nexus-agents 4.3.5 → 4.4.0

package/dist/{chunk-ZLGQY55I.js → chunk-4KDZ4Q6B.js}

@@ -52,7 +52,7 @@ import {
 } from "./chunk-OQLFRJCW.js";
 
 // src/version.ts
-var VERSION = true ? "4.3.5" : "dev";
+var VERSION = true ? "4.4.0" : "dev";
 
 // src/config/schemas-core.ts
 import { z } from "zod";
@@ -2339,7 +2339,7 @@ async function runDoctorFix(result) {
   writeLine2("\u2500".repeat(40));
   let fixCount = 0;
   if (!result.dataDirectory.rootExists || result.dataDirectory.subdirectories.some((d) => !d.exists || !d.writable)) {
-    const { runSetup } = await import("./setup-command-DLIUAXMJ.js");
+    const { runSetup } = await import("./setup-command-4RQUTUDI.js");
     const setupResult = runSetup({
       skipMcp: true,
       skipRules: true,
@@ -2452,4 +2452,4 @@ export {
   startStdioServer,
   closeServer
 };
-//# sourceMappingURL=chunk-ZLGQY55I.js.map
+//# sourceMappingURL=chunk-4KDZ4Q6B.js.map

package/dist/{chunk-HI63BMZ6.js → chunk-FLCUFTXF.js}

@@ -8,7 +8,7 @@ import {
   checkSqlite,
   defaultConfig,
   initDataDirectories
-} from "./chunk-ZLGQY55I.js";
+} from "./chunk-4KDZ4Q6B.js";
 import {
   BUILT_IN_EXPERTS
 } from "./chunk-YPNQPT2F.js";
@@ -2001,4 +2001,4 @@ export {
   setupCommand,
   setupCommandAsync
 };
-//# sourceMappingURL=chunk-HI63BMZ6.js.map
+//# sourceMappingURL=chunk-FLCUFTXF.js.map

package/dist/{chunk-ES3CPAON.js → chunk-YBGX57DL.js}

@@ -22,7 +22,7 @@ import {
   DEFAULT_TASK_TTL_MS,
   DEFAULT_TOOL_RATE_LIMITS,
   clampTaskTtl
-} from "./chunk-ZLGQY55I.js";
+} from "./chunk-4KDZ4Q6B.js";
 import {
   executeExpert
 } from "./chunk-QTP4AIVR.js";
@@ -54497,4 +54497,4 @@ export {
   shutdownFeedbackSubscriber,
   createEventBusBridge
 };
-//# sourceMappingURL=chunk-ES3CPAON.js.map
+//# sourceMappingURL=chunk-YBGX57DL.js.map

package/dist/cli.js

@@ -18,7 +18,7 @@ import "./chunk-TKFWYFBD.js";
 import {
   setupCommandAsync,
   verifyCommand
-} from "./chunk-HI63BMZ6.js";
+} from "./chunk-FLCUFTXF.js";
 import "./chunk-YIV4GQHK.js";
 import {
   AuthHandler,
@@ -139,7 +139,7 @@ import {
   validateCommand,
   validateWorkflow,
   wrapInMarkdownFence
-} from "./chunk-ES3CPAON.js";
+} from "./chunk-YBGX57DL.js";
 import "./chunk-SHG3MYMD.js";
 import "./chunk-HFOQKCD2.js";
 import "./chunk-RSMG2DPB.js";
@@ -166,7 +166,7 @@ import {
   loadConfig,
   runDoctor,
   validateNexusEnv
-} from "./chunk-ZLGQY55I.js";
+} from "./chunk-4KDZ4Q6B.js";
 import {
   buildOpenAICompatAdapters,
   readOpenAICompatEnv
@@ -4279,6 +4279,14 @@ function validateCommandWithPolicy(commandString, options = {}) {
   }
   return null;
 }
+function readErrorStdout(error) {
+  if (typeof error !== "object" || error === null || !("stdout" in error)) return null;
+  const { stdout } = error;
+  const text = typeof stdout === "string" ? stdout : Buffer.isBuffer(stdout) ? stdout.toString("utf-8") : null;
+  if (text === null) return null;
+  const trimmed = text.trim();
+  return trimmed === "" ? null : trimmed;
+}
 function safeExecSandboxed(commandString, options = {}) {
   const violation = validateCommandWithPolicy(commandString, options);
   if (violation !== null) {
@@ -4302,6 +4310,13 @@ function safeExecSandboxed(commandString, options = {}) {
     const result = execSync(commandString, execOptions);
     return typeof result === "string" ? result.trim() : result.toString("utf-8").trim();
   } catch (error) {
+    if (options.allowNonZeroExit === true) {
+      const stdout = readErrorStdout(error);
+      if (stdout !== null) {
+        logger4.debug("Command exited non-zero but produced output", { command: commandString });
+        return stdout;
+      }
+    }
     logger4.debug("Command execution failed", {
       command: commandString,
       error: getErrorMessage(error)
@@ -6329,6 +6344,12 @@ var SYSTEM_REVIEW_CONSTANTS = {
   /** Security severity penalties */
   SECURITY_HIGH_PENALTY: 20,
   SECURITY_MODERATE_PENALTY: 5,
+  /**
+   * Applied when the audit could not run (#4838). An unmeasured audit is not
+   * evidence of health, so it must not score the same as a clean one; it is
+   * set below SECURITY_HIGH_PENALTY because "unknown" is not "known bad".
+   */
+  SECURITY_UNMEASURED_PENALTY: 10,
   /** Code quality penalties */
   TYPECHECK_FAIL_PENALTY: 15,
   LINT_FAIL_PENALTY: 15,
@@ -6347,6 +6368,7 @@ var {
   DOC_REVIEW_PENALTY,
   SECURITY_HIGH_PENALTY,
   SECURITY_MODERATE_PENALTY,
+  SECURITY_UNMEASURED_PENALTY,
   TYPECHECK_FAIL_PENALTY,
   LINT_FAIL_PENALTY,
   LOW_COVERAGE_PENALTY,
@@ -6357,7 +6379,7 @@ function calculateHealthScore(r) {
   for (const d of r.docs) {
     score -= d.status === "stale" ? DOC_STALE_PENALTY : d.status === "review" ? DOC_REVIEW_PENALTY : 0;
   }
-  score -= r.security.high * SECURITY_HIGH_PENALTY + r.security.moderate * SECURITY_MODERATE_PENALTY;
+  score -= r.security.parseError === true ? SECURITY_UNMEASURED_PENALTY : r.security.high * SECURITY_HIGH_PENALTY + r.security.moderate * SECURITY_MODERATE_PENALTY;
   if (!r.quality.typecheckPass) score -= TYPECHECK_FAIL_PENALTY;
   if (!r.quality.lintPass) score -= LINT_FAIL_PENALTY;
   if (r.quality.coveragePercent !== null && r.quality.coveragePercent < COVERAGE_TARGET_PERCENT) {
@@ -6402,6 +6424,11 @@ function printPhase3(i) {
 function printPhase4(s) {
   writeLine(`${colors.cyan}Phase 4: Security Audit${colors.reset}
 `);
+  if (s.parseError === true) {
+    writeLine(`  ${formatStatus("warn")} Unmeasured \u2014 the audit did not run`);
+    writeLine("");
+    return;
+  }
   if (s.totalVulns === 0) {
     writeLine(`  ${formatStatus("pass")} No vulnerabilities found`);
   } else {
@@ -6428,6 +6455,9 @@ function formatDocRow(d) {
   const newerInfo = newerCount > 0 ? ` (${String(newerCount)} newer deps)` : "";
   return `| ${d.file} | ${String(d.daysSinceUpdate)} | ${statusIcon}${newerInfo} |`;
 }
+function formatSecurityCaveat(s) {
+  return s.parseError === true ? "> **Unmeasured:** the audit did not run \u2014 the counts below are defaults, not findings.\n\n" : "";
+}
 function createIssueBody(r) {
   const now = new Date(getTimeProvider().now());
   const date = now.toISOString().split("T")[0] ?? "unknown";
@@ -6462,7 +6492,7 @@ ${r.docs.map(formatDocRow).join("\n")}
 
 ### Phase 4: Security
 
-- High: ${String(r.security.high)}
+${formatSecurityCaveat(r.security)}- High: ${String(r.security.high)}
 - Moderate: ${String(r.security.moderate)}
 - Low: ${String(r.security.low)}
 
@@ -6750,9 +6780,9 @@ var {
   NOT_STARTED_TECHNIQUE_THRESHOLD,
   HEALTH_SCORE_WARN_THRESHOLD: HEALTH_SCORE_WARN_THRESHOLD2
 } = SYSTEM_REVIEW_CONSTANTS;
-function safeExec(command, cwd) {
+function safeExec(command, cwd, allowNonZeroExit = false) {
   const context = command.startsWith("gh ") ? "gh" : command.startsWith("git ") ? "git" : command.startsWith("pnpm ") ? "write" : "read";
-  return cwd !== void 0 ? safeExecSandboxed(command, { context, cwd }) : safeExecSandboxed(command, { context });
+  return cwd !== void 0 ? safeExecSandboxed(command, { context, cwd, allowNonZeroExit }) : safeExecSandboxed(command, { context, allowNonZeroExit });
 }
 function parseGhIssueList(json, context) {
   try {
@@ -6828,7 +6858,7 @@ function runPhase3() {
 }
 function runPhase4(projectRoot) {
   const def = { totalVulns: 0, high: 0, moderate: 0, low: 0, parseError: false };
-  const out = safeExec("pnpm audit --json", projectRoot);
+  const out = safeExec("pnpm audit --json", projectRoot, true);
   if (out === null) {
     logger7.warn("pnpm audit command failed or returned null", { projectRoot });
     return { ...def, parseError: true };
@@ -14776,13 +14806,36 @@ async function releaseNotesCommand(args) {
 import { readFileSync as readFileSync10 } from "fs";
 
 // src/cli/release-validate-helpers.ts
-import { execSync as execSync2 } from "child_process";
+import { execSync as execSync3 } from "child_process";
 import { existsSync as existsSync14, readFileSync as readFileSync9 } from "fs";
+
+// src/cli/release-secret-scan.ts
+import { execSync as execSync2 } from "child_process";
+var SECRET_LINE_PATTERN = /api[_-]?key|secret|password|token/i;
+var MAX_REPORTED_MATCHES = 5;
+function scanRecentCommitsForSecrets(options = {}) {
+  const range = options.range ?? "HEAD~10..HEAD";
+  let diff;
+  try {
+    diff = execSync2(`git diff ${range} -- "*.ts" "*.js"`, {
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: CLI_SUBPROCESS_TIMEOUTS.ghCommandMs,
+      ...options.cwd === void 0 ? {} : { cwd: options.cwd }
+    });
+  } catch (error) {
+    return { ok: false, reason: error instanceof Error ? error.message : String(error) };
+  }
+  const matches = diff.split("\n").filter((line) => SECRET_LINE_PATTERN.test(line)).slice(0, MAX_REPORTED_MATCHES);
+  return { ok: true, matches };
+}
+
+// src/cli/release-validate-helpers.ts
 async function validateSecurity(options) {
   const startTime = Date.now();
   const findings = [];
   try {
-    execSync2("npm audit --audit-level=high 2>/dev/null", {
+    execSync3("npm audit --audit-level=high 2>/dev/null", {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
       timeout: CLI_SUBPROCESS_TIMEOUTS.ghCommandMs
@@ -14805,37 +14858,29 @@ async function validateSecurity(options) {
       remediation: "Ensure .env is in .gitignore and not committed."
     });
   }
-  try {
-    const result = execSync2(
-      'git diff HEAD~10..HEAD -- "*.ts" "*.js" | grep -iE "(api[_-]?key|secret|password|token)" | head -5',
-      {
-        encoding: "utf-8",
-        stdio: ["pipe", "pipe", "pipe"],
-        timeout: CLI_SUBPROCESS_TIMEOUTS.ghCommandMs
-      }
-    );
-    if (result.trim()) {
-      findings.push({
-        severity: "warning",
-        category: "security",
-        title: "Potential secrets in recent commits",
-        description: "Recent commits may contain hardcoded secrets.",
-        remediation: "Review commits for any exposed credentials."
-      });
-    }
-  } catch {
+  const scan = scanRecentCommitsForSecrets();
+  if (!scan.ok) {
     findings.push({
       severity: "warning",
       category: "security",
       title: "Secret scan did not run",
-      description: "The hardcoded-secret scan over recent commits failed to execute.",
+      description: `The hardcoded-secret scan over recent commits failed to execute: ${scan.reason}`,
       remediation: "Re-run with a full git history available, then review the output."
     });
+  } else if (scan.matches.length > 0) {
+    findings.push({
+      severity: "warning",
+      category: "security",
+      title: "Potential secrets in recent commits",
+      description: "Recent commits may contain hardcoded secrets.",
+      remediation: "Review commits for any exposed credentials."
+    });
   }
   return {
     expert: "security",
-    // whenEmpty = false: with the failure above recorded as a finding, an empty
-    // list now genuinely means "scanned, nothing found" (#4581).
+    // whenEmpty = false: an empty list genuinely means "scanned, nothing
+    // found" — every check above records a finding when it cannot run, which
+    // for the secret scan required #4839 as well as #4581.
     passed: !anyOf(findings, (f) => f.severity === "error", false),
     confidence: 0.85,
     findings,
@@ -14846,7 +14891,7 @@ async function validateArchitecture2(options) {
   const startTime = Date.now();
   const findings = [];
   try {
-    const result = execSync2("npx nexus-agents fitness-audit --format=json 2>/dev/null", {
+    const result = execSync3("npx nexus-agents fitness-audit --format=json 2>/dev/null", {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
       timeout: CLI_SUBPROCESS_TIMEOUTS.releaseValidateMs
@@ -14967,7 +15012,7 @@ async function validateDevOps(options) {
   const startTime = Date.now();
   const findings = [];
   try {
-    execSync2("pnpm build 2>/dev/null", {
+    execSync3("pnpm build 2>/dev/null", {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
       timeout: CLI_SUBPROCESS_TIMEOUTS.releaseValidateMs
@@ -14988,7 +15033,7 @@ async function validateDevOps(options) {
     });
   }
   try {
-    execSync2("pnpm lint 2>/dev/null", {
+    execSync3("pnpm lint 2>/dev/null", {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
       timeout: CLI_SUBPROCESS_TIMEOUTS.releaseBuildMs
@@ -15009,7 +15054,7 @@ async function validateDevOps(options) {
     });
   }
   try {
-    execSync2("pnpm typecheck 2>/dev/null", {
+    execSync3("pnpm typecheck 2>/dev/null", {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
       timeout: CLI_SUBPROCESS_TIMEOUTS.releaseValidateMs
@@ -16270,6 +16315,7 @@ Winner (by success rate): ${report.winnerBySuccessRate}`);
 }
 
 // src/cli/memory-eval.ts
+var TOP_K = 5;
 function generateEvalDataset(size = 50) {
   const pairs = [];
   const sources = ["session", "belief", "agentic", "typed"];
@@ -16285,16 +16331,19 @@ function generateEvalDataset(size = 50) {
     { query: "logging best practices", content: "Structured JSON logs with correlation IDs" },
     { query: "security vulnerability scan", content: "Dependabot and CodeQL automated scans" }
   ];
+  const queryCount = Math.max(1, Math.min(topics.length, Math.floor(size / (TOP_K * 2))));
   for (let i = 0; i < size; i++) {
-    const topicIdx = i % topics.length;
+    const topicIdx = i % queryCount;
     const topic = topics[topicIdx];
     const source = sources[i % sources.length] ?? "session";
     const isRelevant = i % 3 !== 0;
-    if (topic !== void 0) {
+    const offset = 1 + i % (topics.length - 1);
+    const contentTopic = isRelevant ? topic : topics[(topicIdx + offset) % topics.length];
+    if (topic !== void 0 && contentTopic !== void 0) {
       pairs.push({
-        query: isRelevant ? topic.query : `unrelated query ${String(i)}`,
+        query: topic.query,
         memoryKey: `mem-${String(i)}-${source}`,
-        memoryContent: topic.content,
+        memoryContent: contentTopic.content,
         source,
         expectedRelevant: isRelevant
       });
@@ -16344,8 +16393,9 @@ function expandKeywords(query) {
   return result;
 }
 function evaluateScorer(dataset, scorer) {
-  const k = 5;
+  const k = TOP_K;
   let totalRecall = 0;
+  let recallQueries = 0;
   let totalPrecision = 0;
   let totalMrr = 0;
   const latencies = [];
@@ -16363,7 +16413,10 @@ function evaluateScorer(dataset, scorer) {
     const topK = scored.slice(0, k);
     const relevantInTopK = topK.filter((s) => s.relevant).length;
     const totalRelevant = pairs.filter((p) => p.expectedRelevant).length;
-    totalRecall += totalRelevant > 0 ? relevantInTopK / totalRelevant : 1;
+    if (totalRelevant > 0) {
+      totalRecall += relevantInTopK / totalRelevant;
+      recallQueries += 1;
+    }
     totalPrecision += topK.length > 0 ? relevantInTopK / topK.length : 0;
     const firstRelevantIdx = scored.findIndex((s) => s.relevant);
     totalMrr += firstRelevantIdx >= 0 ? 1 / (firstRelevantIdx + 1) : 0;
@@ -16372,12 +16425,13 @@ function evaluateScorer(dataset, scorer) {
   latencies.sort((a, b) => a - b);
   const p95Idx = Math.floor(latencies.length * 0.95);
   return {
-    recallAt5: n > 0 ? round(totalRecall / n) : 0,
+    recallAt5: recallQueries > 0 ? round(totalRecall / recallQueries) : 0,
     precisionAt5: n > 0 ? round(totalPrecision / n) : 0,
     mrr: n > 0 ? round(totalMrr / n) : 0,
     avgLatencyMs: round(average(latencies)),
     p95LatencyMs: round(latencies[p95Idx] ?? 0),
-    totalQueries: n
+    totalQueries: n,
+    recallQueries
   };
 }
 function groupByQuery(dataset) {
@@ -16416,6 +16470,11 @@ function formatMemoryEvalReport(report) {
 }
 function formatEvalDetails(baseline, reflective, improvement, datasetSize) {
   const lines = [`Dataset: ${String(datasetSize)} query-memory pairs`];
+  if (baseline.recallQueries < baseline.totalQueries) {
+    lines.push(
+      `Recall measured over ${String(baseline.recallQueries)} of ${String(baseline.totalQueries)} queries \u2014 the rest had no relevant memory.`
+    );
+  }
   lines.push("\nBaseline (keyword search):");
   lines.push(`  Recall@5:    ${baseline.recallAt5.toFixed(3)}`);
   lines.push(`  Precision@5: ${baseline.precisionAt5.toFixed(3)}`);