nexus-agents 4.3.6 → 4.4.0

package/dist/{chunk-CDLXONR6.js → chunk-4KDZ4Q6B.js}

@@ -52,7 +52,7 @@ import {
 } from "./chunk-OQLFRJCW.js";
 
 // src/version.ts
-var VERSION = true ? "4.3.6" : "dev";
+var VERSION = true ? "4.4.0" : "dev";
 
 // src/config/schemas-core.ts
 import { z } from "zod";
@@ -2339,7 +2339,7 @@ async function runDoctorFix(result) {
   writeLine2("\u2500".repeat(40));
   let fixCount = 0;
   if (!result.dataDirectory.rootExists || result.dataDirectory.subdirectories.some((d) => !d.exists || !d.writable)) {
-    const { runSetup } = await import("./setup-command-TLIVUIVE.js");
+    const { runSetup } = await import("./setup-command-4RQUTUDI.js");
     const setupResult = runSetup({
       skipMcp: true,
       skipRules: true,
@@ -2452,4 +2452,4 @@ export {
   startStdioServer,
   closeServer
 };
-//# sourceMappingURL=chunk-CDLXONR6.js.map
+//# sourceMappingURL=chunk-4KDZ4Q6B.js.map

package/dist/{chunk-NXGHNZJV.js → chunk-FLCUFTXF.js}

@@ -8,7 +8,7 @@ import {
   checkSqlite,
   defaultConfig,
   initDataDirectories
-} from "./chunk-CDLXONR6.js";
+} from "./chunk-4KDZ4Q6B.js";
 import {
   BUILT_IN_EXPERTS
 } from "./chunk-YPNQPT2F.js";
@@ -2001,4 +2001,4 @@ export {
   setupCommand,
   setupCommandAsync
 };
-//# sourceMappingURL=chunk-NXGHNZJV.js.map
+//# sourceMappingURL=chunk-FLCUFTXF.js.map

package/dist/{chunk-K6VI5GUF.js → chunk-YBGX57DL.js}

@@ -22,7 +22,7 @@ import {
   DEFAULT_TASK_TTL_MS,
   DEFAULT_TOOL_RATE_LIMITS,
   clampTaskTtl
-} from "./chunk-CDLXONR6.js";
+} from "./chunk-4KDZ4Q6B.js";
 import {
   executeExpert
 } from "./chunk-QTP4AIVR.js";
@@ -54497,4 +54497,4 @@ export {
   shutdownFeedbackSubscriber,
   createEventBusBridge
 };
-//# sourceMappingURL=chunk-K6VI5GUF.js.map
+//# sourceMappingURL=chunk-YBGX57DL.js.map

package/dist/cli.js

@@ -18,7 +18,7 @@ import "./chunk-TKFWYFBD.js";
 import {
   setupCommandAsync,
   verifyCommand
-} from "./chunk-NXGHNZJV.js";
+} from "./chunk-FLCUFTXF.js";
 import "./chunk-YIV4GQHK.js";
 import {
   AuthHandler,
@@ -139,7 +139,7 @@ import {
   validateCommand,
   validateWorkflow,
   wrapInMarkdownFence
-} from "./chunk-K6VI5GUF.js";
+} from "./chunk-YBGX57DL.js";
 import "./chunk-SHG3MYMD.js";
 import "./chunk-HFOQKCD2.js";
 import "./chunk-RSMG2DPB.js";
@@ -166,7 +166,7 @@ import {
   loadConfig,
   runDoctor,
   validateNexusEnv
-} from "./chunk-CDLXONR6.js";
+} from "./chunk-4KDZ4Q6B.js";
 import {
   buildOpenAICompatAdapters,
   readOpenAICompatEnv
@@ -14806,13 +14806,36 @@ async function releaseNotesCommand(args) {
 import { readFileSync as readFileSync10 } from "fs";
 
 // src/cli/release-validate-helpers.ts
-import { execSync as execSync2 } from "child_process";
+import { execSync as execSync3 } from "child_process";
 import { existsSync as existsSync14, readFileSync as readFileSync9 } from "fs";
+
+// src/cli/release-secret-scan.ts
+import { execSync as execSync2 } from "child_process";
+var SECRET_LINE_PATTERN = /api[_-]?key|secret|password|token/i;
+var MAX_REPORTED_MATCHES = 5;
+function scanRecentCommitsForSecrets(options = {}) {
+  const range = options.range ?? "HEAD~10..HEAD";
+  let diff;
+  try {
+    diff = execSync2(`git diff ${range} -- "*.ts" "*.js"`, {
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: CLI_SUBPROCESS_TIMEOUTS.ghCommandMs,
+      ...options.cwd === void 0 ? {} : { cwd: options.cwd }
+    });
+  } catch (error) {
+    return { ok: false, reason: error instanceof Error ? error.message : String(error) };
+  }
+  const matches = diff.split("\n").filter((line) => SECRET_LINE_PATTERN.test(line)).slice(0, MAX_REPORTED_MATCHES);
+  return { ok: true, matches };
+}
+
+// src/cli/release-validate-helpers.ts
 async function validateSecurity(options) {
   const startTime = Date.now();
   const findings = [];
   try {
-    execSync2("npm audit --audit-level=high 2>/dev/null", {
+    execSync3("npm audit --audit-level=high 2>/dev/null", {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
       timeout: CLI_SUBPROCESS_TIMEOUTS.ghCommandMs
@@ -14835,37 +14858,29 @@ async function validateSecurity(options) {
       remediation: "Ensure .env is in .gitignore and not committed."
     });
   }
-  try {
-    const result = execSync2(
-      'git diff HEAD~10..HEAD -- "*.ts" "*.js" | grep -iE "(api[_-]?key|secret|password|token)" | head -5',
-      {
-        encoding: "utf-8",
-        stdio: ["pipe", "pipe", "pipe"],
-        timeout: CLI_SUBPROCESS_TIMEOUTS.ghCommandMs
-      }
-    );
-    if (result.trim()) {
-      findings.push({
-        severity: "warning",
-        category: "security",
-        title: "Potential secrets in recent commits",
-        description: "Recent commits may contain hardcoded secrets.",
-        remediation: "Review commits for any exposed credentials."
-      });
-    }
-  } catch {
+  const scan = scanRecentCommitsForSecrets();
+  if (!scan.ok) {
     findings.push({
       severity: "warning",
       category: "security",
       title: "Secret scan did not run",
-      description: "The hardcoded-secret scan over recent commits failed to execute.",
+      description: `The hardcoded-secret scan over recent commits failed to execute: ${scan.reason}`,
       remediation: "Re-run with a full git history available, then review the output."
     });
+  } else if (scan.matches.length > 0) {
+    findings.push({
+      severity: "warning",
+      category: "security",
+      title: "Potential secrets in recent commits",
+      description: "Recent commits may contain hardcoded secrets.",
+      remediation: "Review commits for any exposed credentials."
+    });
   }
   return {
     expert: "security",
-    // whenEmpty = false: with the failure above recorded as a finding, an empty
-    // list now genuinely means "scanned, nothing found" (#4581).
+    // whenEmpty = false: an empty list genuinely means "scanned, nothing
+    // found" — every check above records a finding when it cannot run, which
+    // for the secret scan required #4839 as well as #4581.
     passed: !anyOf(findings, (f) => f.severity === "error", false),
     confidence: 0.85,
     findings,
@@ -14876,7 +14891,7 @@ async function validateArchitecture2(options) {
   const startTime = Date.now();
   const findings = [];
   try {
-    const result = execSync2("npx nexus-agents fitness-audit --format=json 2>/dev/null", {
+    const result = execSync3("npx nexus-agents fitness-audit --format=json 2>/dev/null", {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
       timeout: CLI_SUBPROCESS_TIMEOUTS.releaseValidateMs
@@ -14997,7 +15012,7 @@ async function validateDevOps(options) {
   const startTime = Date.now();
   const findings = [];
   try {
-    execSync2("pnpm build 2>/dev/null", {
+    execSync3("pnpm build 2>/dev/null", {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
       timeout: CLI_SUBPROCESS_TIMEOUTS.releaseValidateMs
@@ -15018,7 +15033,7 @@ async function validateDevOps(options) {
     });
   }
   try {
-    execSync2("pnpm lint 2>/dev/null", {
+    execSync3("pnpm lint 2>/dev/null", {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
       timeout: CLI_SUBPROCESS_TIMEOUTS.releaseBuildMs
@@ -15039,7 +15054,7 @@ async function validateDevOps(options) {
     });
   }
   try {
-    execSync2("pnpm typecheck 2>/dev/null", {
+    execSync3("pnpm typecheck 2>/dev/null", {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
       timeout: CLI_SUBPROCESS_TIMEOUTS.releaseValidateMs
@@ -16300,6 +16315,7 @@ Winner (by success rate): ${report.winnerBySuccessRate}`);
 }
 
 // src/cli/memory-eval.ts
+var TOP_K = 5;
 function generateEvalDataset(size = 50) {
   const pairs = [];
   const sources = ["session", "belief", "agentic", "typed"];
@@ -16315,16 +16331,19 @@ function generateEvalDataset(size = 50) {
     { query: "logging best practices", content: "Structured JSON logs with correlation IDs" },
     { query: "security vulnerability scan", content: "Dependabot and CodeQL automated scans" }
   ];
+  const queryCount = Math.max(1, Math.min(topics.length, Math.floor(size / (TOP_K * 2))));
   for (let i = 0; i < size; i++) {
-    const topicIdx = i % topics.length;
+    const topicIdx = i % queryCount;
     const topic = topics[topicIdx];
     const source = sources[i % sources.length] ?? "session";
     const isRelevant = i % 3 !== 0;
-    if (topic !== void 0) {
+    const offset = 1 + i % (topics.length - 1);
+    const contentTopic = isRelevant ? topic : topics[(topicIdx + offset) % topics.length];
+    if (topic !== void 0 && contentTopic !== void 0) {
       pairs.push({
-        query: isRelevant ? topic.query : `unrelated query ${String(i)}`,
+        query: topic.query,
         memoryKey: `mem-${String(i)}-${source}`,
-        memoryContent: topic.content,
+        memoryContent: contentTopic.content,
         source,
         expectedRelevant: isRelevant
       });
@@ -16374,8 +16393,9 @@ function expandKeywords(query) {
   return result;
 }
 function evaluateScorer(dataset, scorer) {
-  const k = 5;
+  const k = TOP_K;
   let totalRecall = 0;
+  let recallQueries = 0;
   let totalPrecision = 0;
   let totalMrr = 0;
   const latencies = [];
@@ -16393,7 +16413,10 @@ function evaluateScorer(dataset, scorer) {
     const topK = scored.slice(0, k);
     const relevantInTopK = topK.filter((s) => s.relevant).length;
     const totalRelevant = pairs.filter((p) => p.expectedRelevant).length;
-    totalRecall += totalRelevant > 0 ? relevantInTopK / totalRelevant : 1;
+    if (totalRelevant > 0) {
+      totalRecall += relevantInTopK / totalRelevant;
+      recallQueries += 1;
+    }
     totalPrecision += topK.length > 0 ? relevantInTopK / topK.length : 0;
     const firstRelevantIdx = scored.findIndex((s) => s.relevant);
     totalMrr += firstRelevantIdx >= 0 ? 1 / (firstRelevantIdx + 1) : 0;
@@ -16402,12 +16425,13 @@ function evaluateScorer(dataset, scorer) {
   latencies.sort((a, b) => a - b);
   const p95Idx = Math.floor(latencies.length * 0.95);
   return {
-    recallAt5: n > 0 ? round(totalRecall / n) : 0,
+    recallAt5: recallQueries > 0 ? round(totalRecall / recallQueries) : 0,
     precisionAt5: n > 0 ? round(totalPrecision / n) : 0,
     mrr: n > 0 ? round(totalMrr / n) : 0,
     avgLatencyMs: round(average(latencies)),
     p95LatencyMs: round(latencies[p95Idx] ?? 0),
-    totalQueries: n
+    totalQueries: n,
+    recallQueries
   };
 }
 function groupByQuery(dataset) {
@@ -16446,6 +16470,11 @@ function formatMemoryEvalReport(report) {
 }
 function formatEvalDetails(baseline, reflective, improvement, datasetSize) {
   const lines = [`Dataset: ${String(datasetSize)} query-memory pairs`];
+  if (baseline.recallQueries < baseline.totalQueries) {
+    lines.push(
+      `Recall measured over ${String(baseline.recallQueries)} of ${String(baseline.totalQueries)} queries \u2014 the rest had no relevant memory.`
+    );
+  }
   lines.push("\nBaseline (keyword search):");
   lines.push(`  Recall@5:    ${baseline.recallAt5.toFixed(3)}`);
   lines.push(`  Precision@5: ${baseline.precisionAt5.toFixed(3)}`);