nexus-agents 2.29.0 → 2.29.2

package/dist/cli.js

@@ -1,9 +1,4 @@
 #!/usr/bin/env node
-import "./chunk-HWDBNDUX.js";
-import {
-  setupCommandAsync
-} from "./chunk-HH5LVGEE.js";
-import "./chunk-WSK4VSXP.js";
 import {
   calculateConsensus,
   countByCategory,
@@ -17,6 +12,11 @@ import {
   parseFindings,
   sumFindings
 } from "./chunk-6E3NMMEY.js";
+import "./chunk-63AJLNKU.js";
+import {
+  setupCommandAsync
+} from "./chunk-Z4OZ25VS.js";
+import "./chunk-V6MSPUQF.js";
 import {
   AuthHandler,
   CustomExpertDefinitionSchema,
@@ -38,7 +38,6 @@ import {
   adaptRoutingConfig,
   addResearchPaper,
   analyzeTools,
-  classifyTrust,
   createAgentStages,
   createAnnotationsProxy,
   createAuditLogger,
@@ -48,7 +47,6 @@ import {
   createEventBusBridge,
   createExecutor,
   createFeedbackIntegration,
-  createFullGitHubProvider,
   createGatewayServerProxy,
   createHarnessExecutor,
   createLearnablePolicy,
@@ -73,7 +71,6 @@ import {
   discoverOpenAlex,
   discoverPapersWithCode,
   discoverSemanticScholar,
-  evaluatePolicy2 as evaluatePolicy,
   findOverlaps,
   flushPipelineMemory,
   formatOverlapResult,
@@ -108,11 +105,8 @@ import {
   loadAllExternalPacks,
   loadConfig,
   loadDataset,
-  loadPapersRegistry,
   loadSourcesRegistry,
-  loadTechniquesRegistry,
   loadWorkflowFile,
-  parsePRUrl,
   rankDiscoveredItems,
   readStoredToken,
   registerCreateExpertTool,
@@ -127,6 +121,7 @@ import {
   registerMemoryStatsTool,
   registerMemoryWriteTool,
   registerOrchestrateTool,
+  registerPipelineTool,
   registerPrompts,
   registerQueryTraceTool,
   registerRegistryImportTool,
@@ -148,29 +143,23 @@ import {
   resolveV2Config,
   runBenchmarkInstances,
   runDevPipeline,
-  sanitizeInput,
-  savePapersRegistry,
   saveSourcesRegistry,
   setGlobalToolRateLimiterFactory,
-  synthesizeResearch,
   validateArgs,
   validateCommand,
   validateNexusEnv,
   validateWorkflow,
   wrapInMarkdownFence
-} from "./chunk-DAMRMAM2.js";
+} from "./chunk-QSNAFOE6.js";
 import {
-  VERSION,
-  closeServer,
-  connectTransport,
-  createServer,
-  doctorCommand,
-  initDataDirectories,
-  runDoctor
-} from "./chunk-5VZLXMO7.js";
+  resolveToken
+} from "./chunk-VZ2YOQWU.js";
+import {
+  CATEGORY_DISPLAY_NAMES,
+  DEFAULT_PR_REVIEW_CONFIG
+} from "./chunk-X2M7OF27.js";
 import {
   DEFAULT_VOTE_TIMEOUT_MS,
-  MemoryError,
   THRESHOLD_MAP,
   VOTER_ROLES,
   collectRealVotes,
@@ -180,26 +169,56 @@ import {
   registerConsensusVoteTool,
   shutdownToolMemory,
   validateTimeout
-} from "./chunk-S3BKWNST.js";
+} from "./chunk-J245RJGW.js";
+import {
+  loadPapersRegistry,
+  loadTechniquesRegistry,
+  savePapersRegistry,
+  synthesizeResearch
+} from "./chunk-GX436VRU.js";
+import {
+  classifyTrust,
+  createFullGitHubProvider,
+  evaluatePolicy,
+  parsePRUrl,
+  sanitizeInput
+} from "./chunk-5COIDGQJ.js";
+import "./chunk-EPMBGZQX.js";
+import "./chunk-TL2GJMJ5.js";
+import "./chunk-BC3M4VLP.js";
+import "./chunk-AP2FD37C.js";
+import "./chunk-BQ4YXGGQ.js";
+import "./chunk-ED6VQWNG.js";
+import {
+  BUILT_IN_EXPERTS
+} from "./chunk-LDIN2PLV.js";
+import {
+  VERSION,
+  closeServer,
+  connectTransport,
+  createServer,
+  doctorCommand,
+  initDataDirectories,
+  runDoctor
+} from "./chunk-WSYJN7BI.js";
+import "./chunk-KQIDTE52.js";
+import {
+  MemoryError
+} from "./chunk-DDQGAVQA.js";
 import {
   capitalize,
   capitalizeKebab,
   truncateSentence
 } from "./chunk-633WH2ML.js";
-import "./chunk-I6YDS23R.js";
-import "./chunk-KGDG6PWZ.js";
-import {
-  resolveToken
-} from "./chunk-7F6HYUIY.js";
-import {
-  CATEGORY_DISPLAY_NAMES,
-  DEFAULT_PR_REVIEW_CONFIG
-} from "./chunk-X2M7OF27.js";
+import "./chunk-LKDHAJJB.js";
+import "./chunk-66NNHMVB.js";
+import "./chunk-QGODFK36.js";
 import {
   createAllAdapters,
   getAvailableClis,
   isRecord
-} from "./chunk-ZBZJHXRT.js";
+} from "./chunk-CW2Z773T.js";
+import "./chunk-Y477EGI4.js";
 import {
   API_TIMEOUTS,
   AgentCapability,
@@ -260,11 +279,8 @@ import {
   toError,
   writeEmptyLine,
   writeLine
-} from "./chunk-IMWYKX4H.js";
+} from "./chunk-HSOPD265.js";
 import "./chunk-CLYZ7FWP.js";
-import {
-  BUILT_IN_EXPERTS
-} from "./chunk-POBO4G2P.js";
 import "./chunk-UP2VWCW5.js";
 
 // src/cli.ts
@@ -437,7 +453,9 @@ logging:
   format: json
 
   # Destination: stdout, stderr, file
-  destination: stdout
+  # NOTE: stdout is unsafe when running as an MCP stdio server (corrupts
+  # JSON-RPC frames). Keep stderr unless you have a specific need.
+  destination: stderr
 
   # Log file path (required if destination is 'file')
   # filePath: ./logs/nexus-agents.log
@@ -14137,10 +14155,10 @@ var CATEGORY_ORDER = [
 ];
 
 // src/cli/release-notes-helpers.ts
-import { execSync as execSync2 } from "child_process";
+import { execFileSync } from "child_process";
 function getLatestTag() {
   try {
-    const result = execSync2("git describe --tags --abbrev=0", {
+    const result = execFileSync("git", ["describe", "--tags", "--abbrev=0"], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
       timeout: CLI_SUBPROCESS_TIMEOUTS.ghCommandMs
@@ -14151,8 +14169,12 @@ function getLatestTag() {
   }
 }
 function getCommitsBetween(from, to = "HEAD") {
+  const SAFE_REF = /^[a-zA-Z0-9._\-/~^]+$/;
+  if (!SAFE_REF.test(from) || !SAFE_REF.test(to)) {
+    return [];
+  }
   try {
-    const result = execSync2(`git log ${from}..${to} --oneline --format="%h %s"`, {
+    const result = execFileSync("git", ["log", `${from}..${to}`, "--oneline", "--format=%h %s"], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
       timeout: CLI_SUBPROCESS_TIMEOUTS.ghCommandMs
@@ -14402,13 +14424,13 @@ async function releaseNotesCommand(args) {
 import { readFileSync as readFileSync8 } from "fs";
 
 // src/cli/release-validate-helpers.ts
-import { execSync as execSync3 } from "child_process";
+import { execSync as execSync2 } from "child_process";
 import { existsSync as existsSync13, readFileSync as readFileSync7 } from "fs";
 async function validateSecurity(options) {
   const startTime = Date.now();
   const findings = [];
   try {
-    execSync3("npm audit --audit-level=high 2>/dev/null", {
+    execSync2("npm audit --audit-level=high 2>/dev/null", {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
       timeout: CLI_SUBPROCESS_TIMEOUTS.ghCommandMs
@@ -14432,7 +14454,7 @@ async function validateSecurity(options) {
     });
   }
   try {
-    const result = execSync3(
+    const result = execSync2(
       'git diff HEAD~10..HEAD -- "*.ts" "*.js" | grep -iE "(api[_-]?key|secret|password|token)" | head -5',
       {
         encoding: "utf-8",
@@ -14463,7 +14485,7 @@ async function validateArchitecture2(options) {
   const startTime = Date.now();
   const findings = [];
   try {
-    const result = execSync3("npx nexus-agents fitness-audit --format=json 2>/dev/null", {
+    const result = execSync2("npx nexus-agents fitness-audit --format=json 2>/dev/null", {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
       timeout: CLI_SUBPROCESS_TIMEOUTS.releaseValidateMs
@@ -14584,7 +14606,7 @@ async function validateDevOps(options) {
   const startTime = Date.now();
   const findings = [];
   try {
-    execSync3("pnpm build 2>/dev/null", {
+    execSync2("pnpm build 2>/dev/null", {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
       timeout: CLI_SUBPROCESS_TIMEOUTS.releaseValidateMs
@@ -14605,7 +14627,7 @@ async function validateDevOps(options) {
     });
   }
   try {
-    execSync3("pnpm lint 2>/dev/null", {
+    execSync2("pnpm lint 2>/dev/null", {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
       timeout: CLI_SUBPROCESS_TIMEOUTS.releaseBuildMs
@@ -14626,7 +14648,7 @@ async function validateDevOps(options) {
     });
   }
   try {
-    execSync3("pnpm typecheck 2>/dev/null", {
+    execSync2("pnpm typecheck 2>/dev/null", {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
       timeout: CLI_SUBPROCESS_TIMEOUTS.releaseValidateMs
@@ -14802,7 +14824,7 @@ function getBlueskyConfig() {
 }
 async function loadAtproto() {
   try {
-    const mod = await import("./dist-7PQR2BQB.js");
+    const mod = await import("./dist-CV74KUT7.js");
     return { AtpAgent: mod.AtpAgent, RichText: mod.RichText };
   } catch {
     return void 0;
@@ -15558,8 +15580,18 @@ var LATENCY_RANGES = {
   secondary: { min: 3e3, max: 8e3 },
   other: { min: 5e3, max: 15e3 }
 };
-function pickCategory() {
-  const roll = Math.random();
+function createRng(seed) {
+  if (seed === void 0) return Math.random;
+  let s = seed | 0;
+  return () => {
+    s = s + 1831565813 | 0;
+    let t = Math.imul(s ^ s >>> 15, 1 | s);
+    t = t + Math.imul(t ^ t >>> 7, 61 | t) ^ t;
+    return ((t ^ t >>> 14) >>> 0) / 4294967296;
+  };
+}
+function pickCategory(rng) {
+  const roll = rng();
   let cumulative = 0;
   for (const [category, weight] of DEFAULT_TASK_DISTRIBUTION) {
     cumulative += weight;
@@ -15567,12 +15599,12 @@ function pickCategory() {
   }
   return "code_generation";
 }
-function pickCli(category) {
+function pickCli(category, rng) {
   const primary = PRIMARY_CLI.get(category) ?? "claude";
-  const roll = Math.random();
+  const roll = rng();
   if (roll < 0.5) return primary;
   if (roll < 0.75) return CLI_NAMES3.find((c) => c !== primary) ?? "gemini";
-  return CLI_NAMES3[Math.floor(Math.random() * CLI_NAMES3.length)] ?? "claude";
+  return CLI_NAMES3[Math.floor(rng() * CLI_NAMES3.length)] ?? "claude";
 }
 function getCliRole(cli, category) {
   const primary = PRIMARY_CLI.get(category);
@@ -15591,12 +15623,12 @@ function getCliRole(cli, category) {
   ]);
   return cli === secondaryMap.get(category) ? "secondary" : "other";
 }
-function simulateTask(taskIndex, category, cli) {
+function simulateTask(taskIndex, category, cli, rng) {
   const role = getCliRole(cli, category);
   const successRate = SUCCESS_RATES[role];
   const latency = LATENCY_RANGES[role];
-  const success = Math.random() < successRate;
-  const durationMs = latency.min + Math.random() * (latency.max - latency.min);
+  const success = rng() < successRate;
+  const durationMs = latency.min + rng() * (latency.max - latency.min);
   return {
     id: `e2e-${String(taskIndex)}-${cli}-${category}`,
     cli,
@@ -15609,7 +15641,7 @@ function simulateTask(taskIndex, category, cli) {
     source: "manual"
   };
 }
-function generateOutcomes(taskCount) {
+function generateOutcomes(taskCount, rng) {
   const store = getOutcomeStore();
   const success = /* @__PURE__ */ new Map();
   const total = /* @__PURE__ */ new Map();
@@ -15618,9 +15650,9 @@ function generateOutcomes(taskCount) {
     total.set(cli, 0);
   }
   for (let i = 0; i < taskCount; i++) {
-    const category = pickCategory();
-    const cli = pickCli(category);
-    const outcome = simulateTask(i, category, cli);
+    const category = pickCategory(rng);
+    const cli = pickCli(category, rng);
+    const outcome = simulateTask(i, category, cli, rng);
     store.append(outcome);
     total.set(cli, (total.get(cli) ?? 0) + 1);
     if (outcome.success) success.set(cli, (success.get(cli) ?? 0) + 1);
@@ -15671,7 +15703,8 @@ function runE2EEval(config, logger17) {
     resetOutcomeStore();
     setOutcomeStore(new OutcomeStore());
   }
-  const counts = generateOutcomes(taskCount);
+  const rng = createRng(config?.seed);
+  const counts = generateOutcomes(taskCount, rng);
   log.info("E2E eval: outcomes recorded", { taskCount });
   const { bonuses, nonZeroCount } = checkAdaptiveBonuses();
   const convergenceScore = computeConvergence(counts, nonZeroCount);
@@ -16935,6 +16968,19 @@ var DevPipelineInputSchema = z7.object({
   sessionId: z7.string().max(128).regex(/^[a-zA-Z0-9_-]+$/).optional().describe("Session ID for checkpoint/resume (crash recovery)"),
   /** When true, use simulated votes instead of real CLI consensus (for testing). */
   simulateVotes: z7.boolean().default(false).describe("Use simulated votes (for testing without real CLIs)"),
+  /** Voting strategy for consensus stages. */
+  votingStrategy: z7.enum([
+    "simple_majority",
+    "supermajority",
+    "unanimous",
+    "higher_order",
+    "proof_of_learning",
+    "opinion_wise"
+  ]).optional().describe("Voting strategy for plan approval (default: higher_order)"),
+  /** Use 3 agents instead of 6 for faster voting. */
+  quickMode: z7.boolean().default(false).describe("Use 3 agents instead of 6 for faster consensus voting"),
+  /** Maximum execution time per stage in milliseconds (min 30s, max 600s). */
+  timeoutMs: z7.number().int().min(3e4).max(6e5).optional().describe("Max time per stage in ms (30000-600000). Default: varies by stage complexity"),
   /** Pipeline execution mode. */
   mode: z7.enum(["autonomous", "harness"]).default("autonomous").describe(
     "'autonomous': full pipeline. 'harness': stops after decompose, returns tasks for caller to implement."
@@ -16946,6 +16992,10 @@ function resolveTaskInput(input) {
   }
   if (input.planFile !== void 0) {
     const resolved = path21.resolve(input.planFile);
+    const cwdRoot = path21.resolve(".");
+    if (!resolved.startsWith(cwdRoot)) {
+      throw new Error(`Path traversal denied: planFile must be within ${cwdRoot}`);
+    }
     if (!fs17.existsSync(resolved)) {
       throw new Error(`Plan file not found: ${resolved}`);
     }
@@ -16960,6 +17010,8 @@ async function createStages(input) {
   return createAgentStages({
     scanTarget: input.workingDir,
     simulateVotes: input.simulateVotes,
+    votingStrategy: input.votingStrategy,
+    quickMode: input.quickMode,
     issueNumber: input.issueNumber,
     repo: input.repo,
     tracker
@@ -17681,7 +17733,8 @@ var STANDALONE_TOOLS = [
   { name: "query_trace", register: registerQueryTraceTool },
   { name: "extract_symbols", register: registerExtractSymbolsTool },
   { name: "search_codebase", register: registerSearchCodebaseTool },
-  { name: "run_dev_pipeline", register: registerDevPipelineTool }
+  { name: "run_dev_pipeline", register: registerDevPipelineTool },
+  { name: "run_pipeline", register: registerPipelineTool }
 ];
 function registerToolCategories(ctx) {
   const allowlist = ctx.toolAllowlist;
@@ -19275,6 +19328,8 @@ async function initializeAndLogSandbox(logger17, sandboxConfig) {
   });
 }
 async function connectToStdioTransport(server, logger17, serverLogger) {
+  logger17.setDestination?.("stderr");
+  serverLogger.setDestination?.("stderr");
   logger17.info("Connecting to stdio transport");
   const transport = new StdioServerTransport();
   const connectResult = await connectTransport(server, transport, serverLogger);
@@ -19797,7 +19852,7 @@ async function handleVerifyCommand(args) {
 async function handleDoctorCommand(args) {
   const exitCode = await doctorCommand({ fix: args.options.fix });
   if (args.options.deep) {
-    const { runDeepDiagnostics: runDeepDiagnostics2, formatDeepDiagnostics: formatDeepDiagnostics2 } = await import("./doctor-deep-AWE7SRU6.js");
+    const { runDeepDiagnostics: runDeepDiagnostics2, formatDeepDiagnostics: formatDeepDiagnostics2 } = await import("./doctor-deep-4A4X5X6U.js");
     const diag = runDeepDiagnostics2();
     process.stdout.write(formatDeepDiagnostics2(diag) + "\n");
   }
@@ -21144,7 +21199,7 @@ async function handleMemoryBenchmarkCommand(args) {
 }
 
 // src/cli/status-command.ts
-import { execFileSync } from "child_process";
+import { execFileSync as execFileSync2 } from "child_process";
 var FITNESS_TARGET = 90;
 var API_ADAPTER_CHECKS = [
   { name: "Claude", envVar: "ANTHROPIC_API_KEY" },
@@ -21166,7 +21221,7 @@ function checkApiAdapters() {
 function detectCliTools() {
   return CLI_TOOL_CHECKS.map((check) => {
     try {
-      const version = execFileSync(check.binary, ["--version"], {
+      const version = execFileSync2(check.binary, ["--version"], {
         timeout: CLI_SUBPROCESS_TIMEOUTS.statusProbeMs,
         stdio: ["ignore", "pipe", "ignore"],
         encoding: "utf-8"