nexus-ai-pro 2.3.0 → 2.4.0

package/dist/images/evals.js

@@ -1,4 +1,4 @@
-import { createHash } from 'node:crypto';
+import { Sha256, sha256Hex } from '../utils/sha256.js';
 import { linkSignals } from '../utils/signals.js';
 import { ImageValidationError } from './errors.js';
 export class MemoryReviewQueue {
@@ -325,14 +325,14 @@ function runScores(report) {
     ];
 }
 function mediaVersion(examples) {
-    const hash = createHash('sha256');
+    const hash = new Sha256();
     for (const example of examples) {
         hash.update(JSON.stringify({ id: example.id, inputs: example.inputs }, function (key, value) {
             const original = this[key];
-            return original instanceof Uint8Array ? `bytes:${createHash('sha256').update(original).digest('hex')}` : value;
+            return original instanceof Uint8Array ? `bytes:${sha256Hex(original)}` : value;
         }));
     }
-    return `v${hash.digest('hex').slice(0, 12)}`;
+    return `v${hash.digest().slice(0, 12)}`;
 }
 function uniqueIds(values) {
     const seen = new Map();

package/dist/insights/proposals.js

@@ -1,4 +1,3 @@
-import { randomUUID } from 'node:crypto';
 export class MemoryProposalStore {
     proposals = new Map();
     save(proposal) {
@@ -93,7 +92,7 @@ export async function proposeFix(options) {
             ? 'improved'
             : 'unchanged';
     const proposal = {
-        id: `fix-${randomUUID()}`,
+        id: `fix-${globalThis.crypto.randomUUID()}`,
         issueId: options.issue.id,
         issue: options.issue.summary,
         kind: subject.kind,

package/dist/insights/regressions.d.ts

@@ -33,7 +33,10 @@ export interface CompareRunsOptions {
     metrics?: readonly RegressionMetric[];
     /** Feedback keys whose mean score is compared, such as `helpfulness`. */
     feedback?: readonly string[];
-    /** Runs, or feedback scores, each side needs before it is judged. Defaults to 20. */
+    /**
+     * Runs each side needs before it is judged; for a feedback score, runs that have one. Defaults to
+     * 20. A run counts once per feedback key, however many times it was rated.
+     */
     minRuns?: number;
     /** A rise in p95 latency, relative, that counts. Defaults to 0.25, a quarter slower. */
     latencyIncrease?: number;
@@ -44,6 +47,22 @@ export interface CompareRunsOptions {
     minLatencyChangeMs?: number;
     /** A rise in mean cost, relative, that counts. Defaults to 0.25. */
     costIncrease?: number;
+    /**
+     * Judges every metric the way an evaluation comparison does, at this confidence, such as 0.95. Each
+     * metric is resampled by bootstrap, and it regresses only when two things hold: the change's
+     * interval does not reach zero, and the change is at least that metric's minimum effect. Noise and
+     * trivia both stay below the bar. Without it, the error rate uses a z-test at 95%, and latency and
+     * cost use their margins alone.
+     */
+    confidence?: number;
+    /** The smallest rise in the error rate, absolute, that counts under `confidence`. Defaults to 0.02. */
+    minErrorRateIncrease?: number;
+    /** The smallest fall in a feedback score's mean, absolute, that counts under `confidence`. Defaults to 0.05. */
+    minFeedbackDrop?: number;
+    /** Bootstrap resamples under `confidence`. Defaults to 1,000. */
+    resamples?: number;
+    /** Seeds the resampling, so the same runs always get the same verdict. Defaults to 1. */
+    seed?: number;
 }
 /** Options for `detectRegressions()`. */
 export interface DetectRegressionsOptions {
@@ -61,7 +80,10 @@ export interface DetectRegressionsOptions {
     metrics?: readonly RegressionMetric[];
     /** Feedback keys whose mean score is compared, such as `helpfulness`. */
     feedback?: readonly string[];
-    /** Runs, or feedback scores, each window needs before a group is judged. Defaults to 20. */
+    /**
+     * Runs each window needs before a group is judged; for a feedback score, runs that have one.
+     * Defaults to 20.
+     */
     minRuns?: number;
     /** A rise in p95 latency, relative, that counts. Defaults to 0.25, a quarter slower. */
     latencyIncrease?: number;
@@ -96,6 +118,8 @@ export interface Regression {
     };
     /** One readable line. */
     summary: string;
+    /** The change's interval, in the units of `change`, when the comparison was judged with `confidence`. */
+    interval?: [number, number];
 }
 /**
  * Compares a current window of traces with a baseline window and reports what got worse, per run

package/dist/insights/regressions.js

@@ -1,3 +1,12 @@
+function runScores(runs, key) {
+    return runs.flatMap((run) => {
+        const given = (run.feedback ?? [])
+            .filter((item) => item.key === key)
+            .map((item) => item.score)
+            .filter(isNumber);
+        return given.length ? [given.reduce((sum, score) => sum + score, 0) / given.length] : [];
+    });
+}
 export async function detectRegressions(options) {
     const read = async (window) => {
         const runs = await options.store.query({
@@ -27,6 +36,8 @@ export async function detectRegressions(options) {
     return regressions;
 }
 export function compareRuns(baseline, current, options = {}) {
+    if (options.confidence !== undefined)
+        return judgedRegressions(baseline, current, options, options.confidence);
     const name = options.group ?? 'runs';
     const minRuns = options.minRuns ?? 20;
     const metrics = new Set(options.metrics ?? ['error-rate', 'latency', 'cost']);
@@ -90,9 +101,7 @@ export function compareRuns(baseline, current, options = {}) {
         }
     }
     for (const feedbackKey of options.feedback ?? []) {
-        const scores = (runs) => runs
-            .flatMap((run) => (run.feedback ?? []).filter((item) => item.key === feedbackKey).map((item) => item.score))
-            .filter(isNumber);
+        const scores = (runs) => runScores(runs, feedbackKey);
         const before = scores(baseline);
         const after = scores(current);
         if (before.length < minRuns || after.length < minRuns)
@@ -114,6 +123,123 @@ export function compareRuns(baseline, current, options = {}) {
     }
     return regressions;
 }
+function judgedRegressions(baseline, current, options, confidence) {
+    if (!(confidence > 0 && confidence < 1))
+        throw new RangeError('confidence is between 0 and 1, such as 0.95');
+    const name = options.group ?? 'runs';
+    const minRuns = options.minRuns ?? 20;
+    const metrics = new Set(options.metrics ?? ['error-rate', 'latency', 'cost']);
+    const judge = (before, after, shape) => before.length >= minRuns && after.length >= minRuns
+        ? metricVerdict(before, after, {
+            ...shape,
+            confidence,
+            resamples: options.resamples ?? 1_000,
+            seed: options.seed ?? 1,
+        })
+        : undefined;
+    const regressions = [];
+    const add = (metric, verdict, counts, line) => {
+        if (!verdict?.regressed)
+            return;
+        regressions.push({
+            group: name,
+            metric,
+            baseline: verdict.baseline,
+            current: verdict.current,
+            change: verdict.change,
+            samples: counts,
+            interval: verdict.interval,
+            summary: `${name}: ${line} (${Math.round(confidence * 100)}% interval ${formatInterval(verdict.interval, metric)})`,
+        });
+    };
+    const counts = { baseline: baseline.length, current: current.length };
+    if (metrics.has('error-rate')) {
+        const errors = (runs) => runs.map((run) => (run.status === 'error' ? 1 : 0));
+        const verdict = judge(errors(baseline), errors(current), {
+            statistic: meanOf,
+            relative: false,
+            worse: 'rise',
+            minEffect: options.minErrorRateIncrease ?? 0.02,
+        });
+        add('error-rate', verdict, counts, `error rate rose from ${percent(verdict?.baseline ?? 0)} to ${percent(verdict?.current ?? 0)}`);
+    }
+    if (metrics.has('latency')) {
+        const latencies = (runs) => runs.map((run) => run.latencyMs).filter(isNumber);
+        const before = latencies(baseline);
+        const after = latencies(current);
+        const verdict = judge(before, after, {
+            statistic: (values) => percentile(values, 0.95) ?? 0,
+            relative: true,
+            worse: 'rise',
+            minEffect: options.latencyIncrease ?? 0.25,
+        });
+        const large = verdict && verdict.current - verdict.baseline >= (options.minLatencyChangeMs ?? 0);
+        add('latency-p95', large ? verdict : undefined, { baseline: before.length, current: after.length }, `p95 latency rose from ${Math.round(verdict?.baseline ?? 0)}ms to ${Math.round(verdict?.current ?? 0)}ms`);
+    }
+    if (metrics.has('cost')) {
+        const costs = (runs) => runs.map((run) => run.cost).filter(isNumber);
+        const before = costs(baseline);
+        const after = costs(current);
+        const verdict = judge(before, after, {
+            statistic: meanOf,
+            relative: true,
+            worse: 'rise',
+            minEffect: options.costIncrease ?? 0.25,
+        });
+        add('cost', verdict, { baseline: before.length, current: after.length }, `mean cost rose from $${(verdict?.baseline ?? 0).toFixed(4)} to $${(verdict?.current ?? 0).toFixed(4)}`);
+    }
+    for (const feedbackKey of options.feedback ?? []) {
+        const scores = (runs) => runScores(runs, feedbackKey);
+        const before = scores(baseline);
+        const after = scores(current);
+        const verdict = judge(before, after, {
+            statistic: meanOf,
+            relative: false,
+            worse: 'fall',
+            minEffect: options.minFeedbackDrop ?? 0.05,
+        });
+        add(`feedback:${feedbackKey}`, verdict, { baseline: before.length, current: after.length }, `${feedbackKey} fell from ${(verdict?.baseline ?? 0).toFixed(2)} to ${(verdict?.current ?? 0).toFixed(2)}`);
+    }
+    return regressions;
+}
+function metricVerdict(baseline, current, options) {
+    const change = (before, after) => options.relative ? (before === 0 ? 0 : after / before - 1) : after - before;
+    const before = options.statistic(baseline);
+    const after = options.statistic(current);
+    const random = seeded(options.seed);
+    const resample = (values) => Array.from({ length: values.length }, () => values[Math.floor(random() * values.length)]);
+    const draws = [];
+    for (let index = 0; index < options.resamples; index += 1) {
+        draws.push(change(options.statistic(resample(baseline)), options.statistic(resample(current))));
+    }
+    draws.sort((a, b) => a - b);
+    const tail = (1 - options.confidence) / 2;
+    const at = (quantile) => draws[Math.min(draws.length - 1, Math.max(0, Math.floor(quantile * draws.length)))];
+    const interval = [at(tail), at(1 - tail)];
+    const observed = change(before, after);
+    const regressed = options.worse === 'rise'
+        ? observed >= options.minEffect && interval[0] > 0
+        : -observed >= options.minEffect && interval[1] < 0;
+    return { baseline: before, current: after, change: observed, interval, regressed };
+}
+function seeded(seed) {
+    let state = seed >>> 0;
+    return () => {
+        state = (state + 0x6d2b79f5) >>> 0;
+        let value = state;
+        value = Math.imul(value ^ (value >>> 15), value | 1);
+        value ^= value + Math.imul(value ^ (value >>> 7), value | 61);
+        return ((value ^ (value >>> 14)) >>> 0) / 4294967296;
+    };
+}
+function meanOf(values) {
+    return mean(values) ?? 0;
+}
+function formatInterval(interval, metric) {
+    const relative = metric === 'latency-p95' || metric === 'cost';
+    const show = (value) => (relative ? `${value >= 0 ? '+' : ''}${Math.round(value * 100)}%` : value.toFixed(3));
+    return `${show(interval[0])} to ${show(interval[1])}`;
+}
 function isNumber(value) {
     return typeof value === 'number' && Number.isFinite(value);
 }

package/dist/loaders/git.js

@@ -32,6 +32,8 @@ export async function* loadGitRepository(repository, options = {}) {
         const files = (await git(['ls-files', '-z'], directory, options)).split('\0').filter(Boolean).sort();
         const extensions = options.extensions && new Set(options.extensions.map((extension) => extension.toLowerCase()));
         const maxFileBytes = options.maxFileBytes ?? 1_000_000;
+        const { lstat, realpath } = await import('node:fs/promises');
+        const checkout = await realpath(directory);
         for (const file of files) {
             const extension = path.extname(file).toLowerCase();
             if (extensions && !extensions.has(extension))
@@ -40,7 +42,12 @@ export async function* loadGitRepository(repository, options = {}) {
                 continue;
             let bytes;
             try {
-                bytes = new Uint8Array(await readFile(path.join(directory, file)));
+                const full = path.join(directory, file);
+                if ((await lstat(full)).isSymbolicLink())
+                    continue;
+                if (!(await realpath(full)).startsWith(checkout + path.sep))
+                    continue;
+                bytes = new Uint8Array(await readFile(full));
             }
             catch {
                 continue;

package/dist/loaders/web.js

@@ -1,5 +1,6 @@
 import { parseUrl, safeFetch } from '../utils/safe-fetch.js';
 import { htmlToText } from './html.js';
+const MAX_SITEMAP_BYTES = 50 * 1024 * 1024;
 export class WebLoaderError extends Error {
     url;
     status;
@@ -49,7 +50,12 @@ export async function sitemapUrls(url, options = {}) {
         let xml;
         if (bytes[0] === 0x1f && bytes[1] === 0x8b) {
             const { gunzipSync } = await import('node:zlib');
-            xml = gunzipSync(bytes).toString('utf8');
+            try {
+                xml = gunzipSync(bytes, { maxOutputLength: MAX_SITEMAP_BYTES }).toString('utf8');
+            }
+            catch (error) {
+                throw new WebLoaderError(`${sitemap} does not decompress to a sitemap of at most 50 MB: ${error instanceof Error ? error.message : String(error)}`, sitemap);
+            }
         }
         else
             xml = new TextDecoder().decode(bytes);

package/dist/mcp/client.d.ts

@@ -122,7 +122,21 @@ export interface StdioClientOptions {
     env?: Record<string, string>;
     /** Working directory for the process. */
     cwd?: string;
+    /**
+     * Which of this process's environment variables the server inherits, besides `env`. By default,
+     * only what a process needs to start: the path, the home and temporary directories, the user, the
+     * locale and terminal, the Windows system variables, proxies, and certificate settings. A server is
+     * often third-party code, and must not see this process's API keys or database URLs. A list adds
+     * the variables it names, `true` passes the whole environment, as releases before 2.4 did, and
+     * `false` passes nothing but `env`.
+     */
+    inheritEnv?: boolean | readonly string[];
 }
+/**
+ * The environment a server process starts with. Names compare without case, as Windows compares
+ * them, and `LC_` locale settings are kept with the rest of the locale.
+ */
+export declare function serverEnvironment(source: Record<string, string | undefined>, options?: Pick<StdioClientOptions, 'env' | 'inheritEnv'>): Record<string, string>;
 /**
  * Runs an MCP server as a child process and speaks to it over its stdin and stdout.
  *

package/dist/mcp/client.js

@@ -131,6 +131,64 @@ export class McpClient {
             this.settle(id, undefined, error);
     }
 }
+const INHERITED_ENV = new Set([
+    'PATH',
+    'PATHEXT',
+    'HOME',
+    'USER',
+    'USERNAME',
+    'LOGNAME',
+    'SHELL',
+    'TERM',
+    'LANG',
+    'LANGUAGE',
+    'TZ',
+    'TMPDIR',
+    'TEMP',
+    'TMP',
+    'XDG_CONFIG_HOME',
+    'XDG_CACHE_HOME',
+    'XDG_DATA_HOME',
+    'XDG_RUNTIME_DIR',
+    'SYSTEMROOT',
+    'SYSTEMDRIVE',
+    'WINDIR',
+    'COMSPEC',
+    'APPDATA',
+    'LOCALAPPDATA',
+    'USERPROFILE',
+    'HOMEDRIVE',
+    'HOMEPATH',
+    'PROGRAMDATA',
+    'PROGRAMFILES',
+    'PROGRAMFILES(X86)',
+    'COMMONPROGRAMFILES',
+    'PROCESSOR_ARCHITECTURE',
+    'NUMBER_OF_PROCESSORS',
+    'OS',
+    'HTTP_PROXY',
+    'HTTPS_PROXY',
+    'NO_PROXY',
+    'ALL_PROXY',
+    'NODE_EXTRA_CA_CERTS',
+    'SSL_CERT_FILE',
+    'SSL_CERT_DIR',
+]);
+export function serverEnvironment(source, options = {}) {
+    if (options.inheritEnv === false)
+        return { ...options.env };
+    const named = new Set((Array.isArray(options.inheritEnv) ? options.inheritEnv : []).map((name) => name.toUpperCase()));
+    const inherited = {};
+    for (const [name, value] of Object.entries(source)) {
+        if (value === undefined)
+            continue;
+        const upper = name.toUpperCase();
+        if (options.inheritEnv === true || INHERITED_ENV.has(upper) || upper.startsWith('LC_') || named.has(upper)) {
+            inherited[name] = value;
+        }
+    }
+    return { ...inherited, ...options.env };
+}
 export function createStdioTransport(options) {
     let child;
     const decoder = new LineDecoder();
@@ -141,7 +199,7 @@ export function createStdioTransport(options) {
             const { spawn } = await import('node:child_process');
             const spawned = spawn(options.command, options.args ?? [], {
                 cwd: options.cwd,
-                env: { ...process.env, ...options.env },
+                env: serverEnvironment(process.env, options),
                 stdio: ['pipe', 'pipe', 'inherit'],
             });
             spawned.stdout.setEncoding('utf8');

package/dist/mcp/registry.d.ts

@@ -15,6 +15,12 @@ export interface McpServerConfig {
     env?: Record<string, string>;
     /** Working directory for the process. */
     cwd?: string;
+    /**
+     * Which of this process's own environment variables a local server inherits, besides `env`. By
+     * default, only what a process needs to start, never an API key; a list adds variables by name,
+     * `true` passes the whole environment, and `false` nothing but `env`.
+     */
+    inheritEnv?: boolean | string[];
     /** The endpoint of a remote server, reached over HTTP. */
     url?: string;
     /** Headers sent to a remote server, such as authorization. */

package/dist/mcp/registry.js

@@ -59,6 +59,7 @@ export class McpRegistry {
                         ...(resolved.args ? { args: resolved.args } : {}),
                         ...(resolved.env ? { env: resolved.env } : {}),
                         ...(resolved.cwd ? { cwd: resolved.cwd } : {}),
+                        ...(resolved.inheritEnv !== undefined ? { inheritEnv: resolved.inheritEnv } : {}),
                     })
                     : createHttpTransport({
                         url: resolved.url,
@@ -163,6 +164,12 @@ export function validateMcpConfig(value) {
                 throw new McpRegistryError(`Server "${name}": "${field}" is a list of strings`, name);
             }
         }
+        const inherit = server.inheritEnv;
+        if (inherit !== undefined &&
+            typeof inherit !== 'boolean' &&
+            !(Array.isArray(inherit) && inherit.every((item) => typeof item === 'string'))) {
+            throw new McpRegistryError(`Server "${name}": "inheritEnv" is true, false, or a list of names`, name);
+        }
         for (const field of ['env', 'headers']) {
             const map = server[field];
             if (map !== undefined &&

package/dist/prompts/file.js

@@ -38,20 +38,24 @@ export class FilePromptStore {
     }
     async setLabel(label, expected) {
         const file = this.labelFile(label.name, label.label);
-        if (expected !== undefined) {
-            const current = await readJson(file);
-            if (expected === null ? current !== undefined : current?.version !== expected)
-                return false;
-        }
-        await writeJson(file, label);
-        return true;
+        return serialized(file, async () => {
+            if (expected !== undefined) {
+                const current = await readJson(file);
+                if (expected === null ? current !== undefined : current?.version !== expected)
+                    return false;
+            }
+            await writeJson(file, label);
+            return true;
+        });
     }
     async deleteLabel(name, label) {
         const file = this.labelFile(name, label);
-        if ((await readJson(file)) === undefined)
-            return false;
-        await rm(file, { force: true });
-        return true;
+        return serialized(file, async () => {
+            if ((await readJson(file)) === undefined)
+                return false;
+            await rm(file, { force: true });
+            return true;
+        });
     }
     async appendHistory(entry) {
         await mkdir(this.promptDir(entry.name), { recursive: true });
@@ -109,6 +113,19 @@ async function readJson(file) {
         return undefined;
     }
 }
+const labelWrites = new Map();
+async function serialized(file, work) {
+    const key = path.resolve(file);
+    const next = (labelWrites.get(key) ?? Promise.resolve()).catch(() => undefined).then(work);
+    labelWrites.set(key, next);
+    try {
+        return await next;
+    }
+    finally {
+        if (labelWrites.get(key) === next)
+            labelWrites.delete(key);
+    }
+}
 async function writeJson(file, value) {
     await mkdir(path.dirname(file), { recursive: true });
     const temporary = `${file}.${process.pid}.${Date.now()}.tmp`;