nexrall-code 0.5.48 → 0.5.49

package/dist/index.js

@@ -10819,6 +10819,144 @@ var require_editCompleteness = __commonJS({
   }
 });
 
+// ../core/dist/agent/securityLint.js
+var require_securityLint = __commonJS({
+  "../core/dist/agent/securityLint.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.checkSecurity = checkSecurity;
+    exports.securityNoteText = securityNoteText;
+    var SAMPLE_MAX = 160;
+    function redact(line) {
+      const masked = line.replace(/(['"`]?[\w.-]*(?:secret|password|passwd|token|api[_-]?key|apikey|auth|credential|private[_-]?key)[\w.-]*['"`]?\s*[:=]\s*)(['"`])([^'"`]{4,})\2/gi, (_m, head, q) => `${head}${q}[REDACTED]${q}`).replace(/\b(sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|AKIA[0-9A-Z]{16}|xox[baprs]-[A-Za-z0-9-]{10,})\b/g, "[REDACTED]");
+      return masked.length > SAMPLE_MAX ? masked.slice(0, SAMPLE_MAX) + "\u2026" : masked;
+    }
+    function isLikelyCommentLine(line) {
+      return /^\s*(\/\/|\*|#|--|<!--)/.test(line);
+    }
+    var RULES = [
+      // ── Hardcoded credentials ───────────────────────────────────────────────────
+      // Provider-prefixed tokens are near-zero false positive: the prefixes are
+      // registered formats, not something that occurs naturally in source. Checked
+      // inside comments too — a key commented out is still a committed key.
+      {
+        kind: "hardcoded-secret",
+        re: /\b(sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|AKIA[0-9A-Z]{16}|xox[baprs]-[A-Za-z0-9-]{10,}|AIza[0-9A-Za-z_-]{30,})\b/,
+        message: "Looks like a real API key/token committed to source. Move it to an environment variable and rotate the exposed key.",
+        includeComments: true
+      },
+      // NOTE: the `private-key` check is NOT here — it needs to span multiple lines
+      // (BEGIN header on one, base64 body on the next), which this per-line loop
+      // cannot express. It runs separately in checkSecurity below.
+      {
+        kind: "hardcoded-password",
+        // An ASSIGNMENT of a credential-ish name to a non-trivial literal.
+        //
+        // Tightened after measuring against the real backend, where the looser version
+        // fired on `missingSecret:'FIREBASE_TOKEN'` — code that NAMES a secret in an
+        // error message, the opposite of leaking one. So a value that is itself just a
+        // SCREAMING_SNAKE identifier (an env-var name) is excluded, along with the
+        // usual placeholder vocabulary. The value must also look like actual secret
+        // material: mixed case or digits, not a lone lowercase word.
+        re: /(?:password|passwd|secret|api[_-]?key|apikey|access[_-]?token)['"`]?\s*[:=]\s*['"`](?![A-Z0-9_]+['"`])(?!.*(?:\$\{|process\.env|os\.environ|example|changeme|placeholder|redacted|xxx|test|dummy|fake|sample|your[_-]?|<|\*{3}))(?=[^'"`]*[0-9A-Z])[^'"`\s]{10,}['"`]/,
+        message: "Hardcoded credential literal. Read it from the environment/secret store instead, and rotate the exposed value.",
+        includeComments: true
+      },
+      // ── Injection ───────────────────────────────────────────────────────────────
+      {
+        kind: "dynamic-eval",
+        // The negative lookbehind for `.` is what makes this usable: `redisClient.eval`
+        // (a Redis Lua script), `page.eval` (Playwright), `vm.eval` and friends are
+        // METHOD calls on an object and have nothing to do with JavaScript's global
+        // eval. Without it, the real backend's Redis idempotency script was flagged.
+        // Only a bare `eval(` / `new Function(` with a non-literal argument counts.
+        re: /(?<![.\w$])(?:eval|new\s+Function)\s*\(\s*(?!['"`][^'"`]*['"`]\s*\))[^)]*[a-zA-Z_$][\w$]*/,
+        message: "eval / new Function on a non-literal value executes arbitrary code if that value is ever user-controlled. Use an explicit parser or a lookup table."
+      },
+      {
+        kind: "sql-injection",
+        // Only fires when the interpolated expression is plausibly REQUEST-DERIVED.
+        //
+        // The obvious pattern — any `${...}` inside a SQL string — was measured
+        // against the real backend and flagged 15 of 183 files, essentially all of
+        // them safe and idiomatic: `${sets.join(', ')}` for a dynamic UPDATE, `${field}`
+        // for a server-chosen column, `${CONSUMPTION}` for a module constant. At that
+        // hit rate the warning is pure noise, and noise is worse than silence because
+        // it teaches everyone to skip the channel.
+        //
+        // So the interpolation must name something that plausibly came from the
+        // outside: req/request/params/query/body/input/user/args, or a bare
+        // `'...' + ident`. This trades recall for precision on purpose — thorough SQL
+        // review is the security-auditor agent's job, not an inline regex's.
+        re: /\b(?:SELECT|INSERT\s+INTO|UPDATE|DELETE\s+FROM)\b[^;'"`]{0,160}(?:\$\{\s*(?:req|request|params?|query|body|input|user|args|ctx)\b|['"`]\s*\+\s*(?:req|request|params?|query|body|input|user|args|ctx)\b|%\s*\(\s*(?:request|params?|query|body|input|user)\b)/i,
+        message: "SQL built by interpolating a request-derived value. Use a parameterised query ($1 / ? placeholders) \u2014 this is the classic injection sink."
+      },
+      {
+        kind: "command-injection",
+        // Shell execution with an interpolated or concatenated argument.
+        re: /\b(?:exec|execSync|spawnSync?|system|popen|os\.system|subprocess\.(?:call|run|Popen))\s*\(\s*(?:[`'"][^`'"]*(?:\$\{|['"]\s*\+)|[a-zA-Z_$][\w$]*\s*\+)/,
+        message: "Shell command built from a variable. Pass arguments as an array (no shell), or validate against an allowlist \u2014 a value containing ; or $() becomes command execution."
+      },
+      // ── Transport / verification ────────────────────────────────────────────────
+      {
+        kind: "tls-verification-disabled",
+        re: /(?:rejectUnauthorized\s*:\s*false|NODE_TLS_REJECT_UNAUTHORIZED\s*=\s*['"]?0|verify\s*=\s*False|InsecureSkipVerify\s*:\s*true)/,
+        message: "TLS certificate verification is disabled, which removes protection against man-in-the-middle attacks. Trust a specific CA instead if the cert is self-signed."
+      }
+    ];
+    function checkSecurity(content, max = 5) {
+      if (!content)
+        return [];
+      const findings = [];
+      const lines = content.split(/\r?\n/);
+      const pemIdx = lines.findIndex((l) => /-----BEGIN\s+(?:RSA|EC|DSA|OPENSSH|PGP)?\s*PRIVATE KEY-----/.test(l));
+      if (pemIdx !== -1) {
+        const following = lines.slice(pemIdx, pemIdx + 4).join("\n");
+        if (/[A-Za-z0-9+/]{40,}/.test(following.replace(/-----[^-]+-----/g, ""))) {
+          findings.push({
+            kind: "private-key",
+            message: "A private key with real key material is being written into source. Store it outside the repo (secret manager / env var) and rotate it.",
+            line: pemIdx + 1,
+            sample: "-----BEGIN PRIVATE KEY----- [REDACTED]"
+          });
+        }
+      }
+      const seenKinds = /* @__PURE__ */ new Set();
+      for (let i2 = 0; i2 < lines.length && findings.length < max; i2++) {
+        const line = lines[i2];
+        if (!line || line.length > 2e3)
+          continue;
+        const commentish = isLikelyCommentLine(line);
+        for (const rule of RULES) {
+          if (seenKinds.has(rule.kind))
+            continue;
+          if (commentish && !rule.includeComments)
+            continue;
+          if (!rule.re.test(line))
+            continue;
+          seenKinds.add(rule.kind);
+          findings.push({ kind: rule.kind, message: rule.message, line: i2 + 1, sample: redact(line.trim()) });
+          break;
+        }
+      }
+      return findings;
+    }
+    function securityNoteText(findings) {
+      if (process.env.NEXRALL_SECURITY_LINT === "off")
+        return "";
+      if (!findings.length)
+        return "";
+      const lines = findings.map((f3) => `  \u2022 line ${f3.line} [${f3.kind}]: ${f3.message}
+    ${f3.sample}`);
+      return `
+
+\u26A0 SECURITY REVIEW (${findings.length} finding${findings.length > 1 ? "s" : ""}) \u2014 the write succeeded; check these before moving on:
+` + lines.join("\n") + `
+If a finding is a false positive (test fixture, placeholder, intentionally dynamic), say so and continue \u2014 do NOT rewrite correct code to silence it.`;
+    }
+  }
+});
+
 // ../core/dist/agent/memory.js
 var require_memory = __commonJS({
   "../core/dist/agent/memory.js"(exports) {
@@ -12482,6 +12620,7 @@ var require_executor = __commonJS({
     var sandbox_1 = require_sandbox();
     var auth_1 = require_auth();
     var editCompleteness_1 = require_editCompleteness();
+    var securityLint_1 = require_securityLint();
     var memory_1 = require_memory();
     var skills_1 = require_skills();
     var testIntegrity_1 = require_testIntegrity();
@@ -12737,15 +12876,16 @@ Resolve the conflict (remove <<<<<<< / ======= / >>>>>>> markers and keep the in
         atomicWrite(resolved, content, existingMode);
         const bytes = Buffer.byteLength(content, "utf-8");
         const lines = content.split("\n").length;
+        const sec = (0, securityLint_1.securityNoteText)((0, securityLint_1.checkSecurity)(content));
         if (isNew) {
-          return { output: `Created ${resolved} (${lines} lines, ${bytes} bytes)` };
+          return { output: `Created ${resolved} (${lines} lines, ${bytes} bytes)${sec}` };
         }
         const xfile = crossFileBreakageWarning(resolved, normalizeLF(priorContent), normalizeLF(content), workDir ?? process.cwd());
         let tiMarker = "";
         const ti = (0, testIntegrity_1.analyzeTestEdit)(resolved, normalizeLF(priorContent), normalizeLF(content));
         if (ti.suspicious)
           tiMarker = (0, testIntegrity_1.encodeTestIntegrityMarker)(ti.findings);
-        return { output: `Overwrote ${resolved} (${lines} lines, ${bytes} bytes)${xfile}${tiMarker}` };
+        return { output: `Overwrote ${resolved} (${lines} lines, ${bytes} bytes)${xfile}${sec}${tiMarker}` };
       } catch (err) {
         return { error: err.message };
       }
@@ -13531,9 +13671,10 @@ ${globalCapMatches(output)}` : "";
         const linesBefore = origNorm.split("\n").length;
         const linesAfter = updated.split("\n").length;
         const xfile = crossFileBreakageWarning(resolved, origNorm, normalizeLF(updated), workDir ?? process.cwd());
+        const sec = (0, securityLint_1.securityNoteText)((0, securityLint_1.checkSecurity)(newNorm));
         return { output: `Edited ${resolved} (${linesBefore} \u2192 ${linesAfter} lines)
 
-${diff3}${xfile}` };
+${diff3}${xfile}${sec}` };
       } catch (err) {
         return { error: err.message };
       }
@@ -13801,6 +13942,7 @@ ${body}${truncNote}
         let content = normalizeLF(rawFile);
         const originalNorm = content;
         const diffs = [];
+        const insertedText = [];
         for (let i2 = 0; i2 < edits.length; i2++) {
           const edit = edits[i2];
           const oldStr = normalizeLF(typeof edit.old_string === "string" ? edit.old_string : "");
@@ -13815,16 +13957,18 @@ ${body}${truncNote}
             return { error: `Edit #${i2 + 1}: old_string appears ${count} times \u2014 it must be unique. Add more surrounding context.` };
           }
           diffs.push(buildDiff(filePath, oldStr, newStr, content));
+          insertedText.push(newStr);
           content = literalReplace(content, oldStr, newStr);
         }
         const finalContent = wasCRLF ? content.replace(/\n/g, "\r\n") : content;
         atomicWritePreservingMode(resolved, finalContent, pre.mode);
         const xfile = crossFileBreakageWarning(resolved, originalNorm, content, workDir ?? process.cwd());
+        const sec = (0, securityLint_1.securityNoteText)((0, securityLint_1.checkSecurity)(insertedText.join("\n")));
         return {
           output: `Applied ${edits.length} edit(s) to ${resolved}:
 ` + diffs.map((d, i2) => `
 --- edit #${i2 + 1} ---
-${d}`).join("\n") + xfile
+${d}`).join("\n") + xfile + sec
         };
       } catch (err) {
         return { error: err.message };
@@ -14405,11 +14549,40 @@ var require_agentTypes = __commonJS({
     var path6 = __importStar(__require("path"));
     var os6 = __importStar(__require("os"));
     var index_1 = require_plugins();
+    var READ_ONLY_TOOLS = [
+      // Universal
+      "read_file",
+      "search_files",
+      "glob",
+      "list_directory",
+      "bash",
+      "bash_output",
+      "notebook_read",
+      "todo_write",
+      "todo_read",
+      // VS Code language server (ignored on the CLI)
+      "get_symbols",
+      "get_workspace_symbols",
+      "find_references",
+      "go_to_definition",
+      "get_hover",
+      "get_diagnostics"
+    ];
+    var RESEARCH_TOOLS = [...READ_ONLY_TOOLS, "web_search", "fetch_url"];
+    var WRITE_TOOLS = [
+      ...READ_ONLY_TOOLS,
+      "write_file",
+      "edit_file",
+      "multi_edit",
+      "create_directory",
+      "move_file",
+      "copy_file"
+    ];
     var BUILTIN_AGENTS = [
       {
         name: "reviewer",
         description: "Read-only code reviewer \u2014 finds correctness bugs, edge cases, and security issues in a diff or file set. Cannot modify files.",
-        tools: ["read_file", "search_files", "glob", "list_directory", "bash", "get_symbols", "get_workspace_symbols", "find_references", "go_to_definition", "get_diagnostics"],
+        tools: READ_ONLY_TOOLS,
         source: "builtin",
         prompt: [
           "You are a meticulous senior code reviewer. You NEVER modify files \u2014 you only read, search, and report.",
@@ -14425,6 +14598,162 @@ var require_agentTypes = __commonJS({
           "Report format: \u{1F534} Critical / \u{1F7E1} Warning / \u{1F7E2} Suggestion, each with file:line and a concrete fix,",
           "then a final verdict (APPROVE or REQUEST CHANGES) with a one-paragraph rationale."
         ].join("\n")
+      },
+      // Promoted from the security-audit plugin to a builtin.
+      //
+      // Leaving it plugin-only was indefensible next to `reviewer` being builtin:
+      // reviewer's own prompt already tells it to look for security issues, so
+      // security IS treated as default work — yet the specialist agent for it was
+      // invisible unless the user happened to know the plugin existed. For an agent
+      // that WRITES code, "you only get a security review if you knew to install
+      // something" is the wrong default.
+      {
+        name: "security-auditor",
+        description: "Read-only security auditor \u2014 hunts injection, authz, secrets, and validation flaws in a path or diff. Cannot modify files.",
+        tools: READ_ONLY_TOOLS,
+        model: "pro",
+        source: "builtin",
+        prompt: [
+          "You are a security auditor. You find real, exploitable flaws \u2014 not style issues.",
+          "",
+          "Method:",
+          "1. Map the attack surface FIRST: entry points (HTTP routes, message handlers, CLI args, file/network",
+          "   input, deserialization), then trace user-controlled data inward to where it is used.",
+          "2. For each finding: file:line, the flaw class, a one-line exploit scenario, and the concrete fix.",
+          "3. Grade severity honestly: Critical = remote compromise or data breach; High = auth bypass/IDOR;",
+          "   Medium = needs unusual preconditions; Low = hardening.",
+          "",
+          "Classes worth the most attention, in order: injection (SQL/command/template/prototype), broken",
+          "authz (missing ownership checks, IDOR, trusting client-supplied ids), secrets committed to source,",
+          "path traversal, SSRF, unsafe deserialization, missing rate limits on expensive or auth endpoints,",
+          "and crypto misuse (hand-rolled comparison, predictable randomness).",
+          "",
+          "Hard rules:",
+          "- READ-ONLY: never modify, create or delete files. bash only for read-only inspection.",
+          "- NEVER print a discovered secret's value. Report its location and advise rotation.",
+          "- Distinguish EXPLOITABLE from theoretical, and say which one each finding is.",
+          '- "No issues found in scope X" is a valid, useful result. Do not pad the report to look thorough.'
+        ].join("\n")
+      },
+      // The gap Claude Code fills with its built-in `Explore`: read-heavy codebase
+      // search that would otherwise flood the parent's context. Defaults to the
+      // cheapest model on purpose — "find every caller of X" has no need of a
+      // frontier model, and this is the agent most likely to be spawned in bulk.
+      {
+        name: "explorer",
+        description: "Fast read-only codebase explorer \u2014 locates files, symbols, and call sites and reports concise findings. Use to keep bulk searching out of the main context. Cannot modify files.",
+        tools: READ_ONLY_TOOLS,
+        model: "turbo",
+        source: "builtin",
+        prompt: [
+          "You map code. You NEVER modify anything.",
+          "",
+          "Method:",
+          "1. Prefer structural search over text search where available (get_workspace_symbols, find_references,",
+          "   go_to_definition); fall back to search_files/glob otherwise.",
+          "2. Read only the sections you need \u2014 use read_file with offset/limit on large files instead of",
+          "   pulling in thousands of lines.",
+          "3. Follow the real call graph rather than guessing from names.",
+          "",
+          "Your ONLY output is a compact report: the file:line locations that matter, how they relate, and the",
+          "direct answer to the question you were given. This exists to keep bulk search OUT of the parent's",
+          "context, so do not paste large file contents back \u2014 cite locations and summarise. Say plainly when",
+          'something does not exist; a confident wrong answer is far worse than "not found".'
+        ].join("\n")
+      },
+      // Matches Claude Code's built-in `Plan`: research a change and return a
+      // strategy, deliberately WITHOUT write access so "make a plan" can never
+      // quietly become "start editing".
+      {
+        name: "planner",
+        description: "Read-only planning agent \u2014 researches a change and returns a concrete step-by-step implementation plan with risks and affected files. Cannot modify files.",
+        tools: RESEARCH_TOOLS,
+        model: "pro",
+        source: "builtin",
+        prompt: [
+          "You produce implementation plans. You NEVER modify files \u2014 planning and doing are separate steps,",
+          'and this agent exists so "plan it" cannot silently turn into "change it".',
+          "",
+          "Method:",
+          "1. Read the actual code before proposing anything. No plan may rest on an assumed API shape.",
+          "2. Find every affected call site (find_references / search_files) and list them.",
+          "3. Order the steps so the tree stays working after each one \u2014 types, then implementation, then",
+          "   tests, then exports/registration.",
+          "",
+          "Output:",
+          "- Goal, in one sentence.",
+          "- Numbered steps, each with the exact files touched and what changes in them.",
+          "- Risks + the specific thing that could break, and how it would be detected.",
+          "- How to verify (the exact test/build command for THIS project, taken from package.json/Makefile).",
+          "- Anything genuinely ambiguous, stated as an open question rather than a silent assumption."
+        ].join("\n")
+      },
+      // Promoted from the test-gen plugin. Needs write access — it produces test
+      // files — but is deliberately forbidden from touching source, because "make the
+      // tests pass" is the single most common way an agent destroys signal.
+      {
+        name: "test-writer",
+        description: "Writes tests that follow the project's existing conventions. May create/edit TEST files only \u2014 never production source.",
+        tools: WRITE_TOOLS,
+        // Enforced, not merely requested: the permission gate refuses a write whose
+        // path is not a test file. Without this the allowlist would grant edit_file
+        // for every path and the rule below would be a suggestion the model is free
+        // to rationalise its way past.
+        testFilesOnly: true,
+        source: "builtin",
+        prompt: [
+          "You write tests. You may create and edit TEST files only.",
+          "",
+          "Hard rules \u2014 these are the ways test-writing agents destroy value, so they are non-negotiable:",
+          "- NEVER modify production source to make a test pass. If the code looks wrong, REPORT it and stop.",
+          "- NEVER weaken, delete or skip an existing assertion or test.",
+          "- A test that cannot fail is worse than no test. Every test must be able to fail for one clear reason.",
+          "",
+          "Method:",
+          "1. Read the existing tests FIRST and copy their conventions exactly \u2014 runner, file naming, layout,",
+          "   assertion style, fixture/helper patterns. Never introduce a new framework.",
+          "2. Test observable behaviour and the contract, not private internals.",
+          "3. Cover the boring-but-real cases: empty input, null/undefined, unicode and non-BMP characters,",
+          "   boundaries, error paths, concurrency where it applies.",
+          "4. No sleeps or wall-clock dependence \u2014 those produce the flaky tests that get deleted later.",
+          "5. RUN the tests you wrote and report the real output. Never claim a test passes without running it."
+        ].join("\n")
+      },
+      // The DevOps gap — answered with a READ-ONLY advisor, not an operator.
+      //
+      // A "DevOps agent" with write/apply access is a genuinely different risk class
+      // from the others here: its mistakes are `kubectl delete`, a bad `terraform
+      // apply`, a broken deploy pipeline — often not revertible and affecting
+      // production rather than a working tree. So this one diagnoses and proposes a
+      // diff; a human applies it. That asymmetry is the whole design.
+      {
+        name: "devops-advisor",
+        description: "Read-only CI/CD, container, and infrastructure advisor \u2014 diagnoses pipelines, Dockerfiles, and k8s manifests and proposes concrete fixes as a diff. Never applies changes.",
+        tools: RESEARCH_TOOLS,
+        model: "pro",
+        source: "builtin",
+        prompt: [
+          "You are an infrastructure and delivery advisor. You DIAGNOSE and PROPOSE. You never apply changes.",
+          "",
+          "Hard rules:",
+          "- READ-ONLY, and stricter than the other read-only agents: bash is for INSPECTION only",
+          "  (git log/diff, cat, grep, `kubectl get/describe`, `docker images`, `terraform plan`).",
+          "  NEVER run anything that mutates infrastructure \u2014 no apply/delete/scale/rollout/restart/push,",
+          "  no `terraform apply`, no `helm upgrade`. If a fix needs such a command, WRITE IT OUT for a human.",
+          "- Never print secret values from env files, k8s Secrets or CI variables. Reference them by name.",
+          "",
+          "Method:",
+          "1. Read what actually exists \u2014 workflow files, Dockerfiles, manifests, kustomize overlays, the",
+          '   deploy scripts \u2014 before drawing any conclusion. Never reason from what a stack "usually" looks like.',
+          "2. Follow the real path a change takes to production, and name the step that is broken or missing.",
+          "3. Check the failure modes that bite hardest: CI path filters that skip files a workload actually",
+          "   needs, image tags that do not match what is deployed, missing health probes, absent resource",
+          "   limits, secrets baked into images, ports/timeouts inconsistent between proxy and app, and",
+          "   migrations that must run before the new image is live.",
+          "",
+          "Output: the diagnosis, the evidence (file:line or command output), the proposed change as a diff or",
+          "exact file content, and the command a human should run to apply and verify it."
+        ].join("\n")
       }
     ];
     function parseFrontmatter(raw) {
@@ -14443,6 +14772,9 @@ var require_agentTypes = __commonJS({
       const s2 = (v ?? "").toLowerCase();
       return s2 === "turbo" || s2 === "pro" || s2 === "ultra" ? s2 : void 0;
     }
+    function parseBool(v) {
+      return /^(true|yes|1|on)$/i.test((v ?? "").trim());
+    }
     function parseToolList(v) {
       if (!v)
         return void 0;
@@ -14471,7 +14803,12 @@ var require_agentTypes = __commonJS({
             tools: parseToolList(meta.tools),
             model: parseModel(meta.model),
             prompt: body,
-            source
+            source,
+            // Exposed to user/plugin definitions too — `test_files_only: true` (or
+            // `testFilesOnly`) lets anyone build a test-writing agent that genuinely
+            // cannot touch production source, rather than only the builtin getting
+            // that guarantee.
+            ...parseBool(meta.test_files_only ?? meta.testfilesonly) ? { testFilesOnly: true } : {}
           });
         } catch {
         }
@@ -14487,16 +14824,38 @@ var require_agentTypes = __commonJS({
         if (!out.has(agent.name))
           out.set(agent.name, agent);
       }
-      return [...out.values()];
+      const builtinOrder = new Map(BUILTIN_AGENTS.map((a, i2) => [a.name, i2]));
+      return [...out.values()].sort((a, b) => {
+        const ai = builtinOrder.get(a.name);
+        const bi = builtinOrder.get(b.name);
+        if (ai !== void 0 && bi !== void 0)
+          return ai - bi;
+        if (ai !== void 0)
+          return -1;
+        if (bi !== void 0)
+          return 1;
+        return a.name.localeCompare(b.name);
+      });
     }
     function summariseAgents(types3) {
       if (!types3.length)
         return "";
       return types3.map((t2) => {
-        const tools = t2.tools ? ` (tools: ${t2.tools.join(", ")})` : "";
-        return `- ${t2.name}: ${t2.description}${tools}`;
+        const canWrite = !t2.tools || t2.tools.some((x2) => WRITE_TOOL_HINTS.has(x2));
+        const access = t2.testFilesOnly ? "writes TEST files only" : canWrite ? "can modify files" : "read-only";
+        const model = t2.model ? `, ${t2.model} model` : "";
+        return `- ${t2.name} (${access}${model}): ${t2.description}`;
       }).join("\n");
     }
+    var WRITE_TOOL_HINTS = /* @__PURE__ */ new Set([
+      "write_file",
+      "edit_file",
+      "multi_edit",
+      "notebook_edit",
+      "delete_file",
+      "move_file",
+      "copy_file"
+    ]);
     function findAgentType(types3, name) {
       if (!name)
         return void 0;
@@ -14905,6 +15264,7 @@ var require_loop = __commonJS({
     exports.contextWindowFor = contextWindowFor2;
     exports.compactionThresholds = compactionThresholds2;
     exports.estimateBodyBytes = estimateBodyBytes2;
+    exports.allowsTestOnlyWrite = allowsTestOnlyWrite;
     exports.findSafeCutIndex = findSafeCutIndex;
     exports.transcriptOf = transcriptOf;
     exports.createLedger = createLedger;
@@ -15250,6 +15610,8 @@ ${options.nexrallMd}` : "") : options.nexrallMd;
       const gatedPermission = async (req) => {
         if (allowed && !allowed.has(req.tool))
           return false;
+        if (agent?.testFilesOnly && !allowsTestOnlyWrite(req.tool, req.input))
+          return false;
         return options.requestPermission(req);
       };
       const subMessages = [
@@ -15394,6 +15756,15 @@ ${partial}` : "",
       return true;
     }
     exports.WRITE_TOOL_NAMES = /* @__PURE__ */ new Set(["write_file", "edit_file", "multi_edit", "delete_file", "move_file", "copy_file", "notebook_edit"]);
+    function allowsTestOnlyWrite(tool, input) {
+      if (!exports.WRITE_TOOL_NAMES.has(tool))
+        return true;
+      const pathKeys = tool === "notebook_edit" ? ["path"] : ["path", "source", "dest", "destination"];
+      const candidates = pathKeys.map((k) => input?.[k]).filter((v) => typeof v === "string" && v.length > 0);
+      if (candidates.length === 0)
+        return false;
+      return candidates.every((p) => (0, testIntegrity_1.isTestFile)(p));
+    }
     exports.VERIFY_CMD_RE = /\b(npm|yarn|pnpm)\s+(run\s+)?(test|build|lint|typecheck|tsc)\b|\bpytest\b|\bgo\s+(test|vet|build)\b|\btsc\b|\beslint\b|\bcargo\s+(test|build|check)\b/i;
     function findSafeCutIndex(messages, maxIdx) {
       for (let i2 = Math.min(maxIdx, messages.length - 1); i2 >= 2; i2--) {
@@ -17720,6 +18091,7 @@ var require_dist2 = __commonJS({
     __exportStar(require_loop(), exports);
     __exportStar(require_testIntegrity(), exports);
     __exportStar(require_editCompleteness(), exports);
+    __exportStar(require_securityLint(), exports);
     __exportStar(require_crossFile(), exports);
     __exportStar(require_flaky(), exports);
     __exportStar(require_claimEvidence(), exports);
@@ -62794,7 +63166,7 @@ var InkReadlineAdapter = class extends EventEmitter3 {
 };
 
 // src/commands/chat.ts
-var CLI_VERSION = "0.5.48";
+var CLI_VERSION = "0.5.49";
 var MODEL_LABELS = {
   turbo: "Nexrall Turbo",
   pro: "Nexrall Pro",
@@ -64172,6 +64544,12 @@ async function confirmInstall(i2, name, autoYes) {
   if (autoYes && dangerous) {
     console.log(source_default.yellow("\n  --yes does not apply to plugins with hooks/MCP; confirmation required."));
   }
+  if (!process.stdin.isTTY) {
+    console.log();
+    console.log(source_default.red("  \u2717 Cannot ask for confirmation: stdin is not a terminal."));
+    console.log(source_default.dim(dangerous ? "    This plugin ships hooks/MCP, which always require an interactive confirmation." : "    Re-run with --yes to install non-interactively."));
+    return false;
+  }
   console.log();
   const { ok } = await (0, import_prompts.default)({
     type: "confirm",
@@ -64339,7 +64717,7 @@ function pluginListCommand() {
 
 // src/index.ts
 var program2 = new Command();
-program2.name("nex").description("Nexrall Code \u2014 AI coding assistant (powered by Nexrall)").version("0.5.48");
+program2.name("nex").description("Nexrall Code \u2014 AI coding assistant (powered by Nexrall)").version("0.5.49").enablePositionalOptions();
 program2.command("auth").description("Login to your Nexrall account").action(authCommand);
 program2.command("logout").description("Log out of your Nexrall account").action(logoutCommand);
 program2.command("update").description("Update nex to the latest version").option("-c, --check", "Check for updates without installing").option("-y, --yes", "Skip confirmation prompt").action(async (opts) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexrall-code",
-  "version": "0.5.48",
+  "version": "0.5.49",
   "description": "Nexrall Code — AI coding assistant for your terminal (headless agent for scripts, CI and automation)",
   "keywords": [
     "ai",
@@ -41,7 +41,7 @@
     "react": "^19.2.8",
     "readline": "^1.3.0",
     "string-width": "^7.2.0",
-    "@nexrall/code-core": "1.4.23"
+    "@nexrall/code-core": "1.4.24"
   },
   "devDependencies": {
     "@aws-sdk/client-s3": "^3.600.0",