nexus-agents 3.9.5 → 3.12.0

package/dist/{chunk-RJGW6BKM.js → chunk-XLBLVP35.js}

@@ -1,6 +1,6 @@
 import {
   generateSecurityPlan
-} from "./chunk-MXJEMYC7.js";
+} from "./chunk-FLFPY5PG.js";
 import {
   analyzeGitHubRepo
 } from "./chunk-HFOQKCD2.js";
@@ -22,10 +22,10 @@ import {
   DEFAULT_TASK_TTL_MS,
   DEFAULT_TOOL_RATE_LIMITS,
   clampTaskTtl
-} from "./chunk-JB3ZZ3Y2.js";
+} from "./chunk-RQWS5CIU.js";
 import {
   executeExpert
-} from "./chunk-KPYPJGSD.js";
+} from "./chunk-KMFVYD3M.js";
 import {
   JobStatusSchema,
   abortJob,
@@ -46,24 +46,24 @@ import {
   simulationDeniedResult,
   toJobSummary,
   writeJobCancelled
-} from "./chunk-DMKV7ANB.js";
+} from "./chunk-RAMWS524.js";
 import {
   allOf
 } from "./chunk-OQB3XC5O.js";
 import {
   normalizeTopicToCanonical,
   synthesizeResearch
-} from "./chunk-JBSL2HKV.js";
+} from "./chunk-227ICA6P.js";
 import {
   IssueTriage
-} from "./chunk-ABV3XE7D.js";
+} from "./chunk-7XFZXFXZ.js";
 import {
   resolveEnvMode,
   sanitizeInput
-} from "./chunk-XMNMIMR6.js";
+} from "./chunk-T33KZOQK.js";
 import {
   withPrerequisite
-} from "./chunk-JJZF37X2.js";
+} from "./chunk-NLWMLSFQ.js";
 import {
   NOOP_NOTIFIER,
   RateLimiter,
@@ -86,18 +86,18 @@ import {
   withAuditTrail,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-K3TRG2CD.js";
+} from "./chunk-RXNSNTTE.js";
 import {
   createAuditTrail,
   createGraphAuditBridge,
   emitPipelinePolicyEvent
-} from "./chunk-ZVZHNAQH.js";
+} from "./chunk-ENFMX6RD.js";
 import {
   EventTopics,
   createEvent,
   getGlobalEventBus,
   getGlobalRegistry
-} from "./chunk-SOCKDRK6.js";
+} from "./chunk-3P6G3HQA.js";
 import {
   IDENTIFIER_RE,
   LANG_VALUES,
@@ -130,31 +130,31 @@ import {
   parseRegistry,
   sourceExistsInRegistry,
   summarizeContextForPrompt
-} from "./chunk-JBLM3UZA.js";
-import {
-  getTokenEnvVars,
-  resolveToken
-} from "./chunk-G6AVXG6F.js";
+} from "./chunk-X6XZRVXL.js";
 import {
   loadPapersRegistry,
   loadTechniquesRegistry
-} from "./chunk-MAP3BVCT.js";
+} from "./chunk-OATAIRGV.js";
 import {
   resolveInsideRoot
 } from "./chunk-NUBSJGQZ.js";
+import {
+  getTokenEnvVars,
+  resolveToken
+} from "./chunk-F3CFOOM6.js";
 import {
   DEFAULT_RELEVANCE_CONFIG,
   MemoryImportance,
   calculateTextJaccardSimilarity,
   getToolMemory
-} from "./chunk-QUOCOEDQ.js";
+} from "./chunk-NPCX34QE.js";
 import {
   STOPWORDS,
   truncateWithInfo
 } from "./chunk-6T3EPABN.js";
 import {
   createSessionMemory
-} from "./chunk-OL6TRWBA.js";
+} from "./chunk-NQ2CKBFI.js";
 import {
   BUILT_IN_EXPERTS,
   BuiltInExpertTypeSchema,
@@ -172,25 +172,25 @@ import {
   getAvailableClis,
   sleep,
   withTimeout
-} from "./chunk-M7566JRS.js";
+} from "./chunk-RPZ3Y7OI.js";
 import {
   BaseAdapter,
   createStream,
   requireApiKey,
   validateApiKeyPresence
-} from "./chunk-32AWWH4F.js";
+} from "./chunk-GXATLSZX.js";
 import {
   DEFAULTS
-} from "./chunk-G5GOWK5T.js";
+} from "./chunk-3NYMGWW7.js";
 import {
   getAvailabilityCache,
   getCliForModelId,
   resolveFallback
-} from "./chunk-TJ6UFU3I.js";
+} from "./chunk-TRR7642Q.js";
 import {
   generateHyphenId,
   generateUUID
-} from "./chunk-N62DDWV3.js";
+} from "./chunk-ENULFHFF.js";
 import {
   AGENT_ROUTER_TIMEOUTS,
   API_TIMEOUTS,
@@ -289,7 +289,7 @@ import {
   selectStrategyByManifest,
   toExpertTaskAnalysisResult,
   withStep
-} from "./chunk-6VUIQQ3O.js";
+} from "./chunk-3VZWKZ5Q.js";
 import {
   ensureLearningDir,
   getMetaOutcomesFile,
@@ -28371,7 +28371,7 @@ function execIdFields(executionId) {
 async function populateUnifiedContextOnState(state, options) {
   const taskCandidate = state["task"];
   if (typeof taskCandidate !== "string" || taskCandidate === "") return;
-  const { getContextForTask: getContextForTask2, inferTaskCategory: inferTaskCategory2 } = await import("./context-retriever-JNXUAPWJ.js");
+  const { getContextForTask: getContextForTask2, inferTaskCategory: inferTaskCategory2 } = await import("./context-retriever-FSV4WUJO.js");
   const category = inferTaskCategory2(taskCandidate);
   const executionId = options?.executionId;
   const execFields = execIdFields(executionId);
@@ -43973,7 +43973,7 @@ function classifyTask(task) {
   const scores = calculateTypeScores(lower);
   const pipelineType = selectBestType(scores);
   const complexity = estimateComplexity2(lower);
-  const maxScore = Math.max(...Object.values(scores), 1);
+  const maxScore = Math.max(...Object.values(scores));
   const keywords = extractMatchedKeywords(lower, pipelineType);
   return {
     pipelineType,
@@ -44022,11 +44022,14 @@ var TRIAGE_CATEGORY_MAP = {
   security: "audit",
   research: "research"
 };
+function llmClassificationEnabled() {
+  return process.env["NEXUS_LLM_CLASSIFICATION"] === "1";
+}
 async function tryIssueTriage(task) {
   try {
     const issueMatch = task.match(/github\.com\/([^/]+\/[^/]+)\/issues\/(\d+)/);
     if (issueMatch === null) return null;
-    const { createIssueTriage } = await import("./issue-triage-EBQFRWOQ.js");
+    const { createIssueTriage } = await import("./issue-triage-QQXQQAE7.js");
     const triage = createIssueTriage();
     const owner = issueMatch[1] ?? "";
     const num = issueMatch[2] ?? "";
@@ -44054,7 +44057,7 @@ var VALID_TEMPLATES = /* @__PURE__ */ new Set([
 ]);
 async function classifyWithLLM(task) {
   try {
-    const { executeExpert: executeExpert2 } = await import("./expert-bridge-XI4BNDI7.js");
+    const { executeExpert: executeExpert2 } = await import("./expert-bridge-ZGYSKIPE.js");
     const prompt = [
       "Classify this task into exactly one pipeline template.",
       "Templates: dev (implementation/bug fix/refactor), research (investigate/evaluate/compare),",
@@ -44100,7 +44103,7 @@ async function runAdaptiveOrchestrator(task, options) {
         enriched: enriched.pipelineType
       });
       classification = enriched;
-    } else {
+    } else if (llmClassificationEnabled()) {
       const llmResult = await classifyWithLLM(cleanTask);
       if (llmResult !== null) {
         logger39.info("Classification refined via LLM", {
@@ -45780,7 +45783,7 @@ var memoryInitPromise = null;
 async function initPipelineMemory() {
   if (cachedMemory !== null) return cachedMemory;
   try {
-    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-CY3T3XNO.js");
+    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-42EQPQ7Y.js");
     const { getLearningDir } = await import("./learning-persistence-EGY4VKKO.js");
     const mem = createSessionMemory2(getLearningDir());
     mem.startSession(`pipeline-${String(getTimeProvider().now())}`);
@@ -45842,7 +45845,7 @@ function recordRoutingExperience(category, success, durationMs, tokensUsed = 0,
     callRecord(routingMemoryCache);
     return;
   }
-  routingMemoryInitPromise ??= import("./routing-memory-GFO76574.js").then(({ createRoutingMemory }) => {
+  routingMemoryInitPromise ??= import("./routing-memory-7BJ4KTSH.js").then(({ createRoutingMemory }) => {
     routingMemoryCache ??= createRoutingMemory();
     return routingMemoryCache;
   }).catch((error) => {
@@ -45876,7 +45879,7 @@ ${text}` : "";
 }
 async function getWeatherContext() {
   try {
-    const { generateWeatherReport: generateWeatherReport2 } = await import("./weather-report-MXQTPLDG.js");
+    const { generateWeatherReport: generateWeatherReport2 } = await import("./weather-report-RS2IWF7C.js");
     const report = generateWeatherReport2({ includeAdaptive: true });
     const mappings = "recommendedMappings" in report ? report.recommendedMappings : [];
     if (!Array.isArray(mappings) || mappings.length === 0) return "";
@@ -45894,7 +45897,7 @@ ${lines}
 }
 async function getMemoryContext(task) {
   try {
-    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-CY3T3XNO.js");
+    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-42EQPQ7Y.js");
     const { getLearningDir } = await import("./learning-persistence-EGY4VKKO.js");
     const memory = createSessionMemory2(getLearningDir(), { maxLearningsInContext: 10 });
     const learnings = memory.searchLearnings(task.slice(0, 200));
@@ -46009,7 +46012,7 @@ ${contextBlock}`;
       const strategy = config.votingStrategy ?? "higher_order";
       await postProgress(config, "Vote", `Running consensus with ${strategy} strategy...`);
       try {
-        const { executeVoting } = await import("./consensus-vote-HG5BE56Y.js");
+        const { executeVoting } = await import("./consensus-vote-IAURVUZM.js");
         const votingResult = await executeVoting(
           {
             proposal: buildVoteProposal(plan, research),
@@ -46448,7 +46451,7 @@ async function searchCodebaseForTask(task) {
 }
 async function queryResearchRegistry(task) {
   try {
-    const { synthesizeResearch: synthesizeResearch2 } = await import("./research-helpers-synthesize-KUZRNHXY.js");
+    const { synthesizeResearch: synthesizeResearch2 } = await import("./research-helpers-synthesize-O4PADVTR.js");
     const topic = task.split(/[.!?\n]/).filter((s) => s.trim().length > 10)[0]?.trim();
     if (topic === void 0) return null;
     const result = await synthesizeResearch2(topic.slice(0, 50));
@@ -46519,7 +46522,7 @@ function createScanStageWrapper() {
       try {
         const slug = ctx.task.match(/([a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+)/)?.[1];
         if (slug !== void 0) {
-          const { generateSecurityPlan: generateSecurityPlan2 } = await import("./repo-security-plan-IRILDORZ.js");
+          const { generateSecurityPlan: generateSecurityPlan2 } = await import("./repo-security-plan-XB4D56AF.js");
           const plan = await generateSecurityPlan2({ repo: slug, maxScanners: 10 });
           const recs = plan.recommendations.slice(0, 5).map((r) => `${r.priority}: ${r.displayName} (${r.category})`).join("; ");
           return output(PIPELINE_STATE_KEYS.FINDINGS, recs, getTimeProvider().now() - start, true);
@@ -48899,6 +48902,29 @@ function guardAuthority(strategy, actionClass) {
     throw decision.refusal;
   }
 }
+var ExecuteEnvelopeRefusalError = class extends Error {
+  code = "envelope_undeclared";
+  strategy;
+  constructor(strategy) {
+    super(
+      `Strategy '${strategy}' was dispatched for EXECUTION but declares no executeEnvelope. Refused fail-closed (ADR-0017, #4655): an undeclared envelope means "cannot execute", never "unbounded". Declare one in governance/strategy-manifests.yaml (and its in-tree mirror).`
+    );
+    this.name = "ExecuteEnvelopeRefusalError";
+    this.strategy = strategy;
+  }
+};
+function evaluateExecuteEnvelope(strategy) {
+  const envelope = getStrategyManifest(strategy)?.executeEnvelope;
+  if (envelope === void 0) {
+    return { permitted: false, refusal: new ExecuteEnvelopeRefusalError(strategy) };
+  }
+  return { permitted: true, envelope };
+}
+function guardExecuteEnvelope(strategy) {
+  const decision = evaluateExecuteEnvelope(strategy);
+  if (!decision.permitted) throw decision.refusal;
+  return decision.envelope;
+}
 
 // src/orchestration/meta-orchestrator.ts
 function createAuditLogSink(logger59) {
@@ -48955,6 +48981,9 @@ function createMetaOrchestrator(options) {
       if (input.requiredAuthority !== void 0) {
         guardAuthority(decision.strategy, input.requiredAuthority);
       }
+      if (input.requiresExecuteEnvelope === true) {
+        guardExecuteEnvelope(decision.strategy);
+      }
       const timestamp = new Date(getTimeProvider().now()).toISOString();
       sink.record(toRecord(decision, input.goal, forced, timestamp));
       if (shadowSelector !== void 0 && shadowSink !== void 0) {
@@ -49582,7 +49611,7 @@ var GitHubTaskTracker = class {
   cachedProvider = null;
   async getProvider() {
     if (this.cachedProvider !== null) return this.cachedProvider;
-    const { createScmProvider } = await import("./factory-WU2VY6QI.js");
+    const { createScmProvider } = await import("./factory-DOLFKNUU.js");
     const result = await createScmProvider({ repo: this.config.repo ?? "" });
     if (!result.ok) throw new Error(`SCM provider error: ${result.error.message}`);
     this.cachedProvider = result.value;
@@ -50172,7 +50201,7 @@ var RunInputSchema = z107.object({
     "Dispatch mode (#3732). 'sync' (default): run inline. 'async' (only with execute:true): return a jobId immediately + run in background (poll get_job_result)."
   )
 });
-var NOTE = "Routing decision only (read-only). Invoke the recommendedTool to execute, or wait for inline execution (run execute: true) in a later release. The other pipeline tools remain available as advanced force-strategy paths.";
+var NOTE = "Routing decision only (read-only). Invoke the recommendedTool to execute, or re-run with execute: true for inline execution. The other pipeline tools remain available as advanced force-strategy paths.";
 function toMetaInput(input, mode) {
   const signals = {};
   if (input.requiresConsensus !== void 0) signals.requiresConsensus = input.requiresConsensus;
@@ -50182,6 +50211,8 @@ function toMetaInput(input, mode) {
   return {
     goal: input.goal,
     requiredAuthority: dispatchActionClass(mode),
+    // #4655: an executing dispatch must also clear the envelope precondition.
+    requiresExecuteEnvelope: mode === "execute",
     ...Object.keys(signals).length > 0 ? { signals } : {},
     ...input.forceStrategy !== void 0 ? { forceStrategy: input.forceStrategy } : {}
   };
@@ -50424,7 +50455,7 @@ async function probeSource(source, includeModelIds) {
   }
 }
 async function defaultSources(includeOpenRouter) {
-  const { createAllAdapters: createAllAdapters2 } = await import("./factory-QAH46LJX.js");
+  const { createAllAdapters: createAllAdapters2 } = await import("./factory-6V2FHFQ4.js");
   const adapters = createAllAdapters2();
   return buildDefaultModelSources(adapters, { includeOpenRouter });
 }
@@ -54456,4 +54487,4 @@ export {
   shutdownFeedbackSubscriber,
   createEventBusBridge
 };
-//# sourceMappingURL=chunk-RJGW6BKM.js.map
+//# sourceMappingURL=chunk-XLBLVP35.js.map