nexus-agents 2.174.2 → 2.176.0

package/dist/{chunk-JVBI4WKP.js → chunk-WT4BJODZ.js}

@@ -1,17 +1,17 @@
 import {
   computeCostDetail,
   recordUsageEvent
-} from "./chunk-H5KLPUAL.js";
+} from "./chunk-4S6S6S2S.js";
 import {
   BaseAdapter,
   createStream,
   planOptionalParams,
   requireApiKey,
   validateApiKeyPresence
-} from "./chunk-6RRAQFSX.js";
+} from "./chunk-QI5U2YUL.js";
 import {
   assertCustomApiHostResolvesPublic
-} from "./chunk-OM2VVQKB.js";
+} from "./chunk-ECBV4JNL.js";
 import {
   ConfigError,
   ModelCapability,
@@ -22,7 +22,7 @@ import {
   getTimeProvider,
   getTokenEstimator,
   ok
-} from "./chunk-Y5JA7XEO.js";
+} from "./chunk-CNHPSIHY.js";
 
 // src/adapters/openai-types.ts
 var OPENAI_MODELS = {
@@ -825,4 +825,4 @@ export {
   discoverModels,
   buildOpenAICompatAdapters
 };
-//# sourceMappingURL=chunk-JVBI4WKP.js.map
+//# sourceMappingURL=chunk-WT4BJODZ.js.map

package/dist/{chunk-5QVJCBM4.js → chunk-XAWRBQB7.js}

@@ -1,6 +1,6 @@
 import {
   emitClawGuardViolation
-} from "./chunk-VSETLO4Q.js";
+} from "./chunk-G42V4A5Q.js";
 import {
   CACHE_TIMEOUTS,
   MCP_TIMEOUTS,
@@ -16,10 +16,10 @@ import {
   getTimeProvider,
   ok,
   resolveToolClassGuardMs
-} from "./chunk-Y5JA7XEO.js";
+} from "./chunk-CNHPSIHY.js";
 import {
   getNexusDataDir
-} from "./chunk-DHVMSIT5.js";
+} from "./chunk-OQLFRJCW.js";
 
 // src/mcp/middleware/validation.ts
 function validateToolInput(schema, args) {
@@ -2023,4 +2023,4 @@ export {
   VOTING_THRESHOLDS,
   ConsensusMetricsSchema
 };
-//# sourceMappingURL=chunk-5QVJCBM4.js.map
+//# sourceMappingURL=chunk-XAWRBQB7.js.map

package/dist/{chunk-KYF4YAZO.js → chunk-XES5DPHV.js}

@@ -7,7 +7,7 @@ import {
   toolStructuredError,
   toolSuccessStructured,
   wrapToolWithTimeout
-} from "./chunk-5QVJCBM4.js";
+} from "./chunk-XAWRBQB7.js";
 import {
   JsonlStore,
   SECURITY_KEYWORDS,
@@ -19,11 +19,11 @@ import {
   getPipelineEventBus,
   getTimeProvider,
   isDeclaredNeverDeprecate
-} from "./chunk-Y5JA7XEO.js";
+} from "./chunk-CNHPSIHY.js";
 import {
   getNexusDataDir,
   nexusDataPath
-} from "./chunk-DHVMSIT5.js";
+} from "./chunk-OQLFRJCW.js";
 
 // src/mcp/tools/improvement-review.ts
 import { execFile as execFile2 } from "child_process";
@@ -2132,4 +2132,4 @@ export {
   runImprovementReview,
   registerImprovementReviewTool
 };
-//# sourceMappingURL=chunk-KYF4YAZO.js.map
+//# sourceMappingURL=chunk-XES5DPHV.js.map

package/dist/{chunk-KU2HPCJG.js → chunk-XZJU6WLL.js}

@@ -1,14 +1,14 @@
 import {
   GitHubProvider,
   ScmError
-} from "./chunk-E35RUETV.js";
+} from "./chunk-2DE5L734.js";
 import {
   resolveToken
-} from "./chunk-HUYP2XXH.js";
+} from "./chunk-JRKF4FYO.js";
 import {
   err,
   ok
-} from "./chunk-Y5JA7XEO.js";
+} from "./chunk-CNHPSIHY.js";
 
 // src/scm/factory.ts
 async function createScmProvider(config) {
@@ -41,4 +41,4 @@ export {
   createScmProvider,
   createGitHubProvider
 };
-//# sourceMappingURL=chunk-KU2HPCJG.js.map
+//# sourceMappingURL=chunk-XZJU6WLL.js.map

package/dist/chunk-YAF73ZMR.js

@@ -0,0 +1,38 @@
+import {
+  nexusDataPathEnsure
+} from "./chunk-OQLFRJCW.js";
+
+// src/config/nexus-tmp-dir.ts
+import { mkdirSync, mkdtempSync } from "fs";
+import { mkdtemp } from "fs/promises";
+import { tmpdir } from "os";
+import { join, resolve } from "path";
+function getNexusTmpDir() {
+  const fromEnv = process.env["NEXUS_TMPDIR"]?.trim();
+  if (fromEnv !== void 0 && fromEnv !== "") {
+    const dir = resolve(fromEnv);
+    try {
+      mkdirSync(dir, { recursive: true });
+      return dir;
+    } catch {
+      return tmpdir();
+    }
+  }
+  try {
+    return nexusDataPathEnsure("tmp");
+  } catch {
+    return tmpdir();
+  }
+}
+function nexusMkdtempSync(prefix) {
+  return mkdtempSync(join(getNexusTmpDir(), prefix));
+}
+async function nexusMkdtemp(prefix) {
+  return mkdtemp(join(getNexusTmpDir(), prefix));
+}
+
+export {
+  nexusMkdtempSync,
+  nexusMkdtemp
+};
+//# sourceMappingURL=chunk-YAF73ZMR.js.map

package/dist/chunk-YAF73ZMR.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/config/nexus-tmp-dir.ts"],"sourcesContent":["/**\n * Repo-scoped scratch directory (#4412).\n *\n * Short-lived working files — throwaway git worktrees, system-prompt files,\n * generated MCP configs — used to be built directly into `os.tmpdir()`. That\n * is a shared space with no owner and no budget: anything else on the machine\n * can fill it, and when it fills, the failure surfaces as unrelated nonsense.\n * On this repo it manifested as ~1,100 test files failing to *collect* with\n * zero assertion failures, which reads like a code fault and is not one.\n *\n * Scratch now lands under the data dir we already own and already gitignore,\n * in its own `tmp/` subdir so it can be reaped without touching sessions,\n * traces, or the audit chain. Resolution order:\n *\n * 1. `NEXUS_TMPDIR` — explicit operator override, wins outright.\n * 2. `<dataDir>/tmp` via {@link nexusDataPathEnsure} — inherits the existing\n *    per-repo / sandbox / writability logic rather than re-deriving it.\n * 3. `os.tmpdir()` — fail-open when neither can be created.\n *\n * Step 3 is deliberate. Scratch space is a convenience, not an invariant: a\n * read-only checkout should degrade to `/tmp`, not take down every adapter\n * that needs to write a prompt file.\n *\n * @module config/nexus-tmp-dir\n */\n\nimport { mkdirSync, mkdtempSync } from 'node:fs';\nimport { mkdtemp } from 'node:fs/promises';\nimport { tmpdir } from 'node:os';\nimport { join, resolve } from 'node:path';\nimport { nexusDataPathEnsure } from './nexus-data-dir.js';\n\n/**\n * Returns an existing directory suitable for short-lived working files.\n *\n * Always returns a path that exists — callers may `mkdtemp` into it directly\n * without a preceding `mkdirSync`.\n */\nexport function getNexusTmpDir(): string {\n  const fromEnv = process.env['NEXUS_TMPDIR']?.trim();\n  if (fromEnv !== undefined && fromEnv !== '') {\n    const dir = resolve(fromEnv);\n    try {\n      mkdirSync(dir, { recursive: true });\n      return dir;\n    } catch {\n      // An override that cannot be created is an operator mistake, but not a\n      // reason to fail the caller's actual work. Fall through.\n      return tmpdir();\n    }\n  }\n\n  try {\n    return nexusDataPathEnsure('tmp');\n  } catch {\n    return tmpdir();\n  }\n}\n\n/**\n * `fs.mkdtempSync` against the scratch root.\n *\n * Keep the caller's prefix descriptive — it is the only thing that makes a\n * leaked directory attributable to the code that made it.\n */\nexport function nexusMkdtempSync(prefix: string): string {\n  return mkdtempSync(join(getNexusTmpDir(), prefix));\n}\n\n/** Promise-returning counterpart to {@link nexusMkdtempSync}. */\nexport async function nexusMkdtemp(prefix: string): Promise<string> {\n  return mkdtemp(join(getNexusTmpDir(), prefix));\n}\n"],"mappings":";;;;;AA0BA,SAAS,WAAW,mBAAmB;AACvC,SAAS,eAAe;AACxB,SAAS,cAAc;AACvB,SAAS,MAAM,eAAe;AASvB,SAAS,iBAAyB;AACvC,QAAM,UAAU,QAAQ,IAAI,cAAc,GAAG,KAAK;AAClD,MAAI,YAAY,UAAa,YAAY,IAAI;AAC3C,UAAM,MAAM,QAAQ,OAAO;AAC3B,QAAI;AACF,gBAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AAClC,aAAO;AAAA,IACT,QAAQ;AAGN,aAAO,OAAO;AAAA,IAChB;AAAA,EACF;AAEA,MAAI;AACF,WAAO,oBAAoB,KAAK;AAAA,EAClC,QAAQ;AACN,WAAO,OAAO;AAAA,EAChB;AACF;AAQO,SAAS,iBAAiB,QAAwB;AACvD,SAAO,YAAY,KAAK,eAAe,GAAG,MAAM,CAAC;AACnD;AAGA,eAAsB,aAAa,QAAiC;AAClE,SAAO,QAAQ,KAAK,eAAe,GAAG,MAAM,CAAC;AAC/C;","names":[]}

package/dist/{chunk-SGIWJYLJ.js → chunk-YB4QE7MD.js}

@@ -1,7 +1,7 @@
 import {
   getRandomProvider,
   getTimeProvider
-} from "./chunk-Y5JA7XEO.js";
+} from "./chunk-CNHPSIHY.js";
 
 // src/utils/id-utils.ts
 import { randomUUID } from "crypto";
@@ -24,4 +24,4 @@ export {
   generateHyphenId,
   generateUUID
 };
-//# sourceMappingURL=chunk-SGIWJYLJ.js.map
+//# sourceMappingURL=chunk-YB4QE7MD.js.map

package/dist/{chunk-KAL22DYO.js → chunk-YU2JCUM7.js}

@@ -2,7 +2,7 @@ import {
   CACHE_TIMEOUTS,
   createLogger,
   getTimeProvider
-} from "./chunk-Y5JA7XEO.js";
+} from "./chunk-CNHPSIHY.js";
 
 // src/security/trust-types.ts
 import { z } from "zod";
@@ -560,4 +560,4 @@ export {
   resolveReputationGatingMode,
   gateWithReputation
 };
-//# sourceMappingURL=chunk-KAL22DYO.js.map
+//# sourceMappingURL=chunk-YU2JCUM7.js.map

package/dist/{chunk-4PTAG65V.js → chunk-Z55WHIRU.js}

@@ -1,6 +1,6 @@
 import {
   getErrorMessage
-} from "./chunk-Y5JA7XEO.js";
+} from "./chunk-CNHPSIHY.js";
 
 // src/cli/setup-config.ts
 import { copyFileSync, existsSync, mkdirSync, writeFileSync } from "fs";
@@ -77,4 +77,4 @@ function ensureBackup(outputPath) {
 export {
   runConfigInitSync
 };
-//# sourceMappingURL=chunk-4PTAG65V.js.map
+//# sourceMappingURL=chunk-Z55WHIRU.js.map

package/dist/{cli-circuit-breaker-EINPV2CX.js → cli-circuit-breaker-PJOQTGFZ.js}

@@ -3,10 +3,10 @@ import {
   createCliCircuitBreakerIntegration,
   getCliCircuitBreakerSnapshot,
   getDefaultCliCircuitBreakerRegistry
-} from "./chunk-Z77MIV3C.js";
-import "./chunk-Y5JA7XEO.js";
-import "./chunk-AXTD4TFK.js";
-import "./chunk-DHVMSIT5.js";
+} from "./chunk-5ALUADB6.js";
+import "./chunk-CNHPSIHY.js";
+import "./chunk-2HUC6NZN.js";
+import "./chunk-OQLFRJCW.js";
 import "./chunk-ZPWHCABL.js";
 export {
   CliCircuitBreakerIntegration,
@@ -14,4 +14,4 @@ export {
   getCliCircuitBreakerSnapshot,
   getDefaultCliCircuitBreakerRegistry
 };
-//# sourceMappingURL=cli-circuit-breaker-EINPV2CX.js.map
+//# sourceMappingURL=cli-circuit-breaker-PJOQTGFZ.js.map

package/dist/cli.js

@@ -13,13 +13,13 @@ import {
   generateSummary,
   parseFindings,
   sumFindings
-} from "./chunk-YE2XMU3T.js";
-import "./chunk-JSIX5L3C.js";
+} from "./chunk-5LTRHNOI.js";
+import "./chunk-7TXEBDRM.js";
 import {
   setupCommandAsync,
   verifyCommand
-} from "./chunk-ASJTVA7W.js";
-import "./chunk-4PTAG65V.js";
+} from "./chunk-H4LZLG3P.js";
+import "./chunk-Z55WHIRU.js";
 import {
   AuthHandler,
   DEFAULT_EXPERTS,
@@ -139,8 +139,8 @@ import {
   validateCommand,
   validateWorkflow,
   wrapInMarkdownFence
-} from "./chunk-2CB6QMRX.js";
-import "./chunk-UB6APBIY.js";
+} from "./chunk-AHXJCVMV.js";
+import "./chunk-J4BGV5VE.js";
 import "./chunk-HFOQKCD2.js";
 import "./chunk-YF35FKKD.js";
 import {
@@ -166,14 +166,14 @@ import {
   loadConfig,
   runDoctor,
   validateNexusEnv
-} from "./chunk-YUCJ7VSJ.js";
+} from "./chunk-APXGDZV4.js";
 import {
   buildOpenAICompatAdapters,
   readOpenAICompatEnv
-} from "./chunk-JVBI4WKP.js";
+} from "./chunk-WT4BJODZ.js";
 import {
   shutdownExpertBridge
-} from "./chunk-PN43VH6Z.js";
+} from "./chunk-G5URP3V7.js";
 import {
   ConsensusVoteInputSchema,
   DEFAULT_VOTE_TIMEOUT_MS,
@@ -183,25 +183,25 @@ import {
   executeVoting,
   mapOutcomeToDecision,
   registerConsensusVoteTool
-} from "./chunk-OCTNNEXT.js";
+} from "./chunk-4OPEUDHY.js";
 import {
   loadUsageEvents,
   rollupByModel
-} from "./chunk-H5KLPUAL.js";
+} from "./chunk-4S6S6S2S.js";
 import {
   synthesizeResearch
-} from "./chunk-3P7SMHBU.js";
+} from "./chunk-JGL5HYZL.js";
 import {
   classifyTrust,
   createFullGitHubProvider,
   evaluatePolicy,
   parsePRUrl
-} from "./chunk-KWKGX7LC.js";
-import "./chunk-E35RUETV.js";
+} from "./chunk-5YXHHEAG.js";
+import "./chunk-2DE5L734.js";
 import {
   ReputationCache,
   sanitizeInput
-} from "./chunk-KAL22DYO.js";
+} from "./chunk-YU2JCUM7.js";
 import {
   ImprovementReviewInputSchema,
   calculateFitnessScore,
@@ -215,15 +215,15 @@ import {
   registerImprovementReviewTool,
   runImprovementReview,
   scanForSecrets
-} from "./chunk-KYF4YAZO.js";
+} from "./chunk-XES5DPHV.js";
 import {
   createDefaultPolicyFirewall
-} from "./chunk-5QVJCBM4.js";
-import "./chunk-VSETLO4Q.js";
+} from "./chunk-XAWRBQB7.js";
+import "./chunk-G42V4A5Q.js";
 import {
   createUnifiedRegistry,
   getGlobalRegistry
-} from "./chunk-MRRKFMYJ.js";
+} from "./chunk-QQ3CUUBU.js";
 import {
   CodebaseIndexSchema,
   PaperStatusSchema,
@@ -249,27 +249,27 @@ import {
   loadSourcesRegistry,
   rankDiscoveredItems,
   saveSourcesRegistry
-} from "./chunk-OGR5Q6QO.js";
+} from "./chunk-CGD63GSC.js";
 import {
   resolveToken
-} from "./chunk-HUYP2XXH.js";
+} from "./chunk-JRKF4FYO.js";
 import {
   loadPapersRegistry,
   loadTechniquesRegistry,
   savePapersRegistry
-} from "./chunk-DJZGCMNU.js";
+} from "./chunk-46XEDJRB.js";
 import "./chunk-NUBSJGQZ.js";
 import {
   MemoryError,
   shutdownToolMemory
-} from "./chunk-EDWON3X5.js";
+} from "./chunk-NQU4LNN7.js";
 import {
   capitalize,
   capitalizeKebab
 } from "./chunk-6T3EPABN.js";
-import "./chunk-IVINLVGP.js";
+import "./chunk-U5CV76ZW.js";
 import "./chunk-YPNQPT2F.js";
-import "./chunk-PINS44XA.js";
+import "./chunk-DVKS77O5.js";
 import "./chunk-KSQSWEFH.js";
 import {
   NEXUS_SUBPROCESS_DEPTH_ENV,
@@ -278,16 +278,19 @@ import {
   isRecord,
   probeAllClis,
   readSubprocessDepth
-} from "./chunk-K6NXLBHG.js";
-import "./chunk-6RRAQFSX.js";
+} from "./chunk-N3XDPW64.js";
+import "./chunk-QI5U2YUL.js";
 import {
   DEFAULTS
-} from "./chunk-DGR27REV.js";
-import "./chunk-OM2VVQKB.js";
-import "./chunk-RAIFOYRM.js";
+} from "./chunk-WMV2CXBB.js";
+import "./chunk-ECBV4JNL.js";
+import {
+  nexusMkdtempSync
+} from "./chunk-YAF73ZMR.js";
+import "./chunk-J55NMZ7R.js";
 import "./chunk-QZUG667L.js";
-import "./chunk-SGIWJYLJ.js";
-import "./chunk-Z77MIV3C.js";
+import "./chunk-YB4QE7MD.js";
+import "./chunk-5ALUADB6.js";
 import {
   API_TIMEOUTS,
   AgentCapability,
@@ -361,8 +364,8 @@ import {
   validateTimeout,
   writeEmptyLine,
   writeLine
-} from "./chunk-Y5JA7XEO.js";
-import "./chunk-AXTD4TFK.js";
+} from "./chunk-CNHPSIHY.js";
+import "./chunk-2HUC6NZN.js";
 import {
   applyPortableMode,
   detectSandbox,
@@ -372,7 +375,7 @@ import {
   nexusSharedPath,
   sessionsDbPath,
   setActiveWorkspaceRoot
-} from "./chunk-DHVMSIT5.js";
+} from "./chunk-OQLFRJCW.js";
 import "./chunk-ZPWHCABL.js";
 
 // src/cli/cli-log-bootstrap.ts
@@ -4068,7 +4071,7 @@ ${file.patch}
         violations: policyResult.violations
       });
     }
-    const { formatReviewComment: formatReviewComment2 } = await import("./pr-reviewer-helpers-CZDMP5UJ.js");
+    const { formatReviewComment: formatReviewComment2 } = await import("./pr-reviewer-helpers-6EIUJPXS.js");
     const body = formatReviewComment2(result);
     const postResult = await provider.createReview(pr.prNumber, body, result.decision);
     if (!postResult.ok) {
@@ -17458,7 +17461,7 @@ function startImprovementReviewScheduler(options) {
   let running = false;
   const runOnce = async () => {
     try {
-      const { runImprovementReview: runImprovementReview2, ImprovementReviewInputSchema: ImprovementReviewInputSchema2 } = await import("./improvement-review-ZMUJQSX3.js");
+      const { runImprovementReview: runImprovementReview2, ImprovementReviewInputSchema: ImprovementReviewInputSchema2 } = await import("./improvement-review-PALAAG7V.js");
       const input = ImprovementReviewInputSchema2.parse({ fileIssues });
       const result = await runImprovementReview2(input, { logger: logger19 });
       logger19.info("Scheduled improvement_review complete", {
@@ -19512,7 +19515,7 @@ function adaptConfigToLibrary(config) {
 }
 function createBeliefPromoter() {
   return async (event) => {
-    const { getToolMemory } = await import("./tool-memory-FCEJMKEH.js");
+    const { getToolMemory } = await import("./tool-memory-5REJXBCB.js");
     const tm = getToolMemory();
     await tm.recordBelief(
       `skill:${event.name}`,
@@ -20688,7 +20691,7 @@ async function handleResearchCommand(args) {
   }
 }
 async function handleRegistryCommand(args) {
-  const { registryCommand, isValidRegistrySubcommand, formatRegistryUsage } = await import("./registry-command-5J6RJZMS.js");
+  const { registryCommand, isValidRegistrySubcommand, formatRegistryUsage } = await import("./registry-command-SVTX7FKB.js");
   const subcommand = args.subcommand;
   if (!isValidRegistrySubcommand(subcommand)) {
     process.stdout.write(`${formatRegistryUsage()}
@@ -20736,7 +20739,7 @@ async function handleVerifyCommand(args) {
 async function handleDoctorCommand(args) {
   const exitCode = await doctorCommand({ fix: args.options.fix });
   if (args.options.deep) {
-    const { runDeepDiagnostics: runDeepDiagnostics2, formatDeepDiagnostics: formatDeepDiagnostics2 } = await import("./doctor-deep-X2KP2G4M.js");
+    const { runDeepDiagnostics: runDeepDiagnostics2, formatDeepDiagnostics: formatDeepDiagnostics2 } = await import("./doctor-deep-6HCHHMRP.js");
     const diag = runDeepDiagnostics2();
     process.stdout.write(formatDeepDiagnostics2(diag) + "\n");
   }
@@ -20786,7 +20789,7 @@ async function runInitPortableFlow(args) {
   return cliExit(result.success ? EXIT_CODES.SUCCESS : EXIT_CODES.SERVER_START_FAILED);
 }
 async function runInitOpencodeFlow(args) {
-  const { runInitOpencode } = await import("./init-opencode-I5XSFY34.js");
+  const { runInitOpencode } = await import("./init-opencode-NUMHNVIF.js");
   const opencodePath = args.options.opencode;
   if (opencodePath === void 0 || opencodePath === "") {
     process.stderr.write("Error: --opencode requires a path argument.\n");
@@ -20812,7 +20815,7 @@ async function runInitOpencodeFlow(args) {
   return cliExit(EXIT_CODES.SUCCESS);
 }
 async function renderOpencodeValidate(opencodePath) {
-  const { runOpencodeValidate } = await import("./init-opencode-I5XSFY34.js");
+  const { runOpencodeValidate } = await import("./init-opencode-NUMHNVIF.js");
   const result = await runOpencodeValidate(opencodePath);
   if (!result.ok) {
     process.stderr.write(`init --opencode --validate: ${result.reason ?? "failed"}
@@ -20851,7 +20854,7 @@ async function handleSetupCommandAsync(args) {
   return cliExitFromStatus(exitCode);
 }
 async function runCustomApiSetup(args) {
-  const { configureCustomApi } = await import("./setup-custom-api-BZSHB2M5.js");
+  const { configureCustomApi } = await import("./setup-custom-api-WZPLTGRQ.js");
   const baseUrl = args.options.customApi;
   if (baseUrl === void 0) return EXIT_CODES.SERVER_START_FAILED;
   const input = {
@@ -23717,8 +23720,7 @@ import { createHash as createHash4 } from "crypto";
 
 // src/mcp/tools/codepr-orchestrator.ts
 import { createHash as createHash3 } from "crypto";
-import { mkdtempSync, mkdirSync as mkdirSync6, writeFileSync as writeFileSync8, rmSync as rmSync2, realpathSync as realpathSync2 } from "fs";
-import { tmpdir } from "os";
+import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync8, rmSync as rmSync2, realpathSync as realpathSync2 } from "fs";
 import { dirname as dirname11, join as join19 } from "path";
 import { execFileSync as execFileSync3 } from "child_process";
 import { z as z11 } from "zod";
@@ -24039,7 +24041,11 @@ function sha256(s) {
   return createHash3("sha256").update(s).digest("hex");
 }
 function git(cwd, args) {
-  return execFileSync3("git", [...args], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+  return execFileSync3("git", [...args], {
+    cwd,
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
 }
 function parseNumstat(numstat) {
   const files = [];
@@ -24097,7 +24103,11 @@ function precheckChanges(worktreeRoot, run, logger19) {
         filesTouched: 0,
         linesTouched: 0
       });
-      return denied("sensitive_path", `sensitive path (${cls.category}): ${change.relPath}`, recorded);
+      return denied(
+        "sensitive_path",
+        `sensitive path (${cls.category}): ${change.relPath}`,
+        recorded
+      );
     }
   }
   return void 0;
@@ -24168,7 +24178,7 @@ function runGuardsAndPlan(args, logger19) {
 function runInWorktree(run, logger19, options, handle) {
   const fault = options.faultInjector;
   const repoRoot = options.repoRoot ?? process.cwd();
-  handle.tempParent = realpathSync2(mkdtempSync(join19(tmpdir(), "codepr-orchestrator-")));
+  handle.tempParent = realpathSync2(nexusMkdtempSync("codepr-orchestrator-"));
   handle.worktreeRoot = join19(handle.tempParent, "wt");
   git(repoRoot, ["worktree", "add", "--detach", handle.worktreeRoot]);
   fault?.("after-worktree");