nexrall-code 0.5.61 → 0.5.63

package/dist/index.js

@@ -3160,8 +3160,8 @@ var require_auth = __commonJS({
     exports.updateTokens = updateTokens;
     var fs9 = __importStar(__require("fs"));
     var path6 = __importStar(__require("path"));
-    var os6 = __importStar(__require("os"));
-    var CONFIG_DIR = path6.join(os6.homedir(), ".nexrall");
+    var os5 = __importStar(__require("os"));
+    var CONFIG_DIR = path6.join(os5.homedir(), ".nexrall");
     var CONFIG_FILE = path6.join(CONFIG_DIR, "config.json");
     function ensureConfigDir() {
       if (!fs9.existsSync(CONFIG_DIR)) {
@@ -10677,7 +10677,7 @@ var require_sandbox = __commonJS({
     exports.parseSandboxConfig = parseSandboxConfig;
     exports.wrapCommandForSandbox = wrapCommandForSandbox;
     var child_process_1 = __require("child_process");
-    var os6 = __importStar(__require("os"));
+    var os5 = __importStar(__require("os"));
     function parseSandboxConfig(raw) {
       if (raw === void 0 || raw === null || raw === false || raw === "off")
         return null;
@@ -10722,9 +10722,9 @@ var require_sandbox = __commonJS({
       return lines.join("\n");
     }
     function wrapCommandForSandbox(command, workDir, cfg) {
-      const platform3 = os6.platform();
+      const platform3 = os5.platform();
       if (platform3 === "darwin") {
-        const writePaths = Array.from(/* @__PURE__ */ new Set([workDir, "/tmp", "/private/tmp", "/private/var/folders", os6.tmpdir(), ...cfg.writePaths]));
+        const writePaths = Array.from(/* @__PURE__ */ new Set([workDir, "/tmp", "/private/tmp", "/private/var/folders", os5.tmpdir(), ...cfg.writePaths]));
         const profile = buildSeatbeltProfile(writePaths, cfg.network);
         return {
           command: `sandbox-exec -p ${shQuote(profile)} /bin/sh -c ${shQuote(command)}`,
@@ -11026,10 +11026,10 @@ var require_memory = __commonJS({
     exports.agentMemoryPreamble = agentMemoryPreamble;
     exports.compactMemoryIfNeeded = compactMemoryIfNeeded2;
     var fs9 = __importStar(__require("fs"));
-    var os6 = __importStar(__require("os"));
+    var os5 = __importStar(__require("os"));
     var path6 = __importStar(__require("path"));
     var crypto2 = __importStar(__require("crypto"));
-    var MEMORY_ROOT = process.env.NEXRALL_MEMORY_DIR || path6.join(os6.homedir(), ".nexrall", "memory");
+    var MEMORY_ROOT = process.env.NEXRALL_MEMORY_DIR || path6.join(os5.homedir(), ".nexrall", "memory");
     var GLOBAL_FILE = path6.join(MEMORY_ROOT, "global.md");
     function memoryFilePath(scope, workDir) {
       if (scope === "global" || !workDir)
@@ -11285,7 +11285,7 @@ var require_plugins = __commonJS({
     exports.pluginMcpServers = pluginMcpServers;
     var fs9 = __importStar(__require("fs"));
     var path6 = __importStar(__require("path"));
-    var os6 = __importStar(__require("os"));
+    var os5 = __importStar(__require("os"));
     exports.FILE_CANDIDATES = {
       manifest: ["plugin.json", path6.join(".claude-plugin", "plugin.json")],
       hooks: ["hooks.json", path6.join("hooks", "hooks.json")],
@@ -11345,7 +11345,7 @@ var require_plugins = __commonJS({
     function loadPlugins3(workDir) {
       const out = /* @__PURE__ */ new Map();
       scanRoot(path6.join(workDir, ".nexrall", "plugins"), "project", out);
-      scanRoot(path6.join(os6.homedir(), ".nexrall", "plugins"), "global", out);
+      scanRoot(path6.join(os5.homedir(), ".nexrall", "plugins"), "global", out);
       return [...out.values()];
     }
     function pluginAssetDirs(workDir, kind) {
@@ -11454,7 +11454,7 @@ var require_loader = __commonJS({
     exports.expandCommand = expandCommand;
     var fs9 = __importStar(__require("fs"));
     var path6 = __importStar(__require("path"));
-    var os6 = __importStar(__require("os"));
+    var os5 = __importStar(__require("os"));
     var child_process_1 = __require("child_process");
     var index_1 = require_plugins();
     var BUILTIN_COMMANDS = [
@@ -11535,7 +11535,7 @@ var require_loader = __commonJS({
     function loadSlashCommands(workDir) {
       const out = /* @__PURE__ */ new Map();
       loadDir(path6.join(workDir, ".nexrall", "commands"), "project", out);
-      loadDir(path6.join(os6.homedir(), ".nexrall", "commands"), "global", out);
+      loadDir(path6.join(os5.homedir(), ".nexrall", "commands"), "global", out);
       for (const dir of (0, index_1.pluginAssetDirs)(workDir, "commands"))
         loadDir(dir, "plugin", out);
       for (const cmd of BUILTIN_COMMANDS) {
@@ -11647,7 +11647,7 @@ var require_skills = __commonJS({
     exports.expandSkill = expandSkill2;
     var fs9 = __importStar(__require("fs"));
     var path6 = __importStar(__require("path"));
-    var os6 = __importStar(__require("os"));
+    var os5 = __importStar(__require("os"));
     var index_1 = require_plugins();
     var loader_1 = require_loader();
     function parseFrontmatter(raw) {
@@ -11778,8 +11778,8 @@ var require_skills = __commonJS({
       const out = /* @__PURE__ */ new Map();
       loadFlatCommandDir(path6.join(workDir, ".nexrall", "commands"), "project", out);
       loadSkillDir(path6.join(workDir, ".nexrall", "skills"), "project", out);
-      loadFlatCommandDir(path6.join(os6.homedir(), ".nexrall", "commands"), "global", out);
-      loadSkillDir(path6.join(os6.homedir(), ".nexrall", "skills"), "global", out);
+      loadFlatCommandDir(path6.join(os5.homedir(), ".nexrall", "commands"), "global", out);
+      loadSkillDir(path6.join(os5.homedir(), ".nexrall", "skills"), "global", out);
       for (const dir of (0, index_1.pluginAssetDirs)(workDir, "commands"))
         loadFlatCommandDir(dir, "plugin", out);
       for (const dir of (0, index_1.pluginAssetDirs)(workDir, "skills"))
@@ -12743,7 +12743,7 @@ var require_executor = __commonJS({
     exports.executeTool = executeTool;
     var fs9 = __importStar(__require("fs"));
     var path6 = __importStar(__require("path"));
-    var os6 = __importStar(__require("os"));
+    var os5 = __importStar(__require("os"));
     var https3 = __importStar(__require("https"));
     var http3 = __importStar(__require("http"));
     var dns = __importStar(__require("dns"));
@@ -12769,7 +12769,7 @@ var require_executor = __commonJS({
     var READ_CHARS_PER_TOKEN = 4;
     var MAX_READ_CHARS = MAX_READ_TOKENS * READ_CHARS_PER_TOKEN;
     var MAX_SPILL_BYTES = 20 * 1024 * 1024;
-    var SPILL_DIR = path6.join(os6.tmpdir(), "nexrall-code", "bash-output");
+    var SPILL_DIR = path6.join(os5.tmpdir(), "nexrall-code", "bash-output");
     var BLOCKED_REGEXES = [
       // Filesystem destruction — match rm/chmod with any whitespace between flags.
       // Only root itself and BARE top-level system dirs are blocked; ordinary
@@ -13919,6 +13919,19 @@ ${diff3}${xfile}${sec}` };
         return false;
       return m2.slice(1).every((o) => Number(o) <= 255);
     }
+    function fetchBlocklistCheck(parsedUrl) {
+      const raw = process.env.NEXRALL_FETCH_BLOCKLIST;
+      if (!raw)
+        return null;
+      const host = parsedUrl.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+      const entries = raw.split(",").map((s2) => s2.trim().toLowerCase()).filter(Boolean);
+      for (const entry of entries) {
+        if (host === entry || host.endsWith(`.${entry}`)) {
+          return `Refusing to fetch "${host}" \u2014 blocked by NEXRALL_FETCH_BLOCKLIST (matched "${entry}").`;
+        }
+      }
+      return null;
+    }
     async function fetchUrl(input, _workDir2, _redirectCount = 0) {
       const url = typeof input.url === "string" ? input.url : "";
       if (!url)
@@ -13935,6 +13948,9 @@ ${diff3}${xfile}${sec}` };
       if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") {
         return { error: `Unsupported protocol: ${parsedUrl.protocol}. Only http and https are supported.` };
       }
+      const blocklistError = fetchBlocklistCheck(parsedUrl);
+      if (blocklistError)
+        return { error: blocklistError };
       const ssrfError = await ssrfCheck(parsedUrl);
       if (ssrfError)
         return { error: ssrfError };
@@ -14682,7 +14698,7 @@ var require_agentTypes = __commonJS({
     exports.findAgentType = findAgentType;
     var fs9 = __importStar(__require("fs"));
     var path6 = __importStar(__require("path"));
-    var os6 = __importStar(__require("os"));
+    var os5 = __importStar(__require("os"));
     var index_1 = require_plugins();
     var VALID_MEMORY_SCOPES = ["project", "user", "local"];
     function parseMemoryScope(v) {
@@ -15167,7 +15183,7 @@ var require_agentTypes = __commonJS({
       const out = /* @__PURE__ */ new Map();
       const warnings = [];
       loadDir(path6.join(workDir, ".nexrall", "agents"), "project", out, warnings);
-      loadDir(path6.join(os6.homedir(), ".nexrall", "agents"), "global", out, warnings);
+      loadDir(path6.join(os5.homedir(), ".nexrall", "agents"), "global", out, warnings);
       for (const dir of (0, index_1.pluginAssetDirs)(workDir, "agents"))
         loadDir(dir, "plugin", out, warnings);
       for (const agent of BUILTIN_AGENTS) {
@@ -15275,7 +15291,7 @@ var require_rules = __commonJS({
     exports.evaluatePermission = evaluatePermission2;
     var fs9 = __importStar(__require("fs"));
     var path6 = __importStar(__require("path"));
-    var os6 = __importStar(__require("os"));
+    var os5 = __importStar(__require("os"));
     function managedSettingsPath() {
       if (process.platform === "darwin")
         return "/Library/Application Support/Nexrall/managed-settings.json";
@@ -15298,7 +15314,7 @@ var require_rules = __commonJS({
     function loadSettings2(workDir) {
       const tiers = [
         managedSettingsPath(),
-        path6.join(os6.homedir(), ".nexrall", "settings.json"),
+        path6.join(os5.homedir(), ".nexrall", "settings.json"),
         path6.join(workDir, ".nexrall", "settings.json"),
         path6.join(workDir, ".nexrall", "settings.local.json")
       ];
@@ -16879,7 +16895,15 @@ ${partial}` : "",
       "gpt-5.4": 922e3,
       "gpt-5.4-mini": 272e3,
       "gpt-4.1": 1047576,
-      "gpt-4o-mini": 128e3
+      "gpt-4o-mini": 128e3,
+      // DeepSeek, by real model id (documented — see backend/services/providers/
+      // modelRegistry.js's own TODO(unverified-by-400): DeepSeek accepts an
+      // oversized max_completion_tokens without rejecting it, so there was no 400
+      // to measure the ceiling from the way the OpenAI rows above were).
+      "deepseek-v4-pro": 1048576,
+      "deepseek-v4-flash": 1048576,
+      // Qwen (DashScope), by real model id (documented max input, same caveat).
+      "qwen3.7-max": 991800
     };
     function contextWindowFor2(model) {
       return MODEL_CONTEXT_TOKENS[model ?? "turbo"] ?? 128e3;
@@ -18268,7 +18292,7 @@ var require_manager = __commonJS({
     exports.McpManager = void 0;
     var fs9 = __importStar(__require("fs"));
     var path6 = __importStar(__require("path"));
-    var os6 = __importStar(__require("os"));
+    var os5 = __importStar(__require("os"));
     var client_1 = require_client2();
     var httpClient_1 = require_httpClient();
     var sseClient_1 = require_sseClient();
@@ -18296,7 +18320,7 @@ var require_manager = __commonJS({
         } catch {
         }
         const locations = [
-          path6.join(os6.homedir(), ".nexrall", "mcp.json"),
+          path6.join(os5.homedir(), ".nexrall", "mcp.json"),
           path6.join(workDir, ".nexrall", "mcp.json")
         ];
         for (const loc of locations) {
@@ -18401,7 +18425,7 @@ var require_manager = __commonJS({
       // ─── Config file persistence (for the management UI) ──────────────────────────
       /** Path to an mcp.json for the given scope. */
       static configPath(workDir, scope) {
-        return scope === "user" ? path6.join(os6.homedir(), ".nexrall", "mcp.json") : path6.join(workDir, ".nexrall", "mcp.json");
+        return scope === "user" ? path6.join(os5.homedir(), ".nexrall", "mcp.json") : path6.join(workDir, ".nexrall", "mcp.json");
       }
       static readConfigFile(p) {
         try {
@@ -18503,7 +18527,7 @@ var require_manager2 = __commonJS({
     exports.isMutatingTool = isMutatingTool;
     exports.isPotentiallyMutatingBash = isPotentiallyMutatingBash;
     var fs9 = __importStar(__require("fs"));
-    var os6 = __importStar(__require("os"));
+    var os5 = __importStar(__require("os"));
     var path6 = __importStar(__require("path"));
     var crypto2 = __importStar(__require("crypto"));
     var child_process_1 = __require("child_process");
@@ -18562,7 +18586,7 @@ var require_manager2 = __commonJS({
         this.current = null;
         this.nextId = 1;
         const key = crypto2.createHash("sha1").update(path6.resolve(workDir) + "\0" + (scope ?? "")).digest("hex").slice(0, 16);
-        const base = process.env.NEXRALL_CHECKPOINT_DIR || path6.join(os6.homedir(), ".nexrall", "checkpoints");
+        const base = process.env.NEXRALL_CHECKPOINT_DIR || path6.join(os5.homedir(), ".nexrall", "checkpoints");
         this.storeDir = path6.join(base, key);
         this.loadFromDisk();
       }
@@ -18885,13 +18909,13 @@ var require_modePolicy = __commonJS({
         return "confirm";
       if (mode === "plan")
         return "deny";
-      if (req.bypass)
+      if (req.bypass || mode === "auto")
         return "allow";
       if (exports.FILE_WRITE_TOOLS.has(tool) || exports.FILE_MUTATE_TOOLS.has(tool)) {
         return mode === "ask" ? "ask" : "allow";
       }
       if (exports.BASH_TOOLS.has(tool)) {
-        return mode === "auto" ? "allow" : "ask";
+        return "ask";
       }
       return "ask";
     }
@@ -18904,7 +18928,7 @@ var require_modePolicy = __commonJS({
         case "edit":
           return "edit \u2014 edits files freely; asks before shell commands";
         case "auto":
-          return "auto \u2014 edits and runs commands; still confirms irreversible actions";
+          return "auto \u2014 runs every tool on its own; still confirms irreversible actions";
       }
     }
     function parseMode2(raw) {
@@ -19168,7 +19192,7 @@ var require_sources = __commonJS({
     exports.sourcesFileFor = sourcesFileFor2;
     var fs9 = __importStar(__require("fs"));
     var path6 = __importStar(__require("path"));
-    var os6 = __importStar(__require("os"));
+    var os5 = __importStar(__require("os"));
     function managedSettingsPath() {
       if (process.platform === "darwin")
         return "/Library/Application Support/Nexrall/managed-settings.json";
@@ -19219,7 +19243,7 @@ var require_sources = __commonJS({
     function loadDeclaredSources2(workDir, opts = {}) {
       const out = /* @__PURE__ */ new Map();
       collect(managedSettingsPath(), "managed", out);
-      collect(path6.join(os6.homedir(), ".nexrall", "settings.json"), "user", out);
+      collect(path6.join(os5.homedir(), ".nexrall", "settings.json"), "user", out);
       if (opts.includeProject) {
         collect(path6.join(workDir, ".nexrall", "settings.json"), "project", out);
         collect(path6.join(workDir, ".nexrall", "settings.local.json"), "project", out);
@@ -19274,7 +19298,7 @@ var require_sources = __commonJS({
       return true;
     }
     function sourcesFileFor2(scope, workDir) {
-      return scope === "user" ? path6.join(os6.homedir(), ".nexrall", "settings.json") : path6.join(workDir, ".nexrall", "settings.json");
+      return scope === "user" ? path6.join(os5.homedir(), ".nexrall", "settings.json") : path6.join(workDir, ".nexrall", "settings.json");
     }
   }
 });
@@ -19339,7 +19363,7 @@ var require_installer = __commonJS({
     exports.updatePlugin = updatePlugin2;
     var fs9 = __importStar(__require("fs"));
     var path6 = __importStar(__require("path"));
-    var os6 = __importStar(__require("os"));
+    var os5 = __importStar(__require("os"));
     var child_process_1 = __require("child_process");
     var client_1 = require_client();
     var index_1 = require_plugins();
@@ -19378,7 +19402,7 @@ var require_installer = __commonJS({
       if (!raw)
         throw new Error("Empty plugin source.");
       if (raw.startsWith("./") || raw.startsWith("../") || raw.startsWith("/") || raw.startsWith("~/")) {
-        const abs = path6.resolve(raw.replace(/^~(?=\/)/, os6.homedir()));
+        const abs = path6.resolve(raw.replace(/^~(?=\/)/, os5.homedir()));
         return { kind: "local", repo: abs, raw };
       }
       let rest = raw;
@@ -19506,7 +19530,7 @@ var require_installer = __commonJS({
       }
     }
     function pluginsRoot(scope, workDir) {
-      return scope === "project" ? path6.join(workDir || process.cwd(), ".nexrall", "plugins") : path6.join(os6.homedir(), ".nexrall", "plugins");
+      return scope === "project" ? path6.join(workDir || process.cwd(), ".nexrall", "plugins") : path6.join(os5.homedir(), ".nexrall", "plugins");
     }
     async function installPlugin2(spec, opts = {}) {
       const source2 = parsePluginSource2(spec);
@@ -19515,7 +19539,7 @@ var require_installer = __commonJS({
       if (patterns && source2.kind === "github" && !(0, sources_1.isSourceAllowed)(source2.raw, patterns)) {
         throw new Error(`Blocked by your organisation's policy: plugins may only be installed from ${patterns.join(", ")}.`);
       }
-      const tmpBase = fs9.mkdtempSync(path6.join(os6.tmpdir(), "nexrall-plugin-"));
+      const tmpBase = fs9.mkdtempSync(path6.join(os5.tmpdir(), "nexrall-plugin-"));
       try {
         let repoRoot;
         if (source2.kind === "local") {
@@ -54131,7 +54155,7 @@ function stopSpinner(handle2) {
 import * as readline3 from "readline";
 import * as path4 from "path";
 import * as fs8 from "fs";
-import * as os5 from "os";
+import * as os4 from "os";
 import * as crypto from "crypto";
 import { execSync } from "child_process";
 var import_code_core3 = __toESM(require_dist2(), 1);
@@ -55385,51 +55409,28 @@ function lastSession() {
 import * as fs4 from "fs";
 import * as https2 from "https";
 import * as path2 from "path";
-import * as os3 from "os";
-var API_LATEST = "https://api.nexrall.com/api/code/cli/latest";
-var CDN_BASE = "https://cli.nexrall.com";
+import { fileURLToPath } from "url";
+var __dirname = path2.dirname(fileURLToPath(import.meta.url));
+var NPM_REGISTRY_LATEST = "https://registry.npmjs.org/nexrall-code/latest";
 function get2(url) {
   return new Promise((resolve3, reject) => {
-    https2.get(url, { headers: { "User-Agent": "nexrall-cli-updater" } }, (res) => {
+    https2.get(url, { headers: { "User-Agent": "nexrall-cli-updater", Accept: "application/json" } }, (res) => {
       if (res.statusCode === 301 || res.statusCode === 302) {
         return get2(res.headers.location).then(resolve3).catch(reject);
       }
+      if (res.statusCode !== 200) {
+        res.resume();
+        return reject(new Error(`npm registry returned HTTP ${res.statusCode}`));
+      }
       let raw = "";
       res.on("data", (c) => raw += c.toString());
       res.on("end", () => resolve3(raw));
     }).on("error", reject);
   });
 }
-function download(url, dest) {
-  return new Promise((resolve3, reject) => {
-    const doGet = (u) => {
-      https2.get(u, { headers: { "User-Agent": "nexrall-cli-updater" } }, (res) => {
-        if (res.statusCode === 301 || res.statusCode === 302) {
-          return doGet(res.headers.location);
-        }
-        if (res.statusCode !== 200) {
-          return reject(new Error(`Download failed: HTTP ${res.statusCode}`));
-        }
-        const tmpPath = dest + ".tmp";
-        const file = fs4.createWriteStream(tmpPath);
-        res.pipe(file);
-        file.on("finish", () => {
-          file.close();
-          fs4.renameSync(tmpPath, dest);
-          resolve3();
-        });
-        file.on("error", (err) => {
-          fs4.unlinkSync(tmpPath);
-          reject(err);
-        });
-      }).on("error", reject);
-    };
-    doGet(url);
-  });
-}
 function getCurrentVersion() {
   try {
-    const pkg = path2.resolve(__dirname, "../../package.json");
+    const pkg = path2.resolve(__dirname, "../package.json");
     return JSON.parse(fs4.readFileSync(pkg, "utf-8")).version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -55446,8 +55447,31 @@ function semverGt(a, b) {
   }
   return false;
 }
-function currentBinaryPath() {
-  return process.argv[1] ?? "";
+async function fetchLatestVersion() {
+  const raw = await get2(NPM_REGISTRY_LATEST);
+  const meta = JSON.parse(raw);
+  return meta.version ?? "0.0.0";
+}
+function npmInstallGlobal() {
+  return new Promise((resolve3) => {
+    const { spawn } = __require("child_process");
+    const child = spawn("npm", ["install", "-g", "nexrall-code"], { stdio: "pipe" });
+    let stderr = "";
+    child.stderr?.on("data", (c) => {
+      stderr += c.toString();
+    });
+    child.on("close", (code) => {
+      if (code === 0)
+        return resolve3({ ok: true, usedSudo: false });
+      if (/EACCES|permission denied/i.test(stderr)) {
+        const sudo = spawn("sudo", ["npm", "install", "-g", "nexrall-code"], { stdio: "inherit" });
+        sudo.on("close", (sudoCode) => resolve3({ ok: sudoCode === 0, usedSudo: true }));
+      } else {
+        console.error(source_default.dim(stderr.trim()));
+        resolve3({ ok: false, usedSudo: false });
+      }
+    });
+  });
 }
 async function updateCommand(opts) {
   const current = getCurrentVersion();
@@ -55457,17 +55481,15 @@ async function updateCommand(opts) {
   console.log(source_default.dim(`  Current version: v${current}`));
   console.log();
   process.stdout.write(source_default.dim("  \u2192 Checking latest version\u2026"));
-  let meta;
+  let latest;
   try {
-    meta = JSON.parse(await get2(API_LATEST));
+    latest = await fetchLatestVersion();
     process.stdout.write("\r\x1B[K");
   } catch (e2) {
     process.stdout.write("\r\x1B[K");
-    console.error(source_default.red("  \u2717 Could not reach update server: ") + String(e2.message));
+    console.error(source_default.red("  \u2717 Could not reach npm registry: ") + String(e2.message));
     process.exit(1);
   }
-  const latest = meta.version ?? "0.0.0";
-  const binaryUrl = `${CDN_BASE}/nex`;
   if (!semverGt(latest, current)) {
     console.log(source_default.green(`  \u2713 Already up to date \u2014 v${current}`));
     console.log();
@@ -55497,70 +55519,15 @@ async function updateCommand(opts) {
     }
     console.log();
   }
-  const tmpFile = path2.join(os3.tmpdir(), `nex_update_${Date.now()}`);
-  process.stdout.write(source_default.dim("  \u2192 Downloading\u2026"));
-  try {
-    await download(binaryUrl, tmpFile);
-    fs4.chmodSync(tmpFile, 493);
-    process.stdout.write("\r\x1B[K");
-    console.log(source_default.dim(`  \u2713 Downloaded v${latest}`));
-  } catch (e2) {
-    process.stdout.write("\r\x1B[K");
-    console.error(source_default.red("  \u2717 Download failed: ") + String(e2.message));
-    try {
-      fs4.unlinkSync(tmpFile);
-    } catch {
-    }
+  process.stdout.write(source_default.dim(`  \u2192 Running npm install -g nexrall-code\u2026`));
+  const { ok, usedSudo } = await npmInstallGlobal();
+  process.stdout.write("\r\x1B[K");
+  if (!ok) {
+    console.error(source_default.red("  \u2717 Update failed. Run manually:"));
+    console.error(source_default.dim("  npm install -g nexrall-code"));
     process.exit(1);
   }
-  const binPath = currentBinaryPath();
-  if (!binPath || !fs4.existsSync(binPath)) {
-    const fallbacks = ["/usr/local/bin/nex", `${os3.homedir()}/.local/bin/nex`];
-    const found = fallbacks.find((p) => fs4.existsSync(p));
-    if (!found) {
-      console.log(source_default.yellow("  \u26A0  Could not locate nex binary to replace."));
-      console.log(source_default.dim(`  Downloaded binary is at: ${tmpFile}`));
-      console.log(source_default.dim("  Move it manually: sudo mv " + tmpFile + " /usr/local/bin/nex"));
-      return;
-    }
-    try {
-      fs4.copyFileSync(tmpFile, found);
-      fs4.chmodSync(found, 493);
-      console.log(source_default.green(`  \u2713 Updated \u2192 ${found}`));
-    } catch {
-      console.log(source_default.yellow(`  \u26A0  No write permission to ${found}. Trying sudo\u2026`));
-      const { spawnSync } = await import("child_process");
-      const r2 = spawnSync("sudo", ["cp", tmpFile, found], { stdio: "inherit" });
-      if (r2.status !== 0) {
-        console.error(source_default.red("  \u2717 Update failed. Run manually:"));
-        console.error(source_default.dim(`  sudo cp ${tmpFile} ${found} && sudo chmod +x ${found}`));
-        process.exit(1);
-      }
-      spawnSync("sudo", ["chmod", "+x", found], { stdio: "inherit" });
-      console.log(source_default.green(`  \u2713 Updated \u2192 ${found}`));
-    }
-  } else {
-    try {
-      fs4.copyFileSync(tmpFile, binPath);
-      fs4.chmodSync(binPath, 493);
-      console.log(source_default.green(`  \u2713 Updated \u2192 ${binPath}`));
-    } catch {
-      const { spawnSync } = await import("child_process");
-      console.log(source_default.yellow(`  \u26A0  No write permission. Trying sudo\u2026`));
-      const r2 = spawnSync("sudo", ["cp", tmpFile, binPath], { stdio: "inherit" });
-      if (r2.status !== 0) {
-        console.error(source_default.red("  \u2717 Update failed. Run manually:"));
-        console.error(source_default.dim(`  sudo cp ${tmpFile} ${binPath} && sudo chmod +x ${binPath}`));
-        process.exit(1);
-      }
-      spawnSync("sudo", ["chmod", "+x", binPath], { stdio: "inherit" });
-      console.log(source_default.green(`  \u2713 Updated \u2192 ${binPath}`));
-    }
-  }
-  try {
-    fs4.unlinkSync(tmpFile);
-  } catch {
-  }
+  console.log(source_default.green(`  \u2713 Updated \u2192 v${latest}${usedSudo ? " (via sudo)" : ""}`));
   console.log();
   console.log(source_default.bold(`  Nexrall CLI v${latest} installed!`));
   console.log(source_default.dim("  Restart your terminal or run: exec $SHELL"));
@@ -55957,7 +55924,7 @@ __export(base_exports, {
   synchronizedOutput: () => synchronizedOutput
 });
 import process3 from "node:process";
-import os4 from "node:os";
+import os3 from "node:os";
 
 // ../../node_modules/.pnpm/environment@1.1.0/node_modules/environment/index.js
 var isBrowser = globalThis.window?.document !== void 0;
@@ -56056,7 +56023,7 @@ var isOldWindows = () => {
   if (isBrowser || !isWindows2) {
     return false;
   }
-  const parts = os4.release().split(".");
+  const parts = os3.release().split(".");
   const major = Number(parts[0]);
   const build = Number(parts[2] ?? 0);
   if (major < 10) {
@@ -64751,7 +64718,7 @@ var InkReadlineAdapter = class extends EventEmitter3 {
 };
 
 // src/commands/chat.ts
-var CLI_VERSION = "0.5.61";
+var CLI_VERSION = "0.5.63";
 var MODEL_LABELS = {
   "claude-sonnet-5": "Claude Sonnet 5",
   "claude-opus-5": "Claude Opus 5",
@@ -64759,7 +64726,10 @@ var MODEL_LABELS = {
   "claude-haiku-4-5-20251001": "Claude Haiku 4.5",
   "gpt-5.4": "GPT-5.4",
   "gpt-5.4-mini": "GPT-5.4 Mini",
-  "gpt-4.1": "GPT-4.1"
+  "gpt-4.1": "GPT-4.1",
+  "deepseek-v4-pro": "DeepSeek V4 Pro",
+  "deepseek-v4-flash": "DeepSeek V4 Flash",
+  "qwen3.7-max": "Qwen3.7 Max"
 };
 var LEGACY_MODEL_ALIASES = {
   turbo: "claude-sonnet-5",
@@ -64775,7 +64745,10 @@ var SELECTABLE_MODELS = [
   "claude-fable-5",
   "gpt-5.4",
   "gpt-5.4-mini",
-  "gpt-4.1"
+  "gpt-4.1",
+  "deepseek-v4-pro",
+  "deepseek-v4-flash",
+  "qwen3.7-max"
 ];
 function normaliseModelId(model) {
   const raw = (model ?? "").trim();
@@ -64813,7 +64786,7 @@ function printBalanceNotice(balance, zero) {
 }
 function currentUserLabel() {
   try {
-    const u = os5.userInfo().username;
+    const u = os4.userInfo().username;
     return u ? u.charAt(0).toUpperCase() + u.slice(1) : "there";
   } catch {
     return "there";
@@ -64822,7 +64795,7 @@ function currentUserLabel() {
 function collectEnv(workDir) {
   return {
     cwd: workDir,
-    platform: `${os5.platform()} ${os5.release()}`,
+    platform: `${os4.platform()} ${os4.release()}`,
     shell: process.env.SHELL ?? process.env.ComSpec ?? "unknown",
     date: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10),
     gitBranch: tryExec("git branch --show-current", workDir),
@@ -64849,7 +64822,7 @@ function readNexrallMd(workDir) {
   const memContent = (0, import_code_core3.readAllMemory)(workDir);
   if (memContent)
     parts.push(memContent);
-  const globalContent = tryRead(path4.join(os5.homedir(), ".nexrall", "nexrall.md"));
+  const globalContent = tryRead(path4.join(os4.homedir(), ".nexrall", "nexrall.md"));
   if (globalContent)
     parts.push(`[Global instructions]
 ${globalContent}`);
@@ -66454,7 +66427,7 @@ function pluginSourceRemoveCommand(name, opts) {
 
 // src/index.ts
 var program2 = new Command();
-program2.name("nex").description("Nexrall Code \u2014 AI coding assistant (powered by Nexrall)").version("0.5.61").enablePositionalOptions();
+program2.name("nex").description("Nexrall Code \u2014 AI coding assistant (powered by Nexrall)").version("0.5.63").enablePositionalOptions();
 program2.command("auth").description("Login to your Nexrall account").action(authCommand);
 program2.command("logout").description("Log out of your Nexrall account").action(logoutCommand);
 program2.command("update").description("Update nex to the latest version").option("-c, --check", "Check for updates without installing").option("-y, --yes", "Skip confirmation prompt").action(async (opts) => {

package/install.ps1

@@ -1,20 +1,20 @@
 # Nexrall Code CLI — Windows Installer
-# Usage: irm https://nexrall.com/install.ps1 | iex
+# Usage: irm https://cli.nexrall.com/install.ps1 | iex
 #
 # What it does:
-#   1. Check Node.js >= 18
-#   2. Download latest nex binary from Nexrall CDN
-#   3. Install to %LOCALAPPDATA%\nexrall-cli\nex.js
-#   4. Add to PATH via User environment variable
-#   5. Create nex.cmd wrapper so "nex" works in CMD + PowerShell
+#   1. Check Node.js >= 18 (npm ships with it)
+#   2. Install the `nex` package globally from the npm registry
+#
+# Why npm and not a hand-rolled CDN/binary download: npm's registry is
+# already the correct source of truth for "what is the latest version" —
+# `npm install -g nexrall-code` always resolves to the current `latest`
+# dist-tag with zero extra infrastructure to keep in sync. A previous
+# version of this script downloaded a binary from a custom CDN path whose
+# "latest version" metadata was a hardcoded backend fallback that had
+# drifted 5 months out of date — every install silently got a broken build.
 
 $ErrorActionPreference = 'Stop'
 
-$API_LATEST  = 'https://api.nexrall.com/api/code/cli/latest'
-$INSTALL_DIR = "$env:LOCALAPPDATA\nexrall-cli"
-$BINARY_JS   = "$INSTALL_DIR\nex.js"
-$WRAPPER_CMD = "$INSTALL_DIR\nex.cmd"
-
 Write-Host ""
 Write-Host "  Nexrall Code CLI — Installer" -ForegroundColor Cyan -NoNewline
 Write-Host ""
@@ -37,63 +37,29 @@ try {
   exit 1
 }
 
-# ── Fetch latest version ───────────────────────────────────────────────────────
-Write-Host "  →  Checking latest version…" -ForegroundColor DarkGray
-
-try {
-  $meta       = Invoke-RestMethod -Uri $API_LATEST -UseBasicParsing
-  $version    = $meta.version
-  $binaryUrl  = $meta.url
-} catch {
-  # Fallback
-  $version   = "latest"
-  $binaryUrl = "https://media.nexrall.com/cli/nex"
-}
-
-Write-Host "  →  Version: $version" -ForegroundColor DarkGray
-Write-Host "  →  Download: $binaryUrl" -ForegroundColor DarkGray
-
-# ── Download binary ───────────────────────────────────────────────────────────
-Write-Host "  →  Downloading…" -ForegroundColor DarkGray
-
-New-Item -ItemType Directory -Force -Path $INSTALL_DIR | Out-Null
-$TMP = "$env:TEMP\nex_tmp.js"
-
 try {
-  Invoke-WebRequest -Uri $binaryUrl -OutFile $TMP -UseBasicParsing
+  npm --version 2>$null | Out-Null
 } catch {
-  Write-Host "  ✗  Download failed: $_" -ForegroundColor Red
+  Write-Host "  ✗  npm not found (it normally ships with Node.js). Please reinstall Node.js from https://nodejs.org" -ForegroundColor Red
   exit 1
 }
 
-# Sanity check
-$checkOutput = node $TMP --version 2>&1
+# ── Install via npm ────────────────────────────────────────────────────────────
+Write-Host "  →  Installing nexrall-code (latest) from npm…" -ForegroundColor DarkGray
+
+npm install -g nexrall-code
 if ($LASTEXITCODE -ne 0) {
-  Remove-Item $TMP -Force
-  Write-Host "  ✗  Downloaded binary failed sanity check." -ForegroundColor Red
+  Write-Host "  ✗  npm install failed." -ForegroundColor Red
   exit 1
 }
+Write-Host "  ✓  Installed" -ForegroundColor Green
 
-# ── Install ───────────────────────────────────────────────────────────────────
-Move-Item $TMP $BINARY_JS -Force
-
-# Create nex.cmd wrapper so CMD/PowerShell can run "nex" directly
-$wrapperContent = "@echo off`r`nnode `"%~dp0nex.js`" %*"
-Set-Content -Path $WRAPPER_CMD -Value $wrapperContent -Encoding ASCII
-
-Write-Host "  ✓  Installed to $INSTALL_DIR" -ForegroundColor Green
-
-# ── Add to PATH ───────────────────────────────────────────────────────────────
-$userPath = [System.Environment]::GetEnvironmentVariable('PATH', 'User')
-if ($userPath -notlike "*$INSTALL_DIR*") {
-  [System.Environment]::SetEnvironmentVariable(
-    'PATH',
-    "$INSTALL_DIR;$userPath",
-    'User'
-  )
-  Write-Host "  ✓  Added to PATH (restart your terminal to apply)" -ForegroundColor Green
-} else {
-  Write-Host "  ✓  Already in PATH" -ForegroundColor Green
+# ── Sanity check ───────────────────────────────────────────────────────────────
+try {
+  $installedVersion = (nex --version 2>$null)
+  Write-Host "  ✓  $installedVersion" -ForegroundColor Green
+} catch {
+  Write-Host "  ⚠  'nex' installed but not found on PATH yet. Open a new terminal window." -ForegroundColor Yellow
 }
 
 # ── Done ──────────────────────────────────────────────────────────────────────

package/install.sh

@@ -1,22 +1,22 @@
 #!/usr/bin/env sh
 # Nexrall Code CLI — installer
-# Usage: curl -fsSL https://nexrall.com/install.sh | sh
+# Usage: curl -fsSL https://cli.nexrall.com/install.sh | sh
 #
 # What it does:
-#   1. Detect OS / arch
-#   2. Check Node.js >= 18
-#   3. Download the latest nex binary from Nexrall CDN
-#   4. Install to /usr/local/bin/nex  (or ~/bin/nex if no write permission)
-#   5. Print next steps
+#   1. Check Node.js >= 18 (npm ships with it — no separate check needed)
+#   2. Install the `nex` package globally from the npm registry
+#
+# Why npm and not a hand-rolled CDN/binary download: npm's registry is
+# already the correct source of truth for "what is the latest version" —
+# `npm install -g nexrall-code` always resolves to the current `latest`
+# dist-tag with zero extra infrastructure to keep in sync. A previous
+# version of this script downloaded a binary from a custom CDN path whose
+# "latest version" metadata was a hardcoded fallback in the backend that had
+# drifted 5 months out of date — every install silently got a broken build.
+# Delegating to npm removes that entire class of bug.
 
 set -e
 
-BINARY_NAME="nex"
-CDN_BASE="https://cli.nexrall.com"
-API_LATEST="https://api.nexrall.com/api/code/cli/latest"
-INSTALL_DIR="/usr/local/bin"
-
-# ── Colors ────────────────────────────────────────────────────────────────────
 bold=""
 dim=""
 green=""
@@ -37,29 +37,10 @@ success() { printf "${green}  ✓${reset}  %s\n" "$*"; }
 error()   { printf "${red}  ✗${reset}  %s\n" "$*" >&2; }
 fatal()   { error "$*"; exit 1; }
 
-# ── Banner ────────────────────────────────────────────────────────────────────
 printf "\n"
 printf "${bold}  Nexrall Code CLI — Installer${reset}\n"
 printf "${dim}  ────────────────────────────────────${reset}\n\n"
 
-# ── OS detection ──────────────────────────────────────────────────────────────
-OS=$(uname -s | tr '[:upper:]' '[:lower:]')
-ARCH=$(uname -m)
-
-case "$OS" in
-  darwin)  PLATFORM="macos" ;;
-  linux)   PLATFORM="linux" ;;
-  *)       fatal "Unsupported OS: $OS. Please install manually." ;;
-esac
-
-case "$ARCH" in
-  x86_64|amd64)  ARCH_TAG="x64" ;;
-  arm64|aarch64) ARCH_TAG="arm64" ;;
-  *)             ARCH_TAG="x64" ;;  # fallback
-esac
-
-info "Detected: ${PLATFORM} / ${ARCH_TAG}"
-
 # ── Node.js check ─────────────────────────────────────────────────────────────
 if ! command -v node >/dev/null 2>&1; then
   printf "\n"
@@ -78,82 +59,37 @@ fi
 
 success "Node.js $(node --version)"
 
-# ── Fetch latest version ───────────────────────────────────────────────────────
-info "Checking latest version…"
-
-if command -v curl >/dev/null 2>&1; then
-  LATEST_JSON=$(curl -fsSL "$API_LATEST" 2>/dev/null || echo '{}')
-elif command -v wget >/dev/null 2>&1; then
-  LATEST_JSON=$(wget -qO- "$API_LATEST" 2>/dev/null || echo '{}')
-else
-  fatal "curl or wget is required to download the installer."
-fi
-
-# Parse version from JSON (simple sed, no jq dependency)
-VERSION=$(echo "$LATEST_JSON" | sed -n 's/.*"version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -1)
-BINARY_URL=$(echo "$LATEST_JSON" | sed -n 's/.*"url"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -1)
-
-if [ -z "$VERSION" ] || [ -z "$BINARY_URL" ]; then
-  # Fallback: construct URL directly (single universal Node.js binary)
-  VERSION="latest"
-  BINARY_URL="${CDN_BASE}/nex"
-fi
-
-info "Version: ${VERSION}"
-info "Download: ${BINARY_URL}"
-
-# ── Download binary ───────────────────────────────────────────────────────────
-TMP_FILE=$(mktemp /tmp/nex_XXXXXX)
-
-info "Downloading…"
-if command -v curl >/dev/null 2>&1; then
-  curl -fsSL --progress-bar "$BINARY_URL" -o "$TMP_FILE"
-elif command -v wget >/dev/null 2>&1; then
-  wget -q --show-progress "$BINARY_URL" -O "$TMP_FILE"
-fi
-
-chmod +x "$TMP_FILE"
-
-# Quick sanity check
-if ! node "$TMP_FILE" --version >/dev/null 2>&1; then
-  rm -f "$TMP_FILE"
-  fatal "Downloaded binary failed sanity check. Please try again."
+if ! command -v npm >/dev/null 2>&1; then
+  fatal "npm not found (it normally ships with Node.js). Please reinstall Node.js from https://nodejs.org."
 fi
 
-# ── Install ───────────────────────────────────────────────────────────────────
-TARGET="${INSTALL_DIR}/${BINARY_NAME}"
+# ── Install via npm ────────────────────────────────────────────────────────────
+info "Installing nexrall-code (latest) from npm…"
 
-if [ -w "$INSTALL_DIR" ]; then
-  mv "$TMP_FILE" "$TARGET"
-  success "Installed to ${TARGET}"
+if npm install -g nexrall-code; then
+  success "Installed"
 else
-  # Try sudo
+  # Global install can fail on permissions (e.g. system Node without a user
+  # prefix configured). Retry with sudo before giving up.
   if command -v sudo >/dev/null 2>&1; then
-    info "Need sudo to write to ${INSTALL_DIR}…"
-    sudo mv "$TMP_FILE" "$TARGET"
-    sudo chmod +x "$TARGET"
-    success "Installed to ${TARGET} (via sudo)"
+    info "Retrying with sudo…"
+    sudo npm install -g nexrall-code || fatal "npm install failed. Try: npm config set prefix ~/.npm-global"
+    success "Installed (via sudo)"
   else
-    # Fallback: ~/bin
-    FALLBACK_DIR="$HOME/.local/bin"
-    mkdir -p "$FALLBACK_DIR"
-    mv "$TMP_FILE" "${FALLBACK_DIR}/${BINARY_NAME}"
-    chmod +x "${FALLBACK_DIR}/${BINARY_NAME}"
-    TARGET="${FALLBACK_DIR}/${BINARY_NAME}"
-    success "Installed to ${TARGET}"
-
-    # Check if fallback dir is on PATH
-    case ":$PATH:" in
-      *":${FALLBACK_DIR}:"*) ;;
-      *)
-        printf "\n"
-        printf "  ${dim}Add this to your shell profile (~/.zshrc or ~/.bashrc):${reset}\n"
-        printf "  ${cyan}export PATH=\"\$HOME/.local/bin:\$PATH\"${reset}\n"
-      ;;
-    esac
+    fatal "npm install failed. Try: npm config set prefix ~/.npm-global && npm install -g nexrall-code"
   fi
 fi
 
+if ! command -v nex >/dev/null 2>&1; then
+  printf "\n"
+  error "'nex' installed but is not on PATH."
+  printf "  Find npm's global bin dir with: ${cyan}npm bin -g${reset}\n"
+  printf "  Then add it to PATH in your shell profile.\n\n"
+  exit 1
+fi
+
+success "$(nex --version 2>/dev/null | head -1)"
+
 # ── Done ──────────────────────────────────────────────────────────────────────
 printf "\n"
 printf "${bold}${green}  Nexrall Code CLI installed successfully!${reset}\n\n"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexrall-code",
-  "version": "0.5.61",
+  "version": "0.5.63",
   "description": "Nexrall Code — AI coding assistant for your terminal (headless agent for scripts, CI and automation)",
   "keywords": [
     "ai",
@@ -39,7 +39,7 @@
     "release": "node build.js && node scripts/upload-release.cjs"
   },
   "dependencies": {
-    "@nexrall/code-core": "^1.4.35",
+    "@nexrall/code-core": "^1.4.37",
     "chalk": "^5.3.0",
     "commander": "^12.0.0",
     "diff": "^5.2.0",