nexus-agents 2.125.2 → 2.125.4

package/dist/{chunk-LL6G4PUG.js → chunk-GCYA3Y3L.js}

@@ -2,7 +2,7 @@ import {
   TASK_CATEGORIES,
   getAdaptiveBonus,
   getOutcomeStore
-} from "./chunk-2UXRYB7S.js";
+} from "./chunk-G76X4ULX.js";
 
 // src/cli/doctor-deep.ts
 var CLI_NAMES = ["claude", "gemini", "codex", "opencode"];
@@ -106,4 +106,4 @@ export {
   runDeepDiagnostics,
   formatDeepDiagnostics
 };
-//# sourceMappingURL=chunk-LL6G4PUG.js.map
+//# sourceMappingURL=chunk-GCYA3Y3L.js.map

package/dist/{chunk-OT3WR5BK.js → chunk-IUGXMWCB.js}

@@ -3,7 +3,7 @@ import {
   MODEL_IDS,
   getTimeProvider,
   resolveModelIdentitySync
-} from "./chunk-2UXRYB7S.js";
+} from "./chunk-G76X4ULX.js";
 
 // src/config/model-availability.ts
 var DEFAULT_TTL_MS = 6e4;
@@ -150,4 +150,4 @@ export {
   resetAvailabilityCache,
   filterAvailableModels
 };
-//# sourceMappingURL=chunk-OT3WR5BK.js.map
+//# sourceMappingURL=chunk-IUGXMWCB.js.map

package/dist/{chunk-DUQ2D7ID.js → chunk-J22XW4IH.js}

@@ -10,7 +10,7 @@ import {
   getTokenEstimator,
   isRateLimitLikeError,
   ok
-} from "./chunk-2UXRYB7S.js";
+} from "./chunk-G76X4ULX.js";
 
 // src/adapters/base-adapter.ts
 var AdapterModelError = class extends ModelError {
@@ -707,4 +707,4 @@ export {
   DEFAULT_COLLECT_STREAM_MAX_CHUNKS,
   collectStream
 };
-//# sourceMappingURL=chunk-DUQ2D7ID.js.map
+//# sourceMappingURL=chunk-J22XW4IH.js.map

package/dist/{chunk-QD2C3CBD.js → chunk-K3MKXREZ.js}

@@ -11,7 +11,7 @@ import {
   getErrorMessage,
   getTimeProvider,
   ok
-} from "./chunk-2UXRYB7S.js";
+} from "./chunk-G76X4ULX.js";
 import {
   getNexusDataDir
 } from "./chunk-CH7QIDHQ.js";
@@ -2628,4 +2628,4 @@ export {
   VOTING_THRESHOLDS,
   ConsensusMetricsSchema
 };
-//# sourceMappingURL=chunk-QD2C3CBD.js.map
+//# sourceMappingURL=chunk-K3MKXREZ.js.map

package/dist/{chunk-J7UM3D2A.js → chunk-KHTC44IA.js}

@@ -1,14 +1,14 @@
 import {
   GitHubProvider,
   ScmError
-} from "./chunk-JQSB3FRF.js";
+} from "./chunk-YCPAQ4AG.js";
 import {
   resolveToken
-} from "./chunk-IPFBSZYU.js";
+} from "./chunk-DMSI3IZF.js";
 import {
   err,
   ok
-} from "./chunk-2UXRYB7S.js";
+} from "./chunk-G76X4ULX.js";
 
 // src/scm/factory.ts
 async function createScmProvider(config) {
@@ -41,4 +41,4 @@ export {
   createScmProvider,
   createGitHubProvider
 };
-//# sourceMappingURL=chunk-J7UM3D2A.js.map
+//# sourceMappingURL=chunk-KHTC44IA.js.map

package/dist/{chunk-NJJOVGHY.js → chunk-L7IOK5MX.js}

@@ -1,6 +1,6 @@
 import {
   runConfigInitSync
-} from "./chunk-PBMXKQCK.js";
+} from "./chunk-MMWNGT2K.js";
 import {
   VERSION,
   checkApiKeys,
@@ -8,10 +8,10 @@ import {
   checkSqlite,
   defaultConfig,
   initDataDirectories
-} from "./chunk-U67JEWQ5.js";
+} from "./chunk-EXY42SO7.js";
 import {
   probeAllClis
-} from "./chunk-TSAEDXVB.js";
+} from "./chunk-QN3353M2.js";
 import {
   BUILT_IN_EXPERTS
 } from "./chunk-ZM4O442V.js";
@@ -25,7 +25,7 @@ import {
   getErrorMessage,
   getTimeProvider,
   symbols
-} from "./chunk-2UXRYB7S.js";
+} from "./chunk-G76X4ULX.js";
 import {
   ensureGitignored,
   findRepoRoot
@@ -2000,4 +2000,4 @@ export {
   setupCommand,
   setupCommandAsync
 };
-//# sourceMappingURL=chunk-NJJOVGHY.js.map
+//# sourceMappingURL=chunk-L7IOK5MX.js.map

package/dist/{chunk-PBMXKQCK.js → chunk-MMWNGT2K.js}

@@ -1,6 +1,6 @@
 import {
   getErrorMessage
-} from "./chunk-2UXRYB7S.js";
+} from "./chunk-G76X4ULX.js";
 
 // src/cli/setup-config.ts
 import { copyFileSync, existsSync, mkdirSync, writeFileSync } from "fs";
@@ -77,4 +77,4 @@ function ensureBackup(outputPath) {
 export {
   runConfigInitSync
 };
-//# sourceMappingURL=chunk-PBMXKQCK.js.map
+//# sourceMappingURL=chunk-MMWNGT2K.js.map

package/dist/{chunk-6MFQJEFC.js → chunk-NCL7UPLL.js}

@@ -7,15 +7,16 @@ import {
   toolStructuredError,
   toolSuccessStructured,
   wrapToolWithTimeout
-} from "./chunk-QD2C3CBD.js";
+} from "./chunk-K3MKXREZ.js";
 import {
+  SECURITY_KEYWORDS,
   createLogger,
   formatZodError,
   getErrorMessage,
   getOutcomeStore,
   getPipelineEventBus,
   getTimeProvider
-} from "./chunk-2UXRYB7S.js";
+} from "./chunk-G76X4ULX.js";
 import {
   getNexusDataDir
 } from "./chunk-CH7QIDHQ.js";
@@ -741,8 +742,16 @@ function improvementSignalsToTasks(signals, existingTaskIds) {
 }
 
 // src/mcp/tools/improvement-remediation-shadow.ts
+function isSecuritySignal(signal) {
+  if (signal.category === "security") return true;
+  const haystack = `${signal.signalKey}
+${signal.title}
+${signal.body}`.toLowerCase();
+  return SECURITY_KEYWORDS.some((kw) => haystack.includes(kw));
+}
 function evaluateRemediationShadow(signal) {
-  const isSecurity = signal.category === "security";
+  const isSecurity = isSecuritySignal(signal);
+  const gatedByKeyword = isSecurity && signal.category !== "security";
   return {
     timestamp: new Date(getTimeProvider().now()).toISOString(),
     signalKey: signal.signalKey,
@@ -750,7 +759,7 @@ function evaluateRemediationShadow(signal) {
     category: signal.category,
     severity: signal.severity,
     wouldAutoRemediate: !isSecurity,
-    reason: isSecurity ? "security-category \u2014 always human-gated, never auto-remediated" : "shadow: would route to the dev-pipeline for remediation (not executed)"
+    reason: gatedByKeyword ? `security-related (keyword match, declared category '${signal.category}') \u2014 fail-closed human-gated` : isSecurity ? "security-category \u2014 always human-gated, never auto-remediated" : "shadow: would route to the dev-pipeline for remediation (not executed)"
   };
 }
 var DEFAULT_MAX_RECORDS = 200;
@@ -1256,4 +1265,4 @@ export {
   runImprovementReview,
   registerImprovementReviewTool
 };
-//# sourceMappingURL=chunk-6MFQJEFC.js.map
+//# sourceMappingURL=chunk-NCL7UPLL.js.map