nexus-agents 11.6.1 → 11.7.0

package/dist/{ast-rule-runner-GRU2OC5H.js → ast-rule-runner-PIIAHXDA.js}

@@ -9,11 +9,11 @@ import {
   getBuiltInAstRulesPath,
   loadRules,
   runAstQaRules
-} from "./chunk-L3VR5RXX.js";
-import "./chunk-ZYZIRL4X.js";
+} from "./chunk-E5XKXB3G.js";
+import "./chunk-OMWOFIK5.js";
 import "./chunk-XBEKMUTO.js";
-import "./chunk-HWAJUCPO.js";
-import "./chunk-2URHVZJR.js";
+import "./chunk-PHLASJD2.js";
+import "./chunk-4MKZAA6W.js";
 import "./chunk-G3M3UVAW.js";
 import "./chunk-VIT46LNO.js";
 import "./chunk-MQ23UGSY.js";
@@ -34,4 +34,4 @@ export {
   loadRules,
   runAstQaRules
 };
-//# sourceMappingURL=ast-rule-runner-GRU2OC5H.js.map
+//# sourceMappingURL=ast-rule-runner-PIIAHXDA.js.map

package/dist/{child-mcp-config-DNZN7CMS.js → child-mcp-config-B6BTYZT4.js}

@@ -1,10 +1,10 @@
 import {
   nexusMkdtempSync
 } from "./chunk-EBKVMMWA.js";
-import "./chunk-ZYZIRL4X.js";
+import "./chunk-OMWOFIK5.js";
 import "./chunk-XBEKMUTO.js";
-import "./chunk-HWAJUCPO.js";
-import "./chunk-2URHVZJR.js";
+import "./chunk-PHLASJD2.js";
+import "./chunk-4MKZAA6W.js";
 import "./chunk-G3M3UVAW.js";
 import "./chunk-VIT46LNO.js";
 import {
@@ -81,4 +81,4 @@ async function generateMcpConfig(options) {
 export {
   generateMcpConfig
 };
-//# sourceMappingURL=child-mcp-config-DNZN7CMS.js.map
+//# sourceMappingURL=child-mcp-config-B6BTYZT4.js.map

package/dist/{chunk-L4QFWMXB.js → chunk-26WUCAGU.js}

@@ -1,14 +1,14 @@
 import {
   GitHubProvider,
   ScmError
-} from "./chunk-2SFOJPJH.js";
+} from "./chunk-PYTN5UNL.js";
 import {
   resolveToken
-} from "./chunk-45G5ZV3K.js";
+} from "./chunk-7Y6SB623.js";
 import {
   err,
   ok
-} from "./chunk-ZYZIRL4X.js";
+} from "./chunk-OMWOFIK5.js";
 
 // src/scm/factory.ts
 async function createScmProvider(config) {
@@ -41,4 +41,4 @@ export {
   createScmProvider,
   createGitHubProvider
 };
-//# sourceMappingURL=chunk-L4QFWMXB.js.map
+//# sourceMappingURL=chunk-26WUCAGU.js.map

package/dist/{chunk-MFBTGXR6.js → chunk-3QKRY72I.js}

@@ -1,26 +1,23 @@
 import {
   generateHyphenId
-} from "./chunk-GIW4L5PI.js";
+} from "./chunk-INVGMQKJ.js";
 import {
   getDefaultCliCircuitBreakerRegistry
-} from "./chunk-OMQC4NWX.js";
+} from "./chunk-GCRXO43T.js";
 import {
   sanitizeOutput
-} from "./chunk-O3FMPRQH.js";
+} from "./chunk-VVDPRJU7.js";
 import {
   CLI_VERSION_REQUIREMENTS,
   DEFAULT_CAPABILITIES,
   RETRYABLE_ERROR_CODES,
-  accessModeConflict,
   adapterReadiness,
-  asRecord,
   breakerKeys,
   classifyExtractedError,
   createCallerAbortCliError,
   createCapacityTracker,
   createCliError,
   err,
-  extractNumberField,
   getErrorMessage,
   getOutcomeStore,
   getRandomProvider,
@@ -28,28 +25,13 @@ import {
   isCallerCancelled,
   isDurableCapacityText,
   isRateLimitText,
-  isReadOnlyAnalysis,
   isTimeoutText,
-  isWorkspaceEdit,
-  listModelsForCli,
   ok,
   parseCliErrorEnvelope,
-  restrictedAccessMode,
   servesListedModel,
   unenforcedAccessModeRefusal,
   withEnforcedAccessMode
-} from "./chunk-ZYZIRL4X.js";
-import {
-  FALLBACK_CONTEXT_WINDOW,
-  FALLBACK_MAX_OUTPUT,
-  buildModelInfo,
-  findInTreeByCli,
-  getCliModelName,
-  getDefaultModelForCli
-} from "./chunk-HWAJUCPO.js";
-import {
-  getDefaultRegistry
-} from "./chunk-2URHVZJR.js";
+} from "./chunk-OMWOFIK5.js";
 import {
   createLogger,
   getTimeProvider
@@ -291,8 +273,8 @@ var BaseCliAdapter = class {
    * (#5864).
    */
   cachedVersionAt;
-  constructor(logger2) {
-    this.logger = logger2 ?? createLogger({ component: "cli-adapter" });
+  constructor(logger) {
+    this.logger = logger ?? createLogger({ component: "cli-adapter" });
   }
   /** Local CLI auth evidence from the canonical probe; makes no live API call. */
   async authStatus() {
@@ -1495,412 +1477,6 @@ var SubprocessCliAdapter = class extends BaseCliAdapter {
   }
 };
 
-// src/cli-adapters/parsers/claude-parser.ts
-var logger = createLogger({ component: "claude-parser" });
-function isUsableCost(value) {
-  return Number.isFinite(value) && value >= 0;
-}
-function sumModelUsageCost(raw) {
-  const modelUsage = asRecord(raw);
-  if (modelUsage === null) return null;
-  let sum = 0;
-  let sawCost = false;
-  for (const entry of Object.values(modelUsage)) {
-    const perModel = asRecord(entry);
-    if (perModel === null) continue;
-    const cost = perModel.costUSD;
-    if (typeof cost !== "number" || !isUsableCost(cost)) continue;
-    sum += cost;
-    sawCost = true;
-  }
-  return sawCost ? sum : null;
-}
-var ClaudeResponseParser = class {
-  name = "claude-parser";
-  supportedVersionRange = ">=2.0.0 <3.0.0";
-  /**
-   * Parses complete Claude CLI response.
-   */
-  parse(raw) {
-    try {
-      const data = JSON.parse(raw);
-      if (!this.isValidResponse(data)) {
-        return null;
-      }
-      return data;
-    } catch {
-      logger.debug("Skipped malformed output line", { snippet: raw.slice(0, 100) });
-      return null;
-    }
-  }
-  /**
-   * Extracts just the response text (most stable field).
-   * Returns null if the response contains an error.
-   */
-  extractResponse(raw) {
-    try {
-      const data = JSON.parse(raw);
-      const record = asRecord(data);
-      if (record === null) return null;
-      if (record.is_error === true) {
-        return null;
-      }
-      const result = record.result;
-      if (typeof result === "string") {
-        return result;
-      }
-      return null;
-    } catch {
-      logger.debug("Skipped malformed output line", { snippet: raw.slice(0, 100) });
-      return null;
-    }
-  }
-  /**
-   * The error text of an `is_error: true` envelope, with its `stop_reason`
-   * (#6120).
-   *
-   * Before this the envelope reached the adapter only through the generic
-   * unparseable-output path, whose first step scans the WHOLE stdout for
-   * rate-limit text. The out-of-credits envelope carries `api_error_status:
-   * 429`, so that scan matched and the error message became the first 500
-   * characters of the envelope — `{"duration_api_ms":0,…` — while the one
-   * field that names the cause, `result`, never reached anyone. Surfacing it
-   * here routes the envelope through `classifyErrorOnlyStream`, which
-   * classifies the message text rather than the envelope bytes.
-   *
-   * `null` when the envelope is not an error, or when `result` is empty: an
-   * empty error text is not a message, and the caller's recovery order handles
-   * it as before.
-   */
-  extractErrorMessage(raw) {
-    try {
-      const record = asRecord(JSON.parse(raw));
-      if (record?.is_error !== true) return null;
-      const result = record.result;
-      if (typeof result !== "string" || result === "") return null;
-      const stopReason = record.stop_reason;
-      return typeof stopReason === "string" && stopReason !== "" ? `${result} (stop_reason: ${stopReason})` : result;
-    } catch {
-      logger.debug("Skipped malformed output line", { snippet: raw.slice(0, 100) });
-      return null;
-    }
-  }
-  /**
-   * The tool calls claude's permission layer refused (#6792), from the
-   * result envelope's `permission_denials`. `null` when the field is absent
-   * or empty, or the output is not JSON; an entry without a tool name is
-   * skipped rather than invented.
-   */
-  extractPermissionDenials(raw) {
-    try {
-      const denials = asRecord(JSON.parse(raw))?.permission_denials;
-      if (!Array.isArray(denials)) return null;
-      const parsed = denials.flatMap((entry) => {
-        const record = asRecord(entry);
-        const toolName = record?.tool_name;
-        if (typeof toolName !== "string" || toolName === "") return [];
-        const filePath = asRecord(record?.tool_input)?.file_path;
-        return [{ toolName, ...typeof filePath === "string" && { filePath } }];
-      });
-      return parsed.length > 0 ? parsed : null;
-    } catch {
-      return null;
-    }
-  }
-  /**
-   * Extracts token usage from response.
-   */
-  extractUsage(raw) {
-    try {
-      const data = JSON.parse(raw);
-      const record = asRecord(data);
-      if (record === null) return null;
-      const usageRecord = asRecord(record.usage);
-      if (usageRecord === null) return null;
-      const inputTokens = extractNumberField(usageRecord, "input_tokens");
-      const outputTokens = extractNumberField(usageRecord, "output_tokens");
-      if (inputTokens === null || outputTokens === null) {
-        return null;
-      }
-      const cachedInputTokens = extractNumberField(usageRecord, "cache_read_input_tokens");
-      const cacheCreationInputTokens = extractNumberField(
-        usageRecord,
-        "cache_creation_input_tokens"
-      );
-      return {
-        inputTokens,
-        outputTokens,
-        // NOTE: still uncached input + output. Folding the cache figures in
-        // here is a semantics change for every consumer of totalTokens and
-        // belongs with the threading increment on #4435, not this extraction.
-        totalTokens: inputTokens + outputTokens,
-        ...cachedInputTokens !== null && { cachedInputTokens },
-        ...cacheCreationInputTokens !== null && { cacheCreationInputTokens }
-      };
-    } catch {
-      logger.debug("Skipped malformed output line", { snippet: raw.slice(0, 100) });
-      return null;
-    }
-  }
-  /**
-   * Extracts the cost the Claude CLI reported for this call.
-   *
-   * Prefers `total_cost_usd` — the vendor's own total — over summing
-   * `modelUsage[*].costUSD`, because a per-model breakdown can omit a component
-   * the total includes. Both are declared on {@link ClaudeCliResponse} and
-   * neither reached `CliResponse` before #5241.
-   *
-   * Rejects a negative or non-finite figure: a cost is a measurement, and
-   * letting a corrupt one through would debit the budget router with garbage.
-   */
-  extractCostUsd(raw) {
-    try {
-      const record = asRecord(JSON.parse(raw));
-      if (record === null) return null;
-      const total = record.total_cost_usd;
-      if (typeof total === "number") return isUsableCost(total) ? total : null;
-      return sumModelUsageCost(record.modelUsage);
-    } catch {
-      logger.debug("Skipped malformed output line", { snippet: raw.slice(0, 100) });
-      return null;
-    }
-  }
-  /**
-   * Extracts session ID for resumption.
-   */
-  extractSessionId(raw) {
-    try {
-      const data = JSON.parse(raw);
-      const record = asRecord(data);
-      if (record === null) return null;
-      const sessionId = record.session_id;
-      if (typeof sessionId === "string") {
-        return sessionId;
-      }
-      return null;
-    } catch {
-      logger.debug("Skipped malformed output line", { snippet: raw.slice(0, 100) });
-      return null;
-    }
-  }
-  /**
-   * Type guard for valid response structure.
-   */
-  isValidResponse(data) {
-    const record = asRecord(data);
-    if (record === null) return false;
-    return typeof record.result === "string";
-  }
-};
-
-// src/cli-adapters/adapters/claude-adapter.ts
-var MODEL_TO_CLI_ALIAS = buildClaudeAliasMap();
-function buildClaudeAliasMap() {
-  const map = {};
-  for (const model of findInTreeByCli("claude")) {
-    if (model.cliAlias === void 0) continue;
-    const alias = model.cliAlias;
-    map[alias] = alias;
-    map[model.id] = alias;
-    if (model.cliModelName !== void 0) map[model.cliModelName] = alias;
-    for (const legacyName of model.aliases ?? []) {
-      map[legacyName] = alias;
-    }
-  }
-  return map;
-}
-var UNKNOWN_MODEL_DEFAULT_INPUT_COST = 5;
-var UNKNOWN_MODEL_DEFAULT_OUTPUT_COST = 25;
-var IN_FAMILY_FALLBACK_OPTION = "inFamilyFallback";
-function toCliAlias(internalModel) {
-  return MODEL_TO_CLI_ALIAS[internalModel] ?? internalModel;
-}
-function nextClaudeAlias(alias) {
-  const aliases = getDefaultRegistry().allEntries().flatMap(
-    (entry) => entry.cliName === "claude" && entry.cliAlias !== void 0 ? [entry.cliAlias] : []
-  );
-  const at = aliases.indexOf(alias);
-  return at === -1 ? void 0 : aliases[at + 1];
-}
-var CLAUDE_READ_ONLY_TOOLS = ["Read", "Grep", "Glob"];
-var CLAUDE_READ_ONLY_DISALLOWED_TOOLS = [
-  "Bash",
-  "Edit",
-  "Write",
-  "NotebookEdit",
-  "WebFetch",
-  "WebSearch"
-];
-var CLAUDE_WORKSPACE_EDIT_TOOLS = ["Read", "Grep", "Glob", "Edit", "Write"];
-var CLAUDE_WORKSPACE_EDIT_DISALLOWED_TOOLS = [
-  "Bash",
-  "NotebookEdit",
-  "WebFetch",
-  "WebSearch"
-];
-function restrictedModeArgs(task) {
-  if (isReadOnlyAnalysis(task)) {
-    return [
-      "--permission-mode",
-      "manual",
-      "--tools",
-      CLAUDE_READ_ONLY_TOOLS.join(","),
-      "--strict-mcp-config",
-      "--disallowedTools",
-      CLAUDE_READ_ONLY_DISALLOWED_TOOLS.join(",")
-    ];
-  }
-  if (isWorkspaceEdit(task)) {
-    return [
-      "--permission-mode",
-      "acceptEdits",
-      "--tools",
-      CLAUDE_WORKSPACE_EDIT_TOOLS.join(","),
-      "--strict-mcp-config",
-      "--disallowedTools",
-      CLAUDE_WORKSPACE_EDIT_DISALLOWED_TOOLS.join(",")
-    ];
-  }
-  return void 0;
-}
-var ClaudeCliAdapter = class extends SubprocessCliAdapter {
-  name = "claude";
-  enforcesReadOnlyAnalysis = true;
-  enforcesWorkspaceEdit = true;
-  claudeParser = new ClaudeResponseParser();
-  parser = this.claudeParser;
-  model;
-  constructor(options) {
-    super(options?.logger);
-    this.model = options?.model ?? getCliModelName(getDefaultModelForCli("claude"));
-  }
-  /**
-   * Key-free model enumeration (#3405): the claude CLI has no list-models
-   * command and its OAuth token can't call /v1/models, so we enumerate the
-   * vendor's models from the models.dev snapshot. Existence only.
-   */
-  listModels() {
-    return Promise.resolve(listModelsForCli(this.name));
-  }
-  /**
-   * Gets Claude model information.
-   * `buildModelInfo` matches `cliModelName`, `cliAlias`, and `aliases[]` —
-   * a single call handles 'opus', 'sonnet', 'haiku', current model names,
-   * and the legacy `claude-opus-4` / `claude-haiku-3` / etc. entries that
-   * live in the registry's aliases since #2200 Child 1.
-   *
-   * Truly unrecognized models fall through to conservative defaults
-   * (current Opus pricing).
-   */
-  getModelInfo() {
-    const fromRegistry = buildModelInfo("claude", this.model);
-    if (fromRegistry !== void 0) return fromRegistry;
-    return {
-      id: this.model,
-      name: this.model,
-      contextWindow: FALLBACK_CONTEXT_WINDOW,
-      maxOutput: FALLBACK_MAX_OUTPUT,
-      costPerMillionInput: UNKNOWN_MODEL_DEFAULT_INPUT_COST,
-      costPerMillionOutput: UNKNOWN_MODEL_DEFAULT_OUTPUT_COST
-    };
-  }
-  /**
-   * Run the task, and on an out-of-credits envelope for the requested model
-   * retry ONCE with the next claude alias the registry lists (#6120).
-   *
-   * The credit exhaustion the claude CLI reports is per MODEL — `fable`
-   * answered "You're out of usage credits" while `sonnet` answered the same
-   * prompt — so it is not evidence against the CLI, and it must not reach the
-   * per-CLI circuit breaker as one. The breaker records what leaves this
-   * method: a substituted success records nothing, and a second capacity
-   * error propagates as the typed error and counts once, because by then the
-   * family, not one model, has failed. A non-capacity `is_error` (auth, a
-   * server error) is returned as-is; another model would not fix it.
-   *
-   * The substitution is stamped on the response as `fallbackFrom` so a vote
-   * record can say which model actually answered (#6115).
-   *
-   * Tool calls claude's permission layer refused are copied from the result
-   * envelope onto the response as `permissionDenials` (#6792).
-   */
-  async executeTask(task, options) {
-    const result = await this.executeWithFallback(task, options);
-    if (!result.ok || typeof result.value.raw !== "string") return result;
-    const denials = this.claudeParser.extractPermissionDenials(result.value.raw);
-    return denials === null ? result : ok({ ...result.value, permissionDenials: denials });
-  }
-  /** {@link executeTask}'s run with the one in-family retry (#6120). */
-  async executeWithFallback(task, options) {
-    const first = await super.executeTask(task, options);
-    if (first.ok || !isDurableCapacityText(first.error.message)) return first;
-    if (task.options?.[IN_FAMILY_FALLBACK_OPTION] === false) return first;
-    const requested = toCliAlias(task.model ?? this.model);
-    const next = nextClaudeAlias(requested);
-    if (next === void 0) return first;
-    this.logger.warn("Claude model out of usage credits; retrying once with the next alias", {
-      requested,
-      next
-    });
-    const second = await super.executeTask({ ...task, model: next }, options);
-    if (!second.ok) return second;
-    return ok({ ...second.value, model: next, fallbackFrom: requested });
-  }
-  /**
-   * #6754/#6792: a permission bypass would defeat either restricted mode, so
-   * the combination is refused rather than resolved one way silently.
-   */
-  async accessModeRefusal(task) {
-    const base = await super.accessModeRefusal(task);
-    const mode = restrictedAccessMode(task);
-    if (base !== void 0 || mode === void 0) return base;
-    if (task.options?.["skipPermissions"] === true) {
-      return accessModeConflict(this.name, mode, "the task also asks to skip permissions");
-    }
-    if (typeof task.options?.["mcpConfigPath"] === "string") {
-      return accessModeConflict(this.name, mode, "the task also names an MCP config");
-    }
-    return void 0;
-  }
-  /** Appends optional string-type task options to CLI args. */
-  appendTaskOptions(args, task) {
-    const workDir = task.options?.["workDir"];
-    if (typeof workDir === "string" && workDir.length > 0) {
-      args.push("--add-dir", workDir);
-    }
-    const mcpConfigPath = task.options?.["mcpConfigPath"];
-    if (typeof mcpConfigPath === "string" && mcpConfigPath.length > 0) {
-      args.push("--mcp-config", mcpConfigPath);
-    }
-    const modeArgs = restrictedModeArgs(task);
-    if (modeArgs !== void 0) {
-      args.push(...modeArgs);
-      return;
-    }
-    if (task.options?.["skipPermissions"] === true) {
-      args.push("--dangerously-skip-permissions");
-    }
-  }
-  /**
-   * Gets CLI command and arguments for execution.
-   * Uses stdin for the prompt to avoid argument escaping issues,
-   * especially important when using --add-dir.
-   */
-  getCommand(task) {
-    const args = ["-p", "--output-format", "json"];
-    const internalModel = task.model ?? this.model;
-    const cliModel = toCliAlias(internalModel);
-    args.push("--model", cliModel);
-    if (task.systemPrompt !== void 0 && task.systemPrompt !== "") {
-      args.push("--system-prompt", task.systemPrompt);
-    }
-    if (task.sessionId !== void 0 && task.sessionId !== "") {
-      args.push("--resume", task.sessionId);
-    }
-    this.appendTaskOptions(args, task);
-    return { command: "claude", args, stdin: task.content };
-  }
-};
-
 export {
   CLI_TIMEOUT_PROFILES,
   DEFAULT_TIMEOUT_PROFILE,
@@ -1925,9 +1501,6 @@ export {
   getAbortObservation,
   MAX_RESPONSE_STDERR_CHARS,
   spawnCwd,
-  SubprocessCliAdapter,
-  ClaudeResponseParser,
-  IN_FAMILY_FALLBACK_OPTION,
-  ClaudeCliAdapter
+  SubprocessCliAdapter
 };
-//# sourceMappingURL=chunk-MFBTGXR6.js.map
+//# sourceMappingURL=chunk-3QKRY72I.js.map