@nexrall/code-core 1.4.74 → 1.4.76

package/README.md

@@ -12,6 +12,7 @@ npm install @nexrall/code-core
 |--------|-------------|
 | `@nexrall/code-core` | Everything via the root export |
 | `@nexrall/code-core/agent` | `runAgentLoop` — the main agentic loop |
+| `@nexrall/code-core/agent-types` | `loadAgentTypes`, `findAgentType` — sub-agent type definitions |
 | `@nexrall/code-core/tools` | `executeTool` — built-in tool executor (bash, file I/O, search…) |
 | `@nexrall/code-core/symbols` | `getSymbols`, `getWorkspaceSymbols` — regex-based LSP-lite scanner |
 | `@nexrall/code-core/checkpoint` | `CheckpointManager` — persistent rewind / rollback |
@@ -33,7 +34,7 @@ const messages = [
 ];
 
 const opts: AgentLoopOptions = {
-  model: 'turbo',          // 'turbo' (Sonnet) | 'pro' (Opus) | 'ultra' (Fable 5)
+  model: 'claude-sonnet-5-5',   // any catalogue model id; the tier aliases still work
   workDir: process.cwd(),
   env: { platform: 'node', cwd: process.cwd(), shell: 'bash' },
   clientType: 'cli',
@@ -53,13 +54,13 @@ const history = await runAgentLoop(messages, opts);
 console.log('Done —', history.length, 'messages');
 ```
 
-> **Requires authentication.** The agent streams through the Nexrall API — users must be logged in via `nexrall-code login` (or set `NEXRALL_TOKEN` env var).
+> **Requires authentication.** The agent streams through the Nexrall API — users must be logged in via `nex auth` (or set the `NEXRALL_TOKEN` env var).
 
 ## Agent loop options
 
 ```ts
 interface AgentLoopOptions {
-  model: 'turbo' | 'pro' | 'ultra';
+  model?: string;                // e.g. 'claude-sonnet-5-5', 'gpt-6-astra', 'deepseek-flash'
   workDir: string;
   env: EnvContext;
   clientType?: 'cli' | 'vscode';

package/dist/agent/askOnce.d.ts

@@ -7,6 +7,16 @@ export interface AskOnceOptions {
     abortSignal?: {
         aborted: boolean;
     };
+    /**
+     * S20: the server-reported usage (and cost, when it sent one) of this call.
+     * Optional and additive — the auto-mode classifier uses it to enforce its
+     * per-session budget; every existing caller ignores it.
+     */
+    onUsage?: (u: {
+        input_tokens?: number;
+        output_tokens?: number;
+        cost?: number;
+    }) => void;
 }
 export declare function askModelOnce(prompt: string, opts: AskOnceOptions): Promise<string | null>;
 //# sourceMappingURL=askOnce.d.ts.map

package/dist/agent/askOnce.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"askOnce.d.ts","sourceRoot":"","sources":["../../src/agent/askOnce.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAgB,UAAU,EAAW,MAAM,UAAU,CAAC;AAKlE,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;CACpC;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAwC/F"}
+{"version":3,"file":"askOnce.d.ts","sourceRoot":"","sources":["../../src/agent/askOnce.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAgB,UAAU,EAAW,MAAM,UAAU,CAAC;AAKlE,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IACnC;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CACzF;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgD/F"}

package/dist/agent/askOnce.js

@@ -28,8 +28,16 @@ async function askModelOnce(prompt, opts) {
             env: opts.env ?? { cwd: opts.cwd },
             abortSignal: ctl,
             toolAllowlist: [NO_TOOLS_MARKER],
-        }, () => {
-            /* the final message carries the text */
+        }, (e) => {
+            // The final message carries the text; this tap only forwards usage.
+            if (opts.onUsage && e && e.type === 'usage') {
+                const ev = e;
+                opts.onUsage({
+                    input_tokens: ev.usage?.input_tokens,
+                    output_tokens: ev.usage?.output_tokens,
+                    ...(typeof ev.cost === 'number' ? { cost: ev.cost } : {}),
+                });
+            }
         });
         const blocks = Array.isArray(msg.content) ? msg.content : [];
         const text = blocks

package/dist/agent/planMode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"planMode.d.ts","sourceRoot":"","sources":["../../src/agent/planMode.ts"],"names":[],"mappings":"AAwOA,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,MAAM,EAAE,eAAe,GAAG,oBAAoB,CAAC;IAC/C,gFAAgF;IAChF,OAAO,EAAE,MAAM,CAAC;CACjB;AAuKD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CA8D1D;AAQD;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAU3D;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,eAAe,GAAG,IAAI,CAoClG;AAED,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,QAqBvB,CAAC"}
+{"version":3,"file":"planMode.d.ts","sourceRoot":"","sources":["../../src/agent/planMode.ts"],"names":[],"mappings":"AAqPA,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,MAAM,EAAE,eAAe,GAAG,oBAAoB,CAAC;IAC/C,gFAAgF;IAChF,OAAO,EAAE,MAAM,CAAC;CACjB;AAuKD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAgE1D;AAQD;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAU3D;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,eAAe,GAAG,IAAI,CAoClG;AAED,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,QAqBvB,CAAC"}

package/dist/agent/planMode.js

@@ -163,6 +163,10 @@ const SYSTEM_BIN_DIRS = new Set(['/bin', '/usr/bin', '/usr/local/bin', '/sbin',
  */
 const UNSAFE_ENV = /^(PATH|HOME|SHELL|IFS|ENV|BASH_ENV|PAGER|MANPAGER|EDITOR|VISUAL|BROWSER|LD_\w*|DYLD_\w*|GIT_\w*|NODE_\w*|NPM_\w*|npm_\w*|PYTHON\w*|BASH\w*|RUBY\w*|PERL\w*|LESS\w*|XDG_\w*|\w*OPTS?)=/i;
 const GH_NOUNS = new Set(['pr', 'issue', 'run', 'repo', 'release', 'workflow', 'gist', 'label']);
+/** glab's resource nouns — the guard against `glab api <verb>` (arbitrary HTTP), same as gh. */
+const GLAB_NOUNS = new Set(['mr', 'issue', 'ci', 'repo', 'release', 'pipeline', 'job', 'variable', 'snippet']);
+/** Which tools need a noun guard on their nested form (see the nested branch below). */
+const NESTED_NOUNS = { gh: GH_NOUNS, glab: GLAB_NOUNS };
 /**
  * Subcommands that are read-only for tools whose safety depends on the verb.
  *
@@ -208,10 +212,17 @@ const READ_ONLY_SUBCOMMANDS = {
     // gh: read verbs only. `gh run rerun`, `gh pr merge` etc. are excluded, and
     // the nested-verb check in isReadOnlyCommand handles `gh pr view` vs `gh pr merge`.
     gh: new Set(['browse']),
+    // glab: everything read-only lives in the nested form (`glab mr view`), so the
+    // top-level set is empty and bare `glab` (help) is the only direct read.
+    glab: new Set([]),
 };
 /** Second-level read verbs for CLIs shaped as `<tool> <noun> <verb>`. */
 const READ_ONLY_NESTED = {
     gh: new Set(['view', 'list', 'status', 'diff', 'checks']),
+    // glab mirrors gh's readable set: `glab mr view/diff`, `glab ci status`. Writes
+    // (`glab mr note`, `merge`, `close`) are absent on purpose — S16b posts a review
+    // comment through the main agent, never through read-only classification.
+    glab: new Set(['view', 'list', 'diff', 'status']),
 };
 /**
  * Shell metacharacters that can smuggle a second command past verb inspection.
@@ -418,9 +429,11 @@ function isReadOnlyCommand(command) {
         if (subs.has(sub))
             return subcommandFlagsOk(verb, sub, words.slice(i + 1));
         const nested = READ_ONLY_NESTED[verb];
-        // `gh api list -X DELETE` has "list" in second position too — the noun must be a
-        // real resource noun, and `api` (arbitrary HTTP verbs) is not one.
-        if (nested && rest[1] && nested.has(rest[1]) && (verb !== 'gh' || GH_NOUNS.has(sub)))
+        // `gh api list -X DELETE` (and `glab api done ...`) has "list"/"diff" in second
+        // position too — the noun must be a real resource noun; `api` (arbitrary HTTP
+        // verbs) is not one. Tools without a noun list behave as before.
+        const nouns = NESTED_NOUNS[verb];
+        if (nested && rest[1] && nested.has(rest[1]) && (!nouns || nouns.has(sub)))
             return true;
         return false;
     }

package/dist/index.d.ts

@@ -32,10 +32,12 @@ export * from './permissions/rules';
 export * from './permissions/modePolicy';
 export * from './permissions/bashClassify';
 export * from './permissions/destructive';
+export * from './permissions/autoMode';
 export * from './plugins/index';
 export * from './plugins/installer';
 export * from './plugins/sources';
 export * from './plugins/data';
+export * from './plugins/eval';
 export * from './agent/trust';
 export * from './agent/crossProcessLock';
 export * from './agent/worktree';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,4BAA4B,CAAC;AAC3C,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,4BAA4B,CAAC;AAC3C,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC"}

package/dist/index.js

@@ -48,10 +48,12 @@ __exportStar(require("./permissions/rules"), exports);
 __exportStar(require("./permissions/modePolicy"), exports);
 __exportStar(require("./permissions/bashClassify"), exports);
 __exportStar(require("./permissions/destructive"), exports);
+__exportStar(require("./permissions/autoMode"), exports);
 __exportStar(require("./plugins/index"), exports);
 __exportStar(require("./plugins/installer"), exports);
 __exportStar(require("./plugins/sources"), exports);
 __exportStar(require("./plugins/data"), exports);
+__exportStar(require("./plugins/eval"), exports);
 __exportStar(require("./agent/trust"), exports);
 __exportStar(require("./agent/crossProcessLock"), exports);
 __exportStar(require("./agent/worktree"), exports);

package/dist/permissions/autoMode.d.ts

@@ -0,0 +1,89 @@
+export interface AutoModeLimitDef {
+    /** Short name shown by `nex auto-mode defaults` and in reports. */
+    label: string;
+    /** The prose the classifier reads. One sentence, concrete. */
+    text: string;
+}
+/**
+ * The built-in hard limits (CC's `$defaults` for `hard_deny`): unconditional —
+ * user intent does NOT clear these. Keep this list SHORT and beyond argument;
+ * it exists for the actions no request should ever authorize.
+ */
+export declare const AUTO_MODE_HARD_DENY_DEFAULTS: readonly AutoModeLimitDef[];
+/**
+ * The built-in soft limits (CC's `$defaults` for `soft_deny`): block UNLESS the
+ * user's own latest message directly and specifically asks for this exact
+ * action, or an allow exception matches.
+ */
+export declare const AUTO_MODE_SOFT_DENY_DEFAULTS: readonly AutoModeLimitDef[];
+/** The `$defaults` sentinel (CC's spelling) inside soft_deny / hard_deny lists. */
+export declare const AUTO_MODE_DEFAULTS_SENTINEL = "$defaults";
+export declare const AUTO_MODE_DEFAULT_MAX_CLASSIFICATIONS = 400;
+export declare const AUTO_MODE_DEFAULT_MAX_BUDGET_USD = 0.25;
+export interface AutoModeConfig {
+    /** Whether the classifier runs in auto mode at all. Default true. */
+    enabled: boolean;
+    /** Model for the review call; undefined = the session model. */
+    classifierModel?: string;
+    /** Prose: trusted infra (repos, buckets, domains, deploy targets). */
+    environment: string[];
+    /** Pre-approved patterns; clear soft blocks (never hard ones). */
+    allow: string[];
+    /** Effective soft limits (tier values + built-ins when $defaults applies). */
+    softDeny: string[];
+    /** Effective hard limits. */
+    hardDeny: string[];
+    /** Suspend EVERY bash allow rule while classifying (CC's flag). Default false. */
+    classifyAllShell: boolean;
+    maxClassifications: number;
+    maxBudgetUsd: number;
+    /** Which file (or '--settings') set which key — for `nex auto-mode config`. */
+    sources: Array<{
+        file: string;
+        keys: string[];
+    }>;
+    /** Project/local settings that tried to set `autoMode`; ignored for safety. */
+    ignoredProjectFiles: string[];
+    /** Non-fatal problems (bad types, unknown keys) — reported, never thrown. */
+    warnings: string[];
+}
+/**
+ * Load the effective auto-mode config.
+ *
+ * Tier order — LOW to HIGH precedence (a higher tier that defines a key wins
+ * WHOLESALE for that key): user < managed < session (`--settings`). Project and
+ * settings.local are read ONLY to report that their `autoMode` is ignored;
+ * they can never contribute a value. That asymmetry is the whole security
+ * model: settings travel with a checkout, and a checkout that could grant
+ * itself trust would make the classifier theatre.
+ */
+export declare function loadAutoModeConfig(workDir: string): AutoModeConfig;
+export interface ClassifyPromptInput {
+    tool: string;
+    input: Record<string, unknown>;
+    workDir: string;
+    /** Workspace extensions from --add-dir (trusted like the project). */
+    extraDirs?: string[];
+    /** Recent user messages, oldest → newest; the LAST is the current instruction. */
+    intent?: string[];
+    cfg: AutoModeConfig;
+}
+/**
+ * The review request. Deliberately one flat prompt — the classifier is a fresh,
+ * tool-less call (askModelOnce), so everything it may consult must be here:
+ * the limits, the environment, the action, and the human's actual words.
+ */
+export declare function classifyPrompt(a: ClassifyPromptInput): string;
+export type AutoModeVerdictAction = 'allow' | 'block-soft' | 'block-hard' | 'unavailable';
+export interface AutoModeVerdict {
+    action: AutoModeVerdictAction;
+    reason?: string;
+}
+/** A local guard failed us (or the host never called in) — see the design doc. */
+export declare const AUTO_MODE_UNAVAILABLE: AutoModeVerdict;
+/**
+ * Parse one line of classifier output. Anything that is not a clear ALLOW is
+ * NOT an allow — a mangled or empty reply fails closed (`unavailable`).
+ */
+export declare function parseClassifierReply(text: string | null | undefined): AutoModeVerdict;
+//# sourceMappingURL=autoMode.d.ts.map

package/dist/permissions/autoMode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"autoMode.d.ts","sourceRoot":"","sources":["../../src/permissions/autoMode.ts"],"names":[],"mappings":"AAmBA,MAAM,WAAW,gBAAgB;IAC/B,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAC;IACd,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,EAAE,SAAS,gBAAgB,EAmBnE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,EAAE,SAAS,gBAAgB,EAiBnE,CAAC;AAEF,mFAAmF;AACnF,eAAO,MAAM,2BAA2B,cAAc,CAAC;AAEvD,eAAO,MAAM,qCAAqC,MAAM,CAAC;AACzD,eAAO,MAAM,gCAAgC,OAAO,CAAC;AAErD,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,gEAAgE;IAChE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,kEAAkE;IAClE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,kFAAkF;IAClF,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACjD,+EAA+E;IAC/E,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAgED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CAqFlE;AASD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,GAAG,EAAE,cAAc,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,mBAAmB,GAAG,MAAM,CA4C7D;AAED,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,YAAY,GAAG,YAAY,GAAG,aAAa,CAAC;AAE1F,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,qBAAqB,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,kFAAkF;AAClF,eAAO,MAAM,qBAAqB,EAAE,eAGnC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,eAAe,CAcrF"}

package/dist/permissions/autoMode.js

@@ -0,0 +1,346 @@
+"use strict";
+// S20 — auto-mode config + the classifier's prompt/parse (see the design doc
+// nexrall/docs/AUTO_MODE_CLASSIFIER.md).
+//
+// The pure half: where `autoMode` settings may come from (user + managed +
+// --settings ONLY — never project/local, so a cloned repo cannot loosen the
+// gate), how tiers merge, the built-in prose limits, the classifier prompt and
+// the reply parser. The model CALL and the runtime (cache, budget, fast paths)
+// live in the hosts — cli/src/permissions/autoClassify.ts for the CLI.
+//
+// The lists below are PROSE FOR A JUDGE, not regexes: they say what the
+// classifier must protect, in the same words a human would, because the check
+// is a model call and not another denylist (the destructive-token guard is
+// that — and it stays the code-level floor, unchanged, underneath this).
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTO_MODE_UNAVAILABLE = exports.AUTO_MODE_DEFAULT_MAX_BUDGET_USD = exports.AUTO_MODE_DEFAULT_MAX_CLASSIFICATIONS = exports.AUTO_MODE_DEFAULTS_SENTINEL = exports.AUTO_MODE_SOFT_DENY_DEFAULTS = exports.AUTO_MODE_HARD_DENY_DEFAULTS = void 0;
+exports.loadAutoModeConfig = loadAutoModeConfig;
+exports.classifyPrompt = classifyPrompt;
+exports.parseClassifierReply = parseClassifierReply;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const rules_1 = require("./rules");
+/**
+ * The built-in hard limits (CC's `$defaults` for `hard_deny`): unconditional —
+ * user intent does NOT clear these. Keep this list SHORT and beyond argument;
+ * it exists for the actions no request should ever authorize.
+ */
+exports.AUTO_MODE_HARD_DENY_DEFAULTS = [
+    {
+        label: 'Data exfiltration',
+        text: 'Sending file contents, repository contents, environment variables, credentials or tokens to any network ' +
+            'destination the user has not explicitly named (e.g. curl/wget with a body built from local files or env).',
+    },
+    {
+        label: 'Credential and system files',
+        text: 'Writing to or modifying security-sensitive locations outside the project: ~/.ssh, ~/.aws, ~/.config/gh, ' +
+            '~/.netrc, ~/.npmrc credential entries, shell rc files (.zshrc/.bashrc), /etc, or the OS keychain.',
+    },
+    {
+        label: 'Safety-system tampering',
+        text: "Disabling or weakening this session's own safety controls: editing permission rules or autoMode settings to " +
+            'grant more access, clearing audit trails, or killing the permission gate.',
+    },
+];
+/**
+ * The built-in soft limits (CC's `$defaults` for `soft_deny`): block UNLESS the
+ * user's own latest message directly and specifically asks for this exact
+ * action, or an allow exception matches.
+ */
+exports.AUTO_MODE_SOFT_DENY_DEFAULTS = [
+    {
+        label: 'Git history rewrite',
+        text: 'Rewriting shared history: git push --force/--force-with-lease to a shared branch, or reset --hard that ' +
+            'discards committed work.',
+    },
+    {
+        label: 'Database and infra destruction',
+        text: 'Destructive database or infrastructure operations against shared or production systems: DROP/DELETE/TRUNCATE ' +
+            'on non-scratch data, terraform destroy, kubectl delete of shared resources, deleting cloud buckets.',
+    },
+    {
+        label: 'Mass deletion outside scratch space',
+        text: 'Deleting many files or whole directories outside the project workspace and scratch/temp locations.',
+    },
+];
+/** The `$defaults` sentinel (CC's spelling) inside soft_deny / hard_deny lists. */
+exports.AUTO_MODE_DEFAULTS_SENTINEL = '$defaults';
+exports.AUTO_MODE_DEFAULT_MAX_CLASSIFICATIONS = 400;
+exports.AUTO_MODE_DEFAULT_MAX_BUDGET_USD = 0.25;
+function readTier(file) {
+    try {
+        const obj = JSON.parse(fs.readFileSync(file, 'utf-8'));
+        const am = obj?.autoMode;
+        return am && typeof am === 'object' && !Array.isArray(am) ? am : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Accept CC's snake_case spellings and our camelCase ones. */
+function pickKey(am, ...names) {
+    for (const n of names) {
+        if (Object.prototype.hasOwnProperty.call(am, n))
+            return { key: n, value: am[n] };
+    }
+    return null;
+}
+function asProseList(value, key, warnings) {
+    if (!Array.isArray(value)) {
+        warnings.push(`autoMode.${key} must be an array of strings — ignored`);
+        return null;
+    }
+    return value
+        .filter((v) => typeof v === 'string')
+        .map((v) => v.trim())
+        .filter(Boolean);
+}
+function asBool(value, key, warnings) {
+    if (typeof value === 'boolean')
+        return value;
+    if (value === 'true')
+        return true;
+    if (value === 'false')
+        return false;
+    warnings.push(`autoMode.${key} must be true or false — ignored`);
+    return null;
+}
+function asPositiveNumber(value, key, warnings) {
+    const n = typeof value === 'number' ? value : Number(value);
+    if (!Number.isFinite(n) || n < 0) {
+        warnings.push(`autoMode.${key} must be a non-negative number — ignored`);
+        return null;
+    }
+    return n;
+}
+/** Expand `$defaults` in a list, or supply defaults when the key was never set. */
+function expandDefaults(list, defaults) {
+    if (list === null)
+        return defaults.map((d) => `[${d.label}] ${d.text}`);
+    const out = [];
+    for (const item of list) {
+        if (item === exports.AUTO_MODE_DEFAULTS_SENTINEL)
+            out.push(...defaults.map((d) => `[${d.label}] ${d.text}`));
+        else
+            out.push(item);
+    }
+    return out;
+}
+/**
+ * Load the effective auto-mode config.
+ *
+ * Tier order — LOW to HIGH precedence (a higher tier that defines a key wins
+ * WHOLESALE for that key): user < managed < session (`--settings`). Project and
+ * settings.local are read ONLY to report that their `autoMode` is ignored;
+ * they can never contribute a value. That asymmetry is the whole security
+ * model: settings travel with a checkout, and a checkout that could grant
+ * itself trust would make the classifier theatre.
+ */
+function loadAutoModeConfig(workDir) {
+    const warnings = [];
+    const sources = [];
+    const ignoredProjectFiles = [];
+    const userFile = path.join(os.homedir(), '.nexrall', 'settings.json');
+    const managedFile = (0, rules_1.managedSettingsPath)();
+    const tiers = [
+        { file: userFile, autoMode: readTier(userFile) },
+        { file: managedFile, autoMode: readTier(managedFile) },
+        { file: '--settings', autoMode: (0, rules_1.getSessionSettings)()?.autoMode ?? null },
+    ];
+    // A non-object there (e.g. the string "off") is still an attempt we must not
+    // swallow silently.
+    for (const cand of [
+        path.join(workDir, '.nexrall', 'settings.json'),
+        path.join(workDir, '.nexrall', 'settings.local.json'),
+    ]) {
+        try {
+            const obj = JSON.parse(fs.readFileSync(cand, 'utf-8'));
+            if (obj && Object.prototype.hasOwnProperty.call(obj, 'autoMode'))
+                ignoredProjectFiles.push(cand);
+        }
+        catch {
+            /* no file / unreadable — nothing ignored */
+        }
+    }
+    // Per-key merge, low → high.
+    let enabled = null;
+    let classifierModel;
+    let environment = null;
+    let allow = null;
+    let softList = null;
+    let hardList = null;
+    let classifyAllShell = null;
+    let maxClassifications = null;
+    let maxBudgetUsd = null;
+    for (const tier of tiers) {
+        if (!tier.autoMode)
+            continue;
+        const am = tier.autoMode;
+        const keys = [];
+        const take = (r, key) => {
+            if (r !== null && r !== undefined)
+                keys.push(key);
+            return r;
+        };
+        const en = pickKey(am, 'classifier', 'enabled');
+        if (en)
+            enabled = take(asBool(en.value, 'classifier', warnings) ?? enabled, en.key);
+        const cm = pickKey(am, 'classifierModel', 'classifier_model');
+        if (cm && typeof cm.value === 'string' && cm.value.trim()) {
+            classifierModel = cm.value.trim();
+            keys.push(cm.key);
+        }
+        const env = pickKey(am, 'environment');
+        if (env)
+            environment = take(asProseList(env.value, 'environment', warnings) ?? environment, 'environment');
+        const al = pickKey(am, 'allow');
+        if (al)
+            allow = take(asProseList(al.value, 'allow', warnings) ?? allow, 'allow');
+        const sd = pickKey(am, 'soft_deny', 'softDeny');
+        if (sd)
+            softList = take(asProseList(sd.value, sd.key, warnings) ?? softList, sd.key);
+        const hd = pickKey(am, 'hard_deny', 'hardDeny');
+        if (hd)
+            hardList = take(asProseList(hd.value, hd.key, warnings) ?? hardList, hd.key);
+        const ca = pickKey(am, 'classifyAllShell', 'classify_all_shell');
+        if (ca)
+            classifyAllShell = take(asBool(ca.value, ca.key, warnings) ?? classifyAllShell, ca.key);
+        const mc = pickKey(am, 'maxClassifications', 'max_classifications');
+        if (mc)
+            maxClassifications = take(asPositiveNumber(mc.value, mc.key, warnings) ?? maxClassifications, mc.key);
+        const mb = pickKey(am, 'maxBudgetUsd', 'max_budget_usd');
+        if (mb)
+            maxBudgetUsd = take(asPositiveNumber(mb.value, mb.key, warnings) ?? maxBudgetUsd, mb.key);
+        if (keys.length)
+            sources.push({ file: tier.file, keys });
+    }
+    return {
+        enabled: enabled ?? true,
+        ...(classifierModel ? { classifierModel } : {}),
+        environment: environment ?? [],
+        allow: allow ?? [],
+        softDeny: expandDefaults(softList, exports.AUTO_MODE_SOFT_DENY_DEFAULTS),
+        hardDeny: expandDefaults(hardList, exports.AUTO_MODE_HARD_DENY_DEFAULTS),
+        classifyAllShell: classifyAllShell ?? false,
+        maxClassifications: maxClassifications ?? exports.AUTO_MODE_DEFAULT_MAX_CLASSIFICATIONS,
+        maxBudgetUsd: maxBudgetUsd ?? exports.AUTO_MODE_DEFAULT_MAX_BUDGET_USD,
+        sources,
+        ignoredProjectFiles,
+        warnings,
+    };
+}
+// ─── The classifier's prompt + reply ─────────────────────────────────────────
+/** Clip helper local to this module (the prompt must never grow unbounded). */
+function clip(text, max) {
+    return text.length > max ? text.slice(0, max - 1) + '\u2026' : text;
+}
+/**
+ * The review request. Deliberately one flat prompt — the classifier is a fresh,
+ * tool-less call (askModelOnce), so everything it may consult must be here:
+ * the limits, the environment, the action, and the human's actual words.
+ */
+function classifyPrompt(a) {
+    const list = (items) => (items.length ? items.map((t) => `- ${t}`).join('\n') : '  (none)');
+    const env = [
+        `The project directory ${a.workDir}${a.extraDirs?.length ? ` and the added directories ${a.extraDirs.join(', ')}` : ''}`,
+        "the current git repository's own configured remotes",
+        ...a.cfg.environment,
+    ];
+    const intent = a.intent?.length
+        ? a.intent.map((t, i) => `[${i + 1}] ${clip(t.replace(/\s+/g, ' ').trim(), 300)}`).join('\n')
+        : '  (none)';
+    let action;
+    try {
+        action = clip(JSON.stringify(a.input), 2000);
+    }
+    catch {
+        action = '(unserializable input)';
+    }
+    return ('You are the AUTO-MODE SAFETY CLASSIFIER for a coding agent.\n' +
+        'The agent runs in "auto" mode: it will execute the action below WITHOUT asking the human, unless you block it.\n' +
+        "Judge the ACTION's real-world effect, not its wording.\n\n" +
+        'HARD LIMITS — block unconditionally, even if the user asked:\n' +
+        list(a.cfg.hardDeny) +
+        "\n\nSOFT LIMITS — block UNLESS the user's latest message directly and specifically asks for this exact action, " +
+        'or an ALLOW EXCEPTION matches:\n' +
+        list(a.cfg.softDeny) +
+        '\n\nALLOW EXCEPTIONS (pre-approved by the user; clear SOFT limits, never hard ones):\n' +
+        list(a.cfg.allow) +
+        '\n\nTRUSTED ENVIRONMENT (routine here; staying inside it is not a limit violation):\n' +
+        list(env) +
+        '\n\nTHE ACTION:\ntool: ' +
+        a.tool +
+        '\ninput: ' +
+        action +
+        '\n\nRECENT USER MESSAGES (intent; the LAST one is the current instruction):\n' +
+        intent +
+        '\n\nReply with EXACTLY ONE line, one of:\n' +
+        'ALLOW\n' +
+        'BLOCK: <one short reason>\n' +
+        'BLOCK-HARD: <one short reason>\n' +
+        'Use BLOCK only for a soft limit without clear user intent, BLOCK-HARD for a hard limit. ' +
+        'For a routine, reversible action inside the workspace, reply ALLOW. No other text.');
+}
+/** A local guard failed us (or the host never called in) — see the design doc. */
+exports.AUTO_MODE_UNAVAILABLE = {
+    action: 'unavailable',
+    reason: 'classifier could not review the action',
+};
+/**
+ * Parse one line of classifier output. Anything that is not a clear ALLOW is
+ * NOT an allow — a mangled or empty reply fails closed (`unavailable`).
+ */
+function parseClassifierReply(text) {
+    if (typeof text !== 'string')
+        return { ...exports.AUTO_MODE_UNAVAILABLE, reason: 'no reply from the classifier' };
+    const first = text
+        .split('\n')
+        .find((l) => l.trim().length > 0)
+        ?.trim() ?? '';
+    if (!first)
+        return { ...exports.AUTO_MODE_UNAVAILABLE, reason: 'empty reply from the classifier' };
+    const hard = /^BLOCK[\s_-]*HARD\b[:\s-]*(.*)$/i.exec(first);
+    if (hard)
+        return { action: 'block-hard', reason: hard[1].trim() || 'hard limit' };
+    const soft = /^BLOCK\b[:\s-]*(.*)$/i.exec(first);
+    if (soft)
+        return { action: 'block-soft', reason: soft[1].trim() || 'soft limit' };
+    if (/^ALLOW\b/i.test(first))
+        return { action: 'allow' };
+    return { ...exports.AUTO_MODE_UNAVAILABLE, reason: `unrecognized classifier reply: ${clip(first, 80)}` };
+}
+//# sourceMappingURL=autoMode.js.map

package/dist/permissions/rules.d.ts

@@ -9,11 +9,17 @@ export interface MergedSettings {
     /** Raw merged object (for hooks, allowedTools, etc.). */
     raw: Record<string, unknown>;
 }
+export declare function managedSettingsPath(): string;
 /** Replace the rules supplied for this process by flags. Not persisted anywhere. */
 export declare function setSessionRules(r: Partial<PermissionRules>): void;
 export declare function setSessionSettings(obj: Record<string, unknown> | null): void;
 export declare function getSessionSettings(): Record<string, unknown> | null;
 export declare function loadSettings(workDir: string): MergedSettings;
+/** The first ALLOW rule that matches this call, or null. S20's classifier gate
+ * reads this to tell a NARROW pre-approval (wins, no review) from a BROAD one
+ * (suspended while the classifier is on — see isBroadAllowRule). */
+export declare function matchedAllowRule(rules: PermissionRules, tool: string, input: Record<string, unknown>, workDir: string): string | null;
+export declare function isBroadAllowRule(rule: string): boolean;
 /**
  * Evaluate a tool call against merged rules. Returns the matching decision, or
  * null when no rule applies (caller decides the default, usually "ask").

package/dist/permissions/rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/permissions/rules.ts"],"names":[],"mappings":"AAwBA,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,eAAe,CAAC;IAC7B,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B;AA6BD,oFAAoF;AACpF,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,IAAI,CAEjE;AAQD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,CAE5E;AACD,wBAAgB,kBAAkB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAEnE;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CA8B5D;AAqJD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,EAAE,MAAM,GACd,kBAAkB,GAAG,IAAI,CAK3B"}
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/permissions/rules.ts"],"names":[],"mappings":"AAwBA,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,eAAe,CAAC;IAC7B,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B;AAED,wBAAgB,mBAAmB,IAAI,MAAM,CAQ5C;AAsBD,oFAAoF;AACpF,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,IAAI,CAEjE;AAQD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,CAE5E;AACD,wBAAgB,kBAAkB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAEnE;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CA8B5D;AAqJD;;oEAEoE;AACpE,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,EAAE,MAAM,GACd,MAAM,GAAG,IAAI,CAEf;AAYD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAOtD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,EAAE,MAAM,GACd,kBAAkB,GAAG,IAAI,CAK3B"}