nexus-agents 2.83.1 → 2.85.0

package/dist/{chunk-TKGVRHEI.js → chunk-J5S27RQ4.js}

@@ -4,7 +4,7 @@ import {
 import {
   createLogger,
   getTimeProvider
-} from "./chunk-6UI4NKT4.js";
+} from "./chunk-YLMB5MFQ.js";
 
 // src/mcp/tools/scanner-registry-fetcher.ts
 import { z } from "zod";
@@ -721,4 +721,4 @@ export {
   generateSecurityPlan,
   buildPlanFromAnalysis
 };
-//# sourceMappingURL=chunk-TKGVRHEI.js.map
+//# sourceMappingURL=chunk-J5S27RQ4.js.map

package/dist/{chunk-UFUR6RBP.js → chunk-LY2KLNXM.js}

@@ -4,7 +4,7 @@ import {
   getErrorMessage,
   getTimeProvider,
   ok
-} from "./chunk-6UI4NKT4.js";
+} from "./chunk-YLMB5MFQ.js";
 
 // src/context/session-memory.ts
 import * as fs from "fs";
@@ -351,4 +351,4 @@ export {
   SessionMemory,
   createSessionMemory
 };
-//# sourceMappingURL=chunk-UFUR6RBP.js.map
+//# sourceMappingURL=chunk-LY2KLNXM.js.map

package/dist/{chunk-5QJPM5CB.js → chunk-NSOB2WRI.js}

@@ -1,14 +1,14 @@
 import {
   GitHubProvider,
   ScmError
-} from "./chunk-ZLGU7T6J.js";
+} from "./chunk-EL2KV773.js";
 import {
   CACHE_TIMEOUTS,
   createLogger,
   err,
   getTimeProvider,
   ok
-} from "./chunk-6UI4NKT4.js";
+} from "./chunk-YLMB5MFQ.js";
 
 // src/security/trust-types.ts
 import { z } from "zod";
@@ -1656,4 +1656,4 @@ export {
   IssueTriage,
   createIssueTriage
 };
-//# sourceMappingURL=chunk-5QJPM5CB.js.map
+//# sourceMappingURL=chunk-NSOB2WRI.js.map

package/dist/{chunk-4XSCU4B3.js → chunk-OXVOUVKH.js}

@@ -1,6 +1,6 @@
 import {
   DEFAULTS
-} from "./chunk-DWOSFYI2.js";
+} from "./chunk-25AQZKMN.js";
 import {
   resolveInsideRoot
 } from "./chunk-NUBSJGQZ.js";
@@ -10,7 +10,7 @@ import {
 import {
   createAllAdapters,
   probeCli
-} from "./chunk-ELRNVADA.js";
+} from "./chunk-RTAIMK6P.js";
 import {
   CliNameSchema,
   DEFAULT_CAPABILITIES,
@@ -26,7 +26,7 @@ import {
   ok,
   symbols,
   writeLine
-} from "./chunk-6UI4NKT4.js";
+} from "./chunk-YLMB5MFQ.js";
 import {
   detectSandbox,
   getLearningDir,
@@ -37,10 +37,10 @@ import {
   getRulesFile,
   isPersistenceEnabled,
   nexusDataPath
-} from "./chunk-I2HMWH4R.js";
+} from "./chunk-2WCYG75B.js";
 
 // src/version.ts
-var VERSION = true ? "2.83.1" : "dev";
+var VERSION = true ? "2.85.0" : "dev";
 
 // src/config/schemas-core.ts
 import { z } from "zod";
@@ -2096,7 +2096,7 @@ async function runDoctorFix(result) {
   writeLine2("\u2500".repeat(40));
   let fixCount = 0;
   if (!result.dataDirectory.rootExists || result.dataDirectory.subdirectories.some((d) => !d.exists || !d.writable)) {
-    const { runSetup } = await import("./setup-command-5AEO5A4Z.js");
+    const { runSetup } = await import("./setup-command-ZXDAR3GQ.js");
     const setupResult = runSetup({
       skipMcp: true,
       skipRules: true,
@@ -2110,7 +2110,7 @@ async function runDoctorFix(result) {
     }
   }
   if (!result.configFile.found) {
-    const { runConfigInitSync } = await import("./setup-config-RPSVIQJO.js");
+    const { runConfigInitSync } = await import("./setup-config-EYY5AYZ3.js");
     const configResult = runConfigInitSync(process.cwd(), false, false);
     if (configResult.success && configResult.created) {
       writeLine2(`\u2713 Generated config: ${configResult.path}`);
@@ -2208,4 +2208,4 @@ export {
   startStdioServer,
   closeServer
 };
-//# sourceMappingURL=chunk-4XSCU4B3.js.map
+//# sourceMappingURL=chunk-OXVOUVKH.js.map

package/dist/{chunk-6XRNFLPI.js → chunk-POTGGTJD.js}

@@ -2,7 +2,7 @@ import {
   ConfigError,
   err,
   ok
-} from "./chunk-6UI4NKT4.js";
+} from "./chunk-YLMB5MFQ.js";
 
 // src/adapters/sdk/types.ts
 var PROVIDER_ENV_KEYS = {
@@ -117,4 +117,4 @@ export {
   CUSTOM_API_ALLOW_PRIVATE_ENV,
   validateCustomApiBaseUrl
 };
-//# sourceMappingURL=chunk-6XRNFLPI.js.map
+//# sourceMappingURL=chunk-POTGGTJD.js.map

package/dist/{chunk-ZA6AZ7LK.js → chunk-QR4VYHMI.js}

@@ -1,6 +1,6 @@
 import {
   runConfigInitSync
-} from "./chunk-BUXXAN6V.js";
+} from "./chunk-Z5BAZS6F.js";
 import {
   VERSION,
   checkApiKeys,
@@ -8,10 +8,10 @@ import {
   checkSqlite,
   defaultConfig,
   initDataDirectories
-} from "./chunk-4XSCU4B3.js";
+} from "./chunk-OXVOUVKH.js";
 import {
   probeAllClis
-} from "./chunk-ELRNVADA.js";
+} from "./chunk-RTAIMK6P.js";
 import {
   BUILT_IN_EXPERTS
 } from "./chunk-ZM4O442V.js";
@@ -25,11 +25,11 @@ import {
   getErrorMessage,
   getTimeProvider,
   symbols
-} from "./chunk-6UI4NKT4.js";
+} from "./chunk-YLMB5MFQ.js";
 import {
   ensureGitignored,
   findRepoRoot
-} from "./chunk-I2HMWH4R.js";
+} from "./chunk-2WCYG75B.js";
 
 // src/cli/setup-command.ts
 import { existsSync as existsSync4 } from "fs";
@@ -1987,4 +1987,4 @@ export {
   setupCommand,
   setupCommandAsync
 };
-//# sourceMappingURL=chunk-ZA6AZ7LK.js.map
+//# sourceMappingURL=chunk-QR4VYHMI.js.map

package/dist/{chunk-FHY7I736.js → chunk-QR5KHIZG.js}

@@ -7,7 +7,7 @@ import {
   err,
   getErrorMessage,
   ok
-} from "./chunk-6UI4NKT4.js";
+} from "./chunk-YLMB5MFQ.js";
 
 // src/cli/research-helpers-synthesize.ts
 import { z } from "zod";
@@ -1015,4 +1015,4 @@ export {
   AttributedInsightSchema,
   synthesizeResearch
 };
-//# sourceMappingURL=chunk-FHY7I736.js.map
+//# sourceMappingURL=chunk-QR5KHIZG.js.map

package/dist/{chunk-ELRNVADA.js → chunk-RTAIMK6P.js}

@@ -1,7 +1,10 @@
 import {
   CliCircuitBreaker,
   DEFAULT_CIRCUIT_BREAKER_CONFIG
-} from "./chunk-LM2S2QWO.js";
+} from "./chunk-CIW2BVSN.js";
+import {
+  generateHyphenId
+} from "./chunk-TRX7CAD5.js";
 import {
   CLI_SUBPROCESS_TIMEOUTS,
   CLI_TIMEOUTS,
@@ -24,7 +27,7 @@ import {
   getTimeProvider,
   isRateLimitText,
   ok
-} from "./chunk-6UI4NKT4.js";
+} from "./chunk-YLMB5MFQ.js";
 
 // src/cli-adapters/subprocess-adapter.ts
 import { spawn } from "child_process";
@@ -150,10 +153,30 @@ var CapacityTracker = class {
   usageHistory;
   requestCount;
   windowStart;
+  /**
+   * Timestamps of every recorded request (#3026 finding 4).
+   *
+   * Pre-fix, `requestCount` was a plain counter reset only by the
+   * tumbling-window branch of `pruneOldEntries`. Under continuous
+   * traffic across a window boundary, that branch drops requests that
+   * are still inside the *sliding* window — e.g. with windowMs=60s, a
+   * request at t=59s followed by one at t=61s would tumbling-reset
+   * the counter to 1 even though the t=59s request is still inside
+   * the [1s, 61s] window. The downstream `remainingRequests === 0`
+   * exhaustion check fired prematurely (or too late) depending on
+   * burst patterns.
+   *
+   * Counting via a per-request timestamp array that's pruned the same
+   * way as `usageHistory` keeps the two views consistent. Every
+   * `recordUsage` pushes here; `requestCount` is derived from
+   * `.length` after pruning.
+   */
+  requestTimestamps;
   constructor(config) {
     this.config = config;
     this.usageHistory = [];
     this.requestCount = 0;
+    this.requestTimestamps = [];
     this.windowStart = getTimeProvider().now();
   }
   /**
@@ -162,7 +185,8 @@ var CapacityTracker = class {
   recordUsage(usage) {
     const now = getTimeProvider().now();
     this.pruneOldEntries(now);
-    this.requestCount++;
+    this.requestTimestamps.push(now);
+    this.requestCount = this.requestTimestamps.length;
     if (usage !== void 0) {
       const tokens = usage.totalTokens ?? usage.inputTokens + usage.outputTokens;
       this.usageHistory.push({
@@ -206,6 +230,7 @@ var CapacityTracker = class {
    */
   reset() {
     this.usageHistory.length = 0;
+    this.requestTimestamps.length = 0;
     this.requestCount = 0;
     this.windowStart = getTimeProvider().now();
   }
@@ -226,16 +251,19 @@ var CapacityTracker = class {
    */
   pruneOldEntries(now) {
     const cutoff = now - this.config.windowMs;
-    if (this.windowStart < cutoff) {
-      this.usageHistory.length = 0;
-      this.requestCount = 0;
-      this.windowStart = now;
-      return;
-    }
-    let firstEntry = this.usageHistory[0];
-    while (firstEntry !== void 0 && firstEntry.timestamp < cutoff) {
+    while (this.usageHistory[0] !== void 0 && this.usageHistory[0].timestamp < cutoff) {
       this.usageHistory.shift();
-      firstEntry = this.usageHistory[0];
+    }
+    while (this.requestTimestamps[0] !== void 0 && this.requestTimestamps[0] < cutoff) {
+      this.requestTimestamps.shift();
+    }
+    this.requestCount = this.requestTimestamps.length;
+    const earliestRequest = this.requestTimestamps[0];
+    const earliestUsage = this.usageHistory[0]?.timestamp;
+    if (earliestRequest === void 0 && earliestUsage === void 0) {
+      this.windowStart = now;
+    } else {
+      this.windowStart = Math.min(earliestRequest ?? Infinity, earliestUsage ?? Infinity);
     }
   }
 };
@@ -842,6 +870,7 @@ var TRANSIENT_RETRY_DELAYS_MS = [500, 1e3];
 var MAX_TRANSIENT_RETRIES = TRANSIENT_RETRY_DELAYS_MS.length;
 var MAX_PARSE_RETRIES = 1;
 var TIMEOUT_RETRY_MULTIPLIER = 1.5;
+var SIGKILL_GRACE_MS = 5e3;
 function isTransientError(code) {
   return TRANSIENT_ERROR_CODES.has(code);
 }
@@ -885,6 +914,42 @@ var SubprocessCliAdapter = class extends BaseCliAdapter {
   shouldOuterRetry(opts) {
     return opts.allowRetry && !this.transientRetry.enabled;
   }
+  /**
+   * Invokes the optional cleanup hook supplied by getCommand(). Sync
+   * throws are swallowed (warn-only) and async rejections are caught
+   * so cleanup failures never bubble up and mask the real subprocess
+   * result.
+   */
+  runSubprocessCleanup(cleanup) {
+    if (cleanup === void 0) return;
+    try {
+      const r = cleanup();
+      if (r instanceof Promise) {
+        r.catch((e) => {
+          this.logger.warn("Subprocess cleanup failed", { error: String(e) });
+        });
+      }
+    } catch (e) {
+      this.logger.warn("Subprocess cleanup threw", { error: String(e) });
+    }
+  }
+  /**
+   * #3026 finding 2: SIGTERM the child when the caller's AbortSignal
+   * aborts mid-execution. Listener auto-detaches on `'close'` so we
+   * don't leak across child lifetimes.
+   */
+  attachAbortSignal(child, signal, resolve) {
+    const onAbort = () => {
+      if (child.exitCode === null && child.signalCode === null) {
+        child.kill("SIGTERM");
+      }
+      resolve(err(this.createError("TIMEOUT", "Aborted by caller signal")));
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    child.once("close", () => {
+      signal.removeEventListener("abort", onAbort);
+    });
+  }
   /**
    * Executes a task via subprocess, with optional transient-error retry.
    * When `transientRetry.enabled` is true, transient errors (timeout,
@@ -892,15 +957,16 @@ var SubprocessCliAdapter = class extends BaseCliAdapter {
    * (500ms, 1000ms). Parse errors get max 1 retry (#1533); others get 2.
    */
   async executeTask(task, options) {
-    const result = await this.spawnSubprocess(task, options);
+    const requestId = generateHyphenId("cli-req", 8);
+    const result = await this.spawnSubprocess(task, options, requestId);
     if (result.ok || !this.transientRetry.enabled) return result;
     if (!isTransientError(result.error.code)) return result;
-    return this.retryTransient(task, options, result, 0);
+    return this.retryTransient(task, options, result, 0, requestId);
   }
   /**
    * Retries a transient error with bounded exponential backoff.
    */
-  async retryTransient(task, options, lastResult, attempt) {
+  async retryTransient(task, options, lastResult, attempt, requestId) {
     const isParseError = !lastResult.ok && lastResult.error.code === "PARSE_ERROR";
     const maxRetries = isParseError ? MAX_PARSE_RETRIES : MAX_TRANSIENT_RETRIES;
     if (attempt >= maxRetries) return lastResult;
@@ -908,40 +974,38 @@ var SubprocessCliAdapter = class extends BaseCliAdapter {
     const isTimeout = !lastResult.ok && lastResult.error.code === "TIMEOUT";
     subprocessLogger.debug("Retrying transient error", {
       cli: this.name,
+      requestId,
       attempt: attempt + 1,
       delayMs,
       errorCode: !lastResult.ok ? lastResult.error.code : void 0
     });
     await this.delay(delayMs);
     const retryOptions = isTimeout ? { ...options, timeoutMs: Math.round(options.timeoutMs * TIMEOUT_RETRY_MULTIPLIER) } : options;
-    const result = await this.spawnSubprocess(task, retryOptions);
+    const result = await this.spawnSubprocess(task, retryOptions, requestId);
     if (result.ok) return result;
     if (!isTransientError(result.error.code)) return result;
-    return this.retryTransient(task, retryOptions, result, attempt + 1);
+    return this.retryTransient(task, retryOptions, result, attempt + 1, requestId);
   }
   /**
    * Spawns a single subprocess execution (no retry).
-   */
-  spawnSubprocess(task, options) {
+   *
+   * `requestId` (#2963 site 3) correlates the timing-breakdown log emitted
+   * on subprocess close back to the parent `executeTask` invocation —
+   * essential when multiple subprocesses for the same CLI run concurrently
+   * (pipelines, votes) and the JSDoc's stated goal ("group by cli + provider
+   * + model and surface tail-latency outliers") requires a way to
+   * disambiguate which timing row belongs to which call.
+   */
+  spawnSubprocess(task, options, requestId) {
     const cmdConfig = this.getCommand(task);
     const startTime = getTimeProvider().now();
-    const cleanup = cmdConfig.cleanup;
-    const runCleanup = () => {
-      if (cleanup === void 0) return;
-      try {
-        const r = cleanup();
-        if (r instanceof Promise) {
-          r.catch((e) => {
-            this.logger.warn("Subprocess cleanup failed", { error: String(e) });
-          });
-        }
-      } catch (e) {
-        this.logger.warn("Subprocess cleanup threw", { error: String(e) });
-      }
-    };
+    const signal = options.signal;
+    if (signal?.aborted === true) {
+      return Promise.resolve(err(this.createError("TIMEOUT", "Aborted before spawn")));
+    }
     return new Promise((resolveOuter) => {
       const resolve = (result) => {
-        runCleanup();
+        this.runSubprocessCleanup(cmdConfig.cleanup);
         resolveOuter(result);
       };
       const childEnv = buildChildEnv(this.name);
@@ -950,13 +1014,17 @@ var SubprocessCliAdapter = class extends BaseCliAdapter {
         env: childEnv
       });
       const onProgress = options.onProgress;
-      const state = this.setupChildProcessHandlers(
+      const state = this.setupChildProcessHandlers({
         child,
         startTime,
-        options.timeoutMs,
+        timeoutMs: options.timeoutMs,
         resolve,
-        onProgress
-      );
+        requestId,
+        ...onProgress !== void 0 ? { onProgress } : {}
+      });
+      if (signal !== void 0) {
+        this.attachAbortSignal(child, signal, resolve);
+      }
       if (cmdConfig.stdin !== void 0) {
         child.stdin.write(cmdConfig.stdin);
       }
@@ -967,7 +1035,8 @@ var SubprocessCliAdapter = class extends BaseCliAdapter {
   /**
    * Sets up child process event handlers for output collection and error handling.
    */
-  setupChildProcessHandlers(child, startTime, timeoutMs, resolve, onProgress) {
+  setupChildProcessHandlers(args) {
+    const { child, startTime, timeoutMs, resolve, requestId, onProgress } = args;
     const state = {
       stdout: "",
       stderr: "",
@@ -988,17 +1057,55 @@ var SubprocessCliAdapter = class extends BaseCliAdapter {
     child.on("error", (error) => {
       resolveOnce(this.handleSubprocessError(error));
     });
-    const timeoutId = setTimeout(() => {
-      child.kill("SIGTERM");
-      resolveOnce(err(this.createError("TIMEOUT", "Execution timed out")));
-    }, timeoutMs);
+    const timers = this.scheduleTimeoutWithSigkillEscalation({
+      child,
+      timeoutMs,
+      requestId,
+      resolveOnce
+    });
     child.on("close", (code) => {
-      clearTimeout(timeoutId);
-      this.logTimingBreakdown(state, startTime, code);
+      clearTimeout(timers.timeoutId);
+      if (timers.sigkillTimerId !== void 0) clearTimeout(timers.sigkillTimerId);
+      this.logTimingBreakdown(state, startTime, code, requestId);
       resolveOnce(this.classifyCloseResult(code, state, startTime));
     });
     return state;
   }
+  /**
+   * Schedules the SIGTERM-on-timeout + SIGKILL-on-grace escalation
+   * (#3026 finding 1).
+   *
+   * The primary timer fires SIGTERM and resolves the caller's promise
+   * immediately so it doesn't wait on a hung child. The escalation
+   * timer (`SIGKILL_GRACE_MS` later) checks whether the child actually
+   * exited and force-reaps it with SIGKILL if not — preventing
+   * zombie accumulation when a child ignores SIGTERM (Node CLIs that
+   * install graceful-shutdown handlers can hang on a broken stream).
+   * Both timers are cleared from the `'close'` handler so a child
+   * that exits within the grace window doesn't see the second signal.
+   */
+  scheduleTimeoutWithSigkillEscalation(opts) {
+    const { child, timeoutMs, requestId, resolveOnce } = opts;
+    const timers = {
+      timeoutId: setTimeout(() => {
+        child.kill("SIGTERM");
+        resolveOnce(err(this.createError("TIMEOUT", "Execution timed out")));
+        timers.sigkillTimerId = setTimeout(() => {
+          if (child.exitCode === null && child.signalCode === null) {
+            this.logger.warn("Child ignored SIGTERM, escalating to SIGKILL", {
+              cli: this.name,
+              requestId,
+              sigkillGraceMs: SIGKILL_GRACE_MS
+            });
+            child.kill("SIGKILL");
+          }
+        }, SIGKILL_GRACE_MS);
+        timers.sigkillTimerId.unref();
+      }, timeoutMs),
+      sigkillTimerId: void 0
+    };
+    return timers;
+  }
   /** Attach stdout/stderr data handlers + capture first-byte time (#2472). */
   attachStdoutHandlers(child, state, onProgress) {
     if (child.stdout !== null) {
@@ -1029,13 +1136,14 @@ var SubprocessCliAdapter = class extends BaseCliAdapter {
    * Structured fields chosen so existing query_trace tooling can group by
    * cli + provider + model and surface tail-latency outliers.
    */
-  logTimingBreakdown(state, startTime, code) {
+  logTimingBreakdown(state, startTime, code, requestId) {
     const now = getTimeProvider().now();
     const totalMs = now - startTime;
     const spawnLatencyMs = state.firstByteTime === null ? null : state.firstByteTime - startTime;
     const streamingMs = state.firstByteTime === null ? null : now - state.firstByteTime;
     this.logger.info("Subprocess timing", {
       cli: this.name,
+      requestId,
       totalMs,
       spawnLatencyMs,
       streamingMs,
@@ -3183,4 +3291,4 @@ export {
   isCliAvailable,
   getAvailableClis
 };
-//# sourceMappingURL=chunk-ELRNVADA.js.map
+//# sourceMappingURL=chunk-RTAIMK6P.js.map