nexus-agents 2.70.0 → 2.71.0

package/dist/cli.js

@@ -16,7 +16,7 @@ import "./chunk-32RIOULO.js";
 import {
   setupCommandAsync,
   verifyCommand
-} from "./chunk-SU4667UB.js";
+} from "./chunk-7LHQBMBM.js";
 import "./chunk-OF7CYMMA.js";
 import {
   AuthHandler,
@@ -34,6 +34,7 @@ import {
   WorkflowDefinitionSchema,
   addResearchPaper,
   analyzeTools,
+  calculateFitnessScore,
   createAgentStages,
   createAnnotationsProxy,
   createAuditLogger,
@@ -43,6 +44,7 @@ import {
   createEventBusBridge,
   createExecutor,
   createFeedbackIntegration,
+  createFitnessScoreCalculator,
   createGatewayServerProxy,
   createHarnessExecutor,
   createLearnablePolicy,
@@ -107,6 +109,7 @@ import {
   registerExecuteExpertTool,
   registerExecuteSpecTool,
   registerExtractSymbolsTool,
+  registerImprovementReviewTool,
   registerIssueTriageTool,
   registerListExpertsTool,
   registerListWorkflowsTool,
@@ -146,7 +149,7 @@ import {
   validateCommand,
   validateWorkflow,
   wrapInMarkdownFence
-} from "./chunk-5RMZQEP5.js";
+} from "./chunk-AGVLFRN7.js";
 import "./chunk-ED6VQWNG.js";
 import {
   resolveToken
@@ -168,7 +171,7 @@ import {
   shutdownToolMemory,
   validateTimeout,
   warnIfSimulatedOutsideTests
-} from "./chunk-UMLBVSW4.js";
+} from "./chunk-POQQ7A5E.js";
 import "./chunk-VGZJIR22.js";
 import {
   loadPapersRegistry,
@@ -182,8 +185,8 @@ import {
   evaluatePolicy,
   parsePRUrl,
   sanitizeInput
-} from "./chunk-7QWNOE23.js";
-import "./chunk-7ZPYV4HO.js";
+} from "./chunk-KJCSRP34.js";
+import "./chunk-NER7H3RJ.js";
 import "./chunk-LMRKHQG5.js";
 import "./chunk-BC3M4VLP.js";
 import "./chunk-AP2FD37C.js";
@@ -206,7 +209,7 @@ import {
   loadConfig,
   runDoctor,
   validateNexusEnv
-} from "./chunk-PPGX45YS.js";
+} from "./chunk-U6BK5DQU.js";
 import {
   DEFAULTS
 } from "./chunk-L2LQ3TSV.js";
@@ -14176,546 +14179,6 @@ async function demoCommand(subcommand, args, options) {
   }
 }
 
-// src/governance/fitness-score.ts
-import { existsSync as existsSync12, readFileSync as readFileSync6, readdirSync, statSync } from "fs";
-import { join as join12 } from "path";
-function findPkgRoot() {
-  let dir = import.meta.dirname;
-  for (let i = 0; i < 10; i++) {
-    const pkgPath = join12(dir, "package.json");
-    if (existsSync12(pkgPath)) {
-      const content = readFileSync6(pkgPath, "utf-8");
-      if (content.includes('"nexus-agents"')) return dir;
-    }
-    dir = join12(dir, "..");
-  }
-  return join12(import.meta.dirname, "../..");
-}
-var PKG_ROOT = findPkgRoot();
-var SRC_ROOT = join12(PKG_ROOT, "src");
-var REPO_ROOT = join12(PKG_ROOT, "../..");
-var DOCS_ROOT = join12(REPO_ROOT, "docs");
-var DETERMINISM_EXCLUDES = [
-  /\.test\.ts$/,
-  /\.spec\.ts$/,
-  /random-provider\.ts$/,
-  /time-provider\.ts$/
-];
-function countFiles(dir, pattern) {
-  if (!existsSync12(dir)) return 0;
-  let count = 0;
-  for (const entry of readdirSync(dir)) {
-    const fullPath = join12(dir, entry);
-    const stat2 = statSync(fullPath);
-    if (stat2.isDirectory() && !entry.startsWith(".")) {
-      count += countFiles(fullPath, pattern);
-    } else if (pattern.test(entry)) {
-      count++;
-    }
-  }
-  return count;
-}
-function fileContains(filePath, pattern) {
-  if (!existsSync12(filePath)) return false;
-  return pattern.test(readFileSync6(filePath, "utf-8"));
-}
-function isExcluded(entry, excludePatterns) {
-  return excludePatterns?.some((p) => p.test(entry)) ?? false;
-}
-function countMatchesInFile(fullPath, contentPattern) {
-  const matches = readFileSync6(fullPath, "utf-8").match(contentPattern);
-  return matches?.length ?? 0;
-}
-function countPatternInDir(dir, filePattern, contentPattern, excludePatterns) {
-  if (!existsSync12(dir)) return 0;
-  let count = 0;
-  for (const entry of readdirSync(dir)) {
-    const fullPath = join12(dir, entry);
-    const stat2 = statSync(fullPath);
-    if (stat2.isDirectory() && !entry.startsWith(".") && entry !== "node_modules") {
-      count += countPatternInDir(fullPath, filePattern, contentPattern, excludePatterns);
-    } else if (filePattern.test(entry) && !isExcluded(entry, excludePatterns)) {
-      count += countMatchesInFile(fullPath, contentPattern);
-    }
-  }
-  return count;
-}
-function clamp2(score, max) {
-  return Math.max(0, Math.min(max, score));
-}
-var FitnessScoreCalculator = class {
-  logger;
-  checks = [];
-  constructor(logger17) {
-    this.logger = logger17 ?? createLogger({ component: "FitnessScoreCalculator" });
-    this.registerDefaultChecks();
-  }
-  /** Register default fitness checks. */
-  registerDefaultChecks() {
-    const reg = (dimension, maxPoints, name, check) => {
-      this.checks.push({ dimension, maxPoints, name, check });
-    };
-    reg("canonicalPaths", 20, "Canonical Paths", () => this.checkCanonicalPaths());
-    reg("explicitBehavior", 15, "Explicit Behavior", () => this.checkExplicitBehavior());
-    reg("determinism", 15, "Determinism", () => this.checkDeterminism());
-    reg("observability", 15, "Observability", () => this.checkObservability());
-    reg("configSimplicity", 10, "Config Simplicity", () => this.checkConfigSimplicity());
-    reg("layerSeparation", 10, "Layer Separation", () => this.checkLayerSeparation());
-    reg("operatorErgonomics", 10, "Operator Ergonomics", () => this.checkOperatorErgonomics());
-    reg(
-      "governanceIntegration",
-      5,
-      "Governance Integration",
-      () => this.checkGovernanceIntegration()
-    );
-  }
-  /** Run full fitness audit. */
-  audit(version) {
-    const findings = [];
-    const dimensions = {};
-    for (const check of this.checks) {
-      this.logger.debug(`Running fitness check: ${check.name}`);
-      const result = check.check();
-      dimensions[check.dimension] = result.score;
-      findings.push(...result.findings);
-    }
-    const score = Object.values(dimensions).reduce((sum, val) => sum + val, 0);
-    this.logger.info("Fitness audit complete", { score, version });
-    const safeDim = (k) => dimensions[k] ?? 0;
-    const typedDimensions = {
-      canonicalPaths: safeDim("canonicalPaths"),
-      explicitBehavior: safeDim("explicitBehavior"),
-      determinism: safeDim("determinism"),
-      observability: safeDim("observability"),
-      configSimplicity: safeDim("configSimplicity"),
-      layerSeparation: safeDim("layerSeparation"),
-      operatorErgonomics: safeDim("operatorErgonomics"),
-      governanceIntegration: safeDim("governanceIntegration")
-    };
-    return {
-      score,
-      dimensions: typedDimensions,
-      findings,
-      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-      version
-    };
-  }
-  // =========================================================================
-  // Individual Checks — real filesystem analysis
-  // =========================================================================
-  /**
-   * Check canonical paths: penalize duplicate router implementations.
-   *
-   * The current minimum is 6 (raised from 5 in #2063 after an audit):
-   *   1. composite-router — pipeline orchestrator
-   *   2. budget-router — budget/cost filtering
-   *   3. zero-router — hard-constraint exclusion
-   *   4. preference-router — user/task preference application
-   *   5. topsis-router — TOPSIS multi-criteria scoring
-   *   6. agreement-cascade-router — agreement-based cascade retry
-   *
-   * Each stage is distinct per CLAUDE.md's documented pipeline:
-   * Task → BudgetRouter → ZeroRouter → PreferenceRouter → TopsisRouter → Agreement → Model
-   */
-  checkCanonicalPaths() {
-    const findings = [];
-    let score = 20;
-    const routerCount = countFiles(join12(SRC_ROOT, "cli-adapters"), /router\.ts$/);
-    const ROUTER_COUNT_THRESHOLD = 6;
-    if (routerCount > ROUTER_COUNT_THRESHOLD) {
-      const excess = routerCount - ROUTER_COUNT_THRESHOLD;
-      const deduction = Math.min(5, excess);
-      score -= deduction;
-      findings.push(
-        this.finding(
-          "canonicalPaths",
-          "warning",
-          `${String(routerCount)} router implementations found (target: <=${String(ROUTER_COUNT_THRESHOLD)})`,
-          deduction,
-          "Consolidate duplicate routers into CompositeRouter"
-        )
-      );
-    }
-    if (existsSync12(join12(SRC_ROOT, "cli-adapters/composite-router.ts"))) {
-      score += 2;
-    } else {
-      score -= 3;
-      findings.push(
-        this.finding(
-          "canonicalPaths",
-          "critical",
-          "CompositeRouter missing \u2014 no unified routing entry point",
-          3
-        )
-      );
-    }
-    score = this.checkOrchestratorInterface(score, findings);
-    return { score: clamp2(score, 20), findings };
-  }
-  /** Sub-check for IOrchestrator interface and adapter wiring. */
-  checkOrchestratorInterface(score, findings) {
-    const orchPath = join12(SRC_ROOT, "core/types/orchestrator.ts");
-    if (existsSync12(orchPath) && fileContains(orchPath, /interface IOrchestrator/)) {
-      score += 3;
-    } else {
-      score -= 2;
-      findings.push(
-        this.finding("canonicalPaths", "warning", "No IOrchestrator interface in core/types", 2)
-      );
-    }
-    const adapterPath = join12(SRC_ROOT, "orchestration/orchestrator-adapters.ts");
-    if (existsSync12(adapterPath) && fileContains(adapterPath, /TechLeadAdapter|PuppeteerAdapter/)) {
-      score += 2;
-    }
-    return score;
-  }
-  /**
-   * Check explicit behavior: penalize hidden/magic behavior.
-   *
-   * Implementation is intentionally filesystem-signal-based (no AST parse).
-   * The `NEXUS_ALLOW_MOCK_ORCHESTRATION` guard and magic-routing pattern
-   * grep capture the observable failure modes that historically slipped
-   * past review. AST-based detection of implicit fallbacks was considered
-   * but not pursued — it would significantly widen this function's
-   * footprint and the filesystem signals already catch the recurring
-   * regressions. Revisit only if a new class of hidden-behavior bug
-   * surfaces that this grep-over-source approach can't catch.
-   */
-  checkExplicitBehavior() {
-    const findings = [];
-    let score = 15;
-    const mockGuardCount = countPatternInDir(
-      SRC_ROOT,
-      /\.ts$/,
-      /NEXUS_ALLOW_MOCK_ORCHESTRATION/g,
-      DETERMINISM_EXCLUDES
-    );
-    if (mockGuardCount === 0) {
-      score -= 3;
-      findings.push(
-        this.finding(
-          "explicitBehavior",
-          "warning",
-          "No NEXUS_ALLOW_MOCK_ORCHESTRATION guard found \u2014 mock fallback may be implicit",
-          3,
-          "Require explicit env var for mock orchestration"
-        )
-      );
-    }
-    const magicRouting = countPatternInDir(
-      SRC_ROOT,
-      /\.ts$/,
-      /fallback.*=.*true|implicitRoute/g,
-      DETERMINISM_EXCLUDES
-    );
-    if (magicRouting > 5) {
-      const deduction = Math.min(3, Math.floor(magicRouting / 3));
-      score -= deduction;
-      findings.push(
-        this.finding(
-          "explicitBehavior",
-          "info",
-          `${String(magicRouting)} implicit fallback/routing patterns detected`,
-          deduction
-        )
-      );
-    }
-    return { score: clamp2(score, 15), findings };
-  }
-  /** Check determinism: penalize unseeded random and raw Date.now(). */
-  checkDeterminism() {
-    const findings = [];
-    let score = 15;
-    score = this.checkRandomDeterminism(score, findings);
-    score = this.checkTimeDeterminism(score, findings);
-    return { score: clamp2(score, 15), findings };
-  }
-  /** Sub-check for Math.random() and injectable random provider. */
-  checkRandomDeterminism(score, findings) {
-    const randomCount = countPatternInDir(
-      SRC_ROOT,
-      /\.ts$/,
-      /Math\.random\(\)/g,
-      DETERMINISM_EXCLUDES
-    );
-    if (randomCount > 10) {
-      const deduction = Math.min(5, Math.floor(randomCount / 5));
-      score -= deduction;
-      findings.push(
-        this.finding(
-          "determinism",
-          "warning",
-          `${String(randomCount)} unseeded Math.random() calls in production code`,
-          deduction,
-          "Use getRandomProvider() for injectable randomness"
-        )
-      );
-    } else if (randomCount === 0) {
-      score += 2;
-    }
-    if (existsSync12(join12(SRC_ROOT, "core/random-provider.ts"))) {
-      score += 1;
-    }
-    const randomUsage = countPatternInDir(
-      SRC_ROOT,
-      /\.ts$/,
-      /getRandomProvider\(\)/g,
-      DETERMINISM_EXCLUDES
-    );
-    if (randomUsage > 5) {
-      score += 1;
-    }
-    return score;
-  }
-  /** Sub-check for Date.now() and injectable time provider. */
-  checkTimeDeterminism(score, findings) {
-    const dateNowCount = countPatternInDir(
-      SRC_ROOT,
-      /\.ts$/,
-      /Date\.now\(\)/g,
-      DETERMINISM_EXCLUDES
-    );
-    if (dateNowCount > 50) {
-      score -= 2;
-      findings.push(
-        this.finding(
-          "determinism",
-          "info",
-          `${String(dateNowCount)} Date.now() calls in production code`,
-          2,
-          "Use getTimeProvider() for injectable time"
-        )
-      );
-    }
-    if (existsSync12(join12(SRC_ROOT, "core/time-provider.ts"))) {
-      score += 1;
-    }
-    const timeUsage = countPatternInDir(
-      SRC_ROOT,
-      /\.ts$/,
-      /getTimeProvider\(\)/g,
-      DETERMINISM_EXCLUDES
-    );
-    if (timeUsage > 10) {
-      score += 1;
-    }
-    return score;
-  }
-  /** Check observability: reward tracing, logging, and audit coverage. */
-  checkObservability() {
-    const findings = [];
-    let score = 15;
-    if (existsSync12(join12(SRC_ROOT, "observability/swarm-observer.ts"))) {
-      score += 3;
-    } else {
-      score -= 3;
-      findings.push(
-        this.finding(
-          "observability",
-          "warning",
-          "No SwarmObserver found",
-          3,
-          "Add observability/swarm-observer.ts"
-        )
-      );
-    }
-    if (existsSync12(join12(SRC_ROOT, "core/trace.ts"))) {
-      score += 2;
-    }
-    const loggerCount = countPatternInDir(SRC_ROOT, /\.ts$/, /createLogger\(/g);
-    if (loggerCount > 50) {
-      score += 2;
-    } else {
-      findings.push(
-        this.finding(
-          "observability",
-          "info",
-          `Only ${String(loggerCount)} createLogger() calls (target: >50)`,
-          0
-        )
-      );
-    }
-    if (existsSync12(join12(SRC_ROOT, "audit"))) {
-      score += 2;
-    }
-    return { score: clamp2(score, 15), findings };
-  }
-  /** Check config simplicity: penalize excessive schema sprawl. */
-  checkConfigSimplicity() {
-    const findings = [];
-    let score = 10;
-    const schemaCount = countFiles(join12(SRC_ROOT, "config"), /schema.*\.ts$/);
-    if (schemaCount > 10) {
-      score -= 2;
-      findings.push(
-        this.finding(
-          "configSimplicity",
-          "info",
-          `${String(schemaCount)} config schemas (target: <=10)`,
-          2,
-          "Consolidate related schemas"
-        )
-      );
-    } else {
-      score += 1;
-    }
-    if (existsSync12(join12(SRC_ROOT, "config/config-loader.ts"))) {
-      score += 2;
-    }
-    if (existsSync12(join12(SRC_ROOT, "config/config-manager.ts"))) {
-      score += 1;
-    }
-    return { score: clamp2(score, 10), findings };
-  }
-  /** Check layer separation: penalize cross-layer imports. */
-  checkLayerSeparation() {
-    const findings = [];
-    let score = 10;
-    const adapterAgentImports = countPatternInDir(
-      join12(SRC_ROOT, "adapters"),
-      /\.ts$/,
-      /from ['"]\.\.\/agents\//g
-    );
-    if (adapterAgentImports > 0) {
-      const deduction = Math.min(5, adapterAgentImports);
-      score -= deduction;
-      findings.push(
-        this.finding(
-          "layerSeparation",
-          "warning",
-          `${String(adapterAgentImports)} adapter->agent import violations`,
-          deduction,
-          "Adapters should not import from agents layer"
-        )
-      );
-    } else {
-      score += 2;
-    }
-    const coreMcpImports = countPatternInDir(
-      join12(SRC_ROOT, "core"),
-      /\.ts$/,
-      /from ['"]\.\.\/mcp\//g
-    );
-    if (coreMcpImports > 0) {
-      const deduction = Math.min(3, coreMcpImports);
-      score -= deduction;
-      findings.push(
-        this.finding(
-          "layerSeparation",
-          "critical",
-          `${String(coreMcpImports)} core->MCP import violations`,
-          deduction,
-          "Core must not depend on MCP layer"
-        )
-      );
-    } else {
-      score += 1;
-    }
-    return { score: clamp2(score, 10), findings };
-  }
-  /** Check operator ergonomics: reward rich CLI commands. */
-  checkOperatorErgonomics() {
-    const findings = [];
-    let score = 10;
-    const commandCount = countFiles(join12(SRC_ROOT, "cli"), /\.ts$/);
-    if (commandCount >= 20) {
-      score += 3;
-    } else {
-      findings.push(
-        this.finding(
-          "operatorErgonomics",
-          "info",
-          `${String(commandCount)} CLI commands (target: >=20)`,
-          0
-        )
-      );
-    }
-    score = this.checkCliCommands(score, findings);
-    return { score: clamp2(score, 10), findings };
-  }
-  /** Sub-check for essential CLI commands (doctor, setup, demo, config). */
-  checkCliCommands(score, findings) {
-    const commands = [
-      ["cli/doctor.ts", "Doctor command", 2],
-      ["cli/setup-command.ts", "Setup wizard", 2],
-      ["cli/demo-command.ts", "Demo command", 1],
-      ["cli/config-command.ts", "Config command", 1]
-    ];
-    for (const [path23, name, bonus] of commands) {
-      if (existsSync12(join12(SRC_ROOT, path23))) {
-        score += bonus;
-      } else {
-        findings.push(this.finding("operatorErgonomics", "info", `Missing ${name} (${path23})`, 0));
-      }
-    }
-    return score;
-  }
-  /** Check governance integration: policy firewall, rate limiter, docs. */
-  checkGovernanceIntegration() {
-    const findings = [];
-    let score = 5;
-    score = this.checkGovernanceDocs(score, findings);
-    score = this.checkGovernanceInfra(score, findings);
-    return { score: clamp2(score, 5), findings };
-  }
-  /** Sub-check for governance documentation artifacts. */
-  checkGovernanceDocs(score, findings) {
-    if (!existsSync12(join12(REPO_ROOT, "CLAUDE.md"))) {
-      score -= 3;
-      findings.push(
-        this.finding("governanceIntegration", "critical", "No CLAUDE.md governance document", 3)
-      );
-    } else {
-      score += 1;
-    }
-    if (existsSync12(join12(DOCS_ROOT, "architecture/wiring-graph.json"))) {
-      score += 1;
-    }
-    if (existsSync12(join12(DOCS_ROOT, "adr"))) {
-      score += 1;
-    } else {
-      findings.push(this.finding("governanceIntegration", "info", "No ADR directory", 0));
-    }
-    return score;
-  }
-  /** Sub-check for governance runtime infrastructure. */
-  checkGovernanceInfra(score, findings) {
-    const hasPolicyFirewall = countPatternInDir(join12(SRC_ROOT, "security"), /\.ts$/, /PolicyGate|policyFirewall/g) > 0;
-    if (hasPolicyFirewall) {
-      score += 1;
-    } else {
-      findings.push(
-        this.finding(
-          "governanceIntegration",
-          "warning",
-          "No policy firewall detected in security layer",
-          0
-        )
-      );
-    }
-    const hasRateLimiter = countPatternInDir(SRC_ROOT, /\.ts$/, /RateLimiter|rateLimiter/g) > 0;
-    if (hasRateLimiter) {
-      score += 1;
-    }
-    return score;
-  }
-  /** Helper to create a FitnessFinding with defaults. */
-  finding(dimension, severity, description, pointsDeducted, suggestion) {
-    const base = { dimension, severity, description, pointsDeducted };
-    if (suggestion !== void 0) {
-      return { ...base, suggestion };
-    }
-    return base;
-  }
-};
-function createFitnessScoreCalculator(logger17) {
-  return new FitnessScoreCalculator(logger17);
-}
-function calculateFitnessScore(version) {
-  const calculator = createFitnessScoreCalculator();
-  return calculator.audit(version);
-}
-
 // src/cli/fitness-audit.ts
 var COLORS = colors;
 function formatScore(score, max) {
@@ -15149,11 +14612,11 @@ async function releaseNotesCommand(args) {
 }
 
 // src/cli/release-validate-command.ts
-import { readFileSync as readFileSync8 } from "fs";
+import { readFileSync as readFileSync7 } from "fs";
 
 // src/cli/release-validate-helpers.ts
 import { execSync as execSync2 } from "child_process";
-import { existsSync as existsSync13, readFileSync as readFileSync7 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync6 } from "fs";
 async function validateSecurity(options) {
   const startTime = Date.now();
   const findings = [];
@@ -15172,7 +14635,7 @@ async function validateSecurity(options) {
       remediation: "Run npm audit fix or review and update vulnerable dependencies."
     });
   }
-  if (existsSync13(".env")) {
+  if (existsSync12(".env")) {
     findings.push({
       severity: "error",
       category: "security",
@@ -15268,7 +14731,7 @@ async function validateArchitecture2(options) {
 async function validateDocumentation(options) {
   const startTime = Date.now();
   const findings = [];
-  if (!existsSync13("CHANGELOG.md")) {
+  if (!existsSync12("CHANGELOG.md")) {
     findings.push({
       severity: "error",
       category: "docs",
@@ -15276,7 +14739,7 @@ async function validateDocumentation(options) {
       description: "No CHANGELOG.md found in repository root.",
       remediation: "Create CHANGELOG.md following Keep a Changelog format."
     });
-  } else if (!readFileSync7("CHANGELOG.md", "utf-8").includes(options.version)) {
+  } else if (!readFileSync6("CHANGELOG.md", "utf-8").includes(options.version)) {
     findings.push({
       severity: "warning",
       category: "docs",
@@ -15286,7 +14749,7 @@ async function validateDocumentation(options) {
     });
   }
   const pkgCl = "packages/nexus-agents/CHANGELOG.md";
-  if (existsSync13(pkgCl) && !readFileSync7(pkgCl, "utf-8").includes(options.version)) {
+  if (existsSync12(pkgCl) && !readFileSync6(pkgCl, "utf-8").includes(options.version)) {
     findings.push({
       severity: "warning",
       category: "docs",
@@ -15295,7 +14758,7 @@ async function validateDocumentation(options) {
       remediation: "Run pnpm changeset:version to generate changelog from pending changesets."
     });
   }
-  if (!existsSync13("README.md")) {
+  if (!existsSync12("README.md")) {
     findings.push({
       severity: "error",
       category: "docs",
@@ -15304,8 +14767,8 @@ async function validateDocumentation(options) {
       remediation: "Create README.md with project overview and usage instructions."
     });
   }
-  if (existsSync13("CLAUDE.md")) {
-    const claudeMd = readFileSync7("CLAUDE.md", "utf-8");
+  if (existsSync12("CLAUDE.md")) {
+    const claudeMd = readFileSync6("CLAUDE.md", "utf-8");
     const match = claudeMd.match(/Governance Version: (\d{4}-\d{2}-\d{2})/);
     if (match?.[1]) {
       const governanceDate = new Date(match[1]);
@@ -15413,7 +14876,7 @@ var DEFAULT_OPTIONS2 = {
 };
 function readVersionFromPackage() {
   try {
-    const raw = JSON.parse(readFileSync8("package.json", "utf-8"));
+    const raw = JSON.parse(readFileSync7("package.json", "utf-8"));
     if (typeof raw === "object" && raw !== null && "version" in raw) {
       const pkg = raw;
       return typeof pkg.version === "string" ? pkg.version : "unknown";
@@ -15527,7 +14990,7 @@ async function releaseValidateCommand(args) {
 }
 
 // src/cli/release-announce-command.ts
-import { readFileSync as readFileSync9, existsSync as existsSync14 } from "fs";
+import { readFileSync as readFileSync8, existsSync as existsSync13 } from "fs";
 
 // src/cli/release-announce-types.ts
 var BLUESKY_LIMITS = {
@@ -15594,8 +15057,8 @@ var DEFAULT_OPTIONS3 = {
   verbose: false
 };
 function extractHighlightsFromChangelog(version) {
-  if (!existsSync14("CHANGELOG.md")) return [];
-  const changelog = readFileSync9("CHANGELOG.md", "utf-8");
+  if (!existsSync13("CHANGELOG.md")) return [];
+  const changelog = readFileSync8("CHANGELOG.md", "utf-8");
   const escaped = version.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const versionRegex = new RegExp(`## \\[${escaped}\\][^#]*`, "s");
   const match = changelog.match(versionRegex);
@@ -15857,7 +15320,7 @@ async function releaseAnnounceCommand(args) {
     version = args.options.version;
   } else {
     try {
-      const pkg = JSON.parse(readFileSync9("package.json", "utf-8"));
+      const pkg = JSON.parse(readFileSync8("package.json", "utf-8"));
       if (!pkg.version) {
         console.error(`${colors.red}Error: Could not determine version${colors.reset}`);
         return 1;
@@ -16789,13 +16252,13 @@ function formatEvalDetails(baseline, reflective, improvement, datasetSize) {
 }
 
 // src/cli/auth-command.ts
-import { existsSync as existsSync16, statSync as statSync2, chmodSync } from "fs";
+import { existsSync as existsSync15, statSync, chmodSync } from "fs";
 function isValidAuthSubcommand(value) {
   return value === "init" || value === "show" || value === "rotate" || value === "help";
 }
 function getFilePermissions(filePath) {
   try {
-    const stats = statSync2(filePath);
+    const stats = statSync(filePath);
     return (stats.mode & 511).toString(8);
   } catch {
     return void 0;
@@ -16809,7 +16272,7 @@ function fixPermissions(filePath) {
 }
 function runAuthInit(options) {
   const tokenFile = options.tokenFile ?? getDefaultTokenPath();
-  const tokenExists = existsSync16(tokenFile);
+  const tokenExists = existsSync15(tokenFile);
   if (tokenExists && options.force !== true) {
     return {
       success: false,
@@ -16833,7 +16296,7 @@ function runAuthInit(options) {
 }
 function runAuthShow(options) {
   const tokenFile = options.tokenFile ?? getDefaultTokenPath();
-  const tokenExists = existsSync16(tokenFile);
+  const tokenExists = existsSync15(tokenFile);
   const token = readStoredToken(tokenFile);
   if (!tokenExists || token === void 0) {
     return {
@@ -16854,7 +16317,7 @@ function runAuthShow(options) {
 }
 function runAuthRotate(options) {
   const tokenFile = options.tokenFile ?? getDefaultTokenPath();
-  const tokenExists = existsSync16(tokenFile);
+  const tokenExists = existsSync15(tokenFile);
   if (!tokenExists) {
     return {
       success: false,
@@ -16890,14 +16353,14 @@ function runAuthCommand(options) {
         success: true,
         operation: "help",
         tokenFile: getDefaultTokenPath(),
-        tokenExists: existsSync16(getDefaultTokenPath())
+        tokenExists: existsSync15(getDefaultTokenPath())
       };
     default:
       return {
         success: false,
         operation: "help",
         tokenFile: getDefaultTokenPath(),
-        tokenExists: existsSync16(getDefaultTokenPath()),
+        tokenExists: existsSync15(getDefaultTokenPath()),
         error: `Unknown subcommand: ${String(subcommand)}`
       };
   }
@@ -17740,22 +17203,22 @@ function isValidCommand(value) {
 }
 
 // src/cli-commands-handlers.ts
-import { existsSync as existsSync21 } from "fs";
+import { existsSync as existsSync20 } from "fs";
 
 // src/cli/init-portable.ts
 import {
-  existsSync as existsSync20,
+  existsSync as existsSync19,
   mkdirSync as mkdirSync5,
-  readdirSync as readdirSync2,
-  statSync as statSync3,
+  readdirSync,
+  statSync as statSync2,
   appendFileSync as appendFileSync2,
-  readFileSync as readFileSync12
+  readFileSync as readFileSync11
 } from "fs";
-import { resolve as resolve11, join as join16, isAbsolute as isAbsolute2 } from "path";
+import { resolve as resolve11, join as join15, isAbsolute as isAbsolute2 } from "path";
 
 // src/cli/mcp-config-emitter.ts
-import { existsSync as existsSync17, readFileSync as readFileSync10, writeFileSync as writeFileSync5, appendFileSync } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync9, writeFileSync as writeFileSync5, appendFileSync } from "fs";
+import { join as join12 } from "path";
 var MCP_CONFIG_FILENAME = ".mcp.json";
 var NEXUS_SERVER_KEY = "nexus-agents";
 function buildNexusServerEntry(dataDir, commandPath) {
@@ -17778,10 +17241,10 @@ function entriesEqual(a, b) {
   return true;
 }
 function loadExistingConfig(path23) {
-  if (!existsSync17(path23)) return { ok: true, value: void 0 };
+  if (!existsSync16(path23)) return { ok: true, value: void 0 };
   let raw;
   try {
-    raw = readFileSync10(path23, "utf-8");
+    raw = readFileSync9(path23, "utf-8");
   } catch (e) {
     return { ok: false, error: e instanceof Error ? e.message : String(e) };
   }
@@ -17815,12 +17278,12 @@ function decideEmission(existing, desired, force) {
   return { kind: "write", nextConfig: { ...existing, mcpServers: nextServers } };
 }
 function autoGitignoreMcpConfig(workspaceDir, dryRun) {
-  const gitDir = join13(workspaceDir, ".git");
-  if (!existsSync17(gitDir)) return false;
-  const gitignorePath = join13(workspaceDir, ".gitignore");
+  const gitDir = join12(workspaceDir, ".git");
+  if (!existsSync16(gitDir)) return false;
+  const gitignorePath = join12(workspaceDir, ".gitignore");
   let existing = "";
-  if (existsSync17(gitignorePath)) {
-    existing = readFileSync10(gitignorePath, "utf-8");
+  if (existsSync16(gitignorePath)) {
+    existing = readFileSync9(gitignorePath, "utf-8");
     const already = existing.split("\n").some((l) => l.trim() === MCP_CONFIG_FILENAME || l.trim() === `/${MCP_CONFIG_FILENAME}`);
     if (already) return false;
   }
@@ -17832,7 +17295,7 @@ function autoGitignoreMcpConfig(workspaceDir, dryRun) {
   return true;
 }
 function emitMcpConfig(options) {
-  const mcpConfigPath = join13(options.workspaceDir, MCP_CONFIG_FILENAME);
+  const mcpConfigPath = join12(options.workspaceDir, MCP_CONFIG_FILENAME);
   const dryRun = options.dryRun === true;
   const force = options.force === true;
   const desired = buildNexusServerEntry(options.dataDir, options.commandPath);
@@ -17870,13 +17333,13 @@ function makeFailure(mcpConfigPath, error) {
 
 // src/cli/portable-installer.ts
 import { execFile } from "child_process";
-import { existsSync as existsSync19, mkdirSync as mkdirSync4, rmSync, writeFileSync as writeFileSync7 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync18, mkdirSync as mkdirSync4, rmSync, writeFileSync as writeFileSync7 } from "fs";
+import { join as join14 } from "path";
 import { promisify } from "util";
 
 // src/cli/bin-shim.ts
-import { existsSync as existsSync18, readFileSync as readFileSync11, writeFileSync as writeFileSync6, chmodSync as chmodSync2, mkdirSync as mkdirSync3 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync17, readFileSync as readFileSync10, writeFileSync as writeFileSync6, chmodSync as chmodSync2, mkdirSync as mkdirSync3 } from "fs";
+import { join as join13 } from "path";
 var SHIM_BASENAME = "nexus-agents";
 var SHIM_MODE = 493;
 function buildShimContents(cliEntryPath) {
@@ -17890,18 +17353,18 @@ function buildShimContents(cliEntryPath) {
   return lines.join("\n");
 }
 function writeBinShim(options) {
-  const shimPath = join14(options.binDir, SHIM_BASENAME);
+  const shimPath = join13(options.binDir, SHIM_BASENAME);
   const desired = buildShimContents(options.cliEntryPath);
   const dryRun = options.dryRun === true;
   try {
-    if (existsSync18(shimPath)) {
-      const current = readFileSync11(shimPath, "utf-8");
+    if (existsSync17(shimPath)) {
+      const current = readFileSync10(shimPath, "utf-8");
       if (current === desired) {
         return { success: true, shimPath, written: false, alreadyMatched: true, error: null };
       }
     }
     if (!dryRun) {
-      if (!existsSync18(options.binDir)) mkdirSync3(options.binDir, { recursive: true });
+      if (!existsSync17(options.binDir)) mkdirSync3(options.binDir, { recursive: true });
       writeFileSync6(shimPath, desired, "utf-8");
       chmodSync2(shimPath, SHIM_MODE);
     }
@@ -17936,10 +17399,10 @@ function writeInstallManifest(cliDir, version) {
     description: "Local install root for portable nexus-agents (generated; do not commit)",
     dependencies: { "nexus-agents": version }
   };
-  writeFileSync7(join15(cliDir, "package.json"), JSON.stringify(manifest, null, 2) + "\n", "utf-8");
+  writeFileSync7(join14(cliDir, "package.json"), JSON.stringify(manifest, null, 2) + "\n", "utf-8");
 }
 function isAlreadyInstalled(cliDir) {
-  return existsSync19(join15(cliDir, "node_modules", "nexus-agents", "package.json"));
+  return existsSync18(join14(cliDir, "node_modules", "nexus-agents", "package.json"));
 }
 async function spawnNpmInstall(cliDir) {
   await execFileAsync("npm", ["install", "--no-audit", "--no-fund", "--silent"], {
@@ -17955,7 +17418,7 @@ function cleanupOnFailure(cliDir) {
 }
 async function runNpmStep(ctx) {
   try {
-    if (!existsSync19(ctx.cliDir)) mkdirSync4(ctx.cliDir, { recursive: true });
+    if (!existsSync18(ctx.cliDir)) mkdirSync4(ctx.cliDir, { recursive: true });
     writeInstallManifest(ctx.cliDir, ctx.version);
     await spawnNpmInstall(ctx.cliDir);
     return void 0;
@@ -17966,8 +17429,8 @@ async function runNpmStep(ctx) {
   }
 }
 async function installPortable(options) {
-  const cliDir = join15(options.dataDir, CLI_SUBDIR);
-  const binDir = join15(options.dataDir, BIN_SUBDIR);
+  const cliDir = join14(options.dataDir, CLI_SUBDIR);
+  const binDir = join14(options.dataDir, BIN_SUBDIR);
   const versionResolution = resolveInstallVersion(options.version);
   if (!versionResolution.ok) {
     return {
@@ -17988,7 +17451,7 @@ async function installPortable(options) {
   }
   const npmFailure = await runNpmStep(ctx);
   if (npmFailure !== void 0) return npmFailure;
-  const shim = writeBinShim({ binDir, cliEntryPath: join15(cliDir, CLI_ENTRY_RELATIVE) });
+  const shim = writeBinShim({ binDir, cliEntryPath: join14(cliDir, CLI_ENTRY_RELATIVE) });
   if (!shim.success) {
     cleanupOnFailure(cliDir);
     return {
@@ -18002,14 +17465,14 @@ async function installPortable(options) {
   return { success: true, ...ctx, shim, skipped: false, error: null };
 }
 function uninstallPortable(options) {
-  const cliDir = join15(options.dataDir, CLI_SUBDIR);
-  const binDir = join15(options.dataDir, BIN_SUBDIR);
+  const cliDir = join14(options.dataDir, CLI_SUBDIR);
+  const binDir = join14(options.dataDir, BIN_SUBDIR);
   const removed = [];
   const notPresent = [];
   const dryRun = options.dryRun === true;
   try {
     for (const dir of [cliDir, binDir]) {
-      if (!existsSync19(dir)) {
+      if (!existsSync18(dir)) {
         notPresent.push(dir);
         continue;
       }
@@ -18023,8 +17486,8 @@ function uninstallPortable(options) {
   }
 }
 function findBinShim(dataDir) {
-  const shimPath = join15(dataDir, BIN_SUBDIR, "nexus-agents");
-  return existsSync19(shimPath) ? shimPath : void 0;
+  const shimPath = join14(dataDir, BIN_SUBDIR, "nexus-agents");
+  return existsSync18(shimPath) ? shimPath : void 0;
 }
 
 // src/cli/init-portable.ts
@@ -18037,13 +17500,13 @@ function resolveTargetPath(rawPath) {
   return isAbsolute2(rawPath) ? rawPath : resolve11(process.cwd(), rawPath);
 }
 function isNonEmpty(dir) {
-  if (!existsSync20(dir)) return false;
-  const stat2 = statSync3(dir);
+  if (!existsSync19(dir)) return false;
+  const stat2 = statSync2(dir);
   if (!stat2.isDirectory()) return true;
-  return readdirSync2(dir).length > 0;
+  return readdirSync(dir).length > 0;
 }
 function ensureDir(path23, dryRun, created, alreadyExisted, mode) {
-  if (existsSync20(path23)) {
+  if (existsSync19(path23)) {
     alreadyExisted.push(path23);
     return;
   }
@@ -18053,13 +17516,13 @@ function ensureDir(path23, dryRun, created, alreadyExisted, mode) {
   created.push(path23);
 }
 function maybeUpdateGitignore(workspaceDir, portableDirName, dryRun) {
-  const gitDir = join16(workspaceDir, ".git");
-  if (!existsSync20(gitDir)) return false;
-  const gitignorePath = join16(workspaceDir, ".gitignore");
+  const gitDir = join15(workspaceDir, ".git");
+  if (!existsSync19(gitDir)) return false;
+  const gitignorePath = join15(workspaceDir, ".gitignore");
   const entry = `${portableDirName}/`;
   let existing = "";
-  if (existsSync20(gitignorePath)) {
-    existing = readFileSync12(gitignorePath, "utf-8");
+  if (existsSync19(gitignorePath)) {
+    existing = readFileSync11(gitignorePath, "utf-8");
     if (existing.split("\n").some((l) => l.trim() === entry || l.trim() === portableDirName)) {
       return false;
     }
@@ -18072,18 +17535,18 @@ function maybeUpdateGitignore(workspaceDir, portableDirName, dryRun) {
   return true;
 }
 function inspectTarget(target) {
-  const exists = existsSync20(target);
+  const exists = existsSync19(target);
   if (!exists) return { exists: false, nonEmpty: false, isExistingNexusDir: false };
   const nonEmpty = isNonEmpty(target);
-  const stat2 = statSync3(target);
-  const isExistingNexusDir = stat2.isDirectory() && existsSync20(join16(target, "audit"));
+  const stat2 = statSync2(target);
+  const isExistingNexusDir = stat2.isDirectory() && existsSync19(join15(target, "audit"));
   return { exists, nonEmpty, isExistingNexusDir };
 }
 function createDataLayout(target, dryRun, created, alreadyExisted) {
   ensureDir(target, dryRun, created, alreadyExisted);
   for (const subdir of DATA_SUBDIRECTORIES) {
     const mode = RESTRICTED_SUBDIRS.has(subdir) ? 448 : void 0;
-    ensureDir(join16(target, subdir), dryRun, created, alreadyExisted, mode);
+    ensureDir(join15(target, subdir), dryRun, created, alreadyExisted, mode);
   }
 }
 function makeResult(opts) {
@@ -18818,7 +18281,8 @@ var REGISTERED_TOOLS = [
   "registry_import",
   "query_trace",
   "repo_analyze",
-  "repo_security_plan"
+  "repo_security_plan",
+  "improvement_review"
 ];
 var MOCK_ORCHESTRATION_ENV = "NEXUS_ALLOW_MOCK_ORCHESTRATION";
 function createOrchestratorForOrchestration(modelAdapter, logger17, useMockTechLead) {
@@ -19082,6 +18546,7 @@ function buildStandardDeps(ctx, toolName) {
 var STANDALONE_TOOLS = [
   { name: "consensus_vote", register: registerConsensusVoteTool },
   { name: "weather_report", register: registerWeatherReportTool },
+  { name: "improvement_review", register: registerImprovementReviewTool },
   { name: "registry_import", register: registerRegistryImportTool },
   { name: "repo_analyze", register: registerRepoAnalyzeTool },
   { name: "repo_security_plan", register: registerRepoSecurityPlanTool },
@@ -21109,8 +20574,8 @@ function printFirstRunHint() {
   const isTTY = process.stderr.isTTY;
   if (!isTTY) return;
   const dataDir = getNexusDataDir();
-  const hasConfig = existsSync21("./nexus-agents.yaml") || existsSync21("./nexus-agents.yml");
-  if (existsSync21(dataDir) || hasConfig) return;
+  const hasConfig = existsSync20("./nexus-agents.yaml") || existsSync20("./nexus-agents.yml");
+  if (existsSync20(dataDir) || hasConfig) return;
   process.stderr.write(
     "\n\x1B[36mnexus-agents\x1B[0m: First time? Run \x1B[1mnexus-agents setup\x1B[0m to configure.\n\n"
   );
@@ -21586,12 +21051,12 @@ function findPackageRoot(startDir) {
   }
   return startDir;
 }
-function countFiles2(dir, pattern) {
+function countFiles(dir, pattern) {
   if (!fs18.existsSync(dir)) return 0;
   let count = 0;
   for (const entry of fs18.readdirSync(dir, { withFileTypes: true })) {
     if (entry.isDirectory() && entry.name !== "node_modules" && entry.name !== "dist") {
-      count += countFiles2(path22.join(dir, entry.name), pattern);
+      count += countFiles(path22.join(dir, entry.name), pattern);
     } else if (entry.isFile() && pattern.test(entry.name)) {
       count++;
     }
@@ -21623,11 +21088,11 @@ function gatherSystemSummary() {
   const thisFile = fileURLToPath(import.meta.url);
   const pkgRoot = findPackageRoot(path22.dirname(thisFile));
   const srcDir = path22.resolve(pkgRoot, "src");
-  const allTs = countFiles2(srcDir, /\.ts$/);
-  const testTs = countFiles2(srcDir, /\.test\.ts$/);
+  const allTs = countFiles(srcDir, /\.ts$/);
+  const testTs = countFiles(srcDir, /\.test\.ts$/);
   const layers = LAYER_DIRS.map(({ name, dir }) => ({
     name,
-    files: countFiles2(path22.join(srcDir, dir), /\.ts$/)
+    files: countFiles(path22.join(srcDir, dir), /\.ts$/)
   })).filter((l) => l.files > 0);
   return {
     version: readVersion(pkgRoot),
@@ -22776,7 +22241,7 @@ function handleStatusCommand2(args) {
 
 // src/cli/scenario-command.ts
 import { readdir as readdir4 } from "fs/promises";
-import { join as join18, resolve as resolve14 } from "path";
+import { join as join17, resolve as resolve14 } from "path";
 
 // src/testing/e2e/scenario-runner.ts
 import { readFile as readFile7 } from "fs/promises";
@@ -23146,7 +22611,7 @@ async function handleRun(args) {
     process.exit(EXIT_CODES.SERVER_START_FAILED);
   }
   const runner = createScenarioRunner();
-  const fixturePath = join18(FIXTURES_DIR, `${name}${SCENARIO_SUFFIX}`);
+  const fixturePath = join17(FIXTURES_DIR, `${name}${SCENARIO_SUFFIX}`);
   try {
     const fixture = await runner.loadFixture(fixturePath);
     const result = await runner.run(fixture);