nexus-agents 14.0.2 → 14.0.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -62,7 +62,7 @@ import {
62
62
  updateStage,
63
63
  withFileLock,
64
64
  writeJobCancelled
65
- } from "./chunk-SNSV6GGV.js";
65
+ } from "./chunk-KSF67NHM.js";
66
66
  import {
67
67
  allOf,
68
68
  anyOf
@@ -85,13 +85,14 @@ import {
85
85
  } from "./chunk-RYDTFPVI.js";
86
86
  import {
87
87
  withPrerequisite
88
- } from "./chunk-Q6R3JTXH.js";
88
+ } from "./chunk-JDFDGY5A.js";
89
89
  import {
90
90
  NOOP_NOTIFIER,
91
91
  RateLimiter,
92
92
  VERSION,
93
93
  VOTING_THRESHOLDS,
94
94
  abortSignalStorage,
95
+ buildToolMetadata,
95
96
  checkPolicyForDispatchedTool,
96
97
  coarsenFailureCategory,
97
98
  createDefaultPolicyFirewall,
@@ -117,7 +118,7 @@ import {
117
118
  toolSuccess,
118
119
  withProgressHeartbeat,
119
120
  wrapToolWithTimeout
120
- } from "./chunk-MFUJU7RO.js";
121
+ } from "./chunk-63L435QC.js";
121
122
  import {
122
123
  generateSecurityPlan
123
124
  } from "./chunk-KMGKOF5P.js";
@@ -28402,10 +28403,10 @@ function calculateDifferenceCI(p1, p2, total1, total2, confidence) {
28402
28403
  const difference = p1 - p2;
28403
28404
  const measured = total1 > 0 && total2 > 0;
28404
28405
  const seDiff = Math.sqrt(p1 * (1 - p1) / (total1 || 1) + p2 * (1 - p2) / (total2 || 1));
28405
- const z134 = getZScore(confidence);
28406
+ const z135 = getZScore(confidence);
28406
28407
  return {
28407
- lower: difference - z134 * seDiff,
28408
- upper: difference + z134 * seDiff,
28408
+ lower: difference - z135 * seDiff,
28409
+ upper: difference + z135 * seDiff,
28409
28410
  estimate: difference,
28410
28411
  confidence,
28411
28412
  n: total1 + total2,
@@ -28433,11 +28434,11 @@ function proportionConfidenceInterval(successes, total, options = {}) {
28433
28434
  measured: false
28434
28435
  };
28435
28436
  }
28436
- const z134 = getZScore(opts.confidence);
28437
- const z210 = z134 * z134;
28437
+ const z135 = getZScore(opts.confidence);
28438
+ const z210 = z135 * z135;
28438
28439
  const denominator = 1 + z210 / n;
28439
28440
  const center = (p + z210 / (2 * n)) / denominator;
28440
- const margin = z134 / denominator * Math.sqrt(p * (1 - p) / n + z210 / (4 * n * n));
28441
+ const margin = z135 / denominator * Math.sqrt(p * (1 - p) / n + z210 / (4 * n * n));
28441
28442
  const lower = Math.max(0, center - margin);
28442
28443
  const upper = Math.min(1, center + margin);
28443
28444
  const standardError = Math.sqrt(p * (1 - p) / n);
@@ -28475,8 +28476,8 @@ function meanConfidenceInterval(values, options = {}) {
28475
28476
  const variance = values.reduce((sum, v) => sum + (v - mean) ** 2, 0) / (n - 1 || 1);
28476
28477
  const stdDev = Math.sqrt(variance);
28477
28478
  const standardError = stdDev / Math.sqrt(n);
28478
- const z134 = getZScore(opts.confidence);
28479
- const margin = z134 * standardError;
28479
+ const z135 = getZScore(opts.confidence);
28480
+ const margin = z135 * standardError;
28480
28481
  return {
28481
28482
  lower: mean - margin,
28482
28483
  upper: mean + margin,
@@ -42590,10 +42591,11 @@ async function runBackgroundExpertTask(opts) {
42590
42591
  }
42591
42592
  }
42592
42593
  async function storeResult(taskStore, taskId, status, result, sessionId) {
42594
+ const producedResult = { ...result, _meta: buildToolMetadata(result._meta) };
42593
42595
  if (sessionId !== void 0) {
42594
- await taskStore.storeTaskResult(taskId, status, result, sessionId);
42596
+ await taskStore.storeTaskResult(taskId, status, producedResult, sessionId);
42595
42597
  } else {
42596
- await taskStore.storeTaskResult(taskId, status, result);
42598
+ await taskStore.storeTaskResult(taskId, status, producedResult);
42597
42599
  }
42598
42600
  }
42599
42601
 
@@ -50457,7 +50459,7 @@ function buildVotingInput(plan, config) {
50457
50459
  }
50458
50460
  async function executeSingleVote(plan, config, log) {
50459
50461
  try {
50460
- const { executeVoting } = await import("./consensus-vote-CQGIWMYY.js");
50462
+ const { executeVoting } = await import("./consensus-vote-XRRZGJGJ.js");
50461
50463
  const input = buildVotingInput(plan, config);
50462
50464
  const result = await executeVoting(input, log);
50463
50465
  return parseVotingResult(result);
@@ -52933,7 +52935,7 @@ async function prepareCompletePlanVote(plan, research, config, signal) {
52933
52935
  return { proposal, roleAdapters: panel.seats };
52934
52936
  }
52935
52937
  async function executePlanVote(plan, research, config, strategy, signal) {
52936
- const { executeVoting } = await import("./consensus-vote-CQGIWMYY.js");
52938
+ const { executeVoting } = await import("./consensus-vote-XRRZGJGJ.js");
52937
52939
  const { proposal, roleAdapters } = await prepareCompletePlanVote(plan, research, config, signal);
52938
52940
  const votingResult = await executeVoting(
52939
52941
  {
@@ -55692,10 +55694,27 @@ function createAuditStageRegistry() {
55692
55694
  }
55693
55695
 
55694
55696
  // src/mcp/tools/pr-review-tool.ts
55695
- import { z as z113 } from "zod";
55697
+ import { z as z114 } from "zod";
55696
55698
  import { randomUUID as randomUUID15 } from "node:crypto";
55697
55699
 
55698
55700
  // src/mcp/tools/pr-review-record-producer.ts
55701
+ import { z as z113 } from "zod";
55702
+ var LocalDiffReductionSchema = z113.object({
55703
+ prefixCodeUnits: z113.number().int().positive().max(Number.MAX_SAFE_INTEGER),
55704
+ totalCodeUnits: z113.number().int().positive().max(Number.MAX_SAFE_INTEGER),
55705
+ prefixUtf8Bytes: z113.number().int().positive().max(Number.MAX_SAFE_INTEGER),
55706
+ totalUtf8Bytes: z113.number().int().positive().max(Number.MAX_SAFE_INTEGER),
55707
+ marker: z113.string().min(1).max(64)
55708
+ }).strict();
55709
+ function localReductionStamp(args) {
55710
+ if (args.localDiffReduction === void 0) return "";
55711
+ const r = LocalDiffReductionSchema.parse(args.localDiffReduction);
55712
+ const diff = args.input.prDiff;
55713
+ if (args.diffSource !== "canonical-git" || args.sanitization !== void 0 || args.coverage !== void 0 || r.prefixCodeUnits >= r.totalCodeUnits || r.totalCodeUnits !== diff.length || r.totalUtf8Bytes !== Buffer.byteLength(diff) || r.prefixUtf8Bytes !== Buffer.byteLength(diff.slice(0, r.prefixCodeUnits))) {
55714
+ throw new Error("Invalid local pre-builder diff reduction measurements");
55715
+ }
55716
+ return ` [local pre-builder diff prefix ${String(r.prefixCodeUnits)}/${String(r.totalCodeUnits)} JS code units; UTF-8 ${String(r.prefixUtf8Bytes)}/${String(r.totalUtf8Bytes)} bytes; marker +${String(r.marker.length)} JS code units/+${String(Buffer.byteLength(r.marker))} bytes; additional inspection UNMEASURED]`;
55717
+ }
55699
55718
  function bytes(n) {
55700
55719
  return n.toLocaleString("en-US");
55701
55720
  }
@@ -55770,7 +55789,7 @@ function writeFailedOutcome() {
55770
55789
  function buildAndPersist(prNumber, baseSha, args) {
55771
55790
  const { input, aggregate, counts, reviewCount, logger: logger62, coverage, diffSource, sanitization } = args;
55772
55791
  const reviewedDiffHash = sanitization?.rawDiffHash ?? computeReviewedDiffHash(input.prDiff);
55773
- const stamps = coverageStamps(coverage);
55792
+ const stamps = localReductionStamp(args) + coverageStamps(coverage);
55774
55793
  const coverageFields = coverageFieldsOf(coverage);
55775
55794
  const disclosure = sanitizationDisclosureOf(sanitization, input.prDiff);
55776
55795
  warnIfDiffTruncated(resolveBindingMeasurement(input.prDiff, sanitization), prNumber, logger62);
@@ -55882,19 +55901,19 @@ var MAX_REPO_CONTEXT_LENGTH = 2e3;
55882
55901
  var MAX_TITLE_LENGTH = 500;
55883
55902
  var MAX_DESCRIPTION_LENGTH = 1e4;
55884
55903
  var PR_REVIEW_ASYNC_HINT = "A pr_review run fans out to 5 live LLM voters and can exceed the synchronous MCP request timeout. Retry with `dispatch: 'async'` to get a jobId immediately, then poll get_job_result({ jobId }) for the result.";
55885
- var PrReviewInputSchema = z113.object({
55886
- prTitle: z113.string().min(1).max(MAX_TITLE_LENGTH).describe("PR title"),
55887
- prDescription: z113.string().max(MAX_DESCRIPTION_LENGTH).optional().describe("PR body / description"),
55888
- prDiff: z113.string().min(1).max(MAX_DIFF_INPUT_LENGTH).refine(looksLikeUnifiedDiff, {
55904
+ var PrReviewInputSchema = z114.object({
55905
+ prTitle: z114.string().min(1).max(MAX_TITLE_LENGTH).describe("PR title"),
55906
+ prDescription: z114.string().max(MAX_DESCRIPTION_LENGTH).optional().describe("PR body / description"),
55907
+ prDiff: z114.string().min(1).max(MAX_DIFF_INPUT_LENGTH).refine(looksLikeUnifiedDiff, {
55889
55908
  message: "prDiff must be a unified diff (expected a `diff --git`, `---`/`+++`, or `@@ \u2026 @@` line). Prose descriptions of a change are rejected: a review of a summary is not a review of the code, and would be recorded as though it were (#4451)."
55890
55909
  }).describe(
55891
55910
  `Unified diff text (max ${String(MAX_DIFF_INPUT_LENGTH)} chars). REQUIRED SHAPE (#4451): must contain a \`diff --git\` header, an \`@@ \u2026 @@\` hunk header backed by +/- lines, or a \`---\`/\`+++\` header pair \u2014 a prose summary of the change is REJECTED, because reviewing a summary is not reviewing the code and would be recorded as though it were. (Stated here because Zod refinements do not survive JSON-schema generation, so this constraint is otherwise invisible to clients.) No need to truncate before calling: the panel reads the whole diff whenever it fits the voters' context windows (#6003); a diff larger than that is security-prioritized and PARTIALLY reviewed (lowest-priority whole files dropped; a partial panel read can block but never verified-approve). Separately, the audit record's hash binds only the first ${String(MAX_DIFF_LENGTH)} UTF-8 bytes; the response \`coverage\` and the record summary state both what the panel read and what the hash binds.`
55892
55911
  ),
55893
- repoContext: z113.string().max(MAX_REPO_CONTEXT_LENGTH).optional().describe(
55912
+ repoContext: z114.string().max(MAX_REPO_CONTEXT_LENGTH).optional().describe(
55894
55913
  `Optional one-paragraph repo context (architecture, conventions; max ${String(MAX_REPO_CONTEXT_LENGTH)} chars; trim before calling)`
55895
55914
  ),
55896
- baseRef: z113.string().max(200).optional().describe("Base branch ref (e.g. main)"),
55897
- headRef: z113.string().max(200).optional().describe("Head branch ref"),
55915
+ baseRef: z114.string().max(200).optional().describe("Base branch ref (e.g. main)"),
55916
+ headRef: z114.string().max(200).optional().describe("Head branch ref"),
55898
55917
  /**
55899
55918
  * Option-C audit binding (#4031). When BOTH `prNumber` and `baseSha` are
55900
55919
  * supplied AND the review is live (not simulated), pr_review persists an
@@ -55910,14 +55929,14 @@ var PrReviewInputSchema = z113.object({
55910
55929
  * the PR opened and drifts as main advances), so pass the merge-base as
55911
55930
  * `baseSha` or the record will not match on an aged branch (#5692).
55912
55931
  */
55913
- prNumber: z113.number().int().positive().max(1e6).optional().describe("PR number \u2014 with baseSha, enables Option-C audit-record persistence (#4031)"),
55914
- baseSha: z113.string().regex(/^[0-9a-f]{40}$/, "baseSha must be a 40-char lowercase hex commit sha").optional().describe(
55932
+ prNumber: z114.number().int().positive().max(1e6).optional().describe("PR number \u2014 with baseSha, enables Option-C audit-record persistence (#4031)"),
55933
+ baseSha: z114.string().regex(/^[0-9a-f]{40}$/, "baseSha must be a 40-char lowercase hex commit sha").optional().describe(
55915
55934
  "40-hex base commit sha the reviewed diff was computed from \u2014 pass `git merge-base origin/<base> <head>`, the base the gate recomputes (Option-C binding, #4031, #5692)"
55916
55935
  ),
55917
- repoPath: z113.string().max(1024).optional().describe(
55936
+ repoPath: z114.string().max(1024).optional().describe(
55918
55937
  "Repo root path for persisting the governance pr-review record (overrides cwd auto-detection). Must contain a .git ancestor \u2014 relative paths are resolved against cwd; ignored (falls back to cwd auto-detection) if it is not a real repo root. Env NEXUS_PR_REVIEW_RECORDS_PATH still takes precedence and is unrestricted."
55919
55938
  ),
55920
- simulate: z113.boolean().default(false).describe("Use simulated voters (testing only; never ship live with this true)"),
55939
+ simulate: z114.boolean().default(false).describe("Use simulated voters (testing only; never ship live with this true)"),
55921
55940
  /**
55922
55941
  * Error policy (#4132). `standard` (default) excludes absent voters but
55923
55942
  * requires a majority of the requested panel to approve. `absolute_quorum` gates
@@ -55929,7 +55948,7 @@ var PrReviewInputSchema = z113.object({
55929
55948
  * verified approve. A genuine `request_changes` blocker still wins (Tiers 1-2
55930
55949
  * run first).
55931
55950
  */
55932
- errorPolicy: z113.enum(["standard", "absolute_quorum"]).default("standard").describe(
55951
+ errorPolicy: z114.enum(["standard", "absolute_quorum"]).default("standard").describe(
55933
55952
  "Error policy (#4132). 'standard' (default): absent voters excluded; approval requires a majority of the requested panel. 'absolute_quorum': any errored voter \u2014 esp. the contrarian \u2014 degrades a would-be approve to a recoverable abstain (verified:false); never manufactures a verified approve from an induced error."
55934
55953
  ),
55935
55954
  // #6123: same field as consensus_vote — the panel judges the caller's project.
@@ -56285,27 +56304,27 @@ function absoluteQuorumApprove(reviews, valid) {
56285
56304
  }
56286
56305
 
56287
56306
  // src/mcp/tools/survey-oss-landscape.ts
56288
- import { z as z114 } from "zod";
56289
- var SurveyOssLandscapeInputSchema = z114.object({
56290
- query: z114.string().min(1).max(200).describe('Free-text search query, e.g. "cargo nextest replacement" or "OSS SBOM tools"'),
56291
- maxResults: z114.number().int().min(1).max(50).optional().default(10).describe("Maximum candidates to return (1-50; default 10)"),
56292
- minStars: z114.number().int().min(0).max(1e6).optional().default(0).describe("Minimum star count to include (default 0; useful for filtering noise)"),
56293
- language: z114.string().max(50).optional().describe('GitHub language filter, e.g. "rust" or "typescript"')
56294
- });
56295
- var GitHubRepoSchema = z114.object({
56296
- full_name: z114.string().optional(),
56297
- html_url: z114.string().optional(),
56298
- description: z114.string().nullable().optional(),
56299
- stargazers_count: z114.number().optional(),
56300
- pushed_at: z114.string().nullable().optional(),
56301
- language: z114.string().nullable().optional(),
56302
- license: z114.object({
56303
- spdx_id: z114.string().nullable().optional()
56307
+ import { z as z115 } from "zod";
56308
+ var SurveyOssLandscapeInputSchema = z115.object({
56309
+ query: z115.string().min(1).max(200).describe('Free-text search query, e.g. "cargo nextest replacement" or "OSS SBOM tools"'),
56310
+ maxResults: z115.number().int().min(1).max(50).optional().default(10).describe("Maximum candidates to return (1-50; default 10)"),
56311
+ minStars: z115.number().int().min(0).max(1e6).optional().default(0).describe("Minimum star count to include (default 0; useful for filtering noise)"),
56312
+ language: z115.string().max(50).optional().describe('GitHub language filter, e.g. "rust" or "typescript"')
56313
+ });
56314
+ var GitHubRepoSchema = z115.object({
56315
+ full_name: z115.string().optional(),
56316
+ html_url: z115.string().optional(),
56317
+ description: z115.string().nullable().optional(),
56318
+ stargazers_count: z115.number().optional(),
56319
+ pushed_at: z115.string().nullable().optional(),
56320
+ language: z115.string().nullable().optional(),
56321
+ license: z115.object({
56322
+ spdx_id: z115.string().nullable().optional()
56304
56323
  }).nullable().optional()
56305
56324
  });
56306
- var GitHubSearchResponseSchema = z114.object({
56307
- total_count: z114.number().optional(),
56308
- items: z114.array(GitHubRepoSchema).optional()
56325
+ var GitHubSearchResponseSchema = z115.object({
56326
+ total_count: z115.number().optional(),
56327
+ items: z115.array(GitHubRepoSchema).optional()
56309
56328
  });
56310
56329
  var GITHUB_SEARCH_BASE = "https://api.github.com/search/repositories";
56311
56330
  function buildGithubQuery(input) {
@@ -56427,16 +56446,16 @@ function createSurveyHandler(deps) {
56427
56446
  });
56428
56447
  return withToolError("Survey failed", logger62, async () => {
56429
56448
  const result = await executeSurvey(validation.data, logger62);
56430
- return structuredToolSuccess(z114.object(SURVEY_OUTPUT_SCHEMA), result);
56449
+ return structuredToolSuccess(z115.object(SURVEY_OUTPUT_SCHEMA), result);
56431
56450
  });
56432
56451
  };
56433
56452
  }
56434
56453
  var SURVEY_OUTPUT_SCHEMA = {
56435
- query: z114.string(),
56436
- totalFound: z114.number(),
56437
- candidates: z114.array(z114.unknown()),
56438
- sourcesQueried: z114.array(z114.string()),
56439
- sourcesFailed: z114.array(z114.string())
56454
+ query: z115.string(),
56455
+ totalFound: z115.number(),
56456
+ candidates: z115.array(z115.unknown()),
56457
+ sourcesQueried: z115.array(z115.string()),
56458
+ sourcesFailed: z115.array(z115.string())
56440
56459
  };
56441
56460
  var SURVEY_DESCRIPTION = 'Transient OSS project search. Returns a ranked list of GitHub repositories with license, last-commit, star-count, and one-line description. Does NOT persist to the research registry \u2014 use `research_add_source` for that. Best for one-off engineering decisions like "what tools exist in this space?".';
56442
56461
  function registerSurveyOssLandscapeTool(server, deps) {
@@ -56467,7 +56486,7 @@ function registerSurveyOssLandscapeTool(server, deps) {
56467
56486
  }
56468
56487
 
56469
56488
  // src/mcp/tools/vendor-publishing-audit.ts
56470
- import { z as z115 } from "zod";
56489
+ import { z as z116 } from "zod";
56471
56490
 
56472
56491
  // src/mcp/tools/vendor-publishing-seed.ts
56473
56492
  var VENDOR_PUBLISHING_SEED = {
@@ -56540,8 +56559,8 @@ function listKnownVendors() {
56540
56559
  }
56541
56560
 
56542
56561
  // src/mcp/tools/vendor-publishing-audit.ts
56543
- var VendorPublishingAuditInputSchema = z115.object({
56544
- vendor: z115.string().min(1).max(50).toLowerCase().describe('Vendor identifier, lowercase. e.g. "ubuntu", "debian", "fedora"')
56562
+ var VendorPublishingAuditInputSchema = z116.object({
56563
+ vendor: z116.string().min(1).max(50).toLowerCase().describe('Vendor identifier, lowercase. e.g. "ubuntu", "debian", "fedora"')
56545
56564
  });
56546
56565
  function lookupVendor(vendor) {
56547
56566
  if (isKnownVendor(vendor)) {
@@ -56569,26 +56588,26 @@ function createVendorPublishingAuditHandler(deps) {
56569
56588
  return withToolError("Vendor publishing audit failed", logger62, () => {
56570
56589
  const result = lookupVendor(validation.data.vendor);
56571
56590
  return Promise.resolve(
56572
- structuredToolSuccess(z115.object(VENDOR_PUBLISHING_OUTPUT_SCHEMA), result)
56591
+ structuredToolSuccess(z116.object(VENDOR_PUBLISHING_OUTPUT_SCHEMA), result)
56573
56592
  );
56574
56593
  });
56575
56594
  };
56576
56595
  }
56577
56596
  var VENDOR_PUBLISHING_OUTPUT_SCHEMA = {
56578
- vendor: z115.string(),
56579
- known: z115.boolean(),
56597
+ vendor: z116.string(),
56598
+ known: z116.boolean(),
56580
56599
  // Fields below populate when known=true; permissive optional for known=false.
56581
- sha256SumsUrlPattern: z115.string().optional(),
56582
- sha256SumsSignatureUrlPattern: z115.string().optional(),
56583
- signaturePattern: z115.string().optional(),
56584
- gpgKeys: z115.array(z115.unknown()).optional(),
56585
- releaseCadence: z115.string().optional(),
56586
- keyRotationNotes: z115.string().optional(),
56587
- vendorDocUrl: z115.string().optional(),
56588
- citedAt: z115.string().optional(),
56600
+ sha256SumsUrlPattern: z116.string().optional(),
56601
+ sha256SumsSignatureUrlPattern: z116.string().optional(),
56602
+ signaturePattern: z116.string().optional(),
56603
+ gpgKeys: z116.array(z116.unknown()).optional(),
56604
+ releaseCadence: z116.string().optional(),
56605
+ keyRotationNotes: z116.string().optional(),
56606
+ vendorDocUrl: z116.string().optional(),
56607
+ citedAt: z116.string().optional(),
56589
56608
  // Fields below populate when known=false.
56590
- message: z115.string().optional(),
56591
- knownVendors: z115.array(z115.string()).optional()
56609
+ message: z116.string().optional(),
56610
+ knownVendors: z116.array(z116.string()).optional()
56592
56611
  };
56593
56612
  var VENDOR_PUBLISHING_DESCRIPTION = "Look up a vendor's published-artifact signing infrastructure: GPG key fingerprints, SHA256SUMS URL pattern, signature shape (clearsigned / detached / detached-on-iso), release cadence, key rotation notes, and the vendor doc citation. Static lookup against a curated seed dataset; the vendor doc URL is the authoritative source. Returns `{known: false, knownVendors: [...]}` for vendors without a seed entry. v1 covers ubuntu, debian, fedora.";
56594
56613
  function registerVendorPublishingAuditTool(server, deps) {
@@ -56618,17 +56637,17 @@ function registerVendorPublishingAuditTool(server, deps) {
56618
56637
  }
56619
56638
 
56620
56639
  // src/mcp/tools/compare-data-feeds.ts
56621
- import { z as z116 } from "zod";
56640
+ import { z as z117 } from "zod";
56622
56641
  import * as path6 from "node:path";
56623
56642
  import * as fs7 from "node:fs";
56624
56643
  import * as yaml4 from "yaml";
56625
- var CompareDataFeedsInputSchema = z116.object({
56626
- feedAPath: z116.string().min(1).max(1e3).describe("Filesystem path to feed A (YAML or JSON, auto-detected by extension)"),
56627
- feedBPath: z116.string().min(1).max(1e3).describe("Filesystem path to feed B"),
56628
- keyPath: z116.string().min(1).max(200).describe(
56644
+ var CompareDataFeedsInputSchema = z117.object({
56645
+ feedAPath: z117.string().min(1).max(1e3).describe("Filesystem path to feed A (YAML or JSON, auto-detected by extension)"),
56646
+ feedBPath: z117.string().min(1).max(1e3).describe("Filesystem path to feed B"),
56647
+ keyPath: z117.string().min(1).max(200).describe(
56629
56648
  'Dotted path to the entry key, e.g. "id" or "name". Each entry must have this field.'
56630
56649
  ),
56631
- compareFields: z116.array(z116.string().min(1).max(200)).max(20).optional().describe(
56650
+ compareFields: z117.array(z117.string().min(1).max(200)).max(20).optional().describe(
56632
56651
  'Optional dotted field paths to compare across matched entries (e.g. ["license", "sha256"])'
56633
56652
  )
56634
56653
  });
@@ -56806,29 +56825,29 @@ function createCompareDataFeedsHandler(deps) {
56806
56825
  });
56807
56826
  return withToolError("Compare data feeds failed", logger62, () => {
56808
56827
  const result = executeCompare(validation.data);
56809
- return Promise.resolve(structuredToolSuccess(z116.object(COMPARE_OUTPUT_SCHEMA), result));
56828
+ return Promise.resolve(structuredToolSuccess(z117.object(COMPARE_OUTPUT_SCHEMA), result));
56810
56829
  });
56811
56830
  };
56812
56831
  }
56813
56832
  var COMPARE_OUTPUT_SCHEMA = {
56814
- feedAPath: z116.string(),
56815
- feedBPath: z116.string(),
56816
- keyPath: z116.string(),
56817
- counts: z116.object({
56818
- entriesInA: z116.number(),
56819
- entriesInB: z116.number(),
56820
- onlyInA: z116.number(),
56821
- onlyInB: z116.number(),
56822
- inBoth: z116.number(),
56823
- fieldDifferences: z116.number()
56833
+ feedAPath: z117.string(),
56834
+ feedBPath: z117.string(),
56835
+ keyPath: z117.string(),
56836
+ counts: z117.object({
56837
+ entriesInA: z117.number(),
56838
+ entriesInB: z117.number(),
56839
+ onlyInA: z117.number(),
56840
+ onlyInB: z117.number(),
56841
+ inBoth: z117.number(),
56842
+ fieldDifferences: z117.number()
56824
56843
  }),
56825
- coverage: z116.object({
56826
- onlyInA: z116.array(z116.string()),
56827
- onlyInB: z116.array(z116.string()),
56828
- inBoth: z116.array(z116.string())
56844
+ coverage: z117.object({
56845
+ onlyInA: z117.array(z117.string()),
56846
+ onlyInB: z117.array(z117.string()),
56847
+ inBoth: z117.array(z117.string())
56829
56848
  }),
56830
- fieldDifferences: z116.array(z116.unknown()),
56831
- summary: z116.string()
56849
+ fieldDifferences: z117.array(z117.unknown()),
56850
+ summary: z117.string()
56832
56851
  };
56833
56852
  var COMPARE_DESCRIPTION = "Diff two upstream data feeds (YAML or JSON files) along coverage and per-field axes. Returns which entries exist in A, B, both, plus optional field-level diffs across matched entries. v1 takes file paths only (no URL fetch \u2014 that needs an SSRF design pass). Both feeds must be a top-level array OR a top-level object with exactly one array field.";
56834
56853
  function registerCompareDataFeedsTool(server, deps) {
@@ -56859,9 +56878,9 @@ function registerCompareDataFeedsTool(server, deps) {
56859
56878
  }
56860
56879
 
56861
56880
  // src/mcp/tools/query-task-state-tool.ts
56862
- import { z as z117 } from "zod";
56863
- var QueryTaskStateInputSchema = z117.object({
56864
- taskId: z117.string().min(1).max(128).describe("Task ID whose structured state log should be read")
56881
+ import { z as z118 } from "zod";
56882
+ var QueryTaskStateInputSchema = z118.object({
56883
+ taskId: z118.string().min(1).max(128).describe("Task ID whose structured state log should be read")
56865
56884
  });
56866
56885
  function queryTaskStateHandler(args, ctx) {
56867
56886
  const parsed = QueryTaskStateInputSchema.safeParse(args);
@@ -56896,7 +56915,7 @@ function queryTaskStateHandler(args, ctx) {
56896
56915
  function registerQueryTaskStateTool(server, deps) {
56897
56916
  const logger62 = deps.logger ?? createLogger({ tool: "query_task_state" });
56898
56917
  const toolSchema = {
56899
- taskId: z117.string().min(1).max(128).describe("Task ID whose structured state log should be read")
56918
+ taskId: z118.string().min(1).max(128).describe("Task ID whose structured state log should be read")
56900
56919
  };
56901
56920
  const description = "Read the structured state log for a task ID and return the current snapshot. Includes Magentic-One Task Ledger (facts/guesses/openQuestions) and Progress Ledger (per-step reflections with suggestedAction) when orchestrators have written them. Structured state is only written when NEXUS_TASK_STATE_ENABLED=1 was set during the orchestrate invocation.";
56902
56921
  const secureHandler = createSecureHandler(queryTaskStateHandler, {
@@ -56918,28 +56937,28 @@ function registerQueryTaskStateTool(server, deps) {
56918
56937
  }
56919
56938
 
56920
56939
  // src/mcp/tools/ci-health-check-tool.ts
56921
- import { z as z120 } from "zod";
56940
+ import { z as z121 } from "zod";
56922
56941
 
56923
56942
  // src/mcp/tools/ci-health-log.ts
56924
56943
  import { appendFileSync as appendFileSync5, existsSync as existsSync17, readFileSync as readFileSync14, statSync as statSync5, writeFileSync as writeFileSync3 } from "node:fs";
56925
- import { z as z119 } from "zod";
56944
+ import { z as z120 } from "zod";
56926
56945
 
56927
56946
  // src/mcp/tools/ci-health-types.ts
56928
- import { z as z118 } from "zod";
56929
- var CiHealthStatusSchema = z118.enum(["healthy", "degraded", "outage", "unknown"]);
56947
+ import { z as z119 } from "zod";
56948
+ var CiHealthStatusSchema = z119.enum(["healthy", "degraded", "outage", "unknown"]);
56930
56949
 
56931
56950
  // src/mcp/tools/ci-health-log.ts
56932
56951
  var logger56 = createLogger({ component: "ci-health-log" });
56933
- var CiHealthEventSchema = z119.object({
56934
- v: z119.literal(1),
56935
- ts: z119.iso.datetime(),
56952
+ var CiHealthEventSchema = z120.object({
56953
+ v: z120.literal(1),
56954
+ ts: z120.iso.datetime(),
56936
56955
  status: CiHealthStatusSchema,
56937
- repo: z119.string().optional(),
56938
- signals: z119.array(
56939
- z119.object({
56940
- source: z119.enum(["github-status", "repo-activity-window"]),
56956
+ repo: z120.string().optional(),
56957
+ signals: z120.array(
56958
+ z120.object({
56959
+ source: z120.enum(["github-status", "repo-activity-window"]),
56941
56960
  status: CiHealthStatusSchema,
56942
- evidence: z119.string()
56961
+ evidence: z120.string()
56943
56962
  })
56944
56963
  )
56945
56964
  });
@@ -57019,17 +57038,17 @@ function eventFromCheck(params) {
57019
57038
  }
57020
57039
 
57021
57040
  // src/mcp/tools/ci-health-check-tool.ts
57022
- var CiHealthCheckInputSchema = z120.object({
57041
+ var CiHealthCheckInputSchema = z121.object({
57023
57042
  /**
57024
57043
  * Repo to check for the recent-runs activity signal (in `owner/repo` form).
57025
57044
  * Optional — when omitted, only the status-page signal is consulted.
57026
57045
  */
57027
- repo: z120.string().regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/, "Must be owner/repo form").optional().describe("GitHub repo (owner/repo) to check for recent CI activity. Optional."),
57046
+ repo: z121.string().regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/, "Must be owner/repo form").optional().describe("GitHub repo (owner/repo) to check for recent CI activity. Optional."),
57028
57047
  /**
57029
57048
  * How far back to look for recent-runs activity (minutes). Default 30 —
57030
57049
  * matches the typical wedge-detection window from the #3070 / #3076 outages.
57031
57050
  */
57032
- activityWindowMinutes: z120.number().int().min(5).max(180).default(30).describe("Recent-runs lookback window in minutes (5-180; default 30).")
57051
+ activityWindowMinutes: z121.number().int().min(5).max(180).default(30).describe("Recent-runs lookback window in minutes (5-180; default 30).")
57033
57052
  });
57034
57053
  var STATUS_PAGE_URL = "https://www.githubstatus.com/api/v2/components.json";
57035
57054
  function mapStatusPageStatus(raw) {
@@ -57188,8 +57207,8 @@ var DESCRIPTION = "Check CI infrastructure health before triggering / polling ru
57188
57207
  function registerCiHealthCheckTool(server, deps) {
57189
57208
  const logger62 = deps.logger ?? createLogger({ tool: "ci_health_check" });
57190
57209
  const toolSchema = {
57191
- repo: z120.string().regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/, "Must be owner/repo form").optional().describe("GitHub repo (owner/repo) to check for recent CI activity. Optional."),
57192
- activityWindowMinutes: z120.number().int().min(5).max(180).optional().describe("Recent-runs lookback window in minutes (5-180; default 30).")
57210
+ repo: z121.string().regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/, "Must be owner/repo form").optional().describe("GitHub repo (owner/repo) to check for recent CI activity. Optional."),
57211
+ activityWindowMinutes: z121.number().int().min(5).max(180).optional().describe("Recent-runs lookback window in minutes (5-180; default 30).")
57193
57212
  };
57194
57213
  const secureHandler = createSecureHandler((args) => ciHealthCheckHandler(args, logger62), {
57195
57214
  toolName: "ci_health_check",
@@ -57216,18 +57235,18 @@ function registerCiHealthCheckTool(server, deps) {
57216
57235
 
57217
57236
  // src/mcp/tools/quality-gate-tool.ts
57218
57237
  import { statSync as statSync6 } from "node:fs";
57219
- import { z as z121 } from "zod";
57220
- var QualityCheckSchema = z121.enum(["typecheck", "lint", "tests", "build", "security"]);
57238
+ import { z as z122 } from "zod";
57239
+ var QualityCheckSchema = z122.enum(["typecheck", "lint", "tests", "build", "security"]);
57221
57240
  var DEFAULT_CHECKS = ["typecheck", "lint", "tests"];
57222
- var RunQualityGateInputSchema = z121.object({
57241
+ var RunQualityGateInputSchema = z122.object({
57223
57242
  /** Project directory to run checks against. Must resolve inside the repo/cwd root. */
57224
- projectDir: z121.string().max(500).optional().describe(
57243
+ projectDir: z122.string().max(500).optional().describe(
57225
57244
  "Project directory to run checks against (default: cwd). Must stay inside the repo root."
57226
57245
  ),
57227
57246
  /** Which allowlisted checks to run. */
57228
- checks: z121.array(QualityCheckSchema).nonempty().default([...DEFAULT_CHECKS]).describe("Allowlisted checks to run (default: ['typecheck','lint','tests'])."),
57247
+ checks: z122.array(QualityCheckSchema).nonempty().default([...DEFAULT_CHECKS]).describe("Allowlisted checks to run (default: ['typecheck','lint','tests'])."),
57229
57248
  /** 1-based iteration counter, forwarded to the engine for feedback context. */
57230
- iteration: z121.number().int().min(1).max(100).default(1).describe("1-based iteration number (default 1).")
57249
+ iteration: z122.number().int().min(1).max(100).default(1).describe("1-based iteration number (default 1).")
57231
57250
  });
57232
57251
  function validateProjectDir(raw) {
57233
57252
  const candidate = raw ?? process.cwd();
@@ -57302,11 +57321,11 @@ var DESCRIPTION2 = "Run the QA quality gate (#1684 engine) against a project dir
57302
57321
  function registerRunQualityGateTool(server, deps) {
57303
57322
  const logger62 = deps.logger ?? createLogger({ tool: "run_quality_gate" });
57304
57323
  const toolSchema = {
57305
- projectDir: z121.string().max(500).optional().describe(
57324
+ projectDir: z122.string().max(500).optional().describe(
57306
57325
  "Project directory to run checks against (default: cwd). Must stay inside the repo root."
57307
57326
  ),
57308
- checks: z121.array(QualityCheckSchema).nonempty().optional().describe("Allowlisted checks to run (default: ['typecheck','lint','tests'])."),
57309
- iteration: z121.number().int().min(1).max(100).optional().describe("1-based iteration number (default 1).")
57327
+ checks: z122.array(QualityCheckSchema).nonempty().optional().describe("Allowlisted checks to run (default: ['typecheck','lint','tests'])."),
57328
+ iteration: z122.number().int().min(1).max(100).optional().describe("1-based iteration number (default 1).")
57310
57329
  };
57311
57330
  const secureHandler = createSecureHandler(
57312
57331
  (args) => runQualityGateHandler(args, logger62),
@@ -57336,7 +57355,7 @@ function registerRunQualityGateTool(server, deps) {
57336
57355
  // src/mcp/tools/verify-audit-chain-tool.ts
57337
57356
  import * as fs8 from "node:fs/promises";
57338
57357
  import * as path7 from "node:path";
57339
- import { z as z122 } from "zod";
57358
+ import { z as z123 } from "zod";
57340
57359
 
57341
57360
  // src/cli-server-auth.ts
57342
57361
  function resolveAuthEnabled(config) {
@@ -57510,11 +57529,11 @@ function logSecurityConfig(logger62, config) {
57510
57529
  }
57511
57530
 
57512
57531
  // src/mcp/tools/verify-audit-chain-tool.ts
57513
- var VerifyAuditChainInputSchema = z122.object({
57514
- logDir: z122.string().min(1).max(512).describe(
57532
+ var VerifyAuditChainInputSchema = z123.object({
57533
+ logDir: z123.string().min(1).max(512).describe(
57515
57534
  "Filesystem path to the FileAuditStorage log directory. Must lie inside the nexus data dir, a repo-local `.nexus-agents/`, or the configured `security.audit.logDir`. Tool reads all `audit-*.jsonl` files in lexicographic order and verifies the combined chain."
57516
57535
  ),
57517
- filePrefix: z122.string().min(1).max(64).optional().default(DEFAULT_AUDIT_FILE_PREFIX).describe(
57536
+ filePrefix: z123.string().min(1).max(64).optional().default(DEFAULT_AUDIT_FILE_PREFIX).describe(
57518
57537
  'Filename prefix for audit log files (defaults to "audit"). Files matching `${filePrefix}-*.jsonl` will be verified.'
57519
57538
  )
57520
57539
  });
@@ -57643,10 +57662,10 @@ async function handler2(args, ctx, security) {
57643
57662
  function registerVerifyAuditChainTool(server, deps) {
57644
57663
  const logger62 = deps.logger ?? createLogger({ tool: "verify_audit_chain" });
57645
57664
  const toolSchema = {
57646
- logDir: z122.string().min(1).max(512).describe(
57665
+ logDir: z123.string().min(1).max(512).describe(
57647
57666
  "Filesystem path to the FileAuditStorage log directory. Must lie inside the nexus data dir, a repo-local `.nexus-agents/`, or the configured `security.audit.logDir`. Tool reads all `audit-*.jsonl` files and verifies the combined hash chain."
57648
57667
  ),
57649
- filePrefix: z122.string().min(1).max(64).optional().describe(
57668
+ filePrefix: z123.string().min(1).max(64).optional().describe(
57650
57669
  'Filename prefix for audit log files (defaults to "audit"). Files matching `${filePrefix}-*.jsonl` will be verified.'
57651
57670
  )
57652
57671
  };
@@ -57670,7 +57689,7 @@ function registerVerifyAuditChainTool(server, deps) {
57670
57689
  }
57671
57690
 
57672
57691
  // src/mcp/tools/suggest-research-tasks-tool.ts
57673
- import { z as z123 } from "zod";
57692
+ import { z as z124 } from "zod";
57674
57693
  var SUGGEST_RESEARCH_TASKS_NOTE = "Suggestions derived from external research (untrusted); review before acting \u2014 nothing was executed or filed.";
57675
57694
  var RESEARCH_BUDGET_MS = 2e4;
57676
57695
  var RESEARCH_TIMED_OUT = /* @__PURE__ */ Symbol("research-budget-exceeded");
@@ -57687,11 +57706,11 @@ async function withResearchBudget(p, ms) {
57687
57706
  if (timer !== void 0) clearTimeout(timer);
57688
57707
  }
57689
57708
  }
57690
- var SuggestResearchTasksInputSchema = z123.object({
57691
- topic: z123.string().optional().describe("Topic filter passed to research_discover. Optional."),
57692
- qualityThreshold: z123.number().min(0).max(10).optional().describe("Minimum quality score (0-10) a discovery must meet to be suggested. Optional."),
57693
- maxTriggers: z123.number().int().min(1).max(50).optional().describe("Max number of candidate tasks to return (>=1). Optional."),
57694
- existingTaskIds: z123.array(z123.string()).optional().describe("Known task IDs to skip (dedup). Optional.")
57709
+ var SuggestResearchTasksInputSchema = z124.object({
57710
+ topic: z124.string().optional().describe("Topic filter passed to research_discover. Optional."),
57711
+ qualityThreshold: z124.number().min(0).max(10).optional().describe("Minimum quality score (0-10) a discovery must meet to be suggested. Optional."),
57712
+ maxTriggers: z124.number().int().min(1).max(50).optional().describe("Max number of candidate tasks to return (>=1). Optional."),
57713
+ existingTaskIds: z124.array(z124.string()).optional().describe("Known task IDs to skip (dedup). Optional.")
57695
57714
  });
57696
57715
  function toTriggerConfig(input) {
57697
57716
  return {
@@ -57748,10 +57767,10 @@ var DESCRIPTION3 = "SUGGEST-ONLY: surface candidate pipeline tasks for human/orc
57748
57767
  function registerSuggestResearchTasksTool(server, deps) {
57749
57768
  const logger62 = deps.logger ?? createLogger({ tool: "suggest_research_tasks" });
57750
57769
  const toolSchema = {
57751
- topic: z123.string().optional().describe("Topic filter passed to research_discover. Optional."),
57752
- qualityThreshold: z123.number().min(0).max(10).optional().describe("Minimum quality score (0-10) a discovery must meet to be suggested. Optional."),
57753
- maxTriggers: z123.number().int().min(1).max(50).optional().describe("Max number of candidate tasks to return (>=1). Optional."),
57754
- existingTaskIds: z123.array(z123.string()).optional().describe("Known task IDs to skip (dedup). Optional.")
57770
+ topic: z124.string().optional().describe("Topic filter passed to research_discover. Optional."),
57771
+ qualityThreshold: z124.number().min(0).max(10).optional().describe("Minimum quality score (0-10) a discovery must meet to be suggested. Optional."),
57772
+ maxTriggers: z124.number().int().min(1).max(50).optional().describe("Max number of candidate tasks to return (>=1). Optional."),
57773
+ existingTaskIds: z124.array(z124.string()).optional().describe("Known task IDs to skip (dedup). Optional.")
57755
57774
  };
57756
57775
  const secureHandler = createSecureHandler(
57757
57776
  (args) => suggestResearchTasksHandler(args, logger62),
@@ -57779,7 +57798,7 @@ function registerSuggestResearchTasksTool(server, deps) {
57779
57798
  }
57780
57799
 
57781
57800
  // src/mcp/tools/run-tool.ts
57782
- import { z as z127 } from "zod";
57801
+ import { z as z128 } from "zod";
57783
57802
  import { randomUUID as randomUUID20 } from "node:crypto";
57784
57803
 
57785
57804
  // src/orchestration/consensus-enforcement-mode.ts
@@ -58401,7 +58420,7 @@ function createMetaOrchestrator(options) {
58401
58420
 
58402
58421
  // src/orchestration/meta-shadow-selector.ts
58403
58422
  import { appendFileSync as appendFileSync6, existsSync as existsSync18, readFileSync as readFileSync15 } from "node:fs";
58404
- import { z as z124 } from "zod";
58423
+ import { z as z125 } from "zod";
58405
58424
  var SHADOW_STRATEGY_ARMS = [
58406
58425
  "single-shot",
58407
58426
  "dev-pipeline",
@@ -58490,19 +58509,19 @@ function createHydratableSelector() {
58490
58509
  var META_OUTCOME_SCHEMA_VERSION = 1;
58491
58510
  var HYDRATE_LOOKBACK_DAYS = 30;
58492
58511
  var HYDRATE_LOOKBACK_MS = HYDRATE_LOOKBACK_DAYS * 24 * 60 * 60 * 1e3;
58493
- var PersistedContextSchema = z124.object({
58494
- taskComplexity: z124.number(),
58495
- contextLengthNormalized: z124.number(),
58496
- isCodeTask: z124.number(),
58497
- isReasoningTask: z124.number(),
58498
- budgetUtilization: z124.number(),
58499
- timePressure: z124.number()
58500
- });
58501
- var PersistedMetaOutcomeSchema = z124.object({
58502
- schema: z124.literal(META_OUTCOME_SCHEMA_VERSION),
58503
- timestamp: z124.string(),
58504
- strategy: z124.enum(SHADOW_STRATEGY_ARMS),
58505
- success: z124.boolean(),
58512
+ var PersistedContextSchema = z125.object({
58513
+ taskComplexity: z125.number(),
58514
+ contextLengthNormalized: z125.number(),
58515
+ isCodeTask: z125.number(),
58516
+ isReasoningTask: z125.number(),
58517
+ budgetUtilization: z125.number(),
58518
+ timePressure: z125.number()
58519
+ });
58520
+ var PersistedMetaOutcomeSchema = z125.object({
58521
+ schema: z125.literal(META_OUTCOME_SCHEMA_VERSION),
58522
+ timestamp: z125.string(),
58523
+ strategy: z125.enum(SHADOW_STRATEGY_ARMS),
58524
+ success: z125.boolean(),
58506
58525
  context: PersistedContextSchema
58507
58526
  });
58508
58527
  var persistLogger = createLogger({ component: "MetaShadowSelector" });
@@ -58895,7 +58914,7 @@ function evaluateMetaStrategyReadiness(result, config = DEFAULT_META_STRATEGY_RE
58895
58914
  }
58896
58915
 
58897
58916
  // src/mcp/tools/dev-pipeline-tool.ts
58898
- import { z as z125 } from "zod";
58917
+ import { z as z126 } from "zod";
58899
58918
  import * as fs10 from "node:fs";
58900
58919
  import { randomUUID as randomUUID18 } from "node:crypto";
58901
58920
 
@@ -59161,42 +59180,42 @@ var DEV_PIPELINE_DRY_RUN_NOTE = "This was a dry run (plan+vote), which always ru
59161
59180
  function dispatchNoteFor(dryRun) {
59162
59181
  return dryRun ? DEV_PIPELINE_DRY_RUN_NOTE : DEV_PIPELINE_ASYNC_HINT;
59163
59182
  }
59164
- var DevPipelineInputSchema = z125.object({
59183
+ var DevPipelineInputSchema = z126.object({
59165
59184
  /** Direct task instructions. */
59166
- task: z125.string().max(1e4).optional().describe("Direct task instructions (what to build)"),
59185
+ task: z126.string().max(1e4).optional().describe("Direct task instructions (what to build)"),
59167
59186
  /** Declared provenance of the task text (#6795); omitted means '3'. */
59168
59187
  sourceTrustTier: TaskSourceTrustTierSchema,
59169
59188
  /** Path to a plan file (.md, .yaml, .txt) to use as input. */
59170
- planFile: z125.string().max(500).optional().describe("Path to a plan/spec file to use as input"),
59189
+ planFile: z126.string().max(500).optional().describe("Path to a plan/spec file to use as input"),
59171
59190
  /** Whether to run in dry-run mode (plan+vote only, no implementation). */
59172
- dryRun: z125.boolean().default(false).describe("If true, stop after plan+vote (no implementation)"),
59191
+ dryRun: z126.boolean().default(false).describe("If true, stop after plan+vote (no implementation)"),
59173
59192
  /** Maximum vote iterations before proceeding (default: 3). */
59174
- maxVoteIterations: z125.number().int().min(1).max(5).default(3).describe("Max plan\u2192vote iterations"),
59193
+ maxVoteIterations: z126.number().int().min(1).max(5).default(3).describe("Max plan\u2192vote iterations"),
59175
59194
  /** Maximum QA iterations per task (default: 3). */
59176
- maxQaIterations: z125.number().int().min(1).max(5).default(3).describe("Max QA review iterations per task"),
59195
+ maxQaIterations: z126.number().int().min(1).max(5).default(3).describe("Max QA review iterations per task"),
59177
59196
  /** Working directory for the pipeline (default: cwd). Used for security scan and context. */
59178
- workingDir: z125.string().max(500).optional().describe("Working directory (default: cwd)"),
59197
+ workingDir: z126.string().max(500).optional().describe("Working directory (default: cwd)"),
59179
59198
  /** GitHub issue number to track progress on. Updates posted as comments. */
59180
- issueNumber: z125.number().int().positive().optional().describe("GitHub issue to post progress to"),
59199
+ issueNumber: z126.number().int().positive().optional().describe("GitHub issue to post progress to"),
59181
59200
  /** GitHub repo (owner/name) for issue tracking. */
59182
- repo: z125.string().max(200).optional().describe("GitHub repo for issue tracking (e.g., owner/repo)"),
59201
+ repo: z126.string().max(200).optional().describe("GitHub repo for issue tracking (e.g., owner/repo)"),
59183
59202
  /** Task tracking backend: github, gitlab, or json (default: json). */
59184
- trackerBackend: z125.enum(["github", "gitlab", "json"]).default("json").describe("Task tracking backend for issue creation"),
59203
+ trackerBackend: z126.enum(["github", "gitlab", "json"]).default("json").describe("Task tracking backend for issue creation"),
59185
59204
  /** Labels to apply to created issues. */
59186
- labels: z125.array(z125.string()).optional().describe("Labels for created issues"),
59205
+ labels: z126.array(z126.string()).optional().describe("Labels for created issues"),
59187
59206
  /** Session ID for checkpoint/resume. Enables crash recovery. */
59188
- sessionId: z125.string().max(128).regex(/^[a-zA-Z0-9_-]+$/).optional().describe("Session ID for checkpoint/resume (crash recovery)"),
59207
+ sessionId: z126.string().max(128).regex(/^[a-zA-Z0-9_-]+$/).optional().describe("Session ID for checkpoint/resume (crash recovery)"),
59189
59208
  /**
59190
59209
  * TESTS ONLY — when true, voters return random decisions. Must not be used as
59191
59210
  * a fallback when adapters are unavailable; configure an adapter instead. (#2319)
59192
59211
  */
59193
- simulateVotes: z125.boolean().default(false).describe("TESTS ONLY \u2014 random output, must not be used for real decisions (#2319)"),
59212
+ simulateVotes: z126.boolean().default(false).describe("TESTS ONLY \u2014 random output, must not be used for real decisions (#2319)"),
59194
59213
  /** Voting strategy for consensus stages. */
59195
59214
  votingStrategy: VotingStrategySchema.optional().describe(
59196
59215
  "Voting strategy for plan approval (default: higher_order)"
59197
59216
  ),
59198
59217
  /** Start with the canonical quick panel; approvals may trigger a full-panel re-vote. */
59199
- quickMode: z125.boolean().default(false).describe(
59218
+ quickMode: z126.boolean().default(false).describe(
59200
59219
  "Start with 3 voters (architect, security, scope_steward) instead of 7. An approved quick vote may escalate to the full 7-role panel when the Bayesian posterior is borderline or a separate contrarian check rejects with high confidence, matching CLI --quick"
59201
59220
  ),
59202
59221
  /**
@@ -59204,7 +59223,7 @@ var DevPipelineInputSchema = z125.object({
59204
59223
  * budget for the whole run (#6736). Replaces every stage's default, the
59205
59224
  * vote's included; clamped to the `pipeline` class guard.
59206
59225
  */
59207
- timeoutMs: z125.number().int().min(3e4).max(6e5).optional().describe(
59226
+ timeoutMs: z126.number().int().min(3e4).max(6e5).optional().describe(
59208
59227
  "Max time for EACH stage call in ms (30000-600000), not for the whole run; applies to every stage, the vote included, and to each plan/vote and implement/QA iteration. A stage past it fails with a timeout and its model calls are aborted. Default: the vote stage gets the multi-LLM panel guard (900000 unless overridden), other stages the pipeline guard (1800000 unless overridden)"
59209
59228
  ),
59210
59229
  /**
@@ -59212,7 +59231,7 @@ var DevPipelineInputSchema = z125.object({
59212
59231
  * dispatch. A caller who learned `mode: 'async'` elsewhere gets an error
59213
59232
  * naming `dispatch` rather than the bare enum message (#4968).
59214
59233
  */
59215
- mode: z125.enum(["autonomous", "harness"], { error: modeEnumErrorNamingDispatch }).default("autonomous").describe(
59234
+ mode: z126.enum(["autonomous", "harness"], { error: modeEnumErrorNamingDispatch }).default("autonomous").describe(
59216
59235
  "'autonomous': full pipeline. 'harness': stops after decompose, returns tasks for caller to implement. (Not the async switch \u2014 that is `dispatch`.)"
59217
59236
  ),
59218
59237
  /**
@@ -59226,11 +59245,11 @@ var DevPipelineInputSchema = z125.object({
59226
59245
  */
59227
59246
  dispatch: dispatchFieldDefaultSync("Ignored for dryRun."),
59228
59247
  /** Local pre-ship quality gate (typecheck/lint/tests) mode (#3356). */
59229
- qualityGate: z125.enum(["off", "advisory", "blocking"]).default("off").describe(
59248
+ qualityGate: z126.enum(["off", "advisory", "blocking"]).default("off").describe(
59230
59249
  "Pre-ship local quality gate. 'off' (default): skip. 'advisory': run + record feedback, never fail. 'blocking': a red gate fails the pipeline."
59231
59250
  ),
59232
59251
  /** Opt-in per-run token budget — a safety cap for unattended runs (#3395). */
59233
- maxBudgetTokens: z125.number().int().positive().optional().describe(
59252
+ maxBudgetTokens: z126.number().int().positive().optional().describe(
59234
59253
  "Per-run token ceiling (#3395). When set, expert calls stop (returning failures) once cumulative usage crosses it \u2014 a hard-stop safety cap for unattended/multi-day runs. Omit to disable (default)."
59235
59254
  )
59236
59255
  });
@@ -59319,7 +59338,7 @@ async function executeDevPipelineBody(taskText, stages, pipelineOptions, simulat
59319
59338
  });
59320
59339
  return { ...error, content: [{ type: "text", text: describeFailureText(result) }] };
59321
59340
  }
59322
- return structuredToolSuccess(z125.record(z125.string(), z125.unknown()), output2);
59341
+ return structuredToolSuccess(z126.record(z126.string(), z126.unknown()), output2);
59323
59342
  }
59324
59343
  function describeIncompleteRun(result) {
59325
59344
  if (result.planStatus !== void 0) {
@@ -59485,33 +59504,33 @@ function registerDevPipelineTool(server, deps) {
59485
59504
  }
59486
59505
 
59487
59506
  // src/mcp/tools/pipeline-tool.ts
59488
- import { z as z126 } from "zod";
59507
+ import { z as z127 } from "zod";
59489
59508
  import * as fs11 from "node:fs";
59490
59509
  import { randomUUID as randomUUID19 } from "node:crypto";
59491
59510
  var PIPELINE_ASYNC_HINT = "A full run_pipeline run can exceed the synchronous MCP request timeout. Retry with `dispatch: 'async'` to get a jobId immediately, then poll get_job_result({ jobId }) for the result.";
59492
- var PipelineInputSchema = z126.object({
59511
+ var PipelineInputSchema = z127.object({
59493
59512
  /** The task to execute. */
59494
- task: z126.string().min(5).max(1e4).describe("Task description \u2014 pipeline template auto-selected based on content"),
59513
+ task: z127.string().min(5).max(1e4).describe("Task description \u2014 pipeline template auto-selected based on content"),
59495
59514
  /** Path to a spec file (.md, .yaml) to use as task input. */
59496
- specFile: z126.string().max(500).optional().describe("Path to a spec file \u2014 content prepended to task for greenfield projects"),
59515
+ specFile: z127.string().max(500).optional().describe("Path to a spec file \u2014 content prepended to task for greenfield projects"),
59497
59516
  /** Override template — see `listTemplateIds()` for the canonical list (#2728). Auto-detected if omitted. */
59498
- template: z126.string().max(50).optional().describe(`Pipeline template override. Available: ${listTemplateIds().join(", ")}`),
59517
+ template: z127.string().max(50).optional().describe(`Pipeline template override. Available: ${listTemplateIds().join(", ")}`),
59499
59518
  /** Voting strategy for consensus stages. */
59500
59519
  votingStrategy: VotingStrategySchema.optional().describe(
59501
59520
  "Voting strategy for plan approval. simple_majority (default), supermajority (67%), unanimous, higher_order (Bayesian), opinion_wise"
59502
59521
  ),
59503
59522
  /** Use 3 agents instead of 7 for faster voting. */
59504
- quickMode: z126.boolean().default(false).describe("Use 3 agents instead of 7 for faster consensus voting"),
59523
+ quickMode: z127.boolean().default(false).describe("Use 3 agents instead of 7 for faster consensus voting"),
59505
59524
  /**
59506
59525
  * Deadline for EACH stage in milliseconds (min 30s, max 600s), not a budget
59507
59526
  * for the whole run (#6730). Replaces every stage's default, the vote's
59508
59527
  * included; clamped to the `pipeline` class guard.
59509
59528
  */
59510
- timeoutMs: z126.number().int().min(3e4).max(6e5).optional().describe(
59529
+ timeoutMs: z127.number().int().min(3e4).max(6e5).optional().describe(
59511
59530
  "Max time for EACH stage in ms (30000-600000), not for the whole run; applies to every stage, the vote included. Default: the vote stage gets the multi-LLM panel guard (900000 unless overridden), other stages 120000"
59512
59531
  ),
59513
59532
  /** Stop after planning/voting (no implementation). */
59514
- dryRun: z126.boolean().default(false).describe("Stop after vote stage (no implementation)"),
59533
+ dryRun: z127.boolean().default(false).describe("Stop after vote stage (no implementation)"),
59515
59534
  /**
59516
59535
  * Dispatch mode (#3730). `sync` (default) runs the pipeline inline and
59517
59536
  * returns the result — but a real multi-stage adaptive run can exceed the
@@ -59522,7 +59541,7 @@ var PipelineInputSchema = z126.object({
59522
59541
  */
59523
59542
  ...asyncDispatchInputDefaultSync("Ignored for dryRun."),
59524
59543
  /** TESTS ONLY — random output, must not be used for real decisions. (#2319) */
59525
- simulateVotes: z126.boolean().default(false).describe("TESTS ONLY \u2014 random output, must not be used for real decisions (#2319)")
59544
+ simulateVotes: z127.boolean().default(false).describe("TESTS ONLY \u2014 random output, must not be used for real decisions (#2319)")
59526
59545
  });
59527
59546
  function buildOutput3(result, simulated) {
59528
59547
  return {
@@ -59548,14 +59567,14 @@ function buildOutput3(result, simulated) {
59548
59567
  rateLimitHint: result.error?.toLowerCase().includes("rate limit") === true ? "Consider using quickMode or increasing delay between pipeline runs" : void 0
59549
59568
  };
59550
59569
  }
59551
- var VoteEvidenceSchema = z126.object({
59552
- approvalPercentage: z126.number(),
59553
- voteRecordId: z126.string().optional()
59570
+ var VoteEvidenceSchema = z127.object({
59571
+ approvalPercentage: z127.number(),
59572
+ voteRecordId: z127.string().optional()
59554
59573
  });
59555
- var VoteResultSchema = z126.discriminatedUnion("kind", [
59556
- VoteEvidenceSchema.extend({ kind: z126.literal("approved") }),
59557
- VoteEvidenceSchema.extend({ kind: z126.literal("rejected"), feedback: z126.string() }),
59558
- VoteEvidenceSchema.extend({ kind: z126.literal("no_quorum"), reason: z126.string() })
59574
+ var VoteResultSchema = z127.discriminatedUnion("kind", [
59575
+ VoteEvidenceSchema.extend({ kind: z127.literal("approved") }),
59576
+ VoteEvidenceSchema.extend({ kind: z127.literal("rejected"), feedback: z127.string() }),
59577
+ VoteEvidenceSchema.extend({ kind: z127.literal("no_quorum"), reason: z127.string() })
59559
59578
  ]);
59560
59579
  function isVoteResult(value) {
59561
59580
  return VoteResultSchema.safeParse(value).success;
@@ -59657,7 +59676,7 @@ async function executePipelineBody(task, stages, run) {
59657
59676
  detail: output2
59658
59677
  });
59659
59678
  }
59660
- return structuredToolSuccess(z126.record(z126.string(), z126.unknown()), output2);
59679
+ return structuredToolSuccess(z127.record(z127.string(), z127.unknown()), output2);
59661
59680
  }
59662
59681
  function createPipelineAgentStages(input, config) {
59663
59682
  return createAgentStages({
@@ -59807,9 +59826,9 @@ function cancellableExecutor(strategy, executor, signal) {
59807
59826
  }
59808
59827
 
59809
59828
  // src/mcp/tools/run-tool.ts
59810
- var RunInputSchema = z127.object({
59811
- goal: z127.string().min(1).describe("Natural-language goal. nexus-agents selects how to execute it."),
59812
- forceStrategy: z127.enum([
59829
+ var RunInputSchema = z128.object({
59830
+ goal: z128.string().min(1).describe("Natural-language goal. nexus-agents selects how to execute it."),
59831
+ forceStrategy: z128.enum([
59813
59832
  "single-shot",
59814
59833
  "dev-pipeline",
59815
59834
  "pipeline",
@@ -59821,10 +59840,10 @@ var RunInputSchema = z127.object({
59821
59840
  ]).optional().describe(
59822
59841
  "Power-user override: force a specific strategy instead of letting the router choose."
59823
59842
  ),
59824
- requiresConsensus: z127.boolean().optional().describe("Hint: the task needs a multi-perspective consensus decision."),
59825
- dependencyStructure: z127.enum(["linear", "dag", "independent", "unknown"]).optional().describe("Hint: the dependency structure of the work."),
59826
- isNovel: z127.boolean().optional().describe("Hint: this kind of task has not been seen before."),
59827
- execute: z127.boolean().optional().describe(
59843
+ requiresConsensus: z128.boolean().optional().describe("Hint: the task needs a multi-perspective consensus decision."),
59844
+ dependencyStructure: z128.enum(["linear", "dag", "independent", "unknown"]).optional().describe("Hint: the dependency structure of the work."),
59845
+ isNovel: z128.boolean().optional().describe("Hint: this kind of task has not been seen before."),
59846
+ execute: z128.boolean().optional().describe(
59828
59847
  "When true, actually run the selected strategy (if an executor is wired) and return its result; otherwise return the routing decision only (default false, read-only)."
59829
59848
  ),
59830
59849
  /**
@@ -59839,7 +59858,7 @@ var RunInputSchema = z127.object({
59839
59858
  * other, the call is REFUSED rather than executed: silently ignoring a
59840
59859
  * do-not-act flag is the one outcome a governance substrate cannot allow.
59841
59860
  */
59842
- dryRun: z127.boolean().optional().describe(
59861
+ dryRun: z128.boolean().optional().describe(
59843
59862
  "Plan and vote only, no implementation (#4806). Requires the dev-pipeline strategy \u2014 refused (never silently executed) when the router selects another."
59844
59863
  ),
59845
59864
  /**
@@ -60075,12 +60094,12 @@ function registerRunTool(server, deps) {
60075
60094
  }
60076
60095
 
60077
60096
  // src/mcp/tools/list-available-models-tool.ts
60078
- import { z as z128 } from "zod";
60097
+ import { z as z129 } from "zod";
60079
60098
  var DESCRIPTION5 = "Probe every model-discovery transport (OpenRouter API, the configured gateway, and the opencode/claude/codex/gemini CLIs) and report a per-transport health summary: probe ok/failed, model count, and a sample of usable ids. Models with open route breakers are excluded; each CLI reports whether its default-route breaker is open. Use it to validate the CLIs and APIs are wired and reachable. Read-only; does not change routing.";
60080
60099
  var PROBE_TIMEOUT_MS = 12e3;
60081
- var ListAvailableModelsInputSchema = z128.object({
60082
- includeModelIds: z128.boolean().optional().describe("Include the full model-id list per transport (default false \u2192 sample of 5 only)."),
60083
- includeOpenRouter: z128.boolean().optional().describe("Probe the OpenRouter live catalog (default true).")
60100
+ var ListAvailableModelsInputSchema = z129.object({
60101
+ includeModelIds: z129.boolean().optional().describe("Include the full model-id list per transport (default false \u2192 sample of 5 only)."),
60102
+ includeOpenRouter: z129.boolean().optional().describe("Probe the OpenRouter live catalog (default true).")
60084
60103
  });
60085
60104
  async function probeSource(source, includeModelIds) {
60086
60105
  let timer;
@@ -60189,8 +60208,8 @@ async function listAvailableModelsHandler(args, deps, logger62) {
60189
60208
  function registerListAvailableModelsTool(server, deps) {
60190
60209
  const logger62 = deps.logger ?? createLogger({ tool: "list_available_models" });
60191
60210
  const toolSchema = {
60192
- includeModelIds: z128.boolean().optional().describe("Include the full model-id list per transport (default false \u2192 sample of 5 only)."),
60193
- includeOpenRouter: z128.boolean().optional().describe("Probe the OpenRouter live catalog (default true).")
60211
+ includeModelIds: z129.boolean().optional().describe("Include the full model-id list per transport (default false \u2192 sample of 5 only)."),
60212
+ includeOpenRouter: z129.boolean().optional().describe("Probe the OpenRouter live catalog (default true).")
60194
60213
  };
60195
60214
  const secureHandler = createSecureHandler(
60196
60215
  (args) => listAvailableModelsHandler(args, deps, logger62),
@@ -60214,9 +60233,9 @@ function registerListAvailableModelsTool(server, deps) {
60214
60233
  }
60215
60234
 
60216
60235
  // src/mcp/tools/pr-review-eval-types.ts
60217
- import { z as z129 } from "zod";
60236
+ import { z as z130 } from "zod";
60218
60237
  var MAX_EVAL_FINDINGS = 100;
60219
- var VoterEvalFindingSchema = z129.object({
60238
+ var VoterEvalFindingSchema = z130.object({
60220
60239
  summary: RawFindingSchema.shape.summary,
60221
60240
  location: RawFindingSchema.shape.location,
60222
60241
  severity: RawFindingSchema.shape.severity.unwrap(),
@@ -60224,14 +60243,14 @@ var VoterEvalFindingSchema = z129.object({
60224
60243
  gate: RawFindingSchema.shape.gate.extend({
60225
60244
  named_assertion: RawFindingSchema.shape.claim.min(0)
60226
60245
  }).optional(),
60227
- verified: z129.boolean().optional(),
60228
- classification: z129.enum(["TP", "FP", "FN", "excluded"]),
60229
- source: z129.enum(["voter", "ground_truth"]),
60246
+ verified: z130.boolean().optional(),
60247
+ classification: z130.enum(["TP", "FP", "FN", "excluded"]),
60248
+ source: z130.enum(["voter", "ground_truth"]),
60230
60249
  /** Original index in the voter's raw findings; repeated TP evidence shares it. */
60231
- findingIndex: z129.number().int().nonnegative().optional(),
60232
- knownBugIndex: z129.number().int().nonnegative().optional(),
60250
+ findingIndex: z130.number().int().nonnegative().optional(),
60251
+ knownBugIndex: z130.number().int().nonnegative().optional(),
60233
60252
  /** String fields shortened by the producer, never silently truncated. */
60234
- truncatedFields: z129.array(z129.enum(["summary", "location", "rationale", "gate.named_assertion"])).max(4).optional()
60253
+ truncatedFields: z130.array(z130.enum(["summary", "location", "rationale", "gate.named_assertion"])).max(4).optional()
60235
60254
  });
60236
60255
  var PR_REVIEW_EVAL_ROLES = [
60237
60256
  "architect",
@@ -60240,47 +60259,47 @@ var PR_REVIEW_EVAL_ROLES = [
60240
60259
  "catfish",
60241
60260
  "scope_steward"
60242
60261
  ];
60243
- var PrReviewEvalRoleSchema = z129.enum(PR_REVIEW_EVAL_ROLES);
60244
- var PrReviewCaseClassSchema = z129.enum(["buggy", "clean", "borderline"]);
60245
- var VoterEvalVerdictSchema = z129.object({
60262
+ var PrReviewEvalRoleSchema = z130.enum(PR_REVIEW_EVAL_ROLES);
60263
+ var PrReviewCaseClassSchema = z130.enum(["buggy", "clean", "borderline"]);
60264
+ var VoterEvalVerdictSchema = z130.object({
60246
60265
  /** Stable record id (e.g. `${runId}:${caseNumber}:${role}`). */
60247
- id: z129.string().min(1).max(160),
60266
+ id: z130.string().min(1).max(160),
60248
60267
  /** The pr_review run / batch this verdict belongs to. */
60249
- runId: z129.string().min(1).max(64),
60268
+ runId: z130.string().min(1).max(64),
60250
60269
  /** Dataset case identifier (the dataset's `number` field). */
60251
- caseNumber: z129.string().min(1).max(80),
60270
+ caseNumber: z130.string().min(1).max(80),
60252
60271
  /** Rubric class of the case (ground-truth label). */
60253
60272
  caseClass: PrReviewCaseClassSchema,
60254
60273
  /** The voter role being scored. */
60255
60274
  role: PrReviewEvalRoleSchema,
60256
60275
  /** Verified findings that matched a known bug. */
60257
- truePositives: z129.number().int().nonnegative(),
60276
+ truePositives: z130.number().int().nonnegative(),
60258
60277
  /** Verified findings on clean code that matched no known bug. */
60259
- falsePositives: z129.number().int().nonnegative(),
60278
+ falsePositives: z130.number().int().nonnegative(),
60260
60279
  /** Known bugs this voter failed to flag. */
60261
- falseNegatives: z129.number().int().nonnegative(),
60280
+ falseNegatives: z130.number().int().nonnegative(),
60262
60281
  /** Optional for legacy records/count-only callers; [] means measured, no evidence. */
60263
- findings: z129.array(VoterEvalFindingSchema).max(MAX_EVAL_FINDINGS).optional(),
60282
+ findings: z130.array(VoterEvalFindingSchema).max(MAX_EVAL_FINDINGS).optional(),
60264
60283
  /** Number of evidence entries omitted at the cap; full tallies are unchanged. */
60265
- findingsTruncated: z129.number().int().nonnegative().optional(),
60284
+ findingsTruncated: z130.number().int().nonnegative().optional(),
60266
60285
  /** Rubric version the ground truth was adjudicated under. */
60267
- rubricVersion: z129.string().min(1).max(32),
60286
+ rubricVersion: z130.string().min(1).max(32),
60268
60287
  /** ISO-8601 timestamp the verdict was recorded. */
60269
- timestamp: z129.string().min(1).max(40)
60288
+ timestamp: z130.string().min(1).max(40)
60270
60289
  });
60271
- var VoterEvalVerdictQuerySchema = z129.object({
60290
+ var VoterEvalVerdictQuerySchema = z130.object({
60272
60291
  role: PrReviewEvalRoleSchema.optional(),
60273
- runId: z129.string().min(1).max(64).optional(),
60292
+ runId: z130.string().min(1).max(64).optional(),
60274
60293
  caseClass: PrReviewCaseClassSchema.optional(),
60275
- rubricVersion: z129.string().min(1).max(32).optional(),
60294
+ rubricVersion: z130.string().min(1).max(32).optional(),
60276
60295
  /** ISO-8601 lower bound (inclusive) on `timestamp`. */
60277
- since: z129.string().optional(),
60296
+ since: z130.string().optional(),
60278
60297
  /** Most-recent-N cap. */
60279
- limit: z129.number().int().positive().optional()
60298
+ limit: z130.number().int().positive().optional()
60280
60299
  });
60281
60300
 
60282
60301
  // src/mcp/tools/supply-chain-tradeoff-panel.ts
60283
- import { z as z130 } from "zod";
60302
+ import { z as z131 } from "zod";
60284
60303
  import { randomUUID as randomUUID21 } from "node:crypto";
60285
60304
  var DEFAULT_AXES = [
60286
60305
  "build_time_determinism",
@@ -60302,16 +60321,16 @@ var FULL_PANEL = [
60302
60321
  "scope_steward"
60303
60322
  ];
60304
60323
  var QUICK_PANEL = ["architect", "security", "scope_steward"];
60305
- var SupplyChainTradeoffPanelInputSchema = z130.object({
60306
- proposal: z130.string().min(1).max(MAX_PROPOSAL_LENGTH2).describe('The proposal under tradeoff review (e.g. "Should aegis-boot adopt cargo-nextest?")'),
60307
- axes: z130.array(z130.string().min(1).max(MAX_AXIS_NAME_LENGTH)).min(1).max(MAX_AXES).optional().describe(
60324
+ var SupplyChainTradeoffPanelInputSchema = z131.object({
60325
+ proposal: z131.string().min(1).max(MAX_PROPOSAL_LENGTH2).describe('The proposal under tradeoff review (e.g. "Should aegis-boot adopt cargo-nextest?")'),
60326
+ axes: z131.array(z131.string().min(1).max(MAX_AXIS_NAME_LENGTH)).min(1).max(MAX_AXES).optional().describe(
60308
60327
  `Tradeoff axes to evaluate. Default: ${DEFAULT_AXES.join(", ")}. Custom axes accepted; max ${String(MAX_AXES)}.`
60309
60328
  ),
60310
- context: z130.string().max(MAX_CONTEXT_LENGTH).optional().describe(
60329
+ context: z131.string().max(MAX_CONTEXT_LENGTH).optional().describe(
60311
60330
  "Optional context: relevant repo state, dependency tree, vendor publishing patterns, etc."
60312
60331
  ),
60313
- quickMode: z130.boolean().optional().default(false).describe("Use 3 voters (architect, security, scope_steward) instead of 7"),
60314
- simulate: z130.boolean().optional().default(false).describe("Use simulated voters (testing only)"),
60332
+ quickMode: z131.boolean().optional().default(false).describe("Use 3 voters (architect, security, scope_steward) instead of 7"),
60333
+ simulate: z131.boolean().optional().default(false).describe("Use simulated voters (testing only)"),
60315
60334
  // #6123: same field as consensus_vote — the panel judges the caller's project.
60316
60335
  project: VoterProjectInputSchema,
60317
60336
  /**
@@ -60809,40 +60828,40 @@ var RiskLevel = /* @__PURE__ */ ((RiskLevel2) => {
60809
60828
  })(RiskLevel || {});
60810
60829
 
60811
60830
  // src/mcp/safety/stpa-schemas.ts
60812
- import { z as z131 } from "zod";
60813
- var HazardCategorySchema = z131.enum(HazardCategory);
60814
- var HazardSeveritySchema = z131.enum(HazardSeverity);
60815
- var ConstraintPrioritySchema = z131.enum(ConstraintPriority);
60816
- var RiskLevelSchema = z131.enum(RiskLevel);
60817
- var TriggerPatternSchema = z131.object({
60818
- parameter: z131.string().min(1),
60819
- matchType: z131.enum(["contains", "regex", "equals", "startsWith", "endsWith"]),
60820
- pattern: z131.string(),
60821
- reason: z131.string()
60822
- });
60823
- var HazardSchema = z131.object({
60824
- id: z131.string().min(1),
60825
- description: z131.string(),
60831
+ import { z as z132 } from "zod";
60832
+ var HazardCategorySchema = z132.enum(HazardCategory);
60833
+ var HazardSeveritySchema = z132.enum(HazardSeverity);
60834
+ var ConstraintPrioritySchema = z132.enum(ConstraintPriority);
60835
+ var RiskLevelSchema = z132.enum(RiskLevel);
60836
+ var TriggerPatternSchema = z132.object({
60837
+ parameter: z132.string().min(1),
60838
+ matchType: z132.enum(["contains", "regex", "equals", "startsWith", "endsWith"]),
60839
+ pattern: z132.string(),
60840
+ reason: z132.string()
60841
+ });
60842
+ var HazardSchema = z132.object({
60843
+ id: z132.string().min(1),
60844
+ description: z132.string(),
60826
60845
  category: HazardCategorySchema,
60827
60846
  severity: HazardSeveritySchema,
60828
- likelihood: z131.enum(["almost_certain", "likely", "possible", "unlikely", "rare"]),
60829
- triggerConditions: z131.array(z131.string()),
60830
- consequences: z131.array(z131.string())
60831
- });
60832
- var UnsafeControlActionSchema = z131.object({
60833
- id: z131.string().min(1),
60834
- toolName: z131.string().min(1),
60835
- type: z131.enum(["not_provided", "provided_causes_hazard", "wrong_timing", "wrong_duration"]),
60836
- description: z131.string(),
60837
- unsafeContext: z131.string(),
60838
- relatedHazards: z131.array(z131.string()),
60839
- triggerPatterns: z131.array(TriggerPatternSchema).optional()
60840
- });
60841
- var SafetyConstraintSchema = z131.object({
60842
- id: z131.string().min(1),
60843
- description: z131.string(),
60844
- mitigates: z131.array(z131.string()),
60845
- enforcement: z131.enum([
60847
+ likelihood: z132.enum(["almost_certain", "likely", "possible", "unlikely", "rare"]),
60848
+ triggerConditions: z132.array(z132.string()),
60849
+ consequences: z132.array(z132.string())
60850
+ });
60851
+ var UnsafeControlActionSchema = z132.object({
60852
+ id: z132.string().min(1),
60853
+ toolName: z132.string().min(1),
60854
+ type: z132.enum(["not_provided", "provided_causes_hazard", "wrong_timing", "wrong_duration"]),
60855
+ description: z132.string(),
60856
+ unsafeContext: z132.string(),
60857
+ relatedHazards: z132.array(z132.string()),
60858
+ triggerPatterns: z132.array(TriggerPatternSchema).optional()
60859
+ });
60860
+ var SafetyConstraintSchema = z132.object({
60861
+ id: z132.string().min(1),
60862
+ description: z132.string(),
60863
+ mitigates: z132.array(z132.string()),
60864
+ enforcement: z132.enum([
60846
60865
  "prevent",
60847
60866
  "require_confirmation",
60848
60867
  "alert",
@@ -60850,52 +60869,52 @@ var SafetyConstraintSchema = z131.object({
60850
60869
  "rate_limit",
60851
60870
  "require_privilege"
60852
60871
  ]),
60853
- validationFunction: z131.string().optional(),
60872
+ validationFunction: z132.string().optional(),
60854
60873
  priority: ConstraintPrioritySchema
60855
60874
  });
60856
- var PropertySchemaSchema = z131.object({
60857
- type: z131.string(),
60858
- description: z131.string().optional(),
60859
- enum: z131.array(z131.unknown()).optional(),
60860
- pattern: z131.string().optional(),
60861
- minimum: z131.number().optional(),
60862
- maximum: z131.number().optional()
60863
- });
60864
- var ToolInputSchemaSchema = z131.object({
60865
- type: z131.string(),
60866
- properties: z131.record(z131.string(), PropertySchemaSchema).optional(),
60867
- required: z131.array(z131.string()).optional(),
60868
- additionalProperties: z131.boolean().optional()
60869
- });
60870
- var ToolDefinitionSchema = z131.object({
60871
- name: z131.string().min(1),
60872
- description: z131.string(),
60875
+ var PropertySchemaSchema = z132.object({
60876
+ type: z132.string(),
60877
+ description: z132.string().optional(),
60878
+ enum: z132.array(z132.unknown()).optional(),
60879
+ pattern: z132.string().optional(),
60880
+ minimum: z132.number().optional(),
60881
+ maximum: z132.number().optional()
60882
+ });
60883
+ var ToolInputSchemaSchema = z132.object({
60884
+ type: z132.string(),
60885
+ properties: z132.record(z132.string(), PropertySchemaSchema).optional(),
60886
+ required: z132.array(z132.string()).optional(),
60887
+ additionalProperties: z132.boolean().optional()
60888
+ });
60889
+ var ToolDefinitionSchema = z132.object({
60890
+ name: z132.string().min(1),
60891
+ description: z132.string(),
60873
60892
  inputSchema: ToolInputSchemaSchema
60874
60893
  });
60875
- var AnalysisConfigurationSchema = z131.object({
60876
- includeLowSeverity: z131.boolean().default(true),
60877
- generateAllConstraints: z131.boolean().default(true),
60878
- checkInteractions: z131.boolean().default(true),
60879
- maxHazardsPerTool: z131.number().int().min(1).max(100).default(50),
60880
- categories: z131.array(HazardCategorySchema).default([])
60894
+ var AnalysisConfigurationSchema = z132.object({
60895
+ includeLowSeverity: z132.boolean().default(true),
60896
+ generateAllConstraints: z132.boolean().default(true),
60897
+ checkInteractions: z132.boolean().default(true),
60898
+ maxHazardsPerTool: z132.number().int().min(1).max(100).default(50),
60899
+ categories: z132.array(HazardCategorySchema).default([])
60881
60900
  });
60882
- var ConstraintViolationSchema = z131.object({
60883
- constraintId: z131.string().min(1),
60884
- constraintDescription: z131.string(),
60901
+ var ConstraintViolationSchema = z132.object({
60902
+ constraintId: z132.string().min(1),
60903
+ constraintDescription: z132.string(),
60885
60904
  severity: HazardSeveritySchema,
60886
- details: z131.string(),
60887
- remediation: z131.string()
60888
- });
60889
- var ValidationWarningSchema = z131.object({
60890
- code: z131.string().min(1),
60891
- message: z131.string(),
60892
- affected: z131.string()
60893
- });
60894
- var ValidationResultSchema = z131.object({
60895
- valid: z131.boolean(),
60896
- toolName: z131.string().min(1),
60897
- violations: z131.array(ConstraintViolationSchema),
60898
- passed: z131.array(z131.string()),
60905
+ details: z132.string(),
60906
+ remediation: z132.string()
60907
+ });
60908
+ var ValidationWarningSchema = z132.object({
60909
+ code: z132.string().min(1),
60910
+ message: z132.string(),
60911
+ affected: z132.string()
60912
+ });
60913
+ var ValidationResultSchema = z132.object({
60914
+ valid: z132.boolean(),
60915
+ toolName: z132.string().min(1),
60916
+ violations: z132.array(ConstraintViolationSchema),
60917
+ passed: z132.array(z132.string()),
60899
60918
  // Optional rather than required, deliberately. `ValidationResult` declares
60900
60919
  // both fields required because every result this package produces has them;
60901
60920
  // the schema is the lenient inbound edge for a result that arrived from
@@ -60906,10 +60925,10 @@ var ValidationResultSchema = z131.object({
60906
60925
  // "nothing was evaluated". The strict/lenient split is safe because nothing
60907
60926
  // bridges the two with `z.infer`: a parsed result will not typecheck as a
60908
60927
  // `ValidationResult` without handling the absent fields.
60909
- evaluated: z131.array(z131.string()).optional(),
60910
- notApplicable: z131.array(z131.string()).optional(),
60911
- warnings: z131.array(ValidationWarningSchema),
60912
- validatedAt: z131.date()
60928
+ evaluated: z132.array(z132.string()).optional(),
60929
+ notApplicable: z132.array(z132.string()).optional(),
60930
+ warnings: z132.array(ValidationWarningSchema),
60931
+ validatedAt: z132.date()
60913
60932
  });
60914
60933
 
60915
60934
  // src/mcp/safety/stpa-types.ts
@@ -62009,18 +62028,18 @@ var GeminiResponseParser = class {
62009
62028
  };
62010
62029
 
62011
62030
  // src/cli-adapters/router-types.ts
62012
- import { z as z132 } from "zod";
62013
- var RouterConfigSchema = z132.object({
62014
- preferCostEfficient: z132.boolean().default(false)
62031
+ import { z as z133 } from "zod";
62032
+ var RouterConfigSchema = z133.object({
62033
+ preferCostEfficient: z133.boolean().default(false)
62015
62034
  });
62016
62035
 
62017
62036
  // src/cli-adapters/task-classifier.ts
62018
- import { z as z133 } from "zod";
62019
- var ClassificationPatternsSchema = z133.object({
62020
- code: z133.array(z133.string()).readonly(),
62021
- research: z133.array(z133.string()).readonly(),
62022
- documentation: z133.array(z133.string()).readonly(),
62023
- analysis: z133.array(z133.string()).readonly()
62037
+ import { z as z134 } from "zod";
62038
+ var ClassificationPatternsSchema = z134.object({
62039
+ code: z134.array(z134.string()).readonly(),
62040
+ research: z134.array(z134.string()).readonly(),
62041
+ documentation: z134.array(z134.string()).readonly(),
62042
+ analysis: z134.array(z134.string()).readonly()
62024
62043
  });
62025
62044
 
62026
62045
  // src/security/sandbox/sandbox-types.ts
@@ -63422,4 +63441,4 @@ export {
63422
63441
  initializeSandbox,
63423
63442
  getSandboxMode
63424
63443
  };
63425
- //# sourceMappingURL=chunk-YSEMHACQ.js.map
63444
+ //# sourceMappingURL=chunk-TK723ERO.js.map