nexus-agents 2.79.4 → 2.80.1

package/dist/{chunk-NVSJXN4S.js → chunk-D4NEYNBO.js}

@@ -1,11 +1,12 @@
 import {
   getErrorMessage
-} from "./chunk-UQOSVOEU.js";
+} from "./chunk-T4E6UFFC.js";
 
 // src/cli/setup-config.ts
-import { copyFileSync, existsSync, writeFileSync } from "fs";
-import { resolve } from "path";
+import { copyFileSync, existsSync, mkdirSync, writeFileSync } from "fs";
+import { dirname, resolve } from "path";
 var DEFAULT_CONFIG_FILE = "nexus-agents.yaml";
+var DEFAULT_CONFIG_REL_PATH = `.nexus-agents/${DEFAULT_CONFIG_FILE}`;
 var SETUP_CONFIG_TEMPLATE = `# Nexus Agents Configuration
 # Generated by: nexus-agents setup
 # Full template: nexus-agents config init
@@ -21,7 +22,8 @@ logging:
   format: json
 `;
 function runConfigInitSync(projectRoot, force, dryRun) {
-  const outputPath = resolve(projectRoot, DEFAULT_CONFIG_FILE);
+  const legacyPath = resolve(projectRoot, DEFAULT_CONFIG_FILE);
+  const outputPath = existsSync(legacyPath) ? legacyPath : resolve(projectRoot, DEFAULT_CONFIG_REL_PATH);
   if (existsSync(outputPath) && !force) {
     return {
       success: true,
@@ -41,6 +43,7 @@ function runConfigInitSync(projectRoot, force, dryRun) {
   const backup = ensureBackup(outputPath);
   if ("error" in backup) return backup.error;
   try {
+    mkdirSync(dirname(outputPath), { recursive: true });
     writeFileSync(outputPath, SETUP_CONFIG_TEMPLATE, "utf-8");
     const message = backup.path !== void 0 ? `Created: ${outputPath} (backup saved at ${backup.path})` : `Created: ${outputPath}`;
     return { success: true, path: outputPath, created: true, message };
@@ -74,4 +77,4 @@ function ensureBackup(outputPath) {
 export {
   runConfigInitSync
 };
-//# sourceMappingURL=chunk-NVSJXN4S.js.map
+//# sourceMappingURL=chunk-D4NEYNBO.js.map

package/dist/chunk-D4NEYNBO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/setup-config.ts"],"sourcesContent":["/**\n * Synchronous config file generation for setup command.\n *\n * Reuses the CONFIG_TEMPLATE from config-init.ts pattern but provides\n * a synchronous API suitable for the setup command flow.\n *\n * @module cli/setup-config\n * (Source: Issue #1252 - Setup auto-generates nexus-agents.yaml)\n */\n\nimport { copyFileSync, existsSync, mkdirSync, writeFileSync } from 'node:fs';\nimport { dirname, resolve } from 'node:path';\nimport { getErrorMessage } from '../core/index.js';\n\n/** Default configuration file name. */\nconst DEFAULT_CONFIG_FILE = 'nexus-agents.yaml';\n\n/**\n * Path setup writes new configs to (epic #2872). The config loader checks\n * `.nexus-agents/nexus-agents.yaml` ahead of the legacy root-level location,\n * so writing here is forward-compatible. Existing root-level configs keep\n * working without action (loader still falls back to them).\n */\nconst DEFAULT_CONFIG_REL_PATH = `.nexus-agents/${DEFAULT_CONFIG_FILE}`;\n\n/** Result of the config generation step. */\nexport interface ConfigStepResult {\n  readonly success: boolean;\n  readonly path: string;\n  readonly created: boolean;\n  readonly message: string;\n}\n\n/**\n * Minimal YAML config template for setup command.\n * Intentionally brief — just enough to get started.\n * Users can run `nexus-agents config init` for the full template.\n */\nconst SETUP_CONFIG_TEMPLATE = `# Nexus Agents Configuration\n# Generated by: nexus-agents setup\n# Full template: nexus-agents config init\n\nmodels:\n  default: claude-sonnet-4\n\nexperts:\n  builtin: true\n\nlogging:\n  level: info\n  format: json\n`;\n\n/**\n * Generates a nexus-agents.yaml config file synchronously.\n *\n * @param projectRoot - Directory to create config in.\n * @param force - Overwrite existing config.\n * @param dryRun - Report what would happen without writing.\n */\nexport function runConfigInitSync(\n  projectRoot: string,\n  force: boolean,\n  dryRun: boolean\n): ConfigStepResult {\n  // Prefer the dotdir location for new configs. Per #2877: if a legacy\n  // root-level nexus-agents.yaml already exists, keep editing it in place\n  // rather than silently moving the user's config — the migrate command\n  // (#2879) is the explicit way to relocate. New installs land in the dotdir.\n  const legacyPath = resolve(projectRoot, DEFAULT_CONFIG_FILE);\n  const outputPath = existsSync(legacyPath)\n    ? legacyPath\n    : resolve(projectRoot, DEFAULT_CONFIG_REL_PATH);\n\n  if (existsSync(outputPath) && !force) {\n    return {\n      success: true,\n      path: outputPath,\n      created: false,\n      message: 'Config already exists (use --force to overwrite)',\n    };\n  }\n\n  if (dryRun) {\n    return {\n      success: true,\n      path: outputPath,\n      created: true,\n      message: `Would create: ${outputPath}`,\n    };\n  }\n\n  const backup = ensureBackup(outputPath);\n  if ('error' in backup) return backup.error;\n\n  try {\n    // Ensure parent dir exists — needed for the new dotdir location since\n    // .nexus-agents/ may not yet exist on a fresh repo.\n    mkdirSync(dirname(outputPath), { recursive: true });\n    writeFileSync(outputPath, SETUP_CONFIG_TEMPLATE, 'utf-8');\n    const message =\n      backup.path !== undefined\n        ? `Created: ${outputPath} (backup saved at ${backup.path})`\n        : `Created: ${outputPath}`;\n    return { success: true, path: outputPath, created: true, message };\n  } catch (error: unknown) {\n    return {\n      success: false,\n      path: outputPath,\n      created: false,\n      message: `Failed: ${getErrorMessage(error)}`,\n    };\n  }\n}\n\n/**\n * Saves a timestamped backup of an existing config file before overwrite (#2183).\n *\n * Returns `{ path }` with the backup path (or undefined if no existing file)\n * on success, or `{ error }` with a populated `ConfigStepResult` on failure.\n * Failure to write the backup aborts the overwrite — better to keep the\n * user's customizations intact than to lose them silently.\n */\nfunction ensureBackup(\n  outputPath: string\n): { path: string | undefined } | { error: ConfigStepResult } {\n  if (!existsSync(outputPath)) return { path: undefined };\n  const backupPath = `${outputPath}.bak.${String(Date.now())}`;\n  try {\n    copyFileSync(outputPath, backupPath);\n    return { path: backupPath };\n  } catch (err: unknown) {\n    return {\n      error: {\n        success: false,\n        path: outputPath,\n        created: false,\n        message: `Failed to back up existing config: ${getErrorMessage(err)}`,\n      },\n    };\n  }\n}\n"],"mappings":";;;;;AAUA,SAAS,cAAc,YAAY,WAAW,qBAAqB;AACnE,SAAS,SAAS,eAAe;AAIjC,IAAM,sBAAsB;AAQ5B,IAAM,0BAA0B,iBAAiB,mBAAmB;AAepE,IAAM,wBAAwB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAsBvB,SAAS,kBACd,aACA,OACA,QACkB;AAKlB,QAAM,aAAa,QAAQ,aAAa,mBAAmB;AAC3D,QAAM,aAAa,WAAW,UAAU,IACpC,aACA,QAAQ,aAAa,uBAAuB;AAEhD,MAAI,WAAW,UAAU,KAAK,CAAC,OAAO;AACpC,WAAO;AAAA,MACL,SAAS;AAAA,MACT,MAAM;AAAA,MACN,SAAS;AAAA,MACT,SAAS;AAAA,IACX;AAAA,EACF;AAEA,MAAI,QAAQ;AACV,WAAO;AAAA,MACL,SAAS;AAAA,MACT,MAAM;AAAA,MACN,SAAS;AAAA,MACT,SAAS,iBAAiB,UAAU;AAAA,IACtC;AAAA,EACF;AAEA,QAAM,SAAS,aAAa,UAAU;AACtC,MAAI,WAAW,OAAQ,QAAO,OAAO;AAErC,MAAI;AAGF,cAAU,QAAQ,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;AAClD,kBAAc,YAAY,uBAAuB,OAAO;AACxD,UAAM,UACJ,OAAO,SAAS,SACZ,YAAY,UAAU,qBAAqB,OAAO,IAAI,MACtD,YAAY,UAAU;AAC5B,WAAO,EAAE,SAAS,MAAM,MAAM,YAAY,SAAS,MAAM,QAAQ;AAAA,EACnE,SAAS,OAAgB;AACvB,WAAO;AAAA,MACL,SAAS;AAAA,MACT,MAAM;AAAA,MACN,SAAS;AAAA,MACT,SAAS,WAAW,gBAAgB,KAAK,CAAC;AAAA,IAC5C;AAAA,EACF;AACF;AAUA,SAAS,aACP,YAC4D;AAC5D,MAAI,CAAC,WAAW,UAAU,EAAG,QAAO,EAAE,MAAM,OAAU;AACtD,QAAM,aAAa,GAAG,UAAU,QAAQ,OAAO,KAAK,IAAI,CAAC,CAAC;AAC1D,MAAI;AACF,iBAAa,YAAY,UAAU;AACnC,WAAO,EAAE,MAAM,WAAW;AAAA,EAC5B,SAAS,KAAc;AACrB,WAAO;AAAA,MACL,OAAO;AAAA,QACL,SAAS;AAAA,QACT,MAAM;AAAA,QACN,SAAS;AAAA,QACT,SAAS,sCAAsC,gBAAgB,GAAG,CAAC;AAAA,MACrE;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-42MM7GKW.js → chunk-D5C5N5Q4.js}

@@ -1,6 +1,6 @@
 import {
   createLogger
-} from "./chunk-UQOSVOEU.js";
+} from "./chunk-T4E6UFFC.js";
 
 // src/config/available-models-cache.ts
 var logger = createLogger({ component: "available-models-cache" });
@@ -150,4 +150,4 @@ export {
   getDefaultAvailableModelsCache,
   setDefaultAvailableModelsCache
 };
-//# sourceMappingURL=chunk-42MM7GKW.js.map
+//# sourceMappingURL=chunk-D5C5N5Q4.js.map

package/dist/{chunk-BIH2CBC5.js → chunk-EPZMFIAX.js}

@@ -1,7 +1,7 @@
 import {
   CliCircuitBreaker,
   DEFAULT_CIRCUIT_BREAKER_CONFIG
-} from "./chunk-NJPFN75N.js";
+} from "./chunk-7UM5XRGG.js";
 import {
   CLI_SUBPROCESS_TIMEOUTS,
   CLI_TIMEOUTS,
@@ -24,7 +24,7 @@ import {
   getTimeProvider,
   isRateLimitText,
   ok
-} from "./chunk-UQOSVOEU.js";
+} from "./chunk-T4E6UFFC.js";
 
 // src/cli-adapters/subprocess-adapter.ts
 import { spawn } from "child_process";
@@ -400,13 +400,23 @@ var BaseCliAdapter = class {
     if (task.timeoutMs !== void 0) return task.timeoutMs;
     return getTimeoutForTaskAuto(this.name, task.content);
   }
+  /**
+   * Whether the shared outer retry loop ({@link executeCliRetryLoop}) is
+   * allowed to retry this adapter's failures. The base adapter honors the
+   * caller's `allowRetry`. Subprocess adapters override this to suppress
+   * the outer loop when their own transient-retry layer is active, so the
+   * two layers do not nest into multiplied spawns (#2824).
+   */
+  shouldOuterRetry(opts) {
+    return opts.allowRetry;
+  }
   /**
    * Executes task with retry logic via shared retry loop.
    */
   async executeWithRetry(task, opts) {
     const result = await executeCliRetryLoop(() => this.executeTask(task, opts), {
       maxRetries: opts.maxRetries,
-      allowRetry: opts.allowRetry,
+      allowRetry: this.shouldOuterRetry(opts),
       baseDelayMs: 1e3,
       maxDelayMs: 16e3,
       cli: this.name,
@@ -576,6 +586,78 @@ var BaseCliAdapter = class {
   }
 };
 
+// src/cli-adapters/subprocess-env.ts
+var BASE_ENV_EXACT = [
+  "PATH",
+  "HOME",
+  "USER",
+  "LOGNAME",
+  "SHELL",
+  "LANG",
+  "TERM",
+  "TZ",
+  "TMPDIR",
+  "TEMP",
+  "TMP",
+  "HTTP_PROXY",
+  "HTTPS_PROXY",
+  "NO_PROXY",
+  "ALL_PROXY",
+  "http_proxy",
+  "https_proxy",
+  "no_proxy",
+  "all_proxy",
+  "NODE_OPTIONS",
+  "NODE_PATH",
+  "NODE_ENV",
+  "NODE_EXTRA_CA_CERTS",
+  "SSL_CERT_FILE",
+  "SSL_CERT_DIR"
+];
+var BASE_ENV_PREFIXES = [
+  "LC_",
+  // locale: LC_ALL, LC_CTYPE, …
+  "NEXUS_",
+  // nexus-agents config + nested-run credentials (a child may be a nested nexus-agents)
+  "npm_config_"
+  // npm/node resolution config: registry, proxy, …
+];
+var CLI_VENDOR_KEYS = {
+  claude: ["ANTHROPIC_API_KEY"],
+  gemini: ["GOOGLE_AI_API_KEY", "GEMINI_API_KEY", "GOOGLE_API_KEY"],
+  codex: ["OPENAI_API_KEY"],
+  opencode: [
+    "ANTHROPIC_API_KEY",
+    "OPENAI_API_KEY",
+    "GOOGLE_AI_API_KEY",
+    "GEMINI_API_KEY",
+    "GOOGLE_API_KEY",
+    "OPENROUTER_API_KEY"
+  ]
+};
+function isAllowed(key, vendorKeys) {
+  if (BASE_ENV_EXACT.includes(key)) return true;
+  if (vendorKeys.includes(key)) return true;
+  return BASE_ENV_PREFIXES.some((prefix) => key.startsWith(prefix));
+}
+function buildChildEnv(cliName) {
+  const source = process.env;
+  const childEnv = {};
+  if (source["NEXUS_SUBPROCESS_ENV_ALLOWLIST"] === "0") {
+    for (const [key, value] of Object.entries(source)) {
+      if (value !== void 0 && key !== "CLAUDECODE") childEnv[key] = value;
+    }
+    return childEnv;
+  }
+  const vendorKeys = CLI_VENDOR_KEYS[cliName];
+  for (const [key, value] of Object.entries(source)) {
+    if (value === void 0) continue;
+    if (key === "CLAUDECODE") continue;
+    if (isAllowed(key, vendorKeys)) childEnv[key] = value;
+  }
+  return childEnv;
+}
+
 // src/security/output-sanitizer.ts
 var REDACTED_KEY_PLACEHOLDER = "[REDACTED_KEY]";
 var KEY_PATTERNS = [
@@ -791,6 +873,18 @@ var SubprocessCliAdapter = class extends BaseCliAdapter {
   transport = "subprocess";
   /** Transient-error retry config. Override in subclass to enable. */
   transientRetry = { enabled: true };
+  /**
+   * The inner {@link retryTransient} layer is the single retry authority
+   * for subprocess CLIs. When it is enabled (the default), the shared
+   * outer retry loop must not also retry: nesting both meant up to 6
+   * subprocess spawns and ~10-minute hangs on a persistent TIMEOUT, since
+   * the inner layer's timeout extension compounds on every outer attempt
+   * (#2824). The outer loop still runs once, so circuit-breaker failure
+   * recording is unaffected.
+   */
+  shouldOuterRetry(opts) {
+    return opts.allowRetry && !this.transientRetry.enabled;
+  }
   /**
    * Executes a task via subprocess, with optional transient-error retry.
    * When `transientRetry.enabled` is true, transient errors (timeout,
@@ -850,8 +944,7 @@ var SubprocessCliAdapter = class extends BaseCliAdapter {
         runCleanup();
         resolveOuter(result);
       };
-      const childEnv = { ...process.env };
-      delete childEnv["CLAUDECODE"];
+      const childEnv = buildChildEnv(this.name);
       const child = spawn(cmdConfig.command, cmdConfig.args, {
         stdio: ["pipe", "pipe", "pipe"],
         env: childEnv
@@ -1698,7 +1791,7 @@ var GeminiCliAdapter = class extends SubprocessCliAdapter {
   async executeWithRetryTracking(task, options) {
     return executeCliRetryLoop(() => this.executeTask(task, options), {
       maxRetries: options.maxRetries,
-      allowRetry: options.allowRetry,
+      allowRetry: this.shouldOuterRetry(options),
       baseDelayMs: this.baseDelayMs,
       maxDelayMs: this.maxDelayMs,
       circuitBreaker: this.circuitBreaker,
@@ -2626,9 +2719,10 @@ ${task.content}` : task.content;
   }
   /**
    * (#2540) Lists models the local OpenCode installation can route to.
-   * Wraps the existing `probeAvailableModels()` (already 5-min cached)
-   * and reshapes the result into the CliModelInfo schema. Splits
-   * `provider/model` ids when present.
+   * Wraps the existing `probeAvailableModels()` (cached for the process
+   * lifetime — see `cachedModels` at the top of this file) and reshapes
+   * the result into the CliModelInfo schema. Splits `provider/model` ids
+   * when present.
    */
   async listModels() {
     const ids = await probeAvailableModels();
@@ -3063,6 +3157,7 @@ export {
   categorizeError,
   executeCliRetryLoop,
   BaseCliAdapter,
+  sanitizeOutput,
   SubprocessCliAdapter,
   asRecord,
   isRecord,
@@ -3085,4 +3180,4 @@ export {
   isCliAvailable,
   getAvailableClis
 };
-//# sourceMappingURL=chunk-BIH2CBC5.js.map
+//# sourceMappingURL=chunk-EPZMFIAX.js.map