buildwithnexus 0.11.2 → 0.11.3

package/harness/Cargo.lock

@@ -49,7 +49,7 @@ checksum = "b4388bee8683e3d04af747c73422af53102d2bd24d9eadb6cbc100baef4b43f8"
 
 [[package]]
 name = "buildwithnexus"
-version = "0.11.2"
+version = "0.11.3"
 dependencies = [
  "criterion",
  "crossterm",

package/harness/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "buildwithnexus"
-version = "0.11.2"
+version = "0.11.3"
 edition = "2021"
 description = "A hilariously fast agentic AI CLI harness — remote or local models, full TUI with modes, memory, skills, hooks, and image input"
 license = "MIT"

package/harness/src/agent.rs

@@ -866,6 +866,17 @@ fn text_tool_call(name: &str, input: serde_json::Value) -> provider::ToolCall {
     }
 }
 
+// The single-line composer prompt for reading a question answer. Kept on one
+// line (no `\n`) so the alt-screen composer positions the cursor correctly and
+// echoes typed input; the question text itself is printed separately above.
+fn answer_input_prompt(default: &str) -> String {
+    if default.is_empty() {
+        "  Answer: ".to_string()
+    } else {
+        format!("  Answer {}: ", tui::dim(&format!("[{default}]")))
+    }
+}
+
 fn answer_question(input: &serde_json::Value) -> (String, bool) {
     let question = if let Some(qs) = input["questions"].as_array() {
         let mut acc = Vec::new();
@@ -915,21 +926,16 @@ fn answer_question(input: &serde_json::Value) -> (String, bool) {
         );
     }
     let default = input["default"].as_str().unwrap_or("").trim();
-    let prompt = if default.is_empty() {
-        format!(
-            "  {} {}\n  Answer: ",
-            tui::yellow("?"),
-            tui::bold(&full_prompt)
-        )
-    } else {
-        format!(
-            "  {} {}\n  Answer {} ",
-            tui::yellow("?"),
-            tui::bold(&full_prompt),
-            tui::dim(&format!("[{default}]"))
-        )
-    };
-    let ans = tui::ask(&prompt).unwrap_or_default();
+    // Render the question on its own transcript line, then read the answer with
+    // a SINGLE-LINE composer prompt. A multi-line prompt string mis-positions
+    // the alt-screen composer cursor (prompt_width counts across the newline),
+    // which hides what the user types.
+    tui::line(&format!(
+        "  {} {}",
+        tui::yellow("?"),
+        tui::bold(&full_prompt)
+    ));
+    let ans = tui::ask(&answer_input_prompt(default)).unwrap_or_default();
     let out = if ans.trim().is_empty() && !default.is_empty() {
         default.to_string()
     } else {
@@ -3244,6 +3250,18 @@ mod tests {
     use super::*;
     use serde_json::json;
 
+    #[test]
+    fn answer_input_prompt_is_single_line() {
+        // Must never contain a newline — a multi-line prompt breaks the
+        // alt-screen composer's cursor positioning and hides typed input.
+        let p = answer_input_prompt("");
+        assert!(!p.contains('\n'));
+        assert!(p.contains("Answer"));
+        let d = answer_input_prompt("yes");
+        assert!(!d.contains('\n'));
+        assert!(d.contains("yes"));
+    }
+
     #[test]
     fn permission_parsing() {
         assert!(matches!(permission("auto"), Permission::Auto));

package/harness/src/tools.rs

@@ -318,11 +318,14 @@ pub fn defs_for_context(include_subagent: bool, context_tokens: usize) -> Vec<To
 }
 
 // The compact surface advertises one canonical tool per capability — read,
-// write, edit, shell, glob, grep, list, artifact publishing, plus the
-// finish/question control tools and python_tool for local extensions. Pure
-// aliases (`read`/`write`/`edit`/`bash`, `publish_artifact`) still dispatch in
-// `run` if a model insists, but advertising duplicates wastes prompt tokens
-// and confuses weak models. Keep this list at 12 defs or fewer.
+// write, edit, shell, glob, grep, list, artifact publishing, plus the finish
+// control tool and python_tool for local extensions. The `question` tool is
+// deliberately omitted: small models use it to stall (endlessly re-asking a
+// clarifying question instead of building), so on the compact surface they must
+// act on sensible defaults. Pure aliases (`read`/`write`/`edit`/`bash`,
+// `publish_artifact`) still dispatch in `run` if a model insists, but
+// advertising duplicates wastes prompt tokens and confuses weak models. Keep
+// this list at 12 defs or fewer.
 fn compact_tool(name: &str) -> bool {
     matches!(
         name,
@@ -334,7 +337,6 @@ fn compact_tool(name: &str) -> bool {
             | "grep_files"
             | "list_dir"
             | "finish"
-            | "question"
             | "Artifact"
             | "python_tool"
     )
@@ -1182,6 +1184,57 @@ fn first_local_script_src(contents: &str) -> Option<String> {
     None
 }
 
+// True if `val` is a local relative path (not an absolute URL or data: URI) —
+// such a reference won't exist next to a published single-file artifact.
+fn is_local_asset(val: &str) -> bool {
+    let v = val.trim().to_ascii_lowercase();
+    !v.is_empty()
+        && !v.starts_with("http://")
+        && !v.starts_with("https://")
+        && !v.starts_with("//")
+        && !v.starts_with("data:")
+}
+
+// Extract a (possibly quoted) attribute value from the text right after `attr=`.
+fn attr_after(after: &str) -> String {
+    let v = if let Some(rest) = after.strip_prefix('"') {
+        rest.split('"').next().unwrap_or("")
+    } else if let Some(rest) = after.strip_prefix('\'') {
+        rest.split('\'').next().unwrap_or("")
+    } else {
+        after
+            .split(|c: char| c.is_whitespace() || c == '>')
+            .next()
+            .unwrap_or("")
+    };
+    v.trim().to_string()
+}
+
+// A `<link rel="stylesheet" href="local.css">` pointing at a local file that
+// won't exist next to the published artifact. Returns the local href, else None.
+fn first_local_stylesheet_href(contents: &str) -> Option<String> {
+    let lower = contents.to_ascii_lowercase();
+    let mut at = 0;
+    while let Some(rel) = lower[at..].find("<link") {
+        let tag_start = at + rel;
+        let tag_end = lower[tag_start..]
+            .find('>')
+            .map(|e| tag_start + e)
+            .unwrap_or(lower.len());
+        let tag_lower = &lower[tag_start..tag_end];
+        if tag_lower.contains("stylesheet") {
+            if let Some(hp) = tag_lower.find("href=") {
+                let val = attr_after(&contents[tag_start + hp + "href=".len()..tag_end]);
+                if is_local_asset(&val) {
+                    return Some(val);
+                }
+            }
+        }
+        at = tag_end.max(tag_start + "<link".len());
+    }
+    None
+}
+
 // Rejection reasons for artifact contents. Every message quotes the offending
 // snippet and the exact rule, plus what to change — cheap models can't fix
 // what they can't see.
@@ -1196,7 +1249,12 @@ fn artifact_quality_error(contents: &str, kind: &str) -> Option<String> {
         let trimmed_len = contents.trim().len();
         if trimmed_len < 300 {
             return Some(format!(
-                "HTML artifact is too small to be a complete runnable app: {trimmed_len} chars, but the minimum is 300. Resend the artifact with the full HTML document — markup, embedded CSS, and embedded JavaScript — in `contents`."
+                "HTML artifact is too small to be a complete runnable app: {trimmed_len} chars, but the minimum is 300. It must be ONE self-contained file: do NOT link external files (no <link rel=stylesheet> or <script src=…>); put ALL CSS inside a <style> block and ALL JavaScript — the full working logic — inside a <script> block. Resend the complete document in `contents`."
+            ));
+        }
+        if let Some(href) = first_local_stylesheet_href(contents) {
+            return Some(format!(
+                "HTML artifact links a local stylesheet via <link rel=\"stylesheet\" href=\"{href}\">, which will not exist next to the published file. Move those styles into an inline <style>…</style> block so the artifact is self-contained."
             ));
         }
         if let Some(src) = first_local_script_src(contents) {
@@ -4570,7 +4628,6 @@ mod tests {
             "grep_files",
             "list_dir",
             "finish",
-            "question",
             "Artifact",
             "python_tool",
         ] {
@@ -4583,6 +4640,7 @@ mod tests {
             "kb_record",
             "verify",
             "text_editor_20250124",
+            "question",
             "AskUserQuestion",
             "read",
             "write",
@@ -5411,6 +5469,53 @@ print("hello " + data.get("name", "world"))
         let _ = fs::remove_dir_all(&d);
     }
 
+    #[test]
+    fn artifact_rejects_local_stylesheet_link() {
+        let d = tempdir();
+        // A 1.5B model's canvas-game stub linked <link rel=stylesheet href=styles.css>;
+        // it must be rejected with a message naming the file and telling the
+        // model to inline the CSS.
+        let body = html_app("draw();").replace(
+            "<head>",
+            "<head><link rel=\"stylesheet\" href=\"styles.css\">",
+        );
+        let r = run(
+            "Artifact",
+            &json!({"title": "Game", "contents": body, "type": "html"}),
+            &d,
+        );
+        assert!(r.is_error);
+        assert!(r.content.contains("styles.css"), "{}", r.content);
+        assert!(r.content.contains("<style"), "{}", r.content);
+        let _ = fs::remove_dir_all(&d);
+    }
+
+    #[test]
+    fn artifact_allows_external_stylesheet_link() {
+        let d = tempdir();
+        let body = html_app("draw();").replace(
+            "<head>",
+            "<head><link rel=\"stylesheet\" href=\"https://cdn.example.com/x.css\">",
+        );
+        let r = run(
+            "Artifact",
+            &json!({"title": "Game", "contents": body, "type": "html"}),
+            &d,
+        );
+        assert!(!r.is_error, "{}", r.content);
+        let _ = fs::remove_dir_all(&d);
+    }
+
+    #[test]
+    fn is_local_asset_classifies_paths() {
+        assert!(is_local_asset("styles.css"));
+        assert!(is_local_asset("./css/app.css"));
+        assert!(!is_local_asset("https://x.com/a.css"));
+        assert!(!is_local_asset("//cdn/a.css"));
+        assert!(!is_local_asset("data:text/css,body{}"));
+        assert!(!is_local_asset(""));
+    }
+
     #[test]
     fn artifact_allows_external_script_src() {
         let d = tempdir();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "buildwithnexus",
-  "version": "0.11.2",
+  "version": "0.11.3",
   "description": "A hilariously fast, agentic AI CLI harness in Rust — remote (API key) or local models, full-screen TUI with sessions, plan/build/brainstorm modes, and hooks",
   "bin": {
     "buildwithnexus": "bin/buildwithnexus.js",