@nexus-cortex/cli 4.132.0 → 4.133.3

package/.env.defaults

@@ -753,7 +753,13 @@ CORTEX_LIFT_PLAN=true
 #   user profile. Evidence: holdout-8 (.bench/eval/om2w, 11-05/06): direct tools ~1 min/task vs `standard` 6.5–9.8 min/task; `standard` lifted
 #   deepseek-flash 4/8 → 7/8 (audited). [LEDGER 2026-11-12 in tree, UNMEASURED] user-* profiles built + unit-tested (29/29); not released;
 #   the shipped default stays `standard` until the operator picks one.
-CORTEX_PROFILE=standard
+# [LEDGER 2026-11-12 @4.133.1 SHIPPED ON] DEFAULT = user-hybrid (4.133.0 built, CI failed, never on npm) (operator 11-12: "ship user-hybrid as the default for now"). Evidence: o3
+#   holdout-8 om2w, deepseek-flash, 4.132.0, audited vs trajectories, 0 invented: user-fast 6/8 34.6 min $0.13 · user-hybrid 7/8 35.2 min
+#   $0.14 · user-fast+planner 7/8 46.3 min · user-careful 7/8 82.9 min $0.51 (runs o3uf/o3uh/o3uc/o3up; .bench/levers/ledger.jsonl).
+#   Web tasks only (n=8 = direction); code/file work unmeasured under user-hybrid. Benches unaffected: the Harbor adapter AND the om2w
+#   supervisor pin `standard` when an arm names no profile; the autoresearch sandbox exports `standard`; the hosted nexus-cortex-sandbox
+#   image still sets ENV CORTEX_PROFILE=standard (Dockerfile:397 — hosted users stay on standard until that image changes).
+CORTEX_PROFILE=user-hybrid
 # CORTEX_FEATURES — R262 FEATURE PAYLOAD LAYER (2026-10-15; design .cortex/research/feature-flags-parity-design-2026-10-15.md). A
 #   GrowthBook-format payload {features: {KEY: {defaultValue, rules: [{id, condition, force, variations, weights, coverage, key}]}}}
 #   evaluated OFFLINE at launch by bootstrapEnv (packages/core/src/config/featurePayload.ts; @growthbook/growthbook 1.8.0 with no
@@ -1638,6 +1644,11 @@ CORTEX_ENDTURN_GATE=true
 # (val-W): after the hold the agent launched another browse pass that did not change the answer (BBB: 4 extra delegates after the answer at
 # 4.8 min). Coding turns unchanged. Validation of this default pending (arm T2).
 #CORTEX_FINISH_CONFIRM_WEB=
+# CORTEX_ENDTURN_CITE_ERRORS — true = an ERROR tool result the agent read (a refusal, a failing test, a command error) may ground an EndTurn
+#   citation (Stage 2). Unset/false = byte-identical: error results are excluded from the grounding corpus. EndTurn's own rejections never
+#   count. Set by the user-* profiles. [LEDGER 2026-11-12 in tree, UNMEASURED] evidence: macbook D7 T5 — the agent quoted the failsafe
+#   refusal verbatim, Stage 2 rejected it twice as ungrounded, and the agent re-ran the refused action only to re-quote it (4 extra turns).
+#CORTEX_ENDTURN_CITE_ERRORS=
 # CORTEX_DEBUG_TOOLS — 1 = print the nexus-desktop pin decision and the MCP tool names sent per request to the server stderr (diagnostic only,
 #   2026-11-12 D7). Unset = silent.
 #CORTEX_DEBUG_TOOLS=
@@ -2189,6 +2200,18 @@ PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH=
 # [LEDGER 2026-11-03 @tree] NEW, unreleased. Default hosted = today's behaviour; local verified on this repl (see docs/secrets.md for
 # the browser library's vault keys; install policy: operator 2026-11-03).
 #NEXUS_BROWSER_MODE=
+# NEXUS_BROWSER_NATIVE — 1 (with NEXUS_BROWSER_MODE=local) = the @nexus-cortex/browser library runs IN-PROCESS over the MCP SDK InMemoryTransport
+#   (McpClient transport 'inprocess', createLocalBrowserMCP) instead of a stdio child; same tools + nexus-browser__* names. Unset/0 = stdio (as before).
+#   [LEDGER 2026-11-12 @4.132.0 shipped DARK] parity 54/54 (c906caaba); functional check on the RC install: 53 tools, browse/scan/get_content OK.
+#NEXUS_BROWSER_NATIVE=
+# NEXUS_DESKTOP — virtual | real = the @nexus-cortex/desktop package is served IN-PROCESS as the `nexus-desktop` MCP server, auto-connected at boot
+#   and PINNED (its tool is sent every request even with MCP_AUTO_INJECT=false). virtual = a private Xvfb display; real = the user's screen (set by
+#   `cortex desktop enable --real`, typed confirmation in a TTY only). Wins over the legacy NEXUS_BROWSER_DESKTOP. Unset = off.
+#   [LEDGER 2026-11-12 @4.132.0 shipped DARK] macbook D7 real-screen validation T0–T5 PASS on Big Sur (pin fix ca952ea83 + by-name pin).
+#NEXUS_DESKTOP=
+# CORTEX_PROFILE_LOCKED_OVER — REPORTED (read-only, set by the harness): the levers a LOCKED user profile took over from .env file values.
+#   [LEDGER 2026-11-12 @4.132.0] reported in /health/config + effective_config rows.
+
 # CORTEX_MAX_AGENT_DEPTH — how deep sub-agents may nest. Every sub-agent carries its depth (main = 0, its sub-agents 1, theirs 2); an
 # agent AT this depth is not offered Task / Browse / WebSearch and any spawn request it makes is refused (core orchestrator/
 # toolAllowlist.ts). Default 1 = sub-agents never start sub-agents (the 2026-10-19 R267 design: a delegate that needs a browser drives the
@@ -2198,6 +2221,17 @@ PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH=
 # 6c460bfc3 with default 2 — corrected to 1 the same day after finding the 10-19 design.) Unit tests
 # browseAgentPolicy.test.ts; live check: the Browse delegate runs with CORTEX_BROWSE_AGENT=true.
 #CORTEX_MAX_AGENT_DEPTH=
+# CORTEX_TOOL_PARENT_DEPTH — INTERNAL marker (do not set by hand): every process an agent's tool starts (Bash, …; core toolChildEnv) carries
+#   the depth of the agent that started it. bin/cortex.js refuses to start ANOTHER agent from such a process (prompt / agent / run / TUI,
+#   and the agent-launching subcommands autoresearch, message, tmux; exit 3, "use the Task tool"); info commands still work. Closes the
+#   gap where a sub-agent ran `cortex …` through Bash and got an unbounded fresh agent (often on the parent's shared :4000 server at
+#   depth 0). Empty = unmarked (the vitest configs blank it so suites run from an agent's Bash behave).
+# [LEDGER 2026-11-12 @4.133.3 SHIPPED ON] (4.133.2 CI-failed, never on npm) operator 11-12 "fix the sub-agent nesting gap". Evidence: bin refusal + toolChildEnv marker tests.
+#CORTEX_TOOL_PARENT_DEPTH=
+# CORTEX_ALLOW_NESTED_AGENT — operator override for the guard above: true (REAL env only) lets a tool-started process launch cortex
+#   agents again. Default unset = refused.
+# [LEDGER 2026-11-12 @4.133.3 SHIPPED ON] default unset (guard on).
+#CORTEX_ALLOW_NESTED_AGENT=
 TMUX_BIN=
 # Google Vertex AI project (only when using Vertex instead of the Gemini API)
 GOOGLE_CLOUD_PROJECT=

package/bin/cortex.js

@@ -124,6 +124,21 @@ const COMMANDER_SUBCOMMANDS = new Set([
   'secrets', 'canon', 'features', 'sessions', 'server', 'browser', 'desktop',
 ]);
 const __firstPositional = args.find((a) => !a.startsWith('-'));
+// 2026-11-12 sub-agent NESTING GUARD: an agent's tool (Bash …) marks its children with CORTEX_TOOL_PARENT_DEPTH (core toolChildEnv). From
+// there, anything that would start ANOTHER agent conversation is refused: a prompt / `agent` / `run` / the TUI, and the agent-launching
+// subcommands (autoresearch, message, tmux). Info commands (--version, --help, --sessions, --stats, config, secrets, canon, update …) still
+// work. Sub-agents go through the bounded Task tool. CORTEX_ALLOW_NESTED_AGENT=true (real env) is the operator override.
+{
+  const __parent = process.env.CORTEX_TOOL_PARENT_DEPTH;
+  const __infoOnly = args.some((a) => ['--help', '-h', '--sessions', '--stats', '--list-models', '--models'].includes(a));
+  const __launches = !__infoOnly && (!__firstPositional || !COMMANDER_SUBCOMMANDS.has(__firstPositional) || ['autoresearch', 'message', 'tmux'].includes(__firstPositional));
+  if (__parent && __launches && process.env.CORTEX_ALLOW_NESTED_AGENT !== 'true') {
+    process.stderr.write(`cortex: refused — this command was started by an agent's tool (agent depth ${__parent}), and it would start another agent. `
+      + 'Use the Task tool to delegate to a sub-agent (it is depth-bounded); do not launch cortex from a shell inside an agent. '
+      + '(Operator override: CORTEX_ALLOW_NESTED_AGENT=true.)\n');
+    process.exit(3);
+  }
+}
 if (__firstPositional && COMMANDER_SUBCOMMANDS.has(__firstPositional)) {
   // A few delegated subcommands talk to the cortex server over HTTP (they connect via
   // CortexClient to localhost:PORT). Auto-start the server first so e.g.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nexus-cortex/cli",
-  "version": "4.132.0",
+  "version": "4.133.3",
   "description": "Nexus Cortex CLI - Terminal interface for multi-provider LLM orchestration",
   "main": "dist/index.js",
   "type": "module",
@@ -19,7 +19,7 @@
     "prepack": "node ../../scripts/copy-pkg-cortex-scaffold.mjs"
   },
   "dependencies": {
-    "@nexus-cortex/core": "4.132.0",
+    "@nexus-cortex/core": "4.133.3",
     "chalk": "^4.1.2",
     "cli-spinners": "^2.9.0",
     "commander": "^11.0.0",