nexus-agents 2.174.1 → 2.175.0

package/dist/{child-mcp-config-EYDYXTEN.js → child-mcp-config-XD4ODQJW.js}

@@ -1,14 +1,16 @@
+import {
+  nexusMkdtemp
+} from "./chunk-YAF73ZMR.js";
 import {
   createLogger
-} from "./chunk-KPM6FF6T.js";
-import "./chunk-AXTD4TFK.js";
-import "./chunk-DHVMSIT5.js";
+} from "./chunk-YAJ4XUD2.js";
+import "./chunk-2HUC6NZN.js";
+import "./chunk-OQLFRJCW.js";
 import "./chunk-ZPWHCABL.js";
 
 // src/cli-adapters/child-mcp-config.ts
-import { writeFile, mkdtemp, rm } from "fs/promises";
+import { writeFile, rm } from "fs/promises";
 import { join } from "path";
-import { tmpdir } from "os";
 var logger = createLogger({ component: "swe-bench-mcp-config" });
 var DEFAULT_ALLOWED_TOOLS = [
   "memory_query",
@@ -41,7 +43,7 @@ function buildConfig(options) {
 async function generateMcpConfig(options) {
   const config = buildConfig(options);
   const tools = options?.allowedTools ?? DEFAULT_ALLOWED_TOOLS;
-  const tempDir = await mkdtemp(join(tmpdir(), "nexus-mcp-"));
+  const tempDir = await nexusMkdtemp("nexus-mcp-");
   const configPath = join(tempDir, "mcp-config.json");
   await writeFile(configPath, JSON.stringify(config, null, 2), "utf-8");
   const cleanup = async () => {
@@ -60,4 +62,4 @@ export {
   generateMcpConfig,
   getDefaultAllowedTools
 };
-//# sourceMappingURL=child-mcp-config-EYDYXTEN.js.map
+//# sourceMappingURL=child-mcp-config-XD4ODQJW.js.map

package/dist/child-mcp-config-XD4ODQJW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli-adapters/child-mcp-config.ts"],"sourcesContent":["/**\n * nexus-agents/cli-adapters - Child CLI MCP Config Generator\n *\n * Generates MCP server configuration for child Claude CLI sessions so\n * spawned agents can call back into nexus-agents' MCP tools (memory,\n * research, etc.). Used by `pipeline/expert-bridge.ts` to give expert\n * agents tool access. Originally lived under `swe-bench/` (#1413);\n * relocated here in #2515 — the helper is generic CLI-spawn\n * infrastructure, not benchmark-specific.\n *\n * @module cli-adapters/child-mcp-config\n */\n\nimport { writeFile, rm } from 'node:fs/promises';\nimport { nexusMkdtemp } from '../config/nexus-tmp-dir.js';\nimport { join } from 'node:path';\nimport { createLogger } from '../core/index.js';\n\nconst logger = createLogger({ component: 'swe-bench-mcp-config' });\n\n/**\n * MCP server entry in Claude CLI config format.\n */\ninterface McpServerEntry {\n  readonly command: string;\n  readonly args: readonly string[];\n  readonly env?: Readonly<Record<string, string>>;\n}\n\n/**\n * MCP config file format for Claude CLI (--mcp-config).\n */\ninterface McpConfigFile {\n  readonly mcpServers: Readonly<Record<string, McpServerEntry>>;\n}\n\n/**\n * Options for generating MCP config.\n */\nexport interface McpConfigOptions {\n  /** Path to nexus-agents CLI entry point. */\n  readonly cliPath?: string;\n  /** Additional environment variables for the MCP server. */\n  readonly env?: Readonly<Record<string, string>>;\n  /** Custom allowed tools (default: read-only subset). */\n  readonly allowedTools?: readonly string[];\n}\n\n/** Default read-only tools available to SWE-bench child sessions. */\nconst DEFAULT_ALLOWED_TOOLS: readonly string[] = [\n  'memory_query',\n  'memory_stats',\n  'research_query',\n  'research_discover',\n  'weather_report',\n  'delegate_to_model',\n];\n\n/**\n * Resolves the nexus-agents CLI path.\n * Uses the built dist/cli.js relative to this package.\n */\nfunction resolveCliPath(override?: string): string {\n  if (override !== undefined) return override;\n  // Resolve relative to this file: src/swe-bench/ → dist/cli.js\n  // At runtime we're in dist/swe-bench/, so go up one level\n  const distDir = join(__dirname, '..');\n  return join(distDir, 'cli.js');\n}\n\n/**\n * Builds the MCP config object for a nexus-agents server.\n */\nfunction buildConfig(options?: McpConfigOptions): McpConfigFile {\n  const cliPath = resolveCliPath(options?.cliPath);\n  const tools = options?.allowedTools ?? DEFAULT_ALLOWED_TOOLS;\n\n  const entry: McpServerEntry = {\n    command: 'node',\n    args: [cliPath, '--mode=server'],\n    ...(options?.env !== undefined ? { env: options.env } : {}),\n  };\n\n  return {\n    mcpServers: {\n      'nexus-agents': entry,\n    },\n  };\n\n  // Note: tool allowlisting is handled by Claude CLI's --allowedTools flag,\n  // not in the MCP config itself. The caller should pass tools separately.\n  void tools;\n}\n\n/**\n * Generated MCP config with path and cleanup function.\n */\nexport interface GeneratedMcpConfig {\n  /** Path to the generated config file. */\n  readonly configPath: string;\n  /** Cleanup function to remove temp files. */\n  readonly cleanup: () => Promise<void>;\n  /** Allowed tools list for --allowedTools flag. */\n  readonly allowedTools: readonly string[];\n}\n\n/**\n * Generates an MCP config file for Claude CLI child sessions.\n *\n * Creates a temporary JSON file that can be passed to `claude --mcp-config`.\n * Returns the file path and a cleanup function.\n */\nexport async function generateMcpConfig(options?: McpConfigOptions): Promise<GeneratedMcpConfig> {\n  const config = buildConfig(options);\n  const tools = options?.allowedTools ?? DEFAULT_ALLOWED_TOOLS;\n\n  const tempDir = await nexusMkdtemp('nexus-mcp-');\n  const configPath = join(tempDir, 'mcp-config.json');\n\n  await writeFile(configPath, JSON.stringify(config, null, 2), 'utf-8');\n\n  const cleanup = async (): Promise<void> => {\n    await rm(tempDir, { recursive: true, force: true }).catch((e: unknown) => {\n      logger.debug('Best-effort cleanup failed', {\n        error: e instanceof Error ? e.message : String(e),\n      });\n    });\n  };\n\n  return { configPath, cleanup, allowedTools: tools };\n}\n\n/**\n * Gets the default allowed tools for SWE-bench MCP sessions.\n */\nexport function getDefaultAllowedTools(): readonly string[] {\n  return DEFAULT_ALLOWED_TOOLS;\n}\n"],"mappings":";;;;;;;;;;;AAaA,SAAS,WAAW,UAAU;AAE9B,SAAS,YAAY;AAGrB,IAAM,SAAS,aAAa,EAAE,WAAW,uBAAuB,CAAC;AA+BjE,IAAM,wBAA2C;AAAA,EAC/C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAMA,SAAS,eAAe,UAA2B;AACjD,MAAI,aAAa,OAAW,QAAO;AAGnC,QAAM,UAAU,KAAK,WAAW,IAAI;AACpC,SAAO,KAAK,SAAS,QAAQ;AAC/B;AAKA,SAAS,YAAY,SAA2C;AAC9D,QAAM,UAAU,eAAe,SAAS,OAAO;AAC/C,QAAM,QAAQ,SAAS,gBAAgB;AAEvC,QAAM,QAAwB;AAAA,IAC5B,SAAS;AAAA,IACT,MAAM,CAAC,SAAS,eAAe;AAAA,IAC/B,GAAI,SAAS,QAAQ,SAAY,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;AAAA,EAC3D;AAEA,SAAO;AAAA,IACL,YAAY;AAAA,MACV,gBAAgB;AAAA,IAClB;AAAA,EACF;AAIA,OAAK;AACP;AAoBA,eAAsB,kBAAkB,SAAyD;AAC/F,QAAM,SAAS,YAAY,OAAO;AAClC,QAAM,QAAQ,SAAS,gBAAgB;AAEvC,QAAM,UAAU,MAAM,aAAa,YAAY;AAC/C,QAAM,aAAa,KAAK,SAAS,iBAAiB;AAElD,QAAM,UAAU,YAAY,KAAK,UAAU,QAAQ,MAAM,CAAC,GAAG,OAAO;AAEpE,QAAM,UAAU,YAA2B;AACzC,UAAM,GAAG,SAAS,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC,EAAE,MAAM,CAAC,MAAe;AACxE,aAAO,MAAM,8BAA8B;AAAA,QACzC,OAAO,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC;AAAA,MAClD,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAEA,SAAO,EAAE,YAAY,SAAS,cAAc,MAAM;AACpD;AAKO,SAAS,yBAA4C;AAC1D,SAAO;AACT;","names":[]}

package/dist/{chunk-AXTD4TFK.js → chunk-2HUC6NZN.js}

@@ -1,6 +1,6 @@
 import {
   getNexusDataDir
-} from "./chunk-DHVMSIT5.js";
+} from "./chunk-OQLFRJCW.js";
 
 // src/config/learning-persistence.ts
 import { mkdirSync } from "fs";
@@ -45,4 +45,4 @@ export {
   isPersistenceEnabled,
   ensureLearningDir
 };
-//# sourceMappingURL=chunk-AXTD4TFK.js.map
+//# sourceMappingURL=chunk-2HUC6NZN.js.map

package/dist/{chunk-3XTGA2YK.js → chunk-4OZPWLKY.js}

@@ -1,7 +1,6 @@
 import {
   API_TIMEOUTS,
   CLI_TIMEOUTS,
-  ConfigError,
   INTERNAL_TIMEOUTS,
   MCP_TIMEOUTS,
   TEST_TIMEOUTS,
@@ -11,171 +10,11 @@ import {
   createGetRateLimitConfig,
   createGetRetryConfig,
   createGetTimeout,
-  createGetToolRateLimit,
-  createLogger,
-  err,
-  ok
-} from "./chunk-KPM6FF6T.js";
-
-// src/adapters/sdk/types.ts
-var PROVIDER_ENV_KEYS = {
-  anthropic: "ANTHROPIC_API_KEY",
-  openai: "OPENAI_API_KEY",
-  google: "GOOGLE_AI_API_KEY",
-  "custom-openai": "NEXUS_CUSTOM_API_KEY"
-};
-var CUSTOM_API_BASE_URL_ENV = "NEXUS_CUSTOM_API_BASE_URL";
-var CUSTOM_API_ALLOW_PRIVATE_ENV = "NEXUS_CUSTOM_API_ALLOW_PRIVATE";
-
-// src/adapters/sdk/custom-api-validation.ts
-import { isIPv4, isIPv6 } from "net";
-import { lookup as dnsLookup } from "dns/promises";
-var logger = createLogger({ module: "custom-api-validation" });
-function validateCustomApiBaseUrl(raw, opts = {}) {
-  if (raw === void 0 || raw.trim() === "") {
-    return err(
-      new ConfigError(
-        "Custom API base URL is required but missing. Set NEXUS_CUSTOM_API_BASE_URL or pass `baseUrl` in config."
-      )
-    );
-  }
-  let url;
-  try {
-    url = new URL(raw);
-  } catch {
-    return err(new ConfigError(`Custom API base URL is not a valid URL: ${raw}`));
-  }
-  if (url.protocol !== "http:" && url.protocol !== "https:") {
-    return err(
-      new ConfigError(`Custom API base URL must use http or https, got "${url.protocol}" in ${raw}`)
-    );
-  }
-  const allowPrivate = opts.allowPrivate === true || resolveAllowPrivateFromEnv();
-  if (!allowPrivate) {
-    const rejection = classifyPrivateHost(url.hostname);
-    if (rejection !== null) {
-      return err(
-        new ConfigError(
-          `Custom API base URL rejected (SSRF guard, reason="${rejection.reason}"): ${rejection.message}. Set ${CUSTOM_API_ALLOW_PRIVATE_ENV}=1 to bypass if the gateway runs on a trusted internal host.`
-        )
-      );
-    }
-  }
-  return ok(url);
-}
-function resolveAllowPrivateFromEnv() {
-  const v = process.env[CUSTOM_API_ALLOW_PRIVATE_ENV];
-  return v === "1" || v === "true";
-}
-function classifyPrivateHost(hostname) {
-  const normalized = normalizeHost(hostname);
-  const literal = classifyIpAddress(normalized);
-  if (literal !== "not_an_ip") {
-    return literal;
-  }
-  if (normalized === "localhost" || normalized.endsWith(".localhost") || normalized.endsWith(".local")) {
-    return {
-      reason: "loopback",
-      message: `hostname "${hostname}" resolves to loopback/mDNS`
-    };
-  }
-  return null;
-}
-function normalizeHost(hostname) {
-  const stripped = hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
-  return stripped.toLowerCase();
-}
-function classifyIpAddress(normalized) {
-  if (isIPv4(normalized)) {
-    return classifyIPv4(normalized);
-  }
-  if (isIPv6(normalized)) {
-    return classifyIPv6(normalized);
-  }
-  return "not_an_ip";
-}
-async function assertCustomApiHostResolvesPublic(hostname, opts = {}) {
-  const allowPrivate = opts.allowPrivate === true || resolveAllowPrivateFromEnv();
-  if (allowPrivate) {
-    return ok(void 0);
-  }
-  const normalized = normalizeHost(hostname);
-  if (isIPv4(normalized) || isIPv6(normalized)) {
-    return ok(void 0);
-  }
-  let addresses;
-  try {
-    addresses = await dnsLookup(hostname, { all: true });
-  } catch (error) {
-    logger.debug("custom-api SSRF resolve check: DNS lookup failed, skipping (fail-open)", {
-      hostname,
-      error: error instanceof Error ? error.message : String(error)
-    });
-    return ok(void 0);
-  }
-  const rejection = firstPrivateAddress(addresses);
-  if (rejection !== null) {
-    return err(
-      new ConfigError(
-        `Custom API base URL rejected (SSRF resolve guard, reason="${rejection.reason}"): hostname "${hostname}" resolved to ${rejection.message}. Set ${CUSTOM_API_ALLOW_PRIVATE_ENV}=1 to bypass if the gateway runs on a trusted internal host.`
-      )
-    );
-  }
-  return ok(void 0);
-}
-function firstPrivateAddress(addresses) {
-  for (const { address } of addresses) {
-    const rejection = classifyIpAddress(address.toLowerCase());
-    if (rejection !== null && rejection !== "not_an_ip") {
-      return rejection;
-    }
-  }
-  return null;
-}
-var IPV4_RULES = [
-  { match: (a) => a === 127, reason: "loopback", label: "IPv4 loopback" },
-  { match: (a) => a === 10, reason: "private_range", label: "IPv4 private (10/8)" },
-  {
-    match: (a, b) => a === 172 && b >= 16 && b <= 31,
-    reason: "private_range",
-    label: "IPv4 private (172.16/12)"
-  },
-  {
-    match: (a, b) => a === 192 && b === 168,
-    reason: "private_range",
-    label: "IPv4 private (192.168/16)"
-  },
-  {
-    match: (a, b) => a === 169 && b === 254,
-    reason: "link_local",
-    label: "IPv4 link-local (169.254/16 \u2014 AWS IMDS)"
-  },
-  { match: (a) => a === 0, reason: "reserved", label: "IPv4 reserved (0/8)" }
-];
-function classifyIPv4(ip) {
-  const parts = ip.split(".").map((p) => Number.parseInt(p, 10));
-  if (parts.length !== 4 || parts.some((n) => Number.isNaN(n))) return null;
-  const [a, b] = parts;
-  for (const rule of IPV4_RULES) {
-    if (rule.match(a, b)) {
-      return { reason: rule.reason, message: `${rule.label} (${ip})` };
-    }
-  }
-  return null;
-}
-function classifyIPv6(ip) {
-  const lower = ip.toLowerCase();
-  if (lower === "::1") return { reason: "loopback", message: `IPv6 loopback (${ip})` };
-  if (lower.startsWith("fe80:"))
-    return { reason: "link_local", message: `IPv6 link-local (${ip})` };
-  if (/^fc|^fd/.test(lower)) {
-    return { reason: "private_range", message: `IPv6 unique-local (${ip}, fc00::/7)` };
-  }
-  return null;
-}
+  createGetToolRateLimit
+} from "./chunk-YAJ4XUD2.js";
 
 // src/config/defaults.ts
-var CUSTOM_API_DEFAULT_MODEL = "gpt-4o";
+var CUSTOM_API_DEFAULT_MODEL = "gpt-5.5";
 var DEFAULTS = {
   /**
    * Default timeout settings in milliseconds.
@@ -388,12 +227,7 @@ var getToolRateLimit = createGetToolRateLimit(DEFAULTS.TOOL_RATE_LIMITS);
 var getEnvVarDocumentation = createGetEnvVarDocumentation(DEFAULTS);
 
 export {
-  PROVIDER_ENV_KEYS,
-  CUSTOM_API_BASE_URL_ENV,
-  CUSTOM_API_ALLOW_PRIVATE_ENV,
-  validateCustomApiBaseUrl,
-  assertCustomApiHostResolvesPublic,
   CUSTOM_API_DEFAULT_MODEL,
   DEFAULTS
 };
-//# sourceMappingURL=chunk-3XTGA2YK.js.map
+//# sourceMappingURL=chunk-4OZPWLKY.js.map

package/dist/chunk-4OZPWLKY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/config/defaults.ts"],"sourcesContent":["/**\n * Central Configuration Defaults\n *\n * Consolidates common default values used across the codebase.\n * This prevents scattered magic numbers and ensures consistency.\n *\n * Usage:\n *   import { DEFAULTS, getTimeout, TIMEOUT_PROFILES } from '../config/defaults.js';\n *   const timeout = options.timeout ?? DEFAULTS.TIMEOUT_DEFAULTS.cliMs;\n *   const cliTimeout = getTimeoutForCli('claude', 'complex');\n *\n * Environment overrides can be added via NEXUS_* environment variables.\n *\n * @module config/defaults\n * (Source: Central config consolidation initiative)\n */\n\n// Re-export types from defaults-types\nexport type {\n  TaskComplexity,\n  TimeoutProfile,\n  KnownCliName,\n  TimeoutDefaults,\n  RateLimitDefaults,\n  ToolRateLimitConfig,\n  RetryDefaults,\n  CircuitBreakerDefaults,\n} from './defaults-types.js';\n\nexport { isTaskComplexity, isKnownCliName } from './defaults-types.js';\n\n// Re-export timeout profiles (delegates to config/timeouts.ts)\nexport {\n  TIMEOUT_PROFILES,\n  getTimeoutProfile,\n  getTimeoutForCli,\n} from './defaults-timeout-profiles.js';\n\n// Re-export canonical timeout modules (Issue #984)\nexport {\n  CLI_TIMEOUTS,\n  VOTE_TIMEOUTS,\n  MCP_TIMEOUTS,\n  WORKFLOW_TIMEOUTS,\n  GRAPH_TIMEOUTS,\n  PER_CLI_TASK_TIMEOUTS,\n  API_TIMEOUTS,\n  INTERNAL_TIMEOUTS,\n  TEST_TIMEOUTS,\n  TIMEOUT_ENV_VARS,\n  getCliTimeoutProfile,\n  getCliTimeout,\n  resolveVoteTimeout,\n  resolveEnvTimeout,\n  validateTimeout,\n  BACKOFF_CONFIG,\n  AGENT_ROUTER_TIMEOUTS,\n  CODEX_MCP_TIMEOUTS,\n} from './timeouts.js';\n\n// Re-export env helpers (internal use)\nexport { parseIntEnv, parseFloatEnv, parseBoolEnv } from './defaults-env.js';\n\nimport {\n  createGetTimeout,\n  createGetRetryConfig,\n  createGetRateLimitConfig,\n  createGetCircuitBreakerConfig,\n  createGetToolRateLimit,\n  createGetEnvVarDocumentation,\n} from './defaults-env.js';\nimport {\n  API_TIMEOUTS as _API,\n  WORKFLOW_TIMEOUTS as _WF,\n  MCP_TIMEOUTS as _MCP,\n  INTERNAL_TIMEOUTS as _INT,\n  TEST_TIMEOUTS as _TEST,\n  CLI_TIMEOUTS as _CLI,\n} from './timeouts.js';\n\n// ============================================================================\n// Default Model IDs (#2200 Child 4)\n// ============================================================================\n\n/**\n * Default model identifier for the custom OpenAI-compatible API gateway.\n *\n * Used by both `cli/setup-custom-api.ts` (write to nexus-agents.yaml) and\n * `adapters/auto-adapter.ts` (NEXUS_CUSTOM_MODEL env-var fallback). Single\n * source of truth so changes flow through all consumers.\n *\n * `gpt-4o` was the previous value, chosen because it was widely supported across\n * OpenAI-compatible gateways. It is now END-OF-LIFE at OpenAI, so defaulting to\n * it points new operators at a model their gateway may well refuse (#4408).\n *\n * A custom gateway can serve anything, so ANY default here is a guess — the\n * right long-term answer is to discover the model list from the endpoint\n * (`GET /v1/models`, which this repo already implements) rather than assume one.\n * Until that is wired, guess a current model instead of a retired one.\n *\n * Operators are expected to override via `NEXUS_CUSTOM_MODEL`.\n */\nexport const CUSTOM_API_DEFAULT_MODEL = 'gpt-5.5';\n\n// ============================================================================\n// Central Defaults Object\n// ============================================================================\n\n/**\n * Central defaults object containing all configuration categories.\n */\nexport const DEFAULTS = {\n  /**\n   * Default timeout settings in milliseconds.\n   * Values sourced from config/timeouts.ts (Issue #984).\n   */\n  TIMEOUT_DEFAULTS: {\n    /** CLI tool execution timeout in milliseconds. */\n    cliMs: _CLI.default.standard,\n    // cliSimpleMs / cliComplexMs removed in #4180 — never read by any production\n    // code (the matching NEXUS_TIMEOUT_CLISIMPLE/CLICOMPLEX env vars were silent\n    // no-ops, #2977 class). Per-complexity CLI timeouts come from\n    // getTimeoutForCli/TIMEOUT_PROFILES (CLI_TIMEOUTS in config/timeouts.ts).\n    /** API request timeout in milliseconds. */\n    apiMs: _API.defaultMs,\n    /** Maximum API timeout in milliseconds. */\n    apiMaxMs: _API.maxMs,\n    /** Workflow-level timeout in milliseconds (5 minutes). */\n    workflowMs: _WF.workflowMs,\n    /** Maximum workflow timeout in milliseconds (30 minutes). */\n    workflowMaxMs: _WF.workflowMaxMs,\n    /** Step-level timeout in milliseconds. */\n    stepMs: _INT.selfEvalMs,\n    /** MCP operation default timeout in milliseconds (generic, not per-tool). */\n    mcpMs: _API.defaultMs,\n    /** MCP operation maximum timeout in milliseconds. */\n    mcpMaxMs: _MCP.maxMs,\n    /** Health check timeout in milliseconds. */\n    healthCheckMs: _INT.healthCheckMs,\n    /** Global test run timeout in milliseconds (10 minutes). */\n    testGlobalMs: _TEST.globalMs,\n    /** Per-task test timeout in milliseconds. */\n    testTaskMs: _TEST.taskMs,\n    /** Circuit breaker reset timeout in milliseconds. */\n    circuitBreakerResetMs: _INT.circuitBreakerResetMs,\n  },\n\n  /**\n   * Default rate limit settings for outbound operations.\n   */\n  RATE_LIMIT_DEFAULTS: {\n    /** Global requests per minute. */\n    requestsPerMinute: 60,\n    /** Whether rate limiting is enabled by default. */\n    enabled: true,\n    /** Maximum number of concurrent requests. */\n    maxConcurrent: 4,\n    /** Token bucket capacity. */\n    capacity: 100,\n    /** Token bucket refill rate per second. */\n    refillRate: 10,\n    /** Refill interval in milliseconds. */\n    refillIntervalMs: 100,\n  },\n\n  /**\n   * Per-tool rate limit defaults for MCP tools.\n   * (Source: Issue #274 Phase 2 - per-tool rate limits)\n   */\n  TOOL_RATE_LIMITS: {\n    orchestrate: { capacity: 10, refillRate: 10, refillIntervalMs: 60_000 },\n    delegate: { capacity: 20, refillRate: 20, refillIntervalMs: 60_000 },\n    workflow: { capacity: 5, refillRate: 5, refillIntervalMs: 60_000 },\n    expert: { capacity: 30, refillRate: 30, refillIntervalMs: 60_000 },\n  },\n\n  /**\n   * Default retry strategy settings for transient failures.\n   */\n  RETRY_DEFAULTS: {\n    /** Maximum retry attempts before failing. */\n    maxRetries: 3,\n    /** Base delay between retries in milliseconds. */\n    baseDelayMs: 1_000,\n    /** Maximum delay between retries in milliseconds. */\n    maxDelayMs: 30_000,\n    /** Jitter factor (0-1) to randomize retry delays. */\n    jitterFactor: 0.1,\n  },\n\n  /**\n   * Workflow-specific retry defaults.\n   */\n  WORKFLOW_RETRY_DEFAULTS: {\n    /** Maximum retry attempts for workflow steps. */\n    maxRetries: 2,\n    /** Base delay for workflow retries in milliseconds. */\n    baseDelayMs: 2_000,\n    /** Maximum delay for workflow retries in milliseconds. */\n    maxDelayMs: 60_000,\n    /** Jitter factor for workflow retries. */\n    jitterFactor: 0.15,\n  },\n\n  /**\n   * CLI-specific retry defaults.\n   */\n  CLI_RETRY_DEFAULTS: {\n    /** Maximum retry attempts for CLI operations. */\n    maxRetries: 2,\n    /** Base delay for CLI retries in milliseconds. */\n    baseDelayMs: 5_000,\n    /** Maximum delay for CLI retries in milliseconds. */\n    maxDelayMs: 60_000,\n    /** Jitter factor for CLI retries. */\n    jitterFactor: 0.2,\n  },\n\n  /**\n   * Test framework retry defaults.\n   */\n  TEST_RETRY_DEFAULTS: {\n    /** Maximum retries per test task. */\n    maxRetries: 2,\n    /** Whether to retry failed tasks by default. */\n    retryFailedTasks: true,\n  },\n\n  /**\n   * Default buffer sizing for batching and chunked processing.\n   */\n  BUFFER_DEFAULTS: {\n    /** Preferred batch size for bulk operations. */\n    batchSize: 100,\n    /** Chunk size for streaming or segmented processing. */\n    chunkSize: 256,\n    /** Maximum items allowed in a buffer. */\n    maxItems: 1_000,\n    /** Maximum memory size in bytes (10 MB). */\n    maxMemoryBytes: 10 * 1024 * 1024,\n    /** Log buffer flush interval in milliseconds. */\n    logFlushIntervalMs: 5_000,\n  },\n\n  // WORKER_DEFAULTS removed in #2977 — the eight settings under this category\n  // (maxWorkers, poolSize, idleTimeoutMs, workflowMaxParallel, testParallelism,\n  // evaluationMaxWorkers, eventBusMaxHistory, swarmObserverMaxEvents) had zero\n  // production consumers. `getWorkerConfig()` was never called from anywhere\n  // in src/, and the matching NEXUS_WORKERS_* env vars were silent no-ops.\n  // Silent config rot is worse than missing knobs; re-add when a concrete\n  // consumer exists.\n\n  /**\n   * Default circuit breaker settings.\n   * (Source: Issue #81 - Circuit breaker for CLI failures)\n   */\n  CIRCUIT_BREAKER_DEFAULTS: {\n    /** Failure threshold to open circuit. */\n    failureThreshold: 5,\n    /** Reset timeout in milliseconds. */\n    resetTimeoutMs: 30_000,\n    /** Success threshold to close circuit in half-open state. */\n    halfOpenSuccessThreshold: 2,\n    /** Whether to count timeouts as failures. */\n    countTimeoutsAsFailures: true,\n    /** Whether to count auth failures as failures. */\n    countAuthFailuresAsFailures: false,\n    /** Whether to count rate limit errors as failures (#1529). */\n    countRateLimitsAsFailures: true,\n    /** Maximum requests allowed in half-open state. */\n    halfOpenMaxRequests: 3,\n  },\n\n  /**\n   * Default context/memory settings.\n   */\n  CONTEXT_DEFAULTS: {\n    /** Maximum context tokens. */\n    maxTokens: 100_000,\n    /** Token budget warning threshold (80%). */\n    warningThreshold: 0.8,\n    /** Token budget critical threshold (95%). */\n    criticalThreshold: 0.95,\n    /** Maximum history entries to retain. */\n    maxHistoryEntries: 1_000,\n  },\n\n  /**\n   * Default provider/model settings.\n   */\n  PROVIDER_DEFAULTS: {\n    /** Default timeout for provider API calls in ms. */\n    timeout: 30_000,\n    /** Maximum retries for provider requests. */\n    maxRetries: 3,\n    /** Default model tier. */\n    defaultTier: 'balanced' as const,\n    /** Default temperature. */\n    temperatureDefault: 0.3,\n    /** Minimum temperature. */\n    temperatureMin: 0,\n    /** Maximum temperature. */\n    temperatureMax: 1,\n    /** Billing mode: 'plan' (monthly subscription) or 'api' (pay-per-token). Env: NEXUS_BILLING_MODE */\n    billingMode: 'plan' as const,\n  },\n\n  /**\n   * Security-related defaults.\n   */\n  SECURITY_DEFAULTS: {\n    /** Maximum system prompt length in characters. */\n    maxSystemPromptLength: 4_000,\n    /** Default policy execution mode. */\n    policyDefaultMode: 'read-only' as const,\n    /** Default policy mode. */\n    policyMode: 'enforce' as const,\n    /** Default sandbox mode. */\n    sandboxMode: 'policy' as const,\n    /** Whether to fall back to policy mode if container unavailable. */\n    sandboxFallbackToPolicy: true,\n    /** Whether network is enabled in container mode. */\n    sandboxNetworkEnabled: false,\n  },\n} as const;\n\n// ============================================================================\n// Type Exports for DEFAULTS\n// ============================================================================\n\n/** Type for the DEFAULTS object (readonly/const). */\nexport type DefaultsConfig = typeof DEFAULTS;\n\n/** Type for timeout defaults (readonly/const). */\nexport type TimeoutDefaultsConst = typeof DEFAULTS.TIMEOUT_DEFAULTS;\n\n/** Type for rate limit defaults (readonly/const). */\nexport type RateLimitDefaultsConst = typeof DEFAULTS.RATE_LIMIT_DEFAULTS;\n\n/** Type for retry defaults (readonly/const). */\nexport type RetryDefaultsConst = typeof DEFAULTS.RETRY_DEFAULTS;\n\n/** Type for buffer defaults (readonly/const). */\nexport type BufferDefaults = typeof DEFAULTS.BUFFER_DEFAULTS;\n\n/** Type for circuit breaker defaults (readonly/const). */\nexport type CircuitBreakerDefaultsConst = typeof DEFAULTS.CIRCUIT_BREAKER_DEFAULTS;\n\n/** Type for context defaults (readonly/const). */\nexport type ContextDefaults = typeof DEFAULTS.CONTEXT_DEFAULTS;\n\n/** Type for provider defaults (readonly/const). */\nexport type ProviderDefaults = typeof DEFAULTS.PROVIDER_DEFAULTS;\n\n/** Type for security defaults (readonly/const). */\nexport type SecurityDefaults = typeof DEFAULTS.SECURITY_DEFAULTS;\n\n// ============================================================================\n// Environment Override Functions (bound to DEFAULTS)\n// ============================================================================\n\n/**\n * Get timeout with environment override support.\n *\n * @param key - Timeout key (e.g., 'cliMs', 'apiMs')\n * @returns Timeout value in milliseconds\n */\nexport const getTimeout = createGetTimeout(DEFAULTS.TIMEOUT_DEFAULTS);\n\n/**\n * Get retry config with environment override support.\n *\n * @returns Retry configuration\n */\nexport const getRetryConfig = createGetRetryConfig(DEFAULTS.RETRY_DEFAULTS);\n\n/**\n * Get rate limit config with environment override support.\n *\n * @returns Rate limit configuration\n */\nexport const getRateLimitConfig = createGetRateLimitConfig(DEFAULTS.RATE_LIMIT_DEFAULTS);\n\n/**\n * Gets the circuit breaker configuration.\n *\n * @returns Circuit breaker configuration\n */\nexport const getCircuitBreakerConfig = createGetCircuitBreakerConfig(\n  DEFAULTS.CIRCUIT_BREAKER_DEFAULTS\n);\n\n/**\n * Gets the tool rate limit configuration for a specific tool category.\n *\n * @param tool - Tool category (orchestrate, delegate, workflow, expert)\n * @returns Rate limit configuration\n */\nexport const getToolRateLimit = createGetToolRateLimit(DEFAULTS.TOOL_RATE_LIMITS);\n\n// ============================================================================\n// Documentation Helper\n// ============================================================================\n\n/**\n * Returns documentation for all environment variable overrides.\n *\n * @returns Markdown documentation string\n */\nexport const getEnvVarDocumentation = createGetEnvVarDocumentation(DEFAULTS);\n"],"mappings":";;;;;;;;;;;;;;;;AAsGO,IAAM,2BAA2B;AASjC,IAAM,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA,EAKtB,kBAAkB;AAAA;AAAA,IAEhB,OAAO,aAAK,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMpB,OAAO,aAAK;AAAA;AAAA,IAEZ,UAAU,aAAK;AAAA;AAAA,IAEf,YAAY,kBAAI;AAAA;AAAA,IAEhB,eAAe,kBAAI;AAAA;AAAA,IAEnB,QAAQ,kBAAK;AAAA;AAAA,IAEb,OAAO,aAAK;AAAA;AAAA,IAEZ,UAAU,aAAK;AAAA;AAAA,IAEf,eAAe,kBAAK;AAAA;AAAA,IAEpB,cAAc,cAAM;AAAA;AAAA,IAEpB,YAAY,cAAM;AAAA;AAAA,IAElB,uBAAuB,kBAAK;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA,EAKA,qBAAqB;AAAA;AAAA,IAEnB,mBAAmB;AAAA;AAAA,IAEnB,SAAS;AAAA;AAAA,IAET,eAAe;AAAA;AAAA,IAEf,UAAU;AAAA;AAAA,IAEV,YAAY;AAAA;AAAA,IAEZ,kBAAkB;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,kBAAkB;AAAA,IAChB,aAAa,EAAE,UAAU,IAAI,YAAY,IAAI,kBAAkB,IAAO;AAAA,IACtE,UAAU,EAAE,UAAU,IAAI,YAAY,IAAI,kBAAkB,IAAO;AAAA,IACnE,UAAU,EAAE,UAAU,GAAG,YAAY,GAAG,kBAAkB,IAAO;AAAA,IACjE,QAAQ,EAAE,UAAU,IAAI,YAAY,IAAI,kBAAkB,IAAO;AAAA,EACnE;AAAA;AAAA;AAAA;AAAA,EAKA,gBAAgB;AAAA;AAAA,IAEd,YAAY;AAAA;AAAA,IAEZ,aAAa;AAAA;AAAA,IAEb,YAAY;AAAA;AAAA,IAEZ,cAAc;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA,EAKA,yBAAyB;AAAA;AAAA,IAEvB,YAAY;AAAA;AAAA,IAEZ,aAAa;AAAA;AAAA,IAEb,YAAY;AAAA;AAAA,IAEZ,cAAc;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA,EAKA,oBAAoB;AAAA;AAAA,IAElB,YAAY;AAAA;AAAA,IAEZ,aAAa;AAAA;AAAA,IAEb,YAAY;AAAA;AAAA,IAEZ,cAAc;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA,EAKA,qBAAqB;AAAA;AAAA,IAEnB,YAAY;AAAA;AAAA,IAEZ,kBAAkB;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA,EAKA,iBAAiB;AAAA;AAAA,IAEf,WAAW;AAAA;AAAA,IAEX,WAAW;AAAA;AAAA,IAEX,UAAU;AAAA;AAAA,IAEV,gBAAgB,KAAK,OAAO;AAAA;AAAA,IAE5B,oBAAoB;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,0BAA0B;AAAA;AAAA,IAExB,kBAAkB;AAAA;AAAA,IAElB,gBAAgB;AAAA;AAAA,IAEhB,0BAA0B;AAAA;AAAA,IAE1B,yBAAyB;AAAA;AAAA,IAEzB,6BAA6B;AAAA;AAAA,IAE7B,2BAA2B;AAAA;AAAA,IAE3B,qBAAqB;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAKA,kBAAkB;AAAA;AAAA,IAEhB,WAAW;AAAA;AAAA,IAEX,kBAAkB;AAAA;AAAA,IAElB,mBAAmB;AAAA;AAAA,IAEnB,mBAAmB;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA,EAKA,mBAAmB;AAAA;AAAA,IAEjB,SAAS;AAAA;AAAA,IAET,YAAY;AAAA;AAAA,IAEZ,aAAa;AAAA;AAAA,IAEb,oBAAoB;AAAA;AAAA,IAEpB,gBAAgB;AAAA;AAAA,IAEhB,gBAAgB;AAAA;AAAA,IAEhB,aAAa;AAAA,EACf;AAAA;AAAA;AAAA;AAAA,EAKA,mBAAmB;AAAA;AAAA,IAEjB,uBAAuB;AAAA;AAAA,IAEvB,mBAAmB;AAAA;AAAA,IAEnB,YAAY;AAAA;AAAA,IAEZ,aAAa;AAAA;AAAA,IAEb,yBAAyB;AAAA;AAAA,IAEzB,uBAAuB;AAAA,EACzB;AACF;AA2CO,IAAM,aAAa,iBAAiB,SAAS,gBAAgB;AAO7D,IAAM,iBAAiB,qBAAqB,SAAS,cAAc;AAOnE,IAAM,qBAAqB,yBAAyB,SAAS,mBAAmB;AAOhF,IAAM,0BAA0B;AAAA,EACrC,SAAS;AACX;AAQO,IAAM,mBAAmB,uBAAuB,SAAS,gBAAgB;AAWzE,IAAM,yBAAyB,6BAA6B,QAAQ;","names":[]}

package/dist/{chunk-WJKHJSU2.js → chunk-5Y4RWZ3M.js}

@@ -3,7 +3,7 @@ import {
   MODEL_IDS,
   getTimeProvider,
   resolveModelIdentitySync
-} from "./chunk-KPM6FF6T.js";
+} from "./chunk-YAJ4XUD2.js";
 
 // src/config/model-availability.ts
 var DEFAULT_TTL_MS = 6e4;
@@ -150,4 +150,4 @@ export {
   resetAvailabilityCache,
   filterAvailableModels
 };
-//# sourceMappingURL=chunk-WJKHJSU2.js.map
+//# sourceMappingURL=chunk-5Y4RWZ3M.js.map

package/dist/{chunk-LRGCUZZX.js → chunk-67CGSBQW.js}

@@ -1,6 +1,6 @@
 import {
   getTimeProvider
-} from "./chunk-KPM6FF6T.js";
+} from "./chunk-YAJ4XUD2.js";
 
 // src/security/audit-trail.ts
 var MAX_EVENTS = 1e4;
@@ -205,4 +205,4 @@ export {
   createGraphAuditBridge,
   createAuditTrail
 };
-//# sourceMappingURL=chunk-LRGCUZZX.js.map
+//# sourceMappingURL=chunk-67CGSBQW.js.map

package/dist/{chunk-OC3ABO5L.js → chunk-67ZQSIGP.js}

@@ -2,7 +2,7 @@ import {
   TASK_CATEGORIES,
   getAdaptiveBonus,
   getOutcomeStore
-} from "./chunk-KPM6FF6T.js";
+} from "./chunk-YAJ4XUD2.js";
 
 // src/cli/doctor-deep.ts
 var CLI_NAMES = ["claude", "gemini", "codex", "opencode"];
@@ -106,4 +106,4 @@ export {
   runDeepDiagnostics,
   formatDeepDiagnostics
 };
-//# sourceMappingURL=chunk-OC3ABO5L.js.map
+//# sourceMappingURL=chunk-67ZQSIGP.js.map

package/dist/{chunk-KS4EN2WR.js → chunk-AHJYZNQU.js}

@@ -8,7 +8,7 @@ import {
   getErrorMessage,
   ok,
   parseBoolEnv
-} from "./chunk-KPM6FF6T.js";
+} from "./chunk-YAJ4XUD2.js";
 
 // src/cli/research-helpers-io.ts
 import * as fs2 from "fs/promises";
@@ -146,4 +146,4 @@ export {
   loadPapersRegistry,
   savePapersRegistry
 };
-//# sourceMappingURL=chunk-KS4EN2WR.js.map
+//# sourceMappingURL=chunk-AHJYZNQU.js.map

package/dist/{chunk-TWAUWJET.js → chunk-C7TM6GM7.js}

@@ -1,7 +1,7 @@
 import {
   getRandomProvider,
   getTimeProvider
-} from "./chunk-KPM6FF6T.js";
+} from "./chunk-YAJ4XUD2.js";
 
 // src/utils/id-utils.ts
 import { randomUUID } from "crypto";
@@ -24,4 +24,4 @@ export {
   generateHyphenId,
   generateUUID
 };
-//# sourceMappingURL=chunk-TWAUWJET.js.map
+//# sourceMappingURL=chunk-C7TM6GM7.js.map

package/dist/{chunk-BS43TZVD.js → chunk-CFZGSZEX.js}

@@ -1,9 +1,9 @@
 import {
   getDefaultRegistry
-} from "./chunk-KPM6FF6T.js";
+} from "./chunk-YAJ4XUD2.js";
 import {
   getNexusDataDir
-} from "./chunk-DHVMSIT5.js";
+} from "./chunk-OQLFRJCW.js";
 
 // src/learning/usage-log.ts
 import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync } from "fs";
@@ -124,4 +124,4 @@ export {
   loadUsageEvents,
   rollupByModel
 };
-//# sourceMappingURL=chunk-BS43TZVD.js.map
+//# sourceMappingURL=chunk-CFZGSZEX.js.map

package/dist/{chunk-G456TOMJ.js → chunk-CXF5KR7V.js}

@@ -1,14 +1,17 @@
 import {
   computeCostDetail,
   recordUsageEvent
-} from "./chunk-BS43TZVD.js";
+} from "./chunk-CFZGSZEX.js";
 import {
   BaseAdapter,
   createStream,
   planOptionalParams,
   requireApiKey,
   validateApiKeyPresence
-} from "./chunk-MJXTFQH6.js";
+} from "./chunk-TYLCYSUQ.js";
+import {
+  assertCustomApiHostResolvesPublic
+} from "./chunk-LZ2ATWVV.js";
 import {
   ConfigError,
   ModelCapability,
@@ -19,7 +22,7 @@ import {
   getTimeProvider,
   getTokenEstimator,
   ok
-} from "./chunk-KPM6FF6T.js";
+} from "./chunk-YAJ4XUD2.js";
 
 // src/adapters/openai-types.ts
 var OPENAI_MODELS = {
@@ -701,10 +704,37 @@ function readGatewayFromOpencode() {
   if (fromFile === null) return null;
   return { baseUrl: fromFile.baseURL, apiKey: fromFile.apiKey };
 }
+var MAX_DISCOVERED_MODELS = 256;
+var MODEL_DISCOVERY_TIMEOUT_MS = 1e4;
+function hostnameOf(baseUrl) {
+  try {
+    return new URL(baseUrl).hostname;
+  } catch {
+    return baseUrl;
+  }
+}
 async function discoverModels(config) {
+  const hostCheck = await assertCustomApiHostResolvesPublic(hostnameOf(config.baseUrl));
+  if (!hostCheck.ok) {
+    return err(new ConfigError(`Gateway URL rejected: ${hostCheck.error.message}`));
+  }
   try {
-    const client = new OpenAI2({ baseURL: config.baseUrl, apiKey: config.apiKey });
+    const client = new OpenAI2({
+      baseURL: config.baseUrl,
+      apiKey: config.apiKey,
+      // Discovery runs during server bootstrap, so an unresponsive gateway must
+      // not stall startup indefinitely. The SDK's own default is far longer.
+      timeout: MODEL_DISCOVERY_TIMEOUT_MS,
+      maxRetries: 1
+    });
     const list = await client.models.list();
+    if (list.data.length > MAX_DISCOVERED_MODELS) {
+      return err(
+        new ConfigError(
+          `Gateway ${config.baseUrl} listed ${String(list.data.length)} models, above the ${String(MAX_DISCOVERED_MODELS)} cap. Refusing to build an adapter per model.`
+        )
+      );
+    }
     const models = list.data.map((m) => ({
       id: m.id,
       created: m.created,
@@ -795,4 +825,4 @@ export {
   discoverModels,
   buildOpenAICompatAdapters
 };
-//# sourceMappingURL=chunk-G456TOMJ.js.map
+//# sourceMappingURL=chunk-CXF5KR7V.js.map