@nexrall/code-core 1.4.63 → 1.4.66

package/dist/agent/toolPrefetch.d.ts

@@ -0,0 +1,44 @@
+import type { ToolResult } from '../types';
+/**
+ * Streaming tool prefetch — start read-only tools while the model is still
+ * generating the rest of its message.
+ *
+ * Before: every tool waited for the WHOLE assistant message (all later tool calls,
+ * any trailing text, and the backend's post-message billing write) before the first
+ * one started. The backend now announces each tool_use block the moment it is
+ * complete (SSE `tool_use_ready`); for tools that only READ the filesystem we start
+ * executing immediately and hold the result.
+ *
+ * Safety model — the prefetched result is only a cache, never a bypass:
+ *   • Dispatch still happens from the completed message and still goes through every
+ *     gate (plan mode, worktree isolation, permission, PreToolUse hooks, read dedupe).
+ *     A refused call simply drops its prefetched result; reading had no side effect.
+ *   • Reused only for the identical call (same id, same name, same input).
+ *   • Only pure reads are prefetched, and only reused when nothing else in the same
+ *     message can change the filesystem (see isPrefetchSafeMessage) — otherwise the
+ *     early read could observe state from BEFORE a write the model ordered first.
+ */
+/** Built-in tools that only read the filesystem — safe to run before approval. */
+export declare const PREFETCHABLE_TOOLS: ReadonlySet<string>;
+/** True when no tool in this message can mutate the workspace. */
+export declare function isPrefetchSafeMessage(toolNames: readonly string[]): boolean;
+/** Kill switch: NEXRALL_TOOL_PREFETCH=0 restores the old wait-for-message timing. */
+export declare function toolPrefetchEnabled(): boolean;
+type Runner = (name: string, input: Record<string, unknown>) => Promise<ToolResult>;
+export declare class ToolPrefetcher {
+    private readonly run;
+    private readonly entries;
+    constructor(run: Runner);
+    /** Start `name` early if it is a pure read. Idempotent per id. */
+    start(id: string, name: string, input: Record<string, unknown>): boolean;
+    /**
+     * The prefetched result for exactly this call, or null. Always removes the entry,
+     * so a result is handed out at most once.
+     */
+    take(id: string, name: string, input: Record<string, unknown>): Promise<ToolResult> | null;
+    /** Drop everything (stream restarted — the ids it announced will never be dispatched). */
+    clear(): void;
+    get size(): number;
+}
+export {};
+//# sourceMappingURL=toolPrefetch.d.ts.map

package/dist/agent/toolPrefetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolPrefetch.d.ts","sourceRoot":"","sources":["../../src/agent/toolPrefetch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAE3C;;;;;;;;;;;;;;;;;;GAkBG;AAEH,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAKjD,CAAC;AAiBH,kEAAkE;AAClE,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAE3E;AAED,qFAAqF;AACrF,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C;AASD,KAAK,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;AAEpF,qBAAa,cAAc;IAGb,OAAO,CAAC,QAAQ,CAAC,GAAG;IAFhC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkF;gBAE7E,GAAG,EAAE,MAAM;IAExC,kEAAkE;IAClE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO;IAWxE;;;OAGG;IACH,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI;IAQ1F,0FAA0F;IAC1F,KAAK,IAAI,IAAI;IAIb,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF"}

package/dist/agent/toolPrefetch.js

@@ -0,0 +1,101 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ToolPrefetcher = exports.PREFETCHABLE_TOOLS = void 0;
+exports.isPrefetchSafeMessage = isPrefetchSafeMessage;
+exports.toolPrefetchEnabled = toolPrefetchEnabled;
+/**
+ * Streaming tool prefetch — start read-only tools while the model is still
+ * generating the rest of its message.
+ *
+ * Before: every tool waited for the WHOLE assistant message (all later tool calls,
+ * any trailing text, and the backend's post-message billing write) before the first
+ * one started. The backend now announces each tool_use block the moment it is
+ * complete (SSE `tool_use_ready`); for tools that only READ the filesystem we start
+ * executing immediately and hold the result.
+ *
+ * Safety model — the prefetched result is only a cache, never a bypass:
+ *   • Dispatch still happens from the completed message and still goes through every
+ *     gate (plan mode, worktree isolation, permission, PreToolUse hooks, read dedupe).
+ *     A refused call simply drops its prefetched result; reading had no side effect.
+ *   • Reused only for the identical call (same id, same name, same input).
+ *   • Only pure reads are prefetched, and only reused when nothing else in the same
+ *     message can change the filesystem (see isPrefetchSafeMessage) — otherwise the
+ *     early read could observe state from BEFORE a write the model ordered first.
+ */
+/** Built-in tools that only read the filesystem — safe to run before approval. */
+exports.PREFETCHABLE_TOOLS = new Set([
+    'read_file',
+    'list_directory',
+    'glob',
+    'search_files',
+]);
+/**
+ * Tools that may share a message with a prefetched read without invalidating it:
+ * they cannot change files in the workspace.
+ */
+const NON_MUTATING_COMPANIONS = new Set([
+    ...exports.PREFETCHABLE_TOOLS,
+    'notebook_read',
+    'todo_write', 'todo_read',
+    'memory_read',
+    'use_skill',
+    'fetch_url', 'web_search',
+    'get_diagnostics', 'go_to_definition', 'find_references',
+    'get_symbols', 'get_workspace_symbols', 'get_hover',
+]);
+/** True when no tool in this message can mutate the workspace. */
+function isPrefetchSafeMessage(toolNames) {
+    return toolNames.every((n) => NON_MUTATING_COMPANIONS.has(n));
+}
+/** Kill switch: NEXRALL_TOOL_PREFETCH=0 restores the old wait-for-message timing. */
+function toolPrefetchEnabled() {
+    return process.env.NEXRALL_TOOL_PREFETCH !== '0';
+}
+function stableKey(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value) ?? 'undefined';
+    if (Array.isArray(value))
+        return `[${value.map(stableKey).join(',')}]`;
+    const obj = value;
+    return `{${Object.keys(obj).sort().map((k) => `${JSON.stringify(k)}:${stableKey(obj[k])}`).join(',')}}`;
+}
+class ToolPrefetcher {
+    constructor(run) {
+        this.run = run;
+        this.entries = new Map();
+    }
+    /** Start `name` early if it is a pure read. Idempotent per id. */
+    start(id, name, input) {
+        if (!id || !exports.PREFETCHABLE_TOOLS.has(name) || this.entries.has(id))
+            return false;
+        // Never rejects: an unobserved rejection (the call may be refused later and never
+        // awaited) would otherwise surface as an unhandled rejection.
+        const promise = Promise.resolve()
+            .then(() => this.run(name, input))
+            .catch((err) => ({ error: `Tool execution failed: ${err?.message ?? String(err)}` }));
+        this.entries.set(id, { name, key: stableKey(input), promise });
+        return true;
+    }
+    /**
+     * The prefetched result for exactly this call, or null. Always removes the entry,
+     * so a result is handed out at most once.
+     */
+    take(id, name, input) {
+        const e = this.entries.get(id);
+        if (!e)
+            return null;
+        this.entries.delete(id);
+        if (e.name !== name || e.key !== stableKey(input))
+            return null;
+        return e.promise;
+    }
+    /** Drop everything (stream restarted — the ids it announced will never be dispatched). */
+    clear() {
+        this.entries.clear();
+    }
+    get size() {
+        return this.entries.size;
+    }
+}
+exports.ToolPrefetcher = ToolPrefetcher;
+//# sourceMappingURL=toolPrefetch.js.map

package/dist/agent/trust.d.ts

@@ -1,7 +1,2 @@
-/**
- * Which trust-sensitive files actually exist in `dir`, so a confirmation
- * prompt can tell the user what THIS folder will do rather than describing
- * risks in the abstract. Ordered most- to least-dangerous.
- */
 export declare function detectTrustSignals(dir: string): string[];
 //# sourceMappingURL=trust.d.ts.map

package/dist/agent/trust.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"trust.d.ts","sourceRoot":"","sources":["../../src/agent/trust.ts"],"names":[],"mappings":"AAqDA;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAkExD"}
+{"version":3,"file":"trust.d.ts","sourceRoot":"","sources":["../../src/agent/trust.ts"],"names":[],"mappings":"AAiFA,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAyExD"}

package/dist/agent/trust.js

@@ -90,6 +90,40 @@ function declaresPluginSources(dir) {
  * prompt can tell the user what THIS folder will do rather than describing
  * risks in the abstract. Ordered most- to least-dangerous.
  */
+/** Agent definitions under .nexrall/agents that declare `hooks:` (they run shell commands). */
+function agentFilesWithHooks(dir) {
+    const root = path.join(dir, '.nexrall', 'agents');
+    const found = [];
+    const walk = (d, depth) => {
+        if (depth > 4 || found.length > 20)
+            return;
+        let entries;
+        try {
+            entries = fs.readdirSync(d, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            const full = path.join(d, e.name);
+            if (e.isDirectory()) {
+                walk(full, depth + 1);
+                continue;
+            }
+            if (!e.name.endsWith('.md'))
+                continue;
+            try {
+                const head = fs.readFileSync(full, 'utf-8').slice(0, 64 * 1024);
+                const fm = head.replace(/^\uFEFF/, '').match(/^---\r?\n([\s\S]*?)\r?\n---/);
+                if (fm && /^hooks\s*:/im.test(fm[1]))
+                    found.push(path.relative(dir, full).replace(/\\/g, '/'));
+            }
+            catch { /* unreadable — not a signal */ }
+        }
+    };
+    walk(root, 0);
+    return found;
+}
 function detectTrustSignals(dir) {
     const signals = [];
     const exists = (...p) => {
@@ -137,6 +171,13 @@ function detectTrustSignals(dir) {
             bits.push('runs hooks (shell commands) automatically around tool calls');
         signals.push(bits.join(', '));
     }
+    // Agent definitions can carry their own hooks (Claude Code's agent-scoped `hooks:`),
+    // which run shell commands around that agent's tool calls — same risk as settings hooks.
+    const hookedAgents = agentFilesWithHooks(dir);
+    if (hookedAgents.length) {
+        const shown = hookedAgents.slice(0, 3).join(', ') + (hookedAgents.length > 3 ? ` (+${hookedAgents.length - 3} more)` : '');
+        signals.push(`${shown} — agent definition(s) that run hooks (shell commands) around their tool calls`);
+    }
     // Then things that steer the agent's behaviour.
     if (exists('nexrall.md')) {
         signals.push('nexrall.md — project instructions added to the agent\u2019s prompt');

package/dist/api/client.d.ts

@@ -77,10 +77,16 @@ export interface StreamChatOptions {
      * Same rule as canWriteSharedMemory / canSpawnSubAgents, applied to the network:
      * READ_ONLY_TOOLS grants neither `fetch_url` nor `web_search`, yet the base prompt
      * told every run to search the web, so read-only sub-agents (explorer,
-     * security-auditor, ...) kept calling a tool their own allowlist then refused.
+     * planner, ...) kept calling a tool their own allowlist then refused.
      * Undefined means "main agent" (may browse).
      */
     canBrowseWeb?: boolean;
+    /**
+     * When set, the backend sends ONLY these builtin tool schemas (sub-agents with an
+     * allowlist). Absent = every builtin. Older backends ignore it — the permission gate
+     * still enforces the allowlist either way; this only trims what is sent.
+     */
+    toolAllowlist?: string[];
     /**
      * Opt in to restarting a turn that died AFTER partial output was rendered.
      *
@@ -99,6 +105,14 @@ export interface StreamChatOptions {
      */
     allowRestartAfterRender?: boolean;
 }
+/**
+ * Whether a tool_use round may return as soon as message_complete + usage arrive,
+ * instead of waiting for the trailing `done` (which the backend only sends after its
+ * billing DB write). NEXRALL_EARLY_TOOL_RESOLVE=0 restores the old wait.
+ */
+export declare function earlyToolResolveEnabled(): boolean;
+/** NEXRALL_GZIP_REQUESTS=0 sends chat bodies uncompressed. */
+export declare function gzipRequestsEnabled(): boolean;
 export declare function streamChat(messages: Message[], options: StreamChatOptions, onEvent: (e: SSEEvent) => void): Promise<Message>;
 /**
  * Ask the server to stop generating a turn.

package/dist/api/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAA8B,UAAU,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAiErH,eAAO,MAAM,QAAQ,QAAmB,CAAC;AAIzC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,SAAS;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EAC5D,OAAO,EAAE,CAAC,EAAE,EACZ,UAAU,EAAE,KAAK,CAAC;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,IAAI,GAAG,SAAS,GACtD,CAAC,EAAE,CAeL;AAiGD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IACnC,oFAAoF;IACpF,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IACjG,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6IAA6I;IAC7I,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,yFAAyF;IACzF,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;;OASG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;;;;;;;;;;OAeG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AAmLD,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,CAAC,CAAC,EAAE,QAAQ,KAAK,IAAI,GAC7B,OAAO,CAAC,OAAO,CAAC,CAosClB;AAID;;;;;;;;;;;GAWG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAU9D;AAID;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAYxD;AAeD,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,OAAO,GAAG,KAAK,EACrB,IAAI,EAAE,MAAM,EACZ,SAAS,CAAC,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,wBAAwB,CAAC,CAmCnC;AAID,wBAAsB,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,CA0BlD;AAID;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,IAAI;IAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAGlE;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAc3E;AAID;;;;;GAKG;AACH,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;IACnC,MAAM,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC/B,UAAU,EAAE,QAAQ,GAAG,WAAW,CAAC;IACnC,8FAA8F;IAC9F,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE7B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,qBAAqB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9B,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,+EAA+E;IAC/E,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED;;;;;;;GAOG;AACH,wBAAsB,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,CA2BnD;AAiBD,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,qFAAqF;IACrF,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,wFAAwF;IACxF,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,wBAAsB,aAAa,IAAI,OAAO,CAAC;IAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAyBhG;AAID,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,aAAa,EAAE,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,IAAI,SAAK,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAyBxE;AAID,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA+B1E;AAID,wBAAsB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA0BhF;AAID,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC,CAqB3D"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAA8B,UAAU,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAiErH,eAAO,MAAM,QAAQ,QAAmB,CAAC;AAIzC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,SAAS;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EAC5D,OAAO,EAAE,CAAC,EAAE,EACZ,UAAU,EAAE,KAAK,CAAC;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,IAAI,GAAG,SAAS,GACtD,CAAC,EAAE,CAeL;AAiGD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IACnC,oFAAoF;IACpF,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IACjG,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6IAA6I;IAC7I,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,yFAAyF;IACzF,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;;OASG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB;;;;;;;;;;;;;;;OAeG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AAQD;;;;GAIG;AACH,wBAAgB,uBAAuB,IAAI,OAAO,CAEjD;AAKD,8DAA8D;AAC9D,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C;AA8KD,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,CAAC,CAAC,EAAE,QAAQ,KAAK,IAAI,GAC7B,OAAO,CAAC,OAAO,CAAC,CAqwClB;AAID;;;;;;;;;;;GAWG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAU9D;AAID;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAYxD;AAeD,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,OAAO,GAAG,KAAK,EACrB,IAAI,EAAE,MAAM,EACZ,SAAS,CAAC,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,wBAAwB,CAAC,CAmCnC;AAID,wBAAsB,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,CA0BlD;AAID;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,IAAI;IAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAGlE;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAc3E;AAID;;;;;GAKG;AACH,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;IACnC,MAAM,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC/B,UAAU,EAAE,QAAQ,GAAG,WAAW,CAAC;IACnC,8FAA8F;IAC9F,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE7B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,qBAAqB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9B,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,+EAA+E;IAC/E,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED;;;;;;;GAOG;AACH,wBAAsB,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,CA2BnD;AAiBD,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,qFAAqF;IACrF,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,wFAAwF;IACxF,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,wBAAsB,aAAa,IAAI,OAAO,CAAC;IAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAyBhG;AAID,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,aAAa,EAAE,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,IAAI,SAAK,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAyBxE;AAID,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA+B1E;AAID,wBAAsB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA0BhF;AAID,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC,CAqB3D"}

package/dist/api/client.js

@@ -5,6 +5,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.API_BASE = void 0;
 exports.chooseFinalContent = chooseFinalContent;
+exports.earlyToolResolveEnabled = earlyToolResolveEnabled;
+exports.gzipRequestsEnabled = gzipRequestsEnabled;
 exports.streamChat = streamChat;
 exports.cancelTurn = cancelTurn;
 exports.revokeRefreshToken = revokeRefreshToken;
@@ -21,6 +23,7 @@ exports.getUserProfile = getUserProfile;
 const eventsource_parser_1 = require("eventsource-parser");
 const node_fetch_1 = __importDefault(require("node-fetch"));
 const crypto_1 = require("crypto");
+const zlib_1 = require("zlib");
 const index_1 = require("../auth/index");
 // ─── Constants ────────────────────────────────────────────────────────────────
 const DEFAULT_API_BASE = 'https://api.nexrall.com';
@@ -216,6 +219,20 @@ function isExpiredTokenResponse(status, body) {
 const MAX_RETRIES = 5;
 const RETRY_BASE_MS = 1000;
 const RETRY_MAX_MS = 30000;
+/**
+ * Whether a tool_use round may return as soon as message_complete + usage arrive,
+ * instead of waiting for the trailing `done` (which the backend only sends after its
+ * billing DB write). NEXRALL_EARLY_TOOL_RESOLVE=0 restores the old wait.
+ */
+function earlyToolResolveEnabled() {
+    return process.env.NEXRALL_EARLY_TOOL_RESOLVE !== '0';
+}
+/** Chat bodies smaller than this are sent uncompressed. */
+const GZIP_MIN_BYTES = 32 * 1024;
+/** NEXRALL_GZIP_REQUESTS=0 sends chat bodies uncompressed. */
+function gzipRequestsEnabled() {
+    return process.env.NEXRALL_GZIP_REQUESTS !== '0';
+}
 /**
  * SSE frames that are backend HOUSEKEEPING, not model output.
  *
@@ -249,6 +266,7 @@ const RETRY_MAX_MS = 30000;
  */
 const HOUSEKEEPING_FRAMES = new Set([
     'resumable',
+    'runtime_context',
     'context_warning',
     'tool_progress',
 ]);
@@ -373,7 +391,7 @@ function sleep(ms) {
  *  the nested product (36) exists to bound pathological cases, not to be reached. */
 const MAX_TOTAL_ATTEMPTS = (MAX_RETRIES + 1) * (MAX_RETRIES + 1);
 async function streamChat(messages, options, onEvent) {
-    const { model, env, editorContext, nexrallMd, mode, effort, clientType, abortSignal, extraTools, agents, skills, allowRestartAfterRender, canWriteSharedMemory, hasOwnAgentStore, canSpawnSubAgents, canBrowseWeb } = options;
+    const { model, env, editorContext, nexrallMd, mode, effort, clientType, abortSignal, extraTools, agents, skills, allowRestartAfterRender, canWriteSharedMemory, hasOwnAgentStore, canSpawnSubAgents, canBrowseWeb, toolAllowlist } = options;
     // IDEMPOTENCY KEY for this logical turn, generated ONCE and reused by every retry
     // below (that reuse is the entire point — a fresh id per attempt would be useless).
     //
@@ -449,6 +467,26 @@ async function streamChat(messages, options, onEvent) {
     // chained one so the header wait can be timed out independently. It stays because
     // this shape is also what an unwrapped fetch would need, and a request with no
     // signal at all would silently become uncancellable if that wrapper were removed.
+    // The chat body is serialised (and, when large, gzipped) ONCE per streamChat call and
+    // reused by every retry: the payload is identical across attempts, and re-stringifying
+    // a multi-MB history per retry is pure waste. Gzip is only applied above a threshold —
+    // below it, the CPU cost outweighs the uplink saving. Every Nexrall API host parses
+    // bodies with express.json(), which inflates `Content-Encoding: gzip` natively
+    // (verified against production). NEXRALL_GZIP_REQUESTS=0 disables it.
+    // Keyed by turnId: a restart mints a NEW turnId (prepareRestart), and the cached body
+    // must not carry the old one. The billing override is read per call for the same reason
+    // the body used to be rebuilt per attempt — it cannot change mid-turn in practice, and a
+    // restart (the only path long enough for it to change) rebuilds anyway.
+    let chatBody = null;
+    const getChatBody = () => {
+        if (chatBody && chatBody.turnId === turnId)
+            return chatBody;
+        const json = JSON.stringify({ messages, model, env, editorContext, nexrallMd, mode, effort, clientType, extraTools, agents, skills, turnId, canWriteSharedMemory, hasOwnAgentStore, canSpawnSubAgents, canBrowseWeb, toolAllowlist, ...billingOverrideFields() });
+        chatBody = gzipRequestsEnabled() && json.length >= GZIP_MIN_BYTES
+            ? { data: (0, zlib_1.gzipSync)(json, { level: 5 }), gzip: true, turnId }
+            : { data: json, gzip: false, turnId };
+        return chatBody;
+    };
     const buildFetchArgs = () => {
         const signal = controller.signal;
         if (resuming) {
@@ -463,12 +501,15 @@ async function streamChat(messages, options, onEvent) {
         }
         return [
             `${exports.API_BASE}/api/code/chat`,
-            {
-                method: 'POST',
-                headers: authHeaders(),
-                body: JSON.stringify({ messages, model, env, editorContext, nexrallMd, mode, effort, clientType, extraTools, agents, skills, turnId, canWriteSharedMemory, hasOwnAgentStore, canSpawnSubAgents, canBrowseWeb, ...billingOverrideFields() }),
-                signal,
-            },
+            (() => {
+                const body = getChatBody();
+                return {
+                    method: 'POST',
+                    headers: body.gzip ? { ...authHeaders(), 'Content-Encoding': 'gzip' } : authHeaders(),
+                    body: body.data,
+                    signal,
+                };
+            })(),
         ];
     };
     // A transient mid-stream failure (Anthropic "overloaded_error") arrives as an SSE error
@@ -1274,6 +1315,28 @@ async function streamChat(messages, options, onEvent) {
                                             cache_read_input_tokens: typeof evt.cache_read_input_tokens === 'number' ? evt.cache_read_input_tokens : undefined,
                                         },
                                     });
+                                    // EARLY RESOLVE ON TOOL ROUNDS. The backend emits message_complete +
+                                    // usage synchronously, then awaits its billing write (Postgres + Redis)
+                                    // before sending `done`. For a tool_use turn nothing after this point is
+                                    // needed to run the tools, so waiting for `done` put a DB round-trip on
+                                    // the critical path of EVERY tool round. Return now; the socket keeps
+                                    // draining in the background, so a late balance_status / done / error
+                                    // still reaches onEvent. Only tool_use: a final (end_turn) answer keeps
+                                    // waiting so the low-balance nudge lands before the turn is reported done.
+                                    if (evt.partial !== true &&
+                                        completedMessage?.stopReason === 'tool_use' &&
+                                        earlyToolResolveEnabled()) {
+                                        clearInterval(heartbeatWatchdog);
+                                        // The watchdog is gone, so bound the background drain ourselves: a
+                                        // backend that never sends `done` must not pin the socket forever.
+                                        const drainGuard = setTimeout(() => {
+                                            stream.destroy?.();
+                                        }, HEARTBEAT_TIMEOUT_MS);
+                                        drainGuard.unref?.();
+                                        stream.once('end', () => clearTimeout(drainGuard));
+                                        stream.once('close', () => clearTimeout(drainGuard));
+                                        resolve();
+                                    }
                                 }
                                 break;
                             }
@@ -1326,6 +1389,23 @@ async function streamChat(messages, options, onEvent) {
                                 serverResumable = true;
                                 break;
                             }
+                            case 'tool_use_ready': {
+                                // A complete tool_use block, sent before the message finishes (see
+                                // SSEToolUseReadyEvent). Forwarded as-is; the loop decides what to prefetch.
+                                if (typeof evt.id === 'string' && typeof evt.name === 'string') {
+                                    const input = evt.input && typeof evt.input === 'object' ? evt.input : {};
+                                    onEvent({ type: 'tool_use_ready', id: evt.id, name: evt.name, input });
+                                }
+                                break;
+                            }
+                            case 'runtime_context': {
+                                // The exact context block the backend appended to our final message. The
+                                // agent loop persists it so the next round carries it in the cached history.
+                                if (typeof evt.text === 'string' && evt.text) {
+                                    onEvent({ type: 'runtime_context', text: evt.text });
+                                }
+                                break;
+                            }
                             case 'balance_status': {
                                 const balance = typeof evt.balance === 'number' ? evt.balance : 0;
                                 const zero = !!evt.zero;
@@ -1780,7 +1860,7 @@ async function getCodeModels() {
     const data = (await response.json());
     return {
         models: Array.isArray(data.models) ? data.models : [],
-        defaultModel: typeof data.defaultModel === 'string' ? data.defaultModel : 'claude-sonnet-5',
+        defaultModel: typeof data.defaultModel === 'string' ? data.defaultModel : 'deepseek-flash',
     };
 }
 /**

package/dist/index.d.ts

@@ -22,6 +22,7 @@ export * from './commands/loader';
 export * from './agent/agentTypes';
 export * from './agent/planMode';
 export * from './agent/agentRegistry';
+export * from './agent/backgroundAgents';
 export * from './permissions/rules';
 export * from './permissions/modePolicy';
 export * from './permissions/bashClassify';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC"}

package/dist/index.js

@@ -38,6 +38,7 @@ __exportStar(require("./commands/loader"), exports);
 __exportStar(require("./agent/agentTypes"), exports);
 __exportStar(require("./agent/planMode"), exports);
 __exportStar(require("./agent/agentRegistry"), exports);
+__exportStar(require("./agent/backgroundAgents"), exports);
 __exportStar(require("./permissions/rules"), exports);
 __exportStar(require("./permissions/modePolicy"), exports);
 __exportStar(require("./permissions/bashClassify"), exports);

package/dist/permissions/destructive.d.ts

@@ -29,13 +29,15 @@ export interface DestructiveMatch {
  * Classify a bash command. Returns the FIRST matching destructive category, or
  * null when the command is not recognised as destructive.
  *
- * Two passes with different data-stripping:
- *  - RAW_RULES run on the heredoc-stripped but quote-PRESERVING string, because
- *    real SQL lives inside quotes (`psql -c "DROP TABLE"`); they are gated on a
- *    DB-client token so a mention can't match.
- *  - STRIPPED_RULES run on the fully stripped string (quotes + heredocs gone) so
- *    mentions inside commit messages / echoes / grep patterns / heredoc'd docs
- *    never trip the bare-command rules (git/infra/cloud/container/publish).
+ * Two layers:
+ *  1. Regex rules (above). RAW_RULES run on the heredoc-stripped but quote-PRESERVING
+ *     string (real SQL lives inside quotes) and are gated on a DB-client token;
+ *     STRIPPED_RULES run on the fully stripped string so mentions in commit messages /
+ *     echoes / heredoc'd docs never trip them.
+ *  2. A token pass (destructiveTokens.ts) that splits the command like a shell, peels
+ *     wrappers (sudo/env/xargs/bash -c/ssh/docker exec …) and judges the real command.
+ *     It catches what a regex cannot: `git -C x reset --hard`, `git push -fu`,
+ *     `git push origin +main`, `rm -rf src`, `find . -delete`, `> file`.
  */
 export declare function classifyDestructiveCommand(command: string): DestructiveMatch | null;
 /** True when the given tool + input represents a destructive bash command. */

package/dist/permissions/destructive.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"destructive.d.ts","sourceRoot":"","sources":["../../src/permissions/destructive.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,0FAA0F;IAC1F,QAAQ,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;CAChB;AAsMD;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAenF;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,gBAAgB,GAAG,IAAI,CAQvG"}
+{"version":3,"file":"destructive.d.ts","sourceRoot":"","sources":["../../src/permissions/destructive.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,MAAM,WAAW,gBAAgB;IAC/B,0FAA0F;IAC1F,QAAQ,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;CAChB;AA8PD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAGnF;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,gBAAgB,GAAG,IAAI,CAQvG"}

package/dist/permissions/destructive.js

@@ -23,6 +23,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.classifyDestructiveCommand = classifyDestructiveCommand;
 exports.isDestructiveBash = isDestructiveBash;
+const destructiveTokens_1 = require("./destructiveTokens");
 // ── Data-section stripping (naive; feeds a heuristic, not an executor) ────────
 function stripHeredocs(command) {
     return command.replace(/<<-?\s*(['"]?)(\w+)\1[\s\S]*?\n\2(?=\s|;|&|$)/g, ' ');
@@ -66,6 +67,16 @@ const RAW_RULES = [
         reason: 'drops a Postgres/MySQL role or user',
         re: new RegExp(CMD_POS + DB_CLIENT + String.raw `\b[\s\S]*?\bdrop\s+(?:role|user)\b`, 'i'),
     },
+    {
+        category: 'database',
+        reason: 'UPDATE without a WHERE clause (rewrites every row)',
+        re: new RegExp(CMD_POS + DB_CLIENT + String.raw `\b[\s\S]*?\bupdate\s+[\w.` + '`' + String.raw `"]+\s+set\b(?![\s\S]*\bwhere\b)`, 'i'),
+    },
+    {
+        category: 'database',
+        reason: 'DELETE with a WHERE clause that is always true (deletes every row)',
+        re: new RegExp(CMD_POS + DB_CLIENT + String.raw `\b[\s\S]*?\bdelete\s+from\b[\s\S]*?\bwhere\s+(?:1\s*=\s*1|true)\b`, 'i'),
+    },
     {
         category: 'database',
         reason: 'drops a MongoDB database or collection',
@@ -106,11 +117,6 @@ const STRIPPED_RULES = [
         reason: 'deletes untracked files (git clean)',
         re: /\bgit\s+clean\s+-[a-z]*f/i,
     },
-    {
-        category: 'git-history',
-        reason: 'force-deletes a git branch',
-        re: /\bgit\s+branch\s+-[a-z]*D/i,
-    },
     {
         category: 'git-history',
         reason: 'rewrites git history (filter-branch/filter-repo)',
@@ -213,9 +219,7 @@ const STRIPPED_RULES = [
  *    mentions inside commit messages / echoes / grep patterns / heredoc'd docs
  *    never trip the bare-command rules (git/infra/cloud/container/publish).
  */
-function classifyDestructiveCommand(command) {
-    if (!command || typeof command !== 'string')
-        return null;
+function classifyRegex(command) {
     const raw = stripHeredocs(command);
     for (const rule of RAW_RULES) {
         if (rule.re.test(raw)) {
@@ -230,6 +234,49 @@ function classifyDestructiveCommand(command) {
     }
     return null;
 }
+/** Only the quote-preserving SQL rules — used for SQL a wrapper (ssh/docker exec/env) hid from CMD_POS. */
+function classifyRawSql(command) {
+    const raw = stripHeredocs(command);
+    for (const rule of RAW_RULES) {
+        if (rule.re.test(raw))
+            return { category: rule.category, reason: rule.reason };
+    }
+    return null;
+}
+const MAX_DEPTH = 4;
+function classify(command, depth) {
+    if (depth > MAX_DEPTH)
+        return null;
+    const viaRegex = classifyRegex(command);
+    if (viaRegex)
+        return viaRegex;
+    // Token pass: understands option order, bundled flags, wrappers and `bash -c "…"`.
+    for (const tokens of (0, destructiveTokens_1.tokenize)(stripHeredocs(command))) {
+        const m = (0, destructiveTokens_1.classifyTokens)(tokens, (inner) => classify(inner, depth + 1), classifyRawSql);
+        if (m)
+            return m;
+    }
+    return null;
+}
+/**
+ * Classify a bash command. Returns the FIRST matching destructive category, or
+ * null when the command is not recognised as destructive.
+ *
+ * Two layers:
+ *  1. Regex rules (above). RAW_RULES run on the heredoc-stripped but quote-PRESERVING
+ *     string (real SQL lives inside quotes) and are gated on a DB-client token;
+ *     STRIPPED_RULES run on the fully stripped string so mentions in commit messages /
+ *     echoes / heredoc'd docs never trip them.
+ *  2. A token pass (destructiveTokens.ts) that splits the command like a shell, peels
+ *     wrappers (sudo/env/xargs/bash -c/ssh/docker exec …) and judges the real command.
+ *     It catches what a regex cannot: `git -C x reset --hard`, `git push -fu`,
+ *     `git push origin +main`, `rm -rf src`, `find . -delete`, `> file`.
+ */
+function classifyDestructiveCommand(command) {
+    if (!command || typeof command !== 'string')
+        return null;
+    return classify(command, 0);
+}
 /** True when the given tool + input represents a destructive bash command. */
 function isDestructiveBash(tool, input) {
     if (tool !== 'bash' && tool !== 'run_command' && tool !== 'execute_command')

package/dist/permissions/destructiveTokens.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Token-level half of the destructive-command classifier.
+ *
+ * destructive.ts started life as a pile of regexes run over the command STRING. That
+ * missed most real-world spellings, because a regex does not understand shell:
+ *   - global options between the tool and its verb:  git -C repo reset --hard
+ *   - combined short flags:                           git push -fu origin main
+ *   - refspec force syntax:                           git push origin +main
+ *   - wrappers that hide the real command:            sudo / env X=1 / xargs / nohup
+ *   - interpreters that take the command as a string: bash -c "…", eval "…", ssh host "…"
+ *   - containers that run it elsewhere:               docker exec db psql … / kubectl exec -- …
+ * and it could not express "rm -rf node_modules is fine, rm -rf src is not".
+ *
+ * So this module splits the command into simple commands the way a shell would (honouring
+ * quotes, so a commit message that MENTIONS `git push --force` is one argument of
+ * `git commit`, never a command), peels wrappers off, and judges (binary, args).
+ *
+ * It is a heuristic, not a shell: no variable expansion, no aliases, no functions. When it
+ * cannot tell (an `rm -rf $DIR`), it errs toward asking — the cost of a false positive is
+ * one confirmation, the cost of a false negative is unrecoverable.
+ */
+export interface TokenMatch {
+    category: string;
+    reason: string;
+}
+/** Split `src` into simple commands, each a list of unquoted words. */
+export declare function tokenize(src: string): string[][];
+export declare function classifyTokens(tokens: string[], recurse: (command: string) => TokenMatch | null, rawSql: (command: string) => TokenMatch | null): TokenMatch | null;
+//# sourceMappingURL=destructiveTokens.d.ts.map

package/dist/permissions/destructiveTokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"destructiveTokens.d.ts","sourceRoot":"","sources":["../../src/permissions/destructiveTokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAID,uEAAuE;AACvE,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,CA2BhD;AAgQD,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EAAE,EAChB,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,UAAU,GAAG,IAAI,EAC/C,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,UAAU,GAAG,IAAI,GAC7C,UAAU,GAAG,IAAI,CAyDnB"}