nexrall-code 0.5.130 → 0.5.131

package/dist/index.js

@@ -11208,7 +11208,7 @@ var require_securityLint = __commonJS({
         // So the interpolation must name something that plausibly came from the
         // outside: req/request/params/query/body/input/user/args, or a bare
         // `'...' + ident`. This trades recall for precision on purpose — thorough SQL
-        // review is the security-auditor agent's job, not an inline regex's.
+        // review is a dedicated security review's job, not an inline regex's.
         //
         // THE GAP IS PER-ALTERNATIVE, and that asymmetry is load-bearing. The concat
         // branch originally shared the no-quote gap, which made it miss the QUOTED
@@ -12188,24 +12188,6 @@ var require_agentTypes = __commonJS({
       "get_diagnostics"
     ];
     var RESEARCH_TOOLS = [...READ_ONLY_TOOLS, "fetch_url", "web_search"];
-    var WRITE_TOOLS = [
-      ...READ_ONLY_TOOLS,
-      "write_file",
-      "edit_file",
-      "multi_edit",
-      "create_directory",
-      "move_file",
-      "copy_file",
-      // notebook_edit is a write tool like any other, and allowsTestOnlyWrite already
-      // knows its shape (`source` is cell CONTENT, not a path). Omitting it just meant
-      // test-writer silently could not touch notebooks.
-      "notebook_edit",
-      // Office document generation — same write-access tier as write_file, just a
-      // structured content shape instead of raw text (see tools/executor.ts).
-      "write_docx",
-      "write_xlsx",
-      "write_pptx"
-    ];
     var BUILTIN_AGENTS = [
       {
         // The catch-all, matching Claude Code's `general-purpose`.
@@ -12238,66 +12220,6 @@ var require_agentTypes = __commonJS({
         prompt: "You are a general-purpose engineering sub-agent. Work the task end to end: explore what you need, make the changes, and verify them with the project's own build/test commands.\n\nRules:\n- Mirror existing conventions; make the smallest correct change.\n- Verify before you claim success. If you could not verify, say so explicitly.\n- Your FINAL MESSAGE is the only thing that reaches the main agent: state what you changed (with file paths), what you ran and its outcome, and anything you deliberately left undone.",
         source: "builtin"
       },
-      {
-        name: "reviewer",
-        description: "Read-only code reviewer \u2014 finds correctness bugs, edge cases, and security issues in a diff or file set. Cannot modify files.",
-        tools: READ_ONLY_TOOLS,
-        source: "builtin",
-        prompt: [
-          "You are a meticulous senior code reviewer. You NEVER modify files \u2014 you only read, search, and report.",
-          "",
-          "Method:",
-          "1. Read the full context around every change you are asked to review; never judge a hunk in isolation.",
-          "2. Hunt specifically for: correctness bugs, unhandled edge cases (empty/null/unicode/concurrency/timezone),",
-          "   security issues (injection, path traversal, secrets in code, unsafe deserialization), breaking API",
-          "   changes (search for callers first), silent behaviour changes, and swallowed errors.",
-          "3. Verify test coverage: are the changed paths tested? Were assertions weakened or tests deleted?",
-          "4. Only use bash for read-only commands (git diff/log/show, grep, test runs). Never run mutating commands.",
-          "",
-          "Report format: \u{1F534} Critical / \u{1F7E1} Warning / \u{1F7E2} Suggestion, each with file:line and a concrete fix,",
-          "then a final verdict (APPROVE or REQUEST CHANGES) with a one-paragraph rationale."
-        ].join("\n")
-      },
-      // Promoted from the security-audit plugin to a builtin.
-      //
-      // Leaving it plugin-only was indefensible next to `reviewer` being builtin:
-      // reviewer's own prompt already tells it to look for security issues, so
-      // security IS treated as default work — yet the specialist agent for it was
-      // invisible unless the user happened to know the plugin existed. For an agent
-      // that WRITES code, "you only get a security review if you knew to install
-      // something" is the wrong default.
-      {
-        name: "security-auditor",
-        description: "Read-only security auditor \u2014 hunts injection, authz, secrets, and validation flaws in a path or diff. Cannot modify files.",
-        tools: READ_ONLY_TOOLS,
-        // No `model` override — inherits the session's, same as general-purpose.
-        // A previous version forced 'pro' (Claude Opus 5) here, which silently
-        // billed Anthropic even for a session running entirely on OpenAI/DeepSeek/
-        // Qwen. Consistency with the main conversation's provider matters more
-        // than defaulting every specialist to a fixed tier.
-        source: "builtin",
-        prompt: [
-          "You are a security auditor. You find real, exploitable flaws \u2014 not style issues.",
-          "",
-          "Method:",
-          "1. Map the attack surface FIRST: entry points (HTTP routes, message handlers, CLI args, file/network",
-          "   input, deserialization), then trace user-controlled data inward to where it is used.",
-          "2. For each finding: file:line, the flaw class, a one-line exploit scenario, and the concrete fix.",
-          "3. Grade severity honestly: Critical = remote compromise or data breach; High = auth bypass/IDOR;",
-          "   Medium = needs unusual preconditions; Low = hardening.",
-          "",
-          "Classes worth the most attention, in order: injection (SQL/command/template/prototype), broken",
-          "authz (missing ownership checks, IDOR, trusting client-supplied ids), secrets committed to source,",
-          "path traversal, SSRF, unsafe deserialization, missing rate limits on expensive or auth endpoints,",
-          "and crypto misuse (hand-rolled comparison, predictable randomness).",
-          "",
-          "Hard rules:",
-          "- READ-ONLY: never modify, create or delete files. bash only for read-only inspection.",
-          "- NEVER print a discovered secret's value. Report its location and advise rotation.",
-          "- Distinguish EXPLOITABLE from theoretical, and say which one each finding is.",
-          '- "No issues found in scope X" is a valid, useful result. Do not pad the report to look thorough.'
-        ].join("\n")
-      },
       // The gap Claude Code fills with its built-in `Explore`: read-heavy codebase
       // search that would otherwise flood the parent's context. Defaults to the
       // cheapest model on purpose — "find every caller of X" has no need of a
@@ -12341,7 +12263,7 @@ var require_agentTypes = __commonJS({
         description: "Read-only planning agent \u2014 researches a change and returns a concrete step-by-step implementation plan with risks and affected files. Cannot modify files.",
         tools: RESEARCH_TOOLS,
         // No `model` override — inherits the session's, for the same reason as
-        // explorer/security-auditor above: a fixed alias silently billed Anthropic
+        // explorer above: a fixed alias silently billed Anthropic
         // regardless of the user's chosen provider.
         source: "builtin",
         prompt: [
@@ -12361,74 +12283,6 @@ var require_agentTypes = __commonJS({
           "- How to verify (the exact test/build command for THIS project, taken from package.json/Makefile).",
           "- Anything genuinely ambiguous, stated as an open question rather than a silent assumption."
         ].join("\n")
-      },
-      // Promoted from the test-gen plugin. Needs write access — it produces test
-      // files — but is deliberately forbidden from touching source, because "make the
-      // tests pass" is the single most common way an agent destroys signal.
-      {
-        name: "test-writer",
-        description: "Writes tests that follow the project's existing conventions. May create/edit TEST files only \u2014 never production source.",
-        tools: WRITE_TOOLS,
-        // Enforced, not merely requested: the permission gate refuses a write whose
-        // path is not a test file. Without this the allowlist would grant edit_file
-        // for every path and the rule below would be a suggestion the model is free
-        // to rationalise its way past.
-        testFilesOnly: true,
-        source: "builtin",
-        prompt: [
-          "You write tests. You may create and edit TEST files only.",
-          "",
-          "Hard rules \u2014 these are the ways test-writing agents destroy value, so they are non-negotiable:",
-          "- NEVER modify production source to make a test pass. If the code looks wrong, REPORT it and stop.",
-          "- NEVER weaken, delete or skip an existing assertion or test.",
-          "- A test that cannot fail is worse than no test. Every test must be able to fail for one clear reason.",
-          "",
-          "Method:",
-          "1. Read the existing tests FIRST and copy their conventions exactly \u2014 runner, file naming, layout,",
-          "   assertion style, fixture/helper patterns. Never introduce a new framework.",
-          "2. Test observable behaviour and the contract, not private internals.",
-          "3. Cover the boring-but-real cases: empty input, null/undefined, unicode and non-BMP characters,",
-          "   boundaries, error paths, concurrency where it applies.",
-          "4. No sleeps or wall-clock dependence \u2014 those produce the flaky tests that get deleted later.",
-          "5. RUN the tests you wrote and report the real output. Never claim a test passes without running it."
-        ].join("\n")
-      },
-      // The DevOps gap — answered with a READ-ONLY advisor, not an operator.
-      //
-      // A "DevOps agent" with write/apply access is a genuinely different risk class
-      // from the others here: its mistakes are `kubectl delete`, a bad `terraform
-      // apply`, a broken deploy pipeline — often not revertible and affecting
-      // production rather than a working tree. So this one diagnoses and proposes a
-      // diff; a human applies it. That asymmetry is the whole design.
-      {
-        name: "devops-advisor",
-        description: "Read-only CI/CD, container, and infrastructure advisor \u2014 diagnoses pipelines, Dockerfiles, and k8s manifests and proposes concrete fixes as a diff. Never applies changes.",
-        tools: RESEARCH_TOOLS,
-        // No `model` override — inherits the session's, for the same reason as the
-        // other specialists above.
-        source: "builtin",
-        prompt: [
-          "You are an infrastructure and delivery advisor. You DIAGNOSE and PROPOSE. You never apply changes.",
-          "",
-          "Hard rules:",
-          "- READ-ONLY, and stricter than the other read-only agents: bash is for INSPECTION only",
-          "  (git log/diff, cat, grep, `kubectl get/describe`, `docker images`, `terraform plan`).",
-          "  NEVER run anything that mutates infrastructure \u2014 no apply/delete/scale/rollout/restart/push,",
-          "  no `terraform apply`, no `helm upgrade`. If a fix needs such a command, WRITE IT OUT for a human.",
-          "- Never print secret values from env files, k8s Secrets or CI variables. Reference them by name.",
-          "",
-          "Method:",
-          "1. Read what actually exists \u2014 workflow files, Dockerfiles, manifests, kustomize overlays, the",
-          '   deploy scripts \u2014 before drawing any conclusion. Never reason from what a stack "usually" looks like.',
-          "2. Follow the real path a change takes to production, and name the step that is broken or missing.",
-          "3. Check the failure modes that bite hardest: CI path filters that skip files a workload actually",
-          "   needs, image tags that do not match what is deployed, missing health probes, absent resource",
-          "   limits, secrets baked into images, ports/timeouts inconsistent between proxy and app, and",
-          "   migrations that must run before the new image is live.",
-          "",
-          "Output: the diagnosis, the evidence (file:line or command output), the proposed change as a diff or",
-          "exact file content, and the command a human should run to apply and verify it."
-        ].join("\n")
       }
     ];
     var KNOWN_TOOL_NAMES = /* @__PURE__ */ new Set([
@@ -107812,7 +107666,7 @@ ${body}`);
     function formatTokenCount(n) {
       return n >= 1e6 ? `${(n / 1e6).toFixed(1)}M` : n >= 1e3 ? `${(n / 1e3).toFixed(1)}K` : String(n);
     }
-    function formatElapsed(ms) {
+    function formatElapsed2(ms) {
       const s2 = Math.round(ms / 1e3);
       return s2 < 60 ? `${s2}s` : `${Math.floor(s2 / 60)}m ${s2 % 60}s`;
     }
@@ -108000,7 +107854,7 @@ ${agent.prompt}` : "",
           }
           isoState = void 0;
         }
-        const stats = `[sub-agent stats: ${subToolCalls} tool call(s) \xB7 ${formatTokenCount(subTokens)} tokens \xB7 $${subCost.toFixed(3)} \xB7 ${formatElapsed(Date.now() - subStartedAt)}]`;
+        const stats = `[sub-agent stats: ${subToolCalls} tool call(s) \xB7 ${formatTokenCount(subTokens)} tokens \xB7 $${subCost.toFixed(3)} \xB7 ${formatElapsed2(Date.now() - subStartedAt)}]`;
         const out = { ...r2, ...childVerifications.length ? { childVerifications } : {} };
         if (out.error !== void 0)
           out.error = `${out.error}
@@ -108871,7 +108725,7 @@ Continue the work from here.` }] });
         hasOwnAgentStore: !!options._agentMemory,
         // Same derivation, same reason, for the network. The base prompt's
         // "Web search" section tells the run to reach the network, but
-        // READ_ONLY_TOOLS (explorer, security-auditor, ...) contains neither
+        // READ_ONLY_TOOLS (explorer, planner, ...) contains neither
         // `fetch_url` nor `web_search`. MEASURED on the 195-trial 2026-08-10
         // deepseek-v4-pro benchmark: 29 of 51 `fetch_url` failures and 3 of 14
         // `web_search` failures were the permission gate refusing a sub-agent
@@ -157566,7 +157420,8 @@ function composeFooter(base, extras, columns, reserve = 0) {
     optional.push({ keep: 4, at: 2, segment: ctxSegment(extras.ctxPct) });
   if (typeof extras?.costUsd === "number")
     optional.push({ keep: 2, at: 3, segment: { text: money2(extras.costUsd), tone: "dim" } });
-  const build = (kept2) => [head, ...[...kept2].sort((x2, y) => x2.at - y.at).map((k) => k.segment), ...tail];
+  let tailShown = tail.length;
+  const build = (kept2) => [head, ...[...kept2].sort((x2, y) => x2.at - y.at).map((k) => k.segment), ...tail.slice(0, tailShown)];
   const width = (segs) => visibleLen(segs.map((s2) => s2.text).join(SEP2));
   let kept = [...optional];
   const budget = columns - 1 - reserve;
@@ -157577,6 +157432,8 @@ function composeFooter(base, extras, columns, reserve = 0) {
         lowest = i2;
     kept.splice(lowest, 1);
   }
+  while (tailShown > 0 && width(build(kept)) > budget)
+    tailShown--;
   return build(kept);
 }
 
@@ -157896,6 +157753,7 @@ var BUILTIN_SLASH_COMMANDS = [
   { name: "cost", description: "Tokens and cost of this conversation", kind: "builtin" },
   { name: "status", description: "Version, model, mode, directory and session at a glance", kind: "builtin" },
   { name: "copy", description: "Copy the last reply to the clipboard", kind: "builtin" },
+  { name: "bashes", description: "List, show or stop commands moved to the background (Ctrl+B)", argHint: "[show|kill <id>]", kind: "builtin" },
   { name: "expand", description: "Show the full output of a folded tool call (Ctrl+O)", argHint: "[n]", kind: "builtin" },
   { name: "export", description: "Write this conversation to a Markdown file", argHint: "[file]", kind: "builtin" },
   { name: "rename", description: "Rename this session", argHint: "<title>", requiresArg: true, kind: "builtin" },
@@ -158037,6 +157895,7 @@ function runBang(cmd, opts) {
     let timedOut = false;
     let aborted = false;
     let settled = false;
+    let detached = false;
     const child = spawn("bash", ["-c", cmd], {
       cwd: opts.cwd,
       env: opts.env ?? process.env,
@@ -158077,11 +157936,25 @@ function runBang(cmd, opts) {
     };
     child.stdout.on("data", take);
     child.stderr.on("data", take);
+    opts.onSpawn?.({ kill });
     const timer = setTimeout(() => {
       timedOut = true;
       kill();
     }, timeoutMs);
+    const snapshot = () => {
+      const kept = head.length + tail.length;
+      return { output: head + tail, droppedBytes: Math.max(0, total - kept), code: null, signal: null, timedOut, aborted };
+    };
     const poll = setInterval(() => {
+      if (detached)
+        return;
+      if (opts.detach?.requested) {
+        detached = true;
+        clearTimeout(timer);
+        clearInterval(poll);
+        resolve8({ ...snapshot(), detached: true });
+        return;
+      }
       if (opts.signal?.aborted && !aborted) {
         aborted = true;
         kill();
@@ -158093,8 +157966,11 @@ function runBang(cmd, opts) {
       settled = true;
       clearTimeout(timer);
       clearInterval(poll);
-      const kept = head.length + tail.length;
-      resolve8({ output: head + tail, droppedBytes: Math.max(0, total - kept), code, signal, timedOut, aborted });
+      const r2 = { ...snapshot(), code, signal };
+      if (detached)
+        opts.onSettled?.(r2);
+      else
+        resolve8(r2);
     };
     child.on("error", (err) => {
       head += `${err.message}
@@ -158105,7 +157981,7 @@ function runBang(cmd, opts) {
   });
 }
 function bangTranscript(cmd, r2) {
-  const status = r2.aborted ? "interrupted by the user" : r2.timedOut ? "timed out" : r2.code === 0 ? "exit code 0" : `exit code ${r2.code ?? r2.signal ?? "?"}`;
+  const status = r2.detached ? "moved to the background by the user and still running \u2014 this is the output so far" : r2.aborted ? "interrupted by the user" : r2.timedOut ? "timed out" : r2.code === 0 ? "exit code 0" : `exit code ${r2.code ?? r2.signal ?? "?"}`;
   const body = r2.output.length ? r2.output.replace(/\s+$/, "") : "(no output)";
   const cut = r2.droppedBytes > 0 ? `
 \u2026 ${r2.droppedBytes} bytes omitted from the middle \u2026` : "";
@@ -158727,6 +158603,10 @@ var App2 = ({ onReady }) => {
   const onExpand = (0, import_react35.useCallback)((cb) => {
     onExpandRef.current = cb;
   }, []);
+  const onBackgroundRef = (0, import_react35.useRef)(null);
+  const onBackground = (0, import_react35.useCallback)((cb) => {
+    onBackgroundRef.current = cb;
+  }, []);
   const mentionSelRef = (0, import_react35.useRef)({ query: "", idx: 0 });
   const mentionDismissedRef = (0, import_react35.useRef)(null);
   const mentionRootRef = (0, import_react35.useRef)(process.cwd());
@@ -158930,6 +158810,16 @@ var App2 = ({ onReady }) => {
       onExpandRef.current?.();
       return;
     }
+    if (key.ctrl && char === "b") {
+      if (askResolverRef.current)
+        return;
+      if (busyRef.current) {
+        const moved = onBackgroundRef.current?.() ?? false;
+        if (!moved)
+          setHintText("Ctrl+B moves a running !command to the background \u2014 none is running");
+      }
+      return;
+    }
     const menu = askResolverRef.current || searchRef.current || historyRef.current.browsing ? null : computeMenu(lineRef.current, cursorRef.current, slashEntriesRef.current, menuDismissedRef.current);
     if (menu) {
       const sel = menuSelRef.current.query === menu.query ? menuSelRef.current.idx : 0;
@@ -159301,7 +159191,8 @@ var App2 = ({ onReady }) => {
       onCycleMode,
       onRewind,
       onHelp,
-      onExpand
+      onExpand,
+      onBackground
     });
   }, []);
   const slices = renderInputSlices(line, cursorPos);
@@ -159589,6 +159480,126 @@ function rewindChoices(cps) {
   return { options, ids: newest.map((c) => c.id) };
 }
 
+// src/ui/backgroundShells.ts
+var MAX_KEPT = 64e3;
+var BackgroundShells = class {
+  nextId = 1;
+  jobs = /* @__PURE__ */ new Map();
+  ctls = /* @__PURE__ */ new Map();
+  listeners = [];
+  /** Register a detached command; returns its id. `seed` is the output it already produced. */
+  add(cmd, ctl, seed = "", now = Date.now()) {
+    const job = {
+      id: this.nextId++,
+      cmd,
+      startedAt: now,
+      status: "running",
+      code: null,
+      signal: null,
+      tail: seed.length > MAX_KEPT ? seed.slice(seed.length - MAX_KEPT) : seed
+    };
+    this.jobs.set(job.id, job);
+    this.ctls.set(job.id, ctl);
+    this.emit();
+    return job;
+  }
+  /** Append streamed output (bounded to the newest MAX_KEPT characters). */
+  append(id, chunk) {
+    const j = this.jobs.get(id);
+    if (!j || j.status !== "running")
+      return;
+    j.tail += chunk;
+    if (j.tail.length > MAX_KEPT)
+      j.tail = j.tail.slice(j.tail.length - MAX_KEPT);
+  }
+  /** The process exited. A job the user killed stays 'killed' whatever the exit code says. */
+  finish(id, r2, now = Date.now()) {
+    const j = this.jobs.get(id);
+    if (!j || j.status !== "running")
+      return j;
+    j.status = "done";
+    j.code = r2.code;
+    j.signal = r2.signal;
+    j.endedAt = now;
+    this.ctls.delete(id);
+    this.emit();
+    return j;
+  }
+  /** Stop a running job. False when the id is unknown or it already ended. */
+  kill(id, now = Date.now()) {
+    const j = this.jobs.get(id);
+    const ctl = this.ctls.get(id);
+    if (!j || !ctl || j.status !== "running")
+      return false;
+    j.status = "killed";
+    j.endedAt = now;
+    this.ctls.delete(id);
+    ctl.kill();
+    this.emit();
+    return true;
+  }
+  killAll() {
+    let n = 0;
+    for (const id of [...this.ctls.keys()])
+      if (this.kill(id))
+        n++;
+    return n;
+  }
+  get(id) {
+    return this.jobs.get(id);
+  }
+  list() {
+    return [...this.jobs.values()];
+  }
+  runningCount() {
+    let n = 0;
+    for (const j of this.jobs.values())
+      if (j.status === "running")
+        n++;
+    return n;
+  }
+  onChange(cb) {
+    this.listeners.push(cb);
+  }
+  emit() {
+    for (const l2 of this.listeners)
+      l2();
+  }
+};
+function formatElapsed(ms) {
+  const s2 = Math.max(0, Math.floor(ms / 1e3));
+  if (s2 < 60)
+    return `${s2}s`;
+  const m2 = Math.floor(s2 / 60);
+  if (m2 < 60)
+    return `${m2}m ${String(s2 % 60).padStart(2, "0")}s`;
+  return `${Math.floor(m2 / 60)}h ${String(m2 % 60).padStart(2, "0")}m`;
+}
+function describeShell(j, now = Date.now()) {
+  const state = j.status === "running" ? `running ${formatElapsed(now - j.startedAt)}` : j.status === "killed" ? "killed" : j.code === 0 ? "exit 0" : `exit ${j.code ?? j.signal ?? "?"}`;
+  const cmd = j.cmd.length > 60 ? j.cmd.slice(0, 59) + "\u2026" : j.cmd;
+  return `#${j.id}  ${state.padEnd(14)} ${cmd}`;
+}
+function parseBashesArgs(arg) {
+  const parts = arg.trim().split(/\s+/).filter(Boolean);
+  if (parts.length === 0)
+    return { kind: "list" };
+  const verb = parts[0].toLowerCase();
+  if (verb === "list")
+    return { kind: "list" };
+  if (verb === "kill" && parts[1]?.toLowerCase() === "all" && parts.length === 2)
+    return { kind: "kill-all" };
+  if (verb === "show" || verb === "kill") {
+    if (parts.length !== 2 || !/^#?\d+$/.test(parts[1]))
+      return { kind: "error", message: `Usage: /bashes ${verb} <id>` };
+    const id = Number(parts[1].replace("#", ""));
+    return verb === "show" ? { kind: "show", id } : { kind: "kill", id };
+  }
+  if (parts.length === 1 && /^#?\d+$/.test(parts[0]))
+    return { kind: "show", id: Number(parts[0].replace("#", "")) };
+  return { kind: "error", message: "Usage: /bashes [show <id> | kill <id> | kill all]" };
+}
+
 // src/ui/toolOutputStore.ts
 var MAX_ENTRIES = 20;
 var MAX_ENTRY_CHARS = 4e5;
@@ -159705,6 +159716,11 @@ var CLI_VERSION = (() => {
 })();
 var sessionUsage = new UsageTotals();
 var toolOutputs = new ToolOutputStore();
+var bgShells = new BackgroundShells();
+var bangDetach = null;
+process.on("exit", () => {
+  bgShells.killAll();
+});
 function printExpansion(arg) {
   const r2 = resolveExpand(toolOutputs, arg);
   if (!r2.entry) {
@@ -160695,6 +160711,7 @@ function printHelp() {
     ["/team [use <id|personal>]", "List your teams, or switch what usage is billed to"],
     ["/cost", "Tokens and cost of this conversation so far"],
     ["/status", "Version, model, mode, directory, session and cost at a glance"],
+    ["/bashes [show|kill <id>]", "List commands you moved to the background with Ctrl+B; show their output or stop them"],
     ["/expand [n]", "Show the full output of a folded tool call (newest by default; Ctrl+O does the same)"],
     ["/copy", "Copy the last reply to the clipboard"],
     ["/export [file]", "Write this conversation to a Markdown file"],
@@ -160740,6 +160757,7 @@ function printHelp() {
     ["Esc Esc", "At an empty prompt: pick a checkpoint to rewind to (same as /rewind)"],
     ["?", "At an empty prompt: show this list"],
     ["Ctrl+O", "Expand the last folded tool output (also works while it is running; /expand [n] picks an older one)"],
+    ["Ctrl+B", "While a `!command` runs: move it to the background and keep typing (/bashes lists, shows and stops them)"],
     ["Ctrl+L", "Redraw the screen"],
     ["Ctrl+D", "Delete the character under the cursor; press twice on an empty line to exit"],
     ["(paste)", "Multi-line paste goes into the input box \u2014 it does not send until you press Enter"]
@@ -161185,6 +161203,13 @@ ${text}` : "");
     getInkTerminal().onExpand(() => {
       printExpansion("");
     });
+    getInkTerminal().onBackground(() => {
+      if (bangDetach && !bangDetach.requested) {
+        bangDetach.requested = true;
+        return true;
+      }
+      return false;
+    });
     getInkTerminal().onRewind(() => {
       void (async () => {
         const opts = rewindChoices(checkpoints.list());
@@ -161724,6 +161749,39 @@ ${dirList}`;
           printExpansion(arg);
           rl.prompt();
           return;
+        case "/bashes": {
+          const a = parseBashesArgs(arg);
+          if (a.kind === "error") {
+            console.log(source_default.yellow("  " + a.message));
+          } else if (a.kind === "list") {
+            const jobs = bgShells.list();
+            if (!jobs.length)
+              console.log(source_default.dim("  No background commands. Start `!cmd`, then press Ctrl+B to move it to the background."));
+            else
+              for (const j of jobs)
+                console.log("  " + (j.status === "running" ? source_default.cyan(describeShell(j)) : source_default.dim(describeShell(j))));
+          } else if (a.kind === "show") {
+            const j = bgShells.get(a.id);
+            if (!j)
+              console.log(source_default.yellow(`  No background command #${a.id}.`));
+            else {
+              console.log(source_default.cyan("  " + describeShell(j)));
+              const lines = j.tail.replace(/\s+$/, "").split("\n");
+              const shownLines = lines.slice(-40);
+              if (lines.length > shownLines.length)
+                console.log(source_default.dim(`  \u2026 ${lines.length - shownLines.length} earlier line(s) not shown`));
+              for (const l2 of shownLines)
+                console.log(source_default.dim("  \u2502 ") + l2.split("\r").pop().slice(0, 300));
+            }
+          } else if (a.kind === "kill") {
+            console.log(bgShells.kill(a.id) ? source_default.green(`  Stopped #${a.id}.`) : source_default.yellow(`  #${a.id} is not running.`));
+          } else {
+            const n = bgShells.killAll();
+            console.log(n ? source_default.green(`  Stopped ${n} background command${n === 1 ? "" : "s"}.`) : source_default.dim("  Nothing is running."));
+          }
+          rl.prompt();
+          return;
+        }
         case "/copy": {
           const text = lastAssistantText(messages);
           if (!text) {
@@ -162198,22 +162256,59 @@ ${text}
         shown++;
       };
       let result;
+      let ctl = null;
+      let bgId = null;
+      const detach = { requested: false };
+      bangDetach = detach;
       try {
         result = await runBang(bang, {
           cwd: workDir,
           signal: abortSignal,
+          detach,
+          onSpawn: (c) => {
+            ctl = c;
+          },
           onData: (chunk) => {
+            if (bgId !== null) {
+              bgShells.append(bgId, chunk);
+              return;
+            }
             const parts = (partial + chunk).split("\n");
             partial = parts.pop();
             for (const l2 of parts)
               showLine(l2);
+          },
+          onSettled: (final) => {
+            if (bgId === null)
+              return;
+            const job = bgShells.finish(bgId, final);
+            if (!job || job.status === "killed")
+              return;
+            const ok = final.code === 0;
+            console.log((ok ? source_default.green : source_default.red)(`  \u2699 background #${job.id} finished (exit ${final.code ?? final.signal}): ${job.cmd.length > 50 ? job.cmd.slice(0, 49) + "\u2026" : job.cmd}`) + source_default.dim("  /bashes show " + job.id));
+            toolOutputs.add({ name: "bash", label: `!${job.cmd} (background #${job.id})`, output: final.output, isError: !ok, durationMs: 0 });
           }
         });
         if (partial)
           showLine(partial);
       } finally {
+        bangDetach = null;
         agentRunning = false;
       }
+      if (result.detached && ctl) {
+        const job = bgShells.add(bang, ctl, result.output);
+        bgId = job.id;
+        console.log(source_default.cyan(`  \u2699 Moved to background as #${job.id}`) + source_default.dim("  (/bashes to list \xB7 /bashes show " + job.id + " \xB7 /bashes kill " + job.id + ")"));
+        messages.push(
+          { role: "user", content: [{ type: "text", text: bangTranscript(bang, result) }] },
+          { role: "assistant", content: [{ type: "text", text: "Noted the command output." }] }
+        );
+        updateTitle();
+        saveSession(sessionId, sessionTitle || "Untitled", workDir, messages);
+        rl.resume();
+        rl.prompt();
+        return;
+      }
       const tag = result.aborted ? source_default.yellow("  interrupted") : result.timedOut ? source_default.yellow("  timed out") : result.code === 0 ? source_default.dim("  exit 0") : source_default.red(`  exit ${result.code ?? result.signal}`);
       console.log(tag);
       if (result.output) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexrall-code",
-  "version": "0.5.130",
+  "version": "0.5.131",
   "description": "Nexrall Code — AI coding assistant for your terminal (headless agent for scripts, CI and automation)",
   "keywords": [
     "ai",