nexrall-code 0.5.49 → 0.5.51

package/dist/index.js

@@ -1773,13 +1773,13 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} source - expected values are default/config/env/cli/implied
        * @return {Command} `this` command for chaining
        */
-      setOptionValueWithSource(key, value, source) {
+      setOptionValueWithSource(key, value, source2) {
         if (this._storeOptionsAsProperties) {
           this[key] = value;
         } else {
           this._optionValues[key] = value;
         }
-        this._optionValueSources[key] = source;
+        this._optionValueSources[key] = source2;
         return this;
       }
       /**
@@ -1800,13 +1800,13 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @return {string}
        */
       getOptionValueSourceWithGlobals(key) {
-        let source;
+        let source2;
         this._getCommandAndAncestors().forEach((cmd) => {
           if (cmd.getOptionValueSource(key) !== void 0) {
-            source = cmd.getOptionValueSource(key);
+            source2 = cmd.getOptionValueSource(key);
           }
         });
-        return source;
+        return source2;
       }
       /**
        * Get user arguments from implied or explicit arguments.
@@ -2615,8 +2615,8 @@ Expecting one of '${allowedValues.join("', '")}'`);
         const getErrorMessage = (option2) => {
           const bestOption = findBestOptionFromValue(option2);
           const optionKey = bestOption.attributeName();
-          const source = this.getOptionValueSource(optionKey);
-          if (source === "env") {
+          const source2 = this.getOptionValueSource(optionKey);
+          if (source2 === "env") {
             return `environment variable '${bestOption.envVar}'`;
           }
           return `option '${bestOption.flags}'`;
@@ -5998,10 +5998,10 @@ var require_ponyfill_es2018 = __commonJS({
         return ctor;
       }
       const DOMException2 = getFromGlobal() || createPolyfill();
-      function ReadableStreamPipeTo(source, dest, preventClose, preventAbort, preventCancel, signal) {
-        const reader = AcquireReadableStreamDefaultReader(source);
+      function ReadableStreamPipeTo(source2, dest, preventClose, preventAbort, preventCancel, signal) {
+        const reader = AcquireReadableStreamDefaultReader(source2);
         const writer = AcquireWritableStreamDefaultWriter(dest);
-        source._disturbed = true;
+        source2._disturbed = true;
         let shuttingDown = false;
         let currentWrite = promiseResolvedWith(void 0);
         return newPromise((resolve3, reject) => {
@@ -6020,8 +6020,8 @@ var require_ponyfill_es2018 = __commonJS({
               }
               if (!preventCancel) {
                 actions.push(() => {
-                  if (source._state === "readable") {
-                    return ReadableStreamCancel(source, error);
+                  if (source2._state === "readable") {
+                    return ReadableStreamCancel(source2, error);
                   }
                   return promiseResolvedWith(void 0);
                 });
@@ -6063,7 +6063,7 @@ var require_ponyfill_es2018 = __commonJS({
               });
             });
           }
-          isOrBecomesErrored(source, reader._closedPromise, (storedError) => {
+          isOrBecomesErrored(source2, reader._closedPromise, (storedError) => {
             if (!preventAbort) {
               shutdownWithAction(() => WritableStreamAbort(dest, storedError), true, storedError);
             } else {
@@ -6073,13 +6073,13 @@ var require_ponyfill_es2018 = __commonJS({
           });
           isOrBecomesErrored(dest, writer._closedPromise, (storedError) => {
             if (!preventCancel) {
-              shutdownWithAction(() => ReadableStreamCancel(source, storedError), true, storedError);
+              shutdownWithAction(() => ReadableStreamCancel(source2, storedError), true, storedError);
             } else {
               shutdown(true, storedError);
             }
             return null;
           });
-          isOrBecomesClosed(source, reader._closedPromise, () => {
+          isOrBecomesClosed(source2, reader._closedPromise, () => {
             if (!preventClose) {
               shutdownWithAction(() => WritableStreamDefaultWriterCloseWithErrorPropagation(writer));
             } else {
@@ -6090,7 +6090,7 @@ var require_ponyfill_es2018 = __commonJS({
           if (WritableStreamCloseQueuedOrInFlight(dest) || dest._state === "closed") {
             const destClosed = new TypeError("the destination writable stream closed before all data could be piped to it");
             if (!preventCancel) {
-              shutdownWithAction(() => ReadableStreamCancel(source, destClosed), true, destClosed);
+              shutdownWithAction(() => ReadableStreamCancel(source2, destClosed), true, destClosed);
             } else {
               shutdown(true, destClosed);
             }
@@ -6726,11 +6726,11 @@ var require_ponyfill_es2018 = __commonJS({
       function isReadableStreamLike(stream) {
         return typeIsObject(stream) && typeof stream.getReader !== "undefined";
       }
-      function ReadableStreamFrom(source) {
-        if (isReadableStreamLike(source)) {
-          return ReadableStreamFromDefaultReader(source.getReader());
+      function ReadableStreamFrom(source2) {
+        if (isReadableStreamLike(source2)) {
+          return ReadableStreamFromDefaultReader(source2.getReader());
         }
-        return ReadableStreamFromIterable(source);
+        return ReadableStreamFromIterable(source2);
       }
       function ReadableStreamFromIterable(asyncIterable) {
         let stream;
@@ -6817,9 +6817,9 @@ var require_ponyfill_es2018 = __commonJS({
         stream = CreateReadableStream(startAlgorithm, pullAlgorithm, cancelAlgorithm, 0);
         return stream;
       }
-      function convertUnderlyingDefaultOrByteSource(source, context) {
-        assertDictionary(source, context);
-        const original = source;
+      function convertUnderlyingDefaultOrByteSource(source2, context) {
+        assertDictionary(source2, context);
+        const original = source2;
         const autoAllocateChunkSize = original === null || original === void 0 ? void 0 : original.autoAllocateChunkSize;
         const cancel = original === null || original === void 0 ? void 0 : original.cancel;
         const pull = original === null || original === void 0 ? void 0 : original.pull;
@@ -11201,6 +11201,8 @@ var require_plugins = __commonJS({
       };
     }();
     Object.defineProperty(exports, "__esModule", { value: true });
+    exports.FILE_CANDIDATES = void 0;
+    exports.resolvePluginFile = resolvePluginFile;
     exports.loadPlugins = loadPlugins3;
     exports.pluginAssetDirs = pluginAssetDirs;
     exports.pluginHooks = pluginHooks;
@@ -11208,9 +11210,28 @@ var require_plugins = __commonJS({
     var fs9 = __importStar(__require("fs"));
     var path6 = __importStar(__require("path"));
     var os6 = __importStar(__require("os"));
+    exports.FILE_CANDIDATES = {
+      manifest: ["plugin.json", path6.join(".claude-plugin", "plugin.json")],
+      hooks: ["hooks.json", path6.join("hooks", "hooks.json")],
+      mcp: ["mcp.json", ".mcp.json"]
+    };
+    function resolvePluginFile(dir, kind) {
+      for (const rel of exports.FILE_CANDIDATES[kind]) {
+        const full = path6.join(dir, rel);
+        try {
+          if (fs9.statSync(full).isFile())
+            return full;
+        } catch {
+        }
+      }
+      return null;
+    }
     function readMeta(dir) {
+      const file = resolvePluginFile(dir, "manifest");
+      if (!file)
+        return {};
       try {
-        const raw = fs9.readFileSync(path6.join(dir, "plugin.json"), "utf-8");
+        const raw = fs9.readFileSync(file, "utf-8");
         const j = JSON.parse(raw);
         return {
           name: typeof j.name === "string" ? j.name : void 0,
@@ -11263,8 +11284,11 @@ var require_plugins = __commonJS({
     function pluginHooks(workDir) {
       const merged = {};
       for (const p of loadPlugins3(workDir)) {
+        const file = resolvePluginFile(p.dir, "hooks");
+        if (!file)
+          continue;
         try {
-          const raw = fs9.readFileSync(path6.join(p.dir, "hooks.json"), "utf-8");
+          const raw = fs9.readFileSync(file, "utf-8");
           const j = JSON.parse(raw);
           const hooks = j.hooks ?? j;
           for (const [phase, entries] of Object.entries(hooks)) {
@@ -11280,8 +11304,11 @@ var require_plugins = __commonJS({
     function pluginMcpServers(workDir) {
       const merged = {};
       for (const p of loadPlugins3(workDir)) {
+        const file = resolvePluginFile(p.dir, "mcp");
+        if (!file)
+          continue;
         try {
-          const raw = fs9.readFileSync(path6.join(p.dir, "mcp.json"), "utf-8");
+          const raw = fs9.readFileSync(file, "utf-8");
           const j = JSON.parse(raw);
           const servers = j.mcpServers ?? j;
           for (const [name, cfg] of Object.entries(servers)) {
@@ -11400,7 +11427,7 @@ var require_loader = __commonJS({
       }
       return { meta, body: (m2[2] ?? "").trim() };
     }
-    function loadDir(dir, source, into) {
+    function loadDir(dir, source2, into) {
       let files;
       try {
         files = fs9.readdirSync(dir).filter((f3) => f3.endsWith(".md"));
@@ -11414,7 +11441,7 @@ var require_loader = __commonJS({
           const name = (meta.name || path6.basename(file, ".md")).trim().toLowerCase();
           if (!name)
             continue;
-          if (source !== "project" && into.has(name))
+          if (source2 !== "project" && into.has(name))
             continue;
           const model = ["turbo", "pro", "ultra"].find((x2) => x2 === (meta.model ?? "").toLowerCase());
           into.set(name, {
@@ -11423,7 +11450,7 @@ var require_loader = __commonJS({
             model,
             mode: meta.mode || void 0,
             body,
-            source
+            source: source2
           });
         } catch {
         }
@@ -11569,7 +11596,7 @@ var require_skills = __commonJS({
         return false;
       return fallback;
     }
-    function toSkill(meta, body, name, source, dir) {
+    function toSkill(meta, body, name, source2, dir) {
       const model = ["turbo", "pro", "ultra"].find((x2) => x2 === (meta.model ?? "").toLowerCase());
       return {
         name,
@@ -11577,13 +11604,13 @@ var require_skills = __commonJS({
         model,
         mode: meta.mode || void 0,
         body,
-        source,
+        source: source2,
         dir,
         disableModelInvocation: parseBool(meta["disable-model-invocation"], false),
         userInvocable: parseBool(meta["user-invocable"], true)
       };
     }
-    function loadFlatCommandDir(dir, source, into) {
+    function loadFlatCommandDir(dir, source2, into) {
       let files;
       try {
         files = fs9.readdirSync(dir).filter((f3) => f3.endsWith(".md"));
@@ -11597,14 +11624,14 @@ var require_skills = __commonJS({
           const name = (meta.name || path6.basename(file, ".md")).trim().toLowerCase();
           if (!name)
             continue;
-          if (source !== "project" && into.has(name))
+          if (source2 !== "project" && into.has(name))
             continue;
-          into.set(name, toSkill(meta, body, name, source));
+          into.set(name, toSkill(meta, body, name, source2));
         } catch {
         }
       }
     }
-    function loadSkillDir(root, source, into) {
+    function loadSkillDir(root, source2, into) {
       let entries;
       try {
         entries = fs9.readdirSync(root, { withFileTypes: true });
@@ -11628,9 +11655,9 @@ var require_skills = __commonJS({
           const name = (meta.name || entry.name).trim().toLowerCase();
           if (!name)
             continue;
-          if (source !== "project" && into.has(name))
+          if (source2 !== "project" && into.has(name))
             continue;
-          into.set(name, toSkill(meta, body, name, source, skillDir));
+          into.set(name, toSkill(meta, body, name, source2, skillDir));
         } catch {
         }
       }
@@ -12164,12 +12191,12 @@ var require_symbols = __commonJS({
       return new Set(EXT_TO_LANG.keys());
     }
     var MAX_FILE_BYTES = 1024 * 1024;
-    function extractSymbols(filePath, source) {
+    function extractSymbols(filePath, source2) {
       const lang = EXT_TO_LANG.get(path6.extname(filePath).toLowerCase());
       if (!lang)
         return [];
       const hits = [];
-      const lines = source.split("\n");
+      const lines = source2.split("\n");
       let inBlockComment = false;
       for (let i2 = 0; i2 < lines.length; i2++) {
         const trimmed = lines[i2].trim();
@@ -12206,21 +12233,21 @@ var require_symbols = __commonJS({
       if (!rel)
         return { error: "path is required" };
       const abs = resolveIn(workDir, rel);
-      let source;
+      let source2;
       try {
         const st = fs9.statSync(abs);
         if (!st.isFile())
           return { error: `Not a file: ${rel}` };
         if (st.size > MAX_FILE_BYTES)
           return { error: `File too large for symbol scan (${Math.round(st.size / 1024)} KB > 1024 KB)` };
-        source = fs9.readFileSync(abs, "utf-8");
+        source2 = fs9.readFileSync(abs, "utf-8");
       } catch (err) {
         return { error: `Cannot read ${rel}: ${err.message}` };
       }
       if (!EXT_TO_LANG.has(path6.extname(abs).toLowerCase())) {
         return { output: `No symbol support for ${path6.extname(abs) || "this file type"} (regex-based scanner). Use search_files instead.` };
       }
-      const hits = extractSymbols(abs, source);
+      const hits = extractSymbols(abs, source2);
       if (!hits.length)
         return { output: `No symbols found in ${rel}.` };
       const lines = hits.map((h2) => `${h2.kind.padEnd(10)} ${h2.name}  (line ${h2.line})`);
@@ -12262,10 +12289,10 @@ ${lines.join("\n")}` };
               const st = fs9.statSync(full);
               if (st.size > MAX_FILE_BYTES)
                 continue;
-              const source = fs9.readFileSync(full, "utf-8");
-              if (!source.toLowerCase().includes(q))
+              const source2 = fs9.readFileSync(full, "utf-8");
+              if (!source2.toLowerCase().includes(q))
                 continue;
-              for (const h2 of extractSymbols(full, source)) {
+              for (const h2 of extractSymbols(full, source2)) {
                 if (h2.name.toLowerCase().includes(q)) {
                   results.push({ ...h2, file: path6.relative(root, full) });
                   if (results.length >= MAX_RESULTS)
@@ -12452,18 +12479,18 @@ var require_tsLangService = __commonJS({
         return false;
       }
     }
-    function posToOffset(source, line, character) {
-      const lines = source.split("\n");
+    function posToOffset(source2, line, character) {
+      const lines = source2.split("\n");
       let offset = 0;
       for (let i2 = 0; i2 < line - 1 && i2 < lines.length; i2++)
         offset += lines[i2].length + 1;
       return offset + Math.max(0, character - 1);
     }
-    function offsetToPos(source, offset) {
+    function offsetToPos(source2, offset) {
       let line = 1;
       let last = 0;
-      for (let i2 = 0; i2 < offset && i2 < source.length; i2++) {
-        if (source[i2] === "\n") {
+      for (let i2 = 0; i2 < offset && i2 < source2.length; i2++) {
+        if (source2[i2] === "\n") {
           line++;
           last = i2 + 1;
         }
@@ -12480,8 +12507,8 @@ var require_tsLangService = __commonJS({
         return null;
       if (!ensureFile(svc, deps.filePath))
         return { error: `Cannot read ${deps.filePath}` };
-      const source = svc.snapshots.get(deps.filePath) ?? "";
-      const offset = posToOffset(source, deps.line, deps.character);
+      const source2 = svc.snapshots.get(deps.filePath) ?? "";
+      const offset = posToOffset(source2, deps.line, deps.character);
       let defs;
       try {
         defs = svc.service.getDefinitionAtPosition(deps.filePath, offset);
@@ -12504,8 +12531,8 @@ ${out.join("\n")}` };
         return null;
       if (!ensureFile(svc, deps.filePath))
         return { error: `Cannot read ${deps.filePath}` };
-      const source = svc.snapshots.get(deps.filePath) ?? "";
-      const offset = posToOffset(source, deps.line, deps.character);
+      const source2 = svc.snapshots.get(deps.filePath) ?? "";
+      const offset = posToOffset(source2, deps.line, deps.character);
       let refs;
       try {
         refs = svc.service.getReferencesAtPosition(deps.filePath, offset);
@@ -12532,8 +12559,8 @@ ${lines.join("\n")}` };
         return null;
       if (!ensureFile(svc, deps.filePath))
         return { error: `Cannot read ${deps.filePath}` };
-      const source = svc.snapshots.get(deps.filePath) ?? "";
-      const offset = posToOffset(source, deps.line, deps.character);
+      const source2 = svc.snapshots.get(deps.filePath) ?? "";
+      const offset = posToOffset(source2, deps.line, deps.character);
       let info;
       try {
         info = svc.service.getQuickInfoAtPosition(deps.filePath, offset);
@@ -13528,14 +13555,14 @@ ${globalCapMatches(output)}` : "";
       }
     }
     async function moveFile(input, workDir) {
-      const source = typeof input.source === "string" ? input.source : "";
+      const source2 = typeof input.source === "string" ? input.source : "";
       const dest = typeof input.dest === "string" ? input.dest : "";
-      if (!source)
+      if (!source2)
         return { error: "Missing required parameter: source" };
       if (!dest)
         return { error: "Missing required parameter: dest" };
       try {
-        const resolvedSource = resolvePath(source, workDir);
+        const resolvedSource = resolvePath(source2, workDir);
         const resolvedDest = resolvePath(dest, workDir);
         fs9.mkdirSync(path6.dirname(resolvedDest), { recursive: true });
         try {
@@ -13680,14 +13707,14 @@ ${diff3}${xfile}${sec}` };
       }
     }
     async function copyFile(input, workDir) {
-      const source = typeof input.source === "string" ? input.source : "";
+      const source2 = typeof input.source === "string" ? input.source : "";
       const destination = typeof input.destination === "string" ? input.destination : "";
-      if (!source)
+      if (!source2)
         return { error: "Missing required parameter: source" };
       if (!destination)
         return { error: "Missing required parameter: destination" };
       try {
-        const resolvedSrc = resolvePath(source, workDir);
+        const resolvedSrc = resolvePath(source2, workDir);
         const resolvedDest = resolvePath(destination, workDir);
         if (fs9.existsSync(resolvedDest) && fs9.statSync(resolvedDest).isDirectory()) {
           return { error: `Destination is a directory: ${resolvedDest}. Provide a full file path including the filename.` };
@@ -14133,7 +14160,7 @@ ${lines.join("\n")}`;
       const editType = typeof input.edit_type === "string" ? input.edit_type : "";
       const rawIdx = input.cell_index;
       const cellIndex = typeof rawIdx === "number" ? Math.floor(rawIdx) : typeof rawIdx === "string" && rawIdx.trim() !== "" ? parseInt(rawIdx, 10) : -1;
-      const source = typeof input.source === "string" ? input.source : null;
+      const source2 = typeof input.source === "string" ? input.source : null;
       const cellType = typeof input.cell_type === "string" ? input.cell_type : "code";
       if (!filePath)
         return { error: "Missing required parameter: path" };
@@ -14152,10 +14179,10 @@ ${lines.join("\n")}`;
         if (editType === "replace") {
           if (cellIndex < 0 || cellIndex >= n)
             return { error: `cell_index ${cellIndex} out of range (0\u2013${n - 1})` };
-          if (source === null)
+          if (source2 === null)
             return { error: "Missing required parameter: source (required for replace)" };
           const cell = nb.cells[cellIndex];
-          cell.source = source;
+          cell.source = source2;
           if (cell.cell_type === "code") {
             cell.outputs = [];
             cell.execution_count = null;
@@ -14170,12 +14197,12 @@ ${lines.join("\n")}`;
           save();
           return { output: `Deleted cell ${cellIndex} [${removed.cell_type}] from ${resolved}. Notebook now has ${nb.cells.length} cells.` };
         }
-        if (source === null)
+        if (source2 === null)
           return { error: "Missing required parameter: source (required for insert)" };
         const insertAt = cellIndex >= 0 ? Math.min(cellIndex + 1, n) : n;
         const newCell = {
           cell_type: cellType,
-          source,
+          source: source2,
           metadata: {},
           ...cellType === "code" ? { execution_count: null, outputs: [] } : {}
         };
@@ -14542,7 +14569,10 @@ var require_agentTypes = __commonJS({
       };
     }();
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.loadAgentTypes = loadAgentTypes2;
+    exports.loadAgentTypes = loadAgentTypes;
+    exports.loadAgentTypesWithWarnings = loadAgentTypesWithWarnings2;
+    exports.knownToolNames = knownToolNames;
+    exports.builtinAgents = builtinAgents;
     exports.summariseAgents = summariseAgents;
     exports.findAgentType = findAgentType;
     var fs9 = __importStar(__require("fs"));
@@ -14557,9 +14587,17 @@ var require_agentTypes = __commonJS({
       "list_directory",
       "bash",
       "bash_output",
+      // kill_shell belongs next to bash_output: an agent that can start a background
+      // process and poll it but never stop it leaks that process past its own
+      // lifetime. Stopping a shell you started is not a write to the repo.
+      "kill_shell",
       "notebook_read",
       "todo_write",
       "todo_read",
+      // Skills are reusable prompt playbooks, and loop.ts advertises the skills
+      // catalogue to sub-agents at EVERY depth — so withholding the tool that loads
+      // one meant showing every sub-agent a menu it could not order from.
+      "use_skill",
       // VS Code language server (ignored on the CLI)
       "get_symbols",
       "get_workspace_symbols",
@@ -14568,7 +14606,7 @@ var require_agentTypes = __commonJS({
       "get_hover",
       "get_diagnostics"
     ];
-    var RESEARCH_TOOLS = [...READ_ONLY_TOOLS, "web_search", "fetch_url"];
+    var RESEARCH_TOOLS = [...READ_ONLY_TOOLS, "fetch_url"];
     var WRITE_TOOLS = [
       ...READ_ONLY_TOOLS,
       "write_file",
@@ -14576,7 +14614,11 @@ var require_agentTypes = __commonJS({
       "multi_edit",
       "create_directory",
       "move_file",
-      "copy_file"
+      "copy_file",
+      // notebook_edit is a write tool like any other, and allowsTestOnlyWrite already
+      // knows its shape (`source` is cell CONTENT, not a path). Omitting it just meant
+      // test-writer silently could not touch notebooks.
+      "notebook_edit"
     ];
     var BUILTIN_AGENTS = [
       {
@@ -14756,17 +14798,61 @@ var require_agentTypes = __commonJS({
         ].join("\n")
       }
     ];
+    var KNOWN_TOOL_NAMES = /* @__PURE__ */ new Set([
+      "read_file",
+      "write_file",
+      "edit_file",
+      "multi_edit",
+      "list_directory",
+      "create_directory",
+      "move_file",
+      "copy_file",
+      "delete_file",
+      "search_files",
+      "glob",
+      "bash",
+      "bash_output",
+      "kill_shell",
+      "notebook_read",
+      "notebook_edit",
+      "todo_write",
+      "todo_read",
+      "memory_write",
+      "memory_read",
+      "use_skill",
+      "fetch_url",
+      "web_search",
+      "generate_image",
+      "stock_photo",
+      "open_in_browser",
+      "task",
+      "get_symbols",
+      "get_workspace_symbols",
+      "find_references",
+      "go_to_definition",
+      "get_hover",
+      "get_diagnostics"
+    ]);
+    var KNOWN_META_KEYS = /* @__PURE__ */ new Set([
+      "name",
+      "description",
+      "tools",
+      "model",
+      "test_files_only",
+      "testfilesonly"
+    ]);
+    var VALID_MODELS = ["turbo", "pro", "ultra"];
     function parseFrontmatter(raw) {
       const m2 = /^\s*---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/.exec(raw);
       if (!m2)
-        return { meta: {}, body: raw.trim() };
+        return { meta: {}, body: raw.trim(), ok: false };
       const meta = {};
       for (const line of m2[1].split(/\r?\n/)) {
         const kv = /^([A-Za-z0-9_-]+)\s*:\s*(.*)$/.exec(line.trim());
         if (kv)
           meta[kv[1].toLowerCase()] = kv[2].trim().replace(/^["']|["']$/g, "");
       }
-      return { meta, body: (m2[2] ?? "").trim() };
+      return { meta, body: (m2[2] ?? "").trim(), ok: true };
     }
     function parseModel(v) {
       const s2 = (v ?? "").toLowerCase();
@@ -14781,51 +14867,113 @@ var require_agentTypes = __commonJS({
       const tools = v.replace(/^\[|\]$/g, "").split(/[,\s]+/).map((t2) => t2.trim()).filter(Boolean);
       return tools.length ? tools : void 0;
     }
-    function loadDir(dir, source, into) {
+    function loadDir(dir, source2, into, warnings) {
       let entries;
       try {
-        entries = fs9.readdirSync(dir).filter((f3) => f3.endsWith(".md"));
+        entries = fs9.readdirSync(dir, { withFileTypes: true });
       } catch {
         return;
       }
-      for (const file of entries) {
+      for (const entry of entries) {
+        const full = path6.join(dir, entry.name);
+        if (entry.isDirectory()) {
+          loadDir(full, source2, into, warnings);
+          continue;
+        }
+        if (!entry.name.endsWith(".md"))
+          continue;
+        let raw;
         try {
-          const raw = fs9.readFileSync(path6.join(dir, file), "utf-8");
-          const { meta, body } = parseFrontmatter(raw);
-          const name = (meta.name || path6.basename(file, ".md")).trim();
-          if (!name)
-            continue;
-          if (source !== "project" && into.has(name))
-            continue;
-          into.set(name, {
-            name,
-            description: meta.description || `Custom ${name} agent`,
-            tools: parseToolList(meta.tools),
-            model: parseModel(meta.model),
-            prompt: body,
-            source,
-            // Exposed to user/plugin definitions too — `test_files_only: true` (or
-            // `testFilesOnly`) lets anyone build a test-writing agent that genuinely
-            // cannot touch production source, rather than only the builtin getting
-            // that guarantee.
-            ...parseBool(meta.test_files_only ?? meta.testfilesonly) ? { testFilesOnly: true } : {}
+          raw = fs9.readFileSync(full, "utf-8");
+        } catch (err) {
+          warnings.push({ file: full, agent: path6.basename(entry.name, ".md"), message: `could not be read (${err.message}) \u2014 this agent was skipped` });
+          continue;
+        }
+        const { meta, body, ok } = parseFrontmatter(raw);
+        const name = (meta.name || path6.basename(entry.name, ".md")).trim();
+        if (!name)
+          continue;
+        if (source2 !== "project" && into.has(name))
+          continue;
+        const tools = parseToolList(meta.tools);
+        let effectiveTools = tools;
+        if (!ok) {
+          effectiveTools = READ_ONLY_TOOLS;
+          warnings.push({
+            file: full,
+            agent: name,
+            message: "has no valid YAML frontmatter (a `---` block must be the first thing in the file), so no tool allowlist could be read. Treating it as READ-ONLY. Add frontmatter with a `tools:` line to grant more."
           });
-        } catch {
+        } else {
+          if (!meta.description) {
+            warnings.push({
+              file: full,
+              agent: name,
+              message: "has no `description:` \u2014 that text is the ONLY thing the model uses to decide when to delegate to this agent, so it will rarely be picked."
+            });
+          }
+          if (meta.model !== void 0 && parseModel(meta.model) === void 0) {
+            warnings.push({
+              file: full,
+              agent: name,
+              message: `has model: "${meta.model}", which is not valid \u2014 use one of ${VALID_MODELS.join(", ")}, or omit the line to inherit the current session's model.`
+            });
+          }
+          const unknown = (tools ?? []).filter((t2) => !KNOWN_TOOL_NAMES.has(t2) && !t2.includes("__"));
+          if (unknown.length) {
+            warnings.push({
+              file: full,
+              agent: name,
+              message: `lists unknown tool name(s): ${unknown.join(", ")}. An allowlist only grants, so these silently do nothing and the agent cannot use them. Tool names are lower_snake_case (read_file, search_files, glob, bash).`
+            });
+          }
+          const strayKeys = Object.keys(meta).filter((k) => !KNOWN_META_KEYS.has(k));
+          if (strayKeys.length) {
+            warnings.push({
+              file: full,
+              agent: name,
+              message: `has unrecognised frontmatter key(s): ${strayKeys.join(", ")} \u2014 these are ignored.`
+            });
+          }
+          if (!body) {
+            warnings.push({
+              file: full,
+              agent: name,
+              message: "has an empty body \u2014 the text below the frontmatter IS the agent's system prompt, so it currently has no instructions."
+            });
+          }
         }
+        into.set(name, {
+          name,
+          description: meta.description || `Custom ${name} agent`,
+          tools: effectiveTools,
+          model: parseModel(meta.model),
+          prompt: body,
+          source: source2,
+          // Exposed to user/plugin definitions too — `test_files_only: true` (or
+          // `testFilesOnly`) lets anyone build a test-writing agent that genuinely
+          // cannot touch production source, rather than only the builtin getting
+          // that guarantee.
+          ...parseBool(meta.test_files_only ?? meta.testfilesonly) ? { testFilesOnly: true } : {}
+        });
       }
     }
-    function loadAgentTypes2(workDir) {
+    function loadAgentTypes(workDir) {
+      return loadAgentTypesWithWarnings2(workDir).types;
+    }
+    function loadAgentTypesWithWarnings2(workDir) {
       const out = /* @__PURE__ */ new Map();
-      loadDir(path6.join(workDir, ".nexrall", "agents"), "project", out);
-      loadDir(path6.join(os6.homedir(), ".nexrall", "agents"), "global", out);
+      const warnings = [];
+      loadDir(path6.join(workDir, ".nexrall", "agents"), "project", out, warnings);
+      loadDir(path6.join(os6.homedir(), ".nexrall", "agents"), "global", out, warnings);
       for (const dir of (0, index_1.pluginAssetDirs)(workDir, "agents"))
-        loadDir(dir, "plugin", out);
+        loadDir(dir, "plugin", out, warnings);
       for (const agent of BUILTIN_AGENTS) {
         if (!out.has(agent.name))
           out.set(agent.name, agent);
       }
       const builtinOrder = new Map(BUILTIN_AGENTS.map((a, i2) => [a.name, i2]));
-      return [...out.values()].sort((a, b) => {
+      const types3 = [...out.values()].sort((a, b) => {
         const ai = builtinOrder.get(a.name);
         const bi = builtinOrder.get(b.name);
         if (ai !== void 0 && bi !== void 0)
@@ -14836,6 +14984,13 @@ var require_agentTypes = __commonJS({
           return 1;
         return a.name.localeCompare(b.name);
       });
+      return { types: types3, warnings };
+    }
+    function knownToolNames() {
+      return [...KNOWN_TOOL_NAMES].sort();
+    }
+    function builtinAgents() {
+      return BUILTIN_AGENTS;
     }
     function summariseAgents(types3) {
       if (!types3.length)
@@ -15037,6 +15192,9 @@ var require_rules = __commonJS({
         case "stock_photo":
           vals.push(str(input.path));
           break;
+        case "task":
+          vals.push(str(input.subagent_type));
+          break;
         default:
           pushPath(str(input.path));
           break;
@@ -15077,6 +15235,350 @@ var require_rules = __commonJS({
   }
 });
 
+// ../core/dist/agent/planMode.js
+var require_planMode = __commonJS({
+  "../core/dist/agent/planMode.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.PLAN_MODE_INSTRUCTIONS = void 0;
+    exports.isReadOnlyCommand = isReadOnlyCommand;
+    exports.checkPlanMode = checkPlanMode;
+    var READ_ONLY_TOOLS = /* @__PURE__ */ new Set([
+      "read_file",
+      "search_files",
+      "glob",
+      "list_directory",
+      "notebook_read",
+      // Planning bookkeeping. todo_write persists only to the session's own todo
+      // list, not the repo, so it stays available — a plan mode that cannot draft
+      // a checklist is missing the point of plan mode.
+      "todo_write",
+      "todo_read",
+      // Reading memory is fine; memory_write is NOT here on purpose. Memory is
+      // durable state that survives the session, so writing it is a real mutation
+      // even though no file in the repo changes.
+      "memory_read",
+      "use_skill",
+      "fetch_url",
+      "web_search",
+      // Delegating research is ALLOWED, and this is safe rather than a hole:
+      // runSubTask passes planMode down, so the sub-agent is under the same lock and
+      // its own write tools are refused by this very function one level deeper.
+      //
+      // Worth allowing rather than blanket-refusing, because plan mode exists to
+      // support deep research and the explorer agent is the cheapest way to do bulk
+      // searching without flooding the main context. Blocking `task` would have made
+      // the mode's headline use case worse, for no security gain.
+      "task",
+      // VS Code language server — all pure queries.
+      "get_symbols",
+      "get_workspace_symbols",
+      "find_references",
+      "go_to_definition",
+      "get_hover",
+      "get_diagnostics",
+      // Reading output from an ALREADY-running background shell. Starting one is
+      // gated with the rest of bash below; draining a buffer is not a new effect.
+      "bash_output"
+    ]);
+    var READ_ONLY_BASH = /* @__PURE__ */ new Set([
+      "ls",
+      "cat",
+      "head",
+      "tail",
+      "wc",
+      "file",
+      "stat",
+      "du",
+      "df",
+      "pwd",
+      "which",
+      "type",
+      "echo",
+      "printf",
+      "basename",
+      "dirname",
+      "realpath",
+      "readlink",
+      "grep",
+      "egrep",
+      "fgrep",
+      "rg",
+      "ag",
+      "ack",
+      "find",
+      "fd",
+      "locate",
+      "diff",
+      "comm",
+      "cmp",
+      "sort",
+      "uniq",
+      "cut",
+      "tr",
+      "column",
+      "jq",
+      "yq",
+      "date",
+      "whoami",
+      "hostname",
+      "uname",
+      "env",
+      "printenv",
+      "id",
+      "groups",
+      "ps",
+      "top",
+      "uptime",
+      "free",
+      "node",
+      "python",
+      "python3",
+      "tree",
+      "less",
+      "more",
+      "nl",
+      "tac",
+      "strings",
+      "md5sum",
+      "sha256sum",
+      "true",
+      "false",
+      "test",
+      "sleep",
+      "seq",
+      "expr"
+    ]);
+    var READ_ONLY_SUBCOMMANDS = {
+      git: /* @__PURE__ */ new Set([
+        "log",
+        "show",
+        "diff",
+        "status",
+        "blame",
+        "branch",
+        "tag",
+        "remote",
+        "describe",
+        "rev-parse",
+        "rev-list",
+        "ls-files",
+        "ls-tree",
+        "ls-remote",
+        "cat-file",
+        "shortlog",
+        "reflog",
+        "whatchanged",
+        "grep",
+        "config",
+        "check-ignore",
+        "merge-base",
+        "name-rev",
+        "count-objects",
+        "verify-commit"
+      ]),
+      // Package managers: only their query verbs.
+      npm: /* @__PURE__ */ new Set(["ls", "list", "view", "info", "outdated", "why", "config", "ping", "search"]),
+      pnpm: /* @__PURE__ */ new Set(["ls", "list", "view", "info", "outdated", "why", "config"]),
+      yarn: /* @__PURE__ */ new Set(["list", "info", "why", "config"]),
+      cargo: /* @__PURE__ */ new Set(["tree", "metadata", "search"]),
+      go: /* @__PURE__ */ new Set(["list", "version", "env", "vet", "doc"]),
+      docker: /* @__PURE__ */ new Set(["ps", "images", "logs", "inspect", "version", "info", "top", "port", "diff", "stats"]),
+      kubectl: /* @__PURE__ */ new Set(["get", "describe", "logs", "explain", "top", "version", "api-resources", "api-versions"]),
+      // gh: read verbs only. `gh run rerun`, `gh pr merge` etc. are excluded, and
+      // the nested-verb check in isReadOnlyCommand handles `gh pr view` vs `gh pr merge`.
+      gh: /* @__PURE__ */ new Set(["browse"])
+    };
+    var READ_ONLY_NESTED = {
+      gh: /* @__PURE__ */ new Set(["view", "list", "status", "diff", "checks"])
+    };
+    var SHELL_CONTROL = /[\n\r;&|`]|\$\(|>>|>|<\(/;
+    function firstWords(command) {
+      return command.trim().split(/\s+/).filter(Boolean);
+    }
+    function isReadOnlyCommand(command) {
+      const cmd = command.trim();
+      if (!cmd)
+        return false;
+      if (SHELL_CONTROL.test(cmd))
+        return false;
+      const words = firstWords(cmd);
+      if (!words.length)
+        return false;
+      let i2 = 0;
+      while (i2 < words.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[i2]))
+        i2++;
+      if (i2 >= words.length)
+        return false;
+      let verb = words[i2];
+      const slash = verb.lastIndexOf("/");
+      if (slash >= 0)
+        verb = verb.slice(slash + 1);
+      if (verb === "sudo" || verb === "doas" || verb === "su")
+        return false;
+      const rest = words.slice(i2 + 1).filter((w) => !w.startsWith("-"));
+      const subs = READ_ONLY_SUBCOMMANDS[verb];
+      if (subs) {
+        const sub = rest[0];
+        if (!sub) {
+          return true;
+        }
+        if (subs.has(sub)) {
+          if (verb === "git" && sub === "config") {
+            const args = words.slice(i2 + 2).filter((w) => !w.startsWith("-"));
+            return args.length <= 1;
+          }
+          return true;
+        }
+        const nested = READ_ONLY_NESTED[verb];
+        if (nested && rest[1] && nested.has(rest[1]))
+          return true;
+        return false;
+      }
+      if (!READ_ONLY_TOOLS.has(verb) && !READ_ONLY_BASH.has(verb))
+        return false;
+      if (verb === "node" || verb === "python" || verb === "python3") {
+        return words.slice(i2 + 1).every((w) => w === "--version" || w === "-V" || w === "-v");
+      }
+      if (verb === "find" && words.some((w) => w === "-exec" || w === "-execdir" || w === "-delete")) {
+        return false;
+      }
+      return true;
+    }
+    function checkPlanMode(tool, input) {
+      if (tool === "bash") {
+        const command = typeof input.command === "string" ? input.command : "";
+        if (input.run_in_background === true) {
+          return {
+            reason: "bash-not-read-only",
+            message: "Plan mode is ON: background processes cannot be started. Finish researching and propose your plan; the user will leave plan mode if they want it carried out."
+          };
+        }
+        if (isReadOnlyCommand(command))
+          return null;
+        return {
+          reason: "bash-not-read-only",
+          message: `Plan mode is ON, so \`bash\` is limited to provably read-only commands and this one was not recognised as such (chained commands, redirection and command substitution are always refused). Do NOT ask the user to approve it and do NOT try a variation to get around this \u2014 it is a session-wide lock, not a per-call prompt. Use read-only inspection instead, and put the command in your plan as a step to run once plan mode is off.`
+        };
+      }
+      if (READ_ONLY_TOOLS.has(tool))
+        return null;
+      return {
+        reason: "mutating-tool",
+        message: `Plan mode is ON, so \`${tool}\` is unavailable \u2014 this session may not modify anything yet. Do NOT ask for approval: no answer the user gives at this prompt can unlock it, because it is a session-wide lock they control directly. Research with read-only tools and finish by proposing a concrete plan (files to change, in order, and how to verify). The user will exit plan mode to let you carry it out.`
+      };
+    }
+    exports.PLAN_MODE_INSTRUCTIONS = [
+      "# PLAN MODE IS ACTIVE",
+      "",
+      "This session is READ-ONLY. You cannot edit files, write files, run mutating commands, or start",
+      "background processes. This is enforced outside your control \u2014 it is not a permission prompt, and",
+      "the user cannot approve an exception from inside this turn.",
+      "",
+      "Therefore:",
+      '- NEVER ask "shall I go ahead and make this change?" \u2014 you cannot, whatever the answer.',
+      '- NEVER attempt a mutating tool "just to see" \u2014 it will be refused and wastes the turn.',
+      "- NEVER try to reach a blocked command another way (a different flag, a script, an interpreter).",
+      "",
+      "Your job is to research thoroughly, then deliver a plan:",
+      "1. What you found \u2014 the specific files, functions and line numbers that matter.",
+      "2. What you propose to change \u2014 file by file, in dependency order.",
+      "3. Risks and unknowns \u2014 what could break, what you could not verify, what you assumed.",
+      "4. How it will be verified \u2014 the exact build/test/lint command that proves it works.",
+      "",
+      'Be concrete. "Update the auth logic" is not a plan; "add a `refreshToken` field to AuthConfig in',
+      'auth/index.ts:42, then thread it through client.ts:118" is. The user will review the plan and',
+      "leave plan mode to have it carried out."
+    ].join("\n");
+  }
+});
+
+// ../core/dist/agent/agentRegistry.js
+var require_agentRegistry = __commonJS({
+  "../core/dist/agent/agentRegistry.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports._limits = void 0;
+    exports.rememberAgent = rememberAgent;
+    exports.updateAgent = updateAgent;
+    exports.getAgent = getAgent;
+    exports.listAgents = listAgents;
+    exports._resetAgentRegistry = _resetAgentRegistry;
+    var MAX_AGENTS = 20;
+    var MAX_TOTAL_BYTES = 8 * 1024 * 1024;
+    var _agents = /* @__PURE__ */ new Map();
+    var _counter = 0;
+    var _seq = 0;
+    function totalBytes() {
+      let n = 0;
+      for (const a of _agents.values())
+        n += a.bytes;
+      return n;
+    }
+    function evictUntilWithinLimits() {
+      while (_agents.size > MAX_AGENTS) {
+        const oldest = _agents.keys().next().value;
+        if (oldest === void 0)
+          break;
+        _agents.delete(oldest);
+      }
+      while (totalBytes() > MAX_TOTAL_BYTES && _agents.size > 1) {
+        const oldest = _agents.keys().next().value;
+        if (oldest === void 0)
+          break;
+        _agents.delete(oldest);
+      }
+    }
+    function sizeOf(messages) {
+      try {
+        return JSON.stringify(messages).length;
+      } catch {
+        return MAX_TOTAL_BYTES;
+      }
+    }
+    function rememberAgent(agentName, description, messages) {
+      const id = `agent_${++_counter}`;
+      const now = Date.now();
+      _agents.set(id, {
+        id,
+        agentName,
+        description,
+        messages,
+        createdAt: now,
+        updatedAt: now,
+        seq: ++_seq,
+        bytes: sizeOf(messages)
+      });
+      evictUntilWithinLimits();
+      return id;
+    }
+    function updateAgent(id, messages) {
+      const existing = _agents.get(id);
+      if (!existing)
+        return;
+      existing.messages = messages;
+      existing.updatedAt = Date.now();
+      existing.seq = ++_seq;
+      existing.bytes = sizeOf(messages);
+      _agents.delete(id);
+      _agents.set(id, existing);
+      evictUntilWithinLimits();
+    }
+    function getAgent(id) {
+      return _agents.get(id);
+    }
+    function listAgents() {
+      return [..._agents.values()].sort((a, b) => b.seq - a.seq);
+    }
+    function _resetAgentRegistry() {
+      _agents.clear();
+      _counter = 0;
+      _seq = 0;
+    }
+    exports._limits = { MAX_AGENTS, MAX_TOTAL_BYTES };
+  }
+});
+
 // ../core/dist/agent/flaky.js
 var require_flaky = __commonJS({
   "../core/dist/agent/flaky.js"(exports) {
@@ -15255,7 +15757,7 @@ var require_loop = __commonJS({
       };
     }();
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.VERIFY_CMD_RE = exports.WRITE_TOOL_NAMES = void 0;
+    exports.VERIFY_CMD_RE = exports.WRITE_TOOL_NAMES = exports.ToolNotAllowedError = void 0;
     exports.resolveMaxIterations = resolveMaxIterations;
     exports.createLimiter = createLimiter;
     exports.extractSubTaskText = extractSubTaskText;
@@ -15281,6 +15783,8 @@ var require_loop = __commonJS({
     var agentTypes_1 = require_agentTypes();
     var skills_1 = require_skills();
     var rules_1 = require_rules();
+    var planMode_1 = require_planMode();
+    var agentRegistry_1 = require_agentRegistry();
     var sandbox_1 = require_sandbox();
     var index_1 = require_plugins();
     var testIntegrity_1 = require_testIntegrity();
@@ -15532,6 +16036,13 @@ var require_loop = __commonJS({
     var _subTaskCounter = 0;
     var SUBTASK_TIMEOUT_MS = Number(process.env.NEXRALL_SUBTASK_TIMEOUT_MS) > 0 ? Number(process.env.NEXRALL_SUBTASK_TIMEOUT_MS) : 10 * 60 * 1e3;
     var SUBTASK_MAX = 48e3;
+    var ToolNotAllowedError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "ToolNotAllowedError";
+      }
+    };
+    exports.ToolNotAllowedError = ToolNotAllowedError;
     function sliceSafeEnd(s2, max) {
       if (s2.length <= max)
         return s2;
@@ -15594,11 +16105,34 @@ ${tail}`;
       if (depth >= MAX_TASK_DEPTH) {
         return { error: "Sub-agents cannot spawn further sub-agents. Do this work directly, or report back so the main agent can delegate it." };
       }
-      const requestedType = typeof input.subagent_type === "string" ? input.subagent_type : "";
-      const agent = (0, agentTypes_1.findAgentType)(agentTypes, requestedType);
+      const resumeId = typeof input.resume_agent_id === "string" ? input.resume_agent_id.trim() : "";
+      const resumed = resumeId ? (0, agentRegistry_1.getAgent)(resumeId) : void 0;
+      if (resumeId && !resumed) {
+        return {
+          error: `No resumable sub-agent with id "${resumeId}". Ids live only for the current session and the oldest are dropped when too many accumulate, so this one has expired or never existed. Start a fresh sub-task with a self-contained prompt instead.`
+        };
+      }
+      const requestedType = resumed ? resumed.agentName ?? "" : typeof input.subagent_type === "string" ? input.subagent_type : "";
+      if (requestedType) {
+        const decision = (0, rules_1.evaluatePermission)((0, rules_1.loadSettings)(options.workDir).permissions, "task", { subagent_type: requestedType }, options.workDir);
+        if (decision === "deny") {
+          return {
+            error: `The sub-agent "${requestedType}" is disabled by a permission rule in this project (permissions.deny in settings.json). This is a deliberate policy choice, not a missing file \u2014 do not create it and do not retry. Do the work yourself, or use a different sub-agent.`
+          };
+        }
+      }
+      let agent = (0, agentTypes_1.findAgentType)(agentTypes, requestedType);
+      let knownTypes = agentTypes;
       if (requestedType && !agent) {
-        const known = agentTypes.map((a) => a.name).join(", ") || "(none defined)";
-        return { error: `Unknown subagent_type "${requestedType}". Available types: ${known}.` };
+        knownTypes = (0, agentTypes_1.loadAgentTypes)(options.workDir);
+        agent = (0, agentTypes_1.findAgentType)(knownTypes, requestedType);
+      }
+      if (requestedType && !agent) {
+        const known = knownTypes.map((a) => a.name).join(", ") || "(none defined)";
+        return {
+          error: `Unknown subagent_type "${requestedType}". Available types: ${known}.
+If you just created .nexrall/agents/` + requestedType + ".md, make sure the write finished in an EARLIER tool call than this one \u2014 a file written in the same batch may not be on disk yet."
+        };
       }
       const subNexrallMd = agent ? `# Sub-agent role: ${agent.name}
 ${agent.prompt}` + (options.nexrallMd ? `
@@ -15608,15 +16142,15 @@ ${agent.prompt}` + (options.nexrallMd ? `
 ${options.nexrallMd}` : "") : options.nexrallMd;
       const allowed = agent?.tools ? new Set(agent.tools) : null;
       const gatedPermission = async (req) => {
-        if (allowed && !allowed.has(req.tool))
-          return false;
-        if (agent?.testFilesOnly && !allowsTestOnlyWrite(req.tool, req.input))
-          return false;
+        if (allowed && !allowed.has(req.tool)) {
+          throw new ToolNotAllowedError(`The "${agent.name}" sub-agent is not allowed to use \`${req.tool}\` \u2014 it is not in that agent's tool allowlist. This is a restriction of the agent definition, NOT a user decision: do not ask for approval, use one of the tools you do have, or report back that the task needs a different agent.`);
+        }
+        if (agent?.testFilesOnly && !allowsTestOnlyWrite(req.tool, req.input)) {
+          throw new ToolNotAllowedError(`The "${agent.name}" sub-agent may only write to TEST files, so \`${req.tool}\` was refused for this path. Do not try to work around it: if production code must change, say so in your report instead.`);
+        }
         return options.requestPermission(req);
       };
-      const subMessages = [
-        { role: "user", content: [{ type: "text", text: prompt2 }] }
-      ];
+      const subMessages = resumed ? [...resumed.messages, { role: "user", content: [{ type: "text", text: prompt2 }] }] : [{ role: "user", content: [{ type: "text", text: prompt2 }] }];
       const subAbort = { aborted: false };
       const timer = setTimeout(() => {
         subAbort.aborted = true;
@@ -15634,6 +16168,9 @@ ${options.nexrallMd}` : "") : options.nexrallMd;
           editorContext: null,
           // fresh isolated context for sub-agent
           model: agent?.model ?? options.model,
+          // Plan mode is inherited, never relaxed. If the main agent could spawn a
+          // sub-agent that writes, the lock would be one `task` call from useless.
+          planMode: options.planMode,
           nexrallMd: subNexrallMd,
           abortSignal: subAbort,
           requestPermission: gatedPermission,
@@ -15682,7 +16219,13 @@ ${partial}` : "",
           return { error: sections.join("\n\n") };
         }
         const text = capSubTaskText(extractSubTaskText(result, true));
-        return { output: text || "(sub-task completed with no text output)" };
+        const agentId = resumed ? ((0, agentRegistry_1.updateAgent)(resumed.id, result), resumed.id) : (0, agentRegistry_1.rememberAgent)(agent?.name ?? null, typeof input.description === "string" && input.description.trim() || prompt2.slice(0, 80), result);
+        const body = text || "(sub-task completed with no text output)";
+        return {
+          output: `${body}
+
+[resumable: this sub-agent is "${agentId}". To ask IT a follow-up \u2014 keeping everything it already read and concluded \u2014 call task again with resume_agent_id="` + agentId + '" instead of writing a new prompt from scratch.]'
+        };
       } catch (err) {
         const salvaged = (0, types_1.salvageHistory)(err);
         if (salvaged) {
@@ -16064,10 +16607,15 @@ Continue the work from here.` }] });
       const hooks = loadHooks(options.workDir);
       const depth = options._depth ?? 0;
       const agentScope = options._agentScope ?? "root";
-      const agentTypes = (0, agentTypes_1.loadAgentTypes)(options.workDir);
+      const settings = (0, rules_1.loadSettings)(options.workDir);
+      const agentTypes = (0, agentTypes_1.loadAgentTypes)(options.workDir).filter((t2) => (0, rules_1.evaluatePermission)(settings.permissions, "task", { subagent_type: t2.name }, options.workDir) !== "deny");
       const agentsCatalogue = depth === 0 ? (0, agentTypes_1.summariseAgents)(agentTypes) : "";
       const skillsCatalogue = (0, skills_1.summariseSkills)((0, skills_1.loadSkills)(options.workDir));
-      const settings = (0, rules_1.loadSettings)(options.workDir);
+      const planAwareNexrallMd = options.planMode ? planMode_1.PLAN_MODE_INSTRUCTIONS + (options.nexrallMd ? `
+
+---
+
+${options.nexrallMd}` : "") : options.nexrallMd;
       const sandboxCfg = (0, sandbox_1.parseSandboxConfig)(settings.raw.sandbox) ?? void 0;
       const maxIterations = resolveMaxIterations(options.maxIterations, settings.raw);
       const autoContinue = resolveAutoContinue(options.autoContinue, settings.raw);
@@ -16175,7 +16723,7 @@ Continue the work from here.` }] });
               effort: options.effort,
               env: options.env,
               editorContext: options.editorContext,
-              nexrallMd: options.nexrallMd,
+              nexrallMd: planAwareNexrallMd,
               clientType: options.clientType,
               abortSignal: options.abortSignal,
               extraTools: options.mcpManager?.getAnthropicTools(),
@@ -16295,15 +16843,26 @@ Continue the work from here.` }] });
               options.onToolResult(name, result);
               return { block: { ...block, id }, result };
             }
+            if (options.planMode) {
+              const refusal = (0, planMode_1.checkPlanMode)(name, input);
+              if (refusal) {
+                result = { error: refusal.message };
+                options.onToolResult(name, result);
+                return { block: { ...block, id }, result };
+              }
+            }
             const description = humanDescription(name, input);
             let permitted;
+            let deniedReason = null;
             try {
               permitted = await options.requestPermission({ tool: name, input, description });
-            } catch {
+            } catch (err) {
               permitted = false;
+              if (err instanceof ToolNotAllowedError)
+                deniedReason = err.message;
             }
             if (!permitted) {
-              result = { error: "Permission denied by user" };
+              result = { error: deniedReason ?? "Permission denied by user" };
             } else if (name === "task") {
               result = depth === 0 ? await _subTaskLimit(() => runSubTask(input, options, agentTypes)) : await runSubTask(input, options, agentTypes);
             } else {
@@ -17744,6 +18303,175 @@ var require_destructive = __commonJS({
   }
 });
 
+// ../core/dist/plugins/sources.js
+var require_sources = __commonJS({
+  "../core/dist/plugins/sources.js"(exports) {
+    "use strict";
+    var __createBinding = exports && exports.__createBinding || (Object.create ? function(o, m2, k, k2) {
+      if (k2 === void 0)
+        k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m2, k);
+      if (!desc || ("get" in desc ? !m2.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m2[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    } : function(o, m2, k, k2) {
+      if (k2 === void 0)
+        k2 = k;
+      o[k2] = m2[k];
+    });
+    var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? function(o, v) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v });
+    } : function(o, v) {
+      o["default"] = v;
+    });
+    var __importStar = exports && exports.__importStar || /* @__PURE__ */ function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2)
+            if (Object.prototype.hasOwnProperty.call(o2, k))
+              ar[ar.length] = k;
+          return ar;
+        };
+        return ownKeys(o);
+      };
+      return function(mod) {
+        if (mod && mod.__esModule)
+          return mod;
+        var result = {};
+        if (mod != null) {
+          for (var k = ownKeys(mod), i2 = 0; i2 < k.length; i2++)
+            if (k[i2] !== "default")
+              __createBinding(result, mod, k[i2]);
+        }
+        __setModuleDefault(result, mod);
+        return result;
+      };
+    }();
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.loadDeclaredSources = loadDeclaredSources2;
+    exports.allowedSourcePatterns = allowedSourcePatterns2;
+    exports.isSourceAllowed = isSourceAllowed2;
+    exports.resolveSourceAlias = resolveSourceAlias2;
+    exports.writeDeclaredSource = writeDeclaredSource2;
+    exports.removeDeclaredSource = removeDeclaredSource2;
+    exports.sourcesFileFor = sourcesFileFor2;
+    var fs9 = __importStar(__require("fs"));
+    var path6 = __importStar(__require("path"));
+    var os6 = __importStar(__require("os"));
+    function managedSettingsPath() {
+      if (process.platform === "darwin")
+        return "/Library/Application Support/Nexrall/managed-settings.json";
+      if (process.platform === "win32")
+        return path6.join(process.env.PROGRAMDATA ?? "C:\\ProgramData", "Nexrall", "managed-settings.json");
+      return "/etc/nexrall/managed-settings.json";
+    }
+    function readJson(file) {
+      try {
+        return JSON.parse(fs9.readFileSync(file, "utf-8"));
+      } catch {
+        return null;
+      }
+    }
+    var ALIAS_RE = /^[a-z0-9][\w.-]{0,63}$/i;
+    function readSpec(value) {
+      if (typeof value === "string")
+        return value.trim() || null;
+      if (value && typeof value === "object") {
+        const v = value;
+        const inner = v.source ?? v.repo ?? v.url;
+        if (typeof inner === "string")
+          return inner.trim() || null;
+        if (inner && typeof inner === "object") {
+          const deep = inner.repo ?? inner.url;
+          if (typeof deep === "string")
+            return deep.trim() || null;
+        }
+      }
+      return null;
+    }
+    function collect(file, tier, into) {
+      const obj = readJson(file);
+      const raw = obj?.pluginSources;
+      if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return;
+      for (const [name, value] of Object.entries(raw)) {
+        if (!ALIAS_RE.test(name))
+          continue;
+        const spec = readSpec(value);
+        if (!spec)
+          continue;
+        if (into.has(name))
+          continue;
+        into.set(name, { name, spec, tier, file });
+      }
+    }
+    function loadDeclaredSources2(workDir, opts = {}) {
+      const out = /* @__PURE__ */ new Map();
+      collect(managedSettingsPath(), "managed", out);
+      collect(path6.join(os6.homedir(), ".nexrall", "settings.json"), "user", out);
+      if (opts.includeProject) {
+        collect(path6.join(workDir, ".nexrall", "settings.json"), "project", out);
+        collect(path6.join(workDir, ".nexrall", "settings.local.json"), "project", out);
+      }
+      return [...out.values()];
+    }
+    function allowedSourcePatterns2() {
+      const obj = readJson(managedSettingsPath());
+      const v = obj?.allowedPluginSources;
+      if (!Array.isArray(v))
+        return null;
+      const pats = v.filter((x2) => typeof x2 === "string" && x2.trim().length > 0);
+      return pats.length ? pats : null;
+    }
+    function isSourceAllowed2(spec, patterns = allowedSourcePatterns2()) {
+      if (!patterns)
+        return true;
+      const cleaned = spec.trim().replace(/^https?:\/\/(?:www\.)?github\.com\//i, "").replace(/\.git$/, "");
+      const base = cleaned.split("#")[0].split("/").slice(0, 2).join("/").toLowerCase();
+      return patterns.some((p) => {
+        const pat = p.trim().toLowerCase().replace(/^https?:\/\/(?:www\.)?github\.com\//i, "");
+        if (pat === "*")
+          return true;
+        if (pat.endsWith("/*"))
+          return base.startsWith(pat.slice(0, -1));
+        return base === pat.split("#")[0].split("/").slice(0, 2).join("/");
+      });
+    }
+    function resolveSourceAlias2(alias, workDir, opts = {}) {
+      const want = alias.trim().toLowerCase();
+      return loadDeclaredSources2(workDir, opts).find((s2) => s2.name.toLowerCase() === want) ?? null;
+    }
+    function writeDeclaredSource2(file, name, spec) {
+      if (!ALIAS_RE.test(name)) {
+        throw new Error(`Invalid source name "${name}". Use letters, numbers, dot, dash or underscore.`);
+      }
+      const obj = readJson(file) ?? {};
+      const existing = obj.pluginSources && typeof obj.pluginSources === "object" && !Array.isArray(obj.pluginSources) ? obj.pluginSources : {};
+      obj.pluginSources = { ...existing, [name]: spec };
+      fs9.mkdirSync(path6.dirname(file), { recursive: true });
+      fs9.writeFileSync(file, JSON.stringify(obj, null, 2) + "\n", "utf-8");
+    }
+    function removeDeclaredSource2(file, name) {
+      const obj = readJson(file);
+      if (!obj?.pluginSources || typeof obj.pluginSources !== "object")
+        return false;
+      const sources = obj.pluginSources;
+      if (!(name in sources))
+        return false;
+      delete sources[name];
+      fs9.writeFileSync(file, JSON.stringify(obj, null, 2) + "\n", "utf-8");
+      return true;
+    }
+    function sourcesFileFor2(scope, workDir) {
+      return scope === "user" ? path6.join(os6.homedir(), ".nexrall", "settings.json") : path6.join(workDir, ".nexrall", "settings.json");
+    }
+  }
+});
+
 // ../core/dist/plugins/installer.js
 var require_installer = __commonJS({
   "../core/dist/plugins/installer.js"(exports) {
@@ -17796,8 +18524,8 @@ var require_installer = __commonJS({
     exports.searchRegistry = searchRegistry2;
     exports.getRegistryPlugin = getRegistryPlugin2;
     exports.reportInstall = reportInstall2;
-    exports.parsePluginSource = parsePluginSource;
-    exports.inspectPluginDir = inspectPluginDir;
+    exports.parsePluginSource = parsePluginSource2;
+    exports.inspectPluginDir = inspectPluginDir2;
     exports.installPlugin = installPlugin2;
     exports.readReceipt = readReceipt2;
     exports.removePlugin = removePlugin2;
@@ -17807,6 +18535,8 @@ var require_installer = __commonJS({
     var os6 = __importStar(__require("os"));
     var child_process_1 = __require("child_process");
     var client_1 = require_client();
+    var index_1 = require_plugins();
+    var sources_1 = require_sources();
     var RECEIPT_FILE = "_install.json";
     async function searchRegistry2(query, limit = 50) {
       const u = new URL(`${client_1.API_BASE}/api/code/plugins`);
@@ -17836,7 +18566,7 @@ var require_installer = __commonJS({
       fetch(`${client_1.API_BASE}/api/code/plugins/${encodeURIComponent(name)}/installed`, { method: "POST" }).catch(() => {
       });
     }
-    function parsePluginSource(spec) {
+    function parsePluginSource2(spec) {
       const raw = spec.trim();
       if (!raw)
         throw new Error("Empty plugin source.");
@@ -17883,29 +18613,45 @@ var require_installer = __commonJS({
         return [];
       }
     }
-    function inspectPluginDir(dir) {
+    function inspectPluginDir2(dir) {
       let meta = {};
-      try {
-        const j = JSON.parse(fs9.readFileSync(path6.join(dir, "plugin.json"), "utf-8"));
-        meta = {
-          name: typeof j.name === "string" ? j.name : void 0,
-          version: typeof j.version === "string" ? j.version : void 0,
-          description: typeof j.description === "string" ? j.description : void 0
-        };
-      } catch {
+      const manifest = (0, index_1.resolvePluginFile)(dir, "manifest");
+      if (manifest) {
+        try {
+          const j = JSON.parse(fs9.readFileSync(manifest, "utf-8"));
+          meta = {
+            name: typeof j.name === "string" ? j.name : void 0,
+            version: typeof j.version === "string" ? j.version : void 0,
+            description: typeof j.description === "string" ? j.description : void 0
+          };
+        } catch {
+        }
       }
       return {
         commands: listMd(path6.join(dir, "commands")),
         agents: listMd(path6.join(dir, "agents")),
-        hasHooks: fs9.existsSync(path6.join(dir, "hooks.json")),
-        hasMcp: fs9.existsSync(path6.join(dir, "mcp.json")),
+        hasHooks: (0, index_1.resolvePluginFile)(dir, "hooks") !== null,
+        hasMcp: (0, index_1.resolvePluginFile)(dir, "mcp") !== null,
         meta
       };
     }
     function looksLikePlugin(dir) {
-      const i2 = inspectPluginDir(dir);
+      const i2 = inspectPluginDir2(dir);
       return i2.commands.length > 0 || i2.agents.length > 0 || i2.hasHooks || i2.hasMcp || i2.meta.name !== void 0;
     }
+    async function resolveCommitSha(repo, ref) {
+      try {
+        const res = await fetch(`https://api.github.com/repos/${repo}/commits/${encodeURIComponent(ref || "HEAD")}`, {
+          headers: { Accept: "application/vnd.github.sha", "User-Agent": "nexrall-code" }
+        });
+        if (!res.ok)
+          return null;
+        const sha = (await res.text()).trim();
+        return /^[0-9a-f]{40}$/i.test(sha) ? sha : null;
+      } catch {
+        return null;
+      }
+    }
     async function downloadTarball(repo, ref, destFile) {
       const r2 = ref || "HEAD";
       const url = `https://codeload.github.com/${repo}/tar.gz/${encodeURIComponent(r2)}`;
@@ -17956,28 +18702,33 @@ var require_installer = __commonJS({
       return scope === "project" ? path6.join(workDir || process.cwd(), ".nexrall", "plugins") : path6.join(os6.homedir(), ".nexrall", "plugins");
     }
     async function installPlugin2(spec, opts = {}) {
-      const source = parsePluginSource(spec);
+      const source2 = parsePluginSource2(spec);
       const scope = opts.scope ?? "global";
+      const patterns = (0, sources_1.allowedSourcePatterns)();
+      if (patterns && source2.kind === "github" && !(0, sources_1.isSourceAllowed)(source2.raw, patterns)) {
+        throw new Error(`Blocked by your organisation's policy: plugins may only be installed from ${patterns.join(", ")}.`);
+      }
       const tmpBase = fs9.mkdtempSync(path6.join(os6.tmpdir(), "nexrall-plugin-"));
       try {
         let repoRoot;
-        if (source.kind === "local") {
-          if (!fs9.existsSync(source.repo) || !fs9.statSync(source.repo).isDirectory()) {
-            throw new Error(`Local plugin path not found: ${source.repo}`);
+        if (source2.kind === "local") {
+          if (!fs9.existsSync(source2.repo) || !fs9.statSync(source2.repo).isDirectory()) {
+            throw new Error(`Local plugin path not found: ${source2.repo}`);
           }
-          repoRoot = source.repo;
+          repoRoot = source2.repo;
         } else {
           const tarFile = path6.join(tmpBase, "plugin.tar.gz");
-          await downloadTarball(source.repo, source.ref, tarFile);
+          await downloadTarball(source2.repo, source2.ref, tarFile);
           repoRoot = extractTarball(tarFile, path6.join(tmpBase, "x"));
         }
-        let pluginRoot = source.subdir ? path6.join(repoRoot, source.subdir) : repoRoot;
+        const sha = source2.kind === "github" ? await resolveCommitSha(source2.repo, source2.ref) : null;
+        let pluginRoot = source2.subdir ? path6.join(repoRoot, source2.subdir) : repoRoot;
         pluginRoot = path6.resolve(pluginRoot);
         if (!path6.resolve(pluginRoot).startsWith(path6.resolve(repoRoot))) {
           throw new Error("Plugin subdirectory escapes the repository \u2014 refusing.");
         }
         if (!fs9.existsSync(pluginRoot) || !fs9.statSync(pluginRoot).isDirectory()) {
-          throw new Error(`Subdirectory not found in repo: ${source.subdir}`);
+          throw new Error(`Subdirectory not found in repo: ${source2.subdir}`);
         }
         if (!looksLikePlugin(pluginRoot)) {
           const candidates = ["plugin", ".nexrall-plugin"].map((c) => path6.join(pluginRoot, c));
@@ -17988,12 +18739,16 @@ var require_installer = __commonJS({
             throw new Error("No plugin found: expected plugin.json, commands/, agents/, hooks.json or mcp.json at the source root.");
           }
         }
-        const inspection = inspectPluginDir(pluginRoot);
-        const name = opts.name || inspection.meta.name || (source.subdir ? path6.basename(source.subdir) : void 0) || (source.kind === "github" ? source.repo.split("/")[1] : path6.basename(source.repo));
+        const inspection = inspectPluginDir2(pluginRoot);
+        const name = opts.name || inspection.meta.name || (source2.subdir ? path6.basename(source2.subdir) : void 0) || (source2.kind === "github" ? source2.repo.split("/")[1] : path6.basename(source2.repo));
         if (!/^[\w.-]+$/.test(name))
           throw new Error(`Invalid plugin name "${name}".`);
         if (opts.confirm) {
-          const ok = await opts.confirm(inspection, name);
+          const ok = await opts.confirm(inspection, name, {
+            sha: sha ?? void 0,
+            previousSha: opts._previousSha,
+            isUpdate: Boolean(opts._previousSha) || Boolean(opts.force)
+          });
           if (!ok)
             throw new Error("Installation cancelled.");
         }
@@ -18006,14 +18761,15 @@ var require_installer = __commonJS({
         }
         copyPluginDir(pluginRoot, dest);
         const receipt = {
-          source: source.raw,
-          kind: source.kind,
-          ref: source.ref,
-          subdir: source.subdir,
-          installedAt: (/* @__PURE__ */ new Date()).toISOString()
+          source: source2.raw,
+          kind: source2.kind,
+          ref: source2.ref,
+          subdir: source2.subdir,
+          installedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          ...sha ? { sha } : {}
         };
         fs9.writeFileSync(path6.join(dest, RECEIPT_FILE), JSON.stringify(receipt, null, 2));
-        return { name, dir: dest, scope, inspection };
+        return { name, dir: dest, scope, inspection, sha: sha ?? void 0, previousSha: opts._previousSha };
       } finally {
         fs9.rmSync(tmpBase, { recursive: true, force: true });
       }
@@ -18052,7 +18808,14 @@ var require_installer = __commonJS({
         if (receipt.kind === "local") {
           throw new Error(`Plugin "${name}" was installed from a local path \u2014 re-run 'nex plugin install ${receipt.source} --force'.`);
         }
-        return installPlugin2(receipt.source, { scope: s2, workDir: opts.workDir, name, force: true, confirm: opts.confirm });
+        return installPlugin2(receipt.source, {
+          scope: s2,
+          workDir: opts.workDir,
+          name,
+          force: true,
+          confirm: opts.confirm,
+          _previousSha: receipt.sha
+        });
       }
       throw new Error(`Plugin "${name}" is not installed.`);
     }
@@ -18103,10 +18866,13 @@ var require_dist2 = __commonJS({
     __exportStar(require_manager2(), exports);
     __exportStar(require_loader(), exports);
     __exportStar(require_agentTypes(), exports);
+    __exportStar(require_planMode(), exports);
+    __exportStar(require_agentRegistry(), exports);
     __exportStar(require_rules(), exports);
     __exportStar(require_destructive(), exports);
     __exportStar(require_plugins(), exports);
     __exportStar(require_installer(), exports);
+    __exportStar(require_sources(), exports);
   }
 });
 
@@ -20922,23 +21688,23 @@ var require_react_reconciler_production = __commonJS({
           return "\nError generating stack: " + x2.message + "\n" + x2.stack;
         }
       }
-      function createCapturedValueAtFiber(value, source) {
+      function createCapturedValueAtFiber(value, source2) {
         if ("object" === typeof value && null !== value) {
           var existing = CapturedStacks.get(value);
           if (void 0 !== existing)
             return existing;
-          source = {
+          source2 = {
             value,
-            source,
-            stack: getStackByFiberInDevAndProd(source)
+            source: source2,
+            stack: getStackByFiberInDevAndProd(source2)
           };
-          CapturedStacks.set(value, source);
-          return source;
+          CapturedStacks.set(value, source2);
+          return source2;
         }
         return {
           value,
-          source,
-          stack: getStackByFiberInDevAndProd(source)
+          source: source2,
+          stack: getStackByFiberInDevAndProd(source2)
         };
       }
       function pushTreeFork(workInProgress2, totalChildren) {
@@ -30110,23 +30876,23 @@ var require_react_reconciler_development = __commonJS({
       function describeFunctionComponentFrameWithoutLineNumber(fn) {
         return (fn = fn ? fn.displayName || fn.name : "") ? describeBuiltInComponentFrame(fn) : "";
       }
-      function createCapturedValueAtFiber(value, source) {
+      function createCapturedValueAtFiber(value, source2) {
         if ("object" === typeof value && null !== value) {
           var existing = CapturedStacks.get(value);
           if (void 0 !== existing)
             return existing;
-          source = {
+          source2 = {
             value,
-            source,
-            stack: getStackByFiberInDevAndProd(source)
+            source: source2,
+            stack: getStackByFiberInDevAndProd(source2)
           };
-          CapturedStacks.set(value, source);
-          return source;
+          CapturedStacks.set(value, source2);
+          return source2;
         }
         return {
           value,
-          source,
-          stack: getStackByFiberInDevAndProd(source)
+          source: source2,
+          stack: getStackByFiberInDevAndProd(source2)
         };
       }
       function pushTreeFork(workInProgress2, totalChildren) {
@@ -42684,9 +43450,9 @@ var require_buffer_util = __commonJS({
       }
       return target;
     }
-    function _mask(source, mask, output, offset, length) {
+    function _mask(source2, mask, output, offset, length) {
       for (let i2 = 0; i2 < length; i2++) {
-        output[offset + i2] = source[i2] ^ mask[i2 & 3];
+        output[offset + i2] = source2[i2] ^ mask[i2 & 3];
       }
     }
     function _unmask(buffer, mask) {
@@ -42725,11 +43491,11 @@ var require_buffer_util = __commonJS({
     if (!process.env.WS_NO_BUFFER_UTIL) {
       try {
         const bufferUtil = __require("bufferutil");
-        module.exports.mask = function(source, mask, output, offset, length) {
+        module.exports.mask = function(source2, mask, output, offset, length) {
           if (length < 48)
-            _mask(source, mask, output, offset, length);
+            _mask(source2, mask, output, offset, length);
           else
-            bufferUtil.mask(source, mask, output, offset, length);
+            bufferUtil.mask(source2, mask, output, offset, length);
         };
         module.exports.unmask = function(buffer, mask) {
           if (buffer.length < 32)
@@ -49446,16 +50212,16 @@ var require_dist3 = __commonJS({
     }
     function _objectSpread(target) {
       for (var i2 = 1; i2 < arguments.length; i2++) {
-        var source = arguments[i2] != null ? arguments[i2] : {};
+        var source2 = arguments[i2] != null ? arguments[i2] : {};
         if (i2 % 2) {
-          ownKeys(Object(source), true).forEach(function(key) {
-            _defineProperty(target, key, source[key]);
+          ownKeys(Object(source2), true).forEach(function(key) {
+            _defineProperty(target, key, source2[key]);
           });
         } else if (Object.getOwnPropertyDescriptors) {
-          Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
+          Object.defineProperties(target, Object.getOwnPropertyDescriptors(source2));
         } else {
-          ownKeys(Object(source)).forEach(function(key) {
-            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
+          ownKeys(Object(source2)).forEach(function(key) {
+            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source2, key));
           });
         }
       }
@@ -54175,6 +54941,16 @@ function trustGrantedByEnv() {
   const v = process.env[TRUST_ENV_VAR];
   return v === "1" || v === "true";
 }
+function declaresPluginSources(dir) {
+  try {
+    const raw = fs5.readFileSync(path3.join(dir, ".nexrall", "settings.json"), "utf-8");
+    const obj = JSON.parse(raw);
+    const s2 = obj.pluginSources;
+    return Boolean(s2 && typeof s2 === "object" && !Array.isArray(s2) && Object.keys(s2).length > 0);
+  } catch {
+    return false;
+  }
+}
 function detectTrustSignals(dir) {
   const signals = [];
   const exists = (...p) => {
@@ -54194,7 +54970,9 @@ function detectTrustSignals(dir) {
     signals.push(".nexrall/permissions.json \u2014 pre-approved tool permissions");
   }
   if (exists(".nexrall", "settings.json")) {
-    signals.push(".nexrall/settings.json \u2014 project settings and permission rules");
+    signals.push(
+      declaresPluginSources(dir) ? ".nexrall/settings.json \u2014 project settings, and declares plugin sources (aliases for remote plugin repos)" : ".nexrall/settings.json \u2014 project settings and permission rules"
+    );
   }
   if (exists("nexrall.md")) {
     signals.push("nexrall.md \u2014 project instructions added to the agent\u2019s prompt");
@@ -60703,15 +61481,15 @@ var generateLineNumbers = (line, around) => {
   }
   return lineNumbers;
 };
-var codeExcerpt = (source, line, options = {}) => {
+var codeExcerpt = (source2, line, options = {}) => {
   var _a;
-  if (typeof source !== "string") {
+  if (typeof source2 !== "string") {
     throw new TypeError("Source code is missing.");
   }
   if (!line || line < 1) {
     throw new TypeError("Line number must start from `1`.");
   }
-  const lines = dist_default3(source).split(/\r?\n/);
+  const lines = dist_default3(source2).split(/\r?\n/);
   if (line > lines.length) {
     return;
   }
@@ -63166,7 +63944,7 @@ var InkReadlineAdapter = class extends EventEmitter3 {
 };
 
 // src/commands/chat.ts
-var CLI_VERSION = "0.5.49";
+var CLI_VERSION = "0.5.51";
 var MODEL_LABELS = {
   turbo: "Nexrall Turbo",
   pro: "Nexrall Pro",
@@ -63384,15 +64162,23 @@ function formatContextUsage(messages, modelAlias) {
   return lines.join("\n");
 }
 function formatAgentsList(workDir) {
-  const types3 = (0, import_code_core3.loadAgentTypes)(workDir);
+  const { types: types3, warnings } = (0, import_code_core3.loadAgentTypesWithWarnings)(workDir);
   if (!types3.length)
     return source_default.dim("  No agent types found (this should not happen \u2014 builtins always register).");
   const lines = types3.map((t2) => {
-    const tools = t2.tools ? source_default.dim(` \u2014 tools: ${t2.tools.join(", ")}`) : source_default.dim(" \u2014 all tools");
+    const tools = t2.tools ? source_default.dim(` \u2014 tools: ${t2.tools.join(", ")}`) : source_default.dim(" \u2014 ALL tools (no allowlist)");
     const model = t2.model ? source_default.dim(` \u2014 model: ${t2.model}`) : "";
     const scope = source_default.dim(` (${t2.source})`);
     return "  " + source_default.cyan(t2.name.padEnd(16)) + source_default.white(t2.description) + scope + tools + model;
   });
+  if (warnings.length) {
+    lines.push("");
+    lines.push("  " + source_default.yellow.bold(`\u26A0 ${warnings.length} problem${warnings.length > 1 ? "s" : ""} in your agent definitions:`));
+    for (const w of warnings) {
+      lines.push("    " + source_default.yellow(`\u2022 ${w.agent}`) + source_default.dim(` \u2014 ${w.message}`));
+      lines.push("      " + source_default.dim(w.file));
+    }
+  }
   return lines.join("\n");
 }
 async function runTurn(messages, modelAlias, workDir, abortSignal, env3, nexrallMd, mode, effort, checkpointManager, onProgress) {
@@ -63429,6 +64215,12 @@ async function runTurn(messages, modelAlias, workDir, abortSignal, env3, nexrall
     env: env3,
     nexrallMd,
     mode,
+    // `/mode plan` previously only hinted to the backend — the footer said "plan
+    // mode on" while every write tool stayed live, so the one mode whose entire
+    // promise is "I will not touch anything" was the one not enforced. This
+    // makes it real: the loop refuses mutating tools before the permission
+    // prompt, and sub-agents inherit the lock.
+    planMode: mode === "plan",
     effort,
     // The backend streams a cumulative output-token count (routes/code.js's
     // sendProgress, throttled to ≤5/s) covering thinking, visible text AND
@@ -63582,6 +64374,7 @@ async function runTurnHeadless(messages, modelAlias, workDir, _abortSignal, env3
     env: env3,
     nexrallMd,
     mode,
+    planMode: mode === "plan",
     effort,
     abortSignal: _abortSignal,
     onText: (text) => {
@@ -64509,11 +65302,23 @@ ${caption}` : `[Attached: ${rel}]`;
 // src/commands/plugin.ts
 var import_prompts = __toESM(require_prompts3(), 1);
 var import_code_core4 = __toESM(require_dist2(), 1);
-function describeInspection(i2, name) {
+function describeInspection(i2, name, ctx) {
   console.log();
   console.log(source_default.bold(`  Plugin: ${name}`) + (i2.meta.version ? source_default.dim(`  v${i2.meta.version}`) : ""));
   if (i2.meta.description)
     console.log(source_default.dim(`  ${i2.meta.description}`));
+  if (ctx?.sha) {
+    const short = (s2) => s2.slice(0, 7);
+    if (ctx.previousSha && ctx.previousSha !== ctx.sha) {
+      console.log(source_default.dim("  commit:  ") + source_default.yellow(`${short(ctx.previousSha)} \u2192 ${short(ctx.sha)}`));
+    } else if (ctx.previousSha === ctx.sha) {
+      console.log(source_default.dim(`  commit:  ${short(ctx.sha)} (already up to date)`));
+    } else {
+      console.log(source_default.dim(`  commit:  ${short(ctx.sha)}`));
+    }
+  } else if (ctx?.isUpdate) {
+    console.log(source_default.dim("  commit:  unknown (could not reach the GitHub API)"));
+  }
   if (i2.commands.length)
     console.log(`  ${source_default.cyan("commands:")} ${i2.commands.map((c) => "/" + c).join(", ")}`);
   if (i2.agents.length)
@@ -64523,10 +65328,16 @@ function describeInspection(i2, name) {
   if (i2.hasMcp)
     console.log(`  ${source_default.yellow("mcp:")}      yes`);
 }
-async function confirmInstall(i2, name, autoYes) {
-  describeInspection(i2, name);
+async function confirmInstall(i2, name, autoYes, ctx) {
+  describeInspection(i2, name, ctx);
   const dangerous = i2.hasHooks || i2.hasMcp;
   if (dangerous) {
+    if (ctx?.isUpdate) {
+      console.log();
+      console.log(source_default.red.bold("  \u26A0 THIS UPDATE SHIPS CODE EXECUTION"));
+      console.log(source_default.red("  A version of this plugin you already trust is being replaced by one"));
+      console.log(source_default.red("  that runs commands. Review the diff before continuing."));
+    }
     console.log();
     console.log(source_default.red.bold("  \u26A0 SECURITY WARNING"));
     if (i2.hasHooks) {
@@ -64562,35 +65373,43 @@ async function confirmInstall(i2, name, autoYes) {
 async function pluginInstallCommand(spec, opts) {
   const scope = opts.project ? "project" : "global";
   try {
-    let source = spec;
+    let source2 = spec;
     let registryName;
     const isShortName = /^[\w.-]+$/.test(spec.trim()) && !spec.includes("/");
     if (isShortName) {
+      const alias = (0, import_code_core4.resolveSourceAlias)(spec.trim(), process.cwd(), { includeProject: true });
+      if (alias) {
+        source2 = alias.spec;
+        console.log(source_default.dim(`  Source: ${alias.name} (${alias.tier}) \u2190 ${alias.spec}`));
+      }
+    }
+    if (isShortName && source2 === spec) {
       const entry = await (0, import_code_core4.getRegistryPlugin)(spec.trim()).catch(() => null);
       if (entry) {
-        source = entry.source;
+        source2 = entry.source;
         registryName = entry.name;
         const badge = entry.official ? source_default.magenta(" [official]") : entry.verified ? source_default.green(" [verified]") : "";
         console.log(source_default.dim(`  Registry: ${entry.display_name}${badge} \u2190 ${entry.source}`));
       } else {
-        console.error(source_default.red(`  \u2717 "${spec}" not found in the registry.`));
-        console.error(source_default.dim("    Search:  nex plugin search <keyword>"));
-        console.error(source_default.dim("    Or install from GitHub directly:  nex plugin install owner/repo"));
+        console.error(source_default.red(`  \u2717 "${spec}" is not a declared source or a registry plugin.`));
+        console.error(source_default.dim("    Search:    nex plugin search <keyword>"));
+        console.error(source_default.dim("    From GitHub:  nex plugin install owner/repo"));
+        console.error(source_default.dim("    Declare it:   nex plugin source add " + spec.trim() + " owner/repo"));
         process.exitCode = 1;
         return;
       }
     }
-    const res = await (0, import_code_core4.installPlugin)(source, {
+    const res = await (0, import_code_core4.installPlugin)(source2, {
       scope,
       workDir: process.cwd(),
       name: opts.name ?? registryName,
       force: opts.force,
-      confirm: (i2, name) => confirmInstall(i2, name, opts.yes === true)
+      confirm: (i2, name, ctx) => confirmInstall(i2, name, opts.yes === true, ctx)
     });
     if (registryName)
       (0, import_code_core4.reportInstall)(registryName);
     console.log();
-    console.log(source_default.green(`  \u2713 Installed "${res.name}" (${res.scope}) \u2192 ${res.dir}`));
+    console.log(source_default.green(`  \u2713 Installed "${res.name}" (${res.scope}) \u2192 ${res.dir}`) + (res.sha ? source_default.dim(`  @ ${res.sha.slice(0, 7)}`) : ""));
     if (res.inspection.commands.length) {
       console.log(source_default.dim(`    Try: ${res.inspection.commands.map((c) => "/" + c).join(", ")}`));
     }
@@ -64624,9 +65443,10 @@ async function pluginUpdateCommand(name, opts) {
     try {
       const res = await (0, import_code_core4.updatePlugin)(t2, {
         workDir,
-        confirm: (i2, n) => confirmInstall(i2, n, opts.yes === true)
+        confirm: (i2, n, ctx) => confirmInstall(i2, n, opts.yes === true, ctx)
       });
-      console.log(source_default.green(`  \u2713 Updated "${res.name}"`));
+      const moved = res.sha && res.previousSha && res.sha !== res.previousSha ? source_default.dim(`  ${res.previousSha.slice(0, 7)} \u2192 ${res.sha.slice(0, 7)}`) : res.sha && res.previousSha === res.sha ? source_default.dim("  (unchanged)") : "";
+      console.log(source_default.green(`  \u2713 Updated "${res.name}"`) + moved);
     } catch (err) {
       console.error(source_default.red(`  \u2717 ${t2}: ${err.message}`));
       process.exitCode = 1;
@@ -64708,24 +65528,98 @@ function pluginListCommand() {
   for (const p of plugins) {
     const receipt = (0, import_code_core4.readReceipt)(p.dir);
     const src = receipt ? source_default.dim(`  \u2190 ${receipt.source}`) : source_default.dim("  (manual)");
+    const at = receipt?.sha ? source_default.dim(` @ ${receipt.sha.slice(0, 7)}`) : "";
+    const insp = (0, import_code_core4.inspectPluginDir)(p.dir);
+    const runs = insp.hasHooks || insp.hasMcp ? source_default.yellow(`  \u26A0 ${[insp.hasHooks && "hooks", insp.hasMcp && "mcp"].filter(Boolean).join("+")}`) : "";
     console.log(
-      "  " + source_default.cyan(p.name.padEnd(24)) + source_default.dim(`${(p.version ?? "").padEnd(10)}${p.scope.padEnd(9)}`) + src
+      "  " + source_default.cyan(p.name.padEnd(24)) + source_default.dim(`${(p.version ?? "").padEnd(10)}${p.scope.padEnd(9)}`) + src + at + runs
     );
   }
   console.log();
 }
+function pluginSourceListCommand() {
+  const workDir = process.cwd();
+  const sources = (0, import_code_core4.loadDeclaredSources)(workDir, { includeProject: true });
+  const patterns = (0, import_code_core4.allowedSourcePatterns)();
+  if (patterns) {
+    console.log();
+    console.log(source_default.bold("  Organisation policy: ") + source_default.dim(`installs restricted to ${patterns.join(", ")}`));
+  }
+  if (!sources.length) {
+    console.log(source_default.dim("\n  No plugin sources declared."));
+    console.log(source_default.dim("  Add one:  nex plugin source add <alias> owner/repo"));
+    console.log();
+    return;
+  }
+  console.log();
+  console.log(source_default.bold("  Declared plugin sources:"));
+  for (const s2 of sources) {
+    const tier = s2.tier === "project" ? source_default.yellow(s2.tier.padEnd(9)) : source_default.dim(s2.tier.padEnd(9));
+    const blocked = !(0, import_code_core4.isSourceAllowed)(s2.spec, patterns) ? source_default.red("  \u2717 blocked by policy") : "";
+    console.log("  " + source_default.cyan(s2.name.padEnd(20)) + tier + source_default.white(s2.spec) + blocked);
+  }
+  console.log();
+  console.log(source_default.dim("  Install from one:  nex plugin install <alias>"));
+  console.log(source_default.dim("  Declaring a source does not install anything."));
+  console.log();
+}
+function pluginSourceAddCommand(name, spec, opts) {
+  try {
+    (0, import_code_core4.parsePluginSource)(spec);
+    const patterns = (0, import_code_core4.allowedSourcePatterns)();
+    if (patterns && !(0, import_code_core4.isSourceAllowed)(spec, patterns)) {
+      console.error(source_default.red(`  \u2717 "${spec}" is not permitted by your organisation's policy.`));
+      console.error(source_default.dim(`    Allowed: ${patterns.join(", ")}`));
+      process.exitCode = 1;
+      return;
+    }
+    const scope = opts.project ? "project" : "user";
+    const file = (0, import_code_core4.sourcesFileFor)(scope, process.cwd());
+    (0, import_code_core4.writeDeclaredSource)(file, name, spec);
+    console.log();
+    console.log(source_default.green(`  \u2713 Declared "${name}" \u2192 ${spec}`) + source_default.dim(`  (${scope})`));
+    console.log(source_default.dim(`    ${file}`));
+    console.log(source_default.dim(`    Nothing installed yet \u2014 run:  nex plugin install ${name}`));
+    console.log();
+  } catch (err) {
+    console.error(source_default.red(`  \u2717 ${err.message}`));
+    process.exitCode = 1;
+  }
+}
+function pluginSourceRemoveCommand(name, opts) {
+  const workDir = process.cwd();
+  const scope = opts.project ? "project" : "user";
+  const file = (0, import_code_core4.sourcesFileFor)(scope, workDir);
+  if ((0, import_code_core4.removeDeclaredSource)(file, name)) {
+    console.log(source_default.green(`  \u2713 Removed source "${name}" (${scope})`));
+    console.log(source_default.dim("    Plugins already installed from it are untouched \u2014 remove them with  nex plugin remove <name>"));
+    return;
+  }
+  const found = (0, import_code_core4.resolveSourceAlias)(name, workDir, { includeProject: true });
+  if (found) {
+    console.error(source_default.red(`  \u2717 "${name}" is declared in the ${found.tier} tier, not ${scope}.`));
+    console.error(source_default.dim(`    ${found.file}`));
+    if (found.tier === "project")
+      console.error(source_default.dim("    Retry with --project"));
+    if (found.tier === "managed")
+      console.error(source_default.dim("    Managed sources are set by your organisation and cannot be removed here."));
+  } else {
+    console.error(source_default.red(`  \u2717 No source named "${name}".`));
+  }
+  process.exitCode = 1;
+}
 
 // src/index.ts
 var program2 = new Command();
-program2.name("nex").description("Nexrall Code \u2014 AI coding assistant (powered by Nexrall)").version("0.5.49").enablePositionalOptions();
+program2.name("nex").description("Nexrall Code \u2014 AI coding assistant (powered by Nexrall)").version("0.5.51").enablePositionalOptions();
 program2.command("auth").description("Login to your Nexrall account").action(authCommand);
 program2.command("logout").description("Log out of your Nexrall account").action(logoutCommand);
 program2.command("update").description("Update nex to the latest version").option("-c, --check", "Check for updates without installing").option("-y, --yes", "Skip confirmation prompt").action(async (opts) => {
   await updateCommand({ check: opts.check, yes: opts.yes });
 });
 var plugin = program2.command("plugin").description("Manage plugins (install from GitHub, list, update, remove)");
-plugin.command("install <source>").description("Install a plugin: registry name, owner/repo(#ref)(/subdir), GitHub URL, or local path").option("--project", "Install into ./.nexrall/plugins (default: ~/.nexrall/plugins)").option("--name <name>", "Override the installed plugin name").option("-f, --force", "Overwrite if already installed").option("-y, --yes", "Skip confirmation (still prompts for plugins with hooks/MCP)").action(async (source, opts) => {
-  await pluginInstallCommand(source, opts);
+plugin.command("install <source>").description("Install a plugin: registry name, owner/repo(#ref)(/subdir), GitHub URL, or local path").option("--project", "Install into ./.nexrall/plugins (default: ~/.nexrall/plugins)").option("--name <name>", "Override the installed plugin name").option("-f, --force", "Overwrite if already installed").option("-y, --yes", "Skip confirmation (still prompts for plugins with hooks/MCP)").action(async (source2, opts) => {
+  await pluginInstallCommand(source2, opts);
 });
 plugin.command("remove <name>").alias("uninstall").description("Remove an installed plugin").option("--project", "Only look in ./.nexrall/plugins").action((name, opts) => {
   pluginRemoveCommand(name, opts);
@@ -64742,6 +65636,16 @@ plugin.command("search [query]").description("Search the Nexrall plugin registry
 plugin.command("info <name>").description("Show registry details for a plugin").action(async (name) => {
   await pluginInfoCommand(name);
 });
+var source = plugin.command("source").description("Declare where plugins may be installed from (aliases for plugin repos)");
+source.command("list").alias("ls").description("List declared plugin sources").action(() => {
+  pluginSourceListCommand();
+});
+source.command("add <name> <spec>").description("Declare a source: nex plugin source add acme acme/plugins").option("--project", "Write to ./.nexrall/settings.json so the team shares it (default: ~/.nexrall/settings.json)").action((name, spec, opts) => {
+  pluginSourceAddCommand(name, spec, opts);
+});
+source.command("remove <name>").alias("rm").description("Remove a declared source (installed plugins are untouched)").option("--project", "Remove from ./.nexrall/settings.json").action((name, opts) => {
+  pluginSourceRemoveCommand(name, opts);
+});
 program2.command("sessions").description("List or delete saved chat sessions").option("-d, --delete <id>", "Delete a session by id").option("--clear-all", "Delete ALL saved sessions").action((opts) => {
   if (opts.clearAll) {
     const sessions2 = listSessions();