@nexrall/code-core 1.4.65 → 1.4.66

package/dist/permissions/modePolicy.d.ts

@@ -37,16 +37,20 @@ export declare const FILE_MUTATE_TOOLS: Set<string>;
 /** Tools that run a shell command. */
 export declare const BASH_TOOLS: Set<string>;
 /**
- * Is this bash command read-only?
+ * Is this bash command read-only — i.e. safe to run WITHOUT asking?
  *
- * Deliberately delegates to `bashNeedsRepoLock`, the classifier written for the
- * concurrency work: it already distinguishes commands that mutate shared state
- * (`git`, `npm`, `cargo`, `make` …) from ones that only read (`grep`, `ls`, `cat`,
- * `rg`), scanning every shell segment so `cd x && npm publish` is caught.
+ * History: this used to be `!bashNeedsRepoLock(command)`. That classifier answers a
+ * different question — "does this need the repo-state LOCK?" — by listing the ~30
+ * build/VCS verbs that take one (git, npm, make …). Everything NOT on that list was
+ * therefore "read-only", so `rm file`, `mv`, `echo x > f`, `sed -i`, `kill` and
+ * `curl … | sh` all ran with no prompt in `ask` and `edit` mode. Measured through the
+ * real `requestPermission`: prompted=0 for each. A denylist of mutators can never be
+ * complete; the gate needs an ALLOWLIST of readers, which plan mode already had.
  *
- * Reusing it is the point. Writing a second classifier here would create two
- * definitions of "mutating" that must agree forever — the exact failure this whole
- * audit keeps finding. If the lock treats a command as mutating, so does the gate.
+ * It now delegates to `isReadOnlyPipeline` (agent/planMode.ts), the same "provably
+ * read-only" classifier the plan-mode lock uses, so "read-only" means one thing in
+ * both places. `bashNeedsRepoLock` is unchanged and still correct for what it is for:
+ * deciding which calls must not run concurrently.
  */
 export declare function isReadOnlyBash(command: string): boolean;
 /**

package/dist/permissions/modePolicy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"modePolicy.d.ts","sourceRoot":"","sources":["../../src/permissions/modePolicy.ts"],"names":[],"mappings":"AAsBA,yDAAyD;AACzD,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;AAE9D,kDAAkD;AAClD,MAAM,MAAM,cAAc,GACtB,OAAO,GACP,KAAK,GACL,MAAM,GACN,SAAS,CAAC;AAEd,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,EAAE,cAAc,CAAC;IACrB,oFAAoF;IACpF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,eAAe,aAW1B,CAAC;AAEH,0CAA0C;AAC1C,eAAO,MAAM,gBAAgB,aAG3B,CAAC;AAEH,oEAAoE;AACpE,eAAO,MAAM,iBAAiB,aAE5B,CAAC;AAEH,sCAAsC;AACtC,eAAO,MAAM,UAAU,aAAsD,CAAC;AAE9E;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED;;;;;;;GAOG;AACH,wBAAgB,MAAM,CAAC,GAAG,EAAE,WAAW,GAAG,cAAc,CAwDvD;AAED,4DAA4D;AAC5D,wBAAgB,YAAY,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAOzD;AAED,gFAAgF;AAChF,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,cAAc,CAGtD"}
+{"version":3,"file":"modePolicy.d.ts","sourceRoot":"","sources":["../../src/permissions/modePolicy.ts"],"names":[],"mappings":"AAsBA,yDAAyD;AACzD,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;AAE9D,kDAAkD;AAClD,MAAM,MAAM,cAAc,GACtB,OAAO,GACP,KAAK,GACL,MAAM,GACN,SAAS,CAAC;AAEd,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,EAAE,cAAc,CAAC;IACrB,oFAAoF;IACpF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,eAAe,aAW1B,CAAC;AAEH,0CAA0C;AAC1C,eAAO,MAAM,gBAAgB,aAG3B,CAAC;AAEH,oEAAoE;AACpE,eAAO,MAAM,iBAAiB,aAE5B,CAAC;AAEH,sCAAsC;AACtC,eAAO,MAAM,UAAU,aAAsD,CAAC;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED;;;;;;;GAOG;AACH,wBAAgB,MAAM,CAAC,GAAG,EAAE,WAAW,GAAG,cAAc,CAwDvD;AAED,4DAA4D;AAC5D,wBAAgB,YAAY,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAOzD;AAED,gFAAgF;AAChF,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,cAAc,CAGtD"}

package/dist/permissions/modePolicy.js

@@ -5,7 +5,7 @@ exports.isReadOnlyBash = isReadOnlyBash;
 exports.decide = decide;
 exports.describeMode = describeMode;
 exports.parseMode = parseMode;
-const bashClassify_1 = require("./bashClassify");
+const planMode_1 = require("../agent/planMode");
 /**
  * Tools that only ever READ. Always allowed, in every mode including plan.
  *
@@ -48,19 +48,23 @@ exports.FILE_MUTATE_TOOLS = new Set([
 /** Tools that run a shell command. */
 exports.BASH_TOOLS = new Set(['bash', 'run_command', 'execute_command']);
 /**
- * Is this bash command read-only?
+ * Is this bash command read-only — i.e. safe to run WITHOUT asking?
  *
- * Deliberately delegates to `bashNeedsRepoLock`, the classifier written for the
- * concurrency work: it already distinguishes commands that mutate shared state
- * (`git`, `npm`, `cargo`, `make` …) from ones that only read (`grep`, `ls`, `cat`,
- * `rg`), scanning every shell segment so `cd x && npm publish` is caught.
+ * History: this used to be `!bashNeedsRepoLock(command)`. That classifier answers a
+ * different question — "does this need the repo-state LOCK?" — by listing the ~30
+ * build/VCS verbs that take one (git, npm, make …). Everything NOT on that list was
+ * therefore "read-only", so `rm file`, `mv`, `echo x > f`, `sed -i`, `kill` and
+ * `curl … | sh` all ran with no prompt in `ask` and `edit` mode. Measured through the
+ * real `requestPermission`: prompted=0 for each. A denylist of mutators can never be
+ * complete; the gate needs an ALLOWLIST of readers, which plan mode already had.
  *
- * Reusing it is the point. Writing a second classifier here would create two
- * definitions of "mutating" that must agree forever — the exact failure this whole
- * audit keeps finding. If the lock treats a command as mutating, so does the gate.
+ * It now delegates to `isReadOnlyPipeline` (agent/planMode.ts), the same "provably
+ * read-only" classifier the plan-mode lock uses, so "read-only" means one thing in
+ * both places. `bashNeedsRepoLock` is unchanged and still correct for what it is for:
+ * deciding which calls must not run concurrently.
  */
 function isReadOnlyBash(command) {
-    return !(0, bashClassify_1.bashNeedsRepoLock)(command);
+    return (0, planMode_1.isReadOnlyPipeline)(command);
 }
 /**
  * The single source of truth for "should we prompt?".

package/dist/types.d.ts

@@ -566,7 +566,7 @@ export interface AgentLoopOptions {
      *
      * Separate from _allowedTools because it restricts WHICH PATHS a granted write tool may
      * touch, not which tools exist — intersecting tool names cannot express it. It must be
-     * inherited, or nesting defeats it: `test-writer` may only write tests, but delegating to
+     * inherited, or nesting defeats it: a test-only agent may only write tests, but delegating to
      * any agent without that flag would write production source on its behalf.
      */
     _testFilesOnly?: boolean;
@@ -584,7 +584,7 @@ export interface AgentLoopOptions {
     /** As `_extraAgentTypes`, for `@nexrall/agent`'s `registerSkills()`. */
     _extraSkills?: import('./agent/skills').Skill[];
     /**
-     * Internal: the sub-agent TYPE name this run is executing as (e.g. 'reviewer'),
+     * Internal: the sub-agent TYPE name this run is executing as (e.g. 'explorer'),
      * or undefined for the main agent.
      *
      * Carried for the audit trail: `_agentScope` identifies the run instance

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nexrall/code-core",
-  "version": "1.4.65",
+  "version": "1.4.66",
   "description": "Core agent loop, tools, and extension primitives for Nexrall Code — embed an AI coding agent in any Node.js application.",
   "license": "MIT",
   "author": "Nexrall <support@nexrall.com> (https://nexrall.com)",
@@ -79,6 +79,12 @@
   "engines": {
     "node": ">=18.0.0"
   },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "test": "npm run build && node --test test/*.test.mjs",
+    "prepublishOnly": "npm run build && npm test"
+  },
   "dependencies": {
     "eventsource-parser": "^1.1.2",
     "node-fetch": "^3.3.2",
@@ -89,10 +95,5 @@
   "devDependencies": {
     "@types/node": "^26.0.1",
     "typescript": "^6.0.3"
-  },
-  "scripts": {
-    "build": "tsc",
-    "dev": "tsc --watch",
-    "test": "npm run build && node --test test/*.test.mjs"
   }
-}
+}