fluxflow-cli 2.10.0 → 2.10.2

package/dist/fluxflow.js

@@ -2711,8 +2711,20 @@ var init_exec_command = __esm({
       return new Promise((resolve) => {
         const attempt = (usePowerShell) => {
           const command = adjustWindowsCommand(rawCommand, usePowerShell);
-          const shell = isWin ? usePowerShell ? "powershell.exe" : "cmd.exe" : process.env.SHELL || "bash";
-          const shellArgs = isWin ? usePowerShell ? ["-NoProfile", "-Command", command] : ["/c", command] : ["-c", command];
+          let shell = isWin ? usePowerShell ? "powershell.exe" : "cmd.exe" : process.env.SHELL || "bash";
+          let shellArgs = isWin ? usePowerShell ? ["-NoProfile", "-Command", command] : ["/c", command] : ["-c", command];
+          if (systemSettings.networkAccess === false && !isWin) {
+            const originalShell = shell;
+            const originalArgs = [...shellArgs];
+            if (process.platform === "linux") {
+              shell = "unshare";
+              shellArgs = ["-n", "-r", originalShell, ...originalArgs];
+            } else if (process.platform === "darwin") {
+              const sbProfile = '(version 1)\n(allow default)\n(deny network-outbound)\n(allow network-outbound (remote ip "localhost:*"))\n(allow network-outbound (remote ip "127.0.0.1:*"))\n';
+              shell = "sandbox-exec";
+              shellArgs = ["-p", sbProfile, originalShell, ...originalArgs];
+            }
+          }
           if (pty) {
             try {
               const ptyProcess = pty.spawn(shell, shellArgs, {
@@ -2765,11 +2777,11 @@ ${finalOutput}`);
               if (isWin && usePowerShell && err.code === "ENOENT") {
                 return false;
               }
-              runStandardSpawn(resolve, command, rawCommand, netEnv, onChunk, usePowerShell);
+              runStandardSpawn(resolve, command, rawCommand, netEnv, onChunk, usePowerShell, systemSettings);
               return true;
             }
           } else {
-            runStandardSpawn(resolve, command, rawCommand, netEnv, onChunk, usePowerShell);
+            runStandardSpawn(resolve, command, rawCommand, netEnv, onChunk, usePowerShell, systemSettings);
             return true;
           }
         };
@@ -2782,12 +2794,23 @@ ${finalOutput}`);
         }
       });
     };
-    runStandardSpawn = (resolve, command, rawCommand, netEnv, onChunk, usePowerShell = true) => {
+    runStandardSpawn = (resolve, command, rawCommand, netEnv, onChunk, usePowerShell = true, systemSettings = {}) => {
       const isWin = process.platform === "win32";
-      const shell = isWin ? usePowerShell ? "powershell.exe" : "cmd.exe" : process.env.SHELL || "bash";
-      const shellArgs = isWin ? usePowerShell ? ["-NoProfile", "-Command", command] : ["/c", command] : ["-c", command];
-      const child = isWin ? spawn(shell, shellArgs, { cwd: process.cwd(), env: { ...process.env, ...netEnv } }) : spawn(command, {
-        shell: true,
+      let shell = isWin ? usePowerShell ? "powershell.exe" : "cmd.exe" : process.env.SHELL || "bash";
+      let shellArgs = isWin ? usePowerShell ? ["-NoProfile", "-Command", command] : ["/c", command] : ["-c", command];
+      if (systemSettings.networkAccess === false && !isWin) {
+        const originalShell = shell;
+        const originalArgs = [...shellArgs];
+        if (process.platform === "linux") {
+          shell = "unshare";
+          shellArgs = ["-n", "-r", originalShell, ...originalArgs];
+        } else if (process.platform === "darwin") {
+          const sbProfile = '(version 1)\n(allow default)\n(deny network-outbound)\n(allow network-outbound (remote ip "localhost:*"))\n(allow network-outbound (remote ip "127.0.0.1:*"))\n';
+          shell = "sandbox-exec";
+          shellArgs = ["-p", sbProfile, originalShell, ...originalArgs];
+        }
+      }
+      const child = isWin ? spawn(shell, shellArgs, { cwd: process.cwd(), env: { ...process.env, ...netEnv } }) : spawn(shell, shellArgs, {
         cwd: process.cwd(),
         env: {
           ...process.env,
@@ -2854,7 +2877,7 @@ ${finalOutput}`);
       child.on("error", (err) => {
         if (isWin && usePowerShell && err.code === "ENOENT") {
           const cmdCommand = adjustWindowsCommand(rawCommand, false);
-          return runStandardSpawn(resolve, cmdCommand, rawCommand, netEnv, onChunk, false);
+          return runStandardSpawn(resolve, cmdCommand, rawCommand, netEnv, onChunk, false, systemSettings);
         }
         activeChildProcess = null;
         const errorMsg = err instanceof Error ? err.message : String(err);
@@ -8169,7 +8192,8 @@ ${activeSummaryBlock}${thinkingLevel !== "Fast" && thinkingLevel !== "xHigh" &&
         let wasToolCalledInLastLoop = false;
         modifiedHistory.forEach((msg) => {
           if (msg.text && msg.role === "agent") {
-            msg.text = msg.text.replace(/(?:<(think|thought)>|\[(think|thought)\])[\s\S]*?(?:<\/(think|thought)>|\[\/(think|thought)\])/gi, "").trim();
+            msg.text = msg.text.replace(/(?:<(think|thought)>|\[(think|thought)\])[\s\S]*?(?:<\/(think|thought)>|\[\/(think|thought)\])/gi, "");
+            msg.text = msg.text.replace(/(?:<(think|thought)>|\[(think|thought)\])[^\[\n]*/gi, "").trim();
           }
         });
         for (let loop = 0; loop <= MAX_LOOPS; loop++) {
@@ -8331,7 +8355,7 @@ ${activeSummaryBlock}${thinkingLevel !== "Fast" && thinkingLevel !== "xHigh" &&
               }
               currentSystemInstruction = getSystemInstruction(profile, !(targetModel || "gemma").toLowerCase().startsWith("gemma") ? "GEM" : thinkingLevel, mode, systemSettings, isMemoryEnabled, isFirstPrompt, aiProvider, isMultiModal);
               const lastUserMsg = contents[contents.length - 1];
-              if (isBridgeConnected()) {
+              if (isBridgeConnected() & loop > 0) {
                 yield { type: "status", content: "Checking Code..." };
                 await new Promise((resolve) => setTimeout(resolve, 2500));
                 const ideCtxJIT = await getIDEContext();
@@ -9082,7 +9106,7 @@ ${boxBottom}` };
                           }
                           if (!forcePrompt && !decision) {
                             if (systemSettings2.networkAccess === false) {
-                              const networkCmdRegex = /\b(curl|wget|npm|yarn|pnpm|pip|pip3|ssh|docker|git\s+(clone|push|pull|fetch))\b/i;
+                              const networkCmdRegex = /\b(curl|wget|httpie|fetch|axial|yarn|npm|pnpm|bun|deno|pip|pip3|poetry|uv|gem|cargo|go\s+(get|install)|composer|nuget|ssh|scp|ping|sftp|rsync|docker|podman|kubectl|helm|git\s+(clone|push|pull|fetch)|ftp|telnet|nc|netcat|socat|traceroute|tracert|dig|nslookup|host|nmap|gcloud|aws|az|terraform|ansible-playbook|nix|nix-env)\b/i;
                               if (networkCmdRegex.test(cmdTrimmed)) {
                                 decision = "deny";
                                 isNetworkDeny = true;
@@ -9766,6 +9790,9 @@ Error Log can be found in ${path19.join(LOGS_DIR, "agent", "error.log")}`);
           const cleanedTurnText = contextSafeReplace(turnText, /(\[\s*(turn\s*:)?\s*(continue|finish)\s*\]|\[\[END\]\])/gi, "").trim();
           let isActuallyFinished = (hasFinish || toolResults.length === 0) && !isThinkingLoop && !isStutteringLoop && !isGeneralLoop;
           isActuallyFinished = toolResults.length === 0 ? isActuallyFinished : false;
+          if (turnText && turnText.trim().endsWith('")]') && toolResults.length === 0) {
+            isActuallyFinished = false;
+          }
           if (isActuallyFinished) {
             const fullAgentTextRaw = fullAgentResponseChunks.join("\n");
             const cleanedFullResponse = fullAgentTextRaw.replace(/(?:<think>|\[think\])[\s\S]*?(?:<\/think>|\[\/think\])/g, "").trim();
@@ -9795,7 +9822,7 @@ Error Log can be found in ${path19.join(LOGS_DIR, "agent", "error.log")}`);
             }
           } else {
             if (wasToolCalledInLastLoop) {
-              modifiedHistory.push({ role: "user", text: `[SYSTEM] Failed to verify tool execution, Verify tool syntax, proper escaping or ask user if tool worked when unsure [/SYSTEM]` });
+              modifiedHistory.push({ role: "user", text: `[SYSTEM] Failed to verify tool execution, MUST check if executed or failed. On failure try again [/SYSTEM]` });
             } else {
               modifiedHistory.push({ role: "user", text: `[SYSTEM] ${isStutteringLoop && !isThinkingLoop ? `STUTTERING DETECTED by Internal System. Re-calibrate your response & proceed.` : `${isThinkingLoop ? " OVER THINKING" : " LOOP"} DETECTED by Internal System${isThinkingLoop ? " for current EFFORT_LEVEL" : ""}. ${isThinkingLoop ? "If you have planned the task, prioritize execution/output" : "If you have finished your task use [[END]]"}`} [/SYSTEM]` });
             }
@@ -9808,6 +9835,13 @@ Error Log can be found in ${path19.join(LOGS_DIR, "agent", "error.log")}`);
         modifiedHistory.forEach((msg) => {
           if (msg.role === "user" && msg.text) {
             msg.text = msg.text.replace(/\n\[COMPILE ERROR\][\s\S]*?\[\/ERROR\]/g, "");
+            msg.text = msg.text.replace(`
+
+[SYSTEM] USER QUESTION. RESOLVE THIS SPECIFIC QUERY WITHIN '[ANSWER] ... [/ANSWER]' CONCISELY, NATURALLY [/SYSTEM]
+`, "").replace(`[SYSTEM] USER QUESTION. RESOLVE THIS SPECIFIC QUERY WITHIN '[ANSWER] ... [/ANSWER]' CONCISELY, NATURALLY
+**STRICTLY FOLLOW THINKING POLICY AS CRITICAL PRIORITY. DO NOT START A RESPONSE WITHOUT <think> ... </think>** [/SYSTEM]
+`, "").replace(`[SYSTEM] **STRICTLY FOLLOW THINKING POLICY AS CRITICAL PRIORITY. DO NOT START A RESPONSE WITHOUT <think> ... </think>** [/SYSTEM]
+`, "");
             if (modelName && modelName.toLowerCase().startsWith("gemma") && aiProvider === "Google" && msg.text.startsWith("[TOOL RESULT]")) {
               const jitInstructionFast = `
 [SYSTEM] Tool result received. Analyze output and proceed with your turn [/SYSTEM]`;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "fluxflow-cli",
-	"version": "2.10.0",
+	"version": "2.10.2",
 	"date": "2026-06-20",
 	"description": "A high-fidelity agentic terminal assistant for the Flux Era.",
 	"keywords": [