nexus-agents 2.155.1 → 2.157.0

package/dist/{child-mcp-config-5TDFQBX4.js → child-mcp-config-3YUKLM5F.js}

@@ -1,6 +1,6 @@
 import {
   createLogger
-} from "./chunk-N3Y6J2FL.js";
+} from "./chunk-RCSDD2QY.js";
 import "./chunk-NL7SZQPW.js";
 import "./chunk-DHVMSIT5.js";
 import "./chunk-ZPWHCABL.js";
@@ -60,4 +60,4 @@ export {
   generateMcpConfig,
   getDefaultAllowedTools
 };
-//# sourceMappingURL=child-mcp-config-5TDFQBX4.js.map
+//# sourceMappingURL=child-mcp-config-3YUKLM5F.js.map

package/dist/{chunk-KBHRWQBL.js → chunk-3NT6NAXD.js}

@@ -1,6 +1,6 @@
 import {
   lookupInTreeCapability
-} from "./chunk-N3Y6J2FL.js";
+} from "./chunk-RCSDD2QY.js";
 import {
   getNexusDataDir
 } from "./chunk-DHVMSIT5.js";
@@ -123,4 +123,4 @@ export {
   loadUsageEvents,
   rollupByModel
 };
-//# sourceMappingURL=chunk-KBHRWQBL.js.map
+//# sourceMappingURL=chunk-3NT6NAXD.js.map

package/dist/{chunk-J2P7FOEZ.js → chunk-3S2OPUGU.js}

@@ -2,7 +2,7 @@ import {
   createLogger,
   err,
   ok
-} from "./chunk-N3Y6J2FL.js";
+} from "./chunk-RCSDD2QY.js";
 
 // src/scm/token-resolver.ts
 import { execFile } from "child_process";
@@ -87,4 +87,4 @@ export {
   hasToken,
   getTokenEnvVars
 };
-//# sourceMappingURL=chunk-J2P7FOEZ.js.map
+//# sourceMappingURL=chunk-3S2OPUGU.js.map

package/dist/{chunk-MRYEJZQI.js → chunk-3SE57WOV.js}

@@ -1,6 +1,6 @@
 import {
   generateSecurityPlan
-} from "./chunk-52UVXXYA.js";
+} from "./chunk-5FH7QZIT.js";
 import {
   analyzeGitHubRepo
 } from "./chunk-HFOQKCD2.js";
@@ -18,13 +18,14 @@ import {
   DEFAULT_TASK_TTL_MS,
   DEFAULT_TOOL_RATE_LIMITS,
   clampTaskTtl
-} from "./chunk-6FIWYWPM.js";
+} from "./chunk-OXYGRB4C.js";
 import {
   executeExpert
-} from "./chunk-F5R53HDK.js";
+} from "./chunk-BGAK4N74.js";
 import {
   JobStatusSchema,
   abortJob,
+  checkSimulationAllowed,
   collectRealVotes,
   defaultBusyEnvelope,
   defaultCollisionEnvelope,
@@ -38,24 +39,24 @@ import {
   resolveIdempotency,
   runAsJob,
   runConsensusForGoal,
+  simulationDeniedResult,
   toJobSummary,
-  warnIfSimulatedOutsideTests,
   writeJobCancelled
-} from "./chunk-6LFKY2NE.js";
+} from "./chunk-TT4ZITRU.js";
 import {
   normalizeTopicToCanonical,
   synthesizeResearch
-} from "./chunk-DZCMTSNS.js";
+} from "./chunk-XGUZ2OQK.js";
 import {
   IssueTriage
-} from "./chunk-QERDNK6B.js";
+} from "./chunk-YZQXCCEA.js";
 import {
   resolveEnvMode,
   sanitizeInput
-} from "./chunk-VC7EUQH4.js";
+} from "./chunk-UAGYCCHY.js";
 import {
   withPrerequisite
-} from "./chunk-TWXCQOZN.js";
+} from "./chunk-LZ2LHYDO.js";
 import {
   NOOP_NOTIFIER,
   RateLimiter,
@@ -78,12 +79,12 @@ import {
   withAuditTrail,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-ZVGM3MPI.js";
+} from "./chunk-PZDDA6IW.js";
 import {
   createAuditTrail,
   createGraphAuditBridge,
   emitPipelinePolicyEvent
-} from "./chunk-XDYOJQKC.js";
+} from "./chunk-BM26VPV5.js";
 import {
   addResearchPaper,
   addSourceToRegistry,
@@ -111,15 +112,15 @@ import {
   parseRegistry,
   sourceExistsInRegistry,
   summarizeContextForPrompt
-} from "./chunk-ZLNGFULQ.js";
+} from "./chunk-O7VPOR5A.js";
 import {
   getTokenEnvVars,
   resolveToken
-} from "./chunk-J2P7FOEZ.js";
+} from "./chunk-3S2OPUGU.js";
 import {
   loadPapersRegistry,
   loadTechniquesRegistry
-} from "./chunk-IZVRLJIX.js";
+} from "./chunk-HWG437YQ.js";
 import {
   resolveInsideRoot
 } from "./chunk-NUBSJGQZ.js";
@@ -128,14 +129,14 @@ import {
   MemoryImportance,
   calculateTextJaccardSimilarity,
   getToolMemory
-} from "./chunk-D4N7KBBT.js";
+} from "./chunk-7YOJXOFN.js";
 import {
   STOPWORDS,
   truncateWithInfo
 } from "./chunk-6T3EPABN.js";
 import {
   createSessionMemory
-} from "./chunk-22MKYE4Y.js";
+} from "./chunk-IILTUCFB.js";
 import {
   BUILT_IN_EXPERTS,
   BuiltInExpertTypeSchema,
@@ -150,7 +151,7 @@ import {
   createEvent,
   getGlobalEventBus,
   getGlobalRegistry
-} from "./chunk-MY22I2FD.js";
+} from "./chunk-TKCXD36G.js";
 import {
   CliDetectionCache,
   asRecord,
@@ -158,19 +159,19 @@ import {
   getAvailableClis,
   sleep,
   withTimeout
-} from "./chunk-PRMXFOWF.js";
+} from "./chunk-M532SJS6.js";
 import {
   DEFAULTS
-} from "./chunk-DJTWGM7I.js";
+} from "./chunk-TNRTP5FW.js";
 import {
   getAvailabilityCache,
   getCliForModelId,
   resolveFallback
-} from "./chunk-BMHQATIA.js";
+} from "./chunk-YGYJUPVX.js";
 import {
   generateHyphenId,
   generateUUID
-} from "./chunk-ZFUFS44V.js";
+} from "./chunk-MYSS22Q2.js";
 import {
   AGENT_ROUTER_TIMEOUTS,
   API_TIMEOUTS,
@@ -262,7 +263,7 @@ import {
   selectStrategyByManifest,
   toExpertTaskAnalysisResult,
   withStep
-} from "./chunk-N3Y6J2FL.js";
+} from "./chunk-RCSDD2QY.js";
 import {
   ensureLearningDir,
   getMetaOutcomesFile,
@@ -26297,7 +26298,7 @@ function execIdFields(executionId) {
 async function populateUnifiedContextOnState(state, options) {
   const taskCandidate = state["task"];
   if (typeof taskCandidate !== "string" || taskCandidate === "") return;
-  const { getContextForTask: getContextForTask2, inferTaskCategory: inferTaskCategory2 } = await import("./context-retriever-FTLRG2N6.js");
+  const { getContextForTask: getContextForTask2, inferTaskCategory: inferTaskCategory2 } = await import("./context-retriever-33SGXV33.js");
   const category = inferTaskCategory2(taskCandidate);
   const executionId = options?.executionId;
   const execFields = execIdFields(executionId);
@@ -41571,7 +41572,7 @@ async function tryIssueTriage(task) {
   try {
     const issueMatch = task.match(/github\.com\/([^/]+\/[^/]+)\/issues\/(\d+)/);
     if (issueMatch === null) return null;
-    const { createIssueTriage } = await import("./issue-triage-QOD3WWIM.js");
+    const { createIssueTriage } = await import("./issue-triage-OP3FDRKY.js");
     const triage = createIssueTriage();
     const owner = issueMatch[1] ?? "";
     const num = issueMatch[2] ?? "";
@@ -41599,7 +41600,7 @@ var VALID_TEMPLATES = /* @__PURE__ */ new Set([
 ]);
 async function classifyWithLLM(task) {
   try {
-    const { executeExpert: executeExpert2 } = await import("./expert-bridge-MJJDMA6Z.js");
+    const { executeExpert: executeExpert2 } = await import("./expert-bridge-RJP57L75.js");
     const prompt = [
       "Classify this task into exactly one pipeline template.",
       "Templates: dev (implementation/bug fix/refactor), research (investigate/evaluate/compare),",
@@ -43240,7 +43241,7 @@ var memoryInitPromise = null;
 async function initPipelineMemory() {
   if (cachedMemory !== null) return cachedMemory;
   try {
-    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-BFT6O2F7.js");
+    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-RA7KE6CX.js");
     const { getLearningDir } = await import("./learning-persistence-M3OTCCNI.js");
     const mem = createSessionMemory2(getLearningDir());
     mem.startSession(`pipeline-${String(getTimeProvider().now())}`);
@@ -43302,7 +43303,7 @@ function recordRoutingExperience(category, success, durationMs, tokensUsed = 0,
     callRecord(routingMemoryCache);
     return;
   }
-  routingMemoryInitPromise ??= import("./routing-memory-VBJMY6PE.js").then(({ createRoutingMemory }) => {
+  routingMemoryInitPromise ??= import("./routing-memory-FE4EQUXO.js").then(({ createRoutingMemory }) => {
     routingMemoryCache ??= createRoutingMemory();
     return routingMemoryCache;
   }).catch((error) => {
@@ -43336,7 +43337,7 @@ ${text}` : "";
 }
 async function getWeatherContext() {
   try {
-    const { generateWeatherReport: generateWeatherReport2 } = await import("./weather-report-GLZ2LI7V.js");
+    const { generateWeatherReport: generateWeatherReport2 } = await import("./weather-report-HRQCJEU5.js");
     const report = generateWeatherReport2({ includeAdaptive: true });
     const mappings = "recommendedMappings" in report ? report.recommendedMappings : [];
     if (!Array.isArray(mappings) || mappings.length === 0) return "";
@@ -43354,7 +43355,7 @@ ${lines}
 }
 async function getMemoryContext(task) {
   try {
-    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-BFT6O2F7.js");
+    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-RA7KE6CX.js");
     const { getLearningDir } = await import("./learning-persistence-M3OTCCNI.js");
     const memory = createSessionMemory2(getLearningDir(), { maxLearningsInContext: 10 });
     const learnings = memory.searchLearnings(task.slice(0, 200));
@@ -43466,7 +43467,7 @@ ${contextBlock}`;
       const strategy = config.votingStrategy ?? "higher_order";
       await postProgress(config, "Vote", `Running consensus with ${strategy} strategy...`);
       try {
-        const { executeVoting } = await import("./consensus-vote-CQBTPJRD.js");
+        const { executeVoting } = await import("./consensus-vote-7EBYYBCQ.js");
         const votingResult = await executeVoting(
           {
             proposal: buildVoteProposal(plan, research),
@@ -43903,7 +43904,7 @@ async function searchCodebaseForTask(task) {
 }
 async function queryResearchRegistry(task) {
   try {
-    const { synthesizeResearch: synthesizeResearch2 } = await import("./research-helpers-synthesize-DTNUWPRP.js");
+    const { synthesizeResearch: synthesizeResearch2 } = await import("./research-helpers-synthesize-KUA53BAD.js");
     const topic = task.split(/[.!?\n]/).filter((s) => s.trim().length > 10)[0]?.trim();
     if (topic === void 0) return null;
     const result = await synthesizeResearch2(topic.slice(0, 50));
@@ -43974,7 +43975,7 @@ function createScanStageWrapper() {
       try {
         const slug = ctx.task.match(/([a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+)/)?.[1];
         if (slug !== void 0) {
-          const { generateSecurityPlan: generateSecurityPlan2 } = await import("./repo-security-plan-ELSKPBOD.js");
+          const { generateSecurityPlan: generateSecurityPlan2 } = await import("./repo-security-plan-D62HB5PK.js");
           const plan = await generateSecurityPlan2({ repo: slug, maxScanners: 10 });
           const recs = plan.recommendations.slice(0, 5).map((r) => `${r.priority}: ${r.displayName} (${r.category})`).join("; ");
           return output(PIPELINE_STATE_KEYS.FINDINGS, recs, getTimeProvider().now() - start, true);
@@ -44804,6 +44805,10 @@ function makePrReviewHandler(gatewayAdapters) {
       });
     }
     const input = parsed.data;
+    if (input.simulate) {
+      const simCheck = checkSimulationAllowed("pr_review", ctx.logger);
+      if (!simCheck.allowed) return simulationDeniedResult(simCheck.reason);
+    }
     try {
       if (input.dispatch === "async") {
         return runAsJob({
@@ -46930,7 +46935,7 @@ var GitHubTaskTracker = class {
   cachedProvider = null;
   async getProvider() {
     if (this.cachedProvider !== null) return this.cachedProvider;
-    const { createScmProvider } = await import("./factory-RS462DMM.js");
+    const { createScmProvider } = await import("./factory-YOUM5MCV.js");
     const result = await createScmProvider({ repo: this.config.repo ?? "" });
     if (!result.ok) throw new Error(`SCM provider error: ${result.error.message}`);
     this.cachedProvider = result.value;
@@ -47164,8 +47169,11 @@ async function runDevPipelineForGoal(goal, trustTier) {
   const stages = await createStages(input);
   return runDevPipeline(goal, stages, trustTier !== void 0 ? { trustTier } : void 0);
 }
-function buildStructuredOutput(result) {
+function buildStructuredOutput(result, simulated) {
   return {
+    // #4170: stamped only on an explicit NEXUS_ALLOW_SIMULATE=1 opt-in run so
+    // a random demo panel can never pass as a real decision.
+    ...simulated ? { simulated: true } : {},
     completed: result.completed,
     securityPassed: result.securityPassed,
     voteIterations: result.voteIterations,
@@ -47193,10 +47201,10 @@ function buildPipelineOptions(input, trustTier, auditLogger) {
     ...auditLogger !== void 0 ? { auditLogger } : {}
   };
 }
-async function executeDevPipelineBody(taskText, stages, pipelineOptions) {
+async function executeDevPipelineBody(taskText, stages, pipelineOptions, simulated) {
   const result = await runDevPipeline(taskText, stages, pipelineOptions);
   flushPipelineMemory();
-  return toolSuccessStructured(buildStructuredOutput(result));
+  return toolSuccessStructured(buildStructuredOutput(result, simulated));
 }
 async function runDevPipelineHandler(args, logger58, trustTier, auditLogger) {
   const parsed = DevPipelineInputSchema.safeParse(args);
@@ -47207,8 +47215,11 @@ async function runDevPipelineHandler(args, logger58, trustTier, auditLogger) {
     });
   }
   const input = parsed.data;
+  let simulated = false;
   if (input.simulateVotes) {
-    warnIfSimulatedOutsideTests("run_dev_pipeline", logger58);
+    const simCheck = checkSimulationAllowed("run_dev_pipeline", logger58);
+    if (!simCheck.allowed) return simulationDeniedResult(simCheck.reason);
+    simulated = simCheck.optedIn;
   }
   try {
     const taskText = await resolveTaskInput(input);
@@ -47216,10 +47227,11 @@ async function runDevPipelineHandler(args, logger58, trustTier, auditLogger) {
     const pipelineOptions = buildPipelineOptions(input, trustTier, auditLogger);
     const hasOptions = Object.keys(pipelineOptions).length > 0;
     const resolvedOptions = hasOptions ? pipelineOptions : void 0;
+    const run = () => executeDevPipelineBody(taskText, stages, resolvedOptions, simulated);
     if (input.dispatch === "async" && !input.dryRun) {
-      return dispatchAsyncDevPipeline(input, taskText, stages, resolvedOptions, logger58);
+      return dispatchAsyncDevPipeline(input, run, logger58);
     }
-    return await executeDevPipelineBody(taskText, stages, resolvedOptions);
+    return await run();
   } catch (error) {
     return toolStructuredError({
       errorCategory: "internal",
@@ -47227,8 +47239,7 @@ async function runDevPipelineHandler(args, logger58, trustTier, auditLogger) {
     });
   }
 }
-function dispatchAsyncDevPipeline(input, taskText, stages, pipelineOptions, logger58) {
-  const run = () => executeDevPipelineBody(taskText, stages, pipelineOptions);
+function dispatchAsyncDevPipeline(input, run, logger58) {
   if (input.sessionId === void 0) {
     return runAsJob({
       toolName: "run_dev_pipeline",
@@ -47324,7 +47335,7 @@ var PipelineInputSchema = z104.object({
   /** TESTS ONLY — random output, must not be used for real decisions. (#2319) */
   simulateVotes: z104.boolean().default(false).describe("TESTS ONLY \u2014 random output, must not be used for real decisions (#2319)")
 });
-function buildOutput2(result) {
+function buildOutput2(result, simulated) {
   return {
     success: result.success,
     templateId: result.templateId,
@@ -47333,6 +47344,9 @@ function buildOutput2(result) {
     stepsExecuted: result.stepsExecuted,
     durationMs: result.durationMs,
     error: result.error ?? null,
+    // #4170: stamped only on an explicit NEXUS_ALLOW_SIMULATE=1 opt-in run so
+    // a random demo panel can never pass as a real decision.
+    ...simulated ? { simulated: true } : {},
     // Rate limit awareness (#1802)
     rateLimitHint: result.error?.toLowerCase().includes("rate limit") === true ? "Consider using quickMode or increasing delay between pipeline runs" : void 0
   };
@@ -47400,13 +47414,13 @@ async function runPipelineForGoal(goal, logger58 = createLogger({ tool: "run_pip
   const stages = selectStageRegistry(void 0, goal, agentStages);
   return runAdaptiveOrchestrator(goal, { stages });
 }
-async function executePipelineBody(task, stages, templateId, dryRun) {
+async function executePipelineBody(task, stages, templateId, dryRun, simulated) {
   const result = await runAdaptiveOrchestrator(task, {
     stages,
     templateId,
     dryRun
   });
-  return toolSuccessStructured(buildOutput2(result));
+  return toolSuccessStructured(buildOutput2(result, simulated));
 }
 async function runPipelineHandler(args, logger58) {
   const parsed = PipelineInputSchema.safeParse(args);
@@ -47417,8 +47431,11 @@ async function runPipelineHandler(args, logger58) {
     });
   }
   const input = parsed.data;
+  let simulated = false;
   if (input.simulateVotes) {
-    warnIfSimulatedOutsideTests("run_pipeline", logger58);
+    const simCheck = checkSimulationAllowed("run_pipeline", logger58);
+    if (!simCheck.allowed) return simulationDeniedResult(simCheck.reason);
+    simulated = simCheck.optedIn;
   }
   try {
     const task = await resolveTask(input.task, input.specFile);
@@ -47434,11 +47451,11 @@ async function runPipelineHandler(args, logger58) {
         toolName: "run_pipeline",
         input,
         freshJobId: () => `rp-${randomUUID16()}`,
-        run: () => executePipelineBody(task, stages, input.template, input.dryRun),
+        run: () => executePipelineBody(task, stages, input.template, input.dryRun, simulated),
         logger: logger58
       });
     }
-    return await executePipelineBody(task, stages, input.template, input.dryRun);
+    return await executePipelineBody(task, stages, input.template, input.dryRun, simulated);
   } catch (error) {
     return toolStructuredError({
       errorCategory: "internal",
@@ -47725,7 +47742,7 @@ async function probeSource(source, includeModelIds) {
   }
 }
 async function defaultSources(includeOpenRouter) {
-  const { createAllAdapters: createAllAdapters2 } = await import("./factory-2XKATTCM.js");
+  const { createAllAdapters: createAllAdapters2 } = await import("./factory-C5PY7R6O.js");
   const adapters = createAllAdapters2();
   return buildDefaultModelSources(adapters, { includeOpenRouter });
 }
@@ -48082,6 +48099,10 @@ async function tradeoffPanelHandler(args, ctx) {
     });
   }
   const input = parsed.data;
+  if (input.simulate) {
+    const simCheck = checkSimulationAllowed("supply_chain_tradeoff_panel", ctx.logger);
+    if (!simCheck.allowed) return simulationDeniedResult(simCheck.reason);
+  }
   try {
     if (input.dispatch === "async") {
       return runAsJob({
@@ -51788,4 +51809,4 @@ export {
   shutdownFeedbackSubscriber,
   createEventBusBridge
 };
-//# sourceMappingURL=chunk-MRYEJZQI.js.map
+//# sourceMappingURL=chunk-3SE57WOV.js.map