@nexrall/code-core 1.4.30 → 1.4.32

package/dist/agent/loop.d.ts

@@ -1,5 +1,7 @@
 import type { Message, ToolResult, AgentLoopOptions, EnvContext } from '../types';
 import { type AgentMemoryScope } from './agentTypes';
+import { bashNeedsRepoLock } from '../permissions/bashClassify';
+export { bashNeedsRepoLock };
 /**
  * Fingerprint one round's tool failures, for the repeated-failure runaway guard.
  *
@@ -85,12 +87,35 @@ export declare function stopReasonNotice(reason: StopReason, ctx?: {
     repeatError?: string | null;
 }): string | null;
 export declare function resolveMaxIterations(optionValue: number | undefined, settingsRaw: Record<string, unknown>): number;
+/**
+ * Every path a tool call will touch, so all of them can be locked.
+ *
+ * `move_file`/`copy_file` carry `source` + `destination`, the rest carry `path`. Both
+ * `dest` and `destination` are accepted because the schema has used both spellings and
+ * silently missing the key would mean silently losing the lock — a failure that shows
+ * up as corrupted content rather than an error.
+ *
+ * Exported for tests: getting this wrong is invisible until two writes race.
+ */
+export declare function lockPathsFor(name: string, input: Record<string, unknown>, workDir?: string): string[];
+/**
+ * Resolve the fan-out limit: env → settings.json → default.
+ *
+ * Was env-ONLY, the same gap as the sub-task timeout: a project on a small machine that
+ * wanted 2, or a big one that wanted 6, had to set a shell variable, and nobody reading
+ * settings.json could see what the limit even was. Capped at 16 because this bounds real
+ * shared resources (CPU, the API rate limit, file handles) and a typo like 400 should
+ * degrade to "a lot" rather than fork-bomb the machine.
+ */
+export declare function resolveMaxConcurrentSubtasks(settingsRaw?: Record<string, unknown>): number;
 /**
  * Minimal concurrency gate. Hand-rolled rather than pulling in `p-limit` because
  * the CLI ships as a single esbuild bundle with no node_modules, and this is a
  * dozen lines.
  */
 export declare function createLimiter(max: number): <T>(fn: () => Promise<T>) => Promise<T>;
+/** Test-only: forget the memoised limiter so a new limit can take effect. */
+export declare function _resetSubTaskLimiter(): void;
 /**
  * How long a sub-agent may make NO progress before it is stopped.
  *

package/dist/agent/loop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loop.d.ts","sourceRoot":"","sources":["../../src/agent/loop.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,OAAO,EAKP,UAAU,EACV,gBAAgB,EAChB,UAAU,EACX,MAAM,UAAU,CAAC;AAIlB,OAAO,EAAkE,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAmKrH;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,GAC9C,MAAM,CAKR;AAED,+CAA+C;AAC/C,eAAO,MAAM,YAAY;;;CAAsC,CAAC;AAEhE;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,uBAAuB,CAAC;AAEtD;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;CAgB3B,CAAC;AAEX,mEAAmE;AACnE,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,gBAAgB,CAAC;CACzB;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,EAAE,kBAAkB,GAAG,SAAS,EACvC,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC,CA8BrB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAClB,OAAO,GACP,SAAS,GACT,oBAAoB,GACpB,gBAAgB,GAChB,YAAY,GACZ,SAAS,GACT,gBAAgB,GAChB,QAAQ,GACR,SAAS,CAAC;AAEd;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,UAAU,EAClB,GAAG,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GACzD,MAAM,GAAG,IAAI,CAgCf;AAWD,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,MAAM,CAWR;AAkED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAgBlF;AAiJD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAOpF;AAMD;;;;;;;;;;GAUG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AA4BD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,UAAU,UAAO,GAAG,MAAM,CAYjF;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,SAAc,GAAG,MAAM,CAKtE;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAgCpE;AAMD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CA6B5F;AAgbD,oGAAoG;AACpG,wBAAgB,gBAAgB,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,CAE1E;AA8BD,kHAAkH;AAClH,wBAAgB,oBAAoB,IAAI;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAEzE;AA6CD,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAM7D;AAsBD,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,aAA+G,CAAC;AAC7I;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,OAAO,CA8BrG;AAED,gGAAgG;AAChG,eAAO,MAAM,aAAa,QAA2J,CAAC;AAEtL;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAK5E;AAUD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAwBxD;AAoBD,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3D;;;;;;;OAOG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClE,qFAAqF;IACrF,aAAa,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvD;;;;;;;;;;;OAWG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,YAAY,IAAI,cAAc,CAE7C;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAC1B,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC1C,EAAE,EAAE,OAAO,EACX,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,IAAI,CA2EN;AAED,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAgC5D;AAmBD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,eAAe,SAAI,GAAG,MAAM,CAgCpF;AAsKD,gFAAgF;AAChF,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAE/D;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,OAAO,EAAE,EACnB,IAAI,EAAE;IACJ,KAAK,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC,GACA,OAAO,CAAC,OAAO,CAAC,CAqElB;AAID,wBAAsB,YAAY,CAChC,eAAe,EAAE,OAAO,EAAE,EAC1B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,OAAO,EAAE,CAAC,CA66BpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAqCtE"}
+{"version":3,"file":"loop.d.ts","sourceRoot":"","sources":["../../src/agent/loop.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,OAAO,EAKP,UAAU,EACV,gBAAgB,EAChB,UAAU,EACX,MAAM,UAAU,CAAC;AAIlB,OAAO,EAAkE,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAMrH,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAiK7B;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,GAC9C,MAAM,CAKR;AAED,+CAA+C;AAC/C,eAAO,MAAM,YAAY;;;CAAsC,CAAC;AAEhE;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,uBAAuB,CAAC;AAEtD;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;CAgB3B,CAAC;AAEX,mEAAmE;AACnE,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,gBAAgB,CAAC;CACzB;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,EAAE,kBAAkB,GAAG,SAAS,EACvC,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC,CA8BrB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAClB,OAAO,GACP,SAAS,GACT,oBAAoB,GACpB,gBAAgB,GAChB,YAAY,GACZ,SAAS,GACT,gBAAgB,GAChB,QAAQ,GACR,SAAS,CAAC;AAEd;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,UAAU,EAClB,GAAG,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GACzD,MAAM,GAAG,IAAI,CAgCf;AAWD,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,MAAM,CAWR;AA0ED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,EAAE,CAQV;AAwBD;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAAC,WAAW,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,MAAM,CAO9F;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAgBlF;AA0BD,6EAA6E;AAC7E,wBAAgB,oBAAoB,IAAI,IAAI,CAG3C;AA4ID;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAOpF;AAMD;;;;;;;;;;GAUG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AA4BD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,UAAU,UAAO,GAAG,MAAM,CAYjF;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,SAAc,GAAG,MAAM,CAKtE;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAgCpE;AAMD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CA6B5F;AAgbD,oGAAoG;AACpG,wBAAgB,gBAAgB,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,CAE1E;AA8BD,kHAAkH;AAClH,wBAAgB,oBAAoB,IAAI;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAEzE;AA6CD,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAM7D;AAsBD,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,aAA+G,CAAC;AAC7I;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,OAAO,CA8BrG;AAED,gGAAgG;AAChG,eAAO,MAAM,aAAa,QAA2J,CAAC;AAEtL;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAK5E;AAUD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAwBxD;AAoBD,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3D;;;;;;;OAOG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClE,qFAAqF;IACrF,aAAa,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvD;;;;;;;;;;;OAWG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,YAAY,IAAI,cAAc,CAE7C;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAC1B,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC1C,EAAE,EAAE,OAAO,EACX,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,IAAI,CA2EN;AAED,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAgC5D;AAmBD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,eAAe,SAAI,GAAG,MAAM,CAgCpF;AAsKD,gFAAgF;AAChF,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAE/D;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,OAAO,EAAE,EACnB,IAAI,EAAE;IACJ,KAAK,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC,GACA,OAAO,CAAC,OAAO,CAAC,CAqElB;AAID,wBAAsB,YAAY,CAChC,eAAe,EAAE,OAAO,EAAE,EAC1B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,OAAO,EAAE,CAAC,CA48BpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAqCtE"}

package/dist/agent/loop.js

@@ -33,12 +33,15 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.VERIFY_CMD_RE = exports.WRITE_TOOL_NAMES = exports.ToolNotAllowedError = exports.AGENT_MEMORY_TOOL_SCHEMA = exports.AGENT_MEMORY_TOOL = exports._stallLimits = void 0;
+exports.VERIFY_CMD_RE = exports.WRITE_TOOL_NAMES = exports.ToolNotAllowedError = exports.AGENT_MEMORY_TOOL_SCHEMA = exports.AGENT_MEMORY_TOOL = exports._stallLimits = exports.bashNeedsRepoLock = void 0;
 exports.errorRoundSignature = errorRoundSignature;
 exports.executeAgentMemoryWrite = executeAgentMemoryWrite;
 exports.stopReasonNotice = stopReasonNotice;
 exports.resolveMaxIterations = resolveMaxIterations;
+exports.lockPathsFor = lockPathsFor;
+exports.resolveMaxConcurrentSubtasks = resolveMaxConcurrentSubtasks;
 exports.createLimiter = createLimiter;
+exports._resetSubTaskLimiter = _resetSubTaskLimiter;
 exports.resolveSubtaskTimeoutMs = resolveSubtaskTimeoutMs;
 exports.extractSubTaskText = extractSubTaskText;
 exports.capSubTaskText = capSubTaskText;
@@ -64,6 +67,11 @@ const executor_1 = require("../tools/executor");
 const agentTypes_1 = require("./agentTypes");
 const skills_1 = require("./skills");
 const rules_1 = require("../permissions/rules");
+// bashNeedsRepoLock lives in permissions/bashClassify.ts, not here: the permission
+// gate needs the same "does this command mutate shared state?" answer, and importing
+// it from loop.ts would make permissions depend on the agent loop (a cycle).
+const bashClassify_1 = require("../permissions/bashClassify");
+Object.defineProperty(exports, "bashNeedsRepoLock", { enumerable: true, get: function () { return bashClassify_1.bashNeedsRepoLock; } });
 const planMode_1 = require("./planMode");
 const agentRegistry_1 = require("./agentRegistry");
 const sandbox_1 = require("../tools/sandbox");
@@ -387,6 +395,57 @@ async function withFileLock(absPath, fn) {
             _fileLocks.delete(absPath);
     }
 }
+/**
+ * Take several locks at once, always in a globally consistent order.
+ *
+ * Needed because move_file/copy_file touch TWO paths. Locking only one of them (the
+ * old behaviour locked `source` and left `dest` unprotected) leaves exactly the race
+ * the lock exists to prevent: a `move_file{dest:'shared.ts'}` running concurrently with
+ * an `edit_file{path:'shared.ts'}` had nothing serialising them.
+ *
+ * The sort is load-bearing, not tidiness: two callers acquiring {A,B} and {B,A} at the
+ * same time would deadlock, each holding what the other waits for. Sorting means every
+ * caller in the process takes them in the same order, which makes that impossible.
+ */
+async function withFileLocks(absPaths, fn) {
+    const unique = [...new Set(absPaths.filter(Boolean))].sort();
+    if (unique.length === 0)
+        return fn();
+    const [first, ...rest] = unique;
+    return withFileLock(first, () => (rest.length ? withFileLocks(rest, fn) : fn()));
+}
+/** Tools that mutate the filesystem and must be serialised per path. */
+const WRITE_TOOLS = new Set([
+    'write_file', 'edit_file', 'multi_edit', 'delete_file', 'move_file', 'copy_file', 'notebook_edit',
+]);
+/**
+ * Shared lock key for bash commands that mutate repository-wide state.
+ *
+ * Not a path, because these commands do not declare one — `git commit` contends over
+ * `.git/index.lock`, `npm install` over `node_modules` and the lockfile. One key means
+ * they serialise against each other while everything else stays parallel.
+ */
+const REPO_STATE_LOCK = '\u0000repo-state';
+/**
+ * Every path a tool call will touch, so all of them can be locked.
+ *
+ * `move_file`/`copy_file` carry `source` + `destination`, the rest carry `path`. Both
+ * `dest` and `destination` are accepted because the schema has used both spellings and
+ * silently missing the key would mean silently losing the lock — a failure that shows
+ * up as corrupted content rather than an error.
+ *
+ * Exported for tests: getting this wrong is invisible until two writes race.
+ */
+function lockPathsFor(name, input, workDir) {
+    if (!WRITE_TOOLS.has(name))
+        return [];
+    const raw = [input.path, input.source, input.destination, input.dest]
+        .filter((p) => typeof p === 'string' && p.length > 0);
+    const abs = raw.map((p) => (workDir ? path.resolve(workDir, p) : p));
+    // Fall back to the tool name so a malformed call still serialises against itself
+    // rather than escaping the lock entirely.
+    return abs.length ? abs : [name];
+}
 // ─── Sub-agent fan-out limiter ────────────────────────────────────────────────
 //
 // Tool calls in one turn run via Promise.all with no ceiling. For ordinary tools
@@ -407,10 +466,26 @@ async function withFileLock(absPath, fn) {
 //
 // This is a QUEUE, not a rejection: every sub-task still runs, just at most N at a
 // time. Failing the excess would be worse than serialising it.
-const MAX_CONCURRENT_SUBTASKS = (() => {
-    const raw = Number(process.env.NEXRALL_MAX_CONCURRENT_SUBTASKS);
-    return Number.isFinite(raw) && raw > 0 ? Math.floor(raw) : 4;
-})();
+const DEFAULT_MAX_CONCURRENT_SUBTASKS = 4;
+/**
+ * Resolve the fan-out limit: env → settings.json → default.
+ *
+ * Was env-ONLY, the same gap as the sub-task timeout: a project on a small machine that
+ * wanted 2, or a big one that wanted 6, had to set a shell variable, and nobody reading
+ * settings.json could see what the limit even was. Capped at 16 because this bounds real
+ * shared resources (CPU, the API rate limit, file handles) and a typo like 400 should
+ * degrade to "a lot" rather than fork-bomb the machine.
+ */
+function resolveMaxConcurrentSubtasks(settingsRaw = {}) {
+    const clamp = (n) => Math.min(Math.floor(n), 16);
+    const fromEnv = Number(process.env.NEXRALL_MAX_CONCURRENT_SUBTASKS);
+    if (Number.isFinite(fromEnv) && fromEnv > 0)
+        return clamp(fromEnv);
+    const fromSettings = Number(settingsRaw.maxConcurrentSubtasks);
+    if (Number.isFinite(fromSettings) && fromSettings > 0)
+        return clamp(fromSettings);
+    return DEFAULT_MAX_CONCURRENT_SUBTASKS;
+}
 /**
  * Minimal concurrency gate. Hand-rolled rather than pulling in `p-limit` because
  * the CLI ships as a single esbuild bundle with no node_modules, and this is a
@@ -438,7 +513,28 @@ function createLimiter(max) {
 // Process-wide, deliberately: the limit exists to protect shared resources (CPU,
 // the API rate limit, file handles), and those are shared across every concurrent
 // turn in this process, not just the tool calls of one message.
-const _subTaskLimit = createLimiter(MAX_CONCURRENT_SUBTASKS);
+//
+// Built LAZILY on first use rather than at module load, because the limit can now come
+// from settings.json and the workspace is not known when this module is imported.
+// Once created it is reused for the process lifetime — rebuilding it per turn would
+// reset `active` and let the ceiling be exceeded, which is worse than not honouring a
+// mid-session settings change.
+let _subTaskLimitInstance = null;
+let _subTaskLimitMax = 0;
+/** Sub-tasks dispatched but not yet finished — used only to detect queueing. */
+let _inFlightSubTasks = 0;
+function subTaskLimiter(workDir) {
+    if (!_subTaskLimitInstance) {
+        _subTaskLimitMax = resolveMaxConcurrentSubtasks(workDir ? (0, rules_1.loadSettings)(workDir).raw : {});
+        _subTaskLimitInstance = createLimiter(_subTaskLimitMax);
+    }
+    return { run: _subTaskLimitInstance, max: _subTaskLimitMax };
+}
+/** Test-only: forget the memoised limiter so a new limit can take effect. */
+function _resetSubTaskLimiter() {
+    _subTaskLimitInstance = null;
+    _subTaskLimitMax = 0;
+}
 // ─── Human-readable tool descriptions ────────────────────────────────────────
 function humanDescription(name, input) {
     switch (name) {
@@ -2426,9 +2522,30 @@ async function runAgentLoop(initialMessages, options) {
                     // waiting on a child that can never be scheduled, the run would wedge
                     // permanently. Keeping the limiter acyclic (a holder never re-enters it)
                     // means raising MAX_TASK_DEPTH later can't silently reintroduce that.
-                    result = depth === 0
-                        ? await _subTaskLimit(() => runSubTask(input, options, agentTypes))
-                        : await runSubTask(input, options, agentTypes);
+                    if (depth === 0) {
+                        const { run: limitRun, max: limitMax } = subTaskLimiter(options.workDir);
+                        // Tell the user when a sub-task is WAITING rather than working.
+                        //
+                        // With a burst of 8 and a ceiling of 4, the last four sat silently in the
+                        // queue. From the outside they looked started, so a long wait read as a
+                        // hang — and the fix for a hang (Ctrl+C and retry) is exactly wrong here,
+                        // since the work was about to run. `_inFlightSubTasks` is only ever
+                        // touched from this single dispatch point, so the count is exact.
+                        if (_inFlightSubTasks >= limitMax) {
+                            (options.onNotice ?? options.onText)(`\u23f3 Queued: ${limitMax} sub-agents are already running, so this one starts when a ` +
+                                `slot frees up (raise "maxConcurrentSubtasks" in .nexrall/settings.json to widen it).`);
+                        }
+                        _inFlightSubTasks++;
+                        try {
+                            result = await limitRun(() => runSubTask(input, options, agentTypes));
+                        }
+                        finally {
+                            _inFlightSubTasks--;
+                        }
+                    }
+                    else {
+                        result = await runSubTask(input, options, agentTypes);
+                    }
                 }
                 else {
                     const pre = runToolHooks(hooks.PreToolUse, 'PreToolUse', name, input, options.workDir);
@@ -2462,22 +2579,28 @@ async function runAgentLoop(initialMessages, options) {
                             else {
                                 // Snapshot pre-mutation state so the user can /rewind this turn.
                                 options.checkpointManager?.recordBeforeMutation(name, input);
-                                // Serialise writes to the same file: if the model emits two
-                                // edit_file/write_file calls for the same path in one turn
-                                // (executed via Promise.all), the second would overwrite the
-                                // first. withFileLock queues them so they apply sequentially.
-                                const WRITE_TOOLS = new Set(['write_file', 'edit_file', 'multi_edit', 'delete_file', 'move_file', 'copy_file', 'notebook_edit']);
                                 const onStream = options.onToolStreamChunk
                                     ? (chunk) => options.onToolStreamChunk(name, chunk)
                                     : undefined;
-                                if (WRITE_TOOLS.has(name)) {
-                                    const targetPath = (typeof input.path === 'string' ? input.path : typeof input.source === 'string' ? input.source : '');
-                                    const absTarget = targetPath && options.workDir ? path.resolve(options.workDir, targetPath) : targetPath;
-                                    result = await withFileLock(absTarget || name, () => (0, executor_1.executeTool)(name, input, options.abortSignal, sandboxCfg, options.workDir, agentScope, onStream));
-                                }
-                                else {
-                                    result = await (0, executor_1.executeTool)(name, input, options.abortSignal, sandboxCfg, options.workDir, agentScope, onStream);
-                                }
+                                const run = () => (0, executor_1.executeTool)(name, input, options.abortSignal, sandboxCfg, options.workDir, agentScope, onStream);
+                                // Serialise anything that would otherwise race. Two sources of races:
+                                //
+                                //  • Writes to the SAME PATH — the model emits multiple tool_use blocks
+                                //    per turn and they run via Promise.all, so two edit_file calls on
+                                //    one file would both read the original and the second would discard
+                                //    the first. Now ALL paths a call touches are locked (move_file and
+                                //    copy_file have two), in a globally consistent order.
+                                //  • Repo-wide state via bash — `git commit`, `npm install`, `npm test`.
+                                //    These declare no path, so they take one shared lock. Read-only
+                                //    commands (grep, ls, cat) are excluded and stay parallel, which is
+                                //    what an explorer agent spends nearly all its calls on.
+                                //
+                                // This matters far more with sub-agents than without: up to 4 run
+                                // concurrently, each issuing its own tool calls into this same process.
+                                const locks = name === 'bash'
+                                    ? ((0, bashClassify_1.bashNeedsRepoLock)(String(input.command ?? '')) ? [REPO_STATE_LOCK] : [])
+                                    : lockPathsFor(name, input, options.workDir);
+                                result = locks.length ? await withFileLocks(locks, run) : await run();
                             }
                         }
                         catch (err) {

package/dist/index.d.ts

@@ -20,6 +20,8 @@ export * from './agent/agentTypes';
 export * from './agent/planMode';
 export * from './agent/agentRegistry';
 export * from './permissions/rules';
+export * from './permissions/modePolicy';
+export * from './permissions/bashClassify';
 export * from './permissions/destructive';
 export * from './plugins/index';
 export * from './plugins/installer';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC"}

package/dist/index.js

@@ -36,6 +36,8 @@ __exportStar(require("./agent/agentTypes"), exports);
 __exportStar(require("./agent/planMode"), exports);
 __exportStar(require("./agent/agentRegistry"), exports);
 __exportStar(require("./permissions/rules"), exports);
+__exportStar(require("./permissions/modePolicy"), exports);
+__exportStar(require("./permissions/bashClassify"), exports);
 __exportStar(require("./permissions/destructive"), exports);
 __exportStar(require("./plugins/index"), exports);
 __exportStar(require("./plugins/installer"), exports);

package/dist/permissions/bashClassify.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Whether a bash command should take the repo-state lock.
+ *
+ * Exported for tests: the failure mode (two concurrent `git commit`) is timing-dependent
+ * and painful to reproduce through the real loop.
+ *
+ * Scans EVERY segment, not just the first word, because the mutating verb is routinely
+ * not leading: `cd packages/core && npm publish`, `FOO=1 git push`, `ls && git commit`.
+ * Checking only the first token would miss most real commands.
+ */
+export declare function bashNeedsRepoLock(command: string): boolean;
+//# sourceMappingURL=bashClassify.d.ts.map

package/dist/permissions/bashClassify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bashClassify.d.ts","sourceRoot":"","sources":["../../src/permissions/bashClassify.ts"],"names":[],"mappings":"AAqCA;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAkB1D"}

package/dist/permissions/bashClassify.js

@@ -0,0 +1,73 @@
+"use strict";
+// ─── Classifying shell commands ───────────────────────────────────────────────
+//
+// Lives in permissions/ rather than agent/loop.ts because TWO subsystems need the same
+// answer to "does this command mutate shared state?":
+//
+//   • the concurrency locks — two `git commit` must not interleave;
+//   • the permission gate — `auto` mode runs `npm test` without asking but must still
+//     prompt for anything with wider side effects.
+//
+// Keeping one classifier means those can never disagree. Two copies would be a second
+// source of truth that has to stay in sync forever, which is the exact class of bug this
+// codebase keeps turning up (a prompt promising what the gate didn't enforce; a mode the
+// gate never read).
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.bashNeedsRepoLock = bashNeedsRepoLock;
+/**
+ * Commands that must not run concurrently with another instance of themselves.
+ *
+ * `bash` was excluded from the write-tool lock entirely, which was the largest hole in
+ * the concurrency story: it is the most mutating tool there is, and with 4 sub-agents
+ * fanned out two of them could run `git commit` simultaneously (one dies on
+ * `.git/index.lock`), or two `npm install` (corrupted node_modules / lockfile), or two
+ * `npm test` writing the same coverage and snapshot files (wrong results, not an error).
+ * The comment above withFileLock explains carefully why two edit_file calls must be
+ * sequenced, then a `bash -c 'echo x > file'` did exactly that with nothing holding it.
+ *
+ * Deliberately a VERB ALLOWLIST rather than serialising all of bash: an explorer's
+ * `grep`/`rg`/`ls`/`cat` are read-only and are precisely the calls that benefit most
+ * from running in parallel. Serialising those would trade a real correctness bug for a
+ * real performance regression. These verbs are the ones that take a global lock, write
+ * a lockfile, or mutate a shared build/dependency directory.
+ */
+const MUTATING_BASH_VERBS = new Set([
+    'git', 'npm', 'pnpm', 'yarn', 'bun', 'cargo', 'go', 'pip', 'pip3', 'poetry', 'uv',
+    'bundle', 'composer', 'gradle', 'mvn', 'make', 'terraform', 'helm', 'docker',
+    'vsce', 'tsc', 'pytest', 'dotnet', 'swift', 'gem',
+]);
+/**
+ * Whether a bash command should take the repo-state lock.
+ *
+ * Exported for tests: the failure mode (two concurrent `git commit`) is timing-dependent
+ * and painful to reproduce through the real loop.
+ *
+ * Scans EVERY segment, not just the first word, because the mutating verb is routinely
+ * not leading: `cd packages/core && npm publish`, `FOO=1 git push`, `ls && git commit`.
+ * Checking only the first token would miss most real commands.
+ */
+function bashNeedsRepoLock(command) {
+    if (!command)
+        return false;
+    // Split on shell separators, then take the first bare word of each segment, skipping
+    // env-var assignments (FOO=bar git push) and `sudo`/`time`-style prefixes.
+    const segments = command.split(/\|\||&&|[;|&\n()]|\$\(/);
+    for (const seg of segments) {
+        for (const tokenRaw of seg.trim().split(/\s+/)) {
+            const token = tokenRaw.replace(/^["']|["']$/g, '');
+            if (!token)
+                continue;
+            if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(token))
+                continue; // env assignment
+            if (token === 'sudo' || token === 'time' || token === 'nice' || token === 'env')
+                continue;
+            // Use the basename so `/usr/bin/git` and `./node_modules/.bin/tsc` still match.
+            const verb = token.split('/').pop() ?? token;
+            if (MUTATING_BASH_VERBS.has(verb))
+                return true;
+            break; // only the command word of each segment matters
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=bashClassify.js.map

package/dist/permissions/modePolicy.d.ts

@@ -0,0 +1,55 @@
+/** Permission modes, in increasing order of autonomy. */
+export type PermissionMode = 'plan' | 'ask' | 'edit' | 'auto';
+/** What the gate should do with one tool call. */
+export type PolicyDecision = 'allow' | 'ask' | 'deny' | 'confirm';
+export interface PolicyInput {
+    tool: string;
+    input: Record<string, unknown>;
+    mode: PermissionMode;
+    /** True when the user has already opted into blanket approval (--yolo / bypass). */
+    bypass?: boolean;
+    /** True when this call is irreversible (DB drop, force-push, rm -rf …). */
+    destructive?: boolean;
+}
+/**
+ * Tools that only ever READ. Always allowed, in every mode including plan.
+ *
+ * Kept here rather than in each client so "read-only" cannot mean two different things
+ * in two windows. Note `memory_write` is NOT here even though the CLI's old list had it
+ * — it mutates durable cross-session state, and listing it under "read-only / safe"
+ * meant it silently bypassed plan mode's read-only guarantee.
+ */
+export declare const READ_ONLY_TOOLS: Set<string>;
+/** Tools that write to the filesystem. */
+export declare const FILE_WRITE_TOOLS: Set<string>;
+/** Tools that move/delete files — riskier than an in-place edit. */
+export declare const FILE_MUTATE_TOOLS: Set<string>;
+/** Tools that run a shell command. */
+export declare const BASH_TOOLS: Set<string>;
+/**
+ * Is this bash command read-only?
+ *
+ * Deliberately delegates to `bashNeedsRepoLock`, the classifier written for the
+ * concurrency work: it already distinguishes commands that mutate shared state
+ * (`git`, `npm`, `cargo`, `make` …) from ones that only read (`grep`, `ls`, `cat`,
+ * `rg`), scanning every shell segment so `cd x && npm publish` is caught.
+ *
+ * Reusing it is the point. Writing a second classifier here would create two
+ * definitions of "mutating" that must agree forever — the exact failure this whole
+ * audit keeps finding. If the lock treats a command as mutating, so does the gate.
+ */
+export declare function isReadOnlyBash(command: string): boolean;
+/**
+ * The single source of truth for "should we prompt?".
+ *
+ * Order matters and mirrors Claude Code's: destructive actions are checked BEFORE any
+ * blanket approval, so an irreversible command can never ride `--yolo` or `auto`
+ * straight to execution. That ordering has a body count in the industry (dropped
+ * production databases), and it is the one rule no convenience setting may override.
+ */
+export declare function decide(req: PolicyInput): PolicyDecision;
+/** Human-readable one-liner for the footer / status bar. */
+export declare function describeMode(mode: PermissionMode): string;
+/** Normalise arbitrary input to a known mode, defaulting to the safe middle. */
+export declare function parseMode(raw: unknown): PermissionMode;
+//# sourceMappingURL=modePolicy.d.ts.map

package/dist/permissions/modePolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"modePolicy.d.ts","sourceRoot":"","sources":["../../src/permissions/modePolicy.ts"],"names":[],"mappings":"AAsBA,yDAAyD;AACzD,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;AAE9D,kDAAkD;AAClD,MAAM,MAAM,cAAc,GACtB,OAAO,GACP,KAAK,GACL,MAAM,GACN,SAAS,CAAC;AAEd,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,EAAE,cAAc,CAAC;IACrB,oFAAoF;IACpF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,aAU1B,CAAC;AAEH,0CAA0C;AAC1C,eAAO,MAAM,gBAAgB,aAE3B,CAAC;AAEH,oEAAoE;AACpE,eAAO,MAAM,iBAAiB,aAE5B,CAAC;AAEH,sCAAsC;AACtC,eAAO,MAAM,UAAU,aAAsD,CAAC;AAE9E;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED;;;;;;;GAOG;AACH,wBAAgB,MAAM,CAAC,GAAG,EAAE,WAAW,GAAG,cAAc,CAmDvD;AAED,4DAA4D;AAC5D,wBAAgB,YAAY,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAOzD;AAED,gFAAgF;AAChF,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,cAAc,CAGtD"}

package/dist/permissions/modePolicy.js

@@ -0,0 +1,125 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BASH_TOOLS = exports.FILE_MUTATE_TOOLS = exports.FILE_WRITE_TOOLS = exports.READ_ONLY_TOOLS = void 0;
+exports.isReadOnlyBash = isReadOnlyBash;
+exports.decide = decide;
+exports.describeMode = describeMode;
+exports.parseMode = parseMode;
+const bashClassify_1 = require("./bashClassify");
+/**
+ * Tools that only ever READ. Always allowed, in every mode including plan.
+ *
+ * Kept here rather than in each client so "read-only" cannot mean two different things
+ * in two windows. Note `memory_write` is NOT here even though the CLI's old list had it
+ * — it mutates durable cross-session state, and listing it under "read-only / safe"
+ * meant it silently bypassed plan mode's read-only guarantee.
+ */
+exports.READ_ONLY_TOOLS = new Set([
+    'read_file', 'list_directory', 'search_files', 'glob', 'grep',
+    'fetch_url', 'web_search',
+    'bash_output', 'kill_shell',
+    'todo_read', 'todo_write',
+    'memory_read',
+    'use_skill',
+    'notebook_read',
+    'get_diagnostics', 'go_to_definition', 'find_references',
+    'get_symbols', 'get_workspace_symbols', 'get_hover',
+]);
+/** Tools that write to the filesystem. */
+exports.FILE_WRITE_TOOLS = new Set([
+    'write_file', 'create_file', 'edit_file', 'multi_edit', 'notebook_edit',
+]);
+/** Tools that move/delete files — riskier than an in-place edit. */
+exports.FILE_MUTATE_TOOLS = new Set([
+    'delete_file', 'move_file', 'copy_file',
+]);
+/** Tools that run a shell command. */
+exports.BASH_TOOLS = new Set(['bash', 'run_command', 'execute_command']);
+/**
+ * Is this bash command read-only?
+ *
+ * Deliberately delegates to `bashNeedsRepoLock`, the classifier written for the
+ * concurrency work: it already distinguishes commands that mutate shared state
+ * (`git`, `npm`, `cargo`, `make` …) from ones that only read (`grep`, `ls`, `cat`,
+ * `rg`), scanning every shell segment so `cd x && npm publish` is caught.
+ *
+ * Reusing it is the point. Writing a second classifier here would create two
+ * definitions of "mutating" that must agree forever — the exact failure this whole
+ * audit keeps finding. If the lock treats a command as mutating, so does the gate.
+ */
+function isReadOnlyBash(command) {
+    return !(0, bashClassify_1.bashNeedsRepoLock)(command);
+}
+/**
+ * The single source of truth for "should we prompt?".
+ *
+ * Order matters and mirrors Claude Code's: destructive actions are checked BEFORE any
+ * blanket approval, so an irreversible command can never ride `--yolo` or `auto`
+ * straight to execution. That ordering has a body count in the industry (dropped
+ * production databases), and it is the one rule no convenience setting may override.
+ */
+function decide(req) {
+    const { tool, mode } = req;
+    const command = String(req.input.command ?? req.input.cmd ?? '');
+    // 1. Reads are always fine — an agent that cannot read cannot help.
+    //    Checked before plan mode too: plan mode is read-ONLY, not read-nothing.
+    if (exports.READ_ONLY_TOOLS.has(tool))
+        return 'allow';
+    if (exports.BASH_TOOLS.has(tool) && isReadOnlyBash(command) && !req.destructive)
+        return 'allow';
+    // 2. Irreversible actions ALWAYS need an explicit human "yes".
+    //    Before bypass, before mode. `rm -rf`, `git push --force`, `DROP TABLE` are not
+    //    things any mode should silently perform, and the strong confirm treatment (type
+    //    the word "yes", no "approve all") is what makes it a real speed bump.
+    if (req.destructive)
+        return 'confirm';
+    // 3. Plan mode: refuse every remaining (i.e. mutating) tool outright.
+    //    A refusal, not a prompt — the guarantee is "nothing changes until I approve the
+    //    plan", and a prompt would let one distracted keypress break it.
+    if (mode === 'plan')
+        return 'deny';
+    // 4. Explicit blanket approval (--yolo / bypassPermissions). Deliberately after the
+    //    destructive check above.
+    if (req.bypass)
+        return 'allow';
+    // 5. Mode policy for the mutating tools that remain.
+    if (exports.FILE_WRITE_TOOLS.has(tool) || exports.FILE_MUTATE_TOOLS.has(tool)) {
+        // `edit` and `auto` both pre-authorise ordinary file edits — that is the whole
+        // reason to leave `ask`.
+        return mode === 'ask' ? 'ask' : 'allow';
+    }
+    if (exports.BASH_TOOLS.has(tool)) {
+        // A mutating-but-recoverable command: `npm test`, `npm install`, `git commit`,
+        // `cargo build`. `auto` runs these, which is the behaviour its own prompt block
+        // already advertises. `edit` still asks, matching Claude Code's acceptEdits —
+        // "file changes flow, anything with side effects beyond the working directory
+        // still prompts" — because shell commands reach the network, global caches and
+        // other checkouts, not just this repo.
+        return mode === 'auto' ? 'allow' : 'ask';
+    }
+    // 6. Anything unrecognised — a newly added tool, an MCP tool, a plugin tool — asks,
+    //    in EVERY mode including `auto`.
+    //
+    //    Fail-CLOSED on permission, deliberately: a tool nobody has classified must not
+    //    inherit autonomy merely because the user chose a permissive mode. An MCP server
+    //    is third-party code whose blast radius this policy cannot see, so `auto` meaning
+    //    "run anything, including things I've never heard of" would make the mode
+    //    unauditable. Same principle as forcing an unparseable agent definition to
+    //    read-only: the less we know, the less it gets.
+    return 'ask';
+}
+/** Human-readable one-liner for the footer / status bar. */
+function describeMode(mode) {
+    switch (mode) {
+        case 'plan': return 'plan — read-only, produces a plan for approval';
+        case 'ask': return 'ask — approves reads; asks before edits and commands';
+        case 'edit': return 'edit — edits files freely; asks before shell commands';
+        case 'auto': return 'auto — edits and runs commands; still confirms irreversible actions';
+    }
+}
+/** Normalise arbitrary input to a known mode, defaulting to the safe middle. */
+function parseMode(raw) {
+    const s = String(raw ?? '').trim().toLowerCase();
+    return s === 'plan' || s === 'ask' || s === 'edit' || s === 'auto' ? s : 'ask';
+}
+//# sourceMappingURL=modePolicy.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nexrall/code-core",
-  "version": "1.4.30",
+  "version": "1.4.32",
   "description": "Core agent loop, tools, and extension primitives for Nexrall Code — embed an AI coding agent in any Node.js application.",
   "license": "MIT",
   "author": "Nexrall <support@nexrall.com> (https://nexrall.com)",