nexus-agents 11.5.6 → 11.5.7

package/dist/{chunk-6EW6KXEW.js → chunk-AAHTCFE4.js}

@@ -58,7 +58,7 @@ import {
   updateStage,
   withFileLock,
   writeJobCancelled
-} from "./chunk-PSHG65FT.js";
+} from "./chunk-IEUSEZK7.js";
 import {
   normalizeTopicToCanonical,
   synthesizeResearch
@@ -77,7 +77,7 @@ import {
 } from "./chunk-773AZVR3.js";
 import {
   withPrerequisite
-} from "./chunk-LTH76W6C.js";
+} from "./chunk-QWLNNOYX.js";
 import {
   NOOP_NOTIFIER,
   RateLimiter,
@@ -105,7 +105,7 @@ import {
   toolSuccess,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-NJZSAXXK.js";
+} from "./chunk-CWLHWDRU.js";
 import {
   generateSecurityPlan
 } from "./chunk-6ZTMMN2N.js";
@@ -187,7 +187,7 @@ import {
 import {
   DEFAULT_TASK_TTL_MS,
   clampTaskTtl
-} from "./chunk-SKSR4Q3L.js";
+} from "./chunk-APLXNO7U.js";
 import {
   allOf,
   anyOf
@@ -196,7 +196,7 @@ import {
   VERSION,
   createRequestContext,
   measuredTrustTier
-} from "./chunk-HHB2Z7LX.js";
+} from "./chunk-R6P5JIXG.js";
 import {
   BWRAP_READ_ONLY_ARGS,
   CliDetectionCache,
@@ -46682,7 +46682,7 @@ function buildVotingInput(plan, config) {
 }
 async function executeSingleVote(plan, config, log) {
   try {
-    const { executeVoting } = await import("./consensus-vote-YQS6ALNB.js");
+    const { executeVoting } = await import("./consensus-vote-PEGKNDMD.js");
     const input = buildVotingInput(plan, config);
     const result = await executeVoting(input, log);
     return parseVotingResult(result);
@@ -48583,7 +48583,7 @@ function createVoteStage({ config, startStage }) {
     const strategy = config.votingStrategy ?? "higher_order";
     await postProgress(config, "Vote", `Running consensus with ${strategy} strategy...`);
     try {
-      const { executeVoting } = await import("./consensus-vote-YQS6ALNB.js");
+      const { executeVoting } = await import("./consensus-vote-PEGKNDMD.js");
       const proposal = buildVoteProposal(plan, research);
       const votingResult = await executeVoting(
         {
@@ -49077,7 +49077,7 @@ import { readFile as readFile5, realpath as realpath2, writeFile as writeFile2 }
 import { delimiter as delimiter2, isAbsolute as isAbsolute6, join as join14, parse as parse4, resolve as resolve9 } from "node:path";
 var logger47 = createLogger({ component: "security-scan" });
 var SCAN_TIMEOUT_MS = 3e5;
-async function isSemgrepAvailable(signal, env, wrapper, binary = "semgrep", cwd) {
+async function probeSemgrepVersion(signal, env, wrapper, binary = "semgrep", cwd) {
   try {
     const { stdout } = await execFileTree(binary, ["--version"], {
       timeoutMs: 1e4,
@@ -49086,10 +49086,35 @@ async function isSemgrepAvailable(signal, env, wrapper, binary = "semgrep", cwd)
       wrapper,
       cwd
     });
-    return stdout.trim() || void 0;
-  } catch {
-    return void 0;
+    const version = stdout.trim();
+    return version === "" ? { error: "semgrep version probe returned empty output" } : version;
+  } catch (error) {
+    if (failureCode(error) === "ENOENT" && wrapper === void 0 && await isSemgrepExecutableMissing(binary, env, cwd)) {
+      return { error: "semgrep is not installed. Install with: pip install semgrep" };
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    return {
+      error: `semgrep version probe failed (exit ${String(failureCode(error))}): ${message}`
+    };
+  }
+}
+function probeExecutableCandidates(binary, env, cwd) {
+  const root = cwd ?? process.cwd();
+  const searchPath = (env ?? process.env)["PATH"];
+  return isAbsolute6(binary) || /[/\\]/.test(binary) ? [resolve9(root, binary)] : process.platform === "win32" ? void 0 : searchPath?.split(delimiter2).map((directory) => resolve9(root, directory, binary));
+}
+async function isSemgrepExecutableMissing(binary, env, cwd) {
+  const candidates = probeExecutableCandidates(binary, env, cwd);
+  if (candidates === void 0 || candidates.length === 0) return false;
+  for (const candidate of candidates) {
+    try {
+      await access(candidate);
+      return false;
+    } catch (error) {
+      if (failureCode(error) !== "ENOENT" && failureCode(error) !== "ENOTDIR") return false;
+    }
   }
+  return true;
 }
 async function runSemgrep(targetDir, rulesets, signal, env, options) {
   const prepared = options.preparedScan;
@@ -49175,7 +49200,7 @@ function unwrapRuleset(text) {
   return text;
 }
 async function measureScannerVersion(options, targetDir) {
-  const version = await isSemgrepAvailable(
+  const version = await probeSemgrepVersion(
     options.signal,
     options.env,
     options.wrapper,
@@ -49183,8 +49208,7 @@ async function measureScannerVersion(options, targetDir) {
     parse4(targetDir).root
   );
   if (options.signal?.aborted === true) return { error: "Scan aborted before semgrep ran" };
-  if (version === void 0)
-    return { error: "semgrep is not installed. Install with: pip install semgrep" };
+  if (typeof version !== "string") return version;
   if (options.preparedScan !== void 0 && options.preparedScan.version !== version) {
     return {
       error: `Scanner version changed: expected ${options.preparedScan.version}, got ${version}`
@@ -49196,14 +49220,14 @@ async function prepareSecurityScan(rulesets, options) {
   try {
     if (rulesets.length === 0) throw new Error("No security rulesets configured");
     const binary = await resolveSemgrep(options.env ?? process.env);
-    const version = await isSemgrepAvailable(
+    const version = await probeSemgrepVersion(
       options.signal,
       options.env,
       options.wrapper,
       binary,
       parse4(resolve9(options.directory)).root
     );
-    if (version === void 0) throw new Error("Cannot measure semgrep version");
+    if (typeof version !== "string") throw new Error(version.error);
     const configs = [];
     for (const [index, ruleset] of rulesets.entries()) {
       const contents = await readRuleset(ruleset, options.signal);
@@ -59481,4 +59505,4 @@ export {
   initializeSandbox,
   getSandboxMode
 };
-//# sourceMappingURL=chunk-6EW6KXEW.js.map
+//# sourceMappingURL=chunk-AAHTCFE4.js.map