nexus-agents 11.4.2 → 11.4.4

package/dist/{chunk-7LW3PMQS.js → chunk-HNGZ5AMV.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-BDP422B2.js";
 import {
   executeExpert
-} from "./chunk-CVT26QN5.js";
+} from "./chunk-XBXLA6DJ.js";
 import {
   JobStatusSchema,
   RawFindingSchema,
@@ -58,11 +58,11 @@ import {
   updateStage,
   withFileLock,
   writeJobCancelled
-} from "./chunk-PAYKBSXM.js";
+} from "./chunk-NNVA7BZX.js";
 import {
   normalizeTopicToCanonical,
   synthesizeResearch
-} from "./chunk-UMLKKXBD.js";
+} from "./chunk-FGR6O454.js";
 import {
   IssueTriage,
   createAuditTrail,
@@ -71,13 +71,13 @@ import {
   createGraphAuditBridge,
   emitPipelinePolicyEvent,
   readActionRefusal
-} from "./chunk-ME7LKSBK.js";
+} from "./chunk-4DHC2TDC.js";
 import {
   sanitizeInput
-} from "./chunk-HQ2SMW4Y.js";
+} from "./chunk-773AZVR3.js";
 import {
   withPrerequisite
-} from "./chunk-RYSLBVMQ.js";
+} from "./chunk-VGRTBVWC.js";
 import {
   NOOP_NOTIFIER,
   RateLimiter,
@@ -105,7 +105,7 @@ import {
   toolSuccess,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-2FY4QM42.js";
+} from "./chunk-YC6QAHC2.js";
 import {
   generateSecurityPlan
 } from "./chunk-6ZTMMN2N.js";
@@ -152,18 +152,18 @@ import {
   parseRegistry,
   sourceExistsInRegistry,
   summarizeContextForPrompt
-} from "./chunk-YZXCE5BB.js";
+} from "./chunk-AH4Y7Z6S.js";
 import {
   REGISTRY_PATH,
   getProjectRoot,
   loadPapersRegistry,
   loadTechniquesRegistry,
   resolveRegistryRoot
-} from "./chunk-JDL5WJDM.js";
+} from "./chunk-BCC27PGX.js";
 import {
   getTokenEnvVars,
   resolveToken
-} from "./chunk-KCESFTXP.js";
+} from "./chunk-N5DHPHPE.js";
 import {
   DEFAULT_RELEVANCE_CONFIG,
   MemoryImportance,
@@ -171,7 +171,7 @@ import {
   calculateTextJaccardSimilarity,
   getToolMemory,
   memoryTrustTierTag
-} from "./chunk-6RP53JXS.js";
+} from "./chunk-Y3A3VVGT.js";
 import {
   EXTERNAL_CONTENT_TRUST_TIER,
   resolveContentTrustProvenance,
@@ -187,7 +187,7 @@ import {
 import {
   DEFAULT_TASK_TTL_MS,
   clampTaskTtl
-} from "./chunk-MOILTUAB.js";
+} from "./chunk-OUU6EOZE.js";
 import {
   allOf,
   anyOf
@@ -196,7 +196,7 @@ import {
   VERSION,
   createRequestContext,
   measuredTrustTier
-} from "./chunk-Y5YOOAXF.js";
+} from "./chunk-MYWMM23M.js";
 import {
   BWRAP_READ_ONLY_ARGS,
   CliDetectionCache,
@@ -208,13 +208,13 @@ import {
   getGlobalEventBus,
   getGlobalRegistry,
   isAbsentSeat
-} from "./chunk-6U3GRS6B.js";
+} from "./chunk-VA247HQO.js";
 import {
   ensureGatewayDiscovered,
   getAvailabilityCache,
   getCliForModelId,
   resolveFallback
-} from "./chunk-VKK7ZGSY.js";
+} from "./chunk-W56VP6JH.js";
 import {
   DEFAULTS
 } from "./chunk-4S77S56F.js";
@@ -232,10 +232,10 @@ import {
   parseGatewayExtraHeaders,
   requireApiKey,
   validateApiKeyPresence
-} from "./chunk-54UNI6GV.js";
+} from "./chunk-WSLPF7BX.js";
 import {
   createSessionMemory
-} from "./chunk-CVOE6Q56.js";
+} from "./chunk-FQFCLNYM.js";
 import {
   TrustTierSchema
 } from "./chunk-CJKHQ6MV.js";
@@ -249,14 +249,14 @@ import {
   terminateProcessTree,
   trackProcessTree,
   withTimeout
-} from "./chunk-RGDZIWGS.js";
+} from "./chunk-VMGKPEVR.js";
 import {
   generateHyphenId,
   generateUUID
-} from "./chunk-KSGJB4AF.js";
+} from "./chunk-KXD7ZJWM.js";
 import {
   getDefaultCliCircuitBreakerRegistry
-} from "./chunk-P3ZQVHQA.js";
+} from "./chunk-ZDNXBCOP.js";
 import {
   sanitizeErrorDetails
 } from "./chunk-7LKX7AUQ.js";
@@ -354,7 +354,7 @@ import {
   toExpertTaskAnalysisResult,
   truncateWithInfo,
   withStep
-} from "./chunk-M7JXKUFB.js";
+} from "./chunk-WM2BE65D.js";
 import {
   SUPPORTED_EXTENSIONS
 } from "./chunk-XBEKMUTO.js";
@@ -369,13 +369,13 @@ import {
   lookupInTreeCapability,
   modelSupportsAll,
   resolveOwnerCli
-} from "./chunk-DS6X6MFM.js";
+} from "./chunk-5FYSIB3L.js";
 import {
   deriveEntry,
   getDefaultRegistry,
   resolveModelIdentity,
   resolveModelIdentitySync
-} from "./chunk-NSELDEAX.js";
+} from "./chunk-5TW3NLWA.js";
 import {
   ensureLearningDir,
   getMetaOutcomesFile,
@@ -11473,7 +11473,7 @@ var DEFAULT_MAX_OUTPUT_CHARS = 4e3;
 var INJECTION_PATTERNS = [
   /<\/?(?:system|human|assistant|instructions)(?:\s[^>]*)?>[\s\S]*?(?:<\/(?:system|human|assistant|instructions)>|$)/gi,
   /<img\b[^>]*>/gi,
-  /<!--[\s\S]*?-->/g
+  /\x3c!--[\s\S]*?-->/g
 ];
 var PATH_TRAVERSAL_PATTERN = /(?:\.\.\/){2,}[^\s]*/g;
 function sanitizeTaskContext(input) {
@@ -29770,7 +29770,7 @@ function execIdFields(executionId) {
 async function populateUnifiedContextOnState(state, options) {
   const taskCandidate = state["task"];
   if (typeof taskCandidate !== "string" || taskCandidate === "") return;
-  const { getContextForTask: getContextForTask2, inferTaskCategory: inferTaskCategory2 } = await import("./context-retriever-AUOD3LIJ.js");
+  const { getContextForTask: getContextForTask2, inferTaskCategory: inferTaskCategory2 } = await import("./context-retriever-BJIUY6QW.js");
   const category = inferTaskCategory2(taskCandidate);
   const executionId = options?.executionId;
   const execFields = execIdFields(executionId);
@@ -34327,7 +34327,7 @@ var PRIOR_WAVE_HEADER = "## Prior Wave Context\n\nThe following results were pro
 var INJECTION_PATTERNS2 = [
   /<\/?(?:system|human|assistant|instructions)(?:\s[^>]*)?>[\s\S]*?(?:<\/(?:system|human|assistant|instructions)>|$)/gi,
   /<img\b[^>]*>/gi,
-  /<!--[\s\S]*?-->/g
+  /\x3c!--[\s\S]*?-->/g
 ];
 function sanitizeWorkerOutput(input) {
   if (input === "") return "";
@@ -46285,7 +46285,7 @@ async function tryIssueTriage(task) {
   try {
     const issueMatch = task.match(/github\.com\/([^/]+\/[^/]+)\/issues\/(\d+)/);
     if (issueMatch === null) return null;
-    const { createIssueTriage } = await import("./issue-triage-WZZTRX4K.js");
+    const { createIssueTriage } = await import("./issue-triage-RUA2254S.js");
     const triage = createIssueTriage();
     const owner = issueMatch[1] ?? "";
     const num2 = issueMatch[2] ?? "";
@@ -46313,7 +46313,7 @@ var VALID_TEMPLATES = /* @__PURE__ */ new Set([
 ]);
 async function classifyWithLLM(task) {
   try {
-    const { executeExpert: executeExpert2 } = await import("./expert-bridge-PREN4ZL3.js");
+    const { executeExpert: executeExpert2 } = await import("./expert-bridge-GFO6QWXL.js");
     const prompt = [
       "Classify this task into exactly one pipeline template.",
       "Templates: dev (implementation/bug fix/refactor), research (investigate/evaluate/compare),",
@@ -46682,7 +46682,7 @@ function buildVotingInput(plan, config) {
 }
 async function executeSingleVote(plan, config, log) {
   try {
-    const { executeVoting } = await import("./consensus-vote-CE7X66SQ.js");
+    const { executeVoting } = await import("./consensus-vote-3AJ54VX3.js");
     const input = buildVotingInput(plan, config);
     const result = await executeVoting(input, log);
     return parseVotingResult(result);
@@ -47628,6 +47628,7 @@ async function withDevPipelineWorkspace(stages, run, install = installDependenci
     const dependencies = await provisionDependencies(scratch.path, install, sandbox.wrapper);
     const bound = stages.withWorkspace({
       directory: join13(scratch.path, relative4(repoRoot, directory)),
+      root: scratch.path,
       baseline: { sha: baseSha, directory: repoRoot },
       dependencies,
       wrapper: sandbox.wrapper
@@ -48229,7 +48230,7 @@ var memoryInitPromise = null;
 async function initPipelineMemory() {
   if (cachedMemory !== null) return cachedMemory;
   try {
-    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-4GX3WTEB.js");
+    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-C4R2RA4D.js");
     const { getLearningDir } = await import("./learning-persistence-X24OOBYY.js");
     const mem = createSessionMemory2(getLearningDir());
     mem.startSession(`pipeline-${String(getTimeProvider().now())}`);
@@ -48291,7 +48292,7 @@ function recordRoutingExperience(category, success, durationMs, tokensUsed = 0,
     callRecord(routingMemoryCache);
     return;
   }
-  routingMemoryInitPromise ??= import("./routing-memory-EO7VG7R3.js").then(({ createRoutingMemory }) => {
+  routingMemoryInitPromise ??= import("./routing-memory-TVITESTN.js").then(({ createRoutingMemory }) => {
     routingMemoryCache ??= createRoutingMemory();
     return routingMemoryCache;
   }).catch((error) => {
@@ -48525,7 +48526,7 @@ function createVoteStage({ config, startStage }) {
     const strategy = config.votingStrategy ?? "higher_order";
     await postProgress(config, "Vote", `Running consensus with ${strategy} strategy...`);
     try {
-      const { executeVoting } = await import("./consensus-vote-CE7X66SQ.js");
+      const { executeVoting } = await import("./consensus-vote-3AJ54VX3.js");
       const proposal = buildVoteProposal(plan, research);
       const votingResult = await executeVoting(
         {
@@ -49012,6 +49013,8 @@ var COMPLETE_SCAN_FLAGS = [
   // Avoid mutable ignore files and hidden-ancestor skips in scratch worktrees.
   // Unsupported scanner versions fail closed on this explicitly pinned flag.
   "--x-ignore-semgrepignore-files",
+  // Must exclude nothing the dev pipeline captures (PATCH_PATHS in
+  // pipeline/dev-pipeline-workspace.ts), or a captured file ships unscanned.
   "--exclude=node_modules",
   "--exclude=.git"
 ];
@@ -49661,7 +49664,13 @@ function checkSecurityScan(targetDir, rulesets = ["p/default"], config = {}) {
         durationMs: Date.now() - start
       };
     }
-    const gateResult = await runSecurityPipeline(result, targetDir, config, start, signal);
+    const gateResult = await runSecurityPipeline(
+      result,
+      config.dependencyTarget ?? targetDir,
+      config,
+      start,
+      signal
+    );
     if (gateResult.verdict === "fail") return gateResult;
     if (result.parseDiagnostics !== void 0 && result.parseDiagnostics.length > 0) {
       return {
@@ -49677,7 +49686,7 @@ function checkSecurityScan(targetDir, rulesets = ["p/default"], config = {}) {
 async function runBaselineGate(target, rulesets, config, signal) {
   const start = Date.now();
   const comparison = await compareSecurityBaseline(target, rulesets, config, signal);
-  const osv = comparison.complete ? await runOsvCheck(target, config.enableOsv ?? true, signal) : OSV_EMPTY;
+  const osv = comparison.complete ? await runOsvCheck(config.dependencyTarget ?? target, config.enableOsv ?? true, signal) : OSV_EMPTY;
   throwIfAborted(signal, "Security baseline scan aborted");
   const osvFailed = osv.vulnerabilities.some((v) => v.severity === "CRITICAL");
   const details = comparison.complete ? `Base ${String(comparison.baseCount)}, worktree ${String(comparison.worktreeCount)} findings; ${String(comparison.introducedBlockingCount)} introduced blocking; ${buildScanSummary(comparison.worktreeCount ?? 0, comparison.introducedBlockingCount ?? 0, osv.vulnerabilities.length, osv)}` : `Security comparison incomplete: ${comparison.errors.join("; ")}`;
@@ -49961,7 +49970,7 @@ ${text}` : "";
 }
 async function getWeatherContext() {
   try {
-    const { generateWeatherReport: generateWeatherReport2 } = await import("./weather-report-MLERG4SM.js");
+    const { generateWeatherReport: generateWeatherReport2 } = await import("./weather-report-OIWO4BCH.js");
     const report = generateWeatherReport2({ includeAdaptive: true });
     const mappings = "recommendedMappings" in report ? report.recommendedMappings : [];
     if (!Array.isArray(mappings) || mappings.length === 0) return "";
@@ -49979,7 +49988,7 @@ ${lines}
 }
 async function getMemoryContext(task) {
   try {
-    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-4GX3WTEB.js");
+    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-C4R2RA4D.js");
     const { getLearningDir } = await import("./learning-persistence-X24OOBYY.js");
     const memory = createSessionMemory2(getLearningDir(), { maxLearningsInContext: 10 });
     const learnings = memory.searchLearnings(task.slice(0, 200));
@@ -50402,15 +50411,16 @@ function createQualityGateStage({
   };
 }
 function createSecurityScanStage(deps) {
-  const { config, startStage, workspaceDependencies, wrapper } = deps;
+  const { config, startStage, workspaceDependencies, workspaceRoot, wrapper } = deps;
   return async (signal) => {
     startStage("security");
     const start = getTimeProvider().now();
-    const target = config.scanTarget ?? process.cwd();
+    const target = workspaceRoot ?? config.scanTarget ?? process.cwd();
     await postProgress(config, "Security", `Scanning ${target}...`);
     const scratchBound = workspaceDependencies !== void 0;
     const check = checkSecurityScan(target, void 0, {
       baseline: config.securityBaseline,
+      dependencyTarget: config.scanTarget,
       env: scratchBound ? hermeticGitEnv() : void 0,
       root: scratchBound ? target : void 0,
       wrapper
@@ -50459,10 +50469,17 @@ function createAgentStages(config = {}) {
     decompose: createDecomposeStage(deps),
     ...createExecutionStages(deps),
     // #6794: execution closures share the same guard and scratch directory.
-    withWorkspace: ({ directory, dependencies: workspaceDependencies, wrapper, baseline }) => {
+    withWorkspace: ({
+      directory,
+      root,
+      dependencies: workspaceDependencies,
+      wrapper,
+      baseline
+    }) => {
       const bound = {
         ...deps,
         workspaceDependencies,
+        workspaceRoot: root,
         wrapper,
         config: { ...config, scanTarget: directory, securityBaseline: baseline }
       };
@@ -50693,7 +50710,7 @@ async function searchCodebaseForTask(task) {
 }
 async function queryResearchRegistry(task) {
   try {
-    const { synthesizeResearch: synthesizeResearch2 } = await import("./research-helpers-synthesize-IWS2XZQN.js");
+    const { synthesizeResearch: synthesizeResearch2 } = await import("./research-helpers-synthesize-BY7RH4B3.js");
     const topic = task.split(/[.!?\n]/).filter((s) => s.trim().length > 10)[0]?.trim();
     if (topic === void 0) return null;
     const result = await synthesizeResearch2(topic.slice(0, 50));
@@ -50764,7 +50781,7 @@ function createScanStageWrapper() {
       try {
         const slug = ctx.task.match(/([a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+)/)?.[1];
         if (slug !== void 0) {
-          const { generateSecurityPlan: generateSecurityPlan2 } = await import("./repo-security-plan-BACXPNX3.js");
+          const { generateSecurityPlan: generateSecurityPlan2 } = await import("./repo-security-plan-OZHFTQB3.js");
           const plan = await generateSecurityPlan2({ repo: slug, maxScanners: 10 });
           const recs = plan.recommendations.slice(0, 5).map((r) => `${r.priority}: ${r.displayName} (${r.category})`).join("; ");
           return output(PIPELINE_STATE_KEYS.FINDINGS, recs, getTimeProvider().now() - start, true);
@@ -54711,7 +54728,7 @@ var GitHubTaskTracker = class {
   cachedProvider = null;
   async getProvider() {
     if (this.cachedProvider !== null) return this.cachedProvider;
-    const { createScmProvider } = await import("./factory-KPCJR5RB.js");
+    const { createScmProvider } = await import("./factory-P45WM7Y5.js");
     const result = await createScmProvider({ repo: this.config.repo ?? "" });
     if (!result.ok) throw new Error(`SCM provider error: ${result.error.message}`);
     this.cachedProvider = result.value;
@@ -55792,7 +55809,7 @@ function withCatalogueCaveat(report) {
 var GATEWAY_TRANSPORT = "gateway";
 var GATEWAY_API_ARM = "api:custom-openai";
 async function gatewaySource(apiArm) {
-  const { discoverModels, readOpenAICompatEnv } = await import("./openai-compat-adapter-7NPALXRG.js");
+  const { discoverModels, readOpenAICompatEnv } = await import("./openai-compat-adapter-BAHSQKIS.js");
   const config = readOpenAICompatEnv();
   if (config !== null) {
     return {
@@ -55811,7 +55828,7 @@ async function gatewaySource(apiArm) {
 }
 async function defaultSources(includeOpenRouter, adaptersFactory) {
   const adapters = new Map(
-    adaptersFactory !== void 0 ? adaptersFactory() : (await import("./factory-3YILRPOA.js")).createAllAdapters()
+    adaptersFactory !== void 0 ? adaptersFactory() : (await import("./factory-RZVZ6BLF.js")).createAllAdapters()
   );
   const apiArm = adapters.get(GATEWAY_API_ARM);
   adapters.delete(GATEWAY_API_ARM);
@@ -59168,4 +59185,4 @@ export {
   initializeSandbox,
   getSandboxMode
 };
-//# sourceMappingURL=chunk-7LW3PMQS.js.map
+//# sourceMappingURL=chunk-HNGZ5AMV.js.map