nexus-agents 8.127.8 → 8.127.10

package/dist/{ast-rule-runner-U7KJLJET.js → ast-rule-runner-KW3QSDNI.js}

@@ -9,8 +9,8 @@ import {
   getBuiltInAstRulesPath,
   loadRules,
   runAstQaRules
-} from "./chunk-MWUWNR6R.js";
-import "./chunk-5V2VGTTG.js";
+} from "./chunk-GXPTNQFT.js";
+import "./chunk-B7YJEAUH.js";
 import "./chunk-XBEKMUTO.js";
 import "./chunk-UE7A2XHM.js";
 import "./chunk-LWOX65CP.js";
@@ -27,4 +27,4 @@ export {
   loadRules,
   runAstQaRules
 };
-//# sourceMappingURL=ast-rule-runner-U7KJLJET.js.map
+//# sourceMappingURL=ast-rule-runner-KW3QSDNI.js.map

package/dist/{child-mcp-config-B6EYZIYW.js → child-mcp-config-2MM5LZCN.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-OITVVSWO.js";
 import {
   createLogger
-} from "./chunk-5V2VGTTG.js";
+} from "./chunk-B7YJEAUH.js";
 import "./chunk-XBEKMUTO.js";
 import "./chunk-UE7A2XHM.js";
 import "./chunk-LWOX65CP.js";
@@ -50,4 +50,4 @@ async function generateMcpConfig(options) {
 export {
   generateMcpConfig
 };
-//# sourceMappingURL=child-mcp-config-B6EYZIYW.js.map
+//# sourceMappingURL=child-mcp-config-2MM5LZCN.js.map

package/dist/{chunk-FRBEM62C.js → chunk-25SRHK3D.js}

@@ -1,6 +1,6 @@
 import {
   CUSTOM_API_DEFAULT_MODEL
-} from "./chunk-NPYQTGZ4.js";
+} from "./chunk-J2LCNIZD.js";
 import {
   nexusMkdtempSync
 } from "./chunk-OITVVSWO.js";
@@ -8,7 +8,7 @@ import {
   ensureGatewayDiscovered,
   gatewayDiscoveryStatus,
   getAvailabilityCache
-} from "./chunk-SGOTDHQI.js";
+} from "./chunk-44AUGXUS.js";
 import {
   AdapterModelError,
   BaseAdapter,
@@ -19,7 +19,7 @@ import {
   requireApiKey,
   validateApiKeyPresence,
   withGatewayUsageRecording
-} from "./chunk-MXL47R7E.js";
+} from "./chunk-XWB3YQKW.js";
 import {
   assertCustomApiHostResolvesPublic,
   hostnameOf,
@@ -28,22 +28,22 @@ import {
   readGatewayEnv,
   redactApiKey,
   validateCustomApiBaseUrl
-} from "./chunk-2GPN6SBB.js";
+} from "./chunk-QUG7LULI.js";
 import {
   sanitizeOutput
-} from "./chunk-WXV6ZMME.js";
+} from "./chunk-OULQZF2D.js";
 import {
   extractSystemPrompt
 } from "./chunk-QZUG667L.js";
 import {
   generateHyphenId
-} from "./chunk-7HHYZI7I.js";
+} from "./chunk-COOZM7W2.js";
 import {
   CliCircuitBreaker,
   DEFAULT_CIRCUIT_BREAKER_CONFIG,
   getCliCircuitBreakerSnapshot,
   getDefaultCliCircuitBreakerRegistry
-} from "./chunk-4P6AEBG3.js";
+} from "./chunk-GJBPAZL2.js";
 import {
   CLI_NAMES,
   CLI_SUBPROCESS_TIMEOUTS,
@@ -115,7 +115,7 @@ import {
   unenforcedAccessModeRefusal,
   warnIfGatewayCostUndeclared,
   withEnforcedAccessMode
-} from "./chunk-5V2VGTTG.js";
+} from "./chunk-B7YJEAUH.js";
 import {
   parseBoolValue
 } from "./chunk-LWOX65CP.js";
@@ -3890,7 +3890,7 @@ function agyPrintTimeoutArgs(timeoutMs) {
 
 // src/cli-adapters/adapters/codex-adapter.ts
 import { writeFileSync, rmSync } from "node:fs";
-import { join as join3 } from "node:path";
+import { join as join4 } from "node:path";
 
 // src/cli-adapters/codex-sandbox-preflight.ts
 import { execFile as execFile2 } from "node:child_process";
@@ -4208,9 +4208,12 @@ var CodexResponseParser = class {
 
 // src/cli-adapters/codex-mcp-isolation.ts
 import { readdirSync as readdirSync2, realpathSync, statSync as statSync2 } from "node:fs";
-import { join as join2 } from "node:path";
+import { join as join3 } from "node:path";
 import { parse as parseToml } from "smol-toml";
 
+// src/cli-adapters/codex-cloud-config-auth.ts
+import { join as join2 } from "node:path";
+
 // src/cli-adapters/mcp-config-scan.ts
 import {
   closeSync,
@@ -4308,6 +4311,95 @@ function scanOrThrow(cli, scan) {
   return scan.value;
 }
 
+// src/cli-adapters/codex-cloud-config-auth.ts
+var PERSONAL_PLANS = /* @__PURE__ */ new Set([
+  "free",
+  "go",
+  "plus",
+  "pro",
+  "prolite",
+  "promax"
+]);
+var NON_BACKEND_MODES = /* @__PURE__ */ new Set([
+  "apikey",
+  "bedrockApiKey",
+  "bedrockAccessKeys"
+]);
+var ID_TOKEN_MODES = /* @__PURE__ */ new Set(["chatgpt", "chatgptAuthTokens"]);
+var AUTH_CLAIMS = "https://api.openai.com/auth";
+var ECHOABLE_VALUE = /^[A-Za-z0-9_]{1,40}$/;
+var REFUSAL_SUFFIX = "codex may fetch cloud-managed config whose MCP servers cannot be listed before the run";
+var MODE_BY_FIELD = [
+  ["personal_access_token", "personalAccessToken"],
+  ["bedrock_api_key", "bedrockApiKey"],
+  ["bedrock_access_keys", "bedrockAccessKeys"],
+  ["OPENAI_API_KEY", "apikey"]
+];
+function resolvedMode(auth) {
+  const explicit = auth["auth_mode"];
+  if (explicit !== void 0) return typeof explicit === "string" ? explicit : void 0;
+  const byField = MODE_BY_FIELD.find(
+    ([field]) => auth[field] !== void 0 && auth[field] !== null
+  );
+  return byField?.[1] ?? "chatgpt";
+}
+function planClaim(auth) {
+  const tokens = auth["tokens"];
+  const idToken = isRecord(tokens) ? tokens["id_token"] : void 0;
+  if (typeof idToken !== "string") return err("auth.json has no id_token to read the plan from");
+  const payload = idToken.split(".")[1];
+  let claims;
+  try {
+    claims = payload === void 0 ? void 0 : JSON.parse(Buffer.from(payload, "base64url").toString());
+  } catch {
+    claims = void 0;
+  }
+  const namespace = isRecord(claims) ? claims[AUTH_CLAIMS] : void 0;
+  const plan = isRecord(namespace) ? namespace["chatgpt_plan_type"] : void 0;
+  if (typeof plan !== "string") return err("the auth.json id_token carries no account plan");
+  return ok(plan);
+}
+function echoable(value) {
+  return value !== void 0 && ECHOABLE_VALUE.test(value) ? JSON.stringify(value) : "an unrecognized value";
+}
+function readAuth(codexHome2) {
+  const path = join2(codexHome2, "auth.json");
+  const text = readConfigIfPresent(path);
+  if (!text.ok) return text;
+  if (text.value === void 0) return ok(void 0);
+  let doc;
+  try {
+    doc = JSON.parse(text.value);
+  } catch {
+    return err(`cannot parse ${path}`);
+  }
+  return isRecord(doc) ? ok(doc) : err(`${path} is not a JSON object`);
+}
+function cloudConfigAuthRefusal(codexHome2, credentialsStore) {
+  if (credentialsStore !== void 0 && credentialsStore !== "file") {
+    return err(
+      `cli_auth_credentials_store = ${echoable(credentialsStore)} keeps the account outside auth.json, so its plan cannot be checked; ${REFUSAL_SUFFIX}`
+    );
+  }
+  const auth = readAuth(codexHome2);
+  if (!auth.ok) return err(`${auth.error}; ${REFUSAL_SUFFIX}`);
+  if (auth.value === void 0) return ok(void 0);
+  return accountRefusal(auth.value);
+}
+function accountRefusal(auth) {
+  const mode = resolvedMode(auth);
+  if (mode !== void 0 && NON_BACKEND_MODES.has(mode)) return ok(void 0);
+  if (mode === void 0 || !ID_TOKEN_MODES.has(mode)) {
+    return err(`codex auth_mode ${echoable(mode)} has no plan readable offline; ${REFUSAL_SUFFIX}`);
+  }
+  const plan = planClaim(auth);
+  if (!plan.ok) return err(`${plan.error}; ${REFUSAL_SUFFIX}`);
+  if (PERSONAL_PLANS.has(plan.value)) return ok(void 0);
+  return err(
+    `codex account plan ${echoable(plan.value)} is not a personal plan; ${REFUSAL_SUFFIX}`
+  );
+}
+
 // src/cli-adapters/codex-mcp-isolation.ts
 var CODEX_DISABLED_TRANSPORT_PLACEHOLDER = {
   command: "nexus-agents-disabled-mcp-server",
@@ -4353,6 +4445,10 @@ function readMarkers(path, value) {
   }
   return err(`${path}: project_root_markers is not an array of strings`);
 }
+function readStore(path, value) {
+  if (value === void 0 || typeof value === "string") return ok(value);
+  return err(`${path}: cli_auth_credentials_store is not a string`);
+}
 function readLayer(path) {
   const text = readConfigIfPresent(path);
   if (!text.ok) return text;
@@ -4363,16 +4459,22 @@ function readLayer(path) {
   } catch (error) {
     return err(`cannot parse ${path}: ${error instanceof Error ? error.message : String(error)}`);
   }
+  return parseLayer(path, doc);
+}
+function parseLayer(path, doc) {
   const servers = parseServers(path, doc["mcp_servers"]);
   if (!servers.ok) return servers;
   const markers = readMarkers(path, doc["project_root_markers"]);
   if (!markers.ok) return markers;
   const plugins = enabledPlugins(path, doc["plugins"]);
   if (!plugins.ok) return plugins;
+  const store = readStore(path, doc["cli_auth_credentials_store"]);
+  if (!store.ok) return store;
   return ok({
     servers: servers.value,
     enabledPlugins: plugins.value,
-    ...markers.value !== void 0 && { projectRootMarkers: markers.value }
+    ...markers.value !== void 0 && { projectRootMarkers: markers.value },
+    ...store.value !== void 0 && { credentialsStore: store.value }
   });
 }
 function readLayers(paths) {
@@ -4385,10 +4487,10 @@ function readLayers(paths) {
   return ok(layers);
 }
 function codexHome(env) {
-  return envValue(env, "CODEX_HOME") ?? join2(childHome(env), ".codex");
+  return envValue(env, "CODEX_HOME") ?? join3(childHome(env), ".codex");
 }
 function codexUserConfigPath(env) {
-  return join2(codexHome(env), "config.toml");
+  return join3(codexHome(env), "config.toml");
 }
 var CODEX_CLOUD_CONFIG_CACHE = "cloud-config-bundle-cache.json";
 var PLUGIN_MANIFEST_DIRS = /* @__PURE__ */ new Set([
@@ -4426,9 +4528,9 @@ function listDir(dir) {
   }
 }
 function pluginRootMcp(dir, names) {
-  if (names.includes(".mcp.json")) return ok(join2(dir, ".mcp.json"));
+  if (names.includes(".mcp.json")) return ok(join3(dir, ".mcp.json"));
   for (const name of names.filter((n) => PLUGIN_MANIFEST_DIRS.has(n))) {
-    const path = join2(dir, name, "plugin.json");
+    const path = join3(dir, name, "plugin.json");
     const declares = manifestDeclaresMcp(path);
     if (!declares.ok) return declares;
     if (declares.value) return ok(path);
@@ -4445,7 +4547,7 @@ function findPluginMcp(dir, depth, ancestors = /* @__PURE__ */ new Set()) {
   const branch = descendBranch(dir, depth, ancestors);
   if (!branch.ok) return branch;
   for (const name of entries.value) {
-    const path = join2(dir, name);
+    const path = join3(dir, name);
     if (!isDirectory(path)) continue;
     const found = findPluginMcp(path, depth + 1, branch.value);
     if (!found.ok || found.value !== void 0) return found;
@@ -4472,18 +4574,21 @@ function unlistableSourceRefusal(env, layers) {
     return err(`plugin ${JSON.stringify(plugin)} is enabled; its MCP servers cannot be listed`);
   }
   const home = codexHome(env);
-  const declared = findPluginMcp(join2(home, "plugins"), 0);
+  const declared = findPluginMcp(join3(home, "plugins"), 0);
   if (!declared.ok) return declared;
   if (declared.value !== void 0) {
     return err(`installed plugin declares MCP servers (${declared.value}); they cannot be listed`);
   }
-  const cache = join2(home, CODEX_CLOUD_CONFIG_CACHE);
+  const cache = join3(home, CODEX_CLOUD_CONFIG_CACHE);
   try {
     statSync2(cache);
   } catch (error) {
     const code = error.code;
-    if (code === "ENOENT" || code === "ENOTDIR") return ok(void 0);
-    return err(`cannot stat ${cache}: ${code ?? String(error)}`);
+    if (code !== "ENOENT" && code !== "ENOTDIR") {
+      return err(`cannot stat ${cache}: ${code ?? String(error)}`);
+    }
+    const store = layers.map((l) => l.credentialsStore).find((s) => s !== void 0 && s !== "file");
+    return cloudConfigAuthRefusal(home, store);
   }
   return err(`cloud-managed config is cached at ${cache}; its MCP servers cannot be listed`);
 }
@@ -4492,7 +4597,7 @@ function scanCodexMcpServers(ctx, systemFiles = CODEX_SYSTEM_CONFIG_FILES) {
   if (!always.ok) return always;
   const markers = always.value.findLast((l) => l.projectRootMarkers !== void 0)?.projectRootMarkers ?? DEFAULT_PROJECT_ROOT_MARKERS;
   const project = readLayers(
-    projectDirs(ctx.cwd, markers).map((dir) => join2(dir, ".codex", "config.toml"))
+    projectDirs(ctx.cwd, markers).map((dir) => join3(dir, ".codex", "config.toml"))
   );
   if (!project.ok) return project;
   const unlistable = unlistableSourceRefusal(ctx.env, [...always.value, ...project.value]);
@@ -4628,7 +4733,7 @@ var CodexCliAdapter = class extends SubprocessCliAdapter {
     let cleanup;
     if (task.systemPrompt !== void 0 && task.systemPrompt !== "") {
       const dir = nexusMkdtempSync("nexus-codex-sysprompt-");
-      const file = join3(dir, "instructions.md");
+      const file = join4(dir, "instructions.md");
       writeFileSync(file, task.systemPrompt, { encoding: "utf8", mode: 384 });
       args.push("-c", `model_instructions_file=${file}`);
       cleanup = () => {
@@ -5624,7 +5729,7 @@ import { execFile as execFile4 } from "node:child_process";
 import { promisify as promisify3 } from "node:util";
 import { existsSync, readFileSync as readFileSync3 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { join as join4 } from "node:path";
+import { join as join5 } from "node:path";
 var execFileAsync2 = promisify3(execFile4);
 var HOME = homedir2();
 function claudeNeedsLogin(reason) {
@@ -5641,7 +5746,7 @@ function probeClaude() {
   if (process.env["ANTHROPIC_API_KEY"] !== void 0 && process.env["ANTHROPIC_API_KEY"] !== "") {
     return { cli: "claude", state: "authenticated", via: "env-var" };
   }
-  const credPath = join4(HOME, ".claude", ".credentials.json");
+  const credPath = join5(HOME, ".claude", ".credentials.json");
   if (!existsSync(credPath)) {
     return claudeNeedsLogin(
       "No credentials at ~/.claude/.credentials.json and ANTHROPIC_API_KEY is not set"
@@ -6022,4 +6127,4 @@ export {
   SdkAdapter,
   createAutoAdapter
 };
-//# sourceMappingURL=chunk-FRBEM62C.js.map
+//# sourceMappingURL=chunk-25SRHK3D.js.map