nexrall-code 0.5.72 → 0.5.74

package/dist/index.js

@@ -9873,6 +9873,7 @@ var require_client = __commonJS({
     exports.streamChat = streamChat;
     exports.cancelTurn = cancelTurn;
     exports.revokeRefreshToken = revokeRefreshToken2;
+    exports.describeAttachment = describeAttachment2;
     exports.getBalance = getBalance3;
     exports.exchangeVscodeCode = exchangeVscodeCode;
     exports.login = login2;
@@ -10596,6 +10597,37 @@ var require_client = __commonJS({
       } catch {
       }
     }
+    async function describeAttachment2(kind, data, mediaType, name) {
+      const fetchOnce = () => (0, node_fetch_1.default)(`${exports.API_BASE}/api/code/assets/describe`, {
+        method: "POST",
+        headers: { ...authHeaders(), "Content-Type": "application/json" },
+        body: JSON.stringify({ kind, data, media_type: mediaType, name })
+      });
+      let response = await fetchOnce();
+      if (response.status === 401 || response.status === 403) {
+        const body = await response.text().catch(() => "");
+        if (isExpiredTokenResponse(response.status, body) && await refreshAccessToken()) {
+          response = await fetchOnce();
+        } else {
+          throw new Error(`API error ${response.status}: ${body}`);
+        }
+      }
+      if (!response.ok) {
+        let message = `API error ${response.status}`;
+        try {
+          const body = await response.json();
+          if (body?.error)
+            message = body.error;
+        } catch {
+        }
+        throw new Error(message);
+      }
+      const json = await response.json();
+      return {
+        text: typeof json.text === "string" ? json.text : "",
+        balance: typeof json.balance === "number" ? json.balance : 0
+      };
+    }
     async function getBalance3() {
       const fetchOnce = () => (0, node_fetch_1.default)(`${exports.API_BASE}/api/code/balance`, { method: "GET", headers: authHeaders() });
       let response = await fetchOnce();
@@ -10895,7 +10927,25 @@ var require_securityLint = __commonJS({
         // SCREAMING_SNAKE identifier (an env-var name) is excluded, along with the
         // usual placeholder vocabulary. The value must also look like actual secret
         // material: mixed case or digits, not a lone lowercase word.
-        re: /(?:password|passwd|secret|api[_-]?key|apikey|access[_-]?token)['"`]?\s*[:=]\s*['"`](?![A-Z0-9_]+['"`])(?!.*(?:\$\{|process\.env|os\.environ|example|changeme|placeholder|redacted|xxx|test|dummy|fake|sample|your[_-]?|<|\*{3}))(?=[^'"`]*[0-9A-Z])[^'"`\s]{10,}['"`]/,
+        //
+        // `\{\{` was added after porting this module to the Nexrall backend and
+        // re-measuring there: the only hit across 100 route/service files was
+        // `"x-api-key": "{{PAYOS_API_KEY}}"` inside a connector's DOCUMENTATION
+        // string — a mustache/handlebars placeholder, i.e. the opposite of a leaked
+        // credential. `${...}` was already excluded for exactly this reason; this is
+        // the same idea for the other common templating syntax, and it cannot mask a
+        // real secret because a literal `{{` never appears inside one.
+        //
+        // EXCLUSIONS ARE SCOPED TO THE VALUE (`[^'"`]*`), NOT THE WHOLE LINE (`.*`).
+        // Found by the tests written for the Nexrall backend port: the lookahead
+        // scanned the entire rest of the line, so ANY trailing comment containing a
+        // placeholder word silenced a genuine finding — `const pw = "<real secret>";
+        // // xxx` went SILENT, as did `// test`. An agent writing production code
+        // adds trailing comments constantly, so this was not a rare edge case.
+        // Bounding the lookahead at the closing quote keeps the placeholder
+        // vocabulary matching the VALUE (the only place it was ever meant to) while
+        // making a trailing comment irrelevant.
+        re: /(?:password|passwd|secret|api[_-]?key|apikey|access[_-]?token)['"`]?\s*[:=]\s*['"`](?![A-Z0-9_]+['"`])(?![^'"`]*(?:\$\{|\{\{|process\.env|os\.environ|example|changeme|placeholder|redacted|xxx|test|dummy|fake|sample|your[_-]?|<|\*{3}))(?=[^'"`]*[0-9A-Z])[^'"`\s]{10,}['"`]/,
         message: "Hardcoded credential literal. Read it from the environment/secret store instead, and rotate the exposed value.",
         includeComments: true
       },
@@ -10925,7 +10975,23 @@ var require_securityLint = __commonJS({
         // outside: req/request/params/query/body/input/user/args, or a bare
         // `'...' + ident`. This trades recall for precision on purpose — thorough SQL
         // review is the security-auditor agent's job, not an inline regex's.
-        re: /\b(?:SELECT|INSERT\s+INTO|UPDATE|DELETE\s+FROM)\b[^;'"`]{0,160}(?:\$\{\s*(?:req|request|params?|query|body|input|user|args|ctx)\b|['"`]\s*\+\s*(?:req|request|params?|query|body|input|user|args|ctx)\b|%\s*\(\s*(?:request|params?|query|body|input|user)\b)/i,
+        //
+        // THE GAP IS PER-ALTERNATIVE, and that asymmetry is load-bearing. The concat
+        // branch originally shared the no-quote gap, which made it miss the QUOTED
+        // concatenation form — the more dangerous one, since the value lands inside
+        // a string literal where a lone `'` breaks out of the query:
+        //
+        //     "DELETE FROM s WHERE t = "  + query.token          -> flagged
+        //     "DELETE FROM s WHERE t = '" + query.token + "'"    -> MISSED
+        //
+        // Loosening the gap for ALL branches fixes that but costs precision, measured
+        // on the Nexrall backend: the `${…}` branch then travels PAST the end of the
+        // SQL string to a later interpolation, flagging correctly-parameterised
+        // queries like `UPDATE users SET ${sets.join(',')} WHERE id=$${params.length}`
+        // (0/100 flagged files became 2/100). So only the concat branch gets the loose
+        // gap — it must cross a quote by construction — while the others stay confined
+        // to a single string segment.
+        re: /\b(?:SELECT|INSERT\s+INTO|UPDATE|DELETE\s+FROM)\b(?:[^;'"`]{0,160}(?:\$\{\s*(?:req|request|params?|query|body|input|user|args|ctx)\b|%\s*\(\s*(?:request|params?|query|body|input|user)\b)|[^;]{0,160}['"`]\s*\+\s*(?:req|request|params?|query|body|input|user|args|ctx)\b)/i,
         message: "SQL built by interpolating a request-derived value. Use a parameterised query ($1 / ? placeholders) \u2014 this is the classic injection sink."
       },
       {
@@ -14510,6 +14576,30 @@ ${lines.join("\n")}`;
       return { output: `Found ${photos.length} photo(s) for "${query}":
 ${lines.join("\n")}` };
     }
+    async function webSearch(input) {
+      const query = typeof input.query === "string" ? input.query.trim() : "";
+      if (!query)
+        return { error: "Missing required parameter: query" };
+      const token = (0, auth_1.getToken)();
+      if (!token)
+        return { error: "Not authenticated. Run `nexrall-code login` first." };
+      try {
+        const r2 = await _httpsPost(`${client_1.API_BASE}/api/code/tools/web_search`, JSON.stringify({ query }), { "Content-Type": "application/json", Authorization: `Bearer ${token}` }, 3e4);
+        let json = {};
+        try {
+          json = JSON.parse(r2.body);
+        } catch (_) {
+        }
+        if (r2.status !== 200)
+          return { error: json.error || `Server error ${r2.status}` };
+        const text = json.text ?? "";
+        if (!text)
+          return { error: "web_search succeeded but returned no results text." };
+        return { output: text };
+      } catch (err) {
+        return { error: `web_search failed: ${err.message}` };
+      }
+    }
     function memoryScopeOf(input) {
       return input.scope === "global" ? "global" : "project";
     }
@@ -14605,6 +14695,7 @@ ${expanded}` };
       move_file: moveFile,
       delete_file: deleteFile,
       fetch_url: fetchUrl,
+      web_search: webSearch,
       generate_image: generateImage,
       stock_photo: stockPhoto,
       todo_write: todoWrite,
@@ -66054,20 +66145,6 @@ ${content}
             return;
           }
           const model = normaliseModelId(modelAlias);
-          if (isPdf && NO_PDF_MODELS.has(model)) {
-            console.log(source_default.red(
-              `  ${resolveModelLabel(modelAlias)} does not support PDF attachments. Switch models with /model (Claude models support PDFs), or extract the text yourself and use /add instead.`
-            ));
-            rl.prompt();
-            return;
-          }
-          if (!isPdf && NO_VISION_MODELS.has(model)) {
-            console.log(source_default.red(
-              `  ${resolveModelLabel(modelAlias)} does not support image input. Switch models with /model, or attach as text with /add instead.`
-            ));
-            rl.prompt();
-            return;
-          }
           let buf;
           try {
             buf = fs8.readFileSync(filePath);
@@ -66087,9 +66164,24 @@ ${content}
           const label = caption ? `[Attached: ${rel}]
 ${caption}` : `[Attached: ${rel}]`;
           const content = [{ type: "text", text: label }];
-          content.push(
-            isPdf ? { type: "document", source: { type: "base64", media_type: "application/pdf", data } } : { type: "image", source: { type: "base64", media_type: mimeType, data } }
-          );
+          const needsSidecar = isPdf ? NO_PDF_MODELS.has(model) : NO_VISION_MODELS.has(model);
+          if (needsSidecar) {
+            console.log(source_default.dim(`  ${resolveModelLabel(modelAlias)} can't read ${isPdf ? "PDFs" : "images"} directly \u2014 describing ${rel} with Claude Sonnet 5 first\u2026`));
+            try {
+              const { text } = await (0, import_code_core3.describeAttachment)(isPdf ? "pdf" : "image", data, mimeType, rel);
+              content.push({ type: "text", text: `<attachment_description>
+${text}
+</attachment_description>` });
+            } catch (err) {
+              console.log(source_default.red(`  Could not describe ${rel}: ${err.message}`));
+              rl.prompt();
+              return;
+            }
+          } else {
+            content.push(
+              isPdf ? { type: "document", source: { type: "base64", media_type: "application/pdf", data } } : { type: "image", source: { type: "base64", media_type: mimeType, data } }
+            );
+          }
           console.log(source_default.dim(`  Attached ${rel} (${(buf.length / 1024).toFixed(0)}KB) \u2014 sending\u2026`));
           checkpoints.beginTurn(`/image ${rel}${caption ? " " + caption : ""}`, messages.length);
           messages.push({ role: "user", content });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexrall-code",
-  "version": "0.5.72",
+  "version": "0.5.74",
   "description": "Nexrall Code — AI coding assistant for your terminal (headless agent for scripts, CI and automation)",
   "keywords": [
     "ai",
@@ -39,7 +39,7 @@
     "release": "node build.js && node scripts/upload-release.cjs"
   },
   "dependencies": {
-    "@nexrall/code-core": "^1.4.42",
+    "@nexrall/code-core": "^1.4.44",
     "chalk": "^5.3.0",
     "commander": "^12.0.0",
     "diff": "^5.2.0",