nexrall-code 0.5.71 → 0.5.72

package/dist/index.js

@@ -10012,7 +10012,7 @@ var require_client = __commonJS({
     }
     var MAX_TOTAL_ATTEMPTS = (MAX_RETRIES + 1) * (MAX_RETRIES + 1);
     async function streamChat(messages, options, onEvent) {
-      const { model, env: env3, editorContext, nexrallMd, mode, effort, clientType, abortSignal, extraTools, agents, skills, allowRestartAfterRender, canWriteSharedMemory, hasOwnAgentStore, canSpawnSubAgents } = options;
+      const { model, env: env3, editorContext, nexrallMd, mode, effort, clientType, abortSignal, extraTools, agents, skills, allowRestartAfterRender, canWriteSharedMemory, hasOwnAgentStore, canSpawnSubAgents, canBrowseWeb } = options;
       let turnId = (0, crypto_1.randomUUID)();
       const controller = new AbortController();
       if (abortSignal?.aborted)
@@ -10054,7 +10054,7 @@ var require_client = __commonJS({
           {
             method: "POST",
             headers: authHeaders(),
-            body: JSON.stringify({ messages, model, env: env3, editorContext, nexrallMd, mode, effort, clientType, extraTools, agents, skills, turnId, canWriteSharedMemory, hasOwnAgentStore, canSpawnSubAgents }),
+            body: JSON.stringify({ messages, model, env: env3, editorContext, nexrallMd, mode, effort, clientType, extraTools, agents, skills, turnId, canWriteSharedMemory, hasOwnAgentStore, canSpawnSubAgents, canBrowseWeb }),
             signal
           }
         ];
@@ -17505,6 +17505,16 @@ ${options.nexrallMd}` : "") : options.nexrallMd;
               canWriteSharedMemory: options._allowedTools ? options._allowedTools.has("memory_write") : true,
               // no allowlist = main agent = may write
               hasOwnAgentStore: !!options._agentMemory,
+              // Same derivation, same reason, for the network. The base prompt's
+              // "Web search" section tells the run to reach the network, but
+              // READ_ONLY_TOOLS (explorer, security-auditor, ...) contains neither
+              // `fetch_url` nor `web_search`. MEASURED on the 195-trial 2026-08-10
+              // deepseek-v4-pro benchmark: 29 of 51 `fetch_url` failures and 3 of 14
+              // `web_search` failures were the permission gate refusing a sub-agent
+              // that its own system prompt had just invited to browse — every one a
+              // wasted round-trip on a paid turn.
+              canBrowseWeb: options._allowedTools ? options._allowedTools.has("fetch_url") : true,
+              // no allowlist = main agent = may browse
               // Withholds the `task` schema and its instructions when this run cannot
               // delegate — see canSpawnSubAgents.
               canSpawnSubAgents: maySpawn,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexrall-code",
-  "version": "0.5.71",
+  "version": "0.5.72",
   "description": "Nexrall Code — AI coding assistant for your terminal (headless agent for scripts, CI and automation)",
   "keywords": [
     "ai",
@@ -39,7 +39,7 @@
     "release": "node build.js && node scripts/upload-release.cjs"
   },
   "dependencies": {
-    "@nexrall/code-core": "^1.4.39",
+    "@nexrall/code-core": "^1.4.42",
     "chalk": "^5.3.0",
     "commander": "^12.0.0",
     "diff": "^5.2.0",