@nexrall/code-core 1.4.66 → 1.4.68

package/dist/mcp/sseClient.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.McpSseClient = void 0;
 const node_fetch_1 = __importDefault(require("node-fetch"));
+const client_1 = require("./client");
 const httpClient_1 = require("./httpClient");
 const REQUEST_TIMEOUT_MS = 30000;
 const ENDPOINT_TIMEOUT_MS = 15000;
@@ -19,24 +20,53 @@ class McpSseClient {
         this._closed = false;
         this._pending = new Map();
         this._endpointWaiter = null;
+        this._elicitationHandler = null;
         this.name = name;
     }
     get tools() {
         return this._tools;
     }
+    setElicitationHandler(handler) { this._elicitationHandler = handler; }
     async connect() {
         if (!this.config.url)
             throw new Error(`MCP server "${this.name}" has no url (sse transport requires one).`);
         await this._openStream();
         await this._rpc('initialize', {
             protocolVersion: '2024-11-05',
-            capabilities: {},
+            capabilities: (0, client_1.elicitationCapability)(this.config.bareElicitationCapability),
             clientInfo: { name: 'nexrall-code', version: '1.0' },
         });
         await this._notify('notifications/initialized');
         const res = (await this._rpc('tools/list', {}));
         this._tools = res?.tools ?? [];
     }
+    async listResources() {
+        try {
+            const res = (await this._rpc('resources/list', {}));
+            return Array.isArray(res?.resources) ? res.resources : [];
+        }
+        catch {
+            return []; /* server has no resources capability */
+        }
+    }
+    async readResource(uri) {
+        return (0, client_1.flattenResourceContents)(await this._rpc('resources/read', { uri }));
+    }
+    async listPrompts() {
+        try {
+            const res = (await this._rpc('prompts/list', {}));
+            return Array.isArray(res?.prompts) ? res.prompts : [];
+        }
+        catch {
+            return []; /* server has no prompts capability */
+        }
+    }
+    async getPrompt(name, args) {
+        const params = { name };
+        if (Object.keys(args).length)
+            params.arguments = args;
+        return (0, client_1.flattenPromptMessages)(await this._rpc('prompts/get', params));
+    }
     async callTool(name, args) {
         const result = (await this._rpc('tools/call', { name, arguments: args }));
         if (!result)
@@ -159,6 +189,19 @@ class McpSseClient {
         catch {
             return; // non-JSON frame
         }
+        // A server→client REQUEST (elicitation) — answer it over the POST channel.
+        // Checked first: server request ids are their own namespace and could collide
+        // with one of ours.
+        if (typeof msg.method === 'string' && msg.id != null) {
+            const method = msg.method;
+            const params = msg.params;
+            const reqId = msg.id;
+            void (async () => {
+                const reply = await (0, client_1.serverRequestReply)(this.name, this._elicitationHandler, method, params);
+                await this._postMessage({ jsonrpc: '2.0', id: reqId, ...reply });
+            })().catch(() => { });
+            return;
+        }
         if (typeof msg.id === 'number' && this._pending.has(msg.id)) {
             const { resolve, reject, timer } = this._pending.get(msg.id);
             clearTimeout(timer);
@@ -167,6 +210,7 @@ class McpSseClient {
                 reject(new Error(`MCP error ${msg.error.code}: ${msg.error.message}`));
             else
                 resolve(msg.result ?? null);
+            return;
         }
         // Server-initiated notifications (no matching id) are ignored.
     }

package/dist/mcp/stats.d.ts

@@ -0,0 +1,41 @@
+export interface ToolStat {
+    calls: number;
+    failures: number;
+    /** Total wall time across every call, for an average that ignores the outlier size. */
+    totalMs: number;
+    /** The most recent call's duration — what a user means by "how long does it take". */
+    lastMs: number;
+    lastError?: string;
+    /** Epoch ms of the last call, so a stale number can be recognised as stale. */
+    lastAt: number;
+}
+export interface ServerTotals {
+    calls: number;
+    failures: number;
+    /** Calls that neither succeeded nor failed — still in flight or abandoned. */
+    pending: number;
+}
+export declare class ToolStats {
+    private readonly _byTool;
+    private _pending;
+    /** A call has started. Pair with exactly one ok()/fail(). */
+    begin(): void;
+    ok(name: string, ms: number, now?: number): void;
+    fail(name: string, ms: number, error: string, now?: number): void;
+    /** Everything recorded for one tool, or undefined if it was never called. */
+    get(name: string): ToolStat | undefined;
+    /** Stats for every tool whose name starts with `<server>__`, keyed by the bare tool name. */
+    forServer(server: string, prefix?: string): Array<{
+        tool: string;
+        stat: ToolStat;
+    }>;
+    forServerTotals(server: string, prefix?: string): ServerTotals;
+    /** Forgets one tool's history — so a fixed server stops showing old failures. */
+    reset(name?: string): void;
+    private _entry;
+}
+/** "240ms" / "1.2s" — a latency reading, not a stopwatch. */
+export declare function formatMs(ms: number): string;
+/** One line per tool, or '' when the server was never called (nothing to say yet). */
+export declare function describeStats(stat: ToolStat | undefined, avg?: boolean): string;
+//# sourceMappingURL=stats.d.ts.map

package/dist/mcp/stats.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stats.d.ts","sourceRoot":"","sources":["../../src/mcp/stats.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,uFAAuF;IACvF,OAAO,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA+B;IACvD,OAAO,CAAC,QAAQ,CAAK;IAErB,6DAA6D;IAC7D,KAAK,IAAI,IAAI;IAIb,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,IAAI;IAUpD,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,IAAI;IAWrE,6EAA6E;IAC7E,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS;IAIvC,6FAA6F;IAC7F,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,SAAO,GAAG,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC;IAYjF,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,SAAO,GAAG,YAAY;IAS5D,iFAAiF;IACjF,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI;IAK1B,OAAO,CAAC,MAAM;CAKf;AAED,6DAA6D;AAC7D,wBAAgB,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAI3C;AAED,sFAAsF;AACtF,wBAAgB,aAAa,CAAC,IAAI,EAAE,QAAQ,GAAG,SAAS,EAAE,GAAG,UAAO,GAAG,MAAM,CAO5E"}

package/dist/mcp/stats.js

@@ -0,0 +1,108 @@
+"use strict";
+// Per-tool call statistics for MCP servers (spec §42 "Tool latency / failures").
+//
+// WHY: when an MCP tool call returns nothing useful, the user's only question is
+// "is this server slow, or broken?" — and the answer existed nowhere. The manager
+// saw every call (it is the only path a tool call can take) but kept no record, so
+// a flaky server looked exactly like a healthy one until it failed outright.
+//
+// Kept in its own file, and kept PURE (the caller measures the elapsed time), so the
+// bookkeeping is unit-testable without spawning an MCP server. Nothing here is a
+// promise about the future: the numbers are "since this session started", which is
+// exactly the window a user is reasoning about.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ToolStats = void 0;
+exports.formatMs = formatMs;
+exports.describeStats = describeStats;
+class ToolStats {
+    constructor() {
+        this._byTool = new Map();
+        this._pending = 0;
+    }
+    /** A call has started. Pair with exactly one ok()/fail(). */
+    begin() {
+        this._pending++;
+    }
+    ok(name, ms, now = Date.now()) {
+        this._pending = Math.max(0, this._pending - 1);
+        const s = this._entry(name);
+        s.calls++;
+        s.totalMs += Math.max(0, ms);
+        s.lastMs = Math.max(0, ms);
+        s.lastAt = now;
+        delete s.lastError;
+    }
+    fail(name, ms, error, now = Date.now()) {
+        this._pending = Math.max(0, this._pending - 1);
+        const s = this._entry(name);
+        s.calls++;
+        s.failures++;
+        s.totalMs += Math.max(0, ms);
+        s.lastMs = Math.max(0, ms);
+        s.lastError = error;
+        s.lastAt = now;
+    }
+    /** Everything recorded for one tool, or undefined if it was never called. */
+    get(name) {
+        return this._byTool.get(name);
+    }
+    /** Stats for every tool whose name starts with `<server>__`, keyed by the bare tool name. */
+    forServer(server, prefix = '__') {
+        const head = server + prefix;
+        const out = [];
+        for (const [name, stat] of this._byTool) {
+            if (!name.startsWith(head))
+                continue;
+            out.push({ tool: name.slice(head.length), stat });
+        }
+        // Slowest / most used first: that is the row a user is looking for.
+        out.sort((a, b) => b.stat.calls - a.stat.calls || a.tool.localeCompare(b.tool));
+        return out;
+    }
+    forServerTotals(server, prefix = '__') {
+        const rows = this.forServer(server, prefix);
+        return {
+            calls: rows.reduce((n, r) => n + r.stat.calls, 0),
+            failures: rows.reduce((n, r) => n + r.stat.failures, 0),
+            pending: this._pending,
+        };
+    }
+    /** Forgets one tool's history — so a fixed server stops showing old failures. */
+    reset(name) {
+        if (name === undefined) {
+            this._byTool.clear();
+            return;
+        }
+        this._byTool.delete(name);
+    }
+    _entry(name) {
+        let s = this._byTool.get(name);
+        if (!s) {
+            s = { calls: 0, failures: 0, totalMs: 0, lastMs: 0, lastAt: 0 };
+            this._byTool.set(name, s);
+        }
+        return s;
+    }
+}
+exports.ToolStats = ToolStats;
+/** "240ms" / "1.2s" — a latency reading, not a stopwatch. */
+function formatMs(ms) {
+    if (!Number.isFinite(ms) || ms < 0)
+        return '—';
+    if (ms < 1000)
+        return `${Math.round(ms)}ms`;
+    return `${(ms / 1000).toFixed(ms < 10000 ? 1 : 0)}s`;
+}
+/** One line per tool, or '' when the server was never called (nothing to say yet). */
+function describeStats(stat, avg = true) {
+    if (!stat || stat.calls === 0)
+        return '';
+    const parts = [`${stat.calls} call${stat.calls === 1 ? '' : 's'}`];
+    if (stat.failures)
+        parts.push(`${stat.failures} failed`);
+    parts.push(`${avg && stat.calls > 1 ? 'avg' : 'last'} ${formatMs(avg && stat.calls > 1 ? stat.totalMs / stat.calls : stat.lastMs)}`);
+    if (stat.lastError)
+        parts.push(stat.lastError.split('\n')[0].slice(0, 80));
+    return parts.join(' · ');
+}
+//# sourceMappingURL=stats.js.map

package/dist/permissions/destructive.d.ts

@@ -24,6 +24,8 @@ export interface DestructiveMatch {
     category: string;
     /** Short human-readable reason shown in the confirmation prompt. */
     reason: string;
+    /** Contained harm — `auto` mode may skip the confirmation (see TokenMatch.lowRisk). */
+    lowRisk?: boolean;
 }
 /**
  * Classify a bash command. Returns the FIRST matching destructive category, or

package/dist/permissions/destructive.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"destructive.d.ts","sourceRoot":"","sources":["../../src/permissions/destructive.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,MAAM,WAAW,gBAAgB;IAC/B,0FAA0F;IAC1F,QAAQ,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;CAChB;AA8PD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAGnF;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,gBAAgB,GAAG,IAAI,CAQvG"}
+{"version":3,"file":"destructive.d.ts","sourceRoot":"","sources":["../../src/permissions/destructive.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,MAAM,WAAW,gBAAgB;IAC/B,0FAA0F;IAC1F,QAAQ,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,uFAAuF;IACvF,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAiQD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAGnF;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,gBAAgB,GAAG,IAAI,CAQvG"}

package/dist/permissions/destructive.js

@@ -251,12 +251,16 @@ function classify(command, depth) {
     if (viaRegex)
         return viaRegex;
     // Token pass: understands option order, bundled flags, wrappers and `bash -c "…"`.
+    // A low-risk hit (scratch-file truncation) must not mask a real one later in the chain.
+    let soft = null;
     for (const tokens of (0, destructiveTokens_1.tokenize)(stripHeredocs(command))) {
         const m = (0, destructiveTokens_1.classifyTokens)(tokens, (inner) => classify(inner, depth + 1), classifyRawSql);
-        if (m)
+        if (m && !m.lowRisk)
             return m;
+        if (m && !soft)
+            soft = m;
     }
-    return null;
+    return soft;
 }
 /**
  * Classify a bash command. Returns the FIRST matching destructive category, or

package/dist/permissions/destructiveTokens.d.ts

@@ -22,6 +22,11 @@
 export interface TokenMatch {
     category: string;
     reason: string;
+    /**
+     * True when the harm is contained (e.g. truncating a scratch file under /tmp or a
+     * relative path). `auto` mode may run these without asking; every other mode still does.
+     */
+    lowRisk?: boolean;
 }
 /** Split `src` into simple commands, each a list of unquoted words. */
 export declare function tokenize(src: string): string[][];

package/dist/permissions/destructiveTokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"destructiveTokens.d.ts","sourceRoot":"","sources":["../../src/permissions/destructiveTokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAID,uEAAuE;AACvE,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,CA2BhD;AAgQD,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EAAE,EAChB,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,UAAU,GAAG,IAAI,EAC/C,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,UAAU,GAAG,IAAI,GAC7C,UAAU,GAAG,IAAI,CAyDnB"}
+{"version":3,"file":"destructiveTokens.d.ts","sourceRoot":"","sources":["../../src/permissions/destructiveTokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAID,uEAAuE;AACvE,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,CA2BhD;AAgQD,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EAAE,EAChB,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,UAAU,GAAG,IAAI,EAC/C,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,UAAU,GAAG,IAAI,GAC7C,UAAU,GAAG,IAAI,CA8DnB"}

package/dist/permissions/destructiveTokens.js

@@ -388,9 +388,15 @@ function classifyTokens(tokens, recurse, rawSql) {
             const r = /^>(?![>&])/.test(t[0]) ? t : ((t[0] === ':' || t[0] === 'true') && /^>(?![>&])/.test(t[1] ?? '')) ? t.slice(1) : null;
             if (r) {
                 const target = r[0].length > 1 ? r[0].slice(1) : (r[1] ?? '');
-                if (!target.startsWith('/dev/'))
-                    return hit('filesystem', 'a bare `>` redirect truncates the file (contents lost)');
-                return null;
+                if (target.startsWith('/dev/'))
+                    return null;
+                const m = hit('filesystem', 'a bare `>` redirect truncates the file (contents lost)');
+                // Scratch/relative targets only: no `$var`, `~`, `..`; absolute paths must be under a temp dir.
+                const scratch = target !== '' && !/[$`~]|(^|\/)\.\.(\/|$)/.test(target)
+                    && (!target.startsWith('/') || /^\/(?:private\/)?(?:tmp|var\/folders)\//.test(target));
+                if (scratch)
+                    m.lowRisk = true;
+                return m;
             }
         }
         const bin = base(t[0]);

package/dist/permissions/modePolicy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"modePolicy.d.ts","sourceRoot":"","sources":["../../src/permissions/modePolicy.ts"],"names":[],"mappings":"AAsBA,yDAAyD;AACzD,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;AAE9D,kDAAkD;AAClD,MAAM,MAAM,cAAc,GACtB,OAAO,GACP,KAAK,GACL,MAAM,GACN,SAAS,CAAC;AAEd,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,EAAE,cAAc,CAAC;IACrB,oFAAoF;IACpF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,eAAe,aAW1B,CAAC;AAEH,0CAA0C;AAC1C,eAAO,MAAM,gBAAgB,aAG3B,CAAC;AAEH,oEAAoE;AACpE,eAAO,MAAM,iBAAiB,aAE5B,CAAC;AAEH,sCAAsC;AACtC,eAAO,MAAM,UAAU,aAAsD,CAAC;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED;;;;;;;GAOG;AACH,wBAAgB,MAAM,CAAC,GAAG,EAAE,WAAW,GAAG,cAAc,CAwDvD;AAED,4DAA4D;AAC5D,wBAAgB,YAAY,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAOzD;AAED,gFAAgF;AAChF,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,cAAc,CAGtD"}
+{"version":3,"file":"modePolicy.d.ts","sourceRoot":"","sources":["../../src/permissions/modePolicy.ts"],"names":[],"mappings":"AAsBA,yDAAyD;AACzD,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;AAE9D,kDAAkD;AAClD,MAAM,MAAM,cAAc,GACtB,OAAO,GACP,KAAK,GACL,MAAM,GACN,SAAS,CAAC;AAEd,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,EAAE,cAAc,CAAC;IACrB,oFAAoF;IACpF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,eAAe,aAY1B,CAAC;AAEH,0CAA0C;AAC1C,eAAO,MAAM,gBAAgB,aAG3B,CAAC;AAEH,oEAAoE;AACpE,eAAO,MAAM,iBAAiB,aAE5B,CAAC;AAEH,sCAAsC;AACtC,eAAO,MAAM,UAAU,aAAsD,CAAC;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED;;;;;;;GAOG;AACH,wBAAgB,MAAM,CAAC,GAAG,EAAE,WAAW,GAAG,cAAc,CA0DvD;AAED,4DAA4D;AAC5D,wBAAgB,YAAY,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAOzD;AAED,gFAAgF;AAChF,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,cAAc,CAGtD"}

package/dist/permissions/modePolicy.js

@@ -29,6 +29,7 @@ exports.READ_ONLY_TOOLS = new Set([
     'fetch_url', 'web_search',
     'bash_output', 'kill_shell',
     'todo_read', 'todo_write',
+    'cron_list', 'mcp_list_resources', 'mcp_read_resource',
     'memory_read',
     'use_skill',
     'notebook_read',
@@ -87,7 +88,9 @@ function decide(req) {
     //    Before bypass, before mode. `rm -rf`, `git push --force`, `DROP TABLE` are not
     //    things any mode should silently perform, and the strong confirm treatment (type
     //    the word "yes", no "approve all") is what makes it a real speed bump.
-    if (req.destructive)
+    //    EXCEPT `auto`: the user chose "run everything on your own", so it does not stop here
+    //    (hard-blocked commands such as `rm -rf /` are still denied by the executor).
+    if (req.destructive && mode !== 'auto')
         return 'confirm';
     // 3. Plan mode: refuse every remaining (i.e. mutating) tool outright.
     //    A refusal, not a prompt — the guarantee is "nothing changes until I approve the
@@ -135,7 +138,7 @@ function describeMode(mode) {
         case 'plan': return 'plan — read-only, produces a plan for approval';
         case 'ask': return 'ask — approves reads; asks before edits and commands';
         case 'edit': return 'edit — edits files freely; asks before shell commands';
-        case 'auto': return 'auto — runs every tool on its own; still confirms irreversible actions';
+        case 'auto': return 'auto — runs every tool on its own, including irreversible commands';
     }
 }
 /** Normalise arbitrary input to a known mode, defaulting to the safe middle. */

package/dist/permissions/rules.d.ts

@@ -9,7 +9,10 @@ export interface MergedSettings {
     /** Raw merged object (for hooks, allowedTools, etc.). */
     raw: Record<string, unknown>;
 }
-/** Merge the settings tiers (deny/allow/ask arrays are unioned). */
+/** Replace the rules supplied for this process by flags. Not persisted anywhere. */
+export declare function setSessionRules(r: Partial<PermissionRules>): void;
+export declare function setSessionSettings(obj: Record<string, unknown> | null): void;
+export declare function getSessionSettings(): Record<string, unknown> | null;
 export declare function loadSettings(workDir: string): MergedSettings;
 /**
  * Evaluate a tool call against merged rules. Returns the matching decision, or

package/dist/permissions/rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/permissions/rules.ts"],"names":[],"mappings":"AAwBA,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,eAAe,CAAC;IAC7B,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B;AAsBD,oEAAoE;AACpE,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CAoB5D;AA8ID;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,EAAE,MAAM,GACd,kBAAkB,GAAG,IAAI,CAK3B"}
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/permissions/rules.ts"],"names":[],"mappings":"AAwBA,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,eAAe,CAAC;IAC7B,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B;AA4BD,oFAAoF;AACpF,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,IAAI,CAEjE;AAQD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,CAA2B;AACxG,wBAAgB,kBAAkB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAA4B;AAEhG,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CA8B5D;AA8ID;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,EAAE,MAAM,GACd,kBAAkB,GAAG,IAAI,CAK3B"}

package/dist/permissions/rules.js

@@ -33,6 +33,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.setSessionRules = setSessionRules;
+exports.setSessionSettings = setSessionSettings;
+exports.getSessionSettings = getSessionSettings;
 exports.loadSettings = loadSettings;
 exports.evaluatePermission = evaluatePermission;
 const fs = __importStar(require("fs"));
@@ -58,7 +61,23 @@ function extractRules(obj) {
     const arr = (v) => (Array.isArray(v) ? v.filter((x) => typeof x === 'string') : []);
     return { allow: arr(p.allow), ask: arr(p.ask), deny: arr(p.deny) };
 }
+// Session-scoped rules from CLI flags (--allowedTools / --disallowedTools). Held here, not
+// in the CLI's permission handler, because core's own gates (e.g. the `task` deny check in
+// the agent loop) call loadSettings() directly — a flag that only the handler saw would let
+// a sub-agent dispatch walk straight past it.
+let sessionRules = { allow: [], ask: [], deny: [] };
+/** Replace the rules supplied for this process by flags. Not persisted anywhere. */
+function setSessionRules(r) {
+    sessionRules = { allow: [...(r.allow ?? [])], ask: [...(r.ask ?? [])], deny: [...(r.deny ?? [])] };
+}
 /** Merge the settings tiers (deny/allow/ask arrays are unioned). */
+// A settings object supplied for this run only (`--settings <file|json>`). It is the LAST file
+// tier: it overrides user/project values key-by-key (like the files do among themselves) and
+// its permission rules ADD to theirs. Held here, with the rules above, because core's own gates
+// call loadSettings() directly.
+let sessionSettings = null;
+function setSessionSettings(obj) { sessionSettings = obj; }
+function getSessionSettings() { return sessionSettings; }
 function loadSettings(workDir) {
     const tiers = [
         managedSettingsPath(),
@@ -78,6 +97,16 @@ function loadSettings(workDir) {
         merged.ask.push(...r.ask);
         merged.deny.push(...r.deny);
     }
+    if (sessionSettings) {
+        Object.assign(raw, sessionSettings);
+        const r = extractRules(sessionSettings);
+        merged.allow.push(...r.allow);
+        merged.ask.push(...r.ask);
+        merged.deny.push(...r.deny);
+    }
+    merged.allow.push(...sessionRules.allow);
+    merged.ask.push(...sessionRules.ask);
+    merged.deny.push(...sessionRules.deny);
     return { permissions: merged, raw };
 }
 // ─── Rule matching ──────────────────────────────────────────────────────────

package/dist/plugins/data.d.ts

@@ -0,0 +1,23 @@
+/** Claude Code's rule: letters, digits, `_`, `-` survive; everything else becomes `-`. */
+export declare function sanitizePluginId(name: string): string;
+/** Where this plugin's persistent data lives. Pure — does not touch the disk. */
+export declare function pluginDataDir(name: string): string;
+/**
+ * `pluginDataDir`, created if missing. Returns the path either way.
+ *
+ * Called right before a plugin's process is spawned with NEXRALL_PLUGIN_DATA in
+ * its environment, so the promise "the variable points at a directory you may
+ * write to" holds the moment the plugin can read it.
+ */
+export declare function ensurePluginDataDir(name: string): string;
+/** True when the plugin has data on disk from earlier runs. */
+export declare function pluginHasData(name: string): boolean;
+/**
+ * Raw bytes under a plugin's data directory (0 when missing). Bounded walk: a
+ * plugin can park a large tree here, and reporting the size must not be the
+ * thing that makes `nex plugin prune` slow, so entries are counted up to a cap.
+ */
+export declare function pluginDataSize(name: string, maxEntries?: number): number;
+/** Remove a plugin's data directory. Returns true when something was removed. */
+export declare function removePluginData(name: string): boolean;
+//# sourceMappingURL=data.d.ts.map

package/dist/plugins/data.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data.d.ts","sourceRoot":"","sources":["../../src/plugins/data.ts"],"names":[],"mappings":"AAwBA,0FAA0F;AAC1F,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMxD;AAED,+DAA+D;AAC/D,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMnD;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,SAAO,GAAG,MAAM,CAiBtE;AAED,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAStD"}

package/dist/plugins/data.js

@@ -0,0 +1,141 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanitizePluginId = sanitizePluginId;
+exports.pluginDataDir = pluginDataDir;
+exports.ensurePluginDataDir = ensurePluginDataDir;
+exports.pluginHasData = pluginHasData;
+exports.pluginDataSize = pluginDataSize;
+exports.removePluginData = removePluginData;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+// ─── Plugin data directories ──────────────────────────────────────────────────
+//
+// A plugin's own files are replaced on every update, so state a plugin wants to
+// keep — caches, node_modules, a downloaded model, a database — cannot live
+// inside its install directory. It gets a per-plugin data directory instead:
+//
+//     ~/.nexrall/plugin-data/<id>/
+//
+// which survives updates and is exposed to the plugin's own processes (its hook
+// commands and its MCP servers) as NEXRALL_PLUGIN_DATA. Same idea as Claude
+// Code's ${CLAUDE_PLUGIN_DATA}, same id rule: everything outside [A-Za-z0-9_-]
+// becomes "-", so a name can never escape the parent directory or collide with
+// path syntax ("my.plugin" → "my-plugin"). Two names that differ only in those
+// characters share a directory — which is why the id is derived, never taken
+// verbatim.
+//
+// The directory is created on FIRST REFERENCE, not at install: a plugin that
+// never touches its data dir leaves nothing behind, and `nex plugin remove`
+// does not have to guess whether a directory it finds is in use.
+/** Claude Code's rule: letters, digits, `_`, `-` survive; everything else becomes `-`. */
+function sanitizePluginId(name) {
+    return name.replace(/[^\w-]/g, '-');
+}
+/** Where this plugin's persistent data lives. Pure — does not touch the disk. */
+function pluginDataDir(name) {
+    return path.join(os.homedir(), '.nexrall', 'plugin-data', sanitizePluginId(name));
+}
+/**
+ * `pluginDataDir`, created if missing. Returns the path either way.
+ *
+ * Called right before a plugin's process is spawned with NEXRALL_PLUGIN_DATA in
+ * its environment, so the promise "the variable points at a directory you may
+ * write to" holds the moment the plugin can read it.
+ */
+function ensurePluginDataDir(name) {
+    const dir = pluginDataDir(name);
+    try {
+        fs.mkdirSync(dir, { recursive: true });
+    }
+    catch { /* unwritable home: the plugin will see the path and fail its own write */ }
+    return dir;
+}
+/** True when the plugin has data on disk from earlier runs. */
+function pluginHasData(name) {
+    try {
+        return fs.readdirSync(pluginDataDir(name)).length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Raw bytes under a plugin's data directory (0 when missing). Bounded walk: a
+ * plugin can park a large tree here, and reporting the size must not be the
+ * thing that makes `nex plugin prune` slow, so entries are counted up to a cap.
+ */
+function pluginDataSize(name, maxEntries = 5000) {
+    let total = 0;
+    let seen = 0;
+    const walk = (dir) => {
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            if (seen++ >= maxEntries)
+                return;
+            const full = path.join(dir, e.name);
+            try {
+                if (e.isDirectory())
+                    walk(full);
+                else
+                    total += fs.statSync(full).size;
+            }
+            catch { /* unreadable entry — skip it, size is an estimate */ }
+        }
+    };
+    walk(pluginDataDir(name));
+    return total;
+}
+/** Remove a plugin's data directory. Returns true when something was removed. */
+function removePluginData(name) {
+    const dir = pluginDataDir(name);
+    try {
+        if (!fs.existsSync(dir))
+            return false;
+        fs.rmSync(dir, { recursive: true, force: true });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=data.js.map

package/dist/plugins/index.d.ts

@@ -58,8 +58,20 @@ export declare function loadPlugins(workDir: string): PluginInfo[];
 export declare function findPlugin(workDir: string, name: string, scope: 'project' | 'global'): PluginInfo | undefined;
 /** Subdirectories of every ENABLED installed plugin that hold `kind` assets (existing only). */
 export declare function pluginAssetDirs(workDir: string, kind: 'commands' | 'agents' | 'skills'): string[];
-/** Merge hooks.json from every ENABLED plugin into a single hooks config (arrays concatenated). */
+/** Merge hooks.json from every ENABLED plugin into a single hooks config (arrays concatenated).
+ *
+ * Every handler is stamped with `plugin: <name>`. Provenance is the one thing the merge
+ * would otherwise destroy — and it is what lets the hook runner hand the plugin's own
+ * processes their NEXRALL_PLUGIN_DATA (see runHookHandler). Both entry forms are stamped:
+ * the flat one (the entry IS the handler) and the nested one (each item under `hooks`).
+ */
 export declare function pluginHooks(workDir: string): Record<string, unknown[]>;
-/** MCP server maps declared by ENABLED plugins: { serverName → config } (first plugin wins on clash). */
+/** MCP server maps declared by ENABLED plugins: { serverName → config } (first plugin wins on clash).
+ *
+ * A stdio server from a plugin gets NEXRALL_PLUGIN_DATA in its environment, pointing at the
+ * plugin's persistent data directory — the install directory is replaced on every update, so
+ * this is the only place a server can keep state. A plugin that set the variable itself keeps
+ * its own value: an explicit config value is never overridden here.
+ */
 export declare function pluginMcpServers(workDir: string): Record<string, unknown>;
 //# sourceMappingURL=index.d.ts.map

package/dist/plugins/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/plugins/index.ts"],"names":[],"mappings":"AAsCA,MAAM,WAAW,UAAU;IACzB,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC5B,6EAA6E;IAC7E,QAAQ,EAAE,OAAO,CAAC;CACnB;AAYD,oEAAoE;AACpE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAMrD;AAED,0FAA0F;AAC1F,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,IAAI,CAWtE;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,8DAA8D;AAC9D,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,OAAO,eAAe,GAAG,MAAM,GAAG,IAAI,CAQhG;AAwCD;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,EAAE,CAKzD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,CAK7G;AAED,gGAAgG;AAChG,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,EAAE,CAOjG;AAED,mGAAmG;AACnG,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAkBtE;AAED,yGAAyG;AACzG,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgBzE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/plugins/index.ts"],"names":[],"mappings":"AAuCA,MAAM,WAAW,UAAU;IACzB,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC5B,6EAA6E;IAC7E,QAAQ,EAAE,OAAO,CAAC;CACnB;AAYD,oEAAoE;AACpE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAMrD;AAED,0FAA0F;AAC1F,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,IAAI,CAWtE;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,8DAA8D;AAC9D,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,OAAO,eAAe,GAAG,MAAM,GAAG,IAAI,CAQhG;AAwCD;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,EAAE,CAKzD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,CAK7G;AAED,gGAAgG;AAChG,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,EAAE,CAOjG;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAkBtE;AAeD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgBzE"}