@nexrall/code-core 1.4.5 → 1.4.7

package/dist/api/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAA8B,UAAU,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAKrH,eAAO,MAAM,QAAQ,4BAA4B,CAAC;AAiBlD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IACnC,oFAAoF;IACpF,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IACjG,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAgBD,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,CAAC,CAAC,EAAE,QAAQ,KAAK,IAAI,GAC7B,OAAO,CAAC,OAAO,CAAC,CA0alB;AAID,wBAAsB,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,CAalD;AAID,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAgB1E;AAID,wBAAsB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAkBhF"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAA8B,UAAU,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAKrH,eAAO,MAAM,QAAQ,4BAA4B,CAAC;AAiBlD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IACnC,oFAAoF;IACpF,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IACjG,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AA0BD,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,CAAC,CAAC,EAAE,QAAQ,KAAK,IAAI,GAC7B,OAAO,CAAC,OAAO,CAAC,CA0alB;AAID,wBAAsB,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,CAalD;AAID,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAgB1E;AAID,wBAAsB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAkBhF"}

package/dist/api/client.js

@@ -25,8 +25,17 @@ function authHeaders() {
     };
 }
 // ─── Retry helpers ────────────────────────────────────────────────────────────
-const MAX_RETRIES = 3;
+const MAX_RETRIES = 5;
 const RETRY_BASE_MS = 1000;
+const RETRY_MAX_MS = 30000;
+/** Exponential backoff with full jitter, capped at RETRY_MAX_MS. The jitter spreads
+ *  retries out so a fleet of clients hitting the SAME overloaded API (529) don't all
+ *  reconnect in lockstep and re-trigger the overload (thundering herd). Returns a delay
+ *  in [exp/2, exp] where exp = min(RETRY_MAX_MS, RETRY_BASE_MS * 2^attempt). */
+function backoffMs(attempt) {
+    const exp = Math.min(RETRY_MAX_MS, RETRY_BASE_MS * Math.pow(2, attempt));
+    return Math.round(exp / 2 + Math.random() * (exp / 2));
+}
 function sleep(ms) {
     return new Promise((r) => setTimeout(r, ms));
 }
@@ -92,12 +101,12 @@ async function streamChat(messages, options, onEvent) {
                 if (response.status === 429 && attempt < MAX_RETRIES) {
                     reportRetry('Rate limited by the API — retrying');
                     const retryAfter = parseInt(response.headers.get('retry-after') ?? '0', 10);
-                    await sleep(retryAfter > 0 ? retryAfter * 1000 : RETRY_BASE_MS * Math.pow(2, attempt));
+                    await sleep(retryAfter > 0 ? retryAfter * 1000 : backoffMs(attempt));
                     continue;
                 }
                 if (response.status >= 500 && response.status < 600 && attempt < MAX_RETRIES) {
                     reportRetry(`Server error (${response.status}) — retrying`);
-                    await sleep(RETRY_BASE_MS * Math.pow(2, attempt));
+                    await sleep(backoffMs(attempt));
                     continue;
                 }
                 // 4xx (incl. 413 Payload Too Large, 400 Bad Request, 402 Insufficient balance)
@@ -115,7 +124,7 @@ async function streamChat(messages, options, onEvent) {
                     // Connection couldn't even be established — network drop / DNS blip / the
                     // machine just woke from sleep and Wi-Fi hasn't reconnected yet.
                     reportRetry('Connection lost — attempting to reconnect');
-                    await sleep(RETRY_BASE_MS * Math.pow(2, attempt));
+                    await sleep(backoffMs(attempt));
                     continue;
                 }
             }
@@ -434,7 +443,7 @@ async function streamChat(messages, options, onEvent) {
                     throw err;
                 if (err.retryable && sAttempt < MAX_RETRIES) {
                     reportRetry(err.message || 'Connection interrupted — reconnecting');
-                    await sleep(RETRY_BASE_MS * Math.pow(2, sAttempt));
+                    await sleep(backoffMs(sAttempt));
                     continue;
                 }
                 throw err;

package/dist/tools/executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../src/tools/executor.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAyB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAw9DtE,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,WAAW,CAAC,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,EAClC,OAAO,CAAC,EAAE,aAAa,EACvB,OAAO,CAAC,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,UAAU,CAAC,CAiBrB"}
+{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../src/tools/executor.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAyB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAk/DtE,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,WAAW,CAAC,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,EAClC,OAAO,CAAC,EAAE,aAAa,EACvB,OAAO,CAAC,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,UAAU,CAAC,CAiBrB"}

package/dist/tools/executor.js

@@ -1390,6 +1390,19 @@ async function fetchUrl(input, _workDir, _redirectCount = 0) {
                 return callback(null, address, family);
             });
         });
+        // Guard against double-resolve and — critically — against our OWN intentional
+        // req.destroy() (used to stop downloading once we hit MAX_FETCH_BYTES or to
+        // hand off a redirect) surfacing as an ECONNRESET on res/req 'error'. Without
+        // this flag, aborting the socket ourselves would reject with "socket hang up"
+        // and the truncated-but-valid body we already collected would be thrown away.
+        let settled = false;
+        let selfAborted = false;
+        const finish = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            resolve(result);
+        };
         const req = transport.get(url, {
             timeout: DEFAULT_TIMEOUT_MS,
             lookup: guardedLookup,
@@ -1402,6 +1415,7 @@ async function fetchUrl(input, _workDir, _redirectCount = 0) {
             // Follow redirects (301/302/307/308) with depth counter to prevent infinite loops
             const status = res.statusCode ?? 0;
             if ((status === 301 || status === 302 || status === 307 || status === 308) && res.headers.location) {
+                selfAborted = true; // our destroy() below is intentional — ignore the reset it triggers
                 req.destroy();
                 // Resolve relative Location headers against the current URL
                 let nextUrl;
@@ -1409,10 +1423,10 @@ async function fetchUrl(input, _workDir, _redirectCount = 0) {
                     nextUrl = new URL(res.headers.location, url).href;
                 }
                 catch {
-                    resolve({ error: `Invalid redirect location: ${res.headers.location}` });
+                    finish({ error: `Invalid redirect location: ${res.headers.location}` });
                     return;
                 }
-                fetchUrl({ url: nextUrl }, undefined, _redirectCount + 1).then(resolve);
+                fetchUrl({ url: nextUrl }, undefined, _redirectCount + 1).then(finish);
                 return;
             }
             const contentType = res.headers['content-type'] ?? '';
@@ -1420,6 +1434,19 @@ async function fetchUrl(input, _workDir, _redirectCount = 0) {
             const chunks = [];
             let totalBytes = 0;
             let truncated = false;
+            // Emit whatever we've collected so far (used by both the clean 'end' and the
+            // size-limit truncation path — the two must produce identical output shape).
+            const emitBody = () => {
+                let body = Buffer.concat(chunks).toString('utf-8');
+                if (isHtml)
+                    body = stripHtml(body);
+                const truncNote = truncated ? `\n\n[Truncated at ${MAX_FETCH_BYTES / 1024}KB]` : '';
+                // Prompt-injection mitigation: fetched web content is fully attacker-controlled
+                // (anyone can put "ignore previous instructions..." on a page). Wrap it in an
+                // explicit untrusted-data delimiter so the model treats it as DATA to read, not
+                // as instructions to follow — defense-in-depth alongside the system-prompt rule.
+                finish({ output: `HTTP ${status}\n\n<untrusted_web_content url="${url}">\n${body}${truncNote}\n</untrusted_web_content>` });
+            };
             res.on('data', (chunk) => {
                 if (totalBytes + chunk.length > MAX_FETCH_BYTES) {
                     const remaining = MAX_FETCH_BYTES - totalBytes;
@@ -1427,30 +1454,30 @@ async function fetchUrl(input, _workDir, _redirectCount = 0) {
                         chunks.push(chunk.subarray(0, remaining));
                     totalBytes = MAX_FETCH_BYTES;
                     truncated = true;
+                    // We deliberately stop here. Mark the abort as self-inflicted so the
+                    // error handlers don't turn the resulting ECONNRESET into a failure,
+                    // then emit the (valid, truncated) body we already have.
+                    selfAborted = true;
                     req.destroy();
+                    emitBody();
                 }
                 else {
                     chunks.push(chunk);
                     totalBytes += chunk.length;
                 }
             });
-            res.on('end', () => {
-                let body = Buffer.concat(chunks).toString('utf-8');
-                if (isHtml)
-                    body = stripHtml(body);
-                const truncNote = truncated ? `\n\n[Truncated at ${MAX_FETCH_BYTES / 1024}KB]` : '';
-                // Prompt-injection mitigation: fetched web content is fully attacker-controlled
-                // (anyone can put "ignore previous instructions..." on a page). Wrap it in an
-                // explicit untrusted-data delimiter so the model treats it as DATA to read, not
-                // as instructions to follow — defense-in-depth alongside the system-prompt rule.
-                resolve({ output: `HTTP ${status}\n\n<untrusted_web_content url="${url}">\n${body}${truncNote}\n</untrusted_web_content>` });
-            });
-            res.on('error', (err) => resolve({ error: err.message }));
+            res.on('end', emitBody);
+            // Ignore errors caused by our own intentional destroy (truncation / redirect);
+            // only real transport failures should surface.
+            res.on('error', (err) => { if (!selfAborted)
+                finish({ error: err.message }); });
         });
-        req.on('error', (err) => resolve({ error: err.message }));
+        req.on('error', (err) => { if (!selfAborted)
+            finish({ error: err.message }); });
         req.on('timeout', () => {
+            selfAborted = true;
             req.destroy();
-            resolve({ error: `Request timed out after ${DEFAULT_TIMEOUT_MS}ms` });
+            finish({ error: `Request timed out after ${DEFAULT_TIMEOUT_MS}ms` });
         });
     });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nexrall/code-core",
-  "version": "1.4.5",
+  "version": "1.4.7",
   "description": "Core agent loop, tools, and extension primitives for Nexrall Code — embed an AI coding agent in any Node.js application.",
   "license": "MIT",
   "author": "Nexrall <support@nexrall.com> (https://nexrall.com)",