@nexrall/code-core 1.4.58 → 1.4.60

package/dist/agent/worktreeEnforcement.js

@@ -0,0 +1,203 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports._worktreeEnforcementInternal = void 0;
+exports.checkWorktreeIsolation = checkWorktreeIsolation;
+exports.worktreeInstructions = worktreeInstructions;
+// ─── Worktree isolation enforcement ───────────────────────────────────────────
+//
+// A session-wide lock, structurally identical to planMode.ts (same file, read
+// its header first) but protecting a DIFFERENT invariant: not "nothing may be
+// mutated", but "nothing outside THIS worktree may be mutated". Whichever
+// session created the isolation is confined to its own directory; the main
+// checkout — the thing another session (or the user themselves) may be
+// working in RIGHT NOW — must be provably untouched.
+//
+// FAIL CLOSED, same rule as plan mode: a command whose target this module
+// cannot verify stays inside the worktree is REFUSED, not permitted. Claude
+// Code's own docs describe the identical trade-off for their worktree
+// isolation checks ("Command shape... You can't turn this check off").
+//
+// Four checks, mirroring Claude Code's four:
+//   1. File edits (write_file/edit_file/multi_edit/notebook_edit/delete_file/
+//      move_file/copy_file) — refuse a path that resolves into the main
+//      checkout.
+//   2. Command working directory — refuse a `bash` call whose input.workDir
+//      (rare — most calls inherit the session's) resolves into the main
+//      checkout. (executeTool always receives the SESSION's workDir as a
+//      parameter, never as part of `input`, so in practice this check exists
+//      for defence in depth against a future tool that lets a call declare
+//      its own cwd.)
+//   3. Git redirects — refuse a bash command that points git at the main
+//      checkout via `git -C <path>`, `--git-dir=`, `GIT_DIR=`/`GIT_WORK_TREE=`,
+//      or a `cd <main-checkout-path>` earlier in the same command line.
+//   4. Command shape Claude Code cannot verify — a command name computed at
+//      runtime, or a construct this module's necessarily-conservative parser
+//      cannot fully account for, is refused rather than guessed at.
+const path = __importStar(require("path"));
+const worktree_1 = require("./worktree");
+const EDIT_TOOLS = new Set([
+    'write_file', 'write_docx', 'write_xlsx', 'write_pptx',
+    'edit_file', 'multi_edit', 'delete_file', 'notebook_edit',
+]);
+// move_file/copy_file carry two paths (source/destination — see loop.ts's
+// lockPathsFor, which handles the identical shape for the same reason).
+const DUAL_PATH_TOOLS = new Set(['move_file', 'copy_file']);
+function pathsFromInput(tool, input) {
+    if (DUAL_PATH_TOOLS.has(tool)) {
+        return [input.source, input.destination, input.dest]
+            .filter((p) => typeof p === 'string' && p.length > 0);
+    }
+    if (typeof input.path === 'string' && input.path)
+        return [input.path];
+    return [];
+}
+const REFUSAL_FOOTER = 'Do NOT ask the user to approve it and do NOT try a variation to get around this — this session ' +
+    'is isolated to its own worktree so it cannot collide with other work on the same repository. ' +
+    'Operate only inside the worktree directory.';
+/**
+ * Check ONE tool call against active worktree isolation. Returns null when
+ * the call is fine (either no isolation is active, or the call stays inside
+ * the worktree). Call this the same way checkPlanMode is called — BEFORE
+ * requestPermission, since no user answer at that prompt can lawfully unlock
+ * a session-wide isolation boundary.
+ */
+function checkWorktreeIsolation(tool, input, state, workDir) {
+    if (!state)
+        return null; // no isolation active — nothing to enforce
+    if (tool === 'bash') {
+        const command = typeof input.command === 'string' ? input.command : '';
+        return checkBashAgainstWorktree(command, state);
+    }
+    if (EDIT_TOOLS.has(tool) || DUAL_PATH_TOOLS.has(tool)) {
+        for (const raw of pathsFromInput(tool, input)) {
+            const abs = path.isAbsolute(raw) ? raw : path.resolve(workDir ?? state.worktreePath, raw);
+            if ((0, worktree_1.pathEscapesWorktree)(abs, state)) {
+                return {
+                    reason: 'edit-outside-worktree',
+                    message: `\`${tool}\` targets "${raw}", which resolves outside this session's worktree ` +
+                        `(${state.worktreePath}) and into the main checkout (${state.mainCheckout}). ${REFUSAL_FOOTER}`,
+                };
+            }
+        }
+    }
+    return null;
+}
+// ── bash analysis ──────────────────────────────────────────────────────────
+//
+// Deliberately conservative: this is NOT a shell parser. It looks for the
+// SPECIFIC constructs that can redirect a command at the main checkout, and
+// refuses anything it can't positively clear — the same "command shape it
+// can't verify" refusal Claude Code's own docs describe, worded so the model
+// is told exactly how to recover (split into plain commands) rather than
+// left to guess.
+/** `cd <path>` anywhere in the command, expanded to that path if it looks like the main checkout. */
+const CD_RE = /(?:^|[;&|]|&&|\|\|)\s*cd\s+(\S+)/g;
+/** `git -C <path>` — redirects git's working tree without an actual cd. */
+const GIT_DASH_C_RE = /\bgit\s+-C\s+(\S+)/g;
+/** `git --git-dir=<path>` or `git --git-dir <path>`. */
+const GIT_DIR_FLAG_RE = /\bgit\s+(?:--git-dir=(\S+)|--git-dir\s+(\S+))/g;
+/** `GIT_DIR=<path>` / `GIT_WORK_TREE=<path>` env-var prefix. */
+const GIT_ENV_RE = /\b(?:GIT_DIR|GIT_WORK_TREE)=(\S+)/g;
+/** Constructs this module refuses to reason about at all — runtime-computed command names, unparseable expansions. */
+const UNVERIFIABLE_RE = /\$\(|`|\$\{!|\beval\b|\bexec\b\s*\$/;
+function stripQuotes(s) {
+    return s.replace(/^["']|["']$/g, '');
+}
+function resolvesIntoMainCheckout(candidate, state) {
+    const stripped = stripQuotes(candidate);
+    const abs = path.isAbsolute(stripped) ? stripped : path.resolve(state.worktreePath, stripped);
+    return (0, worktree_1.pathEscapesWorktree)(abs, state);
+}
+function checkBashAgainstWorktree(command, state) {
+    if (!command)
+        return null;
+    // 4. Shape Claude Code (and we) cannot verify at all — refuse outright.
+    // A command substitution or eval could compute a path/verb this scan would
+    // never see, so there is nothing safe to check.
+    if (UNVERIFIABLE_RE.test(command)) {
+        return {
+            reason: 'bash-shape-unverifiable',
+            message: `This command uses command substitution, backticks, or \`eval\`, so this session's worktree ` +
+                `isolation cannot verify where it points before running it. Split it into plain, separate ` +
+                `commands with no substitution so each part can be checked. ${REFUSAL_FOOTER}`,
+        };
+    }
+    // 2/3. cd / git -C / --git-dir / GIT_DIR / GIT_WORK_TREE all name a path
+    // directly — check every one found anywhere in the command line, not just
+    // the first, since `cd repo && git -C ../other status` chains them.
+    const candidates = [];
+    for (const re of [CD_RE, GIT_DASH_C_RE, GIT_DIR_FLAG_RE, GIT_ENV_RE]) {
+        re.lastIndex = 0;
+        let m;
+        while ((m = re.exec(command))) {
+            const val = m[1] ?? m[2];
+            if (val)
+                candidates.push(val);
+        }
+    }
+    for (const candidate of candidates) {
+        if (resolvesIntoMainCheckout(candidate, state)) {
+            return {
+                reason: 'git-redirect-outside-worktree',
+                message: `This command points at "${candidate}", which resolves into the main checkout ` +
+                    `(${state.mainCheckout}) rather than this session's worktree (${state.worktreePath}). ${REFUSAL_FOOTER}`,
+            };
+        }
+    }
+    return null;
+}
+/**
+ * Prepended to nexrall.md when worktree isolation is active — same rationale
+ * as PLAN_MODE_INSTRUCTIONS in planMode.ts: telling the model up front is not
+ * the enforcement (checkWorktreeIsolation at the call site is), it exists so
+ * the model plans its work AROUND the boundary instead of discovering it one
+ * refused tool call at a time.
+ */
+function worktreeInstructions(state) {
+    return (`## Worktree isolation is ACTIVE for this session\n\n` +
+        `Every file write and every \`bash\` call in this session is confined to:\n` +
+        `  ${state.worktreePath}\n\n` +
+        `This exists so this session can never overwrite files another session (or the user) ` +
+        `is working on in the main checkout:\n` +
+        `  ${state.mainCheckout}\n\n` +
+        `Any write, edit, or command that resolves outside the worktree above is refused ` +
+        `automatically, before it runs — this is enforced, not a convention to remember. ` +
+        `Work entirely within the worktree; when the work is ready to share with the main ` +
+        `checkout, that merge is done via git (or whatever the project's normal review process ` +
+        `is) — not by writing outside the worktree from inside this session.`);
+}
+exports._worktreeEnforcementInternal = { checkBashAgainstWorktree, resolvesIntoMainCheckout };
+//# sourceMappingURL=worktreeEnforcement.js.map

package/dist/api/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAA8B,UAAU,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAiErH,eAAO,MAAM,QAAQ,QAAmB,CAAC;AAIzC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,SAAS;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EAC5D,OAAO,EAAE,CAAC,EAAE,EACZ,UAAU,EAAE,KAAK,CAAC;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,IAAI,GAAG,SAAS,GACtD,CAAC,EAAE,CAeL;AAiGD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IACnC,oFAAoF;IACpF,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IACjG,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6IAA6I;IAC7I,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,yFAAyF;IACzF,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;;OASG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;;;;;;;;;;OAeG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AAmLD,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,CAAC,CAAC,EAAE,QAAQ,KAAK,IAAI,GAC7B,OAAO,CAAC,OAAO,CAAC,CAirClB;AAID;;;;;;;;;;;GAWG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAU9D;AAID;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAYxD;AAeD,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,OAAO,GAAG,KAAK,EACrB,IAAI,EAAE,MAAM,EACZ,SAAS,CAAC,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,wBAAwB,CAAC,CAmCnC;AAID,wBAAsB,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,CA0BlD;AAiBD,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,qFAAqF;IACrF,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,wFAAwF;IACxF,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,wBAAsB,aAAa,IAAI,OAAO,CAAC;IAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAyBhG;AAID,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,aAAa,EAAE,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,IAAI,SAAK,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAyBxE;AAID,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA+B1E;AAID,wBAAsB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA0BhF;AAID,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC,CAqB3D"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAA8B,UAAU,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAiErH,eAAO,MAAM,QAAQ,QAAmB,CAAC;AAIzC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,SAAS;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EAC5D,OAAO,EAAE,CAAC,EAAE,EACZ,UAAU,EAAE,KAAK,CAAC;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,IAAI,GAAG,SAAS,GACtD,CAAC,EAAE,CAeL;AAiGD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IACnC,oFAAoF;IACpF,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IACjG,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6IAA6I;IAC7I,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,yFAAyF;IACzF,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;;OASG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;;;;;;;;;;OAeG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AAmLD,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,CAAC,CAAC,EAAE,QAAQ,KAAK,IAAI,GAC7B,OAAO,CAAC,OAAO,CAAC,CAsrClB;AAID;;;;;;;;;;;GAWG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAU9D;AAID;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAYxD;AAeD,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,OAAO,GAAG,KAAK,EACrB,IAAI,EAAE,MAAM,EACZ,SAAS,CAAC,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,wBAAwB,CAAC,CAmCnC;AAID,wBAAsB,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,CA0BlD;AAiBD,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,qFAAqF;IACrF,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,wFAAwF;IACxF,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,wBAAsB,aAAa,IAAI,OAAO,CAAC;IAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAyBhG;AAID,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,aAAa,EAAE,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,IAAI,SAAK,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAyBxE;AAID,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA+B1E;AAID,wBAAsB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA0BhF;AAID,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC,CAqB3D"}

package/dist/api/client.js

@@ -1242,6 +1242,11 @@ async function streamChat(messages, options, onEvent) {
                                         // instead of re-running the model. Nothing new was charged, so a cost
                                         // display must not add them again.
                                         ...(evt.replayed === true ? { replayed: true } : {}),
+                                        // Real USD cost, computed server-side by the same function that decides
+                                        // the actual wallet debit. Absent on an older backend — omit the key
+                                        // entirely rather than coercing to 0, so a cost display can tell
+                                        // "unknown" apart from "this turn genuinely cost nothing".
+                                        ...(typeof evt.cost === 'number' ? { cost: evt.cost } : {}),
                                         usage: {
                                             input_tokens: evt.input_tokens,
                                             output_tokens: evt.output_tokens,

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export * from './types';
+export * from './util/safeSlice';
 export * from './auth/index';
 export * from './api/client';
 export * from './tools/executor';
@@ -29,4 +30,10 @@ export * from './plugins/index';
 export * from './plugins/installer';
 export * from './plugins/sources';
 export * from './agent/trust';
+export * from './agent/crossProcessLock';
+export * from './agent/worktree';
+export * from './agent/worktreeEnforcement';
+export * from './agent/sharedTasks';
+export * from './agent/peerRegistry';
+export * from './agent/peerTransport';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC"}

package/dist/index.js

@@ -15,6 +15,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./types"), exports);
+__exportStar(require("./util/safeSlice"), exports);
 __exportStar(require("./auth/index"), exports);
 __exportStar(require("./api/client"), exports);
 __exportStar(require("./tools/executor"), exports);
@@ -45,4 +46,10 @@ __exportStar(require("./plugins/index"), exports);
 __exportStar(require("./plugins/installer"), exports);
 __exportStar(require("./plugins/sources"), exports);
 __exportStar(require("./agent/trust"), exports);
+__exportStar(require("./agent/crossProcessLock"), exports);
+__exportStar(require("./agent/worktree"), exports);
+__exportStar(require("./agent/worktreeEnforcement"), exports);
+__exportStar(require("./agent/sharedTasks"), exports);
+__exportStar(require("./agent/peerRegistry"), exports);
+__exportStar(require("./agent/peerTransport"), exports);
 //# sourceMappingURL=index.js.map

package/dist/tools/executor.d.ts

@@ -2,5 +2,8 @@ import type { ToolResult } from '../types';
 import { type SandboxConfig } from './sandbox';
 export declare function executeTool(name: string, input: Record<string, unknown>, abortSignal?: {
     aborted: boolean;
-}, sandbox?: SandboxConfig, workDir?: string, agentScope?: string, onStream?: (chunk: string) => void): Promise<ToolResult>;
+}, sandbox?: SandboxConfig, workDir?: string, agentScope?: string, onStream?: (chunk: string) => void, selfPeer?: {
+    id: string;
+    name: string;
+}): Promise<ToolResult>;
 //# sourceMappingURL=executor.d.ts.map

package/dist/tools/executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../src/tools/executor.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAyB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AA8kFtE,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,WAAW,CAAC,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,EAClC,OAAO,CAAC,EAAE,aAAa,EACvB,OAAO,CAAC,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GACjC,OAAO,CAAC,UAAU,CAAC,CA6BrB"}
+{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../src/tools/executor.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAyB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAixFtE,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,WAAW,CAAC,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,EAClC,OAAO,CAAC,EAAE,aAAa,EACvB,OAAO,CAAC,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,EAMlC,QAAQ,CAAC,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACtC,OAAO,CAAC,UAAU,CAAC,CAkCrB"}

package/dist/tools/executor.js

@@ -53,6 +53,9 @@ const client_1 = require("../api/client");
 const symbols_1 = require("./symbols");
 const tsLangService_1 = require("./tsLangService");
 const safeSlice_1 = require("../util/safeSlice");
+const sharedTasks_1 = require("../agent/sharedTasks");
+const peerRegistry_1 = require("../agent/peerRegistry");
+const peerTransport_1 = require("../agent/peerTransport");
 // ─── Constants ────────────────────────────────────────────────────────────────
 const DEFAULT_TIMEOUT_MS = 60000;
 const MAX_FETCH_BYTES = 200 * 1024; // 200 KB
@@ -424,7 +427,8 @@ async function writeFile(input, workDir) {
         // otherwise. This warns; it never blocks (see securityLint.ts for why).
         const sec = (0, securityLint_1.securityNoteText)((0, securityLint_1.checkSecurity)(content));
         if (isNew) {
-            return { output: `Created ${resolved} (${lines} lines, ${bytes} bytes)${sec}` };
+            // A brand-new file has no "removed" side — every line is an addition.
+            return { output: `Created ${resolved} (${lines} lines, ${bytes} bytes)${sec}`, linesAdded: lines, linesRemoved: 0 };
         }
         const xfile = crossFileBreakageWarning(resolved, normalizeLF(priorContent), normalizeLF(content), workDir ?? process.cwd());
         // Reward-hacking guard: a write_file that OVERWRITES an existing test file can
@@ -436,7 +440,14 @@ async function writeFile(input, workDir) {
         const ti = (0, testIntegrity_1.analyzeTestEdit)(resolved, normalizeLF(priorContent), normalizeLF(content));
         if (ti.suspicious)
             tiMarker = (0, testIntegrity_1.encodeTestIntegrityMarker)(ti.findings);
-        return { output: `Overwrote ${resolved} (${lines} lines, ${bytes} bytes)${xfile}${sec}${tiMarker}` };
+        // An overwrite has no line-by-line diff computed here (the whole file is
+        // replaced wholesale) — report the FULL new content as added and the full
+        // prior content as removed, which is what "overwrite" actually means.
+        return {
+            output: `Overwrote ${resolved} (${lines} lines, ${bytes} bytes)${xfile}${sec}${tiMarker}`,
+            linesAdded: lines,
+            linesRemoved: priorContent ? normalizeLF(priorContent).split('\n').length : 0,
+        };
     }
     catch (err) {
         return { error: err.message };
@@ -740,9 +751,21 @@ function startBackgroundShell(command, displayCommand, workDir, note) {
         if (shell.output.length > MAX_OUTPUT_CHARS) {
             // Drop from the front but never behind the read cursor's logical position;
             // readCursor is an absolute offset so we track how much we've discarded.
+            //
+            // sliceSafeStart (not a raw .slice()) — a raw start-slice landing on the
+            // low half of a surrogate pair leaves an orphaned low surrogate at the
+            // front of shell.output. That corrupts the NEXT bash_output/tool_result
+            // JSON.stringify onto the wire and Anthropic rejects the whole request
+            // with a deterministic, un-retryable 400 "no low surrogate in string".
+            // sliceSafeStart may drop one extra char to avoid the split, so recompute
+            // the actual amount discarded from the real length delta rather than
+            // trusting `overflow` — that keeps readCursor's absolute-offset bookkeeping
+            // correct in that edge case too.
             const overflow = shell.output.length - MAX_OUTPUT_CHARS;
-            shell.output = shell.output.slice(overflow);
-            shell.readCursor = Math.max(0, shell.readCursor - overflow);
+            const beforeLen = shell.output.length;
+            shell.output = (0, safeSlice_1.sliceSafeStart)(shell.output, overflow);
+            const actualDropped = beforeLen - shell.output.length;
+            shell.readCursor = Math.max(0, shell.readCursor - actualDropped);
             shell.truncated = true;
         }
     };
@@ -976,15 +999,27 @@ async function bash(input, abortSignal, sandbox, workDir, onStream) {
             }
             if (head.length < HEAD_CHARS) {
                 const room = HEAD_CHARS - head.length;
-                head += chunk.slice(0, room);
-                chunk = chunk.slice(room);
+                // sliceSafeEnd, not a raw slice(0, room) — a cut landing between the
+                // high/low half of an emoji or CJK-extension glyph leaves a lone
+                // surrogate at the end of `head`. That produces a deterministic,
+                // un-retryable 400 "no low surrogate in string" once this bash result
+                // is JSON.stringify'd into the next request. sliceSafeEnd may take one
+                // fewer char to avoid the split; take the ACTUAL prefix length so the
+                // remainder handed to `chunk` starts exactly where head left off
+                // (never re-splitting the same pair from the other side).
+                const taken = (0, safeSlice_1.sliceSafeEnd)(chunk, room);
+                head += taken;
+                chunk = chunk.slice(taken.length);
                 if (!chunk)
                     return;
             }
             // Remaining goes into a rolling tail buffer.
             tail += chunk;
             if (tail.length > TAIL_CHARS) {
-                tail = tail.slice(tail.length - TAIL_CHARS);
+                // sliceSafeStart — the tail is a rolling window kept from the END of the
+                // stream; a raw start-slice can orphan a low surrogate at its front for
+                // the same reason as above.
+                tail = (0, safeSlice_1.sliceSafeStart)(tail, tail.length - TAIL_CHARS);
                 truncated = true;
             }
         };
@@ -1604,7 +1639,15 @@ async function editFile(input, workDir) {
         // noise that has nothing to do with the change being made, and the fastest way
         // to teach everyone to ignore the warning.
         const sec = (0, securityLint_1.securityNoteText)((0, securityLint_1.checkSecurity)(newNorm));
-        return { output: `Edited ${resolved} (${linesBefore} → ${linesAfter} lines)\n\n${diff}${xfile}${sec}` };
+        // Lines touched by THIS edit (old_string vs new_string), not the whole file —
+        // matches what a caller displaying a per-edit diff (e.g. the VS Code permission
+        // bubble) actually shows. A caller wanting "total file size change" already has
+        // linesBefore/linesAfter above via the `output` text.
+        return {
+            output: `Edited ${resolved} (${linesBefore} → ${linesAfter} lines)\n\n${diff}${xfile}${sec}`,
+            linesAdded: newNorm.split('\n').length,
+            linesRemoved: oldNorm.split('\n').length,
+        };
     }
     catch (err) {
         return { error: err.message };
@@ -2006,6 +2049,8 @@ async function multiEdit(input, workDir) {
         // Inserted text from every edit, collected for the security lint below so it
         // scans only what this call ADDED rather than the whole file.
         const insertedText = [];
+        let linesAdded = 0;
+        let linesRemoved = 0;
         for (let i = 0; i < edits.length; i++) {
             const edit = edits[i];
             // Normalize incoming old/new strings too
@@ -2026,6 +2071,8 @@ async function multiEdit(input, workDir) {
             // the point this edit was applied (not the final state after all edits).
             diffs.push(buildDiff(filePath, oldStr, newStr, content));
             insertedText.push(newStr);
+            linesAdded += newStr.split('\n').length;
+            linesRemoved += oldStr.split('\n').length;
             content = literalReplace(content, oldStr, newStr);
         }
         // Restore original line endings before writing (atomic temp+rename),
@@ -2038,6 +2085,8 @@ async function multiEdit(input, workDir) {
         return {
             output: `Applied ${edits.length} edit(s) to ${resolved}:\n` +
                 diffs.map((d, i) => `\n--- edit #${i + 1} ---\n${d}`).join('\n') + xfile + sec,
+            linesAdded,
+            linesRemoved,
         };
     }
     catch (err) {
@@ -2125,6 +2174,147 @@ function formatTodos(scope) {
     const lines = scope.items.map(t => `${icons[t.status] ?? '☐'} [${t.id}] ${t.content}  (${t.status})`);
     return `Tasks (${scope.items.filter(t => t.status === 'completed').length}/${scope.items.length} done):\n${lines.join('\n')}`;
 }
+// ─── Shared task list (cross-SESSION coordination — see agent/sharedTasks.ts) ──
+//
+// Deliberately separate from todo_write/todo_read above: those are a
+// PER-AGENT-PROCESS scratchpad (an in-memory Map, scoped by agentScope) for
+// tracking one session's own progress. These three read/write REAL files
+// under ~/.nexrall/peers/tasks/, visible to every OTHER session working the
+// same project — the coordination layer described in sharedTasks.ts's header
+// (mirrors Claude Code's agent-teams task list). A session's own peer name
+// (once peer messaging lands) is the natural `claimedBy` identity; until
+// then, callers pass whatever string they like to identify themselves.
+function formatSharedTask(t) {
+    const icons = { pending: '☐', in_progress: '▶', completed: '✓', blocked: '⛔' };
+    const claim = t.claimedBy ? ` — claimed by ${t.claimedBy}` : '';
+    return `${icons[t.status] ?? '☐'} [${t.id}] ${t.content}  (${t.status}${claim})`;
+}
+async function listSharedTasksTool(_input, workDir) {
+    if (!workDir)
+        return { error: 'workDir is required' };
+    const tasks = (0, sharedTasks_1.listSharedTasks)(workDir);
+    if (!tasks.length)
+        return { output: 'No shared tasks yet for this project. Use create_shared_task to add one.' };
+    return { output: tasks.map(formatSharedTask).join('\n') };
+}
+async function createSharedTaskTool(input, workDir) {
+    if (!workDir)
+        return { error: 'workDir is required' };
+    const content = typeof input.content === 'string' ? input.content.trim() : '';
+    if (!content)
+        return { error: 'content must be a non-empty string' };
+    const blockedBy = Array.isArray(input.blocked_by)
+        ? input.blocked_by.filter((x) => typeof x === 'string')
+        : undefined;
+    const task = (0, sharedTasks_1.createSharedTask)(workDir, content, { blockedBy });
+    return { output: `Created shared task [${task.id}]: ${task.content}` };
+}
+async function claimSharedTaskTool(input, workDir) {
+    if (!workDir)
+        return { error: 'workDir is required' };
+    const taskId = typeof input.task_id === 'string' ? input.task_id : '';
+    const claimedBy = typeof input.claimed_by === 'string' && input.claimed_by.trim() ? input.claimed_by.trim() : 'this session';
+    if (!taskId)
+        return { error: 'task_id is required' };
+    const res = await (0, sharedTasks_1.claimTask)(workDir, taskId, claimedBy);
+    if (!res.ok) {
+        const reasons = {
+            'not-found': `No shared task with id "${taskId}" exists for this project.`,
+            'already-claimed': `Task "${taskId}" is already claimed by another session. Pick a different task, or check back later.`,
+            'blocked': `Task "${taskId}" is blocked — one or more tasks it depends on are not completed yet.`,
+            'not-pending': `Task "${taskId}" is already completed.`,
+        };
+        return { error: reasons[res.reason] ?? `Could not claim task "${taskId}" (${res.reason}).` };
+    }
+    return { output: `Claimed [${res.task.id}] ${res.task.content} as "${claimedBy}".` };
+}
+async function updateSharedTaskStatusTool(input, workDir) {
+    if (!workDir)
+        return { error: 'workDir is required' };
+    const taskId = typeof input.task_id === 'string' ? input.task_id : '';
+    const status = input.status;
+    const claimedBy = typeof input.claimed_by === 'string' ? input.claimed_by : undefined;
+    if (!taskId)
+        return { error: 'task_id is required' };
+    if (status !== 'pending' && status !== 'in_progress' && status !== 'completed' && status !== 'blocked') {
+        return { error: 'status must be one of: pending, in_progress, completed, blocked' };
+    }
+    const res = await (0, sharedTasks_1.updateSharedTaskStatus)(workDir, taskId, status, { claimedBy });
+    if (!res.ok) {
+        if (res.reason === 'not-found')
+            return { error: `No shared task with id "${taskId}" exists for this project.` };
+        if (res.reason === 'already-claimed')
+            return { error: `Task "${taskId}" is claimed by a different session — only the session that claimed it may change its status.` };
+        return { error: `Could not update task "${taskId}" (${res.reason}).` };
+    }
+    return { output: `Updated [${res.task.id}] ${res.task.content} → ${res.task.status}.` };
+}
+// ─── Cross-session peer messaging (see agent/peerRegistry.ts + peerTransport.ts) ──
+//
+// Deliberately separate function signature (takes `selfId` explicitly rather
+// than reading it from workDir/agentScope) because peer identity is NOT
+// project-scoped like shared tasks — a session's peer id/name is a property
+// of THIS PROCESS, set once at registration (see registerPeer in
+// peerRegistry.ts, wired in by each client host), and has nothing to do with
+// which project directory the tool call happens to be running against.
+function formatPeerForList(p, selfId) {
+    const marker = p.id === selfId ? ' (you)' : '';
+    const status = p.status === 'running' ? 'busy' : 'idle';
+    return `${p.name}${marker} — ${p.clientType}, ${status}, ${p.workDir}`;
+}
+async function listPeerSessionsTool(_input, selfId) {
+    const peers = (0, peerRegistry_1.listPeers)(selfId);
+    if (!peers.length)
+        return { output: 'No other Nexrall Code sessions are currently discoverable on this machine.' };
+    return { output: peers.map((p) => formatPeerForList(p, selfId)).join('\n') };
+}
+async function messagePeerSessionTool(input, selfPeer) {
+    const targetName = typeof input.name === 'string' ? input.name.trim() : '';
+    const text = typeof input.message === 'string' ? input.message.trim() : '';
+    if (!targetName)
+        return { error: 'name is required — see list_peer_sessions for available session names.' };
+    if (!text)
+        return { error: 'message must be a non-empty string.' };
+    if (!selfPeer)
+        return { error: 'This session is not registered as a discoverable peer, so it cannot send messages.' };
+    const target = (0, peerRegistry_1.findPeerByName)(targetName);
+    if (!target)
+        return { error: `No live session named "${targetName}" was found. Use list_peer_sessions to see who is currently reachable.` };
+    if (target.id === selfPeer.id)
+        return { error: 'Cannot message yourself.' };
+    if (!target.socketPath)
+        return { error: `Session "${targetName}" is not currently reachable for messaging.` };
+    if (target.inbound === 'refuse')
+        return { error: `Session "${targetName}" is not accepting messages right now.` };
+    const result = await (0, peerTransport_1.sendPeerMessage)(target.socketPath, { from: selfPeer.name, fromId: selfPeer.id, text });
+    if (!result.ok)
+        return { error: `Could not deliver message to "${targetName}": ${result.error ?? 'unknown error'}` };
+    return { output: `Message sent to "${targetName}".` };
+}
+async function broadcastPeerMessageTool(input, selfPeer) {
+    const text = typeof input.message === 'string' ? input.message.trim() : '';
+    if (!text)
+        return { error: 'message must be a non-empty string.' };
+    if (!selfPeer)
+        return { error: 'This session is not registered as a discoverable peer, so it cannot send messages.' };
+    // Same exclusions as message_peer_session would apply per-target: never
+    // include self, and never target a peer whose inbound policy is 'refuse'
+    // — broadcasting is fan-out over the identical single-message rules, not
+    // an escape hatch around them.
+    const targets = (0, peerRegistry_1.listPeers)(selfPeer.id)
+        .filter((p) => p.id !== selfPeer.id && p.socketPath && p.inbound !== 'refuse')
+        .map((p) => ({ name: p.name, socketPath: p.socketPath }));
+    if (!targets.length)
+        return { output: 'No other reachable Nexrall Code sessions to broadcast to.' };
+    const results = await (0, peerTransport_1.broadcastPeerMessage)(targets, { from: selfPeer.name, fromId: selfPeer.id, text });
+    const succeeded = results.filter((r) => r.ok);
+    const failed = results.filter((r) => !r.ok);
+    const lines = [`Broadcast to ${results.length} session(s): ${succeeded.length} delivered.`];
+    if (failed.length) {
+        lines.push(...failed.map((r) => `  ✗ ${r.name}: ${r.error ?? 'unknown error'}`));
+    }
+    return { output: lines.join('\n') };
+}
 function nbJoin(src) {
     return Array.isArray(src) ? src.join('') : (src ?? '');
 }
@@ -2667,6 +2857,15 @@ const TOOL_MAP = {
     go_to_definition: goToDefinition,
     find_references: findReferences,
     get_hover: getHover,
+    // Cross-session task coordination — see agent/sharedTasks.ts.
+    list_shared_tasks: listSharedTasksTool,
+    create_shared_task: createSharedTaskTool,
+    claim_shared_task: claimSharedTaskTool,
+    update_shared_task_status: updateSharedTaskStatusTool,
+    // Cross-session messaging — see agent/peerRegistry.ts + peerTransport.ts.
+    list_peer_sessions: listPeerSessionsTool,
+    message_peer_session: messagePeerSessionTool,
+    broadcast_peer_message: broadcastPeerMessageTool,
 };
 // Tools that accept a workDir for correct relative-path resolution.
 // TOOL_MAP stores the base signatures; executeTool injects workDir at call time.
@@ -2681,8 +2880,15 @@ const WORKDIR_TOOLS = new Set([
     'get_symbols', 'get_workspace_symbols',
     'go_to_definition', 'find_references', 'get_hover',
     'memory_write', 'memory_read', 'use_skill',
+    'list_shared_tasks', 'create_shared_task', 'claim_shared_task', 'update_shared_task_status',
 ]);
-async function executeTool(name, input, abortSignal, sandbox, workDir, agentScope, onStream) {
+async function executeTool(name, input, abortSignal, sandbox, workDir, agentScope, onStream, 
+// This session's own peer identity (see agent/peerRegistry.ts), if it is
+// registered as a discoverable peer at all — undefined for a session that
+// isn't (the default; see Priority 4d wiring in each client host). Threaded
+// as its own trailing parameter, not through workDir/agentScope, because
+// peer identity is a property of the PROCESS, not the project.
+selfPeer) {
     if (!TOOL_MAP[name])
         return { error: `Unknown tool: ${name}` };
     try {
@@ -2697,6 +2903,14 @@ async function executeTool(name, input, abortSignal, sandbox, workDir, agentScop
             return await todoWrite(input, agentScope);
         if (name === 'todo_read')
             return await todoRead(input, agentScope);
+        // Peer messaging — identity-scoped, not workDir-scoped (see the doc
+        // comment right above these two functions' definitions).
+        if (name === 'list_peer_sessions')
+            return await listPeerSessionsTool(input, selfPeer?.id);
+        if (name === 'message_peer_session')
+            return await messagePeerSessionTool(input, selfPeer);
+        if (name === 'broadcast_peer_message')
+            return await broadcastPeerMessageTool(input, selfPeer);
         // Network-bound tools get abortSignal explicitly (not through the generic
         // WORKDIR_TOOLS branch below, whose signature is (input, workDir) only) —
         // these are the tools that previously had NO way to stop early on Ctrl+C,