nexus-agents 8.112.1 → 8.112.2

package/dist/{ast-rule-runner-25ZAEIFB.js → ast-rule-runner-UEQO7V4Y.js}

@@ -9,9 +9,9 @@ import {
   getBuiltInAstRulesPath,
   loadRules,
   runAstQaRules
-} from "./chunk-AQ3Q2HSV.js";
+} from "./chunk-DAWGZNLK.js";
 import "./chunk-XEPZSDN5.js";
-import "./chunk-2ZGG2AHM.js";
+import "./chunk-Y4ZLHASZ.js";
 import "./chunk-UE7A2XHM.js";
 import "./chunk-LWOX65CP.js";
 import "./chunk-PX6F3LHL.js";
@@ -27,4 +27,4 @@ export {
   loadRules,
   runAstQaRules
 };
-//# sourceMappingURL=ast-rule-runner-25ZAEIFB.js.map
+//# sourceMappingURL=ast-rule-runner-UEQO7V4Y.js.map

package/dist/{child-mcp-config-7F4RU5OD.js → child-mcp-config-BYNNNVZF.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-OITVVSWO.js";
 import {
   createLogger
-} from "./chunk-2ZGG2AHM.js";
+} from "./chunk-Y4ZLHASZ.js";
 import "./chunk-UE7A2XHM.js";
 import "./chunk-LWOX65CP.js";
 import "./chunk-PX6F3LHL.js";
@@ -47,4 +47,4 @@ async function generateMcpConfig(options) {
 export {
   generateMcpConfig
 };
-//# sourceMappingURL=child-mcp-config-7F4RU5OD.js.map
+//# sourceMappingURL=child-mcp-config-BYNNNVZF.js.map

package/dist/{chunk-AVBP6LRJ.js → chunk-27E5O3GY.js}

@@ -7,7 +7,7 @@ import {
   CACHE_TIMEOUTS,
   createLogger,
   getTimeProvider
-} from "./chunk-2ZGG2AHM.js";
+} from "./chunk-Y4ZLHASZ.js";
 
 // src/security/input-sanitizer.ts
 var DANGEROUS_HTML_PATTERN = /<(picture|source|img)\b[^>]*>[\s\S]*?<\/\1>|<(picture|source|img)\b[^>]*\/?>/gi;
@@ -509,4 +509,4 @@ export {
   resolveReputationGatingMode,
   gateWithReputation
 };
-//# sourceMappingURL=chunk-AVBP6LRJ.js.map
+//# sourceMappingURL=chunk-27E5O3GY.js.map

package/dist/{chunk-JIRCYZKV.js → chunk-3E4J3EE6.js}

@@ -1,6 +1,6 @@
 import {
   CUSTOM_API_DEFAULT_MODEL
-} from "./chunk-SDMXHEQA.js";
+} from "./chunk-CZ7EPWIJ.js";
 import {
   AdapterModelError,
   BaseAdapter,
@@ -10,7 +10,7 @@ import {
   readGatewayTransport,
   requireApiKey,
   validateApiKeyPresence
-} from "./chunk-LW73YKZK.js";
+} from "./chunk-6FC5VVDA.js";
 import {
   assertCustomApiHostResolvesPublic,
   hostnameOf,
@@ -19,28 +19,28 @@ import {
   readGatewayEnv,
   redactApiKey,
   validateCustomApiBaseUrl
-} from "./chunk-RRQU3SCH.js";
+} from "./chunk-YBRWJBHN.js";
 import {
   sanitizeOutput
-} from "./chunk-HSD6QCYP.js";
+} from "./chunk-HEBQA4E4.js";
 import {
   nexusMkdtempSync
 } from "./chunk-OITVVSWO.js";
 import {
   getAvailabilityCache
-} from "./chunk-KTL4ECT6.js";
+} from "./chunk-3SY2GPU3.js";
 import {
   extractSystemPrompt
 } from "./chunk-QZUG667L.js";
 import {
   generateHyphenId
-} from "./chunk-A5AWEWO2.js";
+} from "./chunk-ZWXZY3Z7.js";
 import {
   CliCircuitBreaker,
   DEFAULT_CIRCUIT_BREAKER_CONFIG,
   getCliCircuitBreakerSnapshot,
   getDefaultCliCircuitBreakerRegistry
-} from "./chunk-QXAMYEGJ.js";
+} from "./chunk-GFNUYOCY.js";
 import {
   CLI_NAMES,
   CLI_SUBPROCESS_TIMEOUTS,
@@ -106,7 +106,7 @@ import {
   resolveRetryAfterMs,
   toModelTokenUsage,
   warnIfGatewayCostUndeclared
-} from "./chunk-2ZGG2AHM.js";
+} from "./chunk-Y4ZLHASZ.js";
 import {
   parseBoolValue
 } from "./chunk-LWOX65CP.js";
@@ -2203,7 +2203,7 @@ function stampNoRelaunch(cliName, childEnv) {
 }
 
 // src/cli-adapters/process-tree-kill.ts
-import { execFileSync } from "node:child_process";
+import { execFile, execFileSync } from "node:child_process";
 import { readdirSync, readFileSync as readFileSync2 } from "node:fs";
 
 // src/cli-adapters/proc-start-time.ts
@@ -2227,6 +2227,8 @@ function readProcStartTime(pid) {
 
 // src/cli-adapters/process-tree-kill.ts
 var MAX_DESCENDANTS = 1e3;
+var PS_ARGS = ["-A", "-o", "pid=,ppid="];
+var PS_TIMEOUT_MS = 2e3;
 function isSpawnedProcess(child) {
   return typeof child.pid === "number" && typeof child.spawnfile === "string" && Array.isArray(child.spawnargs);
 }
@@ -2246,30 +2248,36 @@ function procChildren(pid) {
     return void 0;
   }
 }
-function psChildMap() {
+function parsePsChildMap(out) {
+  const map = /* @__PURE__ */ new Map();
+  for (const line of out.split("\n")) {
+    const [pidText, ppidText] = line.trim().split(/\s+/);
+    const pid = Number(pidText);
+    const ppid = Number(ppidText);
+    if (!Number.isInteger(pid) || !Number.isInteger(ppid)) continue;
+    map.set(ppid, [...map.get(ppid) ?? [], pid]);
+  }
+  return map;
+}
+function psChildMapSync() {
   if (process.platform === "win32") return void 0;
   try {
-    const out = execFileSync("ps", ["-A", "-o", "pid=,ppid="], {
-      encoding: "utf8",
-      timeout: 2e3
-    });
-    const map = /* @__PURE__ */ new Map();
-    for (const line of out.split("\n")) {
-      const [pidText, ppidText] = line.trim().split(/\s+/);
-      const pid = Number(pidText);
-      const ppid = Number(ppidText);
-      if (!Number.isInteger(pid) || !Number.isInteger(ppid)) continue;
-      map.set(ppid, [...map.get(ppid) ?? [], pid]);
-    }
-    return map;
+    return parsePsChildMap(
+      execFileSync("ps", PS_ARGS, { encoding: "utf8", timeout: PS_TIMEOUT_MS })
+    );
   } catch {
     return void 0;
   }
 }
-function collectDescendants(root) {
-  const useProc = process.platform === "linux" && procChildren(root) !== void 0;
-  const psMap = useProc ? void 0 : psChildMap();
-  const childrenOf = (pid) => (useProc ? procChildren(pid) : psMap?.get(pid)) ?? [];
+function psChildMapAsync() {
+  if (process.platform === "win32") return Promise.resolve(void 0);
+  return new Promise((resolve) => {
+    execFile("ps", PS_ARGS, { encoding: "utf8", timeout: PS_TIMEOUT_MS }, (error, stdout) => {
+      resolve(error === null ? parsePsChildMap(stdout) : void 0);
+    });
+  });
+}
+function walkDescendants(root, childrenOf) {
   const seen = /* @__PURE__ */ new Set([root]);
   const out = [];
   const queue = [root];
@@ -2284,6 +2292,15 @@ function collectDescendants(root) {
   }
   return out;
 }
+function collectDescendants(root) {
+  const useProc = process.platform === "linux" && procChildren(root) !== void 0;
+  const psMap = useProc ? void 0 : psChildMapSync();
+  return walkDescendants(root, (pid) => (useProc ? procChildren(pid) : psMap?.get(pid)) ?? []);
+}
+async function collectDescendantsAsync(root) {
+  const psMap = await psChildMapAsync();
+  return walkDescendants(root, (pid) => psMap?.get(pid) ?? []);
+}
 function isPidAlive(pid) {
   try {
     process.kill(pid, 0);
@@ -2294,6 +2311,7 @@ function isPidAlive(pid) {
 }
 var defaultOps = {
   collectDescendants,
+  collectDescendantsAsync: process.platform === "linux" ? void 0 : collectDescendantsAsync,
   hasStartTimes: process.platform === "linux",
   readStartTime: readProcStartTime,
   isPidAlive,
@@ -2326,10 +2344,10 @@ function hasExited(child) {
 }
 var liveTrees = /* @__PURE__ */ new Map();
 var exitHookInstalled = false;
-function signalProcessTree(child, signal, known, ops = defaultOps) {
-  const pid = child.pid;
-  const walk = isSpawnedProcess(child) && pid !== void 0 && !hasExited(child);
-  const fresh = walk ? identify(ops.collectDescendants(pid), ops) : [];
+function walkablePid(child) {
+  return isSpawnedProcess(child) && !hasExited(child) ? child.pid : void 0;
+}
+function signalCollected(child, signal, known, fresh, ops) {
   const candidates = uniqueByPid([...known, ...liveTrees.get(child) ?? [], ...fresh]);
   child.kill(signal);
   const tree = candidates.filter((entry) => isSameProcess(entry, ops));
@@ -2342,6 +2360,26 @@ function signalProcessTree(child, signal, known, ops = defaultOps) {
   if (liveTrees.has(child)) liveTrees.set(child, tree);
   return tree;
 }
+function signalProcessTree(child, signal, known, ops = defaultOps) {
+  const pid = walkablePid(child);
+  const fresh = pid === void 0 ? [] : identify(ops.collectDescendants(pid), ops);
+  return signalCollected(child, signal, known, fresh, ops);
+}
+function signalProcessTreeSoon(child, signal, known, ops) {
+  const pid = walkablePid(child);
+  const collectAsync = ops.collectDescendantsAsync;
+  if (pid === void 0 || collectAsync === void 0) {
+    return signalProcessTree(child, signal, known, ops);
+  }
+  return collectAsync(pid).then(
+    (pids) => {
+      const fresh = hasExited(child) ? [] : identify(pids, ops);
+      return signalCollected(child, signal, known, fresh, ops);
+    },
+    // A failed walk must not leave the child unsignalled or reject into a `void`.
+    () => signalCollected(child, signal, known, [], ops)
+  );
+}
 function isProcessTreeAlive(child, tree, ops = defaultOps) {
   if (!hasExited(child)) return true;
   return tree.some((entry) => isSameProcess(entry, ops));
@@ -2379,21 +2417,33 @@ function signalTrackedProcessTrees(signal, ops = defaultOps) {
   }
   return count;
 }
+async function signalTrackedProcessTreesAsync(signal, ops = defaultOps) {
+  pruneFinishedTrees(ops);
+  const trees = [...liveTrees];
+  await Promise.all(
+    trees.map(([child, known]) => Promise.resolve(signalProcessTreeSoon(child, signal, known, ops)))
+  );
+  return trees.length;
+}
 var SIGKILL_GRACE_MS = 5e3;
-function terminateProcessTree(child, graceMs = SIGKILL_GRACE_MS, onEscalate) {
-  const tree = signalProcessTree(child, "SIGTERM", []);
-  const timer = setTimeout(() => {
-    if (!isProcessTreeAlive(child, tree)) return;
-    onEscalate?.();
-    signalProcessTree(child, "SIGKILL", tree);
-  }, graceMs);
-  timer.unref();
-  if (tree.length === 0) {
-    child.once("close", () => {
-      clearTimeout(timer);
-    });
-  }
-  return tree;
+function terminateProcessTree(child, graceMs = SIGKILL_GRACE_MS, onEscalate, ops = defaultOps) {
+  const armEscalation = (tree) => {
+    const timer = setTimeout(() => {
+      if (!isProcessTreeAlive(child, tree, ops)) return;
+      onEscalate?.();
+      void signalProcessTreeSoon(child, "SIGKILL", tree, ops);
+    }, graceMs);
+    timer.unref();
+    if (tree.length === 0) {
+      child.once("close", () => {
+        clearTimeout(timer);
+      });
+    }
+    return tree;
+  };
+  const signalled = signalProcessTreeSoon(child, "SIGTERM", [], ops);
+  if (Array.isArray(signalled)) return Promise.resolve(armEscalation(signalled));
+  return signalled.then(armEscalation);
 }
 
 // src/cli-adapters/subprocess-adapter.ts
@@ -2549,7 +2599,7 @@ var SubprocessCliAdapter = class extends BaseCliAdapter {
   attachAbortSignal(child, signal, resolve) {
     const onAbort = () => {
       if (child.exitCode === null && child.signalCode === null) {
-        terminateProcessTree(child, SIGKILL_GRACE_MS, () => {
+        void terminateProcessTree(child, SIGKILL_GRACE_MS, () => {
           this.logger.warn("Child ignored SIGTERM after abort, escalating to SIGKILL", {
             cli: this.name,
             sigkillGraceMs: SIGKILL_GRACE_MS
@@ -2707,17 +2757,14 @@ var SubprocessCliAdapter = class extends BaseCliAdapter {
     child.on("error", (error) => {
       resolveOnce(this.handleSubprocessError(error));
     });
-    const timers = this.scheduleTimeoutWithSigkillEscalation({
+    const timeoutId = this.scheduleTimeoutWithSigkillEscalation({
       child,
       timeoutMs,
       requestId,
       resolveOnce
     });
     child.on("close", (code) => {
-      clearTimeout(timers.timeoutId);
-      if (timers.sigkillTimerId !== void 0 && timers.tree.length === 0) {
-        clearTimeout(timers.sigkillTimerId);
-      }
+      clearTimeout(timeoutId);
       this.logTimingBreakdown(state, startTime, code, requestId);
       resolveOnce(this.classifyCloseResult(code, state, startTime));
     });
@@ -2727,37 +2774,27 @@ var SubprocessCliAdapter = class extends BaseCliAdapter {
    * Schedules the SIGTERM-on-timeout + SIGKILL-on-grace escalation
    * (#3026 finding 1).
    *
-   * The primary timer fires SIGTERM and resolves the caller's promise
+   * The timer SIGTERMs the tree and resolves the caller's promise
    * immediately so it doesn't wait on a hung child. The escalation
-   * timer (`SIGKILL_GRACE_MS` later) checks whether the child actually
-   * exited and force-reaps it with SIGKILL if not — preventing
-   * zombie accumulation when a child ignores SIGTERM (Node CLIs that
-   * install graceful-shutdown handlers can hang on a broken stream).
-   * Both timers are cleared from the `'close'` handler so a child
-   * that exits within the grace window doesn't see the second signal.
+   * (`SIGKILL_GRACE_MS` later, in {@link terminateProcessTree}) checks
+   * whether the tree actually exited and force-reaps it with SIGKILL if
+   * not — preventing zombie accumulation when a child ignores SIGTERM
+   * (Node CLIs that install graceful-shutdown handlers can hang on a broken
+   * stream). Off Linux the descendants are collected by an async `ps`
+   * first (#6718). Returns the timeout timer, for the `'close'` handler.
    */
   scheduleTimeoutWithSigkillEscalation(opts) {
     const { child, timeoutMs, requestId, resolveOnce } = opts;
-    const timers = {
-      tree: [],
-      timeoutId: setTimeout(() => {
-        timers.tree = signalProcessTree(child, "SIGTERM", []);
-        resolveOnce(err(this.createError("TIMEOUT", "Execution timed out")));
-        timers.sigkillTimerId = setTimeout(() => {
-          if (isProcessTreeAlive(child, timers.tree)) {
-            this.logger.warn("Child ignored SIGTERM, escalating to SIGKILL", {
-              cli: this.name,
-              requestId,
-              sigkillGraceMs: SIGKILL_GRACE_MS
-            });
-            signalProcessTree(child, "SIGKILL", timers.tree);
-          }
-        }, SIGKILL_GRACE_MS);
-        timers.sigkillTimerId.unref();
-      }, timeoutMs),
-      sigkillTimerId: void 0
-    };
-    return timers;
+    return setTimeout(() => {
+      void terminateProcessTree(child, SIGKILL_GRACE_MS, () => {
+        this.logger.warn("Child ignored SIGTERM, escalating to SIGKILL", {
+          cli: this.name,
+          requestId,
+          sigkillGraceMs: SIGKILL_GRACE_MS
+        });
+      });
+      resolveOnce(err(this.createError("TIMEOUT", "Execution timed out")));
+    }, timeoutMs);
   }
   /** Attach stdout/stderr data handlers + capture first-byte time (#2472). */
   attachStdoutHandlers(child, state, onProgress) {
@@ -4262,7 +4299,7 @@ var CodexMcpAdapter = class extends BaseCliAdapter {
 };
 
 // src/cli-adapters/adapters/opencode-adapter.ts
-import { execFile } from "node:child_process";
+import { execFile as execFile2 } from "node:child_process";
 
 // src/cli-adapters/parsers/opencode-parser.ts
 var logger5 = createLogger({ component: "opencode-parser" });
@@ -4666,7 +4703,7 @@ function probeAvailableModels() {
   if (cachedModels !== void 0) return Promise.resolve(cachedModels);
   if (probePromise !== void 0) return probePromise;
   probePromise = new Promise((resolve) => {
-    execFile("opencode", ["models"], { timeout: PROBE_TIMEOUT_MS }, (error, stdout) => {
+    execFile2("opencode", ["models"], { timeout: PROBE_TIMEOUT_MS }, (error, stdout) => {
       if (error !== null || stdout.trim() === "") {
         logger6.debug("Failed to probe OpenCode models, will omit --model flag", {
           error: error?.message
@@ -4892,12 +4929,12 @@ ${task.content}` : task.content;
 };
 
 // src/cli/cli-auth-probe.ts
-import { execFile as execFile2 } from "node:child_process";
+import { execFile as execFile3 } from "node:child_process";
 import { promisify as promisify2 } from "node:util";
 import { existsSync, readFileSync as readFileSync3 } from "node:fs";
 import { homedir } from "node:os";
 import { join as join2 } from "node:path";
-var execFileAsync = promisify2(execFile2);
+var execFileAsync = promisify2(execFile3);
 var HOME = homedir();
 function claudeNeedsLogin(reason) {
   return {
@@ -5249,7 +5286,7 @@ export {
   NEXUS_SUBPROCESS_DEPTH_ENV,
   readSubprocessDepth,
   trackProcessTree,
-  signalTrackedProcessTrees,
+  signalTrackedProcessTreesAsync,
   SIGKILL_GRACE_MS,
   terminateProcessTree,
   SubprocessCliAdapter,
@@ -5286,4 +5323,4 @@ export {
   SdkAdapter,
   createAutoAdapter
 };
-//# sourceMappingURL=chunk-JIRCYZKV.js.map
+//# sourceMappingURL=chunk-3E4J3EE6.js.map