nexus-agents 8.42.13 → 8.43.0

package/dist/{chunk-NFM6BODN.js → chunk-LLJPMZKI.js}

@@ -1,6 +1,6 @@
 import {
   generateSecurityPlan
-} from "./chunk-ZXUJ4IZ4.js";
+} from "./chunk-4H44CQIZ.js";
 import {
   analyzeGitHubRepo
 } from "./chunk-DGWT7DXX.js";
@@ -21,10 +21,10 @@ import {
 import {
   DEFAULT_TASK_TTL_MS,
   clampTaskTtl
-} from "./chunk-CY3NQVUK.js";
+} from "./chunk-GWVEY32A.js";
 import {
   executeExpert
-} from "./chunk-QNZ5KLKB.js";
+} from "./chunk-B5R7KEZR.js";
 import {
   JobStatusSchema,
   VOTER_ROLES,
@@ -55,7 +55,7 @@ import {
   toJobSummary,
   updateStage,
   writeJobCancelled
-} from "./chunk-OD5KVPTU.js";
+} from "./chunk-4NWC7WSP.js";
 import {
   allOf,
   anyOf
@@ -63,19 +63,19 @@ import {
 import {
   normalizeTopicToCanonical,
   synthesizeResearch
-} from "./chunk-3LIAXVMB.js";
+} from "./chunk-GCLLRAST.js";
 import {
   IssueTriage,
   createDurableAuditSink,
   createDurableAuditTrail
-} from "./chunk-XZ47WD7T.js";
+} from "./chunk-LHIOFRJX.js";
 import {
   resolveEnvMode,
   sanitizeInput
-} from "./chunk-CY753H4P.js";
+} from "./chunk-ZSMK7RFK.js";
 import {
   withPrerequisite
-} from "./chunk-QJGVEG3R.js";
+} from "./chunk-HMDFOPJY.js";
 import {
   NOOP_NOTIFIER,
   RateLimiter,
@@ -100,18 +100,18 @@ import {
   withAuditTrail,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-CBKAHM7G.js";
+} from "./chunk-AJFJYLUF.js";
 import {
   createAuditTrail,
   createGraphAuditBridge,
   emitPipelinePolicyEvent
-} from "./chunk-DN63HNKL.js";
+} from "./chunk-MLG2PR6E.js";
 import {
   EventTopics,
   createEvent,
   getGlobalEventBus,
   getGlobalRegistry
-} from "./chunk-KTRMTNZX.js";
+} from "./chunk-WPBF2POG.js";
 import {
   IDENTIFIER_RE,
   LANG_VALUES,
@@ -144,7 +144,7 @@ import {
   parseRegistry,
   sourceExistsInRegistry,
   summarizeContextForPrompt
-} from "./chunk-TSCB7FGE.js";
+} from "./chunk-S4QNCIZF.js";
 import {
   REGISTRY_PATH,
   getProjectRoot,
@@ -152,25 +152,25 @@ import {
   loadTechniquesRegistry,
   resolveInsideRoot,
   resolveRegistryRoot
-} from "./chunk-CHQRA33X.js";
+} from "./chunk-RL6F6IUQ.js";
 import {
   getTokenEnvVars,
   resolveToken
-} from "./chunk-FGBKWWIY.js";
+} from "./chunk-LVOXPW3M.js";
 import {
   DEFAULT_RELEVANCE_CONFIG,
   MemoryImportance,
   MemoryType,
   calculateTextJaccardSimilarity,
   getToolMemory
-} from "./chunk-5ZKIRWNN.js";
+} from "./chunk-P6DGZEWY.js";
 import {
   STOPWORDS,
   truncateWithInfo
 } from "./chunk-7LP6VJRP.js";
 import {
   createSessionMemory
-} from "./chunk-E4DVW7L3.js";
+} from "./chunk-H77DZWRG.js";
 import {
   BUILT_IN_EXPERTS,
   BuiltInExpertTypeSchema,
@@ -188,25 +188,25 @@ import {
   getAvailableClis,
   sleep,
   withTimeout
-} from "./chunk-TKUKPHPX.js";
+} from "./chunk-NJDB4LVF.js";
 import {
   BaseAdapter,
   createStream,
   requireApiKey,
   validateApiKeyPresence
-} from "./chunk-P6OFYKRT.js";
+} from "./chunk-LZL23U7Z.js";
 import {
   DEFAULTS
-} from "./chunk-F5M4MABK.js";
+} from "./chunk-OEKALQ2G.js";
 import {
   getAvailabilityCache,
   getCliForModelId,
   resolveFallback
-} from "./chunk-LEY33SKP.js";
+} from "./chunk-AP3KIHPG.js";
 import {
   generateHyphenId,
   generateUUID
-} from "./chunk-UC4HIW3U.js";
+} from "./chunk-5CO7TEYR.js";
 import {
   AGENT_ROUTER_TIMEOUTS,
   API_TIMEOUTS,
@@ -318,7 +318,7 @@ import {
   selectStrategyByManifest,
   toExpertTaskAnalysisResult,
   withStep
-} from "./chunk-EPX75GNG.js";
+} from "./chunk-BTWPTJF3.js";
 import {
   ensureLearningDir,
   getMetaOutcomesFile,
@@ -29996,7 +29996,7 @@ function execIdFields(executionId) {
 async function populateUnifiedContextOnState(state, options) {
   const taskCandidate = state["task"];
   if (typeof taskCandidate !== "string" || taskCandidate === "") return;
-  const { getContextForTask: getContextForTask2, inferTaskCategory: inferTaskCategory2 } = await import("./context-retriever-HEOEBL6B.js");
+  const { getContextForTask: getContextForTask2, inferTaskCategory: inferTaskCategory2 } = await import("./context-retriever-3XRHW4EG.js");
   const category = inferTaskCategory2(taskCandidate);
   const executionId = options?.executionId;
   const execFields = execIdFields(executionId);
@@ -35937,7 +35937,16 @@ var TaskAccessPolicySchema = z64.object({
   objectiveHash: z64.string(),
   derivedAt: z64.string(),
   source: AccessPolicySourceSchema,
-  mode: AccessPolicyModeSchema
+  mode: AccessPolicyModeSchema,
+  /**
+   * The destructive verb the keyword deriver matched in the objective, when it
+   * matched one. Optional and carried for DISCLOSURE only: no enforcement path
+   * reads it, and `checkAccess` still returns `unmeasured` for such a policy
+   * (#5895). It exists so the decision and its log line can say *why* an
+   * objective was interesting, instead of being indistinguishable from an
+   * ordinary read-only fallback.
+   */
+  refuseVerbMatched: z64.string().optional()
 });
 
 // src/security/access-constraint-deriver/config.ts
@@ -36032,32 +36041,37 @@ var REFUSE_VERBS = [
   "transfer ownership"
 ];
 function matchesAny2(content, keywords) {
+  return firstMatch(content, keywords) !== void 0;
+}
+function firstMatch(content, keywords) {
   const lower = content.toLowerCase();
-  return keywords.some((k) => lower.includes(k));
+  return keywords.find((k) => lower.includes(k));
 }
 function deriveFallbackPolicy(userObjective, mode, hash) {
-  const allowedOperations = classifyOperations(userObjective);
+  const { operations, refuseVerbMatched } = classifyOperations(userObjective);
   return {
     allowedTools: [],
     allowedPathPatterns: [],
-    allowedOperations,
+    allowedOperations: operations,
     objectiveHash: hash,
     derivedAt: (/* @__PURE__ */ new Date()).toISOString(),
     source: "fallback-keyword",
-    mode
+    mode,
+    ...refuseVerbMatched !== void 0 && { refuseVerbMatched }
   };
 }
 function classifyOperations(userObjective) {
-  if (matchesAny2(userObjective, REFUSE_VERBS)) {
-    return [];
+  const refuseVerb = firstMatch(userObjective, REFUSE_VERBS);
+  if (refuseVerb !== void 0) {
+    return { operations: [], refuseVerbMatched: refuseVerb };
   }
   if (matchesAny2(userObjective, READ_WRITE_VERBS)) {
-    return ["read", "write"];
+    return { operations: ["read", "write"] };
   }
   if (matchesAny2(userObjective, READ_ONLY_VERBS)) {
-    return ["read"];
+    return { operations: ["read"] };
   }
-  return ["read"];
+  return { operations: ["read"] };
 }
 
 // src/security/access-constraint-deriver/llm-deriver.ts
@@ -45271,9 +45285,19 @@ async function runGraphPipeline(task, template, stages, options) {
   const startTime = getTimeProvider().now();
   const graphResult = compileEffectiveGraph(template, stages, options);
   if (graphResult.error !== void 0) {
-    return buildError(template.id, graphResult.error, startTime);
+    return {
+      ...buildError(template.id, graphResult.error, startTime),
+      ...stamp({ stagesPlanned: template.stages.length, stagesRun: 0 }, options)
+    };
   }
-  return executeAndReport(task, template, graphResult.graph, options, startTime);
+  return executeAndReport({
+    task,
+    template,
+    graph: graphResult.graph,
+    coverage: graphResult.coverage,
+    options,
+    startTime
+  });
 }
 function compileEffectiveGraph(template, stages, options) {
   const effective = resolveEffectiveTemplate(template, options);
@@ -45281,9 +45305,13 @@ function compileEffectiveGraph(template, stages, options) {
   if (!compiled.ok || compiled.graph === void 0) {
     return { error: compiled.error ?? "Compilation failed" };
   }
-  return { graph: compiled.graph };
+  return {
+    graph: compiled.graph,
+    coverage: { stagesPlanned: template.stages.length, stagesRun: effective.stages.length }
+  };
 }
-async function executeAndReport(task, template, graph, options, startTime) {
+async function executeAndReport(args) {
+  const { task, template, graph, coverage, options, startTime } = args;
   logger36.info("Executing graph pipeline", {
     template: template.id,
     dryRun: options?.dryRun === true
@@ -45299,7 +45327,7 @@ async function executeAndReport(task, template, graph, options, startTime) {
   const durationMs = getTimeProvider().now() - startTime;
   if (!result.ok) {
     emitPipelineStageEvent(template.id, "pipeline", "failed", { error: result.error.message });
-    return buildError(template.id, result.error.message, startTime);
+    return { ...buildError(template.id, result.error.message, startTime), ...stamp(coverage, options) };
   }
   const failures = describeFailedNodes(result.value.nodeResults);
   if (failures !== null) {
@@ -45312,7 +45340,8 @@ async function executeAndReport(task, template, graph, options, startTime) {
       // Keep whatever earlier stages produced — callers inspect finalState to
       // see how far the run got before it failed.
       finalState: result.value.finalState,
-      error: failures
+      error: failures,
+      ...stamp(coverage, options)
     };
   }
   emitPipelineStageEvent(template.id, "pipeline", "completed", { durationMs });
@@ -45321,9 +45350,13 @@ async function executeAndReport(task, template, graph, options, startTime) {
     templateId: template.id,
     stepsExecuted: result.value.stepsExecuted,
     durationMs,
-    finalState: result.value.finalState
+    finalState: result.value.finalState,
+    ...stamp(coverage, options)
   };
 }
+function stamp(coverage, options) {
+  return { ...coverage, ...options?.dryRun === true ? { dryRun: true } : {} };
+}
 function describeFailedNodes(nodeResults) {
   const failed = nodeResults.filter((n) => n.status === "failed");
   if (failed.length === 0) return null;
@@ -45558,7 +45591,7 @@ async function tryIssueTriage(task) {
   try {
     const issueMatch = task.match(/github\.com\/([^/]+\/[^/]+)\/issues\/(\d+)/);
     if (issueMatch === null) return null;
-    const { createIssueTriage } = await import("./issue-triage-JZ4MDAHR.js");
+    const { createIssueTriage } = await import("./issue-triage-FRPETYSK.js");
     const triage = createIssueTriage();
     const owner = issueMatch[1] ?? "";
     const num = issueMatch[2] ?? "";
@@ -45586,7 +45619,7 @@ var VALID_TEMPLATES = /* @__PURE__ */ new Set([
 ]);
 async function classifyWithLLM(task) {
   try {
-    const { executeExpert: executeExpert2 } = await import("./expert-bridge-2DIYRMB2.js");
+    const { executeExpert: executeExpert2 } = await import("./expert-bridge-ZNNMHOQH.js");
     const prompt = [
       "Classify this task into exactly one pipeline template.",
       "Templates: dev (implementation/bug fix/refactor), research (investigate/evaluate/compare),",
@@ -45960,7 +45993,7 @@ function buildVotingInput(plan, config) {
 }
 async function executeSingleVote(plan, config, log) {
   try {
-    const { executeVoting } = await import("./consensus-vote-ZIW3GBEI.js");
+    const { executeVoting } = await import("./consensus-vote-EM2FBZJC.js");
     const input = buildVotingInput(plan, config);
     const result = await executeVoting(input, log);
     return parseVotingResult(result);
@@ -47522,7 +47555,7 @@ var memoryInitPromise = null;
 async function initPipelineMemory() {
   if (cachedMemory !== null) return cachedMemory;
   try {
-    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-QH65QG4V.js");
+    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-D2IK4PC2.js");
     const { getLearningDir } = await import("./learning-persistence-TX2WE7Y7.js");
     const mem = createSessionMemory2(getLearningDir());
     mem.startSession(`pipeline-${String(getTimeProvider().now())}`);
@@ -47584,7 +47617,7 @@ function recordRoutingExperience(category, success, durationMs, tokensUsed = 0,
     callRecord(routingMemoryCache);
     return;
   }
-  routingMemoryInitPromise ??= import("./routing-memory-DMJYEGGI.js").then(({ createRoutingMemory }) => {
+  routingMemoryInitPromise ??= import("./routing-memory-PGYUB4UJ.js").then(({ createRoutingMemory }) => {
     routingMemoryCache ??= createRoutingMemory();
     return routingMemoryCache;
   }).catch((error) => {
@@ -47618,7 +47651,7 @@ ${text}` : "";
 }
 async function getWeatherContext() {
   try {
-    const { generateWeatherReport: generateWeatherReport2 } = await import("./weather-report-NDFTFLCH.js");
+    const { generateWeatherReport: generateWeatherReport2 } = await import("./weather-report-2Q6RXC2D.js");
     const report = generateWeatherReport2({ includeAdaptive: true });
     const mappings = "recommendedMappings" in report ? report.recommendedMappings : [];
     if (!Array.isArray(mappings) || mappings.length === 0) return "";
@@ -47636,7 +47669,7 @@ ${lines}
 }
 async function getMemoryContext(task) {
   try {
-    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-QH65QG4V.js");
+    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-D2IK4PC2.js");
     const { getLearningDir } = await import("./learning-persistence-TX2WE7Y7.js");
     const memory = createSessionMemory2(getLearningDir(), { maxLearningsInContext: 10 });
     const learnings = memory.searchLearnings(task.slice(0, 200));
@@ -47755,7 +47788,7 @@ ${contextBlock}`;
       const strategy = config.votingStrategy ?? "higher_order";
       await postProgress(config, "Vote", `Running consensus with ${strategy} strategy...`);
       try {
-        const { executeVoting } = await import("./consensus-vote-ZIW3GBEI.js");
+        const { executeVoting } = await import("./consensus-vote-EM2FBZJC.js");
         const votingResult = await executeVoting(
           {
             proposal: buildVoteProposal(plan, research),
@@ -48186,7 +48219,7 @@ async function searchCodebaseForTask(task) {
 }
 async function queryResearchRegistry(task) {
   try {
-    const { synthesizeResearch: synthesizeResearch2 } = await import("./research-helpers-synthesize-PWIDEIZ6.js");
+    const { synthesizeResearch: synthesizeResearch2 } = await import("./research-helpers-synthesize-NIDQS4XT.js");
     const topic = task.split(/[.!?\n]/).filter((s) => s.trim().length > 10)[0]?.trim();
     if (topic === void 0) return null;
     const result = await synthesizeResearch2(topic.slice(0, 50));
@@ -48257,7 +48290,7 @@ function createScanStageWrapper() {
       try {
         const slug = ctx.task.match(/([a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+)/)?.[1];
         if (slug !== void 0) {
-          const { generateSecurityPlan: generateSecurityPlan2 } = await import("./repo-security-plan-XIZB37ZY.js");
+          const { generateSecurityPlan: generateSecurityPlan2 } = await import("./repo-security-plan-3E3FSPD5.js");
           const plan = await generateSecurityPlan2({ repo: slug, maxScanners: 10 });
           const recs = plan.recommendations.slice(0, 5).map((r) => `${r.priority}: ${r.displayName} (${r.category})`).join("; ");
           return output(PIPELINE_STATE_KEYS.FINDINGS, recs, getTimeProvider().now() - start, true);
@@ -51497,7 +51530,7 @@ var GitHubTaskTracker = class {
   cachedProvider = null;
   async getProvider() {
     if (this.cachedProvider !== null) return this.cachedProvider;
-    const { createScmProvider } = await import("./factory-C66XGNEW.js");
+    const { createScmProvider } = await import("./factory-UYBTTLHZ.js");
     const result = await createScmProvider({ repo: this.config.repo ?? "" });
     if (!result.ok) throw new Error(`SCM provider error: ${result.error.message}`);
     this.cachedProvider = result.value;
@@ -51963,6 +51996,12 @@ function buildOutput3(result, simulated) {
     stepsExecuted: result.stepsExecuted,
     durationMs: result.durationMs,
     error: result.error ?? null,
+    // #5812-adjacent (pipeline sweep): a dryRun truncates the template at
+    // `dryRunStopAfter`, so `success: true` with `templateId: 'dev'` used to be
+    // byte-identical whether qa and security ran or were sliced away. Say which.
+    ...result.dryRun === true ? { dryRun: true } : {},
+    stagesPlanned: result.stagesPlanned,
+    stagesRun: result.stagesRun,
     // #4170: stamped only on an explicit NEXUS_ALLOW_SIMULATE=1 opt-in run so
     // a random demo panel can never pass as a real decision.
     ...simulated ? { simulated: true } : {},
@@ -52422,7 +52461,7 @@ async function probeSource(source, includeModelIds) {
   }
 }
 async function defaultSources(includeOpenRouter) {
-  const { createAllAdapters: createAllAdapters2 } = await import("./factory-JHWFG6RN.js");
+  const { createAllAdapters: createAllAdapters2 } = await import("./factory-TE7DQKRW.js");
   const adapters = createAllAdapters2();
   return buildDefaultModelSources(adapters, { includeOpenRouter });
 }
@@ -54315,6 +54354,9 @@ var RoutingDecisionSchema = z127.object({
   timestamp: z127.iso.datetime(),
   query: z127.string(),
   routerType: z127.enum(["linucb", "preference", "quality", "cascade", "topsis"]),
+  // Optional so a row persisted before #5812 still parses. Absence is read as
+  // unmeasured by `isRouterTypeMeasured`, never as measured.
+  routerTypeMeasured: z127.boolean().optional(),
   selectedModel: z127.string(),
   selectedTier: z127.enum(["strong", "weak"]).optional(),
   armIndex: z127.number().int().min(0).optional(),
@@ -54378,18 +54420,26 @@ function countOutcomesByClass(outcomes) {
   }
   return counts;
 }
+function isRouterTypeMeasured(decision) {
+  return decision.routerTypeMeasured === true;
+}
 function countDecisionsByRouter(decisions) {
-  const counts = {
+  const byRouter = {
     linucb: 0,
     preference: 0,
     quality: 0,
     cascade: 0,
     topsis: 0
   };
+  let unattributed = 0;
   for (const decision of decisions) {
-    counts[decision.routerType]++;
+    if (isRouterTypeMeasured(decision)) {
+      byRouter[decision.routerType]++;
+    } else {
+      unattributed++;
+    }
   }
-  return counts;
+  return { byRouter, unattributed };
 }
 function calculateAverageQuality(outcomes) {
   if (outcomes.length === 0) return 0;
@@ -54559,7 +54609,7 @@ var OutcomeFeedbackCollector = class {
   }
   getStats() {
     const outcomesByClass = countOutcomesByClass(this.outcomes);
-    const decisionsByRouter = countDecisionsByRouter(this.decisionHistory);
+    const routerCounts = countDecisionsByRouter(this.decisionHistory);
     const avgQuality = calculateAverageQuality(this.outcomes);
     const avgReward = this.calculateAverageReward();
     return {
@@ -54569,7 +54619,8 @@ var OutcomeFeedbackCollector = class {
       outcomesByClass,
       avgQualityScore: avgQuality,
       avgReward,
-      decisionsByRouter,
+      decisionsByRouter: routerCounts.byRouter,
+      decisionsUnattributed: routerCounts.unattributed,
       lastUpdatedAt: getTimeProvider().nowIso()
     };
   }
@@ -54703,18 +54754,32 @@ var MAX_DECISION_MAP_SIZE = 1e4;
 function getDecisiveRouterType(decision) {
   const stages = decision.stagesExecuted;
   if (stages.includes("linucb-selection") && decision.ucbScore !== void 0) {
-    return "linucb";
+    return { routerType: "linucb", measured: true };
   }
   if (stages.includes("preference-routing") && decision.preferenceScore !== void 0) {
-    return "preference";
+    return { routerType: "preference", measured: true };
   }
   if (stages.includes("zero-router") && decision.difficultyTier !== void 0) {
-    return "cascade";
+    return { routerType: "cascade", measured: true };
   }
   if (stages.includes("topsis-ranking") && decision.topsisScore !== void 0) {
-    return "topsis";
+    return { routerType: "topsis", measured: true };
   }
-  return "topsis";
+  return { routerType: "topsis", measured: false };
+}
+function buildStoredDecision(id, traceId, routerType, decision) {
+  return {
+    id,
+    traceId,
+    timestamp: getTimeProvider().nowIso(),
+    routerType,
+    // Persisted telemetry is slot-level; collapse the distinct arm (#3422).
+    selectedModel: routingArmDisplaySlot(decision.cliName),
+    alternativeModels: decision.alternatives.map(routingArmDisplaySlot),
+    confidence: decision.confidence,
+    reason: decision.reason,
+    taskProfile: serializeTaskProfile(decision.taskProfile)
+  };
 }
 function serializeTaskProfile(profile) {
   return {
@@ -54771,9 +54836,11 @@ var FeedbackIntegration = class {
       task: decision.taskProfile.taskType,
       createdAt: now
     });
+    const decisive = getDecisiveRouterType(decision);
     const routingDecision = createRoutingDecision({
       traceId: trace,
-      routerType: getDecisiveRouterType(decision),
+      routerType: decisive.routerType,
+      routerTypeMeasured: decisive.measured,
       selectedModel: decision.cliName,
       confidence: decision.confidence,
       query: decision.reason,
@@ -54785,18 +54852,7 @@ var FeedbackIntegration = class {
     const decisionWithId = { ...routingDecision, id };
     this.collector.recordRoutingDecision(decisionWithId);
     if (this.outcomeStorage !== void 0) {
-      const storedDecision = {
-        id,
-        traceId: trace,
-        timestamp: getTimeProvider().nowIso(),
-        routerType: getDecisiveRouterType(decision),
-        // Persisted telemetry is slot-level; collapse the distinct arm (#3422).
-        selectedModel: routingArmDisplaySlot(decision.cliName),
-        alternativeModels: decision.alternatives.map(routingArmDisplaySlot),
-        confidence: decision.confidence,
-        reason: decision.reason,
-        taskProfile: serializeTaskProfile(decision.taskProfile)
-      };
+      const storedDecision = buildStoredDecision(id, trace, decisive.routerType, decision);
       this.outcomeStorage.storeDecision(storedDecision).catch((error) => {
         this.logger.warn("Failed to persist routing decision to SQLite", { id, error });
       });
@@ -56459,4 +56515,4 @@ export {
   startPipelineEventBridge,
   shutdownPipelineEventBridge
 };
-//# sourceMappingURL=chunk-NFM6BODN.js.map
+//# sourceMappingURL=chunk-LLJPMZKI.js.map