nexus-agents 11.5.2 → 11.5.4

package/dist/{chunk-CI3FOOUF.js → chunk-TH3MSFDF.js}

@@ -2,7 +2,7 @@ import {
   FINDING_SEVERITY_LEVELS,
   SARIF_LEVEL_MAP,
   SEVERITY_ORDER
-} from "./chunk-BDP422B2.js";
+} from "./chunk-Z2AAMUNG.js";
 import {
   executeExpert
 } from "./chunk-XBXLA6DJ.js";
@@ -58,7 +58,7 @@ import {
   updateStage,
   withFileLock,
   writeJobCancelled
-} from "./chunk-ZMFKWTMT.js";
+} from "./chunk-6V25ZIPU.js";
 import {
   normalizeTopicToCanonical,
   synthesizeResearch
@@ -77,7 +77,7 @@ import {
 } from "./chunk-773AZVR3.js";
 import {
   withPrerequisite
-} from "./chunk-ZX5262PS.js";
+} from "./chunk-NKITVLTK.js";
 import {
   NOOP_NOTIFIER,
   RateLimiter,
@@ -105,7 +105,7 @@ import {
   toolSuccess,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-S3RKQGKV.js";
+} from "./chunk-IQYJPOMW.js";
 import {
   generateSecurityPlan
 } from "./chunk-6ZTMMN2N.js";
@@ -187,7 +187,7 @@ import {
 import {
   DEFAULT_TASK_TTL_MS,
   clampTaskTtl
-} from "./chunk-TEI6W4ED.js";
+} from "./chunk-HH4FMRXL.js";
 import {
   allOf,
   anyOf
@@ -196,7 +196,7 @@ import {
   VERSION,
   createRequestContext,
   measuredTrustTier
-} from "./chunk-7B4FUABZ.js";
+} from "./chunk-O76YJOEG.js";
 import {
   BWRAP_READ_ONLY_ARGS,
   CliDetectionCache,
@@ -26919,10 +26919,10 @@ function calculateDifferenceCI(p1, p2, total1, total2, confidence) {
   const difference = p1 - p2;
   const measured = total1 > 0 && total2 > 0;
   const seDiff = Math.sqrt(p1 * (1 - p1) / (total1 || 1) + p2 * (1 - p2) / (total2 || 1));
-  const z117 = getZScore(confidence);
+  const z118 = getZScore(confidence);
   return {
-    lower: difference - z117 * seDiff,
-    upper: difference + z117 * seDiff,
+    lower: difference - z118 * seDiff,
+    upper: difference + z118 * seDiff,
     estimate: difference,
     confidence,
     n: total1 + total2,
@@ -26950,11 +26950,11 @@ function proportionConfidenceInterval(successes, total, options = {}) {
       measured: false
     };
   }
-  const z117 = getZScore(opts.confidence);
-  const z210 = z117 * z117;
+  const z118 = getZScore(opts.confidence);
+  const z210 = z118 * z118;
   const denominator = 1 + z210 / n;
   const center = (p + z210 / (2 * n)) / denominator;
-  const margin = z117 / denominator * Math.sqrt(p * (1 - p) / n + z210 / (4 * n * n));
+  const margin = z118 / denominator * Math.sqrt(p * (1 - p) / n + z210 / (4 * n * n));
   const lower = Math.max(0, center - margin);
   const upper = Math.min(1, center + margin);
   const standardError = Math.sqrt(p * (1 - p) / n);
@@ -26992,8 +26992,8 @@ function meanConfidenceInterval(values, options = {}) {
   const variance = values.reduce((sum, v) => sum + (v - mean) ** 2, 0) / (n - 1 || 1);
   const stdDev = Math.sqrt(variance);
   const standardError = stdDev / Math.sqrt(n);
-  const z117 = getZScore(opts.confidence);
-  const margin = z117 * standardError;
+  const z118 = getZScore(opts.confidence);
+  const margin = z118 * standardError;
   return {
     lower: mean - margin,
     upper: mean + margin,
@@ -46682,7 +46682,7 @@ function buildVotingInput(plan, config) {
 }
 async function executeSingleVote(plan, config, log) {
   try {
-    const { executeVoting } = await import("./consensus-vote-OAYLGVUE.js");
+    const { executeVoting } = await import("./consensus-vote-KQTXJS5E.js");
     const input = buildVotingInput(plan, config);
     const result = await executeVoting(input, log);
     return parseVotingResult(result);
@@ -48577,7 +48577,7 @@ function createVoteStage({ config, startStage }) {
     const strategy = config.votingStrategy ?? "higher_order";
     await postProgress(config, "Vote", `Running consensus with ${strategy} strategy...`);
     try {
-      const { executeVoting } = await import("./consensus-vote-OAYLGVUE.js");
+      const { executeVoting } = await import("./consensus-vote-KQTXJS5E.js");
       const proposal = buildVoteProposal(plan, research);
       const votingResult = await executeVoting(
         {
@@ -48678,67 +48678,136 @@ Verdict: PASS/NEEDS_WORK/REJECT`;
 }
 
 // src/mcp/tools/security-scan.ts
-import { z as z93 } from "zod";
+import { z as z94 } from "zod";
 
 // src/security/sarif-parser.ts
+import { z as z93 } from "zod";
+
+// src/security/sarif-diagnostics.ts
 import { z as z92 } from "zod";
-var SarifLocationSchema = z92.object({
-  physicalLocation: z92.object({
-    artifactLocation: z92.object({ uri: z92.string().optional().catch(void 0) }).optional(),
-    region: z92.object({
-      startLine: z92.number().optional().catch(void 0),
-      endLine: z92.number().int().min(1).optional().catch(void 0),
-      snippet: z92.object({
-        text: z92.string().optional().catch(void 0),
+var SarifNotificationSchema = z92.object({
+  descriptor: z92.object({ id: z92.string().optional() }).optional(),
+  level: z92.string().optional(),
+  message: z92.object({ text: z92.string().optional() }).optional()
+});
+var CONTROL_CHARACTERS = /[\u0000-\u001f\u007f-\u009f\u2028\u2029]+/g;
+function hasControlCharacter(text) {
+  return text.replace(CONTROL_CHARACTERS, "") !== text;
+}
+function stripControlCharacters(text) {
+  return text.replace(CONTROL_CHARACTERS, " ");
+}
+function checkConfigurationNotifications(notifications, errors) {
+  for (const notification of notifications ?? []) {
+    if (notification.level !== "note" && notification.level !== "none")
+      errors.push(
+        `Scanner configuration: ${notification.message?.text ?? "unknown configuration error"}`
+      );
+  }
+}
+function diagnosticFields(parseDiagnostics, scannerDiagnostics) {
+  return {
+    ...parseDiagnostics.length > 0 ? { parseDiagnostics } : {},
+    ...scannerDiagnostics.length > 0 ? { scannerDiagnostics } : {}
+  };
+}
+function checkNotifications(notifications, errors, parseDiagnostics, scannerDiagnostics, scanner) {
+  for (const notification of notifications ?? []) {
+    const diagnostic = parseNotification(notification);
+    const scannerDiagnostic = parseScannerNotification(notification, scanner);
+    if (diagnostic !== void 0) parseDiagnostics.push(diagnostic);
+    else if (scannerDiagnostic !== void 0) scannerDiagnostics.push(scannerDiagnostic);
+    else if (notification.level !== "note" && notification.level !== "none")
+      errors.push(`Scanner notification: ${notification.message?.text ?? "unknown scanner error"}`);
+  }
+}
+function parseScannerNotification(notification, scanner) {
+  const kind = fileErrorKind(notification.descriptor?.id, scanner);
+  const message = notification.message?.text;
+  if (kind === void 0 || message === void 0) return void 0;
+  const location = fileErrorLocation(message, kind);
+  return location === void 0 ? void 0 : { ...location, kind, scanner, message };
+}
+function fileErrorLocation(message, kind) {
+  const header = /^(Internal matching error|Timeout) (?:when running (\S+) on ([^\n]+)|at line ([^\n]+):\d+):\n/.exec(
+    message
+  );
+  if (header?.[1] !== kind) return void 0;
+  const file = header[3] ?? header[4];
+  const rule = header[2];
+  if (file === void 0 || hasControlCharacter(file) || kind === "Internal matching error" && rule === void 0)
+    return void 0;
+  return { file, ...rule === void 0 ? {} : { rule } };
+}
+function fileErrorKind(kind, scanner) {
+  if (!["semgrep", "semgrep oss"].includes(scanner.toLowerCase())) return void 0;
+  if (kind !== "Internal matching error" && kind !== "Timeout") return void 0;
+  return kind;
+}
+function parseNotification(notification) {
+  if (!/^(?:Syntax error|Other syntax error)$/.test(notification.descriptor?.id ?? ""))
+    return void 0;
+  const message = notification.message?.text;
+  if (message === void 0) return void 0;
+  const file = /^(?:Syntax error|Other syntax error) at line (.+):(\d+):(?:\n|$| )/.exec(
+    message
+  )?.[1];
+  return file === void 0 || hasControlCharacter(file) ? void 0 : { file, kind: "parse", message };
+}
+
+// src/security/sarif-parser.ts
+var SarifLocationSchema = z93.object({
+  physicalLocation: z93.object({
+    artifactLocation: z93.object({ uri: z93.string().optional().catch(void 0) }).optional(),
+    region: z93.object({
+      startLine: z93.number().optional().catch(void 0),
+      endLine: z93.number().int().min(1).optional().catch(void 0),
+      snippet: z93.object({
+        text: z93.string().optional().catch(void 0),
         // Unknown truncation metadata cannot establish a complete snippet.
-        truncated: z92.boolean().optional().catch(true)
+        truncated: z93.boolean().optional().catch(true)
       }).optional().catch(void 0)
     }).optional()
   }).optional()
 });
-var SarifResultSchema = z92.object({
-  ruleId: z92.string().nullish(),
-  level: z92.string().nullish(),
-  message: z92.object({ text: z92.string().optional() }).nullish(),
-  locations: z92.array(SarifLocationSchema).nullish()
+var SarifResultSchema = z93.object({
+  ruleId: z93.string().nullish(),
+  level: z93.string().nullish(),
+  message: z93.object({ text: z93.string().optional() }).nullish(),
+  locations: z93.array(SarifLocationSchema).nullish()
 });
-var SarifRuleSchema = z92.object({
-  id: z92.string(),
-  shortDescription: z92.object({ text: z92.string().optional().catch(void 0) }).optional(),
-  defaultConfiguration: z92.object({ level: z92.string().optional().catch(void 0) }).optional(),
-  properties: z92.object({
-    precision: z92.string().optional().catch(void 0),
-    tags: z92.array(z92.string()).optional().catch(void 0),
+var SarifRuleSchema = z93.object({
+  id: z93.string(),
+  shortDescription: z93.object({ text: z93.string().optional().catch(void 0) }).optional(),
+  defaultConfiguration: z93.object({ level: z93.string().optional().catch(void 0) }).optional(),
+  properties: z93.object({
+    precision: z93.string().optional().catch(void 0),
+    tags: z93.array(z93.string()).optional().catch(void 0),
     // Accept the number form and normalize; `resolveSeverityFromScore`
     // parses it either way.
-    "security-severity": z92.union([z92.string(), z92.number()]).optional().catch(void 0)
+    "security-severity": z93.union([z93.string(), z93.number()]).optional().catch(void 0)
   }).optional().catch(void 0),
-  helpUri: z92.string().optional().catch(void 0),
-  help: z92.object({ markdown: z92.string().optional().catch(void 0) }).optional()
+  helpUri: z93.string().optional().catch(void 0),
+  help: z93.object({ markdown: z93.string().optional().catch(void 0) }).optional()
 });
-var SarifRunSchema = z92.object({
-  tool: z92.object({
-    driver: z92.object({
-      name: z92.string().optional(),
-      rules: z92.array(z92.unknown()).optional()
+var SarifRunSchema = z93.object({
+  tool: z93.object({
+    driver: z93.object({
+      name: z93.string().optional(),
+      rules: z93.array(z93.unknown()).optional()
     }).optional()
   }).optional(),
-  results: z92.array(z92.unknown()).nullish(),
-  invocations: z92.array(z92.unknown()).optional()
-});
-var SarifNotificationSchema = z92.object({
-  descriptor: z92.object({ id: z92.string().optional() }).optional(),
-  level: z92.string().optional(),
-  message: z92.object({ text: z92.string().optional() }).optional()
+  results: z93.array(z93.unknown()).nullish(),
+  invocations: z93.array(z93.unknown()).optional()
 });
-var SarifInvocationSchema = z92.object({
-  executionSuccessful: z92.boolean().optional(),
-  toolExecutionNotifications: z92.array(SarifNotificationSchema).optional(),
-  toolConfigurationNotifications: z92.array(SarifNotificationSchema).optional()
+var SarifInvocationSchema = z93.object({
+  executionSuccessful: z93.boolean().optional(),
+  toolExecutionNotifications: z93.array(SarifNotificationSchema).optional(),
+  toolConfigurationNotifications: z93.array(SarifNotificationSchema).optional()
 });
-var SarifLogSchema = z92.object({
-  version: z92.string().optional(),
-  runs: z92.array(z92.unknown()).optional()
+var SarifLogSchema = z93.object({
+  version: z93.string().optional(),
+  runs: z93.array(z93.unknown()).optional()
 });
 var UNMAPPED_LEVEL_SEVERITY = "high";
 var MAX_MESSAGE_LENGTH = 2e3;
@@ -48787,6 +48856,7 @@ function parseLog(log, maxFindings, errors) {
   if (runs === void 0 || runs.length === 0) return emptyResult("No runs in SARIF");
   let scanner = "unknown";
   const parseDiagnostics = [];
+  const scannerDiagnostics = [];
   const findings = [];
   for (const [index, raw] of runs.entries()) {
     const parsedRun = SarifRunSchema.safeParse(raw);
@@ -48797,7 +48867,13 @@ function parseLog(log, maxFindings, errors) {
     const driver = describeDriver(parsedRun.data);
     checkRunCoverage(parsedRun.data, errors);
     if (index === 0) scanner = driver.scanner;
-    checkInvocations(parsedRun.data.invocations ?? [], errors, parseDiagnostics);
+    checkInvocations(
+      parsedRun.data.invocations ?? [],
+      errors,
+      parseDiagnostics,
+      scannerDiagnostics,
+      driver.scanner
+    );
     const ruleMap = buildRuleMap(driver.rules, errors);
     findings.push(
       ...collectFindings(parsedRun.data.results ?? [], driver.scanner, ruleMap, errors)
@@ -48815,7 +48891,7 @@ function parseLog(log, maxFindings, errors) {
     findings: findings.slice(0, maxFindings),
     errors,
     coverageComplete: errors.length === 0,
-    ...parseDiagnostics.length > 0 ? { parseDiagnostics } : {}
+    ...diagnosticFields(parseDiagnostics, scannerDiagnostics)
   };
 }
 function checkRunCoverage(run, errors) {
@@ -48826,7 +48902,7 @@ function checkRunCoverage(run, errors) {
     errors.push("SARIF run missing measured results");
   }
 }
-function checkInvocations(invocations, errors, parseDiagnostics) {
+function checkInvocations(invocations, errors, parseDiagnostics, scannerDiagnostics, scanner) {
   for (const raw of invocations) {
     const parsed = SarifInvocationSchema.safeParse(raw);
     if (!parsed.success) {
@@ -48834,31 +48910,16 @@ function checkInvocations(invocations, errors, parseDiagnostics) {
       continue;
     }
     if (parsed.data.executionSuccessful === false) errors.push("Scanner invocation failed");
-    const notifications = [
-      ...parsed.data.toolExecutionNotifications ?? [],
-      ...parsed.data.toolConfigurationNotifications ?? []
-    ];
-    checkNotifications(notifications, errors, parseDiagnostics);
-  }
-}
-function checkNotifications(notifications, errors, parseDiagnostics) {
-  for (const notification of notifications ?? []) {
-    const diagnostic = parseNotification(notification);
-    if (diagnostic !== void 0) parseDiagnostics.push(diagnostic);
-    else if (notification.level !== "note" && notification.level !== "none")
-      errors.push(`Scanner notification: ${notification.message?.text ?? "unknown scanner error"}`);
+    checkNotifications(
+      parsed.data.toolExecutionNotifications,
+      errors,
+      parseDiagnostics,
+      scannerDiagnostics,
+      parsed.data.executionSuccessful === true ? scanner : "unknown"
+    );
+    checkConfigurationNotifications(parsed.data.toolConfigurationNotifications, errors);
   }
 }
-function parseNotification(notification) {
-  if (!/^(?:Syntax error|Other syntax error)$/.test(notification.descriptor?.id ?? ""))
-    return void 0;
-  const message = notification.message?.text;
-  if (message === void 0) return void 0;
-  const file = /^(?:Syntax error|Other syntax error) at line (.+):(\d+):(?:\n|$| )/.exec(
-    message
-  )?.[1];
-  return file === void 0 ? void 0 : { file, kind: "parse", message };
-}
 function collectFindings(results, scanner, ruleMap, errors) {
   const findings = [];
   for (const [index, raw] of results.entries()) {
@@ -49191,10 +49252,10 @@ async function executeSecurityScan(input, options = {}) {
     );
   }
 }
-var InvocationSuccessSchema = z93.object({
-  runs: z93.array(
-    z93.object({
-      invocations: z93.array(z93.object({ executionSuccessful: z93.literal(true) })).min(1)
+var InvocationSuccessSchema = z94.object({
+  runs: z94.array(
+    z94.object({
+      invocations: z94.array(z94.object({ executionSuccessful: z94.literal(true) })).min(1)
     })
   ).min(1)
 });
@@ -49212,11 +49273,14 @@ function scannerInvocationsSuccessful(output2) {
     return false;
   }
 }
+function hasFileDiagnostics(result) {
+  return (result.parseDiagnostics?.length ?? 0) + (result.scannerDiagnostics?.length ?? 0) > 0;
+}
 function handleScanFailure(error, version, maxFindings) {
   const output2 = failureOutput(error);
   const result = output2 === void 0 ? void 0 : parseSarif(output2, maxFindings);
   if (result !== void 0 && output2 !== void 0 && failureCode(error) === 3) {
-    if (result.coverageComplete === true && (result.parseDiagnostics?.length ?? 0) > 0 && scannerInvocationsSuccessful(output2)) {
+    if (result.coverageComplete === true && hasFileDiagnostics(result) && scannerInvocationsSuccessful(output2)) {
       return { ...result, scannerVersion: version };
     }
   }
@@ -49226,7 +49290,9 @@ function handleScanFailure(error, version, maxFindings) {
 }
 function failedOutputDetails(result) {
   if (result === void 0) return "";
-  const files = result.parseDiagnostics?.map((diagnostic) => diagnostic.file) ?? [];
+  const files = [...result.parseDiagnostics ?? [], ...result.scannerDiagnostics ?? []].map(
+    (diagnostic) => diagnostic.file
+  );
   const diagnostics = files.length > 0 ? `; affected files: ${[...new Set(files)].join(", ")}` : "";
   const errors = result.errors.length > 0 ? `; ${result.errors.join("; ")}` : "";
   return diagnostics + errors;
@@ -49257,21 +49323,21 @@ function isScannerNoise(line) {
 // src/pipeline/dependency-gate.ts
 import { join as join15, resolve as resolve9 } from "node:path";
 import { existsSync as existsSync11, lstatSync as lstatSync2, readFileSync as readFileSync9 } from "node:fs";
-import { z as z95 } from "zod";
+import { z as z96 } from "zod";
 
 // src/security/osv-lookup.ts
-import { z as z94 } from "zod";
+import { z as z95 } from "zod";
 var logger48 = createLogger({ component: "osv-lookup" });
 var OSV_API_URL = "https://api.osv.dev/v1/query";
 var DEFAULT_TIMEOUT_MS4 = NETWORK_FETCH_TIMEOUT_MS;
-var OsvVulnerabilitySchema = z94.object({
-  id: z94.string(),
-  summary: z94.string().optional(),
-  severity: z94.enum(["CRITICAL", "HIGH", "MODERATE", "LOW", "UNKNOWN"]).optional(),
-  aliases: z94.array(z94.string()).default([]),
-  affectedVersions: z94.string().optional(),
-  fixedVersion: z94.string().optional(),
-  url: z94.string().optional()
+var OsvVulnerabilitySchema = z95.object({
+  id: z95.string(),
+  summary: z95.string().optional(),
+  severity: z95.enum(["CRITICAL", "HIGH", "MODERATE", "LOW", "UNKNOWN"]).optional(),
+  aliases: z95.array(z95.string()).default([]),
+  affectedVersions: z95.string().optional(),
+  fixedVersion: z95.string().optional(),
+  url: z95.string().optional()
 });
 var DEFAULT_OSV_CONFIG = {
   timeoutMs: DEFAULT_TIMEOUT_MS4
@@ -49365,7 +49431,7 @@ async function queryOsvBatch(packages, config = DEFAULT_OSV_CONFIG, signal) {
 
 // src/pipeline/dependency-gate.ts
 var logger49 = createLogger({ component: "dependency-gate" });
-var MANIFEST_SCHEMA = z95.object({ dependencies: z95.record(z95.string(), z95.string()).optional() });
+var MANIFEST_SCHEMA = z96.object({ dependencies: z96.record(z96.string(), z96.string()).optional() });
 var OSV_EMPTY = {
   vulnerabilities: [],
   failedLookups: 0,
@@ -49488,13 +49554,14 @@ function mergeOsvChecks(previous, next) {
 }
 
 // src/pipeline/security-baseline.ts
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 import { mkdtemp, rm, readFile as readFile7, readlink } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
 import { isAbsolute as isAbsolute8, join as join17 } from "node:path";
 
 // src/pipeline/security-baseline-coverage.ts
-import { readFile as readFile6 } from "node:fs/promises";
+import { createHash as createHash4 } from "node:crypto";
+import { readFile as readFile6, realpath as realpath3, lstat } from "node:fs/promises";
 import { isAbsolute as isAbsolute7, join as join16, relative as relative6 } from "node:path";
 function scanErrors(scan, side) {
   if ("error" in scan) return [`${side}: ${scan.error}`];
@@ -49515,6 +49582,11 @@ function normalizedScan(scan, directory) {
   if ("error" in scan) return scan;
   return {
     ...scan,
+    scannerDiagnostics: (scan.scannerDiagnostics ?? []).map((diagnostic) => ({
+      ...diagnostic,
+      file: isAbsolute7(diagnostic.file) ? relative6(directory, diagnostic.file) : diagnostic.file.replace(/^\.\//, ""),
+      message: diagnostic.message.split(join16(directory, "/")).join("")
+    })),
     parseDiagnostics: (scan.parseDiagnostics ?? []).map((diagnostic) => ({
       ...diagnostic,
       file: isAbsolute7(diagnostic.file) ? relative6(directory, diagnostic.file) : diagnostic.file.replace(/^\.\//, ""),
@@ -49530,42 +49602,82 @@ function ambiguousSnippet(finding) {
   return finding.snippet === void 0 || finding.snippet.trim() === "" || finding.snippetTruncated === true;
 }
 async function compareParseCoverage(input) {
-  const base = input.base.parseDiagnostics ?? [];
-  const worktree = input.worktree.parseDiagnostics ?? [];
+  const base = coverageDiagnostics(input.base);
+  const worktree = coverageDiagnostics(input.worktree);
   const files = [...new Set([...base, ...worktree].map((diagnostic) => diagnostic.file))].sort();
   const errors = [];
   const unscannedCoverage = [];
+  if (files.length === 0) return { errors, unscannedCoverage };
   for (const file of files) {
     if (outsideTree(file)) {
-      errors.push(`Parse diagnostic path outside scanned tree: ${file}`);
+      errors.push(`Coverage diagnostic path outside scanned tree: ${JSON.stringify(file)}`);
       continue;
     }
-    const identities = (diagnostics) => JSON.stringify(
-      diagnostics.filter((d) => d.file === file).map(({ kind, message }) => JSON.stringify([kind, message])).sort()
-    );
-    if (identities(base) !== identities(worktree)) {
-      errors.push(`New or changed parse diagnostics: ${file}`);
+    if (diagnosticIdentities(base, file) !== diagnosticIdentities(worktree, file)) {
+      errors.push(`New or changed coverage diagnostics: ${file}`);
       continue;
     }
     try {
-      const [oldBytes, newBytes, diff] = await Promise.all([
-        readFile6(join16(input.baseDirectory, file)),
-        readFile6(join16(input.target, file)),
-        input.diff(file)
-      ]);
-      if (!oldBytes.equals(newBytes) || diff !== "") {
-        errors.push(`Change touches partially parsed file: ${file}`);
-      } else unscannedCoverage.push(file);
+      if (!await unchangedFile(input, file)) {
+        errors.push(`Change touches unscanned file: ${file}`);
+      } else {
+        unscannedCoverage.push(describeUnscanned(file, worktree));
+      }
     } catch (error) {
       errors.push(
-        `Cannot verify partially parsed file ${file}: ${error instanceof Error ? error.message : String(error)}`
+        `Cannot verify unscanned file ${file}: ${error instanceof Error ? error.message : String(error)}`
       );
     }
   }
   return { errors, unscannedCoverage };
 }
+function coverageDiagnostics(scan) {
+  return [...scan.parseDiagnostics ?? [], ...scan.scannerDiagnostics ?? []];
+}
+function diagnosticIdentities(diagnostics, file) {
+  return JSON.stringify(
+    diagnostics.filter((d) => d.file === file).map(
+      (d) => JSON.stringify("scanner" in d ? [d.scanner, d.kind, d.rule] : [d.kind, d.message])
+    ).sort()
+  );
+}
+function describeUnscanned(file, diagnostics) {
+  const failures = diagnostics.filter((d) => d.file === file && "scanner" in d);
+  if (failures.length === 0) return file;
+  return `${file}: ${failures.map(
+    (d) => "scanner" in d ? `${d.scanner} ${d.rule ?? "(no rule)"} (${d.kind}): ${d.message}` : ""
+  ).join("; ")}`;
+}
+async function unchangedFile(input, file) {
+  const [oldPath, newPath, entry, diff] = await Promise.all([
+    confinedFile(input.baseDirectory, file),
+    confinedFile(input.target, file),
+    input.pinnedEntry(file),
+    input.diff(file)
+  ]);
+  const match = /^(100644|100755) blob ([a-f0-9]{40}|[a-f0-9]{64})\t([^\0]+)\0$/.exec(entry);
+  if (match?.[3] !== file || diff !== "") return false;
+  const [oldBytes, newBytes, oldStat, newStat] = await Promise.all([
+    readFile6(oldPath),
+    readFile6(newPath),
+    lstat(oldPath),
+    lstat(newPath)
+  ]);
+  const mode = (stat5) => (stat5.mode & 73) === 0 ? "100644" : "100755";
+  const hash = match[2];
+  if (hash === void 0 || !oldStat.isFile() || !newStat.isFile()) return false;
+  const digest = (bytes2) => createHash4(hash.length === 64 ? "sha256" : "sha1").update(`blob ${String(bytes2.length)}\0`).update(bytes2).digest("hex");
+  return mode(oldStat) === match[1] && mode(newStat) === match[1] && digest(oldBytes) === hash && digest(newBytes) === hash;
+}
+async function confinedFile(root, file) {
+  const path9 = join16(root, file);
+  const [canonicalRoot, canonicalPath] = await Promise.all([realpath3(root), realpath3(path9)]);
+  if (relative6(canonicalRoot, canonicalPath) !== file || !(await lstat(path9)).isFile())
+    throw new Error(`Unverifiable file path: ${file}`);
+  return path9;
+}
 function outsideTree(file) {
-  return isAbsolute7(file) || file.split("/").includes("..") || /^[a-z]+:/i.test(file);
+  return file === "" || hasControlCharacter(file) || file.includes("\\") || isAbsolute7(file) || file.split("/").includes("..") || /^[a-z]+:/i.test(file);
 }
 
 // src/pipeline/security-baseline.ts
@@ -49689,6 +49801,7 @@ async function assessComparison(input) {
     worktree,
     baseDirectory: input.baseDirectory,
     target,
+    pinnedEntry: async (file) => git2(target, ["ls-tree", "-z", sha, "--", file]),
     diff: async (file) => git2(target, [
       "diff",
       "--text",
@@ -49722,7 +49835,7 @@ async function verifyArchive(directory, tree) {
   for (const entry of tree.split("\0").filter((record) => record !== "")) {
     const { mode, hash, file } = parseTreeEntry(entry);
     const contents = mode === "120000" ? Buffer.from(await readlink(join17(directory, file))) : await readFile7(join17(directory, file));
-    const digest = createHash4(hash.length === 64 ? "sha256" : "sha1").update(`blob ${String(contents.length)}\0`).update(contents).digest("hex");
+    const digest = createHash5(hash.length === 64 ? "sha256" : "sha1").update(`blob ${String(contents.length)}\0`).update(contents).digest("hex");
     if (digest !== hash) throw new Error(`Pinned archive content differs: ${file}`);
   }
 }
@@ -49852,11 +49965,12 @@ function checkSecurityScan(targetDir, rulesets = ["p/default"], config = {}) {
       signal
     );
     if (gateResult.verdict === "fail") return gateResult;
-    if (result.parseDiagnostics !== void 0 && result.parseDiagnostics.length > 0) {
+    const gaps = [...result.parseDiagnostics ?? [], ...result.scannerDiagnostics ?? []];
+    if (gaps.length > 0) {
       return {
         ...gateResult,
         verdict: "skip",
-        details: `Security scan incomplete: unparsed files ${result.parseDiagnostics.map((d) => d.file).join(", ")}`,
+        details: `Security scan incomplete: unscanned files ${gaps.map((d) => d.file).join(", ")}`,
         durationMs: Date.now() - start
       };
     }
@@ -49869,16 +49983,14 @@ async function runBaselineGate(target, rulesets, config, signal) {
   const osv = await runOsvCheck(config.dependencyTarget ?? target, config, signal);
   throwIfAborted(signal, "Security baseline scan aborted");
   const osvFailed = blocksDependencyCheck(osv);
+  const scanNote = unscannedNote(comparison);
   const details = comparison.complete ? `Base ${String(comparison.baseCount)}, worktree ${String(comparison.worktreeCount)} findings; ${String(comparison.introducedBlockingCount)} introduced blocking; ${buildScanSummary(comparison.worktreeCount ?? 0, comparison.introducedBlockingCount ?? 0, osv.vulnerabilities.length, osv)}` : `Dependency check: ${buildScanSummary(null, 0, osv.vulnerabilities.length, osv)}; Security comparison incomplete: ${comparison.errors.join("; ")}`;
   return {
     name: "security_scan",
     verdict: osvFailed ? "fail" : !comparison.complete ? "skip" : comparison.introducedBlockingCount === 0 ? "pass" : "fail",
-    details: (osv.manifestError === void 0 ? details : `${osv.manifestError}; ${details}`).slice(
-      0,
-      500
-    ),
+    details: `${(osv.manifestError === void 0 ? details : `${osv.manifestError}; ${details}`).slice(0, 500)}${scanNote === void 0 ? "" : `; ${scanNote}`}`,
     comparison,
-    ...coverageNoteField(osv),
+    ...combinedCoverageNote(osv, scanNote),
     durationMs: Date.now() - start
   };
 }
@@ -49937,6 +50049,25 @@ function coverageNoteField(osv) {
   if (osv.declared > osv.queried) gaps.push(cappedCoverageNote(osv));
   return gaps.length === 0 ? {} : { coverageNote: `Dependency coverage partial: ${gaps.join("; ")}` };
 }
+var UNSCANNED_ENTRY_MAX_CHARS = 200;
+var UNSCANNED_NOTE_MAX_CHARS = 500;
+function boundedUnscannedEntry(entry) {
+  const flat = stripControlCharacters(entry).trim();
+  return flat.length <= UNSCANNED_ENTRY_MAX_CHARS ? flat : `${flat.slice(0, UNSCANNED_ENTRY_MAX_CHARS)}\u2026`;
+}
+function unscannedNote(comparison) {
+  const unscanned = comparison.unscannedCoverage ?? [];
+  if (unscanned.length === 0) return void 0;
+  const note = `SAST coverage partial; unscanned: ${unscanned.map(boundedUnscannedEntry).join("; ")}`;
+  if (note.length <= UNSCANNED_NOTE_MAX_CHARS) return note;
+  const suffix = `\u2026 (${String(unscanned.length)} unscanned entries; truncated)`;
+  return `${note.slice(0, UNSCANNED_NOTE_MAX_CHARS - suffix.length)}${suffix}`;
+}
+function combinedCoverageNote(osv, scanNote) {
+  const dependencyNote = coverageNoteField(osv).coverageNote;
+  const notes = [dependencyNote, scanNote].filter((note) => note !== void 0);
+  return notes.length === 0 ? {} : { coverageNote: notes.join("; ") };
+}
 function buildScanSummary(total, blocking2, osvCount, osv, sarifParseErrors = 0) {
   const parts = total === null ? [] : [`${String(total)} SAST findings`];
   if (sarifParseErrors > 0) {
@@ -51208,7 +51339,7 @@ ${FINDINGS_FORMAT_INSTRUCTIONS}
 }
 
 // src/mcp/tools/pr-review-tool.ts
-import { z as z96 } from "zod";
+import { z as z97 } from "zod";
 import { randomUUID as randomUUID14 } from "node:crypto";
 
 // src/audit/reviewed-diff-hash.ts
@@ -51759,19 +51890,19 @@ var MAX_REPO_CONTEXT_LENGTH = 2e3;
 var MAX_TITLE_LENGTH = 500;
 var MAX_DESCRIPTION_LENGTH = 1e4;
 var PR_REVIEW_ASYNC_HINT = "A pr_review run fans out to 5 live LLM voters and can exceed the synchronous MCP request timeout. Retry with `dispatch: 'async'` to get a jobId immediately, then poll get_job_result({ jobId }) for the result.";
-var PrReviewInputSchema = z96.object({
-  prTitle: z96.string().min(1).max(MAX_TITLE_LENGTH).describe("PR title"),
-  prDescription: z96.string().max(MAX_DESCRIPTION_LENGTH).optional().describe("PR body / description"),
-  prDiff: z96.string().min(1).max(MAX_DIFF_INPUT_LENGTH).refine(looksLikeUnifiedDiff, {
+var PrReviewInputSchema = z97.object({
+  prTitle: z97.string().min(1).max(MAX_TITLE_LENGTH).describe("PR title"),
+  prDescription: z97.string().max(MAX_DESCRIPTION_LENGTH).optional().describe("PR body / description"),
+  prDiff: z97.string().min(1).max(MAX_DIFF_INPUT_LENGTH).refine(looksLikeUnifiedDiff, {
     message: "prDiff must be a unified diff (expected a `diff --git`, `---`/`+++`, or `@@ \u2026 @@` line). Prose descriptions of a change are rejected: a review of a summary is not a review of the code, and would be recorded as though it were (#4451)."
   }).describe(
     `Unified diff text (max ${String(MAX_DIFF_INPUT_LENGTH)} chars). REQUIRED SHAPE (#4451): must contain a \`diff --git\` header, an \`@@ \u2026 @@\` hunk header backed by +/- lines, or a \`---\`/\`+++\` header pair \u2014 a prose summary of the change is REJECTED, because reviewing a summary is not reviewing the code and would be recorded as though it were. (Stated here because Zod refinements do not survive JSON-schema generation, so this constraint is otherwise invisible to clients.) No need to truncate before calling: the panel reads the whole diff whenever it fits the voters' context windows (#6003); a diff larger than that is security-prioritized and PARTIALLY reviewed (lowest-priority whole files dropped; a partial panel read can block but never verified-approve). Separately, the audit record's hash binds only the first ${String(MAX_DIFF_LENGTH)} UTF-8 bytes; the response \`coverage\` and the record summary state both what the panel read and what the hash binds.`
   ),
-  repoContext: z96.string().max(MAX_REPO_CONTEXT_LENGTH).optional().describe(
+  repoContext: z97.string().max(MAX_REPO_CONTEXT_LENGTH).optional().describe(
     `Optional one-paragraph repo context (architecture, conventions; max ${String(MAX_REPO_CONTEXT_LENGTH)} chars; trim before calling)`
   ),
-  baseRef: z96.string().max(200).optional().describe("Base branch ref (e.g. main)"),
-  headRef: z96.string().max(200).optional().describe("Head branch ref"),
+  baseRef: z97.string().max(200).optional().describe("Base branch ref (e.g. main)"),
+  headRef: z97.string().max(200).optional().describe("Head branch ref"),
   /**
    * Option-C audit binding (#4031). When BOTH `prNumber` and `baseSha` are
    * supplied AND the review is live (not simulated), pr_review persists an
@@ -51787,14 +51918,14 @@ var PrReviewInputSchema = z96.object({
    * the PR opened and drifts as main advances), so pass the merge-base as
    * `baseSha` or the record will not match on an aged branch (#5692).
    */
-  prNumber: z96.number().int().positive().optional().describe("PR number \u2014 with baseSha, enables Option-C audit-record persistence (#4031)"),
-  baseSha: z96.string().regex(/^[0-9a-f]{40}$/, "baseSha must be a 40-char lowercase hex commit sha").optional().describe(
+  prNumber: z97.number().int().positive().optional().describe("PR number \u2014 with baseSha, enables Option-C audit-record persistence (#4031)"),
+  baseSha: z97.string().regex(/^[0-9a-f]{40}$/, "baseSha must be a 40-char lowercase hex commit sha").optional().describe(
     "40-hex base commit sha the reviewed diff was computed from \u2014 pass `git merge-base origin/<base> <head>`, the base the gate recomputes (Option-C binding, #4031, #5692)"
   ),
-  repoPath: z96.string().max(1024).optional().describe(
+  repoPath: z97.string().max(1024).optional().describe(
     "Repo root path for persisting the governance pr-review record (overrides cwd auto-detection). Must contain a .git ancestor \u2014 relative paths are resolved against cwd; ignored (falls back to cwd auto-detection) if it is not a real repo root. Env NEXUS_PR_REVIEW_RECORDS_PATH still takes precedence and is unrestricted."
   ),
-  simulate: z96.boolean().default(false).describe("Use simulated voters (testing only; never ship live with this true)"),
+  simulate: z97.boolean().default(false).describe("Use simulated voters (testing only; never ship live with this true)"),
   /**
    * Error policy (#4132). `standard` (default) excludes absent voters but
    * requires a majority of the requested panel to approve. `absolute_quorum` gates
@@ -51806,7 +51937,7 @@ var PrReviewInputSchema = z96.object({
    * verified approve. A genuine `request_changes` blocker still wins (Tiers 1-2
    * run first).
    */
-  errorPolicy: z96.enum(["standard", "absolute_quorum"]).default("standard").describe(
+  errorPolicy: z97.enum(["standard", "absolute_quorum"]).default("standard").describe(
     "Error policy (#4132). 'standard' (default): absent voters excluded; approval requires a majority of the requested panel. 'absolute_quorum': any errored voter \u2014 esp. the contrarian \u2014 degrades a would-be approve to a recoverable abstain (verified:false); never manufactures a verified approve from an induced error."
   ),
   // #6123: same field as consensus_vote — the panel judges the caller's project.
@@ -52162,27 +52293,27 @@ function absoluteQuorumApprove(reviews, valid) {
 }
 
 // src/mcp/tools/survey-oss-landscape.ts
-import { z as z97 } from "zod";
-var SurveyOssLandscapeInputSchema = z97.object({
-  query: z97.string().min(1).max(200).describe('Free-text search query, e.g. "cargo nextest replacement" or "OSS SBOM tools"'),
-  maxResults: z97.number().int().min(1).max(50).optional().default(10).describe("Maximum candidates to return (1-50; default 10)"),
-  minStars: z97.number().int().min(0).optional().default(0).describe("Minimum star count to include (default 0; useful for filtering noise)"),
-  language: z97.string().max(50).optional().describe('GitHub language filter, e.g. "rust" or "typescript"')
+import { z as z98 } from "zod";
+var SurveyOssLandscapeInputSchema = z98.object({
+  query: z98.string().min(1).max(200).describe('Free-text search query, e.g. "cargo nextest replacement" or "OSS SBOM tools"'),
+  maxResults: z98.number().int().min(1).max(50).optional().default(10).describe("Maximum candidates to return (1-50; default 10)"),
+  minStars: z98.number().int().min(0).optional().default(0).describe("Minimum star count to include (default 0; useful for filtering noise)"),
+  language: z98.string().max(50).optional().describe('GitHub language filter, e.g. "rust" or "typescript"')
 });
-var GitHubRepoSchema = z97.object({
-  full_name: z97.string().optional(),
-  html_url: z97.string().optional(),
-  description: z97.string().nullable().optional(),
-  stargazers_count: z97.number().optional(),
-  pushed_at: z97.string().nullable().optional(),
-  language: z97.string().nullable().optional(),
-  license: z97.object({
-    spdx_id: z97.string().nullable().optional()
+var GitHubRepoSchema = z98.object({
+  full_name: z98.string().optional(),
+  html_url: z98.string().optional(),
+  description: z98.string().nullable().optional(),
+  stargazers_count: z98.number().optional(),
+  pushed_at: z98.string().nullable().optional(),
+  language: z98.string().nullable().optional(),
+  license: z98.object({
+    spdx_id: z98.string().nullable().optional()
   }).nullable().optional()
 });
-var GitHubSearchResponseSchema = z97.object({
-  total_count: z97.number().optional(),
-  items: z97.array(GitHubRepoSchema).optional()
+var GitHubSearchResponseSchema = z98.object({
+  total_count: z98.number().optional(),
+  items: z98.array(GitHubRepoSchema).optional()
 });
 var GITHUB_SEARCH_BASE = "https://api.github.com/search/repositories";
 function buildGithubQuery(input) {
@@ -52304,16 +52435,16 @@ function createSurveyHandler(deps) {
     });
     return withToolError("Survey failed", logger59, async () => {
       const result = await executeSurvey(validation.data, logger59);
-      return structuredToolSuccess(z97.object(SURVEY_OUTPUT_SCHEMA), result);
+      return structuredToolSuccess(z98.object(SURVEY_OUTPUT_SCHEMA), result);
     });
   };
 }
 var SURVEY_OUTPUT_SCHEMA = {
-  query: z97.string(),
-  totalFound: z97.number(),
-  candidates: z97.array(z97.unknown()),
-  sourcesQueried: z97.array(z97.string()),
-  sourcesFailed: z97.array(z97.string())
+  query: z98.string(),
+  totalFound: z98.number(),
+  candidates: z98.array(z98.unknown()),
+  sourcesQueried: z98.array(z98.string()),
+  sourcesFailed: z98.array(z98.string())
 };
 var SURVEY_DESCRIPTION = 'Transient OSS project search. Returns a ranked list of GitHub repositories with license, last-commit, star-count, and one-line description. Does NOT persist to the research registry \u2014 use `research_add_source` for that. Best for one-off engineering decisions like "what tools exist in this space?".';
 function registerSurveyOssLandscapeTool(server, deps) {
@@ -52343,7 +52474,7 @@ function registerSurveyOssLandscapeTool(server, deps) {
 }
 
 // src/mcp/tools/vendor-publishing-audit.ts
-import { z as z98 } from "zod";
+import { z as z99 } from "zod";
 
 // src/mcp/tools/vendor-publishing-seed.ts
 var VENDOR_PUBLISHING_SEED = {
@@ -52416,8 +52547,8 @@ function listKnownVendors() {
 }
 
 // src/mcp/tools/vendor-publishing-audit.ts
-var VendorPublishingAuditInputSchema = z98.object({
-  vendor: z98.string().min(1).max(50).toLowerCase().describe('Vendor identifier, lowercase. e.g. "ubuntu", "debian", "fedora"')
+var VendorPublishingAuditInputSchema = z99.object({
+  vendor: z99.string().min(1).max(50).toLowerCase().describe('Vendor identifier, lowercase. e.g. "ubuntu", "debian", "fedora"')
 });
 function lookupVendor(vendor) {
   if (isKnownVendor(vendor)) {
@@ -52445,26 +52576,26 @@ function createVendorPublishingAuditHandler(deps) {
     return withToolError("Vendor publishing audit failed", logger59, () => {
       const result = lookupVendor(validation.data.vendor);
       return Promise.resolve(
-        structuredToolSuccess(z98.object(VENDOR_PUBLISHING_OUTPUT_SCHEMA), result)
+        structuredToolSuccess(z99.object(VENDOR_PUBLISHING_OUTPUT_SCHEMA), result)
       );
     });
   };
 }
 var VENDOR_PUBLISHING_OUTPUT_SCHEMA = {
-  vendor: z98.string(),
-  known: z98.boolean(),
+  vendor: z99.string(),
+  known: z99.boolean(),
   // Fields below populate when known=true; permissive optional for known=false.
-  sha256SumsUrlPattern: z98.string().optional(),
-  sha256SumsSignatureUrlPattern: z98.string().optional(),
-  signaturePattern: z98.string().optional(),
-  gpgKeys: z98.array(z98.unknown()).optional(),
-  releaseCadence: z98.string().optional(),
-  keyRotationNotes: z98.string().optional(),
-  vendorDocUrl: z98.string().optional(),
-  citedAt: z98.string().optional(),
+  sha256SumsUrlPattern: z99.string().optional(),
+  sha256SumsSignatureUrlPattern: z99.string().optional(),
+  signaturePattern: z99.string().optional(),
+  gpgKeys: z99.array(z99.unknown()).optional(),
+  releaseCadence: z99.string().optional(),
+  keyRotationNotes: z99.string().optional(),
+  vendorDocUrl: z99.string().optional(),
+  citedAt: z99.string().optional(),
   // Fields below populate when known=false.
-  message: z98.string().optional(),
-  knownVendors: z98.array(z98.string()).optional()
+  message: z99.string().optional(),
+  knownVendors: z99.array(z99.string()).optional()
 };
 var VENDOR_PUBLISHING_DESCRIPTION = "Look up a vendor's published-artifact signing infrastructure: GPG key fingerprints, SHA256SUMS URL pattern, signature shape (clearsigned / detached / detached-on-iso), release cadence, key rotation notes, and the vendor doc citation. Static lookup against a curated seed dataset; the vendor doc URL is the authoritative source. Returns `{known: false, knownVendors: [...]}` for vendors without a seed entry. v1 covers ubuntu, debian, fedora.";
 function registerVendorPublishingAuditTool(server, deps) {
@@ -52494,17 +52625,17 @@ function registerVendorPublishingAuditTool(server, deps) {
 }
 
 // src/mcp/tools/compare-data-feeds.ts
-import { z as z99 } from "zod";
+import { z as z100 } from "zod";
 import * as path6 from "node:path";
 import * as fs7 from "node:fs";
 import * as yaml3 from "yaml";
-var CompareDataFeedsInputSchema = z99.object({
-  feedAPath: z99.string().min(1).max(1e3).describe("Filesystem path to feed A (YAML or JSON, auto-detected by extension)"),
-  feedBPath: z99.string().min(1).max(1e3).describe("Filesystem path to feed B"),
-  keyPath: z99.string().min(1).max(200).describe(
+var CompareDataFeedsInputSchema = z100.object({
+  feedAPath: z100.string().min(1).max(1e3).describe("Filesystem path to feed A (YAML or JSON, auto-detected by extension)"),
+  feedBPath: z100.string().min(1).max(1e3).describe("Filesystem path to feed B"),
+  keyPath: z100.string().min(1).max(200).describe(
     'Dotted path to the entry key, e.g. "id" or "name". Each entry must have this field.'
   ),
-  compareFields: z99.array(z99.string().min(1).max(200)).max(20).optional().describe(
+  compareFields: z100.array(z100.string().min(1).max(200)).max(20).optional().describe(
     'Optional dotted field paths to compare across matched entries (e.g. ["license", "sha256"])'
   )
 });
@@ -52682,29 +52813,29 @@ function createCompareDataFeedsHandler(deps) {
     });
     return withToolError("Compare data feeds failed", logger59, () => {
       const result = executeCompare(validation.data);
-      return Promise.resolve(structuredToolSuccess(z99.object(COMPARE_OUTPUT_SCHEMA), result));
+      return Promise.resolve(structuredToolSuccess(z100.object(COMPARE_OUTPUT_SCHEMA), result));
     });
   };
 }
 var COMPARE_OUTPUT_SCHEMA = {
-  feedAPath: z99.string(),
-  feedBPath: z99.string(),
-  keyPath: z99.string(),
-  counts: z99.object({
-    entriesInA: z99.number(),
-    entriesInB: z99.number(),
-    onlyInA: z99.number(),
-    onlyInB: z99.number(),
-    inBoth: z99.number(),
-    fieldDifferences: z99.number()
+  feedAPath: z100.string(),
+  feedBPath: z100.string(),
+  keyPath: z100.string(),
+  counts: z100.object({
+    entriesInA: z100.number(),
+    entriesInB: z100.number(),
+    onlyInA: z100.number(),
+    onlyInB: z100.number(),
+    inBoth: z100.number(),
+    fieldDifferences: z100.number()
   }),
-  coverage: z99.object({
-    onlyInA: z99.array(z99.string()),
-    onlyInB: z99.array(z99.string()),
-    inBoth: z99.array(z99.string())
+  coverage: z100.object({
+    onlyInA: z100.array(z100.string()),
+    onlyInB: z100.array(z100.string()),
+    inBoth: z100.array(z100.string())
   }),
-  fieldDifferences: z99.array(z99.unknown()),
-  summary: z99.string()
+  fieldDifferences: z100.array(z100.unknown()),
+  summary: z100.string()
 };
 var COMPARE_DESCRIPTION = "Diff two upstream data feeds (YAML or JSON files) along coverage and per-field axes. Returns which entries exist in A, B, both, plus optional field-level diffs across matched entries. v1 takes file paths only (no URL fetch \u2014 that needs an SSRF design pass). Both feeds must be a top-level array OR a top-level object with exactly one array field.";
 function registerCompareDataFeedsTool(server, deps) {
@@ -52734,9 +52865,9 @@ function registerCompareDataFeedsTool(server, deps) {
 }
 
 // src/mcp/tools/query-task-state-tool.ts
-import { z as z100 } from "zod";
-var QueryTaskStateInputSchema = z100.object({
-  taskId: z100.string().min(1).max(128).describe("Task ID whose structured state log should be read")
+import { z as z101 } from "zod";
+var QueryTaskStateInputSchema = z101.object({
+  taskId: z101.string().min(1).max(128).describe("Task ID whose structured state log should be read")
 });
 function queryTaskStateHandler(args, ctx) {
   const parsed = QueryTaskStateInputSchema.safeParse(args);
@@ -52771,7 +52902,7 @@ function queryTaskStateHandler(args, ctx) {
 function registerQueryTaskStateTool(server, deps) {
   const logger59 = deps.logger ?? createLogger({ tool: "query_task_state" });
   const toolSchema = {
-    taskId: z100.string().min(1).max(128).describe("Task ID whose structured state log should be read")
+    taskId: z101.string().min(1).max(128).describe("Task ID whose structured state log should be read")
   };
   const description = "Read the structured state log for a task ID and return the current snapshot. Includes Magentic-One Task Ledger (facts/guesses/openQuestions) and Progress Ledger (per-step reflections with suggestedAction) when orchestrators have written them. Structured state is only written when NEXUS_TASK_STATE_ENABLED=1 was set during the orchestrate invocation.";
   const secureHandler = createSecureHandler(queryTaskStateHandler, {
@@ -52793,28 +52924,28 @@ function registerQueryTaskStateTool(server, deps) {
 }
 
 // src/mcp/tools/ci-health-check-tool.ts
-import { z as z103 } from "zod";
+import { z as z104 } from "zod";
 
 // src/mcp/tools/ci-health-log.ts
 import { appendFileSync as appendFileSync5, existsSync as existsSync14, readFileSync as readFileSync12, statSync as statSync2, writeFileSync as writeFileSync3 } from "node:fs";
-import { z as z102 } from "zod";
+import { z as z103 } from "zod";
 
 // src/mcp/tools/ci-health-types.ts
-import { z as z101 } from "zod";
-var CiHealthStatusSchema = z101.enum(["healthy", "degraded", "outage", "unknown"]);
+import { z as z102 } from "zod";
+var CiHealthStatusSchema = z102.enum(["healthy", "degraded", "outage", "unknown"]);
 
 // src/mcp/tools/ci-health-log.ts
 var logger53 = createLogger({ component: "ci-health-log" });
-var CiHealthEventSchema = z102.object({
-  v: z102.literal(1),
-  ts: z102.iso.datetime(),
+var CiHealthEventSchema = z103.object({
+  v: z103.literal(1),
+  ts: z103.iso.datetime(),
   status: CiHealthStatusSchema,
-  repo: z102.string().optional(),
-  signals: z102.array(
-    z102.object({
-      source: z102.enum(["github-status", "repo-activity-window"]),
+  repo: z103.string().optional(),
+  signals: z103.array(
+    z103.object({
+      source: z103.enum(["github-status", "repo-activity-window"]),
       status: CiHealthStatusSchema,
-      evidence: z102.string()
+      evidence: z103.string()
     })
   )
 });
@@ -52894,17 +53025,17 @@ function eventFromCheck(params) {
 }
 
 // src/mcp/tools/ci-health-check-tool.ts
-var CiHealthCheckInputSchema = z103.object({
+var CiHealthCheckInputSchema = z104.object({
   /**
    * Repo to check for the recent-runs activity signal (in `owner/repo` form).
    * Optional — when omitted, only the status-page signal is consulted.
    */
-  repo: z103.string().regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/, "Must be owner/repo form").optional().describe("GitHub repo (owner/repo) to check for recent CI activity. Optional."),
+  repo: z104.string().regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/, "Must be owner/repo form").optional().describe("GitHub repo (owner/repo) to check for recent CI activity. Optional."),
   /**
    * How far back to look for recent-runs activity (minutes). Default 30 —
    * matches the typical wedge-detection window from the #3070 / #3076 outages.
    */
-  activityWindowMinutes: z103.number().int().min(5).max(180).default(30).describe("Recent-runs lookback window in minutes (5-180; default 30).")
+  activityWindowMinutes: z104.number().int().min(5).max(180).default(30).describe("Recent-runs lookback window in minutes (5-180; default 30).")
 });
 var STATUS_PAGE_URL = "https://www.githubstatus.com/api/v2/components.json";
 function mapStatusPageStatus(raw) {
@@ -53063,8 +53194,8 @@ var DESCRIPTION = "Check CI infrastructure health before triggering / polling ru
 function registerCiHealthCheckTool(server, deps) {
   const logger59 = deps.logger ?? createLogger({ tool: "ci_health_check" });
   const toolSchema = {
-    repo: z103.string().regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/, "Must be owner/repo form").optional().describe("GitHub repo (owner/repo) to check for recent CI activity. Optional."),
-    activityWindowMinutes: z103.number().int().min(5).max(180).optional().describe("Recent-runs lookback window in minutes (5-180; default 30).")
+    repo: z104.string().regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/, "Must be owner/repo form").optional().describe("GitHub repo (owner/repo) to check for recent CI activity. Optional."),
+    activityWindowMinutes: z104.number().int().min(5).max(180).optional().describe("Recent-runs lookback window in minutes (5-180; default 30).")
   };
   const secureHandler = createSecureHandler((args) => ciHealthCheckHandler(args, logger59), {
     toolName: "ci_health_check",
@@ -53090,18 +53221,18 @@ function registerCiHealthCheckTool(server, deps) {
 
 // src/mcp/tools/quality-gate-tool.ts
 import { statSync as statSync3 } from "node:fs";
-import { z as z104 } from "zod";
-var QualityCheckSchema = z104.enum(["typecheck", "lint", "tests", "build", "security"]);
+import { z as z105 } from "zod";
+var QualityCheckSchema = z105.enum(["typecheck", "lint", "tests", "build", "security"]);
 var DEFAULT_CHECKS = ["typecheck", "lint", "tests"];
-var RunQualityGateInputSchema = z104.object({
+var RunQualityGateInputSchema = z105.object({
   /** Project directory to run checks against. Must resolve inside the repo/cwd root. */
-  projectDir: z104.string().optional().describe(
+  projectDir: z105.string().optional().describe(
     "Project directory to run checks against (default: cwd). Must stay inside the repo root."
   ),
   /** Which allowlisted checks to run. */
-  checks: z104.array(QualityCheckSchema).nonempty().default([...DEFAULT_CHECKS]).describe("Allowlisted checks to run (default: ['typecheck','lint','tests'])."),
+  checks: z105.array(QualityCheckSchema).nonempty().default([...DEFAULT_CHECKS]).describe("Allowlisted checks to run (default: ['typecheck','lint','tests'])."),
   /** 1-based iteration counter, forwarded to the engine for feedback context. */
-  iteration: z104.number().int().min(1).default(1).describe("1-based iteration number (default 1).")
+  iteration: z105.number().int().min(1).default(1).describe("1-based iteration number (default 1).")
 });
 function validateProjectDir(raw) {
   const candidate = raw ?? process.cwd();
@@ -53176,11 +53307,11 @@ var DESCRIPTION2 = "Run the QA quality gate (#1684 engine) against a project dir
 function registerRunQualityGateTool(server, deps) {
   const logger59 = deps.logger ?? createLogger({ tool: "run_quality_gate" });
   const toolSchema = {
-    projectDir: z104.string().optional().describe(
+    projectDir: z105.string().optional().describe(
       "Project directory to run checks against (default: cwd). Must stay inside the repo root."
     ),
-    checks: z104.array(QualityCheckSchema).nonempty().optional().describe("Allowlisted checks to run (default: ['typecheck','lint','tests'])."),
-    iteration: z104.number().int().min(1).optional().describe("1-based iteration number (default 1).")
+    checks: z105.array(QualityCheckSchema).nonempty().optional().describe("Allowlisted checks to run (default: ['typecheck','lint','tests'])."),
+    iteration: z105.number().int().min(1).optional().describe("1-based iteration number (default 1).")
   };
   const secureHandler = createSecureHandler(
     (args) => runQualityGateHandler(args, logger59),
@@ -53210,7 +53341,7 @@ function registerRunQualityGateTool(server, deps) {
 // src/mcp/tools/verify-audit-chain-tool.ts
 import * as fs8 from "node:fs/promises";
 import * as path7 from "node:path";
-import { z as z105 } from "zod";
+import { z as z106 } from "zod";
 
 // src/cli-server-auth.ts
 function resolveAuthEnabled(config) {
@@ -53384,11 +53515,11 @@ function logSecurityConfig(logger59, config) {
 }
 
 // src/mcp/tools/verify-audit-chain-tool.ts
-var VerifyAuditChainInputSchema = z105.object({
-  logDir: z105.string().min(1).max(512).describe(
+var VerifyAuditChainInputSchema = z106.object({
+  logDir: z106.string().min(1).max(512).describe(
     "Filesystem path to the FileAuditStorage log directory. Must lie inside the nexus data dir, a repo-local `.nexus-agents/`, or the configured `security.audit.logDir`. Tool reads all `audit-*.jsonl` files in lexicographic order and verifies the combined chain."
   ),
-  filePrefix: z105.string().min(1).max(64).optional().default(DEFAULT_AUDIT_FILE_PREFIX).describe(
+  filePrefix: z106.string().min(1).max(64).optional().default(DEFAULT_AUDIT_FILE_PREFIX).describe(
     'Filename prefix for audit log files (defaults to "audit"). Files matching `${filePrefix}-*.jsonl` will be verified.'
   )
 });
@@ -53517,10 +53648,10 @@ async function handler2(args, ctx, security) {
 function registerVerifyAuditChainTool(server, deps) {
   const logger59 = deps.logger ?? createLogger({ tool: "verify_audit_chain" });
   const toolSchema = {
-    logDir: z105.string().min(1).max(512).describe(
+    logDir: z106.string().min(1).max(512).describe(
       "Filesystem path to the FileAuditStorage log directory. Must lie inside the nexus data dir, a repo-local `.nexus-agents/`, or the configured `security.audit.logDir`. Tool reads all `audit-*.jsonl` files and verifies the combined hash chain."
     ),
-    filePrefix: z105.string().min(1).max(64).optional().describe(
+    filePrefix: z106.string().min(1).max(64).optional().describe(
       'Filename prefix for audit log files (defaults to "audit"). Files matching `${filePrefix}-*.jsonl` will be verified.'
     )
   };
@@ -53544,7 +53675,7 @@ function registerVerifyAuditChainTool(server, deps) {
 }
 
 // src/mcp/tools/suggest-research-tasks-tool.ts
-import { z as z106 } from "zod";
+import { z as z107 } from "zod";
 var SUGGEST_RESEARCH_TASKS_NOTE = "Suggestions derived from external research (untrusted); review before acting \u2014 nothing was executed or filed.";
 var RESEARCH_BUDGET_MS = 2e4;
 var RESEARCH_TIMED_OUT = /* @__PURE__ */ Symbol("research-budget-exceeded");
@@ -53561,11 +53692,11 @@ async function withResearchBudget(p, ms) {
     if (timer !== void 0) clearTimeout(timer);
   }
 }
-var SuggestResearchTasksInputSchema = z106.object({
-  topic: z106.string().optional().describe("Topic filter passed to research_discover. Optional."),
-  qualityThreshold: z106.number().min(0).max(10).optional().describe("Minimum quality score (0-10) a discovery must meet to be suggested. Optional."),
-  maxTriggers: z106.number().int().min(1).optional().describe("Max number of candidate tasks to return (>=1). Optional."),
-  existingTaskIds: z106.array(z106.string()).optional().describe("Known task IDs to skip (dedup). Optional.")
+var SuggestResearchTasksInputSchema = z107.object({
+  topic: z107.string().optional().describe("Topic filter passed to research_discover. Optional."),
+  qualityThreshold: z107.number().min(0).max(10).optional().describe("Minimum quality score (0-10) a discovery must meet to be suggested. Optional."),
+  maxTriggers: z107.number().int().min(1).optional().describe("Max number of candidate tasks to return (>=1). Optional."),
+  existingTaskIds: z107.array(z107.string()).optional().describe("Known task IDs to skip (dedup). Optional.")
 });
 function toTriggerConfig(input) {
   return {
@@ -53622,10 +53753,10 @@ var DESCRIPTION3 = "SUGGEST-ONLY: surface candidate pipeline tasks for human/orc
 function registerSuggestResearchTasksTool(server, deps) {
   const logger59 = deps.logger ?? createLogger({ tool: "suggest_research_tasks" });
   const toolSchema = {
-    topic: z106.string().optional().describe("Topic filter passed to research_discover. Optional."),
-    qualityThreshold: z106.number().min(0).max(10).optional().describe("Minimum quality score (0-10) a discovery must meet to be suggested. Optional."),
-    maxTriggers: z106.number().int().min(1).optional().describe("Max number of candidate tasks to return (>=1). Optional."),
-    existingTaskIds: z106.array(z106.string()).optional().describe("Known task IDs to skip (dedup). Optional.")
+    topic: z107.string().optional().describe("Topic filter passed to research_discover. Optional."),
+    qualityThreshold: z107.number().min(0).max(10).optional().describe("Minimum quality score (0-10) a discovery must meet to be suggested. Optional."),
+    maxTriggers: z107.number().int().min(1).optional().describe("Max number of candidate tasks to return (>=1). Optional."),
+    existingTaskIds: z107.array(z107.string()).optional().describe("Known task IDs to skip (dedup). Optional.")
   };
   const secureHandler = createSecureHandler(
     (args) => suggestResearchTasksHandler(args, logger59),
@@ -53653,7 +53784,7 @@ function registerSuggestResearchTasksTool(server, deps) {
 }
 
 // src/mcp/tools/run-tool.ts
-import { z as z110 } from "zod";
+import { z as z111 } from "zod";
 import { randomUUID as randomUUID19 } from "node:crypto";
 
 // src/orchestration/consensus-enforcement-mode.ts
@@ -54275,7 +54406,7 @@ function createMetaOrchestrator(options) {
 
 // src/orchestration/meta-shadow-selector.ts
 import { appendFileSync as appendFileSync6, existsSync as existsSync15, readFileSync as readFileSync13 } from "node:fs";
-import { z as z107 } from "zod";
+import { z as z108 } from "zod";
 var SHADOW_STRATEGY_ARMS = [
   "single-shot",
   "dev-pipeline",
@@ -54364,19 +54495,19 @@ function createHydratableSelector() {
 var META_OUTCOME_SCHEMA_VERSION = 1;
 var HYDRATE_LOOKBACK_DAYS = 30;
 var HYDRATE_LOOKBACK_MS = HYDRATE_LOOKBACK_DAYS * 24 * 60 * 60 * 1e3;
-var PersistedContextSchema = z107.object({
-  taskComplexity: z107.number(),
-  contextLengthNormalized: z107.number(),
-  isCodeTask: z107.number(),
-  isReasoningTask: z107.number(),
-  budgetUtilization: z107.number(),
-  timePressure: z107.number()
+var PersistedContextSchema = z108.object({
+  taskComplexity: z108.number(),
+  contextLengthNormalized: z108.number(),
+  isCodeTask: z108.number(),
+  isReasoningTask: z108.number(),
+  budgetUtilization: z108.number(),
+  timePressure: z108.number()
 });
-var PersistedMetaOutcomeSchema = z107.object({
-  schema: z107.literal(META_OUTCOME_SCHEMA_VERSION),
-  timestamp: z107.string(),
-  strategy: z107.enum(SHADOW_STRATEGY_ARMS),
-  success: z107.boolean(),
+var PersistedMetaOutcomeSchema = z108.object({
+  schema: z108.literal(META_OUTCOME_SCHEMA_VERSION),
+  timestamp: z108.string(),
+  strategy: z108.enum(SHADOW_STRATEGY_ARMS),
+  success: z108.boolean(),
   context: PersistedContextSchema
 });
 var persistLogger = createLogger({ component: "MetaShadowSelector" });
@@ -54769,7 +54900,7 @@ function evaluateMetaStrategyReadiness(result, config = DEFAULT_META_STRATEGY_RE
 }
 
 // src/mcp/tools/dev-pipeline-tool.ts
-import { z as z108 } from "zod";
+import { z as z109 } from "zod";
 import * as fs10 from "node:fs";
 import { randomUUID as randomUUID17 } from "node:crypto";
 
@@ -55034,48 +55165,48 @@ var DEV_PIPELINE_DRY_RUN_NOTE = "This was a dry run (plan+vote), which always ru
 function dispatchNoteFor(dryRun) {
   return dryRun ? DEV_PIPELINE_DRY_RUN_NOTE : DEV_PIPELINE_ASYNC_HINT;
 }
-var DevPipelineInputSchema = z108.object({
+var DevPipelineInputSchema = z109.object({
   /** Direct task instructions. */
-  task: z108.string().max(1e4).optional().describe("Direct task instructions (what to build)"),
+  task: z109.string().max(1e4).optional().describe("Direct task instructions (what to build)"),
   /** Declared provenance of the task text (#6795); omitted means '3'. */
   sourceTrustTier: TaskSourceTrustTierSchema,
   /** Path to a plan file (.md, .yaml, .txt) to use as input. */
-  planFile: z108.string().max(500).optional().describe("Path to a plan/spec file to use as input"),
+  planFile: z109.string().max(500).optional().describe("Path to a plan/spec file to use as input"),
   /** Whether to run in dry-run mode (plan+vote only, no implementation). */
-  dryRun: z108.boolean().default(false).describe("If true, stop after plan+vote (no implementation)"),
+  dryRun: z109.boolean().default(false).describe("If true, stop after plan+vote (no implementation)"),
   /** Maximum vote iterations before proceeding (default: 3). */
-  maxVoteIterations: z108.number().int().min(1).max(5).default(3).describe("Max plan\u2192vote iterations"),
+  maxVoteIterations: z109.number().int().min(1).max(5).default(3).describe("Max plan\u2192vote iterations"),
   /** Maximum QA iterations per task (default: 3). */
-  maxQaIterations: z108.number().int().min(1).max(5).default(3).describe("Max QA review iterations per task"),
+  maxQaIterations: z109.number().int().min(1).max(5).default(3).describe("Max QA review iterations per task"),
   /** Working directory for the pipeline (default: cwd). Used for security scan and context. */
-  workingDir: z108.string().max(500).optional().describe("Working directory (default: cwd)"),
+  workingDir: z109.string().max(500).optional().describe("Working directory (default: cwd)"),
   /** GitHub issue number to track progress on. Updates posted as comments. */
-  issueNumber: z108.number().int().positive().optional().describe("GitHub issue to post progress to"),
+  issueNumber: z109.number().int().positive().optional().describe("GitHub issue to post progress to"),
   /** GitHub repo (owner/name) for issue tracking. */
-  repo: z108.string().max(200).optional().describe("GitHub repo for issue tracking (e.g., owner/repo)"),
+  repo: z109.string().max(200).optional().describe("GitHub repo for issue tracking (e.g., owner/repo)"),
   /** Task tracking backend: github, gitlab, or json (default: json). */
-  trackerBackend: z108.enum(["github", "gitlab", "json"]).default("json").describe("Task tracking backend for issue creation"),
+  trackerBackend: z109.enum(["github", "gitlab", "json"]).default("json").describe("Task tracking backend for issue creation"),
   /** Labels to apply to created issues. */
-  labels: z108.array(z108.string()).optional().describe("Labels for created issues"),
+  labels: z109.array(z109.string()).optional().describe("Labels for created issues"),
   /** Session ID for checkpoint/resume. Enables crash recovery. */
-  sessionId: z108.string().max(128).regex(/^[a-zA-Z0-9_-]+$/).optional().describe("Session ID for checkpoint/resume (crash recovery)"),
+  sessionId: z109.string().max(128).regex(/^[a-zA-Z0-9_-]+$/).optional().describe("Session ID for checkpoint/resume (crash recovery)"),
   /**
    * TESTS ONLY — when true, voters return random decisions. Must not be used as
    * a fallback when adapters are unavailable; configure an adapter instead. (#2319)
    */
-  simulateVotes: z108.boolean().default(false).describe("TESTS ONLY \u2014 random output, must not be used for real decisions (#2319)"),
+  simulateVotes: z109.boolean().default(false).describe("TESTS ONLY \u2014 random output, must not be used for real decisions (#2319)"),
   /** Voting strategy for consensus stages. */
   votingStrategy: VotingStrategySchema.optional().describe(
     "Voting strategy for plan approval (default: higher_order)"
   ),
   /** Use 3 agents instead of 6 for faster voting. */
-  quickMode: z108.boolean().default(false).describe("Use 3 agents instead of 6 for faster consensus voting"),
+  quickMode: z109.boolean().default(false).describe("Use 3 agents instead of 6 for faster consensus voting"),
   /**
    * Deadline for EACH stage call in milliseconds (min 30s, max 600s), not a
    * budget for the whole run (#6736). Replaces every stage's default, the
    * vote's included; clamped to the `pipeline` class guard.
    */
-  timeoutMs: z108.number().int().min(3e4).max(6e5).optional().describe(
+  timeoutMs: z109.number().int().min(3e4).max(6e5).optional().describe(
     "Max time for EACH stage call in ms (30000-600000), not for the whole run; applies to every stage, the vote included, and to each plan/vote and implement/QA iteration. A stage past it fails with a timeout and its model calls are aborted. Default: the vote stage gets the multi-LLM panel guard (900000 unless overridden), other stages the pipeline guard (1800000 unless overridden)"
   ),
   /**
@@ -55083,7 +55214,7 @@ var DevPipelineInputSchema = z108.object({
    * dispatch. A caller who learned `mode: 'async'` elsewhere gets an error
    * naming `dispatch` rather than the bare enum message (#4968).
    */
-  mode: z108.enum(["autonomous", "harness"], { error: modeEnumErrorNamingDispatch }).default("autonomous").describe(
+  mode: z109.enum(["autonomous", "harness"], { error: modeEnumErrorNamingDispatch }).default("autonomous").describe(
     "'autonomous': full pipeline. 'harness': stops after decompose, returns tasks for caller to implement. (Not the async switch \u2014 that is `dispatch`.)"
   ),
   /**
@@ -55097,11 +55228,11 @@ var DevPipelineInputSchema = z108.object({
    */
   dispatch: dispatchFieldDefaultSync("Ignored for dryRun."),
   /** Local pre-ship quality gate (typecheck/lint/tests) mode (#3356). */
-  qualityGate: z108.enum(["off", "advisory", "blocking"]).default("off").describe(
+  qualityGate: z109.enum(["off", "advisory", "blocking"]).default("off").describe(
     "Pre-ship local quality gate. 'off' (default): skip. 'advisory': run + record feedback, never fail. 'blocking': a red gate fails the pipeline."
   ),
   /** Opt-in per-run token budget — a safety cap for unattended runs (#3395). */
-  maxBudgetTokens: z108.number().int().positive().optional().describe(
+  maxBudgetTokens: z109.number().int().positive().optional().describe(
     "Per-run token ceiling (#3395). When set, expert calls stop (returning failures) once cumulative usage crosses it \u2014 a hard-stop safety cap for unattended/multi-day runs. Omit to disable (default)."
   )
 });
@@ -55188,7 +55319,7 @@ async function executeDevPipelineBody(taskText, stages, pipelineOptions, simulat
       detail: output2
     });
   }
-  return structuredToolSuccess(z108.record(z108.string(), z108.unknown()), output2);
+  return structuredToolSuccess(z109.record(z109.string(), z109.unknown()), output2);
 }
 function describeIncompleteRun(result) {
   if (result.planStatus !== void 0) {
@@ -55320,33 +55451,33 @@ function registerDevPipelineTool(server, deps) {
 }
 
 // src/mcp/tools/pipeline-tool.ts
-import { z as z109 } from "zod";
+import { z as z110 } from "zod";
 import * as fs11 from "node:fs";
 import { randomUUID as randomUUID18 } from "node:crypto";
 var PIPELINE_ASYNC_HINT = "A full run_pipeline run can exceed the synchronous MCP request timeout. Retry with `dispatch: 'async'` to get a jobId immediately, then poll get_job_result({ jobId }) for the result.";
-var PipelineInputSchema = z109.object({
+var PipelineInputSchema = z110.object({
   /** The task to execute. */
-  task: z109.string().min(5).max(1e4).describe("Task description \u2014 pipeline template auto-selected based on content"),
+  task: z110.string().min(5).max(1e4).describe("Task description \u2014 pipeline template auto-selected based on content"),
   /** Path to a spec file (.md, .yaml) to use as task input. */
-  specFile: z109.string().max(500).optional().describe("Path to a spec file \u2014 content prepended to task for greenfield projects"),
+  specFile: z110.string().max(500).optional().describe("Path to a spec file \u2014 content prepended to task for greenfield projects"),
   /** Override template — see `listTemplateIds()` for the canonical list (#2728). Auto-detected if omitted. */
-  template: z109.string().max(50).optional().describe(`Pipeline template override. Available: ${listTemplateIds().join(", ")}`),
+  template: z110.string().max(50).optional().describe(`Pipeline template override. Available: ${listTemplateIds().join(", ")}`),
   /** Voting strategy for consensus stages. */
   votingStrategy: VotingStrategySchema.optional().describe(
     "Voting strategy for plan approval. simple_majority (default), supermajority (67%), unanimous, higher_order (Bayesian), opinion_wise"
   ),
   /** Use 3 agents instead of 7 for faster voting. */
-  quickMode: z109.boolean().default(false).describe("Use 3 agents instead of 7 for faster consensus voting"),
+  quickMode: z110.boolean().default(false).describe("Use 3 agents instead of 7 for faster consensus voting"),
   /**
    * Deadline for EACH stage in milliseconds (min 30s, max 600s), not a budget
    * for the whole run (#6730). Replaces every stage's default, the vote's
    * included; clamped to the `pipeline` class guard.
    */
-  timeoutMs: z109.number().int().min(3e4).max(6e5).optional().describe(
+  timeoutMs: z110.number().int().min(3e4).max(6e5).optional().describe(
     "Max time for EACH stage in ms (30000-600000), not for the whole run; applies to every stage, the vote included. Default: the vote stage gets the multi-LLM panel guard (900000 unless overridden), other stages 120000"
   ),
   /** Stop after planning/voting (no implementation). */
-  dryRun: z109.boolean().default(false).describe("Stop after vote stage (no implementation)"),
+  dryRun: z110.boolean().default(false).describe("Stop after vote stage (no implementation)"),
   /**
    * Dispatch mode (#3730). `sync` (default) runs the pipeline inline and
    * returns the result — but a real multi-stage adaptive run can exceed the
@@ -55357,7 +55488,7 @@ var PipelineInputSchema = z109.object({
    */
   ...asyncDispatchInputDefaultSync("Ignored for dryRun."),
   /** TESTS ONLY — random output, must not be used for real decisions. (#2319) */
-  simulateVotes: z109.boolean().default(false).describe("TESTS ONLY \u2014 random output, must not be used for real decisions (#2319)")
+  simulateVotes: z110.boolean().default(false).describe("TESTS ONLY \u2014 random output, must not be used for real decisions (#2319)")
 });
 function buildOutput3(result, simulated) {
   return {
@@ -55383,14 +55514,14 @@ function buildOutput3(result, simulated) {
     rateLimitHint: result.error?.toLowerCase().includes("rate limit") === true ? "Consider using quickMode or increasing delay between pipeline runs" : void 0
   };
 }
-var VoteEvidenceSchema = z109.object({
-  approvalPercentage: z109.number(),
-  voteRecordId: z109.string().optional()
+var VoteEvidenceSchema = z110.object({
+  approvalPercentage: z110.number(),
+  voteRecordId: z110.string().optional()
 });
-var VoteResultSchema = z109.discriminatedUnion("kind", [
-  VoteEvidenceSchema.extend({ kind: z109.literal("approved") }),
-  VoteEvidenceSchema.extend({ kind: z109.literal("rejected"), feedback: z109.string() }),
-  VoteEvidenceSchema.extend({ kind: z109.literal("no_quorum"), reason: z109.string() })
+var VoteResultSchema = z110.discriminatedUnion("kind", [
+  VoteEvidenceSchema.extend({ kind: z110.literal("approved") }),
+  VoteEvidenceSchema.extend({ kind: z110.literal("rejected"), feedback: z110.string() }),
+  VoteEvidenceSchema.extend({ kind: z110.literal("no_quorum"), reason: z110.string() })
 ]);
 function isVoteResult(value) {
   return VoteResultSchema.safeParse(value).success;
@@ -55492,7 +55623,7 @@ async function executePipelineBody(task, stages, run) {
       detail: output2
     });
   }
-  return structuredToolSuccess(z109.record(z109.string(), z109.unknown()), output2);
+  return structuredToolSuccess(z110.record(z110.string(), z110.unknown()), output2);
 }
 function createPipelineAgentStages(input, config) {
   return createAgentStages({
@@ -55643,9 +55774,9 @@ function cancellableExecutor(strategy, executor, signal) {
 }
 
 // src/mcp/tools/run-tool.ts
-var RunInputSchema = z110.object({
-  goal: z110.string().min(1).describe("Natural-language goal. nexus-agents selects how to execute it."),
-  forceStrategy: z110.enum([
+var RunInputSchema = z111.object({
+  goal: z111.string().min(1).describe("Natural-language goal. nexus-agents selects how to execute it."),
+  forceStrategy: z111.enum([
     "single-shot",
     "dev-pipeline",
     "pipeline",
@@ -55657,10 +55788,10 @@ var RunInputSchema = z110.object({
   ]).optional().describe(
     "Power-user override: force a specific strategy instead of letting the router choose."
   ),
-  requiresConsensus: z110.boolean().optional().describe("Hint: the task needs a multi-perspective consensus decision."),
-  dependencyStructure: z110.enum(["linear", "dag", "independent", "unknown"]).optional().describe("Hint: the dependency structure of the work."),
-  isNovel: z110.boolean().optional().describe("Hint: this kind of task has not been seen before."),
-  execute: z110.boolean().optional().describe(
+  requiresConsensus: z111.boolean().optional().describe("Hint: the task needs a multi-perspective consensus decision."),
+  dependencyStructure: z111.enum(["linear", "dag", "independent", "unknown"]).optional().describe("Hint: the dependency structure of the work."),
+  isNovel: z111.boolean().optional().describe("Hint: this kind of task has not been seen before."),
+  execute: z111.boolean().optional().describe(
     "When true, actually run the selected strategy (if an executor is wired) and return its result; otherwise return the routing decision only (default false, read-only)."
   ),
   /**
@@ -55675,7 +55806,7 @@ var RunInputSchema = z110.object({
    * other, the call is REFUSED rather than executed: silently ignoring a
    * do-not-act flag is the one outcome a governance substrate cannot allow.
    */
-  dryRun: z110.boolean().optional().describe(
+  dryRun: z111.boolean().optional().describe(
     "Plan and vote only, no implementation (#4806). Requires the dev-pipeline strategy \u2014 refused (never silently executed) when the router selects another."
   ),
   /**
@@ -55911,12 +56042,12 @@ function registerRunTool(server, deps) {
 }
 
 // src/mcp/tools/list-available-models-tool.ts
-import { z as z111 } from "zod";
+import { z as z112 } from "zod";
 var DESCRIPTION5 = "Probe every model-discovery transport (OpenRouter API, the configured gateway, and the opencode/claude/codex/gemini CLIs) and report a per-transport health summary: probe ok/failed, model count, and a sample of usable ids. Models with open route breakers are excluded; each CLI reports whether its default-route breaker is open. Use it to validate the CLIs and APIs are wired and reachable. Read-only; does not change routing.";
 var PROBE_TIMEOUT_MS = 12e3;
-var ListAvailableModelsInputSchema = z111.object({
-  includeModelIds: z111.boolean().optional().describe("Include the full model-id list per transport (default false \u2192 sample of 5 only)."),
-  includeOpenRouter: z111.boolean().optional().describe("Probe the OpenRouter live catalog (default true).")
+var ListAvailableModelsInputSchema = z112.object({
+  includeModelIds: z112.boolean().optional().describe("Include the full model-id list per transport (default false \u2192 sample of 5 only)."),
+  includeOpenRouter: z112.boolean().optional().describe("Probe the OpenRouter live catalog (default true).")
 });
 async function probeSource(source, includeModelIds) {
   let timer;
@@ -56025,8 +56156,8 @@ async function listAvailableModelsHandler(args, deps, logger59) {
 function registerListAvailableModelsTool(server, deps) {
   const logger59 = deps.logger ?? createLogger({ tool: "list_available_models" });
   const toolSchema = {
-    includeModelIds: z111.boolean().optional().describe("Include the full model-id list per transport (default false \u2192 sample of 5 only)."),
-    includeOpenRouter: z111.boolean().optional().describe("Probe the OpenRouter live catalog (default true).")
+    includeModelIds: z112.boolean().optional().describe("Include the full model-id list per transport (default false \u2192 sample of 5 only)."),
+    includeOpenRouter: z112.boolean().optional().describe("Probe the OpenRouter live catalog (default true).")
   };
   const secureHandler = createSecureHandler(
     (args) => listAvailableModelsHandler(args, deps, logger59),
@@ -56050,9 +56181,9 @@ function registerListAvailableModelsTool(server, deps) {
 }
 
 // src/mcp/tools/pr-review-eval-types.ts
-import { z as z112 } from "zod";
+import { z as z113 } from "zod";
 var MAX_EVAL_FINDINGS = 100;
-var VoterEvalFindingSchema = z112.object({
+var VoterEvalFindingSchema = z113.object({
   summary: RawFindingSchema.shape.summary,
   location: RawFindingSchema.shape.location,
   severity: RawFindingSchema.shape.severity.unwrap(),
@@ -56060,14 +56191,14 @@ var VoterEvalFindingSchema = z112.object({
   gate: RawFindingSchema.shape.gate.extend({
     named_assertion: RawFindingSchema.shape.claim.min(0)
   }).optional(),
-  verified: z112.boolean().optional(),
-  classification: z112.enum(["TP", "FP", "FN", "excluded"]),
-  source: z112.enum(["voter", "ground_truth"]),
+  verified: z113.boolean().optional(),
+  classification: z113.enum(["TP", "FP", "FN", "excluded"]),
+  source: z113.enum(["voter", "ground_truth"]),
   /** Original index in the voter's raw findings; repeated TP evidence shares it. */
-  findingIndex: z112.number().int().nonnegative().optional(),
-  knownBugIndex: z112.number().int().nonnegative().optional(),
+  findingIndex: z113.number().int().nonnegative().optional(),
+  knownBugIndex: z113.number().int().nonnegative().optional(),
   /** String fields shortened by the producer, never silently truncated. */
-  truncatedFields: z112.array(z112.enum(["summary", "location", "rationale", "gate.named_assertion"])).max(4).optional()
+  truncatedFields: z113.array(z113.enum(["summary", "location", "rationale", "gate.named_assertion"])).max(4).optional()
 });
 var PR_REVIEW_EVAL_ROLES = [
   "architect",
@@ -56076,47 +56207,47 @@ var PR_REVIEW_EVAL_ROLES = [
   "catfish",
   "scope_steward"
 ];
-var PrReviewEvalRoleSchema = z112.enum(PR_REVIEW_EVAL_ROLES);
-var PrReviewCaseClassSchema = z112.enum(["buggy", "clean", "borderline"]);
-var VoterEvalVerdictSchema = z112.object({
+var PrReviewEvalRoleSchema = z113.enum(PR_REVIEW_EVAL_ROLES);
+var PrReviewCaseClassSchema = z113.enum(["buggy", "clean", "borderline"]);
+var VoterEvalVerdictSchema = z113.object({
   /** Stable record id (e.g. `${runId}:${caseNumber}:${role}`). */
-  id: z112.string().min(1).max(160),
+  id: z113.string().min(1).max(160),
   /** The pr_review run / batch this verdict belongs to. */
-  runId: z112.string().min(1).max(64),
+  runId: z113.string().min(1).max(64),
   /** Dataset case identifier (the dataset's `number` field). */
-  caseNumber: z112.string().min(1).max(80),
+  caseNumber: z113.string().min(1).max(80),
   /** Rubric class of the case (ground-truth label). */
   caseClass: PrReviewCaseClassSchema,
   /** The voter role being scored. */
   role: PrReviewEvalRoleSchema,
   /** Verified findings that matched a known bug. */
-  truePositives: z112.number().int().nonnegative(),
+  truePositives: z113.number().int().nonnegative(),
   /** Verified findings on clean code that matched no known bug. */
-  falsePositives: z112.number().int().nonnegative(),
+  falsePositives: z113.number().int().nonnegative(),
   /** Known bugs this voter failed to flag. */
-  falseNegatives: z112.number().int().nonnegative(),
+  falseNegatives: z113.number().int().nonnegative(),
   /** Optional for legacy records/count-only callers; [] means measured, no evidence. */
-  findings: z112.array(VoterEvalFindingSchema).max(MAX_EVAL_FINDINGS).optional(),
+  findings: z113.array(VoterEvalFindingSchema).max(MAX_EVAL_FINDINGS).optional(),
   /** Number of evidence entries omitted at the cap; full tallies are unchanged. */
-  findingsTruncated: z112.number().int().nonnegative().optional(),
+  findingsTruncated: z113.number().int().nonnegative().optional(),
   /** Rubric version the ground truth was adjudicated under. */
-  rubricVersion: z112.string().min(1).max(32),
+  rubricVersion: z113.string().min(1).max(32),
   /** ISO-8601 timestamp the verdict was recorded. */
-  timestamp: z112.string().min(1).max(40)
+  timestamp: z113.string().min(1).max(40)
 });
-var VoterEvalVerdictQuerySchema = z112.object({
+var VoterEvalVerdictQuerySchema = z113.object({
   role: PrReviewEvalRoleSchema.optional(),
-  runId: z112.string().min(1).max(64).optional(),
+  runId: z113.string().min(1).max(64).optional(),
   caseClass: PrReviewCaseClassSchema.optional(),
-  rubricVersion: z112.string().min(1).max(32).optional(),
+  rubricVersion: z113.string().min(1).max(32).optional(),
   /** ISO-8601 lower bound (inclusive) on `timestamp`. */
-  since: z112.string().optional(),
+  since: z113.string().optional(),
   /** Most-recent-N cap. */
-  limit: z112.number().int().positive().optional()
+  limit: z113.number().int().positive().optional()
 });
 
 // src/mcp/tools/supply-chain-tradeoff-panel.ts
-import { z as z113 } from "zod";
+import { z as z114 } from "zod";
 import { randomUUID as randomUUID20 } from "node:crypto";
 var DEFAULT_AXES = [
   "build_time_determinism",
@@ -56138,16 +56269,16 @@ var FULL_PANEL = [
   "scope_steward"
 ];
 var QUICK_PANEL = ["architect", "security", "scope_steward"];
-var SupplyChainTradeoffPanelInputSchema = z113.object({
-  proposal: z113.string().min(1).max(MAX_PROPOSAL_LENGTH).describe('The proposal under tradeoff review (e.g. "Should aegis-boot adopt cargo-nextest?")'),
-  axes: z113.array(z113.string().min(1).max(MAX_AXIS_NAME_LENGTH)).min(1).max(MAX_AXES).optional().describe(
+var SupplyChainTradeoffPanelInputSchema = z114.object({
+  proposal: z114.string().min(1).max(MAX_PROPOSAL_LENGTH).describe('The proposal under tradeoff review (e.g. "Should aegis-boot adopt cargo-nextest?")'),
+  axes: z114.array(z114.string().min(1).max(MAX_AXIS_NAME_LENGTH)).min(1).max(MAX_AXES).optional().describe(
     `Tradeoff axes to evaluate. Default: ${DEFAULT_AXES.join(", ")}. Custom axes accepted; max ${String(MAX_AXES)}.`
   ),
-  context: z113.string().max(MAX_CONTEXT_LENGTH).optional().describe(
+  context: z114.string().max(MAX_CONTEXT_LENGTH).optional().describe(
     "Optional context: relevant repo state, dependency tree, vendor publishing patterns, etc."
   ),
-  quickMode: z113.boolean().optional().default(false).describe("Use 3 voters (architect, security, scope_steward) instead of 7"),
-  simulate: z113.boolean().optional().default(false).describe("Use simulated voters (testing only)"),
+  quickMode: z114.boolean().optional().default(false).describe("Use 3 voters (architect, security, scope_steward) instead of 7"),
+  simulate: z114.boolean().optional().default(false).describe("Use simulated voters (testing only)"),
   // #6123: same field as consensus_vote — the panel judges the caller's project.
   project: VoterProjectInputSchema,
   /**
@@ -56769,40 +56900,40 @@ var RiskLevel = /* @__PURE__ */ ((RiskLevel2) => {
 })(RiskLevel || {});
 
 // src/mcp/safety/stpa-schemas.ts
-import { z as z114 } from "zod";
-var HazardCategorySchema = z114.enum(HazardCategory);
-var HazardSeveritySchema = z114.enum(HazardSeverity);
-var ConstraintPrioritySchema = z114.enum(ConstraintPriority);
-var RiskLevelSchema = z114.enum(RiskLevel);
-var TriggerPatternSchema = z114.object({
-  parameter: z114.string().min(1),
-  matchType: z114.enum(["contains", "regex", "equals", "startsWith", "endsWith"]),
-  pattern: z114.string(),
-  reason: z114.string()
+import { z as z115 } from "zod";
+var HazardCategorySchema = z115.enum(HazardCategory);
+var HazardSeveritySchema = z115.enum(HazardSeverity);
+var ConstraintPrioritySchema = z115.enum(ConstraintPriority);
+var RiskLevelSchema = z115.enum(RiskLevel);
+var TriggerPatternSchema = z115.object({
+  parameter: z115.string().min(1),
+  matchType: z115.enum(["contains", "regex", "equals", "startsWith", "endsWith"]),
+  pattern: z115.string(),
+  reason: z115.string()
 });
-var HazardSchema = z114.object({
-  id: z114.string().min(1),
-  description: z114.string(),
+var HazardSchema = z115.object({
+  id: z115.string().min(1),
+  description: z115.string(),
   category: HazardCategorySchema,
   severity: HazardSeveritySchema,
-  likelihood: z114.enum(["almost_certain", "likely", "possible", "unlikely", "rare"]),
-  triggerConditions: z114.array(z114.string()),
-  consequences: z114.array(z114.string())
+  likelihood: z115.enum(["almost_certain", "likely", "possible", "unlikely", "rare"]),
+  triggerConditions: z115.array(z115.string()),
+  consequences: z115.array(z115.string())
 });
-var UnsafeControlActionSchema = z114.object({
-  id: z114.string().min(1),
-  toolName: z114.string().min(1),
-  type: z114.enum(["not_provided", "provided_causes_hazard", "wrong_timing", "wrong_duration"]),
-  description: z114.string(),
-  unsafeContext: z114.string(),
-  relatedHazards: z114.array(z114.string()),
-  triggerPatterns: z114.array(TriggerPatternSchema).optional()
+var UnsafeControlActionSchema = z115.object({
+  id: z115.string().min(1),
+  toolName: z115.string().min(1),
+  type: z115.enum(["not_provided", "provided_causes_hazard", "wrong_timing", "wrong_duration"]),
+  description: z115.string(),
+  unsafeContext: z115.string(),
+  relatedHazards: z115.array(z115.string()),
+  triggerPatterns: z115.array(TriggerPatternSchema).optional()
 });
-var SafetyConstraintSchema = z114.object({
-  id: z114.string().min(1),
-  description: z114.string(),
-  mitigates: z114.array(z114.string()),
-  enforcement: z114.enum([
+var SafetyConstraintSchema = z115.object({
+  id: z115.string().min(1),
+  description: z115.string(),
+  mitigates: z115.array(z115.string()),
+  enforcement: z115.enum([
     "prevent",
     "require_confirmation",
     "alert",
@@ -56810,52 +56941,52 @@ var SafetyConstraintSchema = z114.object({
     "rate_limit",
     "require_privilege"
   ]),
-  validationFunction: z114.string().optional(),
+  validationFunction: z115.string().optional(),
   priority: ConstraintPrioritySchema
 });
-var PropertySchemaSchema = z114.object({
-  type: z114.string(),
-  description: z114.string().optional(),
-  enum: z114.array(z114.unknown()).optional(),
-  pattern: z114.string().optional(),
-  minimum: z114.number().optional(),
-  maximum: z114.number().optional()
+var PropertySchemaSchema = z115.object({
+  type: z115.string(),
+  description: z115.string().optional(),
+  enum: z115.array(z115.unknown()).optional(),
+  pattern: z115.string().optional(),
+  minimum: z115.number().optional(),
+  maximum: z115.number().optional()
 });
-var ToolInputSchemaSchema = z114.object({
-  type: z114.string(),
-  properties: z114.record(z114.string(), PropertySchemaSchema).optional(),
-  required: z114.array(z114.string()).optional(),
-  additionalProperties: z114.boolean().optional()
+var ToolInputSchemaSchema = z115.object({
+  type: z115.string(),
+  properties: z115.record(z115.string(), PropertySchemaSchema).optional(),
+  required: z115.array(z115.string()).optional(),
+  additionalProperties: z115.boolean().optional()
 });
-var ToolDefinitionSchema = z114.object({
-  name: z114.string().min(1),
-  description: z114.string(),
+var ToolDefinitionSchema = z115.object({
+  name: z115.string().min(1),
+  description: z115.string(),
   inputSchema: ToolInputSchemaSchema
 });
-var AnalysisConfigurationSchema = z114.object({
-  includeLowSeverity: z114.boolean().default(true),
-  generateAllConstraints: z114.boolean().default(true),
-  checkInteractions: z114.boolean().default(true),
-  maxHazardsPerTool: z114.number().int().min(1).max(100).default(50),
-  categories: z114.array(HazardCategorySchema).default([])
+var AnalysisConfigurationSchema = z115.object({
+  includeLowSeverity: z115.boolean().default(true),
+  generateAllConstraints: z115.boolean().default(true),
+  checkInteractions: z115.boolean().default(true),
+  maxHazardsPerTool: z115.number().int().min(1).max(100).default(50),
+  categories: z115.array(HazardCategorySchema).default([])
 });
-var ConstraintViolationSchema = z114.object({
-  constraintId: z114.string().min(1),
-  constraintDescription: z114.string(),
+var ConstraintViolationSchema = z115.object({
+  constraintId: z115.string().min(1),
+  constraintDescription: z115.string(),
   severity: HazardSeveritySchema,
-  details: z114.string(),
-  remediation: z114.string()
+  details: z115.string(),
+  remediation: z115.string()
 });
-var ValidationWarningSchema = z114.object({
-  code: z114.string().min(1),
-  message: z114.string(),
-  affected: z114.string()
+var ValidationWarningSchema = z115.object({
+  code: z115.string().min(1),
+  message: z115.string(),
+  affected: z115.string()
 });
-var ValidationResultSchema = z114.object({
-  valid: z114.boolean(),
-  toolName: z114.string().min(1),
-  violations: z114.array(ConstraintViolationSchema),
-  passed: z114.array(z114.string()),
+var ValidationResultSchema = z115.object({
+  valid: z115.boolean(),
+  toolName: z115.string().min(1),
+  violations: z115.array(ConstraintViolationSchema),
+  passed: z115.array(z115.string()),
   // Optional rather than required, deliberately. `ValidationResult` declares
   // both fields required because every result this package produces has them;
   // the schema is the lenient inbound edge for a result that arrived from
@@ -56866,10 +56997,10 @@ var ValidationResultSchema = z114.object({
   // "nothing was evaluated". The strict/lenient split is safe because nothing
   // bridges the two with `z.infer`: a parsed result will not typecheck as a
   // `ValidationResult` without handling the absent fields.
-  evaluated: z114.array(z114.string()).optional(),
-  notApplicable: z114.array(z114.string()).optional(),
-  warnings: z114.array(ValidationWarningSchema),
-  validatedAt: z114.date()
+  evaluated: z115.array(z115.string()).optional(),
+  notApplicable: z115.array(z115.string()).optional(),
+  warnings: z115.array(ValidationWarningSchema),
+  validatedAt: z115.date()
 });
 
 // src/mcp/safety/stpa-types.ts
@@ -57954,18 +58085,18 @@ var GeminiResponseParser = class {
 };
 
 // src/cli-adapters/router-types.ts
-import { z as z115 } from "zod";
-var RouterConfigSchema = z115.object({
-  preferCostEfficient: z115.boolean().default(false)
+import { z as z116 } from "zod";
+var RouterConfigSchema = z116.object({
+  preferCostEfficient: z116.boolean().default(false)
 });
 
 // src/cli-adapters/task-classifier.ts
-import { z as z116 } from "zod";
-var ClassificationPatternsSchema = z116.object({
-  code: z116.array(z116.string()).readonly(),
-  research: z116.array(z116.string()).readonly(),
-  documentation: z116.array(z116.string()).readonly(),
-  analysis: z116.array(z116.string()).readonly()
+import { z as z117 } from "zod";
+var ClassificationPatternsSchema = z117.object({
+  code: z117.array(z117.string()).readonly(),
+  research: z117.array(z117.string()).readonly(),
+  documentation: z117.array(z117.string()).readonly(),
+  analysis: z117.array(z117.string()).readonly()
 });
 
 // src/security/sandbox/sandbox-types.ts
@@ -59343,4 +59474,4 @@ export {
   initializeSandbox,
   getSandboxMode
 };
-//# sourceMappingURL=chunk-CI3FOOUF.js.map
+//# sourceMappingURL=chunk-TH3MSFDF.js.map