@nexus-cortex/cli 4.133.1 → 4.134.0

package/.env.defaults

@@ -1657,6 +1657,16 @@ CORTEX_ENDTURN_GATE=true
 #   [LEDGER 2026-11-12 in tree, UNMEASURED] motivation: holdout-8 web runs, judge reviews were most of the 5-9x harness time (11-04: 116 of
 #   296 task-minutes).
 #CORTEX_ENDTURN_RESOLVER_WEB=
+# [LEDGER 2026-11-13 @4.134.0 SHIPPED ON] widened (operator 11-13: "desktop tasks should perhaps be like web tasks, the model isnt going
+#   to use the desktop for coding"): a finish counts as web/observation-evidenced when it read WEB tool results, nexus-browser MCP results
+#   (direct browser driving — FIX: before this a direct-browser finish was never a web turn, so this lever rarely fired under user-hybrid)
+#   or nexus-desktop results, and wrote no files. Integrity's sources check still keys on web-tool content only (browser MCP kept out).
+# CORTEX_ENDTURN_USER_HALT — default ON: when the desktop tool returns its latched STOP refusal ('desktop control is STOPPED by the user')
+#   the turn is user-halted: the EndTurn gate accepts the finish without its stages and the judge skips it (decisions event
+#   endturn_user_halt / endturn_resolver skipped:user-halt). Keyed on the desktop TOOL result, never on model text. off = old behaviour.
+# [LEDGER 2026-11-13 @4.134.0 SHIPPED ON] operator 11-13 "yes build the desktop stop short-circuit". Evidence: macbook D7 T5 retest on
+#   4.133.1/0.10.1 — after the stop the agent spent 3.5 min and 5 EndTurn calls (1 rejected) before reporting. Unit: endTurnUserHalt.test.ts.
+#CORTEX_ENDTURN_USER_HALT=
 # CORTEX_RESOLVER_WEB_RULE — EndTurn judge web-answer rubric, appended to the judge persona on WEB turns only (web results read, no files
 # changed). A GAP must name a stated constraint the page evidence shows unmet (price, rating, size, location, date, count, a required filter),
 # an answer the evidence contradicts, or a required fact with no evidence; NO wording vetoes (a site's own synonym/abbreviation satisfies a
@@ -2221,6 +2231,17 @@ PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH=
 # 6c460bfc3 with default 2 — corrected to 1 the same day after finding the 10-19 design.) Unit tests
 # browseAgentPolicy.test.ts; live check: the Browse delegate runs with CORTEX_BROWSE_AGENT=true.
 #CORTEX_MAX_AGENT_DEPTH=
+# CORTEX_TOOL_PARENT_DEPTH — INTERNAL marker (do not set by hand): every process an agent's tool starts (Bash, …; core toolChildEnv) carries
+#   the depth of the agent that started it. bin/cortex.js refuses to start ANOTHER agent from such a process (prompt / agent / run / TUI,
+#   and the agent-launching subcommands autoresearch, message, tmux; exit 3, "use the Task tool"); info commands still work. Closes the
+#   gap where a sub-agent ran `cortex …` through Bash and got an unbounded fresh agent (often on the parent's shared :4000 server at
+#   depth 0). Empty = unmarked (the vitest configs blank it so suites run from an agent's Bash behave).
+# [LEDGER 2026-11-12 @4.133.3 SHIPPED ON] (4.133.2 CI-failed, never on npm) operator 11-12 "fix the sub-agent nesting gap". Evidence: bin refusal + toolChildEnv marker tests.
+#CORTEX_TOOL_PARENT_DEPTH=
+# CORTEX_ALLOW_NESTED_AGENT — operator override for the guard above: true (REAL env only) lets a tool-started process launch cortex
+#   agents again. Default unset = refused.
+# [LEDGER 2026-11-12 @4.133.3 SHIPPED ON] default unset (guard on).
+#CORTEX_ALLOW_NESTED_AGENT=
 TMUX_BIN=
 # Google Vertex AI project (only when using Vertex instead of the Gemini API)
 GOOGLE_CLOUD_PROJECT=

package/bin/cortex.js

@@ -124,6 +124,21 @@ const COMMANDER_SUBCOMMANDS = new Set([
   'secrets', 'canon', 'features', 'sessions', 'server', 'browser', 'desktop',
 ]);
 const __firstPositional = args.find((a) => !a.startsWith('-'));
+// 2026-11-12 sub-agent NESTING GUARD: an agent's tool (Bash …) marks its children with CORTEX_TOOL_PARENT_DEPTH (core toolChildEnv). From
+// there, anything that would start ANOTHER agent conversation is refused: a prompt / `agent` / `run` / the TUI, and the agent-launching
+// subcommands (autoresearch, message, tmux). Info commands (--version, --help, --sessions, --stats, config, secrets, canon, update …) still
+// work. Sub-agents go through the bounded Task tool. CORTEX_ALLOW_NESTED_AGENT=true (real env) is the operator override.
+{
+  const __parent = process.env.CORTEX_TOOL_PARENT_DEPTH;
+  const __infoOnly = args.some((a) => ['--help', '-h', '--sessions', '--stats', '--list-models', '--models'].includes(a));
+  const __launches = !__infoOnly && (!__firstPositional || !COMMANDER_SUBCOMMANDS.has(__firstPositional) || ['autoresearch', 'message', 'tmux'].includes(__firstPositional));
+  if (__parent && __launches && process.env.CORTEX_ALLOW_NESTED_AGENT !== 'true') {
+    process.stderr.write(`cortex: refused — this command was started by an agent's tool (agent depth ${__parent}), and it would start another agent. `
+      + 'Use the Task tool to delegate to a sub-agent (it is depth-bounded); do not launch cortex from a shell inside an agent. '
+      + '(Operator override: CORTEX_ALLOW_NESTED_AGENT=true.)\n');
+    process.exit(3);
+  }
+}
 if (__firstPositional && COMMANDER_SUBCOMMANDS.has(__firstPositional)) {
   // A few delegated subcommands talk to the cortex server over HTTP (they connect via
   // CortexClient to localhost:PORT). Auto-start the server first so e.g.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nexus-cortex/cli",
-  "version": "4.133.1",
+  "version": "4.134.0",
   "description": "Nexus Cortex CLI - Terminal interface for multi-provider LLM orchestration",
   "main": "dist/index.js",
   "type": "module",
@@ -19,7 +19,7 @@
     "prepack": "node ../../scripts/copy-pkg-cortex-scaffold.mjs"
   },
   "dependencies": {
-    "@nexus-cortex/core": "4.133.1",
+    "@nexus-cortex/core": "4.134.0",
     "chalk": "^4.1.2",
     "cli-spinners": "^2.9.0",
     "commander": "^11.0.0",