nexus-agents 14.0.1 → 14.0.2

package/dist/cli.js

@@ -16,10 +16,10 @@ import {
   symbols,
   writeEmptyLine,
   writeLine
-} from "./chunk-MO7WRW77.js";
+} from "./chunk-MQSSTTZU.js";
 import {
   runConfigInitSync
-} from "./chunk-RTO52ZBC.js";
+} from "./chunk-GPZQVYKV.js";
 import {
   CATEGORY_DISPLAY_NAMES,
   DEFAULT_PR_REVIEW_CONFIG,
@@ -40,8 +40,8 @@ import {
   parseExpertReview,
   reviewPostingBlock,
   sumFindings
-} from "./chunk-UW54ACTR.js";
-import "./chunk-UZ3KUNPN.js";
+} from "./chunk-LE6TQVXF.js";
+import "./chunk-LC34UPDQ.js";
 import {
   COMMAND_CATALOG,
   EXIT_CODES,
@@ -56,7 +56,7 @@ import {
   renderHelp,
   resolveDefaultModelAdapter,
   wireGateway
-} from "./chunk-HFYXNFXG.js";
+} from "./chunk-TYIIAIXA.js";
 import {
   detectCliBinary,
   detectionRecoveryHint,
@@ -203,8 +203,8 @@ import {
   validateWorkflow,
   withPanelWorkspace,
   wrapInMarkdownFence
-} from "./chunk-PEVU52PM.js";
-import "./chunk-NZDRN4NL.js";
+} from "./chunk-YSEMHACQ.js";
+import "./chunk-H6SGSQJM.js";
 import {
   fenceExternalContent,
   formatDiffs
@@ -225,14 +225,14 @@ import {
   recordVoteDecisionCost,
   registerConsensusVoteTool,
   toRecordDecision
-} from "./chunk-2AWX7DYU.js";
+} from "./chunk-SNSV6GGV.js";
 import {
   allOf,
   anyOf
 } from "./chunk-EZNIYU5T.js";
 import {
   synthesizeResearch
-} from "./chunk-IT5TIGRD.js";
+} from "./chunk-SQPFJLCI.js";
 import {
   DRAFT_REPLY_BODY_MAX_LENGTH,
   configureUntrustedInputFirewall,
@@ -243,7 +243,7 @@ import {
   runUntrustedInputFirewall,
   validateActionCorroboration,
   validateAgentAction
-} from "./chunk-4IKJME6O.js";
+} from "./chunk-YE3T4X2U.js";
 import {
   ReputationCache,
   sanitizeInput
@@ -267,7 +267,7 @@ import {
   renderPlanAsResearch,
   runImprovementReview,
   scanForSecrets
-} from "./chunk-IUQWX4N2.js";
+} from "./chunk-Q6R3JTXH.js";
 import {
   NODE_ENGINE_RANGE,
   VERSION,
@@ -281,11 +281,11 @@ import {
   stagePolicyFirewallForRollout,
   toSdkCallback,
   wrapToolWithTimeout
-} from "./chunk-SVGX2YBK.js";
+} from "./chunk-MFUJU7RO.js";
 import "./chunk-KMGKOF5P.js";
 import "./chunk-4GDMHCKX.js";
 import "./chunk-I2THTVA4.js";
-import "./chunk-VSVDAN2A.js";
+import "./chunk-VH4T4O5L.js";
 import {
   CodebaseIndexSchema,
   PaperStatusSchema,
@@ -312,25 +312,25 @@ import {
   loadSourcesRegistry,
   rankDiscoveredItems,
   saveSourcesRegistry
-} from "./chunk-O3D6HEXJ.js";
+} from "./chunk-DXDKAVWV.js";
 import {
   loadPapersRegistry,
   loadTechniquesRegistry,
   savePapersRegistry
-} from "./chunk-MWPS5QGR.js";
+} from "./chunk-PQ3V2SYP.js";
 import {
   getTsMorph
 } from "./chunk-W654ME6B.js";
 import {
   resolveToken
-} from "./chunk-IMRAE2LB.js";
+} from "./chunk-CZSEUZFE.js";
 import {
   MemoryError,
   configureToolMemory,
   shutdownToolMemory
-} from "./chunk-IXL2W6E3.js";
+} from "./chunk-236T3AOZ.js";
 import "./chunk-RGB5OTRZ.js";
-import "./chunk-O6SI3EVF.js";
+import "./chunk-FEAWCZ7E.js";
 import "./chunk-BFO2NZPO.js";
 import {
   BUILT_IN_EXPERTS
@@ -340,7 +340,7 @@ import {
 } from "./chunk-MZWHXERV.js";
 import {
   shutdownExpertBridge
-} from "./chunk-TG23XP5G.js";
+} from "./chunk-PG6NTUTS.js";
 import {
   CODEX_MCP_SERVER_UNAVAILABLE_REASON,
   Client,
@@ -354,7 +354,7 @@ import {
   createUnifiedRegistry,
   getAvailableClis,
   getGlobalRegistry
-} from "./chunk-L2JOGUR3.js";
+} from "./chunk-GDCIDLUF.js";
 import {
   CUSTOM_API_DEFAULT_MODEL,
   DEFAULTS
@@ -367,20 +367,20 @@ import {
 } from "./chunk-EBKVMMWA.js";
 import {
   ensureGatewayDiscovered
-} from "./chunk-P4L4CEJX.js";
+} from "./chunk-B5RDZLU3.js";
 import {
   createOpenAIAdapter,
   discoverModels,
   readOpenAICompatEndpoint,
   readOpenAICompatEnv
-} from "./chunk-K7JTBFP3.js";
+} from "./chunk-OQR2C64M.js";
 import {
   hostnameOf
-} from "./chunk-OFC642UR.js";
+} from "./chunk-P3CFDAW5.js";
 import {
   CODEX_LEGACY_LANDLOCK_CONFIG,
   codexSandboxPreflight
-} from "./chunk-CZVV33JI.js";
+} from "./chunk-TV6RX3ZL.js";
 import "./chunk-ZI6OOIEI.js";
 import "./chunk-RARMDUSM.js";
 import "./chunk-ROYGBFVE.js";
@@ -390,18 +390,18 @@ import {
 } from "./chunk-JZYTBKAP.js";
 import {
   SERVES_PROBE_PROMPT
-} from "./chunk-QSABRS3I.js";
+} from "./chunk-LBVPKHHU.js";
 import {
   ClaudeCliAdapter,
   IN_FAMILY_FALLBACK_OPTION
-} from "./chunk-2UWQ2GEG.js";
+} from "./chunk-KXWLZDQR.js";
 import {
   NEXUS_SUBPROCESS_DEPTH_ENV,
   readSubprocessDepth,
   signalTrackedProcessTreesAsync
-} from "./chunk-IIUEAOTT.js";
-import "./chunk-OAX3TSGU.js";
-import "./chunk-TKF3X3RI.js";
+} from "./chunk-GR4BMQAS.js";
+import "./chunk-DCPN7F5J.js";
+import "./chunk-HJJRUYNR.js";
 import "./chunk-JHTL4P4L.js";
 import {
   AgentCapability,
@@ -486,7 +486,7 @@ import {
   toError,
   truncateText,
   warmStartBandit
-} from "./chunk-2FOPXY3L.js";
+} from "./chunk-IZSJWIHK.js";
 import "./chunk-XBEKMUTO.js";
 import {
   findInTreeByCli,
@@ -498,13 +498,13 @@ import {
   getDefaultModelForCli,
   getInTreeCapabilitiesMatrix,
   lookupInTreeCapability
-} from "./chunk-OVVJGCB7.js";
+} from "./chunk-5QNWRC7B.js";
 import {
   DEFAULT_MODEL_PER_CLI,
   getDefaultRegistry,
   normaliseModelId,
   resolveModelIdentitySync
-} from "./chunk-V3X7QGN3.js";
+} from "./chunk-JV3UBRRA.js";
 import {
   getLearningDir,
   getOutcomesFile,
@@ -1922,7 +1922,7 @@ async function doctorCommand(options = {}) {
   options.onResult?.(result);
   printDoctorResults(result, void 0, options.deferSummary === true);
   if (options.gateway === true || options.probe === true) {
-    const { formatGatewayReport } = await import("./doctor-gateway-report-DPTKEJA7.js");
+    const { formatGatewayReport } = await import("./doctor-gateway-report-GMYX62JU.js");
     for (const line of formatGatewayReport(result.gateway, result.clis)) {
       process.stdout.write(line + "\n");
     }
@@ -1947,7 +1947,7 @@ async function runDoctorFix(result) {
     if (outcome.counted) fixCount++;
   }
   if (!result.configFile.found) {
-    const { runConfigInitSync: runConfigInitSync2 } = await import("./setup-config-E3TNM4HV.js");
+    const { runConfigInitSync: runConfigInitSync2 } = await import("./setup-config-47NNRD4E.js");
     const configResult = runConfigInitSync2(process.cwd(), false, false);
     if (configResult.success && configResult.created) {
       writeLine6(`\u2713 Generated config: ${configResult.path}`);
@@ -4592,11 +4592,11 @@ function calculateSummary(results) {
     totalConfidence += result.confidence;
     totalEvidence += result.evidenceQuality;
   }
-  const count = results.length || 1;
+  const count2 = results.length || 1;
   return {
     ...counts,
-    averageConfidence: totalConfidence / count,
-    averageEvidenceQuality: totalEvidence / count
+    averageConfidence: totalConfidence / count2,
+    averageEvidenceQuality: totalEvidence / count2
   };
 }
 function parseOptions(args) {
@@ -5173,7 +5173,7 @@ Provide a structured review with:
    * (Source: Issue #828 — Wire policy gate into production pipeline)
    */
   async postReviewToGitHub(provider, pr, result, context) {
-    const { formatReviewComment: formatReviewComment2 } = await import("./pr-reviewer-helpers-NQ3YK7PL.js");
+    const { formatReviewComment: formatReviewComment2 } = await import("./pr-reviewer-helpers-KGGKESLT.js");
     const formattedBody = formatReviewComment2(result);
     const body = truncateText(formattedBody, DRAFT_REPLY_BODY_MAX_LENGTH, "\u2026[review truncated]");
     const sources = buildReviewCitations(pr.files);
@@ -5375,6 +5375,26 @@ function safeExecSandboxed(commandString, options = {}) {
     return null;
   }
 }
+function execSandboxed(commandString, options = {}) {
+  const violation = validateCommandWithPolicy(commandString, options);
+  if (violation !== null) {
+    const msg = `Sandbox policy denied: ${violation.reason}`;
+    logger6.warn(msg, { command: commandString });
+    throw new Error(msg);
+  }
+  const execOptions = {
+    encoding: "utf-8",
+    stdio: ["pipe", "pipe", "pipe"]
+  };
+  if (options.cwd !== void 0) {
+    execOptions.cwd = options.cwd;
+  }
+  if (options.stdin !== void 0) {
+    execOptions.input = options.stdin;
+  }
+  const result = execSync(commandString, execOptions);
+  return typeof result === "string" ? result.trim() : result.toString("utf-8").trim();
+}
 
 // src/cli/review-demo-helpers.ts
 var GITHUB_API_TIMEOUT_MS = API_TIMEOUTS.githubApiMs;
@@ -7462,8 +7482,8 @@ async function handlePrune(args, log, flags) {
   if (!result.ok) {
     throw new Error(result.error.message);
   }
-  const count = String(result.value);
-  output(dryRun ? "Would delete " + count + " sessions." : "Deleted " + count + " sessions.");
+  const count2 = String(result.value);
+  output(dryRun ? "Would delete " + count2 + " sessions." : "Deleted " + count2 + " sessions.");
 }
 async function sessionCommand(subcommand, args, logger22, flags = {}) {
   const log = logger22 ?? createLogger({ component: "SessionCommand" });
@@ -7481,6 +7501,81 @@ async function sessionCommand(subcommand, args, logger22, flags = {}) {
 import * as fs5 from "node:fs";
 import * as path4 from "node:path";
 
+// src/cli/system-review-audit.ts
+import { z as z2 } from "zod";
+var MAX_AUDIT_OUTPUT_BYTES = 1024 * 1024;
+var count = z2.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
+var reportSchema = z2.object({
+  error: z2.never().optional(),
+  errors: z2.never().optional(),
+  metadata: z2.object({
+    vulnerabilities: z2.object({
+      info: count,
+      low: count,
+      moderate: count,
+      high: count,
+      critical: count,
+      total: count.optional()
+    }).strict()
+  })
+});
+function unavailable(reason, exitCode) {
+  return { status: "unmeasured", reason, ...exitCode === void 0 ? {} : { exitCode } };
+}
+function knownExitCode(value) {
+  return typeof value === "number" && Number.isInteger(value) && value >= 0 && value <= 255 ? value : void 0;
+}
+function wasTerminated(error) {
+  const signal = "signal" in error && error.signal !== void 0 && error.signal !== null;
+  const killed = "killed" in error && error.killed !== void 0 && error.killed !== false;
+  return signal || killed;
+}
+function hasExecutionErrorCode(error) {
+  return "code" in error && error.code !== void 0 && error.code !== 1;
+}
+function readFindingsOutput(error) {
+  const exitCode = knownExitCode("status" in error ? error.status : void 0);
+  if (exitCode !== 1 || wasTerminated(error) || hasExecutionErrorCode(error)) {
+    return unavailable("execution-failed", exitCode);
+  }
+  if (!("stdout" in error) || typeof error.stdout !== "string") {
+    return unavailable("execution-failed", exitCode);
+  }
+  return { stdout: error.stdout, exitCode };
+}
+function readExecution(execution) {
+  if (typeof execution === "string") return { stdout: execution, exitCode: 0 };
+  if (execution === void 0 || execution === null) return unavailable("missing-output");
+  return typeof execution === "object" ? readFindingsOutput(execution) : unavailable("execution-failed");
+}
+function isConsistentTotal(computed, reported) {
+  return Number.isSafeInteger(computed) && (reported === void 0 || reported === computed);
+}
+function parsePnpmAuditResult(execution) {
+  const completed = readExecution(execution);
+  if ("status" in completed) return completed;
+  const { stdout, exitCode } = completed;
+  if (Buffer.byteLength(stdout, "utf8") > MAX_AUDIT_OUTPUT_BYTES) {
+    return unavailable("output-too-large", exitCode);
+  }
+  if (stdout.trim() === "") return unavailable("missing-output", exitCode);
+  let raw;
+  try {
+    raw = JSON.parse(stdout);
+  } catch {
+    return unavailable("invalid-json", exitCode);
+  }
+  const parsed = reportSchema.safeParse(raw);
+  if (!parsed.success) return unavailable("invalid-counts", exitCode);
+  const { total: reportedTotal, ...counts } = parsed.data.metadata.vulnerabilities;
+  const total = counts.info + counts.low + counts.moderate + counts.high + counts.critical;
+  if (!isConsistentTotal(total, reportedTotal)) {
+    return unavailable("invalid-counts", exitCode);
+  }
+  if (exitCode === 1 && total === 0) return unavailable("inconsistent-report", exitCode);
+  return { status: "measured", exitCode, counts: { ...counts, total } };
+}
+
 // src/cli/system-review-types.ts
 var SYSTEM_REVIEW_CONSTANTS = {
   /** Time thresholds */
@@ -7535,7 +7630,7 @@ function calculateHealthScore(r) {
   for (const d of r.docs) {
     score -= d.status === "stale" ? DOC_STALE_PENALTY : d.status === "review" ? DOC_REVIEW_PENALTY : 0;
   }
-  score -= r.security.parseError === true ? SECURITY_UNMEASURED_PENALTY : r.security.high * SECURITY_HIGH_PENALTY + r.security.moderate * SECURITY_MODERATE_PENALTY;
+  score -= r.security.parseError === true ? SECURITY_UNMEASURED_PENALTY : (r.security.high + (r.security.critical ?? 0)) * SECURITY_HIGH_PENALTY + r.security.moderate * SECURITY_MODERATE_PENALTY;
   if (!r.quality.typecheckPass) score -= TYPECHECK_FAIL_PENALTY;
   if (!r.quality.lintPass) score -= LINT_FAIL_PENALTY;
   if (r.quality.coveragePercent !== null && r.quality.coveragePercent < COVERAGE_TARGET_PERCENT) {
@@ -7581,13 +7676,16 @@ function printPhase4(s) {
   writeLine(`${colors.cyan}Phase 4: Security Audit${colors.reset}
 `);
   if (s.parseError === true) {
-    writeLine(`  ${formatStatus("warn")} Unmeasured \u2014 the audit did not run`);
+    writeLine(`  ${formatStatus("warn")} Unmeasured \u2014 the audit did not produce a usable result`);
     writeLine("");
     return;
   }
   if (s.totalVulns === 0) {
     writeLine(`  ${formatStatus("pass")} No vulnerabilities found`);
   } else {
+    if ((s.critical ?? 0) > 0)
+      writeLine(`  ${formatStatus("fail")} Critical: ${String(s.critical)}`);
+    if ((s.info ?? 0) > 0) writeLine(`  ${formatStatus("pass")} Info: ${String(s.info)}`);
     if (s.high > 0) writeLine(`  ${formatStatus("fail")} High: ${String(s.high)}`);
     if (s.moderate > 0) writeLine(`  ${formatStatus("warn")} Moderate: ${String(s.moderate)}`);
     if (s.low > 0) writeLine(`  ${formatStatus("pass")} Low: ${String(s.low)}`);
@@ -7612,7 +7710,12 @@ function formatDocRow(d) {
   return `| ${d.file} | ${String(d.daysSinceUpdate)} | ${statusIcon}${newerInfo} |`;
 }
 function formatSecurityCaveat(s) {
-  return s.parseError === true ? "> **Unmeasured:** the audit did not run \u2014 the counts below are defaults, not findings.\n\n" : "";
+  return s.parseError === true ? "> **Unmeasured:** the audit did not produce a usable result \u2014 the counts below are defaults, not findings.\n\n" : "";
+}
+function formatAdditionalSeverities(s) {
+  return (s.critical === void 0 ? "" : `- Critical: ${String(s.critical)}
+`) + (s.info === void 0 ? "" : `- Info: ${String(s.info)}
+`);
 }
 function createIssueBody(r) {
   const now = new Date(getTimeProvider().now());
@@ -7648,7 +7751,7 @@ ${r.docs.map(formatDocRow).join("\n")}
 
 ### Phase 4: Security
 
-${formatSecurityCaveat(r.security)}- High: ${String(r.security.high)}
+${formatSecurityCaveat(r.security)}${formatAdditionalSeverities(r.security)}- High: ${String(r.security.high)}
 - Moderate: ${String(r.security.moderate)}
 - Low: ${String(r.security.low)}
 
@@ -7936,9 +8039,9 @@ var {
   NOT_STARTED_TECHNIQUE_THRESHOLD,
   HEALTH_SCORE_WARN_THRESHOLD: HEALTH_SCORE_WARN_THRESHOLD2
 } = SYSTEM_REVIEW_CONSTANTS;
-function safeExec(command, cwd, allowNonZeroExit = false) {
+function safeExec(command, cwd) {
   const context = command.startsWith("gh ") ? "gh" : command.startsWith("git ") ? "git" : command.startsWith("pnpm ") ? "write" : "read";
-  return cwd !== void 0 ? safeExecSandboxed(command, { context, cwd, allowNonZeroExit }) : safeExecSandboxed(command, { context, allowNonZeroExit });
+  return cwd !== void 0 ? safeExecSandboxed(command, { context, cwd }) : safeExecSandboxed(command, { context });
 }
 function parseGhIssueList(json, context) {
   try {
@@ -8013,30 +8116,19 @@ function runPhase3() {
   return { openCount, staleCount, byLabel };
 }
 function runPhase4(projectRoot) {
-  const def = { totalVulns: 0, high: 0, moderate: 0, low: 0, parseError: false };
-  const out = safeExec("pnpm audit --json", projectRoot, true);
-  if (out === null) {
-    logger10.warn("pnpm audit command failed or returned null", { projectRoot });
-    return { ...def, parseError: true };
-  }
+  let execution;
   try {
-    const a = JSON.parse(out);
-    const m = a.metadata?.vulnerabilities ?? {};
-    return {
-      totalVulns: m.total ?? 0,
-      high: m.high ?? 0,
-      moderate: m.moderate ?? 0,
-      low: m.low ?? 0,
-      parseError: false
-    };
+    execution = execSandboxed("pnpm audit --json", { context: "write", cwd: projectRoot });
   } catch (error) {
-    const message = getErrorMessage(error);
-    logger10.warn("Failed to parse pnpm audit JSON", {
-      error: message,
-      outputPreview: out.slice(0, 200)
-    });
-    return { ...def, parseError: true };
+    execution = error;
+  }
+  const audit = parsePnpmAuditResult(execution);
+  if (audit.status === "unmeasured") {
+    logger10.warn("Security audit is unmeasured", { reason: audit.reason, exitCode: audit.exitCode });
+    return { totalVulns: 0, info: 0, critical: 0, high: 0, moderate: 0, low: 0, parseError: true };
   }
+  const { total: totalVulns, ...counts } = audit.counts;
+  return { totalVulns, ...counts, parseError: false };
 }
 function runPhase5(projectRoot) {
   const tc = safeExec("pnpm typecheck", projectRoot);
@@ -8068,12 +8160,16 @@ function getQualityItems(q) {
 }
 function getSecurityItems(security) {
   if (security.parseError === true) {
-    return ["WARNING: Security audit parsing failed - verify pnpm audit manually"];
+    return ["WARNING: Security audit is unmeasured - verify pnpm audit manually"];
+  }
+  const items = [];
+  if ((security.critical ?? 0) > 0) {
+    items.push(`Address ${String(security.critical)} critical-severity vulnerabilities`);
   }
   if (security.high > 0) {
-    return [`Address ${String(security.high)} high-severity vulnerabilities`];
+    items.push(`Address ${String(security.high)} high-severity vulnerabilities`);
   }
-  return [];
+  return items;
 }
 function getStaleDocItems(docs) {
   const items = [];
@@ -8175,8 +8271,8 @@ function fallbackLabel({ role, fallback, toCli, toModel }) {
   const to = inFamily ? toModel ?? toCli : toCli;
   return `${role}: ${from}\u2192${to}, ${fallback.reason}`;
 }
-function seatCount(count, label) {
-  return count === 0 ? "" : `${String(count)} ${count === 1 ? "seat" : "seats"} ${label}`;
+function seatCount(count2, label) {
+  return count2 === 0 ? "" : `${String(count2)} ${count2 === 1 ? "seat" : "seats"} ${label}`;
 }
 function modelsLine(votes) {
   const { distinctModels, distinctFamilies, unclassifiedSeats, unresolvedSeats, fallbacks } = panelDiversityOf(votes);
@@ -8680,7 +8776,7 @@ ${colors.bold}Nexus Agents Consensus Vote${colors.reset}`);
 }
 
 // src/cli/issue-command.ts
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 
 // src/cli/issue-template-definitions.ts
 var FEAT_TEMPLATE = {
@@ -8997,12 +9093,12 @@ function generateTemplateBody(type) {
 }
 
 // src/cli/issue-command.ts
-var GhIssueJsonSchema = z2.object({
-  number: z2.number(),
-  title: z2.string(),
-  body: z2.string().nullable(),
-  state: z2.string(),
-  labels: z2.array(z2.object({ name: z2.string() }))
+var GhIssueJsonSchema = z3.object({
+  number: z3.number(),
+  title: z3.string(),
+  body: z3.string().nullable(),
+  state: z3.string(),
+  labels: z3.array(z3.object({ name: z3.string() }))
 });
 function fetchGitHubIssue(issueNumber) {
   let output2;
@@ -9669,8 +9765,8 @@ import * as path7 from "node:path";
 import * as yaml3 from "yaml";
 
 // src/research/research-schemas.ts
-import { z as z3 } from "zod";
-var ResearchTopicSchema = z3.string().min(1);
+import { z as z4 } from "zod";
+var ResearchTopicSchema = z4.string().min(1);
 var RESEARCH_TOPICS = [
   "consensus",
   "routing",
@@ -9701,95 +9797,95 @@ var TOPIC_DESCRIPTIONS = {
 };
 var PaperStatusSchema2 = PaperStatusSchema;
 var TechniqueStatusSchema2 = TechniqueStatusSchema;
-var TechniquePrioritySchema = z3.enum(["P1", "P2", "P3", "P4"]).nullable();
-var TechniqueComplexitySchema = z3.enum(["low", "medium", "high"]);
-var RelevanceSchema = z3.enum(["high", "medium", "low"]);
-var PaperSourceSchema = z3.enum(["arxiv", "conference", "journal", "preprint"]);
-var DecisionHistoryEntrySchema = z3.object({
-  date: z3.string().regex(/^\d{4}-\d{2}-\d{2}$/, "Date must be YYYY-MM-DD format"),
-  decision: z3.string().min(1),
-  rationale: z3.string().min(1)
+var TechniquePrioritySchema = z4.enum(["P1", "P2", "P3", "P4"]).nullable();
+var TechniqueComplexitySchema = z4.enum(["low", "medium", "high"]);
+var RelevanceSchema = z4.enum(["high", "medium", "low"]);
+var PaperSourceSchema = z4.enum(["arxiv", "conference", "journal", "preprint"]);
+var DecisionHistoryEntrySchema = z4.object({
+  date: z4.string().regex(/^\d{4}-\d{2}-\d{2}$/, "Date must be YYYY-MM-DD format"),
+  decision: z4.string().min(1),
+  rationale: z4.string().min(1)
 });
-var ResearchPaperSchema = z3.object({
+var ResearchPaperSchema = z4.object({
   /** Paper title (required) */
-  title: z3.string().min(1),
+  title: z4.string().min(1),
   /** Paper authors */
-  authors: z3.array(z3.string()).optional().default([]),
+  authors: z4.array(z4.string()).optional().default([]),
   /** Source type */
   source: PaperSourceSchema.optional(),
   /** arXiv ID (e.g., '2501.06322') */
-  arxiv_id: z3.string().optional(),
+  arxiv_id: z4.string().optional(),
   /** URL to the paper */
   // eslint-disable-next-line @typescript-eslint/no-deprecated -- z.url() fails at runtime despite being recommended
-  url: z3.string().url().optional(),
+  url: z4.string().url().optional(),
   /** Publication date (YYYY-MM format) */
-  publication_date: z3.string().optional(),
+  publication_date: z4.string().optional(),
   /** Publication venue */
-  venue: z3.string().nullable().optional(),
+  venue: z4.string().nullable().optional(),
   /**
    * Research topics (array).
    * First topic is considered primary for counting purposes.
    */
-  topics: z3.array(z3.string()).optional().default([]),
+  topics: z4.array(z4.string()).optional().default([]),
   /** Tags for searching */
-  tags: z3.array(z3.string()).optional().default([]),
+  tags: z4.array(z4.string()).optional().default([]),
   /** Date when the paper was reviewed (YYYY-MM-DD) */
-  reviewed_date: z3.string().optional(),
+  reviewed_date: z4.string().optional(),
   /** File where the paper is reviewed */
-  reviewed_in: z3.string().optional(),
+  reviewed_in: z4.string().optional(),
   /** Summary of the paper */
-  summary: z3.string().optional(),
+  summary: z4.string().optional(),
   /** Key findings from the paper */
-  key_findings: z3.array(z3.string()).optional().default([]),
+  key_findings: z4.array(z4.string()).optional().default([]),
   /** Relevance to the project */
   relevance: RelevanceSchema.optional(),
   /** Techniques extracted from this paper */
-  techniques_extracted: z3.array(z3.string()).optional().default([]),
+  techniques_extracted: z4.array(z4.string()).optional().default([]),
   /** Related GitHub issues */
-  related_issues: z3.array(z3.number().int().positive()).optional().default([]),
+  related_issues: z4.array(z4.number().int().positive()).optional().default([]),
   /** Implementation status */
   implementation_status: PaperStatusSchema2.optional().default("not-started"),
   // ── Quality Assessment (Issue #1571) ──────────────────────────
   /** Citation count from Semantic Scholar (auto-fetched) */
-  citation_count: z3.number().nonnegative().optional(),
+  citation_count: z4.number().nonnegative().optional(),
   /** Venue quality tier: 3=top (NeurIPS/ICML/ICLR), 2=good, 1=workshop, 0=preprint */
-  venue_tier: z3.number().min(0).max(3).optional(),
+  venue_tier: z4.number().min(0).max(3).optional(),
   /** Whether the paper links to a code repository */
-  has_code: z3.boolean().optional(),
+  has_code: z4.boolean().optional(),
   /** Code repository URL (from Papers With Code or manual) */
-  code_url: z3.string().optional(),
+  code_url: z4.string().optional(),
   /** Rigor assessment tags (factual, verifiable signals) */
-  rigor_tags: z3.array(
-    z3.enum(["has-code", "has-dataset", "has-baselines", "peer-reviewed", "single-model-eval"])
+  rigor_tags: z4.array(
+    z4.enum(["has-code", "has-dataset", "has-baselines", "peer-reviewed", "single-model-eval"])
   ).optional().default([]),
   /** Composite quality score (0-10, auto-computed from signals) */
-  quality_score: z3.number().min(0).max(10).optional(),
+  quality_score: z4.number().min(0).max(10).optional(),
   /** Evidence confidence tier for extracted techniques */
-  evidence_tier: z3.enum(["high", "medium", "low"]).optional(),
+  evidence_tier: z4.enum(["high", "medium", "low"]).optional(),
   /** Why this paper scored low — enables future re-review when conditions change */
-  quality_notes: z3.string().optional(),
+  quality_notes: z4.string().optional(),
   /** When quality was last assessed (ISO date) — enables periodic re-review */
-  last_quality_check: z3.string().optional()
+  last_quality_check: z4.string().optional()
 });
-var IntegrationFileObjectSchema = z3.object({
-  path: z3.string(),
-  type: z3.enum(["primary", "test", "types", "helpers"]).optional(),
-  required: z3.boolean().default(true)
+var IntegrationFileObjectSchema = z4.object({
+  path: z4.string(),
+  type: z4.enum(["primary", "test", "types", "helpers"]).optional(),
+  required: z4.boolean().default(true)
 });
-var IntegrationFileSchema = z3.union([z3.string(), IntegrationFileObjectSchema]);
-var ResearchTechniqueSchema = z3.object({
+var IntegrationFileSchema = z4.union([z4.string(), IntegrationFileObjectSchema]);
+var ResearchTechniqueSchema = z4.object({
   /** Technique name (required) */
-  name: z3.string().min(1),
+  name: z4.string().min(1),
   /** Description of the technique (required) */
-  description: z3.string().min(1),
+  description: z4.string().min(1),
   /** Source papers (arXiv IDs or paper IDs) */
-  source_papers: z3.array(z3.string()).optional().default([]),
+  source_papers: z4.array(z4.string()).optional().default([]),
   /** Primary topic (required) */
   topic: ResearchTopicSchema,
   /** Tags for searching */
-  tags: z3.array(z3.string()).optional().default([]),
+  tags: z4.array(z4.string()).optional().default([]),
   /** Metrics associated with this technique */
-  metrics: z3.record(z3.string(), z3.string()).optional().default({}),
+  metrics: z4.record(z4.string(), z4.string()).optional().default({}),
   /** Implementation status (required) */
   status: TechniqueStatusSchema2,
   /** Priority level */
@@ -9797,35 +9893,35 @@ var ResearchTechniqueSchema = z3.object({
   /** Complexity level */
   complexity: TechniqueComplexitySchema.optional(),
   /** Files where this technique is implemented */
-  integration_files: z3.array(IntegrationFileSchema).optional().default([]),
+  integration_files: z4.array(IntegrationFileSchema).optional().default([]),
   /** GitHub issue number for implementation */
-  implementation_issue: z3.number().int().positive().nullable().optional().default(null),
+  implementation_issue: z4.number().int().positive().nullable().optional().default(null),
   /** Related PR numbers */
-  related_prs: z3.array(z3.number().int().positive()).optional().default([]),
+  related_prs: z4.array(z4.number().int().positive()).optional().default([]),
   /** Implementation notes */
-  notes: z3.string().optional(),
+  notes: z4.string().optional(),
   /** Dependent techniques */
-  dependencies: z3.array(z3.string()).optional().default([]),
+  dependencies: z4.array(z4.string()).optional().default([]),
   /** Decision history */
-  decision_history: z3.array(DecisionHistoryEntrySchema).optional().default([]),
+  decision_history: z4.array(DecisionHistoryEntrySchema).optional().default([]),
   // ── Evaluation Plan (Issue #1576 Wave 6) ──────────────────────
   /** Structured evaluation plan for keeping or removing the technique */
-  evaluation_plan: z3.object({
-    success_criteria: z3.string().optional(),
-    evaluation_method: z3.string().optional(),
-    evaluation_deadline: z3.string().optional(),
-    removal_criteria: z3.string().optional()
+  evaluation_plan: z4.object({
+    success_criteria: z4.string().optional(),
+    evaluation_method: z4.string().optional(),
+    evaluation_deadline: z4.string().optional(),
+    removal_criteria: z4.string().optional()
   }).optional(),
   /** Evaluation status: pending (not yet evaluated), passed, failed, deferred */
-  evaluation_status: z3.enum(["pending", "passed", "failed", "deferred"]).optional()
+  evaluation_status: z4.enum(["pending", "passed", "failed", "deferred"]).optional()
 });
-var PapersRegistrySchema = z3.object({
-  schema_version: z3.string(),
-  papers: z3.record(z3.string(), ResearchPaperSchema)
+var PapersRegistrySchema = z4.object({
+  schema_version: z4.string(),
+  papers: z4.record(z4.string(), ResearchPaperSchema)
 });
-var TechniquesRegistrySchema = z3.object({
-  schema_version: z3.string(),
-  techniques: z3.record(z3.string(), ResearchTechniqueSchema)
+var TechniquesRegistrySchema = z4.object({
+  schema_version: z4.string(),
+  techniques: z4.record(z4.string(), ResearchTechniqueSchema)
 });
 function getIntegrationFilePath(file) {
   if (typeof file === "string") {
@@ -11555,43 +11651,43 @@ function validateIndex(index, currentFiles) {
 }
 
 // src/indexer/entrypoint-types.ts
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 var ENTRYPOINT_SCHEMA_VERSION = "1.0";
-var OptionSpecSchema = z4.object({
-  name: z4.string(),
-  type: z4.string(),
-  description: z4.string().optional(),
-  required: z4.boolean().optional(),
-  default: z4.string().optional(),
-  short: z4.string().optional()
+var OptionSpecSchema = z5.object({
+  name: z5.string(),
+  type: z5.string(),
+  description: z5.string().optional(),
+  required: z5.boolean().optional(),
+  default: z5.string().optional(),
+  short: z5.string().optional()
 });
-var ParameterSpecSchema = z4.object({
-  name: z4.string(),
-  type: z4.string(),
-  description: z4.string().optional(),
-  required: z4.boolean().optional(),
-  default: z4.string().optional()
+var ParameterSpecSchema = z5.object({
+  name: z5.string(),
+  type: z5.string(),
+  description: z5.string().optional(),
+  required: z5.boolean().optional(),
+  default: z5.string().optional()
 });
-var CliCommandSpecSchema = z4.object({
-  name: z4.string(),
-  description: z4.string(),
-  subcommands: z4.array(z4.string()).readonly().optional(),
-  options: z4.array(OptionSpecSchema).readonly().optional(),
-  source_file: z4.string(),
-  source_line: z4.number().int().positive()
+var CliCommandSpecSchema = z5.object({
+  name: z5.string(),
+  description: z5.string(),
+  subcommands: z5.array(z5.string()).readonly().optional(),
+  options: z5.array(OptionSpecSchema).readonly().optional(),
+  source_file: z5.string(),
+  source_line: z5.number().int().positive()
 });
-var McpToolSpecSchema = z4.object({
-  name: z4.string(),
-  description: z4.string(),
-  parameters: z4.array(ParameterSpecSchema).readonly(),
-  source_file: z4.string(),
-  source_line: z4.number().int().positive()
+var McpToolSpecSchema = z5.object({
+  name: z5.string(),
+  description: z5.string(),
+  parameters: z5.array(ParameterSpecSchema).readonly(),
+  source_file: z5.string(),
+  source_line: z5.number().int().positive()
 });
-var EntrypointManifestSchema = z4.object({
-  schema_version: z4.literal(ENTRYPOINT_SCHEMA_VERSION),
-  generated_at: z4.string(),
-  cli_commands: z4.array(CliCommandSpecSchema).readonly(),
-  mcp_tools: z4.array(McpToolSpecSchema).readonly()
+var EntrypointManifestSchema = z5.object({
+  schema_version: z5.literal(ENTRYPOINT_SCHEMA_VERSION),
+  generated_at: z5.string(),
+  cli_commands: z5.array(CliCommandSpecSchema).readonly(),
+  mcp_tools: z5.array(McpToolSpecSchema).readonly()
 });
 var DEFAULT_ENTRYPOINT_EXTRACTOR_OPTIONS = {
   packageRoot: "packages/nexus-agents",
@@ -12933,7 +13029,7 @@ function probeGrammars(register, parse6, probes = GRAMMAR_PROBES) {
 }
 async function loadGrammarModules() {
   const [{ ensurePolyglotLangs }, napi] = await Promise.all([
-    import("./ast-rule-runner-3DNARGI6.js"),
+    import("./ast-rule-runner-2PEUHSHO.js"),
     import("@ast-grep/napi")
   ]);
   return { register: ensurePolyglotLangs, parse: napi.parse };
@@ -13242,12 +13338,12 @@ function checkConfigLoading() {
 }
 function checkExpertSystem() {
   const expertTypes = Object.keys(BUILT_IN_EXPERTS);
-  const count = expertTypes.length;
-  if (count >= 5) {
+  const count2 = expertTypes.length;
+  if (count2 >= 5) {
     return {
       name: "Expert System",
       passed: true,
-      message: `${String(count)} expert types available`
+      message: `${String(count2)} expert types available`
     };
   }
   return {
@@ -13574,9 +13670,9 @@ function aggregateFeatureImportance(banditStats) {
       featureMap.set(fi.feature, { sum: existing.sum + fi.importance, count: existing.count + 1 });
     }
   }
-  const topFeatures = Array.from(featureMap.entries()).map(([feature, { sum, count }]) => ({
+  const topFeatures = Array.from(featureMap.entries()).map(([feature, { sum, count: count2 }]) => ({
     feature,
-    importance: sum / count,
+    importance: sum / count2,
     direction: sum >= 0 ? "positive" : "negative"
   })).sort((a, b) => Math.abs(b.importance) - Math.abs(a.importance)).slice(0, 5);
   return topFeatures;
@@ -13700,8 +13796,8 @@ function formatSummary2(result) {
   lines.push(color("\u251C" + horizontalLine() + "\u2524", ANSI3.cyan));
   return lines;
 }
-function sampleLabel(source, count) {
-  return `${count.toLocaleString()} ${source === "bandit" ? "pulls" : "routings"}`;
+function sampleLabel(source, count2) {
+  return `${count2.toLocaleString()} ${source === "bandit" ? "pulls" : "routings"}`;
 }
 function formatSelectionShare(model) {
   if (model.routingSelectionCount === 0) return UNMEASURED_NO_ROUTINGS;
@@ -13936,30 +14032,30 @@ function gatherContextMetrics(context, options) {
 import { existsSync as existsSync14 } from "node:fs";
 
 // src/cli/setup-types.ts
-import { z as z5 } from "zod";
-var SetupOptionsSchema = z5.object({
+import { z as z6 } from "zod";
+var SetupOptionsSchema = z6.object({
   /** Skip interactive prompts */
-  nonInteractive: z5.boolean().default(false),
+  nonInteractive: z6.boolean().default(false),
   /** Overwrite existing configurations */
-  force: z5.boolean().default(false),
+  force: z6.boolean().default(false),
   /** Skip MCP configuration */
-  skipMcp: z5.boolean().default(false),
+  skipMcp: z6.boolean().default(false),
   /** Skip CLAUDE.md/rules generation */
-  skipRules: z5.boolean().default(false),
+  skipRules: z6.boolean().default(false),
   /** Skip hooks configuration (Issue #416) */
-  skipHooks: z5.boolean().default(false),
+  skipHooks: z6.boolean().default(false),
   /** Skip config file generation (#1252) */
-  skipConfig: z5.boolean().default(false),
+  skipConfig: z6.boolean().default(false),
   /** Skip OpenCode MCP configuration (#1253) */
-  skipOpencode: z5.boolean().default(false),
+  skipOpencode: z6.boolean().default(false),
   /** Skip Codex CLI MCP configuration (#1263) */
-  skipCodex: z5.boolean().default(false),
+  skipCodex: z6.boolean().default(false),
   /** Show what would be done without making changes */
-  dryRun: z5.boolean().default(false),
+  dryRun: z6.boolean().default(false),
   /** Show detailed output */
-  verbose: z5.boolean().default(false),
+  verbose: z6.boolean().default(false),
   /** Target scope for MCP config */
-  scope: z5.enum(["user", "project"]).default("user")
+  scope: z6.enum(["user", "project"]).default("user")
 });
 
 // src/cli/setup-environment.ts
@@ -15212,8 +15308,8 @@ function printPermissionsSuggestion() {
 function printDataDirSection(result) {
   writeLine4(formatHeader("Data Directory"));
   writeLine4("\u2500".repeat(40));
-  const count = result.dataDirsCreated ?? 0;
-  const msg = count > 0 ? `${result.dryRun === true ? "Would create:" : "Created"} ${String(count)} directories under ${result.dataDirPath ?? ""}` : `All directories already exist at ${result.dataDirPath ?? ""}`;
+  const count2 = result.dataDirsCreated ?? 0;
+  const msg = count2 > 0 ? `${result.dryRun === true ? "Would create:" : "Created"} ${String(count2)} directories under ${result.dataDirPath ?? ""}` : `All directories already exist at ${result.dataDirPath ?? ""}`;
   writeLine4(msg);
   writeEmptyLine3();
 }
@@ -15344,32 +15440,32 @@ function runSetupAndPrint(options) {
 }
 
 // src/cli/config-command-types.ts
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 var CONFIG_ACTIONS = ["get", "set", "list", "reset", "export", "import"];
 var CONFIG_FORMATS = ["json", "yaml"];
-var ConfigCommandOptionsSchema = z6.object({
+var ConfigCommandOptionsSchema = z7.object({
   /** Command action */
-  action: z6.enum(CONFIG_ACTIONS),
+  action: z7.enum(CONFIG_ACTIONS),
   /** Configuration key (dot notation supported) */
-  key: z6.string().optional(),
+  key: z7.string().optional(),
   /** Value to set */
-  value: z6.string().optional(),
+  value: z7.string().optional(),
   /** File path for import/export */
-  file: z6.string().optional(),
+  file: z7.string().optional(),
   /** Export format */
-  format: z6.enum(CONFIG_FORMATS).default("json"),
+  format: z7.enum(CONFIG_FORMATS).default("json"),
   /** Force overwrite without backup */
-  force: z6.boolean().default(false),
+  force: z7.boolean().default(false),
   /** Show verbose output */
-  verbose: z6.boolean().default(false)
+  verbose: z7.boolean().default(false)
 });
-var ParsedConfigKeySchema = z6.object({
+var ParsedConfigKeySchema = z7.object({
   /** Full key string */
-  fullKey: z6.string(),
+  fullKey: z7.string(),
   /** Category portion */
-  category: z6.string(),
+  category: z7.string(),
   /** Key within category */
-  key: z6.string()
+  key: z7.string()
 });
 var ConfigCommandError = class extends Error {
   code;
@@ -16051,8 +16147,8 @@ async function configCommand(options) {
 }
 
 // src/cli/hooks/hook-types.ts
-import { z as z7 } from "zod";
-var HookEventName = z7.enum([
+import { z as z8 } from "zod";
+var HookEventName = z8.enum([
   "SessionStart",
   "UserPromptSubmit",
   "PreToolUse",
@@ -16067,100 +16163,100 @@ var HookEventName = z7.enum([
   "Notification",
   "Setup"
 ]);
-var PermissionMode = z7.enum([
+var PermissionMode = z8.enum([
   "default",
   "plan",
   "acceptEdits",
   "dontAsk",
   "bypassPermissions"
 ]);
-var HookInputBaseSchema = z7.object({
-  session_id: z7.string(),
-  transcript_path: z7.string(),
-  cwd: z7.string(),
+var HookInputBaseSchema = z8.object({
+  session_id: z8.string(),
+  transcript_path: z8.string(),
+  cwd: z8.string(),
   permission_mode: PermissionMode,
   hook_event_name: HookEventName
 });
-var SessionStartSource = z7.enum(["startup", "resume", "clear", "compact"]);
+var SessionStartSource = z8.enum(["startup", "resume", "clear", "compact"]);
 var SessionStartInputSchema = HookInputBaseSchema.extend({
-  hook_event_name: z7.literal("SessionStart"),
+  hook_event_name: z8.literal("SessionStart"),
   source: SessionStartSource,
-  model: z7.string().optional(),
-  agent_type: z7.string().optional()
+  model: z8.string().optional(),
+  agent_type: z8.string().optional()
 });
-var SessionEndReason = z7.enum(["clear", "logout", "prompt_input_exit", "other"]);
+var SessionEndReason = z8.enum(["clear", "logout", "prompt_input_exit", "other"]);
 var SessionEndInputSchema = HookInputBaseSchema.extend({
-  hook_event_name: z7.literal("SessionEnd"),
+  hook_event_name: z8.literal("SessionEnd"),
   reason: SessionEndReason
 });
 var PreToolUseInputSchema = HookInputBaseSchema.extend({
-  hook_event_name: z7.literal("PreToolUse"),
-  tool_name: z7.string(),
-  tool_input: z7.record(z7.string(), z7.unknown()),
-  tool_use_id: z7.string()
+  hook_event_name: z8.literal("PreToolUse"),
+  tool_name: z8.string(),
+  tool_input: z8.record(z8.string(), z8.unknown()),
+  tool_use_id: z8.string()
 });
 var PostToolUseInputSchema = HookInputBaseSchema.extend({
-  hook_event_name: z7.literal("PostToolUse"),
-  tool_name: z7.string(),
-  tool_input: z7.record(z7.string(), z7.unknown()),
-  tool_response: z7.record(z7.string(), z7.unknown()),
-  tool_use_id: z7.string()
+  hook_event_name: z8.literal("PostToolUse"),
+  tool_name: z8.string(),
+  tool_input: z8.record(z8.string(), z8.unknown()),
+  tool_response: z8.record(z8.string(), z8.unknown()),
+  tool_use_id: z8.string()
 });
 var PostToolUseFailureInputSchema = HookInputBaseSchema.extend({
-  hook_event_name: z7.literal("PostToolUseFailure"),
-  tool_name: z7.string(),
-  tool_input: z7.record(z7.string(), z7.unknown()),
-  tool_use_id: z7.string(),
-  error: z7.string().optional()
+  hook_event_name: z8.literal("PostToolUseFailure"),
+  tool_name: z8.string(),
+  tool_input: z8.record(z8.string(), z8.unknown()),
+  tool_use_id: z8.string(),
+  error: z8.string().optional()
 });
 var StopInputSchema = HookInputBaseSchema.extend({
-  hook_event_name: z7.literal("Stop"),
-  stop_hook_active: z7.boolean()
+  hook_event_name: z8.literal("Stop"),
+  stop_hook_active: z8.boolean()
 });
 var SubagentStopInputSchema = HookInputBaseSchema.extend({
-  hook_event_name: z7.literal("SubagentStop"),
-  stop_hook_active: z7.boolean(),
-  agent_id: z7.string(),
-  agent_transcript_path: z7.string()
+  hook_event_name: z8.literal("SubagentStop"),
+  stop_hook_active: z8.boolean(),
+  agent_id: z8.string(),
+  agent_transcript_path: z8.string()
 });
 var UserPromptSubmitInputSchema = HookInputBaseSchema.extend({
-  hook_event_name: z7.literal("UserPromptSubmit"),
-  prompt: z7.string()
+  hook_event_name: z8.literal("UserPromptSubmit"),
+  prompt: z8.string()
 });
-var NotificationType = z7.enum([
+var NotificationType = z8.enum([
   "permission_prompt",
   "idle_prompt",
   "auth_success",
   "elicitation_dialog"
 ]);
 var NotificationInputSchema = HookInputBaseSchema.extend({
-  hook_event_name: z7.literal("Notification"),
-  message: z7.string(),
+  hook_event_name: z8.literal("Notification"),
+  message: z8.string(),
   notification_type: NotificationType
 });
-var PreCompactTrigger = z7.enum(["manual", "auto"]);
+var PreCompactTrigger = z8.enum(["manual", "auto"]);
 var PreCompactInputSchema = HookInputBaseSchema.extend({
-  hook_event_name: z7.literal("PreCompact"),
+  hook_event_name: z8.literal("PreCompact"),
   trigger: PreCompactTrigger,
-  custom_instructions: z7.string().optional()
+  custom_instructions: z8.string().optional()
 });
-var SetupTrigger = z7.enum(["init", "maintenance"]);
+var SetupTrigger = z8.enum(["init", "maintenance"]);
 var SetupInputSchema = HookInputBaseSchema.extend({
-  hook_event_name: z7.literal("Setup"),
+  hook_event_name: z8.literal("Setup"),
   trigger: SetupTrigger
 });
 var SubagentStartInputSchema = HookInputBaseSchema.extend({
-  hook_event_name: z7.literal("SubagentStart"),
-  agent_id: z7.string(),
-  agent_type: z7.string()
+  hook_event_name: z8.literal("SubagentStart"),
+  agent_id: z8.string(),
+  agent_type: z8.string()
 });
 var PermissionRequestInputSchema = HookInputBaseSchema.extend({
-  hook_event_name: z7.literal("PermissionRequest"),
-  tool_name: z7.string(),
-  tool_input: z7.record(z7.string(), z7.unknown()),
-  tool_use_id: z7.string()
+  hook_event_name: z8.literal("PermissionRequest"),
+  tool_name: z8.string(),
+  tool_input: z8.record(z8.string(), z8.unknown()),
+  tool_use_id: z8.string()
 });
-var HookInputSchema = z7.discriminatedUnion("hook_event_name", [
+var HookInputSchema = z8.discriminatedUnion("hook_event_name", [
   SessionStartInputSchema,
   SessionEndInputSchema,
   PreToolUseInputSchema,
@@ -16175,57 +16271,57 @@ var HookInputSchema = z7.discriminatedUnion("hook_event_name", [
   SubagentStartInputSchema,
   PermissionRequestInputSchema
 ]);
-var PermissionDecision = z7.enum(["allow", "deny", "ask"]);
-var HookDecision = z7.enum(["block"]);
-var HookOutputBaseSchema = z7.object({
-  continue: z7.boolean().optional(),
-  stopReason: z7.string().optional(),
-  suppressOutput: z7.boolean().optional(),
-  systemMessage: z7.string().optional()
+var PermissionDecision = z8.enum(["allow", "deny", "ask"]);
+var HookDecision = z8.enum(["block"]);
+var HookOutputBaseSchema = z8.object({
+  continue: z8.boolean().optional(),
+  stopReason: z8.string().optional(),
+  suppressOutput: z8.boolean().optional(),
+  systemMessage: z8.string().optional()
 });
 var PreToolUseOutputSchema = HookOutputBaseSchema.extend({
-  hookSpecificOutput: z7.object({
-    hookEventName: z7.literal("PreToolUse"),
+  hookSpecificOutput: z8.object({
+    hookEventName: z8.literal("PreToolUse"),
     permissionDecision: PermissionDecision.optional(),
-    permissionDecisionReason: z7.string().optional(),
-    updatedInput: z7.record(z7.string(), z7.unknown()).optional(),
-    additionalContext: z7.string().optional()
+    permissionDecisionReason: z8.string().optional(),
+    updatedInput: z8.record(z8.string(), z8.unknown()).optional(),
+    additionalContext: z8.string().optional()
   }).optional()
 });
 var PostToolUseOutputSchema = HookOutputBaseSchema.extend({
   decision: HookDecision.optional(),
-  reason: z7.string().optional(),
-  hookSpecificOutput: z7.object({
-    hookEventName: z7.literal("PostToolUse"),
-    additionalContext: z7.string().optional()
+  reason: z8.string().optional(),
+  hookSpecificOutput: z8.object({
+    hookEventName: z8.literal("PostToolUse"),
+    additionalContext: z8.string().optional()
   }).optional()
 });
 var StopOutputSchema = HookOutputBaseSchema.extend({
   decision: HookDecision.optional(),
-  reason: z7.string().optional()
+  reason: z8.string().optional()
 });
 var UserPromptSubmitOutputSchema = HookOutputBaseSchema.extend({
   decision: HookDecision.optional(),
-  reason: z7.string().optional(),
-  hookSpecificOutput: z7.object({
-    hookEventName: z7.literal("UserPromptSubmit"),
-    additionalContext: z7.string().optional()
+  reason: z8.string().optional(),
+  hookSpecificOutput: z8.object({
+    hookEventName: z8.literal("UserPromptSubmit"),
+    additionalContext: z8.string().optional()
   }).optional()
 });
 var SessionStartOutputSchema = HookOutputBaseSchema.extend({
-  hookSpecificOutput: z7.object({
-    hookEventName: z7.literal("SessionStart"),
-    additionalContext: z7.string().optional()
+  hookSpecificOutput: z8.object({
+    hookEventName: z8.literal("SessionStart"),
+    additionalContext: z8.string().optional()
   }).optional()
 });
 var PermissionRequestOutputSchema = HookOutputBaseSchema.extend({
-  hookSpecificOutput: z7.object({
-    hookEventName: z7.literal("PermissionRequest"),
-    decision: z7.object({
-      behavior: z7.enum(["allow", "deny"]),
-      updatedInput: z7.record(z7.string(), z7.unknown()).optional(),
-      message: z7.string().optional(),
-      interrupt: z7.boolean().optional()
+  hookSpecificOutput: z8.object({
+    hookEventName: z8.literal("PermissionRequest"),
+    decision: z8.object({
+      behavior: z8.enum(["allow", "deny"]),
+      updatedInput: z8.record(z8.string(), z8.unknown()).optional(),
+      message: z8.string().optional(),
+      interrupt: z8.boolean().optional()
     })
   }).optional()
 });
@@ -16991,9 +17087,9 @@ function isPendingTask(task) {
 }
 function createBlockResult(pendingTasks, maxToShow) {
   const taskList = formatPendingTasks(pendingTasks, maxToShow);
-  const count = String(pendingTasks.length);
+  const count2 = String(pendingTasks.length);
   return blockStop(
-    `There are ${count} incomplete task(s):
+    `There are ${count2} incomplete task(s):
 ${taskList}
 Please complete or cancel these tasks before stopping.`
   );
@@ -17861,8 +17957,8 @@ function scriptedIO() {
 
 // src/governance/claims-registry.ts
 import { parse as parseYaml2 } from "yaml";
-import { z as z8 } from "zod";
-var VerificationMethodSchema = z8.enum([
+import { z as z9 } from "zod";
+var VerificationMethodSchema = z9.enum([
   "file-exists",
   "file-contains",
   "source-contains-all",
@@ -17870,7 +17966,7 @@ var VerificationMethodSchema = z8.enum([
   "manifest-tool-count",
   "roadmap-status"
 ]);
-var ClaimStatusSchema = z8.enum([
+var ClaimStatusSchema = z9.enum([
   "verified",
   // backed by live evidence the runner checks every CI run
   "partial",
@@ -17880,25 +17976,25 @@ var ClaimStatusSchema = z8.enum([
   "stale"
   // known-broken backing; tracked, must not regress to silent
 ]);
-var EvidenceTypeSchema = z8.enum(["test", "gate", "eval-artifact", "adr", "source"]);
-var VerificationSchema = z8.object({
+var EvidenceTypeSchema = z9.enum(["test", "gate", "eval-artifact", "adr", "source"]);
+var VerificationSchema = z9.object({
   method: VerificationMethodSchema,
   /** Repo-root-relative path to the live backing evidence. */
-  path: z8.string().min(1),
+  path: z9.string().min(1),
   /**
    * Expected value. Numeric for `enum-member-count` / `manifest-tool-count`,
    * string for `file-contains` / `roadmap-status`. Unused by `file-exists`.
    */
-  expected: z8.union([z8.number().int().nonnegative(), z8.string().min(1)]).optional(),
+  expected: z9.union([z9.number().int().nonnegative(), z9.string().min(1)]).optional(),
   /** Target symbol name (e.g. the exported `z.enum` const) for count methods. */
-  symbol: z8.string().min(1).optional(),
+  symbol: z9.string().min(1).optional(),
   /**
    * Literal the claim's `subject` doc must contain (#3877). When present, the
    * runner verifies the doc making the claim — not just the source of truth —
    * so README/ARCHITECTURE drift fails the gate. Omit only for claims whose
    * `subject` IS the verification `path` (e.g. `roadmap-status`).
    */
-  subjectContains: z8.string().min(1).optional()
+  subjectContains: z9.string().min(1).optional()
 }).strict().superRefine((v, ctx) => {
   const needsNumber = v.method === "enum-member-count" || v.method === "manifest-tool-count";
   const needsString = v.method === "file-contains" || v.method === "source-contains-all" || v.method === "roadmap-status";
@@ -17924,24 +18020,24 @@ var VerificationSchema = z8.object({
     });
   }
 });
-var ClaimEntrySchema = z8.object({
+var ClaimEntrySchema = z9.object({
   /** Stable, kebab-case identifier; never reused. */
-  id: z8.string().regex(/^[a-z0-9]+(-[a-z0-9]+)*$/, "id must be kebab-case"),
+  id: z9.string().regex(/^[a-z0-9]+(-[a-z0-9]+)*$/, "id must be kebab-case"),
   /** Human-readable claim text (<=25 words). */
-  claim: z8.string().min(1).refine((s) => s.trim().split(/\s+/).length <= 25, "claim must be <=25 words"),
+  claim: z9.string().min(1).refine((s) => s.trim().split(/\s+/).length <= 25, "claim must be <=25 words"),
   /** Repo-root-relative doc that makes the claim (e.g. README.md). */
-  subject: z8.string().min(1),
+  subject: z9.string().min(1),
   status: ClaimStatusSchema,
   evidenceType: EvidenceTypeSchema,
   verification: VerificationSchema,
   /** ISO date (YYYY-MM-DD) the claim was last manually verified. */
-  lastVerified: z8.string().regex(/^\d{4}-\d{2}-\d{2}$/, "lastVerified must be YYYY-MM-DD"),
+  lastVerified: z9.string().regex(/^\d{4}-\d{2}-\d{2}$/, "lastVerified must be YYYY-MM-DD"),
   /** Optional caveat surfaced in reports (required-ish for `partial`). */
-  caveat: z8.string().optional()
+  caveat: z9.string().optional()
 }).strict();
-var ClaimsRegistrySchema = z8.object({
-  version: z8.number().int().positive(),
-  claims: z8.array(ClaimEntrySchema).min(1).superRefine((claims, ctx) => {
+var ClaimsRegistrySchema = z9.object({
+  version: z9.number().int().positive(),
+  claims: z9.array(ClaimEntrySchema).min(1).superRefine((claims, ctx) => {
     const seen = /* @__PURE__ */ new Set();
     for (const [i, c] of claims.entries()) {
       if (seen.has(c.id)) {
@@ -18411,7 +18507,7 @@ import { readFileSync as readFileSync14 } from "node:fs";
 // src/cli/release-validate-helpers.ts
 import { execSync as execSync5 } from "node:child_process";
 import { existsSync as existsSync16, readFileSync as readFileSync13 } from "node:fs";
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 
 // src/cli/release-secret-scan.ts
 import { execSync as execSync4 } from "node:child_process";
@@ -18435,12 +18531,12 @@ function scanRecentCommitsForSecrets(options = {}) {
 }
 
 // src/cli/release-validate-helpers.ts
-var NPM_AUDIT_REPORT_SCHEMA = z9.object({
-  metadata: z9.object({
-    vulnerabilities: z9.object({
-      moderate: z9.number().int().nonnegative(),
-      high: z9.number().int().nonnegative(),
-      critical: z9.number().int().nonnegative()
+var NPM_AUDIT_REPORT_SCHEMA = z10.object({
+  metadata: z10.object({
+    vulnerabilities: z10.object({
+      moderate: z10.number().int().nonnegative(),
+      high: z10.number().int().nonnegative(),
+      critical: z10.number().int().nonnegative()
     })
   })
 });
@@ -20074,9 +20170,9 @@ function createSeededRng(seed) {
     return ((t ^ t >>> 14) >>> 0) / 4294967296;
   };
 }
-function generateTasks(count, rng) {
+function generateTasks(count2, rng) {
   const tasks = [];
-  for (let i = 0; i < count; i++) {
+  for (let i = 0; i < count2; i++) {
     const catIdx = Math.floor(rng() * TASK_CATEGORIES.length);
     const category = TASK_CATEGORIES[catIdx] ?? "code_generation";
     tasks.push({
@@ -20980,7 +21076,7 @@ function startImprovementReviewScheduler(options) {
   let running = false;
   const runOnce = async () => {
     try {
-      const { runImprovementReview: runImprovementReview2, ImprovementReviewInputSchema: ImprovementReviewInputSchema2 } = await import("./improvement-review-3I2L2PBA.js");
+      const { runImprovementReview: runImprovementReview2, ImprovementReviewInputSchema: ImprovementReviewInputSchema2 } = await import("./improvement-review-EBC3I55P.js");
       const input = ImprovementReviewInputSchema2.parse({ fileIssues });
       const result = await runImprovementReview2(input, { logger: logger22 });
       logger22.info("Scheduled improvement_review complete", {
@@ -21466,8 +21562,8 @@ async function initUpstreamServers(gatewayConfig, deps) {
     servers: upstreamServers.length,
     tools: tools.length
   });
-  const { z: z15 } = await import("zod");
-  const passthroughSchema = z15.looseObject({});
+  const { z: z16 } = await import("zod");
+  const passthroughSchema = z16.looseObject({});
   for (const tool of tools) {
     registerSingleUpstreamTool(tool, manager, passthroughSchema, deps);
   }
@@ -23064,7 +23160,7 @@ function adaptConfigToLibrary(config) {
 }
 function createBeliefPromoter() {
   return async (event) => {
-    const { getToolMemory } = await import("./tool-memory-A6XPMC7X.js");
+    const { getToolMemory } = await import("./tool-memory-QESESDGS.js");
     const tm = getToolMemory();
     await tm.recordBelief(
       `skill:${event.name}`,
@@ -24234,7 +24330,7 @@ async function handleResearchCommand(args) {
   }
 }
 async function handleRegistryCommand(args) {
-  const { registryCommand, isValidRegistrySubcommand, formatRegistryUsage } = await import("./registry-command-7U5HC6NB.js");
+  const { registryCommand, isValidRegistrySubcommand, formatRegistryUsage } = await import("./registry-command-SQQNXDGS.js");
   const subcommand = args.subcommand;
   if (!isValidRegistrySubcommand(subcommand)) {
     process.stdout.write(`${formatRegistryUsage()}
@@ -24302,12 +24398,12 @@ async function handleDoctorCommand(args) {
     }
   });
   if (args.options.deep) {
-    const { runDeepDiagnostics: runDeepDiagnostics2, formatDeepDiagnostics: formatDeepDiagnostics2 } = await import("./doctor-deep-IGFWT3TZ.js");
+    const { runDeepDiagnostics: runDeepDiagnostics2, formatDeepDiagnostics: formatDeepDiagnostics2 } = await import("./doctor-deep-VOX7KVGK.js");
     const diag = runDeepDiagnostics2();
     process.stdout.write(formatDeepDiagnostics2(diag) + "\n");
   }
   if (args.options.live) {
-    const { runLiveReadiness, formatLiveReadiness } = await import("./doctor-live-BE6JTA3J.js");
+    const { runLiveReadiness, formatLiveReadiness } = await import("./doctor-live-AES3PON5.js");
     const report = await runLiveReadiness(cliListAdmits !== void 0 ? { cliListAdmits } : {});
     process.stdout.write(formatLiveReadiness(report) + "\n");
     if (doctorResult !== void 0) {
@@ -24470,20 +24566,20 @@ function handleWarmUpCommand(_args) {
   return cliExit(EXIT_CODES.SUCCESS);
 }
 function handleE2EEvalCommand(args) {
-  const count = parsePositiveInt(args.positionals[1], 50);
-  const result = runE2EEval({ taskCount: count });
+  const count2 = parsePositiveInt(args.positionals[1], 50);
+  const result = runE2EEval({ taskCount: count2 });
   process.stdout.write(formatE2EEvalResult(result) + "\n");
   return cliExit(result.passed ? EXIT_CODES.SUCCESS : 1);
 }
 function handleRoutingABCommand(args) {
-  const count = parsePositiveInt(args.positionals[1], 30);
-  const result = runRoutingAB({ taskCount: count });
+  const count2 = parsePositiveInt(args.positionals[1], 30);
+  const result = runRoutingAB({ taskCount: count2 });
   process.stdout.write(formatABReport(result) + "\n");
   return cliExit(EXIT_CODES.SUCCESS);
 }
 function handleMemoryEvalCommand(args) {
-  const count = parsePositiveInt(args.positionals[1], 50);
-  const result = runMemoryEval(count);
+  const count2 = parsePositiveInt(args.positionals[1], 50);
+  const result = runMemoryEval(count2);
   process.stdout.write(formatMemoryEvalReport(result) + "\n");
   return cliExit(EXIT_CODES.SUCCESS);
 }
@@ -25054,7 +25150,7 @@ async function runInitPortableFlow(args) {
   return cliExit(result.success ? EXIT_CODES.SUCCESS : EXIT_CODES.SERVER_START_FAILED);
 }
 async function runInitOpencodeFlow(args) {
-  const { runInitOpencode } = await import("./init-opencode-5CFNILZP.js");
+  const { runInitOpencode } = await import("./init-opencode-F6FV63VR.js");
   const opencodePath = args.options.opencode;
   if (opencodePath === void 0 || opencodePath === "") {
     process.stderr.write("Error: --opencode requires a path argument.\n");
@@ -25080,7 +25176,7 @@ async function runInitOpencodeFlow(args) {
   return cliExit(EXIT_CODES.SUCCESS);
 }
 async function renderOpencodeValidate(opencodePath) {
-  const { runOpencodeValidate } = await import("./init-opencode-5CFNILZP.js");
+  const { runOpencodeValidate } = await import("./init-opencode-F6FV63VR.js");
   const result = await runOpencodeValidate(opencodePath);
   if (!result.ok) {
     process.stderr.write(`init --opencode --validate: ${result.reason ?? "failed"}
@@ -25181,7 +25277,7 @@ function resolveCustomApiInput(args) {
 async function runCustomApiSetup(args) {
   const input = resolveCustomApiInput(args);
   if (input === void 0) return EXIT_CODES.SERVER_START_FAILED;
-  const { configureCustomApi } = await import("./setup-custom-api-6X6FUHNV.js");
+  const { configureCustomApi } = await import("./setup-custom-api-H74QY7EM.js");
   const result = await configureCustomApi(input);
   if (!result.ok) {
     process.stderr.write(`\u2717 ${result.error.message}
@@ -25390,15 +25486,15 @@ function findPackageRoot(startDir) {
 }
 function countFiles(dir, pattern) {
   if (!fs15.existsSync(dir)) return 0;
-  let count = 0;
+  let count2 = 0;
   for (const entry of fs15.readdirSync(dir, { withFileTypes: true })) {
     if (entry.isDirectory() && entry.name !== "node_modules" && entry.name !== "dist") {
-      count += countFiles(path16.join(dir, entry.name), pattern);
+      count2 += countFiles(path16.join(dir, entry.name), pattern);
     } else if (entry.isFile() && pattern.test(entry.name)) {
-      count++;
+      count2++;
     }
   }
-  return count;
+  return count2;
 }
 function readVersion(pkgRoot) {
   try {
@@ -25949,10 +26045,10 @@ async function measurePromotionEffectiveness(backend, logger22) {
   });
   return { retentionRate, itemsPromoted: promotedEntries.length, itemsRetained: retained };
 }
-async function storeTestEntries(backend, importance, count) {
+async function storeTestEntries(backend, importance, count2) {
   const keys = [];
   const metadata = { importance, tags: ["decay-test"] };
-  for (let i = 0; i < count; i++) {
+  for (let i = 0; i < count2; i++) {
     const key = `${importance}-importance-${String(getTimeProvider().now())}-${String(i)}`;
     const value = { importance, content: `${importance} value content #${String(i)}` };
     const storeResult = await backend.store(key, value, metadata);
@@ -25987,10 +26083,10 @@ async function measureDecayAppropriateness(backend, logger22) {
 }
 
 // src/testing/memory-benchmark-synthetic.ts
-async function generateSyntheticTestCases(backend, count = 50) {
+async function generateSyntheticTestCases(backend, count2 = 50) {
   const testCases = [];
   const topics = ["typescript", "react", "nodejs", "testing", "security", "performance"];
-  const entriesPerTopic = Math.ceil(count / topics.length);
+  const entriesPerTopic = Math.ceil(count2 / topics.length);
   for (const topic of topics) {
     const relevantKeys = /* @__PURE__ */ new Set();
     for (let i = 0; i < entriesPerTopic; i++) {
@@ -27794,27 +27890,27 @@ function makeGhPrCreator() {
 import { createHash as createHash4 } from "node:crypto";
 import { readFileSync as readFileSync20 } from "node:fs";
 import { isAbsolute as isAbsolute3 } from "node:path";
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 
 // src/mcp/tools/remediation-review-sample.ts
 import { createHash as createHash3, randomBytes, randomUUID as randomUUID2 } from "node:crypto";
-import { z as z10 } from "zod";
-var PanelSnapshotSchema = z10.object({
-  soakRef: z10.string(),
-  voteRecordId: z10.string().min(1),
-  soakRecordHash: z10.string().regex(/^[a-f0-9]{64}$/),
-  sound: z10.boolean()
+import { z as z11 } from "zod";
+var PanelSnapshotSchema = z11.object({
+  soakRef: z11.string(),
+  voteRecordId: z11.string().min(1),
+  soakRecordHash: z11.string().regex(/^[a-f0-9]{64}$/),
+  sound: z11.boolean()
 });
-var ReviewSampleSchema = z10.object({
-  id: z10.string().min(1),
-  seed: z10.string().min(1),
-  owner: z10.string().trim().min(1),
-  sampledAt: z10.string(),
-  refs: z10.array(z10.string()),
+var ReviewSampleSchema = z11.object({
+  id: z11.string().min(1),
+  seed: z11.string().min(1),
+  owner: z11.string().trim().min(1),
+  sampledAt: z11.string(),
+  refs: z11.array(z11.string()),
   /** Present on new draws; legacy draws remain readable. */
-  randomRefs: z10.array(z10.string()).optional(),
-  mandatoryOverrideRefs: z10.array(z10.string()).optional(),
-  panels: z10.array(PanelSnapshotSchema)
+  randomRefs: z11.array(z11.string()).optional(),
+  mandatoryOverrideRefs: z11.array(z11.string()).optional(),
+  panels: z11.array(PanelSnapshotSchema)
 }).refine(
   (s) => new Set(s.refs).size === s.refs.length && s.refs.length === s.panels.length && s.refs.every((ref, i) => s.panels[i]?.soakRef === ref),
   { message: "Sample refs must be distinct and bound to panel snapshots" }
@@ -27839,9 +27935,9 @@ function getRemediationReviewSampleStore() {
   return createRemediationReviewSampleStore();
 }
 function drawRemediationReviewSample(records, n, owner, seed = randomBytes(32).toString("hex"), samples = []) {
-  z10.number().int().positive().parse(n);
-  owner = z10.string().trim().min(1).parse(owner);
-  z10.string().min(1).parse(seed);
+  z11.number().int().positive().parse(n);
+  owner = z11.string().trim().min(1).parse(owner);
+  z11.string().min(1).parse(seed);
   const current = currentRemediationJudgments(records);
   const candidates = [...current.values()].filter((r) => r.judgeKind === "panel");
   const unconfirmed = new Set(
@@ -28161,29 +28257,29 @@ function hashSoakRecordLine(line) {
 function soakRefOf(record) {
   return `${record.signalKey}::${record.timestamp}`;
 }
-var ReviewRecordSchema = z11.object({
-  judgeKind: z11.enum(["human", "panel", "owner-sample"]).default("human"),
-  voteRecordId: z11.string().min(1).optional(),
+var ReviewRecordSchema = z12.object({
+  judgeKind: z12.enum(["human", "panel", "owner-sample"]).default("human"),
+  voteRecordId: z12.string().min(1).optional(),
   /** Exact absolute ledger used by the panel vote; absent legacy rows cannot verify. */
-  voteLedgerPath: z11.string().refine(isAbsolute3, "Vote ledger path must be absolute").optional(),
-  soakRecordHash: z11.string().regex(/^[a-f0-9]{64}$/).optional(),
-  sampleId: z11.string().min(1).optional(),
+  voteLedgerPath: z12.string().refine(isAbsolute3, "Vote ledger path must be absolute").optional(),
+  soakRecordHash: z12.string().regex(/^[a-f0-9]{64}$/).optional(),
+  sampleId: z12.string().min(1).optional(),
   /** Reference to the reviewed soak selection (`signalKey::timestamp`). */
-  soakRef: z11.string(),
+  soakRef: z12.string(),
   /** ISO-8601 time the review was recorded. */
-  reviewedAt: z11.string(),
+  reviewedAt: z12.string(),
   /** Always true — a persisted record is, by construction, a review. */
-  reviewed: z11.literal(true),
+  reviewed: z12.literal(true),
   /** Whether the evaluator assessed the selection SOUND. */
-  sound: z11.boolean(),
+  sound: z12.boolean(),
   /** Named evaluator who performed the review (required — the gate's named-evaluator criterion). */
-  evaluator: z11.string().min(1),
+  evaluator: z12.string().min(1),
   /** Named owner accepting enforcement, recorded at sign-off time (optional per record). */
-  owner: z11.string().min(1).optional(),
+  owner: z12.string().min(1).optional(),
   /** True only for the explicit sign-off operation; absent on legacy human rows. */
-  ownerSignedOff: z11.boolean().optional(),
+  ownerSignedOff: z12.boolean().optional(),
   /** Free-text note (secret-scrubbed). */
-  note: z11.string().optional()
+  note: z12.string().optional()
 }).superRefine((record, ctx) => {
   if (record.judgeKind === "panel" && (record.voteRecordId === void 0 || record.soakRecordHash === void 0 || record.evaluator !== `panel:${record.voteRecordId}` || record.owner !== void 0)) {
     ctx.addIssue({
@@ -28495,12 +28591,12 @@ import { createHash as createHash5 } from "node:crypto";
 import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync10, rmSync as rmSync2, realpathSync as realpathSync2 } from "node:fs";
 import { dirname as dirname12, join as join22 } from "node:path";
 import { execFileSync as execFileSync6 } from "node:child_process";
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 
 // src/mcp/tools/codepr-guards.ts
 import { realpathSync } from "node:fs";
 import { isAbsolute as isAbsolute4, resolve as resolve15, relative as relative4, sep, dirname as dirname11, basename as basename5 } from "node:path";
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 function deny(reason, detail) {
   return { ok: false, reason, detail };
 }
@@ -28657,11 +28753,11 @@ function classifyPath(relPath) {
   }
   return { sensitive: false };
 }
-var BlastRadiusLimitsSchema = z12.object({
+var BlastRadiusLimitsSchema = z13.object({
   /** Max number of files the change may touch. Default 20. */
-  maxFiles: z12.number().int().positive().default(20),
+  maxFiles: z13.number().int().positive().default(20),
   /** Max total changed lines (added + removed across all files). Default 400. */
-  maxLines: z12.number().int().positive().default(400)
+  maxLines: z13.number().int().positive().default(400)
 }).strict();
 var DEFAULT_BLAST_RADIUS_LIMITS = Object.freeze(
   BlastRadiusLimitsSchema.parse({})
@@ -28739,13 +28835,13 @@ function auditAutonomousEvent(logger22, record) {
   }
   return { ok: true };
 }
-var ResourceBudgetLimitsSchema = z12.object({
+var ResourceBudgetLimitsSchema = z13.object({
   /** Wall-clock ceiling in ms. Default 600000 (10 min). */
-  maxWallClockMs: z12.number().int().positive().default(6e5),
+  maxWallClockMs: z13.number().int().positive().default(6e5),
   /** Token ceiling. Default 200000. */
-  maxTokens: z12.number().int().positive().default(2e5),
+  maxTokens: z13.number().int().positive().default(2e5),
   /** Tool-call ceiling. Default 200. */
-  maxToolCalls: z12.number().int().positive().default(200)
+  maxToolCalls: z13.number().int().positive().default(200)
 }).strict();
 var DEFAULT_RESOURCE_BUDGET_LIMITS = Object.freeze(
   ResourceBudgetLimitsSchema.parse({})
@@ -28805,19 +28901,19 @@ function runGuard(name, fn) {
 }
 
 // src/mcp/tools/codepr-orchestrator.ts
-var ProposedChangeSchema = z13.object({
+var ProposedChangeSchema = z14.object({
   /** Repo-relative path the change would write. */
-  relPath: z13.string().min(1),
+  relPath: z14.string().min(1),
   /** The full new file content. */
-  newContent: z13.string()
+  newContent: z14.string()
 }).strict();
-var CodePrRunInputSchema = z13.object({
+var CodePrRunInputSchema = z14.object({
   /** Correlates all audit events for this run. */
-  runId: z13.string().min(1),
+  runId: z14.string().min(1),
   /** Hash of the source signal (fitness/improvement) that triggered the run. */
-  sourceSignalHash: z13.string().min(1),
+  sourceSignalHash: z14.string().min(1),
   /** The proposed change set. */
-  changes: z13.array(ProposedChangeSchema).min(1)
+  changes: z14.array(ProposedChangeSchema).min(1)
 }).strict();
 var ORCHESTRATOR_USAGE_ZERO = { wallClockMs: 0, tokens: 0, toolCalls: 0 };
 function sha256(s) {
@@ -29036,22 +29132,22 @@ function planCodePrRun(input, logger22, options = {}) {
 }
 
 // src/mcp/tools/codepr-soak-store.ts
-import { z as z14 } from "zod";
-var CodePrSoakRecordSchema = z14.object({
+import { z as z15 } from "zod";
+var CodePrSoakRecordSchema = z15.object({
   /** ISO-8601 capture time. */
-  timestamp: z14.string(),
+  timestamp: z15.string(),
   /** Correlates the data point to the dry-run's orchestrator runId. */
-  runId: z14.string(),
+  runId: z15.string(),
   /** The improvement signal's stable key that triggered the dry-run. */
-  signalKey: z14.string(),
+  signalKey: z15.string(),
   /** Explicit provenance on new writes; absent only on legacy records. */
-  origin: z14.enum(["production", "test"]).optional(),
+  origin: z15.enum(["production", "test"]).optional(),
   /** True when the dry-run plan succeeded with ZERO guard denial. */
-  green: z14.boolean(),
+  green: z15.boolean(),
   /** The guard denial reason when `green` is false; omitted for a green plan. */
-  denialReason: z14.string().optional(),
+  denialReason: z15.string().optional(),
   /** Files the dry-run plan touched (0 on denial before the diff was realized). */
-  filesTouched: z14.number().int().nonnegative()
+  filesTouched: z15.number().int().nonnegative()
 }).strict();
 var CODEPR_SOAK_MAX_RECORDS = 1e4;
 function getCodePrSoakFile() {
@@ -30775,20 +30871,20 @@ function runSignOff(args) {
     throw new Error("remediation-review sign-off: no reviews to sign off (mark selections first)");
   }
   const latest = signOffJudgments(existing, owner);
-  let count = 0;
+  let count2 = 0;
   for (const r of latest.values()) {
     if (!store.record({ ...r, owner, ownerSignedOff: true }))
       throw new Error("Sign-off persistence failed");
-    count++;
+    count2++;
   }
   const summary = readRemediationReviewSummary();
   if (args.options.format === "json") {
-    process.stdout.write(`${JSON.stringify({ owner, signedOff: count, summary }, null, 2)}
+    process.stdout.write(`${JSON.stringify({ owner, signedOff: count2, summary }, null, 2)}
 `);
     return;
   }
   process.stdout.write(
-    `owner sign-off recorded by ${owner} across ${String(count)} selection(s)
+    `owner sign-off recorded by ${owner} across ${String(count2)} selection(s)
 `
   );
 }
@@ -31501,7 +31597,7 @@ async function main() {
     parsedArgs = { ...parsedArgs, command: "help" };
   }
   if (shouldBootstrapGateway(parsedArgs)) {
-    const { wireGateway: wireGateway2 } = await import("./cli-server-gateway-J6SKTZVM.js");
+    const { wireGateway: wireGateway2 } = await import("./cli-server-gateway-HHRF22EB.js");
     await wireGateway2(createLogger({ component: "nexus-cli" }));
   }
   await dispatchCommand(parsedArgs);