nexus-agents 8.74.2 → 8.75.0

package/dist/cli.js

@@ -23,11 +23,11 @@ import {
   parseExpertReview,
   reviewPostingBlock,
   sumFindings
-} from "./chunk-I5DGPV2X.js";
-import "./chunk-DSTEEVDR.js";
+} from "./chunk-Y4WMOZNI.js";
+import "./chunk-IZGDLLDP.js";
 import {
   runConfigInitSync
-} from "./chunk-2KXRL4OW.js";
+} from "./chunk-3CTDUBNC.js";
 import {
   AuthHandler,
   CustomExpertDefinitionSchema,
@@ -156,11 +156,11 @@ import {
   validateNexusEnv,
   validateWorkflow,
   wrapInMarkdownFence
-} from "./chunk-6Y24JDBR.js";
-import "./chunk-CYZ3DUQV.js";
+} from "./chunk-A3TT5LFA.js";
+import "./chunk-GA5VPMGG.js";
 import "./chunk-4GDMHCKX.js";
 import "./chunk-M7DUOIAK.js";
-import "./chunk-Z2XB5IKO.js";
+import "./chunk-74UUAGBU.js";
 import {
   CATEGORY_DISPLAY_NAMES,
   DEFAULT_PR_REVIEW_CONFIG
@@ -176,15 +176,16 @@ import {
   doctorCommand,
   initDataDirectories,
   runDoctor
-} from "./chunk-PWEGOADT.js";
-import "./chunk-43RJNTUZ.js";
+} from "./chunk-2WO24CL5.js";
+import "./chunk-2BTJ5FNP.js";
 import {
   buildOpenAICompatAdapters,
+  readOpenAICompatEndpoint,
   readOpenAICompatEnv
-} from "./chunk-HO2UPJ7T.js";
+} from "./chunk-HO4P3ONC.js";
 import {
   shutdownExpertBridge
-} from "./chunk-ZKEULHX6.js";
+} from "./chunk-4I66XLEU.js";
 import {
   ConsensusVoteInputSchema,
   DEFAULT_VOTE_TIMEOUT_MS,
@@ -202,18 +203,18 @@ import {
   registerConsensusVoteTool,
   seatFallbacks,
   toRecordDecision
-} from "./chunk-M6DJ6AE3.js";
+} from "./chunk-OB2BQ2ES.js";
 import {
   loadUsageEvents,
   rollupByModel
-} from "./chunk-47624RRN.js";
+} from "./chunk-LMCC5TTU.js";
 import {
   allOf,
   anyOf
 } from "./chunk-OQB3XC5O.js";
 import {
   synthesizeResearch
-} from "./chunk-MYGTMAHW.js";
+} from "./chunk-DTT5TSJV.js";
 import {
   DRAFT_REPLY_BODY_MAX_LENGTH,
   configureUntrustedInputFirewall,
@@ -224,12 +225,12 @@ import {
   runUntrustedInputFirewall,
   validateAgentAction,
   validateCorroboration
-} from "./chunk-3PI3INR3.js";
-import "./chunk-NC7X6WQL.js";
+} from "./chunk-ZVINGGSG.js";
+import "./chunk-GEZQW3SK.js";
 import {
   ReputationCache,
   sanitizeInput
-} from "./chunk-ADHIHFBA.js";
+} from "./chunk-A3Q4QZ6G.js";
 import {
   ImprovementReviewInputSchema,
   calculateFitnessScore,
@@ -243,23 +244,23 @@ import {
   registerImprovementReviewTool,
   runImprovementReview,
   scanForSecrets
-} from "./chunk-I2KBD37Y.js";
+} from "./chunk-SPQILQFG.js";
 import {
   createDefaultPolicyFirewall,
   setGlobalPolicyFirewall,
   setSecureHandlerAuditLogger,
   stagePolicyFirewallForRollout
-} from "./chunk-D5ST2Y4W.js";
+} from "./chunk-BM272XDR.js";
 import {
   NODE_ENGINE_RANGE,
   VERSION,
   isNodeVersionSupported
-} from "./chunk-QW5FSTLJ.js";
+} from "./chunk-7GOBJ6MR.js";
 import {
   claimGlobalRegistry,
   createUnifiedRegistry,
   getGlobalRegistry
-} from "./chunk-TL5NV5JH.js";
+} from "./chunk-WBPQYYTY.js";
 import {
   CodebaseIndexSchema,
   PaperStatusSchema,
@@ -285,26 +286,26 @@ import {
   loadSourcesRegistry,
   rankDiscoveredItems,
   saveSourcesRegistry
-} from "./chunk-5QE6DJMH.js";
+} from "./chunk-5AR3IEKE.js";
 import {
   loadPapersRegistry,
   loadTechniquesRegistry,
   savePapersRegistry
-} from "./chunk-GW7SZ555.js";
+} from "./chunk-DYCSNMYD.js";
 import {
   resolveToken
-} from "./chunk-22VQMTR6.js";
+} from "./chunk-KUCHJFK3.js";
 import {
   MemoryError,
   configureToolMemory,
   shutdownToolMemory
-} from "./chunk-B227FYGQ.js";
+} from "./chunk-WZPF7SI7.js";
 import {
   capitalize,
   capitalizeKebab,
   truncateText
 } from "./chunk-7LP6VJRP.js";
-import "./chunk-6DPQOIE7.js";
+import "./chunk-LY53XG4N.js";
 import {
   BUILT_IN_EXPERTS
 } from "./chunk-AHI43IQB.js";
@@ -318,26 +319,30 @@ import {
   probeAllClis,
   readSubprocessDepth,
   safeJsonParse
-} from "./chunk-TUTS6S2G.js";
-import "./chunk-ZDVNHXRV.js";
+} from "./chunk-4D3LWDEK.js";
+import "./chunk-UVLHFNVM.js";
 import {
   DEFAULTS
-} from "./chunk-ST7RKS3P.js";
-import "./chunk-5E33WGDR.js";
+} from "./chunk-X4BBJZDE.js";
+import "./chunk-J6VKBPJQ.js";
 import {
   getNexusTmpDir,
   nexusMkdtempSync
 } from "./chunk-HERI7LXN.js";
-import "./chunk-RGEJZIOJ.js";
+import "./chunk-NDFVPB3Q.js";
 import "./chunk-QZUG667L.js";
-import "./chunk-IQTHG5BO.js";
-import "./chunk-GENL3TXA.js";
+import "./chunk-W6YF4G2Y.js";
+import {
+  getDefaultCliCircuitBreakerRegistry,
+  mapModelErrorToCategory
+} from "./chunk-5DQDMHSW.js";
 import {
   API_TIMEOUTS,
   AgentCapability,
   AgentError,
   CLI_NAMES,
   CLI_SUBPROCESS_TIMEOUTS,
+  ConfigError,
   DEFAULT_CLI,
   DEFAULT_MODEL_PROFILES,
   ErrorCode,
@@ -361,6 +366,7 @@ import {
   calculateCost,
   clamp,
   clamp01,
+  clearGatewayCatalog,
   color,
   colors,
   createCompositeRouter,
@@ -390,15 +396,20 @@ import {
   getRandomProvider,
   getTimeProvider,
   getTuneAdjustmentStore,
+  isDurableCapacityError,
+  isEndpointArmId,
+  isRateLimitLikeError,
   logger,
   lookupInTreeCapability,
   ok,
   openSqliteDatabase,
   parseTierOverrides,
+  recordRateLimitEvent,
   resetOutcomeStore,
   routingArmDisplaySlot,
   runWarmUp,
   safeRegex,
+  setGatewayCatalog,
   setGlobalLogLevel,
   setOutcomeStore,
   summarizeTaskProfile,
@@ -406,10 +417,11 @@ import {
   taskAnalysisResultToTaskProfile,
   taskProfileToBanditContext,
   toError,
+  toRateLimitError,
   validateTimeout,
   writeEmptyLine,
   writeLine
-} from "./chunk-4PWDDMLH.js";
+} from "./chunk-4Q3EURVU.js";
 import "./chunk-4UHDDCRB.js";
 import {
   applyPortableMode,
@@ -4559,7 +4571,7 @@ Provide a structured review with:
    * (Source: Issue #828 — Wire policy gate into production pipeline)
    */
   async postReviewToGitHub(provider, pr, result, gateDecision, reputation) {
-    const { formatReviewComment: formatReviewComment2 } = await import("./pr-reviewer-helpers-RMOEXYCO.js");
+    const { formatReviewComment: formatReviewComment2 } = await import("./pr-reviewer-helpers-3PNRHJFT.js");
     const formattedBody = formatReviewComment2(result);
     const body = truncateText(formattedBody, DRAFT_REPLY_BODY_MAX_LENGTH, "\u2026[review truncated]");
     const sources = buildReviewCitations(pr.files);
@@ -12222,7 +12234,7 @@ function probeGrammars(register, parse6, probes = GRAMMAR_PROBES) {
 }
 async function loadGrammarModules() {
   const [{ ensurePolyglotLangs }, napi] = await Promise.all([
-    import("./ast-rule-runner-K35WYUOD.js"),
+    import("./ast-rule-runner-S6BMBE5T.js"),
     import("@ast-grep/napi")
   ]);
   return { register: ensurePolyglotLangs, parse: napi.parse };
@@ -19679,7 +19691,7 @@ function startImprovementReviewScheduler(options) {
   let running = false;
   const runOnce = async () => {
     try {
-      const { runImprovementReview: runImprovementReview2, ImprovementReviewInputSchema: ImprovementReviewInputSchema2 } = await import("./improvement-review-CF5SWXUB.js");
+      const { runImprovementReview: runImprovementReview2, ImprovementReviewInputSchema: ImprovementReviewInputSchema2 } = await import("./improvement-review-NHUWYT4N.js");
       const input = ImprovementReviewInputSchema2.parse({ fileIssues });
       const result = await runImprovementReview2(input, { logger: logger22 });
       logger22.info("Scheduled improvement_review complete", {
@@ -20805,6 +20817,154 @@ function initializeExperts(options) {
   };
 }
 
+// src/adapters/gateway-arm-adapter.ts
+function createGatewayArmAdapter(armId, models, deps) {
+  const delegate = models[0];
+  if (delegate === void 0) {
+    throw new ConfigError(`Gateway arm ${armId} has no models; nothing to register`);
+  }
+  return new GatewayArmAdapter(armId, delegate, models, deps);
+}
+var GatewayArmAdapter = class {
+  constructor(armId, delegate, models, deps) {
+    this.armId = armId;
+    this.delegate = delegate;
+    this.models = models;
+    this.deps = deps;
+  }
+  armId;
+  delegate;
+  models;
+  deps;
+  selectedAt = /* @__PURE__ */ new Date();
+  // --- IModelAdapter (forwarded to the delegate) ---
+  get providerId() {
+    return this.delegate.providerId;
+  }
+  get modelId() {
+    return this.delegate.modelId;
+  }
+  get capabilities() {
+    return this.delegate.capabilities;
+  }
+  /**
+   * Both halves of the breaker contract, as `base-adapter.ts` records them
+   * for the CLI slots on the same shared registry. The success half matters
+   * (#6403 review): in the closed state `recordSuccess` zeroes the failure
+   * count, which is what makes the threshold mean CONSECUTIVE failures, and
+   * in half-open it is what closes the circuit again. Without it a long-lived
+   * process counted scattered blips for its whole lifetime and, once open,
+   * sat half-open forever with any single error re-opening it.
+   */
+  async complete(request) {
+    const result = await this.delegate.complete(request);
+    if (result.ok) {
+      this.deps.circuitBreakerRegistry.getArmBreaker(this.armId).recordSuccess();
+    } else {
+      this.recordFailure(result.error);
+    }
+    return result;
+  }
+  stream(request) {
+    return this.delegate.stream(request);
+  }
+  countTokens(text) {
+    return this.delegate.countTokens(text);
+  }
+  validateConfig() {
+    return this.delegate.validateConfig();
+  }
+  /** The whole catalogue, not the delegate alone — that is what the arm fronts. */
+  listModels() {
+    return Promise.resolve(this.models.map((m) => ({ id: m.modelId })));
+  }
+  // --- IResilientAdapter ---
+  /**
+   * `source: 'api'` always; `degraded` while the arm's breaker is open. There
+   * is no `unavailable`: the arm exists only once discovery succeeded.
+   */
+  getHealth() {
+    return {
+      source: "api",
+      state: this.deps.circuitBreakerRegistry.isArmOpen(this.armId) ? "degraded" : "healthy",
+      selectedAt: this.selectedAt,
+      failoverCount: 0
+    };
+  }
+  /** Nothing to re-detect: the catalogue is fixed at registration. */
+  refresh() {
+    return Promise.resolve();
+  }
+  /** A gateway arm has no CLI to prefer; said at debug so a caller can see it was ignored. */
+  setPreferredCli(cli) {
+    this.deps.logger.debug("setPreferredCli ignored on a gateway arm", { arm: this.armId, cli });
+  }
+  /** The arm never fails over, so the callback is never invoked. */
+  onFailover() {
+    return () => void 0;
+  }
+  getCircuitBreakerRegistry() {
+    return this.deps.circuitBreakerRegistry;
+  }
+  /**
+   * No listeners or timers are held; the breaker outlives the arm on purpose
+   * (a re-registered gateway keeps its failure history). The catalogue does
+   * not: it describes THIS arm's models, so it goes when the arm goes
+   * (`UnifiedAdapterRegistry.dispose()`, or the re-registration that disposes
+   * the earlier adapter). The re-registering caller therefore sets the new
+   * catalogue AFTER `registerApiArm`, never before.
+   */
+  dispose() {
+    clearGatewayCatalog(this.armId);
+  }
+  // --- Private ---
+  /**
+   * `ResilientAdapter.recordBreakerFailure`, keyed on the ARM (#3423, #5359):
+   * a transient rate limit is recorded by the telemetry branch and exempt from
+   * the breaker (it would double-count, and open a breaker on a condition that
+   * clears within the minute); a DURABLE capacity cap is counted even though it
+   * is rate-limit-shaped, because it never clears; everything else counts.
+   * Every rate-limit-shaped failure, durable or not, is a telemetry event.
+   */
+  recordFailure(error) {
+    const breaker = this.deps.circuitBreakerRegistry.getArmBreaker(this.armId);
+    const category = mapModelErrorToCategory(error);
+    const rateLimitLike = category === "rate_limit" || isRateLimitLikeError(error);
+    if (rateLimitLike) this.recordRateLimit(error);
+    if (isDurableCapacityError(error)) {
+      breaker.recordFailure(category);
+      this.deps.logger.warn("Durable capacity cap recorded to gateway arm breaker", {
+        arm: this.armId,
+        provider: this.delegate.providerId,
+        category
+      });
+      return;
+    }
+    if (rateLimitLike) return;
+    breaker.recordFailure(category);
+    this.deps.logger.warn("Gateway arm failure recorded to circuit breaker", {
+      arm: this.armId,
+      provider: this.delegate.providerId,
+      category
+    });
+  }
+  /** The telemetry branch of `ResilientAdapter.complete`, for the exempted case. */
+  recordRateLimit(error) {
+    const provider = this.delegate.providerId;
+    const rlError = toRateLimitError(error, provider);
+    recordRateLimitEvent({
+      provider,
+      timestamp: getTimeProvider().now(),
+      retryAfterMs: rlError.retryAfterMs
+    });
+    this.deps.logger.warn("Rate limit detected on gateway arm", {
+      arm: this.armId,
+      provider,
+      retryAfterMs: rlError.retryAfterMs
+    });
+  }
+};
+
 // src/cli-server-gateway.ts
 async function tryWireGatewayAdapters(logger22) {
   const sandboxActive = detectSandbox().active;
@@ -20814,7 +20974,7 @@ async function tryWireGatewayAdapters(logger22) {
     noticeCliSubprocessFallback(logger22);
     return void 0;
   }
-  const result = await buildOpenAICompatAdapters();
+  const result = await buildOpenAICompatAdapters(logger22);
   if (result === null) {
     noticeCliSubprocessFallback(logger22);
     return void 0;
@@ -20847,6 +21007,36 @@ function noticeCliSubprocessFallback(logger22) {
 function resolveDefaultModelAdapter(gatewayAdapters, adapterRegistry) {
   return gatewayAdapters?.[0] ?? adapterRegistry.getDefault();
 }
+function registerGatewayArm(adapters, endpoint, registry) {
+  const logger22 = registry.getLogger();
+  if (adapters === void 0 || adapters.length === 0) {
+    logger22.debug("No gateway adapters discovered; no api: arm registered");
+    return void 0;
+  }
+  const armId = `api:${endpoint}`;
+  if (!isEndpointArmId(armId)) {
+    logger22.warn("Gateway endpoint is not a valid endpoint id; no api: arm registered");
+    return void 0;
+  }
+  registry.registerApiArm(
+    armId,
+    createGatewayArmAdapter(armId, adapters, {
+      circuitBreakerRegistry: getDefaultCliCircuitBreakerRegistry(),
+      logger: logger22
+    })
+  );
+  setGatewayCatalog(
+    armId,
+    adapters.map((a) => a.modelId)
+  );
+  logger22.info("Gateway registered as one api: arm", { arm: armId, modelCount: adapters.length });
+  return armId;
+}
+async function wireGateway(logger22, registry) {
+  const adapters = await tryWireGatewayAdapters(logger22);
+  registerGatewayArm(adapters, readOpenAICompatEndpoint(), registry);
+  return adapters;
+}
 function handleMissingEnv(logger22, sandboxActive) {
   if (sandboxActive) {
     logger22.error(
@@ -21779,7 +21969,7 @@ function adaptConfigToLibrary(config) {
 }
 function createBeliefPromoter() {
   return async (event) => {
-    const { getToolMemory } = await import("./tool-memory-JNHE2VP2.js");
+    const { getToolMemory } = await import("./tool-memory-EXKJZ34V.js");
     const tm = getToolMemory();
     await tm.recordBelief(
       `skill:${event.name}`,
@@ -22190,7 +22380,7 @@ async function initializeAndRegisterTools(server, logger22, policyFirewall, conf
   const builtInTemplates = await initializeBuiltInTemplates();
   logger22.info("Loaded built-in templates", { count: builtInTemplates.size });
   const adapterRegistry = createAdapterRegistry(logger22);
-  const gatewayAdapters = await tryWireGatewayAdapters(logger22);
+  const gatewayAdapters = await wireGateway(logger22, adapterRegistry);
   const modelAdapter = resolveDefaultModelAdapter(gatewayAdapters, adapterRegistry);
   const policyVals = getPolicyValues(config);
   const allowedPaths = config.security?.allowedPaths;
@@ -23053,7 +23243,7 @@ async function handleResearchCommand(args) {
   }
 }
 async function handleRegistryCommand(args) {
-  const { registryCommand, isValidRegistrySubcommand, formatRegistryUsage } = await import("./registry-command-XFM4XIGJ.js");
+  const { registryCommand, isValidRegistrySubcommand, formatRegistryUsage } = await import("./registry-command-KI2RZGFI.js");
   const subcommand = args.subcommand;
   if (!isValidRegistrySubcommand(subcommand)) {
     process.stdout.write(`${formatRegistryUsage()}
@@ -23101,12 +23291,12 @@ async function handleVerifyCommand(args) {
 async function handleDoctorCommand(args) {
   const exitCode = await doctorCommand({ fix: args.options.fix });
   if (args.options.deep) {
-    const { runDeepDiagnostics: runDeepDiagnostics2, formatDeepDiagnostics: formatDeepDiagnostics2 } = await import("./doctor-deep-UYXLA4HG.js");
+    const { runDeepDiagnostics: runDeepDiagnostics2, formatDeepDiagnostics: formatDeepDiagnostics2 } = await import("./doctor-deep-2WDIAMWF.js");
     const diag = runDeepDiagnostics2();
     process.stdout.write(formatDeepDiagnostics2(diag) + "\n");
   }
   if (args.options.live) {
-    const { runLiveReadiness, formatLiveReadiness } = await import("./doctor-live-7I6STRL7.js");
+    const { runLiveReadiness, formatLiveReadiness } = await import("./doctor-live-RAZLLAGJ.js");
     const report = await runLiveReadiness();
     process.stdout.write(formatLiveReadiness(report) + "\n");
     if (report.some((r) => r.levels.serves.status === "failed")) {
@@ -23839,7 +24029,7 @@ async function runInitPortableFlow(args) {
   return cliExit(result.success ? EXIT_CODES.SUCCESS : EXIT_CODES.SERVER_START_FAILED);
 }
 async function runInitOpencodeFlow(args) {
-  const { runInitOpencode } = await import("./init-opencode-UTF4K2LR.js");
+  const { runInitOpencode } = await import("./init-opencode-ADIEXXXN.js");
   const opencodePath = args.options.opencode;
   if (opencodePath === void 0 || opencodePath === "") {
     process.stderr.write("Error: --opencode requires a path argument.\n");
@@ -23865,7 +24055,7 @@ async function runInitOpencodeFlow(args) {
   return cliExit(EXIT_CODES.SUCCESS);
 }
 async function renderOpencodeValidate(opencodePath) {
-  const { runOpencodeValidate } = await import("./init-opencode-UTF4K2LR.js");
+  const { runOpencodeValidate } = await import("./init-opencode-ADIEXXXN.js");
   const result = await runOpencodeValidate(opencodePath);
   if (!result.ok) {
     process.stderr.write(`init --opencode --validate: ${result.reason ?? "failed"}
@@ -23904,7 +24094,7 @@ async function handleSetupCommandAsync(args) {
   return cliExitFromStatus(exitCode);
 }
 async function runCustomApiSetup(args) {
-  const { configureCustomApi } = await import("./setup-custom-api-5WL5D24S.js");
+  const { configureCustomApi } = await import("./setup-custom-api-YCHOWLRA.js");
   const baseUrl = args.options.customApi;
   if (baseUrl === void 0) return EXIT_CODES.SERVER_START_FAILED;
   const input = {