@nexusclawhq/cli 0.3.2 → 0.3.4

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/locales/en-US.d.ts

@@ -7401,8 +7401,12 @@ declare const _default: {
             independentIdentityBanner: string;
             assistantIdentityEditorHint: string;
             assistantPermissionNotice: string;
+            assistantDefenseNotice: string;
+            assistantRunAsInheritance: string;
             assistantAccessNotice: string;
             assistantAudienceNotice: string;
+            builderPermissionTitleAssistant: string;
+            builderDefenseBoundaryTitle: string;
             builderIdentityDesc: string;
             builderIdentityGap: string;
             builderIdentityInfo: string;
@@ -7520,6 +7524,8 @@ declare const _default: {
                 noProactiveTitle: string;
                 noContextMemoryTitle: string;
                 noContractDesc: string;
+                openBlueprintCta: string;
+                openBlueprintHint: string;
                 contractIdLabel: string;
                 contractRevisionLabel: string;
                 missionLabel: string;

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/locales/en-US.js

@@ -7408,9 +7408,13 @@ const messages = {
             assistantIdentityBanner: "This is an employee assistant: it runs under the authorizing user's account, role, and org node, and holds no permissions of its own. Fill in the service account and role below to convert it into an independent AI employee.",
             independentIdentityBanner: "This is an independent AI employee: it executes with its own service account (employee ID) and role, with its own account, permissions, and org-structure boundary.",
             assistantIdentityEditorHint: "Assistants do not need the account or role below. To let this employee operate under its own authority, set both the service account and a role — saving converts it into an independent AI employee.",
-            assistantPermissionNotice: "Assistants hold no permissions of their own: their data scope, public groups, permission sets, and runtime limits are all inherited from the authorizing user and cannot be configured here.",
-            assistantAccessNotice: "Assistants cannot work standalone: their run-as identity is inherited from the human who dispatches each task, with no independent service-account permission profile.",
-            assistantAudienceNotice: "Assistants have no standalone audience or org ownership: org node, audience orgs, and audience users are all inherited from the human who dispatches each task, and cannot be configured here.",
+            assistantPermissionNotice: "An assistant's public groups and permission sets are inherited from the authorizing user and cannot be configured here; but data scope, rate limits, and tool allow/deny lists are defense-in-depth narrowing controls that MUST be set to prevent data over-access.",
+            assistantDefenseNotice: "Defense-in-depth narrowing: the data scope, rate limits, and tool allow/deny lists below are intersected with the authorizing user's permissions — they only narrow, never widen. If the assistant's configured org subtree is outside the authorizing user's subtree, access is denied (fail-closed).",
+            assistantRunAsInheritance: "Run-as identity is inherited from the human who dispatches each task; the fields below are this assistant's defense-in-depth boundary.",
+            assistantAccessNotice: "Assistants cannot work standalone: their run-as identity is inherited from the dispatching human, but the defense-in-depth boundary below (scope/rate/tools) is still enforced.",
+            assistantAudienceNotice: "Assistants have no standalone audience: who can invoke this assistant is determined by its mount point (chat, flow node), inherited from the dispatching human, and cannot be configured here.",
+            builderPermissionTitleAssistant: "Defense-in-depth data scope and runtime boundary",
+            builderDefenseBoundaryTitle: "Defense-in-depth boundary (intersected with authorizing user)",
             builderIdentityDesc: "Determines whose identity the AI employee executes as, and what authority and org boundaries it has.",
             builderIdentityGap: "Missing employee ID or role",
             builderIdentityInfo: "Identity information",
@@ -7527,7 +7531,9 @@ const messages = {
                 noContractTitle: "No success contract",
                 noProactiveTitle: "No proactive policy",
                 noContextMemoryTitle: "No context & memory policy",
-                noContractDesc: "The current candidate has no cognitive policy; initialize it via the goal-to-agent blueprint generator or the backend API before editing.",
+                noContractDesc: "The current candidate has no cognitive policy. Go to AI Workforce → Learning Plan, generate a goal-to-agent blueprint and materialize it into a candidate, or initialize via the backend API before editing.",
+                openBlueprintCta: "Generate blueprint",
+                openBlueprintHint: "Opens the Learning Plan page — click '+ Generate goal-to-agent blueprint' at the bottom of the first column",
                 contractIdLabel: "Contract ID",
                 contractRevisionLabel: "Contract revision",
                 missionLabel: "Mission",