@nexrall/code-core 1.4.41 → 1.4.43
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/agent/agentTypes.d.ts.map +1 -1
- package/dist/agent/agentTypes.js +9 -4
- package/dist/agent/loop.d.ts.map +1 -1
- package/dist/agent/loop.js +15 -2
- package/dist/agent/securityLint.d.ts.map +1 -1
- package/dist/agent/securityLint.js +36 -2
- package/dist/api/client.d.ts +22 -7
- package/dist/api/client.d.ts.map +1 -1
- package/dist/api/client.js +25 -20
- package/dist/tools/executor.d.ts.map +1 -1
- package/dist/tools/executor.js +43 -0
- package/package.json +1 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"agentTypes.d.ts","sourceRoot":"","sources":["../../src/agent/agentTypes.ts"],"names":[],"mappings":"AAkCA,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,iDAAiD;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;IACpD;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,qDAAqD;AACrD,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;
|
|
1
|
+
{"version":3,"file":"agentTypes.d.ts","sourceRoot":"","sources":["../../src/agent/agentTypes.ts"],"names":[],"mappings":"AAkCA,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,iDAAiD;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;IACpD;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,qDAAqD;AACrD,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AAgX5D;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAuND;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,CAE3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAAC,QAAQ,EAAE,YAAY,EAAE,CAAA;CAAE,CAqB5G;AAED,yFAAyF;AACzF,wBAAgB,cAAc,IAAI,MAAM,EAAE,CAEzC;AAED,2FAA2F;AAC3F,wBAAgB,aAAa,IAAI,SAAS,EAAE,CAE3C;AACD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,CAY1D;AAQD,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAIjG"}
|
package/dist/agent/agentTypes.js
CHANGED
|
@@ -349,10 +349,15 @@ const BUILTIN_AGENTS = [
|
|
|
349
349
|
*
|
|
350
350
|
* Deliberately a SEPARATE list rather than an import from tools/executor.ts:
|
|
351
351
|
* that module's TOOL_MAP is the CLI's local dispatch table and legitimately
|
|
352
|
-
* lacks `get_diagnostics` (intercepted by VS Code before the executor)
|
|
353
|
-
*
|
|
354
|
-
*
|
|
355
|
-
*
|
|
352
|
+
* lacks `get_diagnostics` (intercepted by VS Code before the executor).
|
|
353
|
+
* Validating against it would reject a perfectly valid name. A canary test
|
|
354
|
+
* asserts every name used by the builtin agents appears here, so the two
|
|
355
|
+
* cannot drift apart unnoticed.
|
|
356
|
+
*
|
|
357
|
+
* `web_search` WAS run server-side by Anthropic (absent from TOOL_MAP) — as of
|
|
358
|
+
* the 2026-08-11+ provider-agnostic port (backend/services/webSearch.js, Tavily)
|
|
359
|
+
* it is a plain client tool the executor runs itself (TOOL_MAP.web_search),
|
|
360
|
+
* exactly like fetch_url, so it no longer needs special-casing in that comment.
|
|
356
361
|
*/
|
|
357
362
|
const KNOWN_TOOL_NAMES = new Set([
|
|
358
363
|
'read_file', 'write_file', 'edit_file', 'multi_edit', 'list_directory', 'create_directory',
|
package/dist/agent/loop.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"loop.d.ts","sourceRoot":"","sources":["../../src/agent/loop.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,OAAO,EAKP,UAAU,EACV,gBAAgB,EAChB,UAAU,EACX,MAAM,UAAU,CAAC;AAIlB,OAAO,EAAkE,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAMrH,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,CAAC;AA0K7B;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,GAC9C,MAAM,CAKR;AAED,+CAA+C;AAC/C,eAAO,MAAM,YAAY;;;CAAsC,CAAC;AAEhE;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,uBAAuB,CAAC;AAEtD;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;CAgB3B,CAAC;AAEX,mEAAmE;AACnE,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,gBAAgB,CAAC;CACzB;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,EAAE,kBAAkB,GAAG,SAAS,EACvC,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC,CA8BrB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAClB,OAAO,GACP,SAAS,GACT,oBAAoB,GACpB,gBAAgB,GAChB,cAAc,GACd,YAAY,GACZ,SAAS,GACT,gBAAgB,GAChB,QAAQ,GACR,SAAS,CAAC;AAEd;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,UAAU,EAClB,GAAG,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GACzD,MAAM,GAAG,IAAI,CA2Cf;AAaD,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,MAAM,CAYR;AA0ED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,EAAE,CAQV;AAwBD;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAAC,WAAW,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,MAAM,CAW9F;AAoBD,kFAAkF;AAClF,wBAAgB,6BAA6B,CAAC,WAAW,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,MAAM,CAa/F;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAgBlF;AA6DD,6EAA6E;AAC7E,wBAAgB,oBAAoB,IAAI,IAAI,CAQ3C;AAeD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,IAAI,IAAI,CAIjD;AAqDD,oFAAoF;AACpF,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAmJD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,MAAM,CAOzF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAe9E;AAED;;;;;;;;;;;;;;;GAeG;AACH;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EACvB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS,GAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAIpB;AAED,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,EACb,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC1B,KAAK,GAAE,MAA+B,GACrC,OAAO,CAMT;AAaD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAOpF;AAMD;;;;;;;;;;GAUG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAQD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,UAAU,UAAO,GAAG,MAAM,CAYjF;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,SAAc,GAAG,MAAM,CAKtE;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAgCpE;AAMD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CA6B5F;AA2jBD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAEvD;AA8BD,kHAAkH;AAClH,wBAAgB,oBAAoB,IAAI;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAEzE;AA6CD,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAM7D;AAsBD,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,aAA+G,CAAC;AAC7I;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,OAAO,CA8BrG;AAED,gGAAgG;AAChG,eAAO,MAAM,aAAa,QAA2J,CAAC;AAEtL;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAK5E;AAUD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAwBxD;AAoBD,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3D;;;;;;;OAOG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClE,qFAAqF;IACrF,aAAa,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvD;;;;;;;;;;;OAWG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,YAAY,IAAI,cAAc,CAE7C;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAC1B,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC1C,EAAE,EAAE,OAAO,EACX,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,IAAI,CA2EN;AAED,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAgC5D;AAmBD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,eAAe,SAAI,GAAG,MAAM,CAgCpF;AAoMD,gFAAgF;AAChF,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAE/D;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,OAAO,EAAE,EACnB,IAAI,EAAE;IACJ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC,GACA,OAAO,CAAC,OAAO,CAAC,CAgFlB;AAID,wBAAsB,YAAY,CAChC,eAAe,EAAE,OAAO,EAAE,EAC1B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,OAAO,EAAE,CAAC,
|
|
1
|
+
{"version":3,"file":"loop.d.ts","sourceRoot":"","sources":["../../src/agent/loop.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,OAAO,EAKP,UAAU,EACV,gBAAgB,EAChB,UAAU,EACX,MAAM,UAAU,CAAC;AAIlB,OAAO,EAAkE,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAMrH,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,CAAC;AA0K7B;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,GAC9C,MAAM,CAKR;AAED,+CAA+C;AAC/C,eAAO,MAAM,YAAY;;;CAAsC,CAAC;AAEhE;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,uBAAuB,CAAC;AAEtD;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;CAgB3B,CAAC;AAEX,mEAAmE;AACnE,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,gBAAgB,CAAC;CACzB;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,EAAE,kBAAkB,GAAG,SAAS,EACvC,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC,CA8BrB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAClB,OAAO,GACP,SAAS,GACT,oBAAoB,GACpB,gBAAgB,GAChB,cAAc,GACd,YAAY,GACZ,SAAS,GACT,gBAAgB,GAChB,QAAQ,GACR,SAAS,CAAC;AAEd;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,UAAU,EAClB,GAAG,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GACzD,MAAM,GAAG,IAAI,CA2Cf;AAaD,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,MAAM,CAYR;AA0ED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,EAAE,CAQV;AAwBD;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAAC,WAAW,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,MAAM,CAW9F;AAoBD,kFAAkF;AAClF,wBAAgB,6BAA6B,CAAC,WAAW,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,MAAM,CAa/F;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAgBlF;AA6DD,6EAA6E;AAC7E,wBAAgB,oBAAoB,IAAI,IAAI,CAQ3C;AAeD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,IAAI,IAAI,CAIjD;AAqDD,oFAAoF;AACpF,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAmJD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,MAAM,CAOzF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAe9E;AAED;;;;;;;;;;;;;;;GAeG;AACH;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EACvB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS,GAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAIpB;AAED,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,EACb,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC1B,KAAK,GAAE,MAA+B,GACrC,OAAO,CAMT;AAaD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAOpF;AAMD;;;;;;;;;;GAUG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAQD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,UAAU,UAAO,GAAG,MAAM,CAYjF;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,SAAc,GAAG,MAAM,CAKtE;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAgCpE;AAMD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CA6B5F;AA2jBD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAEvD;AA8BD,kHAAkH;AAClH,wBAAgB,oBAAoB,IAAI;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAEzE;AA6CD,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAM7D;AAsBD,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,aAA+G,CAAC;AAC7I;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,OAAO,CA8BrG;AAED,gGAAgG;AAChG,eAAO,MAAM,aAAa,QAA2J,CAAC;AAEtL;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAK5E;AAUD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAwBxD;AAoBD,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3D;;;;;;;OAOG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClE,qFAAqF;IACrF,aAAa,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvD;;;;;;;;;;;OAWG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,YAAY,IAAI,cAAc,CAE7C;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAC1B,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC1C,EAAE,EAAE,OAAO,EACX,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,IAAI,CA2EN;AAED,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAgC5D;AAmBD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,eAAe,SAAI,GAAG,MAAM,CAgCpF;AAoMD,gFAAgF;AAChF,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAE/D;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,OAAO,EAAE,EACnB,IAAI,EAAE;IACJ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC,GACA,OAAO,CAAC,OAAO,CAAC,CAgFlB;AAID,wBAAsB,YAAY,CAChC,eAAe,EAAE,OAAO,EAAE,EAC1B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,OAAO,EAAE,CAAC,CAuiCpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAqCtE"}
|
package/dist/agent/loop.js
CHANGED
|
@@ -2729,6 +2729,17 @@ async function runAgentLoop(initialMessages, options) {
|
|
|
2729
2729
|
? options._allowedTools.has('memory_write')
|
|
2730
2730
|
: true, // no allowlist = main agent = may write
|
|
2731
2731
|
hasOwnAgentStore: !!options._agentMemory,
|
|
2732
|
+
// Same derivation, same reason, for the network. The base prompt's
|
|
2733
|
+
// "Web search" section tells the run to reach the network, but
|
|
2734
|
+
// READ_ONLY_TOOLS (explorer, security-auditor, ...) contains neither
|
|
2735
|
+
// `fetch_url` nor `web_search`. MEASURED on the 195-trial 2026-08-10
|
|
2736
|
+
// deepseek-v4-pro benchmark: 29 of 51 `fetch_url` failures and 3 of 14
|
|
2737
|
+
// `web_search` failures were the permission gate refusing a sub-agent
|
|
2738
|
+
// that its own system prompt had just invited to browse — every one a
|
|
2739
|
+
// wasted round-trip on a paid turn.
|
|
2740
|
+
canBrowseWeb: options._allowedTools
|
|
2741
|
+
? options._allowedTools.has('fetch_url')
|
|
2742
|
+
: true, // no allowlist = main agent = may browse
|
|
2732
2743
|
// Withholds the `task` schema and its instructions when this run cannot
|
|
2733
2744
|
// delegate — see canSpawnSubAgents.
|
|
2734
2745
|
canSpawnSubAgents: maySpawn,
|
|
@@ -2818,9 +2829,11 @@ async function runAgentLoop(initialMessages, options) {
|
|
|
2818
2829
|
const { stopReason: _stopReason, ...historyMessage } = assistantMessage;
|
|
2819
2830
|
messages.push(historyMessage);
|
|
2820
2831
|
// 3. Collect tool_use blocks from the completed message.
|
|
2821
|
-
// Server-side tools (e.g.
|
|
2832
|
+
// Server-side tools (e.g. tool_search_tool_bm25) are executed by Anthropic and their
|
|
2822
2833
|
// tool_result blocks appear in the SAME assistant message. We must skip those —
|
|
2823
|
-
// sending a second tool_result for them would confuse the API.
|
|
2834
|
+
// sending a second tool_result for them would confuse the API. (web_search used to
|
|
2835
|
+
// be an example here too — as of the 2026-08-11+ provider-agnostic port it is a
|
|
2836
|
+
// plain client tool executed by THIS process, so it no longer belongs in this set.)
|
|
2824
2837
|
const serverSideResultIds = new Set(assistantMessage.content
|
|
2825
2838
|
.filter(b => b.type === 'tool_result')
|
|
2826
2839
|
.map(b => b.tool_use_id)
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"securityLint.d.ts","sourceRoot":"","sources":["../../src/agent/securityLint.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,eAAe;IAC9B,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;CAChB;
|
|
1
|
+
{"version":3,"file":"securityLint.d.ts","sourceRoot":"","sources":["../../src/agent/securityLint.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,eAAe;IAC9B,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;CAChB;AA+ID;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,SAAI,GAAG,eAAe,EAAE,CA6CzE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,CAepE"}
|
|
@@ -69,7 +69,25 @@ const RULES = [
|
|
|
69
69
|
// SCREAMING_SNAKE identifier (an env-var name) is excluded, along with the
|
|
70
70
|
// usual placeholder vocabulary. The value must also look like actual secret
|
|
71
71
|
// material: mixed case or digits, not a lone lowercase word.
|
|
72
|
-
|
|
72
|
+
//
|
|
73
|
+
// `\{\{` was added after porting this module to the Nexrall backend and
|
|
74
|
+
// re-measuring there: the only hit across 100 route/service files was
|
|
75
|
+
// `"x-api-key": "{{PAYOS_API_KEY}}"` inside a connector's DOCUMENTATION
|
|
76
|
+
// string — a mustache/handlebars placeholder, i.e. the opposite of a leaked
|
|
77
|
+
// credential. `${...}` was already excluded for exactly this reason; this is
|
|
78
|
+
// the same idea for the other common templating syntax, and it cannot mask a
|
|
79
|
+
// real secret because a literal `{{` never appears inside one.
|
|
80
|
+
//
|
|
81
|
+
// EXCLUSIONS ARE SCOPED TO THE VALUE (`[^'"`]*`), NOT THE WHOLE LINE (`.*`).
|
|
82
|
+
// Found by the tests written for the Nexrall backend port: the lookahead
|
|
83
|
+
// scanned the entire rest of the line, so ANY trailing comment containing a
|
|
84
|
+
// placeholder word silenced a genuine finding — `const pw = "<real secret>";
|
|
85
|
+
// // xxx` went SILENT, as did `// test`. An agent writing production code
|
|
86
|
+
// adds trailing comments constantly, so this was not a rare edge case.
|
|
87
|
+
// Bounding the lookahead at the closing quote keeps the placeholder
|
|
88
|
+
// vocabulary matching the VALUE (the only place it was ever meant to) while
|
|
89
|
+
// making a trailing comment irrelevant.
|
|
90
|
+
re: /(?:password|passwd|secret|api[_-]?key|apikey|access[_-]?token)['"`]?\s*[:=]\s*['"`](?![A-Z0-9_]+['"`])(?![^'"`]*(?:\$\{|\{\{|process\.env|os\.environ|example|changeme|placeholder|redacted|xxx|test|dummy|fake|sample|your[_-]?|<|\*{3}))(?=[^'"`]*[0-9A-Z])[^'"`\s]{10,}['"`]/,
|
|
73
91
|
message: 'Hardcoded credential literal. Read it from the environment/secret store instead, and rotate the exposed value.',
|
|
74
92
|
includeComments: true,
|
|
75
93
|
},
|
|
@@ -99,7 +117,23 @@ const RULES = [
|
|
|
99
117
|
// outside: req/request/params/query/body/input/user/args, or a bare
|
|
100
118
|
// `'...' + ident`. This trades recall for precision on purpose — thorough SQL
|
|
101
119
|
// review is the security-auditor agent's job, not an inline regex's.
|
|
102
|
-
|
|
120
|
+
//
|
|
121
|
+
// THE GAP IS PER-ALTERNATIVE, and that asymmetry is load-bearing. The concat
|
|
122
|
+
// branch originally shared the no-quote gap, which made it miss the QUOTED
|
|
123
|
+
// concatenation form — the more dangerous one, since the value lands inside
|
|
124
|
+
// a string literal where a lone `'` breaks out of the query:
|
|
125
|
+
//
|
|
126
|
+
// "DELETE FROM s WHERE t = " + query.token -> flagged
|
|
127
|
+
// "DELETE FROM s WHERE t = '" + query.token + "'" -> MISSED
|
|
128
|
+
//
|
|
129
|
+
// Loosening the gap for ALL branches fixes that but costs precision, measured
|
|
130
|
+
// on the Nexrall backend: the `${…}` branch then travels PAST the end of the
|
|
131
|
+
// SQL string to a later interpolation, flagging correctly-parameterised
|
|
132
|
+
// queries like `UPDATE users SET ${sets.join(',')} WHERE id=$${params.length}`
|
|
133
|
+
// (0/100 flagged files became 2/100). So only the concat branch gets the loose
|
|
134
|
+
// gap — it must cross a quote by construction — while the others stay confined
|
|
135
|
+
// to a single string segment.
|
|
136
|
+
re: /\b(?:SELECT|INSERT\s+INTO|UPDATE|DELETE\s+FROM)\b(?:[^;'"`]{0,160}(?:\$\{\s*(?:req|request|params?|query|body|input|user|args|ctx)\b|%\s*\(\s*(?:request|params?|query|body|input|user)\b)|[^;]{0,160}['"`]\s*\+\s*(?:req|request|params?|query|body|input|user|args|ctx)\b)/i,
|
|
103
137
|
message: 'SQL built by interpolating a request-derived value. Use a parameterised query ($1 / ? placeholders) — this is the classic injection sink.',
|
|
104
138
|
},
|
|
105
139
|
{
|
package/dist/api/client.d.ts
CHANGED
|
@@ -10,13 +10,17 @@ export declare const API_BASE: string;
|
|
|
10
10
|
* already stripped by the backend), when available.
|
|
11
11
|
*
|
|
12
12
|
* Rule: if the raw content contains ANY block beyond plain text / tool_use — i.e.
|
|
13
|
-
* server-side blocks like `server_tool_use
|
|
14
|
-
* nested `tool_reference`s)
|
|
15
|
-
*
|
|
16
|
-
*
|
|
17
|
-
*
|
|
18
|
-
*
|
|
19
|
-
*
|
|
13
|
+
* server-side blocks like `server_tool_use` or `tool_search_tool_result` (with its
|
|
14
|
+
* nested `tool_reference`s) — we MUST preserve the raw array verbatim so those blocks
|
|
15
|
+
* round-trip back to the API on the next request. Dropping them breaks the paired
|
|
16
|
+
* server_tool_use/result the API expects AND, for tool search, makes discovered
|
|
17
|
+
* (deferred) tools be forgotten → re-searched every turn. For an ordinary turn (only
|
|
18
|
+
* text/tool_use) we keep the rebuilt array so the common path is byte-identical to
|
|
19
|
+
* before (zero regression). NOTE: `web_search_tool_result` used to be the other
|
|
20
|
+
* server-side block this guarded — as of the 2026-08-11+ provider-agnostic web_search
|
|
21
|
+
* port (backend/services/webSearch.js, Tavily) it is a plain client tool that produces
|
|
22
|
+
* an ordinary tool_use/tool_result pair, so it no longer needs this preservation path
|
|
23
|
+
* at all; only tool-search's server blocks still do.
|
|
20
24
|
*/
|
|
21
25
|
export declare function chooseFinalContent<T extends {
|
|
22
26
|
type?: string;
|
|
@@ -66,6 +70,17 @@ export interface StreamChatOptions {
|
|
|
66
70
|
* "main agent" (may spawn).
|
|
67
71
|
*/
|
|
68
72
|
canSpawnSubAgents?: boolean;
|
|
73
|
+
/**
|
|
74
|
+
* Whether THIS run may reach the network, i.e. whether the backend should render the
|
|
75
|
+
* prompt's "Web search" section at all.
|
|
76
|
+
*
|
|
77
|
+
* Same rule as canWriteSharedMemory / canSpawnSubAgents, applied to the network:
|
|
78
|
+
* READ_ONLY_TOOLS grants neither `fetch_url` nor `web_search`, yet the base prompt
|
|
79
|
+
* told every run to search the web, so read-only sub-agents (explorer,
|
|
80
|
+
* security-auditor, ...) kept calling a tool their own allowlist then refused.
|
|
81
|
+
* Undefined means "main agent" (may browse).
|
|
82
|
+
*/
|
|
83
|
+
canBrowseWeb?: boolean;
|
|
69
84
|
/**
|
|
70
85
|
* Opt in to restarting a turn that died AFTER partial output was rendered.
|
|
71
86
|
*
|
package/dist/api/client.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAA8B,UAAU,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAiErH,eAAO,MAAM,QAAQ,QAAmB,CAAC;AAIzC
|
|
1
|
+
{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAA8B,UAAU,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAiErH,eAAO,MAAM,QAAQ,QAAmB,CAAC;AAIzC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,SAAS;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EAC5D,OAAO,EAAE,CAAC,EAAE,EACZ,UAAU,EAAE,KAAK,CAAC;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,IAAI,GAAG,SAAS,GACtD,CAAC,EAAE,CAeL;AAiGD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IACnC,oFAAoF;IACpF,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IACjG,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6IAA6I;IAC7I,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,yFAAyF;IACzF,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;;OASG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;;;;;;;;;;OAeG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AA8ID,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,CAAC,CAAC,EAAE,QAAQ,KAAK,IAAI,GAC7B,OAAO,CAAC,OAAO,CAAC,CAkmClB;AAID;;;;;;;;;;;GAWG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAU9D;AAID;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAYxD;AAID,wBAAsB,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,CA0BlD;AAID,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA+B1E;AAID,wBAAsB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA0BhF"}
|
package/dist/api/client.js
CHANGED
|
@@ -81,13 +81,17 @@ exports.API_BASE = resolveApiBase();
|
|
|
81
81
|
* already stripped by the backend), when available.
|
|
82
82
|
*
|
|
83
83
|
* Rule: if the raw content contains ANY block beyond plain text / tool_use — i.e.
|
|
84
|
-
* server-side blocks like `server_tool_use
|
|
85
|
-
* nested `tool_reference`s)
|
|
86
|
-
*
|
|
87
|
-
*
|
|
88
|
-
*
|
|
89
|
-
*
|
|
90
|
-
*
|
|
84
|
+
* server-side blocks like `server_tool_use` or `tool_search_tool_result` (with its
|
|
85
|
+
* nested `tool_reference`s) — we MUST preserve the raw array verbatim so those blocks
|
|
86
|
+
* round-trip back to the API on the next request. Dropping them breaks the paired
|
|
87
|
+
* server_tool_use/result the API expects AND, for tool search, makes discovered
|
|
88
|
+
* (deferred) tools be forgotten → re-searched every turn. For an ordinary turn (only
|
|
89
|
+
* text/tool_use) we keep the rebuilt array so the common path is byte-identical to
|
|
90
|
+
* before (zero regression). NOTE: `web_search_tool_result` used to be the other
|
|
91
|
+
* server-side block this guarded — as of the 2026-08-11+ provider-agnostic web_search
|
|
92
|
+
* port (backend/services/webSearch.js, Tavily) it is a plain client tool that produces
|
|
93
|
+
* an ordinary tool_use/tool_result pair, so it no longer needs this preservation path
|
|
94
|
+
* at all; only tool-search's server blocks still do.
|
|
91
95
|
*/
|
|
92
96
|
function chooseFinalContent(rebuilt, rawContent) {
|
|
93
97
|
if (!Array.isArray(rawContent))
|
|
@@ -326,7 +330,7 @@ function sleep(ms) {
|
|
|
326
330
|
* the nested product (36) exists to bound pathological cases, not to be reached. */
|
|
327
331
|
const MAX_TOTAL_ATTEMPTS = (MAX_RETRIES + 1) * (MAX_RETRIES + 1);
|
|
328
332
|
async function streamChat(messages, options, onEvent) {
|
|
329
|
-
const { model, env, editorContext, nexrallMd, mode, effort, clientType, abortSignal, extraTools, agents, skills, allowRestartAfterRender, canWriteSharedMemory, hasOwnAgentStore, canSpawnSubAgents } = options;
|
|
333
|
+
const { model, env, editorContext, nexrallMd, mode, effort, clientType, abortSignal, extraTools, agents, skills, allowRestartAfterRender, canWriteSharedMemory, hasOwnAgentStore, canSpawnSubAgents, canBrowseWeb } = options;
|
|
330
334
|
// IDEMPOTENCY KEY for this logical turn, generated ONCE and reused by every retry
|
|
331
335
|
// below (that reuse is the entire point — a fresh id per attempt would be useless).
|
|
332
336
|
//
|
|
@@ -419,7 +423,7 @@ async function streamChat(messages, options, onEvent) {
|
|
|
419
423
|
{
|
|
420
424
|
method: 'POST',
|
|
421
425
|
headers: authHeaders(),
|
|
422
|
-
body: JSON.stringify({ messages, model, env, editorContext, nexrallMd, mode, effort, clientType, extraTools, agents, skills, turnId, canWriteSharedMemory, hasOwnAgentStore, canSpawnSubAgents }),
|
|
426
|
+
body: JSON.stringify({ messages, model, env, editorContext, nexrallMd, mode, effort, clientType, extraTools, agents, skills, turnId, canWriteSharedMemory, hasOwnAgentStore, canSpawnSubAgents, canBrowseWeb }),
|
|
423
427
|
signal,
|
|
424
428
|
},
|
|
425
429
|
];
|
|
@@ -1119,18 +1123,19 @@ async function streamChat(messages, options, onEvent) {
|
|
|
1119
1123
|
contentBlocks.push(...toolUseBlocks);
|
|
1120
1124
|
// TOOL-SEARCH / SERVER-SIDE-BLOCK PRESERVATION.
|
|
1121
1125
|
// The rebuild above keeps ONLY text + tool_use. That is lossy for any turn
|
|
1122
|
-
// that also contains server-side blocks — `server_tool_use
|
|
1123
|
-
// `tool_search_tool_result` (and its nested `tool_reference`s)
|
|
1124
|
-
//
|
|
1125
|
-
//
|
|
1126
|
-
//
|
|
1127
|
-
//
|
|
1128
|
-
//
|
|
1126
|
+
// that also contains server-side blocks — `server_tool_use` or
|
|
1127
|
+
// `tool_search_tool_result` (and its nested `tool_reference`s). Those blocks
|
|
1128
|
+
// MUST round-trip back to the API verbatim on the next request or (a) the API
|
|
1129
|
+
// rejects the follow-up (it expects the paired server_tool_use/result to be
|
|
1130
|
+
// present) and (b) for tool search specifically, the discovered (deferred)
|
|
1131
|
+
// tools are FORGOTTEN, forcing Claude to re-search every turn — the exact
|
|
1132
|
+
// opposite of the token saving. web_search is NOT one of these any more — see
|
|
1133
|
+
// chooseFinalContent's note above.
|
|
1129
1134
|
//
|
|
1130
|
-
// Preserve server-side blocks (tool_search_tool_result / server_tool_use
|
|
1131
|
-
//
|
|
1132
|
-
//
|
|
1133
|
-
//
|
|
1135
|
+
// Preserve server-side blocks (tool_search_tool_result / server_tool_use)
|
|
1136
|
+
// verbatim when present; otherwise keep the rebuilt array. See
|
|
1137
|
+
// chooseFinalContent for the full rationale. Zero regression for an ordinary
|
|
1138
|
+
// text/tool_use turn.
|
|
1134
1139
|
const rawContent = Array.isArray(nestedMessage?.content)
|
|
1135
1140
|
? nestedMessage.content
|
|
1136
1141
|
: null;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../src/tools/executor.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAyB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;
|
|
1
|
+
{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../src/tools/executor.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAyB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAqzEtE,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,WAAW,CAAC,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,EAClC,OAAO,CAAC,EAAE,aAAa,EACvB,OAAO,CAAC,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GACjC,OAAO,CAAC,UAAU,CAAC,CAoBrB"}
|
package/dist/tools/executor.js
CHANGED
|
@@ -2242,6 +2242,48 @@ async function stockPhoto(input, workDir) {
|
|
|
2242
2242
|
const lines = photos.map((p, i) => `${i + 1}. ${p.url}${p.width && p.height ? ` (${p.width}×${p.height})` : ''}${p.alt ? ` — ${p.alt}` : ''}${p.credit ? ` · Photo by ${p.credit} on Unsplash` : ''}`);
|
|
2243
2243
|
return { output: `Found ${photos.length} photo(s) for "${query}":\n${lines.join('\n')}` };
|
|
2244
2244
|
}
|
|
2245
|
+
/**
|
|
2246
|
+
* web_search — search the live web via the backend's Tavily proxy (the API key
|
|
2247
|
+
* never leaves the server, same pattern as generate_image/stock_photo above).
|
|
2248
|
+
*
|
|
2249
|
+
* Replaces the OLD approach of relying on Anthropic's server-side
|
|
2250
|
+
* `web_search_20260209` tool (executed by Anthropic itself, invisible to this
|
|
2251
|
+
* executor): that tool only exists on the Anthropic Messages API, so switching
|
|
2252
|
+
* the model to DeepSeek/Qwen/GPT silently removed web search entirely — the
|
|
2253
|
+
* backend's toOpenAITools() correctly drops a `type`-discriminated server tool
|
|
2254
|
+
* on the way out, but the model had already been told it could call one.
|
|
2255
|
+
* web_search is now a PLAIN function tool the backend declares with an
|
|
2256
|
+
* ordinary `parameters` schema (backend/services/codePrompts.js), so it
|
|
2257
|
+
* reaches every provider identically, and the executor here actually runs it
|
|
2258
|
+
* — exactly like fetch_url, just backed by Tavily instead of a raw GET.
|
|
2259
|
+
*
|
|
2260
|
+
* { query }
|
|
2261
|
+
*/
|
|
2262
|
+
async function webSearch(input) {
|
|
2263
|
+
const query = typeof input.query === 'string' ? input.query.trim() : '';
|
|
2264
|
+
if (!query)
|
|
2265
|
+
return { error: 'Missing required parameter: query' };
|
|
2266
|
+
const token = (0, auth_1.getToken)();
|
|
2267
|
+
if (!token)
|
|
2268
|
+
return { error: 'Not authenticated. Run `nexrall-code login` first.' };
|
|
2269
|
+
try {
|
|
2270
|
+
const r = await _httpsPost(`${client_1.API_BASE}/api/code/tools/web_search`, JSON.stringify({ query }), { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` }, 30000);
|
|
2271
|
+
let json = {};
|
|
2272
|
+
try {
|
|
2273
|
+
json = JSON.parse(r.body);
|
|
2274
|
+
}
|
|
2275
|
+
catch (_) { }
|
|
2276
|
+
if (r.status !== 200)
|
|
2277
|
+
return { error: json.error || `Server error ${r.status}` };
|
|
2278
|
+
const text = json.text ?? '';
|
|
2279
|
+
if (!text)
|
|
2280
|
+
return { error: 'web_search succeeded but returned no results text.' };
|
|
2281
|
+
return { output: text };
|
|
2282
|
+
}
|
|
2283
|
+
catch (err) {
|
|
2284
|
+
return { error: `web_search failed: ${err.message}` };
|
|
2285
|
+
}
|
|
2286
|
+
}
|
|
2245
2287
|
// ─── Memory tools ─────────────────────────────────────────────────────────────
|
|
2246
2288
|
// Implementation lives in agent/memory.ts (project vs global scope, size caps,
|
|
2247
2289
|
// LLM-summarizing compaction, file locking) — this is just the tool-call glue.
|
|
@@ -2349,6 +2391,7 @@ const TOOL_MAP = {
|
|
|
2349
2391
|
move_file: moveFile,
|
|
2350
2392
|
delete_file: deleteFile,
|
|
2351
2393
|
fetch_url: fetchUrl,
|
|
2394
|
+
web_search: webSearch,
|
|
2352
2395
|
generate_image: generateImage,
|
|
2353
2396
|
stock_photo: stockPhoto,
|
|
2354
2397
|
todo_write: todoWrite,
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@nexrall/code-core",
|
|
3
|
-
"version": "1.4.
|
|
3
|
+
"version": "1.4.43",
|
|
4
4
|
"description": "Core agent loop, tools, and extension primitives for Nexrall Code — embed an AI coding agent in any Node.js application.",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"author": "Nexrall <support@nexrall.com> (https://nexrall.com)",
|