nexus-agents 2.55.1 → 2.56.0

package/dist/chunk-C3FGEDD7.js

@@ -0,0 +1,2520 @@
+import {
+  resolveInsideRoot
+} from "./chunk-NUBSJGQZ.js";
+import {
+  capitalize
+} from "./chunk-633WH2ML.js";
+import {
+  createAllAdapters
+} from "./chunk-RSUCXOQM.js";
+import {
+  API_TIMEOUTS,
+  CLI_TIMEOUTS,
+  CliNameSchema,
+  DEFAULT_CAPABILITIES,
+  DEFAULT_COMPOSITE_CONFIG,
+  DEFAULT_MODEL_CAPABILITIES,
+  DEFAULT_MODEL_PER_CLI,
+  DEFAULT_ZERO_ROUTER_CONFIG,
+  INTERNAL_TIMEOUTS,
+  MCP_TIMEOUTS,
+  TEST_TIMEOUTS,
+  WORKFLOW_TIMEOUTS,
+  colors,
+  createLogger,
+  err,
+  formatZodIssuesAsArray,
+  getErrorMessage,
+  getTimeProvider,
+  ok,
+  symbols,
+  writeLine
+} from "./chunk-UOUJZIKH.js";
+import {
+  LEARNING_DIR,
+  OUTCOMES_FILE,
+  RULES_FILE,
+  isPersistenceEnabled
+} from "./chunk-CLYZ7FWP.js";
+
+// src/version.ts
+var VERSION = true ? "2.56.0" : "dev";
+
+// src/config/schemas-core.ts
+import { z } from "zod";
+var LoggingConfigSchema = z.object({
+  level: z.enum(["debug", "info", "warn", "error"]).default("info"),
+  format: z.enum(["json", "pretty"]).default("json"),
+  // Default to stderr: MCP stdio transport reserves stdout for JSON-RPC frames.
+  destination: z.enum(["stdout", "stderr", "file"]).default("stderr"),
+  filePath: z.string().optional()
+});
+var ProviderConfigSchema = z.object({
+  apiKey: z.string().optional(),
+  baseUrl: z.url().optional(),
+  timeout: z.number().positive().default(3e4),
+  maxRetries: z.number().nonnegative().default(3)
+});
+var ModelTiersSchema = z.object({
+  fast: z.array(z.string()).min(1),
+  balanced: z.array(z.string()).min(1),
+  powerful: z.array(z.string()).min(1)
+});
+var ModelConfigSchema = z.object({
+  default: z.string(),
+  tiers: ModelTiersSchema,
+  providers: z.record(z.string(), ProviderConfigSchema).optional()
+});
+var WorkflowConfigSchema = z.object({
+  templatesDir: z.string().default("./workflows"),
+  timeout: z.number().positive().default(3e5),
+  maxParallel: z.number().positive().default(5)
+});
+
+// src/config/schemas-expert.ts
+import { z as z2 } from "zod";
+var VALID_EXPERT_TIERS = ["fast", "balanced", "powerful"];
+var VALID_EXPERT_DOMAINS = [
+  "code",
+  "security",
+  "architecture",
+  "documentation",
+  "testing",
+  "general"
+];
+var MAX_SYSTEM_PROMPT_LENGTH = 4e3;
+var CustomExpertDefinitionSchema = z2.object({
+  /** System prompt defining the expert's persona (max 4000 characters) */
+  systemPrompt: z2.string().min(1, "System prompt is required").max(
+    MAX_SYSTEM_PROMPT_LENGTH,
+    `System prompt must be at most ${String(MAX_SYSTEM_PROMPT_LENGTH)} characters`
+  ),
+  /** Model tier for routing */
+  tier: z2.enum(VALID_EXPERT_TIERS, {
+    error: `Invalid tier. Valid options: ${VALID_EXPERT_TIERS.join(", ")}`
+  }).default("balanced"),
+  /** Primary domain of expertise */
+  domain: z2.enum(VALID_EXPERT_DOMAINS, {
+    error: `Invalid domain. Valid options: ${VALID_EXPERT_DOMAINS.join(", ")}`
+  }).default("general"),
+  /** Secondary domains (optional) */
+  secondaryDomains: z2.array(z2.enum(VALID_EXPERT_DOMAINS)).optional(),
+  /** Expert capabilities */
+  capabilities: z2.array(z2.string().min(1)).min(1, "At least one capability is required").default(["task_execution"]),
+  /** Model temperature (0-1) */
+  temperature: z2.number().min(0).max(1).default(0.3),
+  /** Allowed tools (optional, unrestricted if not specified) */
+  tools: z2.array(z2.string()).optional(),
+  /** Human-readable description */
+  description: z2.string().optional(),
+  /** Weight for expert selection scoring (0-1) */
+  weight: z2.number().min(0).max(1).default(1),
+  /** Whether this expert is currently available */
+  available: z2.boolean().default(true)
+});
+var ExpertDefinitionSchema = z2.object({
+  prompt: z2.string().min(1),
+  tier: z2.enum(["fast", "balanced", "powerful"]).default("balanced"),
+  temperature: z2.number().min(0).max(1).default(0.3),
+  tools: z2.array(z2.string()).optional()
+});
+var ExpertConfigSchema = z2.object({
+  /** Enable built-in experts */
+  builtin: z2.boolean().default(true),
+  /** Custom expert definitions keyed by expert ID */
+  custom: z2.record(
+    z2.string().regex(/^[a-z][a-z0-9_]*$/, {
+      message: "Expert ID must start with a letter and contain only lowercase letters, numbers, and underscores"
+    }),
+    CustomExpertDefinitionSchema
+  ).optional()
+});
+
+// src/config/schemas-security.ts
+import { z as z3 } from "zod";
+var PolicyConfigSchema = z3.object({
+  /** Default execution mode for tool operations (default: 'read-only') */
+  defaultMode: z3.enum(["read-only", "read-write"]).default("read-only"),
+  /** Policy enforcement mode (default: 'enforce') */
+  policyMode: z3.enum(["enforce", "warn"]).default("enforce")
+});
+var SandboxConfigSchema = z3.object({
+  /** Sandbox execution mode (default: 'policy') */
+  mode: z3.enum(["none", "policy", "container"]).default("policy"),
+  /** Fall back to policy mode if container mode unavailable (default: true) */
+  fallbackToPolicy: z3.boolean().default(true),
+  /** Docker image to use in container mode (default: 'node:22-alpine') */
+  dockerImage: z3.string().optional(),
+  /** Enable network access in container mode (default: false) */
+  networkEnabled: z3.boolean().default(false)
+});
+var TimeoutConfigSchema = z3.object({
+  /** Default timeout in milliseconds (default: 30000) */
+  defaultTimeoutMs: z3.number().positive().default(3e4),
+  /** Maximum timeout in milliseconds (default: 300000) */
+  maxTimeoutMs: z3.number().positive().default(3e5),
+  /** Whether to log timeout events (default: true) */
+  enableLogging: z3.boolean().default(true),
+  /** Enable URI validation to prevent ReDoS (default: true) */
+  uriValidation: z3.boolean().default(true),
+  /** Per-tool timeout overrides in milliseconds (Issue #657) */
+  perToolTimeout: z3.record(z3.string(), z3.number().positive().max(6e5)).optional()
+});
+var ToolRateLimitSchema = z3.object({
+  /** Maximum tokens (burst capacity) */
+  capacity: z3.number().positive().default(10),
+  /** Tokens refilled per interval */
+  refillRate: z3.number().positive().default(10),
+  /** Refill interval in milliseconds (default: 60000 = 1 minute) */
+  refillIntervalMs: z3.number().positive().default(6e4)
+});
+var DEFAULT_TOOL_RATE_LIMITS = {
+  orchestrate: { capacity: 10, refillRate: 10, refillIntervalMs: 6e4 },
+  delegate: { capacity: 20, refillRate: 20, refillIntervalMs: 6e4 },
+  workflow: { capacity: 5, refillRate: 5, refillIntervalMs: 6e4 },
+  expert: { capacity: 30, refillRate: 30, refillIntervalMs: 6e4 }
+};
+var SecurityConfigSchema = z3.object({
+  allowedPaths: z3.array(z3.string()).default(["./"]),
+  blockedPatterns: z3.array(z3.string()).default([]),
+  rateLimit: z3.object({
+    enabled: z3.boolean().default(true),
+    requestsPerMinute: z3.number().positive().default(60),
+    /** Per-tool rate limits (Issue #274 Phase 2) */
+    perTool: z3.record(z3.string(), ToolRateLimitSchema).optional()
+  }).default(() => ({ enabled: true, requestsPerMinute: 60 })),
+  secretsFile: z3.string().optional(),
+  /** Policy firewall configuration */
+  policy: PolicyConfigSchema.optional(),
+  /** Sandbox execution configuration (Issue #175) */
+  sandbox: SandboxConfigSchema.optional(),
+  /** Timeout configuration (Issue #271, CVE-2026-0621) */
+  timeout: TimeoutConfigSchema.optional(),
+  /** Tool allowlist — when set, only listed tools are registered (Issue #740) */
+  toolAllowlist: z3.array(z3.string()).optional(),
+  /** Audit logging configuration (Issue #740 Phase 2) */
+  audit: z3.object({
+    /** Enable audit logging (default: true) */
+    enabled: z3.boolean().default(true),
+    /** Log directory (default: ~/.nexus-agents/audit) */
+    logDir: z3.string().optional(),
+    /** Minimum severity to log (default: 'info') */
+    minSeverity: z3.enum(["info", "warning", "critical"]).default("info"),
+    /** Enable tamper-evident hash chain (default: true) */
+    enableHashChain: z3.boolean().default(true),
+    /** Maximum log file size in bytes (default: 10MB) */
+    maxFileSizeBytes: z3.number().positive().default(10 * 1024 * 1024),
+    /** Maximum number of log files to retain (default: 10) */
+    maxFiles: z3.number().positive().default(10)
+  }).optional(),
+  /** Authentication configuration (Issue #739) */
+  auth: z3.object({
+    /** Enable authentication for network-exposed transports (default: true) */
+    enabled: z3.boolean().default(true),
+    /** Authentication method (default: 'token') */
+    method: z3.enum(["token", "oauth2"]).default("token"),
+    /** Header name for bearer token (default: 'Authorization') */
+    tokenHeader: z3.string().default("Authorization"),
+    /** Token file path (default: ~/.nexus-agents/auth/server-token) */
+    tokenFile: z3.string().optional()
+  }).optional()
+});
+
+// src/config/schemas.ts
+import { z as z9 } from "zod";
+
+// src/config/schemas-observability.ts
+import { z as z4 } from "zod";
+var EventBusConfigSchema = z4.object({
+  /** Enable EventBus integration (default: true) */
+  enabled: z4.boolean().default(true),
+  /** Maximum events to retain in history (default: 1000) */
+  maxHistorySize: z4.number().positive().default(1e3),
+  /** Event patterns to subscribe to (default: all major patterns) */
+  subscriptions: z4.object({
+    /** Subscribe to consensus events (consensus.*) */
+    consensus: z4.boolean().default(true),
+    /** Subscribe to agent events (agent.*) */
+    agent: z4.boolean().default(true),
+    /** Subscribe to protocol events (protocol.*) */
+    protocol: z4.boolean().default(true),
+    /** Subscribe to session events (session.*) */
+    session: z4.boolean().default(true),
+    /** Subscribe to message events (message.*) */
+    message: z4.boolean().default(false),
+    // Off by default (high volume)
+    /** Subscribe to byzantine detection events (byzantine.*) */
+    byzantine: z4.boolean().default(true)
+  }).default(() => ({
+    consensus: true,
+    agent: true,
+    protocol: true,
+    session: true,
+    message: false,
+    byzantine: true
+  })),
+  /** Logging configuration for events */
+  logging: z4.object({
+    /** Log level for frequent events (default: debug) */
+    frequentEventLevel: z4.enum(["debug", "info"]).default("debug"),
+    /** Log level for important events (default: info) */
+    importantEventLevel: z4.enum(["debug", "info"]).default("info")
+  }).default(() => ({
+    frequentEventLevel: "debug",
+    importantEventLevel: "info"
+  }))
+});
+var ObservabilityConfigSchema = z4.object({
+  /** EventBus configuration */
+  eventBus: EventBusConfigSchema.optional(),
+  /** SwarmObserver maximum events (default: 10000) */
+  swarmObserverMaxEvents: z4.number().positive().default(1e4)
+});
+
+// src/config/schemas-skills.ts
+import { z as z5 } from "zod";
+var ExternalPackSourceSchema = z5.object({
+  /** Pack name for identification */
+  name: z5.string().min(1),
+  /** Source: npm package name or local file path */
+  source: z5.string().min(1),
+  /** Whether the pack is enabled (default: true) */
+  enabled: z5.boolean().default(true)
+});
+var SkillLibraryConfigSchema = z5.object({
+  /** Whether skill library is enabled (default: true) */
+  enabled: z5.boolean().default(true),
+  /** Maximum skills to store (default: 1000) */
+  maxSkills: z5.number().int().positive().default(1e3),
+  /** Minimum success rate to keep skill (0-1, default: 0.3) */
+  minSuccessRateForRetention: z5.number().min(0).max(1).default(0.3),
+  /** Number of executions before evaluating retention (default: 5) */
+  executionsBeforeEvaluation: z5.number().int().nonnegative().default(5),
+  /** Enable automatic skill pruning (default: true) */
+  enablePruning: z5.boolean().default(true),
+  /** Whether to track detailed execution history (default: true) */
+  trackExecutionHistory: z5.boolean().default(true),
+  /** Maximum execution history entries per skill (default: 100) */
+  maxHistoryPerSkill: z5.number().int().positive().default(100),
+  /** External skill pack sources (Issue #654) */
+  externalPacks: z5.array(ExternalPackSourceSchema).optional()
+});
+
+// src/config/schemas-sica.ts
+import { z as z6 } from "zod";
+var SicaConfigSchema = z6.object({
+  /** Whether SICA wrapping is enabled (default: false) */
+  enabled: z6.boolean().default(false),
+  /** Minimum executions before considering improvement (default: 10) */
+  minExecutionsForImprovement: z6.number().int().positive().default(10),
+  /** Success rate threshold to trigger improvement (0-1, default: 0.7) */
+  improvementThreshold: z6.number().min(0).max(1).default(0.7),
+  /** Maximum concurrent versions to evaluate (default: 3) */
+  maxActiveVersions: z6.number().int().positive().max(10).default(3),
+  /** Whether to auto-select best version (default: true) */
+  autoSelectBest: z6.boolean().default(true),
+  /** Improvement cooldown in milliseconds (default: 60000) */
+  improvementCooldownMs: z6.number().int().nonnegative().default(6e4),
+  /** Enable observability logging for SICA events (default: true) */
+  enableObservability: z6.boolean().default(true)
+});
+
+// src/config/schemas-gateway.ts
+import { z as z7 } from "zod";
+var TierNameSchema = z7.enum(["DIRECT", "ANALYZED", "ORCHESTRATED"]);
+var ALLOWED_COMMANDS = ["node", "npx", "python", "python3", "uvx", "docker"];
+var UpstreamServerSchema = z7.object({
+  /** Unique name for this upstream server (used as tool prefix). */
+  name: z7.string().min(1).max(50).regex(/^[a-z0-9_-]+$/),
+  /** Command to spawn the server. Must be in allowlist. */
+  command: z7.enum(ALLOWED_COMMANDS),
+  /** Arguments to pass to the command. */
+  args: z7.array(z7.string().max(500)).default([]),
+  /** Environment variables (use {env:VAR} references, not plaintext secrets). */
+  env: z7.record(z7.string(), z7.string()).optional(),
+  /** Whether to connect lazily on first tool call (default: true). */
+  lazy: z7.boolean().default(true),
+  /** Connection timeout in ms (default: 10000). */
+  timeoutMs: z7.number().int().min(1e3).max(6e4).default(1e4)
+});
+var MAX_UPSTREAM_SERVERS = 5;
+var GatewayConfigSchema = z7.object({
+  /** Enable gateway tier dispatch logging (default: true). */
+  enabled: z7.boolean().default(true),
+  /**
+   * Per-tool tier overrides.
+   * Keys are tool names (e.g., 'delegate_to_model'), values are tier names.
+   * Overrides the default tier from TOOL_TIER_MAP in tier-classifier.ts.
+   */
+  tierOverrides: z7.record(z7.string(), TierNameSchema).optional(),
+  /**
+   * Upstream MCP servers to compose with (#1498).
+   * Tools from upstream servers are available as prefixed tools (e.g., tavily.search).
+   */
+  upstreamServers: z7.array(UpstreamServerSchema).max(MAX_UPSTREAM_SERVERS).optional()
+});
+
+// src/config/schemas-routing.ts
+import { z as z8 } from "zod";
+var BudgetConstraintsSchema = z8.object({
+  /** Maximum tokens per request */
+  maxTokens: z8.number().positive().optional(),
+  /** Maximum cost per request in USD */
+  maxCostUsd: z8.number().positive().optional(),
+  /** Maximum latency per request in milliseconds */
+  maxLatencyMs: z8.number().positive().optional()
+}).optional();
+var TopsisCriterionSchema = z8.object({
+  /** Criterion name (e.g., 'quality', 'cost', 'latency') */
+  name: z8.string().min(1),
+  /** Weight for this criterion (0-1, should sum to 1 across all criteria) */
+  weight: z8.number().min(0).max(1),
+  /** Whether higher values are better (true) or lower is better (false) */
+  beneficial: z8.boolean()
+});
+var TopsisConfigSchema = z8.object({
+  /** Criteria with weights (must sum to 1.0) */
+  criteria: z8.array(TopsisCriterionSchema).optional(),
+  /** Minimum acceptable quality score (0-10) */
+  minQualityThreshold: z8.number().min(0).max(10).default(5),
+  /** Maximum acceptable latency in milliseconds (optional) */
+  maxLatencyMs: z8.number().positive().optional(),
+  /** Maximum acceptable cost per request in USD (optional) */
+  maxCostPerRequest: z8.number().positive().optional(),
+  /** Whether to log detailed scoring info */
+  verbose: z8.boolean().default(false)
+}).optional();
+var DifficultyWeightsConfigSchema = z8.object({
+  /** Weight for reasoning difficulty (0-1) */
+  reasoning: z8.number().min(0).max(1).default(0.3),
+  /** Weight for knowledge difficulty (0-1) */
+  knowledge: z8.number().min(0).max(1).default(0.15),
+  /** Weight for creativity difficulty (0-1) */
+  creativity: z8.number().min(0).max(1).default(0.15),
+  /** Weight for precision difficulty (0-1) */
+  precision: z8.number().min(0).max(1).default(0.25),
+  /** Weight for context length difficulty (0-1) */
+  context_length: z8.number().min(0).max(1).default(0.15)
+});
+var DifficultyThresholdsSchema = z8.object({
+  /** Upper bound for 'easy' classification (0-1) */
+  easyUpperBound: z8.number().min(0).max(1).default(0.3),
+  /** Lower bound for 'hard' classification (0-1) */
+  hardLowerBound: z8.number().min(0).max(1).default(0.7)
+});
+var DifficultyLevelSchema = z8.enum(["easy", "medium", "hard"]);
+var ModelTierSchema = z8.enum(["fast", "balanced", "powerful"]);
+var ZeroRouterConfigSchema = z8.object({
+  /** Difficulty thresholds for level classification */
+  thresholds: DifficultyThresholdsSchema.optional(),
+  /** Weights for difficulty aggregation */
+  weights: DifficultyWeightsConfigSchema.optional(),
+  /** Mapping from difficulty level to model tier */
+  difficultyToTier: z8.record(DifficultyLevelSchema, ModelTierSchema).optional(),
+  /** Mapping from model tier to CLI preference order */
+  tierToClis: z8.record(ModelTierSchema, z8.array(CliNameSchema)).optional(),
+  /** Enable adaptive calibration from outcomes */
+  enableCalibration: z8.boolean().default(true),
+  /** Maximum outcomes to store for calibration */
+  maxCalibrationOutcomes: z8.number().int().positive().default(1e3),
+  /** Minimum outcomes before applying calibration adjustments */
+  minCalibrationOutcomes: z8.number().int().positive().default(50),
+  /** Verbose logging */
+  verbose: z8.boolean().default(false)
+}).optional();
+var LatencyTrackerConfigSchema = z8.object({
+  /** Maximum number of samples to keep per CLI */
+  windowSize: z8.number().int().positive().default(100),
+  /** Time-weighted decay factor (0-1, higher = more weight to recent) */
+  decayFactor: z8.number().min(0).max(1).default(0.95),
+  /** Maximum age of samples in milliseconds before forced eviction */
+  maxSampleAgeMs: z8.number().int().positive().default(36e5),
+  /** Percentiles to calculate */
+  percentiles: z8.array(z8.number().min(0).max(100)).max(20).default([50, 95, 99])
+}).optional();
+var RoutingMemoryConfigSchema = z8.object({
+  /** Minimum observations before using learned routing */
+  minObservations: z8.number().int().positive().default(5),
+  /** Confidence threshold for using cached decisions */
+  confidenceThreshold: z8.number().min(0).max(1).default(0.6),
+  /** Success rate threshold for trusting a routing pattern */
+  successRateThreshold: z8.number().min(0).max(1).default(0.7),
+  /** Maximum age of cached actions in milliseconds */
+  actionCacheMaxAgeMs: z8.number().int().positive().default(36e5)
+}).optional();
+var RoutingConfigSchema = z8.object({
+  /**
+   * Pipeline stage toggles.
+   * Enable or disable individual routing stages.
+   */
+  stages: z8.object({
+    /** Enable budget filtering stage */
+    budgetFilter: z8.boolean().default(true),
+    /** Enable ZeroRouter difficulty-based routing */
+    zeroRouter: z8.boolean().default(true),
+    /** Enable preference-trained routing */
+    preferenceRouting: z8.boolean().default(false),
+    /** Enable TOPSIS ranking */
+    topsisRanking: z8.boolean().default(true),
+    /** Enable LinUCB selection */
+    linucbSelection: z8.boolean().default(true),
+    /** Enable latency tracking */
+    latencyTracking: z8.boolean().default(true),
+    /** Enable routing memory for learned routing */
+    routingMemory: z8.boolean().default(false),
+    /** Enable confidence cascade stage (Issue #755, ADR-0005) */
+    confidenceCascade: z8.boolean().default(false),
+    /** Enable capability match stage (Issue #755, ADR-0005) */
+    capabilityMatch: z8.boolean().default(false),
+    /** Enable quality constraint stage (Issue #755, ADR-0005) */
+    qualityConstraint: z8.boolean().default(false),
+    /** Enable resource strategy stage for budget-aware oscillation (Issue #998) */
+    resourceStrategy: z8.boolean().default(true),
+    /** Enable strategy distillation for learned routing rules (Issue #999) */
+    strategyDistillation: z8.boolean().default(false)
+  }).optional(),
+  /**
+   * Budget constraints for routing decisions.
+   */
+  budget: BudgetConstraintsSchema,
+  /**
+   * TOPSIS multi-criteria decision making configuration.
+   */
+  topsis: TopsisConfigSchema,
+  /**
+   * ZeroRouter difficulty-based routing configuration.
+   */
+  zeroRouter: ZeroRouterConfigSchema,
+  /**
+   * Latency tracker configuration.
+   */
+  latencyTracker: LatencyTrackerConfigSchema,
+  /**
+   * Routing memory configuration.
+   */
+  routingMemory: RoutingMemoryConfigSchema,
+  /**
+   * LinUCB bandit parameters.
+   */
+  linucb: z8.object({
+    /** Exploration parameter (higher = more exploration) */
+    alpha: z8.number().positive().default(1),
+    /** Maximum routing decision time in milliseconds */
+    maxDecisionTimeMs: z8.number().positive().default(50)
+  }).optional(),
+  /**
+   * Preference router parameters.
+   */
+  preference: z8.object({
+    /** Minimum data points before using learned preferences */
+    minDataPoints: z8.number().int().positive().default(10)
+  }).optional(),
+  /**
+   * Weight for latency score in final routing (0-1).
+   */
+  latencyScoreWeight: z8.number().min(0).max(1).default(0.2)
+});
+
+// src/config/schemas.ts
+var AppConfigSchema = z9.object({
+  models: ModelConfigSchema,
+  experts: ExpertConfigSchema.optional(),
+  workflows: WorkflowConfigSchema.optional(),
+  security: SecurityConfigSchema.optional(),
+  logging: LoggingConfigSchema.optional(),
+  /** Observability configuration (Issue #307) */
+  observability: ObservabilityConfigSchema.optional(),
+  /** Routing configuration (Issue #475) - used in orchestrator mode */
+  routing: RoutingConfigSchema.optional(),
+  /** Skill library configuration (Issue #491) */
+  skills: SkillLibraryConfigSchema.optional(),
+  /** SICA self-improvement configuration (Issue #492) */
+  sica: SicaConfigSchema.optional(),
+  /** Gateway middleware configuration (Issue #897) */
+  gateway: GatewayConfigSchema.optional()
+});
+var defaultConfig = {
+  models: {
+    default: "claude-sonnet",
+    tiers: {
+      fast: ["claude-haiku", "gemini-flash"],
+      balanced: ["claude-sonnet", "gemini-pro"],
+      powerful: ["claude-opus", "codex-5.3"]
+    }
+  },
+  logging: {
+    level: "info",
+    format: "json",
+    // stderr is the safe default: MCP stdio transport reserves stdout for
+    // JSON-RPC frames. Any log written to stdout corrupts the transport.
+    destination: "stderr"
+  },
+  security: {
+    allowedPaths: ["./"],
+    blockedPatterns: [],
+    rateLimit: {
+      enabled: true,
+      requestsPerMinute: 60
+    },
+    policy: {
+      defaultMode: "read-only",
+      policyMode: "enforce"
+    },
+    timeout: {
+      defaultTimeoutMs: 3e4,
+      maxTimeoutMs: 3e5,
+      enableLogging: true,
+      uriValidation: true
+    }
+  }
+};
+
+// src/config/env-schema.ts
+import { z as z10 } from "zod";
+var positiveIntStr = z10.string().regex(/^\d+$/, "Must be a positive integer string");
+var boolStr = z10.enum(["true", "false"]);
+var floatStr = z10.string().regex(/^\d+(\.\d+)?$/, "Must be a non-negative number string");
+var NexusEnvSchema = z10.object({
+  // --- Timeouts ---
+  NEXUS_TIMEOUT_CLI: positiveIntStr.optional(),
+  NEXUS_TIMEOUT_CLISIMPLE: positiveIntStr.optional(),
+  NEXUS_TIMEOUT_CLICOMPLEX: positiveIntStr.optional(),
+  NEXUS_TIMEOUT_API: positiveIntStr.optional(),
+  NEXUS_TIMEOUT_WORKFLOW: positiveIntStr.optional(),
+  NEXUS_TIMEOUT_MCP: positiveIntStr.optional(),
+  NEXUS_VOTE_TIMEOUT_MS: positiveIntStr.optional(),
+  NEXUS_MCP_TIMEOUT_MS: positiveIntStr.optional(),
+  NEXUS_WORKFLOW_TIMEOUT_MS: positiveIntStr.optional(),
+  NEXUS_GRAPH_TIMEOUT_MS: positiveIntStr.optional(),
+  NEXUS_TEST_TIMEOUT_MS: positiveIntStr.optional(),
+  NEXUS_EXPERT_TIMEOUT_MS: positiveIntStr.optional(),
+  NEXUS_WORKER_TIMEOUT_MS: positiveIntStr.optional(),
+  // --- Retry ---
+  NEXUS_RETRY_MAX_RETRIES: positiveIntStr.optional(),
+  NEXUS_RETRY_BASE_DELAY: positiveIntStr.optional(),
+  NEXUS_RETRY_MAX_DELAY: positiveIntStr.optional(),
+  NEXUS_RETRY_JITTER: floatStr.optional(),
+  // --- Rate Limit ---
+  NEXUS_RATE_LIMIT_ENABLED: boolStr.optional(),
+  NEXUS_RATE_LIMIT_RPM: positiveIntStr.optional(),
+  NEXUS_RATE_LIMIT_MAX_CONCURRENT: positiveIntStr.optional(),
+  NEXUS_RATE_LIMIT_CAPACITY: positiveIntStr.optional(),
+  NEXUS_RATE_LIMIT_REFILL_RATE: positiveIntStr.optional(),
+  NEXUS_RATE_LIMIT_REFILL_INTERVAL: positiveIntStr.optional(),
+  // --- Workers & Concurrency ---
+  NEXUS_MAX_CONCURRENT_EXPERTS: positiveIntStr.optional(),
+  NEXUS_WORKERS_MAX: positiveIntStr.optional(),
+  NEXUS_WORKERS_POOL_SIZE: positiveIntStr.optional(),
+  NEXUS_WORKERS_IDLE_TIMEOUT: positiveIntStr.optional(),
+  NEXUS_WORKFLOW_MAX_PARALLEL: positiveIntStr.optional(),
+  NEXUS_TEST_PARALLELISM: positiveIntStr.optional(),
+  NEXUS_EVALUATION_MAX_WORKERS: positiveIntStr.optional(),
+  NEXUS_SWARM_OBSERVER_MAX_EVENTS: positiveIntStr.optional(),
+  // --- Circuit Breaker ---
+  NEXUS_CIRCUIT_BREAKER_THRESHOLD: positiveIntStr.optional(),
+  NEXUS_CIRCUIT_BREAKER_RESET_TIMEOUT: positiveIntStr.optional(),
+  // --- V2 Pipeline ---
+  NEXUS_V2_MODE: z10.enum(["off", "partial", "full"]).optional(),
+  NEXUS_V2_DELEGATE: boolStr.optional(),
+  NEXUS_V2_ORCHESTRATE: boolStr.optional(),
+  NEXUS_V2_POLICY_MODE: z10.enum(["off", "warn", "block"]).optional(),
+  NEXUS_AORCHESTRA: boolStr.optional(),
+  NEXUS_AORCHESTRA_DISPATCH: boolStr.optional(),
+  NEXUS_WORKER_MAX_CALLS: positiveIntStr.optional(),
+  // --- Server ---
+  NEXUS_AUTH_ENABLED: boolStr.optional(),
+  NEXUS_AUTH_METHOD: z10.string().optional(),
+  // --- Logging ---
+  NEXUS_LOG_LEVEL: z10.enum(["trace", "debug", "info", "warn", "error", "fatal", "silent"]).optional(),
+  // --- Features ---
+  NEXUS_PERSIST_LEARNING: boolStr.optional(),
+  NEXUS_REFLECTIVE_MEMORY: z10.enum(["true", "false", "shadow"]).optional(),
+  NEXUS_EVENTBUS_ENABLED: boolStr.optional(),
+  NEXUS_EVENTBUS_MAX_HISTORY: positiveIntStr.optional(),
+  NEXUS_BILLING_MODE: z10.enum(["plan", "api"]).optional(),
+  NEXUS_CONFIG_PATH: z10.string().optional(),
+  NEXUS_ALLOW_MOCK_ORCHESTRATION: boolStr.optional(),
+  // --- Hooks & Sessions ---
+  NEXUS_HOOK_VERBOSE: boolStr.optional(),
+  NEXUS_SESSIONS_DB: z10.string().optional(),
+  NEXUS_DISABLE_SESSIONS: boolStr.optional(),
+  NEXUS_DISABLE_METRICS: boolStr.optional()
+});
+var KNOWN_NAMES = Object.keys(NexusEnvSchema.shape);
+function at(arr, i) {
+  return arr[i] ?? 0;
+}
+function levenshtein(a, b) {
+  const m = a.length;
+  const n = b.length;
+  let prev = Array.from({ length: n + 1 }, (_, j) => j);
+  let curr = new Array(n + 1).fill(0);
+  for (let i = 1; i <= m; i++) {
+    curr[0] = i;
+    for (let j = 1; j <= n; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      curr[j] = Math.min(at(prev, j) + 1, at(curr, j - 1) + 1, at(prev, j - 1) + cost);
+    }
+    [prev, curr] = [curr, prev];
+  }
+  return at(prev, n);
+}
+function suggestSimilar(name, known) {
+  let best = null;
+  let bestDist = 4;
+  for (const candidate of known) {
+    const dist = levenshtein(name, candidate);
+    if (dist < bestDist) {
+      bestDist = dist;
+      best = candidate;
+    }
+  }
+  return best;
+}
+function classifyEnvKeys(nexusKeys, env) {
+  const knownRecord = {};
+  const unknownVars = [];
+  for (const key of nexusKeys) {
+    if (KNOWN_NAMES.includes(key)) {
+      const value = env[key];
+      if (value !== void 0) {
+        knownRecord[key] = value;
+      }
+    } else {
+      unknownVars.push({
+        name: key,
+        suggestion: suggestSimilar(key, KNOWN_NAMES)
+      });
+    }
+  }
+  return { knownRecord, unknownVars };
+}
+function logValidationWarnings(logger2, unknownVars, invalidVars) {
+  for (const u of unknownVars) {
+    const hint = u.suggestion !== null ? ` (did you mean ${u.suggestion}?)` : "";
+    logger2.warn(`Unknown environment variable: ${u.name}${hint}`);
+  }
+  for (const inv of invalidVars) {
+    logger2.warn(`Invalid environment variable ${inv.name}="${inv.value}": ${inv.error}`);
+  }
+}
+function validateNexusEnv(logger2) {
+  const nexusKeys = Object.keys(process.env).filter((k) => k.startsWith("NEXUS_"));
+  const { knownRecord, unknownVars } = classifyEnvKeys(nexusKeys, process.env);
+  const invalidVars = [];
+  const result = NexusEnvSchema.safeParse(knownRecord);
+  if (!result.success) {
+    for (const issue of result.error.issues) {
+      const varName = String(issue.path[0]);
+      invalidVars.push({
+        name: varName,
+        value: knownRecord[varName] ?? "",
+        error: issue.message
+      });
+    }
+  }
+  if (logger2 !== void 0) {
+    logValidationWarnings(logger2, unknownVars, invalidVars);
+  }
+  return { unknownVars, invalidVars };
+}
+function getKnownNexusVarNames() {
+  return KNOWN_NAMES;
+}
+
+// src/config/model-availability.ts
+var DEFAULT_TTL_MS = 6e4;
+var DEFAULT_MAX_ENTRIES = 50;
+var AvailabilityCache = class {
+  cache = /* @__PURE__ */ new Map();
+  ttlMs;
+  maxEntries;
+  constructor(config = {}) {
+    this.ttlMs = config.ttlMs ?? DEFAULT_TTL_MS;
+    this.maxEntries = config.maxEntries ?? DEFAULT_MAX_ENTRIES;
+  }
+  /** Get a cached probe result, or undefined if expired/missing. */
+  get(modelId) {
+    const entry = this.cache.get(modelId);
+    if (entry === void 0) return void 0;
+    if (getTimeProvider().now() - entry.checkedAt > this.ttlMs) {
+      this.cache.delete(modelId);
+      return void 0;
+    }
+    return entry;
+  }
+  /** Store a probe result, evicting oldest if at capacity. */
+  set(result) {
+    if (this.cache.size >= this.maxEntries && !this.cache.has(result.modelId)) {
+      const oldest = this.cache.keys().next();
+      if (oldest.done !== true) {
+        this.cache.delete(oldest.value);
+      }
+    }
+    this.cache.set(result.modelId, result);
+  }
+  /** Mark a model as unavailable without a full probe. */
+  markUnavailable(modelId, error) {
+    this.set({
+      modelId,
+      available: false,
+      latencyMs: 0,
+      checkedAt: getTimeProvider().now(),
+      error
+    });
+  }
+  /** Mark a model as available. */
+  markAvailable(modelId, latencyMs) {
+    this.set({
+      modelId,
+      available: true,
+      latencyMs,
+      checkedAt: getTimeProvider().now()
+    });
+  }
+  /** Check if a model is known-unavailable (cached and not expired). */
+  isKnownUnavailable(modelId) {
+    const entry = this.get(modelId);
+    return entry !== void 0 && !entry.available;
+  }
+  /** Get all cached entries (for diagnostics). */
+  entries() {
+    return [...this.cache.values()];
+  }
+  /** Number of cached entries. */
+  get size() {
+    return this.cache.size;
+  }
+  /** Clear all cached entries. */
+  clear() {
+    this.cache.clear();
+  }
+};
+var FALLBACK_CHAINS = {
+  claude: ["claude-opus", "claude-sonnet", "claude-haiku"],
+  gemini: ["gemini-3-pro", "gemini-pro", "gemini-3-flash", "gemini-flash"],
+  codex: ["codex-5.3", "codex-5.2", "codex-5.1-mini"],
+  opencode: ["opencode-custom-opus", "opencode-custom-sonnet", "opencode-default"]
+};
+function resolveFallback(modelId, cache) {
+  const cli = getCliForModelId(modelId);
+  if (cli === void 0) return null;
+  const chain = FALLBACK_CHAINS[cli];
+  for (const candidate of chain) {
+    if (candidate === modelId) continue;
+    if (!cache.isKnownUnavailable(candidate)) {
+      return {
+        modelId: candidate,
+        reason: `Fallback from ${modelId} (unavailable) to ${candidate}`
+      };
+    }
+  }
+  return null;
+}
+function getFallbackChain(cli) {
+  return FALLBACK_CHAINS[cli];
+}
+function getCliForModelId(modelId) {
+  for (const [cli, defaultModel] of Object.entries(DEFAULT_MODEL_PER_CLI)) {
+    const chain = FALLBACK_CHAINS[cli];
+    if (chain.includes(modelId)) return cli;
+    if (defaultModel === modelId) return cli;
+  }
+  return void 0;
+}
+var globalCache;
+function getAvailabilityCache() {
+  globalCache ??= new AvailabilityCache();
+  return globalCache;
+}
+function resetAvailabilityCache() {
+  globalCache = void 0;
+}
+function filterAvailableModels(modelIds, cache) {
+  const available = [];
+  const removed = [];
+  for (const id of modelIds) {
+    if (cache.isKnownUnavailable(id)) {
+      removed.push(id);
+    } else {
+      available.push(id);
+    }
+  }
+  return { available, removed };
+}
+
+// src/config/routing-config-adapter.ts
+var ADAPTER_DEFAULTS = {
+  latencyScoreWeight: 0.2
+};
+function adaptZeroRouterConfig(yaml2) {
+  if (yaml2 === void 0) return {};
+  return {
+    thresholds: yaml2.thresholds ?? DEFAULT_ZERO_ROUTER_CONFIG.thresholds,
+    weights: yaml2.weights ?? DEFAULT_ZERO_ROUTER_CONFIG.weights,
+    difficultyToTier: yaml2.difficultyToTier ?? DEFAULT_ZERO_ROUTER_CONFIG.difficultyToTier,
+    tierToClis: yaml2.tierToClis ?? DEFAULT_ZERO_ROUTER_CONFIG.tierToClis,
+    enableCalibration: yaml2.enableCalibration,
+    maxCalibrationOutcomes: yaml2.maxCalibrationOutcomes,
+    minCalibrationOutcomes: yaml2.minCalibrationOutcomes,
+    verbose: yaml2.verbose
+  };
+}
+function adaptLatencyTrackerConfig(yaml2) {
+  if (yaml2 === void 0) return {};
+  return {
+    windowSize: yaml2.windowSize,
+    decayFactor: yaml2.decayFactor,
+    maxSampleAgeMs: yaml2.maxSampleAgeMs,
+    percentiles: yaml2.percentiles
+  };
+}
+function adaptRoutingMemoryConfig(yaml2) {
+  if (yaml2 === void 0) return {};
+  return {
+    minObservations: yaml2.minObservations,
+    confidenceThreshold: yaml2.confidenceThreshold,
+    successRateThreshold: yaml2.successRateThreshold,
+    actionCacheMaxAgeMs: yaml2.actionCacheMaxAgeMs
+  };
+}
+function adaptStagesConfig(yaml2) {
+  if (yaml2 === void 0) return {};
+  return {
+    enableBudgetFilter: yaml2.budgetFilter,
+    enableZeroRouter: yaml2.zeroRouter,
+    enablePreferenceRouting: yaml2.preferenceRouting,
+    enableTopsisRanking: yaml2.topsisRanking,
+    enableLinUCBSelection: yaml2.linucbSelection,
+    enableLatencyTracking: yaml2.latencyTracking,
+    enableRoutingMemory: yaml2.routingMemory,
+    // Issue #755: New replacement stages
+    enableConfidenceCascade: yaml2.confidenceCascade,
+    enableCapabilityMatch: yaml2.capabilityMatch,
+    enableQualityConstraint: yaml2.qualityConstraint,
+    // Issue #998: Resource strategy
+    enableResourceStrategy: yaml2.resourceStrategy,
+    // Issue #999: Strategy distillation
+    enableStrategyDistillation: yaml2.strategyDistillation
+  };
+}
+var STAGE_FLAG_KEYS = [
+  "enableBudgetFilter",
+  "enableZeroRouter",
+  "enablePreferenceRouting",
+  "enableTopsisRanking",
+  "enableLinUCBSelection",
+  "enableLatencyTracking",
+  "enableRoutingMemory",
+  "enableConfidenceCascade",
+  "enableCapabilityMatch",
+  "enableQualityConstraint",
+  "enableResourceStrategy",
+  "enableStrategyDistillation",
+  "enableKnnRouting",
+  "enableCapacityBalancing"
+];
+var PERSISTENCE_AWARE_FLAGS = /* @__PURE__ */ new Set([
+  "enableRoutingMemory",
+  "enableStrategyDistillation",
+  "enablePreferenceRouting"
+]);
+function resolveStageFlags(stagesConfig) {
+  const persistenceOn = isPersistenceEnabled();
+  const result = {};
+  for (const key of STAGE_FLAG_KEYS) {
+    const explicit = stagesConfig[key];
+    if (explicit !== void 0) {
+      result[key] = explicit;
+    } else if (PERSISTENCE_AWARE_FLAGS.has(key) && persistenceOn) {
+      result[key] = true;
+    } else {
+      result[key] = DEFAULT_COMPOSITE_CONFIG[key];
+    }
+  }
+  return result;
+}
+function buildBaseConfig(config, stagesConfig) {
+  const stageFlags = resolveStageFlags(stagesConfig);
+  return {
+    ...stageFlags,
+    billingMode: DEFAULT_COMPOSITE_CONFIG.billingMode,
+    latencyScoreWeight: config.latencyScoreWeight,
+    budgetConstraints: config.budget,
+    linucbAlpha: config.linucb?.alpha ?? DEFAULT_COMPOSITE_CONFIG.linucbAlpha,
+    maxDecisionTimeMs: config.linucb?.maxDecisionTimeMs ?? DEFAULT_COMPOSITE_CONFIG.maxDecisionTimeMs,
+    preferenceMinDataPoints: config.preference?.minDataPoints ?? DEFAULT_COMPOSITE_CONFIG.preferenceMinDataPoints
+  };
+}
+function adaptRoutingConfig(yamlConfig) {
+  const config = yamlConfig ?? ADAPTER_DEFAULTS;
+  const stagesConfig = adaptStagesConfig(config.stages);
+  const baseConfig = buildBaseConfig(config, stagesConfig);
+  return {
+    ...baseConfig,
+    zeroRouterConfig: adaptZeroRouterConfig(config.zeroRouter),
+    latencyTrackerConfig: adaptLatencyTrackerConfig(config.latencyTracker),
+    routingMemoryConfig: adaptRoutingMemoryConfig(config.routingMemory)
+  };
+}
+
+// src/config/defaults-env.ts
+function parseIntEnv(envKey, fallback) {
+  const envValue = process.env[envKey];
+  if (envValue === void 0) {
+    return fallback;
+  }
+  const parsed = parseInt(envValue, 10);
+  return isNaN(parsed) || parsed <= 0 ? fallback : parsed;
+}
+function parseFloatEnv(envKey, fallback) {
+  const envValue = process.env[envKey];
+  if (envValue === void 0) {
+    return fallback;
+  }
+  const parsed = parseFloat(envValue);
+  return isNaN(parsed) || !isFinite(parsed) ? fallback : parsed;
+}
+function parseBoolEnv(envKey, fallback) {
+  const envValue = process.env[envKey]?.toLowerCase();
+  if (envValue === void 0) {
+    return fallback;
+  }
+  if (envValue === "true" || envValue === "1") return true;
+  if (envValue === "false" || envValue === "0") return false;
+  return fallback;
+}
+function createGetTimeout(timeoutDefaults) {
+  return (key) => {
+    const envKey = `NEXUS_TIMEOUT_${key.replace(/Ms$/, "").toUpperCase()}`;
+    return parseIntEnv(envKey, timeoutDefaults[key]);
+  };
+}
+function createGetRetryConfig(retryDefaults) {
+  return () => {
+    return {
+      maxRetries: parseIntEnv("NEXUS_RETRY_MAX_RETRIES", retryDefaults.maxRetries),
+      baseDelayMs: parseIntEnv("NEXUS_RETRY_BASE_DELAY", retryDefaults.baseDelayMs),
+      maxDelayMs: parseIntEnv("NEXUS_RETRY_MAX_DELAY", retryDefaults.maxDelayMs),
+      jitterFactor: parseFloatEnv("NEXUS_RETRY_JITTER", retryDefaults.jitterFactor)
+    };
+  };
+}
+function createGetRateLimitConfig(rateLimitDefaults) {
+  return () => {
+    return {
+      requestsPerMinute: parseIntEnv("NEXUS_RATE_LIMIT_RPM", rateLimitDefaults.requestsPerMinute),
+      enabled: parseBoolEnv("NEXUS_RATE_LIMIT_ENABLED", rateLimitDefaults.enabled),
+      maxConcurrent: parseIntEnv(
+        "NEXUS_RATE_LIMIT_MAX_CONCURRENT",
+        rateLimitDefaults.maxConcurrent
+      ),
+      capacity: parseIntEnv("NEXUS_RATE_LIMIT_CAPACITY", rateLimitDefaults.capacity),
+      refillRate: parseIntEnv("NEXUS_RATE_LIMIT_REFILL_RATE", rateLimitDefaults.refillRate),
+      refillIntervalMs: parseIntEnv(
+        "NEXUS_RATE_LIMIT_REFILL_INTERVAL",
+        rateLimitDefaults.refillIntervalMs
+      )
+    };
+  };
+}
+function createGetWorkerConfig(workerDefaults) {
+  return () => {
+    return {
+      maxWorkers: parseIntEnv("NEXUS_WORKERS_MAX", workerDefaults.maxWorkers),
+      poolSize: parseIntEnv("NEXUS_WORKERS_POOL_SIZE", workerDefaults.poolSize),
+      idleTimeoutMs: parseIntEnv("NEXUS_WORKERS_IDLE_TIMEOUT", workerDefaults.idleTimeoutMs),
+      workflowMaxParallel: parseIntEnv(
+        "NEXUS_WORKFLOW_MAX_PARALLEL",
+        workerDefaults.workflowMaxParallel
+      ),
+      testParallelism: parseIntEnv("NEXUS_TEST_PARALLELISM", workerDefaults.testParallelism),
+      evaluationMaxWorkers: parseIntEnv(
+        "NEXUS_EVALUATION_MAX_WORKERS",
+        workerDefaults.evaluationMaxWorkers
+      ),
+      eventBusMaxHistory: parseIntEnv(
+        "NEXUS_EVENTBUS_MAX_HISTORY",
+        workerDefaults.eventBusMaxHistory
+      ),
+      swarmObserverMaxEvents: parseIntEnv(
+        "NEXUS_SWARM_OBSERVER_MAX_EVENTS",
+        workerDefaults.swarmObserverMaxEvents
+      )
+    };
+  };
+}
+function createGetCircuitBreakerConfig(cbDefaults) {
+  return () => {
+    return {
+      failureThreshold: parseIntEnv("NEXUS_CIRCUIT_BREAKER_THRESHOLD", cbDefaults.failureThreshold),
+      resetTimeoutMs: parseIntEnv("NEXUS_CIRCUIT_BREAKER_RESET_TIMEOUT", cbDefaults.resetTimeoutMs),
+      halfOpenSuccessThreshold: cbDefaults.halfOpenSuccessThreshold,
+      countTimeoutsAsFailures: cbDefaults.countTimeoutsAsFailures,
+      countAuthFailuresAsFailures: cbDefaults.countAuthFailuresAsFailures,
+      countRateLimitsAsFailures: cbDefaults.countRateLimitsAsFailures,
+      halfOpenMaxRequests: cbDefaults.halfOpenMaxRequests
+    };
+  };
+}
+function createGetToolRateLimit(toolRateLimits) {
+  return (tool) => {
+    return toolRateLimits[tool];
+  };
+}
+function createGetEnvVarDocumentation(defaults) {
+  return () => {
+    const t = defaults.TIMEOUT_DEFAULTS;
+    const r = defaults.RATE_LIMIT_DEFAULTS;
+    const rt = defaults.RETRY_DEFAULTS;
+    const w = defaults.WORKER_DEFAULTS;
+    const cb = defaults.CIRCUIT_BREAKER_DEFAULTS;
+    return `# Environment Variable Overrides
+
+All defaults can be overridden via environment variables using the NEXUS_ prefix.
+
+## Timeouts
+
+| Variable | Default | Description |
+| -------- | ------- | ----------- |
+| NEXUS_TIMEOUT_CLI | ${String(t.cliMs)} | CLI execution timeout (ms) |
+| NEXUS_TIMEOUT_API | ${String(t.apiMs)} | API request timeout (ms) |
+| NEXUS_TIMEOUT_WORKFLOW | ${String(t.workflowMs)} | Workflow timeout (ms) |
+| NEXUS_TIMEOUT_MCP | ${String(t.mcpMs)} | MCP operation timeout (ms) |
+
+## Rate Limits
+
+| Variable | Default | Description |
+| -------- | ------- | ----------- |
+| NEXUS_RATE_LIMIT_RPM | ${String(r.requestsPerMinute)} | Requests per minute |
+| NEXUS_RATE_LIMIT_ENABLED | ${String(r.enabled)} | Enable rate limiting |
+| NEXUS_RATE_LIMIT_CAPACITY | ${String(r.capacity)} | Token bucket capacity |
+
+## Retries
+
+| Variable | Default | Description |
+| -------- | ------- | ----------- |
+| NEXUS_RETRY_MAX_RETRIES | ${String(rt.maxRetries)} | Maximum retry attempts |
+| NEXUS_RETRY_BASE_DELAY | ${String(rt.baseDelayMs)} | Base delay (ms) |
+| NEXUS_RETRY_MAX_DELAY | ${String(rt.maxDelayMs)} | Maximum delay (ms) |
+| NEXUS_RETRY_JITTER | ${String(rt.jitterFactor)} | Jitter factor (0-1) |
+
+## Workers
+
+| Variable | Default | Description |
+| -------- | ------- | ----------- |
+| NEXUS_WORKERS_MAX | ${String(w.maxWorkers)} | Maximum workers |
+| NEXUS_WORKERS_POOL_SIZE | ${String(w.poolSize)} | Worker pool size |
+| NEXUS_WORKFLOW_MAX_PARALLEL | ${String(w.workflowMaxParallel)} | Max parallel workflow steps |
+| NEXUS_TEST_PARALLELISM | ${String(w.testParallelism)} | Test parallelism |
+
+## Circuit Breaker
+
+| Variable | Default | Description |
+| -------- | ------- | ----------- |
+| NEXUS_CIRCUIT_BREAKER_THRESHOLD | ${String(cb.failureThreshold)} | Failure threshold |
+| NEXUS_CIRCUIT_BREAKER_RESET_TIMEOUT | ${String(cb.resetTimeoutMs)} | Reset timeout (ms) |
+`;
+  };
+}
+
+// src/config/defaults.ts
+var DEFAULTS = {
+  /**
+   * Default timeout settings in milliseconds.
+   * Values sourced from config/timeouts.ts (Issue #984).
+   */
+  TIMEOUT_DEFAULTS: {
+    /** CLI tool execution timeout in milliseconds. */
+    cliMs: CLI_TIMEOUTS.default.standard,
+    /** Simple CLI task timeout (single function, quick query). */
+    cliSimpleMs: CLI_TIMEOUTS.default.simple,
+    /** Complex CLI task timeout (codebase-wide, deep analysis). */
+    cliComplexMs: CLI_TIMEOUTS.default.complex,
+    /** API request timeout in milliseconds. */
+    apiMs: API_TIMEOUTS.defaultMs,
+    /** Maximum API timeout in milliseconds. */
+    apiMaxMs: API_TIMEOUTS.maxMs,
+    /** Workflow-level timeout in milliseconds (5 minutes). */
+    workflowMs: WORKFLOW_TIMEOUTS.workflowMs,
+    /** Maximum workflow timeout in milliseconds (30 minutes). */
+    workflowMaxMs: WORKFLOW_TIMEOUTS.workflowMaxMs,
+    /** Step-level timeout in milliseconds. */
+    stepMs: INTERNAL_TIMEOUTS.selfEvalMs,
+    /** MCP operation default timeout in milliseconds (generic, not per-tool). */
+    mcpMs: API_TIMEOUTS.defaultMs,
+    /** MCP operation maximum timeout in milliseconds. */
+    mcpMaxMs: MCP_TIMEOUTS.maxMs,
+    /** Health check timeout in milliseconds. */
+    healthCheckMs: INTERNAL_TIMEOUTS.healthCheckMs,
+    /** Global test run timeout in milliseconds (10 minutes). */
+    testGlobalMs: TEST_TIMEOUTS.globalMs,
+    /** Per-task test timeout in milliseconds. */
+    testTaskMs: TEST_TIMEOUTS.taskMs,
+    /** Circuit breaker reset timeout in milliseconds. */
+    circuitBreakerResetMs: INTERNAL_TIMEOUTS.circuitBreakerResetMs
+  },
+  /**
+   * Default rate limit settings for outbound operations.
+   */
+  RATE_LIMIT_DEFAULTS: {
+    /** Global requests per minute. */
+    requestsPerMinute: 60,
+    /** Whether rate limiting is enabled by default. */
+    enabled: true,
+    /** Maximum number of concurrent requests. */
+    maxConcurrent: 4,
+    /** Token bucket capacity. */
+    capacity: 100,
+    /** Token bucket refill rate per second. */
+    refillRate: 10,
+    /** Refill interval in milliseconds. */
+    refillIntervalMs: 100
+  },
+  /**
+   * Per-tool rate limit defaults for MCP tools.
+   * (Source: Issue #274 Phase 2 - per-tool rate limits)
+   */
+  TOOL_RATE_LIMITS: {
+    orchestrate: { capacity: 10, refillRate: 10, refillIntervalMs: 6e4 },
+    delegate: { capacity: 20, refillRate: 20, refillIntervalMs: 6e4 },
+    workflow: { capacity: 5, refillRate: 5, refillIntervalMs: 6e4 },
+    expert: { capacity: 30, refillRate: 30, refillIntervalMs: 6e4 }
+  },
+  /**
+   * Default retry strategy settings for transient failures.
+   */
+  RETRY_DEFAULTS: {
+    /** Maximum retry attempts before failing. */
+    maxRetries: 3,
+    /** Base delay between retries in milliseconds. */
+    baseDelayMs: 1e3,
+    /** Maximum delay between retries in milliseconds. */
+    maxDelayMs: 3e4,
+    /** Jitter factor (0-1) to randomize retry delays. */
+    jitterFactor: 0.1
+  },
+  /**
+   * Workflow-specific retry defaults.
+   */
+  WORKFLOW_RETRY_DEFAULTS: {
+    /** Maximum retry attempts for workflow steps. */
+    maxRetries: 2,
+    /** Base delay for workflow retries in milliseconds. */
+    baseDelayMs: 2e3,
+    /** Maximum delay for workflow retries in milliseconds. */
+    maxDelayMs: 6e4,
+    /** Jitter factor for workflow retries. */
+    jitterFactor: 0.15
+  },
+  /**
+   * CLI-specific retry defaults.
+   */
+  CLI_RETRY_DEFAULTS: {
+    /** Maximum retry attempts for CLI operations. */
+    maxRetries: 2,
+    /** Base delay for CLI retries in milliseconds. */
+    baseDelayMs: 5e3,
+    /** Maximum delay for CLI retries in milliseconds. */
+    maxDelayMs: 6e4,
+    /** Jitter factor for CLI retries. */
+    jitterFactor: 0.2
+  },
+  /**
+   * Test framework retry defaults.
+   */
+  TEST_RETRY_DEFAULTS: {
+    /** Maximum retries per test task. */
+    maxRetries: 2,
+    /** Whether to retry failed tasks by default. */
+    retryFailedTasks: true
+  },
+  /**
+   * Default buffer sizing for batching and chunked processing.
+   */
+  BUFFER_DEFAULTS: {
+    /** Preferred batch size for bulk operations. */
+    batchSize: 100,
+    /** Chunk size for streaming or segmented processing. */
+    chunkSize: 256,
+    /** Maximum items allowed in a buffer. */
+    maxItems: 1e3,
+    /** Maximum memory size in bytes (10 MB). */
+    maxMemoryBytes: 10 * 1024 * 1024,
+    /** Log buffer flush interval in milliseconds. */
+    logFlushIntervalMs: 5e3
+  },
+  /**
+   * Default worker pool sizing.
+   */
+  WORKER_DEFAULTS: {
+    /** Maximum number of workers. */
+    maxWorkers: 8,
+    /** Default worker pool size. */
+    poolSize: 4,
+    /** Worker idle timeout in milliseconds (5 minutes). */
+    idleTimeoutMs: 5 * 6e4,
+    /** Maximum parallel workflow steps. */
+    workflowMaxParallel: 5,
+    /** Test framework parallelism. */
+    testParallelism: 3,
+    /** Evaluation harness max workers. */
+    evaluationMaxWorkers: 8,
+    /** EventBus max history size. */
+    eventBusMaxHistory: 1e3,
+    /** Swarm observer max events. */
+    swarmObserverMaxEvents: 1e4
+  },
+  /**
+   * Default circuit breaker settings.
+   * (Source: Issue #81 - Circuit breaker for CLI failures)
+   */
+  CIRCUIT_BREAKER_DEFAULTS: {
+    /** Failure threshold to open circuit. */
+    failureThreshold: 5,
+    /** Reset timeout in milliseconds. */
+    resetTimeoutMs: 3e4,
+    /** Success threshold to close circuit in half-open state. */
+    halfOpenSuccessThreshold: 2,
+    /** Whether to count timeouts as failures. */
+    countTimeoutsAsFailures: true,
+    /** Whether to count auth failures as failures. */
+    countAuthFailuresAsFailures: false,
+    /** Whether to count rate limit errors as failures (#1529). */
+    countRateLimitsAsFailures: true,
+    /** Maximum requests allowed in half-open state. */
+    halfOpenMaxRequests: 3
+  },
+  /**
+   * Default context/memory settings.
+   */
+  CONTEXT_DEFAULTS: {
+    /** Maximum context tokens. */
+    maxTokens: 1e5,
+    /** Token budget warning threshold (80%). */
+    warningThreshold: 0.8,
+    /** Token budget critical threshold (95%). */
+    criticalThreshold: 0.95,
+    /** Maximum history entries to retain. */
+    maxHistoryEntries: 1e3
+  },
+  /**
+   * Default provider/model settings.
+   */
+  PROVIDER_DEFAULTS: {
+    /** Default timeout for provider API calls in ms. */
+    timeout: 3e4,
+    /** Maximum retries for provider requests. */
+    maxRetries: 3,
+    /** Default model tier. */
+    defaultTier: "balanced",
+    /** Default temperature. */
+    temperatureDefault: 0.3,
+    /** Minimum temperature. */
+    temperatureMin: 0,
+    /** Maximum temperature. */
+    temperatureMax: 1,
+    /** Billing mode: 'plan' (monthly subscription) or 'api' (pay-per-token). Env: NEXUS_BILLING_MODE */
+    billingMode: "plan"
+  },
+  /**
+   * Security-related defaults.
+   */
+  SECURITY_DEFAULTS: {
+    /** Maximum system prompt length in characters. */
+    maxSystemPromptLength: 4e3,
+    /** Default policy execution mode. */
+    policyDefaultMode: "read-only",
+    /** Default policy mode. */
+    policyMode: "enforce",
+    /** Default sandbox mode. */
+    sandboxMode: "policy",
+    /** Whether to fall back to policy mode if container unavailable. */
+    sandboxFallbackToPolicy: true,
+    /** Whether network is enabled in container mode. */
+    sandboxNetworkEnabled: false
+  }
+};
+var getTimeout = createGetTimeout(DEFAULTS.TIMEOUT_DEFAULTS);
+var getRetryConfig = createGetRetryConfig(DEFAULTS.RETRY_DEFAULTS);
+var getRateLimitConfig = createGetRateLimitConfig(DEFAULTS.RATE_LIMIT_DEFAULTS);
+var getWorkerConfig = createGetWorkerConfig(DEFAULTS.WORKER_DEFAULTS);
+var getCircuitBreakerConfig = createGetCircuitBreakerConfig(
+  DEFAULTS.CIRCUIT_BREAKER_DEFAULTS
+);
+var getToolRateLimit = createGetToolRateLimit(DEFAULTS.TOOL_RATE_LIMITS);
+var getEnvVarDocumentation = createGetEnvVarDocumentation(DEFAULTS);
+
+// src/config/config-manager.ts
+import { z as z11 } from "zod";
+var NumericValueSchema = z11.number();
+var BooleanValueSchema = z11.boolean();
+var StringValueSchema = z11.string();
+function validateValue(value, expectedType) {
+  if (typeof expectedType === "number") return NumericValueSchema.safeParse(value).success;
+  if (typeof expectedType === "boolean") return BooleanValueSchema.safeParse(value).success;
+  if (typeof expectedType === "string") return StringValueSchema.safeParse(value).success;
+  return false;
+}
+var ENV_VAR_MAP = {
+  "TIMEOUT_DEFAULTS.cliMs": "NEXUS_TIMEOUT_CLI",
+  "TIMEOUT_DEFAULTS.apiMs": "NEXUS_TIMEOUT_API",
+  "TIMEOUT_DEFAULTS.workflowMs": "NEXUS_TIMEOUT_WORKFLOW",
+  "TIMEOUT_DEFAULTS.mcpMs": "NEXUS_TIMEOUT_MCP",
+  "RATE_LIMIT_DEFAULTS.requestsPerMinute": "NEXUS_RATE_LIMIT_RPM",
+  "RATE_LIMIT_DEFAULTS.enabled": "NEXUS_RATE_LIMIT_ENABLED",
+  "RATE_LIMIT_DEFAULTS.maxConcurrent": "NEXUS_RATE_LIMIT_MAX_CONCURRENT",
+  "RATE_LIMIT_DEFAULTS.capacity": "NEXUS_RATE_LIMIT_CAPACITY",
+  "RATE_LIMIT_DEFAULTS.refillRate": "NEXUS_RATE_LIMIT_REFILL_RATE",
+  "RATE_LIMIT_DEFAULTS.refillIntervalMs": "NEXUS_RATE_LIMIT_REFILL_INTERVAL",
+  "RETRY_DEFAULTS.maxRetries": "NEXUS_RETRY_MAX_RETRIES",
+  "RETRY_DEFAULTS.baseDelayMs": "NEXUS_RETRY_BASE_DELAY",
+  "RETRY_DEFAULTS.maxDelayMs": "NEXUS_RETRY_MAX_DELAY",
+  "RETRY_DEFAULTS.jitterFactor": "NEXUS_RETRY_JITTER",
+  "WORKER_DEFAULTS.maxWorkers": "NEXUS_WORKERS_MAX",
+  "WORKER_DEFAULTS.poolSize": "NEXUS_WORKERS_POOL_SIZE",
+  "WORKER_DEFAULTS.idleTimeoutMs": "NEXUS_WORKERS_IDLE_TIMEOUT",
+  "WORKER_DEFAULTS.workflowMaxParallel": "NEXUS_WORKFLOW_MAX_PARALLEL",
+  "WORKER_DEFAULTS.testParallelism": "NEXUS_TEST_PARALLELISM",
+  "WORKER_DEFAULTS.evaluationMaxWorkers": "NEXUS_EVALUATION_MAX_WORKERS",
+  "WORKER_DEFAULTS.eventBusMaxHistory": "NEXUS_EVENTBUS_MAX_HISTORY",
+  "WORKER_DEFAULTS.swarmObserverMaxEvents": "NEXUS_SWARM_OBSERVER_MAX_EVENTS",
+  "CIRCUIT_BREAKER_DEFAULTS.failureThreshold": "NEXUS_CIRCUIT_BREAKER_THRESHOLD",
+  "CIRCUIT_BREAKER_DEFAULTS.resetTimeoutMs": "NEXUS_CIRCUIT_BREAKER_RESET_TIMEOUT"
+};
+function parseEnvValue(envValue, defaultValue) {
+  if (typeof defaultValue === "number") {
+    const parsed = Number(envValue);
+    return !isNaN(parsed) && isFinite(parsed) ? parsed : void 0;
+  }
+  if (typeof defaultValue === "boolean") {
+    const lower = envValue.toLowerCase();
+    if (lower === "true" || lower === "1") return true;
+    if (lower === "false" || lower === "0") return false;
+    return void 0;
+  }
+  if (typeof defaultValue === "string") return envValue;
+  return void 0;
+}
+var ConfigManager = class _ConfigManager {
+  static instance = null;
+  overrides = /* @__PURE__ */ new Map();
+  constructor() {
+  }
+  /** Gets the singleton instance. */
+  static getInstance() {
+    _ConfigManager.instance ??= new _ConfigManager();
+    return _ConfigManager.instance;
+  }
+  /** Resets the singleton instance (for testing). */
+  static resetInstance() {
+    _ConfigManager.instance = null;
+  }
+  /** Gets the effective value for a configuration key. */
+  get(category, key) {
+    return this.getWithMeta(category, key).value;
+  }
+  /** Gets the effective value with source metadata. */
+  getWithMeta(category, key) {
+    const fullKey = `${category}.${String(key)}`;
+    const defaultValue = DEFAULTS[category][key];
+    const override = this.overrides.get(fullKey);
+    if (override) {
+      return {
+        value: override.value,
+        source: override.source,
+        key: fullKey,
+        isOverride: true,
+        defaultValue
+      };
+    }
+    const envVar = ENV_VAR_MAP[fullKey];
+    if (envVar !== void 0 && envVar.length > 0) {
+      const envValue = process.env[envVar];
+      if (envValue !== void 0) {
+        const parsed = parseEnvValue(envValue, defaultValue);
+        if (parsed !== void 0) {
+          return { value: parsed, source: "env", key: fullKey, isOverride: true, defaultValue };
+        }
+      }
+    }
+    return {
+      value: defaultValue,
+      source: "package",
+      key: fullKey,
+      isOverride: false,
+      defaultValue
+    };
+  }
+  /**
+   * Sets an override for a configuration key.
+   * @throws {Error} If value fails type validation
+   */
+  setOverride(category, key, value, source) {
+    const fullKey = `${category}.${String(key)}`;
+    const defaultValue = DEFAULTS[category][key];
+    if (!validateValue(value, defaultValue)) {
+      throw new Error(
+        `Invalid value type for ${fullKey}: expected ${typeof defaultValue}, got ${typeof value}`
+      );
+    }
+    this.overrides.set(fullKey, { value, source, setAt: new Date(getTimeProvider().now()) });
+  }
+  /** Clears an override. Returns true if it existed. */
+  clearOverride(category, key) {
+    return this.overrides.delete(`${category}.${String(key)}`);
+  }
+  /** Clears all overrides. */
+  clearAllOverrides() {
+    this.overrides.clear();
+  }
+  /** Lists all active overrides. */
+  listOverrides() {
+    return Array.from(this.overrides.entries()).map(([key, override]) => ({
+      key,
+      value: override.value,
+      source: override.source,
+      setAt: override.setAt
+    }));
+  }
+  /** Lists all configuration keys with their effective values. */
+  listAll(categoryFilter) {
+    const categories = categoryFilter ? [categoryFilter] : Object.keys(DEFAULTS);
+    const result = [];
+    for (const category of categories) {
+      for (const key of Object.keys(DEFAULTS[category])) {
+        const fullKey = `${category}.${key}`;
+        const meta = this.getWithMeta(category, key);
+        result.push({
+          category,
+          key,
+          value: meta.value,
+          source: meta.source,
+          envVar: ENV_VAR_MAP[fullKey]
+        });
+      }
+    }
+    return result;
+  }
+  /** Gets the environment variable name for a config key. */
+  getEnvVarName(category, key) {
+    return ENV_VAR_MAP[`${category}.${String(key)}`];
+  }
+  /** Checks if a key has an active override. */
+  hasOverride(category, key) {
+    return this.overrides.has(`${category}.${String(key)}`);
+  }
+};
+function getConfigManager() {
+  return ConfigManager.getInstance();
+}
+
+// src/config/config-loader.ts
+import { readFileSync, existsSync } from "fs";
+import { resolve, join } from "path";
+import { homedir } from "os";
+import * as yaml from "yaml";
+var DEFAULT_CONFIG_FILE = "nexus-agents.yaml";
+var ALTERNATE_CONFIG_FILE = "nexus-agents.yml";
+var ConfigLoadError = class extends Error {
+  code;
+  constructor(message, code, cause) {
+    super(message, { cause });
+    this.name = "ConfigLoadError";
+    this.code = code;
+  }
+};
+function validatePath(userPath, root) {
+  const resolved = resolveInsideRoot(userPath, root);
+  if (resolved === null) {
+    return err(
+      new ConfigLoadError(
+        `Config path traversal detected: ${userPath} escapes ${root}`,
+        "PATH_TRAVERSAL"
+      )
+    );
+  }
+  return ok(resolved);
+}
+function findConfigPath(cwd) {
+  const envPath = process.env["NEXUS_CONFIG_PATH"];
+  if (envPath !== void 0 && envPath !== "") {
+    const validation = validatePath(envPath, cwd);
+    if (validation.ok && existsSync(validation.value)) {
+      return validation.value;
+    }
+  }
+  const yamlPath = resolve(cwd, DEFAULT_CONFIG_FILE);
+  if (existsSync(yamlPath)) {
+    return yamlPath;
+  }
+  const ymlPath = resolve(cwd, ALTERNATE_CONFIG_FILE);
+  if (existsSync(ymlPath)) {
+    return ymlPath;
+  }
+  const globalDir = join(homedir(), ".nexus-agents");
+  const globalYamlPath = join(globalDir, DEFAULT_CONFIG_FILE);
+  if (existsSync(globalYamlPath)) {
+    return globalYamlPath;
+  }
+  const globalYmlPath = join(globalDir, ALTERNATE_CONFIG_FILE);
+  if (existsSync(globalYmlPath)) {
+    return globalYmlPath;
+  }
+  return void 0;
+}
+function parseYaml(content) {
+  try {
+    const parsed = yaml.parse(content);
+    return ok(parsed);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Unknown YAML parse error";
+    return err(
+      new ConfigLoadError(`YAML parse error: ${message}`, "YAML_PARSE_ERROR", error)
+    );
+  }
+}
+function deepMerge(target, source) {
+  const result = { ...target };
+  for (const key of Object.keys(source)) {
+    const sourceValue = source[key];
+    const targetValue = target[key];
+    if (sourceValue !== void 0 && typeof sourceValue === "object" && sourceValue !== null && !Array.isArray(sourceValue) && typeof targetValue === "object" && targetValue !== null && !Array.isArray(targetValue)) {
+      result[key] = deepMerge(
+        targetValue,
+        sourceValue
+      );
+    } else if (sourceValue !== void 0) {
+      result[key] = sourceValue;
+    }
+  }
+  return result;
+}
+function loadDefaultConfig(logger2) {
+  logger2.debug("No config file found, using defaults");
+  const validated = AppConfigSchema.safeParse(defaultConfig);
+  if (!validated.success) {
+    return err(
+      new ConfigLoadError(
+        `Default config validation failed: ${validated.error.message}`,
+        "VALIDATION_ERROR"
+      )
+    );
+  }
+  return ok({
+    config: validated.data,
+    usingDefaults: true,
+    warnings: ["No config file found, using default configuration"]
+  });
+}
+function readAndParseConfig(configPath, mergeDefaults, logger2) {
+  let content;
+  try {
+    content = readFileSync(configPath, "utf-8");
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Unknown error";
+    return err(
+      new ConfigLoadError(
+        `Failed to read config file: ${message}`,
+        "FILE_READ_ERROR",
+        error
+      )
+    );
+  }
+  const parseResult = parseYaml(content);
+  if (!parseResult.ok) return err(parseResult.error);
+  if (mergeDefaults && typeof parseResult.value === "object" && parseResult.value !== null) {
+    logger2.debug("Merged config with defaults");
+    return ok(
+      deepMerge(
+        defaultConfig,
+        parseResult.value
+      )
+    );
+  }
+  return ok(parseResult.value);
+}
+function validateConfig(configData, configPath, logger2) {
+  const validation = AppConfigSchema.safeParse(configData);
+  if (!validation.success) {
+    const issues = formatZodIssuesAsArray(validation.error);
+    return err(
+      new ConfigLoadError(`Config validation failed:
+${issues.join("\n")}`, "VALIDATION_ERROR")
+    );
+  }
+  logger2.info("Configuration loaded successfully", { configPath });
+  return ok({ config: validation.data, configPath, usingDefaults: false, warnings: [] });
+}
+function loadConfig(options = {}) {
+  const { configPath: explicitPath, cwd = process.cwd(), mergeDefaults = true } = options;
+  const logger2 = options.logger ?? createLogger({ component: "ConfigLoader" });
+  let configPath;
+  if (explicitPath !== void 0) {
+    const validation = validatePath(explicitPath, cwd);
+    if (!validation.ok) return err(validation.error);
+    configPath = validation.value;
+  } else {
+    configPath = findConfigPath(cwd);
+  }
+  if (configPath === void 0) return loadDefaultConfig(logger2);
+  const parseResult = readAndParseConfig(configPath, mergeDefaults, logger2);
+  if (!parseResult.ok) return err(parseResult.error);
+  return validateConfig(parseResult.value, configPath, logger2);
+}
+var loadedConfig;
+function getConfig(options) {
+  if (loadedConfig !== void 0) {
+    return loadedConfig;
+  }
+  const result = loadConfig(options);
+  if (!result.ok) {
+    throw result.error;
+  }
+  loadedConfig = result.value;
+  return loadedConfig;
+}
+
+// src/cli/setup-data-dir.ts
+import { mkdirSync, existsSync as existsSync3 } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join3 } from "path";
+
+// src/cli/doctor.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2, accessSync, constants as fsConstants } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+
+// src/mcp/server.ts
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+
+// src/mcp/task-store.ts
+import { InMemoryTaskStore } from "@modelcontextprotocol/sdk/experimental/tasks";
+var MAX_TASK_TTL_MS = 6e5;
+var DEFAULT_TASK_TTL_MS = 3e5;
+var MAX_TASK_CAPACITY = 50;
+var CLEANUP_INTERVAL_MS = 6e4;
+var logger = createLogger({ component: "task-store" });
+var singletonStore;
+var cleanupTimer;
+function getTaskStore() {
+  if (singletonStore === void 0) {
+    singletonStore = new InMemoryTaskStore();
+    logger.info("Task store created", { maxCapacity: MAX_TASK_CAPACITY });
+    cleanupTimer = setInterval(() => {
+      evictExcessTasks();
+    }, CLEANUP_INTERVAL_MS);
+    if (typeof cleanupTimer === "object" && "unref" in cleanupTimer) {
+      cleanupTimer.unref();
+    }
+  }
+  return singletonStore;
+}
+function clampTaskTtl(requestedTtl) {
+  if (requestedTtl === void 0 || requestedTtl === null) {
+    return DEFAULT_TASK_TTL_MS;
+  }
+  if (requestedTtl > MAX_TASK_TTL_MS) {
+    logger.warn("Task TTL clamped to maximum", {
+      requested: requestedTtl,
+      max: MAX_TASK_TTL_MS
+    });
+    return MAX_TASK_TTL_MS;
+  }
+  return requestedTtl;
+}
+function evictExcessTasks() {
+  if (singletonStore === void 0) return;
+  const allTasks = singletonStore.getAllTasks();
+  if (allTasks.length <= MAX_TASK_CAPACITY) return;
+  const sorted = [...allTasks].sort(
+    (a, b) => new Date(a.createdAt).getTime() - new Date(b.createdAt).getTime()
+  );
+  const evictCount = sorted.length - MAX_TASK_CAPACITY;
+  for (let i = 0; i < evictCount; i++) {
+    const task = sorted[i];
+    if (task === void 0) continue;
+    singletonStore.updateTaskStatus(task.taskId, "cancelled", "Evicted: capacity exceeded").catch((err2) => {
+      logger.debug("Failed to evict task", {
+        taskId: task.taskId,
+        error: String(err2)
+      });
+    });
+  }
+  logger.info("Evicted excess tasks", { evicted: evictCount, total: sorted.length });
+}
+
+// src/mcp/server.ts
+var DEFAULT_SERVER_NAME = "nexus-agents";
+function createServerError(code, message, error) {
+  const serverError = { code, message };
+  if (error instanceof Error) {
+    serverError.cause = error;
+  }
+  return serverError;
+}
+function createServer(config) {
+  const serverName = config?.name ?? DEFAULT_SERVER_NAME;
+  const serverVersion = config?.version ?? VERSION;
+  const logger2 = config?.logger ?? createLogger({ component: "mcp-server" });
+  try {
+    initDataDirectories();
+    logger2.info("Creating MCP server", {
+      name: serverName,
+      version: serverVersion
+    });
+    const server = new McpServer(
+      {
+        name: serverName,
+        version: serverVersion
+      },
+      {
+        capabilities: {
+          logging: {},
+          prompts: {},
+          resources: {},
+          tasks: {}
+        },
+        taskStore: getTaskStore()
+      }
+    );
+    logger2.debug("MCP server created successfully");
+    return ok({ server, logger: logger2 });
+  } catch (error) {
+    const errorMessage = getErrorMessage(error);
+    logger2.error("Failed to create MCP server", error instanceof Error ? error : void 0);
+    return err(
+      createServerError(
+        "SERVER_CREATION_FAILED",
+        `Failed to create MCP server: ${errorMessage}`,
+        error
+      )
+    );
+  }
+}
+async function connectTransport(server, transport, logger2) {
+  const log = logger2 ?? createLogger({ component: "mcp-server" });
+  try {
+    log.info("Connecting server to transport");
+    await server.connect(transport);
+    log.debug("Server connected to transport successfully");
+    return ok(void 0);
+  } catch (error) {
+    const errorMessage = getErrorMessage(error);
+    log.error("Failed to connect to transport", error instanceof Error ? error : void 0);
+    return err(
+      createServerError(
+        "SERVER_START_FAILED",
+        `Failed to connect to transport: ${errorMessage}`,
+        error
+      )
+    );
+  }
+}
+async function startStdioServer(config) {
+  const serverResult = createServer(config);
+  if (!serverResult.ok) {
+    return serverResult;
+  }
+  const { server, logger: logger2 } = serverResult.value;
+  try {
+    logger2.setDestination?.("stderr");
+    logger2.info("Starting stdio transport");
+    const transport = new StdioServerTransport();
+    const connectResult = await connectTransport(server, transport, logger2);
+    if (!connectResult.ok) {
+      return connectResult;
+    }
+    logger2.info("MCP server running with stdio transport");
+    return ok({ server, logger: logger2 });
+  } catch (error) {
+    const errorMessage = getErrorMessage(error);
+    logger2.error("Failed to start stdio server", error instanceof Error ? error : void 0);
+    return err(
+      createServerError(
+        "SERVER_START_FAILED",
+        `Failed to start stdio server: ${errorMessage}`,
+        error
+      )
+    );
+  }
+}
+async function closeServer(server, logger2) {
+  const log = logger2 ?? createLogger({ component: "mcp-server" });
+  try {
+    log.info("Closing MCP server");
+    await server.close();
+    log.info("MCP server closed successfully");
+    return ok(void 0);
+  } catch (error) {
+    const errorMessage = getErrorMessage(error);
+    log.error("Failed to close server", error instanceof Error ? error : void 0);
+    return err(
+      createServerError("SERVER_STOP_FAILED", `Failed to close server: ${errorMessage}`, error)
+    );
+  }
+}
+
+// src/cli/doctor-formatting.ts
+var REQUIRED_NODE_MAJOR = 22;
+function formatStatus(healthy, warn = false) {
+  if (healthy) return `${colors.green}${symbols.check}${colors.reset}`;
+  if (warn) return `${colors.yellow}${symbols.warn}${colors.reset}`;
+  return `${colors.red}${symbols.cross}${colors.reset}`;
+}
+function formatVersionStatus(status) {
+  switch (status) {
+    case "supported":
+      return `${colors.green}supported${colors.reset}`;
+    case "outdated":
+      return `${colors.yellow}outdated${colors.reset}`;
+    case "unsupported":
+    case "breaking":
+      return `${colors.red}${status}${colors.reset}`;
+    default:
+      return status;
+  }
+}
+function formatCapacity(capacity) {
+  if (capacity === void 0) return "Unknown";
+  const remaining = 100 - capacity.utilizationPercent;
+  const remainingStr = String(remaining);
+  if (remaining > 80) return `${colors.green}${remainingStr}% remaining${colors.reset}`;
+  if (remaining > 20) return `${colors.yellow}${remainingStr}% remaining${colors.reset}`;
+  return `${colors.red}${remainingStr}% remaining${colors.reset}`;
+}
+function printInstalledCliDetails(cli) {
+  writeLine(`  Version: ${cli.version} (${formatVersionStatus(cli.versionStatus)})`);
+  const authText = cli.authenticated ? `${colors.green}${cli.authMethod ?? "Authenticated"}${colors.reset}` : `${colors.red}Not authenticated${colors.reset}`;
+  writeLine(`  Auth: ${authText}`);
+  if (cli.capacity !== void 0) {
+    writeLine(`  Capacity: ${formatCapacity(cli.capacity)}`);
+  }
+}
+function printCliResult(cli) {
+  const status = cli.installed && cli.authenticated;
+  const warn = cli.installed && (!cli.authenticated || cli.versionStatus === "outdated");
+  writeLine(
+    `${formatStatus(status, warn)} ${colors.bold}${capitalize(cli.name)} CLI${colors.reset}`
+  );
+  if (cli.installed) {
+    printInstalledCliDetails(cli);
+  } else {
+    const errorText = cli.error ?? "Not installed";
+    writeLine(`  ${colors.red}Error: ${errorText}${colors.reset}`);
+  }
+  if (cli.fix !== void 0 && cli.fix !== "") {
+    writeLine(`  ${colors.dim}Fix: ${cli.fix}${colors.reset}`);
+  }
+  writeLine("");
+}
+function printCapabilities(clis) {
+  const installedClis = clis.filter((c) => c.installed);
+  if (installedClis.length === 0) {
+    writeLine(`${formatStatus(false)} No CLIs installed`);
+    return;
+  }
+  const caps = DEFAULT_CAPABILITIES;
+  const bestReasoning = installedClis.reduce(
+    (best, c) => caps[c.name].reasoning > caps[best.name].reasoning ? c : best
+  );
+  const bestContext = installedClis.reduce(
+    (best, c) => caps[c.name].contextWindow > caps[best.name].contextWindow ? c : best
+  );
+  const bestSpeed = installedClis.reduce(
+    (best, c) => caps[c.name].speed > caps[best.name].speed ? c : best
+  );
+  const contextTokensK = (caps[bestContext.name].contextWindow / 1e3).toFixed(0);
+  writeLine(
+    `${formatStatus(true)} Complex reasoning: ${colors.bold}${capitalize(bestReasoning.name)}${colors.reset}`
+  );
+  writeLine(
+    `${formatStatus(true)} Large context: ${colors.bold}${capitalize(bestContext.name)}${colors.reset} (${contextTokensK}K tokens)`
+  );
+  writeLine(
+    `${formatStatus(true)} Fast execution: ${colors.bold}${capitalize(bestSpeed.name)}${colors.reset}`
+  );
+}
+function printNodeVersionCheck(check) {
+  const versionText = check.supported ? `${colors.green}${check.version}${colors.reset}` : `${colors.yellow}${check.version}${colors.reset}`;
+  writeLine(`${formatStatus(check.supported, !check.supported)} Node.js version: ${versionText}`);
+  if (!check.supported) {
+    writeLine(
+      `  ${colors.dim}Warning: Node.js ${String(REQUIRED_NODE_MAJOR)}.x LTS required${colors.reset}`
+    );
+  }
+}
+function printApiKeysCheck(keys) {
+  const configuredCount = keys.filter((k) => k.configured).length;
+  const configuredNames = keys.filter((k) => k.configured).map((k) => k.name);
+  const hasAny = configuredCount > 0;
+  writeLine(
+    `${formatStatus(hasAny, !hasAny)} API keys configured: ${String(configuredCount)} of ${String(keys.length)}`
+  );
+  if (hasAny) {
+    writeLine(`  ${colors.dim}Keys: ${configuredNames.join(", ")}${colors.reset}`);
+  } else {
+    writeLine(
+      `  ${colors.dim}Set ANTHROPIC_API_KEY, OPENAI_API_KEY, or GOOGLE_AI_API_KEY${colors.reset}`
+    );
+  }
+}
+function printConfigFileCheck(check) {
+  if (check.found && check.path !== null) {
+    writeLine(`${formatStatus(true)} Configuration loaded: ${check.path}`);
+  } else {
+    writeLine(`${formatStatus(false, true)} Configuration file: Not found`);
+    writeLine(`  ${colors.dim}Run: nexus-agents config init${colors.reset}`);
+  }
+}
+function printRegistryAdvisory(advisory) {
+  const allAvailable = advisory.unavailableModels === 0;
+  const countText = `${String(advisory.availableModels)} of ${String(advisory.totalModels)}`;
+  writeLine(`${formatStatus(allAvailable, !allAvailable)} Models available: ${countText}`);
+  if (advisory.unavailableModels > 0) {
+    const missing = advisory.models.filter((m) => !m.available);
+    for (const m of missing) {
+      writeLine(`  ${colors.dim}${m.displayName} \u2014 ${m.reason}${colors.reset}`);
+    }
+  }
+  const ageText = `${String(advisory.registryAgeDays)} days old`;
+  if (advisory.registryStale) {
+    writeLine(
+      `${colors.yellow}${symbols.warn}${colors.reset} Model registry is ${ageText} \u2014 may have stale model data`
+    );
+    writeLine(`  ${colors.dim}Run: npx tsx scripts/probe-models.ts${colors.reset}`);
+  } else {
+    writeLine(`${formatStatus(true)} Model registry: ${ageText}`);
+  }
+}
+function printLearningPersistence(check) {
+  if (!check.enabled) {
+    writeLine(`${formatStatus(true)} Learning persistence: ${colors.dim}Disabled${colors.reset}`);
+    writeLine(`  ${colors.dim}Set NEXUS_PERSIST_LEARNING=true to enable${colors.reset}`);
+    return;
+  }
+  const healthy = check.dirExists && check.dirWritable && check.error === null;
+  writeLine(`${formatStatus(healthy, !healthy)} Learning persistence: Enabled`);
+  if (check.error !== null) {
+    writeLine(`  ${colors.red}Error: ${check.error}${colors.reset}`);
+    return;
+  }
+  const dirStatus = check.dirExists ? check.dirWritable ? `${colors.green}writable${colors.reset}` : `${colors.red}not writable${colors.reset}` : `${colors.yellow}not created yet${colors.reset}`;
+  writeLine(`  Data directory: ${dirStatus}`);
+  writeLine(`  Outcomes: ${String(check.outcomeCount)} recorded`);
+  writeLine(`  Distilled rules: ${String(check.ruleCount)} active`);
+  if (check.rulesLastSaved !== null) {
+    writeLine(`  Rules last saved: ${check.rulesLastSaved}`);
+  }
+}
+function printSqliteCheck(check) {
+  if (check.available) {
+    writeLine(
+      `${formatStatus(true)} SQLite (better-sqlite3): ${colors.green}Available${colors.reset}`
+    );
+  } else {
+    writeLine(
+      `${formatStatus(false, true)} SQLite (better-sqlite3): ${colors.yellow}Not available${colors.reset}`
+    );
+    writeLine(
+      `  ${colors.dim}Memory backends (agentic, adaptive, typed) require it${colors.reset}`
+    );
+    writeLine(`  ${colors.dim}Fix: npm install -g better-sqlite3${colors.reset}`);
+  }
+}
+function printDataDirectory(check) {
+  if (check.rootExists) {
+    const existCount = check.subdirectories.filter((d) => d.exists).length;
+    const totalCount = check.subdirectories.length;
+    const allExist = existCount === totalCount;
+    const allWritable = check.subdirectories.every((d) => !d.exists || d.writable);
+    const healthy = allExist && allWritable;
+    writeLine(
+      `${formatStatus(healthy, !healthy)} Data directory: ${check.rootPath} (${String(existCount)}/${String(totalCount)} subdirs)`
+    );
+    if (!allExist) {
+      const missing = check.subdirectories.filter((d) => !d.exists);
+      for (const dir of missing) {
+        writeLine(`  ${colors.dim}Missing: ${dir.name}/${colors.reset}`);
+      }
+      writeLine(`  ${colors.dim}Fix: nexus-agents setup${colors.reset}`);
+    }
+    if (!allWritable) {
+      const readonly_ = check.subdirectories.filter((d) => d.exists && !d.writable);
+      for (const dir of readonly_) {
+        writeLine(`  ${colors.yellow}Not writable: ${dir.name}/${colors.reset}`);
+      }
+    }
+  } else {
+    writeLine(
+      `${formatStatus(false, true)} Data directory: ${colors.yellow}Not created${colors.reset}`
+    );
+    writeLine(`  ${colors.dim}Run: nexus-agents setup${colors.reset}`);
+  }
+}
+function printDoctorSummary(result) {
+  const unhealthyCount = result.clis.filter((c) => !c.installed || !c.authenticated).length;
+  const nodeIssue = result.nodeVersion.supported ? 0 : 1;
+  const totalIssues = unhealthyCount + nodeIssue + (result.mcpServerReady ? 0 : 1);
+  const summary = result.allHealthy ? `${colors.green}${colors.bold}Status: Ready${colors.reset}` : `${colors.yellow}${colors.bold}Summary: ${String(totalIssues)} issue(s) found${colors.reset}`;
+  writeLine(summary);
+  writeLine("");
+}
+function printDoctorResults(result) {
+  writeLine("");
+  writeLine(`${colors.bold}Nexus Agents Doctor${colors.reset}`);
+  writeLine("===================");
+  writeLine("");
+  writeLine(`${colors.cyan}Checking environment...${colors.reset}`);
+  writeLine("");
+  printNodeVersionCheck(result.nodeVersion);
+  printApiKeysCheck(result.apiKeys);
+  printConfigFileCheck(result.configFile);
+  writeLine("");
+  writeLine(`${colors.cyan}Checking CLI installations...${colors.reset}`);
+  writeLine("");
+  for (const cli of result.clis) {
+    printCliResult(cli);
+  }
+  writeLine(`${colors.cyan}Checking MCP configuration...${colors.reset}`);
+  writeLine("");
+  writeLine(
+    `${formatStatus(result.mcpServerReady)} MCP Server mode: ${result.mcpServerReady ? "Ready" : "Not ready"}`
+  );
+  writeLine(
+    `${formatStatus(result.mcpClientReady)} MCP Client mode: ${result.mcpClientReady ? "Ready (Codex mcp-server)" : "Not ready (Codex not installed)"}`
+  );
+  writeLine("");
+  writeLine(`${colors.cyan}Checking capabilities...${colors.reset}`);
+  writeLine("");
+  printCapabilities(result.clis);
+  writeLine("");
+  writeLine(`${colors.cyan}Checking model registry...${colors.reset}`);
+  writeLine("");
+  printRegistryAdvisory(result.registryAdvisory);
+  writeLine("");
+  writeLine(`${colors.cyan}Checking learning subsystem...${colors.reset}`);
+  writeLine("");
+  printLearningPersistence(result.learningPersistence);
+  writeLine("");
+  writeLine(`${colors.cyan}Checking data storage...${colors.reset}`);
+  writeLine("");
+  printSqliteCheck(result.sqliteCheck);
+  printDataDirectory(result.dataDirectory);
+  writeLine("");
+  printDoctorSummary(result);
+}
+
+// src/cli/doctor.ts
+var REQUIRED_NODE_MAJOR2 = 22;
+var API_KEY_VARS = ["ANTHROPIC_API_KEY", "OPENAI_API_KEY", "GOOGLE_AI_API_KEY"];
+var CONFIG_FILE_PATHS = ["./nexus-agents.yaml", "./nexus-agents.yml"];
+var DATA_SUBDIRECTORIES = [
+  "memory",
+  "memory/beliefs",
+  "learning",
+  "sessions",
+  "audit",
+  "voting",
+  "auth",
+  "research",
+  "checkpoints"
+];
+function getFixCommand(name, issue) {
+  const commands = {
+    claude: {
+      install: "npm install -g @anthropic-ai/claude-code",
+      upgrade: "npm update -g @anthropic-ai/claude-code",
+      auth: "claude auth login"
+    },
+    gemini: {
+      install: "npm install -g @google/gemini-cli",
+      upgrade: "npm update -g @google/gemini-cli",
+      auth: "gemini auth login"
+    },
+    codex: {
+      install: "npm install -g @openai/codex",
+      upgrade: "npm update -g @openai/codex",
+      auth: "codex auth login"
+    },
+    opencode: {
+      install: "npm install -g opencode-ai",
+      upgrade: "npm update -g opencode-ai",
+      auth: "opencode auth login"
+    }
+  };
+  return commands[name][issue] ?? "";
+}
+function createNotFoundResult(name, errorMsg) {
+  return {
+    name,
+    installed: false,
+    version: "N/A",
+    versionStatus: "unsupported",
+    authenticated: false,
+    error: errorMsg,
+    fix: getFixCommand(name, "install")
+  };
+}
+function detectAuthMethod(name) {
+  const authMethods = {
+    claude: "CLI auth",
+    gemini: "ADC/CLI auth",
+    codex: "CLI auth",
+    opencode: "CLI auth"
+  };
+  return authMethods[name];
+}
+function createHealthyResult(name, health, capacity) {
+  const authenticated = health.healthy;
+  const result = {
+    name,
+    installed: true,
+    version: health.version,
+    versionStatus: health.versionStatus,
+    authenticated,
+    ...authenticated && { authMethod: detectAuthMethod(name) },
+    ...capacity !== void 0 && { capacity }
+  };
+  if (health.message !== void 0 && health.message !== "") {
+    return { ...result, error: health.message };
+  }
+  if (!authenticated) {
+    return { ...result, fix: getFixCommand(name, "auth") };
+  }
+  if (health.versionStatus === "outdated") {
+    return { ...result, fix: getFixCommand(name, "upgrade") };
+  }
+  return result;
+}
+async function checkCli(name) {
+  const adapters = createAllAdapters();
+  const adapter = adapters.get(name);
+  if (!adapter) {
+    return createNotFoundResult(name, "Adapter not available");
+  }
+  try {
+    const health = await adapter.healthCheck();
+    let capacity;
+    try {
+      capacity = await adapter.getCapacity();
+    } catch (capErr) {
+      void capErr;
+    }
+    return createHealthyResult(name, health, capacity);
+  } catch (error) {
+    const message = getErrorMessage(error);
+    const isNotFound = message.includes("ENOENT") || message.includes("not found");
+    return createNotFoundResult(name, isNotFound ? "Not found in PATH" : message);
+  }
+}
+function checkNodeVersion() {
+  const version = process.version;
+  const major = Number(version.slice(1).split(".")[0]);
+  return {
+    version,
+    major,
+    supported: major >= REQUIRED_NODE_MAJOR2
+  };
+}
+function checkApiKeys() {
+  return API_KEY_VARS.map((name) => ({
+    name,
+    configured: typeof process.env[name] === "string" && process.env[name] !== ""
+  }));
+}
+function checkConfigFile() {
+  for (const configPath of CONFIG_FILE_PATHS) {
+    if (existsSync2(configPath)) {
+      return { found: true, path: configPath };
+    }
+  }
+  return { found: false, path: null };
+}
+function checkMcpServerReady() {
+  try {
+    const result = createServer({ name: "nexus-agents-doctor-check" });
+    return result.ok;
+  } catch {
+    return false;
+  }
+}
+function buildRegistryAdvisory(cliResults) {
+  const installedClis = new Set(cliResults.filter((c) => c.installed).map((c) => c.name));
+  const models = DEFAULT_MODEL_CAPABILITIES.models.filter((m) => m.cliName !== void 0).map((m) => {
+    const cliName = m.cliName ?? "";
+    const available = cliName.length > 0 && installedClis.has(cliName);
+    const reason = available ? `${cliName} CLI is installed` : `${cliName} CLI is not installed`;
+    return { modelId: m.id, displayName: m.displayName, cliName, available, reason };
+  });
+  const STALE_THRESHOLD_DAYS = 30;
+  const updatedAt = new Date(DEFAULT_MODEL_CAPABILITIES.updatedAt);
+  const nowMs = getTimeProvider().now();
+  const ageDays = Math.floor((nowMs - updatedAt.getTime()) / (1e3 * 60 * 60 * 24));
+  return {
+    totalModels: models.length,
+    availableModels: models.filter((m) => m.available).length,
+    unavailableModels: models.filter((m) => !m.available).length,
+    models,
+    registryAgeDays: ageDays,
+    registryStale: ageDays > STALE_THRESHOLD_DAYS
+  };
+}
+function countJsonlLines(filePath) {
+  if (!existsSync2(filePath)) return 0;
+  return readFileSync2(filePath, "utf-8").split("\n").filter((l) => l.trim().length > 0).length;
+}
+function readRulesMetadata(filePath) {
+  if (!existsSync2(filePath)) return { count: 0, savedAt: null };
+  try {
+    const raw = JSON.parse(readFileSync2(filePath, "utf-8"));
+    const rules = raw["rules"];
+    const saved = raw["savedAt"];
+    return {
+      count: Array.isArray(rules) ? rules.length : 0,
+      savedAt: typeof saved === "string" ? saved : null
+    };
+  } catch {
+    return { count: 0, savedAt: null };
+  }
+}
+function checkDirAccess(dir) {
+  const exists = existsSync2(dir);
+  if (!exists) return { exists: false, writable: false };
+  try {
+    accessSync(dir, fsConstants.W_OK);
+    return { exists: true, writable: true };
+  } catch {
+    return { exists: true, writable: false };
+  }
+}
+var DISABLED_CHECK = {
+  enabled: false,
+  dirExists: false,
+  dirWritable: false,
+  outcomeCount: 0,
+  ruleCount: 0,
+  rulesLastSaved: null,
+  error: null
+};
+function checkLearningPersistence() {
+  if (!isPersistenceEnabled()) return DISABLED_CHECK;
+  try {
+    const { exists: dirExists, writable: dirWritable } = checkDirAccess(LEARNING_DIR);
+    const outcomeCount = countJsonlLines(OUTCOMES_FILE);
+    const { count: ruleCount, savedAt: rulesLastSaved } = readRulesMetadata(RULES_FILE);
+    return {
+      enabled: true,
+      dirExists,
+      dirWritable,
+      outcomeCount,
+      ruleCount,
+      rulesLastSaved,
+      error: null
+    };
+  } catch (error) {
+    return {
+      enabled: true,
+      dirExists: false,
+      dirWritable: false,
+      outcomeCount: 0,
+      ruleCount: 0,
+      rulesLastSaved: null,
+      error: getErrorMessage(error)
+    };
+  }
+}
+async function checkSqlite() {
+  try {
+    await import("better-sqlite3");
+    return { available: true, error: null };
+  } catch (error) {
+    const msg = getErrorMessage(error);
+    const isNotFound = msg.includes("Cannot find") || msg.includes("MODULE_NOT_FOUND");
+    return {
+      available: false,
+      error: isNotFound ? "better-sqlite3 not installed \u2014 5 memory backends unavailable" : `better-sqlite3 load error: ${msg}`
+    };
+  }
+}
+function checkDataDirectory() {
+  const rootPath = join2(homedir2(), ".nexus-agents");
+  const rootExists = existsSync2(rootPath);
+  const subdirectories = DATA_SUBDIRECTORIES.map((name) => {
+    const fullPath = join2(rootPath, name);
+    const exists = existsSync2(fullPath);
+    return { name, path: fullPath, exists, writable: exists && isWritable(fullPath) };
+  });
+  return { rootExists, rootPath, subdirectories };
+}
+function isWritable(dirPath) {
+  try {
+    accessSync(dirPath, fsConstants.W_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function runDoctor() {
+  const clis = await Promise.all([
+    checkCli("claude"),
+    checkCli("gemini"),
+    checkCli("codex"),
+    checkCli("opencode")
+  ]);
+  const nodeVersion = checkNodeVersion();
+  const apiKeys = checkApiKeys();
+  const configFile = checkConfigFile();
+  const mcpServerReady = checkMcpServerReady();
+  const codexCheck = clis.find((c) => c.name === "codex");
+  const mcpClientReady = codexCheck?.installed ?? false;
+  const registryAdvisory = buildRegistryAdvisory(clis);
+  const learningPersistence = checkLearningPersistence();
+  const sqliteCheck = await checkSqlite();
+  const dataDirectory = checkDataDirectory();
+  const hasAuthMethod = apiKeys.some((k) => k.configured) || clis.some((c) => c.installed && c.authenticated);
+  const allHealthy = nodeVersion.supported && hasAuthMethod && mcpServerReady && clis.every((c) => c.installed && c.authenticated && c.versionStatus !== "unsupported");
+  return {
+    clis,
+    nodeVersion,
+    apiKeys,
+    configFile,
+    mcpServerReady,
+    mcpClientReady,
+    registryAdvisory,
+    learningPersistence,
+    sqliteCheck,
+    dataDirectory,
+    allHealthy,
+    timestamp: new Date(getTimeProvider().now())
+  };
+}
+async function doctorCommand(options = {}) {
+  const result = await runDoctor();
+  printDoctorResults(result);
+  if (options.fix === true) {
+    await runDoctorFix(result);
+  }
+  return result.allHealthy ? 0 : 1;
+}
+async function runDoctorFix(result) {
+  const writeLine2 = (text) => {
+    process.stdout.write(text + "\n");
+  };
+  writeLine2("");
+  writeLine2("\x1B[1mAuto-fix\x1B[0m");
+  writeLine2("\u2500".repeat(40));
+  let fixCount = 0;
+  if (!result.dataDirectory.rootExists || result.dataDirectory.subdirectories.some((d) => !d.exists || !d.writable)) {
+    const { runSetup } = await import("./setup-command-AV4MODEL.js");
+    const setupResult = runSetup({
+      skipMcp: true,
+      skipRules: true,
+      skipHooks: true,
+      skipConfig: true,
+      skipOpencode: true
+    });
+    if (setupResult.success) {
+      writeLine2("\u2713 Created missing data directories");
+      fixCount++;
+    }
+  }
+  if (!result.configFile.found) {
+    const { runConfigInitSync } = await import("./setup-config-PWK6WHMG.js");
+    const configResult = runConfigInitSync(process.cwd(), false, false);
+    if (configResult.success && configResult.created) {
+      writeLine2(`\u2713 Generated config: ${configResult.path}`);
+      fixCount++;
+    }
+  }
+  if (!result.sqliteCheck.available) {
+    writeLine2("");
+    writeLine2("\u26A0 better-sqlite3 not installed (manual step required):");
+    writeLine2("  npm install -g better-sqlite3");
+  }
+  if (fixCount > 0) {
+    writeLine2("");
+    writeLine2(
+      `\x1B[32m${String(fixCount)} issue(s) fixed.\x1B[0m Re-run \x1B[1mnexus-agents doctor\x1B[0m to verify.`
+    );
+  } else {
+    writeLine2("No auto-fixable issues found.");
+  }
+  writeLine2("");
+}
+
+// src/cli/setup-data-dir.ts
+var NEXUS_DATA_DIR = join3(homedir3(), ".nexus-agents");
+var RESTRICTED_DIRS = /* @__PURE__ */ new Set(["auth"]);
+function initDataDirectories(dryRun = false) {
+  const created = [];
+  const alreadyExisted = [];
+  try {
+    ensureDir(NEXUS_DATA_DIR, dryRun, created, alreadyExisted);
+    for (const subdir of DATA_SUBDIRECTORIES) {
+      const mode = RESTRICTED_DIRS.has(subdir) ? 448 : void 0;
+      ensureDir(join3(NEXUS_DATA_DIR, subdir), dryRun, created, alreadyExisted, mode);
+    }
+    return { success: true, rootPath: NEXUS_DATA_DIR, created, alreadyExisted, error: null };
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : String(error);
+    return { success: false, rootPath: NEXUS_DATA_DIR, created, alreadyExisted, error: msg };
+  }
+}
+function ensureDir(dirPath, dryRun, created, alreadyExisted, mode) {
+  if (existsSync3(dirPath)) {
+    alreadyExisted.push(dirPath);
+    return;
+  }
+  if (!dryRun) {
+    mkdirSync(dirPath, { recursive: true, ...mode !== void 0 ? { mode } : {} });
+  }
+  created.push(dirPath);
+}
+
+export {
+  VERSION,
+  LoggingConfigSchema,
+  ProviderConfigSchema,
+  ModelTiersSchema,
+  ModelConfigSchema,
+  WorkflowConfigSchema,
+  VALID_EXPERT_TIERS,
+  VALID_EXPERT_DOMAINS,
+  MAX_SYSTEM_PROMPT_LENGTH,
+  CustomExpertDefinitionSchema,
+  ExpertDefinitionSchema,
+  ExpertConfigSchema,
+  DEFAULT_TOOL_RATE_LIMITS,
+  SecurityConfigSchema,
+  AppConfigSchema,
+  defaultConfig,
+  adaptRoutingConfig,
+  DEFAULTS,
+  getConfigManager,
+  loadConfig,
+  getConfig,
+  validateNexusEnv,
+  getKnownNexusVarNames,
+  AvailabilityCache,
+  resolveFallback,
+  getFallbackChain,
+  getCliForModelId,
+  getAvailabilityCache,
+  resetAvailabilityCache,
+  filterAvailableModels,
+  DEFAULT_TASK_TTL_MS,
+  clampTaskTtl,
+  checkApiKeys,
+  checkSqlite,
+  checkDataDirectory,
+  runDoctor,
+  doctorCommand,
+  initDataDirectories,
+  createServer,
+  connectTransport,
+  startStdioServer,
+  closeServer
+};
+//# sourceMappingURL=chunk-C3FGEDD7.js.map