nexus-agents 2.28.0 → 2.29.1

package/dist/cli.js

@@ -1,44 +1,52 @@
 #!/usr/bin/env node
+import {
+  calculateConsensus,
+  countByCategory,
+  countBySeverity,
+  createFailedReview,
+  determineApproval,
+  determineDecision,
+  extractSummary,
+  formatReviewComment,
+  generateSummary,
+  parseFindings,
+  sumFindings
+} from "./chunk-6E3NMMEY.js";
+import "./chunk-XU3NADFE.js";
+import {
+  setupCommandAsync
+} from "./chunk-VKRMXD62.js";
+import "./chunk-3GXDN4AX.js";
 import {
   AuthHandler,
-  BUILT_IN_EXPERTS,
   CustomExpertDefinitionSchema,
   DEFAULTS,
   DEFAULT_EXPERTS,
   DEFAULT_SWE_BENCH_CONFIG,
-  DEFAULT_VOTE_TIMEOUT_MS,
   DEVELOPMENT_POLICY,
   ExpertFactory,
   FeedbackIntegration,
   MAX_SYSTEM_PROMPT_LENGTH,
-  MemoryError,
   Orchestrator,
   PuppeteerOrchestrator,
   READONLY_POLICY,
-  RestApiServer,
-  SwarmObserver2 as SwarmObserver,
-  THRESHOLD_MAP,
+  SwarmObserver,
   VALID_EXPERT_DOMAINS,
   VALID_EXPERT_TIERS,
-  VOTER_ROLES,
   ValidationDashboard,
   WorkflowDefinitionSchema,
   adaptRoutingConfig,
   addResearchPaper,
   analyzeTools,
-  classifyTrust,
-  collectRealVotes,
+  createAgentStages,
   createAnnotationsProxy,
   createAuditLogger,
   createCodeExpert,
-  createConsensusEngine,
   createDefaultDeps,
   createDefaultPolicyEngine,
-  createDefaultPolicyFirewall,
   createEventBusBridge,
   createExecutor,
   createFeedbackIntegration,
-  createFullGitHubProvider,
   createGatewayServerProxy,
   createHarnessExecutor,
   createLearnablePolicy,
@@ -48,12 +56,13 @@ import {
   createRuleBasedPolicy,
   createSecurityExpert,
   createSkillLibrary,
+  createTaskTracker,
   createTemplateRegistry,
   createTestingExpert,
   createToolObservabilityProxy,
   createToolRateLimiterFactory,
-  createUnifiedRegistry,
   defaultConfig,
+  detectBackend,
   discoverDeepMind,
   discoverGitHubRepos,
   discoverGoogleAI,
@@ -62,8 +71,8 @@ import {
   discoverOpenAlex,
   discoverPapersWithCode,
   discoverSemanticScholar,
-  evaluatePolicy3 as evaluatePolicy,
   findOverlaps,
+  flushPipelineMemory,
   formatOverlapResult,
   formatResearchIssueBody,
   formatStatusResult,
@@ -80,7 +89,6 @@ import {
   getDefaultTokenPath,
   getEventBusStats,
   getExpertRegistry,
-  getPipelineEventBus,
   getPipelinePluginRegistry,
   getResearchStatus,
   getSandboxMode,
@@ -97,16 +105,15 @@ import {
   loadAllExternalPacks,
   loadConfig,
   loadDataset,
-  loadTechniquesRegistry,
+  loadSourcesRegistry,
   loadWorkflowFile,
-  parsePRUrl,
   rankDiscoveredItems,
   readStoredToken,
-  registerConsensusVoteTool,
   registerCreateExpertTool,
   registerDelegateToModelTool,
   registerExecuteExpertTool,
   registerExecuteSpecTool,
+  registerExtractSymbolsTool,
   registerIssueTriageTool,
   registerListExpertsTool,
   registerListWorkflowsTool,
@@ -114,11 +121,13 @@ import {
   registerMemoryStatsTool,
   registerMemoryWriteTool,
   registerOrchestrateTool,
+  registerPipelineTool,
   registerPrompts,
   registerQueryTraceTool,
   registerRegistryImportTool,
   registerRepoAnalyzeTool,
   registerRepoSecurityPlanTool,
+  registerResearchAddSourceTool,
   registerResearchAddTool,
   registerResearchAnalyzeTool,
   registerResearchCatalogReviewTool,
@@ -128,58 +137,88 @@ import {
   registerResources,
   registerRunGraphWorkflowTool,
   registerRunWorkflowTool,
+  registerSearchCodebaseTool,
   registerTools,
   registerWeatherReportTool,
-  resolveToken,
   resolveV2Config,
   runBenchmarkInstances,
-  sanitizeInput,
+  runDevPipeline,
+  saveSourcesRegistry,
   setGlobalToolRateLimiterFactory,
-  shutdownToolMemory,
-  synthesizeResearch,
   validateArgs,
   validateCommand,
   validateNexusEnv,
-  validateTimeout,
   validateWorkflow,
   wrapInMarkdownFence
-} from "./chunk-QZEAD6AG.js";
+} from "./chunk-FZFZ77UJ.js";
 import {
-  setupCommandAsync
-} from "./chunk-YSDUVCCZ.js";
+  resolveToken
+} from "./chunk-7SKAKA4I.js";
+import {
+  CATEGORY_DISPLAY_NAMES,
+  DEFAULT_PR_REVIEW_CONFIG
+} from "./chunk-X2M7OF27.js";
+import {
+  DEFAULT_VOTE_TIMEOUT_MS,
+  THRESHOLD_MAP,
+  VOTER_ROLES,
+  collectRealVotes,
+  createConsensusEngine,
+  createDefaultPolicyFirewall,
+  createUnifiedRegistry,
+  registerConsensusVoteTool,
+  shutdownToolMemory,
+  validateTimeout
+} from "./chunk-CGWRJ4EM.js";
+import {
+  loadPapersRegistry,
+  loadTechniquesRegistry,
+  savePapersRegistry,
+  synthesizeResearch
+} from "./chunk-MRU6L7YJ.js";
+import {
+  classifyTrust,
+  createFullGitHubProvider,
+  evaluatePolicy,
+  parsePRUrl,
+  sanitizeInput
+} from "./chunk-IECE6DBS.js";
+import "./chunk-4HA5PAL7.js";
+import "./chunk-2UR7YN6T.js";
+import "./chunk-BC3M4VLP.js";
+import "./chunk-AP2FD37C.js";
+import "./chunk-BQ4YXGGQ.js";
+import "./chunk-ED6VQWNG.js";
+import {
+  BUILT_IN_EXPERTS
+} from "./chunk-OOIPRRPX.js";
 import {
   VERSION,
-  capitalize,
-  capitalizeKebab,
   closeServer,
   connectTransport,
-  createAllAdapters,
   createServer,
   doctorCommand,
-  getAvailableClis,
   initDataDirectories,
-  isRecord,
-  truncateSentence
-} from "./chunk-LKSTILEE.js";
-import "./chunk-UGNLR4NZ.js";
+  runDoctor
+} from "./chunk-3EVVQ32X.js";
+import "./chunk-SRECH7OQ.js";
 import {
-  calculateConsensus,
-  countByCategory,
-  countBySeverity,
-  createFailedReview,
-  determineApproval,
-  determineDecision,
-  extractSummary,
-  formatReviewComment,
-  generateSummary,
-  parseFindings,
-  sumFindings
-} from "./chunk-6E3NMMEY.js";
+  MemoryError
+} from "./chunk-FYJVXQHX.js";
 import {
-  CATEGORY_DISPLAY_NAMES,
-  DEFAULT_PR_REVIEW_CONFIG
-} from "./chunk-X2M7OF27.js";
-import "./chunk-E7EX2KQJ.js";
+  capitalize,
+  capitalizeKebab,
+  truncateSentence
+} from "./chunk-633WH2ML.js";
+import "./chunk-2UUUKVNR.js";
+import "./chunk-C2C5ONFR.js";
+import "./chunk-YSTJEMQX.js";
+import {
+  createAllAdapters,
+  getAvailableClis,
+  isRecord
+} from "./chunk-4AGPR6XZ.js";
+import "./chunk-LLGUX44Z.js";
 import {
   API_TIMEOUTS,
   AgentCapability,
@@ -224,6 +263,7 @@ import {
   getErrorMessage,
   getModelCapabilities,
   getOutcomeStore,
+  getPipelineEventBus,
   getRandomProvider,
   getTimeProvider,
   logger,
@@ -239,7 +279,8 @@ import {
   toError,
   writeEmptyLine,
   writeLine
-} from "./chunk-L2SHSW4T.js";
+} from "./chunk-ELIFTCYM.js";
+import "./chunk-CLYZ7FWP.js";
 import "./chunk-UP2VWCW5.js";
 
 // src/cli.ts
@@ -423,8 +464,8 @@ function resolveOutputPath(output2) {
   }
   return resolve(process.cwd(), DEFAULT_CONFIG_FILE);
 }
-function fileExists(path24) {
-  return existsSync(path24);
+function fileExists(path23) {
+  return existsSync(path23);
 }
 async function ensureDirectory(filePath) {
   const dir = dirname(filePath);
@@ -432,9 +473,9 @@ async function ensureDirectory(filePath) {
     await mkdir(dir, { recursive: true });
   }
 }
-async function writeConfigFile(path24) {
-  await ensureDirectory(path24);
-  await writeFile(path24, CONFIG_TEMPLATE, "utf-8");
+async function writeConfigFile(path23) {
+  await ensureDirectory(path23);
+  await writeFile(path23, CONFIG_TEMPLATE, "utf-8");
 }
 async function runConfigInit(options = {}) {
   const outputPath = resolveOutputPath(options.output);
@@ -993,14 +1034,14 @@ Hint: Ensure the file exists and the path is correct relative to ${cwd}`
     try {
       return JSON.parse(content);
     } catch (e) {
-      const msg = e instanceof Error ? e.message : String(e);
+      const msg = getErrorMessage(e);
       throw new Error(`Invalid JSON in input file "${inputArg}": ${msg}`);
     }
   }
   try {
     return JSON.parse(inputArg);
   } catch (e) {
-    const msg = e instanceof Error ? e.message : String(e);
+    const msg = getErrorMessage(e);
     throw new Error(
       `Invalid JSON input: ${msg}
 Hint: Provide a valid JSON string or path to a .json file.`
@@ -1403,14 +1444,14 @@ ${colors.dim}Session ended.${colors.reset}
     });
   });
   rl.prompt();
-  return new Promise((resolve12) => {
+  return new Promise((resolve14) => {
     rl.on("line", (line) => {
       void (async () => {
         try {
           const shouldExit = await processLine(line, session, logger17);
           if (shouldExit) {
             rl.close();
-            resolve12();
+            resolve14();
             return;
           }
         } catch (error) {
@@ -1422,7 +1463,7 @@ ${colors.dim}Session ended.${colors.reset}
       })();
     });
     rl.on("close", () => {
-      resolve12();
+      resolve14();
     });
   });
 }
@@ -2416,9 +2457,9 @@ async function evaluateDirectory(target, timeoutMs) {
   }
   const aggregator = createAggregator();
   const results = [];
-  for (const [path24, evaluations] of evaluationsByComponent) {
+  for (const [path23, evaluations] of evaluationsByComponent) {
     if (evaluations.length > 0) {
-      results.push(aggregator.aggregate(path24, evaluations));
+      results.push(aggregator.aggregate(path23, evaluations));
     }
   }
   const priority = { deprecate: 0, refactor: 1, review: 2, retain: 3 };
@@ -3930,27 +3971,27 @@ var CliAdapterAgent = class {
 };
 
 // src/cli/orchestrate-puppeteer.ts
-function loadPolicyParameters(path24, logger17) {
+function loadPolicyParameters(path23, logger17) {
   try {
-    if (fs2.existsSync(path24)) {
-      const content = fs2.readFileSync(path24, "utf-8");
+    if (fs2.existsSync(path23)) {
+      const content = fs2.readFileSync(path23, "utf-8");
       const params = JSON.parse(content);
-      logger17.info("Loaded policy parameters", { path: path24 });
+      logger17.info("Loaded policy parameters", { path: path23 });
       return params;
     }
   } catch (error) {
     const message = getErrorMessage(error);
-    logger17.warn("Failed to load policy parameters", { path: path24, error: message });
+    logger17.warn("Failed to load policy parameters", { path: path23, error: message });
   }
   return void 0;
 }
-function savePolicyParameters(path24, params, logger17) {
+function savePolicyParameters(path23, params, logger17) {
   try {
-    fs2.writeFileSync(path24, JSON.stringify(params, null, 2));
-    logger17.info("Saved policy parameters", { path: path24 });
+    fs2.writeFileSync(path23, JSON.stringify(params, null, 2));
+    logger17.info("Saved policy parameters", { path: path23 });
   } catch (error) {
     const message = getErrorMessage(error);
-    logger17.warn("Failed to save policy parameters", { path: path24, error: message });
+    logger17.warn("Failed to save policy parameters", { path: path23, error: message });
   }
 }
 function createAgentsFromAdapters(adapters) {
@@ -6754,15 +6795,7 @@ import * as yaml3 from "yaml";
 
 // src/research/research-schemas.ts
 import { z as z2 } from "zod";
-var ResearchTopicSchema = z2.enum([
-  "consensus",
-  "routing",
-  "memory",
-  "code-generation",
-  "cli-tools",
-  "orchestration",
-  "security"
-]);
+var ResearchTopicSchema = z2.string().min(1);
 var RESEARCH_TOPICS = [
   "consensus",
   "routing",
@@ -6770,16 +6803,26 @@ var RESEARCH_TOPICS = [
   "code-generation",
   "cli-tools",
   "orchestration",
-  "security"
+  "security",
+  "evaluation",
+  "safety",
+  "planning",
+  "tool-use",
+  "reasoning"
 ];
 var TOPIC_DESCRIPTIONS = {
-  consensus: "Multi-agent decision protocols",
-  routing: "Cost-efficient model routing",
-  memory: "Context and long-term memory",
-  "code-generation": "Self-improvement and skill learning",
-  "cli-tools": "External CLI integration",
-  orchestration: "Multi-agent coordination",
-  security: "Safety analysis and evaluation"
+  consensus: "Multi-agent decision protocols and voting",
+  routing: "Cost-efficient model routing and selection",
+  memory: "Context, long-term memory, and compression",
+  "code-generation": "Code generation, repair, and self-improvement",
+  "cli-tools": "External CLI integration and protocols",
+  orchestration: "Multi-agent coordination and workflows",
+  security: "Security analysis, prompt injection defense",
+  evaluation: "Benchmarks, metrics, and testing methodologies",
+  safety: "AI safety, alignment, and reward hacking",
+  planning: "Task planning, decomposition, and reasoning chains",
+  "tool-use": "Tool augmentation, function calling, and MCP",
+  reasoning: "Reasoning, self-reflection, and search strategies"
 };
 var TechniqueStatusSchema = z2.enum([
   "implemented",
@@ -6814,7 +6857,8 @@ var ResearchPaperSchema = z2.object({
   /** arXiv ID (e.g., '2501.06322') */
   arxiv_id: z2.string().optional(),
   /** URL to the paper */
-  url: z2.url().optional(),
+  // eslint-disable-next-line @typescript-eslint/no-deprecated -- z.url() fails at runtime despite being recommended
+  url: z2.string().url().optional(),
   /** Publication date (YYYY-MM format) */
   publication_date: z2.string().optional(),
   /** Publication venue */
@@ -6823,7 +6867,7 @@ var ResearchPaperSchema = z2.object({
    * Research topics (array).
    * First topic is considered primary for counting purposes.
    */
-  topics: z2.array(ResearchTopicSchema).optional().default([]),
+  topics: z2.array(z2.string()).optional().default([]),
   /** Tags for searching */
   tags: z2.array(z2.string()).optional().default([]),
   /** Date when the paper was reviewed (YYYY-MM-DD) */
@@ -6841,7 +6885,28 @@ var ResearchPaperSchema = z2.object({
   /** Related GitHub issues */
   related_issues: z2.array(z2.number().int().positive()).optional().default([]),
   /** Implementation status */
-  implementation_status: PaperStatusSchema.optional().default("not-started")
+  implementation_status: PaperStatusSchema.optional().default("not-started"),
+  // ── Quality Assessment (Issue #1571) ──────────────────────────
+  /** Citation count from Semantic Scholar (auto-fetched) */
+  citation_count: z2.number().nonnegative().optional(),
+  /** Venue quality tier: 3=top (NeurIPS/ICML/ICLR), 2=good, 1=workshop, 0=preprint */
+  venue_tier: z2.number().min(0).max(3).optional(),
+  /** Whether the paper links to a code repository */
+  has_code: z2.boolean().optional(),
+  /** Code repository URL (from Papers With Code or manual) */
+  code_url: z2.string().optional(),
+  /** Rigor assessment tags (factual, verifiable signals) */
+  rigor_tags: z2.array(
+    z2.enum(["has-code", "has-dataset", "has-baselines", "peer-reviewed", "single-model-eval"])
+  ).optional().default([]),
+  /** Composite quality score (0-10, auto-computed from signals) */
+  quality_score: z2.number().min(0).max(10).optional(),
+  /** Evidence confidence tier for extracted techniques */
+  evidence_tier: z2.enum(["high", "medium", "low"]).optional(),
+  /** Why this paper scored low — enables future re-review when conditions change */
+  quality_notes: z2.string().optional(),
+  /** When quality was last assessed (ISO date) — enables periodic re-review */
+  last_quality_check: z2.string().optional()
 });
 var IntegrationFileObjectSchema = z2.object({
   path: z2.string(),
@@ -6879,7 +6944,17 @@ var ResearchTechniqueSchema = z2.object({
   /** Dependent techniques */
   dependencies: z2.array(z2.string()).optional().default([]),
   /** Decision history */
-  decision_history: z2.array(DecisionHistoryEntrySchema).optional().default([])
+  decision_history: z2.array(DecisionHistoryEntrySchema).optional().default([]),
+  // ── Evaluation Plan (Issue #1576 Wave 6) ──────────────────────
+  /** Structured evaluation plan for keeping or removing the technique */
+  evaluation_plan: z2.object({
+    success_criteria: z2.string().optional(),
+    evaluation_method: z2.string().optional(),
+    evaluation_deadline: z2.string().optional(),
+    removal_criteria: z2.string().optional()
+  }).optional(),
+  /** Evaluation status: pending (not yet evaluated), passed, failed, deferred */
+  evaluation_status: z2.enum(["pending", "passed", "failed", "deferred"]).optional()
 });
 var PapersRegistrySchema = z2.object({
   schema_version: z2.string(),
@@ -6976,7 +7051,7 @@ function generateTopicsTable(stats) {
     const topicDisplay = capitalizeKebab(ts.topic);
     const topicLink = `[${topicDisplay}](topics/${ts.topic}/README.md)`;
     const desc = TOPIC_DESCRIPTIONS[ts.topic];
-    return `| ${topicLink} | ${String(ts.papers)} | ${String(ts.techniques)} | ${desc} |`;
+    return `| ${topicLink} | ${String(ts.papers)} | ${String(ts.techniques)} | ${desc ?? ""} |`;
   });
   return `## Topics
 
@@ -7810,6 +7885,267 @@ async function researchIndexCommand(options) {
   }
 }
 
+// src/cli/research-import-command.ts
+import * as fs9 from "fs/promises";
+import { resolve as resolve5 } from "path";
+var VALID_TYPES = ["paper", "repo", "tool", "blog"];
+function parseCsvLine(line) {
+  const fields = [];
+  let current = "";
+  let inQuotes = false;
+  for (let i = 0; i < line.length; i++) {
+    const ch = line[i];
+    if (inQuotes) {
+      if (ch === '"') {
+        const next = line[i + 1];
+        if (next === '"') {
+          current += '"';
+          i++;
+        } else {
+          inQuotes = false;
+        }
+      } else {
+        current += ch;
+      }
+    } else if (ch === '"') {
+      inQuotes = true;
+    } else if (ch === ",") {
+      fields.push(current.trim());
+      current = "";
+    } else {
+      current += ch;
+    }
+  }
+  fields.push(current.trim());
+  return fields;
+}
+function isValidUrl(value) {
+  return /^https?:\/\/.+/.test(value);
+}
+function isValidType(value) {
+  return VALID_TYPES.includes(value);
+}
+function validateRow(fields, colIndex, rowNum) {
+  const title = fields[colIndex["title"]] ?? "";
+  const url = fields[colIndex["url"]] ?? "";
+  const rawType = (fields[colIndex["type"]] ?? "").toLowerCase();
+  const topic = fields[colIndex["topic"]] ?? "";
+  const description = fields[colIndex["description"]] ?? "";
+  if (title === "") return `Row ${String(rowNum)}: missing title`;
+  if (!isValidUrl(url)) return `Row ${String(rowNum)}: invalid URL "${url}"`;
+  if (!isValidType(rawType)) {
+    return `Row ${String(rowNum)}: invalid type "${rawType}" (expected: ${VALID_TYPES.join(", ")})`;
+  }
+  if (topic === "") return `Row ${String(rowNum)}: missing topic`;
+  return { title, url, type: rawType, topic, description };
+}
+function parseHeader(headerLine) {
+  const header = parseCsvLine(headerLine).map((h) => h.toLowerCase());
+  const required = ["title", "url", "type", "topic", "description"];
+  const missing = required.filter((col) => !header.includes(col));
+  if (missing.length > 0) {
+    return { ok: false, error: { message: `Missing CSV columns: ${missing.join(", ")}` } };
+  }
+  const colIndex = Object.fromEntries(required.map((col) => [col, header.indexOf(col)]));
+  return { ok: true, value: colIndex };
+}
+function parseCsvContent(content) {
+  const lines = content.split(/\r?\n/).filter((l) => l.trim() !== "");
+  if (lines.length < 2) {
+    return {
+      ok: false,
+      error: { message: "CSV must have a header row and at least one data row" }
+    };
+  }
+  const headerResult = parseHeader(lines[0]);
+  if (!headerResult.ok) return headerResult;
+  const rows = [];
+  const errors = [];
+  for (let i = 1; i < lines.length; i++) {
+    const fields = parseCsvLine(lines[i]);
+    const result = validateRow(fields, headerResult.value, i + 1);
+    if (typeof result === "string") {
+      errors.push(result);
+    } else {
+      rows.push(result);
+    }
+  }
+  if (errors.length > 0 && rows.length === 0) {
+    return { ok: false, error: { message: errors.join("\n") } };
+  }
+  return { ok: true, value: rows };
+}
+function generateIdFromTitle(title) {
+  return title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 60);
+}
+function mapToSourceType(csvType) {
+  switch (csvType) {
+    case "repo":
+      return "open_source_repo";
+    case "tool":
+      return "code_analysis";
+    case "blog":
+      return "research_blog";
+    default:
+      return "code_analysis";
+  }
+}
+async function executeImport(options) {
+  const csvPath = resolve5(options.csvPath);
+  let content;
+  try {
+    content = await fs9.readFile(csvPath, "utf-8");
+  } catch {
+    return buildResult(
+      [],
+      [{ row: 0, title: "", status: "error", reason: `Cannot read file: ${csvPath}` }]
+    );
+  }
+  const parseResult = parseCsvContent(content);
+  if (!parseResult.ok) {
+    return buildResult(
+      [],
+      [{ row: 0, title: "", status: "error", reason: parseResult.error.message }]
+    );
+  }
+  const rows = parseResult.value;
+  const outcomes = [];
+  const rootDir = options.rootDir;
+  const paperRows = rows.filter((r) => r.type === "paper");
+  const sourceRows = rows.filter((r) => r.type !== "paper");
+  if (paperRows.length > 0) {
+    await processPaperRows(paperRows, outcomes, options.dryRun === true, rootDir);
+  }
+  if (sourceRows.length > 0) {
+    await processSourceRows(sourceRows, outcomes, options.dryRun === true, rootDir);
+  }
+  return buildResult(rows, outcomes);
+}
+function buildPaperEntry(row) {
+  return {
+    title: row.title,
+    url: row.url,
+    source: "preprint",
+    arxiv_id: "",
+    publication_date: "",
+    venue: null,
+    reviewed_date: "",
+    reviewed_in: "",
+    topics: [row.topic],
+    summary: row.description,
+    relevance: "medium",
+    implementation_status: "not-started",
+    tags: [],
+    authors: [],
+    key_findings: [],
+    techniques_extracted: [],
+    related_issues: []
+  };
+}
+function collectNewPapers(rows, existingUrls, existingTitles, outcomes) {
+  const newPapers = {};
+  for (const row of rows) {
+    if (existingUrls.has(row.url) || existingTitles.has(row.title.toLowerCase())) {
+      outcomes.push({ row: 0, title: row.title, status: "skipped", reason: "Already exists" });
+      continue;
+    }
+    newPapers[generateIdFromTitle(row.title)] = buildPaperEntry(row);
+    existingTitles.add(row.title.toLowerCase());
+    outcomes.push({ row: 0, title: row.title, status: "added" });
+  }
+  return newPapers;
+}
+async function processPaperRows(rows, outcomes, dryRun, rootDir) {
+  const loadResult = await loadPapersRegistry(rootDir);
+  if (!loadResult.ok) {
+    for (const row of rows) {
+      outcomes.push({
+        row: 0,
+        title: row.title,
+        status: "error",
+        reason: "Failed to load papers registry"
+      });
+    }
+    return;
+  }
+  const registry = loadResult.value;
+  const existingUrls = new Set(
+    Object.values(registry.papers).map((p) => p.url).filter(Boolean)
+  );
+  const existingTitles = new Set(Object.values(registry.papers).map((p) => p.title.toLowerCase()));
+  const newPapers = collectNewPapers(rows, existingUrls, existingTitles, outcomes);
+  if (!dryRun && Object.keys(newPapers).length > 0) {
+    const updated = { ...registry, papers: { ...registry.papers, ...newPapers } };
+    await savePapersRegistry(updated, rootDir);
+  }
+}
+async function processSourceRows(rows, outcomes, dryRun, rootDir) {
+  const loadResult = await loadSourcesRegistry(rootDir);
+  if (!loadResult.ok) {
+    for (const row of rows) {
+      outcomes.push({
+        row: 0,
+        title: row.title,
+        status: "error",
+        reason: "Failed to load sources registry"
+      });
+    }
+    return;
+  }
+  const registry = loadResult.value;
+  const existingUrls = new Set(Object.values(registry.sources).map((s) => s.url));
+  const newSources = {};
+  for (const row of rows) {
+    if (existingUrls.has(row.url)) {
+      outcomes.push({ row: 0, title: row.title, status: "skipped", reason: "Already exists" });
+      continue;
+    }
+    const sourceId = generateIdFromTitle(row.title);
+    const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+    newSources[sourceId] = {
+      name: row.title,
+      type: mapToSourceType(row.type),
+      url: row.url,
+      topics: [row.topic],
+      reviewed_date: today
+    };
+    existingUrls.add(row.url);
+    outcomes.push({ row: 0, title: row.title, status: "added" });
+  }
+  if (!dryRun && Object.keys(newSources).length > 0) {
+    const updated = {
+      ...registry,
+      sources: { ...registry.sources, ...newSources }
+    };
+    await saveSourcesRegistry(updated, rootDir);
+  }
+}
+function buildResult(_rows, outcomes) {
+  const added = outcomes.filter((o) => o.status === "added").length;
+  const skipped = outcomes.filter((o) => o.status === "skipped").length;
+  const errors = outcomes.filter((o) => o.status === "error").length;
+  const lines = [
+    `Import complete: ${String(added)} added, ${String(skipped)} skipped, ${String(errors)} errors`
+  ];
+  for (const o of outcomes) {
+    const suffix = o.reason !== void 0 ? ` (${o.reason})` : "";
+    lines.push(`  [${o.status}] ${o.title}${suffix}`);
+  }
+  return { added, skipped, errors, outcomes, message: lines.join("\n") };
+}
+async function handleImportCommand(args, options) {
+  const csvPath = args[0];
+  if (csvPath === void 0 || csvPath === "") {
+    return "Error: CSV file path is required. Usage: nexus-agents research import <csv-file> [--dryRun]";
+  }
+  const dryRun = options["dryRun"] === true;
+  const result = await executeImport({ csvPath, dryRun });
+  if (dryRun) {
+    return `[DRY RUN] ${result.message}`;
+  }
+  return result.message;
+}
+
 // src/cli/research-command.ts
 function optString(options, key) {
   const val = options[key];
@@ -8023,7 +8359,8 @@ var VALID_SUBCOMMANDS = [
   "discover",
   "review",
   "prioritize",
-  "synthesize"
+  "synthesize",
+  "import"
 ];
 function isValidResearchSubcommand(value) {
   return value !== void 0 && VALID_SUBCOMMANDS.includes(value);
@@ -8044,7 +8381,8 @@ var SUBCOMMAND_HANDLERS = {
   discover: handleDiscoverCommand,
   review: handleReviewCommand,
   prioritize: handlePrioritizeCommand,
-  synthesize: handleSynthesizeCommand
+  synthesize: handleSynthesizeCommand,
+  import: handleImportCommand
 };
 async function researchCommand(subcommand, args, options) {
   const handler = SUBCOMMAND_HANDLERS[subcommand];
@@ -8055,8 +8393,8 @@ async function researchCommand(subcommand, args, options) {
 }
 
 // src/cli/index-command.ts
-import * as fs12 from "fs/promises";
-import * as path18 from "path";
+import * as fs13 from "fs/promises";
+import * as path17 from "path";
 import * as yaml6 from "yaml";
 
 // src/indexer/types.ts
@@ -8558,7 +8896,7 @@ function buildIndex(files) {
 }
 
 // src/indexer/generator.ts
-import * as fs9 from "fs/promises";
+import * as fs10 from "fs/promises";
 import * as path11 from "path";
 import * as yaml4 from "yaml";
 function indexToYaml(index) {
@@ -8721,33 +9059,22 @@ var McpToolSpecSchema = z4.object({
   source_file: z4.string(),
   source_line: z4.number().int().positive()
 });
-var RestEndpointSpecSchema = z4.object({
-  method: z4.string(),
-  path: z4.string(),
-  description: z4.string(),
-  body_params: z4.array(ParameterSpecSchema).readonly().optional(),
-  query_params: z4.array(ParameterSpecSchema).readonly().optional(),
-  source_file: z4.string(),
-  source_line: z4.number().int().positive()
-});
 var EntrypointManifestSchema = z4.object({
   schema_version: z4.literal(ENTRYPOINT_SCHEMA_VERSION),
   generated_at: z4.string(),
   cli_commands: z4.array(CliCommandSpecSchema).readonly(),
-  mcp_tools: z4.array(McpToolSpecSchema).readonly(),
-  rest_endpoints: z4.array(RestEndpointSpecSchema).readonly()
+  mcp_tools: z4.array(McpToolSpecSchema).readonly()
 });
 var DEFAULT_ENTRYPOINT_EXTRACTOR_OPTIONS = {
   packageRoot: "packages/nexus-agents",
   cliCommandsPath: "src/cli-commands.ts",
   mcpToolsPath: "src/mcp/tools",
-  restRoutesPath: "src/api/routes",
   sanitize: true
 };
 
 // src/indexer/entrypoint-extractor.ts
 import { Project as Project2 } from "ts-morph";
-import * as path15 from "path";
+import * as path14 from "path";
 import * as yaml5 from "yaml";
 
 // src/indexer/entrypoint-sanitizer.ts
@@ -8841,22 +9168,6 @@ function sanitizeTool(tool) {
     source_line: tool.source_line
   };
 }
-function sanitizeEndpoint(endpoint) {
-  const result = {
-    method: endpoint.method,
-    path: endpoint.path,
-    description: sanitizeValue(endpoint.description),
-    source_file: endpoint.source_file,
-    source_line: endpoint.source_line
-  };
-  if (endpoint.body_params !== void 0) {
-    result.body_params = endpoint.body_params.map(sanitizeParameter);
-  }
-  if (endpoint.query_params !== void 0) {
-    result.query_params = endpoint.query_params.map(sanitizeParameter);
-  }
-  return result;
-}
 
 // src/indexer/entrypoint-cli-extractor.ts
 import { SyntaxKind } from "ts-morph";
@@ -9173,159 +9484,6 @@ function extractParametersFromSchema(schemaArg, sourceFile) {
   return [];
 }
 
-// src/indexer/entrypoint-rest-extractor.ts
-import { SyntaxKind as SyntaxKind3 } from "ts-morph";
-import * as path14 from "path";
-function extractJsonSchemaParams(schemaObj) {
-  const params = [];
-  const objLiteral = schemaObj.asKind(SyntaxKind3.ObjectLiteralExpression);
-  if (objLiteral === void 0) return params;
-  const propertiesProp = objLiteral.getProperty("properties");
-  if (propertiesProp === void 0) return params;
-  const propsObj = propertiesProp.asKind(SyntaxKind3.PropertyAssignment)?.getInitializer()?.asKind(SyntaxKind3.ObjectLiteralExpression);
-  if (propsObj === void 0) return params;
-  const requiredFields = extractRequiredFields(objLiteral);
-  for (const prop of propsObj.getProperties()) {
-    const param = extractParameterFromProperty(prop, requiredFields);
-    if (param !== void 0) {
-      params.push(param);
-    }
-  }
-  return params;
-}
-function extractRequiredFields(objLiteral) {
-  const requiredFields = /* @__PURE__ */ new Set();
-  const obj = objLiteral.asKind(SyntaxKind3.ObjectLiteralExpression);
-  if (obj === void 0) return requiredFields;
-  const requiredProp = obj.getProperty("required");
-  if (requiredProp === void 0) return requiredFields;
-  const requiredArr = requiredProp.asKind(SyntaxKind3.PropertyAssignment)?.getInitializer()?.asKind(SyntaxKind3.ArrayLiteralExpression);
-  if (requiredArr !== void 0) {
-    for (const elem of requiredArr.getElements()) {
-      requiredFields.add(elem.getText().replace(/['"]/g, ""));
-    }
-  }
-  return requiredFields;
-}
-function extractParameterFromProperty(prop, requiredFields) {
-  const propAssign = prop.asKind(SyntaxKind3.PropertyAssignment);
-  if (propAssign === void 0) return void 0;
-  const paramName = propAssign.getName().replace(/['"]/g, "");
-  const propValue = propAssign.getInitializer()?.asKind(SyntaxKind3.ObjectLiteralExpression);
-  if (propValue === void 0) return void 0;
-  const spec = {
-    name: paramName,
-    type: "string",
-    required: requiredFields.has(paramName)
-  };
-  const typeProp = propValue.getProperty("type");
-  if (typeProp !== void 0) {
-    const typeValue = typeProp.asKind(SyntaxKind3.PropertyAssignment)?.getInitializer()?.getText().replace(/['"]/g, "");
-    if (typeValue !== void 0 && typeValue !== "") {
-      spec.type = typeValue;
-    }
-  }
-  const descProp = propValue.getProperty("description");
-  if (descProp !== void 0) {
-    const descValue = descProp.asKind(SyntaxKind3.PropertyAssignment)?.getInitializer()?.getText().replace(/^['"]|['"]$/g, "");
-    if (descValue !== void 0 && descValue !== "") {
-      spec.description = descValue;
-    }
-  }
-  return spec;
-}
-function extractRestEndpoints(project, packageRoot, restRoutesPath) {
-  const endpoints = [];
-  const routesDir = path14.join(packageRoot, restRoutesPath);
-  const routeFiles = project.getSourceFiles(`${routesDir}/*.ts`);
-  for (const sourceFile of routeFiles) {
-    const filePath = sourceFile.getFilePath();
-    const fileName = path14.basename(filePath);
-    if (fileName.endsWith(".test.ts") || fileName === "index.ts") continue;
-    const relativePath = path14.relative(process.cwd(), filePath);
-    const extractedEndpoints = extractEndpointsFromFile(sourceFile, relativePath);
-    endpoints.push(...extractedEndpoints);
-  }
-  return endpoints;
-}
-function extractEndpointsFromFile(sourceFile, relativePath) {
-  const endpoints = [];
-  if (sourceFile === void 0) return endpoints;
-  const callExpressions = sourceFile.getDescendantsOfKind(SyntaxKind3.CallExpression);
-  for (const callExpr of callExpressions) {
-    const callText = callExpr.getExpression().getText();
-    const methodMatch = callText.match(/\.(get|post|put|delete|patch)$/i);
-    if (methodMatch === null) continue;
-    const method = methodMatch[1]?.toUpperCase();
-    if (method === void 0) continue;
-    const endpoint = extractEndpointFromCall(callExpr, method, relativePath);
-    if (endpoint !== void 0) {
-      endpoints.push(endpoint);
-    }
-  }
-  return endpoints;
-}
-function extractEndpointFromCall(callExpr, method, relativePath) {
-  const typedCall = callExpr;
-  const args = typedCall.getArguments();
-  if (args.length < 2) return void 0;
-  const pathArgNode = args[0];
-  if (pathArgNode === void 0) return void 0;
-  const pathArg = pathArgNode.getText().replace(/['"]/g, "");
-  const { description, bodyParams } = extractEndpointMeta(args, method, pathArg);
-  const endpointSpec = {
-    method,
-    path: pathArg,
-    description,
-    source_file: relativePath,
-    source_line: typedCall.getStartLineNumber()
-  };
-  if (bodyParams.length > 0) {
-    endpointSpec.body_params = bodyParams;
-  }
-  return endpointSpec;
-}
-function extractEndpointMeta(args, method, pathArg) {
-  let description = `${method} ${pathArg}`;
-  let bodyParams = [];
-  const schemaArg = args[1];
-  if (schemaArg === void 0) {
-    return { description, bodyParams };
-  }
-  if (schemaArg.getKind() !== SyntaxKind3.ObjectLiteralExpression) {
-    return { description, bodyParams };
-  }
-  const schemaObj = schemaArg.asKind(SyntaxKind3.ObjectLiteralExpression);
-  if (schemaObj === void 0) {
-    return { description, bodyParams };
-  }
-  const schemaProp = schemaObj.getProperty("schema");
-  if (schemaProp === void 0) {
-    return { description, bodyParams };
-  }
-  const schemaValue = schemaProp.asKind(SyntaxKind3.PropertyAssignment)?.getInitializer()?.asKind(SyntaxKind3.ObjectLiteralExpression);
-  if (schemaValue === void 0) {
-    return { description, bodyParams };
-  }
-  const descProp = schemaValue.getProperty("description");
-  if (descProp !== void 0) {
-    const descValue = descProp.asKind(SyntaxKind3.PropertyAssignment)?.getInitializer()?.getText().replace(/^['"]|['"]$/g, "");
-    if (descValue !== void 0 && descValue !== "") {
-      description = descValue;
-    }
-  }
-  if (["POST", "PUT", "PATCH"].includes(method)) {
-    const bodyProp = schemaValue.getProperty("body");
-    if (bodyProp !== void 0) {
-      const bodyObj = bodyProp.asKind(SyntaxKind3.PropertyAssignment)?.getInitializer()?.asKind(SyntaxKind3.ObjectLiteralExpression);
-      if (bodyObj !== void 0) {
-        bodyParams = extractJsonSchemaParams(bodyObj);
-      }
-    }
-  }
-  return { description, bodyParams };
-}
-
 // src/indexer/entrypoint-extractor.ts
 function generateTimestamp() {
   return new Date(getTimeProvider().now()).toLocaleString("en-US", {
@@ -9341,14 +9499,13 @@ function generateTimestamp() {
 }
 function createProject(opts) {
   const project = new Project2({
-    tsConfigFilePath: path15.join(opts.packageRoot, "tsconfig.json"),
+    tsConfigFilePath: path14.join(opts.packageRoot, "tsconfig.json"),
     skipAddingFilesFromTsConfig: true
   });
   project.addSourceFilesAtPaths([
-    path15.join(opts.packageRoot, opts.cliCommandsPath),
-    path15.join(opts.packageRoot, "src/cli-types.ts"),
-    path15.join(opts.packageRoot, opts.mcpToolsPath, "*.ts"),
-    path15.join(opts.packageRoot, opts.restRoutesPath, "*.ts")
+    path14.join(opts.packageRoot, opts.cliCommandsPath),
+    path14.join(opts.packageRoot, "src/cli-types.ts"),
+    path14.join(opts.packageRoot, opts.mcpToolsPath, "*.ts")
   ]);
   return project;
 }
@@ -9365,16 +9522,13 @@ function extractEntrypoints(options = {}) {
       "src/cli-types.ts"
     );
     const mcpTools = extractMcpTools(project, opts.packageRoot, opts.mcpToolsPath);
-    const restEndpoints = extractRestEndpoints(project, opts.packageRoot, opts.restRoutesPath);
     const finalCommands = opts.sanitize ? cliCommands.map(sanitizeCommand) : cliCommands;
     const finalTools = opts.sanitize ? mcpTools.map(sanitizeTool) : mcpTools;
-    const finalEndpoints = opts.sanitize ? restEndpoints.map(sanitizeEndpoint) : restEndpoints;
     const manifest = {
       schema_version: ENTRYPOINT_SCHEMA_VERSION,
       generated_at: generateTimestamp(),
       cli_commands: finalCommands,
-      mcp_tools: finalTools,
-      rest_endpoints: finalEndpoints
+      mcp_tools: finalTools
     };
     return { success: true, manifest, errors, warnings };
   } catch (error) {
@@ -9396,20 +9550,20 @@ function manifestToJson(manifest) {
 }
 
 // src/cli/index-command-link-validator.ts
-import * as fs11 from "fs/promises";
-import * as path17 from "path";
+import * as fs12 from "fs/promises";
+import * as path16 from "path";
 
 // src/cli/index-command-link-validation-helpers.ts
-import * as fs10 from "fs/promises";
-import * as path16 from "path";
+import * as fs11 from "fs/promises";
+import * as path15 from "path";
 async function validateInternalLink(url, sourceFile) {
   const [filePath, anchor] = url.split("#");
   if (filePath === void 0 || filePath === "") {
     return { valid: true };
   }
-  const resolvedPath = path16.resolve(path16.dirname(sourceFile), filePath);
+  const resolvedPath = path15.resolve(path15.dirname(sourceFile), filePath);
   try {
-    await fs10.access(resolvedPath);
+    await fs11.access(resolvedPath);
     if (anchor !== void 0 && anchor !== "") {
       const anchorResult = await validateAnchorInFile(anchor, resolvedPath);
       if (!anchorResult.valid) {
@@ -9483,7 +9637,7 @@ function headingToAnchor(heading) {
 }
 async function validateAnchorInFile(anchor, targetFile) {
   try {
-    const content = await fs10.readFile(targetFile, "utf-8");
+    const content = await fs11.readFile(targetFile, "utf-8");
     const headingRegex = /^#{1,6}\s+(.+)$/gm;
     let match;
     while ((match = headingRegex.exec(content)) !== null) {
@@ -9492,9 +9646,9 @@ async function validateAnchorInFile(anchor, targetFile) {
         return { valid: true };
       }
     }
-    return { valid: false, error: `Anchor '#${anchor}' not found in ${path16.basename(targetFile)}` };
+    return { valid: false, error: `Anchor '#${anchor}' not found in ${path15.basename(targetFile)}` };
   } catch {
-    return { valid: false, error: `Failed to read ${path16.basename(targetFile)} for anchor check` };
+    return { valid: false, error: `Failed to read ${path15.basename(targetFile)} for anchor check` };
   }
 }
 async function validateAnchorLink(anchor, sourceFile) {
@@ -9584,9 +9738,9 @@ var REFERENCE_DEF_REGEX = /^\[([^\]]+)\]:\s*(.+)$/gm;
 async function findMarkdownFiles(dir) {
   const files = [];
   try {
-    const entries = await fs11.readdir(dir, { withFileTypes: true });
+    const entries = await fs12.readdir(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = path17.join(dir, entry.name);
+      const fullPath = path16.join(dir, entry.name);
       if (entry.name === "node_modules" || entry.name === "dist") {
         continue;
       }
@@ -9680,7 +9834,7 @@ function extractLinks(content) {
 }
 async function validateFileLinks(filePath, checkExternal, counters) {
   try {
-    const content = await fs11.readFile(filePath, "utf-8");
+    const content = await fs12.readFile(filePath, "utf-8");
     const links = extractLinks(content);
     const brokenLinksInFile = [];
     for (const link of links) {
@@ -9781,10 +9935,10 @@ async function generateIndex(options) {
     `Extracted ${String(extraction.files.length)} files in ${String(extraction.durationMs)}ms`
   );
   const index = buildIndex(extraction.files);
-  const outputDir = path18.dirname(outputPath);
-  await fs12.mkdir(outputDir, { recursive: true });
+  const outputDir = path17.dirname(outputPath);
+  await fs13.mkdir(outputDir, { recursive: true });
   const content = format === "yaml" ? indexToYaml(index) : indexToJson(index);
-  await fs12.writeFile(outputPath, content, "utf-8");
+  await fs13.writeFile(outputPath, content, "utf-8");
   logger9.info(`Wrote index to ${outputPath}`);
   return {
     success: true,
@@ -9799,14 +9953,14 @@ async function generateIndex(options) {
 async function checkIndex(options) {
   const indexPath = options.output ?? "docs/codebase-index.yaml";
   try {
-    await fs12.access(indexPath);
+    await fs13.access(indexPath);
   } catch {
     return {
       success: false,
       message: `Index file not found: ${indexPath}. Run 'nexus-agents index generate' first.`
     };
   }
-  const content = await fs12.readFile(indexPath, "utf-8");
+  const content = await fs13.readFile(indexPath, "utf-8");
   let existingIndex;
   try {
     const parsed = indexPath.endsWith(".json") ? JSON.parse(content) : yaml6.parse(content);
@@ -9842,18 +9996,18 @@ async function generateDiagram(options) {
   const indexPath = options.output ?? "docs/codebase-index.yaml";
   const diagramPath = "docs/dependency-graph.md";
   try {
-    await fs12.access(indexPath);
+    await fs13.access(indexPath);
   } catch {
     logger9.info("Index not found, generating...");
     await generateIndex({ ...options, subcommand: "generate" });
   }
-  const content = await fs12.readFile(indexPath, "utf-8");
+  const content = await fs13.readFile(indexPath, "utf-8");
   const parsed = indexPath.endsWith(".json") ? JSON.parse(content) : yaml6.parse(content);
   CodebaseIndexSchema.parse(parsed);
   const index = parsed;
   const diagram = generateDiagramMarkdown(index);
-  await fs12.mkdir(path18.dirname(diagramPath), { recursive: true });
-  await fs12.writeFile(diagramPath, diagram, "utf-8");
+  await fs13.mkdir(path17.dirname(diagramPath), { recursive: true });
+  await fs13.writeFile(diagramPath, diagram, "utf-8");
   logger9.info(`Wrote diagram to ${diagramPath}`);
   return {
     success: true,
@@ -9882,7 +10036,7 @@ function extractDocumentedModules(architectureContent) {
 }
 async function getActualModules(srcPath) {
   try {
-    const entries = await fs12.readdir(srcPath, { withFileTypes: true });
+    const entries = await fs13.readdir(srcPath, { withFileTypes: true });
     return entries.filter((e) => e.isDirectory() && !e.name.startsWith(".") && !e.name.startsWith("__")).map((e) => e.name);
   } catch (error) {
     logger9.debug("Failed to read source modules", { srcPath, error: getErrorMessage(error) });
@@ -9918,12 +10072,12 @@ async function validateArchitecture(options) {
   const srcPath = "packages/nexus-agents/src";
   let architectureContent;
   try {
-    architectureContent = await fs12.readFile(architecturePath, "utf-8");
+    architectureContent = await fs13.readFile(architecturePath, "utf-8");
   } catch {
     return { success: false, message: `ARCHITECTURE.md not found at ${architecturePath}` };
   }
   try {
-    await fs12.access(srcPath);
+    await fs13.access(srcPath);
   } catch {
     return { success: false, message: `Source directory not found: ${srcPath}` };
   }
@@ -9945,7 +10099,6 @@ async function entrypointsCommand(options) {
     packageRoot: "packages/nexus-agents",
     cliCommandsPath: "src/cli-commands.ts",
     mcpToolsPath: "src/mcp/tools",
-    restRoutesPath: "src/api/routes",
     sanitize: true
   });
   if (!result.success || result.manifest === void 0) {
@@ -9959,15 +10112,15 @@ async function entrypointsCommand(options) {
   for (const warning of result.warnings) {
     logger9.warn(warning);
   }
-  const outputDir = path18.dirname(outputPath);
-  await fs12.mkdir(outputDir, { recursive: true });
+  const outputDir = path17.dirname(outputPath);
+  await fs13.mkdir(outputDir, { recursive: true });
   const content = format === "yaml" ? manifestToYaml(manifest) : manifestToJson(manifest);
-  await fs12.writeFile(outputPath, content, "utf-8");
+  await fs13.writeFile(outputPath, content, "utf-8");
   logger9.info(`Wrote entrypoints manifest to ${outputPath}`);
-  const total = manifest.cli_commands.length + manifest.mcp_tools.length + manifest.rest_endpoints.length;
+  const total = manifest.cli_commands.length + manifest.mcp_tools.length;
   return {
     success: true,
-    message: `Extracted ${String(total)} entrypoints (${String(manifest.cli_commands.length)} CLI, ${String(manifest.mcp_tools.length)} MCP, ${String(manifest.rest_endpoints.length)} REST)`,
+    message: `Extracted ${String(total)} entrypoints (${String(manifest.cli_commands.length)} CLI, ${String(manifest.mcp_tools.length)} MCP)`,
     data: {
       outputPath
     }
@@ -9980,9 +10133,9 @@ async function freshnessCommand(options) {
   const hasIssues = summary.stale > 0 || summary.warning > 0;
   const output2 = options.format === "json" ? formatFreshnessJson(result) : formatFreshnessTable(result);
   if (options.output !== void 0) {
-    const outputDir = path18.dirname(options.output);
-    await fs12.mkdir(outputDir, { recursive: true });
-    await fs12.writeFile(options.output, output2, "utf-8");
+    const outputDir = path17.dirname(options.output);
+    await fs13.mkdir(outputDir, { recursive: true });
+    await fs13.writeFile(options.output, output2, "utf-8");
     logger9.info(`Wrote freshness report to ${options.output}`);
   } else {
     process.stdout.write(output2 + "\n");
@@ -10005,9 +10158,9 @@ async function linksCommand(options) {
   const hasBrokenLinks = summary.brokenLinks > 0;
   const output2 = options.format === "json" ? formatLinkValidationJson(result) : formatLinkValidationTable(result);
   if (options.output !== void 0) {
-    const outputDir = path18.dirname(options.output);
-    await fs12.mkdir(outputDir, { recursive: true });
-    await fs12.writeFile(options.output, output2, "utf-8");
+    const outputDir = path17.dirname(options.output);
+    await fs13.mkdir(outputDir, { recursive: true });
+    await fs13.writeFile(options.output, output2, "utf-8");
     logger9.info(`Wrote link validation report to ${options.output}`);
   } else {
     process.stdout.write(output2 + "\n");
@@ -10348,7 +10501,7 @@ async function verifyCommand(options) {
 
 // src/cli/swe-bench-command.ts
 import * as os2 from "os";
-import * as path19 from "path";
+import * as path18 from "path";
 function runInfo(options) {
   console.log(`
 SWE-bench Dataset: ${options.variant}`);
@@ -10415,7 +10568,8 @@ Error loading dataset: ${error.message}`);
 }
 async function loadAndSelectInstances(options) {
   console.log("Loading dataset...");
-  const loadOptions = options.limit !== void 0 ? { limit: options.limit } : {};
+  const hasInstanceFilter = options.instances.length > 0;
+  const loadOptions = !hasInstanceFilter && options.limit !== void 0 ? { limit: options.limit } : {};
   const loadResult = await loadDataset(options.variant, loadOptions);
   if (!loadResult.ok) {
     logDatasetError(loadResult.error);
@@ -10464,8 +10618,8 @@ function isValidRunId(runId) {
   return /^[a-zA-Z0-9_-]{1,64}$/.test(runId);
 }
 function isValidOutputDir(dir) {
-  const resolved = path19.resolve(dir);
-  return !resolved.includes("..") && resolved === path19.normalize(resolved);
+  const resolved = path18.resolve(dir);
+  return !resolved.includes("..") && resolved === path18.normalize(resolved);
 }
 function formatProgress(progress) {
   const pct = progress.totalCount > 0 ? Math.round(progress.completedCount / progress.totalCount * 100) : 0;
@@ -10479,12 +10633,12 @@ function buildHarnessConfig(options) {
   const predictionsPath = options.predictions ?? options.output;
   const runId = options.runId ?? `eval-${String(Date.now())}`;
   return {
-    predictionsPath: path19.resolve(predictionsPath),
+    predictionsPath: path18.resolve(predictionsPath),
     datasetName: options.variant,
     maxWorkers: options.maxWorkers,
     runId,
     timeoutSeconds: 1800,
-    outputDir: path19.resolve(options.outputDir),
+    outputDir: path18.resolve(options.outputDir),
     useDocker: true,
     cacheLevel: options.cacheLevel
   };
@@ -11066,8 +11220,8 @@ function isValidConfigAction(value) {
 }
 
 // src/cli/config-command-helpers.ts
-import * as fs13 from "fs/promises";
-import * as path20 from "path";
+import * as fs14 from "fs/promises";
+import * as path19 from "path";
 import { existsSync as existsSync10 } from "fs";
 
 // src/cli/config-command-formatting.ts
@@ -11335,10 +11489,10 @@ function parseValueFromString(stringValue, defaultValue) {
 }
 function resolveFilePath(filePath, allowedBase) {
   const base = allowedBase ?? process.cwd();
-  const resolved = path20.isAbsolute(filePath) ? filePath : path20.resolve(base, filePath);
-  const normalizedResolved = path20.normalize(resolved);
-  const normalizedBase = path20.normalize(base);
-  const isWithinBase = normalizedResolved === normalizedBase || normalizedResolved.startsWith(normalizedBase + path20.sep);
+  const resolved = path19.isAbsolute(filePath) ? filePath : path19.resolve(base, filePath);
+  const normalizedResolved = path19.normalize(resolved);
+  const normalizedBase = path19.normalize(base);
+  const isWithinBase = normalizedResolved === normalizedBase || normalizedResolved.startsWith(normalizedBase + path19.sep);
   if (!isWithinBase) {
     throw new ConfigCommandError(
       "PATH_TRAVERSAL",
@@ -11349,11 +11503,11 @@ function resolveFilePath(filePath, allowedBase) {
 }
 function getDefaultExportPath(format) {
   const extension = format === "json" ? "json" : "yaml";
-  return path20.resolve(process.cwd(), `nexus-config.${extension}`);
+  return path19.resolve(process.cwd(), `nexus-config.${extension}`);
 }
 
 // src/cli/config-command-handlers.ts
-import * as fs14 from "fs/promises";
+import * as fs15 from "fs/promises";
 import { existsSync as existsSync11 } from "fs";
 async function handleGet(key) {
   const parsed = parseConfigKey(key);
@@ -11455,7 +11609,7 @@ function buildConfigEntries() {
 }
 async function writeConfigFile2(filePath, content) {
   try {
-    await fs14.writeFile(filePath, content, "utf-8");
+    await fs15.writeFile(filePath, content, "utf-8");
   } catch (error) {
     const message = getErrorMessage(error);
     throw new ConfigCommandError("WRITE_ERROR", `Failed to write file: ${message}`);
@@ -11481,7 +11635,7 @@ async function readImportFile(filePath) {
   }
   const format = filePath.endsWith(".yaml") || filePath.endsWith(".yml") ? "yaml" : "json";
   try {
-    const content = await fs14.readFile(filePath, "utf-8");
+    const content = await fs15.readFile(filePath, "utf-8");
     return { content, format };
   } catch (error) {
     const message = getErrorMessage(error);
@@ -11979,7 +12133,7 @@ function writeResultAndExit(result) {
 
 // src/cli/hooks/hook-router.ts
 async function readStdin() {
-  return new Promise((resolve12, reject) => {
+  return new Promise((resolve14, reject) => {
     let data = "";
     process.stdin.setEncoding("utf8");
     process.stdin.on("readable", () => {
@@ -11990,24 +12144,24 @@ async function readStdin() {
       }
     });
     process.stdin.on("end", () => {
-      resolve12(data);
+      resolve14(data);
     });
     process.stdin.on("error", (err2) => {
       reject(err2);
     });
     if (process.stdin.isTTY) {
-      resolve12("");
+      resolve14("");
     }
   });
 }
 async function readStdinWithTimeout(timeoutMs = 5e3) {
-  return new Promise((resolve12, reject) => {
+  return new Promise((resolve14, reject) => {
     const timeout2 = setTimeout(() => {
       reject(new Error(`Stdin read timeout after ${String(timeoutMs)}ms`));
     }, timeoutMs);
     readStdin().then((data) => {
       clearTimeout(timeout2);
-      resolve12(data);
+      resolve14(data);
     }).catch((err2) => {
       clearTimeout(timeout2);
       reject(err2 instanceof Error ? err2 : new Error(String(err2)));
@@ -12139,9 +12293,9 @@ function setStringOption(options, key, value) {
 
 // src/cli/hooks/handlers/handler-utils.ts
 import { homedir as homedir2 } from "os";
-import { join as join14 } from "path";
+import { join as join13 } from "path";
 function getDefaultDbPath2() {
-  return join14(homedir2(), ".nexus-agents", "sessions.db");
+  return join13(homedir2(), ".nexus-agents", "sessions.db");
 }
 var HookEnvVars = {
   /** Override the default database path */
@@ -13324,6 +13478,72 @@ async function demoCommand(subcommand, args, options) {
 }
 
 // src/governance/fitness-score.ts
+import { existsSync as existsSync12, readFileSync as readFileSync6, readdirSync, statSync } from "fs";
+import { join as join14 } from "path";
+function findPkgRoot() {
+  let dir = import.meta.dirname;
+  for (let i = 0; i < 10; i++) {
+    const pkgPath = join14(dir, "package.json");
+    if (existsSync12(pkgPath)) {
+      const content = readFileSync6(pkgPath, "utf-8");
+      if (content.includes('"nexus-agents"')) return dir;
+    }
+    dir = join14(dir, "..");
+  }
+  return join14(import.meta.dirname, "../..");
+}
+var PKG_ROOT = findPkgRoot();
+var SRC_ROOT = join14(PKG_ROOT, "src");
+var REPO_ROOT = join14(PKG_ROOT, "../..");
+var DOCS_ROOT = join14(REPO_ROOT, "docs");
+var DETERMINISM_EXCLUDES = [
+  /\.test\.ts$/,
+  /\.spec\.ts$/,
+  /random-provider\.ts$/,
+  /time-provider\.ts$/
+];
+function countFiles(dir, pattern) {
+  if (!existsSync12(dir)) return 0;
+  let count = 0;
+  for (const entry of readdirSync(dir)) {
+    const fullPath = join14(dir, entry);
+    const stat2 = statSync(fullPath);
+    if (stat2.isDirectory() && !entry.startsWith(".")) {
+      count += countFiles(fullPath, pattern);
+    } else if (pattern.test(entry)) {
+      count++;
+    }
+  }
+  return count;
+}
+function fileContains(filePath, pattern) {
+  if (!existsSync12(filePath)) return false;
+  return pattern.test(readFileSync6(filePath, "utf-8"));
+}
+function isExcluded(entry, excludePatterns) {
+  return excludePatterns?.some((p) => p.test(entry)) ?? false;
+}
+function countMatchesInFile(fullPath, contentPattern) {
+  const matches = readFileSync6(fullPath, "utf-8").match(contentPattern);
+  return matches?.length ?? 0;
+}
+function countPatternInDir(dir, filePattern, contentPattern, excludePatterns) {
+  if (!existsSync12(dir)) return 0;
+  let count = 0;
+  for (const entry of readdirSync(dir)) {
+    const fullPath = join14(dir, entry);
+    const stat2 = statSync(fullPath);
+    if (stat2.isDirectory() && !entry.startsWith(".") && entry !== "node_modules") {
+      count += countPatternInDir(fullPath, filePattern, contentPattern, excludePatterns);
+    } else if (filePattern.test(entry) && !isExcluded(entry, excludePatterns)) {
+      count += countMatchesInFile(fullPath, contentPattern);
+    }
+  }
+  return count;
+}
+function clamp2(score, max) {
+  return Math.max(0, Math.min(max, score));
+}
 var FitnessScoreCalculator = class {
   logger;
   checks = [];
@@ -13331,62 +13551,26 @@ var FitnessScoreCalculator = class {
     this.logger = logger17 ?? createLogger({ component: "FitnessScoreCalculator" });
     this.registerDefaultChecks();
   }
-  /**
-   * Register default fitness checks.
-   */
+  /** Register default fitness checks. */
   registerDefaultChecks() {
-    this.checks.push({
-      dimension: "canonicalPaths",
-      maxPoints: 20,
-      name: "Canonical Path Analysis",
-      check: () => this.checkCanonicalPaths()
-    });
-    this.checks.push({
-      dimension: "explicitBehavior",
-      maxPoints: 15,
-      name: "Explicit Behavior Analysis",
-      check: () => this.checkExplicitBehavior()
-    });
-    this.checks.push({
-      dimension: "determinism",
-      maxPoints: 15,
-      name: "Determinism Analysis",
-      check: () => this.checkDeterminism()
-    });
-    this.checks.push({
-      dimension: "observability",
-      maxPoints: 15,
-      name: "Observability Analysis",
-      check: () => this.checkObservability()
-    });
-    this.checks.push({
-      dimension: "configSimplicity",
-      maxPoints: 10,
-      name: "Config Simplicity Analysis",
-      check: () => this.checkConfigSimplicity()
-    });
-    this.checks.push({
-      dimension: "layerSeparation",
-      maxPoints: 10,
-      name: "Layer Separation Analysis",
-      check: () => this.checkLayerSeparation()
-    });
-    this.checks.push({
-      dimension: "operatorErgonomics",
-      maxPoints: 10,
-      name: "Operator Ergonomics Analysis",
-      check: () => this.checkOperatorErgonomics()
-    });
-    this.checks.push({
-      dimension: "governanceIntegration",
-      maxPoints: 5,
-      name: "Governance Integration Analysis",
-      check: () => this.checkGovernanceIntegration()
-    });
+    const reg = (dimension, maxPoints, name, check) => {
+      this.checks.push({ dimension, maxPoints, name, check });
+    };
+    reg("canonicalPaths", 20, "Canonical Paths", () => this.checkCanonicalPaths());
+    reg("explicitBehavior", 15, "Explicit Behavior", () => this.checkExplicitBehavior());
+    reg("determinism", 15, "Determinism", () => this.checkDeterminism());
+    reg("observability", 15, "Observability", () => this.checkObservability());
+    reg("configSimplicity", 10, "Config Simplicity", () => this.checkConfigSimplicity());
+    reg("layerSeparation", 10, "Layer Separation", () => this.checkLayerSeparation());
+    reg("operatorErgonomics", 10, "Operator Ergonomics", () => this.checkOperatorErgonomics());
+    reg(
+      "governanceIntegration",
+      5,
+      "Governance Integration",
+      () => this.checkGovernanceIntegration()
+    );
   }
-  /**
-   * Run full fitness audit.
-   */
+  /** Run full fitness audit. */
   audit(version) {
     const findings = [];
     const dimensions = {};
@@ -13407,80 +13591,391 @@ var FitnessScoreCalculator = class {
     };
   }
   // =========================================================================
-  // Individual Checks
+  // Individual Checks — real filesystem analysis
   // =========================================================================
-  /**
-   * Check canonical paths - penalize duplicate paths to same workflow.
-   * Target: 18/20 after consolidation (per Issue #574)
-   */
+  /** Check canonical paths: penalize duplicate router implementations. */
   checkCanonicalPaths() {
     const findings = [];
-    const score = 20;
-    return { score: Math.max(0, score), findings };
+    let score = 20;
+    const routerCount = countFiles(join14(SRC_ROOT, "cli-adapters"), /router\.ts$/);
+    if (routerCount > 5) {
+      const excess = routerCount - 5;
+      const deduction = Math.min(5, excess);
+      score -= deduction;
+      findings.push(
+        this.finding(
+          "canonicalPaths",
+          "warning",
+          `${String(routerCount)} router implementations found (target: <=5)`,
+          deduction,
+          "Consolidate duplicate routers into CompositeRouter"
+        )
+      );
+    }
+    if (existsSync12(join14(SRC_ROOT, "cli-adapters/composite-router.ts"))) {
+      score += 2;
+    } else {
+      score -= 3;
+      findings.push(
+        this.finding(
+          "canonicalPaths",
+          "critical",
+          "CompositeRouter missing \u2014 no unified routing entry point",
+          3
+        )
+      );
+    }
+    score = this.checkOrchestratorInterface(score, findings);
+    return { score: clamp2(score, 20), findings };
+  }
+  /** Sub-check for IOrchestrator interface and adapter wiring. */
+  checkOrchestratorInterface(score, findings) {
+    const orchPath = join14(SRC_ROOT, "core/types/orchestrator.ts");
+    if (existsSync12(orchPath) && fileContains(orchPath, /interface IOrchestrator/)) {
+      score += 3;
+    } else {
+      score -= 2;
+      findings.push(
+        this.finding("canonicalPaths", "warning", "No IOrchestrator interface in core/types", 2)
+      );
+    }
+    const adapterPath = join14(SRC_ROOT, "orchestration/orchestrator-adapters.ts");
+    if (existsSync12(adapterPath) && fileContains(adapterPath, /TechLeadAdapter|PuppeteerAdapter/)) {
+      score += 2;
+    }
+    return score;
   }
   /**
-   * Check explicit behavior - penalize hidden/magic behavior.
+   * Check explicit behavior: penalize hidden/magic behavior.
+   * TODO: This dimension lacks strong filesystem signals. Currently checks
+   * for NEXUS_ALLOW_MOCK_ORCHESTRATION guard and magic routing patterns.
+   * Future: add AST-based detection of implicit fallbacks.
    */
   checkExplicitBehavior() {
     const findings = [];
-    const score = 15;
-    return { score, findings };
+    let score = 15;
+    const mockGuardCount = countPatternInDir(
+      SRC_ROOT,
+      /\.ts$/,
+      /NEXUS_ALLOW_MOCK_ORCHESTRATION/g,
+      DETERMINISM_EXCLUDES
+    );
+    if (mockGuardCount === 0) {
+      score -= 3;
+      findings.push(
+        this.finding(
+          "explicitBehavior",
+          "warning",
+          "No NEXUS_ALLOW_MOCK_ORCHESTRATION guard found \u2014 mock fallback may be implicit",
+          3,
+          "Require explicit env var for mock orchestration"
+        )
+      );
+    }
+    const magicRouting = countPatternInDir(
+      SRC_ROOT,
+      /\.ts$/,
+      /fallback.*=.*true|implicitRoute/g,
+      DETERMINISM_EXCLUDES
+    );
+    if (magicRouting > 5) {
+      const deduction = Math.min(3, Math.floor(magicRouting / 3));
+      score -= deduction;
+      findings.push(
+        this.finding(
+          "explicitBehavior",
+          "info",
+          `${String(magicRouting)} implicit fallback/routing patterns detected`,
+          deduction
+        )
+      );
+    }
+    return { score: clamp2(score, 15), findings };
   }
-  /**
-   * Check determinism - reward deterministic execution.
-   */
+  /** Check determinism: penalize unseeded random and raw Date.now(). */
   checkDeterminism() {
     const findings = [];
     let score = 15;
-    score -= 2;
-    findings.push({
-      dimension: "determinism",
-      severity: "info",
-      description: "Consensus voting uses LLM responses which are non-deterministic",
-      pointsDeducted: 2,
-      suggestion: "Consider caching/memoization for repeated proposals"
-    });
-    return { score: Math.max(0, score), findings };
+    score = this.checkRandomDeterminism(score, findings);
+    score = this.checkTimeDeterminism(score, findings);
+    return { score: clamp2(score, 15), findings };
+  }
+  /** Sub-check for Math.random() and injectable random provider. */
+  checkRandomDeterminism(score, findings) {
+    const randomCount = countPatternInDir(
+      SRC_ROOT,
+      /\.ts$/,
+      /Math\.random\(\)/g,
+      DETERMINISM_EXCLUDES
+    );
+    if (randomCount > 10) {
+      const deduction = Math.min(5, Math.floor(randomCount / 5));
+      score -= deduction;
+      findings.push(
+        this.finding(
+          "determinism",
+          "warning",
+          `${String(randomCount)} unseeded Math.random() calls in production code`,
+          deduction,
+          "Use getRandomProvider() for injectable randomness"
+        )
+      );
+    } else if (randomCount === 0) {
+      score += 2;
+    }
+    if (existsSync12(join14(SRC_ROOT, "core/random-provider.ts"))) {
+      score += 1;
+    }
+    const randomUsage = countPatternInDir(
+      SRC_ROOT,
+      /\.ts$/,
+      /getRandomProvider\(\)/g,
+      DETERMINISM_EXCLUDES
+    );
+    if (randomUsage > 5) {
+      score += 1;
+    }
+    return score;
   }
-  /**
-   * Check observability - reward telemetry coverage.
-   */
+  /** Sub-check for Date.now() and injectable time provider. */
+  checkTimeDeterminism(score, findings) {
+    const dateNowCount = countPatternInDir(
+      SRC_ROOT,
+      /\.ts$/,
+      /Date\.now\(\)/g,
+      DETERMINISM_EXCLUDES
+    );
+    if (dateNowCount > 50) {
+      score -= 2;
+      findings.push(
+        this.finding(
+          "determinism",
+          "info",
+          `${String(dateNowCount)} Date.now() calls in production code`,
+          2,
+          "Use getTimeProvider() for injectable time"
+        )
+      );
+    }
+    if (existsSync12(join14(SRC_ROOT, "core/time-provider.ts"))) {
+      score += 1;
+    }
+    const timeUsage = countPatternInDir(
+      SRC_ROOT,
+      /\.ts$/,
+      /getTimeProvider\(\)/g,
+      DETERMINISM_EXCLUDES
+    );
+    if (timeUsage > 10) {
+      score += 1;
+    }
+    return score;
+  }
+  /** Check observability: reward tracing, logging, and audit coverage. */
   checkObservability() {
     const findings = [];
-    const score = 15;
-    return { score: Math.max(0, score), findings };
+    let score = 15;
+    if (existsSync12(join14(SRC_ROOT, "observability/swarm-observer.ts"))) {
+      score += 3;
+    } else {
+      score -= 3;
+      findings.push(
+        this.finding(
+          "observability",
+          "warning",
+          "No SwarmObserver found",
+          3,
+          "Add observability/swarm-observer.ts"
+        )
+      );
+    }
+    if (existsSync12(join14(SRC_ROOT, "core/trace.ts"))) {
+      score += 2;
+    }
+    const loggerCount = countPatternInDir(SRC_ROOT, /\.ts$/, /createLogger\(/g);
+    if (loggerCount > 50) {
+      score += 2;
+    } else {
+      findings.push(
+        this.finding(
+          "observability",
+          "info",
+          `Only ${String(loggerCount)} createLogger() calls (target: >50)`,
+          0
+        )
+      );
+    }
+    if (existsSync12(join14(SRC_ROOT, "audit"))) {
+      score += 2;
+    }
+    return { score: clamp2(score, 15), findings };
   }
-  /**
-   * Check config simplicity - penalize too many config surfaces.
-   */
+  /** Check config simplicity: penalize excessive schema sprawl. */
   checkConfigSimplicity() {
     const findings = [];
-    const score = 10;
-    return { score: Math.max(0, score), findings };
+    let score = 10;
+    const schemaCount = countFiles(join14(SRC_ROOT, "config"), /schema.*\.ts$/);
+    if (schemaCount > 10) {
+      score -= 2;
+      findings.push(
+        this.finding(
+          "configSimplicity",
+          "info",
+          `${String(schemaCount)} config schemas (target: <=10)`,
+          2,
+          "Consolidate related schemas"
+        )
+      );
+    } else {
+      score += 1;
+    }
+    if (existsSync12(join14(SRC_ROOT, "config/config-loader.ts"))) {
+      score += 2;
+    }
+    if (existsSync12(join14(SRC_ROOT, "config/config-manager.ts"))) {
+      score += 1;
+    }
+    return { score: clamp2(score, 10), findings };
   }
-  /**
-   * Check layer separation - penalize cross-layer coupling.
-   */
+  /** Check layer separation: penalize cross-layer imports. */
   checkLayerSeparation() {
     const findings = [];
-    const score = 10;
-    return { score: Math.max(0, score), findings };
+    let score = 10;
+    const adapterAgentImports = countPatternInDir(
+      join14(SRC_ROOT, "adapters"),
+      /\.ts$/,
+      /from ['"]\.\.\/agents\//g
+    );
+    if (adapterAgentImports > 0) {
+      const deduction = Math.min(5, adapterAgentImports);
+      score -= deduction;
+      findings.push(
+        this.finding(
+          "layerSeparation",
+          "warning",
+          `${String(adapterAgentImports)} adapter->agent import violations`,
+          deduction,
+          "Adapters should not import from agents layer"
+        )
+      );
+    } else {
+      score += 2;
+    }
+    const coreMcpImports = countPatternInDir(
+      join14(SRC_ROOT, "core"),
+      /\.ts$/,
+      /from ['"]\.\.\/mcp\//g
+    );
+    if (coreMcpImports > 0) {
+      const deduction = Math.min(3, coreMcpImports);
+      score -= deduction;
+      findings.push(
+        this.finding(
+          "layerSeparation",
+          "critical",
+          `${String(coreMcpImports)} core->MCP import violations`,
+          deduction,
+          "Core must not depend on MCP layer"
+        )
+      );
+    } else {
+      score += 1;
+    }
+    return { score: clamp2(score, 10), findings };
   }
-  /**
-   * Check operator ergonomics - reward minimal CLI steps.
-   */
+  /** Check operator ergonomics: reward rich CLI commands. */
   checkOperatorErgonomics() {
     const findings = [];
-    const score = 10;
-    return { score: Math.max(0, score), findings };
+    let score = 10;
+    const commandCount = countFiles(join14(SRC_ROOT, "cli"), /\.ts$/);
+    if (commandCount >= 20) {
+      score += 3;
+    } else {
+      findings.push(
+        this.finding(
+          "operatorErgonomics",
+          "info",
+          `${String(commandCount)} CLI commands (target: >=20)`,
+          0
+        )
+      );
+    }
+    score = this.checkCliCommands(score, findings);
+    return { score: clamp2(score, 10), findings };
   }
-  /**
-   * Check governance integration - reward governance injection.
-   */
+  /** Sub-check for essential CLI commands (doctor, setup, demo, config). */
+  checkCliCommands(score, findings) {
+    const commands = [
+      ["cli/doctor.ts", "Doctor command", 2],
+      ["cli/setup-command.ts", "Setup wizard", 2],
+      ["cli/demo-command.ts", "Demo command", 1],
+      ["cli/config-command.ts", "Config command", 1]
+    ];
+    for (const [path23, name, bonus] of commands) {
+      if (existsSync12(join14(SRC_ROOT, path23))) {
+        score += bonus;
+      } else {
+        findings.push(this.finding("operatorErgonomics", "info", `Missing ${name} (${path23})`, 0));
+      }
+    }
+    return score;
+  }
+  /** Check governance integration: policy firewall, rate limiter, docs. */
   checkGovernanceIntegration() {
     const findings = [];
-    const score = 5;
-    return { score, findings };
+    let score = 5;
+    score = this.checkGovernanceDocs(score, findings);
+    score = this.checkGovernanceInfra(score, findings);
+    return { score: clamp2(score, 5), findings };
+  }
+  /** Sub-check for governance documentation artifacts. */
+  checkGovernanceDocs(score, findings) {
+    if (!existsSync12(join14(REPO_ROOT, "CLAUDE.md"))) {
+      score -= 3;
+      findings.push(
+        this.finding("governanceIntegration", "critical", "No CLAUDE.md governance document", 3)
+      );
+    } else {
+      score += 1;
+    }
+    if (existsSync12(join14(DOCS_ROOT, "architecture/wiring-graph.json"))) {
+      score += 1;
+    }
+    if (existsSync12(join14(DOCS_ROOT, "adr"))) {
+      score += 1;
+    } else {
+      findings.push(this.finding("governanceIntegration", "info", "No ADR directory", 0));
+    }
+    return score;
+  }
+  /** Sub-check for governance runtime infrastructure. */
+  checkGovernanceInfra(score, findings) {
+    const hasPolicyFirewall = countPatternInDir(join14(SRC_ROOT, "security"), /\.ts$/, /PolicyGate|policyFirewall/g) > 0;
+    if (hasPolicyFirewall) {
+      score += 1;
+    } else {
+      findings.push(
+        this.finding(
+          "governanceIntegration",
+          "warning",
+          "No policy firewall detected in security layer",
+          0
+        )
+      );
+    }
+    const hasRateLimiter = countPatternInDir(SRC_ROOT, /\.ts$/, /RateLimiter|rateLimiter/g) > 0;
+    if (hasRateLimiter) {
+      score += 1;
+    }
+    return score;
+  }
+  /** Helper to create a FitnessFinding with defaults. */
+  finding(dimension, severity, description, pointsDeducted, suggestion) {
+    const base = { dimension, severity, description, pointsDeducted };
+    if (suggestion !== void 0) {
+      return { ...base, suggestion };
+    }
+    return base;
   }
 };
 function createFitnessScoreCalculator(logger17) {
@@ -13658,10 +14153,10 @@ var CATEGORY_ORDER = [
 ];
 
 // src/cli/release-notes-helpers.ts
-import { execSync as execSync2 } from "child_process";
+import { execFileSync } from "child_process";
 function getLatestTag() {
   try {
-    const result = execSync2("git describe --tags --abbrev=0", {
+    const result = execFileSync("git", ["describe", "--tags", "--abbrev=0"], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
       timeout: CLI_SUBPROCESS_TIMEOUTS.ghCommandMs
@@ -13672,8 +14167,12 @@ function getLatestTag() {
   }
 }
 function getCommitsBetween(from, to = "HEAD") {
+  const SAFE_REF = /^[a-zA-Z0-9._\-/~^]+$/;
+  if (!SAFE_REF.test(from) || !SAFE_REF.test(to)) {
+    return [];
+  }
   try {
-    const result = execSync2(`git log ${from}..${to} --oneline --format="%h %s"`, {
+    const result = execFileSync("git", ["log", `${from}..${to}`, "--oneline", "--format=%h %s"], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
       timeout: CLI_SUBPROCESS_TIMEOUTS.ghCommandMs
@@ -13920,16 +14419,16 @@ async function releaseNotesCommand(args) {
 }
 
 // src/cli/release-validate-command.ts
-import { readFileSync as readFileSync7 } from "fs";
+import { readFileSync as readFileSync8 } from "fs";
 
 // src/cli/release-validate-helpers.ts
-import { execSync as execSync3 } from "child_process";
-import { existsSync as existsSync12, readFileSync as readFileSync6 } from "fs";
+import { execSync as execSync2 } from "child_process";
+import { existsSync as existsSync13, readFileSync as readFileSync7 } from "fs";
 async function validateSecurity(options) {
   const startTime = Date.now();
   const findings = [];
   try {
-    execSync3("npm audit --audit-level=high 2>/dev/null", {
+    execSync2("npm audit --audit-level=high 2>/dev/null", {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
       timeout: CLI_SUBPROCESS_TIMEOUTS.ghCommandMs
@@ -13943,7 +14442,7 @@ async function validateSecurity(options) {
       remediation: "Run npm audit fix or review and update vulnerable dependencies."
     });
   }
-  if (existsSync12(".env")) {
+  if (existsSync13(".env")) {
     findings.push({
       severity: "error",
       category: "security",
@@ -13953,7 +14452,7 @@ async function validateSecurity(options) {
     });
   }
   try {
-    const result = execSync3(
+    const result = execSync2(
       'git diff HEAD~10..HEAD -- "*.ts" "*.js" | grep -iE "(api[_-]?key|secret|password|token)" | head -5',
       {
         encoding: "utf-8",
@@ -13984,7 +14483,7 @@ async function validateArchitecture2(options) {
   const startTime = Date.now();
   const findings = [];
   try {
-    const result = execSync3("npx nexus-agents fitness-audit --format=json 2>/dev/null", {
+    const result = execSync2("npx nexus-agents fitness-audit --format=json 2>/dev/null", {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
       timeout: CLI_SUBPROCESS_TIMEOUTS.releaseValidateMs
@@ -14039,7 +14538,7 @@ async function validateArchitecture2(options) {
 async function validateDocumentation(options) {
   const startTime = Date.now();
   const findings = [];
-  if (!existsSync12("CHANGELOG.md")) {
+  if (!existsSync13("CHANGELOG.md")) {
     findings.push({
       severity: "error",
       category: "docs",
@@ -14047,7 +14546,7 @@ async function validateDocumentation(options) {
       description: "No CHANGELOG.md found in repository root.",
       remediation: "Create CHANGELOG.md following Keep a Changelog format."
     });
-  } else if (!readFileSync6("CHANGELOG.md", "utf-8").includes(options.version)) {
+  } else if (!readFileSync7("CHANGELOG.md", "utf-8").includes(options.version)) {
     findings.push({
       severity: "warning",
       category: "docs",
@@ -14057,7 +14556,7 @@ async function validateDocumentation(options) {
     });
   }
   const pkgCl = "packages/nexus-agents/CHANGELOG.md";
-  if (existsSync12(pkgCl) && !readFileSync6(pkgCl, "utf-8").includes(options.version)) {
+  if (existsSync13(pkgCl) && !readFileSync7(pkgCl, "utf-8").includes(options.version)) {
     findings.push({
       severity: "warning",
       category: "docs",
@@ -14066,7 +14565,7 @@ async function validateDocumentation(options) {
       remediation: "Run pnpm changeset:version to generate changelog from pending changesets."
     });
   }
-  if (!existsSync12("README.md")) {
+  if (!existsSync13("README.md")) {
     findings.push({
       severity: "error",
       category: "docs",
@@ -14075,8 +14574,8 @@ async function validateDocumentation(options) {
       remediation: "Create README.md with project overview and usage instructions."
     });
   }
-  if (existsSync12("CLAUDE.md")) {
-    const claudeMd = readFileSync6("CLAUDE.md", "utf-8");
+  if (existsSync13("CLAUDE.md")) {
+    const claudeMd = readFileSync7("CLAUDE.md", "utf-8");
     const match = claudeMd.match(/Governance Version: (\d{4}-\d{2}-\d{2})/);
     if (match?.[1]) {
       const governanceDate = new Date(match[1]);
@@ -14105,7 +14604,7 @@ async function validateDevOps(options) {
   const startTime = Date.now();
   const findings = [];
   try {
-    execSync3("pnpm build 2>/dev/null", {
+    execSync2("pnpm build 2>/dev/null", {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
       timeout: CLI_SUBPROCESS_TIMEOUTS.releaseValidateMs
@@ -14126,7 +14625,7 @@ async function validateDevOps(options) {
     });
   }
   try {
-    execSync3("pnpm lint 2>/dev/null", {
+    execSync2("pnpm lint 2>/dev/null", {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
       timeout: CLI_SUBPROCESS_TIMEOUTS.releaseBuildMs
@@ -14147,7 +14646,7 @@ async function validateDevOps(options) {
     });
   }
   try {
-    execSync3("pnpm typecheck 2>/dev/null", {
+    execSync2("pnpm typecheck 2>/dev/null", {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
       timeout: CLI_SUBPROCESS_TIMEOUTS.releaseValidateMs
@@ -14184,7 +14683,7 @@ var DEFAULT_OPTIONS2 = {
 };
 function readVersionFromPackage() {
   try {
-    const raw = JSON.parse(readFileSync7("package.json", "utf-8"));
+    const raw = JSON.parse(readFileSync8("package.json", "utf-8"));
     if (typeof raw === "object" && raw !== null && "version" in raw) {
       const pkg = raw;
       return typeof pkg.version === "string" ? pkg.version : "unknown";
@@ -14298,7 +14797,7 @@ async function releaseValidateCommand(args) {
 }
 
 // src/cli/release-announce-command.ts
-import { readFileSync as readFileSync8, existsSync as existsSync13 } from "fs";
+import { readFileSync as readFileSync9, existsSync as existsSync14 } from "fs";
 
 // src/cli/release-announce-types.ts
 var BLUESKY_LIMITS = {
@@ -14323,7 +14822,7 @@ function getBlueskyConfig() {
 }
 async function loadAtproto() {
   try {
-    const mod = await import("./dist-H5XNXVAV.js");
+    const mod = await import("./dist-CV74KUT7.js");
     return { AtpAgent: mod.AtpAgent, RichText: mod.RichText };
   } catch {
     return void 0;
@@ -14365,8 +14864,8 @@ var DEFAULT_OPTIONS3 = {
   verbose: false
 };
 function extractHighlightsFromChangelog(version) {
-  if (!existsSync13("CHANGELOG.md")) return [];
-  const changelog = readFileSync8("CHANGELOG.md", "utf-8");
+  if (!existsSync14("CHANGELOG.md")) return [];
+  const changelog = readFileSync9("CHANGELOG.md", "utf-8");
   const escaped = version.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const versionRegex = new RegExp(`## \\[${escaped}\\][^#]*`, "s");
   const match = changelog.match(versionRegex);
@@ -14628,7 +15127,7 @@ async function releaseAnnounceCommand(args) {
     version = args.options.version;
   } else {
     try {
-      const pkg = JSON.parse(readFileSync8("package.json", "utf-8"));
+      const pkg = JSON.parse(readFileSync9("package.json", "utf-8"));
       if (!pkg.version) {
         console.error(`${colors.red}Error: Could not determine version${colors.reset}`);
         return 1;
@@ -14655,8 +15154,8 @@ async function releaseAnnounceCommand(args) {
 }
 
 // src/cli/scaffold.ts
-import * as fs15 from "fs";
-import * as path21 from "path";
+import * as fs16 from "fs";
+import * as path20 from "path";
 
 // src/cli/scaffold-templates.ts
 function toolImportsAndSchema(name, pascal) {
@@ -14992,17 +15491,17 @@ ${lines}`;
 function writeFiles(files) {
   const createdPaths = [];
   for (const file of files) {
-    const fullPath = path21.resolve(process.cwd(), file.path);
-    const dir = path21.dirname(fullPath);
-    fs15.mkdirSync(dir, { recursive: true });
-    if (fs15.existsSync(fullPath)) {
+    const fullPath = path20.resolve(process.cwd(), file.path);
+    const dir = path20.dirname(fullPath);
+    fs16.mkdirSync(dir, { recursive: true });
+    if (fs16.existsSync(fullPath)) {
       return {
         success: false,
         filesCreated: createdPaths,
         message: `File already exists: ${file.path}. Use a different name.`
       };
     }
-    fs15.writeFileSync(fullPath, file.content, "utf-8");
+    fs16.writeFileSync(fullPath, file.content, "utf-8");
     createdPaths.push(file.path);
   }
   const lines = createdPaths.map((p) => `  ${p}`).join("\n");
@@ -15079,8 +15578,18 @@ var LATENCY_RANGES = {
   secondary: { min: 3e3, max: 8e3 },
   other: { min: 5e3, max: 15e3 }
 };
-function pickCategory() {
-  const roll = Math.random();
+function createRng(seed) {
+  if (seed === void 0) return Math.random;
+  let s = seed | 0;
+  return () => {
+    s = s + 1831565813 | 0;
+    let t = Math.imul(s ^ s >>> 15, 1 | s);
+    t = t + Math.imul(t ^ t >>> 7, 61 | t) ^ t;
+    return ((t ^ t >>> 14) >>> 0) / 4294967296;
+  };
+}
+function pickCategory(rng) {
+  const roll = rng();
   let cumulative = 0;
   for (const [category, weight] of DEFAULT_TASK_DISTRIBUTION) {
     cumulative += weight;
@@ -15088,12 +15597,12 @@ function pickCategory() {
   }
   return "code_generation";
 }
-function pickCli(category) {
+function pickCli(category, rng) {
   const primary = PRIMARY_CLI.get(category) ?? "claude";
-  const roll = Math.random();
+  const roll = rng();
   if (roll < 0.5) return primary;
   if (roll < 0.75) return CLI_NAMES3.find((c) => c !== primary) ?? "gemini";
-  return CLI_NAMES3[Math.floor(Math.random() * CLI_NAMES3.length)] ?? "claude";
+  return CLI_NAMES3[Math.floor(rng() * CLI_NAMES3.length)] ?? "claude";
 }
 function getCliRole(cli, category) {
   const primary = PRIMARY_CLI.get(category);
@@ -15112,12 +15621,12 @@ function getCliRole(cli, category) {
   ]);
   return cli === secondaryMap.get(category) ? "secondary" : "other";
 }
-function simulateTask(taskIndex, category, cli) {
+function simulateTask(taskIndex, category, cli, rng) {
   const role = getCliRole(cli, category);
   const successRate = SUCCESS_RATES[role];
   const latency = LATENCY_RANGES[role];
-  const success = Math.random() < successRate;
-  const durationMs = latency.min + Math.random() * (latency.max - latency.min);
+  const success = rng() < successRate;
+  const durationMs = latency.min + rng() * (latency.max - latency.min);
   return {
     id: `e2e-${String(taskIndex)}-${cli}-${category}`,
     cli,
@@ -15130,7 +15639,7 @@ function simulateTask(taskIndex, category, cli) {
     source: "manual"
   };
 }
-function generateOutcomes(taskCount) {
+function generateOutcomes(taskCount, rng) {
   const store = getOutcomeStore();
   const success = /* @__PURE__ */ new Map();
   const total = /* @__PURE__ */ new Map();
@@ -15139,9 +15648,9 @@ function generateOutcomes(taskCount) {
     total.set(cli, 0);
   }
   for (let i = 0; i < taskCount; i++) {
-    const category = pickCategory();
-    const cli = pickCli(category);
-    const outcome = simulateTask(i, category, cli);
+    const category = pickCategory(rng);
+    const cli = pickCli(category, rng);
+    const outcome = simulateTask(i, category, cli, rng);
     store.append(outcome);
     total.set(cli, (total.get(cli) ?? 0) + 1);
     if (outcome.success) success.set(cli, (success.get(cli) ?? 0) + 1);
@@ -15192,7 +15701,8 @@ function runE2EEval(config, logger17) {
     resetOutcomeStore();
     setOutcomeStore(new OutcomeStore());
   }
-  const counts = generateOutcomes(taskCount);
+  const rng = createRng(config?.seed);
+  const counts = generateOutcomes(taskCount, rng);
   log.info("E2E eval: outcomes recorded", { taskCount });
   const { bonuses, nonZeroCount } = checkAdaptiveBonuses();
   const convergenceScore = computeConvergence(counts, nonZeroCount);
@@ -15549,13 +16059,13 @@ function formatEvalDetails(baseline, reflective, improvement, datasetSize) {
 }
 
 // src/cli/auth-command.ts
-import { existsSync as existsSync15, statSync, chmodSync } from "fs";
+import { existsSync as existsSync16, statSync as statSync2, chmodSync } from "fs";
 function isValidAuthSubcommand(value) {
   return value === "init" || value === "show" || value === "rotate" || value === "help";
 }
 function getFilePermissions(filePath) {
   try {
-    const stats = statSync(filePath);
+    const stats = statSync2(filePath);
     return (stats.mode & 511).toString(8);
   } catch {
     return void 0;
@@ -15569,7 +16079,7 @@ function fixPermissions(filePath) {
 }
 function runAuthInit(options) {
   const tokenFile = options.tokenFile ?? getDefaultTokenPath();
-  const tokenExists = existsSync15(tokenFile);
+  const tokenExists = existsSync16(tokenFile);
   if (tokenExists && options.force !== true) {
     return {
       success: false,
@@ -15593,7 +16103,7 @@ function runAuthInit(options) {
 }
 function runAuthShow(options) {
   const tokenFile = options.tokenFile ?? getDefaultTokenPath();
-  const tokenExists = existsSync15(tokenFile);
+  const tokenExists = existsSync16(tokenFile);
   const token = readStoredToken(tokenFile);
   if (!tokenExists || token === void 0) {
     return {
@@ -15614,7 +16124,7 @@ function runAuthShow(options) {
 }
 function runAuthRotate(options) {
   const tokenFile = options.tokenFile ?? getDefaultTokenPath();
-  const tokenExists = existsSync15(tokenFile);
+  const tokenExists = existsSync16(tokenFile);
   if (!tokenExists) {
     return {
       success: false,
@@ -15650,14 +16160,14 @@ function runAuthCommand(options) {
         success: true,
         operation: "help",
         tokenFile: getDefaultTokenPath(),
-        tokenExists: existsSync15(getDefaultTokenPath())
+        tokenExists: existsSync16(getDefaultTokenPath())
       };
     default:
       return {
         success: false,
         operation: "help",
         tokenFile: getDefaultTokenPath(),
-        tokenExists: existsSync15(getDefaultTokenPath()),
+        tokenExists: existsSync16(getDefaultTokenPath()),
         error: `Unknown subcommand: ${String(subcommand)}`
       };
   }
@@ -15773,7 +16283,7 @@ function authCommand(subcommand, options) {
 
 // src/cli-help-text.ts
 var HELP_TEXT = `
-nexus-agents - Multi-agent orchestration MCP server
+nexus-agents - Intelligent orchestration platform for AI coding tools
 
 USAGE:
   nexus-agents [OPTIONS]
@@ -15814,6 +16324,7 @@ COMMANDS:
   capabilities    Show model capabilities matrix (modalities, tools, features)
   status          At-a-glance project health dashboard (fitness, adapters, version)
   health          Swarm health metrics dashboard (utilization, routing accuracy, failures)
+  validate        Run unified validation (doctor + fitness + config)
   auth            Manage MCP authentication tokens (init, show, rotate)
 
 OPTIONS:
@@ -16415,15 +16926,142 @@ function isValidCommand(value) {
     "e2e-eval",
     "routing-ab",
     "memory-eval",
-    "health"
+    "health",
+    "validate"
   ];
   return validCommands.includes(value);
 }
 
 // src/cli-commands-handlers.ts
-import { existsSync as existsSync17 } from "fs";
-import { join as join17 } from "path";
-import { homedir as homedir5 } from "os";
+import { existsSync as existsSync18 } from "fs";
+import { join as join16 } from "path";
+import { homedir as homedir4 } from "os";
+
+// src/mcp/tools/dev-pipeline-tool.ts
+import { z as z7 } from "zod";
+import * as fs17 from "fs";
+import * as path21 from "path";
+var DevPipelineInputSchema = z7.object({
+  /** Direct task instructions. */
+  task: z7.string().max(1e4).optional().describe("Direct task instructions (what to build)"),
+  /** Path to a plan file (.md, .yaml, .txt) to use as input. */
+  planFile: z7.string().max(500).optional().describe("Path to a plan/spec file to use as input"),
+  /** Whether to run in dry-run mode (plan+vote only, no implementation). */
+  dryRun: z7.boolean().default(false).describe("If true, stop after plan+vote (no implementation)"),
+  /** Maximum vote iterations before proceeding (default: 3). */
+  maxVoteIterations: z7.number().int().min(1).max(5).default(3).describe("Max plan\u2192vote iterations"),
+  /** Maximum QA iterations per task (default: 3). */
+  maxQaIterations: z7.number().int().min(1).max(5).default(3).describe("Max QA review iterations per task"),
+  /** Working directory for the pipeline (default: cwd). Used for security scan and context. */
+  workingDir: z7.string().max(500).optional().describe("Working directory (default: cwd)"),
+  /** GitHub issue number to track progress on. Updates posted as comments. */
+  issueNumber: z7.number().int().positive().optional().describe("GitHub issue to post progress to"),
+  /** GitHub repo (owner/name) for issue tracking. */
+  repo: z7.string().max(200).optional().describe("GitHub repo for issue tracking (e.g., owner/repo)"),
+  /** Task tracking backend: github, gitlab, or json (default: json). */
+  trackerBackend: z7.enum(["github", "gitlab", "json"]).default("json").describe("Task tracking backend for issue creation"),
+  /** Labels to apply to created issues. */
+  labels: z7.array(z7.string()).optional().describe("Labels for created issues"),
+  /** Session ID for checkpoint/resume. Enables crash recovery. */
+  sessionId: z7.string().max(128).regex(/^[a-zA-Z0-9_-]+$/).optional().describe("Session ID for checkpoint/resume (crash recovery)"),
+  /** When true, use simulated votes instead of real CLI consensus (for testing). */
+  simulateVotes: z7.boolean().default(false).describe("Use simulated votes (for testing without real CLIs)"),
+  /** Voting strategy for consensus stages. */
+  votingStrategy: z7.enum([
+    "simple_majority",
+    "supermajority",
+    "unanimous",
+    "higher_order",
+    "proof_of_learning",
+    "opinion_wise"
+  ]).optional().describe("Voting strategy for plan approval (default: higher_order)"),
+  /** Use 3 agents instead of 6 for faster voting. */
+  quickMode: z7.boolean().default(false).describe("Use 3 agents instead of 6 for faster consensus voting"),
+  /** Maximum execution time per stage in milliseconds (min 30s, max 600s). */
+  timeoutMs: z7.number().int().min(3e4).max(6e5).optional().describe("Max time per stage in ms (30000-600000). Default: varies by stage complexity"),
+  /** Pipeline execution mode. */
+  mode: z7.enum(["autonomous", "harness"]).default("autonomous").describe(
+    "'autonomous': full pipeline. 'harness': stops after decompose, returns tasks for caller to implement."
+  )
+});
+function resolveTaskInput(input) {
+  if (input.task !== void 0 && input.task.trim() !== "") {
+    return input.task;
+  }
+  if (input.planFile !== void 0) {
+    const resolved = path21.resolve(input.planFile);
+    const cwdRoot = path21.resolve(".");
+    if (!resolved.startsWith(cwdRoot)) {
+      throw new Error(`Path traversal denied: planFile must be within ${cwdRoot}`);
+    }
+    if (!fs17.existsSync(resolved)) {
+      throw new Error(`Plan file not found: ${resolved}`);
+    }
+    return fs17.readFileSync(resolved, "utf-8");
+  }
+  throw new Error("Either task or planFile must be provided");
+}
+async function createStages(input) {
+  const backendChoice = input.trackerBackend;
+  const backend = backendChoice === "json" && input.repo !== void 0 ? await detectBackend() : backendChoice;
+  const tracker = input.repo !== void 0 ? createTaskTracker({ backend, repo: input.repo, labels: input.labels }) : void 0;
+  return createAgentStages({
+    scanTarget: input.workingDir,
+    simulateVotes: input.simulateVotes,
+    votingStrategy: input.votingStrategy,
+    quickMode: input.quickMode,
+    issueNumber: input.issueNumber,
+    repo: input.repo,
+    tracker
+  });
+}
+function buildStructuredOutput(result) {
+  return {
+    completed: result.completed,
+    securityPassed: result.securityPassed,
+    voteIterations: result.voteIterations,
+    qaIterations: result.qaIterations,
+    plan: result.plan,
+    tasks: result.tasks.map((t) => ({
+      id: t.id,
+      title: t.title,
+      status: t.status,
+      implementation: t.implementation ?? null,
+      feedback: t.feedback ?? null
+    }))
+  };
+}
+function registerDevPipelineTool(server, _deps) {
+  server.tool("run_dev_pipeline", DevPipelineInputSchema.shape, async (args) => {
+    const input = DevPipelineInputSchema.parse(args);
+    try {
+      const taskText = resolveTaskInput(input);
+      const stages = await createStages(input);
+      const pipelineOptions = {
+        ...input.sessionId !== void 0 ? { sessionId: input.sessionId } : {},
+        ...input.dryRun ? { dryRun: true } : {},
+        ...input.mode === "harness" ? { mode: "harness" } : {}
+      };
+      const hasOptions = Object.keys(pipelineOptions).length > 0;
+      const result = await runDevPipeline(
+        taskText,
+        stages,
+        hasOptions ? pipelineOptions : void 0
+      );
+      flushPipelineMemory();
+      const structured = buildStructuredOutput(result);
+      return {
+        content: [{ type: "text", text: JSON.stringify(structured, null, 2) }],
+        structuredContent: structured
+      };
+    } catch (error) {
+      return {
+        content: [{ type: "text", text: `Pipeline error: ${getErrorMessage(error)}` }],
+        isError: true
+      };
+    }
+  });
+}
 
 // src/cli-server-stpa.ts
 var TOOL_DEFINITIONS = [
@@ -16605,6 +17243,206 @@ function runStpaSafetyAnalysis(logger17, failOnHighSeverity) {
   }
 }
 
+// src/mcp/gateway/upstream-client.ts
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+function resolveEnv(env) {
+  if (env === void 0) return {};
+  const resolved = {};
+  for (const [key, val] of Object.entries(env)) {
+    const match = /^\{env:(\w+)\}$/.exec(val);
+    if (match?.[1] !== void 0) {
+      const envKey = match[1];
+      const envVal = process.env[envKey];
+      if (envVal !== void 0) resolved[key] = envVal;
+    } else {
+      resolved[key] = val;
+    }
+  }
+  return resolved;
+}
+var UpstreamClient = class {
+  name;
+  config;
+  log;
+  client = null;
+  transport = null;
+  state = "disconnected";
+  tools = [];
+  constructor(config, logger17) {
+    this.name = config.name;
+    this.config = config;
+    this.log = logger17 ?? createLogger({ component: `upstream:${config.name}` });
+  }
+  /** Connect to the upstream server. Idempotent. */
+  async connect() {
+    if (this.state === "connected") return;
+    if (this.state === "connecting") return;
+    this.state = "connecting";
+    try {
+      const resolvedEnv = resolveEnv(this.config.env);
+      const baseEnv = {};
+      for (const [k, v] of Object.entries(process.env)) {
+        if (v !== void 0) baseEnv[k] = v;
+      }
+      this.transport = new StdioClientTransport({
+        command: this.config.command,
+        args: [...this.config.args],
+        env: { ...baseEnv, ...resolvedEnv }
+      });
+      this.client = new Client(
+        { name: `nexus-upstream-${this.name}`, version: "1.0.0" },
+        { capabilities: {} }
+      );
+      await this.client.connect(this.transport);
+      const result = await this.client.listTools();
+      this.tools = result.tools;
+      this.state = "connected";
+      this.log.info("Upstream server connected", {
+        name: this.name,
+        toolCount: this.tools.length,
+        tools: this.tools.map((t) => t.name)
+      });
+    } catch (error) {
+      this.state = "failed";
+      const msg = error instanceof Error ? error.message : String(error);
+      this.log.warn("Upstream server connection failed", {
+        name: this.name,
+        error: msg
+      });
+      throw error;
+    }
+  }
+  /** Get available tools (prefixed with server name). */
+  getTools() {
+    return this.tools.map((t) => ({
+      ...t,
+      name: `${this.name}.${t.name}`,
+      description: `[${this.name}] ${t.description ?? ""}`
+    }));
+  }
+  /** Call a tool on the upstream server. Returns the raw SDK result. */
+  async callTool(toolName, args) {
+    if (this.client === null || this.state !== "connected") {
+      if (this.config.lazy) {
+        await this.connect();
+      } else {
+        throw new Error(`Upstream server ${this.name} not connected`);
+      }
+    }
+    const activeClient = this.client;
+    if (activeClient === null) throw new Error(`Upstream server ${this.name} not connected`);
+    return activeClient.callTool({ name: toolName, arguments: args });
+  }
+  /** Check if the server is healthy. */
+  async ping() {
+    if (this.client === null || this.state !== "connected") return false;
+    try {
+      await this.client.ping();
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  /** Gracefully shut down the connection. */
+  async shutdown() {
+    if (this.client !== null) {
+      try {
+        await this.client.close();
+      } catch {
+      }
+      this.client = null;
+    }
+    if (this.transport !== null) {
+      try {
+        await this.transport.close();
+      } catch {
+      }
+      this.transport = null;
+    }
+    this.state = "disconnected";
+    this.tools = [];
+    this.log.info("Upstream server disconnected", { name: this.name });
+  }
+  /** Get current connection state. */
+  getState() {
+    return this.state;
+  }
+};
+var UpstreamClientManager = class {
+  clients = /* @__PURE__ */ new Map();
+  log;
+  constructor(logger17) {
+    this.log = logger17 ?? createLogger({ component: "UpstreamClientManager" });
+  }
+  /** Register upstream servers from config. */
+  registerServers(configs) {
+    for (const config of configs) {
+      if (this.clients.has(config.name)) {
+        this.log.warn("Duplicate upstream server name", { name: config.name });
+        continue;
+      }
+      this.clients.set(config.name, new UpstreamClient(config, this.log));
+      this.log.info("Registered upstream server", {
+        name: config.name,
+        command: config.command,
+        lazy: config.lazy
+      });
+    }
+  }
+  /** Connect all non-lazy servers. */
+  async connectEager() {
+    for (const client of this.clients.values()) {
+      if (client.getState() === "disconnected") {
+        try {
+          await client.connect();
+        } catch {
+        }
+      }
+    }
+  }
+  /** Get all available tools across all connected upstream servers. */
+  getAllTools() {
+    const tools = [];
+    for (const client of this.clients.values()) {
+      if (client.getState() === "connected") {
+        tools.push(...client.getTools());
+      }
+    }
+    return tools;
+  }
+  /** Route a prefixed tool call to the appropriate upstream server. */
+  async callTool(prefixedName, args) {
+    const dotIndex = prefixedName.indexOf(".");
+    if (dotIndex === -1) return null;
+    const serverName = prefixedName.slice(0, dotIndex);
+    const toolName = prefixedName.slice(dotIndex + 1);
+    const client = this.clients.get(serverName);
+    if (client === void 0) return null;
+    return client.callTool(toolName, args);
+  }
+  /** Check if a tool name is an upstream prefixed tool. */
+  isUpstreamTool(name) {
+    const dotIndex = name.indexOf(".");
+    if (dotIndex === -1) return false;
+    return this.clients.has(name.slice(0, dotIndex));
+  }
+  /** Shut down all upstream connections. */
+  async shutdownAll() {
+    const promises = [...this.clients.values()].map((c) => c.shutdown());
+    await Promise.allSettled(promises);
+    this.clients.clear();
+    this.log.info("All upstream servers shut down");
+  }
+  /** Get health status of all upstream servers. */
+  getStatus() {
+    return [...this.clients.entries()].map(([name, client]) => ({
+      name,
+      state: client.getState()
+    }));
+  }
+};
+
 // src/cli-server-tools.ts
 var OrchestratorUnavailableError = class extends NexusError {
   constructor(message) {
@@ -16718,6 +17556,10 @@ function registerResearchTools(ctx) {
     ...researchDeps,
     rateLimiter: ctx.rateLimiterFactory.getForTool("research_add")
   });
+  registerResearchAddSourceTool(ctx.server, {
+    ...researchDeps,
+    rateLimiter: ctx.rateLimiterFactory.getForTool("research_add_source")
+  });
   registerResearchDiscoverTool(ctx.server, {
     ...researchDeps,
     rateLimiter: ctx.rateLimiterFactory.getForTool("research_discover")
@@ -16785,6 +17627,33 @@ function registerOrchestrateToolSafe(ctx) {
     });
   }
 }
+async function initUpstreamServers(gatewayConfig, server, logger17) {
+  const upstreamServers = gatewayConfig?.["upstreamServers"];
+  if (upstreamServers === void 0 || upstreamServers.length === 0) return;
+  const manager = new UpstreamClientManager(logger17);
+  manager.registerServers(upstreamServers);
+  await manager.connectEager();
+  const tools = manager.getAllTools();
+  logger17.info("Upstream MCP servers initialized", {
+    servers: upstreamServers.length,
+    tools: tools.length
+  });
+  const { z: z8 } = await import("zod");
+  const passthroughSchema = z8.looseObject({});
+  for (const tool of tools) {
+    const toolName = tool.name;
+    const desc = tool.description ?? `Upstream tool: ${toolName}`;
+    server.registerTool(
+      toolName,
+      { description: desc, inputSchema: passthroughSchema },
+      async (args) => {
+        const upstreamResult = await manager.callTool(toolName, args);
+        const text = upstreamResult !== null ? JSON.stringify(upstreamResult) : "Upstream tool not found";
+        return { content: [{ type: "text", text }] };
+      }
+    );
+  }
+}
 function maybeRunStpaAnalysis(options, logger17) {
   const enableStpa = options.enableStpaSafetyAnalysis ?? false;
   if (!enableStpa) return;
@@ -16859,7 +17728,11 @@ var STANDALONE_TOOLS = [
   { name: "run_graph_workflow", register: registerRunGraphWorkflowTool },
   { name: "execute_spec", register: registerExecuteSpecTool },
   { name: "list_experts", register: registerListExpertsTool },
-  { name: "query_trace", register: registerQueryTraceTool }
+  { name: "query_trace", register: registerQueryTraceTool },
+  { name: "extract_symbols", register: registerExtractSymbolsTool },
+  { name: "search_codebase", register: registerSearchCodebaseTool },
+  { name: "run_dev_pipeline", register: registerDevPipelineTool },
+  { name: "run_pipeline", register: registerPipelineTool }
 ];
 function registerToolCategories(ctx) {
   const allowlist = ctx.toolAllowlist;
@@ -16914,6 +17787,7 @@ function registerMcpTools(options) {
   const gatewayOptions = { ...options, server: observableServer };
   const ctx = createToolContext(gatewayOptions, toolInfra, rateLimiterFactory);
   registerToolCategories(ctx);
+  void initUpstreamServers(gatewayConfig, observableServer, logger17);
   registerPrompts(observableServer, logger17);
   registerResources(observableServer, logger17);
   logToolRegistration(logger17, ctx.toolAllowlist, {
@@ -17017,7 +17891,7 @@ function logFinalEventBusStats(logger17) {
 // src/cli-orchestrator.ts
 import * as readline2 from "readline";
 function runOrchestratorRepl(options, logger17) {
-  return new Promise((resolve12) => {
+  return new Promise((resolve14) => {
     const rl = readline2.createInterface({
       input: process.stdin,
       output: process.stdout,
@@ -17053,7 +17927,7 @@ function runOrchestratorRepl(options, logger17) {
     });
     rl.on("close", () => {
       logger17.info("Orchestrator REPL closed");
-      resolve12();
+      resolve14();
     });
   });
 }
@@ -18198,127 +19072,6 @@ function initializeFeedbackIntegration(options) {
   }
 }
 
-// src/cli-server-rest.ts
-import * as fs16 from "fs";
-import * as path22 from "path";
-import * as crypto3 from "crypto";
-import { homedir as homedir3 } from "os";
-var DEFAULT_REST_CONFIG = {
-  enabled: false,
-  port: 3e3,
-  host: "0.0.0.0",
-  cors: true,
-  swagger: true
-};
-var configLogger = createLogger({ component: "RestApiConfig" });
-function parseValidPort(value) {
-  const port = parseInt(value, 10);
-  if (isNaN(port) || port < 1 || port > 65535) {
-    configLogger.warn("Invalid NEXUS_REST_PORT value, using default", {
-      value,
-      default: DEFAULT_REST_CONFIG.port
-    });
-    return DEFAULT_REST_CONFIG.port;
-  }
-  return port;
-}
-function extractRestConfig(_config) {
-  const portEnv = process.env["NEXUS_REST_PORT"];
-  const hostEnv = process.env["NEXUS_REST_HOST"];
-  return {
-    enabled: process.env["NEXUS_REST_ENABLED"] === "true",
-    port: portEnv !== void 0 ? parseValidPort(portEnv) : DEFAULT_REST_CONFIG.port,
-    host: hostEnv ?? DEFAULT_REST_CONFIG.host,
-    cors: DEFAULT_REST_CONFIG.cors,
-    swagger: DEFAULT_REST_CONFIG.swagger
-  };
-}
-var AUTH_DIR = "auth";
-var API_KEY_FILE = "rest-api-key";
-function getAuthDir(baseDir) {
-  const home = baseDir ?? path22.join(homedir3(), ".nexus-agents");
-  return path22.join(home, AUTH_DIR);
-}
-function loadOrGenerateApiKey(logger17, baseDir) {
-  const authDir = getAuthDir(baseDir);
-  const keyPath = path22.join(authDir, API_KEY_FILE);
-  if (fs16.existsSync(keyPath)) {
-    const key2 = fs16.readFileSync(keyPath, "utf-8").trim();
-    if (key2.length > 0) {
-      logger17.info("Loaded REST API key from disk", { keyFile: keyPath });
-      return { key: key2, name: "auto-generated" };
-    }
-  }
-  const key = "nxa-" + crypto3.randomBytes(24).toString("hex");
-  if (!fs16.existsSync(authDir)) {
-    fs16.mkdirSync(authDir, { recursive: true, mode: 448 });
-  }
-  fs16.writeFileSync(keyPath, key + "\n", { mode: 384 });
-  logger17.info("Generated new REST API key", { keyFile: keyPath });
-  logger17.warn("REST API key stored at: " + keyPath + " \u2014 keep this file secure");
-  return { key, name: "auto-generated" };
-}
-function buildApiKeys(logger17, authHandler) {
-  const keys = [loadOrGenerateApiKey(logger17)];
-  if (authHandler?.isEnabled() === true && authHandler.hasToken()) {
-    const token = authHandler.getStoredTokenForIntegration();
-    if (token !== void 0) {
-      keys.push({ key: token, name: "mcp-bearer-token" });
-      logger17.info("REST API also accepts MCP bearer token for authentication");
-    }
-  }
-  return keys;
-}
-async function startRestApiServer(config, logger17, authHandler) {
-  if (!config.enabled) {
-    logger17.debug("REST API disabled (set NEXUS_REST_ENABLED=true to enable)");
-    return null;
-  }
-  const restLogger = createLogger({ component: "RestApiServer" });
-  const apiKeys = buildApiKeys(logger17, authHandler);
-  const serverOptions = {
-    config: {
-      port: config.port,
-      host: config.host,
-      enableCors: config.cors,
-      enableSwagger: config.swagger
-    },
-    logger: restLogger,
-    apiKeys
-  };
-  const server = new RestApiServer(serverOptions);
-  await server.start();
-  logger17.info("REST API server started", {
-    address: `http://${config.host}:${String(config.port)}`,
-    swagger: config.swagger ? `http://${config.host}:${String(config.port)}/docs` : "disabled"
-  });
-  return server;
-}
-async function stopRestApiServer(server, logger17) {
-  if (server === null) {
-    return;
-  }
-  try {
-    await server.stop();
-    logger17.info("REST API server stopped");
-  } catch (error) {
-    logger17.error(
-      "Error stopping REST API server",
-      error instanceof Error ? error : new Error(String(error))
-    );
-  }
-}
-function logRestApiConfig(config, logger17) {
-  if (config.enabled) {
-    logger17.info("REST API configuration", {
-      port: config.port,
-      host: config.host,
-      cors: config.cors,
-      swagger: config.swagger
-    });
-  }
-}
-
 // src/cli-server-auth.ts
 function resolveAuthEnabled(config) {
   const envValue = process.env["NEXUS_AUTH_ENABLED"];
@@ -18363,9 +19116,9 @@ function initializeAuth(config, logger17) {
 }
 
 // src/cli-server-audit.ts
-import { join as join16 } from "path";
-import { homedir as homedir4 } from "os";
-var DEFAULT_AUDIT_DIR = join16(homedir4(), ".nexus-agents", "audit");
+import { join as join15 } from "path";
+import { homedir as homedir3 } from "os";
+var DEFAULT_AUDIT_DIR = join15(homedir3(), ".nexus-agents", "audit");
 function initializeAuditLogger(securityConfig, logger17) {
   if (securityConfig?.audit?.enabled !== true) {
     logger17.debug("Audit logging disabled (set security.audit.enabled: true to enable)");
@@ -18535,18 +19288,8 @@ function loadAndLogConfig(logger17) {
   return configResult;
 }
 function createShutdownCleanup(options) {
-  const {
-    eventBusBridge,
-    observer,
-    eventContext,
-    server,
-    serverLogger,
-    logger: logger17,
-    restServer,
-    auditLogger
-  } = options;
+  const { eventBusBridge, observer, eventContext, server, serverLogger, logger: logger17, auditLogger } = options;
   return async () => {
-    await stopRestApiServer(restServer, logger17);
     await shutdownAuditLogger(auditLogger, logger17);
     if (eventBusBridge.initialized) {
       logFinalEventBusStats(logger17);
@@ -18703,11 +19446,8 @@ async function startServer(verbose, mode, modeWasExplicit = false, orchestratorO
   const configResult = loadAndLogConfig(logger17);
   applyLoggingConfig(logger17, verbose, configResult.config);
   validateNexusEnv(logger17);
-  const { server, serverLogger, observer, eventBusBridge, auditLogger, authInit } = await initializeSubsystems(configResult.config, logger17);
+  const { server, serverLogger, observer, eventBusBridge, auditLogger } = await initializeSubsystems(configResult.config, logger17);
   await connectToStdioTransport(server, logger17, serverLogger);
-  const restConfig = extractRestConfig(configResult.config);
-  logRestApiConfig(restConfig, logger17);
-  const restServer = await startRestApiServer(restConfig, logger17, authInit.handler);
   const eventContext = recordServerStartup(observer);
   const stdinMonitor = getStdinLifecycleMonitor();
   stdinMonitor.start();
@@ -18722,7 +19462,6 @@ async function startServer(verbose, mode, modeWasExplicit = false, orchestratorO
     server,
     serverLogger,
     logger: logger17,
-    restServer,
     auditLogger
   });
   setupShutdownHandlers(cleanup, logger17);
@@ -18973,9 +19712,9 @@ function buildOrchestratorOptions(args) {
 function printFirstRunHint() {
   const isTTY = process.stderr.isTTY;
   if (!isTTY) return;
-  const dataDir = join17(homedir5(), ".nexus-agents");
-  const hasConfig = existsSync17("./nexus-agents.yaml") || existsSync17("./nexus-agents.yml");
-  if (existsSync17(dataDir) || hasConfig) return;
+  const dataDir = join16(homedir4(), ".nexus-agents");
+  const hasConfig = existsSync18("./nexus-agents.yaml") || existsSync18("./nexus-agents.yml");
+  if (existsSync18(dataDir) || hasConfig) return;
   process.stderr.write(
     "\n\x1B[36mnexus-agents\x1B[0m: First time? Run \x1B[1mnexus-agents setup\x1B[0m to configure.\n\n"
   );
@@ -19109,7 +19848,7 @@ async function handleVerifyCommand(args) {
 async function handleDoctorCommand(args) {
   const exitCode = await doctorCommand({ fix: args.options.fix });
   if (args.options.deep) {
-    const { runDeepDiagnostics: runDeepDiagnostics2, formatDeepDiagnostics: formatDeepDiagnostics2 } = await import("./doctor-deep-BDE2PHVX.js");
+    const { runDeepDiagnostics: runDeepDiagnostics2, formatDeepDiagnostics: formatDeepDiagnostics2 } = await import("./doctor-deep-LMCEAFU4.js");
     const diag = runDeepDiagnostics2();
     process.stdout.write(formatDeepDiagnostics2(diag) + "\n");
   }
@@ -19360,25 +20099,25 @@ function handleScaffoldCommand(args) {
 }
 
 // src/cli/visualize-summary.ts
-import * as fs17 from "fs";
-import * as path23 from "path";
+import * as fs18 from "fs";
+import * as path22 from "path";
 import { fileURLToPath } from "url";
 function findPackageRoot(startDir) {
   let dir = startDir;
   for (let i = 0; i < 5; i++) {
-    if (fs17.existsSync(path23.join(dir, "package.json"))) return dir;
-    const parent = path23.dirname(dir);
+    if (fs18.existsSync(path22.join(dir, "package.json"))) return dir;
+    const parent = path22.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
   return startDir;
 }
-function countFiles(dir, pattern) {
-  if (!fs17.existsSync(dir)) return 0;
+function countFiles2(dir, pattern) {
+  if (!fs18.existsSync(dir)) return 0;
   let count = 0;
-  for (const entry of fs17.readdirSync(dir, { withFileTypes: true })) {
+  for (const entry of fs18.readdirSync(dir, { withFileTypes: true })) {
     if (entry.isDirectory() && entry.name !== "node_modules" && entry.name !== "dist") {
-      count += countFiles(path23.join(dir, entry.name), pattern);
+      count += countFiles2(path22.join(dir, entry.name), pattern);
     } else if (entry.isFile() && pattern.test(entry.name)) {
       count++;
     }
@@ -19387,7 +20126,7 @@ function countFiles(dir, pattern) {
 }
 function readVersion(pkgRoot) {
   try {
-    const raw = fs17.readFileSync(path23.join(pkgRoot, "package.json"), "utf-8");
+    const raw = fs18.readFileSync(path22.join(pkgRoot, "package.json"), "utf-8");
     const pkg = JSON.parse(raw);
     return pkg.version ?? "unknown";
   } catch {
@@ -19408,13 +20147,13 @@ var LAYER_DIRS = [
 ];
 function gatherSystemSummary() {
   const thisFile = fileURLToPath(import.meta.url);
-  const pkgRoot = findPackageRoot(path23.dirname(thisFile));
-  const srcDir = path23.resolve(pkgRoot, "src");
-  const allTs = countFiles(srcDir, /\.ts$/);
-  const testTs = countFiles(srcDir, /\.test\.ts$/);
+  const pkgRoot = findPackageRoot(path22.dirname(thisFile));
+  const srcDir = path22.resolve(pkgRoot, "src");
+  const allTs = countFiles2(srcDir, /\.ts$/);
+  const testTs = countFiles2(srcDir, /\.test\.ts$/);
   const layers = LAYER_DIRS.map(({ name, dir }) => ({
     name,
-    files: countFiles(path23.join(srcDir, dir), /\.ts$/)
+    files: countFiles2(path22.join(srcDir, dir), /\.ts$/)
   })).filter((l) => l.files > 0);
   return {
     version: readVersion(pkgRoot),
@@ -19664,8 +20403,8 @@ function generateDiagramOutput(subcommand, format) {
 }
 function writeOutput(output2, outputPath) {
   if (outputPath !== void 0) {
-    import("fs").then((fs18) => {
-      fs18.writeFileSync(outputPath, output2 + "\n", "utf-8");
+    import("fs").then((fs19) => {
+      fs19.writeFileSync(outputPath, output2 + "\n", "utf-8");
       process.stdout.write(`Diagram written to ${outputPath}
 `);
     }).catch((e) => {
@@ -20456,7 +21195,7 @@ async function handleMemoryBenchmarkCommand(args) {
 }
 
 // src/cli/status-command.ts
-import { execFileSync } from "child_process";
+import { execFileSync as execFileSync2 } from "child_process";
 var FITNESS_TARGET = 90;
 var API_ADAPTER_CHECKS = [
   { name: "Claude", envVar: "ANTHROPIC_API_KEY" },
@@ -20478,7 +21217,7 @@ function checkApiAdapters() {
 function detectCliTools() {
   return CLI_TOOL_CHECKS.map((check) => {
     try {
-      const version = execFileSync(check.binary, ["--version"], {
+      const version = execFileSync2(check.binary, ["--version"], {
         timeout: CLI_SUBPROCESS_TIMEOUTS.statusProbeMs,
         stdio: ["ignore", "pipe", "ignore"],
         encoding: "utf-8"
@@ -20563,10 +21302,10 @@ function handleStatusCommand2(args) {
 
 // src/cli/scenario-command.ts
 import { readdir as readdir4 } from "fs/promises";
-import { join as join19, resolve as resolve11 } from "path";
+import { join as join18, resolve as resolve13 } from "path";
 
 // src/testing/e2e/scenario-runner.ts
-import { readFile as readFile6 } from "fs/promises";
+import { readFile as readFile7 } from "fs/promises";
 import * as yaml7 from "yaml";
 
 // src/testing/e2e/types.ts
@@ -20694,9 +21433,9 @@ function checkCircularDependencies(workflow) {
   for (const step of workflow.steps) {
     stepMap.set(step.id, step);
   }
-  const visit = (stepId, path24) => {
+  const visit = (stepId, path23) => {
     if (visiting.has(stepId)) {
-      errors.push(`Circular dependency detected: ${[...path24, stepId].join(" -> ")}`);
+      errors.push(`Circular dependency detected: ${[...path23, stepId].join(" -> ")}`);
       return false;
     }
     if (visited.has(stepId)) return true;
@@ -20704,7 +21443,7 @@ function checkCircularDependencies(workflow) {
     const step = stepMap.get(stepId);
     if (step?.dependsOn) {
       for (const dep of step.dependsOn) {
-        if (!visit(dep, [...path24, stepId])) {
+        if (!visit(dep, [...path23, stepId])) {
           return false;
         }
       }
@@ -20723,7 +21462,7 @@ function checkCircularDependencies(workflow) {
 var defaultStubFactory = {
   createAgentStub(agentType, action) {
     return async (inputs) => {
-      await new Promise((resolve12) => setTimeout(resolve12, 10));
+      await new Promise((resolve14) => setTimeout(resolve14, 10));
       return {
         stepId: `${agentType}-${action}`,
         status: "success",
@@ -20748,8 +21487,8 @@ var ScenarioRunner = class {
   /**
    * Load a scenario fixture from a YAML file.
    */
-  async loadFixture(path24) {
-    const content = await readFile6(path24, "utf-8");
+  async loadFixture(path23) {
+    const content = await readFile7(path23, "utf-8");
     const data = yaml7.parse(content);
     return ScenarioFixtureSchema.parse(data);
   }
@@ -20882,7 +21621,7 @@ function createScenarioRunner(stubFactory) {
 }
 
 // src/cli/scenario-command.ts
-var FIXTURES_DIR = resolve11(import.meta.dirname, "../testing/e2e/fixtures");
+var FIXTURES_DIR = resolve13(import.meta.dirname, "../testing/e2e/fixtures");
 var SCENARIO_SUFFIX = ".scenario.yaml";
 async function listScenarios() {
   try {
@@ -20933,7 +21672,7 @@ async function handleRun(args) {
     process.exit(EXIT_CODES.SERVER_START_FAILED);
   }
   const runner = createScenarioRunner();
-  const fixturePath = join19(FIXTURES_DIR, `${name}${SCENARIO_SUFFIX}`);
+  const fixturePath = join18(FIXTURES_DIR, `${name}${SCENARIO_SUFFIX}`);
   try {
     const fixture = await runner.loadFixture(fixturePath);
     const result = await runner.run(fixture);
@@ -21094,6 +21833,67 @@ function handleHealthCommand(args) {
   }
 }
 
+// src/cli/validate-command.ts
+var MIN_FITNESS_SCORE = 90;
+function evaluateDoctor(doctor) {
+  const installedCount = doctor.clis.filter((c) => c.installed).length;
+  const total = doctor.clis.length;
+  const summary = doctor.allHealthy ? `All systems healthy (${String(installedCount)}/${String(total)} CLIs installed)` : `Issues detected (${String(installedCount)}/${String(total)} CLIs installed)`;
+  return { name: "Doctor", passed: doctor.allHealthy, summary };
+}
+function evaluateFitness(audit) {
+  const passed = audit.score >= MIN_FITNESS_SCORE;
+  const summary = `Score ${String(audit.score)}/100 (minimum: ${String(MIN_FITNESS_SCORE)})`;
+  return { name: "Fitness Audit", passed, summary };
+}
+function evaluateConfig(doctor) {
+  const found = doctor.configFile.found;
+  const summary = found ? `Config found: ${doctor.configFile.path ?? "unknown"}` : "No nexus-agents.yaml found (optional)";
+  return { name: "Config", passed: true, summary };
+}
+function printReport2(result) {
+  writeLine();
+  writeLine(`${colors.bold}nexus-agents validate${colors.reset}`);
+  writeLine("\u2500".repeat(50));
+  writeLine();
+  for (const phase of result.phases) {
+    const icon = phase.passed ? `${colors.green}${symbols.check}${colors.reset}` : `${colors.red}${symbols.cross}${colors.reset}`;
+    writeLine(`  ${icon} ${colors.bold}${phase.name}${colors.reset}: ${phase.summary}`);
+  }
+  writeLine();
+  if (result.allPassed) {
+    writeLine(`${colors.green}${colors.bold}PASS${colors.reset}: All validation checks passed.`);
+  } else {
+    writeLine(
+      `${colors.red}${colors.bold}FAIL${colors.reset}: One or more validation checks failed.`
+    );
+  }
+  writeLine();
+}
+async function runValidate() {
+  const doctor = await runDoctor();
+  const audit = calculateFitnessScore(`v${VERSION}`);
+  const phases = [
+    evaluateDoctor(doctor),
+    evaluateFitness(audit),
+    evaluateConfig(doctor)
+  ];
+  return {
+    phases,
+    allPassed: phases.every((p) => p.passed)
+  };
+}
+async function handleValidateCommand(args) {
+  const result = await runValidate();
+  const isJson = args.options.format === "json";
+  if (isJson) {
+    writeLine(JSON.stringify(result, null, 2));
+  } else {
+    printReport2(result);
+  }
+  process.exit(result.allPassed ? 0 : 1);
+}
+
 // src/cli-commands.ts
 function printHelp() {
   process.stdout.write(HELP_TEXT + "\n");
@@ -21175,7 +21975,9 @@ var ASYNC_COMMAND_HANDLERS = {
   // Issue #748: Memory Benchmark Command
   "memory-benchmark": handleMemoryBenchmarkCommand,
   // Epic #952: Scenario Command
-  scenario: handleScenarioCommand
+  scenario: handleScenarioCommand,
+  // Issue #1598: Validate Command
+  validate: handleValidateCommand
 };
 async function handleAsyncCommand(args) {
   const handler = ASYNC_COMMAND_HANDLERS[args.command];