nexus-agents 2.71.0 → 2.72.0

package/dist/chunk-GOT7OAL5.js

@@ -0,0 +1,59 @@
+// src/config/nexus-data-dir.ts
+import { homedir } from "os";
+import { join, resolve } from "path";
+
+// src/config/sandbox-detection.ts
+import { existsSync, readFileSync } from "fs";
+function detectSandbox() {
+  const flavorRaw = process.env["NEXUS_SANDBOX"]?.trim();
+  const flavor = flavorRaw !== void 0 && flavorRaw !== "" ? flavorRaw : void 0;
+  const active = flavor !== void 0;
+  const rootRaw = process.env["NEXUS_SANDBOX_ROOT"]?.trim();
+  const root = rootRaw !== void 0 && rootRaw !== "" ? rootRaw : void 0;
+  return {
+    active,
+    flavor,
+    root,
+    heuristicMatch: detectContainerHeuristic()
+  };
+}
+function detectContainerHeuristic() {
+  try {
+    if (existsSync("/.dockerenv")) return "docker";
+    if (existsSync("/run/.containerenv")) return "podman";
+    if (existsSync("/proc/1/cgroup")) {
+      const cgroup = readFileSync("/proc/1/cgroup", "utf8");
+      if (/\bdocker\b/.test(cgroup)) return "docker";
+      if (/\bcontainerd\b/.test(cgroup)) return "docker";
+    }
+    return "unknown";
+  } catch {
+    return null;
+  }
+}
+
+// src/config/nexus-data-dir.ts
+function getNexusDataDir() {
+  const fromEnv = process.env["NEXUS_DATA_DIR"]?.trim();
+  if (fromEnv !== void 0 && fromEnv !== "") {
+    return resolve(fromEnv);
+  }
+  const sandbox = detectSandbox();
+  if (sandbox.active) {
+    return resolve(sandbox.root ?? "/", ".nexus-agents");
+  }
+  return join(homedir(), ".nexus-agents");
+}
+function resetNexusDataDirCache() {
+}
+function nexusDataPath(...segments) {
+  return join(getNexusDataDir(), ...segments);
+}
+
+export {
+  detectSandbox,
+  getNexusDataDir,
+  resetNexusDataDirCache,
+  nexusDataPath
+};
+//# sourceMappingURL=chunk-GOT7OAL5.js.map

package/dist/chunk-GOT7OAL5.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/config/nexus-data-dir.ts","../src/config/sandbox-detection.ts"],"sourcesContent":["/**\n * Nexus runtime data directory resolver (#2302, child of #2301).\n *\n * Returns the absolute path under which nexus-agents stores all runtime\n * state — memory, learning, audit, voting, sessions, checkpoints, traces,\n * model registry. Single source of truth so portable / sandbox / CI\n * deployments can redirect state to a workspace-local folder via the\n * `NEXUS_DATA_DIR` environment variable.\n *\n * Resolution order (first match wins):\n * 1. `NEXUS_DATA_DIR` env var if set + non-empty (resolved against `cwd`).\n * 2. Sandbox-mode default (#2501): when `NEXUS_SANDBOX` is set, use\n *    `${NEXUS_SANDBOX_ROOT ?? '/'}/.nexus-agents`. Sandboxed deployments\n *    typically mount a multi-repo root; state goes there, shared across\n *    repo subfolders rather than buried inside one.\n * 3. `<homedir>/.nexus-agents` (zero-breakage fallback for laptop use).\n *\n * No caching, no filesystem walks, no discovery. The contrarian-narrowed\n * scope (#2301 vote) explicitly defers ancestor-walking to a separate\n * child with a security design pass per CVE-2022-24765. Recomputing the\n * trivial env-or-homedir lookup on each call is ~100ns and avoids cache\n * coordination issues with tests that mock `homedir()`.\n *\n * @module config/nexus-data-dir\n */\n\nimport { homedir } from 'node:os';\nimport { join, resolve } from 'node:path';\n\nimport { detectSandbox } from './sandbox-detection.js';\n\n/** Returns the absolute path to the nexus-agents data directory. */\nexport function getNexusDataDir(): string {\n  const fromEnv = process.env['NEXUS_DATA_DIR']?.trim();\n  if (fromEnv !== undefined && fromEnv !== '') {\n    return resolve(fromEnv);\n  }\n  const sandbox = detectSandbox();\n  if (sandbox.active) {\n    return resolve(sandbox.root ?? '/', '.nexus-agents');\n  }\n  return join(homedir(), '.nexus-agents');\n}\n\n/**\n * No-op kept for source-compatibility with consumers that called this\n * earlier in development. The resolver is no longer cached, so resetting\n * is unnecessary. Kept exported (rather than removed) to avoid breaking\n * imports in tests that may have already adopted it.\n */\nexport function resetNexusDataDirCache(): void {\n  // intentionally empty — see module docstring\n}\n\n/** Returns a path joined under the resolved data directory. */\nexport function nexusDataPath(...segments: string[]): string {\n  return join(getNexusDataDir(), ...segments);\n}\n","/**\n * Sandbox detection (#2501, child 1 of epic #2500).\n *\n * nexus-agents needs to know whether it's running inside a host-provided\n * sandbox (Docker Desktop Sandbox + OpenCode, Codex sandbox, locked-down\n * CI runner) so it can adjust behaviour:\n *\n *   - default `NEXUS_DATA_DIR` to the multi-repo root rather than `~/...`\n *   - skip CLI subprocess detection (binaries aren't there)\n *   - fail-fast when the gateway is unreachable instead of degrading\n *   - suppress diagnostics that don't apply\n *\n * The signal is **explicit**: the image author (Dockerfile, devcontainer,\n * harness wrapper) sets `NEXUS_SANDBOX=<flavor>`. The flavor string is\n * for diagnostics + per-flavor branching (`docker-opencode`, `codex`,\n * `claude-code`, `ci-restricted`, …); presence is the on/off signal.\n *\n * A heuristic check runs alongside for verification — if `NEXUS_SANDBOX`\n * claims `docker-opencode` but `/.dockerenv` is missing, that's a\n * misconfiguration worth surfacing to the operator.\n *\n * @module config/sandbox-detection\n */\n\nimport { existsSync, readFileSync } from 'node:fs';\n\n/**\n * Heuristic detection result. Independent from the explicit\n * `NEXUS_SANDBOX` env var; produced by inspecting filesystem markers.\n */\nexport type SandboxHeuristic = 'docker' | 'podman' | 'unknown' | null;\n\nexport interface SandboxInfo {\n  /**\n   * True iff `NEXUS_SANDBOX` is set + non-empty. The explicit signal\n   * the rest of the codebase keys off — never `true` by heuristic alone.\n   */\n  readonly active: boolean;\n  /**\n   * Operator-supplied flavor string, e.g. `docker-opencode`. Undefined\n   * when `active === false` or the env var is empty.\n   */\n  readonly flavor: string | undefined;\n  /**\n   * Multi-repo root the user mounted. From `NEXUS_SANDBOX_ROOT`. Undefined\n   * when unset; consumers that need a default substitute `/`.\n   */\n  readonly root: string | undefined;\n  /**\n   * Independent heuristic match — `null` when we couldn't run the check,\n   * `'unknown'` when ran but no marker matched. Used by `doctor` to flag\n   * mismatches between the explicit signal and the runtime environment.\n   */\n  readonly heuristicMatch: SandboxHeuristic;\n}\n\n/**\n * Detect whether nexus-agents is running inside a host-provided sandbox.\n * Pure read of env + filesystem; no caching (cheap enough to recompute,\n * and tests routinely mutate process.env).\n */\nexport function detectSandbox(): SandboxInfo {\n  const flavorRaw = process.env['NEXUS_SANDBOX']?.trim();\n  const flavor = flavorRaw !== undefined && flavorRaw !== '' ? flavorRaw : undefined;\n  const active = flavor !== undefined;\n\n  const rootRaw = process.env['NEXUS_SANDBOX_ROOT']?.trim();\n  const root = rootRaw !== undefined && rootRaw !== '' ? rootRaw : undefined;\n\n  return {\n    active,\n    flavor,\n    root,\n    heuristicMatch: detectContainerHeuristic(),\n  };\n}\n\n/**\n * Look for filesystem markers indicating a container runtime. Used as a\n * cross-check against the explicit `NEXUS_SANDBOX` signal.\n *\n * Order of checks:\n *   1. `/.dockerenv` (Docker)\n *   2. `/run/.containerenv` (Podman)\n *   3. `/proc/1/cgroup` containing `docker` or `containerd` strings\n *\n * Returns `null` when none of the checks could run (non-Linux host with\n * no `/proc`, sandbox blocks `existsSync`, etc.) — distinct from\n * `'unknown'` (checks ran, no marker matched) so the doctor message can\n * differentiate \"we couldn't tell\" from \"we checked, no container\".\n */\nfunction detectContainerHeuristic(): SandboxHeuristic {\n  try {\n    if (existsSync('/.dockerenv')) return 'docker';\n    if (existsSync('/run/.containerenv')) return 'podman';\n    if (existsSync('/proc/1/cgroup')) {\n      const cgroup = readFileSync('/proc/1/cgroup', 'utf8');\n      if (/\\bdocker\\b/.test(cgroup)) return 'docker';\n      if (/\\bcontainerd\\b/.test(cgroup)) return 'docker';\n    }\n    return 'unknown';\n  } catch {\n    return null;\n  }\n}\n"],"mappings":";AA0BA,SAAS,eAAe;AACxB,SAAS,MAAM,eAAe;;;ACH9B,SAAS,YAAY,oBAAoB;AAqClC,SAAS,gBAA6B;AAC3C,QAAM,YAAY,QAAQ,IAAI,eAAe,GAAG,KAAK;AACrD,QAAM,SAAS,cAAc,UAAa,cAAc,KAAK,YAAY;AACzE,QAAM,SAAS,WAAW;AAE1B,QAAM,UAAU,QAAQ,IAAI,oBAAoB,GAAG,KAAK;AACxD,QAAM,OAAO,YAAY,UAAa,YAAY,KAAK,UAAU;AAEjE,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,gBAAgB,yBAAyB;AAAA,EAC3C;AACF;AAgBA,SAAS,2BAA6C;AACpD,MAAI;AACF,QAAI,WAAW,aAAa,EAAG,QAAO;AACtC,QAAI,WAAW,oBAAoB,EAAG,QAAO;AAC7C,QAAI,WAAW,gBAAgB,GAAG;AAChC,YAAM,SAAS,aAAa,kBAAkB,MAAM;AACpD,UAAI,aAAa,KAAK,MAAM,EAAG,QAAO;AACtC,UAAI,iBAAiB,KAAK,MAAM,EAAG,QAAO;AAAA,IAC5C;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ADxEO,SAAS,kBAA0B;AACxC,QAAM,UAAU,QAAQ,IAAI,gBAAgB,GAAG,KAAK;AACpD,MAAI,YAAY,UAAa,YAAY,IAAI;AAC3C,WAAO,QAAQ,OAAO;AAAA,EACxB;AACA,QAAM,UAAU,cAAc;AAC9B,MAAI,QAAQ,QAAQ;AAClB,WAAO,QAAQ,QAAQ,QAAQ,KAAK,eAAe;AAAA,EACrD;AACA,SAAO,KAAK,QAAQ,GAAG,eAAe;AACxC;AAQO,SAAS,yBAA+B;AAE/C;AAGO,SAAS,iBAAiB,UAA4B;AAC3D,SAAO,KAAK,gBAAgB,GAAG,GAAG,QAAQ;AAC5C;","names":[]}

package/dist/{chunk-LJT65EA7.js → chunk-I7ORMAO7.js}

@@ -1,6 +1,6 @@
 import {
   getNexusDataDir
-} from "./chunk-FDNWRZNJ.js";
+} from "./chunk-GOT7OAL5.js";
 
 // src/config/learning-persistence.ts
 import { mkdirSync } from "fs";
@@ -29,4 +29,4 @@ export {
   isPersistenceEnabled,
   ensureLearningDir
 };
-//# sourceMappingURL=chunk-LJT65EA7.js.map
+//# sourceMappingURL=chunk-I7ORMAO7.js.map

package/dist/{chunk-LMRKHQG5.js → chunk-L6N2S3UB.js}

@@ -4,7 +4,7 @@ import {
 import {
   createLogger,
   getTimeProvider
-} from "./chunk-7OBFO4GF.js";
+} from "./chunk-O4KUCF5S.js";
 
 // src/mcp/tools/scanner-registry-fetcher.ts
 import { z } from "zod";
@@ -698,4 +698,4 @@ export {
   generateSecurityPlan,
   buildPlanFromAnalysis
 };
-//# sourceMappingURL=chunk-LMRKHQG5.js.map
+//# sourceMappingURL=chunk-L6N2S3UB.js.map

package/dist/{chunk-7OBFO4GF.js → chunk-O4KUCF5S.js}

@@ -1,6 +1,6 @@
 import {
   isPersistenceEnabled
-} from "./chunk-LJT65EA7.js";
+} from "./chunk-I7ORMAO7.js";
 import {
   __require
 } from "./chunk-UP2VWCW5.js";
@@ -227,11 +227,18 @@ function writeLog(entry) {
   const output = globalFormat === "pretty" ? formatPretty(entry) : JSON.stringify(entry) + "\n";
   getOutputStream().write(output);
 }
+var GLOBAL_LEVEL = getDefaultLogLevel();
+function setGlobalLogLevel(level) {
+  GLOBAL_LEVEL = level;
+}
 function createLogger(baseContext) {
-  let currentLevel = getDefaultLogLevel();
+  let instanceLevel;
   const context = baseContext ?? {};
+  function effectiveLevel() {
+    return instanceLevel ?? GLOBAL_LEVEL;
+  }
   function shouldLog(level) {
-    return LEVEL_PRIORITY[level] >= LEVEL_PRIORITY[currentLevel];
+    return LEVEL_PRIORITY[level] >= LEVEL_PRIORITY[effectiveLevel()];
   }
   function log(level, msg, ctx, e) {
     if (shouldLog(level)) {
@@ -253,7 +260,7 @@ function createLogger(baseContext) {
     },
     child: (childCtx) => createLogger({ ...context, ...childCtx }),
     setLevel: (level) => {
-      currentLevel = level;
+      instanceLevel = level;
     },
     setFormat: (format) => {
       globalFormat = format;
@@ -3655,9 +3662,9 @@ var DEFAULT_OUTPUT_TOKENS = 500;
 var TopsisRouter = class {
   config;
   logger;
-  constructor(config = {}, logger10) {
+  constructor(config = {}, logger11) {
     this.config = { ...DEFAULT_TOPSIS_CONFIG, ...config };
-    this.logger = logger10 ?? createLogger({ component: "TopsisRouter" });
+    this.logger = logger11 ?? createLogger({ component: "TopsisRouter" });
     this.validateWeights();
   }
   /**
@@ -5014,9 +5021,9 @@ var ZeroRouter = class {
   logger;
   outcomes = [];
   calibrationBias = 0;
-  constructor(config, logger10) {
+  constructor(config, logger11) {
     this.config = ZeroRouterConfigSchema.parse(config ?? {});
-    this.logger = logger10 ?? createLogger({ component: "ZeroRouter" });
+    this.logger = logger11 ?? createLogger({ component: "ZeroRouter" });
     this.logger.debug("ZeroRouter initialized", {
       thresholds: this.config.thresholds,
       enableCalibration: this.config.enableCalibration
@@ -5708,9 +5715,9 @@ var ConfidenceCascadeStage = class {
   routingsCount = 0;
   escalationCount = 0;
   complexityDistribution = { simple: 0, moderate: 0, complex: 0 };
-  constructor(config = {}, logger10) {
+  constructor(config = {}, logger11) {
     this.config = { ...DEFAULT_CONFIG, ...config };
-    this.logger = logger10 ?? createLogger({ component: "ConfidenceCascadeStage" });
+    this.logger = logger11 ?? createLogger({ component: "ConfidenceCascadeStage" });
   }
   canHandle(ctx) {
     return getRemainingCandidates(ctx).length > 0;
@@ -6051,9 +6058,9 @@ var CapabilityMatchStage = class {
     creative: 0,
     general: 0
   };
-  constructor(config = {}, logger10) {
+  constructor(config = {}, logger11) {
     this.config = { ...DEFAULT_CONFIG2, ...config };
-    this.logger = logger10 ?? createLogger({ component: "CapabilityMatchStage" });
+    this.logger = logger11 ?? createLogger({ component: "CapabilityMatchStage" });
   }
   canHandle(ctx) {
     return getRemainingCandidates(ctx).length > 0;
@@ -6209,9 +6216,9 @@ var QualityConstraintStage = class {
   filteredCount = 0;
   fallbackCount = 0;
   constraintViolations = { quality: 0, cost: 0, latency: 0 };
-  constructor(config = {}, logger10) {
+  constructor(config = {}, logger11) {
     this.config = { ...DEFAULT_CONFIG3, ...config };
-    this.logger = logger10 ?? createLogger({ component: "QualityConstraintStage" });
+    this.logger = logger11 ?? createLogger({ component: "QualityConstraintStage" });
   }
   canHandle(ctx) {
     return getRemainingCandidates(ctx).length > 0;
@@ -6419,9 +6426,9 @@ var ResourceStrategyStage = class {
   logger;
   routingsCount = 0;
   tierHistory = [];
-  constructor(config = {}, logger10) {
+  constructor(config = {}, logger11) {
     this.config = { ...DEFAULT_CONFIG4, ...config };
-    this.logger = logger10 ?? createLogger({ component: "ResourceStrategyStage" });
+    this.logger = logger11 ?? createLogger({ component: "ResourceStrategyStage" });
   }
   canHandle(ctx) {
     return getRemainingCandidates(ctx).length > 1;
@@ -6530,10 +6537,10 @@ var DistilledRuleStage = class {
   config;
   logger;
   rulesAppliedCount = 0;
-  constructor(distiller, config, logger10) {
+  constructor(distiller, config, logger11) {
     this.distiller = distiller;
     this.config = { ...DEFAULT_CONFIG5, ...config };
-    this.logger = logger10 ?? createLogger({ component: "DistilledRuleStage" });
+    this.logger = logger11 ?? createLogger({ component: "DistilledRuleStage" });
   }
   canHandle(ctx) {
     const candidates = getRemainingCandidates(ctx);
@@ -6672,10 +6679,10 @@ var KnnRoutingStage = class {
   memory;
   routingsCount = 0;
   matchCount = 0;
-  constructor(memory, config = {}, logger10) {
+  constructor(memory, config = {}, logger11) {
     this.config = { ...DEFAULT_CONFIG6, ...config };
     this.memory = memory;
-    this.logger = logger10 ?? createLogger({ component: "KnnRoutingStage" });
+    this.logger = logger11 ?? createLogger({ component: "KnnRoutingStage" });
   }
   canHandle(ctx) {
     return getRemainingCandidates(ctx).length > 0;
@@ -6890,10 +6897,10 @@ var StrategyDistiller = class {
   rules = /* @__PURE__ */ new Map();
   outcomeCounter = 0;
   lastDistillAt;
-  constructor(outcomeStore, logger10, config) {
+  constructor(outcomeStore, logger11, config) {
     this.outcomeStore = outcomeStore;
     this.config = { ...DEFAULT_DISTILLER_CONFIG, ...config };
-    this.logger = logger10 ?? createLogger({ component: "StrategyDistiller" });
+    this.logger = logger11 ?? createLogger({ component: "StrategyDistiller" });
   }
   /** Called for each processed outcome. Triggers distillation at threshold. */
   onOutcome() {
@@ -7057,18 +7064,18 @@ var StrategyDistiller = class {
     };
   }
 };
-function createStrategyDistiller(outcomeStore, logger10, config) {
-  return new StrategyDistiller(outcomeStore, logger10, config);
+function createStrategyDistiller(outcomeStore, logger11, config) {
+  return new StrategyDistiller(outcomeStore, logger11, config);
 }
 var persistentDistillerFactory;
 function registerPersistentDistillerFactory(factory) {
   persistentDistillerFactory = factory;
 }
-function createPersistentDistillerOrFallback(outcomeStore, logger10) {
+function createPersistentDistillerOrFallback(outcomeStore, logger11) {
   if (persistentDistillerFactory !== void 0) {
-    return persistentDistillerFactory(outcomeStore, logger10);
+    return persistentDistillerFactory(outcomeStore, logger11);
   }
-  return new StrategyDistiller(outcomeStore, logger10);
+  return new StrategyDistiller(outcomeStore, logger11);
 }
 
 // src/orchestration/outcomes/outcome-types.ts
@@ -7638,8 +7645,8 @@ function generateSyntheticPriors() {
   }
   return priors;
 }
-function runWarmUp(logger10) {
-  const log = logger10 ?? createLogger({ component: "warm-up" });
+function runWarmUp(logger11) {
+  const log = logger11 ?? createLogger({ component: "warm-up" });
   const store = getOutcomeStore();
   const existing = store.query();
   const hasSynthetic = existing.some((o) => o.qualitySignals?.includes(SYNTHETIC_MARKER) === true);
@@ -9385,7 +9392,52 @@ function convertBonusesToScoreMap(bonuses, taskCategory) {
   return scores;
 }
 
+// src/cli-adapters/fallback-chains.ts
+import { z as z14 } from "zod";
+var FallbackChainSchema = z14.array(z14.enum(["claude", "gemini", "codex", "opencode"])).min(1).readonly();
+var FallbackChainRegistrySchema = z14.object({
+  code: FallbackChainSchema,
+  research: FallbackChainSchema,
+  documentation: FallbackChainSchema,
+  analysis: FallbackChainSchema,
+  general: FallbackChainSchema
+});
+var DEFAULT_FALLBACK_CHAINS = {
+  // code_generation/code_review/testing: codex primary, claude secondary
+  code: ["codex", "claude", "gemini", "opencode"],
+  // research/exploration: gemini primary, claude secondary
+  research: ["gemini", "claude", "codex", "opencode"],
+  // documentation: gemini primary, claude secondary
+  documentation: ["gemini", "claude", "codex", "opencode"],
+  // architecture/security/planning: claude primary, gemini secondary
+  // Weather data: gemini arch 66.7% (n=24) > codex 33.3% (n=3)
+  analysis: ["claude", "gemini", "codex", "opencode"],
+  // general: balanced order
+  general: ["claude", "gemini", "codex", "opencode"]
+};
+var CATEGORY_CHAIN_OVERRIDES = {
+  architecture: ["gemini", "claude", "codex", "opencode"],
+  security_review: ["codex", "gemini", "claude", "opencode"],
+  code_review: ["claude", "codex", "gemini", "opencode"],
+  exploration: ["gemini", "codex", "claude", "opencode"],
+  devops: ["claude", "gemini", "codex", "opencode"],
+  // codex has 15% research success (n=20) — push to last position (#1536)
+  research: ["gemini", "claude", "opencode", "codex"],
+  // codex has 33.3% docs success (n=6) — push to last position (#1536)
+  documentation: ["gemini", "claude", "opencode", "codex"]
+};
+var SENSITIVE_CATEGORIES = /* @__PURE__ */ new Set();
+function isCategoryFailClosed(category) {
+  return SENSITIVE_CATEGORIES.has(category);
+}
+function getFallbackChainForCategory(category, bucketType, registry = DEFAULT_FALLBACK_CHAINS) {
+  const override = CATEGORY_CHAIN_OVERRIDES[category];
+  if (override !== void 0) return override;
+  return registry[bucketType];
+}
+
 // src/cli-adapters/composite-router-stages.ts
+var logger9 = createLogger({ component: "composite-router-stages" });
 var sharedAnalyzer2 = createSharedTaskAnalyzer();
 function analyzeTaskProfile(task, stagesExecuted) {
   const internalTask = cliTaskToTask(task);
@@ -9764,6 +9816,34 @@ async function applyQualityConstraints(candidates, stagesExecuted, deps) {
   }
   return ok({ candidates: qualityResult.eligible, qualityResult });
 }
+function applyCategoryOverride(task, candidates, stagesExecuted) {
+  const match = detectTaskCategory(task.content);
+  if (match === null) return ok(candidates);
+  const override = CATEGORY_CHAIN_OVERRIDES[match.category];
+  if (override === void 0) return ok(candidates);
+  const candidateSet = new Set(candidates);
+  const filtered = override.filter((cli) => candidateSet.has(cli));
+  if (filtered.length === 0) {
+    if (isCategoryFailClosed(match.category)) {
+      stagesExecuted.push("category-override:fail-closed");
+      logger9.warn("Category override fail-closed \u2014 every override CLI unavailable", {
+        category: match.category,
+        override,
+        availableCandidates: candidates
+      });
+      return err(
+        new CompositeRoutingError(
+          `category '${match.category}' is fail-closed and every override CLI (${override.join(", ")}) is unavailable; route aborted to prevent silent fallback to excluded CLI`,
+          "category-override"
+        )
+      );
+    }
+    stagesExecuted.push("category-override:no-eligible");
+    return ok(candidates);
+  }
+  stagesExecuted.push("category-override");
+  return ok(filtered);
+}
 function applyLinUCBFloorOverride(linucbCli, topsisRanking, opts) {
   if (opts.perfData === void 0) return linucbCli;
   const cliPerf = opts.perfData.get(linucbCli);
@@ -9789,6 +9869,9 @@ async function runPipeline(task, taskProfile, stagesExecuted, cliNames, deps) {
   const constrained = await applyQualityConstraints(candidates, stagesExecuted, deps);
   if (!constrained.ok) return constrained;
   candidates = constrained.value.candidates;
+  const overrideResult = applyCategoryOverride(task, candidates, stagesExecuted);
+  if (!overrideResult.ok) return overrideResult;
+  candidates = overrideResult.value;
   const stageScores = aggregateStageScores(scoring, task.content);
   const topsisOpts = {
     performanceData: getPerformanceDataForCategory(task.content)
@@ -10044,7 +10127,7 @@ var CompositeRouter = class _CompositeRouter {
   lastRoutedTask;
   // Track last traceId for metrics correlation (Issue #559)
   lastTraceId;
-  constructor(adapters, config, logger10) {
+  constructor(adapters, config, logger11) {
     const {
       preferenceRouterConfig,
       zeroRouterConfig,
@@ -10060,7 +10143,7 @@ var CompositeRouter = class _CompositeRouter {
       ...baseConfig
     } = config ?? {};
     this.config = CompositeRouterConfigSchema.parse(baseConfig);
-    this.logger = logger10 ?? createLogger({ component: "CompositeRouter" });
+    this.logger = logger11 ?? createLogger({ component: "CompositeRouter" });
     this.adapters = adapters;
     this.cliNames = Array.from(adapters.keys());
     if (metricsCollector !== void 0) {
@@ -10491,8 +10574,8 @@ var CompositeRouter = class _CompositeRouter {
     return this.routingMemory;
   }
 };
-function createCompositeRouter(adapters, config, logger10) {
-  return new CompositeRouter(adapters, config, logger10);
+function createCompositeRouter(adapters, config, logger11) {
+  return new CompositeRouter(adapters, config, logger11);
 }
 
 // src/core/types/model.ts
@@ -10880,7 +10963,7 @@ var ActionCacheImpl = class {
 };
 
 // src/context/mobimem.ts
-var logger9 = createLogger({ component: "MobiMem" });
+var logger10 = createLogger({ component: "MobiMem" });
 var MobiMem = class {
   profile;
   experience;
@@ -10892,7 +10975,7 @@ var MobiMem = class {
     this.profile = new ProfileMemoryImpl(this.config);
     this.experience = new ExperienceMemoryImpl(this.config);
     this.action = new ActionCacheImpl(this.config);
-    logger9.info("MobiMem initialized", {
+    logger10.info("MobiMem initialized", {
       maxProfileEntries: this.config.maxProfileEntries,
       maxExperiencePatterns: this.config.maxExperiencePatterns,
       maxActionCacheEntries: this.config.maxActionCacheEntries
@@ -10923,12 +11006,12 @@ var MobiMem = class {
     if (this.config.autoEviction) {
       const evicted = this.action.evictExpired();
       if (evicted > 0) {
-        logger9.debug("Evicted expired action cache entries", { count: evicted });
+        logger10.debug("Evicted expired action cache entries", { count: evicted });
       }
     }
   }
   close() {
-    logger9.info("MobiMem closed");
+    logger10.info("MobiMem closed");
   }
   /** Export MobiMem state for disk persistence (#1782). */
   exportData() {
@@ -10945,9 +11028,9 @@ var MobiMem = class {
       await fs2.mkdir(path2.dirname(filePath), { recursive: true });
       const data = JSON.stringify(this.exportData(), null, 2);
       await fs2.writeFile(filePath, data, "utf-8");
-      logger9.debug("MobiMem state saved", { path: filePath });
+      logger10.debug("MobiMem state saved", { path: filePath });
     } catch (error) {
-      logger9.warn("Failed to save MobiMem state", { error: String(error) });
+      logger10.warn("Failed to save MobiMem state", { error: String(error) });
     }
   }
 };
@@ -10969,6 +11052,7 @@ export {
   getTimeProvider,
   withStep,
   sanitize,
+  setGlobalLogLevel,
   createLogger,
   logger,
   bootstrapStepNotifications,
@@ -11124,6 +11208,7 @@ export {
   queryWithLookback,
   getAdaptiveBonus,
   shouldExplore,
+  getFallbackChainForCategory,
   CompositeRouter,
   createCompositeRouter,
   ModelCapability,
@@ -11131,4 +11216,4 @@ export {
   ParseError,
   OrchestratorError
 };
-//# sourceMappingURL=chunk-7OBFO4GF.js.map
+//# sourceMappingURL=chunk-O4KUCF5S.js.map