Nexus Fast Responses

Technical summary

Native NEXUS plugin that unifies plugin commands, fixed replies and macros in the / autocomplete used in task comments. The /ia command combines threat intelligence, DNS/HTTP context and OpenCode analysis in an asynchronous worker, publishing a readable verdict and falling back to local analysis when the LLM does not return a useful answer.

Executed scope

• backend.php backend (1275 lines): priority resolution in fastr_execute — quick response → macro → /ia → plugin command; dispatch via PluginManager::dispatchApiAction with static_params, pass_task_id (injects task_id/id) and dynamic arg_key.
• fastr_ensure_schema() creates the fastr_quick_responses (command UNIQUE, response_text, created_by) and fastr_custom_commands (command UNIQUE, plugin_command, arg_value, description) tables — DDL from the plugin itself, no install.sql.
• fastr_load_plugin_commands() scans active plugins and reads each fastr.json at catalog/execution time (supports arg_required, arg_name, arg_key, pass_task_id, static_params, arg_suggest_action/arg_suggest_params for argument autocomplete).
• Human markdown formatting per plugin: fastr_format_result() with dedicated formatters (virustotal, safebrowsing, urlhaus, kaspersky-tip, opencnpj, docker-api) and a generic key/value fallback; support for ready fastr_md (slash catalogs) and · cache indicator.
• /ia command: fastr_parse_ia_request (validates the tool against the catalog and forbids /ia as a tool), fastr_run_tool, fastr_web_context (DNS via gethostbynamel, HTTP HEAD via cURL with 4s timeout, rDNS for IPs), fastr_call_opencode preferring local API 127.0.0.1:8081/v1/chat/opencode → satellites with recent pulse (≤2 days, node lock 60s/120s) → local CLI with short budget (3–20s via fastr_run_local_opencode_budget).
• Async worker fastr_ia_async.php (CLI, stdin JSON with task_id/value/pending_comment_id, @set_time_limit(120), restores the spawner session, comment_delete of the pending one and comment_add with the node persona or automatic verdict).
• 7 API actions via PluginManager::registerApiAction — fastr_catalog, fastr_quick_save, fastr_quick_delete, fastr_custom_save, fastr_custom_delete, fastr_execute, fastr_ia — mapped in the core api.php to the nexus-fast-responses plugin; all require an authenticated session or Bearer + CSRF.
• Alpine.js UI (tab.php 385 lines): "Respostas Rápidas" tab with counters in the header and three panes (Plugins / Respostas / Macros) with tables and CRUD; integration with assets/nexus-core.js (intercepts /, inline argument prompt, Ctrl+C cancels, fastr_execute call with per-task state) and assets/nexus-editor.js (autocomplete with Plugins/Respostas/Macros sections and window.nexusRefreshFastrCatalog).
• Own fastr.json manifest publishes /ia (arg_required, pass_task_id: true).

Stack and tooling

• PHP 8 (no framework)
• MySQL 8 (fastr_quick_responses and fastr_custom_commands tables)
• Alpine.js + Tailwind CSS
• cURL (context HTTP HEAD, OpenCode-compatible chat completions HTTP POST)
• OpenCode (local API 127.0.0.1:8081, oci_ai_endpoints/oci_nodes satellites and local CLI with short budget)
• NEXUS plugin system (PluginManager + nx_secure_exec_bg in the nx-exec.php core)

Operational tags

• Productivity
• Slash Commands
• Automation
• AI
• Threat Intelligence

Operational outcome

• Unified NEXUS one-off queries into a single / catalog: plugin commands, fixed responses and macros with autocomplete in the comment editor — without triggering the whole Intelligence Hub for a simple lookup.
• /ia turns IOC queries into readable AI verdicts, with background execution (CLI worker) that bypasses Cloudflare HTTP 524 and keeps the task chat up to date (pending comment → result with the node persona).
• Human formatting per plugin with verdict emoji (✅/🚨/⚠️/❔) and evidence of the answering node — no raw JSON in the chat.
• 24 plugins publish commands via fastr.json, and any new plugin can expose slash commands just by creating the manifest.
• Robust fallback: LLM reply discarded when stub/contingency, with an automatic local verdict generated from the real tool data + DNS/HTTP context.