nexus-agents 9.4.1 → 10.1.0

package/dist/{chunk-OCKU3I4A.js → chunk-C6MM6Z65.js}

@@ -7,7 +7,7 @@ import {
   VERSION,
   isNodeVersionSupported,
   recordServerTransport
-} from "./chunk-L34WFGDZ.js";
+} from "./chunk-AMK4BTAV.js";
 import {
   checkGatewayHealth,
   cliFailsVerdict,
@@ -17,14 +17,14 @@ import {
   gatewaySlotServing,
   gatewayVerdict,
   printVoterTransportCheck
-} from "./chunk-6H4NUU7G.js";
+} from "./chunk-WCHN7B2Q.js";
 import {
   readOpenAICompatEndpoint,
   readOpenAICompatEnv
-} from "./chunk-C5WECFBR.js";
+} from "./chunk-XQMQGUJT.js";
 import {
   claimGlobalRegistry
-} from "./chunk-TFQMVUWQ.js";
+} from "./chunk-V5FGXVSX.js";
 import {
   CODEX_LEGACY_LANDLOCK_CONFIG,
   CODEX_MCP_SERVER_UNAVAILABLE_REASON,
@@ -32,23 +32,24 @@ import {
   codexSandboxPreflight,
   createAllAdapters,
   createCliAdapter
-} from "./chunk-ONYCBTOH.js";
+} from "./chunk-O3VPGING.js";
+import {
+  DEFAULT_EXECUTION_MODE,
+  SecurityConfigSchema
+} from "./chunk-TYLE7Z2S.js";
 import {
   getNexusTmpDir
 } from "./chunk-JPFRRNRR.js";
-import {
-  resolveGatewayEnv
-} from "./chunk-Q5F4OBOK.js";
 import {
   probeCli
 } from "./chunk-TW6PJYTP.js";
 import {
   SERVES_PROBE_PROMPT
-} from "./chunk-FWSAYHGV.js";
+} from "./chunk-EGUISJBB.js";
 import {
   ClaudeCliAdapter,
   IN_FAMILY_FALLBACK_OPTION
-} from "./chunk-TMHCN5EY.js";
+} from "./chunk-NUXSGWDS.js";
 import {
   DEFAULT_CAPABILITIES,
   capitalize,
@@ -58,6 +59,7 @@ import {
   countRoutedOutcomesInFile,
   createLogger,
   err,
+  formatZodIssuesAsArray,
   gatewayCostStatus,
   getCliModelName,
   getDefaultModelForCli,
@@ -71,9 +73,10 @@ import {
   ok,
   resolveAuthEvidence,
   resolveGatewayCostDeclaration,
+  resolveInsideRoot,
   symbols,
   writeLine
-} from "./chunk-7XJZTSHW.js";
+} from "./chunk-WI73OZAU.js";
 import {
   getLearningDir,
   getOutcomesFile,
@@ -90,21 +93,683 @@ import {
   parseBoolEnv
 } from "./chunk-LWOX65CP.js";
 import {
+  CliNameSchema,
+  TaskCategorySchema,
   resolveClassGuardMs
 } from "./chunk-4PN3UVZV.js";
 
 // src/cli/setup-data-dir.ts
-import { mkdirSync, existsSync as existsSync3 } from "node:fs";
+import { mkdirSync, existsSync as existsSync4 } from "node:fs";
 
 // src/cli/doctor.ts
 import {
-  existsSync as existsSync2,
-  readFileSync as readFileSync2,
+  existsSync as existsSync3,
+  readFileSync as readFileSync3,
   readdirSync,
   accessSync,
   constants as fsConstants
 } from "node:fs";
 
+// src/config/config-loader.ts
+import { readFileSync, existsSync } from "node:fs";
+import { resolve, join } from "node:path";
+import * as yaml from "yaml";
+
+// src/config/schemas.ts
+import { z as z9 } from "zod";
+
+// src/config/schemas-core.ts
+import { z } from "zod";
+var LoggingConfigSchema = z.object({
+  level: z.enum(["debug", "info", "warn", "error"]).default("info"),
+  format: z.enum(["json", "pretty"]).default("json"),
+  // Default to stderr: MCP stdio transport reserves stdout for JSON-RPC frames.
+  destination: z.enum(["stdout", "stderr", "file"]).default("stderr"),
+  filePath: z.string().optional()
+});
+var ProviderConfigSchema = z.object({
+  apiKey: z.string().optional(),
+  baseUrl: z.url().optional(),
+  timeout: z.number().positive().default(3e4),
+  maxRetries: z.number().nonnegative().default(3)
+});
+var ModelTiersSchema = z.object({
+  fast: z.array(z.string()).min(1),
+  balanced: z.array(z.string()).min(1),
+  powerful: z.array(z.string()).min(1)
+});
+var ModelConfigSchema = z.object({
+  default: z.string(),
+  tiers: ModelTiersSchema,
+  providers: z.record(z.string(), ProviderConfigSchema).optional()
+});
+var WorkflowConfigSchema = z.object({
+  templatesDir: z.string().default("./workflows"),
+  timeout: z.number().positive().default(3e5),
+  maxParallel: z.number().positive().default(5)
+});
+
+// src/config/schemas-expert.ts
+import { z as z2 } from "zod";
+var VALID_EXPERT_TIERS = ["fast", "balanced", "powerful"];
+var VALID_EXPERT_DOMAINS = [
+  "code",
+  "security",
+  "architecture",
+  "documentation",
+  "testing",
+  "general"
+];
+var MAX_SYSTEM_PROMPT_LENGTH = 4e3;
+var CustomExpertDefinitionSchema = z2.object({
+  /** System prompt defining the expert's persona (max 4000 characters) */
+  systemPrompt: z2.string().min(1, "System prompt is required").max(
+    MAX_SYSTEM_PROMPT_LENGTH,
+    `System prompt must be at most ${String(MAX_SYSTEM_PROMPT_LENGTH)} characters`
+  ),
+  /** Model tier for routing */
+  tier: z2.enum(VALID_EXPERT_TIERS, {
+    error: `Invalid tier. Valid options: ${VALID_EXPERT_TIERS.join(", ")}`
+  }).default("balanced"),
+  /** Primary domain of expertise */
+  domain: z2.enum(VALID_EXPERT_DOMAINS, {
+    error: `Invalid domain. Valid options: ${VALID_EXPERT_DOMAINS.join(", ")}`
+  }).default("general"),
+  /** Secondary domains (optional) */
+  secondaryDomains: z2.array(z2.enum(VALID_EXPERT_DOMAINS)).optional(),
+  /** Expert capabilities */
+  capabilities: z2.array(z2.string().min(1)).min(1, "At least one capability is required").default(["task_execution"]),
+  /** Model temperature (0-1) */
+  temperature: z2.number().min(0).max(1).default(0.3),
+  /** Allowed tools (optional, unrestricted if not specified) */
+  tools: z2.array(z2.string()).optional(),
+  /** Human-readable description */
+  description: z2.string().optional(),
+  /** Weight for expert selection scoring (0-1) */
+  weight: z2.number().min(0).max(1).default(1),
+  /** Whether this expert is currently available */
+  available: z2.boolean().default(true)
+});
+var ExpertDefinitionSchema = z2.object({
+  prompt: z2.string().min(1),
+  tier: z2.enum(["fast", "balanced", "powerful"]).default("balanced"),
+  temperature: z2.number().min(0).max(1).default(0.3),
+  tools: z2.array(z2.string()).optional()
+});
+var ExpertConfigSchema = z2.object({
+  /** Enable built-in experts */
+  builtin: z2.boolean().default(true),
+  /** Custom expert definitions keyed by expert ID */
+  custom: z2.record(
+    z2.string().regex(/^[a-z][a-z0-9_]*$/, {
+      message: "Expert ID must start with a letter and contain only lowercase letters, numbers, and underscores"
+    }),
+    CustomExpertDefinitionSchema
+  ).optional()
+});
+
+// src/config/schemas-observability.ts
+import { z as z3 } from "zod";
+var EventBusConfigSchema = z3.object({
+  /** Enable EventBus integration (default: true) */
+  enabled: z3.boolean().default(true),
+  /** Maximum events to retain in history (default: 1000) */
+  maxHistorySize: z3.number().positive().default(1e3),
+  /** Event patterns to subscribe to (default: all major patterns) */
+  subscriptions: z3.object({
+    /** Subscribe to consensus events (consensus.*) */
+    consensus: z3.boolean().default(true),
+    /** Subscribe to agent events (agent.*) */
+    agent: z3.boolean().default(true),
+    /** Subscribe to protocol events (protocol.*) */
+    protocol: z3.boolean().default(true),
+    /** Subscribe to session events (session.*) */
+    session: z3.boolean().default(true),
+    /** Subscribe to message events (message.*) */
+    message: z3.boolean().default(false),
+    // Off by default (high volume)
+    /** Subscribe to byzantine detection events (byzantine.*) */
+    byzantine: z3.boolean().default(true)
+  }).default(() => ({
+    consensus: true,
+    agent: true,
+    protocol: true,
+    session: true,
+    message: false,
+    byzantine: true
+  })),
+  /** Logging configuration for events */
+  logging: z3.object({
+    /** Log level for frequent events (default: debug) */
+    frequentEventLevel: z3.enum(["debug", "info"]).default("debug"),
+    /** Log level for important events (default: info) */
+    importantEventLevel: z3.enum(["debug", "info"]).default("info")
+  }).default(() => ({
+    frequentEventLevel: "debug",
+    importantEventLevel: "info"
+  }))
+});
+var ObservabilityConfigSchema = z3.object({
+  /** EventBus configuration */
+  eventBus: EventBusConfigSchema.optional(),
+  /** SwarmObserver maximum events (default: 10000) */
+  swarmObserverMaxEvents: z3.number().positive().default(1e4)
+});
+
+// src/config/schemas-skills.ts
+import { z as z4 } from "zod";
+var ExternalPackSourceSchema = z4.object({
+  /** Pack name for identification */
+  name: z4.string().min(1),
+  /** Source: npm package name or local file path */
+  source: z4.string().min(1),
+  /** Whether the pack is enabled (default: true) */
+  enabled: z4.boolean().default(true)
+});
+var SkillLibraryConfigSchema = z4.object({
+  /** Whether skill library is enabled (default: true) */
+  enabled: z4.boolean().default(true),
+  /** Maximum skills to store (default: 1000) */
+  maxSkills: z4.number().int().positive().default(1e3),
+  /** Minimum success rate to keep skill (0-1, default: 0.3) */
+  minSuccessRateForRetention: z4.number().min(0).max(1).default(0.3),
+  /** Number of executions before evaluating retention (default: 5) */
+  executionsBeforeEvaluation: z4.number().int().nonnegative().default(5),
+  /** Enable automatic skill pruning (default: true) */
+  enablePruning: z4.boolean().default(true),
+  /** Whether to track detailed execution history (default: true) */
+  trackExecutionHistory: z4.boolean().default(true),
+  /** Maximum execution history entries per skill (default: 100) */
+  maxHistoryPerSkill: z4.number().int().positive().default(100),
+  /** External skill pack sources (Issue #654) */
+  externalPacks: z4.array(ExternalPackSourceSchema).optional()
+});
+
+// src/config/schemas-sica.ts
+import { z as z5 } from "zod";
+var SicaConfigSchema = z5.object({
+  /** Whether SICA wrapping is enabled (default: false) */
+  enabled: z5.boolean().default(false),
+  /** Minimum executions before considering improvement (default: 10) */
+  minExecutionsForImprovement: z5.number().int().positive().default(10),
+  /** Success rate threshold to trigger improvement (0-1, default: 0.7) */
+  improvementThreshold: z5.number().min(0).max(1).default(0.7),
+  /** Maximum concurrent versions to evaluate (default: 3) */
+  maxActiveVersions: z5.number().int().positive().max(10).default(3),
+  /** Whether to auto-select best version (default: true) */
+  autoSelectBest: z5.boolean().default(true),
+  /** Improvement cooldown in milliseconds (default: 60000) */
+  improvementCooldownMs: z5.number().int().nonnegative().default(6e4),
+  /** Enable observability logging for SICA events (default: true) */
+  enableObservability: z5.boolean().default(true)
+});
+
+// src/config/schemas-gateway.ts
+import { z as z6 } from "zod";
+var TierNameSchema = z6.enum(["DIRECT", "ANALYZED", "ORCHESTRATED"]);
+var ALLOWED_COMMANDS = ["node", "npx", "python", "python3", "uvx", "docker"];
+var UpstreamServerSchema = z6.object({
+  /** Unique name for this upstream server (used as tool prefix). */
+  name: z6.string().min(1).max(50).regex(/^[a-z0-9_-]+$/),
+  /** Command to spawn the server. Must be in allowlist. */
+  command: z6.enum(ALLOWED_COMMANDS),
+  /** Arguments to pass to the command. */
+  args: z6.array(z6.string().max(500)).default([]),
+  /** Environment variables (use {env:VAR} references, not plaintext secrets). */
+  env: z6.record(z6.string(), z6.string()).optional(),
+  /** Whether to connect lazily on first tool call (default: true). */
+  lazy: z6.boolean().default(true),
+  /** Connection timeout in ms (default: 10000). */
+  timeoutMs: z6.number().int().min(1e3).max(6e4).default(1e4)
+});
+var MAX_UPSTREAM_SERVERS = 5;
+var GatewayConfigSchema = z6.object({
+  /** Enable gateway tier dispatch logging (default: true). */
+  enabled: z6.boolean().default(true),
+  /**
+   * Per-tool tier overrides.
+   * Keys are tool names (e.g., 'delegate_to_model'), values are tier names.
+   * Overrides the default tier from TOOL_TIER_MAP in tier-classifier.ts.
+   */
+  tierOverrides: z6.record(z6.string(), TierNameSchema).optional(),
+  /**
+   * Upstream MCP servers to compose with (#1498).
+   * Tools from upstream servers are available as prefixed tools (e.g., tavily.search).
+   */
+  upstreamServers: z6.array(UpstreamServerSchema).max(MAX_UPSTREAM_SERVERS).optional()
+});
+
+// src/config/schemas-routing.ts
+import { z as z7 } from "zod";
+var BudgetConstraintsSchema = z7.object({
+  /** Maximum tokens per request */
+  maxTokens: z7.number().positive().optional(),
+  /** Maximum cost per request in USD */
+  maxCostUsd: z7.number().positive().optional(),
+  /** Maximum latency per request in milliseconds */
+  maxLatencyMs: z7.number().positive().optional(),
+  /**
+   * Per-task-class cost ceilings in USD, keyed by `TaskCategory`
+   * (#4196, #4214). Keys are validated against the enum so a typo'd
+   * class fails config parsing instead of silently configuring nothing.
+   * Absent → no ceiling (OFF/unlimited). Enforced only under
+   * `NEXUS_BILLING_MODE=api`; a candidate with missing registry pricing
+   * fails a configured ceiling (fail-closed).
+   */
+  taskClassMaxCostUsd: z7.partialRecord(TaskCategorySchema, z7.number().positive()).optional()
+}).optional();
+var TopsisCriterionSchema = z7.object({
+  /** Criterion name (e.g., 'quality', 'cost', 'latency') */
+  name: z7.string().min(1),
+  /** Weight for this criterion (0-1, should sum to 1 across all criteria) */
+  weight: z7.number().min(0).max(1),
+  /** Whether higher values are better (true) or lower is better (false) */
+  beneficial: z7.boolean()
+});
+var TopsisConfigSchema = z7.object({
+  /** Criteria with weights (must sum to 1.0) */
+  criteria: z7.array(TopsisCriterionSchema).optional(),
+  /** Minimum acceptable quality score (0-10) */
+  minQualityThreshold: z7.number().min(0).max(10).default(5),
+  /** Maximum acceptable latency in milliseconds (optional) */
+  maxLatencyMs: z7.number().positive().optional(),
+  /** Maximum acceptable cost per request in USD (optional) */
+  maxCostPerRequest: z7.number().positive().optional(),
+  /** Whether to log detailed scoring info */
+  verbose: z7.boolean().default(false)
+}).optional();
+var DifficultyWeightsConfigSchema = z7.object({
+  /** Weight for reasoning difficulty (0-1) */
+  reasoning: z7.number().min(0).max(1).default(0.3),
+  /** Weight for knowledge difficulty (0-1) */
+  knowledge: z7.number().min(0).max(1).default(0.15),
+  /** Weight for creativity difficulty (0-1) */
+  creativity: z7.number().min(0).max(1).default(0.15),
+  /** Weight for precision difficulty (0-1) */
+  precision: z7.number().min(0).max(1).default(0.25),
+  /** Weight for context length difficulty (0-1) */
+  context_length: z7.number().min(0).max(1).default(0.15)
+});
+var DifficultyThresholdsSchema = z7.object({
+  /** Upper bound for 'easy' classification (0-1) */
+  easyUpperBound: z7.number().min(0).max(1).default(0.3),
+  /** Lower bound for 'hard' classification (0-1) */
+  hardLowerBound: z7.number().min(0).max(1).default(0.7)
+});
+var DifficultyLevelSchema = z7.enum(["easy", "medium", "hard"]);
+var ModelTierSchema = z7.enum(["fast", "balanced", "powerful"]);
+var ZeroRouterConfigSchema = z7.object({
+  /** Difficulty thresholds for level classification */
+  thresholds: DifficultyThresholdsSchema.optional(),
+  /** Weights for difficulty aggregation */
+  weights: DifficultyWeightsConfigSchema.optional(),
+  /** Mapping from difficulty level to model tier */
+  difficultyToTier: z7.record(DifficultyLevelSchema, ModelTierSchema).optional(),
+  /** Mapping from model tier to CLI preference order */
+  tierToClis: z7.record(ModelTierSchema, z7.array(CliNameSchema)).optional(),
+  /** Enable adaptive calibration from outcomes */
+  enableCalibration: z7.boolean().default(true),
+  /** Maximum outcomes to store for calibration */
+  maxCalibrationOutcomes: z7.number().int().positive().default(1e3),
+  /** Minimum outcomes before applying calibration adjustments */
+  minCalibrationOutcomes: z7.number().int().positive().default(50),
+  /** Verbose logging */
+  verbose: z7.boolean().default(false)
+}).optional();
+var LatencyTrackerConfigSchema = z7.object({
+  /** Maximum number of samples to keep per CLI */
+  windowSize: z7.number().int().positive().default(100),
+  /** Time-weighted decay factor (0-1, higher = more weight to recent) */
+  decayFactor: z7.number().min(0).max(1).default(0.95),
+  /** Maximum age of samples in milliseconds before forced eviction */
+  maxSampleAgeMs: z7.number().int().positive().default(36e5),
+  /** Percentiles to calculate */
+  percentiles: z7.array(z7.number().min(0).max(100)).max(20).default([50, 95, 99])
+}).optional();
+var RoutingMemoryConfigSchema = z7.object({
+  /** Minimum observations before using learned routing */
+  minObservations: z7.number().int().positive().default(5),
+  /** Confidence threshold for using cached decisions */
+  confidenceThreshold: z7.number().min(0).max(1).default(0.6),
+  /** Success rate threshold for trusting a routing pattern */
+  successRateThreshold: z7.number().min(0).max(1).default(0.7),
+  /** Maximum age of cached actions in milliseconds */
+  actionCacheMaxAgeMs: z7.number().int().positive().default(36e5)
+}).optional();
+var RoutingConfigSchema = z7.object({
+  /**
+   * Pipeline stage toggles.
+   * Enable or disable individual routing stages.
+   */
+  stages: z7.object({
+    /** Enable budget filtering stage */
+    budgetFilter: z7.boolean().default(true),
+    /** Enable ZeroRouter difficulty-based routing */
+    zeroRouter: z7.boolean().default(true),
+    /** Enable preference-trained routing */
+    preferenceRouting: z7.boolean().default(false),
+    /** Enable TOPSIS ranking */
+    topsisRanking: z7.boolean().default(true),
+    /** Enable LinUCB selection */
+    linucbSelection: z7.boolean().default(true),
+    /** Enable latency tracking */
+    latencyTracking: z7.boolean().default(true),
+    /** Enable routing memory for learned routing */
+    routingMemory: z7.boolean().default(false),
+    /** Enable confidence cascade stage (Issue #755, ADR-0005) */
+    confidenceCascade: z7.boolean().default(false),
+    /** Enable capability match stage (Issue #755, ADR-0005) */
+    capabilityMatch: z7.boolean().default(false),
+    /** Enable quality constraint stage (Issue #755, ADR-0005) */
+    qualityConstraint: z7.boolean().default(false),
+    /** Enable resource strategy stage for budget-aware oscillation (Issue #998) */
+    resourceStrategy: z7.boolean().default(true),
+    /** Enable strategy distillation for learned routing rules (Issue #999) */
+    strategyDistillation: z7.boolean().default(false)
+  }).optional(),
+  /**
+   * Budget constraints for routing decisions.
+   */
+  budget: BudgetConstraintsSchema,
+  /**
+   * TOPSIS multi-criteria decision making configuration.
+   */
+  topsis: TopsisConfigSchema,
+  /**
+   * ZeroRouter difficulty-based routing configuration.
+   */
+  zeroRouter: ZeroRouterConfigSchema,
+  /**
+   * Latency tracker configuration.
+   */
+  latencyTracker: LatencyTrackerConfigSchema,
+  /**
+   * Routing memory configuration.
+   */
+  routingMemory: RoutingMemoryConfigSchema,
+  /**
+   * LinUCB bandit parameters.
+   */
+  linucb: z7.object({
+    /** Exploration parameter (higher = more exploration) */
+    alpha: z7.number().positive().default(1)
+  }).optional(),
+  /**
+   * Preference router parameters.
+   */
+  preference: z7.object({
+    /** Minimum data points before using learned preferences */
+    minDataPoints: z7.number().int().positive().default(10)
+  }).optional(),
+  /**
+   * Weight for latency score in final routing (0-1).
+   */
+  latencyScoreWeight: z7.number().min(0).max(1).default(0.2)
+});
+
+// src/config/schemas-memory.ts
+import { z as z8 } from "zod";
+var unitInterval = z8.number().min(0).max(1);
+var MIN_DECAY_INTERVAL_MS = 1e3;
+var MemoryDecayConfigSchema = z8.object({
+  /** Whether decay runs at all (default: true) */
+  enabled: z8.boolean().optional(),
+  /**
+   * Interval between automatic decay runs in ms (default: 1 hour).
+   * Floor: {@link MIN_DECAY_INTERVAL_MS}. `runDecay` has no re-entrancy
+   * guard, so a sub-second cadence invites overlapping sweeps over the same
+   * stores; 1000 ms is the smallest value at which that is implausible.
+   */
+  decayIntervalMs: z8.number().int().min(MIN_DECAY_INTERVAL_MS).optional(),
+  /** Age in days before superseded beliefs are pruned (default: 30) */
+  beliefMaxAgeDays: z8.number().int().positive().optional(),
+  /** Agentic entries before importance-based eviction starts (default: 10000) */
+  agenticMaxEntries: z8.number().int().positive().optional(),
+  /** Importance below which agentic entries are evicted, 0-1 (default: 0.3) */
+  agenticImportanceThreshold: unitInterval.optional(),
+  /** Priority score below which adaptive entries are evicted, 0-1 (default: 0.2) */
+  adaptivePriorityThreshold: unitInterval.optional(),
+  /** Run MobiMem TTL eviction on each coordinated decay (default: true) */
+  mobimemEvictOnDecay: z8.boolean().optional(),
+  /** Check cross-references before evicting (default: true) */
+  checkCrossReferences: z8.boolean().optional(),
+  /** Grace period in ms before removing cross-referenced items (default: 7 days) */
+  crossReferenceGracePeriodMs: z8.number().int().nonnegative().optional()
+});
+var MemoryConfigSchema = z8.object({
+  /** Coordinated decay knobs (#5097) */
+  decay: MemoryDecayConfigSchema.optional()
+});
+
+// src/config/schemas.ts
+var AppConfigSchema = z9.object({
+  models: ModelConfigSchema,
+  experts: ExpertConfigSchema.optional(),
+  workflows: WorkflowConfigSchema.optional(),
+  security: SecurityConfigSchema.optional(),
+  logging: LoggingConfigSchema.optional(),
+  /** Observability configuration (Issue #307) */
+  observability: ObservabilityConfigSchema.optional(),
+  /** Routing configuration (Issue #475) - used in orchestrator mode */
+  routing: RoutingConfigSchema.optional(),
+  /** Skill library configuration (Issue #491) */
+  skills: SkillLibraryConfigSchema.optional(),
+  /** SICA self-improvement configuration (Issue #492) */
+  sica: SicaConfigSchema.optional(),
+  /** Gateway middleware configuration (Issue #897) */
+  gateway: GatewayConfigSchema.optional(),
+  /** Memory configuration — today only `decay` reaches runtime (Issue #5097) */
+  memory: MemoryConfigSchema.optional()
+});
+var defaultConfig = {
+  models: {
+    default: "claude-sonnet",
+    tiers: {
+      fast: ["claude-haiku", "gemini-flash"],
+      balanced: ["claude-sonnet", "gemini-pro"],
+      powerful: ["claude-opus", "codex-5.3"]
+    }
+  },
+  logging: {
+    level: "info",
+    format: "json",
+    // stderr is the safe default: MCP stdio transport reserves stdout for
+    // JSON-RPC frames. Any log written to stdout corrupts the transport.
+    destination: "stderr"
+  },
+  security: {
+    allowedPaths: ["./"],
+    blockedPatterns: [],
+    rateLimit: {
+      enabled: true,
+      requestsPerMinute: 60
+    },
+    policy: {
+      defaultMode: DEFAULT_EXECUTION_MODE,
+      policyMode: "enforce"
+    },
+    timeout: {
+      defaultTimeoutMs: 3e4,
+      maxTimeoutMs: 3e5,
+      enableLogging: true,
+      uriValidation: true
+    }
+  }
+};
+
+// src/config/config-loader.ts
+var DEFAULT_CONFIG_FILE = "nexus-agents.yaml";
+var ALTERNATE_CONFIG_FILE = "nexus-agents.yml";
+var CONFIG_LOOKUP_PATHS = [
+  `.nexus-agents/${DEFAULT_CONFIG_FILE}`,
+  `.nexus-agents/${ALTERNATE_CONFIG_FILE}`,
+  DEFAULT_CONFIG_FILE,
+  ALTERNATE_CONFIG_FILE
+];
+var ConfigLoadError = class extends Error {
+  code;
+  constructor(message, code, cause) {
+    super(message, { cause });
+    this.name = "ConfigLoadError";
+    this.code = code;
+  }
+};
+function validatePath(userPath, root) {
+  const resolved = resolveInsideRoot(userPath, root);
+  if (resolved === null) {
+    return err(
+      new ConfigLoadError(
+        `Config path traversal detected: ${userPath} escapes ${root}`,
+        "PATH_TRAVERSAL"
+      )
+    );
+  }
+  return ok(resolved);
+}
+function findConfigPath(cwd) {
+  const envPath = process.env["NEXUS_CONFIG_PATH"];
+  if (envPath !== void 0 && envPath !== "") {
+    const validation = validatePath(envPath, cwd);
+    if (validation.ok && existsSync(validation.value)) {
+      return validation.value;
+    }
+  }
+  for (const rel of CONFIG_LOOKUP_PATHS) {
+    const abs = resolve(cwd, rel);
+    if (existsSync(abs)) {
+      return abs;
+    }
+  }
+  const globalDir = getNexusDataDir();
+  const globalYamlPath = join(globalDir, DEFAULT_CONFIG_FILE);
+  if (existsSync(globalYamlPath)) {
+    return globalYamlPath;
+  }
+  const globalYmlPath = join(globalDir, ALTERNATE_CONFIG_FILE);
+  if (existsSync(globalYmlPath)) {
+    return globalYmlPath;
+  }
+  return void 0;
+}
+function parseYaml(content) {
+  try {
+    const parsed = yaml.parse(content);
+    return ok(parsed);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Unknown YAML parse error";
+    return err(
+      new ConfigLoadError(`YAML parse error: ${message}`, "YAML_PARSE_ERROR", error)
+    );
+  }
+}
+var PROTOTYPE_POLLUTION_KEYS = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype"
+]);
+function isMergeableObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function deepMerge(target, source) {
+  const result = { ...target };
+  for (const key of Object.keys(source)) {
+    if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+    const sourceValue = source[key];
+    if (sourceValue === void 0) continue;
+    const targetValue = target[key];
+    if (isMergeableObject(sourceValue) && isMergeableObject(targetValue)) {
+      result[key] = deepMerge(targetValue, sourceValue);
+    } else {
+      result[key] = sourceValue;
+    }
+  }
+  return result;
+}
+function loadDefaultConfig(logger2) {
+  logger2.debug("No config file found, using defaults");
+  const validated = AppConfigSchema.safeParse(defaultConfig);
+  if (!validated.success) {
+    return err(
+      new ConfigLoadError(
+        `Default config validation failed: ${validated.error.message}`,
+        "VALIDATION_ERROR"
+      )
+    );
+  }
+  return ok({
+    config: validated.data,
+    usingDefaults: true,
+    warnings: ["No config file found, using default configuration"]
+  });
+}
+function readAndParseConfig(configPath, mergeDefaults, logger2) {
+  let content;
+  try {
+    content = readFileSync(configPath, "utf-8");
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Unknown error";
+    return err(
+      new ConfigLoadError(
+        `Failed to read config file: ${message}`,
+        "FILE_READ_ERROR",
+        error
+      )
+    );
+  }
+  const parseResult = parseYaml(content);
+  if (!parseResult.ok) return err(parseResult.error);
+  if (mergeDefaults && typeof parseResult.value === "object" && parseResult.value !== null) {
+    logger2.debug("Merged config with defaults");
+    return ok(
+      deepMerge(
+        defaultConfig,
+        parseResult.value
+      )
+    );
+  }
+  return ok(parseResult.value);
+}
+function validateConfig(configData, configPath, logger2) {
+  const validation = AppConfigSchema.safeParse(configData);
+  if (!validation.success) {
+    const issues = formatZodIssuesAsArray(validation.error);
+    return err(
+      new ConfigLoadError(`Config validation failed:
+${issues.join("\n")}`, "VALIDATION_ERROR")
+    );
+  }
+  logger2.info("Configuration loaded successfully", { configPath });
+  return ok({ config: validation.data, configPath, usingDefaults: false, warnings: [] });
+}
+function loadConfig(options = {}) {
+  const { configPath: explicitPath, cwd = process.cwd(), mergeDefaults = true } = options;
+  const logger2 = options.logger ?? createLogger({ component: "ConfigLoader" });
+  let configPath;
+  if (explicitPath !== void 0) {
+    const validation = validatePath(explicitPath, cwd);
+    if (!validation.ok) return err(validation.error);
+    configPath = validation.value;
+  } else {
+    configPath = findConfigPath(cwd);
+  }
+  if (configPath === void 0) return loadDefaultConfig(logger2);
+  const parseResult = readAndParseConfig(configPath, mergeDefaults, logger2);
+  if (!parseResult.ok) return err(parseResult.error);
+  return validateConfig(parseResult.value, configPath, logger2);
+}
+var loadedConfig;
+function getConfig(options) {
+  if (loadedConfig !== void 0) {
+    return loadedConfig;
+  }
+  const result = loadConfig(options);
+  if (!result.ok) {
+    throw result.error;
+  }
+  loadedConfig = result.value;
+  return loadedConfig;
+}
+
 // src/cli/doctor-scratch-space.ts
 import { statSync, statfsSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -596,6 +1261,7 @@ function failingVerdictTerms(result, live) {
   const terms = gatewayTerms(result.gateway, gateway);
   if (!result.nodeVersion.supported) terms.push("node version");
   if (!result.mcpServerReady) terms.push("MCP server");
+  if (result.configFile.error !== void 0) terms.push("configuration");
   if (installFreshnessFailsVerdict(result.installFreshness)) {
     terms.push("install freshness");
   }
@@ -769,7 +1435,9 @@ function printApiKeysCheck(keys) {
   }
 }
 function printConfigFileCheck(check) {
-  if (check.found && check.path !== null) {
+  if (check.error !== void 0) {
+    writeLine(`${formatStatus(false)} Configuration failed: ${check.error}`);
+  } else if (check.found && check.path !== null) {
     writeLine(`${formatStatus(true)} Configuration loaded: ${check.path}`);
   } else {
     writeLine(`${formatStatus(false, true)} Configuration file: Not found`);
@@ -1015,8 +1683,8 @@ function printHarnessAlignment(check) {
 }
 
 // src/cli/doctor-harness-alignment.ts
-import { existsSync, readFileSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
+import { dirname, join as join2, resolve as resolve2 } from "node:path";
 var HARNESS_FILES = [
   { harness: "Cursor", path: ".cursor/rules/agents.mdc" },
   { harness: "Windsurf", path: ".windsurf/rules/agents.md" },
@@ -1031,9 +1699,9 @@ function checkHarnessAlignment(cwd = process.cwd()) {
   const projectRoot = findProjectRoot(cwd);
   const inProject = projectRoot !== null;
   const base = projectRoot ?? cwd;
-  const agentsMdExists = existsSync(join(base, "AGENTS.md"));
+  const agentsMdExists = existsSync2(join2(base, "AGENTS.md"));
   const files = HARNESS_FILES.map(
-    ({ harness, path }) => inspectFile(harness, path, join(base, path))
+    ({ harness, path }) => inspectFile(harness, path, join2(base, path))
   );
   const alignedCount = files.filter((f) => f.exists && f.redirectsToAgentsMd).length;
   const driftCount = files.filter((f) => f.exists && !f.redirectsToAgentsMd).length;
@@ -1051,16 +1719,16 @@ function findProjectRoot(start) {
   return findRepoRoot(start) ?? findPackageJsonAncestor(start);
 }
 function findPackageJsonAncestor(start) {
-  let current = resolve(start);
+  let current = resolve2(start);
   for (; ; ) {
-    if (existsSync(join(current, "package.json"))) return current;
+    if (existsSync2(join2(current, "package.json"))) return current;
     const parent = dirname(current);
     if (parent === current) return null;
     current = parent;
   }
 }
 function inspectFile(harness, relativePath, absolutePath) {
-  if (!existsSync(absolutePath)) {
+  if (!existsSync2(absolutePath)) {
     return {
       harness,
       path: relativePath,
@@ -1070,7 +1738,7 @@ function inspectFile(harness, relativePath, absolutePath) {
     };
   }
   try {
-    const content = readFileSync(absolutePath, "utf-8");
+    const content = readFileSync2(absolutePath, "utf-8");
     return {
       harness,
       path: relativePath,
@@ -1092,12 +1760,6 @@ function inspectFile(harness, relativePath, absolutePath) {
 // src/cli/doctor.ts
 import { execFileSync } from "node:child_process";
 var API_KEY_VARS = ["ANTHROPIC_API_KEY", "OPENAI_API_KEY", "GOOGLE_AI_API_KEY"];
-var CONFIG_FILE_PATHS = [
-  "./.nexus-agents/nexus-agents.yaml",
-  "./.nexus-agents/nexus-agents.yml",
-  "./nexus-agents.yaml",
-  "./nexus-agents.yml"
-];
 var DATA_SUBDIRECTORIES = [
   "memory",
   "memory/beliefs",
@@ -1231,12 +1893,11 @@ function checkApiKeys() {
   }));
 }
 function checkConfigFile() {
-  for (const configPath of CONFIG_FILE_PATHS) {
-    if (existsSync2(configPath)) {
-      return { found: true, path: configPath };
-    }
+  const result = loadConfig();
+  if (!result.ok) {
+    return { found: true, path: null, error: result.error.message };
   }
-  return { found: false, path: null };
+  return { found: !result.value.usingDefaults, path: result.value.configPath ?? null };
 }
 function checkMcpServerReady() {
   try {
@@ -1274,11 +1935,11 @@ function buildRegistryAdvisory(cliResults, disabledClis, gateway) {
 function hasPriorUsage() {
   try {
     const root = getNexusDataDir();
-    if (!existsSync2(root)) return false;
+    if (!existsSync3(root)) return false;
     for (const sub of ["audit", "learning", "sessions", "voting"]) {
       const p = `${root}/${sub}`;
       try {
-        if (existsSync2(p) && readdirSync(p).length > 0) return true;
+        if (existsSync3(p) && readdirSync(p).length > 0) return true;
       } catch {
       }
     }
@@ -1288,17 +1949,17 @@ function hasPriorUsage() {
   }
 }
 function countJsonlLines(filePath) {
-  if (!existsSync2(filePath)) return 0;
-  return readFileSync2(filePath, "utf-8").split("\n").filter((l) => l.trim().length > 0).length;
+  if (!existsSync3(filePath)) return 0;
+  return readFileSync3(filePath, "utf-8").split("\n").filter((l) => l.trim().length > 0).length;
 }
 var NO_RULES = { count: 0, activeCount: 0, eligibleOutcomes: null, savedAt: null };
 function isActiveRule(rule) {
   return typeof rule === "object" && rule !== null && rule["status"] === "active";
 }
 function readRulesMetadata(filePath) {
-  if (!existsSync2(filePath)) return NO_RULES;
+  if (!existsSync3(filePath)) return NO_RULES;
   try {
-    const raw = JSON.parse(readFileSync2(filePath, "utf-8"));
+    const raw = JSON.parse(readFileSync3(filePath, "utf-8"));
     const rules = Array.isArray(raw["rules"]) ? raw["rules"] : [];
     const saved = raw["savedAt"];
     const eligible = raw["eligibleOutcomes"];
@@ -1313,7 +1974,7 @@ function readRulesMetadata(filePath) {
   }
 }
 function checkDirAccess(dir) {
-  const exists = existsSync2(dir);
+  const exists = existsSync3(dir);
   if (!exists) return { exists: false, writable: false };
   try {
     accessSync(dir, fsConstants.W_OK);
@@ -1387,13 +2048,13 @@ async function checkSqlite() {
 }
 function checkDataDirectory() {
   const rootPath = getNexusDataDir();
-  const rootExists = existsSync2(rootPath);
+  const rootExists = existsSync3(rootPath);
   const repoRoot = getNexusRepoDir();
   const perRepoSet = getPerRepoSubdirs();
   const subdirectories = DATA_SUBDIRECTORIES.map((name) => {
     const segments = name.split("/");
     const fullPath = nexusDataPath(...segments);
-    const exists = existsSync2(fullPath);
+    const exists = existsSync3(fullPath);
     const scope = perRepoSet.has(segments[0] ?? "") ? "per-repo" : "cross-repo";
     return { name, path: fullPath, scope, exists, writable: exists && isWritable(fullPath) };
   });
@@ -1448,13 +2109,10 @@ function collectEnvironmentChecks() {
 }
 function checkVoterTransport() {
   const gateway = readOpenAICompatEnv();
-  const { deprecated } = resolveGatewayEnv();
-  const deprecatedEnv = deprecated.length > 0 ? { deprecatedEnv: deprecated } : {};
-  if (gateway === null) return { configured: false, ...deprecatedEnv };
+  if (gateway === null) return { configured: false };
   return {
     configured: true,
-    cost: voterGatewayCostDeclaration(gateway.endpoint ?? readOpenAICompatEndpoint()),
-    ...deprecatedEnv
+    cost: voterGatewayCostDeclaration(gateway.endpoint ?? readOpenAICompatEndpoint())
   };
 }
 function voterGatewayCostDeclaration(endpoint) {
@@ -1463,7 +2121,7 @@ function voterGatewayCostDeclaration(endpoint) {
   return resolveGatewayCostDeclaration(`api:${endpoint}`) ?? "no-default";
 }
 function isAllHealthy(input) {
-  return input.gateway !== "fail" && input.nodeSupported && input.hasAuthMethod && input.mcpServerReady && !installFreshnessFailsVerdict(input.installFreshness) && scratchSeverityIsAcceptable(worstSeverity(input.scratchSpace)) && // whenEmpty: zero detected CLIs is not a healthy install (#4581) — unless
+  return input.gateway !== "fail" && input.nodeSupported && input.hasAuthMethod && input.mcpServerReady && input.configFile.error === void 0 && !installFreshnessFailsVerdict(input.installFreshness) && scratchSeverityIsAcceptable(worstSeverity(input.scratchSpace)) && // whenEmpty: zero detected CLIs is not a healthy install (#4581) — unless
   // a passing gateway serves the slots (#6609), as on a gateway-only host.
   allOf(
     input.clis,
@@ -1521,6 +2179,7 @@ async function runDoctor(deps = {}) {
     nodeSupported: nodeVersion.supported,
     hasAuthMethod: hasAnyAuthMethod(apiKeys, clis, gatewayVerdict(gateway)),
     mcpServerReady,
+    configFile,
     installFreshness: env.installFreshness,
     scratchSpace: env.scratchSpace,
     clis,
@@ -1556,7 +2215,7 @@ async function doctorCommand(options = {}) {
   options.onResult?.(result);
   printDoctorResults(result, void 0, options.deferSummary === true);
   if (options.gateway === true || options.probe === true) {
-    const { formatGatewayReport } = await import("./doctor-gateway-report-4TXHTWUM.js");
+    const { formatGatewayReport } = await import("./doctor-gateway-report-RJOSOHGA.js");
     for (const line of formatGatewayReport(result.gateway, result.clis)) {
       process.stdout.write(line + "\n");
     }
@@ -1575,13 +2234,13 @@ async function runDoctorFix(result) {
   writeLine2("\u2500".repeat(40));
   let fixCount = 0;
   if (!result.dataDirectory.rootExists || result.dataDirectory.subdirectories.some((d) => !d.exists || !d.writable)) {
-    const { initDataDirectories: initDataDirectories2, describeDataDirFix: describeDataDirFix2 } = await import("./setup-data-dir-B6URVYUD.js");
+    const { initDataDirectories: initDataDirectories2, describeDataDirFix: describeDataDirFix2 } = await import("./setup-data-dir-75Z5PSSB.js");
     const outcome = describeDataDirFix2(initDataDirectories2());
     writeLine2(outcome.line);
     if (outcome.counted) fixCount++;
   }
   if (!result.configFile.found) {
-    const { runConfigInitSync } = await import("./setup-config-KEPU4NTT.js");
+    const { runConfigInitSync } = await import("./setup-config-VGEBCEKX.js");
     const configResult = runConfigInitSync(process.cwd(), false, false);
     if (configResult.success && configResult.created) {
       writeLine2(`\u2713 Generated config: ${configResult.path}`);
@@ -1632,7 +2291,7 @@ function initDataDirectories(dryRun = false) {
   return { success: true, rootPath: NEXUS_DATA_DIR, created, alreadyExisted, error: null };
 }
 function ensureDir(dirPath, dryRun, created, alreadyExisted, mode) {
-  if (existsSync3(dirPath)) {
+  if (existsSync4(dirPath)) {
     alreadyExisted.push(dirPath);
     return;
   }
@@ -1661,6 +2320,21 @@ function describeDataDirFix(result) {
 }
 
 export {
+  LoggingConfigSchema,
+  ProviderConfigSchema,
+  ModelTiersSchema,
+  ModelConfigSchema,
+  WorkflowConfigSchema,
+  VALID_EXPERT_TIERS,
+  VALID_EXPERT_DOMAINS,
+  MAX_SYSTEM_PROMPT_LENGTH,
+  CustomExpertDefinitionSchema,
+  ExpertDefinitionSchema,
+  ExpertConfigSchema,
+  AppConfigSchema,
+  defaultConfig,
+  loadConfig,
+  getConfig,
   DEFAULT_TASK_TTL_MS,
   clampTaskTtl,
   getCliAdapterDiagnostics,
@@ -1680,4 +2354,4 @@ export {
   startStdioServer,
   closeServer
 };
-//# sourceMappingURL=chunk-OCKU3I4A.js.map
+//# sourceMappingURL=chunk-C6MM6Z65.js.map