nexus-agents 2.81.3 → 2.82.0

package/dist/cli.js

@@ -12,18 +12,18 @@ import {
   parseFindings,
   sumFindings
 } from "./chunk-3RZWLQSC.js";
-import "./chunk-S77SLJ2J.js";
+import "./chunk-XGUDCUMB.js";
 import {
   buildOpenAICompatAdapters,
   loadUsageEvents,
   readOpenAICompatEnv,
   rollupByModel
-} from "./chunk-PUSFT342.js";
+} from "./chunk-BL5IBHEY.js";
 import {
   setupCommandAsync,
   verifyCommand
-} from "./chunk-EKLY4LBJ.js";
-import "./chunk-6YQCLEHL.js";
+} from "./chunk-JM3R267Z.js";
+import "./chunk-SXL744NF.js";
 import {
   AuthHandler,
   DEFAULT_EXPERTS,
@@ -122,6 +122,7 @@ import {
   registerMemoryWriteTool,
   registerOrchestrateTool,
   registerPipelineTool,
+  registerPrReviewTool,
   registerPrompts,
   registerQueryTaskStateTool,
   registerQueryTraceTool,
@@ -139,6 +140,7 @@ import {
   registerRunGraphWorkflowTool,
   registerRunWorkflowTool,
   registerSearchCodebaseTool,
+  registerSupplyChainTradeoffPanelTool,
   registerSurveyOssLandscapeTool,
   registerTools,
   registerVendorPublishingAuditTool,
@@ -153,19 +155,19 @@ import {
   validateCommand,
   validateWorkflow,
   wrapInMarkdownFence
-} from "./chunk-755EZIUF.js";
+} from "./chunk-4XNVJS5A.js";
 import "./chunk-AP2FD37C.js";
 import "./chunk-ED6VQWNG.js";
 import {
   resolveToken
-} from "./chunk-UZCDHAY3.js";
+} from "./chunk-G2DZBEMU.js";
 import {
   CATEGORY_DISPLAY_NAMES,
   DEFAULT_PR_REVIEW_CONFIG
 } from "./chunk-X2M7OF27.js";
-import "./chunk-PKBKWWPK.js";
-import "./chunk-T7RGD5JW.js";
-import "./chunk-SVKH6ASN.js";
+import "./chunk-X3JR3GMT.js";
+import "./chunk-OYDJ3C4N.js";
+import "./chunk-HMXQKDUV.js";
 import {
   DEFAULT_VOTE_TIMEOUT_MS,
   ErrorPolicySchema,
@@ -183,31 +185,31 @@ import {
   toolSuccessStructured,
   warnIfSimulatedOutsideTests,
   wrapToolWithTimeout
-} from "./chunk-P4W7PV6L.js";
-import "./chunk-M66MYHBT.js";
-import "./chunk-YLYT7GSG.js";
+} from "./chunk-FTT2IYYX.js";
+import "./chunk-NTLJ3INA.js";
+import "./chunk-SBZVRH4S.js";
 import {
   loadPapersRegistry,
   loadTechniquesRegistry,
   savePapersRegistry,
   synthesizeResearch
-} from "./chunk-ERWTZSAR.js";
+} from "./chunk-2R5UUBGA.js";
 import {
   classifyTrust,
   createFullGitHubProvider,
   evaluatePolicy,
   parsePRUrl,
   sanitizeInput
-} from "./chunk-RLQZOEMX.js";
-import "./chunk-UTL2SFIN.js";
-import "./chunk-SZ7VPIRA.js";
+} from "./chunk-HJUHDPXJ.js";
+import "./chunk-PZESEBD3.js";
+import "./chunk-W2AIGD35.js";
 import "./chunk-7J7PNOJQ.js";
 import "./chunk-BQ4YXGGQ.js";
-import "./chunk-4OPS2AUD.js";
+import "./chunk-TXIUCEFT.js";
 import {
   MemoryError,
   shutdownToolMemory
-} from "./chunk-PZEE6T5Y.js";
+} from "./chunk-U7JXQSEM.js";
 import {
   CustomExpertDefinitionSchema,
   DATA_SUBDIRECTORIES,
@@ -226,12 +228,12 @@ import {
   loadConfig,
   runDoctor,
   validateNexusEnv
-} from "./chunk-WLAQXITV.js";
-import "./chunk-WZGCVCRQ.js";
-import "./chunk-73K7575Z.js";
+} from "./chunk-S36LIUV2.js";
+import "./chunk-GNG7URCR.js";
+import "./chunk-WUUEKFKG.js";
 import {
   DEFAULTS
-} from "./chunk-V2KWEIV5.js";
+} from "./chunk-SHWGK7X6.js";
 import "./chunk-NUBSJGQZ.js";
 import {
   capitalize,
@@ -243,11 +245,11 @@ import {
   getAvailableClis,
   isRecord,
   probeAllClis
-} from "./chunk-BMNWUPJO.js";
-import "./chunk-LIEFKEAO.js";
+} from "./chunk-2SQXJQTA.js";
+import "./chunk-QHL4KGNB.js";
 import "./chunk-ZM4O442V.js";
 import "./chunk-PQHVC4BD.js";
-import "./chunk-PV3OEDLO.js";
+import "./chunk-HVZ52LOL.js";
 import {
   API_TIMEOUTS,
   AgentCapability,
@@ -315,7 +317,7 @@ import {
   validateTimeout,
   writeEmptyLine,
   writeLine
-} from "./chunk-LJIB6TNE.js";
+} from "./chunk-7VNVDFD5.js";
 import {
   applyPortableMode,
   detectSandbox,
@@ -13879,20 +13881,20 @@ function getLatestTag() {
     return void 0;
   }
 }
-function getCommitsBetween(from, to = "HEAD") {
+function tryGetCommitsBetween(from, to = "HEAD") {
   const SAFE_REF = /^[a-zA-Z0-9._\-/~^]+$/;
-  if (!SAFE_REF.test(from) || !SAFE_REF.test(to)) {
-    return [];
-  }
+  if (!SAFE_REF.test(from)) return { kind: "invalid_ref", ref: from };
+  if (!SAFE_REF.test(to)) return { kind: "invalid_ref", ref: to };
   try {
     const result = execFileSync("git", ["log", `${from}..${to}`, "--oneline", "--format=%h %s"], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
       timeout: CLI_SUBPROCESS_TIMEOUTS.ghCommandMs
     }).trim();
-    return result ? result.split("\n").filter(Boolean) : [];
-  } catch {
-    return [];
+    return { kind: "ok", commits: result ? result.split("\n").filter(Boolean) : [] };
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    return { kind: "git_failed", reason };
   }
 }
 function parseConventionalCommit(hash, message) {
@@ -14046,7 +14048,34 @@ async function runReleaseNotes(options = {}) {
   if (opts.verbose) {
     console.log(`${colors.dim}Analyzing commits from ${fromRef} to ${toRef}...${colors.reset}`);
   }
-  const commitLines = getCommitsBetween(fromRef, toRef);
+  const commitsResult = tryGetCommitsBetween(fromRef, toRef);
+  if (commitsResult.kind === "invalid_ref") {
+    return {
+      success: false,
+      content: `Invalid git ref: "${commitsResult.ref}". Refs may only contain [a-zA-Z0-9._\\-/~^].`,
+      version: "unknown",
+      fromRef,
+      toRef,
+      commitCount: 0,
+      categories: [],
+      usedConsensus: false,
+      durationMs: Date.now() - startTime
+    };
+  }
+  if (commitsResult.kind === "git_failed") {
+    return {
+      success: false,
+      content: `git log failed for ${fromRef}..${toRef}: ${commitsResult.reason}`,
+      version: "unknown",
+      fromRef,
+      toRef,
+      commitCount: 0,
+      categories: [],
+      usedConsensus: false,
+      durationMs: Date.now() - startTime
+    };
+  }
+  const commitLines = commitsResult.commits;
   if (commitLines.length === 0) {
     return {
       success: true,
@@ -14595,7 +14624,14 @@ function generateBlogPost(options) {
   const highlights = options.highlights || extractHighlightsFromChangelog(options.version);
   const today = (/* @__PURE__ */ new Date()).toISOString().split("T")[0] ?? (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   const fromRef = getLatestTag() || "HEAD~50";
-  const commits = getCommitsBetween(fromRef, "HEAD");
+  const commitsResult = tryGetCommitsBetween(fromRef, "HEAD");
+  const commits = commitsResult.kind === "ok" ? commitsResult.commits : [];
+  if (commitsResult.kind !== "ok") {
+    const detail = commitsResult.kind === "invalid_ref" ? `invalid ref: ${commitsResult.ref}` : commitsResult.reason;
+    console.warn(
+      `[release-announce] git log failed for ${fromRef}..HEAD (${detail}); commit stats will be zero.`
+    );
+  }
   const parsedCommits = commits.map((line) => {
     const spaceIndex = line.indexOf(" ");
     return parseConventionalCommit(line.substring(0, spaceIndex), line.substring(spaceIndex + 1));
@@ -16534,8 +16570,8 @@ function autoGitignoreMcpConfig(workspaceDir, dryRun) {
     if (already) return false;
   }
   if (!dryRun) {
-    const sep3 = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
-    appendFileSync(gitignorePath, `${sep3}${MCP_CONFIG_FILENAME}
+    const sep4 = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
+    appendFileSync(gitignorePath, `${sep4}${MCP_CONFIG_FILENAME}
 `, "utf-8");
   }
   return true;
@@ -16774,8 +16810,8 @@ function maybeUpdateGitignore(workspaceDir, portableDirName, dryRun) {
     }
   }
   if (!dryRun) {
-    const sep3 = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
-    appendFileSync2(gitignorePath, `${sep3}${entry}
+    const sep4 = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
+    appendFileSync2(gitignorePath, `${sep4}${entry}
 `, "utf-8");
   }
   return true;
@@ -17029,7 +17065,7 @@ async function resolveTaskInput(input) {
   if (input.planFile !== void 0) {
     const resolved = path20.resolve(input.planFile);
     const cwdRoot = path20.resolve(".");
-    if (!resolved.startsWith(cwdRoot)) {
+    if (resolved !== cwdRoot && !resolved.startsWith(cwdRoot + path20.sep)) {
       throw new Error(`Path traversal denied: planFile must be within ${cwdRoot}`);
     }
     try {
@@ -17323,6 +17359,27 @@ function resolveEnv(env2) {
   }
   return resolved;
 }
+var UPSTREAM_BASELINE_KEYS = [
+  "PATH",
+  "HOME",
+  "USER",
+  "LANG",
+  "LC_ALL",
+  "LC_CTYPE",
+  "TMPDIR",
+  "TZ",
+  "PWD",
+  "SHELL",
+  "TERM"
+];
+function buildUpstreamEnv(configEnv) {
+  const baseline = {};
+  for (const key of UPSTREAM_BASELINE_KEYS) {
+    const value = process.env[key];
+    if (value !== void 0) baseline[key] = value;
+  }
+  return { ...baseline, ...resolveEnv(configEnv) };
+}
 var UpstreamClient = class {
   name;
   config;
@@ -17342,15 +17399,10 @@ var UpstreamClient = class {
     if (this.state === "connecting") return;
     this.state = "connecting";
     try {
-      const resolvedEnv = resolveEnv(this.config.env);
-      const baseEnv = {};
-      for (const [k, v] of Object.entries(process.env)) {
-        if (v !== void 0) baseEnv[k] = v;
-      }
       this.transport = new StdioClientTransport({
         command: this.config.command,
         args: [...this.config.args],
-        env: { ...baseEnv, ...resolvedEnv }
+        env: buildUpstreamEnv(this.config.env)
       });
       this.client = new Client(
         { name: `nexus-upstream-${this.name}`, version: "1.0.0" },
@@ -17523,9 +17575,11 @@ var REGISTERED_TOOLS = [
   "consensus_vote",
   "research_query",
   "research_add",
+  "research_add_source",
   "research_discover",
   "research_analyze",
   "research_catalog_review",
+  "research_synthesize",
   "survey_oss_landscape",
   "vendor_publishing_audit",
   "compare_data_feeds",
@@ -17538,9 +17592,17 @@ var REGISTERED_TOOLS = [
   "execute_spec",
   "registry_import",
   "query_trace",
+  "query_task_state",
+  "verify_audit_chain",
+  "extract_symbols",
+  "search_codebase",
+  "run_dev_pipeline",
+  "run_pipeline",
   "repo_analyze",
   "repo_security_plan",
-  "improvement_review"
+  "improvement_review",
+  "pr_review",
+  "supply_chain_tradeoff_panel"
 ];
 var MOCK_ORCHESTRATION_ENV = "NEXUS_ALLOW_MOCK_ORCHESTRATION";
 function createOrchestratorForOrchestration(modelAdapter, logger18, useMockTechLead) {
@@ -17818,7 +17880,9 @@ var STANDALONE_TOOLS = [
   { name: "extract_symbols", register: registerExtractSymbolsTool },
   { name: "search_codebase", register: registerSearchCodebaseTool },
   { name: "run_dev_pipeline", register: registerDevPipelineTool },
-  { name: "run_pipeline", register: registerPipelineTool }
+  { name: "run_pipeline", register: registerPipelineTool },
+  { name: "pr_review", register: registerPrReviewTool },
+  { name: "supply_chain_tradeoff_panel", register: registerSupplyChainTradeoffPanelTool }
 ];
 function registerToolCategories(ctx) {
   const allowlist = ctx.toolAllowlist;
@@ -17873,7 +17937,12 @@ function registerMcpTools(options) {
   const gatewayOptions = { ...options, server: observableServer };
   const ctx = createToolContext(gatewayOptions, toolInfra, rateLimiterFactory);
   registerToolCategories(ctx);
-  void initUpstreamServers(gatewayConfig, observableServer, logger18);
+  void initUpstreamServers(gatewayConfig, observableServer, logger18).catch((error) => {
+    logger18.error(
+      "Upstream MCP init failed",
+      error instanceof Error ? error : new Error(String(error))
+    );
+  });
   registerPrompts(observableServer, logger18);
   registerResources(observableServer, logger18);
   logToolRegistration(logger18, ctx.toolAllowlist, {
@@ -17976,6 +18045,27 @@ function logFinalEventBusStats(logger18) {
 
 // src/cli-orchestrator.ts
 import * as readline2 from "readline";
+async function executeReplTask(task, options, logger18, rl) {
+  try {
+    await orchestrateCommand({
+      task,
+      verbose: options.verbose,
+      format: options.format,
+      model: options.model,
+      dryRun: options.dryRun,
+      maxTokens: options.maxTokens,
+      maxCostUsd: options.maxCostUsd
+    });
+  } catch (error) {
+    const err2 = error instanceof Error ? error : new Error(String(error));
+    logger18.error("REPL task failed", err2);
+    process.stderr.write(`Error: ${err2.message}
+`);
+  } finally {
+    process.stdout.write("\n");
+    rl.prompt();
+  }
+}
 function runOrchestratorRepl(options, logger18) {
   return new Promise((resolve14) => {
     const rl = readline2.createInterface({
@@ -17996,20 +18086,7 @@ function runOrchestratorRepl(options, logger18) {
         rl.prompt();
         return;
       }
-      void (async () => {
-        const orchestrateOptions = {
-          task,
-          verbose: options.verbose,
-          format: options.format,
-          model: options.model,
-          dryRun: options.dryRun,
-          maxTokens: options.maxTokens,
-          maxCostUsd: options.maxCostUsd
-        };
-        await orchestrateCommand(orchestrateOptions);
-        process.stdout.write("\n");
-        rl.prompt();
-      })();
+      void executeReplTask(task, options, logger18, rl);
     });
     rl.on("close", () => {
       logger18.info("Orchestrator REPL closed");
@@ -19147,7 +19224,7 @@ function adaptConfigToLibrary(config) {
 }
 function createBeliefPromoter() {
   return async (event) => {
-    const { getToolMemory } = await import("./tool-memory-MFDLIJOB.js");
+    const { getToolMemory } = await import("./tool-memory-T7ZYIUJ2.js");
     const tm = getToolMemory();
     await tm.recordBelief(
       `skill:${event.name}`,
@@ -19293,7 +19370,8 @@ function initializeAuditLogger(securityConfig, logger18) {
       maxFiles: auditConfig.maxFiles,
       filePrefix: "audit",
       enableCompression: false,
-      flushIntervalMs: 1e3
+      flushIntervalMs: 1e3,
+      maxQueueDepth: 1e4
     },
     void 0,
     logger18
@@ -20007,7 +20085,7 @@ async function handleResearchCommand(args) {
   }
 }
 async function handleRegistryCommand(args) {
-  const { registryCommand, isValidRegistrySubcommand, formatRegistryUsage } = await import("./registry-command-ALVYOGQY.js");
+  const { registryCommand, isValidRegistrySubcommand, formatRegistryUsage } = await import("./registry-command-TH7U6UMC.js");
   const subcommand = args.subcommand;
   if (!isValidRegistrySubcommand(subcommand)) {
     process.stdout.write(`${formatRegistryUsage()}
@@ -20055,7 +20133,7 @@ async function handleVerifyCommand(args) {
 async function handleDoctorCommand(args) {
   const exitCode = await doctorCommand({ fix: args.options.fix });
   if (args.options.deep) {
-    const { runDeepDiagnostics: runDeepDiagnostics2, formatDeepDiagnostics: formatDeepDiagnostics2 } = await import("./doctor-deep-IH4FG5YZ.js");
+    const { runDeepDiagnostics: runDeepDiagnostics2, formatDeepDiagnostics: formatDeepDiagnostics2 } = await import("./doctor-deep-7YK4BZIJ.js");
     const diag = runDeepDiagnostics2();
     process.stdout.write(formatDeepDiagnostics2(diag) + "\n");
   }
@@ -20099,7 +20177,7 @@ async function handleInitCommand(args) {
   process.exit(result.success ? EXIT_CODES.SUCCESS : EXIT_CODES.SERVER_START_FAILED);
 }
 async function runInitOpencodeFlow(args) {
-  const { runInitOpencode } = await import("./init-opencode-MXZJKG32.js");
+  const { runInitOpencode } = await import("./init-opencode-QP5CAMWN.js");
   const opencodePath = args.options.opencode;
   if (opencodePath === void 0 || opencodePath === "") {
     process.stderr.write("Error: --opencode requires a path argument.\n");
@@ -20126,7 +20204,7 @@ async function runInitOpencodeFlow(args) {
   process.exit(EXIT_CODES.SUCCESS);
 }
 async function renderOpencodeValidate(opencodePath) {
-  const { runOpencodeValidate } = await import("./init-opencode-MXZJKG32.js");
+  const { runOpencodeValidate } = await import("./init-opencode-QP5CAMWN.js");
   const result = await runOpencodeValidate(opencodePath);
   if (!result.ok) {
     process.stderr.write(`init --opencode --validate: ${result.reason ?? "failed"}
@@ -20166,7 +20244,7 @@ async function handleSetupCommandAsync(args) {
   process.exit(exitCode === 0 ? EXIT_CODES.SUCCESS : EXIT_CODES.SERVER_START_FAILED);
 }
 async function runCustomApiSetup(args) {
-  const { configureCustomApi } = await import("./setup-custom-api-QEKHNYQJ.js");
+  const { configureCustomApi } = await import("./setup-custom-api-UOIKUQL4.js");
   const baseUrl = args.options.customApi;
   if (baseUrl === void 0) return EXIT_CODES.SERVER_START_FAILED;
   const input = {