nexus-agents 2.167.0 → 2.168.0

package/dist/{composite-router-WOVGICBS.js → composite-router-EZPPVCMD.js}

@@ -4,7 +4,7 @@ import {
   CompositeRoutingError,
   DEFAULT_COMPOSITE_CONFIG,
   createCompositeRouter
-} from "./chunk-CURHM4TH.js";
+} from "./chunk-OKAHIWG4.js";
 import "./chunk-AXTD4TFK.js";
 import "./chunk-DHVMSIT5.js";
 import "./chunk-ZPWHCABL.js";
@@ -15,4 +15,4 @@ export {
   DEFAULT_COMPOSITE_CONFIG,
   createCompositeRouter
 };
-//# sourceMappingURL=composite-router-WOVGICBS.js.map
+//# sourceMappingURL=composite-router-EZPPVCMD.js.map

package/dist/{consensus-vote-322S65GQ.js → consensus-vote-YKKJHLOD.js}

@@ -8,24 +8,24 @@ import {
   registerConsensusVoteTool,
   resetCorrelationTracker,
   runConsensusForGoal
-} from "./chunk-TGAVZ2ZL.js";
-import "./chunk-ZAPCPHGZ.js";
-import "./chunk-STMW5BSR.js";
-import "./chunk-QV52AXTF.js";
-import "./chunk-KM3YEIEN.js";
+} from "./chunk-ELWMGKVP.js";
+import "./chunk-TORS5V2C.js";
+import "./chunk-G7NDNFIE.js";
+import "./chunk-RJHLNI37.js";
+import "./chunk-2ANAH2UU.js";
 import "./chunk-6T3EPABN.js";
-import "./chunk-QPSYBHK6.js";
+import "./chunk-MX3XD2ML.js";
 import "./chunk-PINS44XA.js";
 import "./chunk-KSQSWEFH.js";
-import "./chunk-GGYQTV2Y.js";
-import "./chunk-S6HCREYY.js";
-import "./chunk-IFSIKGHI.js";
-import "./chunk-2NU774CB.js";
-import "./chunk-GVNY4ZB6.js";
-import "./chunk-ZTTUXPBQ.js";
+import "./chunk-ETFCT2CH.js";
+import "./chunk-7IUVW67T.js";
+import "./chunk-MSBYVBPX.js";
+import "./chunk-VQE3OSUW.js";
+import "./chunk-RQNBJ7AS.js";
+import "./chunk-UGJRDFMN.js";
 import "./chunk-QZUG667L.js";
-import "./chunk-7USEQLMS.js";
-import "./chunk-CURHM4TH.js";
+import "./chunk-2Z4QECP7.js";
+import "./chunk-OKAHIWG4.js";
 import "./chunk-AXTD4TFK.js";
 import "./chunk-DHVMSIT5.js";
 import "./chunk-ZPWHCABL.js";
@@ -40,4 +40,4 @@ export {
   resetCorrelationTracker,
   runConsensusForGoal
 };
-//# sourceMappingURL=consensus-vote-322S65GQ.js.map
+//# sourceMappingURL=consensus-vote-YKKJHLOD.js.map

package/dist/{context-retriever-YMJY6YBJ.js → context-retriever-EGMARBAC.js}

@@ -6,18 +6,18 @@ import {
   inferTaskCategory,
   selectRelevantResearch,
   summarizeContextForPrompt
-} from "./chunk-ZSUN7BHE.js";
-import "./chunk-UNIDAVVR.js";
-import "./chunk-PC4Y4VPX.js";
+} from "./chunk-HJA3Z56H.js";
+import "./chunk-IAGLVGHN.js";
+import "./chunk-5LPPJIZ4.js";
 import "./chunk-NUBSJGQZ.js";
-import "./chunk-KM3YEIEN.js";
+import "./chunk-2ANAH2UU.js";
 import "./chunk-6T3EPABN.js";
-import "./chunk-QPSYBHK6.js";
+import "./chunk-MX3XD2ML.js";
 import "./chunk-PINS44XA.js";
 import "./chunk-KSQSWEFH.js";
 import "./chunk-QZUG667L.js";
-import "./chunk-7USEQLMS.js";
-import "./chunk-CURHM4TH.js";
+import "./chunk-2Z4QECP7.js";
+import "./chunk-OKAHIWG4.js";
 import "./chunk-AXTD4TFK.js";
 import "./chunk-DHVMSIT5.js";
 import "./chunk-ZPWHCABL.js";
@@ -30,4 +30,4 @@ export {
   selectRelevantResearch,
   summarizeContextForPrompt
 };
-//# sourceMappingURL=context-retriever-YMJY6YBJ.js.map
+//# sourceMappingURL=context-retriever-EGMARBAC.js.map

package/dist/{doctor-deep-DALT3OXC.js → doctor-deep-QTBDR3VV.js}

@@ -1,8 +1,8 @@
 import {
   formatDeepDiagnostics,
   runDeepDiagnostics
-} from "./chunk-O6VL6LA4.js";
-import "./chunk-CURHM4TH.js";
+} from "./chunk-CPS2HN4T.js";
+import "./chunk-OKAHIWG4.js";
 import "./chunk-AXTD4TFK.js";
 import "./chunk-DHVMSIT5.js";
 import "./chunk-ZPWHCABL.js";
@@ -10,4 +10,4 @@ export {
   formatDeepDiagnostics,
   runDeepDiagnostics
 };
-//# sourceMappingURL=doctor-deep-DALT3OXC.js.map
+//# sourceMappingURL=doctor-deep-QTBDR3VV.js.map

package/dist/{expert-bridge-WNV3ST2T.js → expert-bridge-FZYJ3XAL.js}

@@ -3,9 +3,9 @@ import {
   shutdownExpertBridge,
   tokenSplitFromUsage,
   totalTokensFromUsage
-} from "./chunk-GRWHPG72.js";
-import "./chunk-ZTTUXPBQ.js";
-import "./chunk-CURHM4TH.js";
+} from "./chunk-GNCUZDQI.js";
+import "./chunk-UGJRDFMN.js";
+import "./chunk-OKAHIWG4.js";
 import "./chunk-AXTD4TFK.js";
 import "./chunk-DHVMSIT5.js";
 import "./chunk-ZPWHCABL.js";
@@ -15,4 +15,4 @@ export {
   tokenSplitFromUsage,
   totalTokensFromUsage
 };
-//# sourceMappingURL=expert-bridge-WNV3ST2T.js.map
+//# sourceMappingURL=expert-bridge-FZYJ3XAL.js.map

package/dist/{factory-TLSTFONW.js → factory-NDMPXPYE.js}

@@ -1,10 +1,10 @@
 import {
   createGitHubProvider,
   createScmProvider
-} from "./chunk-7YD3TRDX.js";
-import "./chunk-BB7KSLNA.js";
-import "./chunk-UNIDAVVR.js";
-import "./chunk-CURHM4TH.js";
+} from "./chunk-LNPKBBPG.js";
+import "./chunk-F5JDQXHJ.js";
+import "./chunk-IAGLVGHN.js";
+import "./chunk-OKAHIWG4.js";
 import "./chunk-AXTD4TFK.js";
 import "./chunk-DHVMSIT5.js";
 import "./chunk-ZPWHCABL.js";
@@ -12,4 +12,4 @@ export {
   createGitHubProvider,
   createScmProvider
 };
-//# sourceMappingURL=factory-TLSTFONW.js.map
+//# sourceMappingURL=factory-NDMPXPYE.js.map

package/dist/{factory-33HQYVCK.js → factory-SABHBAHC.js}

@@ -3,14 +3,14 @@ import {
   createCliAdapter,
   getAvailableClis,
   isCliAvailable
-} from "./chunk-S6HCREYY.js";
-import "./chunk-IFSIKGHI.js";
-import "./chunk-2NU774CB.js";
-import "./chunk-GVNY4ZB6.js";
-import "./chunk-ZTTUXPBQ.js";
+} from "./chunk-7IUVW67T.js";
+import "./chunk-MSBYVBPX.js";
+import "./chunk-VQE3OSUW.js";
+import "./chunk-RQNBJ7AS.js";
+import "./chunk-UGJRDFMN.js";
 import "./chunk-QZUG667L.js";
-import "./chunk-7USEQLMS.js";
-import "./chunk-CURHM4TH.js";
+import "./chunk-2Z4QECP7.js";
+import "./chunk-OKAHIWG4.js";
 import "./chunk-AXTD4TFK.js";
 import "./chunk-DHVMSIT5.js";
 import "./chunk-ZPWHCABL.js";
@@ -20,4 +20,4 @@ export {
   getAvailableClis,
   isCliAvailable
 };
-//# sourceMappingURL=factory-33HQYVCK.js.map
+//# sourceMappingURL=factory-SABHBAHC.js.map

package/dist/{improvement-review-2W6LKP74.js → improvement-review-WYFGNEVP.js}

@@ -11,10 +11,10 @@ import {
   loadSelfEvalSignals,
   registerImprovementReviewTool,
   runImprovementReview
-} from "./chunk-ZIC6ZZFU.js";
-import "./chunk-STMW5BSR.js";
-import "./chunk-QV52AXTF.js";
-import "./chunk-CURHM4TH.js";
+} from "./chunk-CJLMB7MO.js";
+import "./chunk-G7NDNFIE.js";
+import "./chunk-RJHLNI37.js";
+import "./chunk-OKAHIWG4.js";
 import "./chunk-AXTD4TFK.js";
 import "./chunk-DHVMSIT5.js";
 import "./chunk-ZPWHCABL.js";
@@ -32,4 +32,4 @@ export {
   registerImprovementReviewTool,
   runImprovementReview
 };
-//# sourceMappingURL=improvement-review-2W6LKP74.js.map
+//# sourceMappingURL=improvement-review-WYFGNEVP.js.map

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   createGitHubProvider,
   createScmProvider
-} from "./chunk-7YD3TRDX.js";
+} from "./chunk-LNPKBBPG.js";
 import {
   ALLOWED_COMMANDS,
   ARTIFACT_TYPES,
@@ -520,13 +520,7 @@ import {
   validateWorkflow,
   validateWorkflowDependencies,
   withLogging
-} from "./chunk-ZTWKSN5K.js";
-import {
-  OPENAI_MODELS,
-  OPENAI_MODEL_ALIASES,
-  OpenAIAdapter,
-  createOpenAIAdapter
-} from "./chunk-DFCC7FN4.js";
+} from "./chunk-52T2MJDS.js";
 import {
   FALLBACK_SCANNER_DATA,
   buildPlanFromAnalysis,
@@ -534,7 +528,7 @@ import {
   generateSecurityPlan,
   getRegistryManifest,
   resolveScannerData
-} from "./chunk-VNVGGM73.js";
+} from "./chunk-N56C2MWI.js";
 import {
   analyzeGitHubRepo,
   analyzeRepo,
@@ -560,14 +554,20 @@ import {
   getKnownNexusVarNames,
   startStdioServer,
   validateNexusEnv
-} from "./chunk-QLZDOEO4.js";
+} from "./chunk-P7RBQUAG.js";
+import {
+  OPENAI_MODELS,
+  OPENAI_MODEL_ALIASES,
+  OpenAIAdapter,
+  createOpenAIAdapter
+} from "./chunk-OLCDGMEO.js";
 import {
   CliCircuitBreakerIntegration,
   createCliCircuitBreakerIntegration
-} from "./chunk-COIZLMGV.js";
+} from "./chunk-HZNOSJOO.js";
 import {
   executeExpert
-} from "./chunk-GRWHPG72.js";
+} from "./chunk-GNCUZDQI.js";
 import {
   AgentFindingSchema,
   ConsensusEngine,
@@ -616,9 +616,9 @@ import {
   generateProposalId,
   parseAgentPairKey,
   registerConsensusVoteTool
-} from "./chunk-TGAVZ2ZL.js";
-import "./chunk-ZAPCPHGZ.js";
-import "./chunk-7K5LSUEU.js";
+} from "./chunk-ELWMGKVP.js";
+import "./chunk-TORS5V2C.js";
+import "./chunk-3KID7AIF.js";
 import {
   AgentActionSchema,
   GitHubReviewer,
@@ -640,11 +640,11 @@ import {
   requiresCorroboration,
   validateAgentAction,
   validateCorroboration
-} from "./chunk-RKIPSMCN.js";
+} from "./chunk-TZK7VQAW.js";
 import {
   GitHubProvider,
   ScmError
-} from "./chunk-BB7KSLNA.js";
+} from "./chunk-F5JDQXHJ.js";
 import {
   GitHubUserRoleSchema,
   InjectionFlagSchema,
@@ -659,11 +659,11 @@ import {
   assessReputation,
   reconcileTrustTier,
   sanitizeInput
-} from "./chunk-SRNAXDOT.js";
+} from "./chunk-UN7PYUJB.js";
 import {
   ImprovementReviewInputSchema,
   registerImprovementReviewTool
-} from "./chunk-ZIC6ZZFU.js";
+} from "./chunk-CJLMB7MO.js";
 import {
   AgentPerformanceSchema,
   ConsensusAlgorithmSchema,
@@ -699,7 +699,7 @@ import {
   toolSuccess,
   toolSuccessStructured,
   validateToolInput
-} from "./chunk-STMW5BSR.js";
+} from "./chunk-G7NDNFIE.js";
 import {
   AuditTrail,
   MAX_STRIPPED_ELEMENTS_PER_EVENT,
@@ -711,7 +711,7 @@ import {
   emitReputationEvent,
   emitSanitizationEvent,
   emitTrustEvent
-} from "./chunk-QV52AXTF.js";
+} from "./chunk-RJHLNI37.js";
 import {
   PersistentStrategyDistiller,
   RulesSnapshotSchema,
@@ -719,19 +719,19 @@ import {
   TokenCounter,
   TokenCounterProvider,
   createTokenCounter
-} from "./chunk-ZSUN7BHE.js";
+} from "./chunk-HJA3Z56H.js";
 import {
   getTokenEnvVars,
   hasToken,
   resolveToken
-} from "./chunk-UNIDAVVR.js";
-import "./chunk-PC4Y4VPX.js";
+} from "./chunk-IAGLVGHN.js";
+import "./chunk-5LPPJIZ4.js";
 import "./chunk-NUBSJGQZ.js";
 import {
   MemoryError
-} from "./chunk-KM3YEIEN.js";
+} from "./chunk-2ANAH2UU.js";
 import "./chunk-6T3EPABN.js";
-import "./chunk-QPSYBHK6.js";
+import "./chunk-MX3XD2ML.js";
 import {
   BUILT_IN_EXPERTS,
   BuiltInExpertTypeSchema,
@@ -750,7 +750,7 @@ import {
   resetGlobalRegistry,
   withModelNotFoundFallback,
   wrapResilientWithFallback
-} from "./chunk-GGYQTV2Y.js";
+} from "./chunk-ETFCT2CH.js";
 import {
   BaseCliAdapter,
   CLAUDE_MODELS,
@@ -785,7 +785,7 @@ import {
   isCliAvailable,
   isRetryableError,
   sleep
-} from "./chunk-S6HCREYY.js";
+} from "./chunk-7IUVW67T.js";
 import {
   AdapterModelError,
   BaseAdapter,
@@ -809,12 +809,12 @@ import {
   transformStream,
   validateApiKeyPresence,
   withTimeout
-} from "./chunk-IFSIKGHI.js";
+} from "./chunk-MSBYVBPX.js";
 import {
   DEFAULTS,
   PROVIDER_ENV_KEYS
-} from "./chunk-2NU774CB.js";
-import "./chunk-GVNY4ZB6.js";
+} from "./chunk-VQE3OSUW.js";
+import "./chunk-RQNBJ7AS.js";
 import {
   AvailabilityCache,
   filterAvailableModels,
@@ -823,9 +823,9 @@ import {
   getFallbackChain,
   resetAvailabilityCache,
   resolveFallback
-} from "./chunk-ZTTUXPBQ.js";
+} from "./chunk-UGJRDFMN.js";
 import "./chunk-QZUG667L.js";
-import "./chunk-7USEQLMS.js";
+import "./chunk-2Z4QECP7.js";
 import {
   AgentCapability,
   AgentError,
@@ -903,7 +903,7 @@ import {
   toError,
   unwrap,
   unwrapOr
-} from "./chunk-CURHM4TH.js";
+} from "./chunk-OKAHIWG4.js";
 import "./chunk-AXTD4TFK.js";
 import "./chunk-DHVMSIT5.js";
 import "./chunk-ZPWHCABL.js";
@@ -5713,7 +5713,7 @@ function buildVotingInput(plan, config) {
 }
 async function executeSingleVote(plan, config, log) {
   try {
-    const { executeVoting } = await import("./consensus-vote-322S65GQ.js");
+    const { executeVoting } = await import("./consensus-vote-YKKJHLOD.js");
     const input = buildVotingInput(plan, config);
     const result = await executeVoting(input, log);
     return parseVotingResult(result);

package/dist/{init-opencode-I4FY4OGP.js → init-opencode-CMGJ3TXZ.js}

@@ -1,13 +1,12 @@
 import {
   discoverModels,
   readOpencodeGateway
-} from "./chunk-VGEVDF44.js";
-import "./chunk-DFCC7FN4.js";
-import "./chunk-ZAPCPHGZ.js";
-import "./chunk-IFSIKGHI.js";
+} from "./chunk-OLCDGMEO.js";
+import "./chunk-TORS5V2C.js";
+import "./chunk-MSBYVBPX.js";
 import {
   createLogger
-} from "./chunk-CURHM4TH.js";
+} from "./chunk-OKAHIWG4.js";
 import "./chunk-AXTD4TFK.js";
 import "./chunk-DHVMSIT5.js";
 import "./chunk-ZPWHCABL.js";
@@ -176,4 +175,4 @@ export {
   runInitOpencode,
   runOpencodeValidate
 };
-//# sourceMappingURL=init-opencode-I4FY4OGP.js.map
+//# sourceMappingURL=init-opencode-CMGJ3TXZ.js.map

package/dist/{init-opencode-I4FY4OGP.js.map → init-opencode-CMGJ3TXZ.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/cli/init-opencode.ts"],"sourcesContent":["/**\n * `nexus-agents init --opencode <path>` setup helper (#2504, child 4 of #2500).\n *\n * Injects the nexus-agents MCP block + recommended environment into an\n * existing `opencode.json` without overwriting other operator-set keys.\n * Pairs with the existing `init --portable --mcp-config` (which targets\n * Claude Code's `.mcp.json`). Different harness, same merge-not-overwrite\n * pattern.\n *\n * Behaviour:\n *   - File exists → merge `mcp.nexus-agents` into the existing JSON.\n *     Preserve every other key the operator has set (provider config,\n *     model lists, theme, …). Idempotent: re-running produces the same\n *     final file.\n *   - File missing → write a minimal template with the nexus-agents MCP\n *     block + a stubbed `providers.openai-compat` shell the operator\n *     fills in (placeholder baseURL + `{env:WORKSPACE_PROXY_KEY}`).\n *   - `--dry-run` → print the diff (proposed vs existing) without writing.\n *   - `--validate` → after merge (or alongside dry-run), probe\n *     `providers.openai-compat.options.baseURL/v1/models` with the\n *     resolved apiKey, exit non-zero if unreachable.\n *\n * @module cli/init-opencode\n */\n\nimport { existsSync, readFileSync, writeFileSync } from 'node:fs';\nimport { dirname } from 'node:path';\n\nimport { createLogger } from '../core/index.js';\nimport { readOpencodeGateway } from '../config/opencode-bridge.js';\nimport { discoverModels } from '../adapters/openai-compat-adapter.js';\n\nconst logger = createLogger({ component: 'init-opencode' });\n\nexport interface InitOpencodeOptions {\n  /** Absolute or relative path to opencode.json. */\n  readonly path: string;\n  /** Path to the nexus-agents CLI binary that the MCP block will spawn. */\n  readonly cliPath: string;\n  /** Sandbox flavor written to NEXUS_SANDBOX in the MCP environment. */\n  readonly sandboxFlavor?: string;\n  /** Print the diff without writing. */\n  readonly dryRun?: boolean;\n}\n\nexport interface InitOpencodeResult {\n  readonly path: string;\n  readonly action: 'created' | 'updated' | 'unchanged' | 'dry-run';\n  readonly diff: string;\n}\n\ninterface OpencodeMcpBlock {\n  type: 'local';\n  command: string[];\n  enabled: boolean;\n  environment: Record<string, string>;\n}\n\ninterface OpencodeFile {\n  $schema?: string;\n  providers?: Record<string, unknown>;\n  mcp?: Record<string, unknown>;\n  permission?: Record<string, unknown>;\n  [key: string]: unknown;\n}\n\n/**\n * Conservative default OpenCode `permission` block (#2658). OpenCode\n * evaluates a glob map with **last-matching-rule-winning**, so the broad\n * `\"*\"` rule is listed first and the hard `deny` patterns last.\n *\n * - `edit` — everything `ask`s; secrets, keys, and `.git/` are hard-denied\n *   regardless of operator confirmation. The deny patterns come after\n *   `\"*\"` so last-match-wins makes them stick.\n * - `bash` — `ask` unconditionally. Shell is the highest-risk surface.\n * - `skill` — `allow`. Skills are trusted, in-repo, CI-validated content.\n *\n * Emitted only when the operator has not already set their own\n * `permission` block — never overwrites operator config.\n */\nexport function buildDefaultPermissionBlock(): Record<string, unknown> {\n  return {\n    edit: {\n      '*': 'ask',\n      '**/.env': 'deny',\n      '**/.env.*': 'deny',\n      '**/*.pem': 'deny',\n      '**/*.key': 'deny',\n      '**/id_rsa*': 'deny',\n      '**/secrets/**': 'deny',\n      '**/.git/**': 'deny',\n    },\n    bash: 'ask',\n    skill: 'allow',\n  };\n}\n\n/**\n * Build the canonical nexus-agents MCP block. Mirrors what\n * `Dockerfile.sandbox` writes today plus the env vars from #2501 + #2503.\n */\nexport function buildNexusMcpBlock(opts: {\n  readonly cliPath: string;\n  readonly sandboxFlavor?: string;\n  readonly opencodeConfigPath: string;\n}): OpencodeMcpBlock {\n  const env: Record<string, string> = {\n    NEXUS_DATA_DIR: '{env:NEXUS_DATA_DIR}',\n    NEXUS_OPENCODE_CONFIG: opts.opencodeConfigPath,\n  };\n  if (opts.sandboxFlavor !== undefined && opts.sandboxFlavor !== '') {\n    env['NEXUS_SANDBOX'] = opts.sandboxFlavor;\n  }\n  return {\n    type: 'local',\n    command: ['node', opts.cliPath, '--mode=server'],\n    enabled: true,\n    environment: env,\n  };\n}\n\n/**\n * Execute the merge. Pure with respect to `opts.dryRun: true` — no fs\n * writes. Returns the final-or-proposed JSON + a diff string suitable\n * for printing.\n */\nexport function runInitOpencode(opts: InitOpencodeOptions): InitOpencodeResult {\n  const existing = readExisting(opts.path);\n  const merged = mergeNexusBlock(existing, opts);\n  const before = existing === null ? '' : `${JSON.stringify(existing, null, 2)}\\n`;\n  const after = `${JSON.stringify(merged, null, 2)}\\n`;\n  const diff = simpleDiff(before, after);\n\n  if (opts.dryRun === true) {\n    return { path: opts.path, action: 'dry-run', diff };\n  }\n\n  if (existing !== null && before === after) {\n    return { path: opts.path, action: 'unchanged', diff };\n  }\n\n  writeFileSync(opts.path, after, 'utf8');\n  return { path: opts.path, action: existing === null ? 'created' : 'updated', diff };\n}\n\nfunction readExisting(path: string): OpencodeFile | null {\n  if (!existsSync(path)) return null;\n  try {\n    const raw = readFileSync(path, 'utf8');\n    const parsed = JSON.parse(raw) as unknown;\n    if (typeof parsed !== 'object' || parsed === null) {\n      throw new Error('opencode.json root must be an object');\n    }\n    return parsed as OpencodeFile;\n  } catch (err: unknown) {\n    const msg = err instanceof Error ? err.message : String(err);\n    throw new Error(`Failed to parse opencode.json at ${path}: ${msg}`);\n  }\n}\n\nfunction mergeNexusBlock(existing: OpencodeFile | null, opts: InitOpencodeOptions): OpencodeFile {\n  const block = buildNexusMcpBlock({\n    cliPath: opts.cliPath,\n    ...(opts.sandboxFlavor !== undefined && { sandboxFlavor: opts.sandboxFlavor }),\n    opencodeConfigPath: opts.path,\n  });\n\n  if (existing === null) {\n    return {\n      $schema: 'https://opencode.ai/config.json',\n      providers: { 'openai-compat': stubOpenaiCompatProvider() },\n      permission: buildDefaultPermissionBlock(),\n      mcp: { 'nexus-agents': block },\n    };\n  }\n\n  // Idempotent merge: preserve user-customised fields if they exist on the\n  // current MCP block (e.g. `enabled: false`). Update anything else.\n  const existingMcp: Record<string, unknown> = existing.mcp ?? {};\n  const rawNexus = existingMcp['nexus-agents'];\n  const existingNexus: Partial<OpencodeMcpBlock> =\n    typeof rawNexus === 'object' && rawNexus !== null ? rawNexus : {};\n  const mergedBlock: OpencodeMcpBlock = {\n    type: 'local',\n    command: block.command,\n    enabled: existingNexus.enabled ?? block.enabled,\n    environment: { ...block.environment, ...(existingNexus.environment ?? {}) },\n  };\n\n  // Add the default permission block only when the operator has not set\n  // their own — never overwrite an existing `permission` key.\n  const permission = existing.permission ?? buildDefaultPermissionBlock();\n\n  return {\n    ...existing,\n    permission,\n    mcp: { ...existingMcp, 'nexus-agents': mergedBlock },\n  };\n}\n\n/**\n * Stub for `providers.openai-compat`. Operators replace the placeholder\n * baseURL + key with their workspace-proxy values. Empty by design — we\n * never overwrite an existing provider block (see `mergeNexusBlock`).\n */\nfunction stubOpenaiCompatProvider(): Record<string, unknown> {\n  return {\n    npm: '@ai-sdk/openai-compatible',\n    options: {\n      baseURL: '<replace with workspace proxy URL>',\n      apiKey: '{env:WORKSPACE_PROXY_KEY}',\n    },\n  };\n}\n\n/**\n * Cheap line-based diff. Three-line context, +/- prefixes. Good enough\n * for an operator preview; not a unified-diff replacement.\n */\nfunction simpleDiff(before: string, after: string): string {\n  if (before === after) return '(no changes)';\n  const beforeLines = before.split('\\n');\n  const afterLines = after.split('\\n');\n  const out: string[] = [];\n  const max = Math.max(beforeLines.length, afterLines.length);\n  for (let i = 0; i < max; i += 1) {\n    const b = beforeLines[i];\n    const a = afterLines[i];\n    if (b === a) {\n      out.push(`  ${b ?? ''}`);\n    } else {\n      if (b !== undefined) out.push(`- ${b}`);\n      if (a !== undefined) out.push(`+ ${a}`);\n    }\n  }\n  return out.join('\\n');\n}\n\nexport function ensureOpencodeDirExists(path: string): void {\n  const dir = dirname(path);\n  if (!existsSync(dir)) {\n    throw new Error(\n      `Parent directory does not exist: ${dir}. Create it first or pass a path under an existing dir.`\n    );\n  }\n  logger.debug('opencode.json target directory exists', { dir });\n}\n\n/**\n * --validate flow for `init --opencode` (follow-up to #2504).\n *\n * After the merge step writes the file, optionally probe the gateway it\n * points at. Reuses the same opencode-bridge loader (#2503) that the\n * runtime uses, so what we validate is exactly what the server will see\n * at boot.\n *\n * Returns:\n *   - `{ ok: true, models }` when the gateway is reachable and returns ≥1 model\n *   - `{ ok: false, reason }` for every failure path (config missing,\n *     probe failed, zero models)\n *\n * Caller (cli-commands-handlers) maps to exit codes + stderr / stdout.\n * The API key never reaches the returned object — only model IDs +\n * baseURL appear in the success payload.\n */\nexport interface OpencodeValidateResult {\n  readonly ok: boolean;\n  readonly baseURL?: string;\n  readonly models?: readonly string[];\n  readonly reason?: string;\n}\n\nexport async function runOpencodeValidate(opencodePath: string): Promise<OpencodeValidateResult> {\n  const config = readOpencodeGateway(opencodePath);\n  if (config === null) {\n    return {\n      ok: false,\n      reason:\n        'opencode.json does not resolve a usable gateway. Check that providers.openai-compat.options.{baseURL, apiKey} are set and that any {env:VAR} interpolation references are exported.',\n    };\n  }\n  const result = await discoverModels({ baseUrl: config.baseURL, apiKey: config.apiKey });\n  if (!result.ok) {\n    return { ok: false, baseURL: config.baseURL, reason: result.error.message };\n  }\n  if (result.value.length === 0) {\n    return {\n      ok: false,\n      baseURL: config.baseURL,\n      reason: 'gateway returned 0 models. Check upstream provider quotas / list filters.',\n    };\n  }\n  return {\n    ok: true,\n    baseURL: config.baseURL,\n    models: result.value.map((m) => m.id),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;AAyBA,SAAS,YAAY,cAAc,qBAAqB;AACxD,SAAS,eAAe;AAMxB,IAAM,SAAS,aAAa,EAAE,WAAW,gBAAgB,CAAC;AAgDnD,SAAS,8BAAuD;AACrE,SAAO;AAAA,IACL,MAAM;AAAA,MACJ,KAAK;AAAA,MACL,WAAW;AAAA,MACX,aAAa;AAAA,MACb,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,iBAAiB;AAAA,MACjB,cAAc;AAAA,IAChB;AAAA,IACA,MAAM;AAAA,IACN,OAAO;AAAA,EACT;AACF;AAMO,SAAS,mBAAmB,MAId;AACnB,QAAM,MAA8B;AAAA,IAClC,gBAAgB;AAAA,IAChB,uBAAuB,KAAK;AAAA,EAC9B;AACA,MAAI,KAAK,kBAAkB,UAAa,KAAK,kBAAkB,IAAI;AACjE,QAAI,eAAe,IAAI,KAAK;AAAA,EAC9B;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS,CAAC,QAAQ,KAAK,SAAS,eAAe;AAAA,IAC/C,SAAS;AAAA,IACT,aAAa;AAAA,EACf;AACF;AAOO,SAAS,gBAAgB,MAA+C;AAC7E,QAAM,WAAW,aAAa,KAAK,IAAI;AACvC,QAAM,SAAS,gBAAgB,UAAU,IAAI;AAC7C,QAAM,SAAS,aAAa,OAAO,KAAK,GAAG,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAAA;AAC5E,QAAM,QAAQ,GAAG,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAAA;AAChD,QAAM,OAAO,WAAW,QAAQ,KAAK;AAErC,MAAI,KAAK,WAAW,MAAM;AACxB,WAAO,EAAE,MAAM,KAAK,MAAM,QAAQ,WAAW,KAAK;AAAA,EACpD;AAEA,MAAI,aAAa,QAAQ,WAAW,OAAO;AACzC,WAAO,EAAE,MAAM,KAAK,MAAM,QAAQ,aAAa,KAAK;AAAA,EACtD;AAEA,gBAAc,KAAK,MAAM,OAAO,MAAM;AACtC,SAAO,EAAE,MAAM,KAAK,MAAM,QAAQ,aAAa,OAAO,YAAY,WAAW,KAAK;AACpF;AAEA,SAAS,aAAa,MAAmC;AACvD,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO;AAC9B,MAAI;AACF,UAAM,MAAM,aAAa,MAAM,MAAM;AACrC,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,QAAI,OAAO,WAAW,YAAY,WAAW,MAAM;AACjD,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AACA,WAAO;AAAA,EACT,SAAS,KAAc;AACrB,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,UAAM,IAAI,MAAM,oCAAoC,IAAI,KAAK,GAAG,EAAE;AAAA,EACpE;AACF;AAEA,SAAS,gBAAgB,UAA+B,MAAyC;AAC/F,QAAM,QAAQ,mBAAmB;AAAA,IAC/B,SAAS,KAAK;AAAA,IACd,GAAI,KAAK,kBAAkB,UAAa,EAAE,eAAe,KAAK,cAAc;AAAA,IAC5E,oBAAoB,KAAK;AAAA,EAC3B,CAAC;AAED,MAAI,aAAa,MAAM;AACrB,WAAO;AAAA,MACL,SAAS;AAAA,MACT,WAAW,EAAE,iBAAiB,yBAAyB,EAAE;AAAA,MACzD,YAAY,4BAA4B;AAAA,MACxC,KAAK,EAAE,gBAAgB,MAAM;AAAA,IAC/B;AAAA,EACF;AAIA,QAAM,cAAuC,SAAS,OAAO,CAAC;AAC9D,QAAM,WAAW,YAAY,cAAc;AAC3C,QAAM,gBACJ,OAAO,aAAa,YAAY,aAAa,OAAO,WAAW,CAAC;AAClE,QAAM,cAAgC;AAAA,IACpC,MAAM;AAAA,IACN,SAAS,MAAM;AAAA,IACf,SAAS,cAAc,WAAW,MAAM;AAAA,IACxC,aAAa,EAAE,GAAG,MAAM,aAAa,GAAI,cAAc,eAAe,CAAC,EAAG;AAAA,EAC5E;AAIA,QAAM,aAAa,SAAS,cAAc,4BAA4B;AAEtE,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,KAAK,EAAE,GAAG,aAAa,gBAAgB,YAAY;AAAA,EACrD;AACF;AAOA,SAAS,2BAAoD;AAC3D,SAAO;AAAA,IACL,KAAK;AAAA,IACL,SAAS;AAAA,MACP,SAAS;AAAA,MACT,QAAQ;AAAA,IACV;AAAA,EACF;AACF;AAMA,SAAS,WAAW,QAAgB,OAAuB;AACzD,MAAI,WAAW,MAAO,QAAO;AAC7B,QAAM,cAAc,OAAO,MAAM,IAAI;AACrC,QAAM,aAAa,MAAM,MAAM,IAAI;AACnC,QAAM,MAAgB,CAAC;AACvB,QAAM,MAAM,KAAK,IAAI,YAAY,QAAQ,WAAW,MAAM;AAC1D,WAAS,IAAI,GAAG,IAAI,KAAK,KAAK,GAAG;AAC/B,UAAM,IAAI,YAAY,CAAC;AACvB,UAAM,IAAI,WAAW,CAAC;AACtB,QAAI,MAAM,GAAG;AACX,UAAI,KAAK,KAAK,KAAK,EAAE,EAAE;AAAA,IACzB,OAAO;AACL,UAAI,MAAM,OAAW,KAAI,KAAK,KAAK,CAAC,EAAE;AACtC,UAAI,MAAM,OAAW,KAAI,KAAK,KAAK,CAAC,EAAE;AAAA,IACxC;AAAA,EACF;AACA,SAAO,IAAI,KAAK,IAAI;AACtB;AAEO,SAAS,wBAAwB,MAAoB;AAC1D,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,CAAC,WAAW,GAAG,GAAG;AACpB,UAAM,IAAI;AAAA,MACR,oCAAoC,GAAG;AAAA,IACzC;AAAA,EACF;AACA,SAAO,MAAM,yCAAyC,EAAE,IAAI,CAAC;AAC/D;AA0BA,eAAsB,oBAAoB,cAAuD;AAC/F,QAAM,SAAS,oBAAoB,YAAY;AAC/C,MAAI,WAAW,MAAM;AACnB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QACE;AAAA,IACJ;AAAA,EACF;AACA,QAAM,SAAS,MAAM,eAAe,EAAE,SAAS,OAAO,SAAS,QAAQ,OAAO,OAAO,CAAC;AACtF,MAAI,CAAC,OAAO,IAAI;AACd,WAAO,EAAE,IAAI,OAAO,SAAS,OAAO,SAAS,QAAQ,OAAO,MAAM,QAAQ;AAAA,EAC5E;AACA,MAAI,OAAO,MAAM,WAAW,GAAG;AAC7B,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS,OAAO;AAAA,MAChB,QAAQ;AAAA,IACV;AAAA,EACF;AACA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,SAAS,OAAO;AAAA,IAChB,QAAQ,OAAO,MAAM,IAAI,CAAC,MAAM,EAAE,EAAE;AAAA,EACtC;AACF;","names":[]}
+{"version":3,"sources":["../src/cli/init-opencode.ts"],"sourcesContent":["/**\n * `nexus-agents init --opencode <path>` setup helper (#2504, child 4 of #2500).\n *\n * Injects the nexus-agents MCP block + recommended environment into an\n * existing `opencode.json` without overwriting other operator-set keys.\n * Pairs with the existing `init --portable --mcp-config` (which targets\n * Claude Code's `.mcp.json`). Different harness, same merge-not-overwrite\n * pattern.\n *\n * Behaviour:\n *   - File exists → merge `mcp.nexus-agents` into the existing JSON.\n *     Preserve every other key the operator has set (provider config,\n *     model lists, theme, …). Idempotent: re-running produces the same\n *     final file.\n *   - File missing → write a minimal template with the nexus-agents MCP\n *     block + a stubbed `providers.openai-compat` shell the operator\n *     fills in (placeholder baseURL + `{env:WORKSPACE_PROXY_KEY}`).\n *   - `--dry-run` → print the diff (proposed vs existing) without writing.\n *   - `--validate` → after merge (or alongside dry-run), probe\n *     `providers.openai-compat.options.baseURL/v1/models` with the\n *     resolved apiKey, exit non-zero if unreachable.\n *\n * @module cli/init-opencode\n */\n\nimport { existsSync, readFileSync, writeFileSync } from 'node:fs';\nimport { dirname } from 'node:path';\n\nimport { createLogger } from '../core/index.js';\nimport { readOpencodeGateway } from '../config/opencode-bridge.js';\nimport { discoverModels } from '../adapters/openai-compat-adapter.js';\n\nconst logger = createLogger({ component: 'init-opencode' });\n\nexport interface InitOpencodeOptions {\n  /** Absolute or relative path to opencode.json. */\n  readonly path: string;\n  /** Path to the nexus-agents CLI binary that the MCP block will spawn. */\n  readonly cliPath: string;\n  /** Sandbox flavor written to NEXUS_SANDBOX in the MCP environment. */\n  readonly sandboxFlavor?: string;\n  /** Print the diff without writing. */\n  readonly dryRun?: boolean;\n}\n\nexport interface InitOpencodeResult {\n  readonly path: string;\n  readonly action: 'created' | 'updated' | 'unchanged' | 'dry-run';\n  readonly diff: string;\n}\n\ninterface OpencodeMcpBlock {\n  type: 'local';\n  command: string[];\n  enabled: boolean;\n  environment: Record<string, string>;\n}\n\ninterface OpencodeFile {\n  $schema?: string;\n  providers?: Record<string, unknown>;\n  mcp?: Record<string, unknown>;\n  permission?: Record<string, unknown>;\n  [key: string]: unknown;\n}\n\n/**\n * Conservative default OpenCode `permission` block (#2658). OpenCode\n * evaluates a glob map with **last-matching-rule-winning**, so the broad\n * `\"*\"` rule is listed first and the hard `deny` patterns last.\n *\n * - `edit` — everything `ask`s; secrets, keys, and `.git/` are hard-denied\n *   regardless of operator confirmation. The deny patterns come after\n *   `\"*\"` so last-match-wins makes them stick.\n * - `bash` — `ask` unconditionally. Shell is the highest-risk surface.\n * - `skill` — `allow`. Skills are trusted, in-repo, CI-validated content.\n *\n * Emitted only when the operator has not already set their own\n * `permission` block — never overwrites operator config.\n */\nexport function buildDefaultPermissionBlock(): Record<string, unknown> {\n  return {\n    edit: {\n      '*': 'ask',\n      '**/.env': 'deny',\n      '**/.env.*': 'deny',\n      '**/*.pem': 'deny',\n      '**/*.key': 'deny',\n      '**/id_rsa*': 'deny',\n      '**/secrets/**': 'deny',\n      '**/.git/**': 'deny',\n    },\n    bash: 'ask',\n    skill: 'allow',\n  };\n}\n\n/**\n * Build the canonical nexus-agents MCP block. Mirrors what\n * `Dockerfile.sandbox` writes today plus the env vars from #2501 + #2503.\n */\nexport function buildNexusMcpBlock(opts: {\n  readonly cliPath: string;\n  readonly sandboxFlavor?: string;\n  readonly opencodeConfigPath: string;\n}): OpencodeMcpBlock {\n  const env: Record<string, string> = {\n    NEXUS_DATA_DIR: '{env:NEXUS_DATA_DIR}',\n    NEXUS_OPENCODE_CONFIG: opts.opencodeConfigPath,\n  };\n  if (opts.sandboxFlavor !== undefined && opts.sandboxFlavor !== '') {\n    env['NEXUS_SANDBOX'] = opts.sandboxFlavor;\n  }\n  return {\n    type: 'local',\n    command: ['node', opts.cliPath, '--mode=server'],\n    enabled: true,\n    environment: env,\n  };\n}\n\n/**\n * Execute the merge. Pure with respect to `opts.dryRun: true` — no fs\n * writes. Returns the final-or-proposed JSON + a diff string suitable\n * for printing.\n */\nexport function runInitOpencode(opts: InitOpencodeOptions): InitOpencodeResult {\n  const existing = readExisting(opts.path);\n  const merged = mergeNexusBlock(existing, opts);\n  const before = existing === null ? '' : `${JSON.stringify(existing, null, 2)}\\n`;\n  const after = `${JSON.stringify(merged, null, 2)}\\n`;\n  const diff = simpleDiff(before, after);\n\n  if (opts.dryRun === true) {\n    return { path: opts.path, action: 'dry-run', diff };\n  }\n\n  if (existing !== null && before === after) {\n    return { path: opts.path, action: 'unchanged', diff };\n  }\n\n  writeFileSync(opts.path, after, 'utf8');\n  return { path: opts.path, action: existing === null ? 'created' : 'updated', diff };\n}\n\nfunction readExisting(path: string): OpencodeFile | null {\n  if (!existsSync(path)) return null;\n  try {\n    const raw = readFileSync(path, 'utf8');\n    const parsed = JSON.parse(raw) as unknown;\n    if (typeof parsed !== 'object' || parsed === null) {\n      throw new Error('opencode.json root must be an object');\n    }\n    return parsed as OpencodeFile;\n  } catch (err: unknown) {\n    const msg = err instanceof Error ? err.message : String(err);\n    throw new Error(`Failed to parse opencode.json at ${path}: ${msg}`);\n  }\n}\n\nfunction mergeNexusBlock(existing: OpencodeFile | null, opts: InitOpencodeOptions): OpencodeFile {\n  const block = buildNexusMcpBlock({\n    cliPath: opts.cliPath,\n    ...(opts.sandboxFlavor !== undefined && { sandboxFlavor: opts.sandboxFlavor }),\n    opencodeConfigPath: opts.path,\n  });\n\n  if (existing === null) {\n    return {\n      $schema: 'https://opencode.ai/config.json',\n      providers: { 'openai-compat': stubOpenaiCompatProvider() },\n      permission: buildDefaultPermissionBlock(),\n      mcp: { 'nexus-agents': block },\n    };\n  }\n\n  // Idempotent merge: preserve user-customised fields if they exist on the\n  // current MCP block (e.g. `enabled: false`). Update anything else.\n  const existingMcp: Record<string, unknown> = existing.mcp ?? {};\n  const rawNexus = existingMcp['nexus-agents'];\n  const existingNexus: Partial<OpencodeMcpBlock> =\n    typeof rawNexus === 'object' && rawNexus !== null ? rawNexus : {};\n  const mergedBlock: OpencodeMcpBlock = {\n    type: 'local',\n    command: block.command,\n    enabled: existingNexus.enabled ?? block.enabled,\n    environment: { ...block.environment, ...(existingNexus.environment ?? {}) },\n  };\n\n  // Add the default permission block only when the operator has not set\n  // their own — never overwrite an existing `permission` key.\n  const permission = existing.permission ?? buildDefaultPermissionBlock();\n\n  return {\n    ...existing,\n    permission,\n    mcp: { ...existingMcp, 'nexus-agents': mergedBlock },\n  };\n}\n\n/**\n * Stub for `providers.openai-compat`. Operators replace the placeholder\n * baseURL + key with their workspace-proxy values. Empty by design — we\n * never overwrite an existing provider block (see `mergeNexusBlock`).\n */\nfunction stubOpenaiCompatProvider(): Record<string, unknown> {\n  return {\n    npm: '@ai-sdk/openai-compatible',\n    options: {\n      baseURL: '<replace with workspace proxy URL>',\n      apiKey: '{env:WORKSPACE_PROXY_KEY}',\n    },\n  };\n}\n\n/**\n * Cheap line-based diff. Three-line context, +/- prefixes. Good enough\n * for an operator preview; not a unified-diff replacement.\n */\nfunction simpleDiff(before: string, after: string): string {\n  if (before === after) return '(no changes)';\n  const beforeLines = before.split('\\n');\n  const afterLines = after.split('\\n');\n  const out: string[] = [];\n  const max = Math.max(beforeLines.length, afterLines.length);\n  for (let i = 0; i < max; i += 1) {\n    const b = beforeLines[i];\n    const a = afterLines[i];\n    if (b === a) {\n      out.push(`  ${b ?? ''}`);\n    } else {\n      if (b !== undefined) out.push(`- ${b}`);\n      if (a !== undefined) out.push(`+ ${a}`);\n    }\n  }\n  return out.join('\\n');\n}\n\nexport function ensureOpencodeDirExists(path: string): void {\n  const dir = dirname(path);\n  if (!existsSync(dir)) {\n    throw new Error(\n      `Parent directory does not exist: ${dir}. Create it first or pass a path under an existing dir.`\n    );\n  }\n  logger.debug('opencode.json target directory exists', { dir });\n}\n\n/**\n * --validate flow for `init --opencode` (follow-up to #2504).\n *\n * After the merge step writes the file, optionally probe the gateway it\n * points at. Reuses the same opencode-bridge loader (#2503) that the\n * runtime uses, so what we validate is exactly what the server will see\n * at boot.\n *\n * Returns:\n *   - `{ ok: true, models }` when the gateway is reachable and returns ≥1 model\n *   - `{ ok: false, reason }` for every failure path (config missing,\n *     probe failed, zero models)\n *\n * Caller (cli-commands-handlers) maps to exit codes + stderr / stdout.\n * The API key never reaches the returned object — only model IDs +\n * baseURL appear in the success payload.\n */\nexport interface OpencodeValidateResult {\n  readonly ok: boolean;\n  readonly baseURL?: string;\n  readonly models?: readonly string[];\n  readonly reason?: string;\n}\n\nexport async function runOpencodeValidate(opencodePath: string): Promise<OpencodeValidateResult> {\n  const config = readOpencodeGateway(opencodePath);\n  if (config === null) {\n    return {\n      ok: false,\n      reason:\n        'opencode.json does not resolve a usable gateway. Check that providers.openai-compat.options.{baseURL, apiKey} are set and that any {env:VAR} interpolation references are exported.',\n    };\n  }\n  const result = await discoverModels({ baseUrl: config.baseURL, apiKey: config.apiKey });\n  if (!result.ok) {\n    return { ok: false, baseURL: config.baseURL, reason: result.error.message };\n  }\n  if (result.value.length === 0) {\n    return {\n      ok: false,\n      baseURL: config.baseURL,\n      reason: 'gateway returned 0 models. Check upstream provider quotas / list filters.',\n    };\n  }\n  return {\n    ok: true,\n    baseURL: config.baseURL,\n    models: result.value.map((m) => m.id),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;AAyBA,SAAS,YAAY,cAAc,qBAAqB;AACxD,SAAS,eAAe;AAMxB,IAAM,SAAS,aAAa,EAAE,WAAW,gBAAgB,CAAC;AAgDnD,SAAS,8BAAuD;AACrE,SAAO;AAAA,IACL,MAAM;AAAA,MACJ,KAAK;AAAA,MACL,WAAW;AAAA,MACX,aAAa;AAAA,MACb,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,iBAAiB;AAAA,MACjB,cAAc;AAAA,IAChB;AAAA,IACA,MAAM;AAAA,IACN,OAAO;AAAA,EACT;AACF;AAMO,SAAS,mBAAmB,MAId;AACnB,QAAM,MAA8B;AAAA,IAClC,gBAAgB;AAAA,IAChB,uBAAuB,KAAK;AAAA,EAC9B;AACA,MAAI,KAAK,kBAAkB,UAAa,KAAK,kBAAkB,IAAI;AACjE,QAAI,eAAe,IAAI,KAAK;AAAA,EAC9B;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS,CAAC,QAAQ,KAAK,SAAS,eAAe;AAAA,IAC/C,SAAS;AAAA,IACT,aAAa;AAAA,EACf;AACF;AAOO,SAAS,gBAAgB,MAA+C;AAC7E,QAAM,WAAW,aAAa,KAAK,IAAI;AACvC,QAAM,SAAS,gBAAgB,UAAU,IAAI;AAC7C,QAAM,SAAS,aAAa,OAAO,KAAK,GAAG,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAAA;AAC5E,QAAM,QAAQ,GAAG,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAAA;AAChD,QAAM,OAAO,WAAW,QAAQ,KAAK;AAErC,MAAI,KAAK,WAAW,MAAM;AACxB,WAAO,EAAE,MAAM,KAAK,MAAM,QAAQ,WAAW,KAAK;AAAA,EACpD;AAEA,MAAI,aAAa,QAAQ,WAAW,OAAO;AACzC,WAAO,EAAE,MAAM,KAAK,MAAM,QAAQ,aAAa,KAAK;AAAA,EACtD;AAEA,gBAAc,KAAK,MAAM,OAAO,MAAM;AACtC,SAAO,EAAE,MAAM,KAAK,MAAM,QAAQ,aAAa,OAAO,YAAY,WAAW,KAAK;AACpF;AAEA,SAAS,aAAa,MAAmC;AACvD,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO;AAC9B,MAAI;AACF,UAAM,MAAM,aAAa,MAAM,MAAM;AACrC,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,QAAI,OAAO,WAAW,YAAY,WAAW,MAAM;AACjD,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AACA,WAAO;AAAA,EACT,SAAS,KAAc;AACrB,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,UAAM,IAAI,MAAM,oCAAoC,IAAI,KAAK,GAAG,EAAE;AAAA,EACpE;AACF;AAEA,SAAS,gBAAgB,UAA+B,MAAyC;AAC/F,QAAM,QAAQ,mBAAmB;AAAA,IAC/B,SAAS,KAAK;AAAA,IACd,GAAI,KAAK,kBAAkB,UAAa,EAAE,eAAe,KAAK,cAAc;AAAA,IAC5E,oBAAoB,KAAK;AAAA,EAC3B,CAAC;AAED,MAAI,aAAa,MAAM;AACrB,WAAO;AAAA,MACL,SAAS;AAAA,MACT,WAAW,EAAE,iBAAiB,yBAAyB,EAAE;AAAA,MACzD,YAAY,4BAA4B;AAAA,MACxC,KAAK,EAAE,gBAAgB,MAAM;AAAA,IAC/B;AAAA,EACF;AAIA,QAAM,cAAuC,SAAS,OAAO,CAAC;AAC9D,QAAM,WAAW,YAAY,cAAc;AAC3C,QAAM,gBACJ,OAAO,aAAa,YAAY,aAAa,OAAO,WAAW,CAAC;AAClE,QAAM,cAAgC;AAAA,IACpC,MAAM;AAAA,IACN,SAAS,MAAM;AAAA,IACf,SAAS,cAAc,WAAW,MAAM;AAAA,IACxC,aAAa,EAAE,GAAG,MAAM,aAAa,GAAI,cAAc,eAAe,CAAC,EAAG;AAAA,EAC5E;AAIA,QAAM,aAAa,SAAS,cAAc,4BAA4B;AAEtE,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,KAAK,EAAE,GAAG,aAAa,gBAAgB,YAAY;AAAA,EACrD;AACF;AAOA,SAAS,2BAAoD;AAC3D,SAAO;AAAA,IACL,KAAK;AAAA,IACL,SAAS;AAAA,MACP,SAAS;AAAA,MACT,QAAQ;AAAA,IACV;AAAA,EACF;AACF;AAMA,SAAS,WAAW,QAAgB,OAAuB;AACzD,MAAI,WAAW,MAAO,QAAO;AAC7B,QAAM,cAAc,OAAO,MAAM,IAAI;AACrC,QAAM,aAAa,MAAM,MAAM,IAAI;AACnC,QAAM,MAAgB,CAAC;AACvB,QAAM,MAAM,KAAK,IAAI,YAAY,QAAQ,WAAW,MAAM;AAC1D,WAAS,IAAI,GAAG,IAAI,KAAK,KAAK,GAAG;AAC/B,UAAM,IAAI,YAAY,CAAC;AACvB,UAAM,IAAI,WAAW,CAAC;AACtB,QAAI,MAAM,GAAG;AACX,UAAI,KAAK,KAAK,KAAK,EAAE,EAAE;AAAA,IACzB,OAAO;AACL,UAAI,MAAM,OAAW,KAAI,KAAK,KAAK,CAAC,EAAE;AACtC,UAAI,MAAM,OAAW,KAAI,KAAK,KAAK,CAAC,EAAE;AAAA,IACxC;AAAA,EACF;AACA,SAAO,IAAI,KAAK,IAAI;AACtB;AAEO,SAAS,wBAAwB,MAAoB;AAC1D,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,CAAC,WAAW,GAAG,GAAG;AACpB,UAAM,IAAI;AAAA,MACR,oCAAoC,GAAG;AAAA,IACzC;AAAA,EACF;AACA,SAAO,MAAM,yCAAyC,EAAE,IAAI,CAAC;AAC/D;AA0BA,eAAsB,oBAAoB,cAAuD;AAC/F,QAAM,SAAS,oBAAoB,YAAY;AAC/C,MAAI,WAAW,MAAM;AACnB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QACE;AAAA,IACJ;AAAA,EACF;AACA,QAAM,SAAS,MAAM,eAAe,EAAE,SAAS,OAAO,SAAS,QAAQ,OAAO,OAAO,CAAC;AACtF,MAAI,CAAC,OAAO,IAAI;AACd,WAAO,EAAE,IAAI,OAAO,SAAS,OAAO,SAAS,QAAQ,OAAO,MAAM,QAAQ;AAAA,EAC5E;AACA,MAAI,OAAO,MAAM,WAAW,GAAG;AAC7B,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS,OAAO;AAAA,MAChB,QAAQ;AAAA,IACV;AAAA,EACF;AACA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,SAAS,OAAO;AAAA,IAChB,QAAQ,OAAO,MAAM,IAAI,CAAC,MAAM,EAAE,EAAE;AAAA,EACtC;AACF;","names":[]}

package/dist/{issue-triage-CVMVZ3IV.js → issue-triage-NHRZGMKC.js}

@@ -2,11 +2,11 @@ import {
   IssueTriage,
   createIssueTriage,
   formatTriageComment
-} from "./chunk-RKIPSMCN.js";
-import "./chunk-BB7KSLNA.js";
-import "./chunk-SRNAXDOT.js";
-import "./chunk-QV52AXTF.js";
-import "./chunk-CURHM4TH.js";
+} from "./chunk-TZK7VQAW.js";
+import "./chunk-F5JDQXHJ.js";
+import "./chunk-UN7PYUJB.js";
+import "./chunk-RJHLNI37.js";
+import "./chunk-OKAHIWG4.js";
 import "./chunk-AXTD4TFK.js";
 import "./chunk-DHVMSIT5.js";
 import "./chunk-ZPWHCABL.js";
@@ -15,4 +15,4 @@ export {
   createIssueTriage,
   formatTriageComment
 };
-//# sourceMappingURL=issue-triage-CVMVZ3IV.js.map
+//# sourceMappingURL=issue-triage-NHRZGMKC.js.map

package/dist/{pr-reviewer-helpers-SAMOVLNJ.js → pr-reviewer-helpers-HJRFRUZX.js}

@@ -17,10 +17,10 @@ import {
   parseFindings,
   parseSeverity,
   sumFindings
-} from "./chunk-JKUX73VD.js";
+} from "./chunk-EQLJYWLP.js";
 import "./chunk-WAYGXUSM.js";
-import "./chunk-SRNAXDOT.js";
-import "./chunk-CURHM4TH.js";
+import "./chunk-UN7PYUJB.js";
+import "./chunk-OKAHIWG4.js";
 import "./chunk-AXTD4TFK.js";
 import "./chunk-DHVMSIT5.js";
 import "./chunk-ZPWHCABL.js";
@@ -44,4 +44,4 @@ export {
   parseSeverity,
   sumFindings
 };
-//# sourceMappingURL=pr-reviewer-helpers-SAMOVLNJ.js.map
+//# sourceMappingURL=pr-reviewer-helpers-HJRFRUZX.js.map

package/dist/{registry-command-5D2DJT53.js → registry-command-JCOZA7TM.js}

@@ -7,7 +7,7 @@ import {
   loadGeneratedRegistryEntries,
   loadUserManifestOverlay,
   reloadDefaultRegistry
-} from "./chunk-CURHM4TH.js";
+} from "./chunk-OKAHIWG4.js";
 import "./chunk-AXTD4TFK.js";
 import {
   nexusDataPath
@@ -249,4 +249,4 @@ export {
   isValidRegistrySubcommand,
   registryCommand
 };
-//# sourceMappingURL=registry-command-5D2DJT53.js.map
+//# sourceMappingURL=registry-command-JCOZA7TM.js.map

package/dist/{repo-security-plan-F7V5SHAQ.js → repo-security-plan-OMY33VHA.js}

@@ -3,9 +3,9 @@ import {
   buildPlanFromAnalysis,
   generateSecurityPlan,
   resolveScannerData
-} from "./chunk-VNVGGM73.js";
+} from "./chunk-N56C2MWI.js";
 import "./chunk-HFOQKCD2.js";
-import "./chunk-CURHM4TH.js";
+import "./chunk-OKAHIWG4.js";
 import "./chunk-AXTD4TFK.js";
 import "./chunk-DHVMSIT5.js";
 import "./chunk-ZPWHCABL.js";
@@ -15,4 +15,4 @@ export {
   generateSecurityPlan,
   resolveScannerData
 };
-//# sourceMappingURL=repo-security-plan-F7V5SHAQ.js.map
+//# sourceMappingURL=repo-security-plan-OMY33VHA.js.map

package/dist/{research-helpers-synthesize-F4PV4B4B.js → research-helpers-synthesize-DFINP3KN.js}

@@ -1,10 +1,10 @@
 import {
   AttributedInsightSchema,
   synthesizeResearch
-} from "./chunk-7K5LSUEU.js";
-import "./chunk-PC4Y4VPX.js";
+} from "./chunk-3KID7AIF.js";
+import "./chunk-5LPPJIZ4.js";
 import "./chunk-NUBSJGQZ.js";
-import "./chunk-CURHM4TH.js";
+import "./chunk-OKAHIWG4.js";
 import "./chunk-AXTD4TFK.js";
 import "./chunk-DHVMSIT5.js";
 import "./chunk-ZPWHCABL.js";
@@ -12,4 +12,4 @@ export {
   AttributedInsightSchema,
   synthesizeResearch
 };
-//# sourceMappingURL=research-helpers-synthesize-F4PV4B4B.js.map
+//# sourceMappingURL=research-helpers-synthesize-DFINP3KN.js.map

package/dist/{routing-memory-G6YBK4WI.js → routing-memory-KK4GPB64.js}

@@ -2,7 +2,7 @@ import {
   DEFAULT_ROUTING_MEMORY_CONFIG,
   RoutingMemory,
   createRoutingMemory
-} from "./chunk-CURHM4TH.js";
+} from "./chunk-OKAHIWG4.js";
 import "./chunk-AXTD4TFK.js";
 import "./chunk-DHVMSIT5.js";
 import "./chunk-ZPWHCABL.js";
@@ -11,4 +11,4 @@ export {
   RoutingMemory,
   createRoutingMemory
 };
-//# sourceMappingURL=routing-memory-G6YBK4WI.js.map
+//# sourceMappingURL=routing-memory-KK4GPB64.js.map

package/dist/{session-memory-DAJHLPOY.js → session-memory-QTHGU2XM.js}

@@ -6,8 +6,8 @@ import {
   SessionMemory,
   SessionMemoryError,
   createSessionMemory
-} from "./chunk-QPSYBHK6.js";
-import "./chunk-CURHM4TH.js";
+} from "./chunk-MX3XD2ML.js";
+import "./chunk-OKAHIWG4.js";
 import "./chunk-AXTD4TFK.js";
 import "./chunk-DHVMSIT5.js";
 import "./chunk-ZPWHCABL.js";
@@ -20,4 +20,4 @@ export {
   SessionMemoryError,
   createSessionMemory
 };
-//# sourceMappingURL=session-memory-DAJHLPOY.js.map
+//# sourceMappingURL=session-memory-QTHGU2XM.js.map