nexrall-code 0.5.72 → 0.5.73

package/dist/index.js

@@ -10895,7 +10895,25 @@ var require_securityLint = __commonJS({
         // SCREAMING_SNAKE identifier (an env-var name) is excluded, along with the
         // usual placeholder vocabulary. The value must also look like actual secret
         // material: mixed case or digits, not a lone lowercase word.
-        re: /(?:password|passwd|secret|api[_-]?key|apikey|access[_-]?token)['"`]?\s*[:=]\s*['"`](?![A-Z0-9_]+['"`])(?!.*(?:\$\{|process\.env|os\.environ|example|changeme|placeholder|redacted|xxx|test|dummy|fake|sample|your[_-]?|<|\*{3}))(?=[^'"`]*[0-9A-Z])[^'"`\s]{10,}['"`]/,
+        //
+        // `\{\{` was added after porting this module to the Nexrall backend and
+        // re-measuring there: the only hit across 100 route/service files was
+        // `"x-api-key": "{{PAYOS_API_KEY}}"` inside a connector's DOCUMENTATION
+        // string — a mustache/handlebars placeholder, i.e. the opposite of a leaked
+        // credential. `${...}` was already excluded for exactly this reason; this is
+        // the same idea for the other common templating syntax, and it cannot mask a
+        // real secret because a literal `{{` never appears inside one.
+        //
+        // EXCLUSIONS ARE SCOPED TO THE VALUE (`[^'"`]*`), NOT THE WHOLE LINE (`.*`).
+        // Found by the tests written for the Nexrall backend port: the lookahead
+        // scanned the entire rest of the line, so ANY trailing comment containing a
+        // placeholder word silenced a genuine finding — `const pw = "<real secret>";
+        // // xxx` went SILENT, as did `// test`. An agent writing production code
+        // adds trailing comments constantly, so this was not a rare edge case.
+        // Bounding the lookahead at the closing quote keeps the placeholder
+        // vocabulary matching the VALUE (the only place it was ever meant to) while
+        // making a trailing comment irrelevant.
+        re: /(?:password|passwd|secret|api[_-]?key|apikey|access[_-]?token)['"`]?\s*[:=]\s*['"`](?![A-Z0-9_]+['"`])(?![^'"`]*(?:\$\{|\{\{|process\.env|os\.environ|example|changeme|placeholder|redacted|xxx|test|dummy|fake|sample|your[_-]?|<|\*{3}))(?=[^'"`]*[0-9A-Z])[^'"`\s]{10,}['"`]/,
         message: "Hardcoded credential literal. Read it from the environment/secret store instead, and rotate the exposed value.",
         includeComments: true
       },
@@ -10925,7 +10943,23 @@ var require_securityLint = __commonJS({
         // outside: req/request/params/query/body/input/user/args, or a bare
         // `'...' + ident`. This trades recall for precision on purpose — thorough SQL
         // review is the security-auditor agent's job, not an inline regex's.
-        re: /\b(?:SELECT|INSERT\s+INTO|UPDATE|DELETE\s+FROM)\b[^;'"`]{0,160}(?:\$\{\s*(?:req|request|params?|query|body|input|user|args|ctx)\b|['"`]\s*\+\s*(?:req|request|params?|query|body|input|user|args|ctx)\b|%\s*\(\s*(?:request|params?|query|body|input|user)\b)/i,
+        //
+        // THE GAP IS PER-ALTERNATIVE, and that asymmetry is load-bearing. The concat
+        // branch originally shared the no-quote gap, which made it miss the QUOTED
+        // concatenation form — the more dangerous one, since the value lands inside
+        // a string literal where a lone `'` breaks out of the query:
+        //
+        //     "DELETE FROM s WHERE t = "  + query.token          -> flagged
+        //     "DELETE FROM s WHERE t = '" + query.token + "'"    -> MISSED
+        //
+        // Loosening the gap for ALL branches fixes that but costs precision, measured
+        // on the Nexrall backend: the `${…}` branch then travels PAST the end of the
+        // SQL string to a later interpolation, flagging correctly-parameterised
+        // queries like `UPDATE users SET ${sets.join(',')} WHERE id=$${params.length}`
+        // (0/100 flagged files became 2/100). So only the concat branch gets the loose
+        // gap — it must cross a quote by construction — while the others stay confined
+        // to a single string segment.
+        re: /\b(?:SELECT|INSERT\s+INTO|UPDATE|DELETE\s+FROM)\b(?:[^;'"`]{0,160}(?:\$\{\s*(?:req|request|params?|query|body|input|user|args|ctx)\b|%\s*\(\s*(?:request|params?|query|body|input|user)\b)|[^;]{0,160}['"`]\s*\+\s*(?:req|request|params?|query|body|input|user|args|ctx)\b)/i,
         message: "SQL built by interpolating a request-derived value. Use a parameterised query ($1 / ? placeholders) \u2014 this is the classic injection sink."
       },
       {
@@ -14510,6 +14544,30 @@ ${lines.join("\n")}`;
       return { output: `Found ${photos.length} photo(s) for "${query}":
 ${lines.join("\n")}` };
     }
+    async function webSearch(input) {
+      const query = typeof input.query === "string" ? input.query.trim() : "";
+      if (!query)
+        return { error: "Missing required parameter: query" };
+      const token = (0, auth_1.getToken)();
+      if (!token)
+        return { error: "Not authenticated. Run `nexrall-code login` first." };
+      try {
+        const r2 = await _httpsPost(`${client_1.API_BASE}/api/code/tools/web_search`, JSON.stringify({ query }), { "Content-Type": "application/json", Authorization: `Bearer ${token}` }, 3e4);
+        let json = {};
+        try {
+          json = JSON.parse(r2.body);
+        } catch (_) {
+        }
+        if (r2.status !== 200)
+          return { error: json.error || `Server error ${r2.status}` };
+        const text = json.text ?? "";
+        if (!text)
+          return { error: "web_search succeeded but returned no results text." };
+        return { output: text };
+      } catch (err) {
+        return { error: `web_search failed: ${err.message}` };
+      }
+    }
     function memoryScopeOf(input) {
       return input.scope === "global" ? "global" : "project";
     }
@@ -14605,6 +14663,7 @@ ${expanded}` };
       move_file: moveFile,
       delete_file: deleteFile,
       fetch_url: fetchUrl,
+      web_search: webSearch,
       generate_image: generateImage,
       stock_photo: stockPhoto,
       todo_write: todoWrite,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexrall-code",
-  "version": "0.5.72",
+  "version": "0.5.73",
   "description": "Nexrall Code — AI coding assistant for your terminal (headless agent for scripts, CI and automation)",
   "keywords": [
     "ai",
@@ -39,7 +39,7 @@
     "release": "node build.js && node scripts/upload-release.cjs"
   },
   "dependencies": {
-    "@nexrall/code-core": "^1.4.42",
+    "@nexrall/code-core": "^1.4.43",
     "chalk": "^5.3.0",
     "commander": "^12.0.0",
     "diff": "^5.2.0",