@nexrall/code-core 1.4.62 → 1.4.65

package/dist/api/client.js

@@ -5,11 +5,15 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.API_BASE = void 0;
 exports.chooseFinalContent = chooseFinalContent;
+exports.earlyToolResolveEnabled = earlyToolResolveEnabled;
+exports.gzipRequestsEnabled = gzipRequestsEnabled;
 exports.streamChat = streamChat;
 exports.cancelTurn = cancelTurn;
 exports.revokeRefreshToken = revokeRefreshToken;
 exports.describeAttachment = describeAttachment;
 exports.getBalance = getBalance;
+exports.billingOverrideFields = billingOverrideFields;
+exports.setBillingTarget = setBillingTarget;
 exports.getOrgs = getOrgs;
 exports.getCodeModels = getCodeModels;
 exports.getUsageDaily = getUsageDaily;
@@ -19,6 +23,7 @@ exports.getUserProfile = getUserProfile;
 const eventsource_parser_1 = require("eventsource-parser");
 const node_fetch_1 = __importDefault(require("node-fetch"));
 const crypto_1 = require("crypto");
+const zlib_1 = require("zlib");
 const index_1 = require("../auth/index");
 // ─── Constants ────────────────────────────────────────────────────────────────
 const DEFAULT_API_BASE = 'https://api.nexrall.com';
@@ -214,6 +219,20 @@ function isExpiredTokenResponse(status, body) {
 const MAX_RETRIES = 5;
 const RETRY_BASE_MS = 1000;
 const RETRY_MAX_MS = 30000;
+/**
+ * Whether a tool_use round may return as soon as message_complete + usage arrive,
+ * instead of waiting for the trailing `done` (which the backend only sends after its
+ * billing DB write). NEXRALL_EARLY_TOOL_RESOLVE=0 restores the old wait.
+ */
+function earlyToolResolveEnabled() {
+    return process.env.NEXRALL_EARLY_TOOL_RESOLVE !== '0';
+}
+/** Chat bodies smaller than this are sent uncompressed. */
+const GZIP_MIN_BYTES = 32 * 1024;
+/** NEXRALL_GZIP_REQUESTS=0 sends chat bodies uncompressed. */
+function gzipRequestsEnabled() {
+    return process.env.NEXRALL_GZIP_REQUESTS !== '0';
+}
 /**
  * SSE frames that are backend HOUSEKEEPING, not model output.
  *
@@ -247,6 +266,7 @@ const RETRY_MAX_MS = 30000;
  */
 const HOUSEKEEPING_FRAMES = new Set([
     'resumable',
+    'runtime_context',
     'context_warning',
     'tool_progress',
 ]);
@@ -371,7 +391,7 @@ function sleep(ms) {
  *  the nested product (36) exists to bound pathological cases, not to be reached. */
 const MAX_TOTAL_ATTEMPTS = (MAX_RETRIES + 1) * (MAX_RETRIES + 1);
 async function streamChat(messages, options, onEvent) {
-    const { model, env, editorContext, nexrallMd, mode, effort, clientType, abortSignal, extraTools, agents, skills, allowRestartAfterRender, canWriteSharedMemory, hasOwnAgentStore, canSpawnSubAgents, canBrowseWeb } = options;
+    const { model, env, editorContext, nexrallMd, mode, effort, clientType, abortSignal, extraTools, agents, skills, allowRestartAfterRender, canWriteSharedMemory, hasOwnAgentStore, canSpawnSubAgents, canBrowseWeb, toolAllowlist } = options;
     // IDEMPOTENCY KEY for this logical turn, generated ONCE and reused by every retry
     // below (that reuse is the entire point — a fresh id per attempt would be useless).
     //
@@ -447,6 +467,26 @@ async function streamChat(messages, options, onEvent) {
     // chained one so the header wait can be timed out independently. It stays because
     // this shape is also what an unwrapped fetch would need, and a request with no
     // signal at all would silently become uncancellable if that wrapper were removed.
+    // The chat body is serialised (and, when large, gzipped) ONCE per streamChat call and
+    // reused by every retry: the payload is identical across attempts, and re-stringifying
+    // a multi-MB history per retry is pure waste. Gzip is only applied above a threshold —
+    // below it, the CPU cost outweighs the uplink saving. Every Nexrall API host parses
+    // bodies with express.json(), which inflates `Content-Encoding: gzip` natively
+    // (verified against production). NEXRALL_GZIP_REQUESTS=0 disables it.
+    // Keyed by turnId: a restart mints a NEW turnId (prepareRestart), and the cached body
+    // must not carry the old one. The billing override is read per call for the same reason
+    // the body used to be rebuilt per attempt — it cannot change mid-turn in practice, and a
+    // restart (the only path long enough for it to change) rebuilds anyway.
+    let chatBody = null;
+    const getChatBody = () => {
+        if (chatBody && chatBody.turnId === turnId)
+            return chatBody;
+        const json = JSON.stringify({ messages, model, env, editorContext, nexrallMd, mode, effort, clientType, extraTools, agents, skills, turnId, canWriteSharedMemory, hasOwnAgentStore, canSpawnSubAgents, canBrowseWeb, toolAllowlist, ...billingOverrideFields() });
+        chatBody = gzipRequestsEnabled() && json.length >= GZIP_MIN_BYTES
+            ? { data: (0, zlib_1.gzipSync)(json, { level: 5 }), gzip: true, turnId }
+            : { data: json, gzip: false, turnId };
+        return chatBody;
+    };
     const buildFetchArgs = () => {
         const signal = controller.signal;
         if (resuming) {
@@ -461,12 +501,15 @@ async function streamChat(messages, options, onEvent) {
         }
         return [
             `${exports.API_BASE}/api/code/chat`,
-            {
-                method: 'POST',
-                headers: authHeaders(),
-                body: JSON.stringify({ messages, model, env, editorContext, nexrallMd, mode, effort, clientType, extraTools, agents, skills, turnId, canWriteSharedMemory, hasOwnAgentStore, canSpawnSubAgents, canBrowseWeb, teamId: (0, index_1.getBillingTeamId)() }),
-                signal,
-            },
+            (() => {
+                const body = getChatBody();
+                return {
+                    method: 'POST',
+                    headers: body.gzip ? { ...authHeaders(), 'Content-Encoding': 'gzip' } : authHeaders(),
+                    body: body.data,
+                    signal,
+                };
+            })(),
         ];
     };
     // A transient mid-stream failure (Anthropic "overloaded_error") arrives as an SSE error
@@ -1272,6 +1315,28 @@ async function streamChat(messages, options, onEvent) {
                                             cache_read_input_tokens: typeof evt.cache_read_input_tokens === 'number' ? evt.cache_read_input_tokens : undefined,
                                         },
                                     });
+                                    // EARLY RESOLVE ON TOOL ROUNDS. The backend emits message_complete +
+                                    // usage synchronously, then awaits its billing write (Postgres + Redis)
+                                    // before sending `done`. For a tool_use turn nothing after this point is
+                                    // needed to run the tools, so waiting for `done` put a DB round-trip on
+                                    // the critical path of EVERY tool round. Return now; the socket keeps
+                                    // draining in the background, so a late balance_status / done / error
+                                    // still reaches onEvent. Only tool_use: a final (end_turn) answer keeps
+                                    // waiting so the low-balance nudge lands before the turn is reported done.
+                                    if (evt.partial !== true &&
+                                        completedMessage?.stopReason === 'tool_use' &&
+                                        earlyToolResolveEnabled()) {
+                                        clearInterval(heartbeatWatchdog);
+                                        // The watchdog is gone, so bound the background drain ourselves: a
+                                        // backend that never sends `done` must not pin the socket forever.
+                                        const drainGuard = setTimeout(() => {
+                                            stream.destroy?.();
+                                        }, HEARTBEAT_TIMEOUT_MS);
+                                        drainGuard.unref?.();
+                                        stream.once('end', () => clearTimeout(drainGuard));
+                                        stream.once('close', () => clearTimeout(drainGuard));
+                                        resolve();
+                                    }
                                 }
                                 break;
                             }
@@ -1324,6 +1389,23 @@ async function streamChat(messages, options, onEvent) {
                                 serverResumable = true;
                                 break;
                             }
+                            case 'tool_use_ready': {
+                                // A complete tool_use block, sent before the message finishes (see
+                                // SSEToolUseReadyEvent). Forwarded as-is; the loop decides what to prefetch.
+                                if (typeof evt.id === 'string' && typeof evt.name === 'string') {
+                                    const input = evt.input && typeof evt.input === 'object' ? evt.input : {};
+                                    onEvent({ type: 'tool_use_ready', id: evt.id, name: evt.name, input });
+                                }
+                                break;
+                            }
+                            case 'runtime_context': {
+                                // The exact context block the backend appended to our final message. The
+                                // agent loop persists it so the next round carries it in the cached history.
+                                if (typeof evt.text === 'string' && evt.text) {
+                                    onEvent({ type: 'runtime_context', text: evt.text });
+                                }
+                                break;
+                            }
                             case 'balance_status': {
                                 const balance = typeof evt.balance === 'number' ? evt.balance : 0;
                                 const zero = !!evt.zero;
@@ -1633,7 +1715,7 @@ async function describeAttachment(kind, data, mediaType, name) {
     const fetchOnce = () => (0, node_fetch_1.default)(`${exports.API_BASE}/api/code/assets/describe`, {
         method: 'POST',
         headers: { ...authHeaders(), 'Content-Type': 'application/json' },
-        body: JSON.stringify({ kind, data, media_type: mediaType, name, teamId: (0, index_1.getBillingTeamId)() }),
+        body: JSON.stringify({ kind, data, media_type: mediaType, name, ...billingOverrideFields() }),
     });
     let response = await fetchOnce();
     // Same silent-refresh pattern as every other authenticated call here — an
@@ -1687,6 +1769,46 @@ async function getBalance() {
     const data = (await response.json());
     return typeof data.balance === 'number' ? data.balance : 0;
 }
+// ─── Billing target ("Bill to", migrations 139 + 140) ────────────────────────
+/**
+ * The `teamId` field for a request body — present ONLY when this run has an
+ * explicit override (nexrall auth getBillingTeamOverride).
+ *
+ * Omitting the field is what makes the server resolve the ACCOUNT's saved
+ * choice, which is the whole point of v1.1: the web app sets "bill to Acme"
+ * once and this extension obeys it without any local state to keep in sync.
+ * Sending `teamId: null` would mean the opposite — an explicit "personal" that
+ * would override the user's own account setting on every turn.
+ */
+function billingOverrideFields() {
+    const override = (0, index_1.getBillingTeamOverride)();
+    return override === undefined ? {} : { teamId: override };
+}
+/**
+ * Save the account's billing target. `null` clears it (personal wallet).
+ *
+ * Server-side since v1.1, so the web app and every CLI/extension share ONE
+ * answer; the server validates membership and rejects a team the caller cannot
+ * actually use, rather than storing a preference the money path would have to
+ * clean up on the next request.
+ */
+async function setBillingTarget(teamId) {
+    const response = await (0, node_fetch_1.default)(`${exports.API_BASE}/api/user/billing-target`, {
+        method: 'PUT',
+        headers: authHeaders(),
+        body: JSON.stringify({ teamId }),
+    });
+    if (!response.ok) {
+        let message = `API error ${response.status}`;
+        try {
+            const parsed = (await response.json());
+            if (parsed.error)
+                message = parsed.error;
+        }
+        catch { /* non-JSON body — keep the status message */ }
+        throw new Error(message);
+    }
+}
 /**
  * Personal balance + every team the caller belongs to, in one call.
  *
@@ -1716,6 +1838,7 @@ async function getOrgs() {
     return {
         personal: { balance: typeof json.personal?.balance === 'number' ? json.personal.balance : 0 },
         teams: Array.isArray(json.teams) ? json.teams : [],
+        billingTargetTeamId: typeof json.billingTargetTeamId === 'number' ? json.billingTargetTeamId : null,
     };
 }
 async function getCodeModels() {
@@ -1737,7 +1860,7 @@ async function getCodeModels() {
     const data = (await response.json());
     return {
         models: Array.isArray(data.models) ? data.models : [],
-        defaultModel: typeof data.defaultModel === 'string' ? data.defaultModel : 'claude-sonnet-5',
+        defaultModel: typeof data.defaultModel === 'string' ? data.defaultModel : 'deepseek-flash',
     };
 }
 /**

package/dist/auth/index.d.ts

@@ -26,26 +26,34 @@ export declare function getRefreshToken(): string | null;
  */
 export declare function updateTokens(token: string, refreshToken?: string): void;
 /**
- * The team whose budget this installation's usage is billed to, or null for the
- * personal wallet.
+ * The per-RUN override for which budget pays, or `undefined` for "ask the
+ * account's saved choice".
  *
- * Deliberately NOT honoured under NEXRALL_TOKEN: that path is CI/headless, has
- * no config file identity of its own, and charging a company's pool from a
- * build job that merely happens to run on someone's machine is worse than the
- * convenience. env-token runs always bill the token owner.
+ * The choice itself lives SERVER-side in v1.1 (`users.billing_team_id`, set from
+ * Settings > Teams in the web app): one account, one answer, shared by the web
+ * app, this extension and the CLI. v1 kept a copy in `~/.nexrall/config.json`
+ * and that could not work — the web app had no way to express the same choice,
+ * so a company could fund a pool that only ever paid for one product, and two
+ * clients could disagree about who was paying.
  *
- * A malformed stored value (hand-edited config, or written by a future version)
- * reads as null rather than being passed through — the server would refuse it
- * anyway, and failing toward "personal" is the honest, visible outcome.
- */
-export declare function getBillingTeamId(): number | null;
-/**
- * Persist the "Bill to" choice. `null` clears it (back to the personal wallet).
+ * What remains here is only the case where a run must NOT follow the account
+ * default:
+ *
+ *   NEXRALL_BILLING_TEAM=personal|null|0  → explicit personal (returns null)
+ *   NEXRALL_BILLING_TEAM=<team id>        → that team (returns the id)
+ *   NEXRALL_TOKEN set, no NEXRALL_BILLING_TEAM
+ *                                         → explicit personal (returns null):
+ *                                           CI/headless has no identity of its
+ *                                           own, and charging a company's pool
+ *                                           from a build job that merely happens
+ *                                           to run on someone's machine is worse
+ *                                           than the convenience.
+ *   otherwise                             → undefined: omit the field and let
+ *                                           the server resolve the saved choice.
  *
- * Reads the file directly rather than via loadAuth() for the same reason
- * updateTokens does: under NEXRALL_TOKEN, loadAuth returns a synthetic
- * single-field object, and writing THAT back would destroy the user's real
- * stored credentials. Any other fields already in the file are preserved.
+ * The distinction between `undefined` and `null` is the wire's, not a nicety:
+ * absent means "no opinion" and null means "explicitly personal", which is what
+ * lets an override beat a saved team without the two ever being confused.
  */
-export declare function setBillingTeamId(teamId: number | null): void;
+export declare function getBillingTeamOverride(): number | null | undefined;
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAiB3C,wBAAgB,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAGjD;AAED,wBAAgB,QAAQ,IAAI,UAAU,GAAG,IAAI,CAwB5C;AAED,wBAAgB,SAAS,IAAI,IAAI,CAQhC;AAED,wBAAgB,eAAe,IAAI,OAAO,CAGzC;AAED,wBAAgB,QAAQ,IAAI,MAAM,GAAG,IAAI,CAGxC;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,IAAI,MAAM,GAAG,IAAI,CAM/C;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAsBvE;AAID;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAIhD;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAoB5D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAiB3C,wBAAgB,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAGjD;AAED,wBAAgB,QAAQ,IAAI,UAAU,GAAG,IAAI,CAwB5C;AAED,wBAAgB,SAAS,IAAI,IAAI,CAQhC;AAED,wBAAgB,eAAe,IAAI,OAAO,CAGzC;AAED,wBAAgB,QAAQ,IAAI,MAAM,GAAG,IAAI,CAGxC;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,IAAI,MAAM,GAAG,IAAI,CAM/C;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAsBvE;AAID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,GAAG,IAAI,GAAG,SAAS,CAiBlE"}

package/dist/auth/index.js

@@ -40,8 +40,7 @@ exports.isAuthenticated = isAuthenticated;
 exports.getToken = getToken;
 exports.getRefreshToken = getRefreshToken;
 exports.updateTokens = updateTokens;
-exports.getBillingTeamId = getBillingTeamId;
-exports.setBillingTeamId = setBillingTeamId;
+exports.getBillingTeamOverride = getBillingTeamOverride;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const os = __importStar(require("os"));
@@ -152,54 +151,56 @@ function updateTokens(token, refreshToken) {
     };
     fs.writeFileSync(CONFIG_FILE, JSON.stringify(next, null, 2), { mode: 0o600 });
 }
-// ─── Billing target ("Bill to", migration 139) ────────────────────────────────
+// ─── Billing target ("Bill to", migrations 139 + 140) ────────────────────────
 /**
- * The team whose budget this installation's usage is billed to, or null for the
- * personal wallet.
+ * The per-RUN override for which budget pays, or `undefined` for "ask the
+ * account's saved choice".
  *
- * Deliberately NOT honoured under NEXRALL_TOKEN: that path is CI/headless, has
- * no config file identity of its own, and charging a company's pool from a
- * build job that merely happens to run on someone's machine is worse than the
- * convenience. env-token runs always bill the token owner.
+ * The choice itself lives SERVER-side in v1.1 (`users.billing_team_id`, set from
+ * Settings > Teams in the web app): one account, one answer, shared by the web
+ * app, this extension and the CLI. v1 kept a copy in `~/.nexrall/config.json`
+ * and that could not work — the web app had no way to express the same choice,
+ * so a company could fund a pool that only ever paid for one product, and two
+ * clients could disagree about who was paying.
  *
- * A malformed stored value (hand-edited config, or written by a future version)
- * reads as null rather than being passed through — the server would refuse it
- * anyway, and failing toward "personal" is the honest, visible outcome.
- */
-function getBillingTeamId() {
-    const auth = loadAuth();
-    const v = auth?.billingTeamId;
-    return typeof v === 'number' && Number.isSafeInteger(v) && v > 0 ? v : null;
-}
-/**
- * Persist the "Bill to" choice. `null` clears it (back to the personal wallet).
+ * What remains here is only the case where a run must NOT follow the account
+ * default:
+ *
+ *   NEXRALL_BILLING_TEAM=personal|null|0  → explicit personal (returns null)
+ *   NEXRALL_BILLING_TEAM=<team id>        → that team (returns the id)
+ *   NEXRALL_TOKEN set, no NEXRALL_BILLING_TEAM
+ *                                         → explicit personal (returns null):
+ *                                           CI/headless has no identity of its
+ *                                           own, and charging a company's pool
+ *                                           from a build job that merely happens
+ *                                           to run on someone's machine is worse
+ *                                           than the convenience.
+ *   otherwise                             → undefined: omit the field and let
+ *                                           the server resolve the saved choice.
  *
- * Reads the file directly rather than via loadAuth() for the same reason
- * updateTokens does: under NEXRALL_TOKEN, loadAuth returns a synthetic
- * single-field object, and writing THAT back would destroy the user's real
- * stored credentials. Any other fields already in the file are preserved.
+ * The distinction between `undefined` and `null` is the wire's, not a nicety:
+ * absent means "no opinion" and null means "explicitly personal", which is what
+ * lets an override beat a saved team without the two ever being confused.
  */
-function setBillingTeamId(teamId) {
-    let existing = {};
-    try {
-        if (fs.existsSync(CONFIG_FILE)) {
-            const parsed = JSON.parse(fs.readFileSync(CONFIG_FILE, 'utf-8'));
-            if (typeof parsed === 'object' && parsed !== null)
-                existing = parsed;
+function getBillingTeamOverride() {
+    const raw = process.env.NEXRALL_BILLING_TEAM;
+    if (raw != null && raw !== '') {
+        const trimmed = raw.trim();
+        if (/^(personal|null|0)$/i.test(trimmed))
+            return null;
+        // Decimal digits only: `Number()` would happily read '0x10' as 16, and an
+        // env var is typed by a human — a spelling nobody means should not silently
+        // resolve to some team.
+        if (/^\d+$/.test(trimmed)) {
+            const n = Number(trimmed);
+            if (Number.isSafeInteger(n) && n > 0)
+                return n;
         }
+        // Garbage in the env var: fall through to the token rule rather than
+        // guessing a team id out of a typo.
     }
-    catch { /* corrupt or unreadable — start clean rather than refuse to save */ }
-    ensureConfigDir();
-    const next = { ...existing };
-    if (typeof teamId === 'number' && Number.isSafeInteger(teamId) && teamId > 0) {
-        next.billingTeamId = teamId;
-    }
-    else {
-        // Removed rather than set to null: an older client reading this file must
-        // see exactly what it saw before the field existed ("bill personal"), and
-        // `null` in a JSON config is a shape nothing else in this file uses.
-        delete next.billingTeamId;
-    }
-    fs.writeFileSync(CONFIG_FILE, JSON.stringify(next, null, 2), { mode: 0o600 });
+    if (process.env.NEXRALL_TOKEN)
+        return null;
+    return undefined;
 }
 //# sourceMappingURL=index.js.map

package/dist/index.d.ts

@@ -22,6 +22,7 @@ export * from './commands/loader';
 export * from './agent/agentTypes';
 export * from './agent/planMode';
 export * from './agent/agentRegistry';
+export * from './agent/backgroundAgents';
 export * from './permissions/rules';
 export * from './permissions/modePolicy';
 export * from './permissions/bashClassify';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC"}

package/dist/index.js

@@ -38,6 +38,7 @@ __exportStar(require("./commands/loader"), exports);
 __exportStar(require("./agent/agentTypes"), exports);
 __exportStar(require("./agent/planMode"), exports);
 __exportStar(require("./agent/agentRegistry"), exports);
+__exportStar(require("./agent/backgroundAgents"), exports);
 __exportStar(require("./permissions/rules"), exports);
 __exportStar(require("./permissions/modePolicy"), exports);
 __exportStar(require("./permissions/bashClassify"), exports);

package/dist/permissions/modePolicy.d.ts

@@ -18,6 +18,16 @@ export interface PolicyInput {
  * in two windows. Note `memory_write` is NOT here even though the CLI's old list had it
  * — it mutates durable cross-session state, and listing it under "read-only / safe"
  * meant it silently bypassed plan mode's read-only guarantee.
+ *
+ * `task` IS here on purpose, to stay in lockstep with `planMode.ts`'s own
+ * READ_ONLY_TOOLS: that module already lets `task` through its plan-mode lock
+ * because delegating research to a sub-agent is safe — `runAgentLoop` passes
+ * `planMode` down, so the sub-agent is under the identical read-only lock and
+ * its own write tools are refused one level deeper. Without `task` here too,
+ * step 3 of `decide()` (`mode === 'plan' → deny`) would silently re-block a
+ * call that `checkPlanMode()` had already deliberately allowed through — the
+ * exact "two copies that drift" failure this module exists to prevent, just
+ * hitting `task` specifically instead of the read-only tools it was written for.
  */
 export declare const READ_ONLY_TOOLS: Set<string>;
 /** Tools that write to the filesystem. */

package/dist/permissions/modePolicy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"modePolicy.d.ts","sourceRoot":"","sources":["../../src/permissions/modePolicy.ts"],"names":[],"mappings":"AAsBA,yDAAyD;AACzD,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;AAE9D,kDAAkD;AAClD,MAAM,MAAM,cAAc,GACtB,OAAO,GACP,KAAK,GACL,MAAM,GACN,SAAS,CAAC;AAEd,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,EAAE,cAAc,CAAC;IACrB,oFAAoF;IACpF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,aAU1B,CAAC;AAEH,0CAA0C;AAC1C,eAAO,MAAM,gBAAgB,aAG3B,CAAC;AAEH,oEAAoE;AACpE,eAAO,MAAM,iBAAiB,aAE5B,CAAC;AAEH,sCAAsC;AACtC,eAAO,MAAM,UAAU,aAAsD,CAAC;AAE9E;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED;;;;;;;GAOG;AACH,wBAAgB,MAAM,CAAC,GAAG,EAAE,WAAW,GAAG,cAAc,CAwDvD;AAED,4DAA4D;AAC5D,wBAAgB,YAAY,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAOzD;AAED,gFAAgF;AAChF,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,cAAc,CAGtD"}
+{"version":3,"file":"modePolicy.d.ts","sourceRoot":"","sources":["../../src/permissions/modePolicy.ts"],"names":[],"mappings":"AAsBA,yDAAyD;AACzD,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;AAE9D,kDAAkD;AAClD,MAAM,MAAM,cAAc,GACtB,OAAO,GACP,KAAK,GACL,MAAM,GACN,SAAS,CAAC;AAEd,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,EAAE,cAAc,CAAC;IACrB,oFAAoF;IACpF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,eAAe,aAW1B,CAAC;AAEH,0CAA0C;AAC1C,eAAO,MAAM,gBAAgB,aAG3B,CAAC;AAEH,oEAAoE;AACpE,eAAO,MAAM,iBAAiB,aAE5B,CAAC;AAEH,sCAAsC;AACtC,eAAO,MAAM,UAAU,aAAsD,CAAC;AAE9E;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED;;;;;;;GAOG;AACH,wBAAgB,MAAM,CAAC,GAAG,EAAE,WAAW,GAAG,cAAc,CAwDvD;AAED,4DAA4D;AAC5D,wBAAgB,YAAY,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAOzD;AAED,gFAAgF;AAChF,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,cAAc,CAGtD"}

package/dist/permissions/modePolicy.js

@@ -13,6 +13,16 @@ const bashClassify_1 = require("./bashClassify");
  * in two windows. Note `memory_write` is NOT here even though the CLI's old list had it
  * — it mutates durable cross-session state, and listing it under "read-only / safe"
  * meant it silently bypassed plan mode's read-only guarantee.
+ *
+ * `task` IS here on purpose, to stay in lockstep with `planMode.ts`'s own
+ * READ_ONLY_TOOLS: that module already lets `task` through its plan-mode lock
+ * because delegating research to a sub-agent is safe — `runAgentLoop` passes
+ * `planMode` down, so the sub-agent is under the identical read-only lock and
+ * its own write tools are refused one level deeper. Without `task` here too,
+ * step 3 of `decide()` (`mode === 'plan' → deny`) would silently re-block a
+ * call that `checkPlanMode()` had already deliberately allowed through — the
+ * exact "two copies that drift" failure this module exists to prevent, just
+ * hitting `task` specifically instead of the read-only tools it was written for.
  */
 exports.READ_ONLY_TOOLS = new Set([
     'read_file', 'list_directory', 'search_files', 'glob', 'grep',
@@ -24,6 +34,7 @@ exports.READ_ONLY_TOOLS = new Set([
     'notebook_read',
     'get_diagnostics', 'go_to_definition', 'find_references',
     'get_symbols', 'get_workspace_symbols', 'get_hover',
+    'task',
 ]);
 /** Tools that write to the filesystem. */
 exports.FILE_WRITE_TOOLS = new Set([

package/dist/tools/executor.d.ts

@@ -1,5 +1,41 @@
 import type { ToolResult } from '../types';
 import { type SandboxConfig } from './sandbox';
+/**
+ * Cap output from a tool we do not control (MCP servers). Built-in tools all cap their
+ * own output, but an MCP result went into the conversation verbatim: one call to a
+ * DB/browser/log server could inline megabytes, which is then re-sent (and re-billed as
+ * cache writes) on every later round until compaction. Keep HEAD+TAIL inline and spill
+ * the full text to a temp file the model can read_file with offset/limit — the same
+ * contract as bash's GAP B spill.
+ */
+export declare function capExternalOutput(output: string, label: string, maxChars?: number): string;
+/**
+ * Async drop-in for the subset of `spawnSync` the search tools use. spawnSync blocked
+ * the Node event loop for the whole search: several search_files calls issued in one
+ * parallel tool batch ran strictly one after another, and a search started by the
+ * mid-stream prefetcher froze SSE parsing and UI rendering until it finished. Result
+ * shape mirrors spawnSync's (`status`, `signal`, `error` with code ETIMEDOUT / ENOBUFS)
+ * so the callers' existing failure handling is unchanged.
+ */
+export interface CaptureResult {
+    stdout: string;
+    stderr: string;
+    status: number | null;
+    signal: NodeJS.Signals | null;
+    error?: NodeJS.ErrnoException;
+}
+export declare function runCapture(cmd: string, args: string[], opts: {
+    cwd?: string;
+    timeout: number;
+    maxBuffer: number;
+}): Promise<CaptureResult>;
+/**
+ * Glob → anchored RegExp. Scans the pattern once, so the `*` / `?` rules can never
+ * rewrite the regex emitted for `**` (the old chained .replace() calls turned
+ * `**\/` into `([^/]:[^/]+/)` — every `**` pattern silently matched nothing).
+ * Supports `**`, `*`, `?`, `{a,b}` and `[...]` classes.
+ */
+export declare function globToRegex(pattern: string): RegExp;
 export declare function executeTool(name: string, input: Record<string, unknown>, abortSignal?: {
     aborted: boolean;
 }, sandbox?: SandboxConfig, workDir?: string, agentScope?: string, onStream?: (chunk: string) => void, selfPeer?: {

package/dist/tools/executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../src/tools/executor.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAyB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAixFtE,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,WAAW,CAAC,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,EAClC,OAAO,CAAC,EAAE,aAAa,EACvB,OAAO,CAAC,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,EAMlC,QAAQ,CAAC,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACtC,OAAO,CAAC,UAAU,CAAC,CAkCrB"}
+{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../src/tools/executor.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAyB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAokCtE;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,SAAmB,GAAG,MAAM,CAcpG;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;CAC/B;AACD,wBAAgB,UAAU,CACxB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACzD,OAAO,CAAC,aAAa,CAAC,CA0CxB;AAsoCD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAqCnD;AAwwBD,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,WAAW,CAAC,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,EAClC,OAAO,CAAC,EAAE,aAAa,EACvB,OAAO,CAAC,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,EAMlC,QAAQ,CAAC,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACtC,OAAO,CAAC,UAAU,CAAC,CAkCrB"}