nexrall-code 0.5.50 → 0.5.52

package/dist/index.js

@@ -10234,248 +10234,254 @@ var require_client = __commonJS({
         };
         const haveCompleteMessage = () => completedMessage !== null;
         const partialInputs = {};
-        await new Promise((resolve3, reject) => {
-          const stream = response.body;
-          const HEARTBEAT_TIMEOUT_MS = 9e4;
-          const FIRST_EVENT_TIMEOUT_MS = Number(process.env.NEXRALL_FIRST_EVENT_TIMEOUT_MS) || 3e5;
-          const PROGRESS_TIMEOUT_MS = Number(process.env.NEXRALL_PROGRESS_TIMEOUT_MS) || 15e4;
-          let sawModelEvent = false;
-          let lastDataAt = Date.now();
-          let lastProgressAt = Date.now();
-          const heartbeatWatchdog = setInterval(() => {
-            const now = Date.now();
-            if (haveCompleteMessage() && now - lastDataAt > HEARTBEAT_TIMEOUT_MS) {
-              clearInterval(heartbeatWatchdog);
-              stream.destroy?.();
-              resolve3();
-              return;
-            }
-            if (now - lastDataAt > HEARTBEAT_TIMEOUT_MS) {
-              clearInterval(heartbeatWatchdog);
-              stream.destroy?.();
-              const recoverable = !emittedToCaller || !!allowRestartAfterRender;
-              const secs = Math.round(HEARTBEAT_TIMEOUT_MS / 1e3);
-              reject(tagTransient(new Error(recoverable ? `Connection lost \u2014 no data received for ${secs} s. Reconnecting\u2026` : `Connection lost \u2014 no data received for ${secs} s. Retry your message.`)));
-              return;
-            }
-            const stallLimitMs = sawModelEvent ? PROGRESS_TIMEOUT_MS : FIRST_EVENT_TIMEOUT_MS;
-            if (now - lastProgressAt > stallLimitMs) {
-              clearInterval(heartbeatWatchdog);
-              stream.destroy?.();
-              if (haveCompleteMessage()) {
+        let heartbeatWatchdog;
+        try {
+          await new Promise((resolve3, reject) => {
+            const stream = response.body;
+            const HEARTBEAT_TIMEOUT_MS = 9e4;
+            const FIRST_EVENT_TIMEOUT_MS = Number(process.env.NEXRALL_FIRST_EVENT_TIMEOUT_MS) || 3e5;
+            const PROGRESS_TIMEOUT_MS = Number(process.env.NEXRALL_PROGRESS_TIMEOUT_MS) || 15e4;
+            let sawModelEvent = false;
+            let lastDataAt = Date.now();
+            let lastProgressAt = Date.now();
+            heartbeatWatchdog = setInterval(() => {
+              const now = Date.now();
+              if (haveCompleteMessage() && now - lastDataAt > HEARTBEAT_TIMEOUT_MS) {
+                clearInterval(heartbeatWatchdog);
+                stream.destroy?.();
                 resolve3();
                 return;
               }
-              reject(tagTransient(new Error(sawModelEvent ? `The model stopped responding mid-stream (no output for ${Math.round(stallLimitMs / 1e3)} s).` : `The model did not start responding within ${Math.round(stallLimitMs / 1e3)} s (large context can take a while to process).`)));
-              return;
-            }
-          }, 5e3);
-          const parser = (0, eventsource_parser_1.createParser)((event) => {
-            lastDataAt = Date.now();
-            if (event.type !== "event") {
-              return;
-            }
-            {
-              const frameId = event.id;
-              if (frameId) {
-                const n = Number(frameId);
-                if (Number.isFinite(n) && n > lastEventId)
-                  lastEventId = n;
-              }
-              const raw = event.data;
-              if (!raw || raw === "[DONE]") {
-                resolve3();
+              if (now - lastDataAt > HEARTBEAT_TIMEOUT_MS) {
+                clearInterval(heartbeatWatchdog);
+                stream.destroy?.();
+                const recoverable = !emittedToCaller || !!allowRestartAfterRender;
+                const secs = Math.round(HEARTBEAT_TIMEOUT_MS / 1e3);
+                reject(tagTransient(new Error(recoverable ? `Connection lost \u2014 no data received for ${secs} s. Reconnecting\u2026` : `Connection lost \u2014 no data received for ${secs} s. Retry your message.`)));
                 return;
               }
-              let parsed;
-              try {
-                parsed = JSON.parse(raw);
-              } catch {
+              const stallLimitMs = sawModelEvent ? PROGRESS_TIMEOUT_MS : FIRST_EVENT_TIMEOUT_MS;
+              if (now - lastProgressAt > stallLimitMs) {
+                clearInterval(heartbeatWatchdog);
+                stream.destroy?.();
+                if (haveCompleteMessage()) {
+                  resolve3();
+                  return;
+                }
+                reject(tagTransient(new Error(sawModelEvent ? `The model stopped responding mid-stream (no output for ${Math.round(stallLimitMs / 1e3)} s).` : `The model did not start responding within ${Math.round(stallLimitMs / 1e3)} s (large context can take a while to process).`)));
                 return;
               }
-              if (typeof parsed !== "object" || parsed === null || !("type" in parsed)) {
+            }, 5e3);
+            const parser = (0, eventsource_parser_1.createParser)((event) => {
+              lastDataAt = Date.now();
+              if (event.type !== "event") {
                 return;
               }
-              const evt = parsed;
-              lastProgressAt = Date.now();
-              sawModelEvent = true;
-              clearRetryIfNeeded();
-              switch (evt.type) {
-                case "text": {
-                  const text = typeof evt.text === "string" ? evt.text : "";
-                  textParts.push(text);
-                  emittedToCaller = true;
-                  emittedChars += text.length;
-                  emittedAnythingAcrossAttempts = true;
-                  emittedCharsAcrossAttempts += text.length;
-                  onEvent({ type: "text", text });
-                  break;
+              {
+                const frameId = event.id;
+                if (frameId) {
+                  const n = Number(frameId);
+                  if (Number.isFinite(n) && n > lastEventId)
+                    lastEventId = n;
                 }
-                case "tool_use": {
-                  const block = {
-                    type: "tool_use",
-                    id: typeof evt.id === "string" ? evt.id : "",
-                    name: typeof evt.name === "string" ? evt.name : "",
-                    input: evt.input ?? {}
-                  };
-                  if (typeof evt.input_json_delta === "string") {
-                    partialInputs[block.id] = (partialInputs[block.id] ?? "") + evt.input_json_delta;
-                    try {
-                      block.input = JSON.parse(partialInputs[block.id]);
-                    } catch {
-                      return;
-                    }
-                  }
-                  toolUseBlocks.push(block);
-                  emittedToCaller = true;
-                  emittedAnythingAcrossAttempts = true;
-                  onEvent({ type: "tool_use", id: block.id, name: block.name, input: block.input });
-                  break;
-                }
-                case "message_complete": {
-                  const nestedMessage = evt.message;
-                  const stopReason = typeof nestedMessage?.stop_reason === "string" ? nestedMessage.stop_reason : null;
-                  const contentBlocks2 = [];
-                  const fullText2 = textParts.join("");
-                  if (fullText2) {
-                    contentBlocks2.push({ type: "text", text: fullText2 });
-                  }
-                  contentBlocks2.push(...toolUseBlocks);
-                  const rawContent = Array.isArray(nestedMessage?.content) ? nestedMessage.content : null;
-                  const finalContent = chooseFinalContent(contentBlocks2, rawContent);
-                  completedMessage = {
-                    role: "assistant",
-                    content: finalContent,
-                    stopReason
-                  };
-                  onEvent({ type: "message_complete", message: completedMessage });
-                  break;
+                const raw = event.data;
+                if (!raw || raw === "[DONE]") {
+                  resolve3();
+                  return;
                 }
-                case "usage": {
-                  if (typeof evt.input_tokens === "number" && typeof evt.output_tokens === "number") {
-                    onEvent({
-                      type: "usage",
-                      // Forwarded, not dropped: the backend tags the usage of an attempt it
-                      // billed but never completed (its stream `abort` path). Without this
-                      // the flag dies here and every consumer that sums usage silently folds
-                      // a discarded attempt's tokens into the successful turn's total.
-                      ...evt.partial === true ? { partial: true } : {},
-                      // `replayed` means these tokens are being reported a SECOND time: the
-                      // turn completed and was billed on an earlier attempt whose `done` never
-                      // reached us, and the backend served this one from its idempotency cache
-                      // instead of re-running the model. Nothing new was charged, so a cost
-                      // display must not add them again.
-                      ...evt.replayed === true ? { replayed: true } : {},
-                      usage: {
-                        input_tokens: evt.input_tokens,
-                        output_tokens: evt.output_tokens,
-                        cache_creation_input_tokens: typeof evt.cache_creation_input_tokens === "number" ? evt.cache_creation_input_tokens : void 0,
-                        cache_read_input_tokens: typeof evt.cache_read_input_tokens === "number" ? evt.cache_read_input_tokens : void 0
-                      }
-                    });
-                  }
-                  break;
+                let parsed;
+                try {
+                  parsed = JSON.parse(raw);
+                } catch {
+                  return;
                 }
-                case "context_warning": {
-                  break;
+                if (typeof parsed !== "object" || parsed === null || !("type" in parsed)) {
+                  return;
                 }
-                case "thinking": {
-                  const text = typeof evt.text === "string" ? evt.text : "";
-                  if (text) {
+                const evt = parsed;
+                lastProgressAt = Date.now();
+                sawModelEvent = true;
+                clearRetryIfNeeded();
+                switch (evt.type) {
+                  case "text": {
+                    const text = typeof evt.text === "string" ? evt.text : "";
+                    textParts.push(text);
                     emittedToCaller = true;
                     emittedChars += text.length;
                     emittedAnythingAcrossAttempts = true;
                     emittedCharsAcrossAttempts += text.length;
-                    onEvent({ type: "thinking", text });
+                    onEvent({ type: "text", text });
+                    break;
                   }
-                  break;
-                }
-                case "thinking_progress": {
-                  const tokens = typeof evt.tokens === "number" ? evt.tokens : 0;
-                  onEvent({ type: "thinking_progress", tokens });
-                  break;
-                }
-                case "thinking_delta": {
-                  const text = typeof evt.text === "string" ? evt.text : "";
-                  if (text) {
+                  case "tool_use": {
+                    const block = {
+                      type: "tool_use",
+                      id: typeof evt.id === "string" ? evt.id : "",
+                      name: typeof evt.name === "string" ? evt.name : "",
+                      input: evt.input ?? {}
+                    };
+                    if (typeof evt.input_json_delta === "string") {
+                      partialInputs[block.id] = (partialInputs[block.id] ?? "") + evt.input_json_delta;
+                      try {
+                        block.input = JSON.parse(partialInputs[block.id]);
+                      } catch {
+                        return;
+                      }
+                    }
+                    toolUseBlocks.push(block);
                     emittedToCaller = true;
-                    emittedChars += text.length;
                     emittedAnythingAcrossAttempts = true;
-                    emittedCharsAcrossAttempts += text.length;
-                    onEvent({ type: "thinking_delta", text });
+                    onEvent({ type: "tool_use", id: block.id, name: block.name, input: block.input });
+                    break;
                   }
-                  break;
-                }
-                case "resumable": {
-                  serverResumable = true;
-                  break;
-                }
-                case "balance_status": {
-                  const balance = typeof evt.balance === "number" ? evt.balance : 0;
-                  const zero = !!evt.zero;
-                  onEvent({ type: "balance_status", balance, zero });
-                  break;
-                }
-                case "done": {
-                  onEvent({ type: "done" });
-                  resolve3();
-                  break;
-                }
-                case "error": {
-                  const message = typeof evt.message === "string" ? evt.message : typeof evt.error === "string" ? evt.error : "Unknown SSE error";
-                  const notResumable = evt.notResumable === true;
-                  if (haveCompleteMessage()) {
-                    clearInterval(heartbeatWatchdog);
-                    onEvent({ type: "error", message });
+                  case "message_complete": {
+                    const nestedMessage = evt.message;
+                    const stopReason = typeof nestedMessage?.stop_reason === "string" ? nestedMessage.stop_reason : null;
+                    const contentBlocks2 = [];
+                    const fullText2 = textParts.join("");
+                    if (fullText2) {
+                      contentBlocks2.push({ type: "text", text: fullText2 });
+                    }
+                    contentBlocks2.push(...toolUseBlocks);
+                    const rawContent = Array.isArray(nestedMessage?.content) ? nestedMessage.content : null;
+                    const finalContent = chooseFinalContent(contentBlocks2, rawContent);
+                    completedMessage = {
+                      role: "assistant",
+                      content: finalContent,
+                      stopReason
+                    };
+                    onEvent({ type: "message_complete", message: completedMessage });
+                    break;
+                  }
+                  case "usage": {
+                    if (typeof evt.input_tokens === "number" && typeof evt.output_tokens === "number") {
+                      onEvent({
+                        type: "usage",
+                        // Forwarded, not dropped: the backend tags the usage of an attempt it
+                        // billed but never completed (its stream `abort` path). Without this
+                        // the flag dies here and every consumer that sums usage silently folds
+                        // a discarded attempt's tokens into the successful turn's total.
+                        ...evt.partial === true ? { partial: true } : {},
+                        // `replayed` means these tokens are being reported a SECOND time: the
+                        // turn completed and was billed on an earlier attempt whose `done` never
+                        // reached us, and the backend served this one from its idempotency cache
+                        // instead of re-running the model. Nothing new was charged, so a cost
+                        // display must not add them again.
+                        ...evt.replayed === true ? { replayed: true } : {},
+                        usage: {
+                          input_tokens: evt.input_tokens,
+                          output_tokens: evt.output_tokens,
+                          cache_creation_input_tokens: typeof evt.cache_creation_input_tokens === "number" ? evt.cache_creation_input_tokens : void 0,
+                          cache_read_input_tokens: typeof evt.cache_read_input_tokens === "number" ? evt.cache_read_input_tokens : void 0
+                        }
+                      });
+                    }
+                    break;
+                  }
+                  case "context_warning": {
+                    break;
+                  }
+                  case "thinking": {
+                    const text = typeof evt.text === "string" ? evt.text : "";
+                    if (text) {
+                      emittedToCaller = true;
+                      emittedChars += text.length;
+                      emittedAnythingAcrossAttempts = true;
+                      emittedCharsAcrossAttempts += text.length;
+                      onEvent({ type: "thinking", text });
+                    }
+                    break;
+                  }
+                  case "thinking_progress": {
+                    const tokens = typeof evt.tokens === "number" ? evt.tokens : 0;
+                    onEvent({ type: "thinking_progress", tokens });
+                    break;
+                  }
+                  case "thinking_delta": {
+                    const text = typeof evt.text === "string" ? evt.text : "";
+                    if (text) {
+                      emittedToCaller = true;
+                      emittedChars += text.length;
+                      emittedAnythingAcrossAttempts = true;
+                      emittedCharsAcrossAttempts += text.length;
+                      onEvent({ type: "thinking_delta", text });
+                    }
+                    break;
+                  }
+                  case "resumable": {
+                    serverResumable = true;
+                    break;
+                  }
+                  case "balance_status": {
+                    const balance = typeof evt.balance === "number" ? evt.balance : 0;
+                    const zero = !!evt.zero;
+                    onEvent({ type: "balance_status", balance, zero });
+                    break;
+                  }
+                  case "done": {
+                    onEvent({ type: "done" });
                     resolve3();
-                  } else if (notResumable && (!emittedToCaller || allowRestartAfterRender)) {
-                    clearInterval(heartbeatWatchdog);
-                    stream.destroy?.();
-                    reject(Object.assign(tagTransient(new Error(message)), { forceRestart: true }));
-                  } else if (isRetryableStreamMsg(message) && (!emittedToCaller || allowRestartAfterRender)) {
-                    clearInterval(heartbeatWatchdog);
-                    stream.destroy?.();
-                    reject(tagTransient(new Error(message)));
-                  } else {
-                    clearInterval(heartbeatWatchdog);
-                    stream.destroy?.();
-                    onEvent({ type: "error", message });
-                    reject(new Error(message));
+                    break;
+                  }
+                  case "error": {
+                    const message = typeof evt.message === "string" ? evt.message : typeof evt.error === "string" ? evt.error : "Unknown SSE error";
+                    const notResumable = evt.notResumable === true;
+                    if (haveCompleteMessage()) {
+                      clearInterval(heartbeatWatchdog);
+                      onEvent({ type: "error", message });
+                      resolve3();
+                    } else if (notResumable && (!emittedToCaller || allowRestartAfterRender)) {
+                      clearInterval(heartbeatWatchdog);
+                      stream.destroy?.();
+                      reject(Object.assign(tagTransient(new Error(message)), { forceRestart: true }));
+                    } else if (isRetryableStreamMsg(message) && (!emittedToCaller || allowRestartAfterRender)) {
+                      clearInterval(heartbeatWatchdog);
+                      stream.destroy?.();
+                      reject(tagTransient(new Error(message)));
+                    } else {
+                      clearInterval(heartbeatWatchdog);
+                      stream.destroy?.();
+                      onEvent({ type: "error", message });
+                      reject(new Error(message));
+                    }
+                    break;
                   }
-                  break;
                 }
               }
-            }
-          });
-          stream.on("data", (chunk) => {
-            lastDataAt = Date.now();
-            if (abortSignal?.aborted) {
-              stream.destroy?.();
-              return;
-            }
-            parser.feed(chunk.toString("utf-8"));
-          });
-          stream.on("end", () => {
-            clearInterval(heartbeatWatchdog);
-            if (!sawModelEvent && !completedMessage) {
-              reject(Object.assign(new Error("Connection closed before the model responded. Retrying\u2026"), { retryable: true }));
-              return;
-            }
-            resolve3();
-          });
-          stream.on("error", (err) => {
-            clearInterval(heartbeatWatchdog);
-            if (abortSignal?.aborted || controller.signal.aborted) {
-              resolve3();
-              return;
-            }
-            if (haveCompleteMessage()) {
+            });
+            stream.on("data", (chunk) => {
+              lastDataAt = Date.now();
+              if (abortSignal?.aborted) {
+                stream.destroy?.();
+                return;
+              }
+              parser.feed(chunk.toString("utf-8"));
+            });
+            stream.on("end", () => {
+              clearInterval(heartbeatWatchdog);
+              if (!sawModelEvent && !completedMessage) {
+                reject(Object.assign(new Error("Connection closed before the model responded. Retrying\u2026"), { retryable: true }));
+                return;
+              }
               resolve3();
-              return;
-            }
-            reject(tagTransient(err));
+            });
+            stream.on("error", (err) => {
+              clearInterval(heartbeatWatchdog);
+              if (abortSignal?.aborted || controller.signal.aborted) {
+                resolve3();
+                return;
+              }
+              if (haveCompleteMessage()) {
+                resolve3();
+                return;
+              }
+              reject(tagTransient(err));
+            });
           });
-        });
+        } finally {
+          if (heartbeatWatchdog !== void 0)
+            clearInterval(heartbeatWatchdog);
+        }
         if (completedMessage) {
           return completedMessage;
         }
@@ -15192,6 +15198,9 @@ var require_rules = __commonJS({
         case "stock_photo":
           vals.push(str(input.path));
           break;
+        case "task":
+          vals.push(str(input.subagent_type));
+          break;
         default:
           pushPath(str(input.path));
           break;
@@ -15232,6 +15241,350 @@ var require_rules = __commonJS({
   }
 });
 
+// ../core/dist/agent/planMode.js
+var require_planMode = __commonJS({
+  "../core/dist/agent/planMode.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.PLAN_MODE_INSTRUCTIONS = void 0;
+    exports.isReadOnlyCommand = isReadOnlyCommand;
+    exports.checkPlanMode = checkPlanMode;
+    var READ_ONLY_TOOLS = /* @__PURE__ */ new Set([
+      "read_file",
+      "search_files",
+      "glob",
+      "list_directory",
+      "notebook_read",
+      // Planning bookkeeping. todo_write persists only to the session's own todo
+      // list, not the repo, so it stays available — a plan mode that cannot draft
+      // a checklist is missing the point of plan mode.
+      "todo_write",
+      "todo_read",
+      // Reading memory is fine; memory_write is NOT here on purpose. Memory is
+      // durable state that survives the session, so writing it is a real mutation
+      // even though no file in the repo changes.
+      "memory_read",
+      "use_skill",
+      "fetch_url",
+      "web_search",
+      // Delegating research is ALLOWED, and this is safe rather than a hole:
+      // runSubTask passes planMode down, so the sub-agent is under the same lock and
+      // its own write tools are refused by this very function one level deeper.
+      //
+      // Worth allowing rather than blanket-refusing, because plan mode exists to
+      // support deep research and the explorer agent is the cheapest way to do bulk
+      // searching without flooding the main context. Blocking `task` would have made
+      // the mode's headline use case worse, for no security gain.
+      "task",
+      // VS Code language server — all pure queries.
+      "get_symbols",
+      "get_workspace_symbols",
+      "find_references",
+      "go_to_definition",
+      "get_hover",
+      "get_diagnostics",
+      // Reading output from an ALREADY-running background shell. Starting one is
+      // gated with the rest of bash below; draining a buffer is not a new effect.
+      "bash_output"
+    ]);
+    var READ_ONLY_BASH = /* @__PURE__ */ new Set([
+      "ls",
+      "cat",
+      "head",
+      "tail",
+      "wc",
+      "file",
+      "stat",
+      "du",
+      "df",
+      "pwd",
+      "which",
+      "type",
+      "echo",
+      "printf",
+      "basename",
+      "dirname",
+      "realpath",
+      "readlink",
+      "grep",
+      "egrep",
+      "fgrep",
+      "rg",
+      "ag",
+      "ack",
+      "find",
+      "fd",
+      "locate",
+      "diff",
+      "comm",
+      "cmp",
+      "sort",
+      "uniq",
+      "cut",
+      "tr",
+      "column",
+      "jq",
+      "yq",
+      "date",
+      "whoami",
+      "hostname",
+      "uname",
+      "env",
+      "printenv",
+      "id",
+      "groups",
+      "ps",
+      "top",
+      "uptime",
+      "free",
+      "node",
+      "python",
+      "python3",
+      "tree",
+      "less",
+      "more",
+      "nl",
+      "tac",
+      "strings",
+      "md5sum",
+      "sha256sum",
+      "true",
+      "false",
+      "test",
+      "sleep",
+      "seq",
+      "expr"
+    ]);
+    var READ_ONLY_SUBCOMMANDS = {
+      git: /* @__PURE__ */ new Set([
+        "log",
+        "show",
+        "diff",
+        "status",
+        "blame",
+        "branch",
+        "tag",
+        "remote",
+        "describe",
+        "rev-parse",
+        "rev-list",
+        "ls-files",
+        "ls-tree",
+        "ls-remote",
+        "cat-file",
+        "shortlog",
+        "reflog",
+        "whatchanged",
+        "grep",
+        "config",
+        "check-ignore",
+        "merge-base",
+        "name-rev",
+        "count-objects",
+        "verify-commit"
+      ]),
+      // Package managers: only their query verbs.
+      npm: /* @__PURE__ */ new Set(["ls", "list", "view", "info", "outdated", "why", "config", "ping", "search"]),
+      pnpm: /* @__PURE__ */ new Set(["ls", "list", "view", "info", "outdated", "why", "config"]),
+      yarn: /* @__PURE__ */ new Set(["list", "info", "why", "config"]),
+      cargo: /* @__PURE__ */ new Set(["tree", "metadata", "search"]),
+      go: /* @__PURE__ */ new Set(["list", "version", "env", "vet", "doc"]),
+      docker: /* @__PURE__ */ new Set(["ps", "images", "logs", "inspect", "version", "info", "top", "port", "diff", "stats"]),
+      kubectl: /* @__PURE__ */ new Set(["get", "describe", "logs", "explain", "top", "version", "api-resources", "api-versions"]),
+      // gh: read verbs only. `gh run rerun`, `gh pr merge` etc. are excluded, and
+      // the nested-verb check in isReadOnlyCommand handles `gh pr view` vs `gh pr merge`.
+      gh: /* @__PURE__ */ new Set(["browse"])
+    };
+    var READ_ONLY_NESTED = {
+      gh: /* @__PURE__ */ new Set(["view", "list", "status", "diff", "checks"])
+    };
+    var SHELL_CONTROL = /[\n\r;&|`]|\$\(|>>|>|<\(/;
+    function firstWords(command) {
+      return command.trim().split(/\s+/).filter(Boolean);
+    }
+    function isReadOnlyCommand(command) {
+      const cmd = command.trim();
+      if (!cmd)
+        return false;
+      if (SHELL_CONTROL.test(cmd))
+        return false;
+      const words = firstWords(cmd);
+      if (!words.length)
+        return false;
+      let i2 = 0;
+      while (i2 < words.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[i2]))
+        i2++;
+      if (i2 >= words.length)
+        return false;
+      let verb = words[i2];
+      const slash = verb.lastIndexOf("/");
+      if (slash >= 0)
+        verb = verb.slice(slash + 1);
+      if (verb === "sudo" || verb === "doas" || verb === "su")
+        return false;
+      const rest = words.slice(i2 + 1).filter((w) => !w.startsWith("-"));
+      const subs = READ_ONLY_SUBCOMMANDS[verb];
+      if (subs) {
+        const sub = rest[0];
+        if (!sub) {
+          return true;
+        }
+        if (subs.has(sub)) {
+          if (verb === "git" && sub === "config") {
+            const args = words.slice(i2 + 2).filter((w) => !w.startsWith("-"));
+            return args.length <= 1;
+          }
+          return true;
+        }
+        const nested = READ_ONLY_NESTED[verb];
+        if (nested && rest[1] && nested.has(rest[1]))
+          return true;
+        return false;
+      }
+      if (!READ_ONLY_TOOLS.has(verb) && !READ_ONLY_BASH.has(verb))
+        return false;
+      if (verb === "node" || verb === "python" || verb === "python3") {
+        return words.slice(i2 + 1).every((w) => w === "--version" || w === "-V" || w === "-v");
+      }
+      if (verb === "find" && words.some((w) => w === "-exec" || w === "-execdir" || w === "-delete")) {
+        return false;
+      }
+      return true;
+    }
+    function checkPlanMode(tool, input) {
+      if (tool === "bash") {
+        const command = typeof input.command === "string" ? input.command : "";
+        if (input.run_in_background === true) {
+          return {
+            reason: "bash-not-read-only",
+            message: "Plan mode is ON: background processes cannot be started. Finish researching and propose your plan; the user will leave plan mode if they want it carried out."
+          };
+        }
+        if (isReadOnlyCommand(command))
+          return null;
+        return {
+          reason: "bash-not-read-only",
+          message: `Plan mode is ON, so \`bash\` is limited to provably read-only commands and this one was not recognised as such (chained commands, redirection and command substitution are always refused). Do NOT ask the user to approve it and do NOT try a variation to get around this \u2014 it is a session-wide lock, not a per-call prompt. Use read-only inspection instead, and put the command in your plan as a step to run once plan mode is off.`
+        };
+      }
+      if (READ_ONLY_TOOLS.has(tool))
+        return null;
+      return {
+        reason: "mutating-tool",
+        message: `Plan mode is ON, so \`${tool}\` is unavailable \u2014 this session may not modify anything yet. Do NOT ask for approval: no answer the user gives at this prompt can unlock it, because it is a session-wide lock they control directly. Research with read-only tools and finish by proposing a concrete plan (files to change, in order, and how to verify). The user will exit plan mode to let you carry it out.`
+      };
+    }
+    exports.PLAN_MODE_INSTRUCTIONS = [
+      "# PLAN MODE IS ACTIVE",
+      "",
+      "This session is READ-ONLY. You cannot edit files, write files, run mutating commands, or start",
+      "background processes. This is enforced outside your control \u2014 it is not a permission prompt, and",
+      "the user cannot approve an exception from inside this turn.",
+      "",
+      "Therefore:",
+      '- NEVER ask "shall I go ahead and make this change?" \u2014 you cannot, whatever the answer.',
+      '- NEVER attempt a mutating tool "just to see" \u2014 it will be refused and wastes the turn.',
+      "- NEVER try to reach a blocked command another way (a different flag, a script, an interpreter).",
+      "",
+      "Your job is to research thoroughly, then deliver a plan:",
+      "1. What you found \u2014 the specific files, functions and line numbers that matter.",
+      "2. What you propose to change \u2014 file by file, in dependency order.",
+      "3. Risks and unknowns \u2014 what could break, what you could not verify, what you assumed.",
+      "4. How it will be verified \u2014 the exact build/test/lint command that proves it works.",
+      "",
+      'Be concrete. "Update the auth logic" is not a plan; "add a `refreshToken` field to AuthConfig in',
+      'auth/index.ts:42, then thread it through client.ts:118" is. The user will review the plan and',
+      "leave plan mode to have it carried out."
+    ].join("\n");
+  }
+});
+
+// ../core/dist/agent/agentRegistry.js
+var require_agentRegistry = __commonJS({
+  "../core/dist/agent/agentRegistry.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports._limits = void 0;
+    exports.rememberAgent = rememberAgent;
+    exports.updateAgent = updateAgent;
+    exports.getAgent = getAgent;
+    exports.listAgents = listAgents;
+    exports._resetAgentRegistry = _resetAgentRegistry;
+    var MAX_AGENTS = 20;
+    var MAX_TOTAL_BYTES = 8 * 1024 * 1024;
+    var _agents = /* @__PURE__ */ new Map();
+    var _counter = 0;
+    var _seq = 0;
+    function totalBytes() {
+      let n = 0;
+      for (const a of _agents.values())
+        n += a.bytes;
+      return n;
+    }
+    function evictUntilWithinLimits() {
+      while (_agents.size > MAX_AGENTS) {
+        const oldest = _agents.keys().next().value;
+        if (oldest === void 0)
+          break;
+        _agents.delete(oldest);
+      }
+      while (totalBytes() > MAX_TOTAL_BYTES && _agents.size > 1) {
+        const oldest = _agents.keys().next().value;
+        if (oldest === void 0)
+          break;
+        _agents.delete(oldest);
+      }
+    }
+    function sizeOf(messages) {
+      try {
+        return JSON.stringify(messages).length;
+      } catch {
+        return MAX_TOTAL_BYTES;
+      }
+    }
+    function rememberAgent(agentName, description, messages) {
+      const id = `agent_${++_counter}`;
+      const now = Date.now();
+      _agents.set(id, {
+        id,
+        agentName,
+        description,
+        messages,
+        createdAt: now,
+        updatedAt: now,
+        seq: ++_seq,
+        bytes: sizeOf(messages)
+      });
+      evictUntilWithinLimits();
+      return id;
+    }
+    function updateAgent(id, messages) {
+      const existing = _agents.get(id);
+      if (!existing)
+        return;
+      existing.messages = messages;
+      existing.updatedAt = Date.now();
+      existing.seq = ++_seq;
+      existing.bytes = sizeOf(messages);
+      _agents.delete(id);
+      _agents.set(id, existing);
+      evictUntilWithinLimits();
+    }
+    function getAgent(id) {
+      return _agents.get(id);
+    }
+    function listAgents() {
+      return [..._agents.values()].sort((a, b) => b.seq - a.seq);
+    }
+    function _resetAgentRegistry() {
+      _agents.clear();
+      _counter = 0;
+      _seq = 0;
+    }
+    exports._limits = { MAX_AGENTS, MAX_TOTAL_BYTES };
+  }
+});
+
 // ../core/dist/agent/flaky.js
 var require_flaky = __commonJS({
   "../core/dist/agent/flaky.js"(exports) {
@@ -15410,7 +15763,8 @@ var require_loop = __commonJS({
       };
     }();
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.VERIFY_CMD_RE = exports.WRITE_TOOL_NAMES = exports.ToolNotAllowedError = void 0;
+    exports.VERIFY_CMD_RE = exports.WRITE_TOOL_NAMES = exports.ToolNotAllowedError = exports._stallLimits = void 0;
+    exports.errorRoundSignature = errorRoundSignature;
     exports.resolveMaxIterations = resolveMaxIterations;
     exports.createLimiter = createLimiter;
     exports.extractSubTaskText = extractSubTaskText;
@@ -15436,6 +15790,8 @@ var require_loop = __commonJS({
     var agentTypes_1 = require_agentTypes();
     var skills_1 = require_skills();
     var rules_1 = require_rules();
+    var planMode_1 = require_planMode();
+    var agentRegistry_1 = require_agentRegistry();
     var sandbox_1 = require_sandbox();
     var index_1 = require_plugins();
     var testIntegrity_1 = require_testIntegrity();
@@ -15541,6 +15897,11 @@ var require_loop = __commonJS({
     var MAX_ITERATIONS_CEILING = 2e3;
     var HARD_ITERATIONS_CAP = 1e5;
     var STALL_LIMIT = 8;
+    var REPEAT_STALL_LIMIT = 12;
+    function errorRoundSignature(errored) {
+      return errored.map(({ name, error }) => `${name}:${String(error).slice(0, 200)}`).sort().join("|");
+    }
+    exports._stallLimits = { STALL_LIMIT, REPEAT_STALL_LIMIT };
     function resolveMaxIterations(optionValue, settingsRaw) {
       const fromEnv = Number(process.env.NEXRALL_MAX_ITERATIONS);
       const fromSettings = Number(settingsRaw.maxIterations);
@@ -15756,7 +16117,22 @@ ${tail}`;
       if (depth >= MAX_TASK_DEPTH) {
         return { error: "Sub-agents cannot spawn further sub-agents. Do this work directly, or report back so the main agent can delegate it." };
       }
-      const requestedType = typeof input.subagent_type === "string" ? input.subagent_type : "";
+      const resumeId = typeof input.resume_agent_id === "string" ? input.resume_agent_id.trim() : "";
+      const resumed = resumeId ? (0, agentRegistry_1.getAgent)(resumeId) : void 0;
+      if (resumeId && !resumed) {
+        return {
+          error: `No resumable sub-agent with id "${resumeId}". Ids live only for the current session and the oldest are dropped when too many accumulate, so this one has expired or never existed. Start a fresh sub-task with a self-contained prompt instead.`
+        };
+      }
+      const requestedType = resumed ? resumed.agentName ?? "" : typeof input.subagent_type === "string" ? input.subagent_type : "";
+      if (requestedType) {
+        const decision = (0, rules_1.evaluatePermission)((0, rules_1.loadSettings)(options.workDir).permissions, "task", { subagent_type: requestedType }, options.workDir);
+        if (decision === "deny") {
+          return {
+            error: `The sub-agent "${requestedType}" is disabled by a permission rule in this project (permissions.deny in settings.json). This is a deliberate policy choice, not a missing file \u2014 do not create it and do not retry. Do the work yourself, or use a different sub-agent.`
+          };
+        }
+      }
       let agent = (0, agentTypes_1.findAgentType)(agentTypes, requestedType);
       let knownTypes = agentTypes;
       if (requestedType && !agent) {
@@ -15786,9 +16162,7 @@ ${options.nexrallMd}` : "") : options.nexrallMd;
         }
         return options.requestPermission(req);
       };
-      const subMessages = [
-        { role: "user", content: [{ type: "text", text: prompt2 }] }
-      ];
+      const subMessages = resumed ? [...resumed.messages, { role: "user", content: [{ type: "text", text: prompt2 }] }] : [{ role: "user", content: [{ type: "text", text: prompt2 }] }];
       const subAbort = { aborted: false };
       const timer = setTimeout(() => {
         subAbort.aborted = true;
@@ -15806,6 +16180,9 @@ ${options.nexrallMd}` : "") : options.nexrallMd;
           editorContext: null,
           // fresh isolated context for sub-agent
           model: agent?.model ?? options.model,
+          // Plan mode is inherited, never relaxed. If the main agent could spawn a
+          // sub-agent that writes, the lock would be one `task` call from useless.
+          planMode: options.planMode,
           nexrallMd: subNexrallMd,
           abortSignal: subAbort,
           requestPermission: gatedPermission,
@@ -15854,7 +16231,13 @@ ${partial}` : "",
           return { error: sections.join("\n\n") };
         }
         const text = capSubTaskText(extractSubTaskText(result, true));
-        return { output: text || "(sub-task completed with no text output)" };
+        const agentId = resumed ? ((0, agentRegistry_1.updateAgent)(resumed.id, result), resumed.id) : (0, agentRegistry_1.rememberAgent)(agent?.name ?? null, typeof input.description === "string" && input.description.trim() || prompt2.slice(0, 80), result);
+        const body = text || "(sub-task completed with no text output)";
+        return {
+          output: `${body}
+
+[resumable: this sub-agent is "${agentId}". To ask IT a follow-up \u2014 keeping everything it already read and concluded \u2014 call task again with resume_agent_id="` + agentId + '" instead of writing a new prompt from scratch.]'
+        };
       } catch (err) {
         const salvaged = (0, types_1.salvageHistory)(err);
         if (salvaged) {
@@ -15895,6 +16278,8 @@ ${partial}` : "",
     }
     var PRUNE_MIN_RECLAIM_BYTES = 256 * 1024;
     var COMPACT_KEEP_MIN = 6;
+    var COMPACT_MIN_RECLAIM_BYTES = 32 * 1024;
+    var COMPACT_MAX_FAILURES = 3;
     var MAX_BODY_BYTES = 8 * 1024 * 1024;
     function estimateBodyBytes2(messages) {
       try {
@@ -15976,7 +16361,7 @@ ${tail}`;
     var LEDGER_MAX_FILES = 60;
     var LEDGER_MAX_NOTES = 20;
     function createLedger() {
-      return { filesTouched: /* @__PURE__ */ new Map(), verifications: [], testIntegrity: [], epoch: 0 };
+      return { filesTouched: /* @__PURE__ */ new Map(), filesTouchedTotal: 0, verifications: [], testIntegrity: [], testIntegrityTotal: 0, epoch: 0 };
     }
     function ledgerRecord(ledger, toolName, input, ok, output, exitCode) {
       if (exports.WRITE_TOOL_NAMES.has(toolName)) {
@@ -15986,7 +16371,18 @@ ${tail}`;
         const p = typeof input?.path === "string" ? input.path : void 0;
         if (p) {
           const prev = ledger.filesTouched.get(p);
+          if (!prev)
+            ledger.filesTouchedTotal++;
+          ledger.filesTouched.delete(p);
           ledger.filesTouched.set(p, { tool: toolName, edits: (prev?.edits ?? 0) + 1 });
+          if (ledger.filesTouched.size > LEDGER_MAX_FILES * 4) {
+            for (const key of ledger.filesTouched.keys()) {
+              if (ledger.filesTouched.size <= LEDGER_MAX_FILES * 2)
+                break;
+              if (key !== p)
+                ledger.filesTouched.delete(key);
+            }
+          }
         }
         const reasons = [];
         const markerReasons = toolName === "write_file" ? (0, testIntegrity_1.decodeTestIntegrityMarker)(output) : [];
@@ -16000,6 +16396,7 @@ ${tail}`;
         if (reasons.length && p) {
           for (const reason of reasons) {
             ledger.testIntegrity.push({ path: p, reason });
+            ledger.testIntegrityTotal++;
           }
           if (ledger.testIntegrity.length > LEDGER_MAX_NOTES * 2) {
             ledger.testIntegrity.splice(0, ledger.testIntegrity.length - LEDGER_MAX_NOTES);
@@ -16020,8 +16417,8 @@ ${tail}`;
       const lines = [];
       if (ledger.filesTouched.size) {
         const files = [...ledger.filesTouched.entries()];
-        const shown = files.slice(0, LEDGER_MAX_FILES);
-        lines.push(`FILES CHANGED THIS SESSION (${ledger.filesTouched.size}):`);
+        const shown = files.slice(-LEDGER_MAX_FILES);
+        lines.push(`FILES CHANGED THIS SESSION (${ledger.filesTouchedTotal || ledger.filesTouched.size}):`);
         for (const [p, meta] of shown) {
           lines.push(`  \u2022 ${p}  (${meta.tool}${meta.edits > 1 ? ` \xD7${meta.edits}` : ""})`);
         }
@@ -16236,10 +16633,15 @@ Continue the work from here.` }] });
       const hooks = loadHooks(options.workDir);
       const depth = options._depth ?? 0;
       const agentScope = options._agentScope ?? "root";
-      const agentTypes = (0, agentTypes_1.loadAgentTypes)(options.workDir);
+      const settings = (0, rules_1.loadSettings)(options.workDir);
+      const agentTypes = (0, agentTypes_1.loadAgentTypes)(options.workDir).filter((t2) => (0, rules_1.evaluatePermission)(settings.permissions, "task", { subagent_type: t2.name }, options.workDir) !== "deny");
       const agentsCatalogue = depth === 0 ? (0, agentTypes_1.summariseAgents)(agentTypes) : "";
       const skillsCatalogue = (0, skills_1.summariseSkills)((0, skills_1.loadSkills)(options.workDir));
-      const settings = (0, rules_1.loadSettings)(options.workDir);
+      const planAwareNexrallMd = options.planMode ? planMode_1.PLAN_MODE_INSTRUCTIONS + (options.nexrallMd ? `
+
+---
+
+${options.nexrallMd}` : "") : options.nexrallMd;
       const sandboxCfg = (0, sandbox_1.parseSandboxConfig)(settings.raw.sandbox) ?? void 0;
       const maxIterations = resolveMaxIterations(options.maxIterations, settings.raw);
       const autoContinue = resolveAutoContinue(options.autoContinue, settings.raw);
@@ -16253,6 +16655,9 @@ Continue the work from here.` }] });
       let completedRounds = 0;
       let stalledOut = false;
       let consecutiveErrorRounds = 0;
+      let repeatedErrorRounds = 0;
+      let lastErrorSignature = "";
+      let stalledRepeatError = null;
       let budget = maxIterations;
       let iteration = 0;
       let filesMutatedSinceVerify = false;
@@ -16262,6 +16667,8 @@ Continue the work from here.` }] });
       const flakyNudgedCmds = /* @__PURE__ */ new Set();
       let claimEvidenceNudged = false;
       const ledger = createLedger();
+      let compactFailures = 0;
+      let compactDisabled = false;
       try {
         for (; iteration < budget; iteration++) {
           if (options.abortSignal?.aborted)
@@ -16278,14 +16685,25 @@ Continue the work from here.` }] });
               (options.onNotice ?? options.onText)(`\u267B\uFE0F Trimmed ~${(reclaimed / (1024 * 1024)).toFixed(1)}MB of already-processed tool output to keep this chat cheap to continue.`);
             }
           }
-          if (autoCompact && !compacting && (tokenPressure || bytePressure) && messages.length > COMPACT_KEEP_MIN + 2) {
+          if (autoCompact && !compactDisabled && !compacting && (tokenPressure || bytePressure) && messages.length > COMPACT_KEEP_MIN + 2) {
             compacting = true;
             try {
+              const bytesBefore = estimateBodyBytes2(messages);
               const did = await autoCompactMessages(messages, options, ledger);
+              const bytesAfter = did ? estimateBodyBytes2(messages) : bytesBefore;
+              const reclaimed = bytesBefore - bytesAfter;
               if (did) {
                 lastPromptTokens = 0;
                 const reason = bytePressure ? `body ~${(bodyBytes / (1024 * 1024)).toFixed(1)}MB` : "context window";
                 (options.onNotice ?? options.onText)(`\u267B\uFE0F Auto-compacted earlier conversation to stay within the ${reason}.`);
+                bodyBytes = bytesAfter;
+                bytePressure = bodyBytes > MAX_BODY_BYTES;
+              }
+              if (did && reclaimed >= COMPACT_MIN_RECLAIM_BYTES) {
+                compactFailures = 0;
+              } else if (++compactFailures >= COMPACT_MAX_FAILURES) {
+                compactDisabled = true;
+                (options.onNotice ?? options.onText)(`\u26A0\uFE0F Auto-compaction isn't reducing this conversation any further, so it's been switched off for the rest of this run to avoid repeated summarising. If the context fills up, start a fresh chat or run /compact manually.`);
               }
             } finally {
               compacting = false;
@@ -16347,7 +16765,7 @@ Continue the work from here.` }] });
               effort: options.effort,
               env: options.env,
               editorContext: options.editorContext,
-              nexrallMd: options.nexrallMd,
+              nexrallMd: planAwareNexrallMd,
               clientType: options.clientType,
               abortSignal: options.abortSignal,
               extraTools: options.mcpManager?.getAnthropicTools(),
@@ -16400,9 +16818,10 @@ Continue the work from here.` }] });
               messages.push({ role: "user", content: [{ type: "text", text }] });
               continue;
             }
-            if (ledger.testIntegrity.length > testIntegrityNudgedCount) {
-              const fresh = ledger.testIntegrity.slice(testIntegrityNudgedCount);
-              testIntegrityNudgedCount = ledger.testIntegrity.length;
+            if (ledger.testIntegrityTotal > testIntegrityNudgedCount) {
+              const newCount = Math.min(ledger.testIntegrityTotal - testIntegrityNudgedCount, ledger.testIntegrity.length);
+              const fresh = ledger.testIntegrity.slice(ledger.testIntegrity.length - newCount);
+              testIntegrityNudgedCount = ledger.testIntegrityTotal;
               const bullet = fresh.map((t2) => `  \u2022 ${t2.path}: ${t2.reason}`).join("\n");
               messages.push({
                 role: "user",
@@ -16467,6 +16886,14 @@ Continue the work from here.` }] });
               options.onToolResult(name, result);
               return { block: { ...block, id }, result };
             }
+            if (options.planMode) {
+              const refusal = (0, planMode_1.checkPlanMode)(name, input);
+              if (refusal) {
+                result = { error: refusal.message };
+                options.onToolResult(name, result);
+                return { block: { ...block, id }, result };
+              }
+            }
             const description = humanDescription(name, input);
             let permitted;
             let deniedReason = null;
@@ -16575,12 +17002,25 @@ ${result.output}` : `Error: ${result.error}` : result.output ?? "",
           messages.push(toolResultMessage);
           completedRounds++;
           options.onProgress?.(messages);
-          const allErrored = toolResults.length > 0 && toolResults.every(({ result }) => result.error !== void 0);
+          const errored = toolResults.filter(({ result }) => result.error !== void 0);
+          const allErrored = toolResults.length > 0 && errored.length === toolResults.length;
           consecutiveErrorRounds = allErrored ? consecutiveErrorRounds + 1 : 0;
           if (consecutiveErrorRounds >= STALL_LIMIT) {
             stalledOut = true;
             break;
           }
+          const errSignature = errorRoundSignature(errored.map(({ block, result }) => ({ name: block.name, error: String(result.error) })));
+          if (errSignature && errSignature === lastErrorSignature) {
+            repeatedErrorRounds++;
+          } else {
+            repeatedErrorRounds = 0;
+            lastErrorSignature = errSignature;
+          }
+          if (repeatedErrorRounds >= REPEAT_STALL_LIMIT) {
+            stalledOut = true;
+            stalledRepeatError = errored[0] ? String(errored[0].result.error).slice(0, 300) : null;
+            break;
+          }
           if (autoContinue && iteration + 1 >= budget && budget < hardCap) {
             budget = Math.min(budget + maxIterations, hardCap);
             options.onText(`
@@ -16590,11 +17030,15 @@ ${result.output}` : `Error: ${result.error}` : result.output ?? "",
         }
         if (!options.abortSignal?.aborted && !completedCleanly) {
           if (stalledOut) {
-            options.onText(`
+            (options.onNotice ?? options.onText)(stalledRepeatError ? `
+\u{1F6D1} Stopped: the same tool error repeated ${REPEAT_STALL_LIMIT} rounds in a row, so the agent was looping without making progress. The recurring error was:
+${stalledRepeatError}
+Fix that underlying cause (or grant the needed permission) and send "continue".
+` : `
 \u{1F6D1} Stopped: the last ${STALL_LIMIT} tool rounds all failed, so the agent looked stuck. Fix the underlying error (or grant the needed permission) and send "continue".
 `);
           } else if (iteration >= budget) {
-            options.onText(`
+            (options.onNotice ?? options.onText)(`
 \u23F8\uFE0F Stopped at the ${budget}-step safety limit \u2014 the task may be incomplete. Send "continue" to resume, or raise the limit via "maxIterations" in .nexrall/settings.json (or the NEXRALL_MAX_ITERATIONS env var). Auto-continue can be disabled with "autoContinue": false.
 `);
           }
@@ -18482,6 +18926,8 @@ var require_dist2 = __commonJS({
     __exportStar(require_manager2(), exports);
     __exportStar(require_loader(), exports);
     __exportStar(require_agentTypes(), exports);
+    __exportStar(require_planMode(), exports);
+    __exportStar(require_agentRegistry(), exports);
     __exportStar(require_rules(), exports);
     __exportStar(require_destructive(), exports);
     __exportStar(require_plugins(), exports);
@@ -63558,7 +64004,7 @@ var InkReadlineAdapter = class extends EventEmitter3 {
 };
 
 // src/commands/chat.ts
-var CLI_VERSION = "0.5.50";
+var CLI_VERSION = "0.5.52";
 var MODEL_LABELS = {
   turbo: "Nexrall Turbo",
   pro: "Nexrall Pro",
@@ -63829,6 +64275,12 @@ async function runTurn(messages, modelAlias, workDir, abortSignal, env3, nexrall
     env: env3,
     nexrallMd,
     mode,
+    // `/mode plan` previously only hinted to the backend — the footer said "plan
+    // mode on" while every write tool stayed live, so the one mode whose entire
+    // promise is "I will not touch anything" was the one not enforced. This
+    // makes it real: the loop refuses mutating tools before the permission
+    // prompt, and sub-agents inherit the lock.
+    planMode: mode === "plan",
     effort,
     // The backend streams a cumulative output-token count (routes/code.js's
     // sendProgress, throttled to ≤5/s) covering thinking, visible text AND
@@ -63982,6 +64434,7 @@ async function runTurnHeadless(messages, modelAlias, workDir, _abortSignal, env3
     env: env3,
     nexrallMd,
     mode,
+    planMode: mode === "plan",
     effort,
     abortSignal: _abortSignal,
     onText: (text) => {
@@ -65218,7 +65671,7 @@ function pluginSourceRemoveCommand(name, opts) {
 
 // src/index.ts
 var program2 = new Command();
-program2.name("nex").description("Nexrall Code \u2014 AI coding assistant (powered by Nexrall)").version("0.5.50").enablePositionalOptions();
+program2.name("nex").description("Nexrall Code \u2014 AI coding assistant (powered by Nexrall)").version("0.5.52").enablePositionalOptions();
 program2.command("auth").description("Login to your Nexrall account").action(authCommand);
 program2.command("logout").description("Log out of your Nexrall account").action(logoutCommand);
 program2.command("update").description("Update nex to the latest version").option("-c, --check", "Check for updates without installing").option("-y, --yes", "Skip confirmation prompt").action(async (opts) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexrall-code",
-  "version": "0.5.50",
+  "version": "0.5.52",
   "description": "Nexrall Code — AI coding assistant for your terminal (headless agent for scripts, CI and automation)",
   "keywords": [
     "ai",
@@ -41,7 +41,7 @@
     "react": "^19.2.8",
     "readline": "^1.3.0",
     "string-width": "^7.2.0",
-    "@nexrall/code-core": "1.4.25"
+    "@nexrall/code-core": "1.4.27"
   },
   "devDependencies": {
     "@aws-sdk/client-s3": "^3.600.0",