nexus-agents 2.92.5 → 2.94.0

package/dist/{chunk-ZYYU26YH.js → chunk-XBPFVWA2.js}

@@ -1,7 +1,7 @@
 import {
   getRandomProvider,
   getTimeProvider
-} from "./chunk-L5BXCSMP.js";
+} from "./chunk-OT6V5ROA.js";
 
 // src/utils/id-utils.ts
 import { randomUUID } from "crypto";
@@ -24,4 +24,4 @@ export {
   generateHyphenId,
   generateUUID
 };
-//# sourceMappingURL=chunk-ZYYU26YH.js.map
+//# sourceMappingURL=chunk-XBPFVWA2.js.map

package/dist/{chunk-SIICMKBA.js → chunk-YDXGYKZJ.js}

@@ -2,7 +2,7 @@ import {
   ConfigError,
   err,
   ok
-} from "./chunk-L5BXCSMP.js";
+} from "./chunk-OT6V5ROA.js";
 
 // src/adapters/sdk/types.ts
 var PROVIDER_ENV_KEYS = {
@@ -117,4 +117,4 @@ export {
   CUSTOM_API_ALLOW_PRIVATE_ENV,
   validateCustomApiBaseUrl
 };
-//# sourceMappingURL=chunk-SIICMKBA.js.map
+//# sourceMappingURL=chunk-YDXGYKZJ.js.map

package/dist/chunk-YDXGYKZJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/adapters/sdk/types.ts","../src/adapters/sdk/custom-api-validation.ts"],"sourcesContent":["/**\n * nexus-agents/adapters/sdk - Shared Types\n *\n * Type definitions for AI SDK adapter layer.\n *\n * @module adapters/sdk/types\n * (Source: Issue #1123 — AI SDK provider layer)\n */\n\n/**\n * Supported AI SDK provider identifiers.\n *\n * `custom-openai` is for OpenAI-compatible gateways (multi-vendor proxies,\n * self-hosted LLM servers, corporate model gateways) — uses the same\n * @ai-sdk/openai package but with a configurable `baseURL`.\n */\nexport type SdkProviderId = 'anthropic' | 'openai' | 'google' | 'custom-openai';\n\n/**\n * Configuration for creating an AI SDK adapter.\n */\nexport interface SdkAdapterConfig {\n  /** Provider identifier */\n  providerId: SdkProviderId;\n  /** Model to use (e.g., 'claude-sonnet-4-6', 'gpt-4o') */\n  modelId: string;\n  /** API key (falls back to environment variable) */\n  apiKey?: string;\n  /**\n   * Base URL for OpenAI-compatible gateways. Required when\n   * `providerId === 'custom-openai'`, ignored otherwise. Falls back to\n   * the `NEXUS_CUSTOM_API_BASE_URL` environment variable.\n   */\n  baseUrl?: string;\n  /** Request timeout in milliseconds */\n  timeout?: number;\n  /** Maximum retries on transient failures */\n  maxRetries?: number;\n}\n\n/**\n * Maps provider IDs to their environment variable names.\n */\nexport const PROVIDER_ENV_KEYS: Record<SdkProviderId, string> = {\n  anthropic: 'ANTHROPIC_API_KEY',\n  openai: 'OPENAI_API_KEY',\n  google: 'GOOGLE_AI_API_KEY',\n  'custom-openai': 'NEXUS_CUSTOM_API_KEY',\n};\n\n/**\n * Environment variable name for the custom gateway base URL.\n * Keep in sync with `SdkAdapterConfig.baseUrl`.\n */\nexport const CUSTOM_API_BASE_URL_ENV = 'NEXUS_CUSTOM_API_BASE_URL';\n\n/**\n * Escape hatch: set to `1`/`true` to allow the custom gateway base URL to\n * resolve to a loopback or RFC 1918 private address. Default is DENY —\n * SSRF defense. Only disable this when you know the gateway runs on a\n * trusted internal host and you accept the risk.\n */\nexport const CUSTOM_API_ALLOW_PRIVATE_ENV = 'NEXUS_CUSTOM_API_ALLOW_PRIVATE';\n","/**\n * Validation for the `custom-openai` SDK adapter's gateway URL.\n *\n * The base URL is user-provided, so without validation the adapter becomes\n * an SSRF vector: a malicious prompt that reshaped env vars, or a typo in\n * the config, could point nexus-agents at `http://169.254.169.254/` (AWS\n * metadata) or `http://localhost:5432/` (internal services). This module\n * rejects such URLs unless the user explicitly opts in via\n * `NEXUS_CUSTOM_API_ALLOW_PRIVATE=1`.\n *\n * Called out in the #2119 consensus vote by the Security Engineer role.\n *\n * @module adapters/sdk/custom-api-validation\n */\n\nimport { isIPv4, isIPv6 } from 'node:net';\nimport { ConfigError, ok, err, type Result } from '../../core/index.js';\nimport { CUSTOM_API_ALLOW_PRIVATE_ENV } from './types.js';\n\n/**\n * Why a given URL was rejected. Machine-readable so error messages can\n * distinguish root causes in downstream tooling.\n */\nexport type BaseUrlRejectionReason =\n  | 'empty'\n  | 'not_a_url'\n  | 'not_http_https'\n  | 'loopback'\n  | 'link_local'\n  | 'private_range'\n  | 'reserved';\n\ninterface RejectionDetail {\n  readonly reason: BaseUrlRejectionReason;\n  readonly message: string;\n}\n\n/**\n * Validates a user-provided custom-gateway base URL. Returns the URL as an\n * `ok` Result if it passes, or a `ConfigError` with a machine-readable\n * reason if it fails.\n *\n * Pass `{ allowPrivate: true }` (or set the env var) to bypass the SSRF\n * checks — use this only when the gateway is on a trusted internal host\n * and you accept the risk.\n */\nexport function validateCustomApiBaseUrl(\n  raw: string | undefined,\n  opts: { readonly allowPrivate?: boolean } = {}\n): Result<URL, ConfigError> {\n  if (raw === undefined || raw.trim() === '') {\n    return err(\n      new ConfigError(\n        'Custom API base URL is required but missing. Set NEXUS_CUSTOM_API_BASE_URL or pass `baseUrl` in config.'\n      )\n    );\n  }\n\n  let url: URL;\n  try {\n    url = new URL(raw);\n  } catch {\n    return err(new ConfigError(`Custom API base URL is not a valid URL: ${raw}`));\n  }\n\n  if (url.protocol !== 'http:' && url.protocol !== 'https:') {\n    return err(\n      new ConfigError(`Custom API base URL must use http or https, got \"${url.protocol}\" in ${raw}`)\n    );\n  }\n\n  const allowPrivate = opts.allowPrivate === true || resolveAllowPrivateFromEnv();\n  if (!allowPrivate) {\n    const rejection = classifyPrivateHost(url.hostname);\n    if (rejection !== null) {\n      return err(\n        new ConfigError(\n          `Custom API base URL rejected (SSRF guard, reason=\"${rejection.reason}\"): ${rejection.message}. ` +\n            `Set ${CUSTOM_API_ALLOW_PRIVATE_ENV}=1 to bypass if the gateway runs on a trusted internal host.`\n        )\n      );\n    }\n  }\n\n  return ok(url);\n}\n\nfunction resolveAllowPrivateFromEnv(): boolean {\n  // Deliberately strict (case-sensitive, not parseBoolEnv): this disables an\n  // SSRF guard, so we don't want extra case variants (e.g. `TRUE`) to loosen\n  // the control. Fail-closed on anything but exact `1`/`true` (#3297).\n  const v = process.env[CUSTOM_API_ALLOW_PRIVATE_ENV];\n  return v === '1' || v === 'true';\n}\n\n/**\n * Returns a rejection reason if the hostname resolves (by string form) to\n * a loopback, link-local, or RFC 1918 private address; `null` otherwise.\n *\n * Note: this is a string-level check. It does NOT perform DNS resolution,\n * so a public DNS name that secretly resolves to a private IP will pass.\n * Callers who need that level of defense should add a runtime connect\n * check and validate the socket peer address.\n */\nfunction classifyPrivateHost(hostname: string): RejectionDetail | null {\n  // URL.hostname wraps IPv6 literals in brackets (e.g. \"[::1]\"); strip them\n  // before the net-module checks, which expect bare forms.\n  const stripped =\n    hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;\n  const normalized = stripped.toLowerCase();\n\n  // Literal IPv4 loopback or private-range address\n  if (isIPv4(normalized)) {\n    return classifyIPv4(normalized);\n  }\n\n  // Literal IPv6 loopback (::1), link-local (fe80::/10), unique-local (fc00::/7)\n  if (isIPv6(normalized)) {\n    return classifyIPv6(normalized);\n  }\n\n  // Hostname literals that resolve to loopback without needing DNS\n  if (\n    normalized === 'localhost' ||\n    normalized.endsWith('.localhost') ||\n    normalized.endsWith('.local') // mDNS\n  ) {\n    return {\n      reason: 'loopback',\n      message: `hostname \"${hostname}\" resolves to loopback/mDNS`,\n    };\n  }\n\n  return null;\n}\n\n/** IPv4 ranges the SSRF guard rejects, in order of specificity. */\nconst IPV4_RULES: ReadonlyArray<{\n  readonly match: (a: number, b: number) => boolean;\n  readonly reason: BaseUrlRejectionReason;\n  readonly label: string;\n}> = [\n  { match: (a) => a === 127, reason: 'loopback', label: 'IPv4 loopback' },\n  { match: (a) => a === 10, reason: 'private_range', label: 'IPv4 private (10/8)' },\n  {\n    match: (a, b) => a === 172 && b >= 16 && b <= 31,\n    reason: 'private_range',\n    label: 'IPv4 private (172.16/12)',\n  },\n  {\n    match: (a, b) => a === 192 && b === 168,\n    reason: 'private_range',\n    label: 'IPv4 private (192.168/16)',\n  },\n  {\n    match: (a, b) => a === 169 && b === 254,\n    reason: 'link_local',\n    label: 'IPv4 link-local (169.254/16 — AWS IMDS)',\n  },\n  { match: (a) => a === 0, reason: 'reserved', label: 'IPv4 reserved (0/8)' },\n];\n\nfunction classifyIPv4(ip: string): RejectionDetail | null {\n  const parts = ip.split('.').map((p) => Number.parseInt(p, 10));\n  if (parts.length !== 4 || parts.some((n) => Number.isNaN(n))) return null;\n  const [a, b] = parts as [number, number, number, number];\n  for (const rule of IPV4_RULES) {\n    if (rule.match(a, b)) {\n      return { reason: rule.reason, message: `${rule.label} (${ip})` };\n    }\n  }\n  return null;\n}\n\nfunction classifyIPv6(ip: string): RejectionDetail | null {\n  const lower = ip.toLowerCase();\n  if (lower === '::1') return { reason: 'loopback', message: `IPv6 loopback (${ip})` };\n  if (lower.startsWith('fe80:'))\n    return { reason: 'link_local', message: `IPv6 link-local (${ip})` };\n  // Unique-local: fc00::/7 → first byte has high bit set and second-high bit set\n  if (/^fc|^fd/.test(lower)) {\n    return { reason: 'private_range', message: `IPv6 unique-local (${ip}, fc00::/7)` };\n  }\n  return null;\n}\n"],"mappings":";;;;;;;AA2CO,IAAM,oBAAmD;AAAA,EAC9D,WAAW;AAAA,EACX,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,iBAAiB;AACnB;AAMO,IAAM,0BAA0B;AAQhC,IAAM,+BAA+B;;;AC/C5C,SAAS,QAAQ,cAAc;AA+BxB,SAAS,yBACd,KACA,OAA4C,CAAC,GACnB;AAC1B,MAAI,QAAQ,UAAa,IAAI,KAAK,MAAM,IAAI;AAC1C,WAAO;AAAA,MACL,IAAI;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,GAAG;AAAA,EACnB,QAAQ;AACN,WAAO,IAAI,IAAI,YAAY,2CAA2C,GAAG,EAAE,CAAC;AAAA,EAC9E;AAEA,MAAI,IAAI,aAAa,WAAW,IAAI,aAAa,UAAU;AACzD,WAAO;AAAA,MACL,IAAI,YAAY,oDAAoD,IAAI,QAAQ,QAAQ,GAAG,EAAE;AAAA,IAC/F;AAAA,EACF;AAEA,QAAM,eAAe,KAAK,iBAAiB,QAAQ,2BAA2B;AAC9E,MAAI,CAAC,cAAc;AACjB,UAAM,YAAY,oBAAoB,IAAI,QAAQ;AAClD,QAAI,cAAc,MAAM;AACtB,aAAO;AAAA,QACL,IAAI;AAAA,UACF,qDAAqD,UAAU,MAAM,OAAO,UAAU,OAAO,SACpF,4BAA4B;AAAA,QACvC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO,GAAG,GAAG;AACf;AAEA,SAAS,6BAAsC;AAI7C,QAAM,IAAI,QAAQ,IAAI,4BAA4B;AAClD,SAAO,MAAM,OAAO,MAAM;AAC5B;AAWA,SAAS,oBAAoB,UAA0C;AAGrE,QAAM,WACJ,SAAS,WAAW,GAAG,KAAK,SAAS,SAAS,GAAG,IAAI,SAAS,MAAM,GAAG,EAAE,IAAI;AAC/E,QAAM,aAAa,SAAS,YAAY;AAGxC,MAAI,OAAO,UAAU,GAAG;AACtB,WAAO,aAAa,UAAU;AAAA,EAChC;AAGA,MAAI,OAAO,UAAU,GAAG;AACtB,WAAO,aAAa,UAAU;AAAA,EAChC;AAGA,MACE,eAAe,eACf,WAAW,SAAS,YAAY,KAChC,WAAW,SAAS,QAAQ,GAC5B;AACA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,SAAS,aAAa,QAAQ;AAAA,IAChC;AAAA,EACF;AAEA,SAAO;AACT;AAGA,IAAM,aAID;AAAA,EACH,EAAE,OAAO,CAAC,MAAM,MAAM,KAAK,QAAQ,YAAY,OAAO,gBAAgB;AAAA,EACtE,EAAE,OAAO,CAAC,MAAM,MAAM,IAAI,QAAQ,iBAAiB,OAAO,sBAAsB;AAAA,EAChF;AAAA,IACE,OAAO,CAAC,GAAG,MAAM,MAAM,OAAO,KAAK,MAAM,KAAK;AAAA,IAC9C,QAAQ;AAAA,IACR,OAAO;AAAA,EACT;AAAA,EACA;AAAA,IACE,OAAO,CAAC,GAAG,MAAM,MAAM,OAAO,MAAM;AAAA,IACpC,QAAQ;AAAA,IACR,OAAO;AAAA,EACT;AAAA,EACA;AAAA,IACE,OAAO,CAAC,GAAG,MAAM,MAAM,OAAO,MAAM;AAAA,IACpC,QAAQ;AAAA,IACR,OAAO;AAAA,EACT;AAAA,EACA,EAAE,OAAO,CAAC,MAAM,MAAM,GAAG,QAAQ,YAAY,OAAO,sBAAsB;AAC5E;AAEA,SAAS,aAAa,IAAoC;AACxD,QAAM,QAAQ,GAAG,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,OAAO,SAAS,GAAG,EAAE,CAAC;AAC7D,MAAI,MAAM,WAAW,KAAK,MAAM,KAAK,CAAC,MAAM,OAAO,MAAM,CAAC,CAAC,EAAG,QAAO;AACrE,QAAM,CAAC,GAAG,CAAC,IAAI;AACf,aAAW,QAAQ,YAAY;AAC7B,QAAI,KAAK,MAAM,GAAG,CAAC,GAAG;AACpB,aAAO,EAAE,QAAQ,KAAK,QAAQ,SAAS,GAAG,KAAK,KAAK,KAAK,EAAE,IAAI;AAAA,IACjE;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,aAAa,IAAoC;AACxD,QAAM,QAAQ,GAAG,YAAY;AAC7B,MAAI,UAAU,MAAO,QAAO,EAAE,QAAQ,YAAY,SAAS,kBAAkB,EAAE,IAAI;AACnF,MAAI,MAAM,WAAW,OAAO;AAC1B,WAAO,EAAE,QAAQ,cAAc,SAAS,oBAAoB,EAAE,IAAI;AAEpE,MAAI,UAAU,KAAK,KAAK,GAAG;AACzB,WAAO,EAAE,QAAQ,iBAAiB,SAAS,sBAAsB,EAAE,cAAc;AAAA,EACnF;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-3XC5LFWH.js → chunk-ZY2EMD72.js}

@@ -1,6 +1,6 @@
 import {
   runConfigInitSync
-} from "./chunk-WXEMTPML.js";
+} from "./chunk-ROAANOOB.js";
 import {
   VERSION,
   checkApiKeys,
@@ -8,10 +8,10 @@ import {
   checkSqlite,
   defaultConfig,
   initDataDirectories
-} from "./chunk-QXGLZETS.js";
+} from "./chunk-77JUKFTG.js";
 import {
   probeAllClis
-} from "./chunk-DNSBKQ7I.js";
+} from "./chunk-4QESFYGV.js";
 import {
   BUILT_IN_EXPERTS
 } from "./chunk-ZM4O442V.js";
@@ -25,7 +25,7 @@ import {
   getErrorMessage,
   getTimeProvider,
   symbols
-} from "./chunk-L5BXCSMP.js";
+} from "./chunk-OT6V5ROA.js";
 import {
   ensureGitignored,
   findRepoRoot
@@ -1987,4 +1987,4 @@ export {
   setupCommand,
   setupCommandAsync
 };
-//# sourceMappingURL=chunk-3XC5LFWH.js.map
+//# sourceMappingURL=chunk-ZY2EMD72.js.map

package/dist/{cli-circuit-breaker-HFSOBCPK.js → cli-circuit-breaker-BAERQZ3H.js}

@@ -1,13 +1,13 @@
 import {
   CliCircuitBreakerIntegration,
   createCliCircuitBreakerIntegration
-} from "./chunk-EI2E43HI.js";
-import "./chunk-MBK6P4VV.js";
-import "./chunk-L5BXCSMP.js";
+} from "./chunk-EDPDH5YT.js";
+import "./chunk-24WC4XO2.js";
+import "./chunk-OT6V5ROA.js";
 import "./chunk-CH7QIDHQ.js";
 import "./chunk-PR4QN5HX.js";
 export {
   CliCircuitBreakerIntegration,
   createCliCircuitBreakerIntegration
 };
-//# sourceMappingURL=cli-circuit-breaker-HFSOBCPK.js.map
+//# sourceMappingURL=cli-circuit-breaker-BAERQZ3H.js.map

package/dist/cli.js

@@ -13,19 +13,19 @@ import {
   generateSummary,
   parseFindings,
   sumFindings
-} from "./chunk-3TU3RJNK.js";
-import "./chunk-QADQ4LN4.js";
+} from "./chunk-5ZB3MTA7.js";
+import "./chunk-R2NKJPUX.js";
 import {
   buildOpenAICompatAdapters,
   loadUsageEvents,
   readOpenAICompatEnv,
   rollupByModel
-} from "./chunk-QQMYKFG7.js";
+} from "./chunk-5B4VLSMP.js";
 import {
   setupCommandAsync,
   verifyCommand
-} from "./chunk-3XC5LFWH.js";
-import "./chunk-WXEMTPML.js";
+} from "./chunk-ZY2EMD72.js";
+import "./chunk-ROAANOOB.js";
 import {
   AuthHandler,
   DEFAULT_EXPERTS,
@@ -158,25 +158,29 @@ import {
   runImprovementReview,
   saveSourcesRegistry,
   setGlobalToolRateLimiterFactory,
+  shutdownFailoverSignals,
   shutdownFeedbackSubscriber,
+  shutdownSwarmHealthSignals,
+  startFailoverSignals,
   startFeedbackSubscriber,
+  startSwarmHealthSignals,
   validateArgs,
   validateCommand,
   validateWorkflow,
   wrapInMarkdownFence
-} from "./chunk-KTJUMU2A.js";
+} from "./chunk-UC3PVIN4.js";
 import {
   resolveToken
-} from "./chunk-DQEREDUW.js";
+} from "./chunk-OSSGG7KW.js";
 import {
   CATEGORY_DISPLAY_NAMES,
   DEFAULT_PR_REVIEW_CONFIG
 } from "./chunk-OK6U5N5Y.js";
-import "./chunk-TOQJ3UN5.js";
-import "./chunk-EI2E43HI.js";
+import "./chunk-Q3NUA7CW.js";
+import "./chunk-EDPDH5YT.js";
 import {
   shutdownExpertBridge
-} from "./chunk-G55LVPNH.js";
+} from "./chunk-2YMRRZRM.js";
 import {
   DEFAULT_VOTE_TIMEOUT_MS,
   ErrorPolicySchema,
@@ -194,34 +198,34 @@ import {
   toolSuccessStructured,
   warnIfSimulatedOutsideTests,
   wrapToolWithTimeout
-} from "./chunk-NYWZI46K.js";
-import "./chunk-DSERRMPX.js";
-import "./chunk-SIICMKBA.js";
+} from "./chunk-TNBWHOPY.js";
+import "./chunk-L7I55FAN.js";
+import "./chunk-YDXGYKZJ.js";
 import {
   loadPapersRegistry,
   loadTechniquesRegistry,
   savePapersRegistry,
   synthesizeResearch
-} from "./chunk-P646QQYW.js";
+} from "./chunk-G5EBHQ2L.js";
 import {
   classifyTrust,
   createFullGitHubProvider,
   evaluatePolicy,
   parsePRUrl
-} from "./chunk-BG4WK4UP.js";
-import "./chunk-YQAS2EGR.js";
+} from "./chunk-76535ZNP.js";
+import "./chunk-EJR6U67L.js";
 import {
   ReputationCache,
   sanitizeInput
-} from "./chunk-VBIAMMZZ.js";
-import "./chunk-2QJJYCPD.js";
+} from "./chunk-EB43BGAR.js";
+import "./chunk-FUGPKYEJ.js";
 import "./chunk-HFOQKCD2.js";
 import "./chunk-3ACDP4E6.js";
-import "./chunk-VU54VB6K.js";
+import "./chunk-OKGHHCS5.js";
 import {
   MemoryError,
   shutdownToolMemory
-} from "./chunk-FL3AXIUL.js";
+} from "./chunk-63OGXDHS.js";
 import {
   CustomExpertDefinitionSchema,
   DATA_SUBDIRECTORIES,
@@ -240,12 +244,12 @@ import {
   loadConfig,
   runDoctor,
   validateNexusEnv
-} from "./chunk-QXGLZETS.js";
-import "./chunk-YJUHVQSG.js";
-import "./chunk-U4RLBLNO.js";
+} from "./chunk-77JUKFTG.js";
+import "./chunk-GMZDRTVJ.js";
+import "./chunk-KSJPDQSG.js";
 import {
   DEFAULTS
-} from "./chunk-PIDABDFE.js";
+} from "./chunk-43UDRX3N.js";
 import "./chunk-NUBSJGQZ.js";
 import {
   capitalize,
@@ -257,12 +261,12 @@ import {
   getAvailableClis,
   isRecord,
   probeAllClis
-} from "./chunk-DNSBKQ7I.js";
-import "./chunk-MBK6P4VV.js";
-import "./chunk-ZYYU26YH.js";
+} from "./chunk-4QESFYGV.js";
+import "./chunk-24WC4XO2.js";
+import "./chunk-XBPFVWA2.js";
 import "./chunk-ZM4O442V.js";
 import "./chunk-PQHVC4BD.js";
-import "./chunk-OXLXVSN3.js";
+import "./chunk-LCLVSNST.js";
 import {
   API_TIMEOUTS,
   AgentCapability,
@@ -314,9 +318,11 @@ import {
   getPipelineEventBus,
   getRandomProvider,
   getTimeProvider,
+  getTuneAdjustmentStore,
   logger,
   lookupInTreeCapability,
   ok,
+  parseBoolEnv,
   parseTierOverrides,
   resetOutcomeStore,
   runWarmUp,
@@ -330,7 +336,7 @@ import {
   validateTimeout,
   writeEmptyLine,
   writeLine
-} from "./chunk-L5BXCSMP.js";
+} from "./chunk-OT6V5ROA.js";
 import {
   applyPortableMode,
   detectSandbox,
@@ -3109,7 +3115,7 @@ ${file.patch}
         violations: policyResult.violations
       });
     }
-    const { formatReviewComment: formatReviewComment2 } = await import("./pr-reviewer-helpers-WGPLUXPU.js");
+    const { formatReviewComment: formatReviewComment2 } = await import("./pr-reviewer-helpers-JLWEQIN6.js");
     const body = formatReviewComment2(result);
     const postResult = await provider.createReview(pr.prNumber, body, result.decision);
     if (!postResult.ok) {
@@ -12419,8 +12425,7 @@ var HookEnvVars = {
   NEXUS_DISABLE_METRICS: "NEXUS_DISABLE_METRICS"
 };
 function isFeatureDisabled(envVar) {
-  const value = process.env[envVar];
-  return value === "1" || value === "true";
+  return parseBoolEnv(envVar, false);
 }
 function getDbPathFromEnv() {
   return process.env[HookEnvVars.NEXUS_SESSIONS_DB] ?? getDefaultDbPath2();
@@ -17426,6 +17431,92 @@ function runStpaSafetyAnalysis(logger18, failOnHighSeverity) {
   }
 }
 
+// src/pipeline/tune-stage.ts
+var defaultLogger = createLogger({ component: "TuneStage" });
+var TUNE_ENFORCE_ENV = "NEXUS_TUNE_ENFORCE";
+var TUNE_ENFORCE_DEMOTION = 0.15;
+var TUNE_SIGNAL_TYPES = [
+  "signal.fitness_declined",
+  "signal.swarm_unhealthy",
+  "signal.vote_rejected"
+];
+function intendedActionFor(event) {
+  switch (event.type) {
+    case "signal.fitness_declined":
+      return {
+        kind: "flag_tech_debt",
+        detail: `fitness ${String(event.score)} below floor ${String(event.floor)}${event.dimension !== void 0 ? ` (dimension: ${event.dimension})` : ""} \u2014 would surface a tech-debt remediation signal`,
+        signal: event.type
+      };
+    case "signal.swarm_unhealthy":
+      return {
+        kind: "downweight_agent",
+        detail: `agent ${event.agentId} unhealthy (${event.reason}) \u2014 would downweight it for routing (bounded, never zeroed)`,
+        signal: event.type
+      };
+    case "signal.vote_rejected":
+      return {
+        kind: "record_rejection",
+        detail: `proposal ${event.proposalId} rejected at ${String(event.approvalPercentage)}% \u2014 would record a rejection signal for review`,
+        signal: event.type
+      };
+    default:
+      return void 0;
+  }
+}
+function createTuneStage(bus, options = {}) {
+  const enabled = options.enabled ?? false;
+  const log = options.logger ?? defaultLogger;
+  return bus.subscribe({ type: [...TUNE_SIGNAL_TYPES] }, (event) => {
+    try {
+      const action = intendedActionFor(event);
+      if (action === void 0) return;
+      if (enabled) {
+        if (event.type === "signal.swarm_unhealthy") {
+          const adjustment = getTuneAdjustmentStore().demote(
+            event.agentId,
+            TUNE_ENFORCE_DEMOTION,
+            `swarm_unhealthy: ${event.reason}`
+          );
+          log.info("TuneStage (enforce) \u2014 applied bounded routing demotion", {
+            kind: action.kind,
+            signal: action.signal,
+            agentId: event.agentId,
+            reason: event.reason,
+            multiplier: adjustment?.multiplier
+          });
+          return;
+        }
+        log.info("TuneStage (enforce) \u2014 non-routing action, shadow-only", {
+          kind: action.kind,
+          signal: action.signal,
+          detail: action.detail
+        });
+        return;
+      }
+      log.info("TuneStage (shadow) \u2014 intended action", {
+        kind: action.kind,
+        signal: action.signal,
+        detail: action.detail
+      });
+    } catch (e) {
+      log.warn("TuneStage handler error", { error: getErrorMessage(e) });
+    }
+  });
+}
+var cachedTuneUnsubscribe = null;
+function startTuneStage(bus, options) {
+  if (cachedTuneUnsubscribe !== null) return;
+  const enabled = options?.enabled ?? parseBoolEnv(TUNE_ENFORCE_ENV, false);
+  cachedTuneUnsubscribe = createTuneStage(bus, { ...options, enabled });
+}
+function shutdownTuneStage() {
+  if (cachedTuneUnsubscribe !== null) {
+    cachedTuneUnsubscribe();
+    cachedTuneUnsubscribe = null;
+  }
+}
+
 // src/mcp/gateway/upstream-client.ts
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
@@ -17951,6 +18042,9 @@ function initV2PipelineSubsystems(logger18) {
   const pipelineEventBus = getPipelineEventBus();
   const bridge = createEventBusBridge({ source: pipelineEventBus });
   startFeedbackSubscriber(pipelineEventBus, getOutcomeStore());
+  startTuneStage(pipelineEventBus);
+  startSwarmHealthSignals(getSwarmObserver(), pipelineEventBus);
+  startFailoverSignals({ pipelineBus: pipelineEventBus });
   const policyEngine = createDefaultPolicyEngine();
   const v2Config = resolveV2Config();
   logger18.info("V2 Pipeline OS initialized", {
@@ -19276,7 +19370,7 @@ function adaptConfigToLibrary(config) {
 }
 function createBeliefPromoter() {
   return async (event) => {
-    const { getToolMemory } = await import("./tool-memory-AX5G67J6.js");
+    const { getToolMemory } = await import("./tool-memory-YWX4FTIQ.js");
     const tm = getToolMemory();
     await tm.recordBelief(
       `skill:${event.name}`,
@@ -19590,6 +19684,9 @@ function createShutdownCleanup(options) {
     shutdownToolMemory();
     await shutdownExpertBridge();
     shutdownFeedbackSubscriber();
+    shutdownTuneStage();
+    shutdownSwarmHealthSignals();
+    shutdownFailoverSignals();
     const closeResult = await closeServer(server, serverLogger);
     if (!closeResult.ok) {
       throw new Error(closeResult.error.message);
@@ -20139,7 +20236,7 @@ async function handleResearchCommand(args) {
   }
 }
 async function handleRegistryCommand(args) {
-  const { registryCommand, isValidRegistrySubcommand, formatRegistryUsage } = await import("./registry-command-CZZM5SF2.js");
+  const { registryCommand, isValidRegistrySubcommand, formatRegistryUsage } = await import("./registry-command-FYVOMCBG.js");
   const subcommand = args.subcommand;
   if (!isValidRegistrySubcommand(subcommand)) {
     process.stdout.write(`${formatRegistryUsage()}
@@ -20187,7 +20284,7 @@ async function handleVerifyCommand(args) {
 async function handleDoctorCommand(args) {
   const exitCode = await doctorCommand({ fix: args.options.fix });
   if (args.options.deep) {
-    const { runDeepDiagnostics: runDeepDiagnostics2, formatDeepDiagnostics: formatDeepDiagnostics2 } = await import("./doctor-deep-OVGRBG3Z.js");
+    const { runDeepDiagnostics: runDeepDiagnostics2, formatDeepDiagnostics: formatDeepDiagnostics2 } = await import("./doctor-deep-VFBQ7TY4.js");
     const diag = runDeepDiagnostics2();
     process.stdout.write(formatDeepDiagnostics2(diag) + "\n");
   }
@@ -20231,7 +20328,7 @@ async function handleInitCommand(args) {
   process.exit(result.success ? EXIT_CODES.SUCCESS : EXIT_CODES.SERVER_START_FAILED);
 }
 async function runInitOpencodeFlow(args) {
-  const { runInitOpencode } = await import("./init-opencode-2ZBDJILW.js");
+  const { runInitOpencode } = await import("./init-opencode-Y6XKR6WS.js");
   const opencodePath = args.options.opencode;
   if (opencodePath === void 0 || opencodePath === "") {
     process.stderr.write("Error: --opencode requires a path argument.\n");
@@ -20258,7 +20355,7 @@ async function runInitOpencodeFlow(args) {
   process.exit(EXIT_CODES.SUCCESS);
 }
 async function renderOpencodeValidate(opencodePath) {
-  const { runOpencodeValidate } = await import("./init-opencode-2ZBDJILW.js");
+  const { runOpencodeValidate } = await import("./init-opencode-Y6XKR6WS.js");
   const result = await runOpencodeValidate(opencodePath);
   if (!result.ok) {
     process.stderr.write(`init --opencode --validate: ${result.reason ?? "failed"}
@@ -20298,7 +20395,7 @@ async function handleSetupCommandAsync(args) {
   process.exit(exitCode === 0 ? EXIT_CODES.SUCCESS : EXIT_CODES.SERVER_START_FAILED);
 }
 async function runCustomApiSetup(args) {
-  const { configureCustomApi } = await import("./setup-custom-api-GXHPYLDR.js");
+  const { configureCustomApi } = await import("./setup-custom-api-3M7CU3TF.js");
   const baseUrl = args.options.customApi;
   if (baseUrl === void 0) return EXIT_CODES.SERVER_START_FAILED;
   const input = {