error` (not `output`) on purpose: the loop's ledger counts an
             // errored call as a non-effect, which is right — nothing here is verified —
@@ -834,7 +1095,7 @@ async function runSubTask(input, options, agentTypes) {
         return { error: `Sub-task failed: ${err.message}` };
     }
     finally {
-        clearTimeout(timer);
+        clearInterval(stallWatchdog);
         clearInterval(parentAbortPoll);
     }
 }
@@ -1850,7 +2111,23 @@ async function runAgentLoop(initialMessages, options) {
                     nexrallMd: planAwareNexrallMd,
                     clientType: options.clientType,
                     abortSignal: options.abortSignal,
-                    extraTools: options.mcpManager?.getAnthropicTools(),
+                    // MCP tools, plus the per-agent memory tool when (and only when) this run
+                    // is a sub-agent that declared a `memory:` scope. Declaring it through
+                    // extraTools rather than the backend's static catalogue keeps it invisible
+                    // to every other run: a tool the model cannot see is one it cannot try,
+                    // which is better than advertising it everywhere and refusing it at the gate.
+                    extraTools: [
+                        ...(options.mcpManager?.getAnthropicTools() ?? []),
+                        ...(options._agentMemory ? [exports.AGENT_MEMORY_TOOL_SCHEMA] : []),
+                    ],
+                    // Derived from the run's ACTUAL allowlist rather than asserted separately,
+                    // so the prompt's memory instructions cannot drift from what is permitted.
+                    // That drift is the bug being fixed: sub-agents were told they MUST call
+                    // memory_write, which no sub-agent allowlist contains.
+                    canWriteSharedMemory: options._allowedTools
+                        ? options._allowedTools.has('memory_write')
+                        : true, // no allowlist = main agent = may write
+                    hasOwnAgentStore: !!options._agentMemory,
                     agents: agentsCatalogue || undefined,
                     skills: skillsCatalogue || undefined,
                     // Only allow a post-render restart when the caller actually implements the
@@ -2160,6 +2437,15 @@ async function runAgentLoop(initialMessages, options) {
                     }
                     else {
                         try {
+                            // 0. Per-agent memory append. Handled HERE rather than in the executor
+                            // because only this loop knows which agent is running and what scope it
+                            // declared — the executor's TOOL_MAP is keyed by tool name alone, so it
+                            // could not tell whose notes to write to (and must not be able to).
+                            if (name === exports.AGENT_MEMORY_TOOL) {
+                                result = await executeAgentMemoryWrite(input, options._agentMemory, options.workDir);
+                                options.onToolResult(name, result);
+                                return { block: { ...block, id }, result };
+                            }
                             // 1. Try platform-specific tools (e.g. VS Code semantic tools)
                             const external = options.executeExternalTool
                                 ? await options.executeExternalTool(name, input)

package/dist/agent/memory.d.ts

@@ -41,5 +41,49 @@ export declare function memoryStats(scope: MemoryScope, workDir?: string): {
  * pulling api/client.ts's network/auth machinery into every consumer of this
  * module and to keep this file trivially unit-testable.
  */
+/** Max chars injected into a sub-agent's prompt from its own notes. */
+export declare const AGENT_MEMORY_INJECT_MAX = 8000;
+/** Hard cap on one agent's notes file. Same eviction-on-overflow rule as above. */
+export declare const AGENT_MEMORY_MAX_BYTES = 24000;
+/**
+ * Reject anything that isn't a plain, single-segment agent name.
+ *
+ * The name reaches this module from a FILENAME or a `name:` frontmatter field, and it
+ * is about to become a path segment — so `../../.ssh/authorized_keys` as an agent name
+ * would otherwise let a checked-in repo file choose where we write. Allowing only
+ * [A-Za-z0-9._-] and rejecting any form of separator or `..` makes traversal
+ * impossible rather than merely unlikely; the containment assertion in
+ * agentMemoryPath is the second line of defence.
+ */
+export declare function isSafeAgentName(name: string): boolean;
+/**
+ * Resolve where one agent's notes live, or null if the name is unsafe.
+ *
+ * `project` and `local` live under the repo (only `project` is meant to be committed);
+ * `user` follows the person across every checkout.
+ */
+export declare function agentMemoryPath(agentName: string, scope: 'project' | 'user' | 'local', workDir?: string): string | null;
+/** Read an agent's own notes (empty string when it has none). */
+export declare function readAgentMemory(agentName: string, scope: 'project' | 'user' | 'local', workDir?: string): string;
+/**
+ * Append a fact to an agent's own notes.
+ *
+ * Same shape as writeMemory (dated bullets, per-entry cap, near-duplicate skip, file
+ * lock) so behaviour is predictable across both stores — but bounded by simple
+ * eviction rather than LLM compaction: this file is small, per-agent, and not worth a
+ * model call to condense.
+ */
+export declare function writeAgentMemory(agentName: string, scope: 'project' | 'user' | 'local', content: string, workDir?: string): Promise<{
+    ok: boolean;
+    already: boolean;
+    file: string;
+}>;
+/**
+ * The block prepended to a sub-agent's instructions, or '' when it has no notes.
+ *
+ * Truncated from the TAIL: the newest entries are the ones worth keeping when a store
+ * outgrows the injection budget.
+ */
+export declare function agentMemoryPreamble(agentName: string, scope: 'project' | 'user' | 'local', workDir?: string): string;
 export declare function compactMemoryIfNeeded(scope: MemoryScope, workDir: string | undefined, summarize: (prompt: string) => Promise<string>): Promise<boolean>;
 //# sourceMappingURL=memory.d.ts.map

package/dist/agent/memory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../src/agent/memory.ts"],"names":[],"mappings":"AAiCA,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE/C;;;sDAGsD;AACtD,wBAAgB,cAAc,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAI3E;AAED,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAC1C,eAAO,MAAM,gBAAgB,QAAS,CAAC;AACvC,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAMnD,eAAO,MAAM,qBAAqB,QAAmC,CAAC;AA4CtE,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,WAAW,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAuBnH;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAGvE;AAED;gFACgF;AAChF,wBAAgB,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAStD;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAGtE;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAKlH;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GAC7C,OAAO,CAAC,OAAO,CAAC,CA+BlB"}
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../src/agent/memory.ts"],"names":[],"mappings":"AAiCA,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE/C;;;sDAGsD;AACtD,wBAAgB,cAAc,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAI3E;AAED,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAC1C,eAAO,MAAM,gBAAgB,QAAS,CAAC;AACvC,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAMnD,eAAO,MAAM,qBAAqB,QAAmC,CAAC;AA4CtE,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,WAAW,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAuBnH;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAGvE;AAED;gFACgF;AAChF,wBAAgB,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAStD;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAGtE;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAKlH;AAED;;;;;;;;;;;;;;;GAeG;AAUH,uEAAuE;AACvE,eAAO,MAAM,uBAAuB,OAAQ,CAAC;AAC7C,mFAAmF;AACnF,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,EACnC,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,GAAG,IAAI,CAqBf;AAED,iEAAiE;AACjE,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,EACnC,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,CAIR;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,EACnC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAuB1D;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,EACnC,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,CAYR;AAED,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GAC7C,OAAO,CAAC,OAAO,CAAC,CA+BlB"}

package/dist/agent/memory.js

@@ -33,13 +33,18 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MEMORY_HARD_CAP_BYTES = exports.MEMORY_COMPACT_TRIGGER_BYTES = exports.MEMORY_MAX_BYTES = exports.MEMORY_ENTRY_MAX_CHARS = void 0;
+exports.AGENT_MEMORY_MAX_BYTES = exports.AGENT_MEMORY_INJECT_MAX = exports.MEMORY_HARD_CAP_BYTES = exports.MEMORY_COMPACT_TRIGGER_BYTES = exports.MEMORY_MAX_BYTES = exports.MEMORY_ENTRY_MAX_CHARS = void 0;
 exports.memoryFilePath = memoryFilePath;
 exports.writeMemory = writeMemory;
 exports.readMemory = readMemory;
 exports.readAllMemory = readAllMemory;
 exports.clearMemory = clearMemory;
 exports.memoryStats = memoryStats;
+exports.isSafeAgentName = isSafeAgentName;
+exports.agentMemoryPath = agentMemoryPath;
+exports.readAgentMemory = readAgentMemory;
+exports.writeAgentMemory = writeAgentMemory;
+exports.agentMemoryPreamble = agentMemoryPreamble;
 exports.compactMemoryIfNeeded = compactMemoryIfNeeded;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
@@ -209,6 +214,117 @@ function memoryStats(scope, workDir) {
  * pulling api/client.ts's network/auth machinery into every consumer of this
  * module and to keep this file trivially unit-testable.
  */
+// ─── Per-agent memory (the `memory:` frontmatter field) ──────────────────────
+//
+// A SEPARATE store from the shared global/project memory above. The shared store is
+// the main agent's, written while the user watches; this one belongs to a single
+// named sub-agent so a repeatedly-invoked agent can accumulate its own expertise
+// without polluting the shared file (and without 4 parallel sub-agents fighting over
+// it). The cost, stated plainly: these stores are ISOLATED — two agents learn nothing
+// from one another.
+/** Max chars injected into a sub-agent's prompt from its own notes. */
+exports.AGENT_MEMORY_INJECT_MAX = 8000;
+/** Hard cap on one agent's notes file. Same eviction-on-overflow rule as above. */
+exports.AGENT_MEMORY_MAX_BYTES = 24000;
+/**
+ * Reject anything that isn't a plain, single-segment agent name.
+ *
+ * The name reaches this module from a FILENAME or a `name:` frontmatter field, and it
+ * is about to become a path segment — so `../../.ssh/authorized_keys` as an agent name
+ * would otherwise let a checked-in repo file choose where we write. Allowing only
+ * [A-Za-z0-9._-] and rejecting any form of separator or `..` makes traversal
+ * impossible rather than merely unlikely; the containment assertion in
+ * agentMemoryPath is the second line of defence.
+ */
+function isSafeAgentName(name) {
+    return /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(name) && !name.includes('..');
+}
+/**
+ * Resolve where one agent's notes live, or null if the name is unsafe.
+ *
+ * `project` and `local` live under the repo (only `project` is meant to be committed);
+ * `user` follows the person across every checkout.
+ */
+function agentMemoryPath(agentName, scope, workDir) {
+    if (!isSafeAgentName(agentName))
+        return null;
+    const file = `${agentName}.md`;
+    let dir;
+    if (scope === 'user') {
+        dir = path.join(MEMORY_ROOT, 'agent-memory');
+    }
+    else {
+        // Repo-scoped stores need a workDir; without one there is no repo to scope to.
+        if (!workDir)
+            return null;
+        dir = path.join(path.resolve(workDir), '.nexrall', scope === 'local' ? 'agent-memory-local' : 'agent-memory');
+    }
+    const full = path.join(dir, file);
+    // Defence in depth: even if the name check above were ever loosened, the resolved
+    // path must still sit inside the directory we intended.
+    const rel = path.relative(dir, full);
+    if (rel.startsWith('..') || path.isAbsolute(rel))
+        return null;
+    return full;
+}
+/** Read an agent's own notes (empty string when it has none). */
+function readAgentMemory(agentName, scope, workDir) {
+    const file = agentMemoryPath(agentName, scope, workDir);
+    if (!file)
+        return '';
+    return readMemoryFile(file).trim();
+}
+/**
+ * Append a fact to an agent's own notes.
+ *
+ * Same shape as writeMemory (dated bullets, per-entry cap, near-duplicate skip, file
+ * lock) so behaviour is predictable across both stores — but bounded by simple
+ * eviction rather than LLM compaction: this file is small, per-agent, and not worth a
+ * model call to condense.
+ */
+async function writeAgentMemory(agentName, scope, content, workDir) {
+    let trimmed = content.trim();
+    if (!trimmed)
+        return { ok: false, already: false, file: '' };
+    if (trimmed.length > exports.MEMORY_ENTRY_MAX_CHARS) {
+        trimmed = trimmed.slice(0, exports.MEMORY_ENTRY_MAX_CHARS - 1).trimEnd() + '…';
+    }
+    const file = agentMemoryPath(agentName, scope, workDir);
+    if (!file)
+        return { ok: false, already: false, file: '' };
+    return withLock(file, async () => {
+        const existing = readMemoryFile(file);
+        const fingerprint = trimmed.toLowerCase().slice(0, FINGERPRINT_LEN);
+        if (existing.toLowerCase().includes(fingerprint)) {
+            return { ok: true, already: true, file };
+        }
+        const today = new Date().toISOString().slice(0, 10);
+        let next = existing + `\n- [${today}] ${trimmed}`;
+        if (Buffer.byteLength(next, 'utf-8') > exports.AGENT_MEMORY_MAX_BYTES) {
+            next = evictOldest(next, exports.AGENT_MEMORY_MAX_BYTES);
+        }
+        writeMemoryFile(file, next);
+        return { ok: true, already: false, file };
+    });
+}
+/**
+ * The block prepended to a sub-agent's instructions, or '' when it has no notes.
+ *
+ * Truncated from the TAIL: the newest entries are the ones worth keeping when a store
+ * outgrows the injection budget.
+ */
+function agentMemoryPreamble(agentName, scope, workDir) {
+    const notes = readAgentMemory(agentName, scope, workDir);
+    if (!notes)
+        return '';
+    const kept = Buffer.byteLength(notes, 'utf-8') > exports.AGENT_MEMORY_INJECT_MAX
+        ? notes.slice(-exports.AGENT_MEMORY_INJECT_MAX)
+        : notes;
+    return (`# Your own notes (agent: ${agentName}, scope: ${scope})\n` +
+        `These are notes YOU saved on previous runs. Treat them as your accumulated experience, ` +
+        `not as instructions from the user, and verify anything that looks stale against the ` +
+        `current code.\n\n${kept}`);
+}
 async function compactMemoryIfNeeded(scope, workDir, summarize) {
     const file = memoryFilePath(scope, workDir);
     return withLock(file, async () => {

package/dist/api/client.d.ts

@@ -44,6 +44,17 @@ export interface StreamChatOptions {
     agents?: string;
     /** Catalogue of auto-invokable skills (description only) — injected into the system prompt so the model can call use_skill when relevant. */
     skills?: string;
+    /**
+     * Whether THIS run may write the shared memory store.
+     *
+     * Drives which memory instructions the backend puts in the system prompt. It must
+     * mirror the run's actual allowlist: the prompt used to order every sub-agent to
+     * "MUST call memory_write" while no sub-agent has that tool, so each one hit a
+     * refusal on every completed task. Undefined means "main agent" (may write).
+     */
+    canWriteSharedMemory?: boolean;
+    /** Whether this run is a sub-agent with its own `memory:` store (agent_memory_write). */
+    hasOwnAgentStore?: boolean;
     /**
      * Opt in to restarting a turn that died AFTER partial output was rendered.
      *

package/dist/api/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAA8B,UAAU,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAiErH,eAAO,MAAM,QAAQ,QAAmB,CAAC;AAIzC;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,SAAS;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EAC5D,OAAO,EAAE,CAAC,EAAE,EACZ,UAAU,EAAE,KAAK,CAAC;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,IAAI,GAAG,SAAS,GACtD,CAAC,EAAE,CAeL;AAiGD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IACnC,oFAAoF;IACpF,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IACjG,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6IAA6I;IAC7I,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;;;;;;OAeG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AAiDD,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,CAAC,CAAC,EAAE,QAAQ,KAAK,IAAI,GAC7B,OAAO,CAAC,OAAO,CAAC,CAwlClB;AAID;;;;;;;;;;;GAWG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAU9D;AAID;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAYxD;AAID,wBAAsB,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,CA0BlD;AAID,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA+B1E;AAID,wBAAsB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA0BhF"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAA8B,UAAU,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAiErH,eAAO,MAAM,QAAQ,QAAmB,CAAC;AAIzC;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,SAAS;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EAC5D,OAAO,EAAE,CAAC,EAAE,EACZ,UAAU,EAAE,KAAK,CAAC;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,IAAI,GAAG,SAAS,GACtD,CAAC,EAAE,CAeL;AAiGD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IACnC,oFAAoF;IACpF,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IACjG,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6IAA6I;IAC7I,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,yFAAyF;IACzF,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;;;;;;;;OAeG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AAiDD,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,CAAC,CAAC,EAAE,QAAQ,KAAK,IAAI,GAC7B,OAAO,CAAC,OAAO,CAAC,CAwlClB;AAID;;;;;;;;;;;GAWG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAU9D;AAID;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAYxD;AAID,wBAAsB,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,CA0BlD;AAID,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA+B1E;AAID,wBAAsB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA0BhF"}

package/dist/api/client.js

@@ -243,7 +243,7 @@ function sleep(ms) {
  *  the nested product (36) exists to bound pathological cases, not to be reached. */
 const MAX_TOTAL_ATTEMPTS = (MAX_RETRIES + 1) * (MAX_RETRIES + 1);
 async function streamChat(messages, options, onEvent) {
-    const { model, env, editorContext, nexrallMd, mode, effort, clientType, abortSignal, extraTools, agents, skills, allowRestartAfterRender } = options;
+    const { model, env, editorContext, nexrallMd, mode, effort, clientType, abortSignal, extraTools, agents, skills, allowRestartAfterRender, canWriteSharedMemory, hasOwnAgentStore } = options;
     // IDEMPOTENCY KEY for this logical turn, generated ONCE and reused by every retry
     // below (that reuse is the entire point — a fresh id per attempt would be useless).
     //
@@ -331,7 +331,7 @@ async function streamChat(messages, options, onEvent) {
             {
                 method: 'POST',
                 headers: authHeaders(),
-                body: JSON.stringify({ messages, model, env, editorContext, nexrallMd, mode, effort, clientType, extraTools, agents, skills, turnId }),
+                body: JSON.stringify({ messages, model, env, editorContext, nexrallMd, mode, effort, clientType, extraTools, agents, skills, turnId, canWriteSharedMemory, hasOwnAgentStore }),
                 signal: controller.signal,
             },
         ];

package/dist/types.d.ts

@@ -389,6 +389,25 @@ export interface AgentLoopOptions {
      * sub-agents don't clobber each other's todo lists.
      */
     _agentScope?: string;
+    /**
+     * Internal: which agent's own notes `agent_memory_write` may append to.
+     *
+     * Set by runSubTask only for a sub-agent whose definition declares a `memory:`
+     * scope; absent everywhere else, which is what makes the tool unusable by the main
+     * agent and by agents that never opted in. Carried as a binding (name + scope)
+     * rather than a path so the loop cannot be tricked into writing outside the store.
+     */
+    _agentMemory?: {
+        agentName: string;
+        scope: 'project' | 'user' | 'local';
+    };
+    /**
+     * Internal: this run's effective tool allowlist, or undefined for the main agent
+     * (which has none). Passed so the loop can derive prompt content from the SAME set
+     * the permission gate enforces — the alternative, declaring capability separately,
+     * is exactly how the prompt came to order sub-agents to use a tool they lacked.
+     */
+    _allowedTools?: Set<string>;
 }
 /**
  * Thrown by `runAgentLoop` when a turn cannot continue (stream died, upstream

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,UAAU,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,aAAa,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAKD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9D;AAKD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,UAAU,EAAE,iBAAiB,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACzE;AAED,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,YAAY,GAAG,eAAe,GAAG,UAAU,GAAG,aAAa,CAAC;AAInG,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;IAC3B,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAID,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,UAAU,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,SAAS,CAAC;IACjB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,gBAAgB,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,0HAA0H;AAC1H,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,gBAAgB,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,gBAAgB,CAAC;IACvB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,QAAQ,GAChB,YAAY,GACZ,eAAe,GACf,uBAAuB,GACvB,aAAa,GACb,YAAY,GACZ,aAAa,GACb,gBAAgB,GAChB,wBAAwB,GACxB,qBAAqB,GACrB,aAAa,GACb,qBAAqB,GACrB,qBAAqB,GACrB,qBAAqB,CAAC;AAI1B,MAAM,WAAW,SAAS;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,gEAAgE;IAChE,WAAW,CAAC,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvF,8DAA8D;IAC9D,oBAAoB,CAAC,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChH,4DAA4D;IAC5D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,kBAAkB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9C,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IACvF,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9E;;;;;;;;;OASG;IACH,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC/E;;;;;OAKG;IACH,OAAO,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IACnD;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IACzE,+FAA+F;IAC/F,eAAe,CAAC,EAAE,MAAM,IAAI,CAAC;IAC7B;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,KAAK,IAAI,CAAC;IACnE;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IAClE;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,KAAK,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAChE,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACnG,+EAA+E;IAC/E,UAAU,CAAC,EAAE,OAAO,eAAe,EAAE,UAAU,CAAC;IAChD,qFAAqF;IACrF,iBAAiB,CAAC,EAAE,OAAO,sBAAsB,EAAE,iBAAiB,CAAC;IACrE;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,MAAM,EAAE,CAAC;IAClC,+FAA+F;IAC/F,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IAC3C;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAID;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACvC,iFAAiF;IACjF,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC7B;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;gBAEb,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAOzF;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,cAAc,CAEpE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,EAAE,GAAG,IAAI,CAG7D"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,UAAU,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,aAAa,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAKD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9D;AAKD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,UAAU,EAAE,iBAAiB,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACzE;AAED,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,YAAY,GAAG,eAAe,GAAG,UAAU,GAAG,aAAa,CAAC;AAInG,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;IAC3B,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAID,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,UAAU,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,SAAS,CAAC;IACjB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,gBAAgB,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,0HAA0H;AAC1H,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,gBAAgB,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,gBAAgB,CAAC;IACvB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,QAAQ,GAChB,YAAY,GACZ,eAAe,GACf,uBAAuB,GACvB,aAAa,GACb,YAAY,GACZ,aAAa,GACb,gBAAgB,GAChB,wBAAwB,GACxB,qBAAqB,GACrB,aAAa,GACb,qBAAqB,GACrB,qBAAqB,GACrB,qBAAqB,CAAC;AAI1B,MAAM,WAAW,SAAS;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,gEAAgE;IAChE,WAAW,CAAC,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvF,8DAA8D;IAC9D,oBAAoB,CAAC,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChH,4DAA4D;IAC5D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,kBAAkB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9C,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IACvF,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9E;;;;;;;;;OASG;IACH,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC/E;;;;;OAKG;IACH,OAAO,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IACnD;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IACzE,+FAA+F;IAC/F,eAAe,CAAC,EAAE,MAAM,IAAI,CAAC;IAC7B;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,KAAK,IAAI,CAAC;IACnE;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IAClE;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,KAAK,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAChE,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACnG,+EAA+E;IAC/E,UAAU,CAAC,EAAE,OAAO,eAAe,EAAE,UAAU,CAAC;IAChD,qFAAqF;IACrF,iBAAiB,CAAC,EAAE,OAAO,sBAAsB,EAAE,iBAAiB,CAAC;IACrE;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,MAAM,EAAE,CAAC;IAClC,+FAA+F;IAC/F,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IAC3C;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC1E;;;;;OAKG;IACH,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC7B;AAID;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACvC,iFAAiF;IACjF,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC7B;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;gBAEb,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAOzF;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,cAAc,CAEpE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,EAAE,GAAG,IAAI,CAG7D"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nexrall/code-core",
-  "version": "1.4.28",
+  "version": "1.4.30",
   "description": "Core agent loop, tools, and extension primitives for Nexrall Code — embed an AI coding agent in any Node.js application.",
   "license": "MIT",
   "author": "Nexrall <support@nexrall.com> (https://nexrall.com)",