nexus-agents 8.112.2 → 8.113.0

package/dist/{ast-rule-runner-UEQO7V4Y.js → ast-rule-runner-KTQIW2FG.js}

@@ -9,9 +9,9 @@ import {
   getBuiltInAstRulesPath,
   loadRules,
   runAstQaRules
-} from "./chunk-DAWGZNLK.js";
+} from "./chunk-JZM4NB3Z.js";
 import "./chunk-XEPZSDN5.js";
-import "./chunk-Y4ZLHASZ.js";
+import "./chunk-6IGSOP2F.js";
 import "./chunk-UE7A2XHM.js";
 import "./chunk-LWOX65CP.js";
 import "./chunk-PX6F3LHL.js";
@@ -27,4 +27,4 @@ export {
   loadRules,
   runAstQaRules
 };
-//# sourceMappingURL=ast-rule-runner-UEQO7V4Y.js.map
+//# sourceMappingURL=ast-rule-runner-KTQIW2FG.js.map

package/dist/{child-mcp-config-BYNNNVZF.js → child-mcp-config-J7HNH7OD.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-OITVVSWO.js";
 import {
   createLogger
-} from "./chunk-Y4ZLHASZ.js";
+} from "./chunk-6IGSOP2F.js";
 import "./chunk-UE7A2XHM.js";
 import "./chunk-LWOX65CP.js";
 import "./chunk-PX6F3LHL.js";
@@ -17,12 +17,14 @@ function resolveCliPath(override) {
   const distDir = join(__dirname, "..");
   return join(distDir, "cli.js");
 }
+var MCP_CHILD_ENV = "NEXUS_MCP_CHILD";
 function buildConfig(options) {
   const cliPath = resolveCliPath(options?.cliPath);
   const entry = {
     command: "node",
     args: [cliPath, "--mode=server"],
-    ...options?.env !== void 0 ? { env: options.env } : {}
+    // The child marker is applied LAST so caller-supplied env cannot unset it.
+    env: { ...options?.env, [MCP_CHILD_ENV]: "1" }
   };
   return {
     mcpServers: {
@@ -47,4 +49,4 @@ async function generateMcpConfig(options) {
 export {
   generateMcpConfig
 };
-//# sourceMappingURL=child-mcp-config-BYNNNVZF.js.map
+//# sourceMappingURL=child-mcp-config-J7HNH7OD.js.map

package/dist/child-mcp-config-J7HNH7OD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli-adapters/child-mcp-config.ts"],"sourcesContent":["/**\n * nexus-agents/cli-adapters - Child CLI MCP Config Generator\n *\n * Generates MCP server configuration for child Claude CLI sessions so\n * spawned agents can call back into nexus-agents' MCP tools (memory,\n * research, etc.). Used by `pipeline/expert-bridge.ts` to give expert\n * agents tool access. Originally lived under `swe-bench/` (#1413);\n * relocated here in #2515 — the helper is generic CLI-spawn\n * infrastructure, not benchmark-specific.\n *\n * The generated config grants NO tool approvals. It only tells the child\n * where the nexus-agents MCP server is; whether an expert may actually call\n * one of its tools follows the host's Claude permission settings (for\n * example `defaultMode`). Measured 2026-09-24: in auto mode the calls run,\n * in default mode they are refused (#6784). An unused `allowedTools` list\n * that read like a guard but was never passed to the CLI was removed then.\n *\n * @module cli-adapters/child-mcp-config\n */\n\nimport { writeFile, rm } from 'node:fs/promises';\nimport { nexusMkdtemp } from '../config/nexus-tmp-dir.js';\nimport { join } from 'node:path';\nimport { createLogger } from '../core/index.js';\n\nconst logger = createLogger({ component: 'swe-bench-mcp-config' });\n\n/**\n * MCP server entry in Claude CLI config format.\n */\ninterface McpServerEntry {\n  readonly command: string;\n  readonly args: readonly string[];\n  readonly env?: Readonly<Record<string, string>>;\n}\n\n/**\n * MCP config file format for Claude CLI (--mcp-config).\n */\ninterface McpConfigFile {\n  readonly mcpServers: Readonly<Record<string, McpServerEntry>>;\n}\n\n/**\n * Options for generating MCP config.\n */\nexport interface McpConfigOptions {\n  /** Path to nexus-agents CLI entry point. */\n  readonly cliPath?: string;\n  /** Additional environment variables for the MCP server. */\n  readonly env?: Readonly<Record<string, string>>;\n}\n\n/**\n * Resolves the nexus-agents CLI path.\n * Uses the built dist/cli.js relative to this package.\n */\nfunction resolveCliPath(override?: string): string {\n  if (override !== undefined) return override;\n  // Resolve relative to this file: src/swe-bench/ → dist/cli.js\n  // At runtime we're in dist/swe-bench/, so go up one level\n  const distDir = join(__dirname, '..');\n  return join(distDir, 'cli.js');\n}\n\n/**\n * Env marker naming a child server (#6795). The child's stdio caller is an\n * expert CLI driven by a model, not the operator, so the child must not\n * measure it at tier 1; `connectTransport` reads this and records the caller\n * as unmeasured.\n */\nconst MCP_CHILD_ENV = 'NEXUS_MCP_CHILD';\n\n/**\n * Builds the MCP config object for a nexus-agents server.\n */\nfunction buildConfig(options?: McpConfigOptions): McpConfigFile {\n  const cliPath = resolveCliPath(options?.cliPath);\n\n  const entry: McpServerEntry = {\n    command: 'node',\n    args: [cliPath, '--mode=server'],\n    // The child marker is applied LAST so caller-supplied env cannot unset it.\n    env: { ...options?.env, [MCP_CHILD_ENV]: '1' },\n  };\n\n  return {\n    mcpServers: {\n      'nexus-agents': entry,\n    },\n  };\n}\n\n/**\n * Generated MCP config with path and cleanup function.\n */\nexport interface GeneratedMcpConfig {\n  /** Path to the generated config file. */\n  readonly configPath: string;\n  /** Cleanup function to remove temp files. */\n  readonly cleanup: () => Promise<void>;\n}\n\n/**\n * Generates an MCP config file for Claude CLI child sessions.\n *\n * Creates a temporary JSON file that can be passed to `claude --mcp-config`.\n * Returns the file path and a cleanup function.\n */\nexport async function generateMcpConfig(options?: McpConfigOptions): Promise<GeneratedMcpConfig> {\n  const config = buildConfig(options);\n\n  const tempDir = await nexusMkdtemp('nexus-mcp-');\n  const configPath = join(tempDir, 'mcp-config.json');\n\n  await writeFile(configPath, JSON.stringify(config, null, 2), 'utf-8');\n\n  const cleanup = async (): Promise<void> => {\n    await rm(tempDir, { recursive: true, force: true }).catch((e: unknown) => {\n      logger.debug('Best-effort cleanup failed', {\n        error: e instanceof Error ? e.message : String(e),\n      });\n    });\n  };\n\n  return { configPath, cleanup };\n}\n"],"mappings":";;;;;;;;;;;AAoBA,SAAS,WAAW,UAAU;AAE9B,SAAS,YAAY;AAGrB,IAAM,SAAS,aAAa,EAAE,WAAW,uBAAuB,CAAC;AAgCjE,SAAS,eAAe,UAA2B;AACjD,MAAI,aAAa,OAAW,QAAO;AAGnC,QAAM,UAAU,KAAK,WAAW,IAAI;AACpC,SAAO,KAAK,SAAS,QAAQ;AAC/B;AAQA,IAAM,gBAAgB;AAKtB,SAAS,YAAY,SAA2C;AAC9D,QAAM,UAAU,eAAe,SAAS,OAAO;AAE/C,QAAM,QAAwB;AAAA,IAC5B,SAAS;AAAA,IACT,MAAM,CAAC,SAAS,eAAe;AAAA;AAAA,IAE/B,KAAK,EAAE,GAAG,SAAS,KAAK,CAAC,aAAa,GAAG,IAAI;AAAA,EAC/C;AAEA,SAAO;AAAA,IACL,YAAY;AAAA,MACV,gBAAgB;AAAA,IAClB;AAAA,EACF;AACF;AAkBA,eAAsB,kBAAkB,SAAyD;AAC/F,QAAM,SAAS,YAAY,OAAO;AAElC,QAAM,UAAU,MAAM,aAAa,YAAY;AAC/C,QAAM,aAAa,KAAK,SAAS,iBAAiB;AAElD,QAAM,UAAU,YAAY,KAAK,UAAU,QAAQ,MAAM,CAAC,GAAG,OAAO;AAEpE,QAAM,UAAU,YAA2B;AACzC,UAAM,GAAG,SAAS,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC,EAAE,MAAM,CAAC,MAAe;AACxE,aAAO,MAAM,8BAA8B;AAAA,QACzC,OAAO,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC;AAAA,MAClD,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAEA,SAAO,EAAE,YAAY,QAAQ;AAC/B;","names":[]}

package/dist/{chunk-P7ZL3KD6.js → chunk-2QYJTGAC.js}

@@ -7,7 +7,7 @@ import {
   getErrorMessage,
   getTimeProvider,
   ok
-} from "./chunk-Y4ZLHASZ.js";
+} from "./chunk-6IGSOP2F.js";
 
 // src/context/session-memory.ts
 import * as fs from "node:fs";
@@ -374,4 +374,4 @@ export {
   SessionMemory,
   createSessionMemory
 };
-//# sourceMappingURL=chunk-P7ZL3KD6.js.map
+//# sourceMappingURL=chunk-2QYJTGAC.js.map

package/dist/{chunk-M72V2I3F.js → chunk-4VQBNR5X.js}

@@ -4,7 +4,7 @@ import {
   err,
   getErrorMessage,
   ok
-} from "./chunk-Y4ZLHASZ.js";
+} from "./chunk-6IGSOP2F.js";
 
 // src/scm/types.ts
 var ScmError = class extends Error {
@@ -281,4 +281,4 @@ export {
   ScmError,
   GitHubProvider
 };
-//# sourceMappingURL=chunk-M72V2I3F.js.map
+//# sourceMappingURL=chunk-4VQBNR5X.js.map

package/dist/{chunk-6RYPMOR6.js → chunk-4VSMZEBT.js}

@@ -1,15 +1,15 @@
 import {
   ensureGatewayDiscovered,
   gatewayDiscoveryGeneration
-} from "./chunk-LYZ2OXI7.js";
+} from "./chunk-JEWZI3LK.js";
 import {
   resolveCliSlot
-} from "./chunk-3SY2GPU3.js";
+} from "./chunk-YFZWZVYU.js";
 import {
   createLogger,
   getTimeProvider,
   isRateLimitText
-} from "./chunk-Y4ZLHASZ.js";
+} from "./chunk-6IGSOP2F.js";
 
 // src/pipeline/expert-bridge.ts
 function resolveCliFromModelString(model) {
@@ -34,7 +34,7 @@ async function getMcpConfigPath() {
   if (cachedMcpConfigPath !== null) return cachedMcpConfigPath;
   mcpConfigInitPromise ??= (async () => {
     try {
-      const { generateMcpConfig } = await import("./child-mcp-config-BYNNNVZF.js");
+      const { generateMcpConfig } = await import("./child-mcp-config-J7HNH7OD.js");
       const config = await generateMcpConfig();
       cachedMcpConfigPath = config.configPath;
       cachedMcpConfigCleanup = config.cleanup;
@@ -126,8 +126,8 @@ async function getRouter() {
   }
   if (cachedRouter !== null) return cachedRouter;
   routerInitPromise ??= (async () => {
-    const { createAllAdapters } = await import("./factory-ZGYUWL2O.js");
-    const { createCompositeRouter } = await import("./composite-router-OEN6DCPK.js");
+    const { createAllAdapters } = await import("./factory-37NFTAM4.js");
+    const { createCompositeRouter } = await import("./composite-router-J7V4G4AV.js");
     const adapters = createAllAdapters();
     const superseded = generation !== routerGeneration;
     if (adapters.size === 0) {
@@ -138,7 +138,7 @@ async function getRouter() {
     if (superseded) return router;
     cachedRouter = router;
     try {
-      const { createCliCircuitBreakerIntegration } = await import("./cli-circuit-breaker-KR72NLMQ.js");
+      const { createCliCircuitBreakerIntegration } = await import("./cli-circuit-breaker-XPZOXMTZ.js");
       cachedCircuitBreaker = createCliCircuitBreakerIntegration([...adapters.values()]);
     } catch (error) {
       const msg = error instanceof Error ? error.message : String(error);
@@ -294,4 +294,4 @@ export {
   tokenSplitFromUsage,
   executeExpert
 };
-//# sourceMappingURL=chunk-6RYPMOR6.js.map
+//# sourceMappingURL=chunk-4VSMZEBT.js.map

package/dist/{chunk-Y4ZLHASZ.js → chunk-6IGSOP2F.js}

@@ -2749,7 +2749,7 @@ function setDefaultRegistry(registry) {
 }
 async function reloadDefaultRegistry() {
   globalRegistry = buildDefaultRegistry();
-  const { resetGlobalRegistry } = await import("./unified-registry-RBENDRS4.js");
+  const { resetGlobalRegistry } = await import("./unified-registry-PAV3YH3U.js");
   resetGlobalRegistry();
   return globalRegistry;
 }
@@ -17588,7 +17588,7 @@ var CompositeRouter = class _CompositeRouter {
    */
   async consultUnifiedContext(task) {
     try {
-      const { getContextForTask, inferTaskCategory } = await import("./context-retriever-7VBZZG3I.js");
+      const { getContextForTask, inferTaskCategory } = await import("./context-retriever-5RXSSV6H.js");
       const ctx = await getContextForTask({
         task: task.content,
         category: inferTaskCategory(task.content),
@@ -19300,4 +19300,4 @@ export {
   AgentCapability,
   OrchestratorError
 };
-//# sourceMappingURL=chunk-Y4ZLHASZ.js.map
+//# sourceMappingURL=chunk-6IGSOP2F.js.map

package/dist/{chunk-7JKUA5X6.js → chunk-6S2VMUGZ.js}

@@ -1,3 +1,6 @@
+import {
+  leastTrustedTier
+} from "./chunk-ZO6ZKR7L.js";
 import {
   stringifyValue,
   tokenize,
@@ -5,7 +8,7 @@ import {
 } from "./chunk-SX5DB6UR.js";
 import {
   SessionMemory
-} from "./chunk-P7ZL3KD6.js";
+} from "./chunk-2QYJTGAC.js";
 import {
   TRUST_TIER_NUMERIC,
   TrustTierSchema
@@ -19,7 +22,7 @@ import {
 } from "./chunk-MUJCGBZW.js";
 import {
   generateId
-} from "./chunk-ZWXZY3Z7.js";
+} from "./chunk-Y6DGFZL3.js";
 import {
   ErrorCode,
   NexusError,
@@ -33,7 +36,7 @@ import {
   ok,
   openSqliteDatabase,
   setSharedMobiMemDbPathResolver
-} from "./chunk-Y4ZLHASZ.js";
+} from "./chunk-6IGSOP2F.js";
 import {
   nexusDataPath
 } from "./chunk-LWOX65CP.js";
@@ -3315,21 +3318,6 @@ var AdaptiveMemoryBackend = class {
   }
 };
 
-// src/security/content-trust-tier.ts
-var EXTERNAL_CONTENT_TRUST_TIER = "3";
-function leastTrustedTier(tiers) {
-  let least;
-  for (const tier of tiers) {
-    if (least === void 0 || TRUST_TIER_NUMERIC[tier] > TRUST_TIER_NUMERIC[least]) least = tier;
-  }
-  return least;
-}
-function resolveContentTrustTier(callerTier, sourceTiers) {
-  const parsed = TrustTierSchema.safeParse(callerTier);
-  if (!parsed.success) return void 0;
-  return leastTrustedTier([parsed.data, ...sourceTiers]);
-}
-
 // src/context/memory-trust-tier.ts
 var MEMORY_TRUST_TIER_TAG_PREFIX = "trust-tier:";
 var UNTRUSTED_TIER_FLOOR = 3;
@@ -5842,9 +5830,6 @@ export {
   MemoryImportance,
   MemoryError,
   calculateTextJaccardSimilarity,
-  EXTERNAL_CONTENT_TRUST_TIER,
-  leastTrustedTier,
-  resolveContentTrustTier,
   memoryTrustTierTag,
   memoryEntryTrustTier,
   beliefTrustTier,
@@ -5858,4 +5843,4 @@ export {
   shutdownToolMemory,
   ToolMemoryManager
 };
-//# sourceMappingURL=chunk-7JKUA5X6.js.map
+//# sourceMappingURL=chunk-6S2VMUGZ.js.map