@pentoshi/clai 3.0.0 → 3.6.0

package/dist/tools/nmap-runner.js

@@ -1,7 +1,7 @@
 import { platform } from "node:os";
 import { commandAvailable } from "../os/pkgmgr.js";
 import { spawnArgv } from "./shell.js";
-import { nmapScanNeedsPrivilege, toConnectScanArgv } from "./validate.js";
+import { isNmapSingleHostTarget, looksLikeNmapNoHostsUp, nmapArgvHasPn, nmapScanNeedsPrivilege, toConnectScanArgv, withNmapSkipDiscovery, } from "./validate.js";
 /**
  * Pick the OS-appropriate privilege-escalation prefix for a raw-socket scan.
  *   - macOS / Linux  → `sudo` (clai forwards stdin so the user types their
@@ -36,24 +36,33 @@ async function elevationPrefix() {
 function looksLikePrivilegeError(output) {
     return /(?:requires root privileges|you (?:requested|need) (?:a scan type|root)|operation not permitted|must (?:be|run as) root|raw sockets?|sudo: (?:a (?:password|terminal) is required|no askpass|3 incorrect)|incorrect password|authentication failure|permission denied|requires (?:administrator|elevation))/i.test(output);
 }
+function canInteractiveSudo() {
+    return Boolean(process.stdin.isTTY);
+}
 /**
  * Run an nmap scan, transparently obtaining the privileges a stealth/raw
  * scan needs and falling back to an unprivileged TCP connect scan when those
  * privileges can't be obtained (no sudo, password declined, etc.).
  *
  * Strategy:
- *   1. If the scan needs raw sockets and we're not root, wrap it in the
- *      OS-appropriate elevation helper (sudo / doas / gsudo). stdin is
- *      inherited so the user can type their password live — exactly the
- *      pattern documented for shell.exec sudo.
- *   2. If elevation is unavailable, or the privileged attempt fails in a way
+ *   1. Single-host port scans get -Pn so failed host-discovery pings do not
+ *      report "0 hosts up" while ports are actually open.
+ *   2. If the scan needs raw sockets and we're not root, wrap it in the
+ *      OS-appropriate elevation helper (sudo / doas / gsudo). Prefer the
+ *      secure requestSecret path (TUI); else interactive TTY sudo.
+ *   3. If elevation is unavailable, or the privileged attempt fails in a way
  *      that looks like a permission/privilege error, retry as `-sT` (TCP
  *      connect) which works for any user on every OS.
- * This is the "most general approach first, then fall back" behavior the
- * scans need so they never dead-end on "you must be root".
+ *   4. If a run still looks like "host down / 0 hosts up" without -Pn, retry
+ *      once with -Pn before returning.
  */
 export async function runNmapScan(argv, options) {
-    const needsPrivilege = nmapScanNeedsPrivilege(argv);
+    // Known single hosts: skip discovery by default (ICMP/ARP often blocked or
+    // needs root; false "0 hosts up" is a common agent failure mode).
+    let scanArgv = isNmapSingleHostTarget(argv) && !nmapArgvHasPn(argv)
+        ? withNmapSkipDiscovery(argv)
+        : [...argv];
+    const needsPrivilege = nmapScanNeedsPrivilege(scanArgv);
     const prefix = needsPrivilege ? await elevationPrefix() : undefined;
     const attempts = [];
     if (needsPrivilege && prefix) {
@@ -61,74 +70,95 @@ export async function runNmapScan(argv, options) {
             // Authenticate in a short, dedicated process. In the TUI, never inherit
             // stdin for the long nmap scan: pipe the already-entered password to
             // sudo so Ink keeps receiving Escape/Ctrl+C while nmap is running.
-            options?.onOutput?.(options?.requestSecret
-                ? "\nAdministrator access is required for a stealth scan. Complete the secure password prompt below.\n"
-                : "\nAdministrator access is required for a stealth scan. Enter your sudo password below; Ctrl+C cancels.\n", "stdout");
-            let auth;
-            let sudoPassword;
-            if (options?.requestSecret) {
-                const password = await options.requestSecret({
-                    title: "Administrator access",
-                    prompt: "Enter your macOS password for sudo. It is sent only to sudo and is never stored.",
-                });
-                if (password === undefined) {
-                    return { ok: false, output: "Administrator authentication cancelled.", exitCode: 130 };
-                }
-                sudoPassword = password;
-                auth = await spawnArgv({
-                    command: "sudo",
-                    argv: ["-S", "-p", "", "-v"],
-                    stdinText: `${password}\n`,
-                    timeoutMs: 30_000,
-                    signal: options.signal,
-                    onOutput: options.onOutput,
-                    noArtifact: true,
-                    interactiveStdin: false,
-                });
-            }
-            else {
-                // Classic REPL: let sudo read directly from its controlling terminal.
-                auth = await spawnArgv({
-                    command: "sudo",
-                    argv: [...prefix.argv, "-v"],
-                    timeoutMs: 120_000,
-                    signal: options?.signal,
-                    onOutput: options?.onOutput,
-                    interactiveStdin: true,
-                    noArtifact: true,
-                });
-            }
-            if (options?.signal?.aborted || auth.exitCode === 130)
-                return auth;
-            if (auth.ok) {
-                attempts.push({
-                    command: "sudo",
-                    argv: options?.requestSecret ? ["-S", "-p", "", "nmap", ...argv] : ["-n", "nmap", ...argv],
-                    stdinText: options?.requestSecret ? `${sudoPassword ?? ""}\n` : undefined,
-                    note: "Administrator access confirmed. Starting stealth scan (ESC cancels).",
-                });
+            const useSecret = Boolean(options?.requestSecret);
+            const useTty = !useSecret && canInteractiveSudo();
+            if (!useSecret && !useTty) {
+                // No password UI and no TTY — interactive sudo would hang or fail
+                // with "a terminal is required". Skip straight to connect-scan.
+                options?.onOutput?.("\nCannot prompt for sudo password here (no secret UI / no TTY). Using an unprivileged TCP connect scan (-sT -Pn).\n", "stderr");
             }
             else {
-                options?.onOutput?.("\nSudo authentication was not completed; using an unprivileged TCP connect scan instead.\n", "stderr");
+                options?.onOutput?.(useSecret
+                    ? "\nAdministrator access is required for a stealth scan. Complete the secure password prompt below.\n"
+                    : "\nAdministrator access is required for a stealth scan. Enter your sudo password below; Ctrl+C cancels.\n", "stdout");
+                let auth;
+                let sudoPassword;
+                if (useSecret && options?.requestSecret) {
+                    const password = await options.requestSecret({
+                        title: "Administrator access",
+                        prompt: "Enter your password for sudo (nmap raw-socket scan). It is sent only to sudo and is never stored.",
+                    });
+                    if (password === undefined) {
+                        return {
+                            ok: false,
+                            output: "Administrator authentication cancelled. Re-run and enter your password, or use profile.scanType \"tcp\" for an unprivileged connect scan.",
+                            exitCode: 130,
+                        };
+                    }
+                    sudoPassword = password;
+                    auth = await spawnArgv({
+                        command: "sudo",
+                        argv: ["-S", "-p", "", "-v"],
+                        stdinText: `${password}\n`,
+                        timeoutMs: 30_000,
+                        signal: options.signal,
+                        onOutput: options.onOutput,
+                        noArtifact: true,
+                        interactiveStdin: false,
+                    });
+                }
+                else {
+                    // Classic REPL: let sudo read directly from its controlling terminal.
+                    auth = await spawnArgv({
+                        command: "sudo",
+                        argv: [...prefix.argv, "-v"],
+                        timeoutMs: 120_000,
+                        signal: options?.signal,
+                        onOutput: options?.onOutput,
+                        interactiveStdin: true,
+                        noArtifact: true,
+                    });
+                }
+                if (options?.signal?.aborted || auth.exitCode === 130)
+                    return auth;
+                if (auth.ok) {
+                    attempts.push({
+                        command: "sudo",
+                        // -n after a successful -v uses the cached credential without
+                        // another password prompt (and without needing another stdin).
+                        argv: useSecret
+                            ? ["-S", "-p", "", "nmap", ...scanArgv]
+                            : ["-n", "nmap", ...scanArgv],
+                        stdinText: useSecret ? `${sudoPassword ?? ""}\n` : undefined,
+                        note: "Administrator access confirmed. Starting stealth scan (ESC cancels).",
+                    });
+                }
+                else {
+                    const detail = auth.output?.trim()
+                        ? `\n${auth.output.trim().slice(0, 400)}`
+                        : "";
+                    options?.onOutput?.(`\nSudo authentication failed or was not completed; using an unprivileged TCP connect scan instead.${detail}\n`, "stderr");
+                }
             }
         }
         else if (prefix.command) {
             attempts.push({
                 command: prefix.command,
-                argv: [...prefix.argv, "nmap", ...argv],
+                argv: [...prefix.argv, "nmap", ...scanArgv],
                 interactiveStdin: true,
                 note: `Running a stealth scan with ${prefix.command} (you may be prompted for your password).`,
             });
         }
         else {
             // Already root.
-            attempts.push({ command: "nmap", argv });
+            attempts.push({ command: "nmap", argv: scanArgv });
         }
         // Fallback: unprivileged connect scan if elevation fails/declines.
+        const connectArgv = withNmapSkipDiscovery(toConnectScanArgv(scanArgv));
         attempts.push({
             command: "nmap",
-            argv: toConnectScanArgv(argv),
-            note: "Privileged scan unavailable — falling back to an unprivileged TCP connect scan (-sT).",
+            argv: connectArgv,
+            note: "Privileged scan unavailable — falling back to an unprivileged TCP connect scan (-sT -Pn).",
         });
     }
     else if (needsPrivilege && !prefix) {
@@ -136,14 +166,14 @@ export async function runNmapScan(argv, options) {
         // but tell the user why the stealth scan was downgraded.
         attempts.push({
             command: "nmap",
-            argv: toConnectScanArgv(argv),
+            argv: withNmapSkipDiscovery(toConnectScanArgv(scanArgv)),
             note: platform() === "win32"
-                ? "No elevation helper found (sudo/gsudo). Run from an Administrator terminal with Npcap for a SYN scan; using a TCP connect scan (-sT) for now."
-                : "No sudo/doas available for a raw-socket SYN scan — using an unprivileged TCP connect scan (-sT) instead.",
+                ? "No elevation helper found (sudo/gsudo). Run from an Administrator terminal with Npcap for a SYN scan; using a TCP connect scan (-sT -Pn) for now."
+                : "No sudo/doas available for a raw-socket SYN scan — using an unprivileged TCP connect scan (-sT -Pn) instead.",
         });
     }
     else {
-        attempts.push({ command: "nmap", argv });
+        attempts.push({ command: "nmap", argv: scanArgv });
     }
     let last;
     for (let i = 0; i < attempts.length; i += 1) {
@@ -153,7 +183,7 @@ export async function runNmapScan(argv, options) {
         }
         if (attempt.note)
             options?.onOutput?.(`\n${attempt.note}\n`, "stdout");
-        const result = await spawnArgv({
+        let result = await spawnArgv({
             command: attempt.command,
             argv: attempt.argv,
             stdinText: attempt.stdinText,
@@ -164,10 +194,41 @@ export async function runNmapScan(argv, options) {
                 ? { interactiveStdin: attempt.interactiveStdin }
                 : {}),
         });
+        // Host discovery false negative: retry once with -Pn on the same elevation.
+        if (result.ok &&
+            looksLikeNmapNoHostsUp(result.output) &&
+            !nmapArgvHasPn(attempt.argv) &&
+            isNmapSingleHostTarget(attempt.argv)) {
+            options?.onOutput?.("\nHost discovery reported no hosts up — retrying once with -Pn (treat host as online).\n", "stdout");
+            result = await spawnArgv({
+                command: attempt.command,
+                argv: withNmapSkipDiscovery(attempt.argv),
+                stdinText: attempt.stdinText,
+                timeoutMs: 300_000,
+                signal: options?.signal,
+                onOutput: options?.onOutput,
+                ...(attempt.interactiveStdin !== undefined
+                    ? { interactiveStdin: attempt.interactiveStdin }
+                    : {}),
+            });
+        }
         last = result;
         // Success, or a non-privilege failure we shouldn't paper over → return.
         const isLastAttempt = i === attempts.length - 1;
         if (result.ok || isLastAttempt || !looksLikePrivilegeError(result.output)) {
+            // Annotate empty single-host results so the model does not loop forever.
+            if (result.ok &&
+                looksLikeNmapNoHostsUp(result.output) &&
+                isNmapSingleHostTarget(attempt.argv)) {
+                return {
+                    ...result,
+                    output: result.output +
+                        "\n\nNote: nmap still reported no live host/open ports after -Pn. " +
+                        "The target may be offline, firewalled, or blocking this host. " +
+                        "Do not retry the same net.scan args in a loop — try different ports, " +
+                        "confirm the IP with net.context / net.pingSweep, or use shell.exec for a custom nmap line.",
+                };
+            }
             return result;
         }
         // Otherwise loop to the next (fallback) attempt.

package/dist/tools/nmap-runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"nmap-runner.js","sourceRoot":"","sources":["../../src/tools/nmap-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAG1E;;;;;;;;;GASG;AACH,KAAK,UAAU,eAAe;IAG5B,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;QAC7C,oCAAoC;QACpC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC3B,IAAI,MAAM,gBAAgB,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACzE,IAAI,MAAM,gBAAgB,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC3E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,MAAM,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,0EAA0E;QAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,iCAAiC,CAAC,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,MAAM,gBAAgB,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACzE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,iFAAiF;AACjF,SAAS,uBAAuB,CAAC,MAAc;IAC7C,OAAO,8SAA8S,CAAC,IAAI,CACxT,MAAM,CACP,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAc,EACd,OAAwB;IAExB,MAAM,cAAc,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC,MAAM,eAAe,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAEpE,MAAM,QAAQ,GAMT,EAAE,CAAC;IAER,IAAI,cAAc,IAAI,MAAM,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YAC9B,wEAAwE;YACxE,qEAAqE;YACrE,mEAAmE;YACnE,OAAO,EAAE,QAAQ,EAAE,CACjB,OAAO,EAAE,aAAa;gBACpB,CAAC,CAAC,qGAAqG;gBACvG,CAAC,CAAC,0GAA0G,EAC9G,QAAQ,CACT,CAAC;YACF,IAAI,IAAgB,CAAC;YACrB,IAAI,YAAgC,CAAC;YACrC,IAAI,OAAO,EAAE,aAAa,EAAE,CAAC;gBAC3B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC;oBAC3C,KAAK,EAAE,sBAAsB;oBAC7B,MAAM,EAAE,kFAAkF;iBAC3F,CAAC,CAAC;gBACH,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;gBACzF,CAAC;gBACD,YAAY,GAAG,QAAQ,CAAC;gBACxB,IAAI,GAAG,MAAM,SAAS,CAAC;oBACrB,OAAO,EAAE,MAAM;oBACf,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC;oBAC5B,SAAS,EAAE,GAAG,QAAQ,IAAI;oBAC1B,SAAS,EAAE,MAAM;oBACjB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,UAAU,EAAE,IAAI;oBAChB,gBAAgB,EAAE,KAAK;iBACxB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,sEAAsE;gBACtE,IAAI,GAAG,MAAM,SAAS,CAAC;oBACrB,OAAO,EAAE,MAAM;oBACf,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;oBAC5B,SAAS,EAAE,OAAO;oBAClB,MAAM,EAAE,OAAO,EAAE,MAAM;oBACvB,QAAQ,EAAE,OAAO,EAAE,QAAQ;oBAC3B,gBAAgB,EAAE,IAAI;oBACtB,UAAU,EAAE,IAAI;iBACjB,CAAC,CAAC;YACL,CAAC;YACD,IAAI,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YACnE,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;gBACZ,QAAQ,CAAC,IAAI,CAAC;oBACZ,OAAO,EAAE,MAAM;oBACf,IAAI,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;oBAC1F,SAAS,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,YAAY,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS;oBACzE,IAAI,EAAE,sEAAsE;iBAC7E,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,OAAO,EAAE,QAAQ,EAAE,CACjB,4FAA4F,EAC5F,QAAQ,CACT,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;gBACvC,gBAAgB,EAAE,IAAI;gBACtB,IAAI,EAAE,+BAA+B,MAAM,CAAC,OAAO,2CAA2C;aAC/F,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,gBAAgB;YAChB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QACD,mEAAmE;QACnE,QAAQ,CAAC,IAAI,CAAC;YACZ,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC;YAC7B,IAAI,EAAE,uFAAuF;SAC9F,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,cAAc,IAAI,CAAC,MAAM,EAAE,CAAC;QACrC,yEAAyE;QACzE,yDAAyD;QACzD,QAAQ,CAAC,IAAI,CAAC;YACZ,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC;YAC7B,IAAI,EACF,QAAQ,EAAE,KAAK,OAAO;gBACpB,CAAC,CAAC,+IAA+I;gBACjJ,CAAC,CAAC,0GAA0G;SACjH,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,IAA4B,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;QAC7B,IAAI,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;QAClE,CAAC;QACD,IAAI,OAAO,CAAC,IAAI;YAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,OAAO,CAAC,IAAI,IAAI,EAAE,QAAQ,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC;YAC7B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,OAAO,EAAE,MAAM;YACvB,QAAQ,EAAE,OAAO,EAAE,QAAQ;YAC3B,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;gBACxC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE;gBAChD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,IAAI,GAAG,MAAM,CAAC;QACd,wEAAwE;QACxE,MAAM,aAAa,GAAG,CAAC,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,EAAE,IAAI,aAAa,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1E,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,iDAAiD;IACnD,CAAC;IACD,OAAO,IAAI,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AAChF,CAAC"}
+{"version":3,"file":"nmap-runner.js","sourceRoot":"","sources":["../../src/tools/nmap-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,aAAa,EACb,sBAAsB,EACtB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,eAAe,CAAC;AAGvB;;;;;;;;;GASG;AACH,KAAK,UAAU,eAAe;IAG5B,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;QAC7C,oCAAoC;QACpC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC3B,IAAI,MAAM,gBAAgB,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACzE,IAAI,MAAM,gBAAgB,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC3E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,MAAM,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,0EAA0E;QAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,iCAAiC,CAAC,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,MAAM,gBAAgB,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACzE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,iFAAiF;AACjF,SAAS,uBAAuB,CAAC,MAAc;IAC7C,OAAO,8SAA8S,CAAC,IAAI,CACxT,MAAM,CACP,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAc,EACd,OAAwB;IAExB,2EAA2E;IAC3E,kEAAkE;IAClE,IAAI,QAAQ,GACV,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QAClD,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC;QAC7B,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAEhB,MAAM,cAAc,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC,MAAM,eAAe,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAEpE,MAAM,QAAQ,GAMT,EAAE,CAAC;IAER,IAAI,cAAc,IAAI,MAAM,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YAC9B,wEAAwE;YACxE,qEAAqE;YACrE,mEAAmE;YACnE,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,CAAC,SAAS,IAAI,kBAAkB,EAAE,CAAC;YAElD,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC1B,kEAAkE;gBAClE,gEAAgE;gBAChE,OAAO,EAAE,QAAQ,EAAE,CACjB,qHAAqH,EACrH,QAAQ,CACT,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO,EAAE,QAAQ,EAAE,CACjB,SAAS;oBACP,CAAC,CAAC,qGAAqG;oBACvG,CAAC,CAAC,0GAA0G,EAC9G,QAAQ,CACT,CAAC;gBACF,IAAI,IAAgB,CAAC;gBACrB,IAAI,YAAgC,CAAC;gBACrC,IAAI,SAAS,IAAI,OAAO,EAAE,aAAa,EAAE,CAAC;oBACxC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC;wBAC3C,KAAK,EAAE,sBAAsB;wBAC7B,MAAM,EACJ,mGAAmG;qBACtG,CAAC,CAAC;oBACH,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;wBAC3B,OAAO;4BACL,EAAE,EAAE,KAAK;4BACT,MAAM,EACJ,2IAA2I;4BAC7I,QAAQ,EAAE,GAAG;yBACd,CAAC;oBACJ,CAAC;oBACD,YAAY,GAAG,QAAQ,CAAC;oBACxB,IAAI,GAAG,MAAM,SAAS,CAAC;wBACrB,OAAO,EAAE,MAAM;wBACf,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC;wBAC5B,SAAS,EAAE,GAAG,QAAQ,IAAI;wBAC1B,SAAS,EAAE,MAAM;wBACjB,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;wBAC1B,UAAU,EAAE,IAAI;wBAChB,gBAAgB,EAAE,KAAK;qBACxB,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,sEAAsE;oBACtE,IAAI,GAAG,MAAM,SAAS,CAAC;wBACrB,OAAO,EAAE,MAAM;wBACf,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;wBAC5B,SAAS,EAAE,OAAO;wBAClB,MAAM,EAAE,OAAO,EAAE,MAAM;wBACvB,QAAQ,EAAE,OAAO,EAAE,QAAQ;wBAC3B,gBAAgB,EAAE,IAAI;wBACtB,UAAU,EAAE,IAAI;qBACjB,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,GAAG;oBAAE,OAAO,IAAI,CAAC;gBACnE,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;oBACZ,QAAQ,CAAC,IAAI,CAAC;wBACZ,OAAO,EAAE,MAAM;wBACf,8DAA8D;wBAC9D,+DAA+D;wBAC/D,IAAI,EAAE,SAAS;4BACb,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;4BACvC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;wBAC/B,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,YAAY,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS;wBAC5D,IAAI,EAAE,sEAAsE;qBAC7E,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE;wBAChC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;wBACzC,CAAC,CAAC,EAAE,CAAC;oBACP,OAAO,EAAE,QAAQ,EAAE,CACjB,qGAAqG,MAAM,IAAI,EAC/G,QAAQ,CACT,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;gBAC3C,gBAAgB,EAAE,IAAI;gBACtB,IAAI,EAAE,+BAA+B,MAAM,CAAC,OAAO,2CAA2C;aAC/F,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,gBAAgB;YAChB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrD,CAAC;QACD,mEAAmE;QACnE,MAAM,WAAW,GAAG,qBAAqB,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvE,QAAQ,CAAC,IAAI,CAAC;YACZ,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,2FAA2F;SAClG,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,cAAc,IAAI,CAAC,MAAM,EAAE,CAAC;QACrC,yEAAyE;QACzE,yDAAyD;QACzD,QAAQ,CAAC,IAAI,CAAC;YACZ,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,qBAAqB,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACxD,IAAI,EACF,QAAQ,EAAE,KAAK,OAAO;gBACpB,CAAC,CAAC,mJAAmJ;gBACrJ,CAAC,CAAC,8GAA8G;SACrH,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,IAA4B,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;QAC7B,IAAI,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;QAClE,CAAC;QACD,IAAI,OAAO,CAAC,IAAI;YAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,OAAO,CAAC,IAAI,IAAI,EAAE,QAAQ,CAAC,CAAC;QACvE,IAAI,MAAM,GAAG,MAAM,SAAS,CAAC;YAC3B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,OAAO,EAAE,MAAM;YACvB,QAAQ,EAAE,OAAO,EAAE,QAAQ;YAC3B,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;gBACxC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE;gBAChD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QAEH,4EAA4E;QAC5E,IACE,MAAM,CAAC,EAAE;YACT,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC;YACrC,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC;YAC5B,sBAAsB,CAAC,OAAO,CAAC,IAAI,CAAC,EACpC,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,CACjB,0FAA0F,EAC1F,QAAQ,CACT,CAAC;YACF,MAAM,GAAG,MAAM,SAAS,CAAC;gBACvB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,IAAI,EAAE,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC;gBACzC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,SAAS,EAAE,OAAO;gBAClB,MAAM,EAAE,OAAO,EAAE,MAAM;gBACvB,QAAQ,EAAE,OAAO,EAAE,QAAQ;gBAC3B,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;oBACxC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE;oBAChD,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;QACL,CAAC;QAED,IAAI,GAAG,MAAM,CAAC;QACd,wEAAwE;QACxE,MAAM,aAAa,GAAG,CAAC,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,EAAE,IAAI,aAAa,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1E,yEAAyE;YACzE,IACE,MAAM,CAAC,EAAE;gBACT,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC;gBACrC,sBAAsB,CAAC,OAAO,CAAC,IAAI,CAAC,EACpC,CAAC;gBACD,OAAO;oBACL,GAAG,MAAM;oBACT,MAAM,EACJ,MAAM,CAAC,MAAM;wBACb,mEAAmE;wBACnE,gEAAgE;wBAChE,uEAAuE;wBACvE,4FAA4F;iBAC/F,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,iDAAiD;IACnD,CAAC;IACD,OAAO,IAAI,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AAChF,CAAC"}

package/dist/tools/registry.js

@@ -4,6 +4,7 @@ import { safeCwd } from "../os/cwd.js";
 import { fsEdit, fsDelete, fsList, fsRead, fsSearch, fsWrite, fsWriteMany, fsReplaceLines, fsAppend, } from "./fs.js";
 import { httpFetch } from "./http.js";
 import { shellExec, spawnArgv } from "./shell.js";
+import { isLongQuietInstallOrScaffoldCommand, } from "../agent/task-evidence.js";
 import { imageOcr } from "./image.js";
 import { pdfRead } from "./pdf.js";
 import { webFetch } from "./web/fetch.js";
@@ -20,6 +21,7 @@ import { jobManager } from "./jobs.js";
 import { looksLongRunning } from "./command-intent.js";
 import { packageBinaryName } from "./package-binary.js";
 import { runNmapScan } from "./nmap-runner.js";
+import { fromWireName, sanitizeToolName } from "../llm/tool-protocol.js";
 function requireString(args, key) {
     const value = args[key];
     if (typeof value !== "string" || value.length === 0) {
@@ -27,6 +29,14 @@ function requireString(args, key) {
     }
     return value;
 }
+/** Like requireString but allows empty string (e.g. replaceLines delete). */
+function requireStringAllowEmpty(args, key) {
+    const value = args[key];
+    if (typeof value !== "string") {
+        throw new Error(`Tool argument "${key}" must be a string`);
+    }
+    return value;
+}
 function optionalString(args, key) {
     const value = args[key];
     return typeof value === "string" && value.length > 0 ? value : undefined;
@@ -82,10 +92,15 @@ export const toolRegistry = {
             }
             return job;
         }
+        // create-next-app / npm install often exceed the default 3 min shell timeout
+        // when the model omits timeoutMs — bump automatically for known long jobs.
+        const explicitTimeout = optionalNumber(args, "timeoutMs");
+        const timeoutMs = explicitTimeout ??
+            (isLongQuietInstallOrScaffoldCommand(command) ? 900_000 : undefined);
         return shellExec({
             command,
             cwd: optionalString(args, "cwd"),
-            timeoutMs: optionalNumber(args, "timeoutMs"),
+            timeoutMs,
             signal: options?.signal,
             onOutput: options?.onOutput,
         });
@@ -297,10 +312,12 @@ export const toolRegistry = {
      */
     async "whois.lookup"(args, options) {
         const host = parseHost(requireString(args, "target"));
+        // Keep whois short-lived: many servers hang or buffer until close. A hard
+        // 20s cap beats the outer 60s "no output" stall watchdog aborting mid-recon.
         return spawnArgv({
             command: "whois",
             argv: [host.value],
-            timeoutMs: 60_000,
+            timeoutMs: 20_000,
             signal: options?.signal,
             onOutput: options?.onOutput,
         });
@@ -368,28 +385,56 @@ export const toolRegistry = {
         }
         const outputs = [];
         const transcript = [];
+        let anyOk = false;
+        const userAborted = () => Boolean(options?.signal?.aborted);
         for (const step of steps) {
-            if (options?.signal?.aborted)
+            if (userAborted())
                 break;
             const display = `${step.command} ${step.argv.join(" ")}`;
             transcript.push(`$ ${display}`);
             // Announce each sub-step so users see progress through long recons.
             options?.onOutput?.(`\n$ ${display}\n`, "stdout");
-            const result = step.key === "nmap"
-                ? // Route the scan through the privilege-aware runner so the
-                    // stealth SYN scan is elevated (sudo/elevation) and falls back
-                    // to a connect scan when privilege isn't available.
-                    await runNmapScan(step.argv, options)
-                : await spawnArgv({
-                    command: step.command,
-                    argv: step.argv,
-                    timeoutMs: 180_000,
-                    signal: options?.signal,
-                    onOutput: options?.onOutput,
-                });
-            outputs.push(result.output);
-            transcript.push(result.output);
-            if (options?.signal?.aborted)
+            // Heartbeat so the outer 60s stall watchdog doesn't kill a quiet whois.
+            const beat = setInterval(() => {
+                options?.onOutput?.(`[recon] ${step.key} still running…\n`, "stdout");
+            }, 5_000);
+            beat.unref?.();
+            // Per-step caps: whois often hangs; nmap needs longer; dns is quick.
+            const stepTimeoutMs = step.key === "whois" ? 20_000 : step.key === "dns" ? 30_000 : 180_000;
+            let result;
+            try {
+                result =
+                    step.key === "nmap"
+                        ? await runNmapScan(step.argv, options)
+                        : await spawnArgv({
+                            command: step.command,
+                            argv: step.argv,
+                            timeoutMs: stepTimeoutMs,
+                            signal: options?.signal,
+                            onOutput: options?.onOutput,
+                        });
+            }
+            catch (error) {
+                const msg = error instanceof Error ? error.message : String(error);
+                result = {
+                    ok: false,
+                    output: `${step.key} error: ${msg}`,
+                    exitCode: 1,
+                };
+            }
+            finally {
+                clearInterval(beat);
+            }
+            // Continue remaining steps even if whois/dns fails — never cancel
+            // sibling top-level tools just because whois hung.
+            if (result.ok)
+                anyOk = true;
+            const body = result.ok
+                ? result.output
+                : `${result.output || `${step.key} failed`}${result.exitCode !== undefined ? ` (exit ${result.exitCode})` : ""}`;
+            outputs.push(body);
+            transcript.push(body);
+            if (userAborted())
                 break;
         }
         if (artifactPath) {
@@ -401,12 +446,15 @@ export const toolRegistry = {
                 artifactPath = undefined;
             }
         }
+        // Soft-success when any step worked and the user didn't cancel. Partial
+        // whois failure still returns useful dns/nmap output to the model.
+        const aborted = userAborted();
         return {
-            ok: !options?.signal?.aborted,
-            output: options?.signal?.aborted
+            ok: aborted ? false : anyOk || outputs.length > 0,
+            output: aborted
                 ? `${outputs.join("\n\n")}\n\nCommand aborted.`.trim()
                 : outputs.join("\n\n"),
-            exitCode: options?.signal?.aborted ? 130 : 0,
+            exitCode: aborted ? 130 : anyOk ? 0 : 1,
             ...(artifactPath ? { outputPath: artifactPath } : {}),
         };
     },
@@ -460,11 +508,23 @@ export const toolRegistry = {
         return fsEdit(requireString(args, "path"), requireString(args, "oldText"), requireString(args, "newText"), optionalNumber(args, "expectedReplacements"), { confirmed: options?.confirmed });
     },
     async "fs.replaceLines"(args, options) {
-        return fsReplaceLines(requireString(args, "path"), requireNumber(args, "startLine"), requireNumber(args, "endLine"), requireString(args, "content"), { confirmed: options?.confirmed });
+        // Empty content / delete:true removes the line range (X6).
+        let content;
+        if (args.delete === true) {
+            content = "";
+        }
+        else if (typeof args.content === "string") {
+            content = requireStringAllowEmpty(args, "content");
+        }
+        else {
+            throw new Error('Tool argument "content" must be a string (use "" or delete:true to delete the line range)');
+        }
+        return fsReplaceLines(requireString(args, "path"), requireNumber(args, "startLine"), requireNumber(args, "endLine"), content, { confirmed: options?.confirmed });
     },
     async "fs.append"(args, options) {
         return fsAppend(requireString(args, "path"), requireString(args, "content"), {
             position: optionalString(args, "position"),
+            expectedPriorBytes: optionalNumber(args, "expectedPriorBytes"),
             confirmed: options?.confirmed,
         });
     },
@@ -535,13 +595,25 @@ function buildShellCommandFromCall(name, args) {
  * dangerous commands are gated exactly as a hand-written shell.exec would be.
  */
 export function normalizeToolCall(call) {
-    if (toolRegistry[call.name])
-        return call;
-    const name = typeof call.name === "string" ? call.name.trim() : "";
+    // X1: strip channel/commentary tokens before registry lookup.
+    let name = typeof call.name === "string" ? call.name.trim() : "";
+    if (name && !toolRegistry[name]) {
+        const cleaned = sanitizeToolName(name);
+        const mapped = fromWireName(cleaned) ?? fromWireName(name) ?? cleaned;
+        if (mapped && toolRegistry[mapped]) {
+            return { name: mapped, args: call.args ?? {} };
+        }
+        if (cleaned && cleaned !== name)
+            name = cleaned;
+    }
+    if (toolRegistry[name]) {
+        return name === call.name ? call : { name, args: call.args ?? {} };
+    }
     // Leave genuinely unknown namespaced tools (e.g. a typo'd "fs.reed") to
     // surface a clear error rather than guessing at a shell command.
-    if (!name || name.includes(".") || name.includes("/"))
-        return call;
+    if (!name || name.includes(".") || name.includes("/")) {
+        return name === call.name ? call : { name, args: call.args ?? {} };
+    }
     const args = call.args ?? {};
     const command = buildShellCommandFromCall(name, args);
     if (!command)
@@ -716,10 +788,22 @@ async function runToolBatch(args, options) {
             }
             tick(`[batch] #${index + 1} ${spec.name} starting`);
             try {
-                const result = await runToolCall({ name: spec.name, args: spec.args }, 
-                // Do not fan child stdout into the card (keeps parseable sections
-                // clean). Progress lines above are enough for the stall watchdog.
-                { signal: batchAc.signal });
+                // Lightweight child heartbeats so silent tools (whois) never trip the
+                // outer 60s stall watchdog while still running under the batch.
+                const childHeartbeat = setInterval(() => {
+                    tick(`[batch] #${index + 1} ${spec.name} still running…`);
+                }, BATCH_HEARTBEAT_MS);
+                childHeartbeat.unref?.();
+                let result;
+                try {
+                    result = await runToolCall({ name: spec.name, args: spec.args }, 
+                    // Do not fan full child stdout into the card (keeps final sections
+                    // clean). Progress ticks above drive the live UI + stall watchdog.
+                    { signal: batchAc.signal });
+                }
+                finally {
+                    clearInterval(childHeartbeat);
+                }
                 outcomes[index] = {
                     index,
                     name: spec.name,
@@ -770,6 +854,7 @@ async function runToolBatch(args, options) {
     }
     const finalOutcomes = outcomes;
     const allOk = finalOutcomes.every((outcome) => outcome.ok);
+    const parentAborted = Boolean(options?.signal?.aborted);
     const sections = finalOutcomes.map((outcome) => {
         const status = outcome.ok ? "ok" : "fail";
         const head = `── #${outcome.index + 1} ${outcome.name} [${status}${outcome.exitCode !== undefined ? ` exit=${outcome.exitCode}` : ""}]`;
@@ -784,10 +869,14 @@ async function runToolBatch(args, options) {
             `[batch] timed out after ${BATCH_HARD_TIMEOUT_MS / 1000}s — partial results below\n\n` +
                 output;
     }
+    // Soft-success for the agent turn: one failed whois/dns must NOT cancel
+    // sibling top-level tools (http.fetch, net.scan, …). Partial failures stay
+    // visible in the sectioned body and non-zero exitCode for the model.
+    const softOk = !parentAborted && !timedOut;
     return {
-        ok: allOk,
+        ok: softOk ? true : allOk,
         output,
-        exitCode: allOk ? 0 : timedOut ? 124 : 1,
+        exitCode: allOk ? 0 : timedOut ? 124 : parentAborted ? 130 : 1,
     };
 }
 //# sourceMappingURL=registry.js.map