nexus-agents 2.145.1 → 2.147.0

package/dist/{consensus-vote-6V3JNRXI.js → consensus-vote-IBT3C5YC.js}

@@ -7,9 +7,10 @@ import {
   registerConsensusVoteTool,
   resetCorrelationTracker,
   runConsensusForGoal
-} from "./chunk-QKWS3REM.js";
+} from "./chunk-45QUEZNS.js";
 import "./chunk-Y7Z7H66M.js";
-import "./chunk-J2KMYVWA.js";
+import "./chunk-RII4VXHO.js";
+import "./chunk-RCQLUJY3.js";
 import "./chunk-R4YCNXN2.js";
 import "./chunk-6T3EPABN.js";
 import "./chunk-B6VRJBDI.js";
@@ -36,4 +37,4 @@ export {
   resetCorrelationTracker,
   runConsensusForGoal
 };
-//# sourceMappingURL=consensus-vote-6V3JNRXI.js.map
+//# sourceMappingURL=consensus-vote-IBT3C5YC.js.map

package/dist/{improvement-review-K7YYYZCJ.js → improvement-review-WMDMS32T.js}

@@ -11,8 +11,9 @@ import {
   loadSelfEvalSignals,
   registerImprovementReviewTool,
   runImprovementReview
-} from "./chunk-AREFLH3S.js";
-import "./chunk-J2KMYVWA.js";
+} from "./chunk-Y4NDNQYU.js";
+import "./chunk-RII4VXHO.js";
+import "./chunk-RCQLUJY3.js";
 import "./chunk-Q4UU2W6L.js";
 import "./chunk-NL7SZQPW.js";
 import "./chunk-DHVMSIT5.js";
@@ -31,4 +32,4 @@ export {
   registerImprovementReviewTool,
   runImprovementReview
 };
-//# sourceMappingURL=improvement-review-K7YYYZCJ.js.map
+//# sourceMappingURL=improvement-review-WMDMS32T.js.map

package/dist/index.d.ts

@@ -20915,6 +20915,12 @@ interface OrchestrateDeps extends BaseMcpToolDeps {
     modelAdapter?: IModelAdapter | undefined;
     /** MCP notifier for client-visible logging (Issue #974) */
     notifier?: IMcpNotifier | undefined;
+    /**
+     * Durable, hash-chained audit logger (#4097). When present, ClawGuard
+     * AUDIT-mode violations during the orchestrator's nested tool calls are
+     * persisted to the shared store. Absent on the pure-CLI path → no trail.
+     */
+    auditLogger?: IAuditLogger;
 }
 declare class OrchestrationError extends AgentError$1 {
     constructor(message: string, options?: {
@@ -24073,6 +24079,12 @@ type ExecuteExpertInput = z.infer<typeof ExecuteExpertInputSchema>;
 interface ExecuteExpertDeps extends BaseMcpToolDeps {
     /** Registry of created experts (shared with create_expert) */
     expertRegistry: Map<string, Expert>;
+    /**
+     * Durable, hash-chained audit logger (#4097). When present, ClawGuard
+     * AUDIT-mode violations during the expert's nested tool calls are persisted
+     * to the shared store. Absent on the pure-CLI path → no trail established.
+     */
+    auditLogger?: IAuditLogger;
     /** Optional CLI detection cache for checking available CLIs (Issue #747) */
     cliCache?: ICliDetectionCache;
     /** MCP notifier for client-visible logging (Issue #974) */
@@ -29979,7 +29991,7 @@ declare function requiresCitation(actionType: AgentActionType): boolean;
  * Discriminated union of audit event types.
  * Each event captures a single security pipeline decision.
  */
-type AuditEvent = TrustClassificationEvent | PolicyGateEvent | CorroborationEvent | ReputationEvent | SanitizationEvent | GraphExecutionAuditEvent;
+type AuditEvent = TrustClassificationEvent | PolicyGateEvent | CorroborationEvent | ReputationEvent | SanitizationEvent | GraphExecutionAuditEvent | ClawGuardViolationEvent;
 /** Base fields shared by all audit events. */
 interface AuditEventBase {
     readonly id: string;
@@ -30074,6 +30086,26 @@ interface SanitizationEvent extends AuditEventBase {
      */
     readonly strippedElements: readonly StrippedElementSummary[];
 }
+/**
+ * ClawGuard AUDIT-mode violation (#4097). Records a tool call that VIOLATED the
+ * derived access policy but was ALLOWED to proceed because the policy is in
+ * `audit` mode (log-and-allow). Persisting these is what lets the audit→enforce
+ * graduation loop size the real violation rate from durable telemetry rather
+ * than ephemeral logs.
+ */
+interface ClawGuardViolationEvent extends AuditEventBase {
+    readonly type: 'clawguard_violation';
+    /** The tool whose call violated the policy. */
+    readonly toolName: string;
+    /** Human-readable warning from the access decision (may be truncated). */
+    readonly warning: string;
+    /** Source of the derived policy (`llm` / `fallback-keyword` / `bypass`). */
+    readonly policySource: string;
+    /** Policy mode under which the violation was allowed (e.g. `audit`). */
+    readonly mode: string;
+    /** Request ID of the offending tool call, for correlation. */
+    readonly requestId: string;
+}
 /** Graph execution lifecycle event (Issue #839). */
 interface GraphExecutionAuditEvent extends AuditEventBase {
     readonly type: 'graph_execution';

package/dist/index.js

@@ -520,7 +520,7 @@ import {
   validateWorkflow,
   validateWorkflowDependencies,
   withLogging
-} from "./chunk-IIGRVRKD.js";
+} from "./chunk-VFA66KF5.js";
 import {
   OPENAI_MODELS,
   OPENAI_MODEL_ALIASES,
@@ -560,7 +560,7 @@ import {
   getKnownNexusVarNames,
   startStdioServer,
   validateNexusEnv
-} from "./chunk-SDJLXKZZ.js";
+} from "./chunk-LREXQ6DP.js";
 import {
   CliCircuitBreakerIntegration,
   createCliCircuitBreakerIntegration
@@ -616,30 +616,20 @@ import {
   generateProposalId,
   parseAgentPairKey,
   registerConsensusVoteTool
-} from "./chunk-QKWS3REM.js";
+} from "./chunk-45QUEZNS.js";
 import "./chunk-Y7Z7H66M.js";
 import "./chunk-SCPAYR65.js";
 import {
   AgentActionSchema,
-  AuditTrail,
   GitHubReviewer,
   GitHubUserInfo,
-  MAX_STRIPPED_ELEMENTS_PER_EVENT,
   SourceCitationSchema,
   ViolationSchema,
   canInfluenceDecisions,
   canProceed,
   checkRuleOfTwo,
   classifyTrust,
-  createAuditTrail,
   createFullGitHubProvider,
-  createGraphAuditBridge,
-  emitCorroborationEvent,
-  emitGraphExecutionEvent,
-  emitPolicyEvent,
-  emitReputationEvent,
-  emitSanitizationEvent,
-  emitTrustEvent,
   evaluatePolicy as evaluatePolicy2,
   getCorroborationRules,
   getRequiredTrustTier,
@@ -650,7 +640,7 @@ import {
   requiresCorroboration,
   validateAgentAction,
   validateCorroboration
-} from "./chunk-ZRRL3YB6.js";
+} from "./chunk-I5T7GUM7.js";
 import {
   GitHubProvider,
   ScmError
@@ -673,7 +663,7 @@ import {
 import {
   ImprovementReviewInputSchema,
   registerImprovementReviewTool
-} from "./chunk-AREFLH3S.js";
+} from "./chunk-Y4NDNQYU.js";
 import {
   AgentPerformanceSchema,
   ConsensusAlgorithmSchema,
@@ -709,7 +699,19 @@ import {
   toolSuccess,
   toolSuccessStructured,
   validateToolInput
-} from "./chunk-J2KMYVWA.js";
+} from "./chunk-RII4VXHO.js";
+import {
+  AuditTrail,
+  MAX_STRIPPED_ELEMENTS_PER_EVENT,
+  createAuditTrail,
+  createGraphAuditBridge,
+  emitCorroborationEvent,
+  emitGraphExecutionEvent,
+  emitPolicyEvent,
+  emitReputationEvent,
+  emitSanitizationEvent,
+  emitTrustEvent
+} from "./chunk-RCQLUJY3.js";
 import {
   PersistentStrategyDistiller,
   RulesSnapshotSchema
@@ -5953,7 +5955,7 @@ function buildVotingInput(plan, config) {
 }
 async function executeSingleVote(plan, config, log) {
   try {
-    const { executeVoting } = await import("./consensus-vote-6V3JNRXI.js");
+    const { executeVoting } = await import("./consensus-vote-IBT3C5YC.js");
     const input = buildVotingInput(plan, config);
     const result = await executeVoting(input, log);
     return parseVotingResult(result);