@nexrall/code-core 1.4.35 → 1.4.36

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/dist/permissions/modePolicy.d.ts.map +1 -1
  2. package/dist/permissions/modePolicy.js +25 -20
  3. package/package.json +1 -1
package/dist/permissions/modePolicy.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"modePolicy.d.ts","sourceRoot":"","sources":["../../src/permissions/modePolicy.ts"],"names":[],"mappings":"AAsBA,yDAAyD;AACzD,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;AAE9D,kDAAkD;AAClD,MAAM,MAAM,cAAc,GACtB,OAAO,GACP,KAAK,GACL,MAAM,GACN,SAAS,CAAC;AAEd,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,EAAE,cAAc,CAAC;IACrB,oFAAoF;IACpF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,aAU1B,CAAC;AAEH,0CAA0C;AAC1C,eAAO,MAAM,gBAAgB,aAE3B,CAAC;AAEH,oEAAoE;AACpE,eAAO,MAAM,iBAAiB,aAE5B,CAAC;AAEH,sCAAsC;AACtC,eAAO,MAAM,UAAU,aAAsD,CAAC;AAE9E;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED;;;;;;;GAOG;AACH,wBAAgB,MAAM,CAAC,GAAG,EAAE,WAAW,GAAG,cAAc,CAmDvD;AAED,4DAA4D;AAC5D,wBAAgB,YAAY,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAOzD;AAED,gFAAgF;AAChF,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,cAAc,CAGtD"}
1
+ {"version":3,"file":"modePolicy.d.ts","sourceRoot":"","sources":["../../src/permissions/modePolicy.ts"],"names":[],"mappings":"AAsBA,yDAAyD;AACzD,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;AAE9D,kDAAkD;AAClD,MAAM,MAAM,cAAc,GACtB,OAAO,GACP,KAAK,GACL,MAAM,GACN,SAAS,CAAC;AAEd,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,EAAE,cAAc,CAAC;IACrB,oFAAoF;IACpF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,aAU1B,CAAC;AAEH,0CAA0C;AAC1C,eAAO,MAAM,gBAAgB,aAE3B,CAAC;AAEH,oEAAoE;AACpE,eAAO,MAAM,iBAAiB,aAE5B,CAAC;AAEH,sCAAsC;AACtC,eAAO,MAAM,UAAU,aAAsD,CAAC;AAE9E;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED;;;;;;;GAOG;AACH,wBAAgB,MAAM,CAAC,GAAG,EAAE,WAAW,GAAG,cAAc,CAwDvD;AAED,4DAA4D;AAC5D,wBAAgB,YAAY,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAOzD;AAED,gFAAgF;AAChF,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,cAAc,CAGtD"}
package/dist/permissions/modePolicy.js CHANGED
@@ -78,34 +78,39 @@ function decide(req) {
78
78
  // plan", and a prompt would let one distracted keypress break it.
79
79
  if (mode === 'plan')
80
80
  return 'deny';
81
- // 4. Explicit blanket approval (--yolo / bypassPermissions). Deliberately after the
82
- // destructive check above.
83
- if (req.bypass)
81
+ // 4. Explicit blanket approval (--yolo / bypassPermissions), OR `auto` mode itself.
82
+ //
83
+ // `auto` used to only pre-authorise the two tool families it happened to name
84
+ // explicitly (file writes, bash) and fall through to "ask" for everything else —
85
+ // `task` (sub-agent dispatch), `generate_image`, `stock_photo`, `create_directory`,
86
+ // `move_file`, `copy_file`, and every MCP/plugin tool. That made "auto" a lie for
87
+ // any session that used sub-agents or MCP tools: the mode picker said "Nexrall
88
+ // chooses the best mode for each task" / "edits and runs commands", but the model
89
+ // still stopped and asked for a permission bubble on the very first `task` or MCP
90
+ // call. A mode named `auto` must mean the agent runs tools on its own — the same
91
+ // guarantee `bypass` already gives. Destructive commands and plan mode are checked
92
+ // ABOVE this line and are UNAFFECTED: `auto` still cannot silently drop a database
93
+ // or force-push, and cannot escape plan mode's read-only lock.
94
+ if (req.bypass || mode === 'auto')
84
95
  return 'allow';
85
- // 5. Mode policy for the mutating tools that remain.
96
+ // 5. Mode policy for the mutating tools that remain (ask / edit only — auto already
97
+ // returned above).
86
98
  if (exports.FILE_WRITE_TOOLS.has(tool) || exports.FILE_MUTATE_TOOLS.has(tool)) {
87
- // `edit` and `auto` both pre-authorise ordinary file edits — that is the whole
88
- // reason to leave `ask`.
99
+ // `edit` pre-authorises ordinary file edits — that is the whole reason to leave `ask`.
89
100
  return mode === 'ask' ? 'ask' : 'allow';
90
101
  }
91
102
  if (exports.BASH_TOOLS.has(tool)) {
92
- // A mutating-but-recoverable command: `npm test`, `npm install`, `git commit`,
93
- // `cargo build`. `auto` runs these, which is the behaviour its own prompt block
94
- // already advertises. `edit` still asks, matching Claude Code's acceptEdits —
103
+ // `edit` still asks before a shell command, matching Claude Code's acceptEdits —
95
104
  // "file changes flow, anything with side effects beyond the working directory
96
105
  // still prompts" — because shell commands reach the network, global caches and
97
106
  // other checkouts, not just this repo.
98
- return mode === 'auto' ? 'allow' : 'ask';
107
+ return 'ask';
99
108
  }
100
- // 6. Anything unrecognised — a newly added tool, an MCP tool, a plugin tool — asks,
101
- // in EVERY mode including `auto`.
102
- //
103
- // Fail-CLOSED on permission, deliberately: a tool nobody has classified must not
104
- // inherit autonomy merely because the user chose a permissive mode. An MCP server
105
- // is third-party code whose blast radius this policy cannot see, so `auto` meaning
106
- // "run anything, including things I've never heard of" would make the mode
107
- // unauditable. Same principle as forcing an unparseable agent definition to
108
- // read-only: the less we know, the less it gets.
109
+ // 6. Anything unrecognised — a newly added tool, an MCP tool, a plugin tool — asks in
110
+ // `ask` and `edit` mode. `auto` already returned 'allow' above (step 4): a mode
111
+ // whose entire point is "the agent runs tools on its own" cannot then carve out an
112
+ // exception for exactly the tools it wasn't told about, or every third-party/MCP
113
+ // tool call would silently degrade `auto` back into `ask`.
109
114
  return 'ask';
110
115
  }
111
116
  /** Human-readable one-liner for the footer / status bar. */
@@ -114,7 +119,7 @@ function describeMode(mode) {
114
119
  case 'plan': return 'plan — read-only, produces a plan for approval';
115
120
  case 'ask': return 'ask — approves reads; asks before edits and commands';
116
121
  case 'edit': return 'edit — edits files freely; asks before shell commands';
117
- case 'auto': return 'auto — edits and runs commands; still confirms irreversible actions';
122
+ case 'auto': return 'auto — runs every tool on its own; still confirms irreversible actions';
118
123
  }
119
124
  }
120
125
  /** Normalise arbitrary input to a known mode, defaulting to the safe middle. */
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@nexrall/code-core",
3
- "version": "1.4.35",
3
+ "version": "1.4.36",
4
4
  "description": "Core agent loop, tools, and extension primitives for Nexrall Code — embed an AI coding agent in any Node.js application.",
5
5
  "license": "MIT",
6
6
  "author": "Nexrall <support@nexrall.com> (https://nexrall.com)",