nexus-agents 3.2.2 → 3.2.3

package/dist/{chunk-ENZ3IWEM.js → chunk-NF4P6SI6.js}

@@ -4,7 +4,7 @@ import {
 import {
   createLogger,
   getTimeProvider
-} from "./chunk-ATNHVLKJ.js";
+} from "./chunk-OYPTT7VJ.js";
 
 // src/mcp/tools/scanner-registry-fetcher.ts
 import { z } from "zod";
@@ -721,4 +721,4 @@ export {
   generateSecurityPlan,
   buildPlanFromAnalysis
 };
-//# sourceMappingURL=chunk-ENZ3IWEM.js.map
+//# sourceMappingURL=chunk-NF4P6SI6.js.map

package/dist/{chunk-QRZPGTZN.js → chunk-NLRQ2NL3.js}

@@ -4,7 +4,7 @@ import {
   getErrorMessage,
   getTimeProvider,
   ok
-} from "./chunk-ATNHVLKJ.js";
+} from "./chunk-OYPTT7VJ.js";
 
 // src/context/session-memory.ts
 import * as fs from "fs";
@@ -352,4 +352,4 @@ export {
   SessionMemory,
   createSessionMemory
 };
-//# sourceMappingURL=chunk-QRZPGTZN.js.map
+//# sourceMappingURL=chunk-NLRQ2NL3.js.map

package/dist/{chunk-RHO52DBX.js → chunk-OQAV3JMV.js}

@@ -3,7 +3,7 @@ import {
   MODEL_IDS,
   getTimeProvider,
   resolveModelIdentitySync
-} from "./chunk-ATNHVLKJ.js";
+} from "./chunk-OYPTT7VJ.js";
 
 // src/config/model-availability.ts
 var DEFAULT_TTL_MS = 6e4;
@@ -150,4 +150,4 @@ export {
   resetAvailabilityCache,
   filterAvailableModels
 };
-//# sourceMappingURL=chunk-RHO52DBX.js.map
+//# sourceMappingURL=chunk-OQAV3JMV.js.map

package/dist/{chunk-ATNHVLKJ.js → chunk-OYPTT7VJ.js}

@@ -2623,7 +2623,7 @@ function setDefaultRegistry(registry) {
 }
 async function reloadDefaultRegistry() {
   globalRegistry = buildDefaultRegistry();
-  const { resetGlobalRegistry } = await import("./unified-registry-K4DRV5PF.js");
+  const { resetGlobalRegistry } = await import("./unified-registry-P6DPCF4Z.js");
   resetGlobalRegistry();
   return globalRegistry;
 }
@@ -14627,7 +14627,7 @@ var CompositeRouter = class _CompositeRouter {
    */
   async consultUnifiedContext(task) {
     try {
-      const { getContextForTask, inferTaskCategory } = await import("./context-retriever-UDERFG2L.js");
+      const { getContextForTask, inferTaskCategory } = await import("./context-retriever-ACPRWATZ.js");
       const ctx = await getContextForTask({
         task: task.content,
         category: inferTaskCategory(task.content),
@@ -16211,4 +16211,4 @@ export {
   AgentCapability,
   OrchestratorError
 };
-//# sourceMappingURL=chunk-ATNHVLKJ.js.map
+//# sourceMappingURL=chunk-OYPTT7VJ.js.map

package/dist/{chunk-TIQXKIIA.js → chunk-PN7GAIXB.js}

@@ -2,7 +2,7 @@ import {
   CACHE_TIMEOUTS,
   createLogger,
   getTimeProvider
-} from "./chunk-ATNHVLKJ.js";
+} from "./chunk-OYPTT7VJ.js";
 
 // src/security/trust-types.ts
 import { z } from "zod";
@@ -560,4 +560,4 @@ export {
   resolveReputationGatingMode,
   gateWithReputation
 };
-//# sourceMappingURL=chunk-TIQXKIIA.js.map
+//# sourceMappingURL=chunk-PN7GAIXB.js.map

package/dist/{chunk-T6HI32EC.js → chunk-QFYATFSD.js}

@@ -2,7 +2,7 @@ import {
   createLogger,
   err,
   ok
-} from "./chunk-ATNHVLKJ.js";
+} from "./chunk-OYPTT7VJ.js";
 
 // src/scm/token-resolver.ts
 import { execFile } from "child_process";
@@ -87,4 +87,4 @@ export {
   hasToken,
   getTokenEnvVars
 };
-//# sourceMappingURL=chunk-T6HI32EC.js.map
+//# sourceMappingURL=chunk-QFYATFSD.js.map

package/dist/{chunk-F47KBREM.js → chunk-SVSZBXWM.js}

@@ -1,6 +1,6 @@
 import {
   getTimeProvider
-} from "./chunk-ATNHVLKJ.js";
+} from "./chunk-OYPTT7VJ.js";
 
 // src/security/audit-trail.ts
 var MAX_EVENTS = 1e4;
@@ -205,4 +205,4 @@ export {
   createGraphAuditBridge,
   createAuditTrail
 };
-//# sourceMappingURL=chunk-F47KBREM.js.map
+//# sourceMappingURL=chunk-SVSZBXWM.js.map

package/dist/{chunk-4AF6CP7P.js → chunk-SX3UV5B6.js}

@@ -1,9 +1,9 @@
 import {
   createAutoAdapter
-} from "./chunk-A5QBZ5EC.js";
+} from "./chunk-ZNM4GOKK.js";
 import {
   mapModelErrorToCategory
-} from "./chunk-OKVCJFZM.js";
+} from "./chunk-5PM7O2LO.js";
 import {
   CLI_NAMES,
   CircularBuffer,
@@ -21,7 +21,7 @@ import {
   ok,
   recordRateLimitEvent,
   toRateLimitError
-} from "./chunk-ATNHVLKJ.js";
+} from "./chunk-OYPTT7VJ.js";
 
 // src/agents/collaboration/event-bus-helpers.ts
 import { randomUUID } from "crypto";
@@ -833,4 +833,4 @@ export {
   getGlobalRegistry,
   resetGlobalRegistry
 };
-//# sourceMappingURL=chunk-4AF6CP7P.js.map
+//# sourceMappingURL=chunk-SX3UV5B6.js.map

package/dist/{chunk-47WSUCLS.js → chunk-UPRSJALQ.js}

@@ -7,7 +7,7 @@ import {
   toolStructuredError,
   toolSuccessStructured,
   wrapToolWithTimeout
-} from "./chunk-VV7KSMMR.js";
+} from "./chunk-WB2K3FHP.js";
 import {
   JsonlStore,
   SECURITY_KEYWORDS,
@@ -19,7 +19,7 @@ import {
   getPipelineEventBus,
   getTimeProvider,
   isDeclaredNeverDeprecate
-} from "./chunk-ATNHVLKJ.js";
+} from "./chunk-OYPTT7VJ.js";
 import {
   getNexusDataDir,
   nexusDataPath
@@ -2132,4 +2132,4 @@ export {
   runImprovementReview,
   registerImprovementReviewTool
 };
-//# sourceMappingURL=chunk-47WSUCLS.js.map
+//# sourceMappingURL=chunk-UPRSJALQ.js.map

package/dist/{chunk-5NRFPUNP.js → chunk-VNPKYYVU.js}

@@ -1,6 +1,6 @@
 import {
   computeCostDetail
-} from "./chunk-344IEWHJ.js";
+} from "./chunk-FP4C6QYQ.js";
 import {
   DEFAULT_CONSENSUS_CONFIG,
   DEFAULT_INCREMENTAL_QUORUM_CONFIG,
@@ -18,20 +18,20 @@ import {
   toolSuccess,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-VV7KSMMR.js";
+} from "./chunk-WB2K3FHP.js";
 import {
   createEvent,
   getGlobalRegistry
-} from "./chunk-4AF6CP7P.js";
+} from "./chunk-SX3UV5B6.js";
 import {
   getToolMemory
-} from "./chunk-GTU2GK4H.js";
+} from "./chunk-AJW6TWSE.js";
 import {
   authRemediation,
   delay,
   getAvailableClis,
   withTimeout
-} from "./chunk-A5QBZ5EC.js";
+} from "./chunk-ZNM4GOKK.js";
 import {
   AgentError,
   CLI_NAMES,
@@ -60,7 +60,7 @@ import {
   resolveClassGuardMs,
   resolveModelIdentitySync,
   resolveVoteTimeout
-} from "./chunk-ATNHVLKJ.js";
+} from "./chunk-OYPTT7VJ.js";
 import {
   ensureLearningDir,
   getOutcomesFile
@@ -5976,7 +5976,7 @@ async function processVotesWithCascade(engineVotes, opts) {
 var CONTRARIAN_ESCALATION_THRESHOLD = 0.8;
 async function runContrarianCheck(proposal, log) {
   try {
-    const { executeExpert } = await import("./expert-bridge-NIYLN24L.js");
+    const { executeExpert } = await import("./expert-bridge-MIPRZ6DR.js");
     const prompt = [
       "You are a contrarian analyst. Your job is to find reasons this proposal should be REJECTED.",
       "Look for: YAGNI (not needed), MISALIGNED (wrong tech/architecture), SECURITY_RISK, SCOPE_CREEP.",
@@ -6503,4 +6503,4 @@ export {
   CONSENSUS_VOTE_OUTPUT_SCHEMA,
   registerConsensusVoteTool
 };
-//# sourceMappingURL=chunk-5NRFPUNP.js.map
+//# sourceMappingURL=chunk-VNPKYYVU.js.map

package/dist/{chunk-NGFG5TIB.js → chunk-VPYHZVBH.js}

@@ -11,7 +11,7 @@ import {
   createGetRetryConfig,
   createGetTimeout,
   createGetToolRateLimit
-} from "./chunk-ATNHVLKJ.js";
+} from "./chunk-OYPTT7VJ.js";
 
 // src/config/defaults.ts
 var CUSTOM_API_DEFAULT_MODEL = "gpt-5.5";
@@ -230,4 +230,4 @@ export {
   CUSTOM_API_DEFAULT_MODEL,
   DEFAULTS
 };
-//# sourceMappingURL=chunk-NGFG5TIB.js.map
+//# sourceMappingURL=chunk-VPYHZVBH.js.map

package/dist/{chunk-5HG2M5CP.js → chunk-VYYSOP24.js}

@@ -1,6 +1,6 @@
 import {
   readOpenAICompatEnv
-} from "./chunk-GMJUXSLK.js";
+} from "./chunk-FSLKQEK2.js";
 import {
   resolveInsideRoot
 } from "./chunk-NUBSJGQZ.js";
@@ -10,10 +10,10 @@ import {
 import {
   createAllAdapters,
   probeCli
-} from "./chunk-A5QBZ5EC.js";
+} from "./chunk-ZNM4GOKK.js";
 import {
   DEFAULTS
-} from "./chunk-NGFG5TIB.js";
+} from "./chunk-VPYHZVBH.js";
 import {
   CliNameSchema,
   DEFAULT_CAPABILITIES,
@@ -30,7 +30,7 @@ import {
   ok,
   symbols,
   writeLine
-} from "./chunk-ATNHVLKJ.js";
+} from "./chunk-OYPTT7VJ.js";
 import {
   getLearningDir,
   getOutcomesFile,
@@ -46,7 +46,7 @@ import {
 } from "./chunk-OQLFRJCW.js";
 
 // src/version.ts
-var VERSION = true ? "3.2.2" : "dev";
+var VERSION = true ? "3.2.3" : "dev";
 
 // src/config/schemas-core.ts
 import { z } from "zod";
@@ -2188,7 +2188,7 @@ async function runDoctorFix(result) {
   writeLine2("\u2500".repeat(40));
   let fixCount = 0;
   if (!result.dataDirectory.rootExists || result.dataDirectory.subdirectories.some((d) => !d.exists || !d.writable)) {
-    const { runSetup } = await import("./setup-command-NPGRBUWK.js");
+    const { runSetup } = await import("./setup-command-VHA2K7XL.js");
     const setupResult = runSetup({
       skipMcp: true,
       skipRules: true,
@@ -2202,7 +2202,7 @@ async function runDoctorFix(result) {
     }
   }
   if (!result.configFile.found) {
-    const { runConfigInitSync } = await import("./setup-config-D6V7HW6W.js");
+    const { runConfigInitSync } = await import("./setup-config-KCR2RA4L.js");
     const configResult = runConfigInitSync(process.cwd(), false, false);
     if (configResult.success && configResult.created) {
       writeLine2(`\u2713 Generated config: ${configResult.path}`);
@@ -2301,4 +2301,4 @@ export {
   startStdioServer,
   closeServer
 };
-//# sourceMappingURL=chunk-5HG2M5CP.js.map
+//# sourceMappingURL=chunk-VYYSOP24.js.map

package/dist/{chunk-VV7KSMMR.js → chunk-WB2K3FHP.js}

@@ -1,6 +1,6 @@
 import {
   emitClawGuardViolation
-} from "./chunk-F47KBREM.js";
+} from "./chunk-SVSZBXWM.js";
 import {
   CACHE_TIMEOUTS,
   MCP_TIMEOUTS,
@@ -16,7 +16,7 @@ import {
   getTimeProvider,
   ok,
   resolveToolClassGuardMs
-} from "./chunk-ATNHVLKJ.js";
+} from "./chunk-OYPTT7VJ.js";
 import {
   getNexusDataDir
 } from "./chunk-OQLFRJCW.js";
@@ -2023,4 +2023,4 @@ export {
   VOTING_THRESHOLDS,
   ConsensusMetricsSchema
 };
-//# sourceMappingURL=chunk-VV7KSMMR.js.map
+//# sourceMappingURL=chunk-WB2K3FHP.js.map

package/dist/{chunk-SDVDWM3C.js → chunk-YMXYMLBB.js}

@@ -1,6 +1,6 @@
 import {
   runConfigInitSync
-} from "./chunk-43YJRZZW.js";
+} from "./chunk-CAFO4H4L.js";
 import {
   VERSION,
   checkApiKeys,
@@ -8,13 +8,13 @@ import {
   checkSqlite,
   defaultConfig,
   initDataDirectories
-} from "./chunk-5HG2M5CP.js";
+} from "./chunk-VYYSOP24.js";
 import {
   BUILT_IN_EXPERTS
 } from "./chunk-YPNQPT2F.js";
 import {
   probeAllClis
-} from "./chunk-A5QBZ5EC.js";
+} from "./chunk-ZNM4GOKK.js";
 import {
   CLI_SUBPROCESS_TIMEOUTS,
   colors,
@@ -25,7 +25,7 @@ import {
   getErrorMessage,
   getTimeProvider,
   symbols
-} from "./chunk-ATNHVLKJ.js";
+} from "./chunk-OYPTT7VJ.js";
 import {
   ensureGitignored,
   findRepoRoot
@@ -2001,4 +2001,4 @@ export {
   setupCommand,
   setupCommandAsync
 };
-//# sourceMappingURL=chunk-SDVDWM3C.js.map
+//# sourceMappingURL=chunk-YMXYMLBB.js.map

package/dist/{chunk-A5QBZ5EC.js → chunk-ZNM4GOKK.js}

@@ -5,34 +5,34 @@ import {
   planOptionalParams,
   requireApiKey,
   validateApiKeyPresence
-} from "./chunk-HEZ6VTMO.js";
+} from "./chunk-5XPHOP2H.js";
 import {
   CUSTOM_API_DEFAULT_MODEL
-} from "./chunk-NGFG5TIB.js";
+} from "./chunk-VPYHZVBH.js";
 import {
   CUSTOM_API_BASE_URL_ENV,
   PROVIDER_ENV_KEYS,
   assertCustomApiHostResolvesPublic,
   validateCustomApiBaseUrl
-} from "./chunk-ZBTEOM3T.js";
+} from "./chunk-5RNS353B.js";
 import {
   nexusMkdtempSync
 } from "./chunk-YAF73ZMR.js";
 import {
   getAvailabilityCache
-} from "./chunk-RHO52DBX.js";
+} from "./chunk-OQAV3JMV.js";
 import {
   extractSystemPrompt
 } from "./chunk-QZUG667L.js";
 import {
   generateHyphenId
-} from "./chunk-25TDC2C4.js";
+} from "./chunk-FCSXIDDQ.js";
 import {
   CliCircuitBreaker,
   DEFAULT_CIRCUIT_BREAKER_CONFIG,
   getCliCircuitBreakerSnapshot,
   getDefaultCliCircuitBreakerRegistry
-} from "./chunk-OKVCJFZM.js";
+} from "./chunk-5PM7O2LO.js";
 import {
   CLI_SUBPROCESS_TIMEOUTS,
   CLI_TIMEOUTS,
@@ -69,7 +69,7 @@ import {
   ok,
   parseRetryAfterMs,
   resolveCliAlias
-} from "./chunk-ATNHVLKJ.js";
+} from "./chunk-OYPTT7VJ.js";
 
 // src/cli-adapters/cli-to-model-adapter.ts
 var CliToModelAdapter = class {
@@ -2548,6 +2548,38 @@ var SubprocessCliAdapter = class extends BaseCliAdapter {
    * + model and surface tail-latency outliers") requires a way to
    * disambiguate which timing row belongs to which call.
    */
+  /**
+   * Wraps a command's cleanup in a once-guard (#4488).
+   *
+   * `CommandConfig.cleanup` removes a tempdir the command builder created (e.g.
+   * codex's `nexus-codex-sysprompt-*` holding the system prompt). It must run on
+   * EVERY exit path — a path that skips it leaks a directory per invocation, the
+   * leak codex-adapter's own comment records as having exhausted inodes on
+   * long-running MCP daemons — and exactly ONCE, since a second rm could hit a
+   * path the OS has already handed to someone else.
+   */
+  /**
+   * Result for a synchronous spawn failure (#4488).
+   *
+   * `spawn()` throws synchronously on some failures (EACCES, and ENOENT on
+   * certain platforms), and handler setup can throw too. Those paths never
+   * reach `resolve`, so without catching them the tempdir leaks AND the promise
+   * rejects instead of returning a Result — breaking the never-throws contract
+   * this adapter is supposed to honour.
+   */
+  spawnFailure(command, error) {
+    return err(
+      this.createError("EXECUTION_ERROR", `Failed to spawn ${command}: ${getErrorMessage(error)}`)
+    );
+  }
+  onceCleanup(cleanup) {
+    let done = false;
+    return () => {
+      if (done) return;
+      done = true;
+      this.runSubprocessCleanup(cleanup);
+    };
+  }
   spawnSubprocess(task, options, requestId) {
     const cmdConfig = this.getCommand(task);
     const startTime = getTimeProvider().now();
@@ -2556,32 +2588,38 @@ var SubprocessCliAdapter = class extends BaseCliAdapter {
       return Promise.resolve(err(this.createError("TIMEOUT", "Aborted before spawn")));
     }
     return new Promise((resolveOuter) => {
-      const resolve = (result) => {
-        this.runSubprocessCleanup(cmdConfig.cleanup);
-        resolveOuter(result);
+      const runCleanupOnce = this.onceCleanup(cmdConfig.cleanup);
+      const resolve = (r) => {
+        runCleanupOnce();
+        resolveOuter(r);
       };
-      const childEnv = buildChildEnv(this.name);
-      const child = spawn(cmdConfig.command, cmdConfig.args, {
-        stdio: ["pipe", "pipe", "pipe"],
-        env: childEnv
-      });
-      const onProgress = options.onProgress;
-      const state = this.setupChildProcessHandlers({
-        child,
-        startTime,
-        timeoutMs: options.timeoutMs,
-        resolve,
-        requestId,
-        ...onProgress !== void 0 ? { onProgress } : {}
-      });
-      if (signal !== void 0) {
-        this.attachAbortSignal(child, signal, resolve);
-      }
-      if (cmdConfig.stdin !== void 0) {
-        child.stdin.write(cmdConfig.stdin);
+      try {
+        const childEnv = buildChildEnv(this.name);
+        const child = spawn(cmdConfig.command, cmdConfig.args, {
+          stdio: ["pipe", "pipe", "pipe"],
+          env: childEnv
+        });
+        const onProgress = options.onProgress;
+        const state = this.setupChildProcessHandlers({
+          child,
+          startTime,
+          timeoutMs: options.timeoutMs,
+          resolve,
+          requestId,
+          ...onProgress !== void 0 ? { onProgress } : {}
+        });
+        if (signal !== void 0) {
+          this.attachAbortSignal(child, signal, resolve);
+        }
+        if (cmdConfig.stdin !== void 0) {
+          child.stdin.write(cmdConfig.stdin);
+        }
+        child.stdin.end();
+        void state;
+      } catch (error) {
+        runCleanupOnce();
+        resolveOuter(this.spawnFailure(cmdConfig.command, error));
       }
-      child.stdin.end();
-      void state;
     });
   }
   /**
@@ -4724,4 +4762,4 @@ export {
   SdkAdapter,
   createAutoAdapter
 };
-//# sourceMappingURL=chunk-A5QBZ5EC.js.map
+//# sourceMappingURL=chunk-ZNM4GOKK.js.map