nexrall-code 0.5.95 → 0.5.96

package/dist/index.js

@@ -11738,9 +11738,9 @@ var require_frontmatter = __commonJS({
   }
 });
 
-// ../core/dist/commands/loader.js
-var require_loader = __commonJS({
-  "../core/dist/commands/loader.js"(exports2) {
+// ../core/dist/agent/agentTypes.js
+var require_agentTypes = __commonJS({
+  "../core/dist/agent/agentTypes.js"(exports2) {
     "use strict";
     var __createBinding = exports2 && exports2.__createBinding || (Object.create ? function(o, m2, k, k2) {
       if (k2 === void 0)
@@ -11787,155 +11787,767 @@ var require_loader = __commonJS({
       };
     }();
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.loadSlashCommands = loadSlashCommands;
-    exports2.findSlashCommand = findSlashCommand;
-    exports2.expandBody = expandBody;
-    exports2.expandCommand = expandCommand;
+    exports2.MODEL_TIER_ALIASES = exports2.VALID_MODELS = void 0;
+    exports2.parseModel = parseModel;
+    exports2.loadAgentTypes = loadAgentTypes;
+    exports2.loadAgentTypesWithWarnings = loadAgentTypesWithWarnings2;
+    exports2.knownToolNames = knownToolNames;
+    exports2.builtinAgents = builtinAgents;
+    exports2.summariseAgents = summariseAgents;
+    exports2.findAgentType = findAgentType;
     var fs9 = __importStar(__require("fs"));
     var path7 = __importStar(__require("path"));
     var os6 = __importStar(__require("os"));
-    var child_process_1 = __require("child_process");
     var index_1 = require_plugins();
     var frontmatter_1 = require_frontmatter();
-    var BUILTIN_COMMANDS = [
+    var VALID_MEMORY_SCOPES = ["project", "user", "local"];
+    function parseMemoryScope(v) {
+      const s2 = (v ?? "").trim().toLowerCase();
+      return VALID_MEMORY_SCOPES.includes(s2) ? s2 : void 0;
+    }
+    var READ_ONLY_TOOLS = [
+      // Universal
+      "read_file",
+      "search_files",
+      "glob",
+      "list_directory",
+      "bash",
+      "bash_output",
+      // kill_shell belongs next to bash_output: an agent that can start a background
+      // process and poll it but never stop it leaks that process past its own
+      // lifetime. Stopping a shell you started is not a write to the repo.
+      "kill_shell",
+      "notebook_read",
+      "todo_write",
+      "todo_read",
+      // memory_READ, deliberately without memory_write.
+      //
+      // Reading is free capability: a sub-agent that knows "tests run with X" or "never
+      // edit Z directly" does better work, and withholding it meant every sub-agent
+      // rediscovered project conventions from scratch. Writing is a different thing
+      // entirely — memory is durable, cross-session, SHARED state, while sub-agents run
+      // up to 4-wide in parallel with their reasoning hidden from the user. A wrong fact
+      // written there is invisible and permanent, and it competes for a capped, shared
+      // budget that gets periodically condensed.
+      //
+      // So the parent owns writes: a sub-agent that learns something durable says so in
+      // its report, and the main agent — the one actually talking to the user — decides.
+      // A sub-agent that needs its own persistent notes gets the per-agent store instead
+      // (see `memory:` in the frontmatter), which is scoped to itself and cannot pollute
+      // the shared file.
+      "memory_read",
+      // Skills are reusable prompt playbooks, and loop.ts advertises the skills
+      // catalogue to sub-agents at EVERY depth — so withholding the tool that loads
+      // one meant showing every sub-agent a menu it could not order from.
+      "use_skill",
+      // VS Code language server (ignored on the CLI)
+      "get_symbols",
+      "get_workspace_symbols",
+      "find_references",
+      "go_to_definition",
+      "get_hover",
+      "get_diagnostics"
+    ];
+    var RESEARCH_TOOLS = [...READ_ONLY_TOOLS, "fetch_url"];
+    var WRITE_TOOLS = [
+      ...READ_ONLY_TOOLS,
+      "write_file",
+      "edit_file",
+      "multi_edit",
+      "create_directory",
+      "move_file",
+      "copy_file",
+      // notebook_edit is a write tool like any other, and allowsTestOnlyWrite already
+      // knows its shape (`source` is cell CONTENT, not a path). Omitting it just meant
+      // test-writer silently could not touch notebooks.
+      "notebook_edit",
+      // Office document generation — same write-access tier as write_file, just a
+      // structured content shape instead of raw text (see tools/executor.ts).
+      "write_docx",
+      "write_xlsx",
+      "write_pptx"
+    ];
+    var BUILTIN_AGENTS = [
       {
-        name: "review",
-        description: "Review uncommitted changes (or a PR/branch diff) for bugs and risks",
+        // The catch-all, matching Claude Code's `general-purpose`.
+        //
+        // This capability already existed — omitting `subagent_type` gives an unrestricted
+        // sub-agent — but it had no NAME, and that had two consequences worth fixing:
+        //
+        //   1. `permissions.deny: ["task(...)"]` matches on the agent name, so the ONE
+        //      sub-agent that can write files and run bash was the one variant a project
+        //      could not disable individually. Only a blanket `deny: ["task"]` reached it.
+        //   2. The model had to infer that leaving the field blank was even an option, so
+        //      it would sometimes pick a specialist that fitted badly (an unrestricted
+        //      explorer) rather than the general worker it actually wanted.
+        //
+        // `tools` is deliberately UNDEFINED, which means "no allowlist" — full access,
+        // inheriting whatever the session permits. That is the same power an unnamed
+        // sub-task always had; naming it changes only who can see and deny it.
+        //
+        // It also makes this the ONLY builtin that can nest, since every specialist omits
+        // `task` on purpose. So the tree this enables is up to `maxSubagentDepth` generations
+        // of unrestricted agents — accepted deliberately, because the alternative (a catch-all
+        // that cannot delegate) removes the one agent suited to orchestration.
+        //
+        // The safety properties that bound it: plan mode is inherited, the user's permission
+        // gate runs on every call, a child's allowlist is INTERSECTED with its parent's so a
+        // restricted ancestor cannot be escaped through this agent, `test_files_only` is
+        // likewise sticky, and both the depth ceiling and the session budget still apply.
+        name: "general-purpose",
+        description: "General-purpose worker for a multi-step task that needs BOTH exploration and changes (edit files, run commands) and that no specialist above fits. Inherits the session model and full tool access, so prefer a narrower agent when one matches.",
+        prompt: "You are a general-purpose engineering sub-agent. Work the task end to end: explore what you need, make the changes, and verify them with the project's own build/test commands.\n\nRules:\n- Mirror existing conventions; make the smallest correct change.\n- Verify before you claim success. If you could not verify, say so explicitly.\n- Your FINAL MESSAGE is the only thing that reaches the main agent: state what you changed (with file paths), what you ran and its outcome, and anything you deliberately left undone.",
+        source: "builtin"
+      },
+      {
+        name: "reviewer",
+        description: "Read-only code reviewer \u2014 finds correctness bugs, edge cases, and security issues in a diff or file set. Cannot modify files.",
+        tools: READ_ONLY_TOOLS,
         source: "builtin",
-        body: [
-          "Review the following diff like a meticulous senior engineer. Target: $ARGUMENTS",
-          "(If no target given, review the uncommitted working-tree changes below. If a branch or PR",
-          "number is given, run the appropriate `git diff <base>...` or `gh pr diff <n>` yourself first.)",
+        prompt: [
+          "You are a meticulous senior code reviewer. You NEVER modify files \u2014 you only read, search, and report.",
           "",
-          "Branch: !`git branch --show-current`",
-          "Status: !`git status --short`",
+          "Method:",
+          "1. Read the full context around every change you are asked to review; never judge a hunk in isolation.",
+          "2. Hunt specifically for: correctness bugs, unhandled edge cases (empty/null/unicode/concurrency/timezone),",
+          "   security issues (injection, path traversal, secrets in code, unsafe deserialization), breaking API",
+          "   changes (search for callers first), silent behaviour changes, and swallowed errors.",
+          "3. Verify test coverage: are the changed paths tested? Were assertions weakened or tests deleted?",
+          "4. Only use bash for read-only commands (git diff/log/show, grep, test runs). Never run mutating commands.",
           "",
-          "Diff (uncommitted):",
-          "```diff",
-          "!`git diff HEAD --unified=5 --no-color | head -4000`",
-          "```",
+          "Report format: \u{1F534} Critical / \u{1F7E1} Warning / \u{1F7E2} Suggestion, each with file:line and a concrete fix,",
+          "then a final verdict (APPROVE or REQUEST CHANGES) with a one-paragraph rationale."
+        ].join("\n")
+      },
+      // Promoted from the security-audit plugin to a builtin.
+      //
+      // Leaving it plugin-only was indefensible next to `reviewer` being builtin:
+      // reviewer's own prompt already tells it to look for security issues, so
+      // security IS treated as default work — yet the specialist agent for it was
+      // invisible unless the user happened to know the plugin existed. For an agent
+      // that WRITES code, "you only get a security review if you knew to install
+      // something" is the wrong default.
+      {
+        name: "security-auditor",
+        description: "Read-only security auditor \u2014 hunts injection, authz, secrets, and validation flaws in a path or diff. Cannot modify files.",
+        tools: READ_ONLY_TOOLS,
+        // No `model` override — inherits the session's, same as general-purpose.
+        // A previous version forced 'pro' (Claude Opus 5) here, which silently
+        // billed Anthropic even for a session running entirely on OpenAI/DeepSeek/
+        // Qwen. Consistency with the main conversation's provider matters more
+        // than defaulting every specialist to a fixed tier.
+        source: "builtin",
+        prompt: [
+          "You are a security auditor. You find real, exploitable flaws \u2014 not style issues.",
           "",
-          "Review methodology:",
-          "1. Read the surrounding code of every changed hunk (read_file with offset/limit) \u2014 never judge a hunk in isolation.",
-          "2. Look for: correctness bugs, edge cases (empty/null/unicode/concurrency), security issues",
-          "   (injection, path traversal, secrets), breaking API changes (find_references / search callers),",
-          "   silent behaviour changes, and missing error handling.",
-          "3. Check tests: do existing tests cover the change? Are assertions weakened?",
+          "Method:",
+          "1. Map the attack surface FIRST: entry points (HTTP routes, message handlers, CLI args, file/network",
+          "   input, deserialization), then trace user-controlled data inward to where it is used.",
+          "2. For each finding: file:line, the flaw class, a one-line exploit scenario, and the concrete fix.",
+          "3. Grade severity honestly: Critical = remote compromise or data breach; High = auth bypass/IDOR;",
+          "   Medium = needs unusual preconditions; Low = hardening.",
           "",
-          "Output format:",
-          "- \u{1F534} Critical (must fix before merge) \u2014 with file:line and a concrete fix",
-          "- \u{1F7E1} Warning (should fix) \u2014 with file:line",
-          "- \u{1F7E2} Suggestion (nice to have)",
-          "- Verdict: APPROVE / REQUEST CHANGES with a one-paragraph summary.",
-          "Do NOT modify any files \u2014 this is a read-only review."
+          "Classes worth the most attention, in order: injection (SQL/command/template/prototype), broken",
+          "authz (missing ownership checks, IDOR, trusting client-supplied ids), secrets committed to source,",
+          "path traversal, SSRF, unsafe deserialization, missing rate limits on expensive or auth endpoints,",
+          "and crypto misuse (hand-rolled comparison, predictable randomness).",
+          "",
+          "Hard rules:",
+          "- READ-ONLY: never modify, create or delete files. bash only for read-only inspection.",
+          "- NEVER print a discovered secret's value. Report its location and advise rotation.",
+          "- Distinguish EXPLOITABLE from theoretical, and say which one each finding is.",
+          '- "No issues found in scope X" is a valid, useful result. Do not pad the report to look thorough.'
+        ].join("\n")
+      },
+      // The gap Claude Code fills with its built-in `Explore`: read-heavy codebase
+      // search that would otherwise flood the parent's context. Defaults to the
+      // cheapest model on purpose — "find every caller of X" has no need of a
+      // frontier model, and this is the agent most likely to be spawned in bulk.
+      {
+        name: "explorer",
+        // Lean prompt: this agent exists to keep bulk searching cheap, and it reports
+        // findings for the MAIN agent to interpret with full project context.
+        lightPrompt: true,
+        description: "Fast read-only codebase explorer \u2014 locates files, symbols, and call sites and reports concise findings. Use to keep bulk searching out of the main context. Cannot modify files.",
+        tools: READ_ONLY_TOOLS,
+        // No `model` override — inherits the session's. A previous version forced
+        // 'turbo' (Claude Sonnet 5) on the theory that bulk search doesn't need a
+        // frontier model, but that silently billed Anthropic regardless of which
+        // provider the user actually selected for the conversation.
+        source: "builtin",
+        prompt: [
+          "You map code. You NEVER modify anything.",
+          "",
+          "Method:",
+          "1. Prefer structural search over text search where available (get_workspace_symbols, find_references,",
+          "   go_to_definition); fall back to search_files/glob otherwise.",
+          "2. Read only the sections you need \u2014 use read_file with offset/limit on large files instead of",
+          "   pulling in thousands of lines.",
+          "3. Follow the real call graph rather than guessing from names.",
+          "",
+          "Your ONLY output is a compact report: the file:line locations that matter, how they relate, and the",
+          "direct answer to the question you were given. This exists to keep bulk search OUT of the parent's",
+          "context, so do not paste large file contents back \u2014 cite locations and summarise. Say plainly when",
+          'something does not exist; a confident wrong answer is far worse than "not found".'
+        ].join("\n")
+      },
+      // Matches Claude Code's built-in `Plan`: research a change and return a
+      // strategy, deliberately WITHOUT write access so "make a plan" can never
+      // quietly become "start editing".
+      {
+        name: "planner",
+        description: "Read-only planning agent \u2014 researches a change and returns a concrete step-by-step implementation plan with risks and affected files. Cannot modify files.",
+        tools: RESEARCH_TOOLS,
+        // No `model` override — inherits the session's, for the same reason as
+        // explorer/security-auditor above: a fixed alias silently billed Anthropic
+        // regardless of the user's chosen provider.
+        source: "builtin",
+        prompt: [
+          "You produce implementation plans. You NEVER modify files \u2014 planning and doing are separate steps,",
+          'and this agent exists so "plan it" cannot silently turn into "change it".',
+          "",
+          "Method:",
+          "1. Read the actual code before proposing anything. No plan may rest on an assumed API shape.",
+          "2. Find every affected call site (find_references / search_files) and list them.",
+          "3. Order the steps so the tree stays working after each one \u2014 types, then implementation, then",
+          "   tests, then exports/registration.",
+          "",
+          "Output:",
+          "- Goal, in one sentence.",
+          "- Numbered steps, each with the exact files touched and what changes in them.",
+          "- Risks + the specific thing that could break, and how it would be detected.",
+          "- How to verify (the exact test/build command for THIS project, taken from package.json/Makefile).",
+          "- Anything genuinely ambiguous, stated as an open question rather than a silent assumption."
+        ].join("\n")
+      },
+      // Promoted from the test-gen plugin. Needs write access — it produces test
+      // files — but is deliberately forbidden from touching source, because "make the
+      // tests pass" is the single most common way an agent destroys signal.
+      {
+        name: "test-writer",
+        description: "Writes tests that follow the project's existing conventions. May create/edit TEST files only \u2014 never production source.",
+        tools: WRITE_TOOLS,
+        // Enforced, not merely requested: the permission gate refuses a write whose
+        // path is not a test file. Without this the allowlist would grant edit_file
+        // for every path and the rule below would be a suggestion the model is free
+        // to rationalise its way past.
+        testFilesOnly: true,
+        source: "builtin",
+        prompt: [
+          "You write tests. You may create and edit TEST files only.",
+          "",
+          "Hard rules \u2014 these are the ways test-writing agents destroy value, so they are non-negotiable:",
+          "- NEVER modify production source to make a test pass. If the code looks wrong, REPORT it and stop.",
+          "- NEVER weaken, delete or skip an existing assertion or test.",
+          "- A test that cannot fail is worse than no test. Every test must be able to fail for one clear reason.",
+          "",
+          "Method:",
+          "1. Read the existing tests FIRST and copy their conventions exactly \u2014 runner, file naming, layout,",
+          "   assertion style, fixture/helper patterns. Never introduce a new framework.",
+          "2. Test observable behaviour and the contract, not private internals.",
+          "3. Cover the boring-but-real cases: empty input, null/undefined, unicode and non-BMP characters,",
+          "   boundaries, error paths, concurrency where it applies.",
+          "4. No sleeps or wall-clock dependence \u2014 those produce the flaky tests that get deleted later.",
+          "5. RUN the tests you wrote and report the real output. Never claim a test passes without running it."
+        ].join("\n")
+      },
+      // The DevOps gap — answered with a READ-ONLY advisor, not an operator.
+      //
+      // A "DevOps agent" with write/apply access is a genuinely different risk class
+      // from the others here: its mistakes are `kubectl delete`, a bad `terraform
+      // apply`, a broken deploy pipeline — often not revertible and affecting
+      // production rather than a working tree. So this one diagnoses and proposes a
+      // diff; a human applies it. That asymmetry is the whole design.
+      {
+        name: "devops-advisor",
+        description: "Read-only CI/CD, container, and infrastructure advisor \u2014 diagnoses pipelines, Dockerfiles, and k8s manifests and proposes concrete fixes as a diff. Never applies changes.",
+        tools: RESEARCH_TOOLS,
+        // No `model` override — inherits the session's, for the same reason as the
+        // other specialists above.
+        source: "builtin",
+        prompt: [
+          "You are an infrastructure and delivery advisor. You DIAGNOSE and PROPOSE. You never apply changes.",
+          "",
+          "Hard rules:",
+          "- READ-ONLY, and stricter than the other read-only agents: bash is for INSPECTION only",
+          "  (git log/diff, cat, grep, `kubectl get/describe`, `docker images`, `terraform plan`).",
+          "  NEVER run anything that mutates infrastructure \u2014 no apply/delete/scale/rollout/restart/push,",
+          "  no `terraform apply`, no `helm upgrade`. If a fix needs such a command, WRITE IT OUT for a human.",
+          "- Never print secret values from env files, k8s Secrets or CI variables. Reference them by name.",
+          "",
+          "Method:",
+          "1. Read what actually exists \u2014 workflow files, Dockerfiles, manifests, kustomize overlays, the",
+          '   deploy scripts \u2014 before drawing any conclusion. Never reason from what a stack "usually" looks like.',
+          "2. Follow the real path a change takes to production, and name the step that is broken or missing.",
+          "3. Check the failure modes that bite hardest: CI path filters that skip files a workload actually",
+          "   needs, image tags that do not match what is deployed, missing health probes, absent resource",
+          "   limits, secrets baked into images, ports/timeouts inconsistent between proxy and app, and",
+          "   migrations that must run before the new image is live.",
+          "",
+          "Output: the diagnosis, the evidence (file:line or command output), the proposed change as a diff or",
+          "exact file content, and the command a human should run to apply and verify it."
         ].join("\n")
       }
     ];
-    function loadDir(dir, source2, into) {
-      let files;
+    var KNOWN_TOOL_NAMES = /* @__PURE__ */ new Set([
+      "read_file",
+      "write_file",
+      "write_docx",
+      "write_xlsx",
+      "write_pptx",
+      "edit_file",
+      "multi_edit",
+      "list_directory",
+      "create_directory",
+      "move_file",
+      "copy_file",
+      "delete_file",
+      "search_files",
+      "glob",
+      "bash",
+      "bash_output",
+      "kill_shell",
+      "notebook_read",
+      "notebook_edit",
+      "todo_write",
+      "todo_read",
+      "memory_write",
+      "memory_read",
+      "use_skill",
+      "fetch_url",
+      "web_search",
+      "generate_image",
+      "stock_photo",
+      "open_in_browser",
+      "browser_action",
+      "task",
+      // Granted by a `memory:` scope rather than listed in a `tools:` line, but a user may
+      // still name it explicitly — so it must validate rather than be flagged as a typo.
+      "agent_memory_write",
+      "get_symbols",
+      "get_workspace_symbols",
+      "find_references",
+      "go_to_definition",
+      "get_hover",
+      "get_diagnostics"
+    ]);
+    var KNOWN_META_KEYS = /* @__PURE__ */ new Set([
+      "name",
+      "description",
+      "tools",
+      "model",
+      "test_files_only",
+      "testfilesonly",
+      "memory"
+    ]);
+    exports2.VALID_MODELS = [
+      "claude-sonnet-5",
+      "claude-opus-5",
+      "claude-fable-5",
+      "gpt-5.4",
+      "gpt-5.4-mini",
+      "gpt-4.1",
+      // Legacy tier aliases — still accepted, still resolved by the backend.
+      "turbo",
+      "pro",
+      "ultra",
+      "fast"
+    ];
+    exports2.MODEL_TIER_ALIASES = ["turbo", "pro", "ultra", "fast"];
+    function parseModel(v) {
+      const raw = (v ?? "").trim();
+      if (!raw)
+        return void 0;
+      const lower2 = raw.toLowerCase();
+      if (exports2.MODEL_TIER_ALIASES.includes(lower2))
+        return lower2;
+      return raw;
+    }
+    function parseBool(v) {
+      return /^(true|yes|1|on)$/i.test((v ?? "").trim());
+    }
+    function parseToolList(v) {
+      if (!v)
+        return void 0;
+      const tools = v.replace(/^\[|\]$/g, "").split(/[,\s]+/).map((t2) => t2.trim()).filter(Boolean);
+      return tools.length ? tools : void 0;
+    }
+    function loadDir(dir, source2, into, warnings) {
+      let entries;
       try {
-        files = fs9.readdirSync(dir).filter((f3) => f3.endsWith(".md"));
+        entries = fs9.readdirSync(dir, { withFileTypes: true });
       } catch {
         return;
       }
-      for (const file of files) {
-        try {
-          const raw = fs9.readFileSync(path7.join(dir, file), "utf-8");
-          const { meta, body } = (0, frontmatter_1.parseFrontmatter)(raw);
-          const name = (meta.name || path7.basename(file, ".md")).trim().toLowerCase();
-          if (!name)
-            continue;
-          if (source2 !== "project" && into.has(name))
-            continue;
-          const model = ["turbo", "pro", "ultra"].find((x2) => x2 === (meta.model ?? "").toLowerCase());
-          into.set(name, {
-            name,
-            description: meta.description || `Custom /${name} command`,
-            model,
-            mode: meta.mode || void 0,
-            body,
-            source: source2
-          });
-        } catch {
+      for (const entry of entries) {
+        const full = path7.join(dir, entry.name);
+        if (entry.isDirectory()) {
+          loadDir(full, source2, into, warnings);
+          continue;
         }
-      }
-    }
-    function loadSlashCommands(workDir) {
-      const out = /* @__PURE__ */ new Map();
-      loadDir(path7.join(workDir, ".nexrall", "commands"), "project", out);
-      loadDir(path7.join(os6.homedir(), ".nexrall", "commands"), "global", out);
-      for (const dir of (0, index_1.pluginAssetDirs)(workDir, "commands"))
-        loadDir(dir, "plugin", out);
-      for (const cmd of BUILTIN_COMMANDS) {
-        if (!out.has(cmd.name))
-          out.set(cmd.name, cmd);
-      }
-      return [...out.values()];
-    }
-    function findSlashCommand(cmds, name) {
-      const want = name.replace(/^\//, "").trim().toLowerCase();
-      return cmds.find((c) => c.name === want);
-    }
-    function expandBody(body, argString, workDir) {
-      const args = argString.trim();
-      const positional = args ? args.split(/\s+/) : [];
-      let out = body;
-      out = out.replace(/!`([^`]+)`/g, (_m, c) => {
+        if (!entry.name.endsWith(".md"))
+          continue;
+        let raw;
         try {
-          const stdout = (0, child_process_1.execSync)(c, { cwd: workDir, encoding: "utf-8", timeout: 15e3, stdio: ["ignore", "pipe", "pipe"] });
-          return stdout.trim();
+          raw = fs9.readFileSync(full, "utf-8");
         } catch (err) {
-          return `[command failed: ${c} \u2014 ${err.message}]`;
-        }
-      });
-      out = out.replace(/(^|\s)@([^\s]+)/g, (_m, lead, rel) => {
-        const abs = path7.isAbsolute(rel) ? rel : path7.join(workDir, rel);
-        try {
-          const content = fs9.readFileSync(abs, "utf-8").slice(0, 12e3);
-          return `${lead}
-[File: ${rel}]
-\`\`\`
-${content}
-\`\`\`
-`;
-        } catch {
-          return `${lead}[missing file: ${rel}]`;
+          warnings.push({ file: full, agent: path7.basename(entry.name, ".md"), message: `could not be read (${err.message}) \u2014 this agent was skipped` });
+          continue;
         }
-      });
-      out = out.replace(/\$(\d+)/g, (_m, n) => positional[Number(n) - 1] ?? "");
-      const hadArgsToken = /\$ARGUMENTS/.test(out);
-      out = out.replace(/\$ARGUMENTS/g, args);
-      if (!hadArgsToken && !/\$\d+/.test(body) && args) {
-        out = `${out}
-
-${args}`;
-      }
-      return out.trim();
-    }
-    function expandCommand(cmd, argString, workDir) {
-      return expandBody(cmd.body, argString, workDir);
-    }
-  }
-});
-
-// ../core/dist/agent/skills.js
-var require_skills = __commonJS({
-  "../core/dist/agent/skills.js"(exports2) {
-    "use strict";
-    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? function(o, m2, k, k2) {
-      if (k2 === void 0)
-        k2 = k;
-      var desc = Object.getOwnPropertyDescriptor(m2, k);
-      if (!desc || ("get" in desc ? !m2.__esModule : desc.writable || desc.configurable)) {
-        desc = { enumerable: true, get: function() {
-          return m2[k];
-        } };
-      }
-      Object.defineProperty(o, k2, desc);
-    } : function(o, m2, k, k2) {
-      if (k2 === void 0)
-        k2 = k;
-      o[k2] = m2[k];
+        const { meta, body, ok } = (0, frontmatter_1.parseFrontmatter)(raw);
+        const name = (meta.name || path7.basename(entry.name, ".md")).trim();
+        if (!name)
+          continue;
+        if (source2 !== "project" && into.has(name))
+          continue;
+        const tools = parseToolList(meta.tools);
+        let effectiveTools = tools;
+        if (!ok) {
+          effectiveTools = READ_ONLY_TOOLS;
+          warnings.push({
+            file: full,
+            agent: name,
+            message: "has no valid YAML frontmatter (a `---` block must be the first thing in the file), so no tool allowlist could be read. Treating it as READ-ONLY. Add frontmatter with a `tools:` line to grant more."
+          });
+        } else {
+          if (!meta.description) {
+            warnings.push({
+              file: full,
+              agent: name,
+              message: "has no `description:` \u2014 that text is the ONLY thing the model uses to decide when to delegate to this agent, so it will rarely be picked."
+            });
+          }
+          if (meta.memory !== void 0 && parseMemoryScope(meta.memory) === void 0) {
+            warnings.push({
+              file: full,
+              agent: name,
+              message: `has memory: "${meta.memory}", which is not a valid scope \u2014 use one of ${VALID_MEMORY_SCOPES.join(", ")}, or omit the line to give this agent no persistent notes.`
+            });
+          }
+          const declaredModel = meta.model === void 0 ? void 0 : parseModel(meta.model);
+          if (meta.model !== void 0 && (declaredModel === void 0 || !exports2.VALID_MODELS.includes(declaredModel))) {
+            warnings.push({
+              file: full,
+              agent: name,
+              message: `has model: "${meta.model}", which this version does not recognise \u2014 expected one of ${exports2.VALID_MODELS.join(", ")}, or omit the line to inherit the current session's model. It will still be sent; the server decides whether it is valid.`
+            });
+          }
+          const unknown = (tools ?? []).filter((t2) => !KNOWN_TOOL_NAMES.has(t2) && !t2.includes("__"));
+          if (unknown.length) {
+            warnings.push({
+              file: full,
+              agent: name,
+              message: `lists unknown tool name(s): ${unknown.join(", ")}. An allowlist only grants, so these silently do nothing and the agent cannot use them. Tool names are lower_snake_case (read_file, search_files, glob, bash).`
+            });
+          }
+          if ((tools ?? []).length === 1 && tools?.[0] === "task") {
+            warnings.push({
+              file: full,
+              agent: name,
+              message: "lists `task` as its ONLY tool, so it can delegate but cannot read, write or run anything itself \u2014 it has no way to do or verify work. Add the tools it needs, or drop the `tools:` line to inherit its parent's."
+            });
+          }
+          const strayKeys = Object.keys(meta).filter((k) => !KNOWN_META_KEYS.has(k));
+          if (strayKeys.length) {
+            warnings.push({
+              file: full,
+              agent: name,
+              message: `has unrecognised frontmatter key(s): ${strayKeys.join(", ")} \u2014 these are ignored.`
+            });
+          }
+          if (!body) {
+            warnings.push({
+              file: full,
+              agent: name,
+              message: "has an empty body \u2014 the text below the frontmatter IS the agent's system prompt, so it currently has no instructions."
+            });
+          }
+        }
+        into.set(name, {
+          name,
+          description: meta.description || `Custom ${name} agent`,
+          tools: effectiveTools,
+          model: parseModel(meta.model),
+          prompt: body,
+          source: source2,
+          // Exposed to user/plugin definitions too — `test_files_only: true` (or
+          // `testFilesOnly`) lets anyone build a test-writing agent that genuinely
+          // cannot touch production source, rather than only the builtin getting
+          // that guarantee.
+          ...parseBool(meta.test_files_only ?? meta.testfilesonly) ? { testFilesOnly: true } : {},
+          // The `ok &&` is defensive, not load-bearing: parseFrontmatter already returns an
+          // EMPTY meta when it cannot find a `---` block, so `meta.memory` is undefined on
+          // that path regardless. It stays because the guarantee we want — an unreadable
+          // definition never receives a writable store — should survive parseFrontmatter
+          // being changed to salvage partial metadata, which is a plausible future edit.
+          ...ok && parseMemoryScope(meta.memory) ? { memory: parseMemoryScope(meta.memory) } : {}
+        });
+      }
+    }
+    function loadAgentTypes(workDir) {
+      return loadAgentTypesWithWarnings2(workDir).types;
+    }
+    function loadAgentTypesWithWarnings2(workDir) {
+      const out = /* @__PURE__ */ new Map();
+      const warnings = [];
+      loadDir(path7.join(workDir, ".nexrall", "agents"), "project", out, warnings);
+      loadDir(path7.join(os6.homedir(), ".nexrall", "agents"), "global", out, warnings);
+      for (const dir of (0, index_1.pluginAssetDirs)(workDir, "agents"))
+        loadDir(dir, "plugin", out, warnings);
+      for (const agent of BUILTIN_AGENTS) {
+        if (!out.has(agent.name))
+          out.set(agent.name, agent);
+      }
+      const builtinOrder = new Map(BUILTIN_AGENTS.map((a, i2) => [a.name, i2]));
+      const types3 = [...out.values()].sort((a, b) => {
+        const ai = builtinOrder.get(a.name);
+        const bi = builtinOrder.get(b.name);
+        if (ai !== void 0 && bi !== void 0)
+          return ai - bi;
+        if (ai !== void 0)
+          return -1;
+        if (bi !== void 0)
+          return 1;
+        return a.name.localeCompare(b.name);
+      });
+      return { types: types3, warnings };
+    }
+    function knownToolNames() {
+      return [...KNOWN_TOOL_NAMES].sort();
+    }
+    function builtinAgents() {
+      return BUILTIN_AGENTS;
+    }
+    function summariseAgents(types3) {
+      if (!types3.length)
+        return "";
+      return types3.map((t2) => {
+        const canWrite = !t2.tools || t2.tools.some((x2) => WRITE_TOOL_HINTS.has(x2));
+        const access = t2.testFilesOnly ? "writes TEST files only" : canWrite ? "can modify files" : "read-only";
+        const model = t2.model ? `, ${t2.model} model` : "";
+        return `- ${t2.name} (${access}${model}): ${t2.description}`;
+      }).join("\n");
+    }
+    var WRITE_TOOL_HINTS = /* @__PURE__ */ new Set([
+      "write_file",
+      "edit_file",
+      "multi_edit",
+      "notebook_edit",
+      "delete_file",
+      "move_file",
+      "copy_file",
+      "write_docx",
+      "write_xlsx",
+      "write_pptx"
+    ]);
+    function findAgentType(types3, name) {
+      if (!name)
+        return void 0;
+      const want = name.trim().toLowerCase();
+      return types3.find((t2) => t2.name.toLowerCase() === want);
+    }
+  }
+});
+
+// ../core/dist/commands/loader.js
+var require_loader = __commonJS({
+  "../core/dist/commands/loader.js"(exports2) {
+    "use strict";
+    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? function(o, m2, k, k2) {
+      if (k2 === void 0)
+        k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m2, k);
+      if (!desc || ("get" in desc ? !m2.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m2[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    } : function(o, m2, k, k2) {
+      if (k2 === void 0)
+        k2 = k;
+      o[k2] = m2[k];
+    });
+    var __setModuleDefault = exports2 && exports2.__setModuleDefault || (Object.create ? function(o, v) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v });
+    } : function(o, v) {
+      o["default"] = v;
+    });
+    var __importStar = exports2 && exports2.__importStar || /* @__PURE__ */ function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2)
+            if (Object.prototype.hasOwnProperty.call(o2, k))
+              ar[ar.length] = k;
+          return ar;
+        };
+        return ownKeys(o);
+      };
+      return function(mod) {
+        if (mod && mod.__esModule)
+          return mod;
+        var result = {};
+        if (mod != null) {
+          for (var k = ownKeys(mod), i2 = 0; i2 < k.length; i2++)
+            if (k[i2] !== "default")
+              __createBinding(result, mod, k[i2]);
+        }
+        __setModuleDefault(result, mod);
+        return result;
+      };
+    }();
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.loadSlashCommands = loadSlashCommands;
+    exports2.findSlashCommand = findSlashCommand;
+    exports2.expandBody = expandBody;
+    exports2.expandCommand = expandCommand;
+    var fs9 = __importStar(__require("fs"));
+    var path7 = __importStar(__require("path"));
+    var os6 = __importStar(__require("os"));
+    var child_process_1 = __require("child_process");
+    var index_1 = require_plugins();
+    var frontmatter_1 = require_frontmatter();
+    var agentTypes_1 = require_agentTypes();
+    var BUILTIN_COMMANDS = [
+      {
+        name: "review",
+        description: "Review uncommitted changes (or a PR/branch diff) for bugs and risks",
+        source: "builtin",
+        body: [
+          "Review the following diff like a meticulous senior engineer. Target: $ARGUMENTS",
+          "(If no target given, review the uncommitted working-tree changes below. If a branch or PR",
+          "number is given, run the appropriate `git diff <base>...` or `gh pr diff <n>` yourself first.)",
+          "",
+          "Branch: !`git branch --show-current`",
+          "Status: !`git status --short`",
+          "",
+          "Diff (uncommitted):",
+          "```diff",
+          "!`git diff HEAD --unified=5 --no-color | head -4000`",
+          "```",
+          "",
+          "Review methodology:",
+          "1. Read the surrounding code of every changed hunk (read_file with offset/limit) \u2014 never judge a hunk in isolation.",
+          "2. Look for: correctness bugs, edge cases (empty/null/unicode/concurrency), security issues",
+          "   (injection, path traversal, secrets), breaking API changes (find_references / search callers),",
+          "   silent behaviour changes, and missing error handling.",
+          "3. Check tests: do existing tests cover the change? Are assertions weakened?",
+          "",
+          "Output format:",
+          "- \u{1F534} Critical (must fix before merge) \u2014 with file:line and a concrete fix",
+          "- \u{1F7E1} Warning (should fix) \u2014 with file:line",
+          "- \u{1F7E2} Suggestion (nice to have)",
+          "- Verdict: APPROVE / REQUEST CHANGES with a one-paragraph summary.",
+          "Do NOT modify any files \u2014 this is a read-only review."
+        ].join("\n")
+      }
+    ];
+    function loadDir(dir, source2, into) {
+      let files;
+      try {
+        files = fs9.readdirSync(dir).filter((f3) => f3.endsWith(".md"));
+      } catch {
+        return;
+      }
+      for (const file of files) {
+        try {
+          const raw = fs9.readFileSync(path7.join(dir, file), "utf-8");
+          const { meta, body } = (0, frontmatter_1.parseFrontmatter)(raw);
+          const name = (meta.name || path7.basename(file, ".md")).trim().toLowerCase();
+          if (!name)
+            continue;
+          if (source2 !== "project" && into.has(name))
+            continue;
+          const model = (0, agentTypes_1.parseModel)(meta.model);
+          into.set(name, {
+            name,
+            description: meta.description || `Custom /${name} command`,
+            model,
+            mode: meta.mode || void 0,
+            body,
+            source: source2
+          });
+        } catch {
+        }
+      }
+    }
+    function loadSlashCommands(workDir) {
+      const out = /* @__PURE__ */ new Map();
+      loadDir(path7.join(workDir, ".nexrall", "commands"), "project", out);
+      loadDir(path7.join(os6.homedir(), ".nexrall", "commands"), "global", out);
+      for (const dir of (0, index_1.pluginAssetDirs)(workDir, "commands"))
+        loadDir(dir, "plugin", out);
+      for (const cmd of BUILTIN_COMMANDS) {
+        if (!out.has(cmd.name))
+          out.set(cmd.name, cmd);
+      }
+      return [...out.values()];
+    }
+    function findSlashCommand(cmds, name) {
+      const want = name.replace(/^\//, "").trim().toLowerCase();
+      return cmds.find((c) => c.name === want);
+    }
+    function expandBody(body, argString, workDir) {
+      const args = argString.trim();
+      const positional = args ? args.split(/\s+/) : [];
+      let out = body;
+      out = out.replace(/!`([^`]+)`/g, (_m, c) => {
+        try {
+          const stdout = (0, child_process_1.execSync)(c, { cwd: workDir, encoding: "utf-8", timeout: 15e3, stdio: ["ignore", "pipe", "pipe"] });
+          return stdout.trim();
+        } catch (err) {
+          return `[command failed: ${c} \u2014 ${err.message}]`;
+        }
+      });
+      out = out.replace(/(^|\s)@([^\s]+)/g, (_m, lead, rel) => {
+        const abs = path7.isAbsolute(rel) ? rel : path7.join(workDir, rel);
+        try {
+          const content = fs9.readFileSync(abs, "utf-8").slice(0, 12e3);
+          return `${lead}
+[File: ${rel}]
+\`\`\`
+${content}
+\`\`\`
+`;
+        } catch {
+          return `${lead}[missing file: ${rel}]`;
+        }
+      });
+      out = out.replace(/\$(\d+)/g, (_m, n) => positional[Number(n) - 1] ?? "");
+      const hadArgsToken = /\$ARGUMENTS/.test(out);
+      out = out.replace(/\$ARGUMENTS/g, args);
+      if (!hadArgsToken && !/\$\d+/.test(body) && args) {
+        out = `${out}
+
+${args}`;
+      }
+      return out.trim();
+    }
+    function expandCommand(cmd, argString, workDir) {
+      return expandBody(cmd.body, argString, workDir);
+    }
+  }
+});
+
+// ../core/dist/agent/skills.js
+var require_skills = __commonJS({
+  "../core/dist/agent/skills.js"(exports2) {
+    "use strict";
+    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? function(o, m2, k, k2) {
+      if (k2 === void 0)
+        k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m2, k);
+      if (!desc || ("get" in desc ? !m2.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m2[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    } : function(o, m2, k, k2) {
+      if (k2 === void 0)
+        k2 = k;
+      o[k2] = m2[k];
     });
     var __setModuleDefault = exports2 && exports2.__setModuleDefault || (Object.create ? function(o, v) {
       Object.defineProperty(o, "default", { enumerable: true, value: v });
@@ -11980,6 +12592,7 @@ var require_skills = __commonJS({
     var index_1 = require_plugins();
     var loader_1 = require_loader();
     var frontmatter_1 = require_frontmatter();
+    var agentTypes_1 = require_agentTypes();
     var KNOWN_META_KEYS = /* @__PURE__ */ new Set([
       "name",
       "description",
@@ -12010,7 +12623,7 @@ var require_skills = __commonJS({
       return items.length ? items : void 0;
     }
     function toSkill(meta, body, name, source2, dir, nested) {
-      const model = ["turbo", "pro", "ultra"].find((x2) => x2 === (meta.model ?? "").toLowerCase());
+      const model = (0, agentTypes_1.parseModel)(meta.model);
       return {
         name,
         description: meta.description || `Custom /${name} skill`,
@@ -12050,6 +12663,14 @@ var require_skills = __commonJS({
       if (strayKeys.length) {
         warnings.push({ file, name: effectiveName, message: `has unrecognised frontmatter key(s): ${strayKeys.join(", ")} \u2014 these are ignored.` });
       }
+      const declaredModel = meta.model === void 0 ? void 0 : (0, agentTypes_1.parseModel)(meta.model);
+      if (meta.model !== void 0 && (declaredModel === void 0 || !agentTypes_1.VALID_MODELS.includes(declaredModel))) {
+        warnings.push({
+          file,
+          name: effectiveName,
+          message: `has model: "${meta.model}", which this version does not recognise \u2014 expected one of ${agentTypes_1.VALID_MODELS.join(", ")}, or omit the line to inherit the current session's model. It will still be sent; the server decides whether it is valid.`
+        });
+      }
     }
     function loadFlatCommandDir(dir, source2, into, warnings) {
       let files;
@@ -101710,614 +102331,6 @@ ${expanded}` };
   }
 });
 
-// ../core/dist/agent/agentTypes.js
-var require_agentTypes = __commonJS({
-  "../core/dist/agent/agentTypes.js"(exports2) {
-    "use strict";
-    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? function(o, m2, k, k2) {
-      if (k2 === void 0)
-        k2 = k;
-      var desc = Object.getOwnPropertyDescriptor(m2, k);
-      if (!desc || ("get" in desc ? !m2.__esModule : desc.writable || desc.configurable)) {
-        desc = { enumerable: true, get: function() {
-          return m2[k];
-        } };
-      }
-      Object.defineProperty(o, k2, desc);
-    } : function(o, m2, k, k2) {
-      if (k2 === void 0)
-        k2 = k;
-      o[k2] = m2[k];
-    });
-    var __setModuleDefault = exports2 && exports2.__setModuleDefault || (Object.create ? function(o, v) {
-      Object.defineProperty(o, "default", { enumerable: true, value: v });
-    } : function(o, v) {
-      o["default"] = v;
-    });
-    var __importStar = exports2 && exports2.__importStar || /* @__PURE__ */ function() {
-      var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function(o2) {
-          var ar = [];
-          for (var k in o2)
-            if (Object.prototype.hasOwnProperty.call(o2, k))
-              ar[ar.length] = k;
-          return ar;
-        };
-        return ownKeys(o);
-      };
-      return function(mod) {
-        if (mod && mod.__esModule)
-          return mod;
-        var result = {};
-        if (mod != null) {
-          for (var k = ownKeys(mod), i2 = 0; i2 < k.length; i2++)
-            if (k[i2] !== "default")
-              __createBinding(result, mod, k[i2]);
-        }
-        __setModuleDefault(result, mod);
-        return result;
-      };
-    }();
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.loadAgentTypes = loadAgentTypes;
-    exports2.loadAgentTypesWithWarnings = loadAgentTypesWithWarnings2;
-    exports2.knownToolNames = knownToolNames;
-    exports2.builtinAgents = builtinAgents;
-    exports2.summariseAgents = summariseAgents;
-    exports2.findAgentType = findAgentType;
-    var fs9 = __importStar(__require("fs"));
-    var path7 = __importStar(__require("path"));
-    var os6 = __importStar(__require("os"));
-    var index_1 = require_plugins();
-    var frontmatter_1 = require_frontmatter();
-    var VALID_MEMORY_SCOPES = ["project", "user", "local"];
-    function parseMemoryScope(v) {
-      const s2 = (v ?? "").trim().toLowerCase();
-      return VALID_MEMORY_SCOPES.includes(s2) ? s2 : void 0;
-    }
-    var READ_ONLY_TOOLS = [
-      // Universal
-      "read_file",
-      "search_files",
-      "glob",
-      "list_directory",
-      "bash",
-      "bash_output",
-      // kill_shell belongs next to bash_output: an agent that can start a background
-      // process and poll it but never stop it leaks that process past its own
-      // lifetime. Stopping a shell you started is not a write to the repo.
-      "kill_shell",
-      "notebook_read",
-      "todo_write",
-      "todo_read",
-      // memory_READ, deliberately without memory_write.
-      //
-      // Reading is free capability: a sub-agent that knows "tests run with X" or "never
-      // edit Z directly" does better work, and withholding it meant every sub-agent
-      // rediscovered project conventions from scratch. Writing is a different thing
-      // entirely — memory is durable, cross-session, SHARED state, while sub-agents run
-      // up to 4-wide in parallel with their reasoning hidden from the user. A wrong fact
-      // written there is invisible and permanent, and it competes for a capped, shared
-      // budget that gets periodically condensed.
-      //
-      // So the parent owns writes: a sub-agent that learns something durable says so in
-      // its report, and the main agent — the one actually talking to the user — decides.
-      // A sub-agent that needs its own persistent notes gets the per-agent store instead
-      // (see `memory:` in the frontmatter), which is scoped to itself and cannot pollute
-      // the shared file.
-      "memory_read",
-      // Skills are reusable prompt playbooks, and loop.ts advertises the skills
-      // catalogue to sub-agents at EVERY depth — so withholding the tool that loads
-      // one meant showing every sub-agent a menu it could not order from.
-      "use_skill",
-      // VS Code language server (ignored on the CLI)
-      "get_symbols",
-      "get_workspace_symbols",
-      "find_references",
-      "go_to_definition",
-      "get_hover",
-      "get_diagnostics"
-    ];
-    var RESEARCH_TOOLS = [...READ_ONLY_TOOLS, "fetch_url"];
-    var WRITE_TOOLS = [
-      ...READ_ONLY_TOOLS,
-      "write_file",
-      "edit_file",
-      "multi_edit",
-      "create_directory",
-      "move_file",
-      "copy_file",
-      // notebook_edit is a write tool like any other, and allowsTestOnlyWrite already
-      // knows its shape (`source` is cell CONTENT, not a path). Omitting it just meant
-      // test-writer silently could not touch notebooks.
-      "notebook_edit",
-      // Office document generation — same write-access tier as write_file, just a
-      // structured content shape instead of raw text (see tools/executor.ts).
-      "write_docx",
-      "write_xlsx",
-      "write_pptx"
-    ];
-    var BUILTIN_AGENTS = [
-      {
-        // The catch-all, matching Claude Code's `general-purpose`.
-        //
-        // This capability already existed — omitting `subagent_type` gives an unrestricted
-        // sub-agent — but it had no NAME, and that had two consequences worth fixing:
-        //
-        //   1. `permissions.deny: ["task(...)"]` matches on the agent name, so the ONE
-        //      sub-agent that can write files and run bash was the one variant a project
-        //      could not disable individually. Only a blanket `deny: ["task"]` reached it.
-        //   2. The model had to infer that leaving the field blank was even an option, so
-        //      it would sometimes pick a specialist that fitted badly (an unrestricted
-        //      explorer) rather than the general worker it actually wanted.
-        //
-        // `tools` is deliberately UNDEFINED, which means "no allowlist" — full access,
-        // inheriting whatever the session permits. That is the same power an unnamed
-        // sub-task always had; naming it changes only who can see and deny it.
-        //
-        // It also makes this the ONLY builtin that can nest, since every specialist omits
-        // `task` on purpose. So the tree this enables is up to `maxSubagentDepth` generations
-        // of unrestricted agents — accepted deliberately, because the alternative (a catch-all
-        // that cannot delegate) removes the one agent suited to orchestration.
-        //
-        // The safety properties that bound it: plan mode is inherited, the user's permission
-        // gate runs on every call, a child's allowlist is INTERSECTED with its parent's so a
-        // restricted ancestor cannot be escaped through this agent, `test_files_only` is
-        // likewise sticky, and both the depth ceiling and the session budget still apply.
-        name: "general-purpose",
-        description: "General-purpose worker for a multi-step task that needs BOTH exploration and changes (edit files, run commands) and that no specialist above fits. Inherits the session model and full tool access, so prefer a narrower agent when one matches.",
-        prompt: "You are a general-purpose engineering sub-agent. Work the task end to end: explore what you need, make the changes, and verify them with the project's own build/test commands.\n\nRules:\n- Mirror existing conventions; make the smallest correct change.\n- Verify before you claim success. If you could not verify, say so explicitly.\n- Your FINAL MESSAGE is the only thing that reaches the main agent: state what you changed (with file paths), what you ran and its outcome, and anything you deliberately left undone.",
-        source: "builtin"
-      },
-      {
-        name: "reviewer",
-        description: "Read-only code reviewer \u2014 finds correctness bugs, edge cases, and security issues in a diff or file set. Cannot modify files.",
-        tools: READ_ONLY_TOOLS,
-        source: "builtin",
-        prompt: [
-          "You are a meticulous senior code reviewer. You NEVER modify files \u2014 you only read, search, and report.",
-          "",
-          "Method:",
-          "1. Read the full context around every change you are asked to review; never judge a hunk in isolation.",
-          "2. Hunt specifically for: correctness bugs, unhandled edge cases (empty/null/unicode/concurrency/timezone),",
-          "   security issues (injection, path traversal, secrets in code, unsafe deserialization), breaking API",
-          "   changes (search for callers first), silent behaviour changes, and swallowed errors.",
-          "3. Verify test coverage: are the changed paths tested? Were assertions weakened or tests deleted?",
-          "4. Only use bash for read-only commands (git diff/log/show, grep, test runs). Never run mutating commands.",
-          "",
-          "Report format: \u{1F534} Critical / \u{1F7E1} Warning / \u{1F7E2} Suggestion, each with file:line and a concrete fix,",
-          "then a final verdict (APPROVE or REQUEST CHANGES) with a one-paragraph rationale."
-        ].join("\n")
-      },
-      // Promoted from the security-audit plugin to a builtin.
-      //
-      // Leaving it plugin-only was indefensible next to `reviewer` being builtin:
-      // reviewer's own prompt already tells it to look for security issues, so
-      // security IS treated as default work — yet the specialist agent for it was
-      // invisible unless the user happened to know the plugin existed. For an agent
-      // that WRITES code, "you only get a security review if you knew to install
-      // something" is the wrong default.
-      {
-        name: "security-auditor",
-        description: "Read-only security auditor \u2014 hunts injection, authz, secrets, and validation flaws in a path or diff. Cannot modify files.",
-        tools: READ_ONLY_TOOLS,
-        // No `model` override — inherits the session's, same as general-purpose.
-        // A previous version forced 'pro' (Claude Opus 5) here, which silently
-        // billed Anthropic even for a session running entirely on OpenAI/DeepSeek/
-        // Qwen. Consistency with the main conversation's provider matters more
-        // than defaulting every specialist to a fixed tier.
-        source: "builtin",
-        prompt: [
-          "You are a security auditor. You find real, exploitable flaws \u2014 not style issues.",
-          "",
-          "Method:",
-          "1. Map the attack surface FIRST: entry points (HTTP routes, message handlers, CLI args, file/network",
-          "   input, deserialization), then trace user-controlled data inward to where it is used.",
-          "2. For each finding: file:line, the flaw class, a one-line exploit scenario, and the concrete fix.",
-          "3. Grade severity honestly: Critical = remote compromise or data breach; High = auth bypass/IDOR;",
-          "   Medium = needs unusual preconditions; Low = hardening.",
-          "",
-          "Classes worth the most attention, in order: injection (SQL/command/template/prototype), broken",
-          "authz (missing ownership checks, IDOR, trusting client-supplied ids), secrets committed to source,",
-          "path traversal, SSRF, unsafe deserialization, missing rate limits on expensive or auth endpoints,",
-          "and crypto misuse (hand-rolled comparison, predictable randomness).",
-          "",
-          "Hard rules:",
-          "- READ-ONLY: never modify, create or delete files. bash only for read-only inspection.",
-          "- NEVER print a discovered secret's value. Report its location and advise rotation.",
-          "- Distinguish EXPLOITABLE from theoretical, and say which one each finding is.",
-          '- "No issues found in scope X" is a valid, useful result. Do not pad the report to look thorough.'
-        ].join("\n")
-      },
-      // The gap Claude Code fills with its built-in `Explore`: read-heavy codebase
-      // search that would otherwise flood the parent's context. Defaults to the
-      // cheapest model on purpose — "find every caller of X" has no need of a
-      // frontier model, and this is the agent most likely to be spawned in bulk.
-      {
-        name: "explorer",
-        // Lean prompt: this agent exists to keep bulk searching cheap, and it reports
-        // findings for the MAIN agent to interpret with full project context.
-        lightPrompt: true,
-        description: "Fast read-only codebase explorer \u2014 locates files, symbols, and call sites and reports concise findings. Use to keep bulk searching out of the main context. Cannot modify files.",
-        tools: READ_ONLY_TOOLS,
-        // No `model` override — inherits the session's. A previous version forced
-        // 'turbo' (Claude Sonnet 5) on the theory that bulk search doesn't need a
-        // frontier model, but that silently billed Anthropic regardless of which
-        // provider the user actually selected for the conversation.
-        source: "builtin",
-        prompt: [
-          "You map code. You NEVER modify anything.",
-          "",
-          "Method:",
-          "1. Prefer structural search over text search where available (get_workspace_symbols, find_references,",
-          "   go_to_definition); fall back to search_files/glob otherwise.",
-          "2. Read only the sections you need \u2014 use read_file with offset/limit on large files instead of",
-          "   pulling in thousands of lines.",
-          "3. Follow the real call graph rather than guessing from names.",
-          "",
-          "Your ONLY output is a compact report: the file:line locations that matter, how they relate, and the",
-          "direct answer to the question you were given. This exists to keep bulk search OUT of the parent's",
-          "context, so do not paste large file contents back \u2014 cite locations and summarise. Say plainly when",
-          'something does not exist; a confident wrong answer is far worse than "not found".'
-        ].join("\n")
-      },
-      // Matches Claude Code's built-in `Plan`: research a change and return a
-      // strategy, deliberately WITHOUT write access so "make a plan" can never
-      // quietly become "start editing".
-      {
-        name: "planner",
-        description: "Read-only planning agent \u2014 researches a change and returns a concrete step-by-step implementation plan with risks and affected files. Cannot modify files.",
-        tools: RESEARCH_TOOLS,
-        // No `model` override — inherits the session's, for the same reason as
-        // explorer/security-auditor above: a fixed alias silently billed Anthropic
-        // regardless of the user's chosen provider.
-        source: "builtin",
-        prompt: [
-          "You produce implementation plans. You NEVER modify files \u2014 planning and doing are separate steps,",
-          'and this agent exists so "plan it" cannot silently turn into "change it".',
-          "",
-          "Method:",
-          "1. Read the actual code before proposing anything. No plan may rest on an assumed API shape.",
-          "2. Find every affected call site (find_references / search_files) and list them.",
-          "3. Order the steps so the tree stays working after each one \u2014 types, then implementation, then",
-          "   tests, then exports/registration.",
-          "",
-          "Output:",
-          "- Goal, in one sentence.",
-          "- Numbered steps, each with the exact files touched and what changes in them.",
-          "- Risks + the specific thing that could break, and how it would be detected.",
-          "- How to verify (the exact test/build command for THIS project, taken from package.json/Makefile).",
-          "- Anything genuinely ambiguous, stated as an open question rather than a silent assumption."
-        ].join("\n")
-      },
-      // Promoted from the test-gen plugin. Needs write access — it produces test
-      // files — but is deliberately forbidden from touching source, because "make the
-      // tests pass" is the single most common way an agent destroys signal.
-      {
-        name: "test-writer",
-        description: "Writes tests that follow the project's existing conventions. May create/edit TEST files only \u2014 never production source.",
-        tools: WRITE_TOOLS,
-        // Enforced, not merely requested: the permission gate refuses a write whose
-        // path is not a test file. Without this the allowlist would grant edit_file
-        // for every path and the rule below would be a suggestion the model is free
-        // to rationalise its way past.
-        testFilesOnly: true,
-        source: "builtin",
-        prompt: [
-          "You write tests. You may create and edit TEST files only.",
-          "",
-          "Hard rules \u2014 these are the ways test-writing agents destroy value, so they are non-negotiable:",
-          "- NEVER modify production source to make a test pass. If the code looks wrong, REPORT it and stop.",
-          "- NEVER weaken, delete or skip an existing assertion or test.",
-          "- A test that cannot fail is worse than no test. Every test must be able to fail for one clear reason.",
-          "",
-          "Method:",
-          "1. Read the existing tests FIRST and copy their conventions exactly \u2014 runner, file naming, layout,",
-          "   assertion style, fixture/helper patterns. Never introduce a new framework.",
-          "2. Test observable behaviour and the contract, not private internals.",
-          "3. Cover the boring-but-real cases: empty input, null/undefined, unicode and non-BMP characters,",
-          "   boundaries, error paths, concurrency where it applies.",
-          "4. No sleeps or wall-clock dependence \u2014 those produce the flaky tests that get deleted later.",
-          "5. RUN the tests you wrote and report the real output. Never claim a test passes without running it."
-        ].join("\n")
-      },
-      // The DevOps gap — answered with a READ-ONLY advisor, not an operator.
-      //
-      // A "DevOps agent" with write/apply access is a genuinely different risk class
-      // from the others here: its mistakes are `kubectl delete`, a bad `terraform
-      // apply`, a broken deploy pipeline — often not revertible and affecting
-      // production rather than a working tree. So this one diagnoses and proposes a
-      // diff; a human applies it. That asymmetry is the whole design.
-      {
-        name: "devops-advisor",
-        description: "Read-only CI/CD, container, and infrastructure advisor \u2014 diagnoses pipelines, Dockerfiles, and k8s manifests and proposes concrete fixes as a diff. Never applies changes.",
-        tools: RESEARCH_TOOLS,
-        // No `model` override — inherits the session's, for the same reason as the
-        // other specialists above.
-        source: "builtin",
-        prompt: [
-          "You are an infrastructure and delivery advisor. You DIAGNOSE and PROPOSE. You never apply changes.",
-          "",
-          "Hard rules:",
-          "- READ-ONLY, and stricter than the other read-only agents: bash is for INSPECTION only",
-          "  (git log/diff, cat, grep, `kubectl get/describe`, `docker images`, `terraform plan`).",
-          "  NEVER run anything that mutates infrastructure \u2014 no apply/delete/scale/rollout/restart/push,",
-          "  no `terraform apply`, no `helm upgrade`. If a fix needs such a command, WRITE IT OUT for a human.",
-          "- Never print secret values from env files, k8s Secrets or CI variables. Reference them by name.",
-          "",
-          "Method:",
-          "1. Read what actually exists \u2014 workflow files, Dockerfiles, manifests, kustomize overlays, the",
-          '   deploy scripts \u2014 before drawing any conclusion. Never reason from what a stack "usually" looks like.',
-          "2. Follow the real path a change takes to production, and name the step that is broken or missing.",
-          "3. Check the failure modes that bite hardest: CI path filters that skip files a workload actually",
-          "   needs, image tags that do not match what is deployed, missing health probes, absent resource",
-          "   limits, secrets baked into images, ports/timeouts inconsistent between proxy and app, and",
-          "   migrations that must run before the new image is live.",
-          "",
-          "Output: the diagnosis, the evidence (file:line or command output), the proposed change as a diff or",
-          "exact file content, and the command a human should run to apply and verify it."
-        ].join("\n")
-      }
-    ];
-    var KNOWN_TOOL_NAMES = /* @__PURE__ */ new Set([
-      "read_file",
-      "write_file",
-      "write_docx",
-      "write_xlsx",
-      "write_pptx",
-      "edit_file",
-      "multi_edit",
-      "list_directory",
-      "create_directory",
-      "move_file",
-      "copy_file",
-      "delete_file",
-      "search_files",
-      "glob",
-      "bash",
-      "bash_output",
-      "kill_shell",
-      "notebook_read",
-      "notebook_edit",
-      "todo_write",
-      "todo_read",
-      "memory_write",
-      "memory_read",
-      "use_skill",
-      "fetch_url",
-      "web_search",
-      "generate_image",
-      "stock_photo",
-      "open_in_browser",
-      "browser_action",
-      "task",
-      // Granted by a `memory:` scope rather than listed in a `tools:` line, but a user may
-      // still name it explicitly — so it must validate rather than be flagged as a typo.
-      "agent_memory_write",
-      "get_symbols",
-      "get_workspace_symbols",
-      "find_references",
-      "go_to_definition",
-      "get_hover",
-      "get_diagnostics"
-    ]);
-    var KNOWN_META_KEYS = /* @__PURE__ */ new Set([
-      "name",
-      "description",
-      "tools",
-      "model",
-      "test_files_only",
-      "testfilesonly",
-      "memory"
-    ]);
-    var VALID_MODELS = [
-      "claude-sonnet-5",
-      "claude-opus-5",
-      "claude-fable-5",
-      "gpt-5.4",
-      "gpt-5.4-mini",
-      "gpt-4.1",
-      // Legacy tier aliases — still accepted, still resolved by the backend.
-      "turbo",
-      "pro",
-      "ultra",
-      "fast"
-    ];
-    function parseModel(v) {
-      const raw = (v ?? "").trim();
-      if (!raw)
-        return void 0;
-      const lower2 = raw.toLowerCase();
-      if (lower2 === "turbo" || lower2 === "pro" || lower2 === "ultra" || lower2 === "fast")
-        return lower2;
-      return raw;
-    }
-    function parseBool(v) {
-      return /^(true|yes|1|on)$/i.test((v ?? "").trim());
-    }
-    function parseToolList(v) {
-      if (!v)
-        return void 0;
-      const tools = v.replace(/^\[|\]$/g, "").split(/[,\s]+/).map((t2) => t2.trim()).filter(Boolean);
-      return tools.length ? tools : void 0;
-    }
-    function loadDir(dir, source2, into, warnings) {
-      let entries;
-      try {
-        entries = fs9.readdirSync(dir, { withFileTypes: true });
-      } catch {
-        return;
-      }
-      for (const entry of entries) {
-        const full = path7.join(dir, entry.name);
-        if (entry.isDirectory()) {
-          loadDir(full, source2, into, warnings);
-          continue;
-        }
-        if (!entry.name.endsWith(".md"))
-          continue;
-        let raw;
-        try {
-          raw = fs9.readFileSync(full, "utf-8");
-        } catch (err) {
-          warnings.push({ file: full, agent: path7.basename(entry.name, ".md"), message: `could not be read (${err.message}) \u2014 this agent was skipped` });
-          continue;
-        }
-        const { meta, body, ok } = (0, frontmatter_1.parseFrontmatter)(raw);
-        const name = (meta.name || path7.basename(entry.name, ".md")).trim();
-        if (!name)
-          continue;
-        if (source2 !== "project" && into.has(name))
-          continue;
-        const tools = parseToolList(meta.tools);
-        let effectiveTools = tools;
-        if (!ok) {
-          effectiveTools = READ_ONLY_TOOLS;
-          warnings.push({
-            file: full,
-            agent: name,
-            message: "has no valid YAML frontmatter (a `---` block must be the first thing in the file), so no tool allowlist could be read. Treating it as READ-ONLY. Add frontmatter with a `tools:` line to grant more."
-          });
-        } else {
-          if (!meta.description) {
-            warnings.push({
-              file: full,
-              agent: name,
-              message: "has no `description:` \u2014 that text is the ONLY thing the model uses to decide when to delegate to this agent, so it will rarely be picked."
-            });
-          }
-          if (meta.memory !== void 0 && parseMemoryScope(meta.memory) === void 0) {
-            warnings.push({
-              file: full,
-              agent: name,
-              message: `has memory: "${meta.memory}", which is not a valid scope \u2014 use one of ${VALID_MEMORY_SCOPES.join(", ")}, or omit the line to give this agent no persistent notes.`
-            });
-          }
-          const declaredModel = meta.model === void 0 ? void 0 : parseModel(meta.model);
-          if (meta.model !== void 0 && (declaredModel === void 0 || !VALID_MODELS.includes(declaredModel))) {
-            warnings.push({
-              file: full,
-              agent: name,
-              message: `has model: "${meta.model}", which this version does not recognise \u2014 expected one of ${VALID_MODELS.join(", ")}, or omit the line to inherit the current session's model. It will still be sent; the server decides whether it is valid.`
-            });
-          }
-          const unknown = (tools ?? []).filter((t2) => !KNOWN_TOOL_NAMES.has(t2) && !t2.includes("__"));
-          if (unknown.length) {
-            warnings.push({
-              file: full,
-              agent: name,
-              message: `lists unknown tool name(s): ${unknown.join(", ")}. An allowlist only grants, so these silently do nothing and the agent cannot use them. Tool names are lower_snake_case (read_file, search_files, glob, bash).`
-            });
-          }
-          if ((tools ?? []).length === 1 && tools?.[0] === "task") {
-            warnings.push({
-              file: full,
-              agent: name,
-              message: "lists `task` as its ONLY tool, so it can delegate but cannot read, write or run anything itself \u2014 it has no way to do or verify work. Add the tools it needs, or drop the `tools:` line to inherit its parent's."
-            });
-          }
-          const strayKeys = Object.keys(meta).filter((k) => !KNOWN_META_KEYS.has(k));
-          if (strayKeys.length) {
-            warnings.push({
-              file: full,
-              agent: name,
-              message: `has unrecognised frontmatter key(s): ${strayKeys.join(", ")} \u2014 these are ignored.`
-            });
-          }
-          if (!body) {
-            warnings.push({
-              file: full,
-              agent: name,
-              message: "has an empty body \u2014 the text below the frontmatter IS the agent's system prompt, so it currently has no instructions."
-            });
-          }
-        }
-        into.set(name, {
-          name,
-          description: meta.description || `Custom ${name} agent`,
-          tools: effectiveTools,
-          model: parseModel(meta.model),
-          prompt: body,
-          source: source2,
-          // Exposed to user/plugin definitions too — `test_files_only: true` (or
-          // `testFilesOnly`) lets anyone build a test-writing agent that genuinely
-          // cannot touch production source, rather than only the builtin getting
-          // that guarantee.
-          ...parseBool(meta.test_files_only ?? meta.testfilesonly) ? { testFilesOnly: true } : {},
-          // The `ok &&` is defensive, not load-bearing: parseFrontmatter already returns an
-          // EMPTY meta when it cannot find a `---` block, so `meta.memory` is undefined on
-          // that path regardless. It stays because the guarantee we want — an unreadable
-          // definition never receives a writable store — should survive parseFrontmatter
-          // being changed to salvage partial metadata, which is a plausible future edit.
-          ...ok && parseMemoryScope(meta.memory) ? { memory: parseMemoryScope(meta.memory) } : {}
-        });
-      }
-    }
-    function loadAgentTypes(workDir) {
-      return loadAgentTypesWithWarnings2(workDir).types;
-    }
-    function loadAgentTypesWithWarnings2(workDir) {
-      const out = /* @__PURE__ */ new Map();
-      const warnings = [];
-      loadDir(path7.join(workDir, ".nexrall", "agents"), "project", out, warnings);
-      loadDir(path7.join(os6.homedir(), ".nexrall", "agents"), "global", out, warnings);
-      for (const dir of (0, index_1.pluginAssetDirs)(workDir, "agents"))
-        loadDir(dir, "plugin", out, warnings);
-      for (const agent of BUILTIN_AGENTS) {
-        if (!out.has(agent.name))
-          out.set(agent.name, agent);
-      }
-      const builtinOrder = new Map(BUILTIN_AGENTS.map((a, i2) => [a.name, i2]));
-      const types3 = [...out.values()].sort((a, b) => {
-        const ai = builtinOrder.get(a.name);
-        const bi = builtinOrder.get(b.name);
-        if (ai !== void 0 && bi !== void 0)
-          return ai - bi;
-        if (ai !== void 0)
-          return -1;
-        if (bi !== void 0)
-          return 1;
-        return a.name.localeCompare(b.name);
-      });
-      return { types: types3, warnings };
-    }
-    function knownToolNames() {
-      return [...KNOWN_TOOL_NAMES].sort();
-    }
-    function builtinAgents() {
-      return BUILTIN_AGENTS;
-    }
-    function summariseAgents(types3) {
-      if (!types3.length)
-        return "";
-      return types3.map((t2) => {
-        const canWrite = !t2.tools || t2.tools.some((x2) => WRITE_TOOL_HINTS.has(x2));
-        const access = t2.testFilesOnly ? "writes TEST files only" : canWrite ? "can modify files" : "read-only";
-        const model = t2.model ? `, ${t2.model} model` : "";
-        return `- ${t2.name} (${access}${model}): ${t2.description}`;
-      }).join("\n");
-    }
-    var WRITE_TOOL_HINTS = /* @__PURE__ */ new Set([
-      "write_file",
-      "edit_file",
-      "multi_edit",
-      "notebook_edit",
-      "delete_file",
-      "move_file",
-      "copy_file",
-      "write_docx",
-      "write_xlsx",
-      "write_pptx"
-    ]);
-    function findAgentType(types3, name) {
-      if (!name)
-        return void 0;
-      const want = name.trim().toLowerCase();
-      return types3.find((t2) => t2.name.toLowerCase() === want);
-    }
-  }
-});
-
 // ../core/dist/permissions/rules.js
 var require_rules = __commonJS({
   "../core/dist/permissions/rules.js"(exports2) {