nexus-agents 8.73.1 → 8.74.1

package/dist/{ast-rule-runner-6XYO26ND.js → ast-rule-runner-K35WYUOD.js}

@@ -9,8 +9,8 @@ import {
   getBuiltInAstRulesPath,
   loadRules,
   runAstQaRules
-} from "./chunk-A7JEVXYD.js";
-import "./chunk-QXMVHFW7.js";
+} from "./chunk-Z2XB5IKO.js";
+import "./chunk-4PWDDMLH.js";
 import "./chunk-4UHDDCRB.js";
 import "./chunk-RNDHNRSX.js";
 import "./chunk-PX6F3LHL.js";
@@ -26,4 +26,4 @@ export {
   loadRules,
   runAstQaRules
 };
-//# sourceMappingURL=ast-rule-runner-6XYO26ND.js.map
+//# sourceMappingURL=ast-rule-runner-K35WYUOD.js.map

package/dist/{child-mcp-config-RGGZXRY5.js → child-mcp-config-B2CWZ2ZK.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-HERI7LXN.js";
 import {
   createLogger
-} from "./chunk-QXMVHFW7.js";
+} from "./chunk-4PWDDMLH.js";
 import "./chunk-4UHDDCRB.js";
 import "./chunk-RNDHNRSX.js";
 import "./chunk-PX6F3LHL.js";
@@ -60,4 +60,4 @@ export {
   generateMcpConfig,
   getDefaultAllowedTools
 };
-//# sourceMappingURL=child-mcp-config-RGGZXRY5.js.map
+//# sourceMappingURL=child-mcp-config-B2CWZ2ZK.js.map

package/dist/{chunk-AM3SBI6U.js → chunk-22VQMTR6.js}

@@ -2,7 +2,7 @@ import {
   createLogger,
   err,
   ok
-} from "./chunk-QXMVHFW7.js";
+} from "./chunk-4PWDDMLH.js";
 
 // src/scm/token-resolver.ts
 import { execFile } from "node:child_process";
@@ -87,4 +87,4 @@ export {
   hasToken,
   getTokenEnvVars
 };
-//# sourceMappingURL=chunk-AM3SBI6U.js.map
+//# sourceMappingURL=chunk-22VQMTR6.js.map

package/dist/{chunk-HZEPJMP4.js → chunk-2KXRL4OW.js}

@@ -1,6 +1,6 @@
 import {
   getErrorMessage
-} from "./chunk-QXMVHFW7.js";
+} from "./chunk-4PWDDMLH.js";
 
 // src/cli/setup-config.ts
 import { copyFileSync, existsSync, mkdirSync, writeFileSync } from "node:fs";
@@ -77,4 +77,4 @@ function ensureBackup(outputPath) {
 export {
   runConfigInitSync
 };
-//# sourceMappingURL=chunk-HZEPJMP4.js.map
+//# sourceMappingURL=chunk-2KXRL4OW.js.map

package/dist/{chunk-DSBCOWEN.js → chunk-3FK67YI4.js}

@@ -1,6 +1,6 @@
 import {
   generateSecurityPlan
-} from "./chunk-ALYZL2P2.js";
+} from "./chunk-CYZ3DUQV.js";
 import {
   analyzeGitHubRepo
 } from "./chunk-4GDMHCKX.js";
@@ -21,10 +21,10 @@ import {
 import {
   DEFAULT_TASK_TTL_MS,
   clampTaskTtl
-} from "./chunk-RCISIRX7.js";
+} from "./chunk-MYEDID77.js";
 import {
   executeExpert
-} from "./chunk-KCMHX6AZ.js";
+} from "./chunk-ZKEULHX6.js";
 import {
   DEPRECATED_MODE_ALIAS_INPUT,
   JobStatusSchema,
@@ -71,7 +71,7 @@ import {
   updateStage,
   withWarnings,
   writeJobCancelled
-} from "./chunk-NSX7C7GA.js";
+} from "./chunk-BQMUX3TR.js";
 import {
   allOf,
   anyOf
@@ -79,7 +79,7 @@ import {
 import {
   normalizeTopicToCanonical,
   synthesizeResearch
-} from "./chunk-2GYLTWEC.js";
+} from "./chunk-MYGTMAHW.js";
 import {
   IssueTriage,
   createAuditTrail,
@@ -87,13 +87,13 @@ import {
   createDurableAuditTrail,
   createGraphAuditBridge,
   emitPipelinePolicyEvent
-} from "./chunk-ERYTWOXV.js";
+} from "./chunk-3PI3INR3.js";
 import {
   sanitizeInput
-} from "./chunk-5LBLNPCD.js";
+} from "./chunk-ADHIHFBA.js";
 import {
   withPrerequisite
-} from "./chunk-5NC4I44Y.js";
+} from "./chunk-MPWPST6S.js";
 import {
   NOOP_NOTIFIER,
   RateLimiter,
@@ -116,14 +116,14 @@ import {
   toolSuccessStructured,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-WZGUYIQA.js";
+} from "./chunk-4XP43CH7.js";
 import {
   EventTopics,
   UNRESOLVED_MODEL_ID,
   createEvent,
   getGlobalEventBus,
   getGlobalRegistry
-} from "./chunk-AQ6NLVIB.js";
+} from "./chunk-TL5NV5JH.js";
 import {
   IDENTIFIER_RE,
   LANG_VALUES,
@@ -156,7 +156,7 @@ import {
   parseRegistry,
   sourceExistsInRegistry,
   summarizeContextForPrompt
-} from "./chunk-MH376WDZ.js";
+} from "./chunk-5QE6DJMH.js";
 import {
   REGISTRY_PATH,
   getProjectRoot,
@@ -164,25 +164,25 @@ import {
   loadTechniquesRegistry,
   resolveInsideRoot,
   resolveRegistryRoot
-} from "./chunk-WSAXCNCP.js";
+} from "./chunk-GW7SZ555.js";
 import {
   getTokenEnvVars,
   resolveToken
-} from "./chunk-AM3SBI6U.js";
+} from "./chunk-22VQMTR6.js";
 import {
   DEFAULT_RELEVANCE_CONFIG,
   MemoryImportance,
   MemoryType,
   calculateTextJaccardSimilarity,
   getToolMemory
-} from "./chunk-2YYS65XE.js";
+} from "./chunk-B227FYGQ.js";
 import {
   STOPWORDS,
   truncateWithInfo
 } from "./chunk-7LP6VJRP.js";
 import {
   createSessionMemory
-} from "./chunk-6NWIPX4E.js";
+} from "./chunk-6DPQOIE7.js";
 import {
   BUILT_IN_EXPERTS,
   BuiltInExpertTypeSchema,
@@ -200,25 +200,25 @@ import {
   getAvailableClis,
   sleep,
   withTimeout
-} from "./chunk-2X765QTY.js";
+} from "./chunk-TUTS6S2G.js";
 import {
   BaseAdapter,
   createStream,
   requireApiKey,
   validateApiKeyPresence
-} from "./chunk-T4Q5AAYP.js";
+} from "./chunk-ZDVNHXRV.js";
 import {
   DEFAULTS
-} from "./chunk-BVCKYGMS.js";
+} from "./chunk-ST7RKS3P.js";
 import {
   getAvailabilityCache,
   getCliForModelId,
   resolveFallback
-} from "./chunk-UDXIRE5Z.js";
+} from "./chunk-RGEJZIOJ.js";
 import {
   generateHyphenId,
   generateUUID
-} from "./chunk-YQUUI66R.js";
+} from "./chunk-IQTHG5BO.js";
 import {
   AGENT_ROUTER_TIMEOUTS,
   API_TIMEOUTS,
@@ -319,6 +319,7 @@ import {
   matchesAnyKeyword,
   modelSupportsAll,
   ok,
+  parseGatewayCostEnv,
   rankStrategiesByManifest,
   recordRoutingGaps,
   researchContextFromText,
@@ -329,7 +330,7 @@ import {
   selectStrategyByManifest,
   toExpertTaskAnalysisResult,
   withStep
-} from "./chunk-QXMVHFW7.js";
+} from "./chunk-4PWDDMLH.js";
 import {
   ensureLearningDir,
   getMetaOutcomesFile,
@@ -1103,6 +1104,18 @@ var NexusEnvSchema = z11.object({
   NEXUS_CUSTOM_API_BASE_URL: z11.string().optional(),
   NEXUS_CUSTOM_API_KEY: z11.string().optional(),
   NEXUS_CUSTOM_MODEL: z11.string().optional(),
+  // #4392 increment 2: what a gateway arm costs (GATEWAY_COST_ENV; spelled
+  // out because scripts/check-env-schema-coverage.ts reads keys by regex).
+  // Validated by the same parser every runtime reader uses, so "invalid" here
+  // means UNDECLARED there — the task-class cost ceiling and the per-task
+  // budget exclude the gateway (#6393) and `doctor` warns.
+  // The parser's own reason is forwarded (superRefine, not a fixed message):
+  // "duplicate endpoint key" and "more than one bare declaration" are different
+  // fixes, and a grammar reminder names neither.
+  NEXUS_GATEWAY_COST: z11.string().superRefine((v, ctx) => {
+    const parsed = parseGatewayCostEnv(v);
+    if (!parsed.ok) ctx.addIssue({ code: "custom", message: parsed.error.message });
+  }).optional(),
   NEXUS_MODEL_REGISTRY_OVERLAY: z11.string().optional(),
   NEXUS_OPENAI_COMPAT_KEY: z11.string().optional(),
   NEXUS_OPENAI_COMPAT_URL: z11.string().optional(),
@@ -1156,6 +1169,8 @@ var NexusEnvSchema = z11.object({
   }).optional()
 });
 var KNOWN_NAMES = Object.keys(NexusEnvSchema.shape);
+var REDACTED_VALUE_VARS = /* @__PURE__ */ new Set(["NEXUS_GATEWAY_COST"]);
+var REDACTED_VALUE = "<redacted>";
 var DYNAMIC_FAMILIES = [
   {
     // cli/voter-model-overrides.ts:24 — `NEXUS_VOTER_MODEL_${role.toUpperCase()}`
@@ -1221,7 +1236,8 @@ function logValidationWarnings(logger57, unknownVars, invalidVars, ineffectiveVa
     logger57.warn(`Unknown environment variable: ${u.name}${hint}`);
   }
   for (const inv of invalidVars) {
-    logger57.warn(`Invalid environment variable ${inv.name}="${inv.value}": ${inv.error}`);
+    const shown = inv.value === REDACTED_VALUE ? REDACTED_VALUE : `"${inv.value}"`;
+    logger57.warn(`Invalid environment variable ${inv.name}=${shown}: ${inv.error}`);
   }
   for (const ineff of ineffectiveVars) {
     logger57.warn(
@@ -1261,7 +1277,9 @@ function validateNexusEnv(logger57) {
       const varName = String(issue.path[0]);
       invalidVars.push({
         name: varName,
-        value: knownRecord[varName] ?? "",
+        // Redacted at the record, not only at the log line: the record is
+        // returned to callers, and a copy is one more place a key can leak.
+        value: REDACTED_VALUE_VARS.has(varName) ? REDACTED_VALUE : knownRecord[varName] ?? "",
         error: issue.message
       });
     }
@@ -30060,7 +30078,7 @@ function execIdFields(executionId) {
 async function populateUnifiedContextOnState(state, options) {
   const taskCandidate = state["task"];
   if (typeof taskCandidate !== "string" || taskCandidate === "") return;
-  const { getContextForTask: getContextForTask2, inferTaskCategory: inferTaskCategory2 } = await import("./context-retriever-XP47NAWK.js");
+  const { getContextForTask: getContextForTask2, inferTaskCategory: inferTaskCategory2 } = await import("./context-retriever-5BL34V6Y.js");
   const category = inferTaskCategory2(taskCandidate);
   const executionId = options?.executionId;
   const execFields = execIdFields(executionId);
@@ -45443,7 +45461,7 @@ async function tryIssueTriage(task) {
   try {
     const issueMatch = task.match(/github\.com\/([^/]+\/[^/]+)\/issues\/(\d+)/);
     if (issueMatch === null) return null;
-    const { createIssueTriage } = await import("./issue-triage-7Y7WIMHD.js");
+    const { createIssueTriage } = await import("./issue-triage-KCRQNDYX.js");
     const triage = createIssueTriage();
     const owner = issueMatch[1] ?? "";
     const num2 = issueMatch[2] ?? "";
@@ -45471,7 +45489,7 @@ var VALID_TEMPLATES = /* @__PURE__ */ new Set([
 ]);
 async function classifyWithLLM(task) {
   try {
-    const { executeExpert: executeExpert2 } = await import("./expert-bridge-XYKGSZER.js");
+    const { executeExpert: executeExpert2 } = await import("./expert-bridge-PLY7MNUK.js");
     const prompt = [
       "Classify this task into exactly one pipeline template.",
       "Templates: dev (implementation/bug fix/refactor), research (investigate/evaluate/compare),",
@@ -45845,7 +45863,7 @@ function buildVotingInput(plan, config) {
 }
 async function executeSingleVote(plan, config, log) {
   try {
-    const { executeVoting } = await import("./consensus-vote-H4T6XK3A.js");
+    const { executeVoting } = await import("./consensus-vote-5RFJPG5F.js");
     const input = buildVotingInput(plan, config);
     const result = await executeVoting(input, log);
     return parseVotingResult(result);
@@ -47410,7 +47428,7 @@ var memoryInitPromise = null;
 async function initPipelineMemory() {
   if (cachedMemory !== null) return cachedMemory;
   try {
-    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-PJGNXWPZ.js");
+    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-ZNIJGF7Z.js");
     const { getLearningDir } = await import("./learning-persistence-7BEPQEGN.js");
     const mem = createSessionMemory2(getLearningDir());
     mem.startSession(`pipeline-${String(getTimeProvider().now())}`);
@@ -47472,7 +47490,7 @@ function recordRoutingExperience(category, success, durationMs, tokensUsed = 0,
     callRecord(routingMemoryCache);
     return;
   }
-  routingMemoryInitPromise ??= import("./routing-memory-XV627IOT.js").then(({ createRoutingMemory }) => {
+  routingMemoryInitPromise ??= import("./routing-memory-T22PQ5FF.js").then(({ createRoutingMemory }) => {
     routingMemoryCache ??= createRoutingMemory();
     return routingMemoryCache;
   }).catch((error) => {
@@ -47506,7 +47524,7 @@ ${text}` : "";
 }
 async function getWeatherContext() {
   try {
-    const { generateWeatherReport: generateWeatherReport2 } = await import("./weather-report-536EMQ24.js");
+    const { generateWeatherReport: generateWeatherReport2 } = await import("./weather-report-3AZHFDM3.js");
     const report = generateWeatherReport2({ includeAdaptive: true });
     const mappings = "recommendedMappings" in report ? report.recommendedMappings : [];
     if (!Array.isArray(mappings) || mappings.length === 0) return "";
@@ -47524,7 +47542,7 @@ ${lines}
 }
 async function getMemoryContext(task) {
   try {
-    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-PJGNXWPZ.js");
+    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-ZNIJGF7Z.js");
     const { getLearningDir } = await import("./learning-persistence-7BEPQEGN.js");
     const memory = createSessionMemory2(getLearningDir(), { maxLearningsInContext: 10 });
     const learnings = memory.searchLearnings(task.slice(0, 200));
@@ -47649,7 +47667,7 @@ ${contextBlock}`;
       const strategy = config.votingStrategy ?? "higher_order";
       await postProgress(config, "Vote", `Running consensus with ${strategy} strategy...`);
       try {
-        const { executeVoting } = await import("./consensus-vote-H4T6XK3A.js");
+        const { executeVoting } = await import("./consensus-vote-5RFJPG5F.js");
         const votingResult = await executeVoting(
           {
             proposal: buildVoteProposal(plan, research),
@@ -48080,7 +48098,7 @@ async function searchCodebaseForTask(task) {
 }
 async function queryResearchRegistry(task) {
   try {
-    const { synthesizeResearch: synthesizeResearch2 } = await import("./research-helpers-synthesize-DHFIDH3H.js");
+    const { synthesizeResearch: synthesizeResearch2 } = await import("./research-helpers-synthesize-QFKDDHRE.js");
     const topic = task.split(/[.!?\n]/).filter((s) => s.trim().length > 10)[0]?.trim();
     if (topic === void 0) return null;
     const result = await synthesizeResearch2(topic.slice(0, 50));
@@ -48151,7 +48169,7 @@ function createScanStageWrapper() {
       try {
         const slug = ctx.task.match(/([a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+)/)?.[1];
         if (slug !== void 0) {
-          const { generateSecurityPlan: generateSecurityPlan2 } = await import("./repo-security-plan-ZWNLJX53.js");
+          const { generateSecurityPlan: generateSecurityPlan2 } = await import("./repo-security-plan-YWANNRJE.js");
           const plan = await generateSecurityPlan2({ repo: slug, maxScanners: 10 });
           const recs = plan.recommendations.slice(0, 5).map((r) => `${r.priority}: ${r.displayName} (${r.category})`).join("; ");
           return output(PIPELINE_STATE_KEYS.FINDINGS, recs, getTimeProvider().now() - start, true);
@@ -51851,7 +51869,7 @@ var GitHubTaskTracker = class {
   cachedProvider = null;
   async getProvider() {
     if (this.cachedProvider !== null) return this.cachedProvider;
-    const { createScmProvider } = await import("./factory-MEITN7TW.js");
+    const { createScmProvider } = await import("./factory-5XIEO5EA.js");
     const result = await createScmProvider({ repo: this.config.repo ?? "" });
     if (!result.ok) throw new Error(`SCM provider error: ${result.error.message}`);
     this.cachedProvider = result.value;
@@ -52823,7 +52841,7 @@ async function probeSource(source, includeModelIds) {
   }
 }
 async function defaultSources(includeOpenRouter) {
-  const { createAllAdapters: createAllAdapters2 } = await import("./factory-6NL5M2B6.js");
+  const { createAllAdapters: createAllAdapters2 } = await import("./factory-ZCMLOSDY.js");
   const adapters = createAllAdapters2();
   return buildDefaultModelSources(adapters, { includeOpenRouter });
 }
@@ -56899,4 +56917,4 @@ export {
   startPipelineEventBridge,
   shutdownPipelineEventBridge
 };
-//# sourceMappingURL=chunk-DSBCOWEN.js.map
+//# sourceMappingURL=chunk-3FK67YI4.js.map