nexrall-code 0.5.123 → 0.5.124

package/dist/index.js

@@ -104964,60 +104964,361 @@ var require_rules = __commonJS({
   }
 });
 
-// ../core/dist/permissions/bashClassify.js
-var require_bashClassify = __commonJS({
-  "../core/dist/permissions/bashClassify.js"(exports2) {
+// ../core/dist/agent/planMode.js
+var require_planMode = __commonJS({
+  "../core/dist/agent/planMode.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.bashNeedsRepoLock = bashNeedsRepoLock;
-    var MUTATING_BASH_VERBS = /* @__PURE__ */ new Set([
-      "git",
-      "npm",
-      "pnpm",
-      "yarn",
-      "bun",
-      "cargo",
-      "go",
-      "pip",
-      "pip3",
-      "poetry",
-      "uv",
-      "bundle",
-      "composer",
-      "gradle",
-      "mvn",
-      "make",
-      "terraform",
-      "helm",
-      "docker",
-      "vsce",
-      "tsc",
-      "pytest",
-      "dotnet",
-      "swift",
-      "gem"
+    exports2.PLAN_MODE_INSTRUCTIONS = void 0;
+    exports2.isReadOnlyCommand = isReadOnlyCommand;
+    exports2.isReadOnlyPipeline = isReadOnlyPipeline;
+    exports2.checkPlanMode = checkPlanMode;
+    var READ_ONLY_TOOLS = /* @__PURE__ */ new Set([
+      "read_file",
+      "search_files",
+      "glob",
+      "list_directory",
+      "notebook_read",
+      // Planning bookkeeping. todo_write persists only to the session's own todo
+      // list, not the repo, so it stays available — a plan mode that cannot draft
+      // a checklist is missing the point of plan mode.
+      "todo_write",
+      "todo_read",
+      // Reading memory is fine; memory_write is NOT here on purpose. Memory is
+      // durable state that survives the session, so writing it is a real mutation
+      // even though no file in the repo changes.
+      "memory_read",
+      "use_skill",
+      "fetch_url",
+      "web_search",
+      // Delegating research is ALLOWED, and this is safe rather than a hole:
+      // runSubTask passes planMode down, so the sub-agent is under the same lock and
+      // its own write tools are refused by this very function one level deeper.
+      //
+      // Worth allowing rather than blanket-refusing, because plan mode exists to
+      // support deep research and the explorer agent is the cheapest way to do bulk
+      // searching without flooding the main context. Blocking `task` would have made
+      // the mode's headline use case worse, for no security gain.
+      "task",
+      // VS Code language server — all pure queries.
+      "get_symbols",
+      "get_workspace_symbols",
+      "find_references",
+      "go_to_definition",
+      "get_hover",
+      "get_diagnostics",
+      // Reading output from an ALREADY-running background shell. Starting one is
+      // gated with the rest of bash below; draining a buffer is not a new effect.
+      "bash_output"
     ]);
-    function bashNeedsRepoLock(command) {
-      if (!command)
-        return false;
-      const segments = command.split(/\|\||&&|[;|&\n()]|\$\(/);
-      for (const seg of segments) {
-        for (const tokenRaw of seg.trim().split(/\s+/)) {
-          const token = tokenRaw.replace(/^["']|["']$/g, "");
-          if (!token)
-            continue;
-          if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(token))
-            continue;
-          if (token === "sudo" || token === "time" || token === "nice" || token === "env")
-            continue;
-          const verb = token.split("/").pop() ?? token;
-          if (MUTATING_BASH_VERBS.has(verb))
+    var READ_ONLY_BASH = /* @__PURE__ */ new Set([
+      "ls",
+      "cat",
+      "head",
+      "tail",
+      "wc",
+      "file",
+      "stat",
+      "du",
+      "df",
+      "pwd",
+      "which",
+      "type",
+      "echo",
+      "printf",
+      "basename",
+      "dirname",
+      "realpath",
+      "readlink",
+      "grep",
+      "egrep",
+      "fgrep",
+      "rg",
+      "ag",
+      "ack",
+      "find",
+      "fd",
+      "locate",
+      "diff",
+      "comm",
+      "cmp",
+      "sort",
+      "uniq",
+      "cut",
+      "tr",
+      "column",
+      "jq",
+      "yq",
+      "date",
+      "whoami",
+      "hostname",
+      "uname",
+      "env",
+      "printenv",
+      "id",
+      "groups",
+      "ps",
+      "uptime",
+      "free",
+      "node",
+      "python",
+      "python3",
+      // `less`/`more`/`top` are deliberately NOT here: pagers run `!cmd` from inside and
+      // `top` never exits. `env` is listed but only bare — see toolFlagsOk.
+      "tree",
+      "nl",
+      "tac",
+      "strings",
+      "md5sum",
+      "sha256sum",
+      "true",
+      "false",
+      "test",
+      "sleep",
+      "seq",
+      "expr",
+      // Changes this shell's cwd only. Needed so `cd x && ls` is not refused.
+      "cd"
+    ]);
+    var SYSTEM_BIN_DIRS = /* @__PURE__ */ new Set([
+      "/bin",
+      "/usr/bin",
+      "/usr/local/bin",
+      "/sbin",
+      "/usr/sbin",
+      "/opt/homebrew/bin"
+    ]);
+    var UNSAFE_ENV = /^(PATH|HOME|SHELL|IFS|ENV|BASH_ENV|PAGER|MANPAGER|EDITOR|VISUAL|BROWSER|LD_\w*|DYLD_\w*|GIT_\w*|NODE_\w*|NPM_\w*|npm_\w*|PYTHON\w*|BASH\w*|RUBY\w*|PERL\w*|LESS\w*|XDG_\w*|\w*OPTS?)=/i;
+    var GH_NOUNS = /* @__PURE__ */ new Set(["pr", "issue", "run", "repo", "release", "workflow", "gist", "label"]);
+    var READ_ONLY_SUBCOMMANDS = {
+      git: /* @__PURE__ */ new Set([
+        "log",
+        "show",
+        "diff",
+        "status",
+        "blame",
+        "branch",
+        "tag",
+        "remote",
+        "describe",
+        "rev-parse",
+        "rev-list",
+        "ls-files",
+        "ls-tree",
+        "ls-remote",
+        "cat-file",
+        "shortlog",
+        "reflog",
+        "whatchanged",
+        "grep",
+        "config",
+        "check-ignore",
+        "merge-base",
+        "name-rev",
+        "count-objects",
+        "verify-commit"
+      ]),
+      // Package managers: only their query verbs.
+      npm: /* @__PURE__ */ new Set(["ls", "list", "view", "info", "outdated", "why", "config", "ping", "search"]),
+      pnpm: /* @__PURE__ */ new Set(["ls", "list", "view", "info", "outdated", "why", "config"]),
+      yarn: /* @__PURE__ */ new Set(["list", "info", "why", "config"]),
+      cargo: /* @__PURE__ */ new Set(["tree", "metadata", "search"]),
+      go: /* @__PURE__ */ new Set(["list", "version", "env", "vet", "doc"]),
+      docker: /* @__PURE__ */ new Set(["ps", "images", "logs", "inspect", "version", "info", "top", "port", "diff", "stats"]),
+      kubectl: /* @__PURE__ */ new Set(["get", "describe", "logs", "explain", "top", "version", "api-resources", "api-versions"]),
+      // gh: read verbs only. `gh run rerun`, `gh pr merge` etc. are excluded, and
+      // the nested-verb check in isReadOnlyCommand handles `gh pr view` vs `gh pr merge`.
+      gh: /* @__PURE__ */ new Set(["browse"])
+    };
+    var READ_ONLY_NESTED = {
+      gh: /* @__PURE__ */ new Set(["view", "list", "status", "diff", "checks"])
+    };
+    var SHELL_CONTROL = /[\n\r;&|`]|\$\(|>>|>|<\(/;
+    var isShort = (f3) => f3.startsWith("-") && !f3.startsWith("--");
+    var flagName = (f3) => f3.split("=")[0];
+    function toolFlagsOk(verb, args) {
+      const flags = args.filter((a) => a.startsWith("-"));
+      const pos = args.filter((a) => !a.startsWith("-"));
+      switch (verb) {
+        case "env":
+          return args.length === 0;
+        case "sort":
+          return !flags.some((f3) => isShort(f3) && /^-[A-Za-z]*o/.test(f3) || f3.startsWith("--output") || f3.startsWith("--compress-program"));
+        case "uniq":
+          return pos.length <= 1;
+        case "find":
+          return !args.some((a) => ["-exec", "-execdir", "-delete", "-ok", "-okdir", "-fprint", "-fprint0", "-fprintf", "-fls"].includes(a));
+        case "fd":
+          return !flags.some((f3) => f3.startsWith("--exec") || isShort(f3) && /^-[A-Za-z]*[xX]/.test(f3));
+        case "rg":
+          return !flags.some((f3) => flagName(f3) === "--pre" || f3.startsWith("--hostname-bin"));
+        case "ag":
+        case "ack":
+          return !flags.some((f3) => f3.startsWith("--pager"));
+        case "yq":
+          return !flags.some((f3) => isShort(f3) && /^-[A-Za-z]*i/.test(f3) || f3.startsWith("--inplace"));
+        case "tree":
+          return !flags.some((f3) => isShort(f3) && /^-[A-Za-z]*o/.test(f3));
+        case "date":
+          return !flags.some((f3) => isShort(f3) && /^-[A-Za-z]*s/.test(f3) || f3.startsWith("--set"));
+        case "hostname":
+          return pos.length === 0;
+        case "file":
+          return !flags.some((f3) => isShort(f3) && /^-[A-Za-z]*C/.test(f3) || f3.startsWith("--compile"));
+        default:
+          return true;
+      }
+    }
+    function flagsWithin(flags, shorts, longs) {
+      return flags.every((f3) => {
+        if (isShort(f3))
+          return [...f3.slice(1)].every((c) => shorts.includes(c) || /\d/.test(c));
+        return longs.includes(flagName(f3));
+      });
+    }
+    var LISTISH = ["-l", "--list", "--contains", "--no-contains", "--merged", "--no-merged", "--points-at"];
+    function subcommandFlagsOk(verb, sub, args) {
+      const flags = args.filter((a) => a.startsWith("-"));
+      const pos = args.filter((a) => !a.startsWith("-"));
+      const listish = flags.some((f3) => LISTISH.includes(flagName(f3)) || isShort(f3) && f3.includes("l"));
+      if (verb === "git") {
+        if (flags.some((f3) => f3.startsWith("--output") || f3 === "--ext-diff" || f3 === "-O" || f3.startsWith("--open-files-in-pager")))
+          return false;
+        switch (sub) {
+          case "branch":
+            return flagsWithin(flags, "arvlq", ["--all", "--remotes", "--verbose", "--list", "--show-current", "--contains", "--no-contains", "--merged", "--no-merged", "--points-at", "--sort", "--format", "--column", "--no-column", "--color", "--no-color", "--abbrev", "--no-abbrev", "--ignore-case", "--omit-empty"]) && (pos.length <= 1 || listish);
+          case "tag":
+            return flagsWithin(flags, "lnv", ["--list", "--contains", "--no-contains", "--merged", "--no-merged", "--points-at", "--sort", "--format", "--column", "--no-column", "--color", "--no-color", "--verify", "--ignore-case", "--omit-empty"]) && (pos.length <= 1 || listish || flags.some((f3) => f3 === "-v" || f3 === "--verify"));
+          case "remote":
+            return flagsWithin(flags, "vn", ["--verbose"]) && (pos[1] === void 0 || pos[1] === "show" || pos[1] === "get-url");
+          case "config":
+            return flagsWithin(flags, "lz", ["--get", "--get-all", "--get-regexp", "--list", "--show-origin", "--show-scope", "--global", "--local", "--system", "--worktree", "--name-only", "--null", "--includes", "--no-includes", "--type"]) && pos.length <= 2;
+          case "reflog":
+            return pos[1] !== "expire" && pos[1] !== "delete";
+          default:
             return true;
-          break;
         }
       }
-      return false;
+      if (sub === "config" && (verb === "npm" || verb === "pnpm" || verb === "yarn")) {
+        return pos[1] === void 0 || pos[1] === "get" || pos[1] === "list" || pos[1] === "ls";
+      }
+      if (verb === "go") {
+        return !flags.some((f3) => {
+          const n = f3.replace(/^--?/, "-");
+          return n === "-w" || n === "-u" || n.startsWith("-vettool") || n.startsWith("-toolexec") || n === "-exec";
+        });
+      }
+      return true;
+    }
+    function firstWords(command) {
+      return command.trim().split(/\s+/).filter(Boolean);
+    }
+    function isReadOnlyCommand(command) {
+      const cmd = command.trim();
+      if (!cmd)
+        return false;
+      if (SHELL_CONTROL.test(cmd))
+        return false;
+      const words = firstWords(cmd);
+      if (!words.length)
+        return false;
+      let i2 = 0;
+      while (i2 < words.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[i2])) {
+        if (UNSAFE_ENV.test(words[i2]))
+          return false;
+        i2++;
+      }
+      if (i2 >= words.length)
+        return false;
+      let verb = words[i2];
+      const slash = verb.lastIndexOf("/");
+      if (slash >= 0) {
+        if (!SYSTEM_BIN_DIRS.has(verb.slice(0, slash)))
+          return false;
+        verb = verb.slice(slash + 1);
+      }
+      if (verb === "sudo" || verb === "doas" || verb === "su")
+        return false;
+      const rest = words.slice(i2 + 1).filter((w) => !w.startsWith("-"));
+      const subs = READ_ONLY_SUBCOMMANDS[verb];
+      if (subs) {
+        const sub = rest[0];
+        if (!sub) {
+          return true;
+        }
+        if (subs.has(sub))
+          return subcommandFlagsOk(verb, sub, words.slice(i2 + 1));
+        const nested = READ_ONLY_NESTED[verb];
+        if (nested && rest[1] && nested.has(rest[1]) && (verb !== "gh" || GH_NOUNS.has(sub)))
+          return true;
+        return false;
+      }
+      if (!READ_ONLY_TOOLS.has(verb) && !READ_ONLY_BASH.has(verb))
+        return false;
+      if (verb === "node" || verb === "python" || verb === "python3") {
+        return words.slice(i2 + 1).every((w) => w === "--version" || w === "-V" || w === "-v");
+      }
+      if (!toolFlagsOk(verb, words.slice(i2 + 1)))
+        return false;
+      return true;
+    }
+    var HARMLESS_REDIRECT = /\s*\d?>\s*&\d\b|\s*\d?>>?\s*\/dev\/null(?=\s|$)/g;
+    function isReadOnlyPipeline(command) {
+      const cmd = command.replace(HARMLESS_REDIRECT, " ").trim();
+      if (!cmd)
+        return false;
+      if (/[>`]|\$\(|<\(/.test(cmd))
+        return false;
+      const segs = cmd.split(/\|\||&&|[;|\n\r]/).map((x2) => x2.trim()).filter(Boolean);
+      if (!segs.length)
+        return false;
+      return segs.every((seg) => !seg.includes("&") && isReadOnlyCommand(seg));
     }
+    function checkPlanMode(tool, input) {
+      if (tool === "bash") {
+        const command = typeof input.command === "string" ? input.command : "";
+        if (input.run_in_background === true) {
+          return {
+            reason: "bash-not-read-only",
+            message: "Plan mode is ON: background processes cannot be started. Finish researching and propose your plan; the user will leave plan mode if they want it carried out."
+          };
+        }
+        if (isReadOnlyCommand(command))
+          return null;
+        return {
+          reason: "bash-not-read-only",
+          message: `Plan mode is ON, so \`bash\` is limited to provably read-only commands and this one was not recognised as such (chained commands, redirection and command substitution are always refused). Do NOT ask the user to approve it and do NOT try a variation to get around this \u2014 it is a session-wide lock, not a per-call prompt. Use read-only inspection instead, and put the command in your plan as a step to run once plan mode is off.`
+        };
+      }
+      if (READ_ONLY_TOOLS.has(tool))
+        return null;
+      return {
+        reason: "mutating-tool",
+        message: `Plan mode is ON, so \`${tool}\` is unavailable \u2014 this session may not modify anything yet. Do NOT ask for approval: no answer the user gives at this prompt can unlock it, because it is a session-wide lock they control directly. Research with read-only tools and finish by proposing a concrete plan (files to change, in order, and how to verify). The user will exit plan mode to let you carry it out.`
+      };
+    }
+    exports2.PLAN_MODE_INSTRUCTIONS = [
+      "# PLAN MODE IS ACTIVE",
+      "",
+      "This session is READ-ONLY. You cannot edit files, write files, run mutating commands, or start",
+      "background processes. This is enforced outside your control \u2014 it is not a permission prompt, and",
+      "the user cannot approve an exception from inside this turn.",
+      "",
+      "Therefore:",
+      '- NEVER ask "shall I go ahead and make this change?" \u2014 you cannot, whatever the answer.',
+      '- NEVER attempt a mutating tool "just to see" \u2014 it will be refused and wastes the turn.',
+      "- NEVER try to reach a blocked command another way (a different flag, a script, an interpreter).",
+      "",
+      "Your job is to research thoroughly, then deliver a plan:",
+      "1. What you found \u2014 the specific files, functions and line numbers that matter.",
+      "2. What you propose to change \u2014 file by file, in dependency order.",
+      "3. Risks and unknowns \u2014 what could break, what you could not verify, what you assumed.",
+      "4. How it will be verified \u2014 the exact build/test/lint command that proves it works.",
+      "",
+      'Be concrete. "Update the auth logic" is not a plan; "add a `refreshToken` field to AuthConfig in',
+      'auth/index.ts:42, then thread it through client.ts:118" is. The user will review the plan and',
+      "leave plan mode to have it carried out."
+    ].join("\n");
   }
 });
 
@@ -105027,11 +105328,11 @@ var require_modePolicy = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.BASH_TOOLS = exports2.FILE_MUTATE_TOOLS = exports2.FILE_WRITE_TOOLS = exports2.READ_ONLY_TOOLS = void 0;
-    exports2.isReadOnlyBash = isReadOnlyBash;
+    exports2.isReadOnlyBash = isReadOnlyBash2;
     exports2.decide = decide;
     exports2.describeMode = describeMode2;
     exports2.parseMode = parseMode2;
-    var bashClassify_1 = require_bashClassify();
+    var planMode_1 = require_planMode();
     exports2.READ_ONLY_TOOLS = /* @__PURE__ */ new Set([
       "read_file",
       "list_directory",
@@ -105071,15 +105372,15 @@ var require_modePolicy = __commonJS({
       "copy_file"
     ]);
     exports2.BASH_TOOLS = /* @__PURE__ */ new Set(["bash", "run_command", "execute_command"]);
-    function isReadOnlyBash(command) {
-      return !(0, bashClassify_1.bashNeedsRepoLock)(command);
+    function isReadOnlyBash2(command) {
+      return (0, planMode_1.isReadOnlyPipeline)(command);
     }
     function decide(req) {
       const { tool, mode } = req;
       const command = String(req.input.command ?? req.input.cmd ?? "");
       if (exports2.READ_ONLY_TOOLS.has(tool))
         return "allow";
-      if (exports2.BASH_TOOLS.has(tool) && isReadOnlyBash(command) && !req.destructive)
+      if (exports2.BASH_TOOLS.has(tool) && isReadOnlyBash2(command) && !req.destructive)
         return "allow";
       if (req.destructive)
         return "confirm";
@@ -105310,261 +105611,60 @@ var require_destructive = __commonJS({
   }
 });
 
-// ../core/dist/agent/planMode.js
-var require_planMode = __commonJS({
-  "../core/dist/agent/planMode.js"(exports2) {
+// ../core/dist/permissions/bashClassify.js
+var require_bashClassify = __commonJS({
+  "../core/dist/permissions/bashClassify.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.PLAN_MODE_INSTRUCTIONS = void 0;
-    exports2.isReadOnlyCommand = isReadOnlyCommand;
-    exports2.checkPlanMode = checkPlanMode;
-    var READ_ONLY_TOOLS = /* @__PURE__ */ new Set([
-      "read_file",
-      "search_files",
-      "glob",
-      "list_directory",
-      "notebook_read",
-      // Planning bookkeeping. todo_write persists only to the session's own todo
-      // list, not the repo, so it stays available — a plan mode that cannot draft
-      // a checklist is missing the point of plan mode.
-      "todo_write",
-      "todo_read",
-      // Reading memory is fine; memory_write is NOT here on purpose. Memory is
-      // durable state that survives the session, so writing it is a real mutation
-      // even though no file in the repo changes.
-      "memory_read",
-      "use_skill",
-      "fetch_url",
-      "web_search",
-      // Delegating research is ALLOWED, and this is safe rather than a hole:
-      // runSubTask passes planMode down, so the sub-agent is under the same lock and
-      // its own write tools are refused by this very function one level deeper.
-      //
-      // Worth allowing rather than blanket-refusing, because plan mode exists to
-      // support deep research and the explorer agent is the cheapest way to do bulk
-      // searching without flooding the main context. Blocking `task` would have made
-      // the mode's headline use case worse, for no security gain.
-      "task",
-      // VS Code language server — all pure queries.
-      "get_symbols",
-      "get_workspace_symbols",
-      "find_references",
-      "go_to_definition",
-      "get_hover",
-      "get_diagnostics",
-      // Reading output from an ALREADY-running background shell. Starting one is
-      // gated with the rest of bash below; draining a buffer is not a new effect.
-      "bash_output"
-    ]);
-    var READ_ONLY_BASH = /* @__PURE__ */ new Set([
-      "ls",
-      "cat",
-      "head",
-      "tail",
-      "wc",
-      "file",
-      "stat",
-      "du",
-      "df",
-      "pwd",
-      "which",
-      "type",
-      "echo",
-      "printf",
-      "basename",
-      "dirname",
-      "realpath",
-      "readlink",
-      "grep",
-      "egrep",
-      "fgrep",
-      "rg",
-      "ag",
-      "ack",
-      "find",
-      "fd",
-      "locate",
-      "diff",
-      "comm",
-      "cmp",
-      "sort",
-      "uniq",
-      "cut",
-      "tr",
-      "column",
-      "jq",
-      "yq",
-      "date",
-      "whoami",
-      "hostname",
-      "uname",
-      "env",
-      "printenv",
-      "id",
-      "groups",
-      "ps",
-      "top",
-      "uptime",
-      "free",
-      "node",
-      "python",
-      "python3",
-      "tree",
-      "less",
-      "more",
-      "nl",
-      "tac",
-      "strings",
-      "md5sum",
-      "sha256sum",
-      "true",
-      "false",
-      "test",
-      "sleep",
-      "seq",
-      "expr"
+    exports2.bashNeedsRepoLock = bashNeedsRepoLock;
+    var MUTATING_BASH_VERBS = /* @__PURE__ */ new Set([
+      "git",
+      "npm",
+      "pnpm",
+      "yarn",
+      "bun",
+      "cargo",
+      "go",
+      "pip",
+      "pip3",
+      "poetry",
+      "uv",
+      "bundle",
+      "composer",
+      "gradle",
+      "mvn",
+      "make",
+      "terraform",
+      "helm",
+      "docker",
+      "vsce",
+      "tsc",
+      "pytest",
+      "dotnet",
+      "swift",
+      "gem"
     ]);
-    var READ_ONLY_SUBCOMMANDS = {
-      git: /* @__PURE__ */ new Set([
-        "log",
-        "show",
-        "diff",
-        "status",
-        "blame",
-        "branch",
-        "tag",
-        "remote",
-        "describe",
-        "rev-parse",
-        "rev-list",
-        "ls-files",
-        "ls-tree",
-        "ls-remote",
-        "cat-file",
-        "shortlog",
-        "reflog",
-        "whatchanged",
-        "grep",
-        "config",
-        "check-ignore",
-        "merge-base",
-        "name-rev",
-        "count-objects",
-        "verify-commit"
-      ]),
-      // Package managers: only their query verbs.
-      npm: /* @__PURE__ */ new Set(["ls", "list", "view", "info", "outdated", "why", "config", "ping", "search"]),
-      pnpm: /* @__PURE__ */ new Set(["ls", "list", "view", "info", "outdated", "why", "config"]),
-      yarn: /* @__PURE__ */ new Set(["list", "info", "why", "config"]),
-      cargo: /* @__PURE__ */ new Set(["tree", "metadata", "search"]),
-      go: /* @__PURE__ */ new Set(["list", "version", "env", "vet", "doc"]),
-      docker: /* @__PURE__ */ new Set(["ps", "images", "logs", "inspect", "version", "info", "top", "port", "diff", "stats"]),
-      kubectl: /* @__PURE__ */ new Set(["get", "describe", "logs", "explain", "top", "version", "api-resources", "api-versions"]),
-      // gh: read verbs only. `gh run rerun`, `gh pr merge` etc. are excluded, and
-      // the nested-verb check in isReadOnlyCommand handles `gh pr view` vs `gh pr merge`.
-      gh: /* @__PURE__ */ new Set(["browse"])
-    };
-    var READ_ONLY_NESTED = {
-      gh: /* @__PURE__ */ new Set(["view", "list", "status", "diff", "checks"])
-    };
-    var SHELL_CONTROL = /[\n\r;&|`]|\$\(|>>|>|<\(/;
-    function firstWords(command) {
-      return command.trim().split(/\s+/).filter(Boolean);
-    }
-    function isReadOnlyCommand(command) {
-      const cmd = command.trim();
-      if (!cmd)
-        return false;
-      if (SHELL_CONTROL.test(cmd))
-        return false;
-      const words = firstWords(cmd);
-      if (!words.length)
-        return false;
-      let i2 = 0;
-      while (i2 < words.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[i2]))
-        i2++;
-      if (i2 >= words.length)
-        return false;
-      let verb = words[i2];
-      const slash = verb.lastIndexOf("/");
-      if (slash >= 0)
-        verb = verb.slice(slash + 1);
-      if (verb === "sudo" || verb === "doas" || verb === "su")
-        return false;
-      const rest = words.slice(i2 + 1).filter((w) => !w.startsWith("-"));
-      const subs = READ_ONLY_SUBCOMMANDS[verb];
-      if (subs) {
-        const sub = rest[0];
-        if (!sub) {
-          return true;
-        }
-        if (subs.has(sub)) {
-          if (verb === "git" && sub === "config") {
-            const args = words.slice(i2 + 2).filter((w) => !w.startsWith("-"));
-            return args.length <= 1;
-          }
-          return true;
-        }
-        const nested = READ_ONLY_NESTED[verb];
-        if (nested && rest[1] && nested.has(rest[1]))
-          return true;
-        return false;
-      }
-      if (!READ_ONLY_TOOLS.has(verb) && !READ_ONLY_BASH.has(verb))
-        return false;
-      if (verb === "node" || verb === "python" || verb === "python3") {
-        return words.slice(i2 + 1).every((w) => w === "--version" || w === "-V" || w === "-v");
-      }
-      if (verb === "find" && words.some((w) => w === "-exec" || w === "-execdir" || w === "-delete")) {
+    function bashNeedsRepoLock(command) {
+      if (!command)
         return false;
-      }
-      return true;
-    }
-    function checkPlanMode(tool, input) {
-      if (tool === "bash") {
-        const command = typeof input.command === "string" ? input.command : "";
-        if (input.run_in_background === true) {
-          return {
-            reason: "bash-not-read-only",
-            message: "Plan mode is ON: background processes cannot be started. Finish researching and propose your plan; the user will leave plan mode if they want it carried out."
-          };
+      const segments = command.split(/\|\||&&|[;|&\n()]|\$\(/);
+      for (const seg of segments) {
+        for (const tokenRaw of seg.trim().split(/\s+/)) {
+          const token = tokenRaw.replace(/^["']|["']$/g, "");
+          if (!token)
+            continue;
+          if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(token))
+            continue;
+          if (token === "sudo" || token === "time" || token === "nice" || token === "env")
+            continue;
+          const verb = token.split("/").pop() ?? token;
+          if (MUTATING_BASH_VERBS.has(verb))
+            return true;
+          break;
         }
-        if (isReadOnlyCommand(command))
-          return null;
-        return {
-          reason: "bash-not-read-only",
-          message: `Plan mode is ON, so \`bash\` is limited to provably read-only commands and this one was not recognised as such (chained commands, redirection and command substitution are always refused). Do NOT ask the user to approve it and do NOT try a variation to get around this \u2014 it is a session-wide lock, not a per-call prompt. Use read-only inspection instead, and put the command in your plan as a step to run once plan mode is off.`
-        };
       }
-      if (READ_ONLY_TOOLS.has(tool))
-        return null;
-      return {
-        reason: "mutating-tool",
-        message: `Plan mode is ON, so \`${tool}\` is unavailable \u2014 this session may not modify anything yet. Do NOT ask for approval: no answer the user gives at this prompt can unlock it, because it is a session-wide lock they control directly. Research with read-only tools and finish by proposing a concrete plan (files to change, in order, and how to verify). The user will exit plan mode to let you carry it out.`
-      };
+      return false;
     }
-    exports2.PLAN_MODE_INSTRUCTIONS = [
-      "# PLAN MODE IS ACTIVE",
-      "",
-      "This session is READ-ONLY. You cannot edit files, write files, run mutating commands, or start",
-      "background processes. This is enforced outside your control \u2014 it is not a permission prompt, and",
-      "the user cannot approve an exception from inside this turn.",
-      "",
-      "Therefore:",
-      '- NEVER ask "shall I go ahead and make this change?" \u2014 you cannot, whatever the answer.',
-      '- NEVER attempt a mutating tool "just to see" \u2014 it will be refused and wastes the turn.',
-      "- NEVER try to reach a blocked command another way (a different flag, a script, an interpreter).",
-      "",
-      "Your job is to research thoroughly, then deliver a plan:",
-      "1. What you found \u2014 the specific files, functions and line numbers that matter.",
-      "2. What you propose to change \u2014 file by file, in dependency order.",
-      "3. Risks and unknowns \u2014 what could break, what you could not verify, what you assumed.",
-      "4. How it will be verified \u2014 the exact build/test/lint command that proves it works.",
-      "",
-      'Be concrete. "Update the auth logic" is not a plan; "add a `refreshToken` field to AuthConfig in',
-      'auth/index.ts:42, then thread it through client.ts:118" is. The user will review the plan and',
-      "leave plan mode to have it carried out."
-    ].join("\n");
   }
 });
 
@@ -145175,7 +145275,7 @@ var chalkStderr = createChalk({ level: stderrColor ? stderrColor.level : 0 });
 var source_default = chalk;
 
 // src/index.ts
-var import_code_core9 = __toESM(require_dist3(), 1);
+var import_code_core10 = __toESM(require_dist3(), 1);
 
 // src/commands/auth.ts
 import * as readline from "readline";
@@ -145392,7 +145492,7 @@ import * as crypto4 from "crypto";
 import { createRequire } from "module";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { execSync, execFileSync as execFileSync3 } from "child_process";
-var import_code_core6 = __toESM(require_dist3(), 1);
+var import_code_core7 = __toESM(require_dist3(), 1);
 
 // ../../node_modules/.pnpm/ansi-regex@6.2.2/node_modules/ansi-regex/index.js
 function ansiRegex({ onlyFirst = false } = {}) {
@@ -146350,17 +146450,9 @@ function showDiff(filePath, oldContent, newContent) {
 }
 
 // src/permissions/risk.ts
+var import_code_core3 = __toESM(require_dist3(), 1);
 import * as path from "path";
 var HIGH_BASH = /\b(sudo|rm|rmdir|chmod|chown|dd|mkfs|kill|killall|pkill|shutdown|reboot)\b|\b(curl|wget)\b[^|]*\|\s*(sudo\s+)?(ba|z)?sh\b|\b(ssh|scp|rsync)\b|\bgit\s+(push|reset\s+--hard|clean)\b/;
-var READ_VERBS = /* @__PURE__ */ new Set(["ls", "cat", "head", "tail", "wc", "pwd", "echo", "which", "grep", "rg", "find", "stat", "file", "du", "df", "tree", "diff", "sort", "uniq", "date", "whoami"]);
-function looksReadOnly(cmd) {
-  if (/[>`]|\$\(|\bfind\b[^|;&]*\s-(delete|exec|execdir)\b/.test(cmd))
-    return false;
-  return cmd.split(/\|\||&&|[;|&\n]/).every((seg) => {
-    const verb = seg.trim().split(/\s+/)[0] ?? "";
-    return verb === "" || READ_VERBS.has(verb.split("/").pop());
-  });
-}
 function outsideProject(p, workDir) {
   if (!p)
     return false;
@@ -146376,7 +146468,7 @@ function assessRisk(tool, input, workDir, fileExists) {
     const cmd = String(input.command ?? input.cmd ?? "");
     if (HIGH_BASH.test(cmd))
       return { risk: "high", detail: `can delete, overwrite or reach the network${out}` };
-    if (looksReadOnly(cmd))
+    if ((0, import_code_core3.isReadOnlyBash)(cmd))
       return { risk: "low", detail: "read-only command" };
     return { risk: "medium", detail: "runs code that may change files" };
   }
@@ -146396,18 +146488,18 @@ function assessRisk(tool, input, workDir, fileExists) {
 }
 
 // src/permissions/handler.ts
-var import_code_core3 = __toESM(require_dist3(), 1);
+var import_code_core4 = __toESM(require_dist3(), 1);
 var autoApproved = /* @__PURE__ */ new Set();
 var _rules = { allow: [], ask: [], deny: [] };
 var _workDir = process.cwd();
 var _mode = "ask";
 function initPermissions(workDir) {
   _workDir = workDir;
-  _rules = (0, import_code_core3.loadSettings)(workDir).permissions;
+  _rules = (0, import_code_core4.loadSettings)(workDir).permissions;
   return _rules;
 }
 function setMode(mode) {
-  _mode = (0, import_code_core3.parseMode)(mode);
+  _mode = (0, import_code_core4.parseMode)(mode);
 }
 function setAutoApprove(category) {
   autoApproved.add(category);
@@ -146485,12 +146577,12 @@ function announceAgent(req) {
 }
 async function requestPermission(req) {
   const { tool, input } = req;
-  const decision = (0, import_code_core3.evaluatePermission)(_rules, tool, input, _workDir);
+  const decision = (0, import_code_core4.evaluatePermission)(_rules, tool, input, _workDir);
   if (decision === "deny") {
     console.error(source_default.red(`  \u2716 Denied by permission rule: ${tool}`));
     return false;
   }
-  const destructive = (0, import_code_core3.isDestructiveBash)(tool, input);
+  const destructive = (0, import_code_core4.isDestructiveBash)(tool, input);
   if (destructive && process.env.NEXRALL_ALLOW_DESTRUCTIVE !== "1") {
     return serialisePrompt(async () => {
       announceAgent(req);
@@ -146511,7 +146603,7 @@ async function requestPermission(req) {
   }
   if (decision === "allow")
     return true;
-  const verdict = (0, import_code_core3.decide)({
+  const verdict = (0, import_code_core4.decide)({
     tool,
     input,
     mode: _mode,
@@ -146671,7 +146763,7 @@ async function askFlow(req) {
 }
 
 // src/audit.ts
-var import_code_core4 = __toESM(require_dist3(), 1);
+var import_code_core5 = __toESM(require_dist3(), 1);
 import * as path2 from "path";
 var _state;
 var _sinks = /* @__PURE__ */ new Map();
@@ -146691,7 +146783,7 @@ function currentAudit() {
   const target = resolveAuditPath(_state);
   let sink = _sinks.get(target);
   if (!sink) {
-    sink = (0, import_code_core4.createJsonlAuditSink)(target);
+    sink = (0, import_code_core5.createJsonlAuditSink)(target);
     _sinks.set(target, sink);
   }
   const cfg = {
@@ -146704,14 +146796,14 @@ function currentAudit() {
     // request that caused it. Same trap as @nexrall/agent's and Desktop's.
     sessionId: _state.getSessionId()
   };
-  const email = (0, import_code_core4.loadAuth)()?.email;
+  const email = (0, import_code_core5.loadAuth)()?.email;
   if (email)
     cfg.userId = email;
   return cfg;
 }
 
 // src/commands/chat.ts
-var import_code_core7 = __toESM(require_dist3(), 1);
+var import_code_core8 = __toESM(require_dist3(), 1);
 
 // src/commands/sessions.ts
 import * as fs3 from "fs";
@@ -147145,7 +147237,7 @@ async function updateCommand(opts) {
 }
 
 // src/commands/sessionTools.ts
-var import_code_core5 = __toESM(require_dist3(), 1);
+var import_code_core6 = __toESM(require_dist3(), 1);
 import { spawnSync, execFileSync } from "child_process";
 import fs5 from "fs";
 import path6 from "path";
@@ -147205,7 +147297,7 @@ function nextMode(current) {
   return MODE_CYCLE[(i2 + 1) % MODE_CYCLE.length];
 }
 function textOf(m2) {
-  return m2.content.filter((b) => b.type === "text" && !(0, import_code_core5.isRuntimeContextBlock)(b)).map((b) => b.text).join("\n").trim();
+  return m2.content.filter((b) => b.type === "text" && !(0, import_code_core6.isRuntimeContextBlock)(b)).map((b) => b.text).join("\n").trim();
 }
 function lastAssistantText(messages) {
   for (let i2 = messages.length - 1; i2 >= 0; i2--) {
@@ -147231,7 +147323,7 @@ function exportMarkdown(messages, meta) {
   for (const m2 of messages) {
     const parts = [];
     for (const b of m2.content) {
-      if ((0, import_code_core5.isRuntimeContextBlock)(b))
+      if ((0, import_code_core6.isRuntimeContextBlock)(b))
         continue;
       if (b.type === "text") {
         if (b.text.trim())
@@ -158021,7 +158113,7 @@ var MODEL_COST_MULTIPLIER = {
   "glm-5.3": 0.6
 };
 function modelWithCostHint(id) {
-  const mult = (0, import_code_core6.liveCostMultiplierFor)(id, MODEL_COST_MULTIPLIER[id]);
+  const mult = (0, import_code_core7.liveCostMultiplierFor)(id, MODEL_COST_MULTIPLIER[id]);
   return mult === void 0 ? id : `${id} (${mult}x)`;
 }
 var NO_VISION_MODELS = /* @__PURE__ */ new Set(["qwen3.7-max", "glm-5.3"]);
@@ -158037,13 +158129,13 @@ var NO_PDF_MODELS = /* @__PURE__ */ new Set([
   ...NO_VISION_MODELS
 ]);
 function needsVisionSidecar(model) {
-  return !(0, import_code_core6.liveSupportsImageInput)(model, !NO_VISION_MODELS.has(model));
+  return !(0, import_code_core7.liveSupportsImageInput)(model, !NO_VISION_MODELS.has(model));
 }
 function needsPdfSidecar(model) {
-  return !(0, import_code_core6.liveSupportsPdfInput)(model, !NO_PDF_MODELS.has(model));
+  return !(0, import_code_core7.liveSupportsPdfInput)(model, !NO_PDF_MODELS.has(model));
 }
 function selectableModelIds() {
-  return (0, import_code_core6.liveSelectableModelIds)() ?? SELECTABLE_MODELS;
+  return (0, import_code_core7.liveSelectableModelIds)() ?? SELECTABLE_MODELS;
 }
 function normaliseModelId(model) {
   const raw = (model ?? "").trim();
@@ -158104,9 +158196,9 @@ var _BACKEND_STYLE_TO_LOCAL = {
 };
 function effortStyleFor(modelId) {
   const id = normaliseModelId(modelId);
-  if ((0, import_code_core6.liveVendorFor)(id) === "Anthropic")
+  if ((0, import_code_core7.liveVendorFor)(id) === "Anthropic")
     return "anthropic";
-  const liveStyle = (0, import_code_core6.liveReasoningEffortStyle)(id);
+  const liveStyle = (0, import_code_core7.liveReasoningEffortStyle)(id);
   if (liveStyle && _BACKEND_STYLE_TO_LOCAL[liveStyle])
     return _BACKEND_STYLE_TO_LOCAL[liveStyle];
   return MODEL_EFFORT_STYLE[id] ?? "anthropic";
@@ -158126,7 +158218,7 @@ function defaultEffortForModel(modelId) {
 }
 function resolveModelLabel(alias) {
   const id = normaliseModelId(alias);
-  return (0, import_code_core6.liveLabelFor)(id, MODEL_LABELS[id] ?? id);
+  return (0, import_code_core7.liveLabelFor)(id, MODEL_LABELS[id] ?? id);
 }
 function tryExec(cmd, cwd2) {
   try {
@@ -158200,7 +158292,7 @@ var tryRead = (p) => {
 };
 function readNexrallMd(workDir) {
   const parts = [];
-  const memContent = (0, import_code_core6.readAllMemory)(workDir);
+  const memContent = (0, import_code_core7.readAllMemory)(workDir);
   if (memContent)
     parts.push(memContent);
   const globalContent = tryRead(path9.join(os6.homedir(), ".nexrall", "nexrall.md"));
@@ -158307,7 +158399,7 @@ var Spinner = class {
     return this.interval !== null;
   }
 };
-var cliBackgroundAgents = new import_code_core6.BackgroundAgentHub();
+var cliBackgroundAgents = new import_code_core7.BackgroundAgentHub();
 function nextBackgroundChange() {
   return new Promise((resolve6) => {
     const off = cliBackgroundAgents.onChange(() => {
@@ -158319,12 +158411,12 @@ function nextBackgroundChange() {
 var _mcpManager = null;
 var _mcpConfig = null;
 async function initMcp(workDir) {
-  _mcpConfig = import_code_core6.McpManager.loadConfig(workDir);
+  _mcpConfig = import_code_core7.McpManager.loadConfig(workDir);
   if (Object.keys(_mcpConfig.mcpServers).length === 0) {
     _mcpManager = null;
     return;
   }
-  const manager = new import_code_core6.McpManager();
+  const manager = new import_code_core7.McpManager();
   await manager.connectAll(_mcpConfig);
   _mcpManager = manager;
 }
@@ -158345,10 +158437,10 @@ function formatMcpStatus() {
   return lines.join("\n");
 }
 function formatContextUsage(messages, modelAlias) {
-  const window2 = (0, import_code_core6.contextWindowFor)(modelAlias);
-  const tokens = (0, import_code_core6.estimateTokensRough)(messages);
-  const bytes = (0, import_code_core6.estimateBodyBytes)(messages);
-  const { prune, compact } = (0, import_code_core6.compactionThresholds)(window2);
+  const window2 = (0, import_code_core7.contextWindowFor)(modelAlias);
+  const tokens = (0, import_code_core7.estimateTokensRough)(messages);
+  const bytes = (0, import_code_core7.estimateBodyBytes)(messages);
+  const { prune, compact } = (0, import_code_core7.compactionThresholds)(window2);
   const pct = Math.min(100, tokens / window2 * 100);
   const barWidth = 30;
   const filled = Math.round(pct / 100 * barWidth);
@@ -158365,7 +158457,7 @@ function formatContextUsage(messages, modelAlias) {
   return lines.join("\n");
 }
 function formatAgentsList(workDir) {
-  const { types: types3, warnings } = (0, import_code_core6.loadAgentTypesWithWarnings)(workDir);
+  const { types: types3, warnings } = (0, import_code_core7.loadAgentTypesWithWarnings)(workDir);
   if (!types3.length)
     return source_default.dim("  No agent types found (this should not happen \u2014 builtins always register).");
   const lines = types3.map((t2) => {
@@ -158414,7 +158506,7 @@ async function runTurn(messages, modelAlias, workDir, abortSignal, env4, nexrall
   setMode(mode);
   console.log();
   spinner.start("thinking\u2026", { hint: false });
-  const result = await (0, import_code_core6.runAgentLoop)(messages, {
+  const result = await (0, import_code_core7.runAgentLoop)(messages, {
     workDir,
     model: modelAlias,
     env: refreshEnvForTurn(env4, workDir),
@@ -158624,7 +158716,7 @@ async function runTurnHeadless(messages, modelAlias, workDir, _abortSignal, env4
       process.stdout.write(JSON.stringify(obj2) + "\n");
   };
   emit({ type: "start", model: modelAlias, workDir });
-  const result = await (0, import_code_core6.runAgentLoop)(messages, {
+  const result = await (0, import_code_core7.runAgentLoop)(messages, {
     workDir,
     model: modelAlias,
     env: refreshEnvForTurn(env4, workDir),
@@ -158722,7 +158814,7 @@ async function runTurnHeadless(messages, modelAlias, workDir, _abortSignal, env4
     // no human to confirm, they are denied unless NEXRALL_ALLOW_DESTRUCTIVE=1 is
     // explicitly set for this CI run.
     requestPermission: async ({ tool, input }) => {
-      const d = (0, import_code_core6.isDestructiveBash)(tool, input);
+      const d = (0, import_code_core7.isDestructiveBash)(tool, input);
       if (d && process.env.NEXRALL_ALLOW_DESTRUCTIVE !== "1") {
         emit({ type: "error", error: `Destructive command blocked in headless mode (${d.category}): ${d.reason}. Set NEXRALL_ALLOW_DESTRUCTIVE=1 to permit.` });
         return false;
@@ -158838,7 +158930,7 @@ function printSessions() {
   console.log();
 }
 async function startChatSession(options) {
-  (0, import_code_core6.enableAgentTranscriptPersistence)();
+  (0, import_code_core7.enableAgentTranscriptPersistence)();
   const headless = options.outputFormat === "json" || options.outputFormat === "stream-json";
   const requestedWorkDir = options.workDir;
   let workDir = requestedWorkDir;
@@ -158847,7 +158939,7 @@ async function startChatSession(options) {
   let peerInbox;
   const peerInboxQueue = [];
   let modelAlias = options.model;
-  void (0, import_code_core6.getModelCatalogue)().catch(() => {
+  void (0, import_code_core7.getModelCatalogue)().catch(() => {
   });
   const canPrompt = !headless && !options.prompt && !options.stdinText && process.stdin.isTTY === true && process.stdout.isTTY === true;
   if (!trustGrantedByEnv()) {
@@ -158875,9 +158967,9 @@ Set ${TRUST_ENV_VAR}=1 to confirm non-interactively, or run \`nex\` interactivel
   }
   if (options.worktree !== void 0) {
     const requestedName = typeof options.worktree === "string" ? options.worktree : void 0;
-    const existing = requestedName ? (0, import_code_core6.findWorktreeByName)(requestedWorkDir, requestedName) : null;
+    const existing = requestedName ? (0, import_code_core7.findWorktreeByName)(requestedWorkDir, requestedName) : null;
     if (existing) {
-      const entered = (0, import_code_core6.enterWorktree)(existing);
+      const entered = (0, import_code_core7.enterWorktree)(existing);
       if (!entered.ok) {
         process.stderr.write(`Failed to resume worktree "${requestedName}": ${entered.error}
 `);
@@ -158887,7 +158979,7 @@ Set ${TRUST_ENV_VAR}=1 to confirm non-interactively, or run \`nex\` interactivel
       if (!headless)
         console.log(source_default.dim(`  Resumed worktree: ${source_default.bold(existing.name)} (${existing.worktreePath})`));
     } else {
-      const created = (0, import_code_core6.createWorktree)(requestedWorkDir, requestedName);
+      const created = (0, import_code_core7.createWorktree)(requestedWorkDir, requestedName);
       if (!created.ok || !created.state) {
         process.stderr.write(`Failed to create worktree: ${created.error ?? "unknown error"}
 `);
@@ -158906,7 +158998,7 @@ Set ${TRUST_ENV_VAR}=1 to confirm non-interactively, or run \`nex\` interactivel
     process.on("exit", () => {
       if (!worktreeState)
         return;
-      const hadWork = (0, import_code_core6.worktreeHasWork)(worktreeState);
+      const hadWork = (0, import_code_core7.worktreeHasWork)(worktreeState);
       if (hadWork) {
         process.stderr.write(
           `
@@ -158917,7 +159009,7 @@ Resume it with: nex --worktree ${worktreeState.name}
         );
         return;
       }
-      (0, import_code_core6.removeWorktree)(worktreeState);
+      (0, import_code_core7.removeWorktree)(worktreeState);
     });
   }
   const env4 = collectEnv(workDir);
@@ -158925,8 +159017,8 @@ Resume it with: nex --worktree ${worktreeState.name}
   const interactive = !headless && !options.prompt && !options.stdinText;
   let peerHeartbeatTimer;
   if (interactive) {
-    const handle2 = (0, import_code_core6.registerPeer)({ clientType: "cli", workDir: requestedWorkDir });
-    const inbox = (0, import_code_core6.startPeerInbox)(handle2.record.id, { onMessage: (m2) => peerInboxQueue.push(m2) });
+    const handle2 = (0, import_code_core7.registerPeer)({ clientType: "cli", workDir: requestedWorkDir });
+    const inbox = (0, import_code_core7.startPeerInbox)(handle2.record.id, { onMessage: (m2) => peerInboxQueue.push(m2) });
     handle2.record.socketPath = inbox.socketPath;
     handle2.heartbeat();
     peerHandle = handle2;
@@ -158996,7 +159088,7 @@ Resume it with: nex --worktree ${worktreeState.name}
   const ruleCount = permRules.allow.length + permRules.ask.length + permRules.deny.length;
   if (ruleCount && !headless)
     console.log(source_default.dim(`  ${ruleCount} permission rule(s) loaded`));
-  let skills = (0, import_code_core6.loadSkills)(workDir);
+  let skills = (0, import_code_core7.loadSkills)(workDir);
   if (skills.length && !headless)
     console.log(source_default.dim(`  ${skills.length} skill(s) loaded`));
   const mcpStarted = (async () => {
@@ -159028,7 +159120,7 @@ Resume it with: nex --worktree ${worktreeState.name}
     sessionId = stored.id;
     sessionTitle = stored.title;
     try {
-      const compacted = await (0, import_code_core6.compactMessagesForResume)(messages, {
+      const compacted = await (0, import_code_core7.compactMessagesForResume)(messages, {
         workDir,
         model: modelAlias,
         clientType: "cli"
@@ -159042,7 +159134,7 @@ Resume it with: nex --worktree ${worktreeState.name}
       console.log();
     }
   }
-  const checkpoints = new import_code_core6.CheckpointManager(workDir, sessionId);
+  const checkpoints = new import_code_core7.CheckpointManager(workDir, sessionId);
   if (options.audit) {
     const auditPath = enableAudit({
       filePath: typeof options.audit === "string" ? options.audit : void 0,
@@ -159060,7 +159152,7 @@ Resume it with: nex --worktree ${worktreeState.name}
     sessionTitle = raw.length > 60 ? raw.slice(0, 60) + "\u2026" : raw;
   };
   const recoverTurn = (err, current) => {
-    const salvaged = (0, import_code_core6.salvageHistory)(err);
+    const salvaged = (0, import_code_core7.salvageHistory)(err);
     console.error("\n" + source_default.red("Error: ") + String(err.message));
     if (!salvaged)
       return current;
@@ -159110,7 +159202,7 @@ ${text}` : "");
           continue;
         }
         const notes = cliBackgroundAgents.takeNotifications();
-        messages.push({ role: "user", content: [{ type: "text", text: (0, import_code_core6.formatBackgroundNotifications)(notes) }] });
+        messages.push({ role: "user", content: [{ type: "text", text: (0, import_code_core7.formatBackgroundNotifications)(notes) }] });
         result = await runOnce();
         messages = result.messages;
       }
@@ -159122,7 +159214,7 @@ ${text}` : "");
       await new Promise((r2) => setImmediate(r2));
       process.exit(0);
     } catch (err) {
-      const salvaged = (0, import_code_core6.salvageHistory)(err);
+      const salvaged = (0, import_code_core7.salvageHistory)(err);
       if (salvaged) {
         messages = salvaged;
         try {
@@ -159153,11 +159245,11 @@ ${text}` : "");
   console.log(source_default.dim("  Type a message, /help for commands, or Ctrl+C to exit."));
   console.log();
   const footerExtras = () => {
-    const win = (0, import_code_core6.contextWindowFor)(modelAlias);
+    const win = (0, import_code_core7.contextWindowFor)(modelAlias);
     return {
       model: resolveModelLabel(modelAlias),
       branch: gitBranch(workDir) ?? void 0,
-      ctxPct: messages.length ? Math.min(100, (0, import_code_core6.estimateTokensRough)(messages) / win * 100) : 0,
+      ctxPct: messages.length ? Math.min(100, (0, import_code_core7.estimateTokensRough)(messages) / win * 100) : 0,
       costUsd: sessionUsage.costReported ? sessionUsage.cost : void 0
     };
   };
@@ -159201,7 +159293,7 @@ ${text}` : "");
   updateFooter();
   const syncSlashMenu = () => {
     if (interactive)
-      getInkTerminal().setSlashEntries([...BUILTIN_SLASH_COMMANDS, ...skillEntries((0, import_code_core6.userInvokableSkills)(skills))]);
+      getInkTerminal().setSlashEntries([...BUILTIN_SLASH_COMMANDS, ...skillEntries((0, import_code_core7.userInvokableSkills)(skills))]);
   };
   syncSlashMenu();
   if (interactive) {
@@ -159251,7 +159343,7 @@ ${text}` : "");
           messages = [];
           sessionId = crypto4.randomBytes(8).toString("hex");
           sessionTitle = "";
-          (0, import_code_core7.resetSessionSubAgentBudget)();
+          (0, import_code_core8.resetSessionSubAgentBudget)();
           sessionUsage.reset();
           cliBackgroundAgents.stopAll({ dropPending: true });
           inputBuffer = "";
@@ -159291,7 +159383,7 @@ ${text}` : "");
           sessionTitle = stored.title;
           sessionUsage.reset();
           try {
-            await (0, import_code_core6.compactMessagesForResume)(messages, {
+            await (0, import_code_core7.compactMessagesForResume)(messages, {
               workDir,
               model: modelAlias,
               clientType: "cli"
@@ -159466,13 +159558,13 @@ ${dirList}`;
           const sub = arg.trim().toLowerCase();
           console.log();
           if (sub === "list") {
-            const all = (0, import_code_core6.listWorktrees)(requestedWorkDir);
+            const all = (0, import_code_core7.listWorktrees)(requestedWorkDir);
             if (!all.length) {
               console.log(source_default.dim("  No worktrees under this project."));
             } else {
               console.log(source_default.bold(`  Worktrees (${all.length})`));
               for (const w of all) {
-                const dirty = (0, import_code_core6.worktreeHasWork)(w) ? source_default.yellow("dirty") : source_default.dim("clean");
+                const dirty = (0, import_code_core7.worktreeHasWork)(w) ? source_default.yellow("dirty") : source_default.dim("clean");
                 console.log(`  ${source_default.cyan(w.name)}  ${source_default.dim(w.worktreePath)}  [${dirty}]`);
               }
               console.log();
@@ -159510,7 +159602,7 @@ ${dirList}`;
             if (!targetName || !text) {
               console.log(source_default.dim("  Usage: /peers send <name> <message>"));
             } else {
-              const target = (0, import_code_core6.listPeers)().find((p) => p.name === targetName);
+              const target = (0, import_code_core7.listPeers)().find((p) => p.name === targetName);
               if (!target) {
                 console.log(source_default.red(`  No live session named "${targetName}". Use /peers to list who's reachable.`));
               } else if (!target.socketPath) {
@@ -159527,7 +159619,7 @@ ${dirList}`;
               console.log(source_default.dim("  Usage: /peers broadcast <message>"));
             } else {
               const { broadcastPeerMessage } = await Promise.resolve().then(() => __toESM(require_dist3(), 1));
-              const targets = (0, import_code_core6.listPeers)(peerHandle.record.id).filter((p) => p.id !== peerHandle.record.id && p.socketPath && p.inbound !== "refuse").map((p) => ({ name: p.name, socketPath: p.socketPath }));
+              const targets = (0, import_code_core7.listPeers)(peerHandle.record.id).filter((p) => p.id !== peerHandle.record.id && p.socketPath && p.inbound !== "refuse").map((p) => ({ name: p.name, socketPath: p.socketPath }));
               if (!targets.length) {
                 console.log(source_default.dim("  No other reachable Nexrall Code sessions to broadcast to."));
               } else {
@@ -159539,7 +159631,7 @@ ${dirList}`;
               }
             }
           } else {
-            const peers = (0, import_code_core6.listPeers)(peerHandle.record.id);
+            const peers = (0, import_code_core7.listPeers)(peerHandle.record.id);
             if (peers.length <= 1) {
               console.log(source_default.dim("  No other Nexrall Code sessions are currently discoverable on this machine."));
             } else {
@@ -159569,7 +159661,7 @@ ${dirList}`;
             const label = memScope === "global" ? "GLOBAL" : "this PROJECT's";
             const answer = await new Promise((resolve6) => rl.question(source_default.yellow(`  Clear ${label} memory? This cannot be undone. [y/n] `), (a) => resolve6(a.trim())));
             if (answer === "y" || answer === "yes") {
-              (0, import_code_core6.clearMemory)(memScope, workDir);
+              (0, import_code_core7.clearMemory)(memScope, workDir);
               console.log(source_default.green(`  ${memScope === "global" ? "Global" : "Project"} memory cleared.`));
             } else {
               console.log(source_default.dim("  Cancelled."));
@@ -159580,20 +159672,20 @@ ${dirList}`;
           }
           console.log();
           if (wantsGlobalOnly) {
-            const stats = (0, import_code_core6.memoryStats)("global");
-            const content = (0, import_code_core6.readMemory)("global", void 0, { includeArchived: wantsArchived });
+            const stats = (0, import_code_core7.memoryStats)("global");
+            const content = (0, import_code_core7.readMemory)("global", void 0, { includeArchived: wantsArchived });
             const archivedNote = stats.archived > 0 ? `, ${stats.archived} archived` : "";
             console.log(source_default.bold("  Global memory ") + source_default.dim(`(${stats.entries} entries${archivedNote}, ${(stats.bytes / 1024).toFixed(1)}KB) \u2014 ${stats.file}`));
             console.log();
             console.log(content || source_default.dim("  No global memories saved yet."));
           } else {
-            const projStats = (0, import_code_core6.memoryStats)("project", workDir);
-            const globalStats = (0, import_code_core6.memoryStats)("global");
+            const projStats = (0, import_code_core7.memoryStats)("project", workDir);
+            const globalStats = (0, import_code_core7.memoryStats)("global");
             const projArchived = projStats.archived > 0 ? `+${projStats.archived} archived ` : "";
             const globalArchived = globalStats.archived > 0 ? `+${globalStats.archived} archived ` : "";
             console.log(source_default.bold("  Memory") + source_default.dim(`  \u2014 project: ${projStats.entries} ${projArchived}entries (${(projStats.bytes / 1024).toFixed(1)}KB)  \xB7  global: ${globalStats.entries} ${globalArchived}entries (${(globalStats.bytes / 1024).toFixed(1)}KB)`));
             console.log();
-            const merged = (0, import_code_core6.readAllMemory)(workDir, { includeArchived: wantsArchived });
+            const merged = (0, import_code_core7.readAllMemory)(workDir, { includeArchived: wantsArchived });
             console.log(merged || source_default.dim("  No memories saved yet."));
           }
           console.log();
@@ -159632,12 +159724,12 @@ ${dirList}`;
             console.log(source_default.dim(`  Current: ${source_default.cyan(agentMode)}`));
             for (const m2 of ["ask", "edit", "auto", "plan"]) {
               const marker = m2 === agentMode ? source_default.cyan("\u276F") : " ";
-              console.log(`  ${marker} ${source_default.bold(m2.padEnd(5))} ${source_default.dim((0, import_code_core7.describeMode)(m2).replace(`${m2} \u2014 `, ""))}`);
+              console.log(`  ${marker} ${source_default.bold(m2.padEnd(5))} ${source_default.dim((0, import_code_core8.describeMode)(m2).replace(`${m2} \u2014 `, ""))}`);
             }
           } else if (["ask", "edit", "plan", "auto"].includes(modeArg)) {
             agentMode = modeArg;
             updateFooter();
-            console.log(source_default.green(`  Mode \u2192 ${source_default.bold(modeArg)}`) + source_default.dim(`  ${(0, import_code_core7.describeMode)(modeArg).replace(`${modeArg} \u2014 `, "")}`));
+            console.log(source_default.green(`  Mode \u2192 ${source_default.bold(modeArg)}`) + source_default.dim(`  ${(0, import_code_core8.describeMode)(modeArg).replace(`${modeArg} \u2014 `, "")}`));
           } else {
             console.log(source_default.red(`  Unknown: ${modeArg}`));
           }
@@ -159675,22 +159767,22 @@ ${dirList}`;
               if (target === void 0) {
                 console.log(source_default.red("  Usage: /team use <team id|personal>   (/team lists the ids)"));
               } else {
-                await (0, import_code_core6.setBillingTarget)(target);
+                await (0, import_code_core7.setBillingTarget)(target);
                 console.log(source_default.green(`  \u2713 Usage will now be billed to ${target === null ? "your personal wallet" : `team ${target}`}.`));
                 if (target !== null)
                   console.log(source_default.dim("    This applies to every product and client on this account, not just the CLI."));
               }
             } else {
               try {
-                const orgs = await (0, import_code_core6.getOrgs)();
-                const pin = (0, import_code_core6.billingOverrideFields)();
+                const orgs = await (0, import_code_core7.getOrgs)();
+                const pin = (0, import_code_core7.billingOverrideFields)();
                 for (const l2 of billingLines(orgs, "teamId" in pin ? pin.teamId : void 0)) {
                   console.log(l2.startsWith("!") ? source_default.yellow("  " + l2) : "  " + l2);
                 }
               } catch (orgErr) {
                 if (cmd === "/team")
                   throw orgErr;
-                const bal = await (0, import_code_core6.getBalance)();
+                const bal = await (0, import_code_core7.getBalance)();
                 console.log(source_default.dim("  Balance: ") + source_default.cyan(`$${bal.toFixed(4)}`));
               }
             }
@@ -159800,7 +159892,7 @@ ${dirList}`;
         case "/plan": {
           agentMode = "plan";
           updateFooter();
-          console.log(source_default.green(`  Mode \u2192 ${source_default.bold("plan")}`) + source_default.dim(`  ${(0, import_code_core7.describeMode)("plan").replace("plan \u2014 ", "")}  (/mode auto to leave)`));
+          console.log(source_default.green(`  Mode \u2192 ${source_default.bold("plan")}`) + source_default.dim(`  ${(0, import_code_core8.describeMode)("plan").replace("plan \u2014 ", "")}  (/mode auto to leave)`));
           rl.prompt();
           return;
         }
@@ -159887,7 +159979,7 @@ ${caption}` : `[Attached: ${rel}]`;
           if (needsSidecar) {
             console.log(source_default.dim(`  ${resolveModelLabel(modelAlias)} can't read ${isPdf ? "PDFs" : "images"} directly \u2014 describing ${rel} with Claude Sonnet 5.5 first\u2026`));
             try {
-              const { text } = await (0, import_code_core6.describeAttachment)(isPdf ? "pdf" : "image", data, mimeType, rel);
+              const { text } = await (0, import_code_core7.describeAttachment)(isPdf ? "pdf" : "image", data, mimeType, rel);
               content.push({ type: "text", text: `<attachment_description>
 ${text}
 </attachment_description>` });
@@ -159931,7 +160023,7 @@ ${text}
           process.exit(0);
         }
         case "/plugins": {
-          const plugins = (0, import_code_core6.loadPlugins)(workDir);
+          const plugins = (0, import_code_core7.loadPlugins)(workDir);
           if (!plugins.length) {
             console.log(source_default.dim("  No plugins installed. Install one:  nex plugin install owner/repo"));
           } else {
@@ -159944,7 +160036,7 @@ ${text}
             }
             console.log();
           }
-          skills = (0, import_code_core6.loadSkills)(workDir);
+          skills = (0, import_code_core7.loadSkills)(workDir);
           syncSlashMenu();
           rl.prompt();
           return;
@@ -160080,9 +160172,9 @@ ${text}
         }
         case "/skills":
         case "/commands": {
-          skills = (0, import_code_core6.loadSkills)(workDir);
+          skills = (0, import_code_core7.loadSkills)(workDir);
           syncSlashMenu();
-          const invocable = (0, import_code_core6.userInvokableSkills)(skills);
+          const invocable = (0, import_code_core7.userInvokableSkills)(skills);
           if (!invocable.length) {
             console.log(source_default.dim("  No skills. Add .nexrall/skills/<name>/SKILL.md (or .nexrall/commands/<name>.md) to create one."));
           } else {
@@ -160099,15 +160191,15 @@ ${text}
           return;
         }
         default: {
-          const custom = (0, import_code_core6.findSkill)(skills, cmd);
+          const custom = (0, import_code_core7.findSkill)(skills, cmd);
           if (!custom) {
             console.log(source_default.red(`  Unknown command: ${cmd}`));
             console.log(source_default.dim("  Type /help for built-ins or /skills for custom ones."));
             rl.prompt();
             return;
           }
-          const expanded = (0, import_code_core6.expandSkill)(custom, arg, workDir);
-          const turnModel = (0, import_code_core6.resolveSubAgentModel)(custom.model, modelAlias) ?? modelAlias;
+          const expanded = (0, import_code_core7.expandSkill)(custom, arg, workDir);
+          const turnModel = (0, import_code_core7.resolveSubAgentModel)(custom.model, modelAlias) ?? modelAlias;
           const turnMode = custom.mode ?? agentMode;
           console.log(source_default.dim(`  Running /${custom.name}\u2026`));
           checkpoints.beginTurn(`/${custom.name} ${arg}`.trim(), messages.length);
@@ -160169,7 +160261,7 @@ ${text}
         return;
       const notes = cliBackgroundAgents.takeNotifications();
       console.log(source_default.dim(`  \u2699 background agent${notes.length > 1 ? "s" : ""} ${notes.map((n) => `"${n.description}"`).join(", ")} finished \u2014 continuing`));
-      rl.emit("line", (0, import_code_core6.formatBackgroundNotifications)(notes));
+      rl.emit("line", (0, import_code_core7.formatBackgroundNotifications)(notes));
     }, 400);
   }
   cliBackgroundAgents.onChange(() => {
@@ -160190,7 +160282,7 @@ ${text}
 
 // src/commands/plugin.ts
 var import_prompts = __toESM(require_prompts3(), 1);
-var import_code_core8 = __toESM(require_dist3(), 1);
+var import_code_core9 = __toESM(require_dist3(), 1);
 function describeInspection(i2, name, ctx) {
   console.log();
   console.log(source_default.bold(`  Plugin: ${name}`) + (i2.meta.version ? source_default.dim(`  v${i2.meta.version}`) : ""));
@@ -160266,14 +160358,14 @@ async function pluginInstallCommand(spec, opts) {
     let registryName;
     const isShortName = /^[\w.-]+$/.test(spec.trim()) && !spec.includes("/");
     if (isShortName) {
-      const alias = (0, import_code_core8.resolveSourceAlias)(spec.trim(), process.cwd(), { includeProject: true });
+      const alias = (0, import_code_core9.resolveSourceAlias)(spec.trim(), process.cwd(), { includeProject: true });
       if (alias) {
         source2 = alias.spec;
         console.log(source_default.dim(`  Source: ${alias.name} (${alias.tier}) \u2190 ${alias.spec}`));
       }
     }
     if (isShortName && source2 === spec) {
-      const entry = await (0, import_code_core8.getRegistryPlugin)(spec.trim()).catch(() => null);
+      const entry = await (0, import_code_core9.getRegistryPlugin)(spec.trim()).catch(() => null);
       if (entry) {
         source2 = entry.source;
         registryName = entry.name;
@@ -160288,7 +160380,7 @@ async function pluginInstallCommand(spec, opts) {
         return;
       }
     }
-    const res = await (0, import_code_core8.installPlugin)(source2, {
+    const res = await (0, import_code_core9.installPlugin)(source2, {
       scope,
       workDir: process.cwd(),
       name: opts.name ?? registryName,
@@ -160296,7 +160388,7 @@ async function pluginInstallCommand(spec, opts) {
       confirm: (i2, name, ctx) => confirmInstall(i2, name, opts.yes === true, ctx)
     });
     if (registryName)
-      (0, import_code_core8.reportInstall)(registryName);
+      (0, import_code_core9.reportInstall)(registryName);
     console.log();
     console.log(source_default.green(`  \u2713 Installed "${res.name}" (${res.scope}) \u2192 ${res.dir}`) + (res.sha ? source_default.dim(`  @ ${res.sha.slice(0, 7)}`) : ""));
     if (res.inspection.commands.length) {
@@ -160310,7 +160402,7 @@ async function pluginInstallCommand(spec, opts) {
 }
 function pluginRemoveCommand(name, opts) {
   try {
-    const dir = (0, import_code_core8.removePlugin)(name, {
+    const dir = (0, import_code_core9.removePlugin)(name, {
       scope: opts.project ? "project" : void 0,
       // no flag → search both scopes
       workDir: process.cwd()
@@ -160323,14 +160415,14 @@ function pluginRemoveCommand(name, opts) {
 }
 async function pluginUpdateCommand(name, opts) {
   const workDir = process.cwd();
-  const targets = name ? [name] : (0, import_code_core8.loadPlugins)(workDir).filter((p) => (0, import_code_core8.readReceipt)(p.dir)?.kind === "github").map((p) => p.name);
+  const targets = name ? [name] : (0, import_code_core9.loadPlugins)(workDir).filter((p) => (0, import_code_core9.readReceipt)(p.dir)?.kind === "github").map((p) => p.name);
   if (!targets.length) {
     console.log(source_default.dim("  No updatable plugins (only GitHub-installed plugins with receipts can update)."));
     return;
   }
   for (const t2 of targets) {
     try {
-      const res = await (0, import_code_core8.updatePlugin)(t2, {
+      const res = await (0, import_code_core9.updatePlugin)(t2, {
         workDir,
         confirm: (i2, n, ctx) => confirmInstall(i2, n, opts.yes === true, ctx)
       });
@@ -160347,7 +160439,7 @@ function badgeFor(p) {
 }
 async function pluginSearchCommand(query) {
   try {
-    const results = await (0, import_code_core8.searchRegistry)(query);
+    const results = await (0, import_code_core9.searchRegistry)(query);
     if (!results.length) {
       console.log(source_default.dim(query ? `  No plugins matching "${query}".` : "  Registry is empty."));
       return;
@@ -160370,7 +160462,7 @@ async function pluginSearchCommand(query) {
 }
 async function pluginInfoCommand(name) {
   try {
-    const p = await (0, import_code_core8.getRegistryPlugin)(name);
+    const p = await (0, import_code_core9.getRegistryPlugin)(name);
     if (!p) {
       console.error(source_default.red(`  \u2717 "${name}" not found in the registry.`));
       process.exitCode = 1;
@@ -160406,7 +160498,7 @@ async function pluginInfoCommand(name) {
   }
 }
 function pluginListCommand() {
-  const plugins = (0, import_code_core8.loadPlugins)(process.cwd());
+  const plugins = (0, import_code_core9.loadPlugins)(process.cwd());
   if (!plugins.length) {
     console.log(source_default.dim("  No plugins installed."));
     console.log(source_default.dim("  Install one:  nex plugin install owner/repo"));
@@ -160415,10 +160507,10 @@ function pluginListCommand() {
   console.log();
   console.log(source_default.bold("  Installed plugins:"));
   for (const p of plugins) {
-    const receipt = (0, import_code_core8.readReceipt)(p.dir);
+    const receipt = (0, import_code_core9.readReceipt)(p.dir);
     const src = receipt ? source_default.dim(`  \u2190 ${receipt.source}`) : source_default.dim("  (manual)");
     const at = receipt?.sha ? source_default.dim(` @ ${receipt.sha.slice(0, 7)}`) : "";
-    const insp = (0, import_code_core8.inspectPluginDir)(p.dir);
+    const insp = (0, import_code_core9.inspectPluginDir)(p.dir);
     const runs = insp.hasHooks || insp.hasMcp ? source_default.yellow(`  \u26A0 ${[insp.hasHooks && "hooks", insp.hasMcp && "mcp"].filter(Boolean).join("+")}`) : "";
     console.log(
       "  " + source_default.cyan(p.name.padEnd(24)) + source_default.dim(`${(p.version ?? "").padEnd(10)}${p.scope.padEnd(9)}`) + src + at + runs
@@ -160428,8 +160520,8 @@ function pluginListCommand() {
 }
 function pluginSourceListCommand() {
   const workDir = process.cwd();
-  const sources = (0, import_code_core8.loadDeclaredSources)(workDir, { includeProject: true });
-  const patterns = (0, import_code_core8.allowedSourcePatterns)();
+  const sources = (0, import_code_core9.loadDeclaredSources)(workDir, { includeProject: true });
+  const patterns = (0, import_code_core9.allowedSourcePatterns)();
   if (patterns) {
     console.log();
     console.log(source_default.bold("  Organisation policy: ") + source_default.dim(`installs restricted to ${patterns.join(", ")}`));
@@ -160444,7 +160536,7 @@ function pluginSourceListCommand() {
   console.log(source_default.bold("  Declared plugin sources:"));
   for (const s2 of sources) {
     const tier = s2.tier === "project" ? source_default.yellow(s2.tier.padEnd(9)) : source_default.dim(s2.tier.padEnd(9));
-    const blocked = !(0, import_code_core8.isSourceAllowed)(s2.spec, patterns) ? source_default.red("  \u2717 blocked by policy") : "";
+    const blocked = !(0, import_code_core9.isSourceAllowed)(s2.spec, patterns) ? source_default.red("  \u2717 blocked by policy") : "";
     console.log("  " + source_default.cyan(s2.name.padEnd(20)) + tier + source_default.white(s2.spec) + blocked);
   }
   console.log();
@@ -160454,17 +160546,17 @@ function pluginSourceListCommand() {
 }
 function pluginSourceAddCommand(name, spec, opts) {
   try {
-    (0, import_code_core8.parsePluginSource)(spec);
-    const patterns = (0, import_code_core8.allowedSourcePatterns)();
-    if (patterns && !(0, import_code_core8.isSourceAllowed)(spec, patterns)) {
+    (0, import_code_core9.parsePluginSource)(spec);
+    const patterns = (0, import_code_core9.allowedSourcePatterns)();
+    if (patterns && !(0, import_code_core9.isSourceAllowed)(spec, patterns)) {
       console.error(source_default.red(`  \u2717 "${spec}" is not permitted by your organisation's policy.`));
       console.error(source_default.dim(`    Allowed: ${patterns.join(", ")}`));
       process.exitCode = 1;
       return;
     }
     const scope = opts.project ? "project" : "user";
-    const file = (0, import_code_core8.sourcesFileFor)(scope, process.cwd());
-    (0, import_code_core8.writeDeclaredSource)(file, name, spec);
+    const file = (0, import_code_core9.sourcesFileFor)(scope, process.cwd());
+    (0, import_code_core9.writeDeclaredSource)(file, name, spec);
     console.log();
     console.log(source_default.green(`  \u2713 Declared "${name}" \u2192 ${spec}`) + source_default.dim(`  (${scope})`));
     console.log(source_default.dim(`    ${file}`));
@@ -160478,13 +160570,13 @@ function pluginSourceAddCommand(name, spec, opts) {
 function pluginSourceRemoveCommand(name, opts) {
   const workDir = process.cwd();
   const scope = opts.project ? "project" : "user";
-  const file = (0, import_code_core8.sourcesFileFor)(scope, workDir);
-  if ((0, import_code_core8.removeDeclaredSource)(file, name)) {
+  const file = (0, import_code_core9.sourcesFileFor)(scope, workDir);
+  if ((0, import_code_core9.removeDeclaredSource)(file, name)) {
     console.log(source_default.green(`  \u2713 Removed source "${name}" (${scope})`));
     console.log(source_default.dim("    Plugins already installed from it are untouched \u2014 remove them with  nex plugin remove <name>"));
     return;
   }
-  const found = (0, import_code_core8.resolveSourceAlias)(name, workDir, { includeProject: true });
+  const found = (0, import_code_core9.resolveSourceAlias)(name, workDir, { includeProject: true });
   if (found) {
     console.error(source_default.red(`  \u2717 "${name}" is declared in the ${found.tier} tier, not ${scope}.`));
     console.error(source_default.dim(`    ${found.file}`));
@@ -160581,7 +160673,7 @@ program2.command("sessions").description("List or delete saved chat sessions").o
   console.log();
 });
 program2.option("-p, --pro", "Use Claude Opus 5.5 (most capable)").option("-t, --turbo", "Use Claude Sonnet 5.5 (fast)").option("-u, --ultra", "Use Claude Fable 5.1 (most powerful)").option("-y, --yolo", "Auto-approve all tool calls (no permission prompts)").option("-d, --dir <path>", "Set working directory (default: current directory)").option("-m, --model <name>", "Explicit model, e.g. claude-opus-5-5 | gpt-5.4 | gpt-4.1").option("-r, --resume [id]", "Resume last session, or a specific session id").option("-w, --worktree [name]", "Isolate this session in its own worktree \u2014 a separate directory (and, in a git repo, its own branch) so it can never overwrite files another session (or you) are touching in the main checkout. Omit a name for an auto-generated one; pass an existing name to resume that same worktree.").option("-e, --effort <level>", "Thinking effort \u2014 real levels depend on the model (e.g. DeepSeek: low|high|max, Qwen: low|high); run `nex --model <id>` then `/effort` with no argument to see a model's scale").option("--no-banner", "Skip the ASCII banner (useful in scripts/pipes)").option("--output-format <fmt>", "One-shot output format: text | json | stream-json (implies auto-approve)").option("--audit [path]", "Log every tool call (and refusal) to a JSONL trail (default: .nexrall/audit/<session>.jsonl)").argument("[prompt...]", "One-shot prompt \u2014 if omitted, starts interactive mode").action(async (promptParts, options) => {
-  if (!(0, import_code_core9.isAuthenticated)()) {
+  if (!(0, import_code_core10.isAuthenticated)()) {
     console.error("Not logged in. Run: nex auth");
     process.exit(1);
   }