nexus-agents 2.106.0 → 2.109.0

package/dist/{chunk-YL7SS6JZ.js → chunk-PFZNK25E.js}

@@ -2,7 +2,7 @@ import {
   TASK_CATEGORIES,
   getAdaptiveBonus,
   getOutcomeStore
-} from "./chunk-2DHISFDY.js";
+} from "./chunk-VO7FEIXD.js";
 
 // src/cli/doctor-deep.ts
 var CLI_NAMES = ["claude", "gemini", "codex", "opencode"];
@@ -106,4 +106,4 @@ export {
   runDeepDiagnostics,
   formatDeepDiagnostics
 };
-//# sourceMappingURL=chunk-YL7SS6JZ.js.map
+//# sourceMappingURL=chunk-PFZNK25E.js.map

package/dist/{chunk-GRHCGUBQ.js → chunk-RCN76RFJ.js}

@@ -9,17 +9,20 @@ import {
   toolSuccess,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-KZWJ52HH.js";
+} from "./chunk-4QH4IHCY.js";
 import {
   getToolMemory
-} from "./chunk-75NKH2VD.js";
+} from "./chunk-5H3YYSMY.js";
 import {
   authRemediation,
   createAutoAdapter,
   delay,
   getAvailableClis,
   withTimeout
-} from "./chunk-GMHCPEHS.js";
+} from "./chunk-N5I4PC3P.js";
+import {
+  mapModelErrorToCategory
+} from "./chunk-K3UILZ5X.js";
 import {
   AgentError,
   CLI_NAMES,
@@ -54,7 +57,7 @@ import {
   registerPersistentOutcomeStoreFactory,
   resolveVoteTimeout,
   toRateLimitError
-} from "./chunk-2DHISFDY.js";
+} from "./chunk-VO7FEIXD.js";
 import {
   ensureLearningDir,
   getOutcomesFile,
@@ -438,17 +441,20 @@ var ResilientAdapter = class {
       return err(new ModelError("No model adapter available"));
     }
     const result = await adapter.complete(request);
-    if (!result.ok && isRateLimitLikeError(result.error)) {
-      const rlError = toRateLimitError(result.error, adapter.providerId);
-      recordRateLimitEvent({
-        provider: adapter.providerId,
-        timestamp: getTimeProvider().now(),
-        retryAfterMs: rlError.retryAfterMs
-      });
-      this.logger.warn("Rate limit detected", {
-        provider: adapter.providerId,
-        retryAfterMs: rlError.retryAfterMs
-      });
+    if (!result.ok) {
+      if (isRateLimitLikeError(result.error)) {
+        const rlError = toRateLimitError(result.error, adapter.providerId);
+        recordRateLimitEvent({
+          provider: adapter.providerId,
+          timestamp: getTimeProvider().now(),
+          retryAfterMs: rlError.retryAfterMs
+        });
+        this.logger.warn("Rate limit detected", {
+          provider: adapter.providerId,
+          retryAfterMs: rlError.retryAfterMs
+        });
+      }
+      this.recordBreakerFailure(adapter, result.error);
     }
     return result;
   }
@@ -572,6 +578,37 @@ var ResilientAdapter = class {
       this.emitFailover();
     }
   }
+  /**
+   * Record a direct-API failure to the circuit breaker so API adapters get the
+   * same degradation/failover learning that CLI subprocess failures get (#3423).
+   *
+   * The breaker key is `currentSelection.name` — distinct from the `api:<vendor>`
+   * arm key used by the ModelToCliAdapter path (#3422), so the two paths never
+   * double-count the same failure.
+   *
+   * Rate-limit failures are deliberately skipped here: they are already recorded
+   * by the `recordRateLimitEvent` telemetry branch in `complete()`, and the
+   * breaker counts rate limits as failures by default
+   * (`countRateLimitsAsFailures`), so recording them again would double-count.
+   *
+   * Security (#3422 constraint): the logged payload carries only `provider` and
+   * `category` — never `error.message`, the request, or the ModelError object,
+   * any of which could embed credentials.
+   */
+  recordBreakerFailure(adapter, error) {
+    if (this.circuitBreakerRegistry === void 0 || this.currentSelection === void 0) {
+      return;
+    }
+    const category = mapModelErrorToCategory(error);
+    if (category === "rate_limit" || isRateLimitLikeError(error)) {
+      return;
+    }
+    this.circuitBreakerRegistry.getBreaker(this.currentSelection.name).recordFailure(category);
+    this.logger.warn("API failure recorded to circuit breaker", {
+      provider: adapter.providerId,
+      category
+    });
+  }
   handleCircuitStateChange(event) {
     if (event.newState !== "open") return;
     const currentSource = this.currentSelection?.name;
@@ -1300,6 +1337,103 @@ var VoteResponseSchema = z.object({
    * Replaces the YAML-in-reasoning encoding that proved lossy. */
   findings: z.array(RawFindingSchema).optional().describe("Structured findings (PR review only)")
 });
+var VOTE_JSON_SCHEMA = {
+  type: "object",
+  additionalProperties: false,
+  required: ["decision", "reasoning", "confidence"],
+  properties: {
+    decision: {
+      type: "string",
+      enum: ["approve", "reject", "abstain"],
+      description: "Your vote decision"
+    },
+    reasoning: {
+      type: "string",
+      minLength: 10,
+      maxLength: 4e3,
+      description: "Explanation for your vote (10-4000 chars)"
+    },
+    confidence: {
+      type: "number",
+      minimum: 0,
+      maximum: 1,
+      description: "Confidence level 0-1"
+    },
+    conditions: {
+      type: "array",
+      items: { type: "string" },
+      description: "Optional conditions for approval"
+    },
+    rejectionCategories: {
+      type: "array",
+      items: {
+        type: "string",
+        enum: [
+          "YAGNI",
+          "DRY_VIOLATION",
+          "OVER_ENGINEERING",
+          "SCOPE_CREEP",
+          "SECURITY_RISK",
+          "MISALIGNED",
+          "INSUFFICIENT_EVIDENCE"
+        ]
+      },
+      description: "Rejection reason categories when decision is reject"
+    },
+    findings: {
+      type: "array",
+      description: "Structured findings (PR review only)",
+      items: {
+        type: "object",
+        additionalProperties: false,
+        required: ["summary", "location", "severity", "gate", "claim"],
+        properties: {
+          summary: {
+            type: "string",
+            minLength: 1,
+            maxLength: 500,
+            description: "One-line summary of the issue"
+          },
+          location: {
+            type: "string",
+            minLength: 1,
+            maxLength: 200,
+            description: "path/file.ext:line"
+          },
+          severity: { type: "string", enum: ["critical", "high", "medium", "low"] },
+          gate: {
+            type: "object",
+            additionalProperties: false,
+            required: [
+              "reread_cited_line",
+              "traced_call_path",
+              "named_assertion",
+              "ruled_out_language_non_issue"
+            ],
+            properties: {
+              reread_cited_line: { type: "string", enum: ["passed", "failed", "skipped"] },
+              traced_call_path: { type: "string", enum: ["passed", "failed", "skipped"] },
+              named_assertion: {
+                type: "string",
+                description: "Concrete failing assertion \u2014 substantive, not a rubber-stamp word"
+              },
+              ruled_out_language_non_issue: {
+                type: "string",
+                enum: ["passed", "failed", "skipped"]
+              }
+            }
+          },
+          claim: {
+            type: "string",
+            minLength: 1,
+            maxLength: 2e3,
+            description: "What is wrong and why it justifies blocking"
+          }
+        }
+      }
+    }
+  }
+};
 var VOTE_PROMPT_EXAMPLES = `Example approve response:
 {
   "decision": "approve",
@@ -1537,6 +1671,12 @@ async function executeSingleVoteAttempt(role, proposal, adapter, timeoutMs) {
     maxTokens: 2e3,
     temperature: 0.3,
     // Low temperature for consistent evaluations
+    // #3433: request native structured output (Claude tool_use / OpenAI+Gemini
+    // json mode) so the vote arrives as a schema-valid JSON object instead of
+    // prose-wrapped JSON. Adapters that don't honor responseFormat ignore it and
+    // the existing extractTextFromResponse + parseVoteResponse regex/Zod path
+    // below is the fallback — no behavior change for those backends.
+    responseFormat: { type: "json_schema", schema: VOTE_JSON_SCHEMA },
     // Thread the vote's budget into the adapter so its shorter standard CLI
     // timeout doesn't fire first and surface as an MCP -32001 on slow voters
     // (e.g. the Security role on complex proposals) (#3304).
@@ -5987,7 +6127,7 @@ async function processVotesWithCascade(engineVotes, opts) {
 var CONTRARIAN_ESCALATION_THRESHOLD = 0.8;
 async function runContrarianCheck(proposal, log) {
   try {
-    const { executeExpert } = await import("./expert-bridge-OBOSFIHR.js");
+    const { executeExpert } = await import("./expert-bridge-N7PLXYBV.js");
     const prompt = [
       "You are a contrarian analyst. Your job is to find reasons this proposal should be REJECTED.",
       "Look for: YAGNI (not needed), MISALIGNED (wrong tech/architecture), SECURITY_RISK, SCOPE_CREEP.",
@@ -6471,4 +6611,4 @@ export {
   CONSENSUS_VOTE_OUTPUT_SCHEMA,
   registerConsensusVoteTool
 };
-//# sourceMappingURL=chunk-GRHCGUBQ.js.map
+//# sourceMappingURL=chunk-RCN76RFJ.js.map