nexus-agents 4.22.2 → 4.22.4

package/dist/{chunk-BG2LQ5I2.js → chunk-VDEDTAHZ.js}

@@ -1,6 +1,6 @@
 import {
   generateSecurityPlan
-} from "./chunk-QRG7UR2F.js";
+} from "./chunk-BZGTZKXY.js";
 import {
   analyzeGitHubRepo
 } from "./chunk-HFOQKCD2.js";
@@ -17,14 +17,14 @@ import {
   FINDING_SEVERITY_LEVELS,
   SARIF_LEVEL_MAP,
   SEVERITY_ORDER
-} from "./chunk-CQ77TF4Y.js";
+} from "./chunk-BYUVLVN7.js";
 import {
   DEFAULT_TASK_TTL_MS,
   clampTaskTtl
-} from "./chunk-JDWXD3YZ.js";
+} from "./chunk-HLVST3JE.js";
 import {
   executeExpert
-} from "./chunk-PSXX2GBZ.js";
+} from "./chunk-VSHQMS37.js";
 import {
   JobStatusSchema,
   abortJob,
@@ -46,24 +46,24 @@ import {
   simulationDeniedResult,
   toJobSummary,
   writeJobCancelled
-} from "./chunk-W2DYH4WL.js";
+} from "./chunk-ZRSKNV3E.js";
 import {
   allOf
 } from "./chunk-OQB3XC5O.js";
 import {
   normalizeTopicToCanonical,
   synthesizeResearch
-} from "./chunk-H7CV35LZ.js";
+} from "./chunk-NQ65EKMG.js";
 import {
   IssueTriage
-} from "./chunk-6U3LS57H.js";
+} from "./chunk-BTAWCQP6.js";
 import {
   resolveEnvMode,
   sanitizeInput
-} from "./chunk-GMJQ6QMZ.js";
+} from "./chunk-7MBFKJJT.js";
 import {
   withPrerequisite
-} from "./chunk-MM7BINTV.js";
+} from "./chunk-DXWF7V74.js";
 import {
   NOOP_NOTIFIER,
   RateLimiter,
@@ -87,18 +87,18 @@ import {
   withAuditTrail,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-D6ZTSN34.js";
+} from "./chunk-PLO6VSSN.js";
 import {
   createAuditTrail,
   createGraphAuditBridge,
   emitPipelinePolicyEvent
-} from "./chunk-X7MLVGJV.js";
+} from "./chunk-YSOWQJ5S.js";
 import {
   EventTopics,
   createEvent,
   getGlobalEventBus,
   getGlobalRegistry
-} from "./chunk-V533P6BT.js";
+} from "./chunk-QS5K3PAY.js";
 import {
   IDENTIFIER_RE,
   LANG_VALUES,
@@ -131,29 +131,29 @@ import {
   parseRegistry,
   sourceExistsInRegistry,
   summarizeContextForPrompt
-} from "./chunk-IK6JPHMX.js";
+} from "./chunk-3PVG7CQS.js";
 import {
   loadPapersRegistry,
   loadTechniquesRegistry,
   resolveInsideRoot
-} from "./chunk-P422WQJM.js";
+} from "./chunk-EPOKODTI.js";
 import {
   getTokenEnvVars,
   resolveToken
-} from "./chunk-XYWCZNFC.js";
+} from "./chunk-5YBFBXEB.js";
 import {
   DEFAULT_RELEVANCE_CONFIG,
   MemoryImportance,
   calculateTextJaccardSimilarity,
   getToolMemory
-} from "./chunk-EU7S5CDW.js";
+} from "./chunk-IBW6CJ4G.js";
 import {
   STOPWORDS,
   truncateWithInfo
 } from "./chunk-6T3EPABN.js";
 import {
   createSessionMemory
-} from "./chunk-DGLAEH7Y.js";
+} from "./chunk-3K3IPRED.js";
 import {
   BUILT_IN_EXPERTS,
   BuiltInExpertTypeSchema,
@@ -171,25 +171,25 @@ import {
   getAvailableClis,
   sleep,
   withTimeout
-} from "./chunk-JM42KPWJ.js";
+} from "./chunk-SBWVYOTV.js";
 import {
   BaseAdapter,
   createStream,
   requireApiKey,
   validateApiKeyPresence
-} from "./chunk-CBORIR4Y.js";
+} from "./chunk-MCCN5UUW.js";
 import {
   DEFAULTS
-} from "./chunk-TMKBZG3W.js";
+} from "./chunk-RXGHRVL2.js";
 import {
   getAvailabilityCache,
   getCliForModelId,
   resolveFallback
-} from "./chunk-RMTTKP4L.js";
+} from "./chunk-HWPFUVMS.js";
 import {
   generateHyphenId,
   generateUUID
-} from "./chunk-MTGMOLRO.js";
+} from "./chunk-QQS6FVTQ.js";
 import {
   AGENT_ROUTER_TIMEOUTS,
   API_TIMEOUTS,
@@ -293,7 +293,7 @@ import {
   selectStrategyByManifest,
   toExpertTaskAnalysisResult,
   withStep
-} from "./chunk-2SVIHHNJ.js";
+} from "./chunk-TBWKMKCX.js";
 import {
   ensureLearningDir,
   getMetaOutcomesFile,
@@ -29544,7 +29544,7 @@ function execIdFields(executionId) {
 async function populateUnifiedContextOnState(state, options) {
   const taskCandidate = state["task"];
   if (typeof taskCandidate !== "string" || taskCandidate === "") return;
-  const { getContextForTask: getContextForTask2, inferTaskCategory: inferTaskCategory2 } = await import("./context-retriever-CKJ7EJME.js");
+  const { getContextForTask: getContextForTask2, inferTaskCategory: inferTaskCategory2 } = await import("./context-retriever-BROUADMF.js");
   const category = inferTaskCategory2(taskCandidate);
   const executionId = options?.executionId;
   const execFields = execIdFields(executionId);
@@ -41482,7 +41482,13 @@ function recordGraphWorkflowResult(result) {
     const store = getOutcomeStore();
     store.append({
       id: `graph-${String(getTimeProvider().now())}-${getRandomProvider().random().toString(36).slice(2, 8)}`,
-      cli: DEFAULT_CLI,
+      // #5020: NOT `DEFAULT_CLI`. This tool does not know which CLI served the
+      // work — the model field below is a synthetic label, not a model id — and
+      // hardcoding 'claude' credited or debited claude for every run, poisoning
+      // the same routing learner #5003 fixed in the feedback bridge.
+      // `'unknown'` is the schema's own unattributed value, and the bandit's
+      // warm-start already partitions it out (#4935) instead of replaying it.
+      cli: "unknown",
       category: workflowToCategory(result.workflow),
       model: "graph-workflow",
       success: succeeded,
@@ -42097,7 +42103,13 @@ function recordSpecOutcome(success, durationMs, stage) {
     const store = getOutcomeStore();
     store.append({
       id: `spec-${String(getTimeProvider().now())}-${getRandomProvider().random().toString(36).slice(2, 8)}`,
-      cli: DEFAULT_CLI,
+      // #5020: NOT `DEFAULT_CLI`. This tool does not know which CLI served the
+      // work — the model field below is a synthetic label, not a model id — and
+      // hardcoding 'claude' credited or debited claude for every run, poisoning
+      // the same routing learner #5003 fixed in the feedback bridge.
+      // `'unknown'` is the schema's own unattributed value, and the bandit's
+      // warm-start already partitions it out (#4935) instead of replaying it.
+      cli: "unknown",
       category: "code_generation",
       model: "spec-executor",
       success,
@@ -45272,7 +45284,7 @@ async function tryIssueTriage(task) {
   try {
     const issueMatch = task.match(/github\.com\/([^/]+\/[^/]+)\/issues\/(\d+)/);
     if (issueMatch === null) return null;
-    const { createIssueTriage } = await import("./issue-triage-NH25YRNT.js");
+    const { createIssueTriage } = await import("./issue-triage-PM67ACC5.js");
     const triage = createIssueTriage();
     const owner = issueMatch[1] ?? "";
     const num = issueMatch[2] ?? "";
@@ -45300,7 +45312,7 @@ var VALID_TEMPLATES = /* @__PURE__ */ new Set([
 ]);
 async function classifyWithLLM(task) {
   try {
-    const { executeExpert: executeExpert2 } = await import("./expert-bridge-5MK4DOB7.js");
+    const { executeExpert: executeExpert2 } = await import("./expert-bridge-H6ITLZUY.js");
     const prompt = [
       "Classify this task into exactly one pipeline template.",
       "Templates: dev (implementation/bug fix/refactor), research (investigate/evaluate/compare),",
@@ -46679,7 +46691,8 @@ async function runTriagePipeline(sarifResult, targetDir, config, start) {
   });
   lastTriageVerdicts = triageResult.triaged;
   recordTriageLifecycle(triageResult.triaged, lifecycleEntries);
-  const osvVulns = await runOsvCheck(targetDir, config.enableOsv ?? true);
+  const osv = await runOsvCheck(targetDir, config.enableOsv ?? true);
+  const osvVulns = osv.vulnerabilities;
   lastOsvVulnerabilities = osvVulns;
   const confirmed = getConfirmedBlockingFindings(sarifResult.findings, triageResult.triaged);
   const lifecycle = summarizeLifecycle(lifecycleEntries);
@@ -46687,13 +46700,15 @@ async function runTriagePipeline(sarifResult, targetDir, config, start) {
     sarifResult.totalFindings,
     confirmed.length,
     lifecycle.falsePositiveCount,
-    osvVulns.length
+    osvVulns.length,
+    osv
   );
   logger46.info("Security gate complete", {
     total: sarifResult.totalFindings,
     confirmed: confirmed.length,
     falsePositives: lifecycle.falsePositiveCount,
-    osvVulns: osvVulns.length
+    osvVulns: osvVulns.length,
+    osvFailedLookups: osv.failedLookups
   });
   const failed = confirmed.length > 0 || osvVulns.some((v) => v.severity === "CRITICAL");
   return {
@@ -46708,24 +46723,39 @@ function recordTriageLifecycle(verdicts, entries) {
     recordTriaged(triaged.finding, triaged.verdict, (entry) => entries.push(entry));
   }
 }
+var OSV_EMPTY = {
+  vulnerabilities: [],
+  failedLookups: 0,
+  queried: 0,
+  declared: 0
+};
+var OSV_DEPENDENCY_CAP = 20;
 async function runOsvCheck(targetDir, enabled) {
-  if (!enabled) return [];
+  if (!enabled) return OSV_EMPTY;
   try {
     const fs13 = await import("fs");
     const path12 = await import("path");
     const pkgPath = path12.join(targetDir, "package.json");
-    if (!fs13.existsSync(pkgPath)) return [];
+    if (!fs13.existsSync(pkgPath)) return OSV_EMPTY;
     const pkg = JSON.parse(fs13.readFileSync(pkgPath, "utf-8"));
-    const deps = Object.entries(pkg.dependencies ?? {}).slice(0, 20).map(([name, version]) => ({
+    const declared = Object.keys(pkg.dependencies ?? {}).length;
+    const deps = Object.entries(pkg.dependencies ?? {}).slice(0, OSV_DEPENDENCY_CAP).map(([name, version]) => ({
       name,
       version: version.replace(/^[\^~>=<]+/, "")
     }));
-    if (deps.length === 0) return [];
+    if (deps.length === 0) return OSV_EMPTY;
     const results = await queryOsvBatch(deps);
-    return results.flatMap((r) => [...r.vulnerabilities]);
+    return {
+      vulnerabilities: results.flatMap((r) => [...r.vulnerabilities]),
+      // The half that used to be dropped: a 503 or a timeout yields an empty
+      // `vulnerabilities` array with an `error` set, which read as "clean".
+      failedLookups: results.filter((r) => r.error !== null).length,
+      queried: deps.length,
+      declared
+    };
   } catch (error) {
     logger46.debug("OSV check skipped", { error: String(error) });
-    return [];
+    return OSV_EMPTY;
   }
 }
 function getConfirmedBlockingFindings(findings, verdicts) {
@@ -46737,12 +46767,23 @@ function getConfirmedBlockingFindings(findings, verdicts) {
     return verdict === void 0 || verdict.confirmed;
   });
 }
-function buildScanSummary(total, confirmed, falsePositives, osvCount) {
+function buildScanSummary(total, confirmed, falsePositives, osvCount, osv) {
   const parts = [`${String(total)} SAST findings`];
   if (falsePositives > 0) parts.push(`${String(falsePositives)} filtered as false positives`);
   if (confirmed > 0) parts.push(`${String(confirmed)} confirmed blocking`);
   if (osvCount > 0) parts.push(`${String(osvCount)} OSV dependency vulnerabilities`);
-  if (confirmed === 0 && osvCount === 0) parts.push("none blocking");
+  if (osv !== void 0 && osv.failedLookups > 0) {
+    parts.push(
+      `OSV not checked for ${String(osv.failedLookups)} of ${String(osv.queried)} dependencies (lookup failed)`
+    );
+  } else if (confirmed === 0 && osvCount === 0) {
+    parts.push("none blocking");
+  }
+  if (osv !== void 0 && osv.declared > osv.queried) {
+    parts.push(
+      `OSV covered ${String(osv.queried)} of ${String(osv.declared)} declared dependencies`
+    );
+  }
   return parts.join(", ");
 }
 
@@ -47052,7 +47093,7 @@ var memoryInitPromise = null;
 async function initPipelineMemory() {
   if (cachedMemory !== null) return cachedMemory;
   try {
-    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-OWEWA5BX.js");
+    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-B6TFD55A.js");
     const { getLearningDir } = await import("./learning-persistence-SR5F4DSY.js");
     const mem = createSessionMemory2(getLearningDir());
     mem.startSession(`pipeline-${String(getTimeProvider().now())}`);
@@ -47114,7 +47155,7 @@ function recordRoutingExperience(category, success, durationMs, tokensUsed = 0,
     callRecord(routingMemoryCache);
     return;
   }
-  routingMemoryInitPromise ??= import("./routing-memory-IZH3XQQH.js").then(({ createRoutingMemory }) => {
+  routingMemoryInitPromise ??= import("./routing-memory-YIKR7EMC.js").then(({ createRoutingMemory }) => {
     routingMemoryCache ??= createRoutingMemory();
     return routingMemoryCache;
   }).catch((error) => {
@@ -47148,7 +47189,7 @@ ${text}` : "";
 }
 async function getWeatherContext() {
   try {
-    const { generateWeatherReport: generateWeatherReport2 } = await import("./weather-report-4OFVK5Q5.js");
+    const { generateWeatherReport: generateWeatherReport2 } = await import("./weather-report-YDYML3JW.js");
     const report = generateWeatherReport2({ includeAdaptive: true });
     const mappings = "recommendedMappings" in report ? report.recommendedMappings : [];
     if (!Array.isArray(mappings) || mappings.length === 0) return "";
@@ -47166,7 +47207,7 @@ ${lines}
 }
 async function getMemoryContext(task) {
   try {
-    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-OWEWA5BX.js");
+    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-B6TFD55A.js");
     const { getLearningDir } = await import("./learning-persistence-SR5F4DSY.js");
     const memory = createSessionMemory2(getLearningDir(), { maxLearningsInContext: 10 });
     const learnings = memory.searchLearnings(task.slice(0, 200));
@@ -47285,7 +47326,7 @@ ${contextBlock}`;
       const strategy = config.votingStrategy ?? "higher_order";
       await postProgress(config, "Vote", `Running consensus with ${strategy} strategy...`);
       try {
-        const { executeVoting } = await import("./consensus-vote-TMMGZROW.js");
+        const { executeVoting } = await import("./consensus-vote-65UZRQMY.js");
         const votingResult = await executeVoting(
           {
             proposal: buildVoteProposal(plan, research),
@@ -47724,7 +47765,7 @@ async function searchCodebaseForTask(task) {
 }
 async function queryResearchRegistry(task) {
   try {
-    const { synthesizeResearch: synthesizeResearch2 } = await import("./research-helpers-synthesize-2R6TO2SP.js");
+    const { synthesizeResearch: synthesizeResearch2 } = await import("./research-helpers-synthesize-2XQBWVG6.js");
     const topic = task.split(/[.!?\n]/).filter((s) => s.trim().length > 10)[0]?.trim();
     if (topic === void 0) return null;
     const result = await synthesizeResearch2(topic.slice(0, 50));
@@ -47795,7 +47836,7 @@ function createScanStageWrapper() {
       try {
         const slug = ctx.task.match(/([a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+)/)?.[1];
         if (slug !== void 0) {
-          const { generateSecurityPlan: generateSecurityPlan2 } = await import("./repo-security-plan-NP6AT3NR.js");
+          const { generateSecurityPlan: generateSecurityPlan2 } = await import("./repo-security-plan-MF4E5MG6.js");
           const plan = await generateSecurityPlan2({ repo: slug, maxScanners: 10 });
           const recs = plan.recommendations.slice(0, 5).map((r) => `${r.priority}: ${r.displayName} (${r.category})`).join("; ");
           return output(PIPELINE_STATE_KEYS.FINDINGS, recs, getTimeProvider().now() - start, true);
@@ -50920,7 +50961,7 @@ var GitHubTaskTracker = class {
   cachedProvider = null;
   async getProvider() {
     if (this.cachedProvider !== null) return this.cachedProvider;
-    const { createScmProvider } = await import("./factory-OO7MN24L.js");
+    const { createScmProvider } = await import("./factory-WJ6AV4WU.js");
     const result = await createScmProvider({ repo: this.config.repo ?? "" });
     if (!result.ok) throw new Error(`SCM provider error: ${result.error.message}`);
     this.cachedProvider = result.value;
@@ -51833,7 +51874,7 @@ async function probeSource(source, includeModelIds) {
   }
 }
 async function defaultSources(includeOpenRouter) {
-  const { createAllAdapters: createAllAdapters2 } = await import("./factory-6FNJM6P3.js");
+  const { createAllAdapters: createAllAdapters2 } = await import("./factory-ZIYR7YJ3.js");
   const adapters = createAllAdapters2();
   return buildDefaultModelSources(adapters, { includeOpenRouter });
 }
@@ -55204,10 +55245,6 @@ function createFeedbackSubscriber(bus, store) {
   });
 }
 var cachedFeedbackUnsubscribe = null;
-function startFeedbackSubscriber(bus, store) {
-  if (cachedFeedbackUnsubscribe !== null) return;
-  cachedFeedbackUnsubscribe = createFeedbackSubscriber(bus, store);
-}
 function shutdownFeedbackSubscriber() {
   if (cachedFeedbackUnsubscribe !== null) {
     cachedFeedbackUnsubscribe();
@@ -55220,10 +55257,17 @@ function handleEvent2(event, store) {
   }
 }
 function recordStageFailed(event, store) {
+  const cli = event.model === void 0 ? void 0 : lookupInTreeCapability(event.model)?.cliName;
+  if (cli === void 0) {
+    logger57.debug("Skipping stage-failure outcome \u2014 no attributable CLI", {
+      stageId: event.stageId,
+      model: event.model ?? "absent"
+    });
+    return;
+  }
   const outcome = {
     id: `fb-fail-${event.executionId}-${String(event.timestamp)}`,
-    cli: DEFAULT_CLI,
-    // Stage failures don't carry CLI info; default to canonical fallback
+    cli,
     category: "code_generation",
     // Real model id when the emitter attributed one (#4194); 'unknown' is
     // reserved for stages that genuinely have no single model — never a guess.
@@ -55891,8 +55935,7 @@ export {
   initializeSandbox,
   getSandboxMode,
   createFeedbackSubscriber,
-  startFeedbackSubscriber,
   shutdownFeedbackSubscriber,
   createEventBusBridge
 };
-//# sourceMappingURL=chunk-BG2LQ5I2.js.map
+//# sourceMappingURL=chunk-VDEDTAHZ.js.map