nexus-agents 2.79.4 → 2.80.1

package/dist/cli.js

@@ -12,18 +12,18 @@ import {
   parseFindings,
   sumFindings
 } from "./chunk-3RZWLQSC.js";
-import "./chunk-JMRCMMZ5.js";
+import "./chunk-7ZKZ7K7J.js";
 import {
   buildOpenAICompatAdapters,
   loadUsageEvents,
   readOpenAICompatEnv,
   rollupByModel
-} from "./chunk-IPDUZJPH.js";
+} from "./chunk-HR7C4DSA.js";
 import {
   setupCommandAsync,
   verifyCommand
-} from "./chunk-SU3Y6LU2.js";
-import "./chunk-NVSJXN4S.js";
+} from "./chunk-WZ2T4T7N.js";
+import "./chunk-D4NEYNBO.js";
 import {
   AuthHandler,
   DEFAULT_EXPERTS,
@@ -153,56 +153,61 @@ import {
   validateCommand,
   validateWorkflow,
   wrapInMarkdownFence
-} from "./chunk-3ENBGGYA.js";
+} from "./chunk-LDD272PW.js";
 import "./chunk-AP2FD37C.js";
 import "./chunk-ED6VQWNG.js";
 import {
   resolveToken
-} from "./chunk-LFTK5ZQG.js";
+} from "./chunk-NCBWA6RU.js";
 import {
   CATEGORY_DISPLAY_NAMES,
   DEFAULT_PR_REVIEW_CONFIG
 } from "./chunk-X2M7OF27.js";
-import "./chunk-OGV7J5WG.js";
-import "./chunk-ACP4YARI.js";
-import "./chunk-PHBRELUK.js";
+import "./chunk-5WN3WGXG.js";
+import "./chunk-GODRGVF4.js";
+import "./chunk-UEKTTIDA.js";
 import {
   DEFAULT_VOTE_TIMEOUT_MS,
   ErrorPolicySchema,
   VOTER_ROLES,
   VoteThresholdSchema,
   createDefaultPolicyFirewall,
+  createSecureHandler,
   createUnifiedRegistry,
   executeVoting,
   getToolAnnotations,
+  getToolTimeout,
   registerConsensusVoteTool,
+  toSdkCallback,
   toolStructuredError,
-  warnIfSimulatedOutsideTests
-} from "./chunk-DW3UTO43.js";
-import "./chunk-PAKVXGS2.js";
-import "./chunk-DOI7RE3X.js";
+  toolSuccessStructured,
+  warnIfSimulatedOutsideTests,
+  wrapToolWithTimeout
+} from "./chunk-D3MQ4U2R.js";
+import "./chunk-I5KYDT23.js";
+import "./chunk-33LDLZCC.js";
 import {
   loadPapersRegistry,
   loadTechniquesRegistry,
   savePapersRegistry,
   synthesizeResearch
-} from "./chunk-UNFS6YBY.js";
+} from "./chunk-Q4DXTNGR.js";
 import {
   classifyTrust,
   createFullGitHubProvider,
   evaluatePolicy,
   parsePRUrl,
   sanitizeInput
-} from "./chunk-BXI6DKBU.js";
-import "./chunk-BSQ4KTY4.js";
-import "./chunk-TN5ZKSGC.js";
+} from "./chunk-O2ECPTFH.js";
+import "./chunk-SX3P2PD2.js";
+import "./chunk-MVIYQMQM.js";
 import "./chunk-7J7PNOJQ.js";
 import "./chunk-BQ4YXGGQ.js";
-import "./chunk-PDCLBWH5.js";
+import "./chunk-L7433REX.js";
 import {
   MemoryError,
   shutdownToolMemory
-} from "./chunk-NXNNT5XW.js";
+} from "./chunk-NALIFUBD.js";
 import {
   CustomExpertDefinitionSchema,
   DATA_SUBDIRECTORIES,
@@ -221,12 +226,12 @@ import {
   loadConfig,
   runDoctor,
   validateNexusEnv
-} from "./chunk-UOR2JWFH.js";
-import "./chunk-OFRDE7MK.js";
-import "./chunk-42MM7GKW.js";
+} from "./chunk-TFTP7EUQ.js";
+import "./chunk-MUIA32LU.js";
+import "./chunk-D5C5N5Q4.js";
 import {
   DEFAULTS
-} from "./chunk-UNRTM43V.js";
+} from "./chunk-54UT2JUQ.js";
 import "./chunk-NUBSJGQZ.js";
 import {
   capitalize,
@@ -238,11 +243,11 @@ import {
   getAvailableClis,
   isRecord,
   probeAllClis
-} from "./chunk-BIH2CBC5.js";
-import "./chunk-NJPFN75N.js";
+} from "./chunk-EPZMFIAX.js";
+import "./chunk-7UM5XRGG.js";
 import "./chunk-ZM4O442V.js";
 import "./chunk-PQHVC4BD.js";
-import "./chunk-45NUO4FE.js";
+import "./chunk-ALDKPBOZ.js";
 import {
   API_TIMEOUTS,
   AgentCapability,
@@ -310,125 +315,19 @@ import {
   validateTimeout,
   writeEmptyLine,
   writeLine
-} from "./chunk-UQOSVOEU.js";
+} from "./chunk-T4E6UFFC.js";
 import {
+  applyPortableMode,
   detectSandbox,
+  findRepoRoot,
   getNexusDataDir,
+  getPerRepoSubdirs,
   nexusDataPath
-} from "./chunk-7BMOZJYS.js";
+} from "./chunk-2JQXC3CK.js";
 import "./chunk-UP2VWCW5.js";
 
 // src/cli/cli-log-bootstrap.ts
 import { argv, env } from "process";
-
-// src/config/portable-mode.ts
-import { accessSync, constants, existsSync, readFileSync, appendFileSync, statSync } from "fs";
-import { homedir } from "os";
-import { join, resolve } from "path";
-var SANDBOX_ENV_VARS = [
-  "KUBERNETES_SERVICE_HOST",
-  "DOCKER_CONTAINER",
-  "ECS_CONTAINER_METADATA_URI",
-  "ECS_CONTAINER_METADATA_URI_V4",
-  "SANDBOX",
-  "NEXUS_SANDBOX"
-];
-var DETECTED = false;
-function isHomeWritable() {
-  try {
-    const home = homedir();
-    if (!existsSync(home)) return false;
-    accessSync(home, constants.W_OK);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function inSandboxEnv() {
-  for (const v of SANDBOX_ENV_VARS) {
-    const val = process.env[v];
-    if (val !== void 0 && val !== "") return true;
-  }
-  return false;
-}
-function checkExplicitEnv(cwd) {
-  const fromEnv = process.env["NEXUS_DATA_DIR"]?.trim();
-  if (fromEnv !== void 0 && fromEnv !== "") {
-    return { portable: false, dataDir: resolve(fromEnv), reason: "env-data-dir" };
-  }
-  const portableEnv = process.env["NEXUS_PORTABLE_MODE"];
-  if (portableEnv === "0" || portableEnv === "false") {
-    return { portable: false, dataDir: join(homedir(), ".nexus-agents"), reason: "env-opt-out" };
-  }
-  if (portableEnv === "1" || portableEnv === "true") {
-    return { portable: true, dataDir: join(cwd, ".nexus-agents"), reason: "env-opt-in" };
-  }
-  return null;
-}
-function checkHeuristics(cwd) {
-  if (!isHomeWritable()) {
-    return { portable: true, dataDir: join(cwd, ".nexus-agents"), reason: "home-unwritable" };
-  }
-  if (inSandboxEnv()) {
-    return { portable: true, dataDir: join(cwd, ".nexus-agents"), reason: "container-env" };
-  }
-  return null;
-}
-function detectPortableMode(cwd = process.cwd()) {
-  return checkExplicitEnv(cwd) ?? checkHeuristics(cwd) ?? {
-    portable: false,
-    dataDir: join(homedir(), ".nexus-agents"),
-    reason: "default"
-  };
-}
-function applyPortableMode(cwd = process.cwd()) {
-  if (DETECTED) return;
-  DETECTED = true;
-  const result = detectPortableMode(cwd);
-  if (!result.portable) return;
-  if (result.reason === "home-unwritable" || result.reason === "container-env") {
-    process.stderr.write(
-      `[portable-mode] Sandbox detected (${result.reason}). Using ${result.dataDir} for all nexus-agents data.
-                Set NEXUS_PORTABLE_MODE=0 to override; see docs/guides/SANDBOXED-USAGE.md
-`
-    );
-  }
-  process.env["NEXUS_DATA_DIR"] = result.dataDir;
-  if (isInsideGitRepo(cwd)) {
-    ensureGitignored(cwd, ".nexus-agents/");
-  }
-}
-function isInsideGitRepo(cwd) {
-  try {
-    const gitDir = join(cwd, ".git");
-    return existsSync(gitDir) && statSync(gitDir).isDirectory();
-  } catch {
-    return false;
-  }
-}
-function ensureGitignored(cwd, entry) {
-  const path22 = join(cwd, ".gitignore");
-  try {
-    const existing = existsSync(path22) ? readFileSync(path22, "utf-8") : "";
-    const lines = existing.split("\n").map((l) => l.trim());
-    if (lines.includes(entry) || lines.includes(entry.replace(/\/$/, ""))) return;
-    const sep3 = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
-    appendFileSync(path22, `${sep3}${entry}
-`, "utf-8");
-    process.stderr.write(
-      `[portable-mode] Added '${entry}' to ${path22} so nexus-agents data is gitignored.
-`
-    );
-  } catch (e) {
-    const msg = e instanceof Error ? e.message : String(e);
-    process.stderr.write(
-      `[portable-mode] Could not auto-update ${path22} (${msg}). Add '${entry}' manually if you don't want nexus-agents data tracked by git.
-`
-    );
-  }
-}
-
-// src/cli/cli-log-bootstrap.ts
 var SERVER_COMMANDS = /* @__PURE__ */ new Set(["server"]);
 var VERBOSE_FLAGS = /* @__PURE__ */ new Set(["--verbose", "-v", "--debug"]);
 function findSubcommand(args) {
@@ -512,10 +411,11 @@ function helloCommand() {
 }
 
 // src/cli/config-init.ts
-import { existsSync as existsSync2 } from "fs";
+import { existsSync } from "fs";
 import { writeFile, mkdir } from "fs/promises";
-import { dirname, resolve as resolve2 } from "path";
+import { dirname, resolve } from "path";
 var DEFAULT_CONFIG_FILE = "nexus-agents.yaml";
+var DEFAULT_CONFIG_REL_PATH = `.nexus-agents/${DEFAULT_CONFIG_FILE}`;
 function qualifiesPowerful(m) {
   return (m.qualityScores?.reasoning ?? 0) >= 9;
 }
@@ -692,16 +592,20 @@ logging:
 `;
 function resolveOutputPath(output2) {
   if (output2 !== void 0 && output2 !== "") {
-    return resolve2(process.cwd(), output2);
+    return resolve(process.cwd(), output2);
   }
-  return resolve2(process.cwd(), DEFAULT_CONFIG_FILE);
+  const legacyPath = resolve(process.cwd(), DEFAULT_CONFIG_FILE);
+  if (existsSync(legacyPath)) {
+    return legacyPath;
+  }
+  return resolve(process.cwd(), DEFAULT_CONFIG_REL_PATH);
 }
 function fileExists(path22) {
-  return existsSync2(path22);
+  return existsSync(path22);
 }
 async function ensureDirectory(filePath) {
   const dir = dirname(filePath);
-  if (dir !== "." && !existsSync2(dir)) {
+  if (dir !== "." && !existsSync(dir)) {
     await mkdir(dir, { recursive: true });
   }
 }
@@ -765,10 +669,10 @@ async function configInitCommand(options = {}) {
 }
 
 // src/cli/custom-expert-validation.ts
-import { resolve as resolve3, sep } from "path";
+import { resolve as resolve2, sep } from "path";
 function validateConfigPath(userPath, allowedRoot) {
-  const resolvedRoot = resolve3(allowedRoot);
-  const resolved = resolve3(allowedRoot, userPath);
+  const resolvedRoot = resolve2(allowedRoot);
+  const resolved = resolve2(allowedRoot, userPath);
   if (!resolved.startsWith(resolvedRoot + sep) && resolved !== resolvedRoot) {
     return err(
       new SecurityError("Path traversal detected: config path escapes allowed root directory", {
@@ -836,8 +740,8 @@ function formatValidationErrors(errors) {
 }
 
 // src/cli/custom-expert-parsing.ts
-import { readFileSync as readFileSync2, existsSync as existsSync3 } from "fs";
-import { resolve as resolve4 } from "path";
+import { readFileSync, existsSync as existsSync2 } from "fs";
+import { resolve as resolve3 } from "path";
 import * as yaml from "yaml";
 var DEFAULT_CONFIG_FILE2 = "nexus-agents.yaml";
 function findConfigPath() {
@@ -848,12 +752,12 @@ function findConfigPath() {
     if (!validation.ok) {
       return { securityError: validation.error };
     }
-    if (existsSync3(validation.value)) {
+    if (existsSync2(validation.value)) {
       return { path: validation.value };
     }
   }
-  const cwdPath = resolve4(cwd, DEFAULT_CONFIG_FILE2);
-  if (existsSync3(cwdPath)) {
+  const cwdPath = resolve3(cwd, DEFAULT_CONFIG_FILE2);
+  if (existsSync2(cwdPath)) {
     return { path: cwdPath };
   }
   return {};
@@ -956,7 +860,7 @@ function resolveConfigPath(configPath) {
 }
 function readConfigContent(configPath) {
   try {
-    return { content: readFileSync2(configPath, "utf-8") };
+    return { content: readFileSync(configPath, "utf-8") };
   } catch (error) {
     return {
       error: {
@@ -1604,10 +1508,10 @@ async function handleBuiltInCommand(input, session) {
   }
   return { handled: false, exit: false };
 }
-function handleTask(input, session, logger17) {
+function handleTask(input, session, logger18) {
   const trimmed = input.trim();
   if (session.verbose) {
-    logger17.debug("Processing task", { task: trimmed, sessionId: session.sessionId });
+    logger18.debug("Processing task", { task: trimmed, sessionId: session.sessionId });
   }
   process.stdout.write(`
 ${colors.bold}Task Analysis:${colors.reset}
@@ -1651,7 +1555,7 @@ function createReadlineInterface() {
     historySize: 100
   });
 }
-async function processLine(line, session, logger17) {
+async function processLine(line, session, logger18) {
   const trimmed = line.trim();
   if (trimmed === "") {
     return false;
@@ -1665,36 +1569,36 @@ async function processLine(line, session, logger17) {
     }
     return result.exit;
   }
-  handleTask(trimmed, session, logger17);
+  handleTask(trimmed, session, logger18);
   return false;
 }
 async function startRepl(options = {}) {
-  const logger17 = createLogger({ component: "repl" });
+  const logger18 = createLogger({ component: "repl" });
   const session = createSession(options.verbose ?? false);
   if (session.verbose) {
-    logger17.setLevel("debug");
+    logger18.setLevel("debug");
   }
-  logger17.info("Starting interactive REPL", { sessionId: session.sessionId });
+  logger18.info("Starting interactive REPL", { sessionId: session.sessionId });
   printBanner();
   const rl = createReadlineInterface();
   rl.on("close", () => {
     process.stdout.write(`
 ${colors.dim}Session ended.${colors.reset}
 `);
-    logger17.info("REPL session ended", {
+    logger18.info("REPL session ended", {
       sessionId: session.sessionId,
       commandsRun: session.history.length
     });
   });
   rl.prompt();
-  return new Promise((resolve15) => {
+  return new Promise((resolve14) => {
     rl.on("line", (line) => {
       void (async () => {
         try {
-          const shouldExit = await processLine(line, session, logger17);
+          const shouldExit = await processLine(line, session, logger18);
           if (shouldExit) {
             rl.close();
-            resolve15();
+            resolve14();
             return;
           }
         } catch (error) {
@@ -1706,7 +1610,7 @@ ${colors.dim}Session ended.${colors.reset}
       })();
     });
     rl.on("close", () => {
-      resolve15();
+      resolve14();
     });
   });
 }
@@ -1724,7 +1628,7 @@ async function replCommand(options = {}) {
 
 // src/self-eval/component-scanner.ts
 import { readdir, readFile, stat } from "fs/promises";
-import { join as join2, basename, extname, relative } from "path";
+import { join, basename, extname, relative } from "path";
 var DEFAULT_EXTENSIONS = [".ts"];
 var DEFAULT_MAX_FILE_SIZE = 1024 * 1024;
 var COMPLEXITY_PATTERNS = [
@@ -1789,7 +1693,7 @@ var ComponentScanner = class {
     const files = [];
     const entries = await readdir(directory, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = join2(directory, entry.name);
+      const fullPath = join(directory, entry.name);
       if (entry.isDirectory()) {
         const subFiles = await this.findFiles(fullPath);
         files.push(...subFiles);
@@ -3339,6 +3243,9 @@ function safeExecSandboxed(commandString, options = {}) {
     if (options.cwd !== void 0) {
       execOptions.cwd = options.cwd;
     }
+    if (options.stdin !== void 0) {
+      execOptions.input = options.stdin;
+    }
     const result = execSync(commandString, execOptions);
     return typeof result === "string" ? result.trim() : result.toString("utf-8").trim();
   } catch (error) {
@@ -4214,27 +4121,27 @@ var CliAdapterAgent = class {
 };
 
 // src/cli/orchestrate-puppeteer.ts
-function loadPolicyParameters(path22, logger17) {
+function loadPolicyParameters(path22, logger18) {
   try {
     if (fs2.existsSync(path22)) {
       const content = fs2.readFileSync(path22, "utf-8");
       const params = JSON.parse(content);
-      logger17.info("Loaded policy parameters", { path: path22 });
+      logger18.info("Loaded policy parameters", { path: path22 });
       return params;
     }
   } catch (error) {
     const message = getErrorMessage(error);
-    logger17.warn("Failed to load policy parameters", { path: path22, error: message });
+    logger18.warn("Failed to load policy parameters", { path: path22, error: message });
   }
   return void 0;
 }
-function savePolicyParameters(path22, params, logger17) {
+function savePolicyParameters(path22, params, logger18) {
   try {
     fs2.writeFileSync(path22, JSON.stringify(params, null, 2));
-    logger17.info("Saved policy parameters", { path: path22 });
+    logger18.info("Saved policy parameters", { path: path22 });
   } catch (error) {
     const message = getErrorMessage(error);
-    logger17.warn("Failed to save policy parameters", { path: path22, error: message });
+    logger18.warn("Failed to save policy parameters", { path: path22, error: message });
   }
 }
 function createAgentsFromAdapters(adapters) {
@@ -4244,7 +4151,7 @@ function createAgentsFromAdapters(adapters) {
   }
   return agents;
 }
-function createPolicyEngine(options, logger17) {
+function createPolicyEngine(options, logger18) {
   const useLearnable = options.learn === true;
   if (useLearnable) {
     const learnablePolicy = createLearnablePolicy({
@@ -4252,7 +4159,7 @@ function createPolicyEngine(options, logger17) {
       warmupUpdates: 5
     });
     if (options.policyPath !== void 0) {
-      const savedParams = loadPolicyParameters(options.policyPath, logger17);
+      const savedParams = loadPolicyParameters(options.policyPath, logger18);
       if (savedParams !== void 0) {
         learnablePolicy.loadParameters(savedParams);
       }
@@ -4293,7 +4200,7 @@ function buildPuppeteerResult(puppeteerResult, startTime, policyEngine, useLearn
   }
   return result;
 }
-async function executeWithPuppeteer(taskContent, adapters, options, logger17) {
+async function executeWithPuppeteer(taskContent, adapters, options, logger18) {
   const startTime = getTimeProvider().now();
   const useLearnable = options.learn === true;
   const agents = createAgentsFromAdapters(adapters);
@@ -4305,14 +4212,14 @@ async function executeWithPuppeteer(taskContent, adapters, options, logger17) {
       durationMs: getTimeProvider().now() - startTime
     };
   }
-  const policyEngine = createPolicyEngine(options, logger17);
+  const policyEngine = createPolicyEngine(options, logger18);
   const orchestrator = createOrchestrator(policyEngine, agents, options);
   const task = {
     id: `cli-${String(getTimeProvider().now())}`,
     description: taskContent,
     context: { workingDirectory: process.cwd() }
   };
-  logger17.info("Executing with PuppeteerOrchestrator", {
+  logger18.info("Executing with PuppeteerOrchestrator", {
     agents: agents.map((a) => a.id),
     learnable: useLearnable,
     maxSteps: options.maxSteps ?? 5
@@ -4329,7 +4236,7 @@ async function executeWithPuppeteer(taskContent, adapters, options, logger17) {
   const puppeteerResult = execResult.value;
   if (useLearnable && options.policyPath !== void 0) {
     const learnablePolicy = policyEngine;
-    savePolicyParameters(options.policyPath, learnablePolicy.getParameters(), logger17);
+    savePolicyParameters(options.policyPath, learnablePolicy.getParameters(), logger18);
   }
   return buildPuppeteerResult(puppeteerResult, startTime, policyEngine, useLearnable);
 }
@@ -4408,9 +4315,9 @@ function formatPct(value) {
 }
 
 // src/cli/orchestrate-command.ts
-async function runWithAdapter(task, decision, logger17, startTime) {
+async function runWithAdapter(task, decision, logger18, startTime) {
   const time = getTimeProvider();
-  logger17.info("Executing task...", { model: decision.cliName });
+  logger18.info("Executing task...", { model: decision.cliName });
   const execResult = await decision.adapter.execute(task);
   if (!execResult.ok) {
     return {
@@ -4429,7 +4336,7 @@ async function runWithAdapter(task, decision, logger17, startTime) {
     durationMs: time.now() - startTime
   };
 }
-async function executeWithRouting(task, adapters, options, logger17) {
+async function executeWithRouting(task, adapters, options, logger18) {
   const time = getTimeProvider();
   const startTime = time.now();
   const configResult = getConfig();
@@ -4443,7 +4350,7 @@ async function executeWithRouting(task, adapters, options, logger17) {
     ...routingConfig,
     budgetConstraints
   });
-  logger17.info("Routing task...", { task: task.content.slice(0, 50) });
+  logger18.info("Routing task...", { task: task.content.slice(0, 50) });
   const routingResult = await router.route(task);
   if (!routingResult.ok) {
     return {
@@ -4463,9 +4370,9 @@ async function executeWithRouting(task, adapters, options, logger17) {
       durationMs: time.now() - startTime
     };
   }
-  return runWithAdapter(task, decision, logger17, startTime);
+  return runWithAdapter(task, decision, logger18, startTime);
 }
-async function executeWithModel(task, model, adapters, logger17) {
+async function executeWithModel(task, model, adapters, logger18) {
   const time = getTimeProvider();
   const startTime = time.now();
   const adapter = adapters.get(model);
@@ -4477,7 +4384,7 @@ async function executeWithModel(task, model, adapters, logger17) {
       durationMs: time.now() - startTime
     };
   }
-  logger17.info("Executing task...", { model });
+  logger18.info("Executing task...", { model });
   const execResult = await adapter.execute(task);
   if (!execResult.ok) {
     return {
@@ -4575,7 +4482,7 @@ function formatResult(result, format) {
   return format === "json" ? formatResultJson(result) : formatResultText(result);
 }
 async function orchestrateCommand(options) {
-  const logger17 = createLogger({ component: "orchestrate", verbose: options.verbose });
+  const logger18 = createLogger({ component: "orchestrate", verbose: options.verbose });
   const availableClis = await getAvailableClis();
   if (availableClis.length === 0) {
     console.error("No CLI tools available.");
@@ -4587,23 +4494,23 @@ async function orchestrateCommand(options) {
     console.log(`Available CLIs: ${availableClis.join(", ")}`);
   }
   const codexTransport = options.engine === "puppeteer" ? "subprocess" : "mcp";
-  const adapters = createAllAdapters(logger17, codexTransport);
+  const adapters = createAllAdapters(logger18, codexTransport);
   if (adapters.size === 0) {
     console.error("Failed to create CLI adapters.");
     return 1;
   }
   let result;
   if (options.engine === "puppeteer") {
-    result = await executeWithPuppeteer(options.task, adapters, options, logger17);
+    result = await executeWithPuppeteer(options.task, adapters, options, logger18);
   } else {
     const task = {
       content: options.task,
       systemPrompt: "You are a helpful assistant."
     };
     if (options.model !== void 0) {
-      result = await executeWithModel(task, options.model, adapters, logger17);
+      result = await executeWithModel(task, options.model, adapters, logger18);
     } else {
-      result = await executeWithRouting(task, adapters, options, logger17);
+      result = await executeWithRouting(task, adapters, options, logger18);
     }
   }
   const output2 = formatResult(result, options.format ?? "text");
@@ -5295,8 +5202,8 @@ async function handlePrune(args, log) {
   const count = String(result.value);
   output(dryRun ? "Would delete " + count + " sessions." : "Deleted " + count + " sessions.");
 }
-async function sessionCommand(subcommand, args, logger17) {
-  const log = logger17 ?? createLogger({ component: "SessionCommand" });
+async function sessionCommand(subcommand, args, logger18) {
+  const log = logger18 ?? createLogger({ component: "SessionCommand" });
   const handlers = {
     list: handleList,
     show: handleShow,
@@ -6052,9 +5959,6 @@ function validateGitHubIssue(issueNumber) {
   });
   return output2 !== null;
 }
-function escapeForShell(text) {
-  return text.replace(/'/g, "'\\''");
-}
 function formatVoteComment(result) {
   const now = new Date(getTimeProvider().now()).toLocaleDateString("en-US", {
     timeZone: "America/New_York",
@@ -6091,11 +5995,10 @@ ${voteRows}
 }
 function recordVoteToGitHub(issueNumber, result) {
   const comment = formatVoteComment(result);
-  const escapedComment = escapeForShell(comment);
-  const output2 = safeExecSandboxed(
-    `gh issue comment ${String(issueNumber)} --body '${escapedComment}'`,
-    { context: "gh" }
-  );
+  const output2 = safeExecSandboxed(`gh issue comment ${String(issueNumber)} --body-file -`, {
+    context: "gh",
+    stdin: comment
+  });
   if (output2 !== null) {
     writeLine(
       `${colors.green}${symbols.check}${colors.reset} Vote recorded to issue #${String(issueNumber)}
@@ -6129,8 +6032,8 @@ async function runVote(options) {
     ...options.threshold !== void 0 && { threshold: options.threshold },
     ...options.errorPolicy !== void 0 && { errorPolicy: options.errorPolicy }
   };
-  const logger17 = createLogger({ component: "cli-vote" });
-  const result = await executeVoting(input, logger17, { voteTimeoutMs: timeoutMs });
+  const logger18 = createLogger({ component: "cli-vote" });
+  const result = await executeVoting(input, logger18, { voteTimeoutMs: timeoutMs });
   return {
     proposal: result.proposal,
     threshold: result.threshold,
@@ -6831,7 +6734,7 @@ function generateSprintTitle(duration) {
     month: "2-digit",
     day: "2-digit"
   });
-  return `sprint: ${dateStr} (${duration})`;
+  return `sprint: ${dateStr} - ${duration}`;
 }
 function formatIssueForBody(issue) {
   const effort = issue.estimatedEffort !== void 0 ? ` (${issue.estimatedEffort})` : "";
@@ -6913,10 +6816,9 @@ function generateProposal(issues, options) {
 function createSprintIssue(proposal) {
   try {
     const escapedTitle = proposal.title.replace(/'/g, "'\\''");
-    const escapedBody = proposal.body.replace(/'/g, "'\\''");
     const output2 = safeExecSandboxed(
-      `gh issue create --title '${escapedTitle}' --body '${escapedBody}' --label 'epic'`,
-      { context: "gh" }
+      `gh issue create --title '${escapedTitle}' --body-file - --label epic`,
+      { context: "gh", stdin: proposal.body }
     );
     if (output2 === null) {
       return null;
@@ -8231,7 +8133,7 @@ async function researchIndexCommand(options) {
 
 // src/cli/research-import-command.ts
 import * as fs9 from "fs/promises";
-import { resolve as resolve6 } from "path";
+import { resolve as resolve5 } from "path";
 var VALID_TYPES = ["paper", "repo", "tool", "blog"];
 function parseCsvLine(line) {
   const fields = [];
@@ -8335,7 +8237,7 @@ function mapToSourceType(csvType) {
   }
 }
 async function executeImport(options) {
-  const csvPath = resolve6(options.csvPath);
+  const csvPath = resolve5(options.csvPath);
   let content;
   try {
     content = await fs9.readFile(csvPath, "utf-8");
@@ -8540,8 +8442,8 @@ async function handleAddCommand(args, options) {
     ...topic !== void 0 && { topic },
     ...priority !== void 0 && { priority }
   };
-  const logger17 = createLogger({ component: "cli-research-add" });
-  const result = await executeResearchAdd(input, logger17);
+  const logger18 = createLogger({ component: "cli-research-add" });
+  const result = await executeResearchAdd(input, logger18);
   return result.message;
 }
 var SOURCE_PROVIDERS = [
@@ -8606,8 +8508,8 @@ async function handleDiscoverCommand(args, options) {
   if (!parsed.success) {
     return `Error: ${parsed.error.issues.map((i) => i.message).join("; ")}`;
   }
-  const logger17 = createLogger({ component: "cli-research-discover" });
-  const response = await executeDiscovery(parsed.data, logger17);
+  const logger18 = createLogger({ component: "cli-research-discover" });
+  const response = await executeDiscovery(parsed.data, logger18);
   return renderDiscoverResponse(response);
 }
 async function handleReviewCommand(args, options) {
@@ -9643,6 +9545,11 @@ var COMMAND_CATALOG = [
     description: "Inspect + refresh the dynamic model registry (doctor / refresh)",
     audience: "advanced"
   },
+  {
+    command: "migrate",
+    description: "Relocate homedir state (sessions, checkpoints, traces, runs, audit, pipeline, tasks) into <repo>/.nexus-agents/ for users adopting NEXUS_REPO_PREFERRED=1. Cross-repo state stays homedir. --dry-run for a no-op plan. Epic #2872.",
+    audience: "advanced"
+  },
   {
     command: "review",
     description: "Review a GitHub PR (dogfooding helper)",
@@ -11359,7 +11266,7 @@ function isValidConfigAction(value) {
 // src/cli/config-command-helpers.ts
 import * as fs14 from "fs/promises";
 import * as path18 from "path";
-import { existsSync as existsSync11 } from "fs";
+import { existsSync as existsSync10 } from "fs";
 
 // src/cli/config-command-formatting.ts
 function formatSource(source) {
@@ -11645,7 +11552,7 @@ function getDefaultExportPath(format) {
 
 // src/cli/config-command-handlers.ts
 import * as fs15 from "fs/promises";
-import { existsSync as existsSync12 } from "fs";
+import { existsSync as existsSync11 } from "fs";
 async function handleGet(key) {
   const parsed = parseConfigKey(key);
   const config = getConfigManager();
@@ -11767,7 +11674,7 @@ async function handleExport2(file, format = "json") {
   };
 }
 async function readImportFile(filePath) {
-  if (!existsSync12(filePath)) {
+  if (!existsSync11(filePath)) {
     throw new ConfigCommandError("FILE_NOT_FOUND", `File not found: ${filePath}`);
   }
   const format = filePath.endsWith(".yaml") || filePath.endsWith(".yml") ? "yaml" : "json";
@@ -12270,7 +12177,7 @@ function writeResultAndExit(result) {
 
 // src/cli/hooks/hook-router.ts
 async function readStdin() {
-  return new Promise((resolve15, reject) => {
+  return new Promise((resolve14, reject) => {
     let data = "";
     process.stdin.setEncoding("utf8");
     process.stdin.on("readable", () => {
@@ -12281,24 +12188,24 @@ async function readStdin() {
       }
     });
     process.stdin.on("end", () => {
-      resolve15(data);
+      resolve14(data);
     });
     process.stdin.on("error", (err2) => {
       reject(err2);
     });
     if (process.stdin.isTTY) {
-      resolve15("");
+      resolve14("");
     }
   });
 }
 async function readStdinWithTimeout(timeoutMs = 5e3) {
-  return new Promise((resolve15, reject) => {
+  return new Promise((resolve14, reject) => {
     const timeout2 = setTimeout(() => {
       reject(new Error(`Stdin read timeout after ${String(timeoutMs)}ms`));
     }, timeoutMs);
     readStdin().then((data) => {
       clearTimeout(timeout2);
-      resolve15(data);
+      resolve14(data);
     }).catch((err2) => {
       clearTimeout(timeout2);
       reject(err2 instanceof Error ? err2 : new Error(String(err2)));
@@ -14045,11 +13952,11 @@ async function releaseNotesCommand(args) {
 }
 
 // src/cli/release-validate-command.ts
-import { readFileSync as readFileSync8 } from "fs";
+import { readFileSync as readFileSync7 } from "fs";
 
 // src/cli/release-validate-helpers.ts
 import { execSync as execSync2 } from "child_process";
-import { existsSync as existsSync13, readFileSync as readFileSync7 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync6 } from "fs";
 async function validateSecurity(options) {
   const startTime = Date.now();
   const findings = [];
@@ -14068,7 +13975,7 @@ async function validateSecurity(options) {
       remediation: "Run npm audit fix or review and update vulnerable dependencies."
     });
   }
-  if (existsSync13(".env")) {
+  if (existsSync12(".env")) {
     findings.push({
       severity: "error",
       category: "security",
@@ -14164,7 +14071,7 @@ async function validateArchitecture2(options) {
 async function validateDocumentation(options) {
   const startTime = Date.now();
   const findings = [];
-  if (!existsSync13("CHANGELOG.md")) {
+  if (!existsSync12("CHANGELOG.md")) {
     findings.push({
       severity: "error",
       category: "docs",
@@ -14172,7 +14079,7 @@ async function validateDocumentation(options) {
       description: "No CHANGELOG.md found in repository root.",
       remediation: "Create CHANGELOG.md following Keep a Changelog format."
     });
-  } else if (!readFileSync7("CHANGELOG.md", "utf-8").includes(options.version)) {
+  } else if (!readFileSync6("CHANGELOG.md", "utf-8").includes(options.version)) {
     findings.push({
       severity: "warning",
       category: "docs",
@@ -14182,7 +14089,7 @@ async function validateDocumentation(options) {
     });
   }
   const pkgCl = "packages/nexus-agents/CHANGELOG.md";
-  if (existsSync13(pkgCl) && !readFileSync7(pkgCl, "utf-8").includes(options.version)) {
+  if (existsSync12(pkgCl) && !readFileSync6(pkgCl, "utf-8").includes(options.version)) {
     findings.push({
       severity: "warning",
       category: "docs",
@@ -14191,7 +14098,7 @@ async function validateDocumentation(options) {
       remediation: "Run pnpm changeset:version to generate changelog from pending changesets."
     });
   }
-  if (!existsSync13("README.md")) {
+  if (!existsSync12("README.md")) {
     findings.push({
       severity: "error",
       category: "docs",
@@ -14200,8 +14107,8 @@ async function validateDocumentation(options) {
       remediation: "Create README.md with project overview and usage instructions."
     });
   }
-  if (existsSync13("CLAUDE.md")) {
-    const claudeMd = readFileSync7("CLAUDE.md", "utf-8");
+  if (existsSync12("CLAUDE.md")) {
+    const claudeMd = readFileSync6("CLAUDE.md", "utf-8");
     const match = claudeMd.match(/Governance Version: (\d{4}-\d{2}-\d{2})/);
     if (match?.[1]) {
       const governanceDate = new Date(match[1]);
@@ -14309,7 +14216,7 @@ var DEFAULT_OPTIONS2 = {
 };
 function readVersionFromPackage() {
   try {
-    const raw = JSON.parse(readFileSync8("package.json", "utf-8"));
+    const raw = JSON.parse(readFileSync7("package.json", "utf-8"));
     if (typeof raw === "object" && raw !== null && "version" in raw) {
       const pkg = raw;
       return typeof pkg.version === "string" ? pkg.version : "unknown";
@@ -14423,7 +14330,7 @@ async function releaseValidateCommand(args) {
 }
 
 // src/cli/release-announce-command.ts
-import { readFileSync as readFileSync9, existsSync as existsSync14 } from "fs";
+import { readFileSync as readFileSync8, existsSync as existsSync13 } from "fs";
 
 // src/cli/release-announce-types.ts
 var BLUESKY_LIMITS = {
@@ -14490,8 +14397,8 @@ var DEFAULT_OPTIONS3 = {
   verbose: false
 };
 function extractHighlightsFromChangelog(version) {
-  if (!existsSync14("CHANGELOG.md")) return [];
-  const changelog = readFileSync9("CHANGELOG.md", "utf-8");
+  if (!existsSync13("CHANGELOG.md")) return [];
+  const changelog = readFileSync8("CHANGELOG.md", "utf-8");
   const escaped = version.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const versionRegex = new RegExp(`## \\[${escaped}\\][^#]*`, "s");
   const match = changelog.match(versionRegex);
@@ -14753,7 +14660,7 @@ async function releaseAnnounceCommand(args) {
     version = args.options.version;
   } else {
     try {
-      const pkg = JSON.parse(readFileSync9("package.json", "utf-8"));
+      const pkg = JSON.parse(readFileSync8("package.json", "utf-8"));
       if (!pkg.version) {
         console.error(`${colors.red}Error: Could not determine version${colors.reset}`);
         return 1;
@@ -15320,8 +15227,8 @@ function buildDetails(taskCount, counts, nonZero, score, passed) {
   lines.push(`Result: ${passed ? "PASSED" : "FAILED"}`);
   return lines;
 }
-function runE2EEval(config, logger17) {
-  const log = logger17 ?? createLogger({ component: "e2e-eval" });
+function runE2EEval(config, logger18) {
+  const log = logger18 ?? createLogger({ component: "e2e-eval" });
   const taskCount = config?.taskCount ?? 50;
   if (config?.resetStore !== false) {
     resetOutcomeStore();
@@ -15685,13 +15592,13 @@ function formatEvalDetails(baseline, reflective, improvement, datasetSize) {
 }
 
 // src/cli/auth-command.ts
-import { existsSync as existsSync16, statSync as statSync2, chmodSync } from "fs";
+import { existsSync as existsSync15, statSync, chmodSync } from "fs";
 function isValidAuthSubcommand(value) {
   return value === "init" || value === "show" || value === "rotate" || value === "help" || value === "status";
 }
 function getFilePermissions(filePath) {
   try {
-    const stats = statSync2(filePath);
+    const stats = statSync(filePath);
     return (stats.mode & 511).toString(8);
   } catch {
     return void 0;
@@ -15705,7 +15612,7 @@ function fixPermissions(filePath) {
 }
 function runAuthInit(options) {
   const tokenFile = options.tokenFile ?? getDefaultTokenPath();
-  const tokenExists = existsSync16(tokenFile);
+  const tokenExists = existsSync15(tokenFile);
   if (tokenExists && options.force !== true) {
     return {
       success: false,
@@ -15729,7 +15636,7 @@ function runAuthInit(options) {
 }
 function runAuthShow(options) {
   const tokenFile = options.tokenFile ?? getDefaultTokenPath();
-  const tokenExists = existsSync16(tokenFile);
+  const tokenExists = existsSync15(tokenFile);
   const token = readStoredToken(tokenFile);
   if (!tokenExists || token === void 0) {
     return {
@@ -15750,7 +15657,7 @@ function runAuthShow(options) {
 }
 function runAuthRotate(options) {
   const tokenFile = options.tokenFile ?? getDefaultTokenPath();
-  const tokenExists = existsSync16(tokenFile);
+  const tokenExists = existsSync15(tokenFile);
   if (!tokenExists) {
     return {
       success: false,
@@ -15786,14 +15693,14 @@ function runAuthCommand(options) {
         success: true,
         operation: "help",
         tokenFile: getDefaultTokenPath(),
-        tokenExists: existsSync16(getDefaultTokenPath())
+        tokenExists: existsSync15(getDefaultTokenPath())
       };
     default:
       return {
         success: false,
         operation: "help",
         tokenFile: getDefaultTokenPath(),
-        tokenExists: existsSync16(getDefaultTokenPath()),
+        tokenExists: existsSync15(getDefaultTokenPath()),
         error: `Unknown subcommand: ${subcommand}`
       };
   }
@@ -16163,8 +16070,12 @@ var PARSE_ARGS_CONFIG = {
       type: "string"
     },
     "output-dir": {
-      type: "string",
-      default: "./logs/run_evaluation"
+      type: "string"
+      // No default: the only consumer (handleSweBenchCommand) is a
+      // deprecation shim that ignores it. Live callers should pass an
+      // explicit path or resolve through getNexusDataDir() at use time.
+      // Removed the './logs/run_evaluation' default per epic #2872 to
+      // stop the parser from advertising a sprawl-creating fallback.
     },
     // ATBench command options (#1981)
     fixture: {
@@ -16349,29 +16260,30 @@ var VALID_COMMANDS = [
   "registry",
   "login",
   "usage",
-  "improvement-review"
+  "improvement-review",
+  "migrate"
 ];
 function isValidCommand(value) {
   return VALID_COMMANDS.includes(value);
 }
 
 // src/cli-commands-handlers.ts
-import { existsSync as existsSync21 } from "fs";
+import { existsSync as existsSync20 } from "fs";
 
 // src/cli/init-portable.ts
 import {
-  existsSync as existsSync20,
+  existsSync as existsSync19,
   mkdirSync as mkdirSync5,
   readdirSync,
-  statSync as statSync3,
-  appendFileSync as appendFileSync3,
-  readFileSync as readFileSync12
+  statSync as statSync2,
+  appendFileSync as appendFileSync2,
+  readFileSync as readFileSync11
 } from "fs";
-import { resolve as resolve11, join as join16, isAbsolute as isAbsolute2 } from "path";
+import { resolve as resolve10, join as join15, isAbsolute as isAbsolute2 } from "path";
 
 // src/cli/mcp-config-emitter.ts
-import { existsSync as existsSync17, readFileSync as readFileSync10, writeFileSync as writeFileSync5, appendFileSync as appendFileSync2 } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync9, writeFileSync as writeFileSync5, appendFileSync } from "fs";
+import { join as join12 } from "path";
 var MCP_CONFIG_FILENAME = ".mcp.json";
 var NEXUS_SERVER_KEY = "nexus-agents";
 function buildNexusServerEntry(dataDir, commandPath) {
@@ -16394,10 +16306,10 @@ function entriesEqual(a, b) {
   return true;
 }
 function loadExistingConfig(path22) {
-  if (!existsSync17(path22)) return { ok: true, value: void 0 };
+  if (!existsSync16(path22)) return { ok: true, value: void 0 };
   let raw;
   try {
-    raw = readFileSync10(path22, "utf-8");
+    raw = readFileSync9(path22, "utf-8");
   } catch (e) {
     return { ok: false, error: e instanceof Error ? e.message : String(e) };
   }
@@ -16431,24 +16343,24 @@ function decideEmission(existing, desired, force) {
   return { kind: "write", nextConfig: { ...existing, mcpServers: nextServers } };
 }
 function autoGitignoreMcpConfig(workspaceDir, dryRun) {
-  const gitDir = join13(workspaceDir, ".git");
-  if (!existsSync17(gitDir)) return false;
-  const gitignorePath = join13(workspaceDir, ".gitignore");
+  const gitDir = join12(workspaceDir, ".git");
+  if (!existsSync16(gitDir)) return false;
+  const gitignorePath = join12(workspaceDir, ".gitignore");
   let existing = "";
-  if (existsSync17(gitignorePath)) {
-    existing = readFileSync10(gitignorePath, "utf-8");
+  if (existsSync16(gitignorePath)) {
+    existing = readFileSync9(gitignorePath, "utf-8");
     const already = existing.split("\n").some((l) => l.trim() === MCP_CONFIG_FILENAME || l.trim() === `/${MCP_CONFIG_FILENAME}`);
     if (already) return false;
   }
   if (!dryRun) {
     const sep3 = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
-    appendFileSync2(gitignorePath, `${sep3}${MCP_CONFIG_FILENAME}
+    appendFileSync(gitignorePath, `${sep3}${MCP_CONFIG_FILENAME}
 `, "utf-8");
   }
   return true;
 }
 function emitMcpConfig(options) {
-  const mcpConfigPath = join13(options.workspaceDir, MCP_CONFIG_FILENAME);
+  const mcpConfigPath = join12(options.workspaceDir, MCP_CONFIG_FILENAME);
   const dryRun = options.dryRun === true;
   const force = options.force === true;
   const desired = buildNexusServerEntry(options.dataDir, options.commandPath);
@@ -16486,13 +16398,13 @@ function makeFailure(mcpConfigPath, error) {
 
 // src/cli/portable-installer.ts
 import { execFile } from "child_process";
-import { existsSync as existsSync19, mkdirSync as mkdirSync4, rmSync, writeFileSync as writeFileSync7 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync18, mkdirSync as mkdirSync4, rmSync, writeFileSync as writeFileSync7 } from "fs";
+import { join as join14 } from "path";
 import { promisify } from "util";
 
 // src/cli/bin-shim.ts
-import { existsSync as existsSync18, readFileSync as readFileSync11, writeFileSync as writeFileSync6, chmodSync as chmodSync2, mkdirSync as mkdirSync3 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync17, readFileSync as readFileSync10, writeFileSync as writeFileSync6, chmodSync as chmodSync2, mkdirSync as mkdirSync3 } from "fs";
+import { join as join13 } from "path";
 var SHIM_BASENAME = "nexus-agents";
 var SHIM_MODE = 493;
 function buildShimContents(cliEntryPath) {
@@ -16506,18 +16418,18 @@ function buildShimContents(cliEntryPath) {
   return lines.join("\n");
 }
 function writeBinShim(options) {
-  const shimPath = join14(options.binDir, SHIM_BASENAME);
+  const shimPath = join13(options.binDir, SHIM_BASENAME);
   const desired = buildShimContents(options.cliEntryPath);
   const dryRun = options.dryRun === true;
   try {
-    if (existsSync18(shimPath)) {
-      const current = readFileSync11(shimPath, "utf-8");
+    if (existsSync17(shimPath)) {
+      const current = readFileSync10(shimPath, "utf-8");
       if (current === desired) {
         return { success: true, shimPath, written: false, alreadyMatched: true, error: null };
       }
     }
     if (!dryRun) {
-      if (!existsSync18(options.binDir)) mkdirSync3(options.binDir, { recursive: true });
+      if (!existsSync17(options.binDir)) mkdirSync3(options.binDir, { recursive: true });
       writeFileSync6(shimPath, desired, "utf-8");
       chmodSync2(shimPath, SHIM_MODE);
     }
@@ -16552,10 +16464,10 @@ function writeInstallManifest(cliDir, version) {
     description: "Local install root for portable nexus-agents (generated; do not commit)",
     dependencies: { "nexus-agents": version }
   };
-  writeFileSync7(join15(cliDir, "package.json"), JSON.stringify(manifest, null, 2) + "\n", "utf-8");
+  writeFileSync7(join14(cliDir, "package.json"), JSON.stringify(manifest, null, 2) + "\n", "utf-8");
 }
 function isAlreadyInstalled(cliDir) {
-  return existsSync19(join15(cliDir, "node_modules", "nexus-agents", "package.json"));
+  return existsSync18(join14(cliDir, "node_modules", "nexus-agents", "package.json"));
 }
 async function spawnNpmInstall(cliDir) {
   await execFileAsync("npm", ["install", "--no-audit", "--no-fund", "--silent"], {
@@ -16571,7 +16483,7 @@ function cleanupOnFailure(cliDir) {
 }
 async function runNpmStep(ctx) {
   try {
-    if (!existsSync19(ctx.cliDir)) mkdirSync4(ctx.cliDir, { recursive: true });
+    if (!existsSync18(ctx.cliDir)) mkdirSync4(ctx.cliDir, { recursive: true });
     writeInstallManifest(ctx.cliDir, ctx.version);
     await spawnNpmInstall(ctx.cliDir);
     return void 0;
@@ -16582,8 +16494,8 @@ async function runNpmStep(ctx) {
   }
 }
 async function installPortable(options) {
-  const cliDir = join15(options.dataDir, CLI_SUBDIR);
-  const binDir = join15(options.dataDir, BIN_SUBDIR);
+  const cliDir = join14(options.dataDir, CLI_SUBDIR);
+  const binDir = join14(options.dataDir, BIN_SUBDIR);
   const versionResolution = resolveInstallVersion(options.version);
   if (!versionResolution.ok) {
     return {
@@ -16604,7 +16516,7 @@ async function installPortable(options) {
   }
   const npmFailure = await runNpmStep(ctx);
   if (npmFailure !== void 0) return npmFailure;
-  const shim = writeBinShim({ binDir, cliEntryPath: join15(cliDir, CLI_ENTRY_RELATIVE) });
+  const shim = writeBinShim({ binDir, cliEntryPath: join14(cliDir, CLI_ENTRY_RELATIVE) });
   if (!shim.success) {
     cleanupOnFailure(cliDir);
     return {
@@ -16618,14 +16530,14 @@ async function installPortable(options) {
   return { success: true, ...ctx, shim, skipped: false, error: null };
 }
 function uninstallPortable(options) {
-  const cliDir = join15(options.dataDir, CLI_SUBDIR);
-  const binDir = join15(options.dataDir, BIN_SUBDIR);
+  const cliDir = join14(options.dataDir, CLI_SUBDIR);
+  const binDir = join14(options.dataDir, BIN_SUBDIR);
   const removed = [];
   const notPresent = [];
   const dryRun = options.dryRun === true;
   try {
     for (const dir of [cliDir, binDir]) {
-      if (!existsSync19(dir)) {
+      if (!existsSync18(dir)) {
         notPresent.push(dir);
         continue;
       }
@@ -16639,8 +16551,8 @@ function uninstallPortable(options) {
   }
 }
 function findBinShim(dataDir) {
-  const shimPath = join15(dataDir, BIN_SUBDIR, "nexus-agents");
-  return existsSync19(shimPath) ? shimPath : void 0;
+  const shimPath = join14(dataDir, BIN_SUBDIR, "nexus-agents");
+  return existsSync18(shimPath) ? shimPath : void 0;
 }
 
 // src/cli/init-portable.ts
@@ -16648,18 +16560,18 @@ var DEFAULT_PORTABLE_DIRNAME = ".nexus-agents";
 var RESTRICTED_SUBDIRS = /* @__PURE__ */ new Set(["auth"]);
 function resolveTargetPath(rawPath) {
   if (rawPath === void 0 || rawPath === "") {
-    return resolve11(process.cwd(), DEFAULT_PORTABLE_DIRNAME);
+    return resolve10(process.cwd(), DEFAULT_PORTABLE_DIRNAME);
   }
-  return isAbsolute2(rawPath) ? rawPath : resolve11(process.cwd(), rawPath);
+  return isAbsolute2(rawPath) ? rawPath : resolve10(process.cwd(), rawPath);
 }
 function isNonEmpty(dir) {
-  if (!existsSync20(dir)) return false;
-  const stat2 = statSync3(dir);
+  if (!existsSync19(dir)) return false;
+  const stat2 = statSync2(dir);
   if (!stat2.isDirectory()) return true;
   return readdirSync(dir).length > 0;
 }
 function ensureDir(path22, dryRun, created, alreadyExisted, mode) {
-  if (existsSync20(path22)) {
+  if (existsSync19(path22)) {
     alreadyExisted.push(path22);
     return;
   }
@@ -16669,37 +16581,37 @@ function ensureDir(path22, dryRun, created, alreadyExisted, mode) {
   created.push(path22);
 }
 function maybeUpdateGitignore(workspaceDir, portableDirName, dryRun) {
-  const gitDir = join16(workspaceDir, ".git");
-  if (!existsSync20(gitDir)) return false;
-  const gitignorePath = join16(workspaceDir, ".gitignore");
+  const gitDir = join15(workspaceDir, ".git");
+  if (!existsSync19(gitDir)) return false;
+  const gitignorePath = join15(workspaceDir, ".gitignore");
   const entry = `${portableDirName}/`;
   let existing = "";
-  if (existsSync20(gitignorePath)) {
-    existing = readFileSync12(gitignorePath, "utf-8");
+  if (existsSync19(gitignorePath)) {
+    existing = readFileSync11(gitignorePath, "utf-8");
     if (existing.split("\n").some((l) => l.trim() === entry || l.trim() === portableDirName)) {
       return false;
     }
   }
   if (!dryRun) {
     const sep3 = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
-    appendFileSync3(gitignorePath, `${sep3}${entry}
+    appendFileSync2(gitignorePath, `${sep3}${entry}
 `, "utf-8");
   }
   return true;
 }
 function inspectTarget(target) {
-  const exists = existsSync20(target);
+  const exists = existsSync19(target);
   if (!exists) return { exists: false, nonEmpty: false, isExistingNexusDir: false };
   const nonEmpty = isNonEmpty(target);
-  const stat2 = statSync3(target);
-  const isExistingNexusDir = stat2.isDirectory() && existsSync20(join16(target, "audit"));
+  const stat2 = statSync2(target);
+  const isExistingNexusDir = stat2.isDirectory() && existsSync19(join15(target, "audit"));
   return { exists, nonEmpty, isExistingNexusDir };
 }
 function createDataLayout(target, dryRun, created, alreadyExisted) {
   ensureDir(target, dryRun, created, alreadyExisted);
   for (const subdir of DATA_SUBDIRECTORIES) {
     const mode = RESTRICTED_SUBDIRS.has(subdir) ? 448 : void 0;
-    ensureDir(join16(target, subdir), dryRun, created, alreadyExisted, mode);
+    ensureDir(join15(target, subdir), dryRun, created, alreadyExisted, mode);
   }
 }
 function makeResult(opts) {
@@ -16718,13 +16630,13 @@ function makeResult(opts) {
 }
 function applyGitignoreOption(target, options, dryRun) {
   if (options.gitignore !== true) return false;
-  const workspaceDir = resolve11(target, "..");
+  const workspaceDir = resolve10(target, "..");
   const portableName = target.slice(workspaceDir.length + 1);
   return maybeUpdateGitignore(workspaceDir, portableName, dryRun);
 }
 function applyMcpConfigOption(target, options, dryRun) {
   if (options.mcpConfig !== true) return void 0;
-  const workspaceDir = resolve11(target, "..");
+  const workspaceDir = resolve10(target, "..");
   const shimPath = findBinShim(target);
   return emitMcpConfig({
     workspaceDir,
@@ -16981,7 +16893,45 @@ function buildStructuredOutput(result) {
   };
 }
 var RUN_DEV_PIPELINE_DESCRIPTION = "Run the multi-agent development pipeline. Accepts direct task instructions, a plan file, or a spec file. Supports dry-run (plan+vote only).";
-function registerDevPipelineTool(server, _deps) {
+async function runDevPipelineHandler(args, logger18) {
+  const parsed = DevPipelineInputSchema.safeParse(args);
+  if (!parsed.success) {
+    return toolStructuredError({
+      errorCategory: "validation",
+      message: `Invalid input: ${formatZodError(parsed.error)}`
+    });
+  }
+  const input = parsed.data;
+  if (input.simulateVotes) {
+    warnIfSimulatedOutsideTests("run_dev_pipeline", logger18);
+  }
+  try {
+    const taskText = await resolveTaskInput(input);
+    const stages = await createStages(input);
+    const pipelineOptions = {
+      ...input.sessionId !== void 0 ? { sessionId: input.sessionId } : {},
+      ...input.dryRun ? { dryRun: true } : {},
+      ...input.mode === "harness" ? { mode: "harness" } : {}
+    };
+    const hasOptions = Object.keys(pipelineOptions).length > 0;
+    const result = await runDevPipeline(taskText, stages, hasOptions ? pipelineOptions : void 0);
+    flushPipelineMemory();
+    return toolSuccessStructured(buildStructuredOutput(result));
+  } catch (error) {
+    return toolStructuredError({
+      errorCategory: "internal",
+      message: `Pipeline error: ${getErrorMessage(error)}`
+    });
+  }
+}
+function registerDevPipelineTool(server, deps) {
+  const logger18 = deps.logger ?? createLogger({ tool: "run_dev_pipeline" });
+  const secureHandler = createSecureHandler(
+    (args) => runDevPipelineHandler(args, logger18),
+    { toolName: "run_dev_pipeline", rateLimiter: deps.rateLimiter, logger: logger18 }
+  );
+  const timeoutMs = getToolTimeout("run_dev_pipeline", deps.security);
+  const wrapped = wrapToolWithTimeout("run_dev_pipeline", secureHandler, { timeoutMs, logger: logger18 });
   server.registerTool(
     "run_dev_pipeline",
     {
@@ -16989,41 +16939,9 @@ function registerDevPipelineTool(server, _deps) {
       inputSchema: DevPipelineInputSchema.shape,
       annotations: getToolAnnotations("run_dev_pipeline")
     },
-    async (args) => {
-      const input = DevPipelineInputSchema.parse(args);
-      if (input.simulateVotes) {
-        warnIfSimulatedOutsideTests("run_dev_pipeline", createLogger({ tool: "run_dev_pipeline" }));
-      }
-      try {
-        const taskText = await resolveTaskInput(input);
-        const stages = await createStages(input);
-        const pipelineOptions = {
-          ...input.sessionId !== void 0 ? { sessionId: input.sessionId } : {},
-          ...input.dryRun ? { dryRun: true } : {},
-          ...input.mode === "harness" ? { mode: "harness" } : {}
-        };
-        const hasOptions = Object.keys(pipelineOptions).length > 0;
-        const result = await runDevPipeline(
-          taskText,
-          stages,
-          hasOptions ? pipelineOptions : void 0
-        );
-        flushPipelineMemory();
-        const structured = buildStructuredOutput(result);
-        return {
-          content: [{ type: "text", text: JSON.stringify(structured, null, 2) }],
-          structuredContent: structured
-        };
-      } catch (error) {
-        return {
-          ...toolStructuredError({
-            errorCategory: "internal",
-            message: `Pipeline error: ${getErrorMessage(error)}`
-          })
-        };
-      }
-    }
+    toSdkCallback(wrapped)
   );
+  logger18.info("Registered run_dev_pipeline tool");
 }
 
 // src/cli-server-stpa.ts
@@ -17136,7 +17054,7 @@ var StpaSafetyError = class extends NexusError {
     this.analysisResult = analysisResult;
   }
 };
-function logToolResults(logger17, result) {
+function logToolResults(logger18, result) {
   for (const toolResult of result.toolResults) {
     if (toolResult.hazards.length === 0) continue;
     const criticalCount = toolResult.hazards.filter(
@@ -17144,7 +17062,7 @@ function logToolResults(logger17, result) {
     ).length;
     const highCount = toolResult.hazards.filter((h) => h.severity === "high" /* HIGH */).length;
     if (criticalCount > 0 || highCount > 0) {
-      logger17.warn(`STPA hazards for tool '${toolResult.toolName}'`, {
+      logger18.warn(`STPA hazards for tool '${toolResult.toolName}'`, {
         riskLevel: toolResult.riskLevel,
         riskScore: toolResult.riskScore,
         criticalHazards: criticalCount,
@@ -17152,7 +17070,7 @@ function logToolResults(logger17, result) {
         safetyConstraints: toolResult.safetyConstraints.length
       });
     } else {
-      logger17.debug(`STPA analysis for tool '${toolResult.toolName}'`, {
+      logger18.debug(`STPA analysis for tool '${toolResult.toolName}'`, {
         riskLevel: toolResult.riskLevel,
         hazards: toolResult.hazards.length
       });
@@ -17170,7 +17088,7 @@ function checkHighSeverityTools(result, failOnHighSeverity) {
     result
   );
 }
-function runStpaSafetyAnalysis(logger17, failOnHighSeverity) {
+function runStpaSafetyAnalysis(logger18, failOnHighSeverity) {
   const analysisResult = analyzeTools(TOOL_DEFINITIONS);
   if (!analysisResult.ok) {
     const errorMsg = analysisResult.error.message;
@@ -17179,12 +17097,12 @@ function runStpaSafetyAnalysis(logger17, failOnHighSeverity) {
         code: ErrorCode.SECURITY_ERROR
       });
     }
-    logger17.warn("STPA safety analysis failed", { error: errorMsg });
+    logger18.warn("STPA safety analysis failed", { error: errorMsg });
     return;
   }
   const result = analysisResult.value;
   const { summary } = result;
-  logger17.info("STPA safety analysis completed", {
+  logger18.info("STPA safety analysis completed", {
     toolsAnalyzed: summary.totalTools,
     hazardsIdentified: summary.totalHazards,
     unsafeControlActions: summary.totalUnsafeControlActions,
@@ -17192,10 +17110,10 @@ function runStpaSafetyAnalysis(logger17, failOnHighSeverity) {
     averageRiskScore: summary.averageRiskScore.toFixed(1),
     toolsByRiskLevel: summary.toolsByRiskLevel
   });
-  logToolResults(logger17, result);
+  logToolResults(logger18, result);
   checkHighSeverityTools(result, failOnHighSeverity);
   if (result.interactions.length > 0) {
-    logger17.info("STPA cross-tool hazard interactions detected", {
+    logger18.info("STPA cross-tool hazard interactions detected", {
       interactionCount: result.interactions.length,
       interactions: result.interactions.map((i) => ({
         tools: i.involvedTools,
@@ -17232,10 +17150,10 @@ var UpstreamClient = class {
   transport = null;
   state = "disconnected";
   tools = [];
-  constructor(config, logger17) {
+  constructor(config, logger18) {
     this.name = config.name;
     this.config = config;
-    this.log = logger17 ?? createLogger({ component: `upstream:${config.name}` });
+    this.log = logger18 ?? createLogger({ component: `upstream:${config.name}` });
   }
   /** Connect to the upstream server. Idempotent. */
   async connect() {
@@ -17335,8 +17253,8 @@ var UpstreamClient = class {
 var UpstreamClientManager = class {
   clients = /* @__PURE__ */ new Map();
   log;
-  constructor(logger17) {
-    this.log = logger17 ?? createLogger({ component: "UpstreamClientManager" });
+  constructor(logger18) {
+    this.log = logger18 ?? createLogger({ component: "UpstreamClientManager" });
   }
   /** Register upstream servers from config. */
   registerServers(configs) {
@@ -17444,11 +17362,11 @@ var REGISTERED_TOOLS = [
   "improvement_review"
 ];
 var MOCK_ORCHESTRATION_ENV = "NEXUS_ALLOW_MOCK_ORCHESTRATION";
-function createOrchestratorForOrchestration(modelAdapter, logger17, useMockTechLead) {
+function createOrchestratorForOrchestration(modelAdapter, logger18, useMockTechLead) {
   if (modelAdapter !== void 0) {
-    const orchestratorAgent = new Orchestrator({ adapter: modelAdapter, logger: logger17 });
+    const orchestratorAgent = new Orchestrator({ adapter: modelAdapter, logger: logger18 });
     const factory = new OrchestratorFactory({
-      logger: logger17,
+      logger: logger18,
       techLead: orchestratorAgent
     });
     return factory.create("orchestrator");
@@ -17457,7 +17375,7 @@ function createOrchestratorForOrchestration(modelAdapter, logger17, useMockTechL
   const mockEnabled = useMockTechLead === true || envMockEnabled;
   if (mockEnabled) {
     const source = envMockEnabled ? `${MOCK_ORCHESTRATION_ENV} env var` : "config";
-    logger17.warn(
+    logger18.warn(
       `Using mock orchestrator as explicitly configured via ${source} (no real adapter available)`
     );
     return createMockOrchestrator();
@@ -17611,14 +17529,14 @@ function registerOrchestrateToolSafe(ctx) {
     });
   }
 }
-async function initUpstreamServers(gatewayConfig, server, logger17) {
+async function initUpstreamServers(gatewayConfig, server, logger18) {
   const upstreamServers = gatewayConfig?.["upstreamServers"];
   if (upstreamServers === void 0 || upstreamServers.length === 0) return;
-  const manager = new UpstreamClientManager(logger17);
+  const manager = new UpstreamClientManager(logger18);
   manager.registerServers(upstreamServers);
   await manager.connectEager();
   const tools = manager.getAllTools();
-  logger17.info("Upstream MCP servers initialized", {
+  logger18.info("Upstream MCP servers initialized", {
     servers: upstreamServers.length,
     tools: tools.length
   });
@@ -17638,11 +17556,11 @@ async function initUpstreamServers(gatewayConfig, server, logger17) {
     );
   }
 }
-function maybeRunStpaAnalysis(options, logger17) {
+function maybeRunStpaAnalysis(options, logger18) {
   const enableStpa = options.enableStpaSafetyAnalysis ?? false;
   if (!enableStpa) return;
-  logger17.info("Running STPA safety analysis on registered tools");
-  runStpaSafetyAnalysis(logger17, options.failOnHighSeverityHazards ?? false);
+  logger18.info("Running STPA safety analysis on registered tools");
+  runStpaSafetyAnalysis(logger18, options.failOnHighSeverityHazards ?? false);
 }
 function copyOptionalProps(opts) {
   const result = {};
@@ -17668,16 +17586,16 @@ function createToolContext(options, toolInfra, rateLimiterFactory) {
     }
   };
 }
-function logToolRegistration(logger17, allowlist, info) {
+function logToolRegistration(logger18, allowlist, info) {
   const activeTools = allowlist ? REGISTERED_TOOLS.filter((t) => allowlist.has(t)) : [...REGISTERED_TOOLS];
   if (allowlist !== void 0) {
-    logger17.info("Tool allowlist active", {
+    logger18.info("Tool allowlist active", {
       allowed: activeTools.length,
       total: REGISTERED_TOOLS.length,
       blocked: REGISTERED_TOOLS.filter((t) => !allowlist.has(t))
     });
   }
-  logger17.info("Tools registered with per-tool rate limiting", {
+  logger18.info("Tools registered with per-tool rate limiting", {
     registeredTools: activeTools,
     rateLimitingEnabled: info.rateLimiterFactory.isEnabled(),
     customRateLimitsConfigured: info.perToolConfig !== void 0,
@@ -17733,13 +17651,13 @@ function registerToolCategories(ctx) {
     if (allowed(tool.name)) tool.register(ctx.server, buildStandardDeps(ctx, tool.name));
   }
 }
-function initV2PipelineSubsystems(logger17) {
+function initV2PipelineSubsystems(logger18) {
   const pluginRegistry = getPipelinePluginRegistry();
   const pipelineEventBus = getPipelineEventBus();
   const bridge = createEventBusBridge({ source: pipelineEventBus });
   const policyEngine = createDefaultPolicyEngine();
   const v2Config = resolveV2Config();
-  logger17.info("V2 Pipeline OS initialized", {
+  logger18.info("V2 Pipeline OS initialized", {
     plugins: pluginRegistry.listEnabled().length,
     bridged: bridge.forwarded(),
     policyRules: policyEngine.listRules().length,
@@ -17750,7 +17668,7 @@ function initV2PipelineSubsystems(logger17) {
 function registerMcpTools(options) {
   const {
     server,
-    logger: logger17,
+    logger: logger18,
     builtInTemplates,
     modelAdapter,
     policyFirewall,
@@ -17761,7 +17679,7 @@ function registerMcpTools(options) {
   const gatewayServer = gatewayConfig !== void 0 ? createGatewayServerProxy(server, gatewayConfig) : server;
   const annotatedServer = createAnnotationsProxy(gatewayServer);
   const observableServer = createToolObservabilityProxy(annotatedServer, getPipelineEventBus());
-  const toolInfra = registerTools(observableServer, { logger: logger17 });
+  const toolInfra = registerTools(observableServer, { logger: logger18 });
   const rateLimitConfig = securityConfig?.rateLimit;
   const perToolConfig = rateLimitConfig?.perTool;
   const rateLimiterFactory = createToolRateLimiterFactory({
@@ -17770,14 +17688,14 @@ function registerMcpTools(options) {
     logger: toolInfra.logger
   });
   setGlobalToolRateLimiterFactory(rateLimiterFactory);
-  initV2PipelineSubsystems(logger17);
+  initV2PipelineSubsystems(logger18);
   const gatewayOptions = { ...options, server: observableServer };
   const ctx = createToolContext(gatewayOptions, toolInfra, rateLimiterFactory);
   registerToolCategories(ctx);
-  void initUpstreamServers(gatewayConfig, observableServer, logger17);
-  registerPrompts(observableServer, logger17);
-  registerResources(observableServer, logger17);
-  logToolRegistration(logger17, ctx.toolAllowlist, {
+  void initUpstreamServers(gatewayConfig, observableServer, logger18);
+  registerPrompts(observableServer, logger18);
+  registerResources(observableServer, logger18);
+  logToolRegistration(logger18, ctx.toolAllowlist, {
     rateLimiterFactory,
     perToolConfig,
     builtInTemplates,
@@ -17785,34 +17703,34 @@ function registerMcpTools(options) {
     policyFirewall,
     executionMode
   });
-  maybeRunStpaAnalysis(options, logger17);
+  maybeRunStpaAnalysis(options, logger18);
 }
 
 // src/cli-server.ts
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 
 // src/cli-server-lifecycle.ts
-function initializeSwarmObserver(logger17, options) {
+function initializeSwarmObserver(logger18, options) {
   const maxEvents = options?.maxEvents ?? 1e4;
   const observer = getSwarmObserver({
     maxEvents
   });
-  logger17.info("SwarmObserver initialized for interaction tracing", {
+  logger18.info("SwarmObserver initialized for interaction tracing", {
     maxEvents,
     configuredFromYaml: options?.maxEvents !== void 0
   });
   return observer;
 }
-function initializeEventBus(observer, logger17, config) {
+function initializeEventBus(observer, logger18, config) {
   const envEnabled = process.env["NEXUS_EVENTBUS_ENABLED"];
   const enabled = envEnabled !== void 0 ? envEnabled === "true" : config?.enabled ?? true;
   const effectiveConfig = {
     ...config,
     enabled
   };
-  const result = initializeEventBusBridge(observer, logger17, effectiveConfig);
+  const result = initializeEventBusBridge(observer, logger18, effectiveConfig);
   if (result.initialized) {
-    logger17.info("EventBus bridge initialized for A2A visibility", {
+    logger18.info("EventBus bridge initialized for A2A visibility", {
       subscriptionCount: result.subscriptionCount,
       eventBusEnabled: enabled
     });
@@ -17857,17 +17775,17 @@ function recordServerShutdown(observer, context) {
     }
   });
 }
-function logFinalHealthMetrics(observer, logger17) {
+function logFinalHealthMetrics(observer, logger18) {
   const healthMetrics = observer.getHealthMetrics();
-  logger17.info("Final swarm health metrics", {
+  logger18.info("Final swarm health metrics", {
     activeAgents: healthMetrics.activeAgents,
     totalAgents: healthMetrics.totalAgents,
     totalInteractions: healthMetrics.totalInteractions
   });
 }
-function logFinalEventBusStats(logger17) {
+function logFinalEventBusStats(logger18) {
   const finalStats = getEventBusStats();
-  logger17.info("Final EventBus statistics", {
+  logger18.info("Final EventBus statistics", {
     eventsEmitted: finalStats.eventsEmitted,
     activeSubscriptions: finalStats.activeSubscriptions,
     historySize: finalStats.historySize,
@@ -17877,14 +17795,14 @@ function logFinalEventBusStats(logger17) {
 
 // src/cli-orchestrator.ts
 import * as readline2 from "readline";
-function runOrchestratorRepl(options, logger17) {
-  return new Promise((resolve15) => {
+function runOrchestratorRepl(options, logger18) {
+  return new Promise((resolve14) => {
     const rl = readline2.createInterface({
       input: process.stdin,
       output: process.stdout,
       prompt: "nexus> "
     });
-    logger17.info('Orchestrator REPL started (type "exit" to quit)');
+    logger18.info('Orchestrator REPL started (type "exit" to quit)');
     process.stdout.write("\n");
     rl.prompt();
     rl.on("line", (line) => {
@@ -17913,15 +17831,15 @@ function runOrchestratorRepl(options, logger17) {
       })();
     });
     rl.on("close", () => {
-      logger17.info("Orchestrator REPL closed");
-      resolve15();
+      logger18.info("Orchestrator REPL closed");
+      resolve14();
     });
   });
 }
 async function startOrchestratorMode(options) {
-  const logger17 = createLogger({ component: "orchestrator" });
-  if (options.verbose) logger17.setLevel("debug");
-  logger17.info("Starting Nexus Agents in orchestrator mode", {
+  const logger18 = createLogger({ component: "orchestrator" });
+  if (options.verbose) logger18.setLevel("debug");
+  logger18.info("Starting Nexus Agents in orchestrator mode", {
     version: VERSION,
     hasTask: options.task !== void 0
   });
@@ -17939,17 +17857,17 @@ async function startOrchestratorMode(options) {
     process.exit(exitCode2);
   }
   if (process.stdin.isTTY) {
-    await runOrchestratorRepl(options, logger17);
+    await runOrchestratorRepl(options, logger18);
     process.exit(EXIT_CODES.SUCCESS);
   }
-  logger17.info("Reading task from stdin...");
+  logger18.info("Reading task from stdin...");
   const chunks = [];
   for await (const chunk of process.stdin) {
     chunks.push(String(chunk));
   }
   const task = chunks.join("").trim();
   if (task.length === 0) {
-    logger17.error("No task provided. Use --task or pipe input via stdin.");
+    logger18.error("No task provided. Use --task or pipe input via stdin.");
     process.exit(EXIT_CODES.INVALID_ARGS);
   }
   const orchestrateOptions = {
@@ -18015,50 +17933,50 @@ function convertCustomExpert(id, def) {
     }
   };
 }
-function createBuiltInExperts(logger17, options) {
+function createBuiltInExperts(logger18, options) {
   const result = ExpertFactory.createAllBuiltIn(options);
   if (!result.ok) {
-    logger17.warn("Failed to create built-in experts", { error: result.error.message });
+    logger18.warn("Failed to create built-in experts", { error: result.error.message });
     return { count: 0, ids: [] };
   }
   const registry = getExpertRegistry();
   const registerResult = registry.registerMany(result.value, { replace: true });
   if (!registerResult.ok) {
-    logger17.warn("Failed to register built-in experts", { error: registerResult.error.message });
+    logger18.warn("Failed to register built-in experts", { error: registerResult.error.message });
     return { count: 0, ids: [] };
   }
   const ids = result.value.map((e) => e.id);
-  logger17.info("Registered built-in experts", { count: result.value.length, ids });
+  logger18.info("Registered built-in experts", { count: result.value.length, ids });
   return { count: result.value.length, ids };
 }
-function createCustomExperts(customDefs, logger17, options) {
+function createCustomExperts(customDefs, logger18, options) {
   const registry = getExpertRegistry();
   const ids = [];
   for (const [id, def] of Object.entries(customDefs)) {
     if (!def.available) {
-      logger17.debug("Skipping unavailable custom expert", { id });
+      logger18.debug("Skipping unavailable custom expert", { id });
       continue;
     }
     const config = convertCustomExpert(id, def);
     const result = ExpertFactory.create(config, options);
     if (!result.ok) {
-      logger17.warn("Failed to create custom expert", { id, error: result.error.message });
+      logger18.warn("Failed to create custom expert", { id, error: result.error.message });
       continue;
     }
     const registerResult = registry.register(result.value, { replace: true });
     if (!registerResult.ok) {
-      logger17.warn("Failed to register custom expert", { id, error: registerResult.error.message });
+      logger18.warn("Failed to register custom expert", { id, error: registerResult.error.message });
       continue;
     }
     ids.push(id);
   }
   if (ids.length > 0) {
-    logger17.info("Registered custom experts", { count: ids.length, ids });
+    logger18.info("Registered custom experts", { count: ids.length, ids });
   }
   return { count: ids.length, ids };
 }
 function initializeExperts(options) {
-  const { expertConfig, logger: logger17, modelAdapter } = options;
+  const { expertConfig, logger: logger18, modelAdapter } = options;
   const createOptions = {};
   if (modelAdapter !== void 0) {
     createOptions.adapter = modelAdapter;
@@ -18068,19 +17986,19 @@ function initializeExperts(options) {
   const registeredIds = [];
   const shouldCreateBuiltIn = expertConfig?.builtin !== false;
   if (shouldCreateBuiltIn) {
-    const builtInResult = createBuiltInExperts(logger17, createOptions);
+    const builtInResult = createBuiltInExperts(logger18, createOptions);
     builtInCount = builtInResult.count;
     registeredIds.push(...builtInResult.ids);
   } else {
-    logger17.info("Built-in experts disabled by configuration");
+    logger18.info("Built-in experts disabled by configuration");
   }
   if (expertConfig?.custom !== void 0 && Object.keys(expertConfig.custom).length > 0) {
-    const customResult = createCustomExperts(expertConfig.custom, logger17, createOptions);
+    const customResult = createCustomExperts(expertConfig.custom, logger18, createOptions);
     customCount = customResult.count;
     registeredIds.push(...customResult.ids);
   }
   const totalCount = builtInCount + customCount;
-  logger17.info("Expert initialization complete", {
+  logger18.info("Expert initialization complete", {
     builtInCount,
     customCount,
     totalCount,
@@ -18095,33 +18013,33 @@ function initializeExperts(options) {
 }
 
 // src/cli-server-gateway.ts
-async function tryWireGatewayAdapter(logger17) {
+async function tryWireGatewayAdapter(logger18) {
   const sandboxActive = detectSandbox().active;
   const env2 = readOpenAICompatEnv();
   if (env2 === null) {
-    handleMissingEnv(logger17, sandboxActive);
+    handleMissingEnv(logger18, sandboxActive);
     return void 0;
   }
   const result = await buildOpenAICompatAdapters();
   if (result === null) return void 0;
   if (!result.ok) {
-    handleProbeFailure(logger17, sandboxActive, result.error.message);
+    handleProbeFailure(logger18, sandboxActive, result.error.message);
     return void 0;
   }
   if (result.value.length === 0) {
-    handleZeroModels(logger17, sandboxActive);
+    handleZeroModels(logger18, sandboxActive);
     return void 0;
   }
-  logger17.info("OpenAI-compatible gateway wired", {
+  logger18.info("OpenAI-compatible gateway wired", {
     baseUrl: env2.baseUrl,
     modelCount: result.value.length,
     models: result.value.map((a) => a.modelId)
   });
   return result.value[0];
 }
-function handleMissingEnv(logger17, sandboxActive) {
+function handleMissingEnv(logger18, sandboxActive) {
   if (sandboxActive) {
-    logger17.error(
+    logger18.error(
       "Sandbox mode active but NEXUS_OPENAI_COMPAT_URL / NEXUS_OPENAI_COMPAT_KEY are not set. Configure the gateway in your launch env or opencode.json. See docs/guides/SANDBOXED-USAGE.md.",
       new Error("Missing gateway configuration in sandbox mode")
     );
@@ -18129,28 +18047,28 @@ function handleMissingEnv(logger17, sandboxActive) {
   }
   return void 0;
 }
-function handleProbeFailure(logger17, sandboxActive, reason) {
+function handleProbeFailure(logger18, sandboxActive, reason) {
   if (sandboxActive) {
-    logger17.error(
+    logger18.error(
       "Sandbox mode active and OpenAI-compatible gateway probe failed.",
       new Error(reason)
     );
     process.exit(EXIT_CODES.SERVER_START_FAILED);
   }
-  logger17.warn("OpenAI-compatible gateway probe failed; continuing with CLI adapters", {
+  logger18.warn("OpenAI-compatible gateway probe failed; continuing with CLI adapters", {
     error: reason
   });
   return void 0;
 }
-function handleZeroModels(logger17, sandboxActive) {
+function handleZeroModels(logger18, sandboxActive) {
   if (sandboxActive) {
-    logger17.error(
+    logger18.error(
       "Sandbox mode active and gateway returned 0 models. Check upstream provider quotas / list filters.",
       new Error("Gateway discovered 0 models")
     );
     process.exit(EXIT_CODES.SERVER_START_FAILED);
   }
-  logger17.warn("OpenAI-compatible gateway returned 0 models; ignoring");
+  logger18.warn("OpenAI-compatible gateway returned 0 models; ignoring");
   return void 0;
 }
 
@@ -19007,7 +18925,7 @@ var ALL_STANDARDS_SKILLS = [
   ...CODING_SKILLS,
   ...ARCHITECTURE_SKILLS
 ];
-function registerStandardsSkills(library, logger17) {
+function registerStandardsSkills(library, logger18) {
   let registered = 0;
   for (const skillDef of ALL_STANDARDS_SKILLS) {
     try {
@@ -19015,10 +18933,10 @@ function registerStandardsSkills(library, logger17) {
       registered++;
     } catch (error) {
       const message = getErrorMessage(error);
-      logger17.warn(`Failed to register skill "${skillDef.name}": ${message}`);
+      logger18.warn(`Failed to register skill "${skillDef.name}": ${message}`);
     }
   }
-  logger17.info(
+  logger18.info(
     `Registered ${String(registered)}/${String(ALL_STANDARDS_SKILLS.length)} standards skills`,
     {
       domains: {
@@ -19048,7 +18966,7 @@ function adaptConfigToLibrary(config) {
 }
 function createBeliefPromoter() {
   return async (event) => {
-    const { getToolMemory } = await import("./tool-memory-K2QPTPKV.js");
+    const { getToolMemory } = await import("./tool-memory-LUXUOE6Q.js");
     const tm = getToolMemory();
     await tm.recordBelief(
       `skill:${event.name}`,
@@ -19059,40 +18977,40 @@ function createBeliefPromoter() {
   };
 }
 async function initializeSkillLibrary(options) {
-  const { skillsConfig, logger: logger17 } = options;
+  const { skillsConfig, logger: logger18 } = options;
   if (globalSkillLibrary !== void 0) {
-    logger17.debug("Skill library already initialized");
+    logger18.debug("Skill library already initialized");
     return { initialized: true, library: globalSkillLibrary };
   }
   if (skillsConfig?.enabled === false) {
-    logger17.info("Skill library disabled by configuration");
+    logger18.info("Skill library disabled by configuration");
     return { initialized: false, reason: "disabled in config" };
   }
   const libraryConfig = skillsConfig !== void 0 ? adaptConfigToLibrary(skillsConfig) : void 0;
-  globalSkillLibrary = createSkillLibrary(libraryConfig, logger17);
-  registerStandardsSkills(globalSkillLibrary, logger17);
-  await loadExternalSkillPacks(skillsConfig, globalSkillLibrary, logger17);
-  logger17.info("Skill library initialized", {
+  globalSkillLibrary = createSkillLibrary(libraryConfig, logger18);
+  registerStandardsSkills(globalSkillLibrary, logger18);
+  await loadExternalSkillPacks(skillsConfig, globalSkillLibrary, logger18);
+  logger18.info("Skill library initialized", {
     maxSkills: globalSkillLibrary.getConfig().maxSkills,
     enablePruning: globalSkillLibrary.getConfig().enablePruning,
     trackHistory: globalSkillLibrary.getConfig().trackExecutionHistory
   });
   return { initialized: true, library: globalSkillLibrary };
 }
-async function loadExternalSkillPacks(skillsConfig, library, logger17) {
+async function loadExternalSkillPacks(skillsConfig, library, logger18) {
   const externalPacks = skillsConfig?.externalPacks;
   if (!externalPacks || externalPacks.length === 0) {
     return;
   }
-  logger17.info("Loading external skill packs", { count: externalPacks.length });
-  const { loaded, errors } = await loadAllExternalPacks(externalPacks, logger17);
+  logger18.info("Loading external skill packs", { count: externalPacks.length });
+  const { loaded, errors } = await loadAllExternalPacks(externalPacks, logger18);
   for (const packResult of loaded) {
     for (const skill of packResult.skills) {
       library.addSkill(skill);
     }
   }
   if (errors.length > 0) {
-    logger17.warn("Some external packs failed to load", {
+    logger18.warn("Some external packs failed to load", {
       failedCount: errors.length,
       failedPacks: errors.map((e) => e.packName)
     });
@@ -19102,19 +19020,19 @@ async function loadExternalSkillPacks(skillsConfig, library, logger17) {
 // src/cli-server-feedback.ts
 var globalFeedbackIntegration;
 function initializeFeedbackIntegration(options) {
-  const { logger: logger17, config, router } = options;
+  const { logger: logger18, config, router } = options;
   try {
     globalFeedbackIntegration = createFeedbackIntegration({
       enableAutoFeedback: true,
       // Enable automatic feedback collection
       ...config,
-      logger: logger17
+      logger: logger18
     });
     if (router !== void 0 && globalFeedbackIntegration instanceof FeedbackIntegration) {
       globalFeedbackIntegration.registerCompositeRouter(router);
-      logger17.debug("FeedbackIntegration attached to CompositeRouter");
+      logger18.debug("FeedbackIntegration attached to CompositeRouter");
     }
-    logger17.info("FeedbackIntegration initialized", {
+    logger18.info("FeedbackIntegration initialized", {
       enableAutoFeedback: config?.enableAutoFeedback ?? true,
       hasRouter: router !== void 0
     });
@@ -19125,7 +19043,7 @@ function initializeFeedbackIntegration(options) {
     };
   } catch (error) {
     const message = getErrorMessage(error);
-    logger17.warn("FeedbackIntegration initialization failed", { error: message });
+    logger18.warn("FeedbackIntegration initialization failed", { error: message });
     return {
       initialized: false,
       reason: `Initialization failed: ${message}`
@@ -19151,8 +19069,8 @@ function buildAuthConfig(config) {
     tokenFile: configAuth?.tokenFile ?? getDefaultTokenPath()
   };
 }
-function initializeAuth(config, logger17) {
-  const log = logger17 ?? createLogger({ component: "auth" });
+function initializeAuth(config, logger18) {
+  const log = logger18 ?? createLogger({ component: "auth" });
   const authConfig = buildAuthConfig(config);
   const handler = new AuthHandler(authConfig, log);
   const tokenFile = authConfig.tokenFile ?? getDefaultTokenPath();
@@ -19178,9 +19096,9 @@ function initializeAuth(config, logger17) {
 
 // src/cli-server-audit.ts
 var DEFAULT_AUDIT_DIR = nexusDataPath("audit");
-function initializeAuditLogger(securityConfig, logger17) {
+function initializeAuditLogger(securityConfig, logger18) {
   if (securityConfig?.audit?.enabled !== true) {
-    logger17.debug("Audit logging disabled (set security.audit.enabled: true to enable)");
+    logger18.debug("Audit logging disabled (set security.audit.enabled: true to enable)");
     return null;
   }
   const auditConfig = securityConfig.audit;
@@ -19197,20 +19115,20 @@ function initializeAuditLogger(securityConfig, logger17) {
       flushIntervalMs: 1e3
     },
     void 0,
-    logger17
+    logger18
   );
   auditLogger.logSystemStartup({ auditLogDir: logDir });
-  logger17.info("Audit logging enabled", { logDir });
+  logger18.info("Audit logging enabled", { logDir });
   return auditLogger;
 }
-async function shutdownAuditLogger(auditLogger, logger17) {
+async function shutdownAuditLogger(auditLogger, logger18) {
   if (auditLogger === null) return;
   try {
     auditLogger.logSystemShutdown();
     await auditLogger.close();
-    logger17.info("Audit logger shutdown complete");
+    logger18.info("Audit logger shutdown complete");
   } catch (error) {
-    logger17.error(
+    logger18.error(
       "Error shutting down audit logger",
       error instanceof Error ? error : new Error(String(error))
     );
@@ -19224,9 +19142,9 @@ function getRateLimitValues(config) {
   const rl = config?.security?.rateLimit;
   return { enabled: rl?.enabled ?? true, rpm: rl?.requestsPerMinute ?? 60 };
 }
-function createConfiguredPolicyFirewall(logger17, config) {
+function createConfiguredPolicyFirewall(logger18, config) {
   const policyVals = getPolicyValues(config);
-  return createDefaultPolicyFirewall({ mode: policyVals.mode, logger: logger17 });
+  return createDefaultPolicyFirewall({ mode: policyVals.mode, logger: logger18 });
 }
 function getAuthValues(config) {
   const envAuth = process.env["NEXUS_AUTH_ENABLED"];
@@ -19235,12 +19153,12 @@ function getAuthValues(config) {
   const method = configAuth?.method ?? process.env["NEXUS_AUTH_METHOD"] ?? "none";
   return { enabled, method };
 }
-function logSecurityConfig(logger17, config) {
-  const policyFirewall = createConfiguredPolicyFirewall(logger17, config);
+function logSecurityConfig(logger18, config) {
+  const policyFirewall = createConfiguredPolicyFirewall(logger18, config);
   const authVals = getAuthValues(config);
   const policyVals = getPolicyValues(config);
   const rateLimitVals = getRateLimitValues(config);
-  logger17.info("Security configuration", {
+  logger18.info("Security configuration", {
     policyMode: policyVals.mode,
     defaultExecutionMode: policyVals.defaultExec,
     policyRuleCount: policyFirewall.getRules().length,
@@ -19251,32 +19169,32 @@ function logSecurityConfig(logger17, config) {
     allowedPaths: config?.security?.allowedPaths ?? ["./"]
   });
   if (!authVals.enabled) {
-    logger17.warn(
+    logger18.warn(
       "Authentication explicitly disabled \u2014 network-exposed endpoints are unprotected. Remove NEXUS_AUTH_ENABLED=false to re-enable."
     );
   }
-  logger17.debug("Policy firewall rules", {
+  logger18.debug("Policy firewall rules", {
     rules: policyFirewall.getRules().map((r) => ({ name: r.name, description: r.description }))
   });
   return policyFirewall;
 }
 
 // src/cli-server.ts
-function setupShutdownHandlers(cleanup, logger17) {
+function setupShutdownHandlers(cleanup, logger18) {
   let isShuttingDown = false;
   const handleShutdown = async (signal) => {
     if (isShuttingDown) {
-      logger17.debug("Shutdown already in progress, ignoring signal", { signal });
+      logger18.debug("Shutdown already in progress, ignoring signal", { signal });
       return;
     }
     isShuttingDown = true;
-    logger17.info("Received shutdown signal", { signal });
+    logger18.info("Received shutdown signal", { signal });
     try {
       await cleanup();
-      logger17.info("Shutdown complete");
+      logger18.info("Shutdown complete");
       process.exit(EXIT_CODES.SUCCESS);
     } catch (error) {
-      logger17.error(
+      logger18.error(
         "Error during shutdown",
         error instanceof Error ? error : new Error(String(error))
       );
@@ -19285,24 +19203,24 @@ function setupShutdownHandlers(cleanup, logger17) {
   };
   const onSignal = (signal) => () => {
     handleShutdown(signal).catch((err2) => {
-      logger17.error("Shutdown handler crashed", err2 instanceof Error ? err2 : new Error(String(err2)));
+      logger18.error("Shutdown handler crashed", err2 instanceof Error ? err2 : new Error(String(err2)));
       process.exit(EXIT_CODES.SHUTDOWN_ERROR);
     });
   };
   process.on("SIGINT", onSignal("SIGINT"));
   process.on("SIGTERM", onSignal("SIGTERM"));
   process.on("uncaughtException", (error) => {
-    logger17.error("Uncaught exception", error);
+    logger18.error("Uncaught exception", error);
     process.exit(EXIT_CODES.SERVER_START_FAILED);
   });
   process.on("unhandledRejection", (reason) => {
     const error = reason instanceof Error ? reason : new Error(String(reason));
-    logger17.error("Unhandled rejection", error);
+    logger18.error("Unhandled rejection", error);
     process.exit(EXIT_CODES.SERVER_START_FAILED);
   });
 }
-function logStartupInfo(logger17, detectionResult, verbose) {
-  logger17.info("Starting Nexus Agents", {
+function logStartupInfo(logger18, detectionResult, verbose) {
+  logger18.info("Starting Nexus Agents", {
     version: VERSION,
     mode: detectionResult.mode,
     modeSource: detectionResult.source,
@@ -19312,7 +19230,7 @@ function logStartupInfo(logger17, detectionResult, verbose) {
     platform: process.platform
   });
   if (verbose) {
-    logger17.debug("Mode detection signals", {
+    logger18.debug("Mode detection signals", {
       stdinIsTty: detectionResult.signals.stdinIsTty,
       stdoutIsTty: detectionResult.signals.stdoutIsTty,
       mcpClientName: detectionResult.signals.mcpClientName,
@@ -19322,20 +19240,20 @@ function logStartupInfo(logger17, detectionResult, verbose) {
     });
   }
 }
-function validateModeOrExit(logger17, mode) {
+function validateModeOrExit(logger18, mode) {
   if (mode === "mesh") {
-    logger17.error("Mesh mode is not yet implemented. Use --mode=server or --mode=orchestrator.");
+    logger18.error("Mesh mode is not yet implemented. Use --mode=server or --mode=orchestrator.");
     process.exit(EXIT_CODES.INVALID_ARGS);
   }
 }
-function loadAndLogConfig(logger17) {
-  const result = loadConfig({ logger: logger17 });
+function loadAndLogConfig(logger18) {
+  const result = loadConfig({ logger: logger18 });
   if (!result.ok) {
-    logger17.error("Failed to load configuration", new Error(result.error.message));
+    logger18.error("Failed to load configuration", new Error(result.error.message));
     process.exit(EXIT_CODES.SERVER_START_FAILED);
   }
   const configResult = result.value;
-  logger17.info("Configuration loaded", {
+  logger18.info("Configuration loaded", {
     configPath: configResult.configPath ?? "(defaults)",
     usingDefaults: configResult.usingDefaults,
     warningCount: configResult.warnings.length,
@@ -19344,20 +19262,20 @@ function loadAndLogConfig(logger17) {
     hasSecurity: configResult.config.security !== void 0
   });
   for (const warning of configResult.warnings) {
-    logger17.warn(warning);
+    logger18.warn(warning);
   }
   return configResult;
 }
 function createShutdownCleanup(options) {
-  const { eventBusBridge, observer, eventContext, server, serverLogger, logger: logger17, auditLogger } = options;
+  const { eventBusBridge, observer, eventContext, server, serverLogger, logger: logger18, auditLogger } = options;
   return async () => {
-    await shutdownAuditLogger(auditLogger, logger17);
+    await shutdownAuditLogger(auditLogger, logger18);
     if (eventBusBridge.initialized) {
-      logFinalEventBusStats(logger17);
+      logFinalEventBusStats(logger18);
       eventBusBridge.cleanup();
     }
     recordServerShutdown(observer, eventContext);
-    logFinalHealthMetrics(observer, logger17);
+    logFinalHealthMetrics(observer, logger18);
     shutdownToolMemory();
     const closeResult = await closeServer(server, serverLogger);
     if (!closeResult.ok) {
@@ -19365,61 +19283,61 @@ function createShutdownCleanup(options) {
     }
   };
 }
-function createAndValidateMcpServer(logger17) {
+function createAndValidateMcpServer(logger18) {
   const serverResult = createServer({
     name: "nexus-agents",
     version: VERSION,
-    logger: logger17
+    logger: logger18
   });
   if (!serverResult.ok) {
-    logger17.error("Failed to create MCP server", new Error(serverResult.error.message));
+    logger18.error("Failed to create MCP server", new Error(serverResult.error.message));
     process.exit(EXIT_CODES.SERVER_START_FAILED);
   }
   return serverResult.value;
 }
-async function initializeAndLogSandbox(logger17, sandboxConfig) {
+async function initializeAndLogSandbox(logger18, sandboxConfig) {
   const sandboxResult = await initializeSandbox(sandboxConfig);
-  logger17.info("Sandbox initialized", {
+  logger18.info("Sandbox initialized", {
     mode: getSandboxMode(),
     executor: sandboxResult.executor.name,
     usedFallback: sandboxResult.usedFallback,
     configuredMode: sandboxConfig?.mode ?? "default"
   });
 }
-async function connectToStdioTransport(server, logger17, serverLogger) {
-  logger17.setDestination?.("stderr");
+async function connectToStdioTransport(server, logger18, serverLogger) {
+  logger18.setDestination?.("stderr");
   serverLogger.setDestination?.("stderr");
-  logger17.info("Connecting to stdio transport");
+  logger18.info("Connecting to stdio transport");
   const transport = new StdioServerTransport();
   const connectResult = await connectTransport(server, transport, serverLogger);
   if (!connectResult.ok) {
-    logger17.error("Failed to connect MCP server", new Error(connectResult.error.message));
+    logger18.error("Failed to connect MCP server", new Error(connectResult.error.message));
     process.exit(EXIT_CODES.SERVER_START_FAILED);
   }
-  logger17.info("MCP server started successfully");
+  logger18.info("MCP server started successfully");
 }
-function createAdapterRegistry(logger17) {
+function createAdapterRegistry(logger18) {
   return createUnifiedRegistry({
-    logger: logger17,
+    logger: logger18,
     defaultCliTimeoutMs: MCP_TIMEOUTS.perTool["orchestrate"] ?? MCP_TIMEOUTS.defaultMs
   });
 }
-function buildGatewayConfig(config, logger17) {
+function buildGatewayConfig(config, logger18) {
   const gatewaySection = config.gateway;
   const enabled = gatewaySection?.enabled !== false;
   const tierOverrides = parseTierOverrides(gatewaySection?.tierOverrides);
   return {
     enabled,
-    logger: logger17,
+    logger: logger18,
     ...tierOverrides !== void 0 && { tierOverrides }
   };
 }
-async function initializeAndRegisterTools(server, logger17, policyFirewall, config, feedbackIntegration) {
-  logger17.info("Loading built-in workflow templates");
+async function initializeAndRegisterTools(server, logger18, policyFirewall, config, feedbackIntegration) {
+  logger18.info("Loading built-in workflow templates");
   const builtInTemplates = await initializeBuiltInTemplates();
-  logger17.info("Loaded built-in templates", { count: builtInTemplates.size });
-  const adapterRegistry = createAdapterRegistry(logger17);
-  const gatewayAdapter = await tryWireGatewayAdapter(logger17);
+  logger18.info("Loaded built-in templates", { count: builtInTemplates.size });
+  const adapterRegistry = createAdapterRegistry(logger18);
+  const gatewayAdapter = await tryWireGatewayAdapter(logger18);
   const modelAdapter = gatewayAdapter ?? adapterRegistry.getDefault();
   const policyVals = getPolicyValues(config);
   const allowedPaths = config.security?.allowedPaths;
@@ -19427,13 +19345,13 @@ async function initializeAndRegisterTools(server, logger17, policyFirewall, conf
   const workflowConfig = config.workflows;
   const toolsOptions = {
     server,
-    logger: logger17,
+    logger: logger18,
     builtInTemplates,
     policyFirewall,
     executionMode: policyVals.defaultExec,
     modelAdapter,
     // Gateway middleware for tier-aware dispatch logging (Issue #896, #897)
-    gatewayConfig: buildGatewayConfig(config, logger17),
+    gatewayConfig: buildGatewayConfig(config, logger18),
     ...allowedPaths !== void 0 && { allowedPaths },
     ...securityConfig !== void 0 && { securityConfig },
     ...workflowConfig !== void 0 && { workflowConfig },
@@ -19441,45 +19359,45 @@ async function initializeAndRegisterTools(server, logger17, policyFirewall, conf
   };
   registerMcpTools(toolsOptions);
 }
-function applyLoggingConfig(logger17, verbose, config) {
+function applyLoggingConfig(logger18, verbose, config) {
   if (!verbose && config.logging?.level !== void 0) {
-    logger17.setLevel(config.logging.level);
-    logger17.debug("Log level set from configuration", { level: config.logging.level });
+    logger18.setLevel(config.logging.level);
+    logger18.debug("Log level set from configuration", { level: config.logging.level });
   }
-  if (config.logging?.format !== void 0 && logger17.setFormat !== void 0) {
-    logger17.setFormat(config.logging.format);
-    logger17.debug("Log format set from configuration", { format: config.logging.format });
+  if (config.logging?.format !== void 0 && logger18.setFormat !== void 0) {
+    logger18.setFormat(config.logging.format);
+    logger18.debug("Log format set from configuration", { format: config.logging.format });
   }
-  if (config.logging?.destination !== void 0 && logger17.setDestination !== void 0) {
-    logger17.setDestination(config.logging.destination, config.logging.filePath);
-    logger17.debug("Log destination set from configuration", {
+  if (config.logging?.destination !== void 0 && logger18.setDestination !== void 0) {
+    logger18.setDestination(config.logging.destination, config.logging.filePath);
+    logger18.debug("Log destination set from configuration", {
       destination: config.logging.destination,
       filePath: config.logging.filePath
     });
   }
 }
-async function initializeSubsystems(config, logger17) {
-  const expertResult = initializeExperts({ expertConfig: config.experts, logger: logger17 });
-  logger17.debug("Expert system initialized", {
+async function initializeSubsystems(config, logger18) {
+  const expertResult = initializeExperts({ expertConfig: config.experts, logger: logger18 });
+  logger18.debug("Expert system initialized", {
     builtIn: expertResult.builtInCount,
     custom: expertResult.customCount
   });
-  const skillsResult = await initializeSkillLibrary({ skillsConfig: config.skills, logger: logger17 });
-  logger17.debug("Skill library initialization", {
+  const skillsResult = await initializeSkillLibrary({ skillsConfig: config.skills, logger: logger18 });
+  logger18.debug("Skill library initialization", {
     initialized: skillsResult.initialized,
     reason: skillsResult.reason
   });
-  const sicaResult = initializeSica({ sicaConfig: config.sica, logger: logger17 });
-  logger17.debug("SICA initialization", {
+  const sicaResult = initializeSica({ sicaConfig: config.sica, logger: logger18 });
+  logger18.debug("SICA initialization", {
     enabled: sicaResult.enabled,
     reason: sicaResult.reason
   });
-  const feedbackResult = initializeFeedbackIntegration({ logger: logger17 });
-  logger17.debug("FeedbackIntegration initialization", {
+  const feedbackResult = initializeFeedbackIntegration({ logger: logger18 });
+  logger18.debug("FeedbackIntegration initialization", {
     initialized: feedbackResult.initialized,
     reason: feedbackResult.reason
   });
-  const { server, logger: serverLogger } = createAndValidateMcpServer(logger17);
+  const { server, logger: serverLogger } = createAndValidateMcpServer(logger18);
   const observer = initializeSwarmObserver(serverLogger, {
     maxEvents: config.observability?.swarmObserverMaxEvents
   });
@@ -19499,32 +19417,32 @@ async function initializeSubsystems(config, logger17) {
 }
 var SERVER_STARTUP_TIMEOUT_MS = 3e4;
 async function startServer(verbose, mode, modeWasExplicit = false, orchestratorOptions) {
-  const logger17 = createLogger({ component: "cli" });
-  if (verbose) logger17.setLevel("debug");
-  validateModeOrExit(logger17, mode);
+  const logger18 = createLogger({ component: "cli" });
+  if (verbose) logger18.setLevel("debug");
+  validateModeOrExit(logger18, mode);
   if (mode === "orchestrator") {
     await startOrchestratorMode(orchestratorOptions ?? { verbose });
     return;
   }
   const startupWatchdog = setTimeout(() => {
-    logger17.error(
+    logger18.error(
       `Server startup exceeded ${String(SERVER_STARTUP_TIMEOUT_MS)}ms \u2014 aborting. Common causes: hung config load, blocked subsystem init, stdio transport stall.`
     );
     process.exit(EXIT_CODES.SERVER_START_FAILED);
   }, SERVER_STARTUP_TIMEOUT_MS);
   startupWatchdog.unref();
   const detectionResult = detectMode({ explicitMode: modeWasExplicit ? mode : void 0 });
-  logStartupInfo(logger17, detectionResult, verbose);
-  const configResult = loadAndLogConfig(logger17);
-  applyLoggingConfig(logger17, verbose, configResult.config);
-  validateNexusEnv(logger17);
-  const { server, serverLogger, observer, eventBusBridge, auditLogger } = await initializeSubsystems(configResult.config, logger17);
-  await connectToStdioTransport(server, logger17, serverLogger);
+  logStartupInfo(logger18, detectionResult, verbose);
+  const configResult = loadAndLogConfig(logger18);
+  applyLoggingConfig(logger18, verbose, configResult.config);
+  validateNexusEnv(logger18);
+  const { server, serverLogger, observer, eventBusBridge, auditLogger } = await initializeSubsystems(configResult.config, logger18);
+  await connectToStdioTransport(server, logger18, serverLogger);
   const eventContext = recordServerStartup(observer);
   const stdinMonitor = getStdinLifecycleMonitor();
   stdinMonitor.start();
   stdinMonitor.onClose(() => {
-    logger17.warn("Parent process closed stdin, shutting down");
+    logger18.warn("Parent process closed stdin, shutting down");
     process.exit(0);
   });
   const cleanup = createShutdownCleanup({
@@ -19533,12 +19451,12 @@ async function startServer(verbose, mode, modeWasExplicit = false, orchestratorO
     eventContext,
     server,
     serverLogger,
-    logger: logger17,
+    logger: logger18,
     auditLogger
   });
-  setupShutdownHandlers(cleanup, logger17);
+  setupShutdownHandlers(cleanup, logger18);
   clearTimeout(startupWatchdog);
-  logger17.debug("Server running, waiting for requests...");
+  logger18.debug("Server running, waiting for requests...");
 }
 
 // src/cli-commands-validators.ts
@@ -19792,8 +19710,8 @@ function printFirstRunHint() {
   const isTTY = process.stderr.isTTY;
   if (!isTTY) return;
   const dataDir = getNexusDataDir();
-  const hasConfig = existsSync21("./nexus-agents.yaml") || existsSync21("./nexus-agents.yml");
-  if (existsSync21(dataDir) || hasConfig) return;
+  const hasConfig = existsSync20("./.nexus-agents/nexus-agents.yaml") || existsSync20("./.nexus-agents/nexus-agents.yml") || existsSync20("./nexus-agents.yaml") || existsSync20("./nexus-agents.yml");
+  if (existsSync20(dataDir) || hasConfig) return;
   process.stderr.write(
     "\n\x1B[36mnexus-agents\x1B[0m: First time? Run \x1B[1mnexus-agents setup\x1B[0m to configure.\n\n"
   );
@@ -19908,7 +19826,7 @@ async function handleResearchCommand(args) {
   }
 }
 async function handleRegistryCommand(args) {
-  const { registryCommand, isValidRegistrySubcommand, formatRegistryUsage } = await import("./registry-command-6KJWW3W7.js");
+  const { registryCommand, isValidRegistrySubcommand, formatRegistryUsage } = await import("./registry-command-YMZPSW7S.js");
   const subcommand = args.subcommand;
   if (!isValidRegistrySubcommand(subcommand)) {
     process.stdout.write(`${formatRegistryUsage()}
@@ -19956,7 +19874,7 @@ async function handleVerifyCommand(args) {
 async function handleDoctorCommand(args) {
   const exitCode = await doctorCommand({ fix: args.options.fix });
   if (args.options.deep) {
-    const { runDeepDiagnostics: runDeepDiagnostics2, formatDeepDiagnostics: formatDeepDiagnostics2 } = await import("./doctor-deep-XBPRQ6ZP.js");
+    const { runDeepDiagnostics: runDeepDiagnostics2, formatDeepDiagnostics: formatDeepDiagnostics2 } = await import("./doctor-deep-ZMBSG2DF.js");
     const diag = runDeepDiagnostics2();
     process.stdout.write(formatDeepDiagnostics2(diag) + "\n");
   }
@@ -20000,7 +19918,7 @@ async function handleInitCommand(args) {
   process.exit(result.success ? EXIT_CODES.SUCCESS : EXIT_CODES.SERVER_START_FAILED);
 }
 async function runInitOpencodeFlow(args) {
-  const { runInitOpencode } = await import("./init-opencode-RV6IQEMS.js");
+  const { runInitOpencode } = await import("./init-opencode-WFL4OXMB.js");
   const opencodePath = args.options.opencode;
   if (opencodePath === void 0 || opencodePath === "") {
     process.stderr.write("Error: --opencode requires a path argument.\n");
@@ -20027,7 +19945,7 @@ async function runInitOpencodeFlow(args) {
   process.exit(EXIT_CODES.SUCCESS);
 }
 async function renderOpencodeValidate(opencodePath) {
-  const { runOpencodeValidate } = await import("./init-opencode-RV6IQEMS.js");
+  const { runOpencodeValidate } = await import("./init-opencode-WFL4OXMB.js");
   const result = await runOpencodeValidate(opencodePath);
   if (!result.ok) {
     process.stderr.write(`init --opencode --validate: ${result.reason ?? "failed"}
@@ -20067,7 +19985,7 @@ async function handleSetupCommandAsync(args) {
   process.exit(exitCode === 0 ? EXIT_CODES.SUCCESS : EXIT_CODES.SERVER_START_FAILED);
 }
 async function runCustomApiSetup(args) {
-  const { configureCustomApi } = await import("./setup-custom-api-PJ6TGHJH.js");
+  const { configureCustomApi } = await import("./setup-custom-api-4EYRKCHB.js");
   const baseUrl = args.options.customApi;
   if (baseUrl === void 0) return EXIT_CODES.SERVER_START_FAILED;
   const input = {
@@ -20964,7 +20882,7 @@ function handleCapabilitiesCommand(args) {
 }
 
 // src/testing/memory-benchmark-phase3.ts
-async function measurePromotionEffectiveness(backend, logger17) {
+async function measurePromotionEffectiveness(backend, logger18) {
   const promotedEntries = [];
   const metadata = { importance: "high", tags: ["promoted", "benchmark"] };
   for (let i = 0; i < 10; i++) {
@@ -20984,7 +20902,7 @@ async function measurePromotionEffectiveness(backend, logger17) {
     if (result.ok) retained++;
   }
   const retentionRate = promotedEntries.length > 0 ? retained / promotedEntries.length : 1;
-  logger17?.debug("Promotion effectiveness measured", {
+  logger18?.debug("Promotion effectiveness measured", {
     promoted: promotedEntries.length,
     retained,
     retentionRate
@@ -21010,7 +20928,7 @@ async function countDecayed(backend, keys) {
   }
   return decayed;
 }
-async function measureDecayAppropriateness(backend, logger17) {
+async function measureDecayAppropriateness(backend, logger18) {
   const lowKeys = await storeTestEntries(backend, "low", 5);
   const highKeys = await storeTestEntries(backend, "high", 5);
   const cutoffDate = new Date(Date.now() + 1e3);
@@ -21019,7 +20937,7 @@ async function measureDecayAppropriateness(backend, logger17) {
   const lowDecayed = await countDecayed(backend, lowKeys);
   const totalDecayed = highDecayed + lowDecayed;
   const regret = totalDecayed > 0 ? highDecayed / totalDecayed : 0;
-  logger17?.debug("Decay appropriateness measured", {
+  logger18?.debug("Decay appropriateness measured", {
     highImportanceDecayed: highDecayed,
     lowImportanceDecayed: lowDecayed,
     regretScore: regret
@@ -21215,13 +21133,13 @@ function averageMetrics(acc, kValues, numCases) {
   }
   return { recallAtK, precisionAtK, mrr: acc.mrrSum / numCases };
 }
-async function measureRetrievalQuality(backend, testCases, kValues, logger17) {
+async function measureRetrievalQuality(backend, testCases, kValues, logger18) {
   const acc = createAccumulators(kValues);
   const maxK = Math.max(...kValues);
   for (const testCase of testCases) {
     const searchResult = await backend.search(testCase.query, maxK);
     if (!searchResult.ok) {
-      logger17.warn("Search failed during benchmark", { query: testCase.query });
+      logger18.warn("Search failed during benchmark", { query: testCase.query });
       continue;
     }
     const retrievedKeys = searchResult.value.map((e) => e.key);
@@ -21275,21 +21193,21 @@ async function measureSelfConsistency(backend) {
   }
   return buildCoherenceResult(validCount, allEntries.value.length);
 }
-async function validateCrossRefs(refs, targetBackend, logger17) {
+async function validateCrossRefs(refs, targetBackend, logger18) {
   let validCount = 0;
   for (const ref of refs) {
     const result = await targetBackend.retrieve(ref.targetKey);
     if (result.ok) validCount++;
-    else logger17?.debug("Orphaned reference", { source: ref.sourceKey, target: ref.targetKey });
+    else logger18?.debug("Orphaned reference", { source: ref.sourceKey, target: ref.targetKey });
   }
   return buildCoherenceResult(validCount, refs.length);
 }
-async function measureCoherence(backend, config, logger17) {
+async function measureCoherence(backend, config, logger18) {
   const refs = config?.crossReferences ?? [];
   if (refs.length === 0) return measureSelfConsistency(backend);
-  return validateCrossRefs(refs, config?.targetBackend ?? backend, logger17);
+  return validateCrossRefs(refs, config?.targetBackend ?? backend, logger18);
 }
-async function measureGrowthRate(backend, operationCount = 50, logger17) {
+async function measureGrowthRate(backend, operationCount = 50, logger18) {
   const initialEntries = await backend.search("", 1e4);
   let initialBytes = 0;
   if (initialEntries.ok) {
@@ -21307,13 +21225,13 @@ async function measureGrowthRate(backend, operationCount = 50, logger17) {
     finalBytes = finalEntries.value.reduce((sum, e) => sum + estimateStorageBytes(e), 0);
   }
   const bytesPerOp = operationCount > 0 ? (finalBytes - initialBytes) / operationCount : 0;
-  logger17?.debug("Growth rate measured", { initialBytes, finalBytes, bytesPerOp });
+  logger18?.debug("Growth rate measured", { initialBytes, finalBytes, bytesPerOp });
   return { bytesPerOperation: bytesPerOp, operationsExecuted: operationCount };
 }
-async function measureDecayConsistency(backend, logger17) {
+async function measureDecayConsistency(backend, logger18) {
   const beforePrune = await backend.search("", 1e4);
   if (!beforePrune.ok) {
-    logger17?.debug("Cannot measure decay consistency - search failed");
+    logger18?.debug("Cannot measure decay consistency - search failed");
     return { consistencyScore: 1, itemsChecked: 0 };
   }
   const beforeCount = beforePrune.value.length;
@@ -21328,7 +21246,7 @@ async function measureDecayConsistency(backend, logger17) {
     if (result.ok) retrievable++;
   }
   const score = sampleSize > 0 ? retrievable / sampleSize : 1;
-  logger17?.debug("Decay consistency measured", { sampleSize, retrievable, score });
+  logger18?.debug("Decay consistency measured", { sampleSize, retrievable, score });
   return { consistencyScore: score, itemsChecked: sampleSize };
 }
 function buildBenchmarkResult(m) {
@@ -21354,20 +21272,20 @@ function buildBenchmarkResult(m) {
   };
 }
 async function runMemoryBenchmark(backend, testCases, config) {
-  const { logger: logger17, kValues, iterations } = parseConfig(config);
+  const { logger: logger18, kValues, iterations } = parseConfig(config);
   const startTime = getTimeProvider().now();
-  logger17.info("Starting memory benchmark", { testCases: testCases.length, iterations });
-  const quality = await measureRetrievalQuality(backend, testCases, kValues, logger17);
+  logger18.info("Starting memory benchmark", { testCases: testCases.length, iterations });
+  const quality = await measureRetrievalQuality(backend, testCases, kValues, logger18);
   const latency = await measureLatency(backend, iterations);
   const storage = await measureStorage(backend);
-  const coherence = await measureCoherence(backend, config?.coherenceConfig, logger17);
+  const coherence = await measureCoherence(backend, config?.coherenceConfig, logger18);
   const growthIterations = config?.quickMode === true ? 10 : 50;
-  const growth = await measureGrowthRate(backend, growthIterations, logger17);
-  const decay = await measureDecayConsistency(backend, logger17);
-  const promotion = await measurePromotionEffectiveness(backend, logger17);
-  const appropriateness = await measureDecayAppropriateness(backend, logger17);
+  const growth = await measureGrowthRate(backend, growthIterations, logger18);
+  const decay = await measureDecayConsistency(backend, logger18);
+  const promotion = await measurePromotionEffectiveness(backend, logger18);
+  const appropriateness = await measureDecayAppropriateness(backend, logger18);
   const durationMs = getTimeProvider().now() - startTime;
-  logger17.info("Memory benchmark complete", { mrr: quality.mrr, durationMs });
+  logger18.info("Memory benchmark complete", { mrr: quality.mrr, durationMs });
   return buildBenchmarkResult({
     quality,
     latency,
@@ -21561,8 +21479,8 @@ function determineStrategy(cliTools, adapters) {
   return "none (no adapters available)";
 }
 function collectStatus() {
-  const logger17 = createLogger({ component: "status", level: "error" });
-  const calculator = createFitnessScoreCalculator(logger17);
+  const logger18 = createLogger({ component: "status", level: "error" });
+  const calculator = createFitnessScoreCalculator(logger18);
   const audit = calculator.audit(VERSION);
   const adapters = checkApiAdapters();
   const cliTools = detectCliTools();
@@ -21626,7 +21544,7 @@ function handleStatusCommand2(args) {
 
 // src/cli/scenario-command.ts
 import { readdir as readdir4 } from "fs/promises";
-import { join as join18, resolve as resolve14 } from "path";
+import { join as join17, resolve as resolve13 } from "path";
 
 // src/testing/e2e/scenario-runner.ts
 import { readFile as readFile7 } from "fs/promises";
@@ -21786,7 +21704,7 @@ function checkCircularDependencies(workflow) {
 var defaultStubFactory = {
   createAgentStub(agentType, action) {
     return async (inputs) => {
-      await new Promise((resolve15) => setTimeout(resolve15, 10));
+      await new Promise((resolve14) => setTimeout(resolve14, 10));
       return {
         stepId: `${agentType}-${action}`,
         status: "success",
@@ -21945,7 +21863,7 @@ function createScenarioRunner(stubFactory) {
 }
 
 // src/cli/scenario-command.ts
-var FIXTURES_DIR = resolve14(import.meta.dirname, "../testing/e2e/fixtures");
+var FIXTURES_DIR = resolve13(import.meta.dirname, "../testing/e2e/fixtures");
 var SCENARIO_SUFFIX = ".scenario.yaml";
 async function listScenarios() {
   try {
@@ -21996,7 +21914,7 @@ async function handleRun(args) {
     process.exit(EXIT_CODES.SERVER_START_FAILED);
   }
   const runner = createScenarioRunner();
-  const fixturePath = join18(FIXTURES_DIR, `${name}${SCENARIO_SUFFIX}`);
+  const fixturePath = join17(FIXTURES_DIR, `${name}${SCENARIO_SUFFIX}`);
   try {
     const fixture = await runner.loadFixture(fixturePath);
     const result = await runner.run(fixture);
@@ -22386,6 +22304,137 @@ function printSignal(signal) {
   console.log("");
 }
 
+// src/cli/migrate-command.ts
+import { cpSync, existsSync as existsSync22, mkdirSync as mkdirSync6, readdirSync as readdirSync3 } from "fs";
+import { homedir } from "os";
+import { join as join18 } from "path";
+var logger17 = createLogger({ component: "migrate-command" });
+var HOMEDIR_DEFAULT_BASE = join18(homedir(), ".nexus-agents");
+function countItems(dir) {
+  if (!existsSync22(dir)) return 0;
+  try {
+    const entries = readdirSync3(dir, { withFileTypes: true });
+    let n = 0;
+    for (const e of entries) {
+      const p = join18(dir, e.name);
+      if (e.isDirectory()) {
+        n += countItems(p);
+      } else {
+        n += 1;
+      }
+    }
+    return n;
+  } catch {
+    return 0;
+  }
+}
+function runMigrate(options = {}) {
+  const fromBase = options.from ?? HOMEDIR_DEFAULT_BASE;
+  const cwd = options.cwd ?? process.cwd();
+  const dryRun = options.dryRun ?? false;
+  const toBase = options.to ?? resolveDefaultTarget(cwd);
+  const earlyExit = checkEarlyExits(fromBase, toBase, dryRun);
+  if (earlyExit !== null) return earlyExit;
+  const perRepoSet = getPerRepoSubdirs();
+  const sourceEntries = readdirSync3(fromBase, { withFileTypes: true });
+  const subdirs = [];
+  for (const entry of sourceEntries) {
+    if (!entry.isDirectory()) continue;
+    subdirs.push(planAndExecuteEntry(entry.name, fromBase, toBase, perRepoSet, dryRun));
+  }
+  const copied = subdirs.filter((s) => s.status === "copied").length;
+  const summary = dryRun ? `Dry run: would copy ${String(copied)} per-repo subdir(s) from ${fromBase} \u2192 ${String(toBase)}.` : `Copied ${String(copied)} per-repo subdir(s) from ${fromBase} \u2192 ${String(toBase)}.`;
+  logger17.info("Migration complete", { dryRun, copied, fromBase, toBase });
+  return { fromBase, toBase, dryRun, subdirs, success: true, summary };
+}
+function checkEarlyExits(fromBase, toBase, dryRun) {
+  if (toBase === null) {
+    return {
+      fromBase,
+      toBase: "",
+      dryRun,
+      subdirs: [],
+      success: false,
+      summary: "No git repo detected from cwd. Run from inside a repo or pass --to <path> to choose an explicit destination."
+    };
+  }
+  if (!existsSync22(fromBase)) {
+    return {
+      fromBase,
+      toBase,
+      dryRun,
+      subdirs: [],
+      success: true,
+      summary: `No source state at ${fromBase}. Nothing to migrate.`
+    };
+  }
+  return null;
+}
+function planAndExecuteEntry(name, fromBase, toBase, perRepoSet, dryRun) {
+  const source = join18(fromBase, name);
+  const target = join18(toBase, name);
+  if (!perRepoSet.has(name)) {
+    return { subdir: name, status: "skipped-not-per-repo", source, target: "", itemsCopied: 0 };
+  }
+  const items = countItems(source);
+  if (items === 0) {
+    return { subdir: name, status: "skipped-empty", source, target, itemsCopied: 0 };
+  }
+  if (existsSync22(target) && readdirSync3(target).length > 0) {
+    return { subdir: name, status: "skipped-exists", source, target, itemsCopied: 0 };
+  }
+  if (!dryRun) {
+    mkdirSync6(toBase, { recursive: true });
+    cpSync(source, target, { recursive: true, errorOnExist: false });
+  }
+  return { subdir: name, status: "copied", source, target, itemsCopied: items };
+}
+function resolveDefaultTarget(cwd) {
+  const repoRoot = findRepoRoot(cwd);
+  if (repoRoot === null) return null;
+  return join18(repoRoot, ".nexus-agents");
+}
+function formatMigrationResult(result) {
+  if (!result.success) {
+    return `migrate: ${result.summary}
+`;
+  }
+  const lines = [];
+  lines.push(result.summary);
+  if (result.subdirs.length === 0) {
+    return `${lines.join("\n")}
+`;
+  }
+  lines.push("");
+  for (const s of result.subdirs) {
+    const tag = s.status === "copied" ? "\u2713" : "\xB7";
+    const detail = s.status === "copied" ? `(${String(s.itemsCopied)} item(s))` : s.status === "skipped-not-per-repo" ? "(cross-repo \u2014 kept in homedir)" : s.status === "skipped-exists" ? "(destination already has state \u2014 skipped)" : "(empty source \u2014 skipped)";
+    lines.push(`  ${tag} ${s.subdir} ${detail}`);
+  }
+  if (!result.dryRun && result.subdirs.some((s) => s.status === "copied")) {
+    lines.push("");
+    lines.push("Next: export NEXUS_REPO_PREFERRED=1 to start using the per-repo data dir.");
+    lines.push(
+      "See: https://github.com/nexus-substrate/nexus-agents/issues/2872 for the full epic."
+    );
+  }
+  return `${lines.join("\n")}
+`;
+}
+async function handleMigrateCommand(args) {
+  const opts = {
+    ...args.options.input !== void 0 ? { from: args.options.input } : {},
+    ...args.options.output !== void 0 ? { to: args.options.output } : {},
+    ...args.options.dryRun !== void 0 ? { dryRun: args.options.dryRun } : {}
+  };
+  const result = runMigrate(opts);
+  process.stderr.write(formatMigrationResult(result));
+  await Promise.resolve();
+  if (!result.success) {
+    process.exit(1);
+  }
+}
+
 // src/cli-commands.ts
 function printHelp(args) {
   const all = args?.options.all ?? false;
@@ -22464,6 +22513,8 @@ var ASYNC_COMMAND_HANDLERS = {
   usage: handleUsageCommand,
   // Issue #2444: improvement-review command (observability-driven improvement loop)
   "improvement-review": handleImprovementReviewCommand,
+  // Issue #2879 / epic #2872: migrate command (relocate homedir state per-repo)
+  migrate: handleMigrateCommand,
   // #2305 / #2308 / #2311: Init Portable Command (async because --install spawns npm)
   init: handleInitCommand,
   demo: handleDemoCommand,
@@ -22948,8 +22999,8 @@ var isDirectRun = () => {
 };
 if (isDirectRun()) {
   main().catch((error) => {
-    const logger17 = createLogger({ component: "cli" });
-    logger17.error(
+    const logger18 = createLogger({ component: "cli" });
+    logger18.error(
       "Fatal error during startup",
       error instanceof Error ? error : new Error(String(error))
     );