nexrall-code 0.5.47 → 0.5.49

package/dist/index.js

@@ -3156,6 +3156,8 @@ var require_auth = __commonJS({
     exports.clearAuth = clearAuth2;
     exports.isAuthenticated = isAuthenticated3;
     exports.getToken = getToken;
+    exports.getRefreshToken = getRefreshToken;
+    exports.updateTokens = updateTokens;
     var fs9 = __importStar(__require("fs"));
     var path6 = __importStar(__require("path"));
     var os6 = __importStar(__require("os"));
@@ -3205,6 +3207,34 @@ var require_auth = __commonJS({
       const auth = loadAuth();
       return auth?.token ?? null;
     }
+    function getRefreshToken() {
+      const envToken = process.env.NEXRALL_TOKEN;
+      if (envToken && envToken.trim().length > 0)
+        return null;
+      const auth = loadAuth();
+      const rt = auth?.refreshToken;
+      return typeof rt === "string" && rt.length > 0 ? rt : null;
+    }
+    function updateTokens(token, refreshToken) {
+      let existing = {};
+      try {
+        if (fs9.existsSync(CONFIG_FILE)) {
+          const parsed = JSON.parse(fs9.readFileSync(CONFIG_FILE, "utf-8"));
+          if (typeof parsed === "object" && parsed !== null)
+            existing = parsed;
+        }
+      } catch {
+      }
+      ensureConfigDir();
+      const next = {
+        ...existing,
+        token,
+        // Keep the previous refresh token if the server didn't send a new one, rather
+        // than deleting the only means of refreshing again.
+        ...refreshToken ? { refreshToken } : {}
+      };
+      fs9.writeFileSync(CONFIG_FILE, JSON.stringify(next, null, 2), { mode: 384 });
+    }
   }
 });
 
@@ -9842,6 +9872,7 @@ var require_client = __commonJS({
     exports.chooseFinalContent = chooseFinalContent;
     exports.streamChat = streamChat;
     exports.cancelTurn = cancelTurn;
+    exports.revokeRefreshToken = revokeRefreshToken2;
     exports.getBalance = getBalance3;
     exports.exchangeVscodeCode = exchangeVscodeCode;
     exports.login = login2;
@@ -9892,6 +9923,49 @@ var require_client = __commonJS({
         Authorization: `Bearer ${token}`
       };
     }
+    var _refreshInFlight = null;
+    async function refreshAccessToken() {
+      if (_refreshInFlight)
+        return _refreshInFlight;
+      _refreshInFlight = (async () => {
+        const refreshToken = (0, index_1.getRefreshToken)();
+        if (!refreshToken)
+          return false;
+        try {
+          const res = await (0, node_fetch_1.default)(`${exports.API_BASE}/api/auth/refresh`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ refreshToken })
+          });
+          if (!res.ok)
+            return false;
+          const data = await res.json();
+          if (!data.token)
+            return false;
+          (0, index_1.updateTokens)(data.token, data.refreshToken);
+          return true;
+        } catch {
+          return false;
+        }
+      })();
+      try {
+        return await _refreshInFlight;
+      } finally {
+        _refreshInFlight = null;
+      }
+    }
+    function isExpiredTokenResponse(status, body) {
+      if (status !== 401 && status !== 403)
+        return false;
+      try {
+        const parsed = JSON.parse(body);
+        if (parsed?.error && typeof parsed.error === "object")
+          return false;
+        return typeof parsed?.error === "string" && /token|auth|expired/i.test(parsed.error);
+      } catch {
+        return false;
+      }
+    }
     var MAX_RETRIES = 5;
     var RETRY_BASE_MS = 1e3;
     var RETRY_MAX_MS = 3e4;
@@ -9974,14 +10048,43 @@ var require_client = __commonJS({
           onEvent({ type: "retry_resolved" });
         }
       };
+      const prepareRestart = async (reason) => {
+        await cancelTurn(turnId);
+        turnId = (0, crypto_1.randomUUID)();
+        resuming = false;
+        serverResumable = false;
+        lastEventId = 0;
+        carryText = [];
+        carryToolUse = [];
+        const hadRendered = emittedAnythingAcrossAttempts;
+        const renderedChars = emittedCharsAcrossAttempts;
+        emittedAnythingAcrossAttempts = false;
+        emittedCharsAcrossAttempts = 0;
+        if (hadRendered && !allowRestartAfterRender)
+          return false;
+        if (hadRendered) {
+          onEvent({ type: "stream_restart", reason, discardedChars: renderedChars });
+        }
+        return true;
+      };
+      const bodySaysNotResumable = (body) => {
+        try {
+          return JSON.parse(body)?.notResumable === true;
+        } catch {
+          return false;
+        }
+      };
       async function runAttempt() {
         let response;
         let lastErr;
         let inFlightWaits = 0;
         let errorBodyOverride = null;
         let forbiddenExhausted = false;
+        let refreshedThisAttempt = false;
+        let sessionExpired = false;
         for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
           try {
+            errorBodyOverride = null;
             response = await (0, node_fetch_1.default)(...buildFetchArgs());
             if (response.status === 429 && attempt < MAX_RETRIES && canRetry()) {
               reportRetry("Rate limited by the API \u2014 retrying");
@@ -9994,9 +10097,30 @@ var require_client = __commonJS({
               await sleepWithinBudget(backoffMs(attempt));
               continue;
             }
+            if (response.status === 401 || response.status === 403) {
+              const bodyText = await response.text().catch(() => "");
+              if (isExpiredTokenResponse(response.status, bodyText)) {
+                if (!refreshedThisAttempt) {
+                  refreshedThisAttempt = true;
+                  if (await refreshAccessToken()) {
+                    reportRetry("Session expired \u2014 signing you back in");
+                    attempt--;
+                    continue;
+                  }
+                }
+                sessionExpired = true;
+                errorBodyOverride = JSON.stringify({
+                  // Replaces the backend's bare "Invalid or expired token", which reads
+                  // like a bug rather than something the user can act on.
+                  error: "Your session has expired. Run `nex login` to sign in again."
+                });
+                break;
+              }
+              errorBodyOverride = bodyText;
+            }
             const FORBIDDEN_RETRY_LIMIT = 2;
             if (response.status === 403) {
-              const bodyText = await response.text().catch(() => "");
+              const bodyText = errorBodyOverride ?? await response.text().catch(() => "");
               let isUpstreamForbidden = false;
               try {
                 const parsed = JSON.parse(bodyText);
@@ -10016,35 +10140,22 @@ var require_client = __commonJS({
               errorBodyOverride = bodyText;
               break;
             }
-            if (response.status === 410 && resuming) {
-              await response.text().catch(() => "");
-              await cancelTurn(turnId);
-              turnId = (0, crypto_1.randomUUID)();
-              resuming = false;
-              serverResumable = false;
-              lastEventId = 0;
-              carryText = [];
-              carryToolUse = [];
-              const hadRendered = emittedAnythingAcrossAttempts;
-              const renderedChars = emittedCharsAcrossAttempts;
-              emittedAnythingAcrossAttempts = false;
-              emittedCharsAcrossAttempts = 0;
-              if (hadRendered && !allowRestartAfterRender) {
-                throw new Error("Connection lost and this turn could no longer be resumed. Send your message again.");
-              }
-              if (hadRendered) {
-                onEvent({
-                  type: "stream_restart",
-                  reason: "Connection lost too long to resume",
-                  discardedChars: renderedChars
-                });
-              }
-              if (attempt < MAX_RETRIES && canRetry()) {
-                reportRetry("Could not resume \u2014 restarting this turn");
-                await sleepWithinBudget(backoffMs(attempt));
-                continue;
+            if (resuming && response.status >= 400 && response.status < 500) {
+              const body = errorBodyOverride ?? await response.text().catch(() => "");
+              if (response.status === 410 || response.status === 404 || bodySaysNotResumable(body)) {
+                const canRestart = await prepareRestart("Connection lost too long to resume");
+                if (!canRestart) {
+                  throw new Error("Connection lost and this turn could no longer be resumed. Send your message again.");
+                }
+                if (attempt < MAX_RETRIES && canRetry()) {
+                  reportRetry("Could not resume \u2014 restarting this turn");
+                  await sleepWithinBudget(backoffMs(attempt));
+                  continue;
+                }
+                errorBodyOverride = JSON.stringify({ error: "Could not resume this turn \u2014 send your message again." });
+                break;
               }
-              errorBodyOverride = JSON.stringify({ error: "Could not resume this turn \u2014 send your message again." });
+              errorBodyOverride = body;
               break;
             }
             if (response.status === 409) {
@@ -10096,7 +10207,12 @@ var require_client = __commonJS({
           } catch {
             errMsg = errText || errMsg;
           }
-          throw Object.assign(new Error(errMsg), { status: response.status, balance, ...forbiddenExhausted ? { retryable: true } : {} });
+          throw Object.assign(new Error(errMsg), {
+            status: response.status,
+            balance,
+            ...forbiddenExhausted ? { retryable: true } : {},
+            ...sessionExpired ? { authExpired: true } : {}
+          });
         }
         if (!response.body) {
           throw new Error("Response body is null");
@@ -10321,6 +10437,8 @@ var require_client = __commonJS({
                     stream.destroy?.();
                     reject(tagTransient(new Error(message)));
                   } else {
+                    clearInterval(heartbeatWatchdog);
+                    stream.destroy?.();
                     onEvent({ type: "error", message });
                     reject(new Error(message));
                   }
@@ -10381,27 +10499,10 @@ var require_client = __commonJS({
             const e2 = err;
             if (e2.retryable && sAttempt < MAX_RETRIES && canRetry()) {
               if (e2.forceRestart) {
-                await cancelTurn(turnId);
-                turnId = (0, crypto_1.randomUUID)();
-                resuming = false;
-                serverResumable = false;
-                lastEventId = 0;
-                carryText = [];
-                carryToolUse = [];
-                const hadRendered = emittedAnythingAcrossAttempts;
-                const renderedChars = emittedCharsAcrossAttempts;
-                emittedAnythingAcrossAttempts = false;
-                emittedCharsAcrossAttempts = 0;
-                if (hadRendered && !allowRestartAfterRender) {
+                const canRestart = await prepareRestart(err.message || "Could not resume \u2014 restarting this turn");
+                if (!canRestart) {
                   throw new Error("Connection lost and this turn could no longer be resumed. Send your message again.");
                 }
-                if (hadRendered) {
-                  onEvent({
-                    type: "stream_restart",
-                    reason: err.message || "Could not resume \u2014 restarting this turn",
-                    discardedChars: renderedChars
-                  });
-                }
                 reportRetry("Could not resume \u2014 restarting this turn");
                 await sleepWithinBudget(backoffMs(sAttempt));
                 continue;
@@ -10445,11 +10546,30 @@ var require_client = __commonJS({
       } catch {
       }
     }
+    async function revokeRefreshToken2() {
+      const refreshToken = (0, index_1.getRefreshToken)();
+      if (!refreshToken)
+        return;
+      try {
+        await (0, node_fetch_1.default)(`${exports.API_BASE}/api/auth/logout`, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ refreshToken })
+        });
+      } catch {
+      }
+    }
     async function getBalance3() {
-      const response = await (0, node_fetch_1.default)(`${exports.API_BASE}/api/code/balance`, {
-        method: "GET",
-        headers: authHeaders()
-      });
+      const fetchOnce = () => (0, node_fetch_1.default)(`${exports.API_BASE}/api/code/balance`, { method: "GET", headers: authHeaders() });
+      let response = await fetchOnce();
+      if (response.status === 401 || response.status === 403) {
+        const body = await response.text().catch(() => "");
+        if (isExpiredTokenResponse(response.status, body) && await refreshAccessToken()) {
+          response = await fetchOnce();
+        } else {
+          throw new Error(`API error ${response.status}: ${body}`);
+        }
+      }
       if (!response.ok) {
         const errText = await response.text();
         throw new Error(`API error ${response.status}: ${errText}`);
@@ -10470,7 +10590,11 @@ var require_client = __commonJS({
       const data = await response.json();
       if (!data.token)
         throw new Error("No token in exchange response");
-      return { token: data.token, email: data.user?.email ?? "" };
+      return {
+        token: data.token,
+        ...data.refreshToken ? { refreshToken: data.refreshToken } : {},
+        email: data.user?.email ?? ""
+      };
     }
     async function login2(email, password) {
       const response = await (0, node_fetch_1.default)(`${exports.API_BASE}/api/auth/login/email`, {
@@ -10486,7 +10610,11 @@ var require_client = __commonJS({
       if (!data.token) {
         throw new Error("Login response missing token");
       }
-      return { token: data.token, email: data.email ?? email };
+      return {
+        token: data.token,
+        ...data.refreshToken ? { refreshToken: data.refreshToken } : {},
+        email: data.email ?? email
+      };
     }
   }
 });
@@ -10691,6 +10819,144 @@ var require_editCompleteness = __commonJS({
   }
 });
 
+// ../core/dist/agent/securityLint.js
+var require_securityLint = __commonJS({
+  "../core/dist/agent/securityLint.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.checkSecurity = checkSecurity;
+    exports.securityNoteText = securityNoteText;
+    var SAMPLE_MAX = 160;
+    function redact(line) {
+      const masked = line.replace(/(['"`]?[\w.-]*(?:secret|password|passwd|token|api[_-]?key|apikey|auth|credential|private[_-]?key)[\w.-]*['"`]?\s*[:=]\s*)(['"`])([^'"`]{4,})\2/gi, (_m, head, q) => `${head}${q}[REDACTED]${q}`).replace(/\b(sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|AKIA[0-9A-Z]{16}|xox[baprs]-[A-Za-z0-9-]{10,})\b/g, "[REDACTED]");
+      return masked.length > SAMPLE_MAX ? masked.slice(0, SAMPLE_MAX) + "\u2026" : masked;
+    }
+    function isLikelyCommentLine(line) {
+      return /^\s*(\/\/|\*|#|--|<!--)/.test(line);
+    }
+    var RULES = [
+      // ── Hardcoded credentials ───────────────────────────────────────────────────
+      // Provider-prefixed tokens are near-zero false positive: the prefixes are
+      // registered formats, not something that occurs naturally in source. Checked
+      // inside comments too — a key commented out is still a committed key.
+      {
+        kind: "hardcoded-secret",
+        re: /\b(sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|AKIA[0-9A-Z]{16}|xox[baprs]-[A-Za-z0-9-]{10,}|AIza[0-9A-Za-z_-]{30,})\b/,
+        message: "Looks like a real API key/token committed to source. Move it to an environment variable and rotate the exposed key.",
+        includeComments: true
+      },
+      // NOTE: the `private-key` check is NOT here — it needs to span multiple lines
+      // (BEGIN header on one, base64 body on the next), which this per-line loop
+      // cannot express. It runs separately in checkSecurity below.
+      {
+        kind: "hardcoded-password",
+        // An ASSIGNMENT of a credential-ish name to a non-trivial literal.
+        //
+        // Tightened after measuring against the real backend, where the looser version
+        // fired on `missingSecret:'FIREBASE_TOKEN'` — code that NAMES a secret in an
+        // error message, the opposite of leaking one. So a value that is itself just a
+        // SCREAMING_SNAKE identifier (an env-var name) is excluded, along with the
+        // usual placeholder vocabulary. The value must also look like actual secret
+        // material: mixed case or digits, not a lone lowercase word.
+        re: /(?:password|passwd|secret|api[_-]?key|apikey|access[_-]?token)['"`]?\s*[:=]\s*['"`](?![A-Z0-9_]+['"`])(?!.*(?:\$\{|process\.env|os\.environ|example|changeme|placeholder|redacted|xxx|test|dummy|fake|sample|your[_-]?|<|\*{3}))(?=[^'"`]*[0-9A-Z])[^'"`\s]{10,}['"`]/,
+        message: "Hardcoded credential literal. Read it from the environment/secret store instead, and rotate the exposed value.",
+        includeComments: true
+      },
+      // ── Injection ───────────────────────────────────────────────────────────────
+      {
+        kind: "dynamic-eval",
+        // The negative lookbehind for `.` is what makes this usable: `redisClient.eval`
+        // (a Redis Lua script), `page.eval` (Playwright), `vm.eval` and friends are
+        // METHOD calls on an object and have nothing to do with JavaScript's global
+        // eval. Without it, the real backend's Redis idempotency script was flagged.
+        // Only a bare `eval(` / `new Function(` with a non-literal argument counts.
+        re: /(?<![.\w$])(?:eval|new\s+Function)\s*\(\s*(?!['"`][^'"`]*['"`]\s*\))[^)]*[a-zA-Z_$][\w$]*/,
+        message: "eval / new Function on a non-literal value executes arbitrary code if that value is ever user-controlled. Use an explicit parser or a lookup table."
+      },
+      {
+        kind: "sql-injection",
+        // Only fires when the interpolated expression is plausibly REQUEST-DERIVED.
+        //
+        // The obvious pattern — any `${...}` inside a SQL string — was measured
+        // against the real backend and flagged 15 of 183 files, essentially all of
+        // them safe and idiomatic: `${sets.join(', ')}` for a dynamic UPDATE, `${field}`
+        // for a server-chosen column, `${CONSUMPTION}` for a module constant. At that
+        // hit rate the warning is pure noise, and noise is worse than silence because
+        // it teaches everyone to skip the channel.
+        //
+        // So the interpolation must name something that plausibly came from the
+        // outside: req/request/params/query/body/input/user/args, or a bare
+        // `'...' + ident`. This trades recall for precision on purpose — thorough SQL
+        // review is the security-auditor agent's job, not an inline regex's.
+        re: /\b(?:SELECT|INSERT\s+INTO|UPDATE|DELETE\s+FROM)\b[^;'"`]{0,160}(?:\$\{\s*(?:req|request|params?|query|body|input|user|args|ctx)\b|['"`]\s*\+\s*(?:req|request|params?|query|body|input|user|args|ctx)\b|%\s*\(\s*(?:request|params?|query|body|input|user)\b)/i,
+        message: "SQL built by interpolating a request-derived value. Use a parameterised query ($1 / ? placeholders) \u2014 this is the classic injection sink."
+      },
+      {
+        kind: "command-injection",
+        // Shell execution with an interpolated or concatenated argument.
+        re: /\b(?:exec|execSync|spawnSync?|system|popen|os\.system|subprocess\.(?:call|run|Popen))\s*\(\s*(?:[`'"][^`'"]*(?:\$\{|['"]\s*\+)|[a-zA-Z_$][\w$]*\s*\+)/,
+        message: "Shell command built from a variable. Pass arguments as an array (no shell), or validate against an allowlist \u2014 a value containing ; or $() becomes command execution."
+      },
+      // ── Transport / verification ────────────────────────────────────────────────
+      {
+        kind: "tls-verification-disabled",
+        re: /(?:rejectUnauthorized\s*:\s*false|NODE_TLS_REJECT_UNAUTHORIZED\s*=\s*['"]?0|verify\s*=\s*False|InsecureSkipVerify\s*:\s*true)/,
+        message: "TLS certificate verification is disabled, which removes protection against man-in-the-middle attacks. Trust a specific CA instead if the cert is self-signed."
+      }
+    ];
+    function checkSecurity(content, max = 5) {
+      if (!content)
+        return [];
+      const findings = [];
+      const lines = content.split(/\r?\n/);
+      const pemIdx = lines.findIndex((l) => /-----BEGIN\s+(?:RSA|EC|DSA|OPENSSH|PGP)?\s*PRIVATE KEY-----/.test(l));
+      if (pemIdx !== -1) {
+        const following = lines.slice(pemIdx, pemIdx + 4).join("\n");
+        if (/[A-Za-z0-9+/]{40,}/.test(following.replace(/-----[^-]+-----/g, ""))) {
+          findings.push({
+            kind: "private-key",
+            message: "A private key with real key material is being written into source. Store it outside the repo (secret manager / env var) and rotate it.",
+            line: pemIdx + 1,
+            sample: "-----BEGIN PRIVATE KEY----- [REDACTED]"
+          });
+        }
+      }
+      const seenKinds = /* @__PURE__ */ new Set();
+      for (let i2 = 0; i2 < lines.length && findings.length < max; i2++) {
+        const line = lines[i2];
+        if (!line || line.length > 2e3)
+          continue;
+        const commentish = isLikelyCommentLine(line);
+        for (const rule of RULES) {
+          if (seenKinds.has(rule.kind))
+            continue;
+          if (commentish && !rule.includeComments)
+            continue;
+          if (!rule.re.test(line))
+            continue;
+          seenKinds.add(rule.kind);
+          findings.push({ kind: rule.kind, message: rule.message, line: i2 + 1, sample: redact(line.trim()) });
+          break;
+        }
+      }
+      return findings;
+    }
+    function securityNoteText(findings) {
+      if (process.env.NEXRALL_SECURITY_LINT === "off")
+        return "";
+      if (!findings.length)
+        return "";
+      const lines = findings.map((f3) => `  \u2022 line ${f3.line} [${f3.kind}]: ${f3.message}
+    ${f3.sample}`);
+      return `
+
+\u26A0 SECURITY REVIEW (${findings.length} finding${findings.length > 1 ? "s" : ""}) \u2014 the write succeeded; check these before moving on:
+` + lines.join("\n") + `
+If a finding is a false positive (test fixture, placeholder, intentionally dynamic), say so and continue \u2014 do NOT rewrite correct code to silence it.`;
+    }
+  }
+});
+
 // ../core/dist/agent/memory.js
 var require_memory = __commonJS({
   "../core/dist/agent/memory.js"(exports) {
@@ -12354,6 +12620,7 @@ var require_executor = __commonJS({
     var sandbox_1 = require_sandbox();
     var auth_1 = require_auth();
     var editCompleteness_1 = require_editCompleteness();
+    var securityLint_1 = require_securityLint();
     var memory_1 = require_memory();
     var skills_1 = require_skills();
     var testIntegrity_1 = require_testIntegrity();
@@ -12606,24 +12873,19 @@ Resolve the conflict (remove <<<<<<< / ======= / >>>>>>> markers and keep the in
           } catch {
           }
         }
-        fs9.writeFileSync(resolved, content, "utf-8");
-        if (existingMode !== void 0) {
-          try {
-            fs9.chmodSync(resolved, existingMode);
-          } catch {
-          }
-        }
+        atomicWrite(resolved, content, existingMode);
         const bytes = Buffer.byteLength(content, "utf-8");
         const lines = content.split("\n").length;
+        const sec = (0, securityLint_1.securityNoteText)((0, securityLint_1.checkSecurity)(content));
         if (isNew) {
-          return { output: `Created ${resolved} (${lines} lines, ${bytes} bytes)` };
+          return { output: `Created ${resolved} (${lines} lines, ${bytes} bytes)${sec}` };
         }
         const xfile = crossFileBreakageWarning(resolved, normalizeLF(priorContent), normalizeLF(content), workDir ?? process.cwd());
         let tiMarker = "";
         const ti = (0, testIntegrity_1.analyzeTestEdit)(resolved, normalizeLF(priorContent), normalizeLF(content));
         if (ti.suspicious)
           tiMarker = (0, testIntegrity_1.encodeTestIntegrityMarker)(ti.findings);
-        return { output: `Overwrote ${resolved} (${lines} lines, ${bytes} bytes)${xfile}${tiMarker}` };
+        return { output: `Overwrote ${resolved} (${lines} lines, ${bytes} bytes)${xfile}${sec}${tiMarker}` };
       } catch (err) {
         return { error: err.message };
       }
@@ -13326,14 +13588,52 @@ ${globalCapMatches(output)}` : "";
       }
       return { mode: stat2.mode, content: fs9.readFileSync(resolved, "utf-8") };
     }
-    function atomicWritePreservingMode(resolved, data, mode) {
-      const tmp = resolved + ".nexrall_tmp";
-      fs9.writeFileSync(tmp, data, "utf-8");
+    function atomicWrite(resolved, data, mode) {
+      let target = resolved;
       try {
-        fs9.chmodSync(tmp, mode);
+        if (fs9.lstatSync(resolved).isSymbolicLink())
+          target = fs9.realpathSync(resolved);
       } catch {
       }
-      fs9.renameSync(tmp, resolved);
+      const tmp = `${target}.nexrall_tmp_${process.pid}`;
+      try {
+        fs9.writeFileSync(tmp, data, "utf-8");
+      } catch (err) {
+        const code = err.code;
+        if (code === "EACCES" || code === "EPERM" || code === "EROFS") {
+          fs9.writeFileSync(target, data, "utf-8");
+          if (mode !== void 0) {
+            try {
+              fs9.chmodSync(target, mode);
+            } catch {
+            }
+          }
+          return;
+        }
+        try {
+          fs9.rmSync(tmp, { force: true });
+        } catch {
+        }
+        throw err;
+      }
+      try {
+        if (mode !== void 0) {
+          try {
+            fs9.chmodSync(tmp, mode);
+          } catch {
+          }
+        }
+        fs9.renameSync(tmp, target);
+      } catch (err) {
+        try {
+          fs9.rmSync(tmp, { force: true });
+        } catch {
+        }
+        throw err;
+      }
+    }
+    function atomicWritePreservingMode(resolved, data, mode) {
+      atomicWrite(resolved, data, mode);
     }
     function normalizeLF(s2) {
       return s2.replace(/\r\n/g, "\n");
@@ -13371,9 +13671,10 @@ ${globalCapMatches(output)}` : "";
         const linesBefore = origNorm.split("\n").length;
         const linesAfter = updated.split("\n").length;
         const xfile = crossFileBreakageWarning(resolved, origNorm, normalizeLF(updated), workDir ?? process.cwd());
+        const sec = (0, securityLint_1.securityNoteText)((0, securityLint_1.checkSecurity)(newNorm));
         return { output: `Edited ${resolved} (${linesBefore} \u2192 ${linesAfter} lines)
 
-${diff3}${xfile}` };
+${diff3}${xfile}${sec}` };
       } catch (err) {
         return { error: err.message };
       }
@@ -13641,6 +13942,7 @@ ${body}${truncNote}
         let content = normalizeLF(rawFile);
         const originalNorm = content;
         const diffs = [];
+        const insertedText = [];
         for (let i2 = 0; i2 < edits.length; i2++) {
           const edit = edits[i2];
           const oldStr = normalizeLF(typeof edit.old_string === "string" ? edit.old_string : "");
@@ -13655,16 +13957,18 @@ ${body}${truncNote}
             return { error: `Edit #${i2 + 1}: old_string appears ${count} times \u2014 it must be unique. Add more surrounding context.` };
           }
           diffs.push(buildDiff(filePath, oldStr, newStr, content));
+          insertedText.push(newStr);
           content = literalReplace(content, oldStr, newStr);
         }
         const finalContent = wasCRLF ? content.replace(/\n/g, "\r\n") : content;
         atomicWritePreservingMode(resolved, finalContent, pre.mode);
         const xfile = crossFileBreakageWarning(resolved, originalNorm, content, workDir ?? process.cwd());
+        const sec = (0, securityLint_1.securityNoteText)((0, securityLint_1.checkSecurity)(insertedText.join("\n")));
         return {
           output: `Applied ${edits.length} edit(s) to ${resolved}:
 ` + diffs.map((d, i2) => `
 --- edit #${i2 + 1} ---
-${d}`).join("\n") + xfile
+${d}`).join("\n") + xfile + sec
         };
       } catch (err) {
         return { error: err.message };
@@ -14245,11 +14549,40 @@ var require_agentTypes = __commonJS({
     var path6 = __importStar(__require("path"));
     var os6 = __importStar(__require("os"));
     var index_1 = require_plugins();
+    var READ_ONLY_TOOLS = [
+      // Universal
+      "read_file",
+      "search_files",
+      "glob",
+      "list_directory",
+      "bash",
+      "bash_output",
+      "notebook_read",
+      "todo_write",
+      "todo_read",
+      // VS Code language server (ignored on the CLI)
+      "get_symbols",
+      "get_workspace_symbols",
+      "find_references",
+      "go_to_definition",
+      "get_hover",
+      "get_diagnostics"
+    ];
+    var RESEARCH_TOOLS = [...READ_ONLY_TOOLS, "web_search", "fetch_url"];
+    var WRITE_TOOLS = [
+      ...READ_ONLY_TOOLS,
+      "write_file",
+      "edit_file",
+      "multi_edit",
+      "create_directory",
+      "move_file",
+      "copy_file"
+    ];
     var BUILTIN_AGENTS = [
       {
         name: "reviewer",
         description: "Read-only code reviewer \u2014 finds correctness bugs, edge cases, and security issues in a diff or file set. Cannot modify files.",
-        tools: ["read_file", "search_files", "glob", "list_directory", "bash", "get_symbols", "get_workspace_symbols", "find_references", "go_to_definition", "get_diagnostics"],
+        tools: READ_ONLY_TOOLS,
         source: "builtin",
         prompt: [
           "You are a meticulous senior code reviewer. You NEVER modify files \u2014 you only read, search, and report.",
@@ -14265,6 +14598,162 @@ var require_agentTypes = __commonJS({
           "Report format: \u{1F534} Critical / \u{1F7E1} Warning / \u{1F7E2} Suggestion, each with file:line and a concrete fix,",
           "then a final verdict (APPROVE or REQUEST CHANGES) with a one-paragraph rationale."
         ].join("\n")
+      },
+      // Promoted from the security-audit plugin to a builtin.
+      //
+      // Leaving it plugin-only was indefensible next to `reviewer` being builtin:
+      // reviewer's own prompt already tells it to look for security issues, so
+      // security IS treated as default work — yet the specialist agent for it was
+      // invisible unless the user happened to know the plugin existed. For an agent
+      // that WRITES code, "you only get a security review if you knew to install
+      // something" is the wrong default.
+      {
+        name: "security-auditor",
+        description: "Read-only security auditor \u2014 hunts injection, authz, secrets, and validation flaws in a path or diff. Cannot modify files.",
+        tools: READ_ONLY_TOOLS,
+        model: "pro",
+        source: "builtin",
+        prompt: [
+          "You are a security auditor. You find real, exploitable flaws \u2014 not style issues.",
+          "",
+          "Method:",
+          "1. Map the attack surface FIRST: entry points (HTTP routes, message handlers, CLI args, file/network",
+          "   input, deserialization), then trace user-controlled data inward to where it is used.",
+          "2. For each finding: file:line, the flaw class, a one-line exploit scenario, and the concrete fix.",
+          "3. Grade severity honestly: Critical = remote compromise or data breach; High = auth bypass/IDOR;",
+          "   Medium = needs unusual preconditions; Low = hardening.",
+          "",
+          "Classes worth the most attention, in order: injection (SQL/command/template/prototype), broken",
+          "authz (missing ownership checks, IDOR, trusting client-supplied ids), secrets committed to source,",
+          "path traversal, SSRF, unsafe deserialization, missing rate limits on expensive or auth endpoints,",
+          "and crypto misuse (hand-rolled comparison, predictable randomness).",
+          "",
+          "Hard rules:",
+          "- READ-ONLY: never modify, create or delete files. bash only for read-only inspection.",
+          "- NEVER print a discovered secret's value. Report its location and advise rotation.",
+          "- Distinguish EXPLOITABLE from theoretical, and say which one each finding is.",
+          '- "No issues found in scope X" is a valid, useful result. Do not pad the report to look thorough.'
+        ].join("\n")
+      },
+      // The gap Claude Code fills with its built-in `Explore`: read-heavy codebase
+      // search that would otherwise flood the parent's context. Defaults to the
+      // cheapest model on purpose — "find every caller of X" has no need of a
+      // frontier model, and this is the agent most likely to be spawned in bulk.
+      {
+        name: "explorer",
+        description: "Fast read-only codebase explorer \u2014 locates files, symbols, and call sites and reports concise findings. Use to keep bulk searching out of the main context. Cannot modify files.",
+        tools: READ_ONLY_TOOLS,
+        model: "turbo",
+        source: "builtin",
+        prompt: [
+          "You map code. You NEVER modify anything.",
+          "",
+          "Method:",
+          "1. Prefer structural search over text search where available (get_workspace_symbols, find_references,",
+          "   go_to_definition); fall back to search_files/glob otherwise.",
+          "2. Read only the sections you need \u2014 use read_file with offset/limit on large files instead of",
+          "   pulling in thousands of lines.",
+          "3. Follow the real call graph rather than guessing from names.",
+          "",
+          "Your ONLY output is a compact report: the file:line locations that matter, how they relate, and the",
+          "direct answer to the question you were given. This exists to keep bulk search OUT of the parent's",
+          "context, so do not paste large file contents back \u2014 cite locations and summarise. Say plainly when",
+          'something does not exist; a confident wrong answer is far worse than "not found".'
+        ].join("\n")
+      },
+      // Matches Claude Code's built-in `Plan`: research a change and return a
+      // strategy, deliberately WITHOUT write access so "make a plan" can never
+      // quietly become "start editing".
+      {
+        name: "planner",
+        description: "Read-only planning agent \u2014 researches a change and returns a concrete step-by-step implementation plan with risks and affected files. Cannot modify files.",
+        tools: RESEARCH_TOOLS,
+        model: "pro",
+        source: "builtin",
+        prompt: [
+          "You produce implementation plans. You NEVER modify files \u2014 planning and doing are separate steps,",
+          'and this agent exists so "plan it" cannot silently turn into "change it".',
+          "",
+          "Method:",
+          "1. Read the actual code before proposing anything. No plan may rest on an assumed API shape.",
+          "2. Find every affected call site (find_references / search_files) and list them.",
+          "3. Order the steps so the tree stays working after each one \u2014 types, then implementation, then",
+          "   tests, then exports/registration.",
+          "",
+          "Output:",
+          "- Goal, in one sentence.",
+          "- Numbered steps, each with the exact files touched and what changes in them.",
+          "- Risks + the specific thing that could break, and how it would be detected.",
+          "- How to verify (the exact test/build command for THIS project, taken from package.json/Makefile).",
+          "- Anything genuinely ambiguous, stated as an open question rather than a silent assumption."
+        ].join("\n")
+      },
+      // Promoted from the test-gen plugin. Needs write access — it produces test
+      // files — but is deliberately forbidden from touching source, because "make the
+      // tests pass" is the single most common way an agent destroys signal.
+      {
+        name: "test-writer",
+        description: "Writes tests that follow the project's existing conventions. May create/edit TEST files only \u2014 never production source.",
+        tools: WRITE_TOOLS,
+        // Enforced, not merely requested: the permission gate refuses a write whose
+        // path is not a test file. Without this the allowlist would grant edit_file
+        // for every path and the rule below would be a suggestion the model is free
+        // to rationalise its way past.
+        testFilesOnly: true,
+        source: "builtin",
+        prompt: [
+          "You write tests. You may create and edit TEST files only.",
+          "",
+          "Hard rules \u2014 these are the ways test-writing agents destroy value, so they are non-negotiable:",
+          "- NEVER modify production source to make a test pass. If the code looks wrong, REPORT it and stop.",
+          "- NEVER weaken, delete or skip an existing assertion or test.",
+          "- A test that cannot fail is worse than no test. Every test must be able to fail for one clear reason.",
+          "",
+          "Method:",
+          "1. Read the existing tests FIRST and copy their conventions exactly \u2014 runner, file naming, layout,",
+          "   assertion style, fixture/helper patterns. Never introduce a new framework.",
+          "2. Test observable behaviour and the contract, not private internals.",
+          "3. Cover the boring-but-real cases: empty input, null/undefined, unicode and non-BMP characters,",
+          "   boundaries, error paths, concurrency where it applies.",
+          "4. No sleeps or wall-clock dependence \u2014 those produce the flaky tests that get deleted later.",
+          "5. RUN the tests you wrote and report the real output. Never claim a test passes without running it."
+        ].join("\n")
+      },
+      // The DevOps gap — answered with a READ-ONLY advisor, not an operator.
+      //
+      // A "DevOps agent" with write/apply access is a genuinely different risk class
+      // from the others here: its mistakes are `kubectl delete`, a bad `terraform
+      // apply`, a broken deploy pipeline — often not revertible and affecting
+      // production rather than a working tree. So this one diagnoses and proposes a
+      // diff; a human applies it. That asymmetry is the whole design.
+      {
+        name: "devops-advisor",
+        description: "Read-only CI/CD, container, and infrastructure advisor \u2014 diagnoses pipelines, Dockerfiles, and k8s manifests and proposes concrete fixes as a diff. Never applies changes.",
+        tools: RESEARCH_TOOLS,
+        model: "pro",
+        source: "builtin",
+        prompt: [
+          "You are an infrastructure and delivery advisor. You DIAGNOSE and PROPOSE. You never apply changes.",
+          "",
+          "Hard rules:",
+          "- READ-ONLY, and stricter than the other read-only agents: bash is for INSPECTION only",
+          "  (git log/diff, cat, grep, `kubectl get/describe`, `docker images`, `terraform plan`).",
+          "  NEVER run anything that mutates infrastructure \u2014 no apply/delete/scale/rollout/restart/push,",
+          "  no `terraform apply`, no `helm upgrade`. If a fix needs such a command, WRITE IT OUT for a human.",
+          "- Never print secret values from env files, k8s Secrets or CI variables. Reference them by name.",
+          "",
+          "Method:",
+          "1. Read what actually exists \u2014 workflow files, Dockerfiles, manifests, kustomize overlays, the",
+          '   deploy scripts \u2014 before drawing any conclusion. Never reason from what a stack "usually" looks like.',
+          "2. Follow the real path a change takes to production, and name the step that is broken or missing.",
+          "3. Check the failure modes that bite hardest: CI path filters that skip files a workload actually",
+          "   needs, image tags that do not match what is deployed, missing health probes, absent resource",
+          "   limits, secrets baked into images, ports/timeouts inconsistent between proxy and app, and",
+          "   migrations that must run before the new image is live.",
+          "",
+          "Output: the diagnosis, the evidence (file:line or command output), the proposed change as a diff or",
+          "exact file content, and the command a human should run to apply and verify it."
+        ].join("\n")
       }
     ];
     function parseFrontmatter(raw) {
@@ -14283,6 +14772,9 @@ var require_agentTypes = __commonJS({
       const s2 = (v ?? "").toLowerCase();
       return s2 === "turbo" || s2 === "pro" || s2 === "ultra" ? s2 : void 0;
     }
+    function parseBool(v) {
+      return /^(true|yes|1|on)$/i.test((v ?? "").trim());
+    }
     function parseToolList(v) {
       if (!v)
         return void 0;
@@ -14311,7 +14803,12 @@ var require_agentTypes = __commonJS({
             tools: parseToolList(meta.tools),
             model: parseModel(meta.model),
             prompt: body,
-            source
+            source,
+            // Exposed to user/plugin definitions too — `test_files_only: true` (or
+            // `testFilesOnly`) lets anyone build a test-writing agent that genuinely
+            // cannot touch production source, rather than only the builtin getting
+            // that guarantee.
+            ...parseBool(meta.test_files_only ?? meta.testfilesonly) ? { testFilesOnly: true } : {}
           });
         } catch {
         }
@@ -14327,16 +14824,38 @@ var require_agentTypes = __commonJS({
         if (!out.has(agent.name))
           out.set(agent.name, agent);
       }
-      return [...out.values()];
+      const builtinOrder = new Map(BUILTIN_AGENTS.map((a, i2) => [a.name, i2]));
+      return [...out.values()].sort((a, b) => {
+        const ai = builtinOrder.get(a.name);
+        const bi = builtinOrder.get(b.name);
+        if (ai !== void 0 && bi !== void 0)
+          return ai - bi;
+        if (ai !== void 0)
+          return -1;
+        if (bi !== void 0)
+          return 1;
+        return a.name.localeCompare(b.name);
+      });
     }
     function summariseAgents(types3) {
       if (!types3.length)
         return "";
       return types3.map((t2) => {
-        const tools = t2.tools ? ` (tools: ${t2.tools.join(", ")})` : "";
-        return `- ${t2.name}: ${t2.description}${tools}`;
+        const canWrite = !t2.tools || t2.tools.some((x2) => WRITE_TOOL_HINTS.has(x2));
+        const access = t2.testFilesOnly ? "writes TEST files only" : canWrite ? "can modify files" : "read-only";
+        const model = t2.model ? `, ${t2.model} model` : "";
+        return `- ${t2.name} (${access}${model}): ${t2.description}`;
       }).join("\n");
     }
+    var WRITE_TOOL_HINTS = /* @__PURE__ */ new Set([
+      "write_file",
+      "edit_file",
+      "multi_edit",
+      "notebook_edit",
+      "delete_file",
+      "move_file",
+      "copy_file"
+    ]);
     function findAgentType(types3, name) {
       if (!name)
         return void 0;
@@ -14738,9 +15257,14 @@ var require_loop = __commonJS({
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.VERIFY_CMD_RE = exports.WRITE_TOOL_NAMES = void 0;
     exports.resolveMaxIterations = resolveMaxIterations;
+    exports.createLimiter = createLimiter;
+    exports.extractSubTaskText = extractSubTaskText;
+    exports.capSubTaskText = capSubTaskText;
+    exports.summariseSubTaskProgress = summariseSubTaskProgress;
     exports.contextWindowFor = contextWindowFor2;
     exports.compactionThresholds = compactionThresholds2;
     exports.estimateBodyBytes = estimateBodyBytes2;
+    exports.allowsTestOnlyWrite = allowsTestOnlyWrite;
     exports.findSafeCutIndex = findSafeCutIndex;
     exports.transcriptOf = transcriptOf;
     exports.createLedger = createLedger;
@@ -14900,6 +15424,29 @@ var require_loop = __commonJS({
           _fileLocks.delete(absPath);
       }
     }
+    var MAX_CONCURRENT_SUBTASKS = (() => {
+      const raw = Number(process.env.NEXRALL_MAX_CONCURRENT_SUBTASKS);
+      return Number.isFinite(raw) && raw > 0 ? Math.floor(raw) : 4;
+    })();
+    function createLimiter(max) {
+      let active = 0;
+      const queue = [];
+      const release2 = () => {
+        active--;
+        queue.shift()?.();
+      };
+      return async (fn) => {
+        if (active >= max)
+          await new Promise((resolve3) => queue.push(resolve3));
+        active++;
+        try {
+          return await fn();
+        } finally {
+          release2();
+        }
+      };
+    }
+    var _subTaskLimit = createLimiter(MAX_CONCURRENT_SUBTASKS);
     function humanDescription(name, input) {
       switch (name) {
         case "read_file":
@@ -14981,16 +15528,71 @@ var require_loop = __commonJS({
           return `Use tool: ${name}`;
       }
     }
-    var MAX_TASK_DEPTH = 2;
+    var MAX_TASK_DEPTH = 1;
     var _subTaskCounter = 0;
     var SUBTASK_TIMEOUT_MS = Number(process.env.NEXRALL_SUBTASK_TIMEOUT_MS) > 0 ? Number(process.env.NEXRALL_SUBTASK_TIMEOUT_MS) : 10 * 60 * 1e3;
+    var SUBTASK_MAX = 48e3;
+    function sliceSafeEnd(s2, max) {
+      if (s2.length <= max)
+        return s2;
+      let end = max;
+      const code = s2.charCodeAt(end - 1);
+      if (code >= 55296 && code <= 56319)
+        end--;
+      return s2.slice(0, end);
+    }
+    function sliceSafeStart(s2, from) {
+      if (from <= 0)
+        return s2;
+      let start = from;
+      const code = s2.charCodeAt(start);
+      if (code >= 56320 && code <= 57343)
+        start++;
+      return s2.slice(start);
+    }
+    function extractSubTaskText(messages, preferLast = true) {
+      const assistants = messages.filter((m2) => m2.role === "assistant");
+      const textOf = (m2) => (m2?.content ?? []).filter((b) => b.type === "text" && typeof b.text === "string").map((b) => b.text).join("").trim();
+      if (preferLast)
+        return textOf(assistants[assistants.length - 1]);
+      return assistants.map(textOf).filter(Boolean).join("\n\n").trim();
+    }
+    function capSubTaskText(text, max = SUBTASK_MAX) {
+      if (text.length <= max)
+        return text;
+      const head = sliceSafeEnd(text, Math.floor(max * 0.6));
+      const tail = sliceSafeStart(text, text.length - Math.floor(max * 0.4));
+      return `${head}
+
+[\u2026 sub-task output truncated (${text.length} chars) \u2014 kept the beginning and end \u2026]
+
+${tail}`;
+    }
+    function summariseSubTaskProgress(messages) {
+      const toolNames = [];
+      for (const m2 of messages) {
+        if (m2.role !== "assistant" || !Array.isArray(m2.content))
+          continue;
+        for (const b of m2.content) {
+          if (b?.type === "tool_use" && typeof b.name === "string")
+            toolNames.push(b.name);
+        }
+      }
+      if (toolNames.length === 0)
+        return "";
+      const counts = /* @__PURE__ */ new Map();
+      for (const n of toolNames)
+        counts.set(n, (counts.get(n) ?? 0) + 1);
+      const inventory = [...counts.entries()].sort((a, b) => b[1] - a[1]).map(([name, n]) => n > 1 ? `${name} \xD7${n}` : name).join(", ");
+      return `Tool calls completed before it was stopped (${toolNames.length} total): ${inventory}.`;
+    }
     async function runSubTask(input, options, agentTypes) {
       const prompt2 = typeof input.prompt === "string" ? input.prompt.trim() : "";
       if (!prompt2)
         return { error: "task tool requires a non-empty prompt" };
       const depth = options._depth ?? 0;
       if (depth >= MAX_TASK_DEPTH) {
-        return { error: `Sub-task depth limit (${MAX_TASK_DEPTH}) reached \u2014 sub-agents cannot spawn further sub-agents.` };
+        return { error: "Sub-agents cannot spawn further sub-agents. Do this work directly, or report back so the main agent can delegate it." };
       }
       const requestedType = typeof input.subagent_type === "string" ? input.subagent_type : "";
       const agent = (0, agentTypes_1.findAgentType)(agentTypes, requestedType);
@@ -15008,6 +15610,8 @@ ${options.nexrallMd}` : "") : options.nexrallMd;
       const gatedPermission = async (req) => {
         if (allowed && !allowed.has(req.tool))
           return false;
+        if (agent?.testFilesOnly && !allowsTestOnlyWrite(req.tool, req.input))
+          return false;
         return options.requestPermission(req);
       };
       const subMessages = [
@@ -15064,22 +15668,36 @@ ${options.nexrallMd}` : "") : options.nexrallMd;
           onThinkingProgress: (tok) => options.onThinkingProgress?.(tok)
         });
         if (subAbort.aborted && !options.abortSignal?.aborted) {
-          return { error: `Sub-task stalled and was stopped after ${Math.round(SUBTASK_TIMEOUT_MS / 6e4)} minutes with no completion. Consider breaking it into smaller sub-tasks or investigating what it may have been stuck on (a hung command, an unresponsive MCP/tool call, or a very large scope).` };
-        }
-        const lastAssistant = [...result].reverse().find((m2) => m2.role === "assistant");
-        let text = (lastAssistant?.content ?? []).filter((b) => b.type === "text").map((b) => b.text).join("").trim();
-        const SUBTASK_MAX = 48e3;
-        if (text.length > SUBTASK_MAX) {
-          const head = text.slice(0, Math.floor(SUBTASK_MAX * 0.6));
-          const tail = text.slice(text.length - Math.floor(SUBTASK_MAX * 0.4));
-          text = `${head}
-
-[\u2026 sub-task output truncated (${text.length} chars) \u2014 kept the beginning and end \u2026]
-
-${tail}`;
-        }
+          const mins = Math.round(SUBTASK_TIMEOUT_MS / 6e4);
+          const partial = capSubTaskText(extractSubTaskText(result, false));
+          const progress = summariseSubTaskProgress(result);
+          const sections = [
+            `Sub-task STOPPED after ${mins} minutes without completing \u2014 treat the following as PARTIAL, unverified work, not a finished answer.`,
+            progress,
+            partial ? `Partial output before it was stopped:
+
+${partial}` : "",
+            "Do NOT simply re-run the same sub-task: build on what is above, or split the remaining work into smaller, more focused sub-tasks."
+          ].filter(Boolean);
+          return { error: sections.join("\n\n") };
+        }
+        const text = capSubTaskText(extractSubTaskText(result, true));
         return { output: text || "(sub-task completed with no text output)" };
       } catch (err) {
+        const salvaged = (0, types_1.salvageHistory)(err);
+        if (salvaged) {
+          const partial = capSubTaskText(extractSubTaskText(salvaged, false));
+          const progress = summariseSubTaskProgress(salvaged);
+          const sections = [
+            `Sub-task FAILED before completing: ${err.message}`,
+            progress,
+            partial ? `Partial output before the failure:
+
+${partial}` : "",
+            "Treat the above as PARTIAL, unverified work. Build on it rather than re-running the whole sub-task."
+          ].filter(Boolean);
+          return { error: sections.join("\n\n") };
+        }
         return { error: `Sub-task failed: ${err.message}` };
       } finally {
         clearTimeout(timer);
@@ -15138,6 +15756,15 @@ ${tail}`;
       return true;
     }
     exports.WRITE_TOOL_NAMES = /* @__PURE__ */ new Set(["write_file", "edit_file", "multi_edit", "delete_file", "move_file", "copy_file", "notebook_edit"]);
+    function allowsTestOnlyWrite(tool, input) {
+      if (!exports.WRITE_TOOL_NAMES.has(tool))
+        return true;
+      const pathKeys = tool === "notebook_edit" ? ["path"] : ["path", "source", "dest", "destination"];
+      const candidates = pathKeys.map((k) => input?.[k]).filter((v) => typeof v === "string" && v.length > 0);
+      if (candidates.length === 0)
+        return false;
+      return candidates.every((p) => (0, testIntegrity_1.isTestFile)(p));
+    }
     exports.VERIFY_CMD_RE = /\b(npm|yarn|pnpm)\s+(run\s+)?(test|build|lint|typecheck|tsc)\b|\bpytest\b|\bgo\s+(test|vet|build)\b|\btsc\b|\beslint\b|\bcargo\s+(test|build|check)\b/i;
     function findSafeCutIndex(messages, maxIdx) {
       for (let i2 = Math.min(maxIdx, messages.length - 1); i2 >= 2; i2--) {
@@ -15678,7 +16305,7 @@ Continue the work from here.` }] });
             if (!permitted) {
               result = { error: "Permission denied by user" };
             } else if (name === "task") {
-              result = await runSubTask(input, options, agentTypes);
+              result = depth === 0 ? await _subTaskLimit(() => runSubTask(input, options, agentTypes)) : await runSubTask(input, options, agentTypes);
             } else {
               const pre = runToolHooks(hooks.PreToolUse, "PreToolUse", name, input, options.workDir);
               if (pre.block) {
@@ -17464,6 +18091,7 @@ var require_dist2 = __commonJS({
     __exportStar(require_loop(), exports);
     __exportStar(require_testIntegrity(), exports);
     __exportStar(require_editCompleteness(), exports);
+    __exportStar(require_securityLint(), exports);
     __exportStar(require_crossFile(), exports);
     __exportStar(require_flaky(), exports);
     __exportStar(require_claimEvidence(), exports);
@@ -51904,6 +52532,7 @@ async function logoutCommand() {
     console.log();
     return;
   }
+  await (0, import_code_core.revokeRefreshToken)();
   (0, import_code_core.clearAuth)();
   console.log(source_default.green("  \u2713 Logged out."));
   console.log();
@@ -62537,7 +63166,7 @@ var InkReadlineAdapter = class extends EventEmitter3 {
 };
 
 // src/commands/chat.ts
-var CLI_VERSION = "0.5.47";
+var CLI_VERSION = "0.5.49";
 var MODEL_LABELS = {
   turbo: "Nexrall Turbo",
   pro: "Nexrall Pro",
@@ -62622,28 +63251,83 @@ ${content}`);
   }
   return parts.length > 0 ? parts.join("\n\n---\n\n") : void 0;
 }
+var THINK_TAIL_CHARS = 48;
+function composeStatusLine(opts) {
+  const timer = source_default.dim(` (${opts.elapsedSec}s)`);
+  const hint = opts.hint !== false && !opts.detail && opts.elapsedSec >= 15 ? source_default.dim("  \xB7 still running, no output yet is normal for quiet commands") : "";
+  const detail = opts.detail ? source_default.dim(`  ${opts.detail}`) : "";
+  return `${source_default.cyan(opts.frame)} ${source_default.dim(opts.text)}${timer}${detail}${hint}`;
+}
+function formatProgressTokens(tokens) {
+  if (!Number.isFinite(tokens) || tokens <= 0)
+    return "";
+  return tokens >= 1e3 ? `~${(tokens / 1e3).toFixed(1)}k tokens` : `~${tokens} tokens`;
+}
 var Spinner = class {
   interval = null;
   frames = ["\u25D0", "\u25D3", "\u25D1", "\u25D2"];
   i = 0;
   startedAt = 0;
   baseText = "";
-  start(text) {
+  // Extra live detail appended after the elapsed timer (e.g. "~1.2k tokens").
+  // Kept separate from `baseText` and mutated through setDetail() so a stream of
+  // progress events can refresh it WITHOUT restarting the spinner — calling
+  // start() again would reset `startedAt` and the elapsed counter would sit at 0s
+  // forever, which is precisely the "is it frozen?" signal this class exists to
+  // remove.
+  detail = "";
+  // Whether the reassurance hint applies. Off for phases where slowness is
+  // already explained by the detail text (e.g. a live token counter is itself
+  // proof of life, so "no output yet is normal" would be noise).
+  hintEnabled = true;
+  start(text, opts) {
     this.stop();
     this.baseText = text;
+    this.detail = "";
+    this.hintEnabled = opts?.hint !== false;
     this.startedAt = Date.now();
-    this.interval = setInterval(() => {
-      const elapsedSec = Math.floor((Date.now() - this.startedAt) / 1e3);
-      const timer = source_default.dim(` (${elapsedSec}s)`);
-      const hint = elapsedSec >= 15 ? source_default.dim("  \xB7 still running, no output yet is normal for quiet commands") : "";
-      getInkTerminal()?.setLive(`${source_default.cyan(this.frames[this.i % this.frames.length])} ${source_default.dim(this.baseText)}${timer}${hint}`);
-      this.i++;
-    }, 100);
+    this.render();
+    this.interval = setInterval(() => this.render(), 100);
+  }
+  /**
+   * Replace the trailing detail text in place, keeping the elapsed timer running.
+   *
+   * No-op when the spinner isn't active: progress events can arrive a tick after
+   * something else (a tool row, the first text delta) legitimately stopped it, and
+   * resurrecting the spinner there would fight the printed output for the status line.
+   */
+  setDetail(detail) {
+    if (this.interval === null)
+      return;
+    if (this.detail === detail)
+      return;
+    this.detail = detail;
+    this.render();
+  }
+  /** Swap the label without resetting the elapsed timer (phase change within one turn). */
+  setText(text) {
+    if (this.interval === null)
+      return;
+    if (this.baseText === text)
+      return;
+    this.baseText = text;
+    this.render();
+  }
+  render() {
+    getInkTerminal()?.setLive(composeStatusLine({
+      frame: this.frames[this.i % this.frames.length],
+      text: this.baseText,
+      elapsedSec: Math.floor((Date.now() - this.startedAt) / 1e3),
+      detail: this.detail,
+      hint: this.hintEnabled
+    }));
+    this.i++;
   }
   stop() {
     if (this.interval !== null) {
       clearInterval(this.interval);
       this.interval = null;
+      this.detail = "";
       getInkTerminal()?.setLive("");
     }
   }
@@ -62719,8 +63403,26 @@ async function runTurn(messages, modelAlias, workDir, abortSignal, env3, nexrall
   let toolStartTime = 0;
   let lastToolName = "";
   let thinkingTokens = 0;
+  let liveThinkTail = "";
+  const pushStatus = () => {
+    const parts = [];
+    const tok = formatProgressTokens(thinkingTokens);
+    if (tok)
+      parts.push(tok);
+    if (liveThinkTail)
+      parts.push(liveThinkTail);
+    spinner.setDetail(parts.join("  \xB7 "));
+  };
+  const resumeWorking = (label = "working\u2026") => {
+    if (abortSignal.aborted)
+      return;
+    thinkingTokens = 0;
+    liveThinkTail = "";
+    spinner.start(label, { hint: false });
+  };
   setMode(mode);
   console.log();
+  spinner.start("thinking\u2026", { hint: false });
   const result = await (0, import_code_core3.runAgentLoop)(messages, {
     workDir,
     model: modelAlias,
@@ -62728,10 +63430,26 @@ async function runTurn(messages, modelAlias, workDir, abortSignal, env3, nexrall
     nexrallMd,
     mode,
     effort,
+    // The backend streams a cumulative output-token count (routes/code.js's
+    // sendProgress, throttled to ≤5/s) covering thinking, visible text AND
+    // tool-argument JSON. This used to be stored in a variable and rendered only
+    // at message_complete — i.e. after the turn was already over — so during the
+    // long phase it exists to describe, it showed nothing at all.
     onThinkingProgress: (tokens) => {
       thinkingTokens = tokens;
+      pushStatus();
     },
-    onThinkingDelta: () => {
+    // Live thinking text. Previously a hard no-op with the note "shown on
+    // onThinking" — but onThinking only fires at message_complete, so a long
+    // reasoning phase rendered nothing whatsoever until it had finished. Show a
+    // short rolling tail on the status line so the user can see it actively
+    // reasoning, then let onThinking print the proper summary block at the end.
+    onThinkingDelta: (text) => {
+      if (abortSignal.aborted)
+        return;
+      const flat = text.replace(/\s+/g, " ");
+      liveThinkTail = (liveThinkTail + flat).slice(-THINK_TAIL_CHARS);
+      pushStatus();
     },
     onThinking: (text) => {
       if (abortSignal.aborted)
@@ -62739,6 +63457,8 @@ async function runTurn(messages, modelAlias, workDir, abortSignal, env3, nexrall
       spinner.stop();
       console.log(formatThinking(text, thinkingTokens));
       thinkingTokens = 0;
+      liveThinkTail = "";
+      resumeWorking();
     },
     onText: (text) => {
       if (abortSignal.aborted)
@@ -62757,6 +63477,7 @@ async function runTurn(messages, modelAlias, workDir, abortSignal, env3, nexrall
       mdRender.flush();
       spinner.stop();
       console.log(source_default.dim(`  ${text}`));
+      resumeWorking();
     },
     onToolUse: (name, input) => {
       if (abortSignal.aborted)
@@ -62787,6 +63508,7 @@ async function runTurn(messages, modelAlias, workDir, abortSignal, env3, nexrall
       const durationMs = Date.now() - toolStartTime;
       console.log(formatToolResult(lastToolName, res, durationMs));
       toolStartTime = 0;
+      resumeWorking();
     },
     // Ignore a `partial` report: it belongs to a cut-short attempt that was restarted,
     // and the replacement attempt reports the turn's real totals. Letting it through
@@ -63822,6 +64544,12 @@ async function confirmInstall(i2, name, autoYes) {
   if (autoYes && dangerous) {
     console.log(source_default.yellow("\n  --yes does not apply to plugins with hooks/MCP; confirmation required."));
   }
+  if (!process.stdin.isTTY) {
+    console.log();
+    console.log(source_default.red("  \u2717 Cannot ask for confirmation: stdin is not a terminal."));
+    console.log(source_default.dim(dangerous ? "    This plugin ships hooks/MCP, which always require an interactive confirmation." : "    Re-run with --yes to install non-interactively."));
+    return false;
+  }
   console.log();
   const { ok } = await (0, import_prompts.default)({
     type: "confirm",
@@ -63989,7 +64717,7 @@ function pluginListCommand() {
 
 // src/index.ts
 var program2 = new Command();
-program2.name("nex").description("Nexrall Code \u2014 AI coding assistant (powered by Nexrall)").version("0.5.47");
+program2.name("nex").description("Nexrall Code \u2014 AI coding assistant (powered by Nexrall)").version("0.5.49").enablePositionalOptions();
 program2.command("auth").description("Login to your Nexrall account").action(authCommand);
 program2.command("logout").description("Log out of your Nexrall account").action(logoutCommand);
 program2.command("update").description("Update nex to the latest version").option("-c, --check", "Check for updates without installing").option("-y, --yes", "Skip confirmation prompt").action(async (opts) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexrall-code",
-  "version": "0.5.47",
+  "version": "0.5.49",
   "description": "Nexrall Code — AI coding assistant for your terminal (headless agent for scripts, CI and automation)",
   "keywords": [
     "ai",
@@ -41,7 +41,7 @@
     "react": "^19.2.8",
     "readline": "^1.3.0",
     "string-width": "^7.2.0",
-    "@nexrall/code-core": "1.4.22"
+    "@nexrall/code-core": "1.4.24"
   },
   "devDependencies": {
     "@aws-sdk/client-s3": "^3.600.0",