nexrall-code 0.5.57 → 0.5.60

package/dist/index.js

@@ -9982,7 +9982,7 @@ var require_client = __commonJS({
     }
     var MAX_TOTAL_ATTEMPTS = (MAX_RETRIES + 1) * (MAX_RETRIES + 1);
     async function streamChat(messages, options, onEvent) {
-      const { model, env: env3, editorContext, nexrallMd, mode, effort, clientType, abortSignal, extraTools, agents, skills, allowRestartAfterRender, canWriteSharedMemory, hasOwnAgentStore } = options;
+      const { model, env: env3, editorContext, nexrallMd, mode, effort, clientType, abortSignal, extraTools, agents, skills, allowRestartAfterRender, canWriteSharedMemory, hasOwnAgentStore, canSpawnSubAgents } = options;
       let turnId = (0, crypto_1.randomUUID)();
       const controller = new AbortController();
       if (abortSignal?.aborted)
@@ -10023,7 +10023,7 @@ var require_client = __commonJS({
           {
             method: "POST",
             headers: authHeaders(),
-            body: JSON.stringify({ messages, model, env: env3, editorContext, nexrallMd, mode, effort, clientType, extraTools, agents, skills, turnId, canWriteSharedMemory, hasOwnAgentStore }),
+            body: JSON.stringify({ messages, model, env: env3, editorContext, nexrallMd, mode, effort, clientType, extraTools, agents, skills, turnId, canWriteSharedMemory, hasOwnAgentStore, canSpawnSubAgents }),
             signal: controller.signal
           }
         ];
@@ -12663,6 +12663,34 @@ ${doc}` : sig || "No type information." };
   }
 });
 
+// ../core/dist/util/safeSlice.js
+var require_safeSlice = __commonJS({
+  "../core/dist/util/safeSlice.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.sliceSafeEnd = sliceSafeEnd;
+    exports.sliceSafeStart = sliceSafeStart;
+    function sliceSafeEnd(s2, max) {
+      if (s2.length <= max)
+        return s2;
+      let end = max;
+      const code = s2.charCodeAt(end - 1);
+      if (code >= 55296 && code <= 56319)
+        end--;
+      return s2.slice(0, end);
+    }
+    function sliceSafeStart(s2, from) {
+      if (from <= 0)
+        return s2;
+      let start = from;
+      const code = s2.charCodeAt(start);
+      if (code >= 56320 && code <= 57343)
+        start++;
+      return s2.slice(start);
+    }
+  }
+});
+
 // ../core/dist/tools/executor.js
 var require_executor = __commonJS({
   "../core/dist/tools/executor.js"(exports) {
@@ -12731,6 +12759,7 @@ var require_executor = __commonJS({
     var client_1 = require_client();
     var symbols_1 = require_symbols();
     var tsLangService_1 = require_tsLangService();
+    var safeSlice_1 = require_safeSlice();
     var DEFAULT_TIMEOUT_MS = 6e4;
     var MAX_FETCH_BYTES = 200 * 1024;
     var MAX_READ_BYTES = 500 * 1024;
@@ -13024,7 +13053,7 @@ Resolve the conflict (remove <<<<<<< / ======= / >>>>>>> markers and keep the in
         }
         let output = lines.join("\n");
         if (output.length > MAX_OUTPUT_CHARS) {
-          output = output.slice(0, MAX_OUTPUT_CHARS) + `
+          output = (0, safeSlice_1.sliceSafeEnd)(output, MAX_OUTPUT_CHARS) + `
 [Truncated \u2014 ${entries.length} total entries]`;
         }
         return { output };
@@ -13496,7 +13525,7 @@ Update these call-sites (or restore the symbol), then run a build/typecheck to c
             return { output: "No matching files found." };
           let out = matches.join("\n");
           if (out.length > MAX_OUTPUT_CHARS)
-            out = out.slice(0, MAX_OUTPUT_CHARS) + "\n[Truncated]";
+            out = (0, safeSlice_1.sliceSafeEnd)(out, MAX_OUTPUT_CHARS) + "\n[Truncated]";
           return { output: out };
         } else {
           const SEARCH_MAX_BUFFER = 64 * 1024 * 1024;
@@ -13566,7 +13595,7 @@ ${globalCapMatches(output)}` : "";
 [Showing first ${GLOBAL_MATCH_CAP} of ${lines.length} matched lines \u2014 narrow the pattern/path for the rest.]`;
       }
       if (capped.length > MAX_OUTPUT_CHARS) {
-        capped = capped.slice(0, MAX_OUTPUT_CHARS);
+        capped = (0, safeSlice_1.sliceSafeEnd)(capped, MAX_OUTPUT_CHARS);
         note = `
 [Output truncated at ${MAX_OUTPUT_CHARS / 1024}KB.]`;
       }
@@ -14102,7 +14131,7 @@ ${d}`).join("\n") + xfile + sec
           return { output: `No files matched pattern: ${pattern}` };
         let out = matches.join("\n");
         if (out.length > MAX_OUTPUT_CHARS)
-          out = out.slice(0, MAX_OUTPUT_CHARS) + "\n[Truncated]";
+          out = (0, safeSlice_1.sliceSafeEnd)(out, MAX_OUTPUT_CHARS) + "\n[Truncated]";
         return { output: `${matches.length} file(s) matched "${pattern}":
 ${out}` };
       } catch (err) {
@@ -14158,7 +14187,7 @@ ${lines.join("\n")}`;
       switch (out.output_type) {
         case "stream": {
           const txt = nbJoin(out.text ?? "");
-          lines.push(`[${out.name === "stderr" ? "stderr" : "stdout"}] ${txt.slice(0, 3e3)}${txt.length > 3e3 ? "\n[truncated]" : ""}`);
+          lines.push(`[${out.name === "stderr" ? "stderr" : "stdout"}] ${(0, safeSlice_1.sliceSafeEnd)(txt, 3e3)}${txt.length > 3e3 ? "\n[truncated]" : ""}`);
           break;
         }
         case "execute_result":
@@ -14168,9 +14197,9 @@ ${lines.join("\n")}`;
           const html = d["text/html"] ? nbJoin(d["text/html"]) : null;
           const hasImg = "image/png" in d || "image/jpeg" in d || "image/svg+xml" in d;
           if (plain)
-            lines.push(plain.slice(0, 2e3) + (plain.length > 2e3 ? "\n[truncated]" : ""));
+            lines.push((0, safeSlice_1.sliceSafeEnd)(plain, 2e3) + (plain.length > 2e3 ? "\n[truncated]" : ""));
           else if (html)
-            lines.push(stripHtml(html).slice(0, 1e3));
+            lines.push((0, safeSlice_1.sliceSafeEnd)(stripHtml(html), 1e3));
           if (hasImg)
             lines.push("[image output \u2014 not shown in text mode]");
           break;
@@ -14179,7 +14208,7 @@ ${lines.join("\n")}`;
           lines.push(`[error] ${out.ename ?? "Error"}: ${out.evalue ?? ""}`);
           if (out.traceback) {
             const clean = out.traceback.map((l) => l.replace(/\x1b\[[0-9;]*[mGKH]/g, "")).join("\n");
-            lines.push(clean.slice(0, 1500) + (clean.length > 1500 ? "\n[truncated]" : ""));
+            lines.push((0, safeSlice_1.sliceSafeEnd)(clean, 1500) + (clean.length > 1500 ? "\n[truncated]" : ""));
           }
           break;
         }
@@ -14222,7 +14251,7 @@ ${lines.join("\n")}`;
         });
         let output = lines.join("\n");
         if (output.length > MAX_OUTPUT_CHARS) {
-          output = output.slice(0, MAX_OUTPUT_CHARS) + "\n\n[Notebook output truncated at 100KB]";
+          output = (0, safeSlice_1.sliceSafeEnd)(output, MAX_OUTPUT_CHARS) + "\n\n[Notebook output truncated at 100KB]";
         }
         return { output };
       } catch (err) {
@@ -14733,9 +14762,17 @@ var require_agentTypes = __commonJS({
         //
         // `tools` is deliberately UNDEFINED, which means "no allowlist" — full access,
         // inheriting whatever the session permits. That is the same power an unnamed
-        // sub-task always had; naming it changes only who can see and deny it. The safety
-        // properties elsewhere still apply: plan mode is inherited, the user's permission
-        // gate still runs on every call, and it cannot spawn further sub-agents.
+        // sub-task always had; naming it changes only who can see and deny it.
+        //
+        // It also makes this the ONLY builtin that can nest, since every specialist omits
+        // `task` on purpose. So the tree this enables is up to `maxSubagentDepth` generations
+        // of unrestricted agents — accepted deliberately, because the alternative (a catch-all
+        // that cannot delegate) removes the one agent suited to orchestration.
+        //
+        // The safety properties that bound it: plan mode is inherited, the user's permission
+        // gate runs on every call, a child's allowlist is INTERSECTED with its parent's so a
+        // restricted ancestor cannot be escaped through this agent, `test_files_only` is
+        // likewise sticky, and both the depth ceiling and the session budget still apply.
         name: "general-purpose",
         description: "General-purpose worker for a multi-step task that needs BOTH exploration and changes (edit files, run commands) and that no specialist above fits. Inherits the session model and full tool access, so prefer a narrower agent when one matches.",
         prompt: "You are a general-purpose engineering sub-agent. Work the task end to end: explore what you need, make the changes, and verify them with the project's own build/test commands.\n\nRules:\n- Mirror existing conventions; make the smallest correct change.\n- Verify before you claim success. If you could not verify, say so explicitly.\n- Your FINAL MESSAGE is the only thing that reaches the main agent: state what you changed (with file paths), what you ran and its outcome, and anything you deliberately left undone.",
@@ -15061,6 +15098,13 @@ var require_agentTypes = __commonJS({
               message: `lists unknown tool name(s): ${unknown.join(", ")}. An allowlist only grants, so these silently do nothing and the agent cannot use them. Tool names are lower_snake_case (read_file, search_files, glob, bash).`
             });
           }
+          if ((tools ?? []).length === 1 && tools?.[0] === "task") {
+            warnings.push({
+              file: full,
+              agent: name,
+              message: "lists `task` as its ONLY tool, so it can delegate but cannot read, write or run anything itself \u2014 it has no way to do or verify work. Add the tools it needs, or drop the `tools:` line to inherit its parent's."
+            });
+          }
           const strayKeys = Object.keys(meta).filter((k) => !KNOWN_META_KEYS.has(k));
           if (strayKeys.length) {
             warnings.push({
@@ -15697,10 +15741,12 @@ var require_agentRegistry = __commonJS({
     Object.defineProperty(exports, "__esModule", { value: true });
     exports._limits = void 0;
     exports.rememberAgent = rememberAgent;
+    exports.canResume = canResume;
     exports.updateAgent = updateAgent;
     exports.getAgent = getAgent;
     exports.listAgents = listAgents;
     exports._resetAgentRegistry = _resetAgentRegistry;
+    var node_crypto_1 = __require("node:crypto");
     var MAX_AGENTS = 20;
     var MAX_TOTAL_BYTES = 8 * 1024 * 1024;
     var _agents = /* @__PURE__ */ new Map();
@@ -15733,12 +15779,13 @@ var require_agentRegistry = __commonJS({
         return MAX_TOTAL_BYTES;
       }
     }
-    function rememberAgent(agentName, description, messages) {
-      const id = `agent_${++_counter}`;
+    function rememberAgent(agentName, description, messages, ownerScope = "root") {
+      const id = `agent_${++_counter}_${(0, node_crypto_1.randomUUID)().slice(0, 8)}`;
       const now = Date.now();
       _agents.set(id, {
         id,
         agentName,
+        ownerScope,
         description,
         messages,
         createdAt: now,
@@ -15749,10 +15796,15 @@ var require_agentRegistry = __commonJS({
       evictUntilWithinLimits();
       return id;
     }
-    function updateAgent(id, messages) {
+    function canResume(stored, scope) {
+      return stored.ownerScope === scope || scope === "root";
+    }
+    function updateAgent(id, messages, scope = "root") {
       const existing = _agents.get(id);
       if (!existing)
         return;
+      if (!canResume(existing, scope))
+        return;
       existing.messages = messages;
       existing.updatedAt = Date.now();
       existing.seq = ++_seq;
@@ -15961,8 +16013,15 @@ var require_loop = __commonJS({
     exports.resolveMaxIterations = resolveMaxIterations;
     exports.lockPathsFor = lockPathsFor;
     exports.resolveMaxConcurrentSubtasks = resolveMaxConcurrentSubtasks;
+    exports.resolveMaxSubagentsPerSession = resolveMaxSubagentsPerSession;
     exports.createLimiter = createLimiter;
     exports._resetSubTaskLimiter = _resetSubTaskLimiter;
+    exports.resetSessionSubAgentBudget = resetSessionSubAgentBudget2;
+    exports._sessionSubAgentCount = _sessionSubAgentCount;
+    exports.resolveMaxSubagentDepth = resolveMaxSubagentDepth;
+    exports.noSpawnReason = noSpawnReason;
+    exports.intersectAllowlists = intersectAllowlists;
+    exports.canSpawnSubAgents = canSpawnSubAgents;
     exports.resolveSubtaskTimeoutMs = resolveSubtaskTimeoutMs;
     exports.extractSubTaskText = extractSubTaskText;
     exports.capSubTaskText = capSubTaskText;
@@ -16000,6 +16059,7 @@ var require_loop = __commonJS({
     var flaky_1 = require_flaky();
     var claimEvidence_1 = require_claimEvidence();
     var memory_1 = require_memory();
+    var safeSlice_1 = require_safeSlice();
     var fs9 = __importStar(__require("fs"));
     var path6 = __importStar(__require("path"));
     var child_process_1 = __require("child_process");
@@ -16234,7 +16294,7 @@ ${ctx.repeatError}
     }
     var DEFAULT_MAX_CONCURRENT_SUBTASKS = 4;
     function resolveMaxConcurrentSubtasks(settingsRaw = {}) {
-      const clamp = (n) => Math.min(Math.floor(n), 16);
+      const clamp = (n) => Math.max(1, Math.min(Math.floor(n), 16));
       const fromEnv = Number(process.env.NEXRALL_MAX_CONCURRENT_SUBTASKS);
       if (Number.isFinite(fromEnv) && fromEnv > 0)
         return clamp(fromEnv);
@@ -16243,6 +16303,17 @@ ${ctx.repeatError}
         return clamp(fromSettings);
       return DEFAULT_MAX_CONCURRENT_SUBTASKS;
     }
+    var DEFAULT_MAX_SUBAGENTS_PER_SESSION = 100;
+    function resolveMaxSubagentsPerSession(settingsRaw = {}) {
+      const floor = (n) => Math.max(1, Math.min(Math.floor(n), 1e4));
+      const fromEnv = Number(process.env.NEXRALL_MAX_SUBAGENTS_PER_SESSION);
+      if (Number.isFinite(fromEnv) && fromEnv > 0)
+        return floor(fromEnv);
+      const fromSettings = Number(settingsRaw.maxSubagentsPerSession);
+      if (Number.isFinite(fromSettings) && fromSettings > 0)
+        return floor(fromSettings);
+      return DEFAULT_MAX_SUBAGENTS_PER_SESSION;
+    }
     function createLimiter(max) {
       let active = 0;
       const queue = [];
@@ -16261,19 +16332,61 @@ ${ctx.repeatError}
         }
       };
     }
-    var _subTaskLimitInstance = null;
+    var _subTaskLimiters = /* @__PURE__ */ new Map();
+    var _subTaskLimitMaxByDepth = /* @__PURE__ */ new Map();
     var _subTaskLimitMax = 0;
-    var _inFlightSubTasks = 0;
-    function subTaskLimiter(workDir) {
-      if (!_subTaskLimitInstance) {
+    var _inFlightByDepth = /* @__PURE__ */ new Map();
+    function subTaskLimiter(depth, workDir) {
+      if (!_subTaskLimitMax) {
         _subTaskLimitMax = resolveMaxConcurrentSubtasks(workDir ? (0, rules_1.loadSettings)(workDir).raw : {});
-        _subTaskLimitInstance = createLimiter(_subTaskLimitMax);
       }
-      return { run: _subTaskLimitInstance, max: _subTaskLimitMax };
+      let run = _subTaskLimiters.get(depth);
+      let max = _subTaskLimitMaxByDepth.get(depth) ?? 0;
+      if (!run) {
+        max = Math.max(1, Math.ceil(_subTaskLimitMax / 2 ** Math.max(0, depth - 1)));
+        run = createLimiter(max);
+        _subTaskLimiters.set(depth, run);
+        _subTaskLimitMaxByDepth.set(depth, max);
+      }
+      return { run, max };
     }
     function _resetSubTaskLimiter() {
-      _subTaskLimitInstance = null;
+      _subTaskLimiters.clear();
+      _subTaskLimitMaxByDepth.clear();
+      _inFlightByDepth.clear();
       _subTaskLimitMax = 0;
+      _subAgentsThisSession = 0;
+      _sessionCapMax = 0;
+      _sessionCapNotified = false;
+    }
+    var _subAgentsThisSession = 0;
+    var _sessionCapMax = 0;
+    var _sessionCapNotified = false;
+    function resetSessionSubAgentBudget2() {
+      _subAgentsThisSession = 0;
+      _sessionCapMax = 0;
+      _sessionCapNotified = false;
+    }
+    function claimSessionSubAgentSlot(workDir, notify) {
+      if (!_sessionCapMax) {
+        _sessionCapMax = resolveMaxSubagentsPerSession(workDir ? (0, rules_1.loadSettings)(workDir).raw : {});
+      }
+      if (_subAgentsThisSession >= _sessionCapMax) {
+        if (!_sessionCapNotified) {
+          _sessionCapNotified = true;
+          notify?.(`\u26A0\uFE0F Sub-agent budget reached (${_sessionCapMax} this session) \u2014 further delegation is blocked and the agent will continue without it. Raise "maxSubagentsPerSession" in .nexrall/settings.json if this was legitimate work.`);
+        }
+        return `Sub-agent budget for this session is exhausted (${_sessionCapMax} started). This is a runaway-delegation guard, not a per-task limit: do the remaining work directly, and say in your final message that you hit the delegation cap.`;
+      }
+      _subAgentsThisSession++;
+      return null;
+    }
+    function refundSessionSubAgentSlot() {
+      if (_subAgentsThisSession > 0)
+        _subAgentsThisSession--;
+    }
+    function _sessionSubAgentCount() {
+      return _subAgentsThisSession;
     }
     function humanDescription(name, input) {
       switch (name) {
@@ -16356,7 +16469,36 @@ ${ctx.repeatError}
           return `Use tool: ${name}`;
       }
     }
-    var MAX_TASK_DEPTH = 1;
+    var DEFAULT_MAX_TASK_DEPTH = 3;
+    var HARD_MAX_TASK_DEPTH = 5;
+    function resolveMaxSubagentDepth(settingsRaw = {}) {
+      const clamp = (n) => Math.max(1, Math.min(Math.floor(n), HARD_MAX_TASK_DEPTH));
+      const fromEnv = Number(process.env.NEXRALL_MAX_SUBAGENT_DEPTH);
+      if (Number.isFinite(fromEnv) && fromEnv > 0)
+        return clamp(fromEnv);
+      const fromSettings = Number(settingsRaw.maxSubagentDepth);
+      if (Number.isFinite(fromSettings) && fromSettings > 0)
+        return clamp(fromSettings);
+      return DEFAULT_MAX_TASK_DEPTH;
+    }
+    function noSpawnReason(kind, limit) {
+      if (kind === "denied") {
+        return "This sub-agent's definition does not grant `task`, so it may not delegate. That is a deliberate restriction on this agent type \u2014 do not ask for approval and do not look for a way around it. Do the work with the tools you have, or report back what is missing.";
+      }
+      return `Maximum sub-agent nesting depth (${limit ?? DEFAULT_MAX_TASK_DEPTH}) reached, so this run is a leaf and cannot delegate further. Depth is a budget, not a bug: finish this work yourself, or report back so a shallower frame can decide. (The ceiling is "maxSubagentDepth" in .nexrall/settings.json, but raising it mid-task will not help you \u2014 it applies from the next session.)`;
+    }
+    function intersectAllowlists(own, parent) {
+      if (own && parent)
+        return new Set([...own].filter((t2) => parent.has(t2)));
+      if (own)
+        return own;
+      return parent ? new Set(parent) : null;
+    }
+    function canSpawnSubAgents(depth, allowedTools, limit = DEFAULT_MAX_TASK_DEPTH) {
+      if (depth >= limit)
+        return false;
+      return allowedTools ? allowedTools.has("task") : true;
+    }
     var _subTaskCounter = 0;
     var DEFAULT_SUBTASK_TIMEOUT_MS = 10 * 60 * 1e3;
     function resolveSubtaskTimeoutMs(settingsRaw) {
@@ -16377,24 +16519,6 @@ ${ctx.repeatError}
       }
     };
     exports.ToolNotAllowedError = ToolNotAllowedError;
-    function sliceSafeEnd(s2, max) {
-      if (s2.length <= max)
-        return s2;
-      let end = max;
-      const code = s2.charCodeAt(end - 1);
-      if (code >= 55296 && code <= 56319)
-        end--;
-      return s2.slice(0, end);
-    }
-    function sliceSafeStart(s2, from) {
-      if (from <= 0)
-        return s2;
-      let start = from;
-      const code = s2.charCodeAt(start);
-      if (code >= 56320 && code <= 57343)
-        start++;
-      return s2.slice(start);
-    }
     function extractSubTaskText(messages, preferLast = true) {
       const assistants = messages.filter((m2) => m2.role === "assistant");
       const textOf = (m2) => (m2?.content ?? []).filter((b) => b.type === "text" && typeof b.text === "string").map((b) => b.text).join("").trim();
@@ -16405,8 +16529,8 @@ ${ctx.repeatError}
     function capSubTaskText(text, max = SUBTASK_MAX) {
       if (text.length <= max)
         return text;
-      const head = sliceSafeEnd(text, Math.floor(max * 0.6));
-      const tail = sliceSafeStart(text, text.length - Math.floor(max * 0.4));
+      const head = (0, safeSlice_1.sliceSafeEnd)(text, Math.floor(max * 0.6));
+      const tail = (0, safeSlice_1.sliceSafeStart)(text, text.length - Math.floor(max * 0.4));
       return `${head}
 
 [\u2026 sub-task output truncated (${text.length} chars) \u2014 kept the beginning and end \u2026]
@@ -16462,7 +16586,7 @@ ${recentFindings}` : header;
           if (!text)
             continue;
           const name = nameById.get(String(b.tool_use_id ?? "")) ?? "tool";
-          const body = text.length > maxChars ? `${sliceSafeEnd(text, maxChars)}
+          const body = text.length > maxChars ? `${(0, safeSlice_1.sliceSafeEnd)(text, maxChars)}
 \u2026 [truncated]` : text;
           out.push(`\u2022 ${name}:
 ${body}`);
@@ -16479,29 +16603,35 @@ ${body}`);
       }
       return "";
     }
-    async function runSubTask(input, options, agentTypes) {
+    async function runSubTask(input, options, agentTypes, started) {
       const prompt2 = typeof input.prompt === "string" ? input.prompt.trim() : "";
       if (!prompt2)
         return { error: "task tool requires a non-empty prompt" };
+      const agentScope = options._agentScope ?? "root";
       const depth = options._depth ?? 0;
-      if (depth >= MAX_TASK_DEPTH) {
-        return { error: "Sub-agents cannot spawn further sub-agents. Do this work directly, or report back so the main agent can delegate it." };
+      const depthLimit = resolveMaxSubagentDepth(options.workDir ? (0, rules_1.loadSettings)(options.workDir).raw : {});
+      if (depth >= depthLimit) {
+        return { error: noSpawnReason("depth", depthLimit) };
       }
       const resumeId = typeof input.resume_agent_id === "string" ? input.resume_agent_id.trim() : "";
       const resumed = resumeId ? (0, agentRegistry_1.getAgent)(resumeId) : void 0;
+      if (resumed && !(0, agentRegistry_1.canResume)(resumed, agentScope)) {
+        return {
+          error: `No resumable sub-agent with id "${resumeId}" is available to this run. Start a fresh sub-task with a self-contained prompt instead.`
+        };
+      }
       if (resumeId && !resumed) {
         return {
           error: `No resumable sub-agent with id "${resumeId}". Ids live only for the current session and the oldest are dropped when too many accumulate, so this one has expired or never existed. Start a fresh sub-task with a self-contained prompt instead.`
         };
       }
       const requestedType = resumed ? resumed.agentName ?? "" : typeof input.subagent_type === "string" ? input.subagent_type : "";
-      if (requestedType) {
-        const decision = (0, rules_1.evaluatePermission)((0, rules_1.loadSettings)(options.workDir).permissions, "task", { subagent_type: requestedType }, options.workDir);
-        if (decision === "deny") {
-          return {
-            error: `The sub-agent "${requestedType}" is disabled by a permission rule in this project (permissions.deny in settings.json). This is a deliberate policy choice, not a missing file \u2014 do not create it and do not retry. Do the work yourself, or use a different sub-agent.`
-          };
-        }
+      const denyKey = requestedType || "general-purpose";
+      const decision = (0, rules_1.evaluatePermission)((0, rules_1.loadSettings)(options.workDir).permissions, "task", { subagent_type: denyKey }, options.workDir);
+      if (decision === "deny") {
+        return {
+          error: `The sub-agent "${denyKey}" is disabled by a permission rule in this project (permissions.deny in settings.json). This is a deliberate policy choice, not a missing file \u2014 do not create it and do not retry. Do the work yourself, or use a different sub-agent.`
+        };
       }
       let agent = (0, agentTypes_1.findAgentType)(agentTypes, requestedType);
       let knownTypes = agentTypes;
@@ -16529,18 +16659,31 @@ ${agentMemoryNotes}` : "") + (inheritedMd ? `
 ---
 
 ${inheritedMd}` : "") : options.nexrallMd;
-      const allowed = agent?.tools ? new Set(agent.tools) : null;
+      const testFilesOnly = !!agent?.testFilesOnly || !!options._testFilesOnly;
+      const allowed = intersectAllowlists(agent?.tools ? new Set(agent.tools) : null, options._allowedTools);
       if (allowed && memoryScope)
         allowed.add(exports.AGENT_MEMORY_TOOL);
       const gatedPermission = async (req) => {
         if (req.tool === exports.AGENT_MEMORY_TOOL && !(agent && memoryScope)) {
           throw new ToolNotAllowedError(`\`${exports.AGENT_MEMORY_TOOL}\` is only available to a sub-agent whose definition declares a \`memory:\` scope (project, user or local). Report anything worth remembering in your final message instead \u2014 the main agent decides what to persist.`);
         }
+        if (req.tool === "task" && !canSpawnSubAgents(depth + 1, allowed ?? void 0, depthLimit)) {
+          throw new ToolNotAllowedError(allowed && !allowed.has("task") ? noSpawnReason("denied") : noSpawnReason("depth", depthLimit));
+        }
         if (allowed && !allowed.has(req.tool)) {
-          throw new ToolNotAllowedError(`The "${agent.name}" sub-agent is not allowed to use \`${req.tool}\` \u2014 it is not in that agent's tool allowlist. This is a restriction of the agent definition, NOT a user decision: do not ask for approval, use one of the tools you do have, or report back that the task needs a different agent.`);
+          throw new ToolNotAllowedError(
+            // `agent?.name`, NOT `agent!.name`. The non-null assertion held only while `allowed`
+            // was derived solely from `agent?.tools` (non-null allowlist ⇒ named agent). The
+            // parent-intersection broke that invariant: a RESTRICTED parent dispatching `task`
+            // with no subagent_type yields a non-null inherited allowlist with `agent`
+            // undefined, and this line then threw a TypeError instead of ToolNotAllowedError —
+            // which the dispatch site does not recognise, so it laundered the refusal into the
+            // generic "Permission denied by user" this very message exists to avoid.
+            `The "${agent?.name ?? "general-purpose"}" sub-agent is not allowed to use \`${req.tool}\` \u2014 it is not in that agent's tool allowlist. This is a restriction of the agent definition, NOT a user decision: do not ask for approval, use one of the tools you do have, or report back that the task needs a different agent.`
+          );
         }
-        if (agent?.testFilesOnly && !allowsTestOnlyWrite(req.tool, req.input)) {
-          throw new ToolNotAllowedError(`The "${agent.name}" sub-agent may only write to TEST files, so \`${req.tool}\` was refused for this path. Do not try to work around it: if production code must change, say so in your report instead.`);
+        if (testFilesOnly && !allowsTestOnlyWrite(req.tool, req.input)) {
+          throw new ToolNotAllowedError(`The "${agent?.name ?? "general-purpose"}" sub-agent may only write to TEST files, so \`${req.tool}\` was refused for this path. Do not try to work around it: if production code must change, say so in your report instead.`);
         }
         return options.requestPermission(req);
       };
@@ -16563,6 +16706,8 @@ ${inheritedMd}` : "") : options.nexrallMd;
           subAbort.aborted = true;
       }, 250);
       try {
+        if (started)
+          started.value = true;
         const result = await runAgentLoop2(subMessages, {
           ...options,
           _depth: depth + 1,
@@ -16580,15 +16725,21 @@ ${inheritedMd}` : "") : options.nexrallMd;
           // `tools:` line inherited the parent's allowlist, making the prompt's capability
           // claim disagree with its real one.
           //
-          // MAX_TASK_DEPTH === 1 means no nested spawn can reach this today, so it is
-          // latent rather than live — but the limiter comment below explicitly contemplates
-          // raising that depth, and this is exactly the kind of leak that would come back
-          // as a security bug rather than a visible error. Explicit undefined makes the
-          // child's identity independent of the parent's by construction.
+          // This is now LIVE, not latent: nesting is enabled by default, so a grandchild really
+          // can be spawned by an agent that has a memory binding. The explicit `undefined` is
+          // what stops it inheriting that binding and appending to its grandparent's private
+          // notes — a silent cross-agent write rather than a visible error. Note the allowlist
+          // takes the opposite direction on purpose (inherited, because it RESTRICTS); identity
+          // must not be inherited, capability must.
           _agentMemory: agent && memoryScope ? { agentName: agent.name, scope: memoryScope } : void 0,
           // The same set `gatedPermission` enforces above, so prompt and permission agree
           // by construction instead of by two people remembering to update both.
           _allowedTools: allowed ?? void 0,
+          // Propagated so a grandchild inherits it too — see _testFilesOnly. Assigned
+          // unconditionally (not by conditional spread) for the same reason as _agentMemory
+          // above: a conditional spread leaves the parent's value in place instead of clearing
+          // it, and here that direction is at least safe, whereas forgetting to propagate is not.
+          _testFilesOnly: testFilesOnly,
           editorContext: null,
           // fresh isolated context for sub-agent
           model: agent?.model ?? options.model,
@@ -16654,7 +16805,7 @@ ${inheritedMd}` : "") : options.nexrallMd;
           const mins = Math.round(subtaskTimeoutMs / 6e4);
           const partial = capSubTaskText(extractSubTaskText(result, false));
           const progress = summariseSubTaskProgress(result);
-          const partialId = (0, agentRegistry_1.rememberAgent)(agent?.name ?? null, typeof input.description === "string" && input.description.trim() || prompt2.slice(0, 80), result);
+          const partialId = (0, agentRegistry_1.rememberAgent)(agent?.name ?? null, typeof input.description === "string" && input.description.trim() || prompt2.slice(0, 80), result, agentScope);
           const sections = [
             `Sub-task STOPPED after ${mins} minutes with NO PROGRESS (it was not making tool calls or producing output) \u2014 treat everything below as PARTIAL, unverified work, not a finished answer.`,
             progress,
@@ -16666,7 +16817,7 @@ ${partial}` : "",
           return { error: sections.join("\n\n") };
         }
         const text = capSubTaskText(extractSubTaskText(result, true));
-        const agentId = resumed ? ((0, agentRegistry_1.updateAgent)(resumed.id, result), resumed.id) : (0, agentRegistry_1.rememberAgent)(agent?.name ?? null, typeof input.description === "string" && input.description.trim() || prompt2.slice(0, 80), result);
+        const agentId = resumed ? ((0, agentRegistry_1.updateAgent)(resumed.id, result, agentScope), resumed.id) : (0, agentRegistry_1.rememberAgent)(agent?.name ?? null, typeof input.description === "string" && input.description.trim() || prompt2.slice(0, 80), result, agentScope);
         const body = text || "(sub-task completed with no text output)";
         return {
           output: `${body}
@@ -16771,11 +16922,11 @@ ${partial}` : "",
       for (const m2 of messages) {
         for (const b of m2.content) {
           if (b.type === "text" && b.text) {
-            parts.push(`${m2.role.toUpperCase()}: ${b.text.slice(0, 2e3)}`);
+            parts.push(`${m2.role.toUpperCase()}: ${(0, safeSlice_1.sliceSafeEnd)(b.text, 2e3)}`);
           } else if (b.type === "tool_use") {
-            parts.push(`${m2.role.toUpperCase()} [tool: ${b.name}]: ${JSON.stringify(b.input ?? {}).slice(0, 400)}`);
+            parts.push(`${m2.role.toUpperCase()} [tool: ${b.name}]: ${(0, safeSlice_1.sliceSafeEnd)(JSON.stringify(b.input ?? {}), 400)}`);
           } else if (b.type === "tool_result") {
-            parts.push(`TOOL RESULT: ${String(b.content ?? "").slice(0, 600)}`);
+            parts.push(`TOOL RESULT: ${(0, safeSlice_1.sliceSafeEnd)(String(b.content ?? ""), 600)}`);
           }
         }
       }
@@ -16784,8 +16935,8 @@ ${partial}` : "",
         return full;
       const headBudget = Math.floor(MAX_TRANSCRIPT_CHARS * 0.4);
       const tailBudget = MAX_TRANSCRIPT_CHARS - headBudget;
-      const head = full.slice(0, headBudget);
-      const tail = full.slice(full.length - tailBudget);
+      const head = (0, safeSlice_1.sliceSafeEnd)(full, headBudget);
+      const tail = (0, safeSlice_1.sliceSafeStart)(full, full.length - tailBudget);
       const dropped = full.length - head.length - tail.length;
       return `${head}
 
@@ -17070,7 +17221,9 @@ Continue the work from here.` }] });
       const agentScope = options._agentScope ?? "root";
       const settings = (0, rules_1.loadSettings)(options.workDir);
       const agentTypes = (0, agentTypes_1.loadAgentTypes)(options.workDir).filter((t2) => (0, rules_1.evaluatePermission)(settings.permissions, "task", { subagent_type: t2.name }, options.workDir) !== "deny");
-      const agentsCatalogue = depth === 0 ? (0, agentTypes_1.summariseAgents)(agentTypes) : "";
+      const depthLimit = resolveMaxSubagentDepth(settings.raw);
+      const maySpawn = canSpawnSubAgents(depth, options._allowedTools, depthLimit);
+      const agentsCatalogue = maySpawn ? (0, agentTypes_1.summariseAgents)(agentTypes) : "";
       const skillsCatalogue = (0, skills_1.summariseSkills)((0, skills_1.loadSkills)(options.workDir));
       const planAwareNexrallMd = options.planMode ? planMode_1.PLAN_MODE_INSTRUCTIONS + (options.nexrallMd ? `
 
@@ -17220,6 +17373,9 @@ ${options.nexrallMd}` : "") : options.nexrallMd;
               canWriteSharedMemory: options._allowedTools ? options._allowedTools.has("memory_write") : true,
               // no allowlist = main agent = may write
               hasOwnAgentStore: !!options._agentMemory,
+              // Withholds the `task` schema and its instructions when this run cannot
+              // delegate — see canSpawnSubAgents.
+              canSpawnSubAgents: maySpawn,
               agents: agentsCatalogue || void 0,
               skills: skillsCatalogue || void 0,
               // Only allow a post-render restart when the caller actually implements the
@@ -17363,19 +17519,29 @@ ${options.nexrallMd}` : "") : options.nexrallMd;
             if (!permitted) {
               result = { error: deniedReason ?? "Permission denied by user" };
             } else if (name === "task") {
-              if (depth === 0) {
-                const { run: limitRun, max: limitMax } = subTaskLimiter(options.workDir);
-                if (_inFlightSubTasks >= limitMax) {
-                  (options.onNotice ?? options.onText)(`\u23F3 Queued: ${limitMax} sub-agents are already running, so this one starts when a slot frees up (raise "maxConcurrentSubtasks" in .nexrall/settings.json to widen it).`);
+              const overBudget = claimSessionSubAgentSlot(options.workDir, options.onNotice ?? options.onText);
+              if (overBudget) {
+                result = { error: overBudget };
+              } else {
+                const childDepth = depth + 1;
+                const { run: limitRun, max: limitMax } = subTaskLimiter(childDepth, options.workDir);
+                const inFlight = _inFlightByDepth.get(childDepth) ?? 0;
+                if (inFlight >= limitMax) {
+                  (options.onNotice ?? options.onText)(`\u23F3 Queued: ${limitMax} sub-agent(s) already running at this level, so this one starts when a slot frees up (raise "maxConcurrentSubtasks" in .nexrall/settings.json to widen it).`);
                 }
-                _inFlightSubTasks++;
+                _inFlightByDepth.set(childDepth, inFlight + 1);
+                const started = { value: false };
                 try {
-                  result = await limitRun(() => runSubTask(input, options, agentTypes));
+                  result = await limitRun(() => runSubTask(input, options, agentTypes, started));
                 } finally {
-                  _inFlightSubTasks--;
+                  if (!started.value)
+                    refundSessionSubAgentSlot();
+                  const n = (_inFlightByDepth.get(childDepth) ?? 1) - 1;
+                  if (n > 0)
+                    _inFlightByDepth.set(childDepth, n);
+                  else
+                    _inFlightByDepth.delete(childDepth);
                 }
-              } else {
-                result = await runSubTask(input, options, agentTypes);
               }
             } else {
               const pre = runToolHooks(hooks.PreToolUse, "PreToolUse", name, input, options.workDir);
@@ -64351,7 +64517,7 @@ function TrustPrompt({ workDir, signals, onDecide }) {
       decide(false);
       return;
     }
-    if (key.return || input === "\r" || input === "\n") {
+    if (key.return || /[\r\n]/.test(input)) {
       decide(indexRef.current === 0);
     }
   });
@@ -64554,7 +64720,7 @@ var InkReadlineAdapter = class extends EventEmitter3 {
 };
 
 // src/commands/chat.ts
-var CLI_VERSION = "0.5.57";
+var CLI_VERSION = "0.5.60";
 var MODEL_LABELS = {
   turbo: "Nexrall Turbo",
   pro: "Nexrall Pro",
@@ -65137,6 +65303,9 @@ Set ${TRUST_ENV_VAR}=1 to confirm non-interactively, or run \`nex\` interactivel
       process.stdout.write("Not trusted \u2014 exiting without loading this folder.\n");
       process.exit(0);
     }
+    await new Promise((resolve3) => setImmediate(resolve3));
+    if (process.stdin.isTTY)
+      process.stdin.setRawMode(true);
   }
   const env3 = collectEnv(workDir);
   const nexrallMd = readNexrallMd(workDir);
@@ -65366,6 +65535,7 @@ ${text}` : "");
           messages = [];
           sessionId = crypto.randomBytes(8).toString("hex");
           sessionTitle = "";
+          (0, import_code_core4.resetSessionSubAgentBudget)();
           console.log(source_default.dim("  Conversation cleared. New session started."));
           rl.prompt();
           return;
@@ -66225,7 +66395,7 @@ function pluginSourceRemoveCommand(name, opts) {
 
 // src/index.ts
 var program2 = new Command();
-program2.name("nex").description("Nexrall Code \u2014 AI coding assistant (powered by Nexrall)").version("0.5.57").enablePositionalOptions();
+program2.name("nex").description("Nexrall Code \u2014 AI coding assistant (powered by Nexrall)").version("0.5.60").enablePositionalOptions();
 program2.command("auth").description("Login to your Nexrall account").action(authCommand);
 program2.command("logout").description("Log out of your Nexrall account").action(logoutCommand);
 program2.command("update").description("Update nex to the latest version").option("-c, --check", "Check for updates without installing").option("-y, --yes", "Skip confirmation prompt").action(async (opts) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexrall-code",
-  "version": "0.5.57",
+  "version": "0.5.60",
   "description": "Nexrall Code — AI coding assistant for your terminal (headless agent for scripts, CI and automation)",
   "keywords": [
     "ai",
@@ -31,7 +31,15 @@
   "engines": {
     "node": ">=18"
   },
+  "scripts": {
+    "build": "node build.js",
+    "dev": "tsx src/index.ts",
+    "start": "node dist/index.js",
+    "test": "tsc --noEmit && tsc --noEmit -p test/tsconfig.json && node --import tsx --test test/*.test.ts test/*.test.mts",
+    "release": "node build.js && node scripts/upload-release.cjs"
+  },
   "dependencies": {
+    "@nexrall/code-core": "workspace:*",
     "chalk": "^5.3.0",
     "commander": "^12.0.0",
     "diff": "^5.2.0",
@@ -40,8 +48,7 @@
     "prompts": "^2.4.2",
     "react": "^19.2.8",
     "readline": "^1.3.0",
-    "string-width": "^7.2.0",
-    "@nexrall/code-core": "1.4.32"
+    "string-width": "^7.2.0"
   },
   "devDependencies": {
     "@aws-sdk/client-s3": "^3.600.0",
@@ -52,12 +59,5 @@
     "esbuild": "^0.20.0",
     "tsx": "^4.7.0",
     "typescript": "^6.0.3"
-  },
-  "scripts": {
-    "build": "node build.js",
-    "dev": "tsx src/index.ts",
-    "start": "node dist/index.js",
-    "test": "tsc --noEmit && tsc --noEmit -p test/tsconfig.json && node --import tsx --test test/*.test.ts test/*.test.mts",
-    "release": "node build.js && node scripts/upload-release.cjs"
   }
-}
+}