@nexrall/code-core 1.4.6 → 1.4.8

package/dist/agent/loop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loop.d.ts","sourceRoot":"","sources":["../../src/agent/loop.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,OAAO,EAMP,gBAAgB,EAChB,UAAU,EACX,MAAM,UAAU,CAAC;AAsKlB,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,MAAM,CAWR;AA8RD,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAM7D;AAsBD,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,aAA+G,CAAC;AAC7I,gGAAgG;AAChG,eAAO,MAAM,aAAa,QAA2J,CAAC;AAEtL;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAK5E;AAUD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAwBxD;AAoBD,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3D,aAAa,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClE,qFAAqF;IACrF,aAAa,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvD;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,YAAY,IAAI,cAAc,CAE7C;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAC1B,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC1C,EAAE,EAAE,OAAO,EACX,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,IAAI,CAoDN;AAED,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CA6B5D;AAmBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAmB/D;AA+GD,gFAAgF;AAChF,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAE/D;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,OAAO,EAAE,EACnB,IAAI,EAAE;IACJ,KAAK,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC,GACA,OAAO,CAAC,OAAO,CAAC,CA2DlB;AAID,wBAAsB,YAAY,CAChC,eAAe,EAAE,OAAO,EAAE,EAC1B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,OAAO,EAAE,CAAC,CAulBpB"}
+{"version":3,"file":"loop.d.ts","sourceRoot":"","sources":["../../src/agent/loop.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,OAAO,EAMP,gBAAgB,EAChB,UAAU,EACX,MAAM,UAAU,CAAC;AAsKlB,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,MAAM,CAWR;AA8RD,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAM7D;AAsBD,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,aAA+G,CAAC;AAC7I,gGAAgG;AAChG,eAAO,MAAM,aAAa,QAA2J,CAAC;AAEtL;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAK5E;AAUD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAwBxD;AAoBD,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3D,aAAa,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClE,qFAAqF;IACrF,aAAa,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvD;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,YAAY,IAAI,cAAc,CAE7C;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAC1B,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC1C,EAAE,EAAE,OAAO,EACX,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,IAAI,CAoDN;AAED,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CA6B5D;AAmBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAmB/D;AAsHD,gFAAgF;AAChF,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAE/D;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,OAAO,EAAE,EACnB,IAAI,EAAE;IACJ,KAAK,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC,GACA,OAAO,CAAC,OAAO,CAAC,CA2DlB;AAID,wBAAsB,YAAY,CAChC,eAAe,EAAE,OAAO,EAAE,EAC1B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,OAAO,EAAE,CAAC,CAulBpB"}

package/dist/agent/loop.js

@@ -736,7 +736,14 @@ async function autoCompactMessages(messages, options, ledger) {
     let summary = '';
     try {
         const reply = await (0, client_1.streamChat)([{ role: 'user', content: [{ type: 'text', text: summaryPrompt }] }], {
-            model: options.model ?? 'turbo',
+            // COST: the summariser is a mechanical "bullet-point this transcript" task —
+            // its quality is indistinguishable across model tiers, so there is no reason
+            // to run it on the user's (possibly expensive) tier. Force 'turbo' (Sonnet 5):
+            // it is the cheapest 1M-context tier (in $2.0/1M vs Opus $2.5, Fable $3.0;
+            // out $15/1M vs $25 / $50), so this is always ≤ the user's cost, and its 1M
+            // window comfortably holds the transcript (capped at ~170K tokens by
+            // transcriptOf) even on the largest sessions.
+            model: 'turbo',
             mode: 'ask', // summariser must not call tools; ask-mode discourages action
             env: options.env,
             clientType: options.clientType,

package/dist/tools/executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../src/tools/executor.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAyB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAw9DtE,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,WAAW,CAAC,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,EAClC,OAAO,CAAC,EAAE,aAAa,EACvB,OAAO,CAAC,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,UAAU,CAAC,CAiBrB"}
+{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../src/tools/executor.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAyB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAk/DtE,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,WAAW,CAAC,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,EAClC,OAAO,CAAC,EAAE,aAAa,EACvB,OAAO,CAAC,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,UAAU,CAAC,CAiBrB"}

package/dist/tools/executor.js

@@ -1390,6 +1390,19 @@ async function fetchUrl(input, _workDir, _redirectCount = 0) {
                 return callback(null, address, family);
             });
         });
+        // Guard against double-resolve and — critically — against our OWN intentional
+        // req.destroy() (used to stop downloading once we hit MAX_FETCH_BYTES or to
+        // hand off a redirect) surfacing as an ECONNRESET on res/req 'error'. Without
+        // this flag, aborting the socket ourselves would reject with "socket hang up"
+        // and the truncated-but-valid body we already collected would be thrown away.
+        let settled = false;
+        let selfAborted = false;
+        const finish = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            resolve(result);
+        };
         const req = transport.get(url, {
             timeout: DEFAULT_TIMEOUT_MS,
             lookup: guardedLookup,
@@ -1402,6 +1415,7 @@ async function fetchUrl(input, _workDir, _redirectCount = 0) {
             // Follow redirects (301/302/307/308) with depth counter to prevent infinite loops
             const status = res.statusCode ?? 0;
             if ((status === 301 || status === 302 || status === 307 || status === 308) && res.headers.location) {
+                selfAborted = true; // our destroy() below is intentional — ignore the reset it triggers
                 req.destroy();
                 // Resolve relative Location headers against the current URL
                 let nextUrl;
@@ -1409,10 +1423,10 @@ async function fetchUrl(input, _workDir, _redirectCount = 0) {
                     nextUrl = new URL(res.headers.location, url).href;
                 }
                 catch {
-                    resolve({ error: `Invalid redirect location: ${res.headers.location}` });
+                    finish({ error: `Invalid redirect location: ${res.headers.location}` });
                     return;
                 }
-                fetchUrl({ url: nextUrl }, undefined, _redirectCount + 1).then(resolve);
+                fetchUrl({ url: nextUrl }, undefined, _redirectCount + 1).then(finish);
                 return;
             }
             const contentType = res.headers['content-type'] ?? '';
@@ -1420,6 +1434,19 @@ async function fetchUrl(input, _workDir, _redirectCount = 0) {
             const chunks = [];
             let totalBytes = 0;
             let truncated = false;
+            // Emit whatever we've collected so far (used by both the clean 'end' and the
+            // size-limit truncation path — the two must produce identical output shape).
+            const emitBody = () => {
+                let body = Buffer.concat(chunks).toString('utf-8');
+                if (isHtml)
+                    body = stripHtml(body);
+                const truncNote = truncated ? `\n\n[Truncated at ${MAX_FETCH_BYTES / 1024}KB]` : '';
+                // Prompt-injection mitigation: fetched web content is fully attacker-controlled
+                // (anyone can put "ignore previous instructions..." on a page). Wrap it in an
+                // explicit untrusted-data delimiter so the model treats it as DATA to read, not
+                // as instructions to follow — defense-in-depth alongside the system-prompt rule.
+                finish({ output: `HTTP ${status}\n\n<untrusted_web_content url="${url}">\n${body}${truncNote}\n</untrusted_web_content>` });
+            };
             res.on('data', (chunk) => {
                 if (totalBytes + chunk.length > MAX_FETCH_BYTES) {
                     const remaining = MAX_FETCH_BYTES - totalBytes;
@@ -1427,30 +1454,30 @@ async function fetchUrl(input, _workDir, _redirectCount = 0) {
                         chunks.push(chunk.subarray(0, remaining));
                     totalBytes = MAX_FETCH_BYTES;
                     truncated = true;
+                    // We deliberately stop here. Mark the abort as self-inflicted so the
+                    // error handlers don't turn the resulting ECONNRESET into a failure,
+                    // then emit the (valid, truncated) body we already have.
+                    selfAborted = true;
                     req.destroy();
+                    emitBody();
                 }
                 else {
                     chunks.push(chunk);
                     totalBytes += chunk.length;
                 }
             });
-            res.on('end', () => {
-                let body = Buffer.concat(chunks).toString('utf-8');
-                if (isHtml)
-                    body = stripHtml(body);
-                const truncNote = truncated ? `\n\n[Truncated at ${MAX_FETCH_BYTES / 1024}KB]` : '';
-                // Prompt-injection mitigation: fetched web content is fully attacker-controlled
-                // (anyone can put "ignore previous instructions..." on a page). Wrap it in an
-                // explicit untrusted-data delimiter so the model treats it as DATA to read, not
-                // as instructions to follow — defense-in-depth alongside the system-prompt rule.
-                resolve({ output: `HTTP ${status}\n\n<untrusted_web_content url="${url}">\n${body}${truncNote}\n</untrusted_web_content>` });
-            });
-            res.on('error', (err) => resolve({ error: err.message }));
+            res.on('end', emitBody);
+            // Ignore errors caused by our own intentional destroy (truncation / redirect);
+            // only real transport failures should surface.
+            res.on('error', (err) => { if (!selfAborted)
+                finish({ error: err.message }); });
         });
-        req.on('error', (err) => resolve({ error: err.message }));
+        req.on('error', (err) => { if (!selfAborted)
+            finish({ error: err.message }); });
         req.on('timeout', () => {
+            selfAborted = true;
             req.destroy();
-            resolve({ error: `Request timed out after ${DEFAULT_TIMEOUT_MS}ms` });
+            finish({ error: `Request timed out after ${DEFAULT_TIMEOUT_MS}ms` });
         });
     });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nexrall/code-core",
-  "version": "1.4.6",
+  "version": "1.4.8",
   "description": "Core agent loop, tools, and extension primitives for Nexrall Code — embed an AI coding agent in any Node.js application.",
   "license": "MIT",
   "author": "Nexrall <support@nexrall.com> (https://nexrall.com)",