nexrall-code 0.5.116 → 0.5.117

package/dist/index.js

@@ -12526,7 +12526,7 @@ var require_agentTypes = __commonJS({
       return t2;
     }
     exports2.VALID_MODELS = [
-      "claude-sonnet-5",
+      "claude-sonnet-5-5",
       "claude-opus-5-5",
       "claude-fable-5-1",
       "gpt-5.4",
@@ -106306,8 +106306,8 @@ var require_modelCatalogue = __commonJS({
     }
     exports2.CHEAPEST_MODEL_ALIAS = "cheapest";
     var LEGACY_ALIAS_IDS = {
-      turbo: "claude-sonnet-5",
-      fast: "claude-sonnet-5",
+      turbo: "claude-sonnet-5-5",
+      fast: "claude-sonnet-5-5",
       pro: "claude-opus-5-5",
       ultra: "claude-fable-5-1"
     };
@@ -107626,7 +107626,7 @@ ${partial}` : "",
       ultra: 1e6,
       fast: 2e5,
       // Anthropic, by real model id.
-      "claude-sonnet-5": 1e6,
+      "claude-sonnet-5-5": 1e6,
       "claude-opus-5-5": 1e6,
       "claude-fable-5-1": 1e6,
       "claude-haiku-4-5-20251001": 2e5,
@@ -156779,7 +156779,7 @@ var CLI_VERSION = (() => {
   return "unknown";
 })();
 var MODEL_LABELS = {
-  "claude-sonnet-5": "Claude Sonnet 5",
+  "claude-sonnet-5-5": "Claude Sonnet 5.5",
   "claude-opus-5-5": "Claude Opus 5.5",
   "claude-fable-5-1": "Claude Fable 5.1",
   "claude-haiku-4-5-20251001": "Claude Haiku 4.5",
@@ -156794,15 +156794,15 @@ var MODEL_LABELS = {
   "glm-5.3": "GLM 5.3"
 };
 var LEGACY_MODEL_ALIASES = {
-  turbo: "claude-sonnet-5",
-  auto: "claude-sonnet-5",
+  turbo: "claude-sonnet-5-5",
+  auto: "claude-sonnet-5-5",
   pro: "claude-opus-5-5",
   power: "claude-opus-5-5",
   ultra: "claude-fable-5-1",
   fast: "claude-haiku-4-5-20251001"
 };
 var SELECTABLE_MODELS = [
-  "claude-sonnet-5",
+  "claude-sonnet-5-5",
   "claude-opus-5-5",
   "claude-fable-5-1",
   "gpt-5.6-sol",
@@ -156822,7 +156822,7 @@ var SELECTABLE_MODELS = [
   "glm-5.3"
 ];
 var MODEL_COST_MULTIPLIER = {
-  "claude-sonnet-5": 1.5,
+  "claude-sonnet-5-5": 1.5,
   "claude-opus-5-5": 3,
   "claude-fable-5-1": 5,
   // GPT-5.6 family (2026-07 launch, Terra/Luna repriced 2026-07-30) — same
@@ -158526,7 +158526,7 @@ ${caption}` : `[Attached: ${rel}]`;
           const content = [{ type: "text", text: label }];
           const needsSidecar = isPdf ? needsPdfSidecar(model) : needsVisionSidecar(model);
           if (needsSidecar) {
-            console.log(source_default.dim(`  ${resolveModelLabel(modelAlias)} can't read ${isPdf ? "PDFs" : "images"} directly \u2014 describing ${rel} with Claude Sonnet 5 first\u2026`));
+            console.log(source_default.dim(`  ${resolveModelLabel(modelAlias)} can't read ${isPdf ? "PDFs" : "images"} directly \u2014 describing ${rel} with Claude Sonnet 5.5 first\u2026`));
             try {
               const { text } = await (0, import_code_core5.describeAttachment)(isPdf ? "pdf" : "image", data, mimeType, rel);
               content.push({ type: "text", text: `<attachment_description>
@@ -159219,12 +159219,12 @@ program2.command("sessions").description("List or delete saved chat sessions").o
   console.log(source_default.dim("  nex sessions --delete <id>  to remove one"));
   console.log();
 });
-program2.option("-p, --pro", "Use Claude Opus 5 (most capable)").option("-t, --turbo", "Use Claude Sonnet 5 (fast, default)").option("-u, --ultra", "Use Claude Fable 5 (most powerful)").option("-y, --yolo", "Auto-approve all tool calls (no permission prompts)").option("-d, --dir <path>", "Set working directory (default: current directory)").option("-m, --model <name>", "Explicit model, e.g. claude-opus-5-5 | gpt-5.4 | gpt-4.1").option("-r, --resume [id]", "Resume last session, or a specific session id").option("-w, --worktree [name]", "Isolate this session in its own worktree \u2014 a separate directory (and, in a git repo, its own branch) so it can never overwrite files another session (or you) are touching in the main checkout. Omit a name for an auto-generated one; pass an existing name to resume that same worktree.").option("-e, --effort <level>", "Thinking effort \u2014 real levels depend on the model (e.g. DeepSeek: low|high|max, Qwen: low|high); run `nex --model <id>` then `/effort` with no argument to see a model's scale").option("--no-banner", "Skip the ASCII banner (useful in scripts/pipes)").option("--output-format <fmt>", "One-shot output format: text | json | stream-json (implies auto-approve)").option("--audit [path]", "Log every tool call (and refusal) to a JSONL trail (default: .nexrall/audit/<session>.jsonl)").argument("[prompt...]", "One-shot prompt \u2014 if omitted, starts interactive mode").action(async (promptParts, options) => {
+program2.option("-p, --pro", "Use Claude Opus 5.5 (most capable)").option("-t, --turbo", "Use Claude Sonnet 5.5 (fast)").option("-u, --ultra", "Use Claude Fable 5.1 (most powerful)").option("-y, --yolo", "Auto-approve all tool calls (no permission prompts)").option("-d, --dir <path>", "Set working directory (default: current directory)").option("-m, --model <name>", "Explicit model, e.g. claude-opus-5-5 | gpt-5.4 | gpt-4.1").option("-r, --resume [id]", "Resume last session, or a specific session id").option("-w, --worktree [name]", "Isolate this session in its own worktree \u2014 a separate directory (and, in a git repo, its own branch) so it can never overwrite files another session (or you) are touching in the main checkout. Omit a name for an auto-generated one; pass an existing name to resume that same worktree.").option("-e, --effort <level>", "Thinking effort \u2014 real levels depend on the model (e.g. DeepSeek: low|high|max, Qwen: low|high); run `nex --model <id>` then `/effort` with no argument to see a model's scale").option("--no-banner", "Skip the ASCII banner (useful in scripts/pipes)").option("--output-format <fmt>", "One-shot output format: text | json | stream-json (implies auto-approve)").option("--audit [path]", "Log every tool call (and refusal) to a JSONL trail (default: .nexrall/audit/<session>.jsonl)").argument("[prompt...]", "One-shot prompt \u2014 if omitted, starts interactive mode").action(async (promptParts, options) => {
   if (!(0, import_code_core8.isAuthenticated)()) {
     console.error("Not logged in. Run: nex auth");
     process.exit(1);
   }
-  const model = options.model ? options.model : options.ultra ? "claude-fable-5-1" : options.pro ? "claude-opus-5-5" : options.turbo ? "claude-sonnet-5" : "deepseek-flash";
+  const model = options.model ? options.model : options.ultra ? "claude-fable-5-1" : options.pro ? "claude-opus-5-5" : options.turbo ? "claude-sonnet-5-5" : "deepseek-flash";
   const workDir = options.dir ? path7.resolve(options.dir) : process.cwd();
   if (options.yolo)
     setAutoApprove("all");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexrall-code",
-  "version": "0.5.116",
+  "version": "0.5.117",
   "description": "Nexrall Code — AI coding assistant for your terminal (headless agent for scripts, CI and automation)",
   "keywords": [
     "ai",
@@ -12,11 +12,6 @@
     "ci"
   ],
   "homepage": "https://nexrall.com",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/nexrall/nexrall-code.git",
-    "directory": "packages/cli"
-  },
   "license": "MIT",
   "type": "module",
   "bin": {
@@ -33,13 +28,6 @@
   "engines": {
     "node": ">=18"
   },
-  "scripts": {
-    "build": "node build.js",
-    "dev": "tsx src/index.ts",
-    "start": "node dist/index.js",
-    "test": "tsc --noEmit && tsc --noEmit -p test/tsconfig.json && node --import tsx --test test/*.test.ts test/*.test.mts",
-    "release": "node build.js && node scripts/upload-release.cjs"
-  },
   "dependencies": {
     "chalk": "^5.3.0",
     "commander": "^12.0.0",
@@ -53,13 +41,20 @@
   },
   "devDependencies": {
     "@aws-sdk/client-s3": "^3.600.0",
-    "@nexrall/code-core": "workspace:*",
     "@types/diff": "^5.2.1",
     "@types/node": "^20.0.0",
     "@types/prompts": "^2.4.9",
     "@types/react": "^19.2.18",
     "esbuild": "^0.20.0",
     "tsx": "^4.7.0",
-    "typescript": "^6.0.3"
+    "typescript": "^6.0.3",
+    "@nexrall/code-core": "1.4.65"
+  },
+  "scripts": {
+    "build": "node build.js",
+    "dev": "tsx src/index.ts",
+    "start": "node dist/index.js",
+    "test": "tsc --noEmit && tsc --noEmit -p test/tsconfig.json && node --import tsx --test test/*.test.ts test/*.test.mts",
+    "release": "node build.js && node scripts/upload-release.cjs"
   }
-}
+}

package/dist/audit.js

@@ -1,102 +0,0 @@
-/**
- * `--audit [path]` — the CLI's opt-in tool-call trail.
- *
- * WHY THE CLI HAS THIS AT ALL
- *
- * The trail was originally skipped here: an interactive terminal already has a
- * human watching every permission prompt, so the human IS the oversight layer,
- * and shipping a flag nobody asked for is just maintenance surface.
- *
- * Headless mode is what changes the answer. `--output-format json|stream-json`
- * auto-approves every tool call (there is no TTY to ask on) and is meant for CI
- * and scripted runs — i.e. an agent acting with nobody watching. That is where a
- * trail is worth MOST, not least: without one there is no way to answer "what
- * did last night's job actually touch?". The consumer that makes it useful also
- * already exists, since stream-json output is machine-readable by design.
- *
- * Still OPT-IN, including in headless: writing an unrequested file into a user's
- * working directory is not a default worth taking, and every other host
- * (code-core, the SDK, Desktop) keeps auditing off unless asked. Opt-in
- * consistency is itself a property worth having.
- *
- * State lives at module level rather than being threaded through runTurn()'s
- * parameter list, matching setMode()/setAutoApprove() in permissions/. That list
- * already carries ten positional parameters across six call sites; an eleventh
- * would have to be added correctly six times, and the failure mode of missing
- * one is a silently unaudited turn — the exact defect this feature exists to
- * prevent, and the one already hit once in @nexrall/agent.
- *
- * See docs/NEXRALL_AUDIT_TRAIL_LAYER.md in the Nexrall repo.
- */
-import * as path from 'path';
-import { createJsonlAuditSink, loadAuth } from '@nexrall/code-core';
-let _state;
-/**
- * One sink per resolved path.
- *
- * Cached because the default path is derived from the session id, so `/clear`
- * legitimately starts a NEW trail file, while an explicit `--audit <path>`
- * keeps appending to one. Re-creating a sink per turn would also re-run the
- * mkdir bookkeeping on every call for no benefit.
- */
-const _sinks = new Map();
-/** Default trail location when `--audit` is given with no path. */
-export function defaultAuditPath(workDir, sessionId) {
-    return path.join(workDir, '.nexrall', 'audit', `${sessionId}.jsonl`);
-}
-/**
- * Resolve where this session's trail is written.
- *
- * An explicit path is resolved against the CWD the user invoked from, not
- * `workDir`: a CI job typically wants the trail in its artifacts directory,
- * which is usually not the repo being worked on.
- */
-export function resolveAuditPath(state) {
-    return state.filePath
-        ? path.resolve(state.filePath)
-        : defaultAuditPath(state.workDir, state.getSessionId());
-}
-/** Enable auditing for this process. Returns the path used for the first session. */
-export function enableAudit(opts) {
-    _state = opts;
-    return resolveAuditPath(opts);
-}
-/**
- * The audit config for the CURRENT turn, or undefined when `--audit` was not
- * passed.
- *
- * Built per call (cheap: a map lookup plus an object literal) so a session id
- * changed by `/clear` or `/resume` is picked up on the very next turn.
- */
-export function currentAudit() {
-    if (!_state)
-        return undefined;
-    const target = resolveAuditPath(_state);
-    let sink = _sinks.get(target);
-    if (!sink) {
-        sink = createJsonlAuditSink(target);
-        _sinks.set(target, sink);
-    }
-    const cfg = {
-        sink,
-        // Pinned per turn to the CLI's live session id, so a whole conversation —
-        // every turn, and every sub-agent it delegates to — shares one session in
-        // the trail. code-core mints an id per runAgentLoop() call and the REPL
-        // calls it once PER TURN, so leaving this unset would make each turn look
-        // like a separate session and break the link between a later write and the
-        // request that caused it. Same trap as @nexrall/agent's and Desktop's.
-        sessionId: _state.getSessionId(),
-    };
-    // The human half of dual attribution. Absent when the account has no email on
-    // record — never substituted with a placeholder, because a fabricated
-    // attribution in a compliance record is worse than a visibly missing one.
-    const email = loadAuth()?.email;
-    if (email)
-        cfg.userId = email;
-    return cfg;
-}
-/** Test seam — resets module state between cases. */
-export function resetAudit() {
-    _state = undefined;
-    _sinks.clear();
-}

package/dist/commands/auth.js

@@ -1,134 +0,0 @@
-import * as readline from 'readline';
-import chalk from 'chalk';
-import { login, saveAuth, clearAuth, isAuthenticated, getBalance, revokeRefreshToken } from '@nexrall/code-core';
-// ─── Hidden Password Prompt ───────────────────────────────────────────────────
-function prompt(question, hidden = false) {
-    return new Promise((resolve) => {
-        const rl = readline.createInterface({
-            input: process.stdin,
-            output: process.stdout,
-            terminal: true,
-        });
-        if (hidden) {
-            // Temporarily suppress echoing for password input
-            process.stdout.write(question);
-            let value = '';
-            const { stdin } = process;
-            const wasRaw = stdin.isRaw;
-            stdin.setRawMode(true);
-            stdin.resume();
-            stdin.setEncoding('utf8');
-            const onData = (char) => {
-                if (char === '\n' || char === '\r' || char === '') {
-                    // Enter or Ctrl+C
-                    stdin.setRawMode(wasRaw ?? false);
-                    stdin.pause();
-                    stdin.removeListener('data', onData);
-                    rl.close();
-                    process.stdout.write('\n');
-                    if (char === '') {
-                        process.exit(0);
-                    }
-                    resolve(value);
-                }
-                else if (char === '' || char === '\b') {
-                    // Backspace
-                    if (value.length > 0) {
-                        value = value.slice(0, -1);
-                    }
-                }
-                else {
-                    value += char;
-                }
-            };
-            stdin.on('data', onData);
-        }
-        else {
-            rl.question(question, (answer) => {
-                rl.close();
-                resolve(answer.trim());
-            });
-        }
-    });
-}
-// ─── Auth Command ─────────────────────────────────────────────────────────────
-export async function authCommand() {
-    console.log();
-    console.log(chalk.bold.blue('  Nexrall Code — Login'));
-    console.log(chalk.dim('  ─────────────────────'));
-    console.log();
-    if (isAuthenticated()) {
-        const overwrite = await prompt(chalk.yellow('  Already logged in. Login again? ') + chalk.dim('[y/n] > '));
-        if (overwrite !== 'y' && overwrite !== 'yes') {
-            console.log(chalk.dim('  Cancelled.'));
-            return;
-        }
-        console.log();
-    }
-    const email = await prompt(chalk.bold('  Email    ') + chalk.dim('> '));
-    const password = await prompt(chalk.bold('  Password ') + chalk.dim('> '), true);
-    console.log();
-    const spinner = startSpinner('Logging in…');
-    try {
-        const authConfig = await login(email, password);
-        saveAuth(authConfig);
-        stopSpinner(spinner);
-        console.log(chalk.green('  ✓ Logged in as ') + chalk.bold(authConfig.email ?? email));
-        console.log();
-        // Show balance
-        try {
-            const balance = await getBalance();
-            console.log(chalk.dim('  Wallet balance: ') + chalk.cyan(`$${balance.toFixed(4)}`));
-        }
-        catch {
-            // Non-fatal — balance fetch can fail
-        }
-        console.log();
-        console.log(chalk.dim('  Run ') + chalk.bold('nex') + chalk.dim(' to start coding.'));
-        console.log();
-    }
-    catch (err) {
-        stopSpinner(spinner);
-        console.log();
-        console.log(chalk.red('  ✗ Login failed: ') + String(err.message));
-        console.log();
-        process.exit(1);
-    }
-}
-// ─── Logout Command ───────────────────────────────────────────────────────────
-export async function logoutCommand() {
-    console.log();
-    if (!isAuthenticated()) {
-        console.log(chalk.dim('  Not logged in.'));
-        console.log();
-        return;
-    }
-    const confirm = await prompt(chalk.yellow('  Log out? ') + chalk.dim('[y/n] > '));
-    if (confirm !== 'y' && confirm !== 'yes') {
-        console.log(chalk.dim('  Cancelled.'));
-        console.log();
-        return;
-    }
-    // Revoke server-side BEFORE clearing the local file — the refresh token has to be
-    // read from it. Without this, "logging out" only deleted the local copy while the
-    // 60-day refresh token stayed valid and could keep minting access tokens for
-    // anyone who recovered it (a synced dotfile, a backup, a shared machine).
-    await revokeRefreshToken();
-    clearAuth();
-    console.log(chalk.green('  ✓ Logged out.'));
-    console.log();
-}
-function startSpinner(text) {
-    const frames = ['◐', '◓', '◑', '◒'];
-    let i = 0;
-    process.stdout.write('  ');
-    const interval = setInterval(() => {
-        process.stdout.write(`\r  ${chalk.cyan(frames[i % frames.length])} ${chalk.dim(text)}`);
-        i++;
-    }, 120);
-    return { interval };
-}
-function stopSpinner(handle) {
-    clearInterval(handle.interval);
-    process.stdout.write('\r\x1b[K'); // Clear the spinner line
-}