nexus-agents 2.99.0 → 2.100.0

package/dist/{chunk-WHFCVKAV.js → chunk-FU2AMASK.js}

@@ -8,10 +8,10 @@ import {
   checkSqlite,
   defaultConfig,
   initDataDirectories
-} from "./chunk-VPH2M5H7.js";
+} from "./chunk-BFN7RO3R.js";
 import {
   probeAllClis
-} from "./chunk-EM7NUGMG.js";
+} from "./chunk-P453545L.js";
 import {
   BUILT_IN_EXPERTS
 } from "./chunk-ZM4O442V.js";
@@ -1987,4 +1987,4 @@ export {
   setupCommand,
   setupCommandAsync
 };
-//# sourceMappingURL=chunk-WHFCVKAV.js.map
+//# sourceMappingURL=chunk-FU2AMASK.js.map

package/dist/{chunk-6IHEDRKI.js → chunk-H4LBBFCO.js}

@@ -71,7 +71,7 @@ var routerInitPromise = null;
 async function getRouter() {
   if (cachedRouter !== null) return cachedRouter;
   routerInitPromise ??= (async () => {
-    const { createAllAdapters } = await import("./factory-NJRJAZKK.js");
+    const { createAllAdapters } = await import("./factory-PVN7DDNZ.js");
     const { createCompositeRouter } = await import("./composite-router-JJNQIHX6.js");
     const adapters = createAllAdapters();
     if (adapters.size === 0) {
@@ -185,4 +185,4 @@ export {
   shutdownExpertBridge,
   executeExpert
 };
-//# sourceMappingURL=chunk-6IHEDRKI.js.map
+//# sourceMappingURL=chunk-H4LBBFCO.js.map

package/dist/{chunk-EM7NUGMG.js → chunk-P453545L.js}

@@ -753,7 +753,15 @@ var NOT_AUTH_PATTERNS = [
   // Token expiry/revocation as a standalone signal, not co-occurring with
   // "unauthorized" — some upstreams emit "Token expired. Please re-auth."
   // without the unauthorized keyword.
-  /token (?:expired|revoked)/i
+  /token (?:expired|revoked)/i,
+  // #3350: OAuth refresh-token rotation. The codex CLI emits "Your access
+  // token could not be refreshed because your refresh token was already used.
+  // Please log out and sign in again." This previously fell through to a raw
+  // fail-closed voter error with no `<cli> login` signal for the operator.
+  /refresh token .*already used/i,
+  /could not be refreshed/i,
+  /log ?out and sign in/i,
+  /sign in again/i
 ];
 function classifyMessage(message) {
   for (const re of NOT_AUTH_PATTERNS) {
@@ -761,6 +769,16 @@ function classifyMessage(message) {
   }
   return { code: "EXECUTION_ERROR", auth: false };
 }
+function resolveCliName(cliName) {
+  const bare = cliName.startsWith("cli-") ? cliName.slice("cli-".length) : cliName;
+  return bare in LOGIN_HINTS ? bare : null;
+}
+function authRemediation(message, cliName) {
+  if (!classifyMessage(message).auth) return null;
+  const cli = resolveCliName(cliName);
+  if (cli === null) return null;
+  return `Re-authenticate: run \`${LOGIN_HINTS[cli]}\` (the ${cli} CLI's stored OAuth token is stale).`;
+}
 function parseCliErrorEnvelope(stdout, cliName) {
   const trimmed = stdout.trim();
   if (trimmed === "" || !trimmed.startsWith("{") && !trimmed.startsWith("[")) return null;
@@ -3286,6 +3304,7 @@ export {
   executeCliRetryLoop,
   BaseCliAdapter,
   sanitizeOutput,
+  authRemediation,
   SubprocessCliAdapter,
   asRecord,
   isRecord,
@@ -3308,4 +3327,4 @@ export {
   isCliAvailable,
   getAvailableClis
 };
-//# sourceMappingURL=chunk-EM7NUGMG.js.map
+//# sourceMappingURL=chunk-P453545L.js.map