nexrall-code 0.5.50 → 0.5.51

package/dist/index.js

@@ -15192,6 +15192,9 @@ var require_rules = __commonJS({
         case "stock_photo":
           vals.push(str(input.path));
           break;
+        case "task":
+          vals.push(str(input.subagent_type));
+          break;
         default:
           pushPath(str(input.path));
           break;
@@ -15232,6 +15235,350 @@ var require_rules = __commonJS({
   }
 });
 
+// ../core/dist/agent/planMode.js
+var require_planMode = __commonJS({
+  "../core/dist/agent/planMode.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.PLAN_MODE_INSTRUCTIONS = void 0;
+    exports.isReadOnlyCommand = isReadOnlyCommand;
+    exports.checkPlanMode = checkPlanMode;
+    var READ_ONLY_TOOLS = /* @__PURE__ */ new Set([
+      "read_file",
+      "search_files",
+      "glob",
+      "list_directory",
+      "notebook_read",
+      // Planning bookkeeping. todo_write persists only to the session's own todo
+      // list, not the repo, so it stays available — a plan mode that cannot draft
+      // a checklist is missing the point of plan mode.
+      "todo_write",
+      "todo_read",
+      // Reading memory is fine; memory_write is NOT here on purpose. Memory is
+      // durable state that survives the session, so writing it is a real mutation
+      // even though no file in the repo changes.
+      "memory_read",
+      "use_skill",
+      "fetch_url",
+      "web_search",
+      // Delegating research is ALLOWED, and this is safe rather than a hole:
+      // runSubTask passes planMode down, so the sub-agent is under the same lock and
+      // its own write tools are refused by this very function one level deeper.
+      //
+      // Worth allowing rather than blanket-refusing, because plan mode exists to
+      // support deep research and the explorer agent is the cheapest way to do bulk
+      // searching without flooding the main context. Blocking `task` would have made
+      // the mode's headline use case worse, for no security gain.
+      "task",
+      // VS Code language server — all pure queries.
+      "get_symbols",
+      "get_workspace_symbols",
+      "find_references",
+      "go_to_definition",
+      "get_hover",
+      "get_diagnostics",
+      // Reading output from an ALREADY-running background shell. Starting one is
+      // gated with the rest of bash below; draining a buffer is not a new effect.
+      "bash_output"
+    ]);
+    var READ_ONLY_BASH = /* @__PURE__ */ new Set([
+      "ls",
+      "cat",
+      "head",
+      "tail",
+      "wc",
+      "file",
+      "stat",
+      "du",
+      "df",
+      "pwd",
+      "which",
+      "type",
+      "echo",
+      "printf",
+      "basename",
+      "dirname",
+      "realpath",
+      "readlink",
+      "grep",
+      "egrep",
+      "fgrep",
+      "rg",
+      "ag",
+      "ack",
+      "find",
+      "fd",
+      "locate",
+      "diff",
+      "comm",
+      "cmp",
+      "sort",
+      "uniq",
+      "cut",
+      "tr",
+      "column",
+      "jq",
+      "yq",
+      "date",
+      "whoami",
+      "hostname",
+      "uname",
+      "env",
+      "printenv",
+      "id",
+      "groups",
+      "ps",
+      "top",
+      "uptime",
+      "free",
+      "node",
+      "python",
+      "python3",
+      "tree",
+      "less",
+      "more",
+      "nl",
+      "tac",
+      "strings",
+      "md5sum",
+      "sha256sum",
+      "true",
+      "false",
+      "test",
+      "sleep",
+      "seq",
+      "expr"
+    ]);
+    var READ_ONLY_SUBCOMMANDS = {
+      git: /* @__PURE__ */ new Set([
+        "log",
+        "show",
+        "diff",
+        "status",
+        "blame",
+        "branch",
+        "tag",
+        "remote",
+        "describe",
+        "rev-parse",
+        "rev-list",
+        "ls-files",
+        "ls-tree",
+        "ls-remote",
+        "cat-file",
+        "shortlog",
+        "reflog",
+        "whatchanged",
+        "grep",
+        "config",
+        "check-ignore",
+        "merge-base",
+        "name-rev",
+        "count-objects",
+        "verify-commit"
+      ]),
+      // Package managers: only their query verbs.
+      npm: /* @__PURE__ */ new Set(["ls", "list", "view", "info", "outdated", "why", "config", "ping", "search"]),
+      pnpm: /* @__PURE__ */ new Set(["ls", "list", "view", "info", "outdated", "why", "config"]),
+      yarn: /* @__PURE__ */ new Set(["list", "info", "why", "config"]),
+      cargo: /* @__PURE__ */ new Set(["tree", "metadata", "search"]),
+      go: /* @__PURE__ */ new Set(["list", "version", "env", "vet", "doc"]),
+      docker: /* @__PURE__ */ new Set(["ps", "images", "logs", "inspect", "version", "info", "top", "port", "diff", "stats"]),
+      kubectl: /* @__PURE__ */ new Set(["get", "describe", "logs", "explain", "top", "version", "api-resources", "api-versions"]),
+      // gh: read verbs only. `gh run rerun`, `gh pr merge` etc. are excluded, and
+      // the nested-verb check in isReadOnlyCommand handles `gh pr view` vs `gh pr merge`.
+      gh: /* @__PURE__ */ new Set(["browse"])
+    };
+    var READ_ONLY_NESTED = {
+      gh: /* @__PURE__ */ new Set(["view", "list", "status", "diff", "checks"])
+    };
+    var SHELL_CONTROL = /[\n\r;&|`]|\$\(|>>|>|<\(/;
+    function firstWords(command) {
+      return command.trim().split(/\s+/).filter(Boolean);
+    }
+    function isReadOnlyCommand(command) {
+      const cmd = command.trim();
+      if (!cmd)
+        return false;
+      if (SHELL_CONTROL.test(cmd))
+        return false;
+      const words = firstWords(cmd);
+      if (!words.length)
+        return false;
+      let i2 = 0;
+      while (i2 < words.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[i2]))
+        i2++;
+      if (i2 >= words.length)
+        return false;
+      let verb = words[i2];
+      const slash = verb.lastIndexOf("/");
+      if (slash >= 0)
+        verb = verb.slice(slash + 1);
+      if (verb === "sudo" || verb === "doas" || verb === "su")
+        return false;
+      const rest = words.slice(i2 + 1).filter((w) => !w.startsWith("-"));
+      const subs = READ_ONLY_SUBCOMMANDS[verb];
+      if (subs) {
+        const sub = rest[0];
+        if (!sub) {
+          return true;
+        }
+        if (subs.has(sub)) {
+          if (verb === "git" && sub === "config") {
+            const args = words.slice(i2 + 2).filter((w) => !w.startsWith("-"));
+            return args.length <= 1;
+          }
+          return true;
+        }
+        const nested = READ_ONLY_NESTED[verb];
+        if (nested && rest[1] && nested.has(rest[1]))
+          return true;
+        return false;
+      }
+      if (!READ_ONLY_TOOLS.has(verb) && !READ_ONLY_BASH.has(verb))
+        return false;
+      if (verb === "node" || verb === "python" || verb === "python3") {
+        return words.slice(i2 + 1).every((w) => w === "--version" || w === "-V" || w === "-v");
+      }
+      if (verb === "find" && words.some((w) => w === "-exec" || w === "-execdir" || w === "-delete")) {
+        return false;
+      }
+      return true;
+    }
+    function checkPlanMode(tool, input) {
+      if (tool === "bash") {
+        const command = typeof input.command === "string" ? input.command : "";
+        if (input.run_in_background === true) {
+          return {
+            reason: "bash-not-read-only",
+            message: "Plan mode is ON: background processes cannot be started. Finish researching and propose your plan; the user will leave plan mode if they want it carried out."
+          };
+        }
+        if (isReadOnlyCommand(command))
+          return null;
+        return {
+          reason: "bash-not-read-only",
+          message: `Plan mode is ON, so \`bash\` is limited to provably read-only commands and this one was not recognised as such (chained commands, redirection and command substitution are always refused). Do NOT ask the user to approve it and do NOT try a variation to get around this \u2014 it is a session-wide lock, not a per-call prompt. Use read-only inspection instead, and put the command in your plan as a step to run once plan mode is off.`
+        };
+      }
+      if (READ_ONLY_TOOLS.has(tool))
+        return null;
+      return {
+        reason: "mutating-tool",
+        message: `Plan mode is ON, so \`${tool}\` is unavailable \u2014 this session may not modify anything yet. Do NOT ask for approval: no answer the user gives at this prompt can unlock it, because it is a session-wide lock they control directly. Research with read-only tools and finish by proposing a concrete plan (files to change, in order, and how to verify). The user will exit plan mode to let you carry it out.`
+      };
+    }
+    exports.PLAN_MODE_INSTRUCTIONS = [
+      "# PLAN MODE IS ACTIVE",
+      "",
+      "This session is READ-ONLY. You cannot edit files, write files, run mutating commands, or start",
+      "background processes. This is enforced outside your control \u2014 it is not a permission prompt, and",
+      "the user cannot approve an exception from inside this turn.",
+      "",
+      "Therefore:",
+      '- NEVER ask "shall I go ahead and make this change?" \u2014 you cannot, whatever the answer.',
+      '- NEVER attempt a mutating tool "just to see" \u2014 it will be refused and wastes the turn.',
+      "- NEVER try to reach a blocked command another way (a different flag, a script, an interpreter).",
+      "",
+      "Your job is to research thoroughly, then deliver a plan:",
+      "1. What you found \u2014 the specific files, functions and line numbers that matter.",
+      "2. What you propose to change \u2014 file by file, in dependency order.",
+      "3. Risks and unknowns \u2014 what could break, what you could not verify, what you assumed.",
+      "4. How it will be verified \u2014 the exact build/test/lint command that proves it works.",
+      "",
+      'Be concrete. "Update the auth logic" is not a plan; "add a `refreshToken` field to AuthConfig in',
+      'auth/index.ts:42, then thread it through client.ts:118" is. The user will review the plan and',
+      "leave plan mode to have it carried out."
+    ].join("\n");
+  }
+});
+
+// ../core/dist/agent/agentRegistry.js
+var require_agentRegistry = __commonJS({
+  "../core/dist/agent/agentRegistry.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports._limits = void 0;
+    exports.rememberAgent = rememberAgent;
+    exports.updateAgent = updateAgent;
+    exports.getAgent = getAgent;
+    exports.listAgents = listAgents;
+    exports._resetAgentRegistry = _resetAgentRegistry;
+    var MAX_AGENTS = 20;
+    var MAX_TOTAL_BYTES = 8 * 1024 * 1024;
+    var _agents = /* @__PURE__ */ new Map();
+    var _counter = 0;
+    var _seq = 0;
+    function totalBytes() {
+      let n = 0;
+      for (const a of _agents.values())
+        n += a.bytes;
+      return n;
+    }
+    function evictUntilWithinLimits() {
+      while (_agents.size > MAX_AGENTS) {
+        const oldest = _agents.keys().next().value;
+        if (oldest === void 0)
+          break;
+        _agents.delete(oldest);
+      }
+      while (totalBytes() > MAX_TOTAL_BYTES && _agents.size > 1) {
+        const oldest = _agents.keys().next().value;
+        if (oldest === void 0)
+          break;
+        _agents.delete(oldest);
+      }
+    }
+    function sizeOf(messages) {
+      try {
+        return JSON.stringify(messages).length;
+      } catch {
+        return MAX_TOTAL_BYTES;
+      }
+    }
+    function rememberAgent(agentName, description, messages) {
+      const id = `agent_${++_counter}`;
+      const now = Date.now();
+      _agents.set(id, {
+        id,
+        agentName,
+        description,
+        messages,
+        createdAt: now,
+        updatedAt: now,
+        seq: ++_seq,
+        bytes: sizeOf(messages)
+      });
+      evictUntilWithinLimits();
+      return id;
+    }
+    function updateAgent(id, messages) {
+      const existing = _agents.get(id);
+      if (!existing)
+        return;
+      existing.messages = messages;
+      existing.updatedAt = Date.now();
+      existing.seq = ++_seq;
+      existing.bytes = sizeOf(messages);
+      _agents.delete(id);
+      _agents.set(id, existing);
+      evictUntilWithinLimits();
+    }
+    function getAgent(id) {
+      return _agents.get(id);
+    }
+    function listAgents() {
+      return [..._agents.values()].sort((a, b) => b.seq - a.seq);
+    }
+    function _resetAgentRegistry() {
+      _agents.clear();
+      _counter = 0;
+      _seq = 0;
+    }
+    exports._limits = { MAX_AGENTS, MAX_TOTAL_BYTES };
+  }
+});
+
 // ../core/dist/agent/flaky.js
 var require_flaky = __commonJS({
   "../core/dist/agent/flaky.js"(exports) {
@@ -15436,6 +15783,8 @@ var require_loop = __commonJS({
     var agentTypes_1 = require_agentTypes();
     var skills_1 = require_skills();
     var rules_1 = require_rules();
+    var planMode_1 = require_planMode();
+    var agentRegistry_1 = require_agentRegistry();
     var sandbox_1 = require_sandbox();
     var index_1 = require_plugins();
     var testIntegrity_1 = require_testIntegrity();
@@ -15756,7 +16105,22 @@ ${tail}`;
       if (depth >= MAX_TASK_DEPTH) {
         return { error: "Sub-agents cannot spawn further sub-agents. Do this work directly, or report back so the main agent can delegate it." };
       }
-      const requestedType = typeof input.subagent_type === "string" ? input.subagent_type : "";
+      const resumeId = typeof input.resume_agent_id === "string" ? input.resume_agent_id.trim() : "";
+      const resumed = resumeId ? (0, agentRegistry_1.getAgent)(resumeId) : void 0;
+      if (resumeId && !resumed) {
+        return {
+          error: `No resumable sub-agent with id "${resumeId}". Ids live only for the current session and the oldest are dropped when too many accumulate, so this one has expired or never existed. Start a fresh sub-task with a self-contained prompt instead.`
+        };
+      }
+      const requestedType = resumed ? resumed.agentName ?? "" : typeof input.subagent_type === "string" ? input.subagent_type : "";
+      if (requestedType) {
+        const decision = (0, rules_1.evaluatePermission)((0, rules_1.loadSettings)(options.workDir).permissions, "task", { subagent_type: requestedType }, options.workDir);
+        if (decision === "deny") {
+          return {
+            error: `The sub-agent "${requestedType}" is disabled by a permission rule in this project (permissions.deny in settings.json). This is a deliberate policy choice, not a missing file \u2014 do not create it and do not retry. Do the work yourself, or use a different sub-agent.`
+          };
+        }
+      }
       let agent = (0, agentTypes_1.findAgentType)(agentTypes, requestedType);
       let knownTypes = agentTypes;
       if (requestedType && !agent) {
@@ -15786,9 +16150,7 @@ ${options.nexrallMd}` : "") : options.nexrallMd;
         }
         return options.requestPermission(req);
       };
-      const subMessages = [
-        { role: "user", content: [{ type: "text", text: prompt2 }] }
-      ];
+      const subMessages = resumed ? [...resumed.messages, { role: "user", content: [{ type: "text", text: prompt2 }] }] : [{ role: "user", content: [{ type: "text", text: prompt2 }] }];
       const subAbort = { aborted: false };
       const timer = setTimeout(() => {
         subAbort.aborted = true;
@@ -15806,6 +16168,9 @@ ${options.nexrallMd}` : "") : options.nexrallMd;
           editorContext: null,
           // fresh isolated context for sub-agent
           model: agent?.model ?? options.model,
+          // Plan mode is inherited, never relaxed. If the main agent could spawn a
+          // sub-agent that writes, the lock would be one `task` call from useless.
+          planMode: options.planMode,
           nexrallMd: subNexrallMd,
           abortSignal: subAbort,
           requestPermission: gatedPermission,
@@ -15854,7 +16219,13 @@ ${partial}` : "",
           return { error: sections.join("\n\n") };
         }
         const text = capSubTaskText(extractSubTaskText(result, true));
-        return { output: text || "(sub-task completed with no text output)" };
+        const agentId = resumed ? ((0, agentRegistry_1.updateAgent)(resumed.id, result), resumed.id) : (0, agentRegistry_1.rememberAgent)(agent?.name ?? null, typeof input.description === "string" && input.description.trim() || prompt2.slice(0, 80), result);
+        const body = text || "(sub-task completed with no text output)";
+        return {
+          output: `${body}
+
+[resumable: this sub-agent is "${agentId}". To ask IT a follow-up \u2014 keeping everything it already read and concluded \u2014 call task again with resume_agent_id="` + agentId + '" instead of writing a new prompt from scratch.]'
+        };
       } catch (err) {
         const salvaged = (0, types_1.salvageHistory)(err);
         if (salvaged) {
@@ -16236,10 +16607,15 @@ Continue the work from here.` }] });
       const hooks = loadHooks(options.workDir);
       const depth = options._depth ?? 0;
       const agentScope = options._agentScope ?? "root";
-      const agentTypes = (0, agentTypes_1.loadAgentTypes)(options.workDir);
+      const settings = (0, rules_1.loadSettings)(options.workDir);
+      const agentTypes = (0, agentTypes_1.loadAgentTypes)(options.workDir).filter((t2) => (0, rules_1.evaluatePermission)(settings.permissions, "task", { subagent_type: t2.name }, options.workDir) !== "deny");
       const agentsCatalogue = depth === 0 ? (0, agentTypes_1.summariseAgents)(agentTypes) : "";
       const skillsCatalogue = (0, skills_1.summariseSkills)((0, skills_1.loadSkills)(options.workDir));
-      const settings = (0, rules_1.loadSettings)(options.workDir);
+      const planAwareNexrallMd = options.planMode ? planMode_1.PLAN_MODE_INSTRUCTIONS + (options.nexrallMd ? `
+
+---
+
+${options.nexrallMd}` : "") : options.nexrallMd;
       const sandboxCfg = (0, sandbox_1.parseSandboxConfig)(settings.raw.sandbox) ?? void 0;
       const maxIterations = resolveMaxIterations(options.maxIterations, settings.raw);
       const autoContinue = resolveAutoContinue(options.autoContinue, settings.raw);
@@ -16347,7 +16723,7 @@ Continue the work from here.` }] });
               effort: options.effort,
               env: options.env,
               editorContext: options.editorContext,
-              nexrallMd: options.nexrallMd,
+              nexrallMd: planAwareNexrallMd,
               clientType: options.clientType,
               abortSignal: options.abortSignal,
               extraTools: options.mcpManager?.getAnthropicTools(),
@@ -16467,6 +16843,14 @@ Continue the work from here.` }] });
               options.onToolResult(name, result);
               return { block: { ...block, id }, result };
             }
+            if (options.planMode) {
+              const refusal = (0, planMode_1.checkPlanMode)(name, input);
+              if (refusal) {
+                result = { error: refusal.message };
+                options.onToolResult(name, result);
+                return { block: { ...block, id }, result };
+              }
+            }
             const description = humanDescription(name, input);
             let permitted;
             let deniedReason = null;
@@ -18482,6 +18866,8 @@ var require_dist2 = __commonJS({
     __exportStar(require_manager2(), exports);
     __exportStar(require_loader(), exports);
     __exportStar(require_agentTypes(), exports);
+    __exportStar(require_planMode(), exports);
+    __exportStar(require_agentRegistry(), exports);
     __exportStar(require_rules(), exports);
     __exportStar(require_destructive(), exports);
     __exportStar(require_plugins(), exports);
@@ -63558,7 +63944,7 @@ var InkReadlineAdapter = class extends EventEmitter3 {
 };
 
 // src/commands/chat.ts
-var CLI_VERSION = "0.5.50";
+var CLI_VERSION = "0.5.51";
 var MODEL_LABELS = {
   turbo: "Nexrall Turbo",
   pro: "Nexrall Pro",
@@ -63829,6 +64215,12 @@ async function runTurn(messages, modelAlias, workDir, abortSignal, env3, nexrall
     env: env3,
     nexrallMd,
     mode,
+    // `/mode plan` previously only hinted to the backend — the footer said "plan
+    // mode on" while every write tool stayed live, so the one mode whose entire
+    // promise is "I will not touch anything" was the one not enforced. This
+    // makes it real: the loop refuses mutating tools before the permission
+    // prompt, and sub-agents inherit the lock.
+    planMode: mode === "plan",
     effort,
     // The backend streams a cumulative output-token count (routes/code.js's
     // sendProgress, throttled to ≤5/s) covering thinking, visible text AND
@@ -63982,6 +64374,7 @@ async function runTurnHeadless(messages, modelAlias, workDir, _abortSignal, env3
     env: env3,
     nexrallMd,
     mode,
+    planMode: mode === "plan",
     effort,
     abortSignal: _abortSignal,
     onText: (text) => {
@@ -65218,7 +65611,7 @@ function pluginSourceRemoveCommand(name, opts) {
 
 // src/index.ts
 var program2 = new Command();
-program2.name("nex").description("Nexrall Code \u2014 AI coding assistant (powered by Nexrall)").version("0.5.50").enablePositionalOptions();
+program2.name("nex").description("Nexrall Code \u2014 AI coding assistant (powered by Nexrall)").version("0.5.51").enablePositionalOptions();
 program2.command("auth").description("Login to your Nexrall account").action(authCommand);
 program2.command("logout").description("Log out of your Nexrall account").action(logoutCommand);
 program2.command("update").description("Update nex to the latest version").option("-c, --check", "Check for updates without installing").option("-y, --yes", "Skip confirmation prompt").action(async (opts) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexrall-code",
-  "version": "0.5.50",
+  "version": "0.5.51",
   "description": "Nexrall Code — AI coding assistant for your terminal (headless agent for scripts, CI and automation)",
   "keywords": [
     "ai",
@@ -41,7 +41,7 @@
     "react": "^19.2.8",
     "readline": "^1.3.0",
     "string-width": "^7.2.0",
-    "@nexrall/code-core": "1.4.25"
+    "@nexrall/code-core": "1.4.26"
   },
   "devDependencies": {
     "@aws-sdk/client-s3": "^3.600.0",