nexrall-code 0.5.53 → 0.5.55

package/dist/index.js

@@ -9982,7 +9982,7 @@ var require_client = __commonJS({
     }
     var MAX_TOTAL_ATTEMPTS = (MAX_RETRIES + 1) * (MAX_RETRIES + 1);
     async function streamChat(messages, options, onEvent) {
-      const { model, env: env3, editorContext, nexrallMd, mode, effort, clientType, abortSignal, extraTools, agents, skills, allowRestartAfterRender } = options;
+      const { model, env: env3, editorContext, nexrallMd, mode, effort, clientType, abortSignal, extraTools, agents, skills, allowRestartAfterRender, canWriteSharedMemory, hasOwnAgentStore } = options;
       let turnId = (0, crypto_1.randomUUID)();
       const controller = new AbortController();
       if (abortSignal?.aborted)
@@ -10023,7 +10023,7 @@ var require_client = __commonJS({
           {
             method: "POST",
             headers: authHeaders(),
-            body: JSON.stringify({ messages, model, env: env3, editorContext, nexrallMd, mode, effort, clientType, extraTools, agents, skills, turnId }),
+            body: JSON.stringify({ messages, model, env: env3, editorContext, nexrallMd, mode, effort, clientType, extraTools, agents, skills, turnId, canWriteSharedMemory, hasOwnAgentStore }),
             signal: controller.signal
           }
         ];
@@ -11012,13 +11012,18 @@ var require_memory = __commonJS({
       };
     }();
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.MEMORY_HARD_CAP_BYTES = exports.MEMORY_COMPACT_TRIGGER_BYTES = exports.MEMORY_MAX_BYTES = exports.MEMORY_ENTRY_MAX_CHARS = void 0;
+    exports.AGENT_MEMORY_MAX_BYTES = exports.AGENT_MEMORY_INJECT_MAX = exports.MEMORY_HARD_CAP_BYTES = exports.MEMORY_COMPACT_TRIGGER_BYTES = exports.MEMORY_MAX_BYTES = exports.MEMORY_ENTRY_MAX_CHARS = void 0;
     exports.memoryFilePath = memoryFilePath;
     exports.writeMemory = writeMemory;
     exports.readMemory = readMemory2;
     exports.readAllMemory = readAllMemory2;
     exports.clearMemory = clearMemory2;
     exports.memoryStats = memoryStats2;
+    exports.isSafeAgentName = isSafeAgentName;
+    exports.agentMemoryPath = agentMemoryPath;
+    exports.readAgentMemory = readAgentMemory;
+    exports.writeAgentMemory = writeAgentMemory;
+    exports.agentMemoryPreamble = agentMemoryPreamble;
     exports.compactMemoryIfNeeded = compactMemoryIfNeeded2;
     var fs9 = __importStar(__require("fs"));
     var os6 = __importStar(__require("os"));
@@ -11127,6 +11132,71 @@ ${projMem}`);
       const entries = content.split("\n").filter((l) => /^-\s\[\d{4}-\d{2}-\d{2}\]/.test(l)).length;
       return { file, bytes: Buffer.byteLength(content, "utf-8"), entries };
     }
+    exports.AGENT_MEMORY_INJECT_MAX = 8e3;
+    exports.AGENT_MEMORY_MAX_BYTES = 24e3;
+    function isSafeAgentName(name) {
+      return /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(name) && !name.includes("..");
+    }
+    function agentMemoryPath(agentName, scope, workDir) {
+      if (!isSafeAgentName(agentName))
+        return null;
+      const file = `${agentName}.md`;
+      let dir;
+      if (scope === "user") {
+        dir = path6.join(MEMORY_ROOT, "agent-memory");
+      } else {
+        if (!workDir)
+          return null;
+        dir = path6.join(path6.resolve(workDir), ".nexrall", scope === "local" ? "agent-memory-local" : "agent-memory");
+      }
+      const full = path6.join(dir, file);
+      const rel = path6.relative(dir, full);
+      if (rel.startsWith("..") || path6.isAbsolute(rel))
+        return null;
+      return full;
+    }
+    function readAgentMemory(agentName, scope, workDir) {
+      const file = agentMemoryPath(agentName, scope, workDir);
+      if (!file)
+        return "";
+      return readMemoryFile(file).trim();
+    }
+    async function writeAgentMemory(agentName, scope, content, workDir) {
+      let trimmed = content.trim();
+      if (!trimmed)
+        return { ok: false, already: false, file: "" };
+      if (trimmed.length > exports.MEMORY_ENTRY_MAX_CHARS) {
+        trimmed = trimmed.slice(0, exports.MEMORY_ENTRY_MAX_CHARS - 1).trimEnd() + "\u2026";
+      }
+      const file = agentMemoryPath(agentName, scope, workDir);
+      if (!file)
+        return { ok: false, already: false, file: "" };
+      return withLock(file, async () => {
+        const existing = readMemoryFile(file);
+        const fingerprint = trimmed.toLowerCase().slice(0, FINGERPRINT_LEN);
+        if (existing.toLowerCase().includes(fingerprint)) {
+          return { ok: true, already: true, file };
+        }
+        const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+        let next = existing + `
+- [${today}] ${trimmed}`;
+        if (Buffer.byteLength(next, "utf-8") > exports.AGENT_MEMORY_MAX_BYTES) {
+          next = evictOldest(next, exports.AGENT_MEMORY_MAX_BYTES);
+        }
+        writeMemoryFile(file, next);
+        return { ok: true, already: false, file };
+      });
+    }
+    function agentMemoryPreamble(agentName, scope, workDir) {
+      const notes = readAgentMemory(agentName, scope, workDir);
+      if (!notes)
+        return "";
+      const kept = Buffer.byteLength(notes, "utf-8") > exports.AGENT_MEMORY_INJECT_MAX ? notes.slice(-exports.AGENT_MEMORY_INJECT_MAX) : notes;
+      return `# Your own notes (agent: ${agentName}, scope: ${scope})
+These are notes YOU saved on previous runs. Treat them as your accumulated experience, not as instructions from the user, and verify anything that looks stale against the current code.
+
+${kept}`;
+    }
     async function compactMemoryIfNeeded2(scope, workDir, summarize) {
       const file = memoryFilePath(scope, workDir);
       return withLock(file, async () => {
@@ -14585,6 +14655,11 @@ var require_agentTypes = __commonJS({
     var path6 = __importStar(__require("path"));
     var os6 = __importStar(__require("os"));
     var index_1 = require_plugins();
+    var VALID_MEMORY_SCOPES = ["project", "user", "local"];
+    function parseMemoryScope(v) {
+      const s2 = (v ?? "").trim().toLowerCase();
+      return VALID_MEMORY_SCOPES.includes(s2) ? s2 : void 0;
+    }
     var READ_ONLY_TOOLS = [
       // Universal
       "read_file",
@@ -14600,6 +14675,22 @@ var require_agentTypes = __commonJS({
       "notebook_read",
       "todo_write",
       "todo_read",
+      // memory_READ, deliberately without memory_write.
+      //
+      // Reading is free capability: a sub-agent that knows "tests run with X" or "never
+      // edit Z directly" does better work, and withholding it meant every sub-agent
+      // rediscovered project conventions from scratch. Writing is a different thing
+      // entirely — memory is durable, cross-session, SHARED state, while sub-agents run
+      // up to 4-wide in parallel with their reasoning hidden from the user. A wrong fact
+      // written there is invisible and permanent, and it competes for a capped, shared
+      // budget that gets periodically condensed.
+      //
+      // So the parent owns writes: a sub-agent that learns something durable says so in
+      // its report, and the main agent — the one actually talking to the user — decides.
+      // A sub-agent that needs its own persistent notes gets the per-agent store instead
+      // (see `memory:` in the frontmatter), which is scoped to itself and cannot pollute
+      // the shared file.
+      "memory_read",
       // Skills are reusable prompt playbooks, and loop.ts advertises the skills
       // catalogue to sub-agents at EVERY depth — so withholding the tool that loads
       // one meant showing every sub-agent a menu it could not order from.
@@ -14627,6 +14718,29 @@ var require_agentTypes = __commonJS({
       "notebook_edit"
     ];
     var BUILTIN_AGENTS = [
+      {
+        // The catch-all, matching Claude Code's `general-purpose`.
+        //
+        // This capability already existed — omitting `subagent_type` gives an unrestricted
+        // sub-agent — but it had no NAME, and that had two consequences worth fixing:
+        //
+        //   1. `permissions.deny: ["task(...)"]` matches on the agent name, so the ONE
+        //      sub-agent that can write files and run bash was the one variant a project
+        //      could not disable individually. Only a blanket `deny: ["task"]` reached it.
+        //   2. The model had to infer that leaving the field blank was even an option, so
+        //      it would sometimes pick a specialist that fitted badly (an unrestricted
+        //      explorer) rather than the general worker it actually wanted.
+        //
+        // `tools` is deliberately UNDEFINED, which means "no allowlist" — full access,
+        // inheriting whatever the session permits. That is the same power an unnamed
+        // sub-task always had; naming it changes only who can see and deny it. The safety
+        // properties elsewhere still apply: plan mode is inherited, the user's permission
+        // gate still runs on every call, and it cannot spawn further sub-agents.
+        name: "general-purpose",
+        description: "General-purpose worker for a multi-step task that needs BOTH exploration and changes (edit files, run commands) and that no specialist above fits. Inherits the session model and full tool access, so prefer a narrower agent when one matches.",
+        prompt: "You are a general-purpose engineering sub-agent. Work the task end to end: explore what you need, make the changes, and verify them with the project's own build/test commands.\n\nRules:\n- Mirror existing conventions; make the smallest correct change.\n- Verify before you claim success. If you could not verify, say so explicitly.\n- Your FINAL MESSAGE is the only thing that reaches the main agent: state what you changed (with file paths), what you ran and its outcome, and anything you deliberately left undone.",
+        source: "builtin"
+      },
       {
         name: "reviewer",
         description: "Read-only code reviewer \u2014 finds correctness bugs, edge cases, and security issues in a diff or file set. Cannot modify files.",
@@ -14689,6 +14803,9 @@ var require_agentTypes = __commonJS({
       // frontier model, and this is the agent most likely to be spawned in bulk.
       {
         name: "explorer",
+        // Lean prompt: this agent exists to keep bulk searching cheap, and it reports
+        // findings for the MAIN agent to interpret with full project context.
+        lightPrompt: true,
         description: "Fast read-only codebase explorer \u2014 locates files, symbols, and call sites and reports concise findings. Use to keep bulk searching out of the main context. Cannot modify files.",
         tools: READ_ONLY_TOOLS,
         model: "turbo",
@@ -14832,6 +14949,9 @@ var require_agentTypes = __commonJS({
       "stock_photo",
       "open_in_browser",
       "task",
+      // Granted by a `memory:` scope rather than listed in a `tools:` line, but a user may
+      // still name it explicitly — so it must validate rather than be flagged as a typo.
+      "agent_memory_write",
       "get_symbols",
       "get_workspace_symbols",
       "find_references",
@@ -14845,7 +14965,8 @@ var require_agentTypes = __commonJS({
       "tools",
       "model",
       "test_files_only",
-      "testfilesonly"
+      "testfilesonly",
+      "memory"
     ]);
     var VALID_MODELS = ["turbo", "pro", "ultra"];
     function parseFrontmatter(raw) {
@@ -14918,6 +15039,13 @@ var require_agentTypes = __commonJS({
               message: "has no `description:` \u2014 that text is the ONLY thing the model uses to decide when to delegate to this agent, so it will rarely be picked."
             });
           }
+          if (meta.memory !== void 0 && parseMemoryScope(meta.memory) === void 0) {
+            warnings.push({
+              file: full,
+              agent: name,
+              message: `has memory: "${meta.memory}", which is not a valid scope \u2014 use one of ${VALID_MEMORY_SCOPES.join(", ")}, or omit the line to give this agent no persistent notes.`
+            });
+          }
           if (meta.model !== void 0 && parseModel(meta.model) === void 0) {
             warnings.push({
               file: full,
@@ -14960,7 +15088,13 @@ var require_agentTypes = __commonJS({
           // `testFilesOnly`) lets anyone build a test-writing agent that genuinely
           // cannot touch production source, rather than only the builtin getting
           // that guarantee.
-          ...parseBool(meta.test_files_only ?? meta.testfilesonly) ? { testFilesOnly: true } : {}
+          ...parseBool(meta.test_files_only ?? meta.testfilesonly) ? { testFilesOnly: true } : {},
+          // The `ok &&` is defensive, not load-bearing: parseFrontmatter already returns an
+          // EMPTY meta when it cannot find a `---` block, so `meta.memory` is undefined on
+          // that path regardless. It stays because the guarantee we want — an unreadable
+          // definition never receives a writable store — should survive parseFrontmatter
+          // being changed to salvage partial metadata, which is a plausible future edit.
+          ...ok && parseMemoryScope(meta.memory) ? { memory: parseMemoryScope(meta.memory) } : {}
         });
       }
     }
@@ -15763,14 +15897,17 @@ var require_loop = __commonJS({
       };
     }();
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.VERIFY_CMD_RE = exports.WRITE_TOOL_NAMES = exports.ToolNotAllowedError = exports._stallLimits = void 0;
+    exports.VERIFY_CMD_RE = exports.WRITE_TOOL_NAMES = exports.ToolNotAllowedError = exports.AGENT_MEMORY_TOOL_SCHEMA = exports.AGENT_MEMORY_TOOL = exports._stallLimits = void 0;
     exports.errorRoundSignature = errorRoundSignature;
+    exports.executeAgentMemoryWrite = executeAgentMemoryWrite;
     exports.stopReasonNotice = stopReasonNotice;
     exports.resolveMaxIterations = resolveMaxIterations;
     exports.createLimiter = createLimiter;
+    exports.resolveSubtaskTimeoutMs = resolveSubtaskTimeoutMs;
     exports.extractSubTaskText = extractSubTaskText;
     exports.capSubTaskText = capSubTaskText;
     exports.summariseSubTaskProgress = summariseSubTaskProgress;
+    exports.lastToolResults = lastToolResults;
     exports.contextWindowFor = contextWindowFor2;
     exports.compactionThresholds = compactionThresholds2;
     exports.estimateBodyBytes = estimateBodyBytes2;
@@ -15903,6 +16040,37 @@ var require_loop = __commonJS({
       return errored.map(({ name, error }) => `${name}:${String(error).slice(0, 200)}`).sort().join("|");
     }
     exports._stallLimits = { STALL_LIMIT, REPEAT_STALL_LIMIT };
+    exports.AGENT_MEMORY_TOOL = "agent_memory_write";
+    exports.AGENT_MEMORY_TOOL_SCHEMA = {
+      name: exports.AGENT_MEMORY_TOOL,
+      description: "Save a durable note to YOUR OWN persistent notes, which are injected into your prompt on future runs. Use this for lessons that will still be true next time \u2014 a convention this repo follows, a recurring bug pattern, a command that works, a dead end not worth retrying. These notes are PRIVATE to you: they are NOT shown to the user and NOT read by the main agent, so anything the user or the main agent needs to know must still go in your final message. One self-contained fact per call, a sentence or two. Do not save transient task details.",
+      input_schema: {
+        type: "object",
+        properties: {
+          content: { type: "string", description: "The single fact to remember, 1-2 sentences." }
+        },
+        required: ["content"]
+      }
+    };
+    async function executeAgentMemoryWrite(input, binding, workDir) {
+      if (!binding) {
+        return {
+          error: `${exports.AGENT_MEMORY_TOOL} is only available to a sub-agent whose definition declares a \`memory:\` scope. Put anything worth remembering in your final message instead.`
+        };
+      }
+      const content = typeof input.content === "string" ? input.content.trim() : "";
+      if (!content)
+        return { error: `${exports.AGENT_MEMORY_TOOL} requires a non-empty \`content\` string.` };
+      const res = await (0, memory_1.writeAgentMemory)(binding.agentName, binding.scope, content, workDir);
+      if (!res.ok) {
+        return {
+          error: `Could not save to the "${binding.agentName}" agent's ${binding.scope} notes. Either this scope needs a project directory (use \`memory: user\` for a store that works anywhere) or the agent name is not usable as a filename.`
+        };
+      }
+      return {
+        output: res.already ? "Already saved (a near-identical note exists) \u2014 nothing added." : `Saved to your ${binding.scope} notes. It will be in your prompt on your next run.`
+      };
+    }
     function stopReasonNotice(reason, ctx = {}) {
       switch (reason) {
         case "clean":
@@ -16082,7 +16250,17 @@ ${ctx.repeatError}
     }
     var MAX_TASK_DEPTH = 1;
     var _subTaskCounter = 0;
-    var SUBTASK_TIMEOUT_MS = Number(process.env.NEXRALL_SUBTASK_TIMEOUT_MS) > 0 ? Number(process.env.NEXRALL_SUBTASK_TIMEOUT_MS) : 10 * 60 * 1e3;
+    var DEFAULT_SUBTASK_TIMEOUT_MS = 10 * 60 * 1e3;
+    function resolveSubtaskTimeoutMs(settingsRaw) {
+      const fromEnv = Number(process.env.NEXRALL_SUBTASK_TIMEOUT_MS);
+      if (Number.isFinite(fromEnv) && fromEnv > 0)
+        return Math.floor(fromEnv);
+      const raw = settingsRaw.subtaskTimeoutMs;
+      const fromSettings = Number(raw);
+      if (Number.isFinite(fromSettings) && fromSettings > 0)
+        return Math.floor(fromSettings);
+      return DEFAULT_SUBTASK_TIMEOUT_MS;
+    }
     var SUBTASK_MAX = 48e3;
     var ToolNotAllowedError = class extends Error {
       constructor(message) {
@@ -16139,11 +16317,59 @@ ${tail}`;
       }
       if (toolNames.length === 0)
         return "";
+      const recentFindings = lastToolResults(messages, SALVAGE_RESULT_COUNT, SALVAGE_RESULT_CHARS);
       const counts = /* @__PURE__ */ new Map();
       for (const n of toolNames)
         counts.set(n, (counts.get(n) ?? 0) + 1);
       const inventory = [...counts.entries()].sort((a, b) => b[1] - a[1]).map(([name, n]) => n > 1 ? `${name} \xD7${n}` : name).join(", ");
-      return `Tool calls completed before it was stopped (${toolNames.length} total): ${inventory}.`;
+      const header = `Tool calls completed before it was stopped (${toolNames.length} total): ${inventory}.`;
+      return recentFindings ? `${header}
+
+What its most recent tool calls actually returned (use this instead of repeating them):
+${recentFindings}` : header;
+    }
+    var SALVAGE_RESULT_COUNT = 4;
+    var SALVAGE_RESULT_CHARS = 2e3;
+    function lastToolResults(messages, count, maxChars) {
+      const nameById = /* @__PURE__ */ new Map();
+      for (const m2 of messages) {
+        if (m2.role !== "assistant" || !Array.isArray(m2.content))
+          continue;
+        for (const b of m2.content) {
+          if (b?.type === "tool_use" && b.id && typeof b.name === "string")
+            nameById.set(b.id, b.name);
+        }
+      }
+      const out = [];
+      for (let i2 = messages.length - 1; i2 >= 0 && out.length < count; i2--) {
+        const m2 = messages[i2];
+        if (m2.role !== "user" || !Array.isArray(m2.content))
+          continue;
+        for (const b of [...m2.content].reverse()) {
+          if (out.length >= count)
+            break;
+          if (b?.type !== "tool_result")
+            continue;
+          const text = toolResultText(b);
+          if (!text)
+            continue;
+          const name = nameById.get(String(b.tool_use_id ?? "")) ?? "tool";
+          const body = text.length > maxChars ? `${sliceSafeEnd(text, maxChars)}
+\u2026 [truncated]` : text;
+          out.push(`\u2022 ${name}:
+${body}`);
+        }
+      }
+      return out.reverse().join("\n\n");
+    }
+    function toolResultText(block) {
+      const c = block.content;
+      if (typeof c === "string")
+        return c.trim();
+      if (Array.isArray(c)) {
+        return c.filter((x2) => x2?.type === "text" && typeof x2.text === "string").map((x2) => x2.text).join("\n").trim();
+      }
+      return "";
     }
     async function runSubTask(input, options, agentTypes) {
       const prompt2 = typeof input.prompt === "string" ? input.prompt.trim() : "";
@@ -16182,14 +16408,26 @@ ${tail}`;
 If you just created .nexrall/agents/` + requestedType + ".md, make sure the write finished in an EARLIER tool call than this one \u2014 a file written in the same batch may not be on disk yet."
         };
       }
+      const memoryScope = agent?.memory;
+      const agentMemoryNotes = agent && memoryScope ? (0, memory_1.agentMemoryPreamble)(agent.name, memoryScope, options.workDir) : "";
+      const inheritedMd = agent?.lightPrompt ? "" : options.nexrallMd ?? "";
       const subNexrallMd = agent ? `# Sub-agent role: ${agent.name}
-${agent.prompt}` + (options.nexrallMd ? `
+${agent.prompt}` + (agentMemoryNotes ? `
 
 ---
 
-${options.nexrallMd}` : "") : options.nexrallMd;
+${agentMemoryNotes}` : "") + (inheritedMd ? `
+
+---
+
+${inheritedMd}` : "") : options.nexrallMd;
       const allowed = agent?.tools ? new Set(agent.tools) : null;
+      if (allowed && memoryScope)
+        allowed.add(exports.AGENT_MEMORY_TOOL);
       const gatedPermission = async (req) => {
+        if (req.tool === exports.AGENT_MEMORY_TOOL && !(agent && memoryScope)) {
+          throw new ToolNotAllowedError(`\`${exports.AGENT_MEMORY_TOOL}\` is only available to a sub-agent whose definition declares a \`memory:\` scope (project, user or local). Report anything worth remembering in your final message instead \u2014 the main agent decides what to persist.`);
+        }
         if (allowed && !allowed.has(req.tool)) {
           throw new ToolNotAllowedError(`The "${agent.name}" sub-agent is not allowed to use \`${req.tool}\` \u2014 it is not in that agent's tool allowlist. This is a restriction of the agent definition, NOT a user decision: do not ask for approval, use one of the tools you do have, or report back that the task needs a different agent.`);
         }
@@ -16200,9 +16438,18 @@ ${options.nexrallMd}` : "") : options.nexrallMd;
       };
       const subMessages = resumed ? [...resumed.messages, { role: "user", content: [{ type: "text", text: prompt2 }] }] : [{ role: "user", content: [{ type: "text", text: prompt2 }] }];
       const subAbort = { aborted: false };
-      const timer = setTimeout(() => {
-        subAbort.aborted = true;
-      }, SUBTASK_TIMEOUT_MS);
+      const subtaskTimeoutMs = resolveSubtaskTimeoutMs((0, rules_1.loadSettings)(options.workDir).raw);
+      let lastProgressAt = Date.now();
+      let stalled = false;
+      const bumpProgress = () => {
+        lastProgressAt = Date.now();
+      };
+      const stallWatchdog = setInterval(() => {
+        if (Date.now() - lastProgressAt > subtaskTimeoutMs) {
+          stalled = true;
+          subAbort.aborted = true;
+        }
+      }, 1e3);
       const parentAbortPoll = setInterval(() => {
         if (options.abortSignal?.aborted)
           subAbort.aborted = true;
@@ -16213,6 +16460,27 @@ ${options.nexrallMd}` : "") : options.nexrallMd;
           _depth: depth + 1,
           _agentScope: `sub_${++_subTaskCounter}`,
           // isolated todo store per sub-agent
+          // ── Assigned UNCONDITIONALLY, never by conditional spread ────────────────
+          //
+          // These two were previously spread in only when set:
+          //
+          //   ...(agent && memoryScope ? { _agentMemory: … } : {}),
+          //
+          // which does NOT clear the key — it leaves whatever `...options` already had.
+          // So a child WITHOUT its own `memory:` inherited its PARENT's binding and would
+          // have appended to another agent's private notes; likewise an agent with no
+          // `tools:` line inherited the parent's allowlist, making the prompt's capability
+          // claim disagree with its real one.
+          //
+          // MAX_TASK_DEPTH === 1 means no nested spawn can reach this today, so it is
+          // latent rather than live — but the limiter comment below explicitly contemplates
+          // raising that depth, and this is exactly the kind of leak that would come back
+          // as a security bug rather than a visible error. Explicit undefined makes the
+          // child's identity independent of the parent's by construction.
+          _agentMemory: agent && memoryScope ? { agentName: agent.name, scope: memoryScope } : void 0,
+          // The same set `gatedPermission` enforces above, so prompt and permission agree
+          // by construction instead of by two people remembering to update both.
+          _allowedTools: allowed ?? void 0,
           editorContext: null,
           // fresh isolated context for sub-agent
           model: agent?.model ?? options.model,
@@ -16244,25 +16512,48 @@ ${options.nexrallMd}` : "") : options.nexrallMd;
           // Forward tool events with isSubTask=true so the UI can render a badge
           // instead of prepending "[sub-task]" to the tool name (which caused double-prefix
           // when the name was already labelled, and mixed display concerns into the data layer).
-          onToolUse: (n, i2) => options.onToolUse(n, i2, true),
-          onToolResult: (n, r2) => options.onToolResult(n, r2, true),
+          // Every tool event is PROGRESS: it proves the sub-agent is still doing work, which
+          // is what the stall watchdog above measures. Bumping on both use and result means a
+          // single very slow tool (a long test run) resets the clock when it starts AND when
+          // it finishes, so it cannot be mistaken for a hang.
+          onToolUse: (n, i2) => {
+            bumpProgress();
+            options.onToolUse(n, i2, true);
+          },
+          onToolResult: (n, r2) => {
+            bumpProgress();
+            options.onToolResult(n, r2, true);
+          },
           onToolStreamChunk: (n, c) => options.onToolStreamChunk?.(n, c, true),
           // Forward thinking so the UI shows the indicator while sub-agent reasons
-          onThinking: (text2) => options.onThinking?.(text2),
-          onThinkingDelta: (text2) => options.onThinkingDelta?.(text2),
-          onThinkingProgress: (tok) => options.onThinkingProgress?.(tok)
+          // Thinking is progress too — a model reasoning for minutes on a hard problem is
+          // working, not stalled. Without this, deep reasoning on an expensive tier would
+          // trip the watchdog precisely when the sub-agent was most valuable.
+          onThinking: (text2) => {
+            bumpProgress();
+            options.onThinking?.(text2);
+          },
+          onThinkingDelta: (text2) => {
+            bumpProgress();
+            options.onThinkingDelta?.(text2);
+          },
+          onThinkingProgress: (tok) => {
+            bumpProgress();
+            options.onThinkingProgress?.(tok);
+          }
         });
-        if (subAbort.aborted && !options.abortSignal?.aborted) {
-          const mins = Math.round(SUBTASK_TIMEOUT_MS / 6e4);
+        if (stalled && !options.abortSignal?.aborted) {
+          const mins = Math.round(subtaskTimeoutMs / 6e4);
           const partial = capSubTaskText(extractSubTaskText(result, false));
           const progress = summariseSubTaskProgress(result);
+          const partialId = (0, agentRegistry_1.rememberAgent)(agent?.name ?? null, typeof input.description === "string" && input.description.trim() || prompt2.slice(0, 80), result);
           const sections = [
-            `Sub-task STOPPED after ${mins} minutes without completing \u2014 treat the following as PARTIAL, unverified work, not a finished answer.`,
+            `Sub-task STOPPED after ${mins} minutes with NO PROGRESS (it was not making tool calls or producing output) \u2014 treat everything below as PARTIAL, unverified work, not a finished answer.`,
             progress,
             partial ? `Partial output before it was stopped:
 
 ${partial}` : "",
-            "Do NOT simply re-run the same sub-task: build on what is above, or split the remaining work into smaller, more focused sub-tasks."
+            `Do NOT re-run the same sub-task from scratch. Either build on what is above, or continue THIS run with resume_agent_id="${partialId}" (it still has everything it read), or split the remaining work into smaller, more focused sub-tasks.`
           ].filter(Boolean);
           return { error: sections.join("\n\n") };
         }
@@ -16291,7 +16582,7 @@ ${partial}` : "",
         }
         return { error: `Sub-task failed: ${err.message}` };
       } finally {
-        clearTimeout(timer);
+        clearInterval(stallWatchdog);
         clearInterval(parentAbortPoll);
       }
     }
@@ -16805,7 +17096,22 @@ ${options.nexrallMd}` : "") : options.nexrallMd;
               nexrallMd: planAwareNexrallMd,
               clientType: options.clientType,
               abortSignal: options.abortSignal,
-              extraTools: options.mcpManager?.getAnthropicTools(),
+              // MCP tools, plus the per-agent memory tool when (and only when) this run
+              // is a sub-agent that declared a `memory:` scope. Declaring it through
+              // extraTools rather than the backend's static catalogue keeps it invisible
+              // to every other run: a tool the model cannot see is one it cannot try,
+              // which is better than advertising it everywhere and refusing it at the gate.
+              extraTools: [
+                ...options.mcpManager?.getAnthropicTools() ?? [],
+                ...options._agentMemory ? [exports.AGENT_MEMORY_TOOL_SCHEMA] : []
+              ],
+              // Derived from the run's ACTUAL allowlist rather than asserted separately,
+              // so the prompt's memory instructions cannot drift from what is permitted.
+              // That drift is the bug being fixed: sub-agents were told they MUST call
+              // memory_write, which no sub-agent allowlist contains.
+              canWriteSharedMemory: options._allowedTools ? options._allowedTools.has("memory_write") : true,
+              // no allowlist = main agent = may write
+              hasOwnAgentStore: !!options._agentMemory,
               agents: agentsCatalogue || void 0,
               skills: skillsCatalogue || void 0,
               // Only allow a post-render restart when the caller actually implements the
@@ -16956,6 +17262,11 @@ ${options.nexrallMd}` : "") : options.nexrallMd;
                 result = { error: `Blocked by PreToolUse hook: ${pre.reason}` };
               } else {
                 try {
+                  if (name === exports.AGENT_MEMORY_TOOL) {
+                    result = await executeAgentMemoryWrite(input, options._agentMemory, options.workDir);
+                    options.onToolResult(name, result);
+                    return { block: { ...block, id }, result };
+                  }
                   const external = options.executeExternalTool ? await options.executeExternalTool(name, input) : null;
                   if (external !== null && external !== void 0) {
                     result = external;
@@ -64038,7 +64349,7 @@ var InkReadlineAdapter = class extends EventEmitter3 {
 };
 
 // src/commands/chat.ts
-var CLI_VERSION = "0.5.53";
+var CLI_VERSION = "0.5.55";
 var MODEL_LABELS = {
   turbo: "Nexrall Turbo",
   pro: "Nexrall Pro",
@@ -65705,7 +66016,7 @@ function pluginSourceRemoveCommand(name, opts) {
 
 // src/index.ts
 var program2 = new Command();
-program2.name("nex").description("Nexrall Code \u2014 AI coding assistant (powered by Nexrall)").version("0.5.53").enablePositionalOptions();
+program2.name("nex").description("Nexrall Code \u2014 AI coding assistant (powered by Nexrall)").version("0.5.55").enablePositionalOptions();
 program2.command("auth").description("Login to your Nexrall account").action(authCommand);
 program2.command("logout").description("Log out of your Nexrall account").action(logoutCommand);
 program2.command("update").description("Update nex to the latest version").option("-c, --check", "Check for updates without installing").option("-y, --yes", "Skip confirmation prompt").action(async (opts) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexrall-code",
-  "version": "0.5.53",
+  "version": "0.5.55",
   "description": "Nexrall Code — AI coding assistant for your terminal (headless agent for scripts, CI and automation)",
   "keywords": [
     "ai",
@@ -41,7 +41,7 @@
     "react": "^19.2.8",
     "readline": "^1.3.0",
     "string-width": "^7.2.0",
-    "@nexrall/code-core": "1.4.28"
+    "@nexrall/code-core": "1.4.30"
   },
   "devDependencies": {
     "@aws-sdk/client-s3": "^3.600.0",