nexus-agents 2.113.0 → 2.114.0

package/dist/{chunk-RPWYEJ66.js → chunk-CLL2GXNL.js}

@@ -1,7 +1,7 @@
 import {
   GitHubProvider,
   ScmError
-} from "./chunk-3DB4DEFY.js";
+} from "./chunk-Q6HUW6EI.js";
 import {
   ROLE_DEFAULT_TRUST,
   ReputationCache,
@@ -11,13 +11,13 @@ import {
   gateWithReputation,
   resolveReputationGatingMode,
   sanitizeInput
-} from "./chunk-AWXWDGG5.js";
+} from "./chunk-S7RTQRQ3.js";
 import {
   createLogger,
   err,
   getTimeProvider,
   ok
-} from "./chunk-JRBUSUYD.js";
+} from "./chunk-ZXF2XA4R.js";
 
 // src/security/trust-classifier.ts
 function mapAuthorAssociation(association) {
@@ -1390,4 +1390,4 @@ export {
   IssueTriage,
   createIssueTriage
 };
-//# sourceMappingURL=chunk-RPWYEJ66.js.map
+//# sourceMappingURL=chunk-CLL2GXNL.js.map

package/dist/chunk-E2ER3LQF.js

@@ -0,0 +1,149 @@
+import {
+  resolveInsideRoot
+} from "./chunk-NUBSJGQZ.js";
+import {
+  ParseError,
+  SecurityError,
+  err,
+  getErrorMessage,
+  ok,
+  parseBoolEnv
+} from "./chunk-ZXF2XA4R.js";
+
+// src/cli/research-helpers-io.ts
+import * as fs2 from "fs/promises";
+import { join, resolve as resolve2 } from "path";
+import { parse as parseYaml, stringify as stringifyYaml2 } from "yaml";
+
+// src/cli/research-scaffold.ts
+import * as fs from "fs/promises";
+import { existsSync } from "fs";
+import { dirname, resolve } from "path";
+import { stringify as stringifyYaml } from "yaml";
+var SCHEMA_VERSION = "1.0";
+var ANNOUNCED = /* @__PURE__ */ new Set();
+function announceOnce(path, kind) {
+  if (ANNOUNCED.has(path)) return;
+  ANNOUNCED.add(path);
+  process.stderr.write(
+    `[scaffold] Created empty ${kind} at ${path}; add entries via 'nexus-agents research add' or research_add MCP tool.
+`
+  );
+}
+function scaffoldDisabled() {
+  return parseBoolEnv("NEXUS_NO_SCAFFOLD", false);
+}
+function emptyPapersYaml() {
+  return stringifyYaml({ schema_version: SCHEMA_VERSION, papers: {} });
+}
+function emptyTechniquesYaml() {
+  return stringifyYaml({ schema_version: SCHEMA_VERSION, techniques: {} });
+}
+async function ensureRegistryFile(rootDir, filename) {
+  const filePath = resolve(rootDir, REGISTRY_PATH, filename);
+  if (existsSync(filePath)) return ok(filePath);
+  if (scaffoldDisabled()) {
+    return err(
+      new ParseError(
+        `Registry file missing: ${filePath}. Scaffolding disabled (NEXUS_NO_SCAFFOLD=1). Create the file manually or unset the env var.`
+      )
+    );
+  }
+  if (!existsSync(resolve(rootDir, "docs"))) {
+    return err(
+      new ParseError(
+        `Registry file missing: ${filePath}. ${rootDir}/docs/ does not exist; refusing to create a Nexus subtree in a non-documented root. Run 'nexus-agents init' first, or create ${rootDir}/docs/ manually.`
+      )
+    );
+  }
+  try {
+    await fs.mkdir(dirname(filePath), { recursive: true });
+    const content = filename === PAPERS_FILE ? emptyPapersYaml() : emptyTechniquesYaml();
+    await fs.writeFile(filePath, content, "utf-8");
+    announceOnce(filePath, filename);
+    return ok(filePath);
+  } catch (e) {
+    return err(
+      new ParseError(
+        `Failed to scaffold ${filename} at ${filePath}: ${getErrorMessage(e)}. Set NEXUS_NO_SCAFFOLD=1 and create manually if scaffolding is unwanted.`
+      )
+    );
+  }
+}
+
+// src/cli/research-helpers-io.ts
+var REGISTRY_PATH = "docs/research/registry";
+var TECHNIQUES_FILE = "techniques.yaml";
+var PAPERS_FILE = "papers.yaml";
+function getProjectRoot() {
+  return process.cwd();
+}
+function validatePath(constructedPath, allowedRoot) {
+  const resolved = resolveInsideRoot(constructedPath, allowedRoot);
+  if (resolved === null) {
+    return {
+      ok: false,
+      error: new SecurityError("Path traversal detected: path escapes allowed root directory", {
+        context: { constructedPath, allowedRoot: resolve2(allowedRoot) }
+      })
+    };
+  }
+  return { ok: true, value: resolved };
+}
+async function loadTechniquesRegistry(rootDir) {
+  const root = rootDir ?? process.cwd();
+  const filePath = join(root, REGISTRY_PATH, TECHNIQUES_FILE);
+  const pathValidation = validatePath(filePath, root);
+  if (!pathValidation.ok) {
+    return pathValidation;
+  }
+  await ensureRegistryFile(root, TECHNIQUES_FILE);
+  try {
+    const content = await fs2.readFile(pathValidation.value, "utf-8");
+    return { ok: true, value: parseYaml(content) };
+  } catch (error) {
+    const message = getErrorMessage(error);
+    return { ok: false, error: new ParseError(`Failed to load techniques registry: ${message}`) };
+  }
+}
+async function loadPapersRegistry(rootDir) {
+  const root = rootDir ?? process.cwd();
+  const filePath = join(root, REGISTRY_PATH, PAPERS_FILE);
+  const pathValidation = validatePath(filePath, root);
+  if (!pathValidation.ok) {
+    return pathValidation;
+  }
+  await ensureRegistryFile(root, PAPERS_FILE);
+  try {
+    const content = await fs2.readFile(pathValidation.value, "utf-8");
+    return { ok: true, value: parseYaml(content) };
+  } catch (error) {
+    const message = getErrorMessage(error);
+    return { ok: false, error: new ParseError(`Failed to load papers registry: ${message}`) };
+  }
+}
+async function savePapersRegistry(registry, rootDir) {
+  const root = rootDir ?? process.cwd();
+  const filePath = join(root, REGISTRY_PATH, PAPERS_FILE);
+  const pathValidation = validatePath(filePath, root);
+  if (!pathValidation.ok) {
+    return pathValidation;
+  }
+  try {
+    const content = stringifyYaml2(registry, { lineWidth: 100 });
+    await fs2.writeFile(pathValidation.value, content, "utf-8");
+    return { ok: true, value: void 0 };
+  } catch (error) {
+    const message = getErrorMessage(error);
+    return { ok: false, error: new ParseError(`Failed to save papers registry: ${message}`) };
+  }
+}
+
+export {
+  REGISTRY_PATH,
+  getProjectRoot,
+  loadTechniquesRegistry,
+  loadPapersRegistry,
+  savePapersRegistry
+};
+//# sourceMappingURL=chunk-E2ER3LQF.js.map

package/dist/chunk-E2ER3LQF.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/research-helpers-io.ts","../src/cli/research-scaffold.ts"],"sourcesContent":["/**\n * Research Registry I/O Operations\n *\n * File operations for loading and saving research registry YAML files.\n * Includes path traversal protection per Issue #353.\n *\n * @see docs/research/RESEARCH_INDEX.md\n * @see Issue #237 (Epic #225)\n * @see Issue #353 (Security - Path traversal fix)\n */\n\nimport * as fs from 'node:fs/promises';\nimport { join, resolve } from 'node:path';\nimport { resolveInsideRoot } from '../security/safe-path.js';\nimport { parse as parseYaml, stringify as stringifyYaml } from 'yaml';\nimport type { Result } from '../core/index.js';\nimport { SecurityError, getErrorMessage } from '../core/index.js';\nimport { ParseError } from '../core/types/workflow.js';\nimport type { TechniquesRegistry, PapersRegistry } from './research-types.js';\nimport { ensureRegistryFile } from './research-scaffold.js';\n\n// =============================================================================\n// CONSTANTS\n// =============================================================================\n\n/** Path to research registry directory relative to project root */\nexport const REGISTRY_PATH = 'docs/research/registry';\n\n/** Filename for techniques registry */\nexport const TECHNIQUES_FILE = 'techniques.yaml';\n\n/** Filename for papers registry */\nexport const PAPERS_FILE = 'papers.yaml';\n\n// =============================================================================\n// PROJECT ROOT\n// =============================================================================\n\n/**\n * Get the project root directory.\n * Note: Returns cwd since registry operations use explicit rootDir parameter\n */\nexport function getProjectRoot(): string {\n  return process.cwd();\n}\n\n// =============================================================================\n// PATH VALIDATION\n// =============================================================================\n\n/**\n * Validates that a constructed path stays within the allowed root directory.\n * Prevents path traversal attacks (e.g., ../../../etc/passwd).\n *\n * @param constructedPath - The full path to validate\n * @param allowedRoot - The root directory that paths must be within\n * @returns Result with validated absolute path or SecurityError\n */\nfunction validatePath(constructedPath: string, allowedRoot: string): Result<string, SecurityError> {\n  const resolved = resolveInsideRoot(constructedPath, allowedRoot);\n  if (resolved === null) {\n    return {\n      ok: false,\n      error: new SecurityError('Path traversal detected: path escapes allowed root directory', {\n        context: { constructedPath, allowedRoot: resolve(allowedRoot) },\n      }),\n    };\n  }\n  return { ok: true, value: resolved };\n}\n\n// =============================================================================\n// LOAD OPERATIONS\n// =============================================================================\n\n/**\n * Load techniques registry from YAML file.\n * Validates path to prevent directory traversal attacks.\n *\n * @param rootDir - Project root directory (defaults to cwd)\n * @returns Result with TechniquesRegistry or SecurityError/ParseError\n */\nexport async function loadTechniquesRegistry(\n  rootDir?: string\n): Promise<Result<TechniquesRegistry, SecurityError | ParseError>> {\n  const root = rootDir ?? process.cwd();\n  const filePath = join(root, REGISTRY_PATH, TECHNIQUES_FILE);\n\n  const pathValidation = validatePath(filePath, root);\n  if (!pathValidation.ok) {\n    return pathValidation;\n  }\n\n  // #2470: try to scaffold an empty techniques.yaml on first run so research_*\n  // workflows don't error on a fresh install. No-op when file exists.\n  // When scaffold refuses (e.g. <rootDir>/docs/ doesn't exist, or\n  // NEXUS_NO_SCAFFOLD=1), fall through and let readFile produce the original\n  // ENOENT error — that's the existing contract.\n  await ensureRegistryFile(root, TECHNIQUES_FILE);\n\n  try {\n    const content = await fs.readFile(pathValidation.value, 'utf-8');\n    return { ok: true, value: parseYaml(content) as TechniquesRegistry };\n  } catch (error) {\n    const message = getErrorMessage(error);\n    return { ok: false, error: new ParseError(`Failed to load techniques registry: ${message}`) };\n  }\n}\n\n/**\n * Load papers registry from YAML file.\n * Validates path to prevent directory traversal attacks.\n *\n * @param rootDir - Project root directory (defaults to cwd)\n * @returns Result with PapersRegistry or SecurityError/ParseError\n */\nexport async function loadPapersRegistry(\n  rootDir?: string\n): Promise<Result<PapersRegistry, SecurityError | ParseError>> {\n  const root = rootDir ?? process.cwd();\n  const filePath = join(root, REGISTRY_PATH, PAPERS_FILE);\n\n  const pathValidation = validatePath(filePath, root);\n  if (!pathValidation.ok) {\n    return pathValidation;\n  }\n\n  // #2470: try to scaffold an empty papers.yaml on first run so research_*\n  // workflows don't error on a fresh install. No-op when file exists; falls\n  // through silently when scaffold refuses (no docs/ root, or NEXUS_NO_SCAFFOLD).\n  await ensureRegistryFile(root, PAPERS_FILE);\n\n  try {\n    const content = await fs.readFile(pathValidation.value, 'utf-8');\n    return { ok: true, value: parseYaml(content) as PapersRegistry };\n  } catch (error) {\n    const message = getErrorMessage(error);\n    return { ok: false, error: new ParseError(`Failed to load papers registry: ${message}`) };\n  }\n}\n\n// =============================================================================\n// SAVE OPERATIONS\n// =============================================================================\n\n/**\n * Save techniques registry to YAML file.\n * Validates path to prevent directory traversal attacks.\n *\n * @param registry - The techniques registry to save\n * @param rootDir - Project root directory (defaults to cwd)\n * @returns Result with void on success or SecurityError/ParseError on failure\n */\nexport async function saveTechniquesRegistry(\n  registry: TechniquesRegistry,\n  rootDir?: string\n): Promise<Result<void, SecurityError | ParseError>> {\n  const root = rootDir ?? process.cwd();\n  const filePath = join(root, REGISTRY_PATH, TECHNIQUES_FILE);\n\n  const pathValidation = validatePath(filePath, root);\n  if (!pathValidation.ok) {\n    return pathValidation;\n  }\n\n  try {\n    const content = stringifyYaml(registry, { lineWidth: 100 });\n    await fs.writeFile(pathValidation.value, content, 'utf-8');\n    return { ok: true, value: undefined };\n  } catch (error) {\n    const message = getErrorMessage(error);\n    return { ok: false, error: new ParseError(`Failed to save techniques registry: ${message}`) };\n  }\n}\n\n/**\n * Save papers registry to YAML file.\n * Validates path to prevent directory traversal attacks.\n *\n * @param registry - The papers registry to save\n * @param rootDir - Project root directory (defaults to cwd)\n * @returns Result with void on success or SecurityError/ParseError on failure\n */\nexport async function savePapersRegistry(\n  registry: PapersRegistry,\n  rootDir?: string\n): Promise<Result<void, SecurityError | ParseError>> {\n  const root = rootDir ?? process.cwd();\n  const filePath = join(root, REGISTRY_PATH, PAPERS_FILE);\n\n  const pathValidation = validatePath(filePath, root);\n  if (!pathValidation.ok) {\n    return pathValidation;\n  }\n\n  try {\n    const content = stringifyYaml(registry, { lineWidth: 100 });\n    await fs.writeFile(pathValidation.value, content, 'utf-8');\n    return { ok: true, value: undefined };\n  } catch (error) {\n    const message = getErrorMessage(error);\n    return { ok: false, error: new ParseError(`Failed to save papers registry: ${message}`) };\n  }\n}\n","/**\n * research-scaffold — auto-create empty research registry files when missing.\n *\n * On a fresh install or in a sandboxed environment where the project doesn't\n * have `docs/research/registry/`, the research workflows previously errored\n * with `Failed to load papers registry: ENOENT`. The user has no idea what\n * to do.\n *\n * This module provides `ensureResearchRegistry()`: idempotent scaffolding\n * that creates empty YAML registries on ENOENT, announces what it did to\n * stderr (so the operator knows), and returns the path that's now safe to\n * read.\n *\n * Source: Issue #2470 (epic #2467 child).\n */\n\nimport * as fs from 'node:fs/promises';\nimport { existsSync } from 'node:fs';\nimport { dirname, resolve } from 'node:path';\nimport { stringify as stringifyYaml } from 'yaml';\n\nimport type { Result } from '../core/index.js';\nimport { ok, err, getErrorMessage } from '../core/index.js';\nimport { ParseError } from '../core/types/workflow.js';\n\nimport { REGISTRY_PATH, PAPERS_FILE, TECHNIQUES_FILE } from './research-helpers-io.js';\nimport { parseBoolEnv } from '../config/defaults-env.js';\n\n/**\n * Names of the registry files this scaffolder knows how to create.\n * `sources.yaml` and `alignments.yaml` live alongside but are populated by\n * different code paths; this scaffolder only owns the two YAML registries\n * that block `research_query` / `research_synthesize` on a fresh install.\n */\ntype ScaffoldedFile = typeof PAPERS_FILE | typeof TECHNIQUES_FILE;\n\nconst SCHEMA_VERSION = '1.0';\n\nconst ANNOUNCED = new Set<string>();\n\nfunction announceOnce(path: string, kind: ScaffoldedFile): void {\n  // De-dupe so that running multiple research commands in one session\n  // produces one announcement per scaffolded file, not per call.\n  if (ANNOUNCED.has(path)) return;\n  ANNOUNCED.add(path);\n  process.stderr.write(\n    `[scaffold] Created empty ${kind} at ${path}; add entries via 'nexus-agents research add' or research_add MCP tool.\\n`\n  );\n}\n\n/**\n * Operator opt-out. When set, scaffolding errors loudly with an actionable\n * message instead of silently writing files. Useful for CI and for\n * environments that want strict \"fail when state is wrong\" semantics.\n */\nfunction scaffoldDisabled(): boolean {\n  return parseBoolEnv('NEXUS_NO_SCAFFOLD', false);\n}\n\nfunction emptyPapersYaml(): string {\n  return stringifyYaml({ schema_version: SCHEMA_VERSION, papers: {} });\n}\n\nfunction emptyTechniquesYaml(): string {\n  return stringifyYaml({ schema_version: SCHEMA_VERSION, techniques: {} });\n}\n\n/**\n * Create the registry directory + an empty YAML file if either is missing.\n * Idempotent: existing files are left untouched.\n *\n * Scaffolds only when `<rootDir>/docs/` already exists. That guard keeps\n * tests, vitest's package cwd, and random scratch directories from getting\n * a `docs/research/` subtree implicitly. Operators on a real project root\n * (which always has `docs/`, either from cloning the repo or running\n * `nexus-agents init`) still get the auto-create behavior the issue asks for.\n *\n * Returns the resolved file path on success, or a ParseError when scaffolding\n * is disabled / refused (so the caller can pass the error through unchanged\n * for backwards compat with existing call sites).\n */\nexport async function ensureRegistryFile(\n  rootDir: string,\n  filename: ScaffoldedFile\n): Promise<Result<string, ParseError>> {\n  const filePath = resolve(rootDir, REGISTRY_PATH, filename);\n\n  if (existsSync(filePath)) return ok(filePath);\n\n  if (scaffoldDisabled()) {\n    return err(\n      new ParseError(\n        `Registry file missing: ${filePath}. Scaffolding disabled (NEXUS_NO_SCAFFOLD=1). Create the file manually or unset the env var.`\n      )\n    );\n  }\n\n  // Refuse to create a docs/ subtree in directories that aren't already\n  // documented project roots. The presence of `<rootDir>/docs/` is the\n  // strong signal we use.\n  if (!existsSync(resolve(rootDir, 'docs'))) {\n    return err(\n      new ParseError(\n        `Registry file missing: ${filePath}. ${rootDir}/docs/ does not exist; ` +\n          `refusing to create a Nexus subtree in a non-documented root. ` +\n          `Run 'nexus-agents init' first, or create ${rootDir}/docs/ manually.`\n      )\n    );\n  }\n\n  try {\n    await fs.mkdir(dirname(filePath), { recursive: true });\n    const content = filename === PAPERS_FILE ? emptyPapersYaml() : emptyTechniquesYaml();\n    await fs.writeFile(filePath, content, 'utf-8');\n    announceOnce(filePath, filename);\n    return ok(filePath);\n  } catch (e: unknown) {\n    return err(\n      new ParseError(\n        `Failed to scaffold ${filename} at ${filePath}: ${getErrorMessage(e)}. Set NEXUS_NO_SCAFFOLD=1 and create manually if scaffolding is unwanted.`\n      )\n    );\n  }\n}\n\n/**\n * Convenience: scaffold both papers.yaml and techniques.yaml. Used by the\n * research workflow startup paths that need both registries available.\n */\nexport async function ensureResearchRegistry(rootDir?: string): Promise<Result<void, ParseError>> {\n  const root = rootDir ?? process.cwd();\n  const papers = await ensureRegistryFile(root, PAPERS_FILE);\n  if (!papers.ok) return papers;\n  const techniques = await ensureRegistryFile(root, TECHNIQUES_FILE);\n  if (!techniques.ok) return techniques;\n  return ok(undefined);\n}\n\n/**\n * Test-only reset of the announcement de-dupe set. Production code never\n * needs this; tests do because Vitest reuses process state across files.\n */\nexport function _resetAnnouncedForTests(): void {\n  ANNOUNCED.clear();\n}\n"],"mappings":";;;;;;;;;;;;;AAWA,YAAYA,SAAQ;AACpB,SAAS,MAAM,WAAAC,gBAAe;AAE9B,SAAS,SAAS,WAAW,aAAaC,sBAAqB;;;ACE/D,YAAY,QAAQ;AACpB,SAAS,kBAAkB;AAC3B,SAAS,SAAS,eAAe;AACjC,SAAS,aAAa,qBAAqB;AAiB3C,IAAM,iBAAiB;AAEvB,IAAM,YAAY,oBAAI,IAAY;AAElC,SAAS,aAAa,MAAc,MAA4B;AAG9D,MAAI,UAAU,IAAI,IAAI,EAAG;AACzB,YAAU,IAAI,IAAI;AAClB,UAAQ,OAAO;AAAA,IACb,4BAA4B,IAAI,OAAO,IAAI;AAAA;AAAA,EAC7C;AACF;AAOA,SAAS,mBAA4B;AACnC,SAAO,aAAa,qBAAqB,KAAK;AAChD;AAEA,SAAS,kBAA0B;AACjC,SAAO,cAAc,EAAE,gBAAgB,gBAAgB,QAAQ,CAAC,EAAE,CAAC;AACrE;AAEA,SAAS,sBAA8B;AACrC,SAAO,cAAc,EAAE,gBAAgB,gBAAgB,YAAY,CAAC,EAAE,CAAC;AACzE;AAgBA,eAAsB,mBACpB,SACA,UACqC;AACrC,QAAM,WAAW,QAAQ,SAAS,eAAe,QAAQ;AAEzD,MAAI,WAAW,QAAQ,EAAG,QAAO,GAAG,QAAQ;AAE5C,MAAI,iBAAiB,GAAG;AACtB,WAAO;AAAA,MACL,IAAI;AAAA,QACF,0BAA0B,QAAQ;AAAA,MACpC;AAAA,IACF;AAAA,EACF;AAKA,MAAI,CAAC,WAAW,QAAQ,SAAS,MAAM,CAAC,GAAG;AACzC,WAAO;AAAA,MACL,IAAI;AAAA,QACF,0BAA0B,QAAQ,KAAK,OAAO,gIAEA,OAAO;AAAA,MACvD;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,UAAS,SAAM,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AACrD,UAAM,UAAU,aAAa,cAAc,gBAAgB,IAAI,oBAAoB;AACnF,UAAS,aAAU,UAAU,SAAS,OAAO;AAC7C,iBAAa,UAAU,QAAQ;AAC/B,WAAO,GAAG,QAAQ;AAAA,EACpB,SAAS,GAAY;AACnB,WAAO;AAAA,MACL,IAAI;AAAA,QACF,sBAAsB,QAAQ,OAAO,QAAQ,KAAK,gBAAgB,CAAC,CAAC;AAAA,MACtE;AAAA,IACF;AAAA,EACF;AACF;;;ADjGO,IAAM,gBAAgB;AAGtB,IAAM,kBAAkB;AAGxB,IAAM,cAAc;AAUpB,SAAS,iBAAyB;AACvC,SAAO,QAAQ,IAAI;AACrB;AAcA,SAAS,aAAa,iBAAyB,aAAoD;AACjG,QAAM,WAAW,kBAAkB,iBAAiB,WAAW;AAC/D,MAAI,aAAa,MAAM;AACrB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,OAAO,IAAI,cAAc,gEAAgE;AAAA,QACvF,SAAS,EAAE,iBAAiB,aAAaC,SAAQ,WAAW,EAAE;AAAA,MAChE,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO,EAAE,IAAI,MAAM,OAAO,SAAS;AACrC;AAaA,eAAsB,uBACpB,SACiE;AACjE,QAAM,OAAO,WAAW,QAAQ,IAAI;AACpC,QAAM,WAAW,KAAK,MAAM,eAAe,eAAe;AAE1D,QAAM,iBAAiB,aAAa,UAAU,IAAI;AAClD,MAAI,CAAC,eAAe,IAAI;AACtB,WAAO;AAAA,EACT;AAOA,QAAM,mBAAmB,MAAM,eAAe;AAE9C,MAAI;AACF,UAAM,UAAU,MAAS,aAAS,eAAe,OAAO,OAAO;AAC/D,WAAO,EAAE,IAAI,MAAM,OAAO,UAAU,OAAO,EAAwB;AAAA,EACrE,SAAS,OAAO;AACd,UAAM,UAAU,gBAAgB,KAAK;AACrC,WAAO,EAAE,IAAI,OAAO,OAAO,IAAI,WAAW,uCAAuC,OAAO,EAAE,EAAE;AAAA,EAC9F;AACF;AASA,eAAsB,mBACpB,SAC6D;AAC7D,QAAM,OAAO,WAAW,QAAQ,IAAI;AACpC,QAAM,WAAW,KAAK,MAAM,eAAe,WAAW;AAEtD,QAAM,iBAAiB,aAAa,UAAU,IAAI;AAClD,MAAI,CAAC,eAAe,IAAI;AACtB,WAAO;AAAA,EACT;AAKA,QAAM,mBAAmB,MAAM,WAAW;AAE1C,MAAI;AACF,UAAM,UAAU,MAAS,aAAS,eAAe,OAAO,OAAO;AAC/D,WAAO,EAAE,IAAI,MAAM,OAAO,UAAU,OAAO,EAAoB;AAAA,EACjE,SAAS,OAAO;AACd,UAAM,UAAU,gBAAgB,KAAK;AACrC,WAAO,EAAE,IAAI,OAAO,OAAO,IAAI,WAAW,mCAAmC,OAAO,EAAE,EAAE;AAAA,EAC1F;AACF;AA4CA,eAAsB,mBACpB,UACA,SACmD;AACnD,QAAM,OAAO,WAAW,QAAQ,IAAI;AACpC,QAAM,WAAW,KAAK,MAAM,eAAe,WAAW;AAEtD,QAAM,iBAAiB,aAAa,UAAU,IAAI;AAClD,MAAI,CAAC,eAAe,IAAI;AACtB,WAAO;AAAA,EACT;AAEA,MAAI;AACF,UAAM,UAAUC,eAAc,UAAU,EAAE,WAAW,IAAI,CAAC;AAC1D,UAAS,cAAU,eAAe,OAAO,SAAS,OAAO;AACzD,WAAO,EAAE,IAAI,MAAM,OAAO,OAAU;AAAA,EACtC,SAAS,OAAO;AACd,UAAM,UAAU,gBAAgB,KAAK;AACrC,WAAO,EAAE,IAAI,OAAO,OAAO,IAAI,WAAW,mCAAmC,OAAO,EAAE,EAAE;AAAA,EAC1F;AACF;","names":["fs","resolve","stringifyYaml","resolve","stringifyYaml"]}

package/dist/{chunk-TIOXPJIO.js → chunk-E4HZTSBP.js}

@@ -3,7 +3,7 @@ import {
   MODEL_IDS,
   getTimeProvider,
   resolveModelIdentitySync
-} from "./chunk-JRBUSUYD.js";
+} from "./chunk-ZXF2XA4R.js";
 
 // src/config/model-availability.ts
 var DEFAULT_TTL_MS = 6e4;
@@ -150,4 +150,4 @@ export {
   resetAvailabilityCache,
   filterAvailableModels
 };
-//# sourceMappingURL=chunk-TIOXPJIO.js.map
+//# sourceMappingURL=chunk-E4HZTSBP.js.map

package/dist/{chunk-SXG2NPZP.js → chunk-F6NOHVYQ.js}

@@ -2,14 +2,14 @@ import {
   CircuitBreakerRegistry,
   CircuitError,
   mapCliErrorToCategory
-} from "./chunk-5EH7WMME.js";
+} from "./chunk-5RDUP5K7.js";
 import {
   createLogger,
   err,
   getFallbackChainForCategory,
   getTimeProvider,
   ok
-} from "./chunk-JRBUSUYD.js";
+} from "./chunk-ZXF2XA4R.js";
 
 // src/cli-adapters/cli-circuit-breaker.ts
 var CATEGORY_TO_FALLBACK = {
@@ -152,4 +152,4 @@ export {
   CliCircuitBreakerIntegration,
   createCliCircuitBreakerIntegration
 };
-//# sourceMappingURL=chunk-SXG2NPZP.js.map
+//# sourceMappingURL=chunk-F6NOHVYQ.js.map

package/dist/{chunk-JPCEQZPE.js → chunk-FSZNZZO5.js}

@@ -7,10 +7,10 @@ import {
 import {
   createAllAdapters,
   probeCli
-} from "./chunk-F2ULTSZ6.js";
+} from "./chunk-XMNGHZBR.js";
 import {
   DEFAULTS
-} from "./chunk-3XGPHTO6.js";
+} from "./chunk-7AO4FKAD.js";
 import {
   CliNameSchema,
   DEFAULT_CAPABILITIES,
@@ -26,7 +26,7 @@ import {
   ok,
   symbols,
   writeLine
-} from "./chunk-JRBUSUYD.js";
+} from "./chunk-ZXF2XA4R.js";
 import {
   detectSandbox,
   getLearningDir,
@@ -40,7 +40,7 @@ import {
 } from "./chunk-CH7QIDHQ.js";
 
 // src/version.ts
-var VERSION = true ? "2.113.0" : "dev";
+var VERSION = true ? "2.114.0" : "dev";
 
 // src/config/schemas-core.ts
 import { z } from "zod";
@@ -2099,7 +2099,7 @@ async function runDoctorFix(result) {
   writeLine2("\u2500".repeat(40));
   let fixCount = 0;
   if (!result.dataDirectory.rootExists || result.dataDirectory.subdirectories.some((d) => !d.exists || !d.writable)) {
-    const { runSetup } = await import("./setup-command-UZTCNASI.js");
+    const { runSetup } = await import("./setup-command-MWZ5M3UB.js");
     const setupResult = runSetup({
       skipMcp: true,
       skipRules: true,
@@ -2113,7 +2113,7 @@ async function runDoctorFix(result) {
     }
   }
   if (!result.configFile.found) {
-    const { runConfigInitSync } = await import("./setup-config-R7GWRUW2.js");
+    const { runConfigInitSync } = await import("./setup-config-ICI5OIGW.js");
     const configResult = runConfigInitSync(process.cwd(), false, false);
     if (configResult.success && configResult.created) {
       writeLine2(`\u2713 Generated config: ${configResult.path}`);
@@ -2211,4 +2211,4 @@ export {
   startStdioServer,
   closeServer
 };
-//# sourceMappingURL=chunk-JPCEQZPE.js.map
+//# sourceMappingURL=chunk-FSZNZZO5.js.map

package/dist/{chunk-NCWD4UOI.js → chunk-IBRRXLMJ.js}

@@ -1,11 +1,11 @@
 import {
   resolveCliSlot
-} from "./chunk-TIOXPJIO.js";
+} from "./chunk-E4HZTSBP.js";
 import {
   createLogger,
   getTimeProvider,
   isRateLimitText
-} from "./chunk-JRBUSUYD.js";
+} from "./chunk-ZXF2XA4R.js";
 
 // src/pipeline/expert-bridge.ts
 function resolveCliFromModelString(model) {
@@ -21,7 +21,7 @@ async function getMcpConfigPath() {
   if (cachedMcpConfigPath !== null) return cachedMcpConfigPath;
   mcpConfigInitPromise ??= (async () => {
     try {
-      const { generateMcpConfig } = await import("./child-mcp-config-UMNWY25S.js");
+      const { generateMcpConfig } = await import("./child-mcp-config-BTYHNG2N.js");
       const config = await generateMcpConfig();
       cachedMcpConfigPath = config.configPath;
       cachedMcpConfigCleanup = config.cleanup;
@@ -93,8 +93,8 @@ var routerInitPromise = null;
 async function getRouter() {
   if (cachedRouter !== null) return cachedRouter;
   routerInitPromise ??= (async () => {
-    const { createAllAdapters } = await import("./factory-AIERXI3O.js");
-    const { createCompositeRouter } = await import("./composite-router-VWQ65U6B.js");
+    const { createAllAdapters } = await import("./factory-3FKPAH26.js");
+    const { createCompositeRouter } = await import("./composite-router-QC4OLIQ5.js");
     const adapters = createAllAdapters();
     if (adapters.size === 0) {
       routerInitPromise = null;
@@ -102,7 +102,7 @@ async function getRouter() {
     }
     cachedRouter = adaptCompositeRouter(createCompositeRouter(adapters));
     try {
-      const { createCliCircuitBreakerIntegration } = await import("./cli-circuit-breaker-XB5FPZJ5.js");
+      const { createCliCircuitBreakerIntegration } = await import("./cli-circuit-breaker-OR2Z2ZXU.js");
       cachedCircuitBreaker = createCliCircuitBreakerIntegration([...adapters.values()]);
     } catch (error) {
       const msg = error instanceof Error ? error.message : String(error);
@@ -213,4 +213,4 @@ export {
   tokenSplitFromUsage,
   executeExpert
 };
-//# sourceMappingURL=chunk-NCWD4UOI.js.map
+//# sourceMappingURL=chunk-IBRRXLMJ.js.map

package/dist/{chunk-FSODHLOV.js → chunk-KTPMJSLZ.js}

@@ -3,14 +3,14 @@ import {
   createStream,
   requireApiKey,
   validateApiKeyPresence
-} from "./chunk-5OOFU3EY.js";
+} from "./chunk-3S4N6OCF.js";
 import {
   ModelCapability,
   err,
   getCliModelName,
   getTokenEstimator,
   ok
-} from "./chunk-JRBUSUYD.js";
+} from "./chunk-ZXF2XA4R.js";
 
 // src/adapters/openai-types.ts
 var OPENAI_MODELS = {
@@ -553,4 +553,4 @@ export {
   OpenAIAdapter,
   createOpenAIAdapter
 };
-//# sourceMappingURL=chunk-FSODHLOV.js.map
+//# sourceMappingURL=chunk-KTPMJSLZ.js.map

package/dist/{chunk-2JIV7Q6A.js → chunk-MD6TVSOI.js}

@@ -1,6 +1,6 @@
 import {
   OpenAIAdapter
-} from "./chunk-FSODHLOV.js";
+} from "./chunk-KTPMJSLZ.js";
 import {
   ConfigError,
   createLogger,
@@ -9,7 +9,7 @@ import {
   getTimeProvider,
   lookupInTreeCapability,
   ok
-} from "./chunk-JRBUSUYD.js";
+} from "./chunk-ZXF2XA4R.js";
 import {
   getNexusDataDir
 } from "./chunk-CH7QIDHQ.js";
@@ -307,4 +307,4 @@ export {
   discoverModels,
   buildOpenAICompatAdapters
 };
-//# sourceMappingURL=chunk-2JIV7Q6A.js.map
+//# sourceMappingURL=chunk-MD6TVSOI.js.map

package/dist/{chunk-WDOJESN6.js → chunk-MYN7CMD5.js}

@@ -2,7 +2,7 @@ import {
   TASK_CATEGORIES,
   getAdaptiveBonus,
   getOutcomeStore
-} from "./chunk-JRBUSUYD.js";
+} from "./chunk-ZXF2XA4R.js";
 
 // src/cli/doctor-deep.ts
 var CLI_NAMES = ["claude", "gemini", "codex", "opencode"];
@@ -106,4 +106,4 @@ export {
   runDeepDiagnostics,
   formatDeepDiagnostics
 };
-//# sourceMappingURL=chunk-WDOJESN6.js.map
+//# sourceMappingURL=chunk-MYN7CMD5.js.map

package/dist/{chunk-ZSJG7EB2.js → chunk-N7NCTB3O.js}

@@ -1,147 +1,13 @@
 import {
-  resolveInsideRoot
-} from "./chunk-NUBSJGQZ.js";
+  loadPapersRegistry
+} from "./chunk-E2ER3LQF.js";
 import {
-  ParseError,
-  SecurityError,
-  err,
-  getErrorMessage,
-  ok,
-  parseBoolEnv
-} from "./chunk-JRBUSUYD.js";
+  getErrorMessage
+} from "./chunk-ZXF2XA4R.js";
 
 // src/cli/research-helpers-synthesize.ts
 import { z } from "zod";
 
-// src/cli/research-helpers-io.ts
-import * as fs2 from "fs/promises";
-import { join, resolve as resolve2 } from "path";
-import { parse as parseYaml, stringify as stringifyYaml2 } from "yaml";
-
-// src/cli/research-scaffold.ts
-import * as fs from "fs/promises";
-import { existsSync } from "fs";
-import { dirname, resolve } from "path";
-import { stringify as stringifyYaml } from "yaml";
-var SCHEMA_VERSION = "1.0";
-var ANNOUNCED = /* @__PURE__ */ new Set();
-function announceOnce(path, kind) {
-  if (ANNOUNCED.has(path)) return;
-  ANNOUNCED.add(path);
-  process.stderr.write(
-    `[scaffold] Created empty ${kind} at ${path}; add entries via 'nexus-agents research add' or research_add MCP tool.
-`
-  );
-}
-function scaffoldDisabled() {
-  return parseBoolEnv("NEXUS_NO_SCAFFOLD", false);
-}
-function emptyPapersYaml() {
-  return stringifyYaml({ schema_version: SCHEMA_VERSION, papers: {} });
-}
-function emptyTechniquesYaml() {
-  return stringifyYaml({ schema_version: SCHEMA_VERSION, techniques: {} });
-}
-async function ensureRegistryFile(rootDir, filename) {
-  const filePath = resolve(rootDir, REGISTRY_PATH, filename);
-  if (existsSync(filePath)) return ok(filePath);
-  if (scaffoldDisabled()) {
-    return err(
-      new ParseError(
-        `Registry file missing: ${filePath}. Scaffolding disabled (NEXUS_NO_SCAFFOLD=1). Create the file manually or unset the env var.`
-      )
-    );
-  }
-  if (!existsSync(resolve(rootDir, "docs"))) {
-    return err(
-      new ParseError(
-        `Registry file missing: ${filePath}. ${rootDir}/docs/ does not exist; refusing to create a Nexus subtree in a non-documented root. Run 'nexus-agents init' first, or create ${rootDir}/docs/ manually.`
-      )
-    );
-  }
-  try {
-    await fs.mkdir(dirname(filePath), { recursive: true });
-    const content = filename === PAPERS_FILE ? emptyPapersYaml() : emptyTechniquesYaml();
-    await fs.writeFile(filePath, content, "utf-8");
-    announceOnce(filePath, filename);
-    return ok(filePath);
-  } catch (e) {
-    return err(
-      new ParseError(
-        `Failed to scaffold ${filename} at ${filePath}: ${getErrorMessage(e)}. Set NEXUS_NO_SCAFFOLD=1 and create manually if scaffolding is unwanted.`
-      )
-    );
-  }
-}
-
-// src/cli/research-helpers-io.ts
-var REGISTRY_PATH = "docs/research/registry";
-var TECHNIQUES_FILE = "techniques.yaml";
-var PAPERS_FILE = "papers.yaml";
-function getProjectRoot() {
-  return process.cwd();
-}
-function validatePath(constructedPath, allowedRoot) {
-  const resolved = resolveInsideRoot(constructedPath, allowedRoot);
-  if (resolved === null) {
-    return {
-      ok: false,
-      error: new SecurityError("Path traversal detected: path escapes allowed root directory", {
-        context: { constructedPath, allowedRoot: resolve2(allowedRoot) }
-      })
-    };
-  }
-  return { ok: true, value: resolved };
-}
-async function loadTechniquesRegistry(rootDir) {
-  const root = rootDir ?? process.cwd();
-  const filePath = join(root, REGISTRY_PATH, TECHNIQUES_FILE);
-  const pathValidation = validatePath(filePath, root);
-  if (!pathValidation.ok) {
-    return pathValidation;
-  }
-  await ensureRegistryFile(root, TECHNIQUES_FILE);
-  try {
-    const content = await fs2.readFile(pathValidation.value, "utf-8");
-    return { ok: true, value: parseYaml(content) };
-  } catch (error) {
-    const message = getErrorMessage(error);
-    return { ok: false, error: new ParseError(`Failed to load techniques registry: ${message}`) };
-  }
-}
-async function loadPapersRegistry(rootDir) {
-  const root = rootDir ?? process.cwd();
-  const filePath = join(root, REGISTRY_PATH, PAPERS_FILE);
-  const pathValidation = validatePath(filePath, root);
-  if (!pathValidation.ok) {
-    return pathValidation;
-  }
-  await ensureRegistryFile(root, PAPERS_FILE);
-  try {
-    const content = await fs2.readFile(pathValidation.value, "utf-8");
-    return { ok: true, value: parseYaml(content) };
-  } catch (error) {
-    const message = getErrorMessage(error);
-    return { ok: false, error: new ParseError(`Failed to load papers registry: ${message}`) };
-  }
-}
-async function savePapersRegistry(registry, rootDir) {
-  const root = rootDir ?? process.cwd();
-  const filePath = join(root, REGISTRY_PATH, PAPERS_FILE);
-  const pathValidation = validatePath(filePath, root);
-  if (!pathValidation.ok) {
-    return pathValidation;
-  }
-  try {
-    const content = stringifyYaml2(registry, { lineWidth: 100 });
-    await fs2.writeFile(pathValidation.value, content, "utf-8");
-    return { ok: true, value: void 0 };
-  } catch (error) {
-    const message = getErrorMessage(error);
-    return { ok: false, error: new ParseError(`Failed to save papers registry: ${message}`) };
-  }
-}
-
 // src/cli/research-alignment-map.ts
 var TECHNIQUE_IMPLEMENTATION_MAP = /* @__PURE__ */ new Map([
   // Routing techniques
@@ -1006,13 +872,8 @@ function attributeFindings(papers) {
 }
 
 export {
-  REGISTRY_PATH,
-  getProjectRoot,
-  loadTechniquesRegistry,
-  loadPapersRegistry,
-  savePapersRegistry,
   normalizeTopicToCanonical,
   AttributedInsightSchema,
   synthesizeResearch
 };
-//# sourceMappingURL=chunk-ZSJG7EB2.js.map
+//# sourceMappingURL=chunk-N7NCTB3O.js.map