nexus-agents 4.3.5 → 4.3.6

package/dist/{chunk-ZLGQY55I.js → chunk-CDLXONR6.js}

@@ -52,7 +52,7 @@ import {
 } from "./chunk-OQLFRJCW.js";
 
 // src/version.ts
-var VERSION = true ? "4.3.5" : "dev";
+var VERSION = true ? "4.3.6" : "dev";
 
 // src/config/schemas-core.ts
 import { z } from "zod";
@@ -2339,7 +2339,7 @@ async function runDoctorFix(result) {
   writeLine2("\u2500".repeat(40));
   let fixCount = 0;
   if (!result.dataDirectory.rootExists || result.dataDirectory.subdirectories.some((d) => !d.exists || !d.writable)) {
-    const { runSetup } = await import("./setup-command-DLIUAXMJ.js");
+    const { runSetup } = await import("./setup-command-TLIVUIVE.js");
     const setupResult = runSetup({
       skipMcp: true,
       skipRules: true,
@@ -2452,4 +2452,4 @@ export {
   startStdioServer,
   closeServer
 };
-//# sourceMappingURL=chunk-ZLGQY55I.js.map
+//# sourceMappingURL=chunk-CDLXONR6.js.map

package/dist/{chunk-ES3CPAON.js → chunk-K6VI5GUF.js}

@@ -22,7 +22,7 @@ import {
   DEFAULT_TASK_TTL_MS,
   DEFAULT_TOOL_RATE_LIMITS,
   clampTaskTtl
-} from "./chunk-ZLGQY55I.js";
+} from "./chunk-CDLXONR6.js";
 import {
   executeExpert
 } from "./chunk-QTP4AIVR.js";
@@ -54497,4 +54497,4 @@ export {
   shutdownFeedbackSubscriber,
   createEventBusBridge
 };
-//# sourceMappingURL=chunk-ES3CPAON.js.map
+//# sourceMappingURL=chunk-K6VI5GUF.js.map

package/dist/{chunk-HI63BMZ6.js → chunk-NXGHNZJV.js}

@@ -8,7 +8,7 @@ import {
   checkSqlite,
   defaultConfig,
   initDataDirectories
-} from "./chunk-ZLGQY55I.js";
+} from "./chunk-CDLXONR6.js";
 import {
   BUILT_IN_EXPERTS
 } from "./chunk-YPNQPT2F.js";
@@ -2001,4 +2001,4 @@ export {
   setupCommand,
   setupCommandAsync
 };
-//# sourceMappingURL=chunk-HI63BMZ6.js.map
+//# sourceMappingURL=chunk-NXGHNZJV.js.map

package/dist/cli.js

@@ -18,7 +18,7 @@ import "./chunk-TKFWYFBD.js";
 import {
   setupCommandAsync,
   verifyCommand
-} from "./chunk-HI63BMZ6.js";
+} from "./chunk-NXGHNZJV.js";
 import "./chunk-YIV4GQHK.js";
 import {
   AuthHandler,
@@ -139,7 +139,7 @@ import {
   validateCommand,
   validateWorkflow,
   wrapInMarkdownFence
-} from "./chunk-ES3CPAON.js";
+} from "./chunk-K6VI5GUF.js";
 import "./chunk-SHG3MYMD.js";
 import "./chunk-HFOQKCD2.js";
 import "./chunk-RSMG2DPB.js";
@@ -166,7 +166,7 @@ import {
   loadConfig,
   runDoctor,
   validateNexusEnv
-} from "./chunk-ZLGQY55I.js";
+} from "./chunk-CDLXONR6.js";
 import {
   buildOpenAICompatAdapters,
   readOpenAICompatEnv
@@ -4279,6 +4279,14 @@ function validateCommandWithPolicy(commandString, options = {}) {
   }
   return null;
 }
+function readErrorStdout(error) {
+  if (typeof error !== "object" || error === null || !("stdout" in error)) return null;
+  const { stdout } = error;
+  const text = typeof stdout === "string" ? stdout : Buffer.isBuffer(stdout) ? stdout.toString("utf-8") : null;
+  if (text === null) return null;
+  const trimmed = text.trim();
+  return trimmed === "" ? null : trimmed;
+}
 function safeExecSandboxed(commandString, options = {}) {
   const violation = validateCommandWithPolicy(commandString, options);
   if (violation !== null) {
@@ -4302,6 +4310,13 @@ function safeExecSandboxed(commandString, options = {}) {
     const result = execSync(commandString, execOptions);
     return typeof result === "string" ? result.trim() : result.toString("utf-8").trim();
   } catch (error) {
+    if (options.allowNonZeroExit === true) {
+      const stdout = readErrorStdout(error);
+      if (stdout !== null) {
+        logger4.debug("Command exited non-zero but produced output", { command: commandString });
+        return stdout;
+      }
+    }
     logger4.debug("Command execution failed", {
       command: commandString,
       error: getErrorMessage(error)
@@ -6329,6 +6344,12 @@ var SYSTEM_REVIEW_CONSTANTS = {
   /** Security severity penalties */
   SECURITY_HIGH_PENALTY: 20,
   SECURITY_MODERATE_PENALTY: 5,
+  /**
+   * Applied when the audit could not run (#4838). An unmeasured audit is not
+   * evidence of health, so it must not score the same as a clean one; it is
+   * set below SECURITY_HIGH_PENALTY because "unknown" is not "known bad".
+   */
+  SECURITY_UNMEASURED_PENALTY: 10,
   /** Code quality penalties */
   TYPECHECK_FAIL_PENALTY: 15,
   LINT_FAIL_PENALTY: 15,
@@ -6347,6 +6368,7 @@ var {
   DOC_REVIEW_PENALTY,
   SECURITY_HIGH_PENALTY,
   SECURITY_MODERATE_PENALTY,
+  SECURITY_UNMEASURED_PENALTY,
   TYPECHECK_FAIL_PENALTY,
   LINT_FAIL_PENALTY,
   LOW_COVERAGE_PENALTY,
@@ -6357,7 +6379,7 @@ function calculateHealthScore(r) {
   for (const d of r.docs) {
     score -= d.status === "stale" ? DOC_STALE_PENALTY : d.status === "review" ? DOC_REVIEW_PENALTY : 0;
   }
-  score -= r.security.high * SECURITY_HIGH_PENALTY + r.security.moderate * SECURITY_MODERATE_PENALTY;
+  score -= r.security.parseError === true ? SECURITY_UNMEASURED_PENALTY : r.security.high * SECURITY_HIGH_PENALTY + r.security.moderate * SECURITY_MODERATE_PENALTY;
   if (!r.quality.typecheckPass) score -= TYPECHECK_FAIL_PENALTY;
   if (!r.quality.lintPass) score -= LINT_FAIL_PENALTY;
   if (r.quality.coveragePercent !== null && r.quality.coveragePercent < COVERAGE_TARGET_PERCENT) {
@@ -6402,6 +6424,11 @@ function printPhase3(i) {
 function printPhase4(s) {
   writeLine(`${colors.cyan}Phase 4: Security Audit${colors.reset}
 `);
+  if (s.parseError === true) {
+    writeLine(`  ${formatStatus("warn")} Unmeasured \u2014 the audit did not run`);
+    writeLine("");
+    return;
+  }
   if (s.totalVulns === 0) {
     writeLine(`  ${formatStatus("pass")} No vulnerabilities found`);
   } else {
@@ -6428,6 +6455,9 @@ function formatDocRow(d) {
   const newerInfo = newerCount > 0 ? ` (${String(newerCount)} newer deps)` : "";
   return `| ${d.file} | ${String(d.daysSinceUpdate)} | ${statusIcon}${newerInfo} |`;
 }
+function formatSecurityCaveat(s) {
+  return s.parseError === true ? "> **Unmeasured:** the audit did not run \u2014 the counts below are defaults, not findings.\n\n" : "";
+}
 function createIssueBody(r) {
   const now = new Date(getTimeProvider().now());
   const date = now.toISOString().split("T")[0] ?? "unknown";
@@ -6462,7 +6492,7 @@ ${r.docs.map(formatDocRow).join("\n")}
 
 ### Phase 4: Security
 
-- High: ${String(r.security.high)}
+${formatSecurityCaveat(r.security)}- High: ${String(r.security.high)}
 - Moderate: ${String(r.security.moderate)}
 - Low: ${String(r.security.low)}
 
@@ -6750,9 +6780,9 @@ var {
   NOT_STARTED_TECHNIQUE_THRESHOLD,
   HEALTH_SCORE_WARN_THRESHOLD: HEALTH_SCORE_WARN_THRESHOLD2
 } = SYSTEM_REVIEW_CONSTANTS;
-function safeExec(command, cwd) {
+function safeExec(command, cwd, allowNonZeroExit = false) {
   const context = command.startsWith("gh ") ? "gh" : command.startsWith("git ") ? "git" : command.startsWith("pnpm ") ? "write" : "read";
-  return cwd !== void 0 ? safeExecSandboxed(command, { context, cwd }) : safeExecSandboxed(command, { context });
+  return cwd !== void 0 ? safeExecSandboxed(command, { context, cwd, allowNonZeroExit }) : safeExecSandboxed(command, { context, allowNonZeroExit });
 }
 function parseGhIssueList(json, context) {
   try {
@@ -6828,7 +6858,7 @@ function runPhase3() {
 }
 function runPhase4(projectRoot) {
   const def = { totalVulns: 0, high: 0, moderate: 0, low: 0, parseError: false };
-  const out = safeExec("pnpm audit --json", projectRoot);
+  const out = safeExec("pnpm audit --json", projectRoot, true);
   if (out === null) {
     logger7.warn("pnpm audit command failed or returned null", { projectRoot });
     return { ...def, parseError: true };