nexus-agents 2.167.1 → 2.169.0

package/dist/{chunk-2S7T66IQ.js → chunk-N7FIUFQL.js}

@@ -1,6 +1,6 @@
 import {
   generateSecurityPlan
-} from "./chunk-VNVGGM73.js";
+} from "./chunk-HNNSCTOI.js";
 import {
   analyzeGitHubRepo
 } from "./chunk-HFOQKCD2.js";
@@ -9,8 +9,9 @@ import {
   DEFAULT_INDEX_MAX_DEPTH,
   MAX_INDEX_MAX_DEPTH,
   extractSymbolIndex,
-  extractSymbols
-} from "./chunk-AO4X3BMP.js";
+  extractSymbols,
+  findSourceFiles
+} from "./chunk-YF35FKKD.js";
 import {
   FINDING_SEVERITY_LEVELS,
   SARIF_LEVEL_MAP,
@@ -20,10 +21,10 @@ import {
   DEFAULT_TASK_TTL_MS,
   DEFAULT_TOOL_RATE_LIMITS,
   clampTaskTtl
-} from "./chunk-EUQNHT7O.js";
+} from "./chunk-ROCNXZBC.js";
 import {
   executeExpert
-} from "./chunk-GRWHPG72.js";
+} from "./chunk-4G5W5EPU.js";
 import {
   JobStatusSchema,
   abortJob,
@@ -44,21 +45,21 @@ import {
   simulationDeniedResult,
   toJobSummary,
   writeJobCancelled
-} from "./chunk-TGAVZ2ZL.js";
+} from "./chunk-F6HJJG3E.js";
 import {
   normalizeTopicToCanonical,
   synthesizeResearch
-} from "./chunk-7K5LSUEU.js";
+} from "./chunk-7S43YASS.js";
 import {
   IssueTriage
-} from "./chunk-RKIPSMCN.js";
+} from "./chunk-R46SBPLH.js";
 import {
   resolveEnvMode,
   sanitizeInput
-} from "./chunk-SRNAXDOT.js";
+} from "./chunk-SX4E2W3Z.js";
 import {
   withPrerequisite
-} from "./chunk-ZIC6ZZFU.js";
+} from "./chunk-EQRN5FRZ.js";
 import {
   NOOP_NOTIFIER,
   RateLimiter,
@@ -81,12 +82,12 @@ import {
   withAuditTrail,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-STMW5BSR.js";
+} from "./chunk-IQC2K3KY.js";
 import {
   createAuditTrail,
   createGraphAuditBridge,
   emitPipelinePolicyEvent
-} from "./chunk-QV52AXTF.js";
+} from "./chunk-BWG54OJS.js";
 import {
   addResearchPaper,
   addSourceToRegistry,
@@ -114,15 +115,15 @@ import {
   parseRegistry,
   sourceExistsInRegistry,
   summarizeContextForPrompt
-} from "./chunk-ZSUN7BHE.js";
+} from "./chunk-XGNB7LQB.js";
 import {
   getTokenEnvVars,
   resolveToken
-} from "./chunk-UNIDAVVR.js";
+} from "./chunk-3JH3FMEJ.js";
 import {
   loadPapersRegistry,
   loadTechniquesRegistry
-} from "./chunk-PC4Y4VPX.js";
+} from "./chunk-HAVBBSYN.js";
 import {
   resolveInsideRoot
 } from "./chunk-NUBSJGQZ.js";
@@ -131,14 +132,14 @@ import {
   MemoryImportance,
   calculateTextJaccardSimilarity,
   getToolMemory
-} from "./chunk-KM3YEIEN.js";
+} from "./chunk-Q3UMNYV2.js";
 import {
   STOPWORDS,
   truncateWithInfo
 } from "./chunk-6T3EPABN.js";
 import {
   createSessionMemory
-} from "./chunk-QPSYBHK6.js";
+} from "./chunk-W76DOL27.js";
 import {
   BUILT_IN_EXPERTS,
   BuiltInExpertTypeSchema,
@@ -153,7 +154,7 @@ import {
   createEvent,
   getGlobalEventBus,
   getGlobalRegistry
-} from "./chunk-GGYQTV2Y.js";
+} from "./chunk-P7MYTCE6.js";
 import {
   CliDetectionCache,
   asRecord,
@@ -161,19 +162,19 @@ import {
   getAvailableClis,
   sleep,
   withTimeout
-} from "./chunk-S6HCREYY.js";
+} from "./chunk-NT3KCLT6.js";
 import {
   DEFAULTS
-} from "./chunk-2NU774CB.js";
+} from "./chunk-JCJHQSAY.js";
 import {
   getAvailabilityCache,
   getCliForModelId,
   resolveFallback
-} from "./chunk-ZTTUXPBQ.js";
+} from "./chunk-T3VD32JY.js";
 import {
   generateHyphenId,
   generateUUID
-} from "./chunk-7USEQLMS.js";
+} from "./chunk-OOFPDA3B.js";
 import {
   AGENT_ROUTER_TIMEOUTS,
   API_TIMEOUTS,
@@ -265,7 +266,7 @@ import {
   selectStrategyByManifest,
   toExpertTaskAnalysisResult,
   withStep
-} from "./chunk-CURHM4TH.js";
+} from "./chunk-QXSR5KPG.js";
 import {
   ensureLearningDir,
   getMetaOutcomesFile,
@@ -2565,13 +2566,13 @@ function makeCancelError(taskId) {
 }
 function executeWithTimeout(params) {
   const { task, maxDurationMs, executeTask, transformError, signal } = params;
-  return new Promise((resolve19) => {
+  return new Promise((resolve20) => {
     let settled = false;
     const settle = (result) => {
       if (settled) return;
       settled = true;
       clearTimeout(timeoutId);
-      resolve19(result);
+      resolve20(result);
     };
     const timeoutId = setTimeout(() => {
       settle(
@@ -7981,13 +7982,13 @@ var WaveScheduler = class {
   }
   async withTimeout(promise, timeoutMs, taskId) {
     if (timeoutMs <= 0) return promise;
-    return new Promise((resolve19, reject) => {
+    return new Promise((resolve20, reject) => {
       const timer = setTimeout(() => {
         reject(new Error(`Task ${taskId} timed out after ${String(timeoutMs)}ms`));
       }, timeoutMs);
       promise.then((result) => {
         clearTimeout(timer);
-        resolve19(result);
+        resolve20(result);
       }).catch((error) => {
         clearTimeout(timer);
         reject(error instanceof Error ? error : new Error(String(error)));
@@ -7999,8 +8000,8 @@ function chunkByDirectory(files, basePath) {
   const normalizedBase = basePath.endsWith("/") ? basePath : `${basePath}/`;
   const groups = /* @__PURE__ */ new Map();
   for (const file of files) {
-    const relative = file.startsWith(normalizedBase) ? file.slice(normalizedBase.length) : file;
-    const stripped = relative.startsWith("/") ? relative.slice(1) : relative;
+    const relative2 = file.startsWith(normalizedBase) ? file.slice(normalizedBase.length) : file;
+    const stripped = relative2.startsWith("/") ? relative2.slice(1) : relative2;
     const topDir = stripped.split("/")[0] ?? "root";
     const existing = groups.get(topDir);
     if (existing !== void 0) {
@@ -14921,8 +14922,8 @@ var Semaphore = class {
       this.available -= 1;
       return Promise.resolve();
     }
-    return new Promise((resolve19) => {
-      this.waiters.push(resolve19);
+    return new Promise((resolve20) => {
+      this.waiters.push(resolve20);
     });
   }
   release() {
@@ -18355,9 +18356,9 @@ var ExpertPool = class {
     if (this.active < this.capacity) {
       return this.issuePermit();
     }
-    return new Promise((resolve19, reject) => {
+    return new Promise((resolve20, reject) => {
       const timer = setTimeout(() => {
-        const idx = this.queue.findIndex((e) => e.resolve === resolve19);
+        const idx = this.queue.findIndex((e) => e.resolve === resolve20);
         if (idx !== -1) {
           this.queue.splice(idx, 1);
         }
@@ -18367,7 +18368,7 @@ var ExpertPool = class {
           )
         );
       }, this.acquireTimeoutMs);
-      this.queue.push({ resolve: resolve19, reject, timer });
+      this.queue.push({ resolve: resolve20, reject, timer });
     });
   }
   /** Release a permit back to the pool. */
@@ -18951,8 +18952,8 @@ var TaskQueue = class {
     if (this.cancelled) {
       return Promise.reject(new Error("Queue has been cancelled"));
     }
-    return new Promise((resolve19, reject) => {
-      this.queue.push({ task, resolve: resolve19, reject });
+    return new Promise((resolve20, reject) => {
+      this.queue.push({ task, resolve: resolve20, reject });
       this.processNext();
     });
   }
@@ -19228,16 +19229,16 @@ async function executeStepWithTimeout(step, context, stepExecutor, signal) {
   return executeWithTimeout2(step, stepContext, stepExecutor, stepTimeout, startTime);
 }
 function executeWithTimeout2(step, context, executor, timeout, startTime) {
-  return new Promise((resolve19) => {
+  return new Promise((resolve20) => {
     const timeoutId = setTimeout(() => {
-      resolve19(createTimeoutResult(step.id, getTimeProvider().now() - startTime, timeout));
+      resolve20(createTimeoutResult(step.id, getTimeProvider().now() - startTime, timeout));
     }, timeout);
     executor(step, context).then((result) => {
       clearTimeout(timeoutId);
-      resolve19(result);
+      resolve20(result);
     }).catch((error) => {
       clearTimeout(timeoutId);
-      resolve19(createErrorResult(step.id, getTimeProvider().now() - startTime, error));
+      resolve20(createErrorResult(step.id, getTimeProvider().now() - startTime, error));
     });
   });
 }
@@ -23644,10 +23645,10 @@ function calculateZStatistic(params) {
 function calculateDifferenceCI(p1, p2, total1, total2, confidence) {
   const difference = p1 - p2;
   const seDiff = Math.sqrt(p1 * (1 - p1) / (total1 || 1) + p2 * (1 - p2) / (total2 || 1));
-  const z116 = getZScore(confidence);
+  const z117 = getZScore(confidence);
   return {
-    lower: difference - z116 * seDiff,
-    upper: difference + z116 * seDiff,
+    lower: difference - z117 * seDiff,
+    upper: difference + z117 * seDiff,
     estimate: difference,
     confidence,
     n: total1 + total2,
@@ -23670,11 +23671,11 @@ function proportionConfidenceInterval(successes, total, options = {}) {
       standardError: 0
     };
   }
-  const z116 = getZScore(opts.confidence);
-  const z210 = z116 * z116;
+  const z117 = getZScore(opts.confidence);
+  const z210 = z117 * z117;
   const denominator = 1 + z210 / n;
   const center = (p + z210 / (2 * n)) / denominator;
-  const margin = z116 / denominator * Math.sqrt(p * (1 - p) / n + z210 / (4 * n * n));
+  const margin = z117 / denominator * Math.sqrt(p * (1 - p) / n + z210 / (4 * n * n));
   const lower = Math.max(0, center - margin);
   const upper = Math.min(1, center + margin);
   const standardError = Math.sqrt(p * (1 - p) / n);
@@ -23704,8 +23705,8 @@ function meanConfidenceInterval(values, options = {}) {
   const variance = values.reduce((sum, v) => sum + (v - mean) ** 2, 0) / (n - 1 || 1);
   const stdDev = Math.sqrt(variance);
   const standardError = stdDev / Math.sqrt(n);
-  const z116 = getZScore(opts.confidence);
-  const margin = z116 * standardError;
+  const z117 = getZScore(opts.confidence);
+  const margin = z117 * standardError;
   return {
     lower: mean - margin,
     upper: mean + margin,
@@ -26300,7 +26301,7 @@ function execIdFields(executionId) {
 async function populateUnifiedContextOnState(state, options) {
   const taskCandidate = state["task"];
   if (typeof taskCandidate !== "string" || taskCandidate === "") return;
-  const { getContextForTask: getContextForTask2, inferTaskCategory: inferTaskCategory2 } = await import("./context-retriever-YMJY6YBJ.js");
+  const { getContextForTask: getContextForTask2, inferTaskCategory: inferTaskCategory2 } = await import("./context-retriever-TIJGFLGO.js");
   const category = inferTaskCategory2(taskCandidate);
   const executionId = options?.executionId;
   const execFields = execIdFields(executionId);
@@ -26797,13 +26798,13 @@ function dedupe(ids) {
   return [...new Set(ids)];
 }
 async function withTimeout2(promise, ms) {
-  return new Promise((resolve19, reject) => {
+  return new Promise((resolve20, reject) => {
     const timer = setTimeout(() => {
       reject(new Error(`Node timed out after ${String(ms)}ms`));
     }, ms);
     promise.then((result) => {
       clearTimeout(timer);
-      resolve19(result);
+      resolve20(result);
     }).catch((error) => {
       clearTimeout(timer);
       reject(error instanceof Error ? error : new Error(String(error)));
@@ -29243,11 +29244,11 @@ function createMockOrchestrator() {
 async function raceAgainstDeadline(promise, deadlineMs, onTimeout) {
   const startedAt = Date.now();
   let timer;
-  const timeoutP = new Promise((resolve19, reject) => {
+  const timeoutP = new Promise((resolve20, reject) => {
     timer = setTimeout(
       () => {
         try {
-          resolve19(onTimeout(Date.now() - startedAt));
+          resolve20(onTimeout(Date.now() - startedAt));
         } catch (err2) {
           reject(err2 instanceof Error ? err2 : new Error(String(err2)));
         }
@@ -30450,11 +30451,11 @@ function createWorkerTask(entry, taskIndex, waveNumber, opts) {
     const staggerSlot = taskIndex % opts.maxConcurrency;
     const staggerMs = staggerSlot * opts.staggerDelayMs;
     if (staggerMs > 0) {
-      await new Promise((resolve19) => setTimeout(resolve19, staggerMs));
+      await new Promise((resolve20) => setTimeout(resolve20, staggerMs));
     }
     const spacingDelay = opts.failureTracker.getSpacingDelay(entry.role);
     if (spacingDelay > 0) {
-      await new Promise((resolve19) => setTimeout(resolve19, spacingDelay));
+      await new Promise((resolve20) => setTimeout(resolve20, spacingDelay));
     }
     const timeoutMs = opts.options.workerTimeoutMs ?? getExpertTaskTimeout(entry.subTask);
     const result = await executeSafe({
@@ -30506,7 +30507,7 @@ async function maybeDelayForRateLimit(results, waveIdx, totalWaves) {
   );
   if (hasRateLimit) {
     logger26.warn("Rate-limit detected \u2014 delaying next wave", { delayMs: RATE_LIMIT_WAVE_DELAY_MS });
-    await new Promise((resolve19) => setTimeout(resolve19, RATE_LIMIT_WAVE_DELAY_MS));
+    await new Promise((resolve20) => setTimeout(resolve20, RATE_LIMIT_WAVE_DELAY_MS));
   }
 }
 function emitWaveStarted(ctx, workerCount, roles) {
@@ -30604,7 +30605,7 @@ async function maybeRetryAfterTriage(opts) {
   }
   const useAltCli = triage.action === "retry_different_cli" && altExecuteWorker !== void 0;
   if (triage.action === "retry_different_cli") {
-    await new Promise((resolve19) => setTimeout(resolve19, RATE_LIMIT_SPACING_MS));
+    await new Promise((resolve20) => setTimeout(resolve20, RATE_LIMIT_SPACING_MS));
   }
   const retryTimeout = triage.action === "extend_timeout" ? Math.min(timeoutMs * TIMEOUT_EXTENSION_FACTOR, MAX_WORKER_TIMEOUT_MS) : timeoutMs;
   const retryExecutor = useAltCli ? altExecuteWorker : executeWorker;
@@ -39848,14 +39849,224 @@ function registerExtractSymbolsTool(server, deps) {
   logger58.info("Registered extract_symbols tool");
 }
 
-// src/mcp/tools/query-trace-tool.ts
-import { readFile as readFile3, stat as stat3 } from "fs/promises";
-import { join as join6, resolve as resolve9, sep as sep5 } from "path";
+// src/mcp/tools/search-usages-tool.ts
+import { readFile as readFile3 } from "fs/promises";
+import { extname as extname3, relative, resolve as resolve9, sep as sep5 } from "path";
 import { z as z81 } from "zod";
-var QueryTraceInputSchema = z81.object({
-  runId: z81.string().min(1).max(128).regex(/^[a-zA-Z0-9_-]+$/, "runId must be alphanumeric, hyphens, or underscores").describe("Run ID to query traces for"),
-  eventType: z81.string().max(100).regex(/^[a-zA-Z0-9._-]+$/, "eventType must be alphanumeric with dots, hyphens, or underscores").optional().describe("Filter by event type"),
-  limit: z81.number().min(1).max(500).optional().describe("Max events to return (default: 100)")
+import { Lang, parse as parse2 } from "@ast-grep/napi";
+var DEFAULT_USAGES_LIMIT = 50;
+var MAX_USAGES_LIMIT = 500;
+var DEFAULT_USAGES_MAX_DEPTH = 24;
+var MAX_USAGES_MAX_DEPTH = 64;
+var MAX_FILES_SCANNED = 5e3;
+var MAX_SNIPPET_CHARS = 200;
+var IDENTIFIER_RE = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+var LANG_VALUES = ["typescript", "tsx", "javascript"];
+var SearchUsagesInputSchema = z81.object({
+  symbol: z81.string().min(1).max(200).regex(IDENTIFIER_RE, "symbol must be a single JS identifier (letters, digits, _ or $)").describe("Identifier to find usages/call-sites of (a single JS identifier)"),
+  path: z81.string().min(1).max(500).optional().describe("Restrict to a single source file (takes precedence over dir)"),
+  dir: z81.string().min(1).max(500).optional().describe("Directory to search recursively (default: current working directory)"),
+  lang: z81.enum(LANG_VALUES).optional().describe(
+    "Language override (default: inferred from each file extension, fallback typescript)"
+  ),
+  limit: z81.number().int().min(1).max(MAX_USAGES_LIMIT).optional().describe(
+    `Max usage matches emitted (default ${String(DEFAULT_USAGES_LIMIT)}). Excess is reported.`
+  ),
+  maxDepth: z81.number().int().min(1).max(MAX_USAGES_MAX_DEPTH).optional().describe(`Directory walk depth for dir scope (default ${String(DEFAULT_USAGES_MAX_DEPTH)}).`)
+});
+var DECLARATION_PARENT_KINDS = /* @__PURE__ */ new Set([
+  "function_declaration",
+  "generator_function_declaration",
+  "class_declaration",
+  "interface_declaration",
+  "type_alias_declaration",
+  "enum_declaration",
+  "function_signature",
+  "method_definition",
+  "abstract_method_signature"
+]);
+var IMPORT_PARENT_KINDS = /* @__PURE__ */ new Set([
+  "import_specifier",
+  "namespace_import",
+  "import_clause"
+]);
+function langToNapi(lang) {
+  if (lang === "tsx") return Lang.Tsx;
+  if (lang === "javascript") return Lang.JavaScript;
+  return Lang.TypeScript;
+}
+function escapeRegex2(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function isDeclaredName(declarator, node) {
+  const name = declarator.field("name");
+  return name !== null && name.id() === node.id();
+}
+function classifyIdentifier(node) {
+  const parent = node.parent();
+  if (parent === null) return "reference";
+  const pk = String(parent.kind());
+  if (DECLARATION_PARENT_KINDS.has(pk)) return null;
+  if (pk === "variable_declarator") return isDeclaredName(parent, node) ? null : "reference";
+  if (IMPORT_PARENT_KINDS.has(pk)) return "import";
+  if (pk === "call_expression") return "call";
+  if (pk === "new_expression") return "new";
+  return "reference";
+}
+function classifyProperty(node) {
+  const member = node.parent();
+  const grandparent = member === null ? null : member.parent();
+  if (grandparent !== null && String(grandparent.kind()) === "call_expression")
+    return "method-call";
+  return "reference";
+}
+function toMatch(node, kind, lines) {
+  const { start } = node.range();
+  const rawLine = lines[start.line] ?? node.text();
+  return {
+    line: start.line + 1,
+    column: start.column + 1,
+    kind,
+    snippet: rawLine.trim().slice(0, MAX_SNIPPET_CHARS)
+  };
+}
+function findUsagesInSource(symbol, src, lang) {
+  if (!IDENTIFIER_RE.test(symbol)) return [];
+  const root = parse2(langToNapi(lang), src).root();
+  const lines = src.split("\n");
+  const out = [];
+  for (const node of root.findAll(symbol)) {
+    const kind = classifyIdentifier(node);
+    if (kind !== null) out.push(toMatch(node, kind, lines));
+  }
+  const propRule = {
+    rule: { kind: "property_identifier", regex: `^${escapeRegex2(symbol)}$` }
+  };
+  for (const node of root.findAll(propRule)) {
+    out.push(toMatch(node, classifyProperty(node), lines));
+  }
+  return out.sort((a, b) => a.line - b.line || a.column - b.column);
+}
+function inferLang(file) {
+  const ext = extname3(file).toLowerCase();
+  if (ext === ".tsx" || ext === ".jsx") return "tsx";
+  if (ext === ".js" || ext === ".mjs" || ext === ".cjs") return "javascript";
+  return "typescript";
+}
+function resolveWithinCwd(target) {
+  const resolved = resolve9(target);
+  const cwdRoot = resolve9(".");
+  if (resolved !== cwdRoot && !resolved.startsWith(cwdRoot + sep5)) {
+    return { error: `Path traversal denied: scope must be within ${cwdRoot}` };
+  }
+  return { resolved };
+}
+async function resolveFileScope(input) {
+  if (input.path !== void 0) {
+    const guard2 = resolveWithinCwd(input.path);
+    if ("error" in guard2) return guard2;
+    return { files: [guard2.resolved], root: resolve9(".") };
+  }
+  const guard = resolveWithinCwd(input.dir ?? process.cwd());
+  if ("error" in guard) return guard;
+  const walk = await findSourceFiles(guard.resolved, input.maxDepth ?? DEFAULT_USAGES_MAX_DEPTH);
+  return { files: walk.files.slice(0, MAX_FILES_SCANNED), root: guard.resolved };
+}
+async function collectUsages(input, scope, limit, ctx) {
+  const results = [];
+  let total = 0;
+  for (const file of scope.files) {
+    let src;
+    try {
+      src = await readFile3(file, "utf8");
+    } catch {
+      ctx.logger.warn(`search_usages: skipped unreadable file ${file}`);
+      continue;
+    }
+    const lang = input.lang ?? inferLang(file);
+    const rel = relative(scope.root, file) || file;
+    for (const match of findUsagesInSource(input.symbol, src, lang)) {
+      total += 1;
+      if (results.length < limit) results.push({ file: rel, ...match });
+    }
+  }
+  return { results, total };
+}
+function buildOutput2(input, scope, limit, collected) {
+  const payload = {
+    symbol: input.symbol,
+    scope: input.path !== void 0 ? { path: input.path } : { dir: input.dir ?? "." },
+    lang: input.lang ?? "inferred",
+    filesScanned: scope.files.length,
+    totalMatches: collected.total,
+    results: collected.results
+  };
+  if (collected.total > collected.results.length) {
+    payload["truncated"] = true;
+    payload["omittedMatches"] = collected.total - collected.results.length;
+    payload["limit"] = limit;
+  }
+  return JSON.stringify(payload, null, 2);
+}
+async function searchUsagesHandler(args, ctx) {
+  const parsed = SearchUsagesInputSchema.safeParse(args);
+  if (!parsed.success) {
+    return toolStructuredError({
+      errorCategory: "validation",
+      message: `Validation error: ${formatZodError(parsed.error)}`
+    });
+  }
+  const scope = await resolveFileScope(parsed.data);
+  if ("error" in scope) {
+    return toolStructuredError({ errorCategory: "permission", message: scope.error });
+  }
+  try {
+    const limit = parsed.data.limit ?? DEFAULT_USAGES_LIMIT;
+    const collected = await collectUsages(parsed.data, scope, limit, ctx);
+    return toolSuccess(buildOutput2(parsed.data, scope, limit, collected));
+  } catch (caught) {
+    const e = caught instanceof Error ? caught : new Error(String(caught));
+    ctx.logger.error("Usage search failed", e);
+    return toolStructuredError({
+      errorCategory: "internal",
+      message: `Usage search failed: ${e.message}`
+    });
+  }
+}
+function registerSearchUsagesTool(server, deps) {
+  const logger58 = deps.logger ?? createLogger({ tool: "search_usages" });
+  const toolSchema = {
+    symbol: z81.string().min(1).max(200).regex(IDENTIFIER_RE, "symbol must be a single JS identifier").describe("Identifier to find usages/call-sites of"),
+    path: z81.string().min(1).max(500).optional().describe("Restrict to a single source file"),
+    dir: z81.string().min(1).max(500).optional().describe("Directory to search (default: cwd)"),
+    lang: z81.enum(LANG_VALUES).optional().describe("Language override (default: infer from ext)"),
+    limit: z81.number().int().min(1).max(MAX_USAGES_LIMIT).optional().describe(`Max matches (default ${String(DEFAULT_USAGES_LIMIT)})`),
+    maxDepth: z81.number().int().min(1).max(MAX_USAGES_MAX_DEPTH).optional().describe(`Directory walk depth (default ${String(DEFAULT_USAGES_MAX_DEPTH)})`)
+  };
+  const description = `Structural USAGE / call-site search for a symbol via ast-grep (tree-sitter). Answers "where is X used or called" \u2014 finds calls (foo()), member calls (obj.foo()), new expressions (new Foo()), imports, and bare references, with file:line:column + snippet. This is the gap \`search_codebase\` CANNOT fill: that indexes declared symbol NAMES only, not usages. Excludes the declaration itself (use \`search_codebase\` for declarations). Syntactic, not type-aware (a same-named member on an unrelated object may match). Read-only. Results capped at ${String(DEFAULT_USAGES_LIMIT)} by default (override via limit up to ${String(MAX_USAGES_LIMIT)}); overflow is reported, never silent.`;
+  const secureHandler = createSecureHandler(searchUsagesHandler, {
+    toolName: "search_usages",
+    rateLimiter: deps.rateLimiter,
+    logger: logger58
+  });
+  const timeoutMs = getToolTimeout("search_usages", deps.security);
+  const wrapped = wrapToolWithTimeout("search_usages", secureHandler, { timeoutMs, logger: logger58 });
+  server.registerTool(
+    "search_usages",
+    { description, inputSchema: toolSchema, annotations: getToolAnnotations("search_usages") },
+    toSdkCallback(wrapped)
+  );
+  logger58.info("Registered search_usages tool");
+}
+
+// src/mcp/tools/query-trace-tool.ts
+import { readFile as readFile4, stat as stat3 } from "fs/promises";
+import { join as join6, resolve as resolve10, sep as sep6 } from "path";
+import { z as z82 } from "zod";
+var QueryTraceInputSchema = z82.object({
+  runId: z82.string().min(1).max(128).regex(/^[a-zA-Z0-9_-]+$/, "runId must be alphanumeric, hyphens, or underscores").describe("Run ID to query traces for"),
+  eventType: z82.string().max(100).regex(/^[a-zA-Z0-9._-]+$/, "eventType must be alphanumeric with dots, hyphens, or underscores").optional().describe("Filter by event type"),
+  limit: z82.number().min(1).max(500).optional().describe("Max events to return (default: 100)")
 });
 var MAX_TRACE_FILE_BYTES = 100 * 1024 * 1024;
 var traceLogger = createLogger({ component: "query-trace" });
@@ -39899,9 +40110,9 @@ var EMPTY_RESPONSE = {
 async function queryTraceFromDisk(input, runsDir) {
   const dir = runsDir ?? getDefaultRunsDir();
   const tracePath = join6(dir, input.runId, "trace.jsonl");
-  const resolvedDir = resolve9(dir);
-  const resolvedTrace = resolve9(tracePath);
-  if (!resolvedTrace.startsWith(resolvedDir + sep5) && resolvedTrace !== resolvedDir) {
+  const resolvedDir = resolve10(dir);
+  const resolvedTrace = resolve10(tracePath);
+  if (!resolvedTrace.startsWith(resolvedDir + sep6) && resolvedTrace !== resolvedDir) {
     return { runId: input.runId, ...EMPTY_RESPONSE };
   }
   try {
@@ -39909,7 +40120,7 @@ async function queryTraceFromDisk(input, runsDir) {
     if (fileStat.size > MAX_TRACE_FILE_BYTES) {
       return { runId: input.runId, ...EMPTY_RESPONSE, truncated: true };
     }
-    const content = await readFile3(tracePath, "utf-8");
+    const content = await readFile4(tracePath, "utf-8");
     let parsed = parseJsonlLines(content);
     const limit = input.limit ?? 100;
     if (input.eventType !== void 0) {
@@ -39960,9 +40171,9 @@ function queryTraceHandler(args, ctx) {
 function registerQueryTraceTool(server, deps) {
   const logger58 = deps.logger ?? createLogger({ tool: "query_trace" });
   const toolSchema = {
-    runId: z81.string().min(1).max(128).regex(/^[a-zA-Z0-9_-]+$/, "runId must be alphanumeric, hyphens, or underscores").describe("Run ID to query traces for"),
-    eventType: z81.string().max(100).regex(/^[a-zA-Z0-9._-]+$/).optional().describe("Filter by event type (e.g., model.called)"),
-    limit: z81.number().min(1).max(500).optional().describe("Max events to return (default: 100)")
+    runId: z82.string().min(1).max(128).regex(/^[a-zA-Z0-9_-]+$/, "runId must be alphanumeric, hyphens, or underscores").describe("Run ID to query traces for"),
+    eventType: z82.string().max(100).regex(/^[a-zA-Z0-9._-]+$/).optional().describe("Filter by event type (e.g., model.called)"),
+    limit: z82.number().min(1).max(500).optional().describe("Max events to return (default: 100)")
   };
   const description = "Query execution traces by run ID. Returns agent and model attribution for pipeline runs including decision paths, error taxonomy, and timing data.";
   const secureHandler = createSecureHandler(queryTraceHandler, {
@@ -39981,7 +40192,7 @@ function registerQueryTraceTool(server, deps) {
 }
 
 // src/mcp/tools/get-job-result-tool.ts
-import { z as z82 } from "zod";
+import { z as z83 } from "zod";
 
 // src/mcp/jobs/task-state-source.ts
 var logger33 = createLogger({ component: "task-state-source" });
@@ -40090,8 +40301,8 @@ function resolveJobList(customDir) {
 }
 
 // src/mcp/tools/get-job-result-tool.ts
-var GetJobResultInputSchema = z82.object({
-  jobId: z82.string().min(1).max(128).describe('Job ID returned by orchestrate({ mode: "async" })')
+var GetJobResultInputSchema = z83.object({
+  jobId: z83.string().min(1).max(128).describe('Job ID returned by orchestrate({ mode: "async" })')
 });
 function getJobResultHandler(args) {
   const parsed = GetJobResultInputSchema.safeParse(args);
@@ -40122,7 +40333,7 @@ function getJobResultHandler(args) {
 function registerGetJobResultTool(server, deps) {
   const logger58 = deps.logger ?? createLogger({ tool: "get_job_result" });
   const toolSchema = {
-    jobId: z82.string().min(1).max(128).describe('Job ID returned by orchestrate({ mode: "async" })')
+    jobId: z83.string().min(1).max(128).describe('Job ID returned by orchestrate({ mode: "async" })')
   };
   const description = 'Read the result of an async-mode tool invocation by jobId. Returns the structured record (status, result | error, timestamps). Poll until status !== "pending". Stage-1 of epic #2631 \u2014 Stage 2 will fold this into query_task_state once StructuredTaskState gains the result field.';
   const secureHandler = createSecureHandler(getJobResultHandler, {
@@ -40144,14 +40355,14 @@ function registerGetJobResultTool(server, deps) {
 }
 
 // src/mcp/tools/list-jobs-tool.ts
-import { z as z83 } from "zod";
+import { z as z84 } from "zod";
 var MAX_LIST_JOBS_RESULTS = 200;
-var ListJobsInputSchema = z83.object({
+var ListJobsInputSchema = z84.object({
   /**
    * Filter to jobs from a specific tool (exact match — e.g. `'orchestrate'`).
    * Omit to list every tool's jobs.
    */
-  toolName: z83.string().min(1).max(128).optional().describe("Filter to one tool (exact match)."),
+  toolName: z84.string().min(1).max(128).optional().describe("Filter to one tool (exact match)."),
   /**
    * Filter to jobs in a specific lifecycle state.
    * Omit to list every state.
@@ -40164,7 +40375,7 @@ var ListJobsInputSchema = z83.object({
    * Newest jobs are returned first, so a smaller limit shows the most
    * recent activity.
    */
-  limit: z83.number().int().min(1).max(MAX_LIST_JOBS_RESULTS).optional().describe(`Max summaries to return (1-${String(MAX_LIST_JOBS_RESULTS)}, newest first).`)
+  limit: z84.number().int().min(1).max(MAX_LIST_JOBS_RESULTS).optional().describe(`Max summaries to return (1-${String(MAX_LIST_JOBS_RESULTS)}, newest first).`)
 });
 function listJobsHandler(args) {
   const parsed = ListJobsInputSchema.safeParse(args);
@@ -40195,11 +40406,11 @@ function listJobsHandler(args) {
 function registerListJobsTool(server, deps) {
   const logger58 = deps.logger ?? createLogger({ tool: "list_jobs" });
   const toolSchema = {
-    toolName: z83.string().min(1).max(128).optional().describe("Filter to one tool (exact match)."),
+    toolName: z84.string().min(1).max(128).optional().describe("Filter to one tool (exact match)."),
     status: JobStatusSchema.optional().describe(
       "Filter to pending | complete | failed | cancelled. Omit for all."
     ),
-    limit: z83.number().int().min(1).max(MAX_LIST_JOBS_RESULTS).optional().describe(`Max summaries to return (1-${String(MAX_LIST_JOBS_RESULTS)}, newest first).`)
+    limit: z84.number().int().min(1).max(MAX_LIST_JOBS_RESULTS).optional().describe(`Max summaries to return (1-${String(MAX_LIST_JOBS_RESULTS)}, newest first).`)
   };
   const description = "List async-mode jobs (cross-session discovery). Returns summaries \u2014 jobId, toolName, status, timestamps \u2014 newest first. Filter by toolName / status / limit. Result payloads excluded; fetch via get_job_result(jobId). Stage 5 of epic #2631.";
   const secureHandler = createSecureHandler(listJobsHandler, {
@@ -40221,10 +40432,10 @@ function registerListJobsTool(server, deps) {
 }
 
 // src/mcp/tools/cancel-job-tool.ts
-import { z as z84 } from "zod";
-var CancelJobInputSchema = z84.object({
-  jobId: z84.string().min(1).max(128).describe("Job ID returned by orchestrate / run_workflow / consensus_vote in async mode"),
-  reason: z84.string().max(1e3).optional().describe('Optional human-readable note (e.g. "user clicked cancel").')
+import { z as z85 } from "zod";
+var CancelJobInputSchema = z85.object({
+  jobId: z85.string().min(1).max(128).describe("Job ID returned by orchestrate / run_workflow / consensus_vote in async mode"),
+  reason: z85.string().max(1e3).optional().describe('Optional human-readable note (e.g. "user clicked cancel").')
 });
 function cancelJobHandler(args) {
   const parsed = CancelJobInputSchema.safeParse(args);
@@ -40281,8 +40492,8 @@ function cancelPendingJob(jobId, toolName, reason) {
 function registerCancelJobTool(server, deps) {
   const logger58 = deps.logger ?? createLogger({ tool: "cancel_job" });
   const toolSchema = {
-    jobId: z84.string().min(1).max(128).describe("Job ID returned by orchestrate / run_workflow / consensus_vote in async mode"),
-    reason: z84.string().max(1e3).optional().describe('Optional human-readable note (e.g. "user clicked cancel").')
+    jobId: z85.string().min(1).max(128).describe("Job ID returned by orchestrate / run_workflow / consensus_vote in async mode"),
+    reason: z85.string().max(1e3).optional().describe('Optional human-readable note (e.g. "user clicked cancel").')
   };
   const description = "Mark an async-mode job as cancelled (#3042 Stage 1b / epic #2631). Same-process dispatcher unwinds via AbortSignal (#3035/#3038); cross-process workers observe via get_job_result. Idempotent \u2014 cancel-after-complete is a no-op (preserves the terminal record); second cancel returns already_cancelled.";
   const secureHandler = createSecureHandler(cancelJobHandler, {
@@ -40304,7 +40515,7 @@ function registerCancelJobTool(server, deps) {
 }
 
 // src/audit/audit-types.ts
-import { z as z85 } from "zod";
+import { z as z86 } from "zod";
 var AuditError = class extends Error {
   code = "AUDIT_ERROR";
   context;
@@ -40316,7 +40527,7 @@ var AuditError = class extends Error {
     this.context = options?.context;
   }
 };
-var AuditCategorySchema = z85.enum([
+var AuditCategorySchema = z86.enum([
   "authentication",
   // Login, logout, token refresh
   "authorization",
@@ -40336,28 +40547,28 @@ var AuditCategorySchema = z85.enum([
   "governance"
   // Authority-tier transitions, ratification (Epic D, #3842)
 ]);
-var TierTransitionKindSchema = z85.enum(["promotion", "demotion"]);
-var TierTransitionTierSchema = z85.enum(["observe", "suggest", "advisory", "enforce"]);
-var TierTransitionPayloadSchema = z85.object({
+var TierTransitionKindSchema = z86.enum(["promotion", "demotion"]);
+var TierTransitionTierSchema = z86.enum(["observe", "suggest", "advisory", "enforce"]);
+var TierTransitionPayloadSchema = z86.object({
   /** Whether the loop moved up (`promotion`) or down (`demotion`) the ladder. */
   kind: TierTransitionKindSchema,
   /** The loop/strategy whose tier changed (manifest `id` or loop identifier). */
-  subject: z85.string().min(1),
+  subject: z86.string().min(1),
   /** Tier before the transition. */
   fromTier: TierTransitionTierSchema,
   /** Tier after the transition. */
   toTier: TierTransitionTierSchema,
   /** Ref to the promotion-evidence record this transition was earned against. */
-  evidenceRef: z85.string().min(1),
+  evidenceRef: z86.string().min(1),
   /**
    * Ref to the recorded `consensus_vote` that ratified a PROMOTION. Required
    * by the ratification gate for `kind: 'promotion'`; legitimately absent for
    * `kind: 'demotion'` (automatic, ADR-0017 §"Demotion is automatic").
    */
-  ratificationVoteRef: z85.string().min(1).optional()
+  ratificationVoteRef: z86.string().min(1).optional()
 }).strict();
 var TIER_TRANSITION_METADATA_KEY = "tierTransition";
-var AuditSeveritySchema = z85.enum([
+var AuditSeveritySchema = z86.enum([
   "info",
   // Normal operations
   "warning",
@@ -40365,7 +40576,7 @@ var AuditSeveritySchema = z85.enum([
   "critical"
   // Security violations, failures
 ]);
-var AuditOutcomeSchema = z85.enum([
+var AuditOutcomeSchema = z86.enum([
   "success",
   // Operation completed successfully
   "failure",
@@ -40375,61 +40586,61 @@ var AuditOutcomeSchema = z85.enum([
   "error"
   // Unexpected error occurred
 ]);
-var AuditActorSchema = z85.object({
-  type: z85.enum(["user", "agent", "system", "external"]),
-  id: z85.string().min(1),
-  name: z85.string().optional(),
-  ip: z85.string().optional(),
-  userAgent: z85.string().optional()
+var AuditActorSchema = z86.object({
+  type: z86.enum(["user", "agent", "system", "external"]),
+  id: z86.string().min(1),
+  name: z86.string().optional(),
+  ip: z86.string().optional(),
+  userAgent: z86.string().optional()
 });
-var AuditResourceSchema = z85.object({
-  type: z85.string().min(1),
+var AuditResourceSchema = z86.object({
+  type: z86.string().min(1),
   // e.g., 'file', 'tool', 'config', 'agent'
-  id: z85.string().min(1),
-  name: z85.string().optional(),
-  path: z85.string().optional()
+  id: z86.string().min(1),
+  name: z86.string().optional(),
+  path: z86.string().optional()
 });
-var AuditEventSchema = z85.object({
+var AuditEventSchema = z86.object({
   // Identity
-  id: z85.string().min(1),
+  id: z86.string().min(1),
   // Unique event ID
-  version: z85.literal("1.0"),
+  version: z86.literal("1.0"),
   // Schema version for migrations
   // Timing
-  timestamp: z85.string(),
+  timestamp: z86.string(),
   // ISO 8601 format
-  timestampMs: z85.number(),
+  timestampMs: z86.number(),
   // Unix epoch milliseconds
   // Classification
   category: AuditCategorySchema,
   severity: AuditSeveritySchema,
   outcome: AuditOutcomeSchema,
   // Event details
-  action: z85.string().min(1),
+  action: z86.string().min(1),
   // e.g., 'tool.invoke', 'policy.evaluate'
-  description: z85.string().optional(),
+  description: z86.string().optional(),
   // Actors and resources
   actor: AuditActorSchema,
   resource: AuditResourceSchema.optional(),
   // Correlation
-  requestId: z85.string().optional(),
+  requestId: z86.string().optional(),
   // Request correlation ID
-  traceId: z85.string().optional(),
+  traceId: z86.string().optional(),
   // Distributed trace ID
-  sessionId: z85.string().optional(),
+  sessionId: z86.string().optional(),
   // Session correlation ID
   // Context
-  toolName: z85.string().optional(),
-  durationMs: z85.number().optional(),
-  metadata: z85.record(z85.string(), z85.unknown()).optional(),
+  toolName: z86.string().optional(),
+  durationMs: z86.number().optional(),
+  metadata: z86.record(z86.string(), z86.unknown()).optional(),
   // Policy and security
-  policyName: z85.string().optional(),
-  policyDecision: z85.string().optional(),
-  violationType: z85.string().optional(),
+  policyName: z86.string().optional(),
+  policyDecision: z86.string().optional(),
+  violationType: z86.string().optional(),
   // Integrity (for tamper-evidence)
-  previousHash: z85.string().optional(),
+  previousHash: z86.string().optional(),
   // Hash of previous event (chain)
-  hash: z85.string().optional(),
+  hash: z86.string().optional(),
   // Hash of this event
   /**
    * Hash-projection version (#3921). ABSENT/`1` = the legacy projection
@@ -40439,60 +40650,60 @@ var AuditEventSchema = z85.object({
    * Versioned so pre-existing v1 chains keep verifying under their own
    * projection (see {@link AUDIT_HASH_VERSION_TIER_TRANSITION}).
    */
-  hashVersion: z85.number().int().positive().optional()
+  hashVersion: z86.number().int().positive().optional()
 });
 var AUDIT_HASH_VERSION_TIER_TRANSITION = 2;
-var AuditEventInputSchema = z85.object({
+var AuditEventInputSchema = z86.object({
   category: AuditCategorySchema,
   severity: AuditSeveritySchema.optional().default("info"),
   outcome: AuditOutcomeSchema,
-  action: z85.string().min(1),
-  description: z85.string().optional(),
+  action: z86.string().min(1),
+  description: z86.string().optional(),
   actor: AuditActorSchema,
   resource: AuditResourceSchema.optional(),
-  requestId: z85.string().optional(),
-  traceId: z85.string().optional(),
-  sessionId: z85.string().optional(),
-  toolName: z85.string().optional(),
-  durationMs: z85.number().optional(),
-  metadata: z85.record(z85.string(), z85.unknown()).optional(),
-  policyName: z85.string().optional(),
-  policyDecision: z85.string().optional(),
-  violationType: z85.string().optional()
+  requestId: z86.string().optional(),
+  traceId: z86.string().optional(),
+  sessionId: z86.string().optional(),
+  toolName: z86.string().optional(),
+  durationMs: z86.number().optional(),
+  metadata: z86.record(z86.string(), z86.unknown()).optional(),
+  policyName: z86.string().optional(),
+  policyDecision: z86.string().optional(),
+  violationType: z86.string().optional()
 });
-var AuditLogConfigSchema = z85.object({
+var AuditLogConfigSchema = z86.object({
   // Storage
-  logDir: z85.string().min(1),
-  filePrefix: z85.string().optional().default("audit"),
-  maxFileSizeBytes: z85.number().positive().optional().default(10 * 1024 * 1024),
+  logDir: z86.string().min(1),
+  filePrefix: z86.string().optional().default("audit"),
+  maxFileSizeBytes: z86.number().positive().optional().default(10 * 1024 * 1024),
   // 10MB
-  maxFiles: z85.number().positive().optional().default(10),
+  maxFiles: z86.number().positive().optional().default(10),
   // Features
-  enableHashChain: z85.boolean().optional().default(true),
-  enableCompression: z85.boolean().optional().default(false),
-  flushIntervalMs: z85.number().positive().optional().default(1e3),
+  enableHashChain: z86.boolean().optional().default(true),
+  enableCompression: z86.boolean().optional().default(false),
+  flushIntervalMs: z86.number().positive().optional().default(1e3),
   /**
    * Maximum in-memory event queue depth before drop-oldest backpressure
    * engages. Bounds memory under load when storage.write is slow or the flush
    * timer is overlapping; see #2979.
    */
-  maxQueueDepth: z85.number().positive().optional().default(1e4),
+  maxQueueDepth: z86.number().positive().optional().default(1e4),
   // Filtering
   minSeverity: AuditSeveritySchema.optional().default("info"),
-  categories: z85.array(AuditCategorySchema).optional()
+  categories: z86.array(AuditCategorySchema).optional()
 });
-var AuditQueryCriteriaSchema = z85.object({
-  startTime: z85.date().optional(),
-  endTime: z85.date().optional(),
-  categories: z85.array(AuditCategorySchema).optional(),
-  severities: z85.array(AuditSeveritySchema).optional(),
-  outcomes: z85.array(AuditOutcomeSchema).optional(),
-  actorId: z85.string().optional(),
-  resourceId: z85.string().optional(),
-  requestId: z85.string().optional(),
-  traceId: z85.string().optional(),
-  limit: z85.number().positive().optional().default(100),
-  offset: z85.number().nonnegative().optional().default(0)
+var AuditQueryCriteriaSchema = z86.object({
+  startTime: z86.date().optional(),
+  endTime: z86.date().optional(),
+  categories: z86.array(AuditCategorySchema).optional(),
+  severities: z86.array(AuditSeveritySchema).optional(),
+  outcomes: z86.array(AuditOutcomeSchema).optional(),
+  actorId: z86.string().optional(),
+  resourceId: z86.string().optional(),
+  requestId: z86.string().optional(),
+  traceId: z86.string().optional(),
+  limit: z86.number().positive().optional().default(100),
+  offset: z86.number().nonnegative().optional().default(0)
 });
 
 // src/audit/audit-storage-queries.ts
@@ -40753,27 +40964,27 @@ var FileAuditStorage = class _FileAuditStorage {
     const data = this.writeBuffer.join("");
     this.writeBuffer = [];
     const stream = this.writeStream;
-    return new Promise((resolve19, reject) => {
+    return new Promise((resolve20, reject) => {
       stream.write(data, (err2) => {
         if (err2 !== void 0 && err2 !== null) {
           reject(new AuditError("Failed to flush audit log", { cause: err2 }));
         } else {
-          resolve19();
+          resolve20();
         }
       });
     });
   }
   async close() {
     await this.flush();
-    return new Promise((resolve19) => {
+    return new Promise((resolve20) => {
       if (this.writeStream === null) {
-        resolve19();
+        resolve20();
         return;
       }
       this.writeStream.end(() => {
         this.writeStream = null;
         this.logger.info("Audit storage closed");
-        resolve19();
+        resolve20();
       });
     });
   }
@@ -41674,7 +41885,7 @@ async function tryIssueTriage(task) {
   try {
     const issueMatch = task.match(/github\.com\/([^/]+\/[^/]+)\/issues\/(\d+)/);
     if (issueMatch === null) return null;
-    const { createIssueTriage } = await import("./issue-triage-CVMVZ3IV.js");
+    const { createIssueTriage } = await import("./issue-triage-RVDZEM53.js");
     const triage = createIssueTriage();
     const owner = issueMatch[1] ?? "";
     const num = issueMatch[2] ?? "";
@@ -41702,7 +41913,7 @@ var VALID_TEMPLATES = /* @__PURE__ */ new Set([
 ]);
 async function classifyWithLLM(task) {
   try {
-    const { executeExpert: executeExpert2 } = await import("./expert-bridge-WNV3ST2T.js");
+    const { executeExpert: executeExpert2 } = await import("./expert-bridge-7HQ54XYU.js");
     const prompt = [
       "Classify this task into exactly one pipeline template.",
       "Templates: dev (implementation/bug fix/refactor), research (investigate/evaluate/compare),",
@@ -41810,7 +42021,7 @@ function ensureRunnableTemplate(template, stages) {
 // src/pipeline/pipeline-checkpoint.ts
 import * as fs7 from "fs";
 import * as path5 from "path";
-import { z as z86 } from "zod";
+import { z as z87 } from "zod";
 var logger38 = createLogger({ component: "pipeline-checkpoint" });
 var SESSION_ID_REGEX = /^[a-zA-Z0-9_-]{1,128}$/;
 function validateSessionId(sessionId) {
@@ -41858,7 +42069,7 @@ function loadCheckpointState(sessionId, customDir) {
     return null;
   }
 }
-var PipelineStageSchema = z86.enum([
+var PipelineStageSchema = z87.enum([
   "research",
   "plan",
   "vote",
@@ -41866,27 +42077,27 @@ var PipelineStageSchema = z86.enum([
   "implement",
   "security"
 ]);
-var PipelineStageDataSchema = z86.discriminatedUnion("type", [
-  z86.object({ type: z86.literal("research"), text: z86.string() }),
-  z86.object({ type: z86.literal("plan"), text: z86.string(), iterations: z86.number() }),
-  z86.object({
-    type: z86.literal("vote"),
-    approved: z86.boolean(),
-    conditional: z86.boolean(),
-    conditions: z86.array(z86.string()).optional(),
-    caveats: z86.array(z86.string()).optional(),
-    iterations: z86.number()
+var PipelineStageDataSchema = z87.discriminatedUnion("type", [
+  z87.object({ type: z87.literal("research"), text: z87.string() }),
+  z87.object({ type: z87.literal("plan"), text: z87.string(), iterations: z87.number() }),
+  z87.object({
+    type: z87.literal("vote"),
+    approved: z87.boolean(),
+    conditional: z87.boolean(),
+    conditions: z87.array(z87.string()).optional(),
+    caveats: z87.array(z87.string()).optional(),
+    iterations: z87.number()
   }),
   // PipelineTask shape is loose at the persistence layer — capture as
   // `z.unknown()` and trust the downstream consumer's narrower validation.
-  z86.object({ type: z86.literal("decompose"), tasks: z86.array(z86.unknown()) }),
-  z86.object({ type: z86.literal("implement"), tasks: z86.array(z86.unknown()) }),
-  z86.object({ type: z86.literal("security"), passed: z86.boolean() })
+  z87.object({ type: z87.literal("decompose"), tasks: z87.array(z87.unknown()) }),
+  z87.object({ type: z87.literal("implement"), tasks: z87.array(z87.unknown()) }),
+  z87.object({ type: z87.literal("security"), passed: z87.boolean() })
 ]);
-var PipelineCheckpointEntrySchema = z86.object({
-  sessionId: z86.string(),
+var PipelineCheckpointEntrySchema = z87.object({
+  sessionId: z87.string(),
   stage: PipelineStageSchema,
-  timestamp: z86.string(),
+  timestamp: z87.string(),
   data: PipelineStageDataSchema
 });
 function rebuildState(lines) {
@@ -42706,8 +42917,8 @@ async function executeSecurityScan(input) {
 }
 
 // src/security/finding-lifecycle.ts
-import { z as z87 } from "zod";
-var FindingLifecycleStageSchema = z87.enum([
+import { z as z88 } from "zod";
+var FindingLifecycleStageSchema = z88.enum([
   "detected",
   "triaged",
   "fix_generated",
@@ -42793,14 +43004,14 @@ function summarizeLifecycle(entries) {
 }
 
 // src/security/finding-triage.ts
-import { z as z88 } from "zod";
+import { z as z89 } from "zod";
 import { readFileSync as readFileSync6 } from "fs";
 var logger42 = createLogger({ component: "security-finding-triage" });
-var TriageVerdictSchema = z88.object({
-  confirmed: z88.boolean(),
-  confidence: z88.number().min(0).max(1),
-  reasoning: z88.string().max(1e3),
-  suggestedSeverity: z88.enum(FINDING_SEVERITY_LEVELS)
+var TriageVerdictSchema = z89.object({
+  confirmed: z89.boolean(),
+  confidence: z89.number().min(0).max(1),
+  reasoning: z89.string().max(1e3),
+  suggestedSeverity: z89.enum(FINDING_SEVERITY_LEVELS)
 });
 var DEFAULT_CONFIG3 = {
   maxFindings: 10,
@@ -42910,18 +43121,18 @@ async function triageFindings(findings, delegateFn, config = DEFAULT_CONFIG3) {
 }
 
 // src/security/osv-lookup.ts
-import { z as z89 } from "zod";
+import { z as z90 } from "zod";
 var logger43 = createLogger({ component: "osv-lookup" });
 var OSV_API_URL = "https://api.osv.dev/v1/query";
 var DEFAULT_TIMEOUT_MS4 = NETWORK_FETCH_TIMEOUT_MS;
-var OsvVulnerabilitySchema = z89.object({
-  id: z89.string(),
-  summary: z89.string().optional(),
-  severity: z89.enum(["CRITICAL", "HIGH", "MODERATE", "LOW", "UNKNOWN"]).optional(),
-  aliases: z89.array(z89.string()).default([]),
-  affectedVersions: z89.string().optional(),
-  fixedVersion: z89.string().optional(),
-  url: z89.string().optional()
+var OsvVulnerabilitySchema = z90.object({
+  id: z90.string(),
+  summary: z90.string().optional(),
+  severity: z90.enum(["CRITICAL", "HIGH", "MODERATE", "LOW", "UNKNOWN"]).optional(),
+  aliases: z90.array(z90.string()).default([]),
+  affectedVersions: z90.string().optional(),
+  fixedVersion: z90.string().optional(),
+  url: z90.string().optional()
 });
 var DEFAULT_OSV_CONFIG = {
   timeoutMs: DEFAULT_TIMEOUT_MS4
@@ -43343,7 +43554,7 @@ var memoryInitPromise = null;
 async function initPipelineMemory() {
   if (cachedMemory !== null) return cachedMemory;
   try {
-    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-DAJHLPOY.js");
+    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-TQMLN67N.js");
     const { getLearningDir } = await import("./learning-persistence-6D5GGT7D.js");
     const mem = createSessionMemory2(getLearningDir());
     mem.startSession(`pipeline-${String(getTimeProvider().now())}`);
@@ -43405,7 +43616,7 @@ function recordRoutingExperience(category, success, durationMs, tokensUsed = 0,
     callRecord(routingMemoryCache);
     return;
   }
-  routingMemoryInitPromise ??= import("./routing-memory-G6YBK4WI.js").then(({ createRoutingMemory }) => {
+  routingMemoryInitPromise ??= import("./routing-memory-INY5DC2P.js").then(({ createRoutingMemory }) => {
     routingMemoryCache ??= createRoutingMemory();
     return routingMemoryCache;
   }).catch((error) => {
@@ -43439,7 +43650,7 @@ ${text}` : "";
 }
 async function getWeatherContext() {
   try {
-    const { generateWeatherReport: generateWeatherReport2 } = await import("./weather-report-TWBLIHPZ.js");
+    const { generateWeatherReport: generateWeatherReport2 } = await import("./weather-report-7NZ6D4C7.js");
     const report = generateWeatherReport2({ includeAdaptive: true });
     const mappings = "recommendedMappings" in report ? report.recommendedMappings : [];
     if (!Array.isArray(mappings) || mappings.length === 0) return "";
@@ -43457,7 +43668,7 @@ ${lines}
 }
 async function getMemoryContext(task) {
   try {
-    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-DAJHLPOY.js");
+    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-TQMLN67N.js");
     const { getLearningDir } = await import("./learning-persistence-6D5GGT7D.js");
     const memory = createSessionMemory2(getLearningDir(), { maxLearningsInContext: 10 });
     const learnings = memory.searchLearnings(task.slice(0, 200));
@@ -43572,7 +43783,7 @@ ${contextBlock}`;
       const strategy = config.votingStrategy ?? "higher_order";
       await postProgress(config, "Vote", `Running consensus with ${strategy} strategy...`);
       try {
-        const { executeVoting } = await import("./consensus-vote-322S65GQ.js");
+        const { executeVoting } = await import("./consensus-vote-FEDF24T5.js");
         const votingResult = await executeVoting(
           {
             proposal: buildVoteProposal(plan, research),
@@ -43998,7 +44209,7 @@ function createScaffoldStageWrapper() {
 }
 async function searchCodebaseForTask(task) {
   try {
-    const { CodebaseIndex: CodebaseIndex2 } = await import("./codebase-search-DKLEA4PR.js");
+    const { CodebaseIndex: CodebaseIndex2 } = await import("./codebase-search-LUF5YJLQ.js");
     const index = new CodebaseIndex2(process.cwd());
     const terms = task.toLowerCase().split(/\s+/).filter((w) => w.length > 4).slice(0, 3);
     if (terms.length === 0) return null;
@@ -44013,7 +44224,7 @@ async function searchCodebaseForTask(task) {
 }
 async function queryResearchRegistry(task) {
   try {
-    const { synthesizeResearch: synthesizeResearch2 } = await import("./research-helpers-synthesize-F4PV4B4B.js");
+    const { synthesizeResearch: synthesizeResearch2 } = await import("./research-helpers-synthesize-4L6SXYQU.js");
     const topic = task.split(/[.!?\n]/).filter((s) => s.trim().length > 10)[0]?.trim();
     if (topic === void 0) return null;
     const result = await synthesizeResearch2(topic.slice(0, 50));
@@ -44084,7 +44295,7 @@ function createScanStageWrapper() {
       try {
         const slug = ctx.task.match(/([a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+)/)?.[1];
         if (slug !== void 0) {
-          const { generateSecurityPlan: generateSecurityPlan2 } = await import("./repo-security-plan-F7V5SHAQ.js");
+          const { generateSecurityPlan: generateSecurityPlan2 } = await import("./repo-security-plan-YCTKRAGA.js");
           const plan = await generateSecurityPlan2({ repo: slug, maxScanners: 10 });
           const recs = plan.recommendations.slice(0, 5).map((r) => `${r.priority}: ${r.displayName} (${r.category})`).join("; ");
           return output(PIPELINE_STATE_KEYS.FINDINGS, recs, getTimeProvider().now() - start, true);
@@ -44124,7 +44335,7 @@ function createAuditStageRegistry() {
 }
 
 // src/mcp/tools/pr-review-tool.ts
-import { z as z91 } from "zod";
+import { z as z92 } from "zod";
 import { randomUUID as randomUUID13 } from "crypto";
 
 // src/mcp/tools/pr-review-findings.ts
@@ -44236,20 +44447,20 @@ function reviewedDiffWasTruncated(diff) {
 
 // src/audit/pr-review-record-store.ts
 import { appendFileSync as appendFileSync4, existsSync as existsSync9, mkdirSync as mkdirSync6, readFileSync as readFileSync7 } from "fs";
-import { dirname as dirname4, isAbsolute, join as join9, resolve as resolve12 } from "path";
+import { dirname as dirname4, isAbsolute, join as join9, resolve as resolve13 } from "path";
 
 // src/audit/pr-review-record.ts
 import * as crypto3 from "crypto";
-import { z as z90 } from "zod";
-var PrReviewVerdictSchema = z90.enum(["approve", "request_changes", "abstain"]);
-var PrReviewVoteCountsSchema = z90.object({
-  approve: z90.number().int().nonnegative(),
-  request_changes: z90.number().int().nonnegative(),
-  abstain: z90.number().int().nonnegative(),
-  error: z90.number().int().nonnegative(),
-  total: z90.number().int().nonnegative()
+import { z as z91 } from "zod";
+var PrReviewVerdictSchema = z91.enum(["approve", "request_changes", "abstain"]);
+var PrReviewVoteCountsSchema = z91.object({
+  approve: z91.number().int().nonnegative(),
+  request_changes: z91.number().int().nonnegative(),
+  abstain: z91.number().int().nonnegative(),
+  error: z91.number().int().nonnegative(),
+  total: z91.number().int().nonnegative()
 }).strict();
-var PrReviewRecordSchema = z90.object({
+var PrReviewRecordSchema = z91.object({
   /**
    * Schema version. '1.1' is the Option-C binding (#3831): the record binds to
    * `{prNumber, baseSha, reviewedDiffHash}` instead of the rejected `headSha`.
@@ -44257,22 +44468,22 @@ var PrReviewRecordSchema = z90.object({
    * empty on every install (no producer ever wrote a '1.0' record), so there is
    * no '1.0' data to migrate.
    */
-  version: z90.literal("1.1"),
+  version: z91.literal("1.1"),
   /**
    * Monotonic sequence number (integer ≥ 0). Assigned as (max existing
    * sequence)+1 at write time. Sorted, the set of sequences must cover
    * 0..maxSeq with no gap (omission detection); DUPLICATE sequences are a
    * benign concurrent-fork signal, not tampering.
    */
-  sequence: z90.number().int().nonnegative(),
+  sequence: z91.number().int().nonnegative(),
   /** The PR number the review covers. */
-  prNumber: z90.number().int().positive(),
+  prNumber: z91.number().int().positive(),
   /**
    * The 40-hex BASE commit SHA the reviewed diff was computed against (the
    * `<base>..<head>` range base). Part of the Option-C binding so the gate knows
    * which range to recompute {@link reviewedDiffHash} over.
    */
-  baseSha: z90.string().regex(/^[0-9a-f]{40}$/, "baseSha must be a 40-char lowercase hex commit sha"),
+  baseSha: z91.string().regex(/^[0-9a-f]{40}$/, "baseSha must be a 40-char lowercase hex commit sha"),
   /**
    * DIFF-BINDING (Option-C, #3831): sha256 of the canonical reviewed diff bytes
    * (see `audit/reviewed-diff-hash.ts` — pinned `git diff` invocation + 50k
@@ -44281,9 +44492,9 @@ var PrReviewRecordSchema = z90.object({
    * byte-identical to what the voters saw. Covered by the self-hash below, so it
    * cannot be edited to claim a different reviewed diff.
    */
-  reviewedDiffHash: z90.string().length(64),
+  reviewedDiffHash: z91.string().length(64),
   /** ISO-8601 timestamp the review was recorded. */
-  recordedAt: z90.string().min(1),
+  recordedAt: z91.string().min(1),
   /** The resolved aggregate verdict. */
   verdict: PrReviewVerdictSchema,
   /**
@@ -44291,21 +44502,21 @@ var PrReviewRecordSchema = z90.object({
    * `request_changes` with `verified: true` is a strict blocker; covered by the
    * hash so it cannot be flipped without detection.
    */
-  verified: z90.boolean(),
+  verified: z91.boolean(),
   /** Per-decision voter tally from the pr_review aggregate. */
   voteCounts: PrReviewVoteCountsSchema,
   /** Truncated human-readable review summary for the reviewer record. */
-  summary: z90.string(),
+  summary: z91.string(),
   /** Optional correlation/decision id linking to the cost rollup / trace. */
-  correlationId: z90.string().min(1).optional(),
+  correlationId: z91.string().min(1).optional(),
   /**
    * ADVISORY hash of the tip record at write time (absent for the first).
    * Retained for audit texture but NOT covered by `hash` and NOT verified —
    * the record-set model is position-independent (mirrors #3927).
    */
-  previousHash: z90.string().length(64).optional(),
+  previousHash: z91.string().length(64).optional(),
   /** SHA-256 over every field above EXCEPT `previousHash` (and except `hash`). */
-  hash: z90.string().length(64)
+  hash: z91.string().length(64)
 }).strict();
 function computePrReviewRecordHash(payload) {
   const canonical = JSON.stringify({
@@ -44363,7 +44574,7 @@ function buildPrReviewRecord(input) {
 function resolvePrReviewRecordsPath() {
   const envPath = process.env[PR_REVIEW_RECORDS_PATH_ENV];
   if (envPath !== void 0 && envPath.trim() !== "") {
-    return isAbsolute(envPath) ? envPath : resolve12(envPath);
+    return isAbsolute(envPath) ? envPath : resolve13(envPath);
   }
   const root = findRepoRoot(process.cwd());
   if (root === null) return void 0;
@@ -44654,17 +44865,17 @@ var MAX_DIFF_INPUT_LENGTH = 2e6;
 var MAX_REPO_CONTEXT_LENGTH = 2e3;
 var MAX_DESCRIPTION_LENGTH = 1e4;
 var PR_REVIEW_ASYNC_HINT = "A pr_review run fans out to 5 live LLM voters and can exceed the synchronous MCP request timeout. Retry with `dispatch: 'async'` to get a jobId immediately, then poll get_job_result({ jobId }) for the result.";
-var PrReviewInputSchema = z91.object({
-  prTitle: z91.string().min(1).max(500).describe("PR title"),
-  prDescription: z91.string().max(MAX_DESCRIPTION_LENGTH).optional().describe("PR body / description"),
-  prDiff: z91.string().min(1).max(MAX_DIFF_INPUT_LENGTH).describe(
+var PrReviewInputSchema = z92.object({
+  prTitle: z92.string().min(1).max(500).describe("PR title"),
+  prDescription: z92.string().max(MAX_DESCRIPTION_LENGTH).optional().describe("PR body / description"),
+  prDiff: z92.string().min(1).max(MAX_DIFF_INPUT_LENGTH).describe(
     `Unified diff text (max ${String(MAX_DIFF_INPUT_LENGTH)} chars). No need to truncate before calling: diffs over ${String(MAX_DIFF_LENGTH)} chars are security-prioritized and PARTIALLY reviewed (lowest-priority whole files dropped; coverage reported on the response, and a partial review can block but never verified-approve).`
   ),
-  repoContext: z91.string().max(MAX_REPO_CONTEXT_LENGTH).optional().describe(
+  repoContext: z92.string().max(MAX_REPO_CONTEXT_LENGTH).optional().describe(
     `Optional one-paragraph repo context (architecture, conventions; max ${String(MAX_REPO_CONTEXT_LENGTH)} chars; trim before calling)`
   ),
-  baseRef: z91.string().max(200).optional().describe("Base branch ref (e.g. main)"),
-  headRef: z91.string().max(200).optional().describe("Head branch ref"),
+  baseRef: z92.string().max(200).optional().describe("Base branch ref (e.g. main)"),
+  headRef: z92.string().max(200).optional().describe("Head branch ref"),
   /**
    * Option-C audit binding (#4031). When BOTH `prNumber` and `baseSha` are
    * supplied AND the review is live (not simulated), pr_review persists an
@@ -44676,11 +44887,11 @@ var PrReviewInputSchema = z91.object({
    * canonical `git diff <baseSha>..<headSha>` the gate recomputes (the hash
    * truncates at that byte cap) — pass the canonical diff, not a reordered one.
    */
-  prNumber: z91.number().int().positive().optional().describe("PR number \u2014 with baseSha, enables Option-C audit-record persistence (#4031)"),
-  baseSha: z91.string().regex(/^[0-9a-f]{40}$/, "baseSha must be a 40-char lowercase hex commit sha").optional().describe(
+  prNumber: z92.number().int().positive().optional().describe("PR number \u2014 with baseSha, enables Option-C audit-record persistence (#4031)"),
+  baseSha: z92.string().regex(/^[0-9a-f]{40}$/, "baseSha must be a 40-char lowercase hex commit sha").optional().describe(
     "40-hex base commit sha the reviewed diff was computed from (Option-C binding, #4031)"
   ),
-  simulate: z91.boolean().default(false).describe("Use simulated voters (testing only; never ship live with this true)"),
+  simulate: z92.boolean().default(false).describe("Use simulated voters (testing only; never ship live with this true)"),
   /**
    * Error policy (#4132). `standard` (default) keeps the pre-#4132 aggregation:
    * an errored voter is simply excluded from the panel. `absolute_quorum` gates
@@ -44692,7 +44903,7 @@ var PrReviewInputSchema = z91.object({
    * verified approve. A genuine `request_changes` blocker still wins (Tiers 1-2
    * run first).
    */
-  errorPolicy: z91.enum(["standard", "absolute_quorum"]).default("standard").describe(
+  errorPolicy: z92.enum(["standard", "absolute_quorum"]).default("standard").describe(
     "Error policy (#4132). 'standard' (default): errored voters excluded. 'absolute_quorum': any errored voter \u2014 esp. the contrarian \u2014 degrades a would-be approve to a recoverable abstain (verified:false); never manufactures a verified approve from an induced error."
   ),
   /**
@@ -44702,7 +44913,7 @@ var PrReviewInputSchema = z91.object({
    * runs the panel in the background; poll `get_job_result({ jobId })` for the
    * result.
    */
-  dispatch: z91.enum(["sync", "async"]).default("sync").describe(
+  dispatch: z92.enum(["sync", "async"]).default("sync").describe(
     "Dispatch mode (#3731). 'sync' (default): run inline. 'async': return a jobId immediately + run the panel in background (poll get_job_result)."
   )
 });
@@ -44960,27 +45171,27 @@ function registerPrReviewTool(server, deps) {
 }
 
 // src/mcp/tools/survey-oss-landscape.ts
-import { z as z92 } from "zod";
-var SurveyOssLandscapeInputSchema = z92.object({
-  query: z92.string().min(1).max(200).describe('Free-text search query, e.g. "cargo nextest replacement" or "OSS SBOM tools"'),
-  maxResults: z92.number().int().min(1).max(50).optional().default(10).describe("Maximum candidates to return (1-50; default 10)"),
-  minStars: z92.number().int().min(0).optional().default(0).describe("Minimum star count to include (default 0; useful for filtering noise)"),
-  language: z92.string().max(50).optional().describe('GitHub language filter, e.g. "rust" or "typescript"')
+import { z as z93 } from "zod";
+var SurveyOssLandscapeInputSchema = z93.object({
+  query: z93.string().min(1).max(200).describe('Free-text search query, e.g. "cargo nextest replacement" or "OSS SBOM tools"'),
+  maxResults: z93.number().int().min(1).max(50).optional().default(10).describe("Maximum candidates to return (1-50; default 10)"),
+  minStars: z93.number().int().min(0).optional().default(0).describe("Minimum star count to include (default 0; useful for filtering noise)"),
+  language: z93.string().max(50).optional().describe('GitHub language filter, e.g. "rust" or "typescript"')
 });
-var GitHubRepoSchema = z92.object({
-  full_name: z92.string().optional(),
-  html_url: z92.string().optional(),
-  description: z92.string().nullable().optional(),
-  stargazers_count: z92.number().optional(),
-  pushed_at: z92.string().nullable().optional(),
-  language: z92.string().nullable().optional(),
-  license: z92.object({
-    spdx_id: z92.string().nullable().optional()
+var GitHubRepoSchema = z93.object({
+  full_name: z93.string().optional(),
+  html_url: z93.string().optional(),
+  description: z93.string().nullable().optional(),
+  stargazers_count: z93.number().optional(),
+  pushed_at: z93.string().nullable().optional(),
+  language: z93.string().nullable().optional(),
+  license: z93.object({
+    spdx_id: z93.string().nullable().optional()
   }).nullable().optional()
 });
-var GitHubSearchResponseSchema = z92.object({
-  total_count: z92.number().optional(),
-  items: z92.array(GitHubRepoSchema).optional()
+var GitHubSearchResponseSchema = z93.object({
+  total_count: z93.number().optional(),
+  items: z93.array(GitHubRepoSchema).optional()
 });
 var GITHUB_SEARCH_BASE = "https://api.github.com/search/repositories";
 function buildGithubQuery(input) {
@@ -45107,11 +45318,11 @@ function createSurveyHandler(deps) {
   };
 }
 var SURVEY_OUTPUT_SCHEMA = {
-  query: z92.string(),
-  totalFound: z92.number(),
-  candidates: z92.array(z92.unknown()),
-  sourcesQueried: z92.array(z92.string()),
-  sourcesFailed: z92.array(z92.string())
+  query: z93.string(),
+  totalFound: z93.number(),
+  candidates: z93.array(z93.unknown()),
+  sourcesQueried: z93.array(z93.string()),
+  sourcesFailed: z93.array(z93.string())
 };
 var SURVEY_DESCRIPTION = 'Transient OSS project search. Returns a ranked list of GitHub repositories with license, last-commit, star-count, and one-line description. Does NOT persist to the research registry \u2014 use `research_add_source` for that. Best for one-off engineering decisions like "what tools exist in this space?".';
 function registerSurveyOssLandscapeTool(server, deps) {
@@ -45140,7 +45351,7 @@ function registerSurveyOssLandscapeTool(server, deps) {
 }
 
 // src/mcp/tools/vendor-publishing-audit.ts
-import { z as z93 } from "zod";
+import { z as z94 } from "zod";
 
 // src/mcp/tools/vendor-publishing-seed.ts
 var VENDOR_PUBLISHING_SEED = {
@@ -45213,8 +45424,8 @@ function listKnownVendors() {
 }
 
 // src/mcp/tools/vendor-publishing-audit.ts
-var VendorPublishingAuditInputSchema = z93.object({
-  vendor: z93.string().min(1).max(50).toLowerCase().describe('Vendor identifier, lowercase. e.g. "ubuntu", "debian", "fedora"')
+var VendorPublishingAuditInputSchema = z94.object({
+  vendor: z94.string().min(1).max(50).toLowerCase().describe('Vendor identifier, lowercase. e.g. "ubuntu", "debian", "fedora"')
 });
 function lookupVendor(vendor) {
   if (isKnownVendor(vendor)) {
@@ -45246,20 +45457,20 @@ function createVendorPublishingAuditHandler(deps) {
   };
 }
 var VENDOR_PUBLISHING_OUTPUT_SCHEMA = {
-  vendor: z93.string(),
-  known: z93.boolean(),
+  vendor: z94.string(),
+  known: z94.boolean(),
   // Fields below populate when known=true; permissive optional for known=false.
-  sha256SumsUrlPattern: z93.string().optional(),
-  sha256SumsSignatureUrlPattern: z93.string().optional(),
-  signaturePattern: z93.string().optional(),
-  gpgKeys: z93.array(z93.unknown()).optional(),
-  releaseCadence: z93.string().optional(),
-  keyRotationNotes: z93.string().optional(),
-  vendorDocUrl: z93.string().optional(),
-  citedAt: z93.string().optional(),
+  sha256SumsUrlPattern: z94.string().optional(),
+  sha256SumsSignatureUrlPattern: z94.string().optional(),
+  signaturePattern: z94.string().optional(),
+  gpgKeys: z94.array(z94.unknown()).optional(),
+  releaseCadence: z94.string().optional(),
+  keyRotationNotes: z94.string().optional(),
+  vendorDocUrl: z94.string().optional(),
+  citedAt: z94.string().optional(),
   // Fields below populate when known=false.
-  message: z93.string().optional(),
-  knownVendors: z93.array(z93.string()).optional()
+  message: z94.string().optional(),
+  knownVendors: z94.array(z94.string()).optional()
 };
 var VENDOR_PUBLISHING_DESCRIPTION = "Look up a vendor's published-artifact signing infrastructure: GPG key fingerprints, SHA256SUMS URL pattern, signature shape (clearsigned / detached / detached-on-iso), release cadence, key rotation notes, and the vendor doc citation. Static lookup against a curated seed dataset; the vendor doc URL is the authoritative source. Returns `{known: false, knownVendors: [...]}` for vendors without a seed entry. v1 covers ubuntu, debian, fedora.";
 function registerVendorPublishingAuditTool(server, deps) {
@@ -45288,17 +45499,17 @@ function registerVendorPublishingAuditTool(server, deps) {
 }
 
 // src/mcp/tools/compare-data-feeds.ts
-import { z as z94 } from "zod";
+import { z as z95 } from "zod";
 import * as path7 from "path";
 import * as fs8 from "fs";
 import * as yaml2 from "yaml";
-var CompareDataFeedsInputSchema = z94.object({
-  feedAPath: z94.string().min(1).max(1e3).describe("Filesystem path to feed A (YAML or JSON, auto-detected by extension)"),
-  feedBPath: z94.string().min(1).max(1e3).describe("Filesystem path to feed B"),
-  keyPath: z94.string().min(1).max(200).describe(
+var CompareDataFeedsInputSchema = z95.object({
+  feedAPath: z95.string().min(1).max(1e3).describe("Filesystem path to feed A (YAML or JSON, auto-detected by extension)"),
+  feedBPath: z95.string().min(1).max(1e3).describe("Filesystem path to feed B"),
+  keyPath: z95.string().min(1).max(200).describe(
     'Dotted path to the entry key, e.g. "id" or "name". Each entry must have this field.'
   ),
-  compareFields: z94.array(z94.string().min(1).max(200)).max(20).optional().describe(
+  compareFields: z95.array(z95.string().min(1).max(200)).max(20).optional().describe(
     'Optional dotted field paths to compare across matched entries (e.g. ["license", "sha256"])'
   )
 });
@@ -45482,24 +45693,24 @@ function createCompareDataFeedsHandler(deps) {
   };
 }
 var COMPARE_OUTPUT_SCHEMA = {
-  feedAPath: z94.string(),
-  feedBPath: z94.string(),
-  keyPath: z94.string(),
-  counts: z94.object({
-    entriesInA: z94.number(),
-    entriesInB: z94.number(),
-    onlyInA: z94.number(),
-    onlyInB: z94.number(),
-    inBoth: z94.number(),
-    fieldDifferences: z94.number()
+  feedAPath: z95.string(),
+  feedBPath: z95.string(),
+  keyPath: z95.string(),
+  counts: z95.object({
+    entriesInA: z95.number(),
+    entriesInB: z95.number(),
+    onlyInA: z95.number(),
+    onlyInB: z95.number(),
+    inBoth: z95.number(),
+    fieldDifferences: z95.number()
   }),
-  coverage: z94.object({
-    onlyInA: z94.array(z94.string()),
-    onlyInB: z94.array(z94.string()),
-    inBoth: z94.array(z94.string())
+  coverage: z95.object({
+    onlyInA: z95.array(z95.string()),
+    onlyInB: z95.array(z95.string()),
+    inBoth: z95.array(z95.string())
   }),
-  fieldDifferences: z94.array(z94.unknown()),
-  summary: z94.string()
+  fieldDifferences: z95.array(z95.unknown()),
+  summary: z95.string()
 };
 var COMPARE_DESCRIPTION = "Diff two upstream data feeds (YAML or JSON files) along coverage and per-field axes. Returns which entries exist in A, B, both, plus optional field-level diffs across matched entries. v1 takes file paths only (no URL fetch \u2014 that needs an SSRF design pass). Both feeds must be a top-level array OR a top-level object with exactly one array field.";
 function registerCompareDataFeedsTool(server, deps) {
@@ -45528,9 +45739,9 @@ function registerCompareDataFeedsTool(server, deps) {
 }
 
 // src/mcp/tools/query-task-state-tool.ts
-import { z as z95 } from "zod";
-var QueryTaskStateInputSchema = z95.object({
-  taskId: z95.string().min(1).max(128).describe("Task ID whose structured state log should be read")
+import { z as z96 } from "zod";
+var QueryTaskStateInputSchema = z96.object({
+  taskId: z96.string().min(1).max(128).describe("Task ID whose structured state log should be read")
 });
 function queryTaskStateHandler(args, ctx) {
   const parsed = QueryTaskStateInputSchema.safeParse(args);
@@ -45565,7 +45776,7 @@ function queryTaskStateHandler(args, ctx) {
 function registerQueryTaskStateTool(server, deps) {
   const logger58 = deps.logger ?? createLogger({ tool: "query_task_state" });
   const toolSchema = {
-    taskId: z95.string().min(1).max(128).describe("Task ID whose structured state log should be read")
+    taskId: z96.string().min(1).max(128).describe("Task ID whose structured state log should be read")
   };
   const description = "Read the structured state log for a task ID and return the current snapshot. Includes Magentic-One Task Ledger (facts/guesses/openQuestions) and Progress Ledger (per-step reflections with suggestedAction) when orchestrators have written them. Structured state is only written when NEXUS_TASK_STATE_ENABLED=1 was set during the orchestrate invocation.";
   const secureHandler = createSecureHandler(queryTaskStateHandler, {
@@ -45587,28 +45798,28 @@ function registerQueryTaskStateTool(server, deps) {
 }
 
 // src/mcp/tools/ci-health-check-tool.ts
-import { z as z98 } from "zod";
+import { z as z99 } from "zod";
 
 // src/mcp/tools/ci-health-log.ts
 import { appendFileSync as appendFileSync5, existsSync as existsSync11, readFileSync as readFileSync9, statSync as statSync2, writeFileSync as writeFileSync3 } from "fs";
-import { z as z97 } from "zod";
+import { z as z98 } from "zod";
 
 // src/mcp/tools/ci-health-types.ts
-import { z as z96 } from "zod";
-var CiHealthStatusSchema = z96.enum(["healthy", "degraded", "outage", "unknown"]);
+import { z as z97 } from "zod";
+var CiHealthStatusSchema = z97.enum(["healthy", "degraded", "outage", "unknown"]);
 
 // src/mcp/tools/ci-health-log.ts
 var logger46 = createLogger({ component: "ci-health-log" });
-var CiHealthEventSchema = z97.object({
-  v: z97.literal(1),
-  ts: z97.iso.datetime(),
+var CiHealthEventSchema = z98.object({
+  v: z98.literal(1),
+  ts: z98.iso.datetime(),
   status: CiHealthStatusSchema,
-  repo: z97.string().optional(),
-  signals: z97.array(
-    z97.object({
-      source: z97.enum(["github-status", "repo-activity-window"]),
+  repo: z98.string().optional(),
+  signals: z98.array(
+    z98.object({
+      source: z98.enum(["github-status", "repo-activity-window"]),
       status: CiHealthStatusSchema,
-      evidence: z97.string()
+      evidence: z98.string()
     })
   )
 });
@@ -45688,17 +45899,17 @@ function eventFromCheck(params) {
 }
 
 // src/mcp/tools/ci-health-check-tool.ts
-var CiHealthCheckInputSchema = z98.object({
+var CiHealthCheckInputSchema = z99.object({
   /**
    * Repo to check for the recent-runs activity signal (in `owner/repo` form).
    * Optional — when omitted, only the status-page signal is consulted.
    */
-  repo: z98.string().regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/, "Must be owner/repo form").optional().describe("GitHub repo (owner/repo) to check for recent CI activity. Optional."),
+  repo: z99.string().regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/, "Must be owner/repo form").optional().describe("GitHub repo (owner/repo) to check for recent CI activity. Optional."),
   /**
    * How far back to look for recent-runs activity (minutes). Default 30 —
    * matches the typical wedge-detection window from the #3070 / #3076 outages.
    */
-  activityWindowMinutes: z98.number().int().min(5).max(180).default(30).describe("Recent-runs lookback window in minutes (5-180; default 30).")
+  activityWindowMinutes: z99.number().int().min(5).max(180).default(30).describe("Recent-runs lookback window in minutes (5-180; default 30).")
 });
 var STATUS_PAGE_URL = "https://www.githubstatus.com/api/v2/components.json";
 function mapStatusPageStatus(raw) {
@@ -45831,8 +46042,8 @@ var DESCRIPTION = "Check CI infrastructure health before triggering / polling ru
 function registerCiHealthCheckTool(server, deps) {
   const logger58 = deps.logger ?? createLogger({ tool: "ci_health_check" });
   const toolSchema = {
-    repo: z98.string().regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/, "Must be owner/repo form").optional().describe("GitHub repo (owner/repo) to check for recent CI activity. Optional."),
-    activityWindowMinutes: z98.number().int().min(5).max(180).optional().describe("Recent-runs lookback window in minutes (5-180; default 30).")
+    repo: z99.string().regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/, "Must be owner/repo form").optional().describe("GitHub repo (owner/repo) to check for recent CI activity. Optional."),
+    activityWindowMinutes: z99.number().int().min(5).max(180).optional().describe("Recent-runs lookback window in minutes (5-180; default 30).")
   };
   const secureHandler = createSecureHandler((args) => ciHealthCheckHandler(args, logger58), {
     toolName: "ci_health_check",
@@ -45858,18 +46069,18 @@ function registerCiHealthCheckTool(server, deps) {
 
 // src/mcp/tools/quality-gate-tool.ts
 import { statSync as statSync3 } from "fs";
-import { z as z99 } from "zod";
-var QualityCheckSchema = z99.enum(["typecheck", "lint", "tests", "build", "security"]);
+import { z as z100 } from "zod";
+var QualityCheckSchema = z100.enum(["typecheck", "lint", "tests", "build", "security"]);
 var DEFAULT_CHECKS = ["typecheck", "lint", "tests"];
-var RunQualityGateInputSchema = z99.object({
+var RunQualityGateInputSchema = z100.object({
   /** Project directory to run checks against. Must resolve inside the repo/cwd root. */
-  projectDir: z99.string().optional().describe(
+  projectDir: z100.string().optional().describe(
     "Project directory to run checks against (default: cwd). Must stay inside the repo root."
   ),
   /** Which allowlisted checks to run. */
-  checks: z99.array(QualityCheckSchema).nonempty().default([...DEFAULT_CHECKS]).describe("Allowlisted checks to run (default: ['typecheck','lint','tests'])."),
+  checks: z100.array(QualityCheckSchema).nonempty().default([...DEFAULT_CHECKS]).describe("Allowlisted checks to run (default: ['typecheck','lint','tests'])."),
   /** 1-based iteration counter, forwarded to the engine for feedback context. */
-  iteration: z99.number().int().min(1).default(1).describe("1-based iteration number (default 1).")
+  iteration: z100.number().int().min(1).default(1).describe("1-based iteration number (default 1).")
 });
 function validateProjectDir(raw) {
   const candidate = raw ?? process.cwd();
@@ -45944,11 +46155,11 @@ var DESCRIPTION2 = "Run the QA quality gate (#1684 engine) against a project dir
 function registerRunQualityGateTool(server, deps) {
   const logger58 = deps.logger ?? createLogger({ tool: "run_quality_gate" });
   const toolSchema = {
-    projectDir: z99.string().optional().describe(
+    projectDir: z100.string().optional().describe(
       "Project directory to run checks against (default: cwd). Must stay inside the repo root."
     ),
-    checks: z99.array(QualityCheckSchema).nonempty().optional().describe("Allowlisted checks to run (default: ['typecheck','lint','tests'])."),
-    iteration: z99.number().int().min(1).optional().describe("1-based iteration number (default 1).")
+    checks: z100.array(QualityCheckSchema).nonempty().optional().describe("Allowlisted checks to run (default: ['typecheck','lint','tests'])."),
+    iteration: z100.number().int().min(1).optional().describe("1-based iteration number (default 1).")
   };
   const secureHandler = createSecureHandler(
     (args) => runQualityGateHandler(args, logger58),
@@ -45978,9 +46189,9 @@ function registerRunQualityGateTool(server, deps) {
 // src/mcp/tools/verify-audit-chain-tool.ts
 import * as fs9 from "fs/promises";
 import * as path8 from "path";
-import { z as z100 } from "zod";
-var VerifyAuditChainInputSchema = z100.object({
-  logDir: z100.string().min(1).max(512).describe(
+import { z as z101 } from "zod";
+var VerifyAuditChainInputSchema = z101.object({
+  logDir: z101.string().min(1).max(512).describe(
     "Filesystem path to the FileAuditStorage log directory. Tool reads all `audit-*.jsonl` files in lexicographic order and verifies the combined chain."
   )
 });
@@ -46057,7 +46268,7 @@ async function handler2(args, ctx) {
 function registerVerifyAuditChainTool(server, deps) {
   const logger58 = deps.logger ?? createLogger({ tool: "verify_audit_chain" });
   const toolSchema = {
-    logDir: z100.string().min(1).max(512).describe(
+    logDir: z101.string().min(1).max(512).describe(
       "Filesystem path to the FileAuditStorage log directory. Tool reads all `audit-*.jsonl` files and verifies the combined hash chain."
     )
   };
@@ -46081,15 +46292,15 @@ function registerVerifyAuditChainTool(server, deps) {
 }
 
 // src/mcp/tools/suggest-research-tasks-tool.ts
-import { z as z101 } from "zod";
+import { z as z102 } from "zod";
 var SUGGEST_RESEARCH_TASKS_NOTE = "Suggestions derived from external research (untrusted); review before acting \u2014 nothing was executed or filed.";
 var RESEARCH_BUDGET_MS = 2e4;
 var RESEARCH_TIMED_OUT = /* @__PURE__ */ Symbol("research-budget-exceeded");
 async function withResearchBudget(p, ms) {
   let timer;
-  const budget = new Promise((resolve19) => {
+  const budget = new Promise((resolve20) => {
     timer = setTimeout(() => {
-      resolve19(RESEARCH_TIMED_OUT);
+      resolve20(RESEARCH_TIMED_OUT);
     }, ms);
   });
   try {
@@ -46098,11 +46309,11 @@ async function withResearchBudget(p, ms) {
     if (timer !== void 0) clearTimeout(timer);
   }
 }
-var SuggestResearchTasksInputSchema = z101.object({
-  topic: z101.string().optional().describe("Topic filter passed to research_discover. Optional."),
-  qualityThreshold: z101.number().min(0).max(10).optional().describe("Minimum quality score (0-10) a discovery must meet to be suggested. Optional."),
-  maxTriggers: z101.number().int().min(1).optional().describe("Max number of candidate tasks to return (>=1). Optional."),
-  existingTaskIds: z101.array(z101.string()).optional().describe("Known task IDs to skip (dedup). Optional.")
+var SuggestResearchTasksInputSchema = z102.object({
+  topic: z102.string().optional().describe("Topic filter passed to research_discover. Optional."),
+  qualityThreshold: z102.number().min(0).max(10).optional().describe("Minimum quality score (0-10) a discovery must meet to be suggested. Optional."),
+  maxTriggers: z102.number().int().min(1).optional().describe("Max number of candidate tasks to return (>=1). Optional."),
+  existingTaskIds: z102.array(z102.string()).optional().describe("Known task IDs to skip (dedup). Optional.")
 });
 function toTriggerConfig(input) {
   return {
@@ -46159,10 +46370,10 @@ var DESCRIPTION3 = "SUGGEST-ONLY: surface candidate pipeline tasks for human/orc
 function registerSuggestResearchTasksTool(server, deps) {
   const logger58 = deps.logger ?? createLogger({ tool: "suggest_research_tasks" });
   const toolSchema = {
-    topic: z101.string().optional().describe("Topic filter passed to research_discover. Optional."),
-    qualityThreshold: z101.number().min(0).max(10).optional().describe("Minimum quality score (0-10) a discovery must meet to be suggested. Optional."),
-    maxTriggers: z101.number().int().min(1).optional().describe("Max number of candidate tasks to return (>=1). Optional."),
-    existingTaskIds: z101.array(z101.string()).optional().describe("Known task IDs to skip (dedup). Optional.")
+    topic: z102.string().optional().describe("Topic filter passed to research_discover. Optional."),
+    qualityThreshold: z102.number().min(0).max(10).optional().describe("Minimum quality score (0-10) a discovery must meet to be suggested. Optional."),
+    maxTriggers: z102.number().int().min(1).optional().describe("Max number of candidate tasks to return (>=1). Optional."),
+    existingTaskIds: z102.array(z102.string()).optional().describe("Known task IDs to skip (dedup). Optional.")
   };
   const secureHandler = createSecureHandler(
     (args) => suggestResearchTasksHandler(args, logger58),
@@ -46190,7 +46401,7 @@ function registerSuggestResearchTasksTool(server, deps) {
 }
 
 // src/mcp/tools/run-tool.ts
-import { z as z105 } from "zod";
+import { z as z106 } from "zod";
 import { randomUUID as randomUUID17 } from "crypto";
 
 // src/orchestration/meta-orchestrator.ts
@@ -46436,7 +46647,7 @@ function createMetaOrchestrator(options) {
 
 // src/orchestration/meta-shadow-selector.ts
 import { appendFileSync as appendFileSync6, existsSync as existsSync12, readFileSync as readFileSync10 } from "fs";
-import { z as z102 } from "zod";
+import { z as z103 } from "zod";
 var SHADOW_STRATEGY_ARMS = [
   "single-shot",
   "dev-pipeline",
@@ -46517,19 +46728,19 @@ function createHydratableSelector() {
 var META_OUTCOME_SCHEMA_VERSION = 1;
 var HYDRATE_LOOKBACK_DAYS = 30;
 var HYDRATE_LOOKBACK_MS = HYDRATE_LOOKBACK_DAYS * 24 * 60 * 60 * 1e3;
-var PersistedContextSchema = z102.object({
-  taskComplexity: z102.number(),
-  contextLengthNormalized: z102.number(),
-  isCodeTask: z102.number(),
-  isReasoningTask: z102.number(),
-  budgetUtilization: z102.number(),
-  timePressure: z102.number()
+var PersistedContextSchema = z103.object({
+  taskComplexity: z103.number(),
+  contextLengthNormalized: z103.number(),
+  isCodeTask: z103.number(),
+  isReasoningTask: z103.number(),
+  budgetUtilization: z103.number(),
+  timePressure: z103.number()
 });
-var PersistedMetaOutcomeSchema = z102.object({
-  schema: z102.literal(META_OUTCOME_SCHEMA_VERSION),
-  timestamp: z102.string(),
-  strategy: z102.enum(SHADOW_STRATEGY_ARMS),
-  success: z102.boolean(),
+var PersistedMetaOutcomeSchema = z103.object({
+  schema: z103.literal(META_OUTCOME_SCHEMA_VERSION),
+  timestamp: z103.string(),
+  strategy: z103.enum(SHADOW_STRATEGY_ARMS),
+  success: z103.boolean(),
   context: PersistedContextSchema
 });
 var persistLogger = createLogger({ component: "MetaShadowSelector" });
@@ -47020,7 +47231,7 @@ function createMetaDispatcher(options) {
 }
 
 // src/mcp/tools/dev-pipeline-tool.ts
-import { z as z103 } from "zod";
+import { z as z104 } from "zod";
 import * as fs11 from "fs";
 import * as path10 from "path";
 import { randomUUID as randomUUID15 } from "crypto";
@@ -47044,7 +47255,7 @@ var GitHubTaskTracker = class {
   cachedProvider = null;
   async getProvider() {
     if (this.cachedProvider !== null) return this.cachedProvider;
-    const { createScmProvider } = await import("./factory-TLSTFONW.js");
+    const { createScmProvider } = await import("./factory-RW2ROEDS.js");
     const result = await createScmProvider({ repo: this.config.repo ?? "" });
     if (!result.ok) throw new Error(`SCM provider error: ${result.error.message}`);
     this.cachedProvider = result.value;
@@ -47169,36 +47380,36 @@ function createTaskTracker(config) {
 
 // src/mcp/tools/dev-pipeline-tool.ts
 var DEV_PIPELINE_ASYNC_HINT = "A full run_dev_pipeline run can exceed the 900s synchronous MCP timeout. Retry with `dispatch: 'async'` to get a jobId immediately, then poll get_job_result({ jobId }) for the result.";
-var DevPipelineInputSchema = z103.object({
+var DevPipelineInputSchema = z104.object({
   /** Direct task instructions. */
-  task: z103.string().max(1e4).optional().describe("Direct task instructions (what to build)"),
+  task: z104.string().max(1e4).optional().describe("Direct task instructions (what to build)"),
   /** Path to a plan file (.md, .yaml, .txt) to use as input. */
-  planFile: z103.string().max(500).optional().describe("Path to a plan/spec file to use as input"),
+  planFile: z104.string().max(500).optional().describe("Path to a plan/spec file to use as input"),
   /** Whether to run in dry-run mode (plan+vote only, no implementation). */
-  dryRun: z103.boolean().default(false).describe("If true, stop after plan+vote (no implementation)"),
+  dryRun: z104.boolean().default(false).describe("If true, stop after plan+vote (no implementation)"),
   /** Maximum vote iterations before proceeding (default: 3). */
-  maxVoteIterations: z103.number().int().min(1).max(5).default(3).describe("Max plan\u2192vote iterations"),
+  maxVoteIterations: z104.number().int().min(1).max(5).default(3).describe("Max plan\u2192vote iterations"),
   /** Maximum QA iterations per task (default: 3). */
-  maxQaIterations: z103.number().int().min(1).max(5).default(3).describe("Max QA review iterations per task"),
+  maxQaIterations: z104.number().int().min(1).max(5).default(3).describe("Max QA review iterations per task"),
   /** Working directory for the pipeline (default: cwd). Used for security scan and context. */
-  workingDir: z103.string().max(500).optional().describe("Working directory (default: cwd)"),
+  workingDir: z104.string().max(500).optional().describe("Working directory (default: cwd)"),
   /** GitHub issue number to track progress on. Updates posted as comments. */
-  issueNumber: z103.number().int().positive().optional().describe("GitHub issue to post progress to"),
+  issueNumber: z104.number().int().positive().optional().describe("GitHub issue to post progress to"),
   /** GitHub repo (owner/name) for issue tracking. */
-  repo: z103.string().max(200).optional().describe("GitHub repo for issue tracking (e.g., owner/repo)"),
+  repo: z104.string().max(200).optional().describe("GitHub repo for issue tracking (e.g., owner/repo)"),
   /** Task tracking backend: github, gitlab, or json (default: json). */
-  trackerBackend: z103.enum(["github", "gitlab", "json"]).default("json").describe("Task tracking backend for issue creation"),
+  trackerBackend: z104.enum(["github", "gitlab", "json"]).default("json").describe("Task tracking backend for issue creation"),
   /** Labels to apply to created issues. */
-  labels: z103.array(z103.string()).optional().describe("Labels for created issues"),
+  labels: z104.array(z104.string()).optional().describe("Labels for created issues"),
   /** Session ID for checkpoint/resume. Enables crash recovery. */
-  sessionId: z103.string().max(128).regex(/^[a-zA-Z0-9_-]+$/).optional().describe("Session ID for checkpoint/resume (crash recovery)"),
+  sessionId: z104.string().max(128).regex(/^[a-zA-Z0-9_-]+$/).optional().describe("Session ID for checkpoint/resume (crash recovery)"),
   /**
    * TESTS ONLY — when true, voters return random decisions. Must not be used as
    * a fallback when adapters are unavailable; configure an adapter instead. (#2319)
    */
-  simulateVotes: z103.boolean().default(false).describe("TESTS ONLY \u2014 random output, must not be used for real decisions (#2319)"),
+  simulateVotes: z104.boolean().default(false).describe("TESTS ONLY \u2014 random output, must not be used for real decisions (#2319)"),
   /** Voting strategy for consensus stages. */
-  votingStrategy: z103.enum([
+  votingStrategy: z104.enum([
     "simple_majority",
     "supermajority",
     "unanimous",
@@ -47207,11 +47418,11 @@ var DevPipelineInputSchema = z103.object({
     "opinion_wise"
   ]).optional().describe("Voting strategy for plan approval (default: higher_order)"),
   /** Use 3 agents instead of 6 for faster voting. */
-  quickMode: z103.boolean().default(false).describe("Use 3 agents instead of 6 for faster consensus voting"),
+  quickMode: z104.boolean().default(false).describe("Use 3 agents instead of 6 for faster consensus voting"),
   /** Maximum execution time per stage in milliseconds (min 30s, max 600s). */
-  timeoutMs: z103.number().int().min(3e4).max(6e5).optional().describe("Max time per stage in ms (30000-600000). Default: varies by stage complexity"),
+  timeoutMs: z104.number().int().min(3e4).max(6e5).optional().describe("Max time per stage in ms (30000-600000). Default: varies by stage complexity"),
   /** Pipeline execution mode. */
-  mode: z103.enum(["autonomous", "harness"]).default("autonomous").describe(
+  mode: z104.enum(["autonomous", "harness"]).default("autonomous").describe(
     "'autonomous': full pipeline. 'harness': stops after decompose, returns tasks for caller to implement."
   ),
   /**
@@ -47222,15 +47433,15 @@ var DevPipelineInputSchema = z103.object({
    * `get_job_result({ jobId })` for the result. Ignored when `dryRun` is
    * true (plan+vote completes fast, so dry runs always stay sync).
    */
-  dispatch: z103.enum(["sync", "async"]).default("sync").describe(
+  dispatch: z104.enum(["sync", "async"]).default("sync").describe(
     "Dispatch mode (#3726). 'sync' (default): run inline. 'async': return a jobId immediately + run in background (poll get_job_result). Ignored for dryRun."
   ),
   /** Local pre-ship quality gate (typecheck/lint/tests) mode (#3356). */
-  qualityGate: z103.enum(["off", "advisory", "blocking"]).default("off").describe(
+  qualityGate: z104.enum(["off", "advisory", "blocking"]).default("off").describe(
     "Pre-ship local quality gate. 'off' (default): skip. 'advisory': run + record feedback, never fail. 'blocking': a red gate fails the pipeline."
   ),
   /** Opt-in per-run token budget — a safety cap for unattended runs (#3395). */
-  maxBudgetTokens: z103.number().int().positive().optional().describe(
+  maxBudgetTokens: z104.number().int().positive().optional().describe(
     "Per-run token ceiling (#3395). When set, expert calls stop (returning failures) once cumulative usage crosses it \u2014 a hard-stop safety cap for unattended/multi-day runs. Omit to disable (default)."
   )
 });
@@ -47401,20 +47612,20 @@ function registerDevPipelineTool(server, deps) {
 }
 
 // src/mcp/tools/pipeline-tool.ts
-import { z as z104 } from "zod";
+import { z as z105 } from "zod";
 import * as fs12 from "fs";
 import * as path11 from "path";
 import { randomUUID as randomUUID16 } from "crypto";
 var PIPELINE_ASYNC_HINT = "A full run_pipeline run can exceed the synchronous MCP request timeout. Retry with `dispatch: 'async'` to get a jobId immediately, then poll get_job_result({ jobId }) for the result.";
-var PipelineInputSchema = z104.object({
+var PipelineInputSchema = z105.object({
   /** The task to execute. */
-  task: z104.string().min(5).max(1e4).describe("Task description \u2014 pipeline template auto-selected based on content"),
+  task: z105.string().min(5).max(1e4).describe("Task description \u2014 pipeline template auto-selected based on content"),
   /** Path to a spec file (.md, .yaml) to use as task input. */
-  specFile: z104.string().max(500).optional().describe("Path to a spec file \u2014 content prepended to task for greenfield projects"),
+  specFile: z105.string().max(500).optional().describe("Path to a spec file \u2014 content prepended to task for greenfield projects"),
   /** Override template — see `listTemplateIds()` for the canonical list (#2728). Auto-detected if omitted. */
-  template: z104.string().max(50).optional().describe(`Pipeline template override. Available: ${listTemplateIds().join(", ")}`),
+  template: z105.string().max(50).optional().describe(`Pipeline template override. Available: ${listTemplateIds().join(", ")}`),
   /** Voting strategy for consensus stages. */
-  votingStrategy: z104.enum([
+  votingStrategy: z105.enum([
     "simple_majority",
     "supermajority",
     "unanimous",
@@ -47425,11 +47636,11 @@ var PipelineInputSchema = z104.object({
     "Voting strategy for plan approval. simple_majority (default), supermajority (67%), unanimous, higher_order (Bayesian), proof_of_learning, opinion_wise"
   ),
   /** Use 3 agents instead of 6 for faster voting. */
-  quickMode: z104.boolean().default(false).describe("Use 3 agents instead of 6 for faster consensus voting"),
+  quickMode: z105.boolean().default(false).describe("Use 3 agents instead of 6 for faster consensus voting"),
   /** Maximum execution time per stage in milliseconds (min 30s, max 600s). */
-  timeoutMs: z104.number().int().min(3e4).max(6e5).optional().describe("Max time per stage in ms (30000-600000). Default: varies by stage complexity"),
+  timeoutMs: z105.number().int().min(3e4).max(6e5).optional().describe("Max time per stage in ms (30000-600000). Default: varies by stage complexity"),
   /** Stop after planning/voting (no implementation). */
-  dryRun: z104.boolean().default(false).describe("Stop after vote stage (no implementation)"),
+  dryRun: z105.boolean().default(false).describe("Stop after vote stage (no implementation)"),
   /**
    * Dispatch mode (#3730). `sync` (default) runs the pipeline inline and
    * returns the result — but a real multi-stage adaptive run can exceed the
@@ -47438,13 +47649,13 @@ var PipelineInputSchema = z104.object({
    * `get_job_result({ jobId })` for the result. Ignored when `dryRun` is true
    * (plan+vote completes fast, so dry runs always stay sync).
    */
-  dispatch: z104.enum(["sync", "async"]).default("sync").describe(
+  dispatch: z105.enum(["sync", "async"]).default("sync").describe(
     "Dispatch mode (#3730). 'sync' (default): run inline. 'async': return a jobId immediately + run in background (poll get_job_result). Ignored for dryRun."
   ),
   /** TESTS ONLY — random output, must not be used for real decisions. (#2319) */
-  simulateVotes: z104.boolean().default(false).describe("TESTS ONLY \u2014 random output, must not be used for real decisions (#2319)")
+  simulateVotes: z105.boolean().default(false).describe("TESTS ONLY \u2014 random output, must not be used for real decisions (#2319)")
 });
-function buildOutput2(result, simulated) {
+function buildOutput3(result, simulated) {
   return {
     success: result.success,
     templateId: result.templateId,
@@ -47529,7 +47740,7 @@ async function executePipelineBody(task, stages, templateId, dryRun, simulated)
     templateId,
     dryRun
   });
-  return toolSuccessStructured(buildOutput2(result, simulated));
+  return toolSuccessStructured(buildOutput3(result, simulated));
 }
 async function runPipelineHandler(args, logger58) {
   const parsed = PipelineInputSchema.safeParse(args);
@@ -47594,9 +47805,9 @@ function registerPipelineTool(server, deps) {
 }
 
 // src/mcp/tools/run-tool.ts
-var RunInputSchema = z105.object({
-  goal: z105.string().min(1).describe("Natural-language goal. nexus-agents selects how to execute it."),
-  forceStrategy: z105.enum([
+var RunInputSchema = z106.object({
+  goal: z106.string().min(1).describe("Natural-language goal. nexus-agents selects how to execute it."),
+  forceStrategy: z106.enum([
     "single-shot",
     "dev-pipeline",
     "pipeline",
@@ -47608,10 +47819,10 @@ var RunInputSchema = z105.object({
   ]).optional().describe(
     "Power-user override: force a specific strategy instead of letting the router choose."
   ),
-  requiresConsensus: z105.boolean().optional().describe("Hint: the task needs a multi-perspective consensus decision."),
-  dependencyStructure: z105.enum(["linear", "dag", "independent", "unknown"]).optional().describe("Hint: the dependency structure of the work."),
-  isNovel: z105.boolean().optional().describe("Hint: this kind of task has not been seen before."),
-  execute: z105.boolean().optional().describe(
+  requiresConsensus: z106.boolean().optional().describe("Hint: the task needs a multi-perspective consensus decision."),
+  dependencyStructure: z106.enum(["linear", "dag", "independent", "unknown"]).optional().describe("Hint: the dependency structure of the work."),
+  isNovel: z106.boolean().optional().describe("Hint: this kind of task has not been seen before."),
+  execute: z106.boolean().optional().describe(
     "When true, actually run the selected strategy (if an executor is wired) and return its result; otherwise return the routing decision only (default false, read-only)."
   ),
   /**
@@ -47622,7 +47833,7 @@ var RunInputSchema = z105.object({
    * envelope immediately and runs in the background; poll
    * `get_job_result({ jobId })`. Ignored for read-only routing (execute:false).
    */
-  dispatch: z105.enum(["sync", "async"]).optional().describe(
+  dispatch: z106.enum(["sync", "async"]).optional().describe(
     "Dispatch mode (#3732). 'sync' (default): run inline. 'async' (only with execute:true): return a jobId immediately + run in background (poll get_job_result)."
   )
 });
@@ -47814,12 +48025,12 @@ function registerRunTool(server, deps) {
 }
 
 // src/mcp/tools/list-available-models-tool.ts
-import { z as z106 } from "zod";
+import { z as z107 } from "zod";
 var DESCRIPTION5 = "Probe every model-discovery transport (OpenRouter API + opencode/claude/codex/gemini CLIs) and report a per-transport health summary: probe ok/failed, model count, and a sample of ids. Use it to validate the CLIs and APIs are wired and reachable. Read-only; does not change routing.";
 var PROBE_TIMEOUT_MS = 12e3;
-var ListAvailableModelsInputSchema = z106.object({
-  includeModelIds: z106.boolean().optional().describe("Include the full model-id list per transport (default false \u2192 sample of 5 only)."),
-  includeOpenRouter: z106.boolean().optional().describe("Probe the OpenRouter live catalog (default true).")
+var ListAvailableModelsInputSchema = z107.object({
+  includeModelIds: z107.boolean().optional().describe("Include the full model-id list per transport (default false \u2192 sample of 5 only)."),
+  includeOpenRouter: z107.boolean().optional().describe("Probe the OpenRouter live catalog (default true).")
 });
 async function probeSource(source, includeModelIds) {
   let timer;
@@ -47851,7 +48062,7 @@ async function probeSource(source, includeModelIds) {
   }
 }
 async function defaultSources(includeOpenRouter) {
-  const { createAllAdapters: createAllAdapters2 } = await import("./factory-33HQYVCK.js");
+  const { createAllAdapters: createAllAdapters2 } = await import("./factory-QZZQVDGQ.js");
   const adapters = createAllAdapters2();
   return buildDefaultModelSources(adapters, { includeOpenRouter });
 }
@@ -47883,8 +48094,8 @@ async function listAvailableModelsHandler(args, deps, logger58) {
 function registerListAvailableModelsTool(server, deps) {
   const logger58 = deps.logger ?? createLogger({ tool: "list_available_models" });
   const toolSchema = {
-    includeModelIds: z106.boolean().optional().describe("Include the full model-id list per transport (default false \u2192 sample of 5 only)."),
-    includeOpenRouter: z106.boolean().optional().describe("Probe the OpenRouter live catalog (default true).")
+    includeModelIds: z107.boolean().optional().describe("Include the full model-id list per transport (default false \u2192 sample of 5 only)."),
+    includeOpenRouter: z107.boolean().optional().describe("Probe the OpenRouter live catalog (default true).")
   };
   const secureHandler = createSecureHandler(
     (args) => listAvailableModelsHandler(args, deps, logger58),
@@ -47908,7 +48119,7 @@ function registerListAvailableModelsTool(server, deps) {
 }
 
 // src/mcp/tools/pr-review-eval-types.ts
-import { z as z107 } from "zod";
+import { z as z108 } from "zod";
 var PR_REVIEW_EVAL_ROLES = [
   "architect",
   "security",
@@ -47916,43 +48127,43 @@ var PR_REVIEW_EVAL_ROLES = [
   "catfish",
   "scope_steward"
 ];
-var PrReviewEvalRoleSchema = z107.enum(PR_REVIEW_EVAL_ROLES);
-var PrReviewCaseClassSchema = z107.enum(["buggy", "clean", "borderline"]);
-var VoterEvalVerdictSchema = z107.object({
+var PrReviewEvalRoleSchema = z108.enum(PR_REVIEW_EVAL_ROLES);
+var PrReviewCaseClassSchema = z108.enum(["buggy", "clean", "borderline"]);
+var VoterEvalVerdictSchema = z108.object({
   /** Stable record id (e.g. `${runId}:${caseNumber}:${role}`). */
-  id: z107.string().min(1).max(160),
+  id: z108.string().min(1).max(160),
   /** The pr_review run / batch this verdict belongs to. */
-  runId: z107.string().min(1).max(64),
+  runId: z108.string().min(1).max(64),
   /** Dataset case identifier (the dataset's `number` field). */
-  caseNumber: z107.string().min(1).max(80),
+  caseNumber: z108.string().min(1).max(80),
   /** Rubric class of the case (ground-truth label). */
   caseClass: PrReviewCaseClassSchema,
   /** The voter role being scored. */
   role: PrReviewEvalRoleSchema,
   /** Verified findings that matched a known bug. */
-  truePositives: z107.number().int().nonnegative(),
+  truePositives: z108.number().int().nonnegative(),
   /** Verified findings on clean code that matched no known bug. */
-  falsePositives: z107.number().int().nonnegative(),
+  falsePositives: z108.number().int().nonnegative(),
   /** Known bugs this voter failed to flag. */
-  falseNegatives: z107.number().int().nonnegative(),
+  falseNegatives: z108.number().int().nonnegative(),
   /** Rubric version the ground truth was adjudicated under. */
-  rubricVersion: z107.string().min(1).max(32),
+  rubricVersion: z108.string().min(1).max(32),
   /** ISO-8601 timestamp the verdict was recorded. */
-  timestamp: z107.string().min(1).max(40)
+  timestamp: z108.string().min(1).max(40)
 });
-var VoterEvalVerdictQuerySchema = z107.object({
+var VoterEvalVerdictQuerySchema = z108.object({
   role: PrReviewEvalRoleSchema.optional(),
-  runId: z107.string().min(1).max(64).optional(),
+  runId: z108.string().min(1).max(64).optional(),
   caseClass: PrReviewCaseClassSchema.optional(),
-  rubricVersion: z107.string().min(1).max(32).optional(),
+  rubricVersion: z108.string().min(1).max(32).optional(),
   /** ISO-8601 lower bound (inclusive) on `timestamp`. */
-  since: z107.string().optional(),
+  since: z108.string().optional(),
   /** Most-recent-N cap. */
-  limit: z107.number().int().positive().optional()
+  limit: z108.number().int().positive().optional()
 });
 
 // src/mcp/tools/supply-chain-tradeoff-panel.ts
-import { z as z108 } from "zod";
+import { z as z109 } from "zod";
 import { randomUUID as randomUUID18 } from "crypto";
 var DEFAULT_AXES = [
   "build_time_determinism",
@@ -47974,16 +48185,16 @@ var FULL_PANEL = [
   "scope_steward"
 ];
 var QUICK_PANEL = ["architect", "security", "scope_steward"];
-var SupplyChainTradeoffPanelInputSchema = z108.object({
-  proposal: z108.string().min(1).max(MAX_PROPOSAL_LENGTH).describe('The proposal under tradeoff review (e.g. "Should aegis-boot adopt cargo-nextest?")'),
-  axes: z108.array(z108.string().min(1).max(MAX_AXIS_NAME_LENGTH)).min(1).max(MAX_AXES).optional().describe(
+var SupplyChainTradeoffPanelInputSchema = z109.object({
+  proposal: z109.string().min(1).max(MAX_PROPOSAL_LENGTH).describe('The proposal under tradeoff review (e.g. "Should aegis-boot adopt cargo-nextest?")'),
+  axes: z109.array(z109.string().min(1).max(MAX_AXIS_NAME_LENGTH)).min(1).max(MAX_AXES).optional().describe(
     `Tradeoff axes to evaluate. Default: ${DEFAULT_AXES.join(", ")}. Custom axes accepted; max ${String(MAX_AXES)}.`
   ),
-  context: z108.string().max(MAX_CONTEXT_LENGTH).optional().describe(
+  context: z109.string().max(MAX_CONTEXT_LENGTH).optional().describe(
     "Optional context: relevant repo state, dependency tree, vendor publishing patterns, etc."
   ),
-  quickMode: z108.boolean().optional().default(false).describe("Use 3 voters (architect, security, scope_steward) instead of 7"),
-  simulate: z108.boolean().optional().default(false).describe("Use simulated voters (testing only)"),
+  quickMode: z109.boolean().optional().default(false).describe("Use 3 voters (architect, security, scope_steward) instead of 7"),
+  simulate: z109.boolean().optional().default(false).describe("Use simulated voters (testing only)"),
   /**
    * Dispatch mode (#3731). `sync` (default) runs the panel inline and returns
    * the result — but a live fan-out (up to 7 voters) can exceed the MCP request
@@ -47991,7 +48202,7 @@ var SupplyChainTradeoffPanelInputSchema = z108.object({
    * immediately and runs the panel in the background; poll
    * `get_job_result({ jobId })` for the result.
    */
-  dispatch: z108.enum(["sync", "async"]).default("sync").describe(
+  dispatch: z109.enum(["sync", "async"]).default("sync").describe(
     "Dispatch mode (#3731). 'sync' (default): run inline. 'async': return a jobId immediately + run the panel in background (poll get_job_result)."
   )
 });
@@ -48462,40 +48673,40 @@ var RiskLevel = /* @__PURE__ */ ((RiskLevel2) => {
 })(RiskLevel || {});
 
 // src/mcp/safety/stpa-schemas.ts
-import { z as z109 } from "zod";
-var HazardCategorySchema = z109.enum(HazardCategory);
-var HazardSeveritySchema = z109.enum(HazardSeverity);
-var ConstraintPrioritySchema = z109.enum(ConstraintPriority);
-var RiskLevelSchema = z109.enum(RiskLevel);
-var TriggerPatternSchema = z109.object({
-  parameter: z109.string().min(1),
-  matchType: z109.enum(["contains", "regex", "equals", "startsWith", "endsWith"]),
-  pattern: z109.string(),
-  reason: z109.string()
+import { z as z110 } from "zod";
+var HazardCategorySchema = z110.enum(HazardCategory);
+var HazardSeveritySchema = z110.enum(HazardSeverity);
+var ConstraintPrioritySchema = z110.enum(ConstraintPriority);
+var RiskLevelSchema = z110.enum(RiskLevel);
+var TriggerPatternSchema = z110.object({
+  parameter: z110.string().min(1),
+  matchType: z110.enum(["contains", "regex", "equals", "startsWith", "endsWith"]),
+  pattern: z110.string(),
+  reason: z110.string()
 });
-var HazardSchema = z109.object({
-  id: z109.string().min(1),
-  description: z109.string(),
+var HazardSchema = z110.object({
+  id: z110.string().min(1),
+  description: z110.string(),
   category: HazardCategorySchema,
   severity: HazardSeveritySchema,
-  likelihood: z109.enum(["almost_certain", "likely", "possible", "unlikely", "rare"]),
-  triggerConditions: z109.array(z109.string()),
-  consequences: z109.array(z109.string())
+  likelihood: z110.enum(["almost_certain", "likely", "possible", "unlikely", "rare"]),
+  triggerConditions: z110.array(z110.string()),
+  consequences: z110.array(z110.string())
 });
-var UnsafeControlActionSchema = z109.object({
-  id: z109.string().min(1),
-  toolName: z109.string().min(1),
-  type: z109.enum(["not_provided", "provided_causes_hazard", "wrong_timing", "wrong_duration"]),
-  description: z109.string(),
-  unsafeContext: z109.string(),
-  relatedHazards: z109.array(z109.string()),
-  triggerPatterns: z109.array(TriggerPatternSchema).optional()
+var UnsafeControlActionSchema = z110.object({
+  id: z110.string().min(1),
+  toolName: z110.string().min(1),
+  type: z110.enum(["not_provided", "provided_causes_hazard", "wrong_timing", "wrong_duration"]),
+  description: z110.string(),
+  unsafeContext: z110.string(),
+  relatedHazards: z110.array(z110.string()),
+  triggerPatterns: z110.array(TriggerPatternSchema).optional()
 });
-var SafetyConstraintSchema = z109.object({
-  id: z109.string().min(1),
-  description: z109.string(),
-  mitigates: z109.array(z109.string()),
-  enforcement: z109.enum([
+var SafetyConstraintSchema = z110.object({
+  id: z110.string().min(1),
+  description: z110.string(),
+  mitigates: z110.array(z110.string()),
+  enforcement: z110.enum([
     "prevent",
     "require_confirmation",
     "alert",
@@ -48503,54 +48714,54 @@ var SafetyConstraintSchema = z109.object({
     "rate_limit",
     "require_privilege"
   ]),
-  validationFunction: z109.string().optional(),
+  validationFunction: z110.string().optional(),
   priority: ConstraintPrioritySchema
 });
-var PropertySchemaSchema = z109.object({
-  type: z109.string(),
-  description: z109.string().optional(),
-  enum: z109.array(z109.unknown()).optional(),
-  pattern: z109.string().optional(),
-  minimum: z109.number().optional(),
-  maximum: z109.number().optional()
+var PropertySchemaSchema = z110.object({
+  type: z110.string(),
+  description: z110.string().optional(),
+  enum: z110.array(z110.unknown()).optional(),
+  pattern: z110.string().optional(),
+  minimum: z110.number().optional(),
+  maximum: z110.number().optional()
 });
-var ToolInputSchemaSchema = z109.object({
-  type: z109.string(),
-  properties: z109.record(z109.string(), PropertySchemaSchema).optional(),
-  required: z109.array(z109.string()).optional(),
-  additionalProperties: z109.boolean().optional()
+var ToolInputSchemaSchema = z110.object({
+  type: z110.string(),
+  properties: z110.record(z110.string(), PropertySchemaSchema).optional(),
+  required: z110.array(z110.string()).optional(),
+  additionalProperties: z110.boolean().optional()
 });
-var ToolDefinitionSchema = z109.object({
-  name: z109.string().min(1),
-  description: z109.string(),
+var ToolDefinitionSchema = z110.object({
+  name: z110.string().min(1),
+  description: z110.string(),
   inputSchema: ToolInputSchemaSchema
 });
-var AnalysisConfigurationSchema = z109.object({
-  includeLowSeverity: z109.boolean().default(true),
-  generateAllConstraints: z109.boolean().default(true),
-  checkInteractions: z109.boolean().default(true),
-  maxHazardsPerTool: z109.number().int().min(1).max(100).default(50),
-  categories: z109.array(HazardCategorySchema).default([])
+var AnalysisConfigurationSchema = z110.object({
+  includeLowSeverity: z110.boolean().default(true),
+  generateAllConstraints: z110.boolean().default(true),
+  checkInteractions: z110.boolean().default(true),
+  maxHazardsPerTool: z110.number().int().min(1).max(100).default(50),
+  categories: z110.array(HazardCategorySchema).default([])
 });
-var ConstraintViolationSchema = z109.object({
-  constraintId: z109.string().min(1),
-  constraintDescription: z109.string(),
+var ConstraintViolationSchema = z110.object({
+  constraintId: z110.string().min(1),
+  constraintDescription: z110.string(),
   severity: HazardSeveritySchema,
-  details: z109.string(),
-  remediation: z109.string()
+  details: z110.string(),
+  remediation: z110.string()
 });
-var ValidationWarningSchema = z109.object({
-  code: z109.string().min(1),
-  message: z109.string(),
-  affected: z109.string()
+var ValidationWarningSchema = z110.object({
+  code: z110.string().min(1),
+  message: z110.string(),
+  affected: z110.string()
 });
-var ValidationResultSchema = z109.object({
-  valid: z109.boolean(),
-  toolName: z109.string().min(1),
-  violations: z109.array(ConstraintViolationSchema),
-  passed: z109.array(z109.string()),
-  warnings: z109.array(ValidationWarningSchema),
-  validatedAt: z109.date()
+var ValidationResultSchema = z110.object({
+  valid: z110.boolean(),
+  toolName: z110.string().min(1),
+  violations: z110.array(ConstraintViolationSchema),
+  passed: z110.array(z110.string()),
+  warnings: z110.array(ValidationWarningSchema),
+  validatedAt: z110.date()
 });
 
 // src/mcp/safety/stpa-types.ts
@@ -49635,43 +49846,43 @@ var GeminiResponseParser = class {
 };
 
 // src/cli-adapters/router-types.ts
-import { z as z110 } from "zod";
-var RouterConfigSchema = z110.object({
-  minCapacityThreshold: z110.number().min(0).max(1).default(0.1),
-  preferCostEfficient: z110.boolean().default(false),
-  maxDecisionTimeMs: z110.number().min(1).max(1e3).default(100)
+import { z as z111 } from "zod";
+var RouterConfigSchema = z111.object({
+  minCapacityThreshold: z111.number().min(0).max(1).default(0.1),
+  preferCostEfficient: z111.boolean().default(false),
+  maxDecisionTimeMs: z111.number().min(1).max(1e3).default(100)
 });
 
 // src/cli-adapters/agreement-cascade-types.ts
-import { z as z111 } from "zod";
-var AgreementCascadeConfigSchema = z111.object({
-  agreementThreshold: z111.number().min(0.5).max(1).default(0.7),
-  maxStages: z111.number().int().min(1).max(5).default(3),
-  modelTimeoutMs: z111.number().int().min(1e3).max(3e5).default(6e4)
+import { z as z112 } from "zod";
+var AgreementCascadeConfigSchema = z112.object({
+  agreementThreshold: z112.number().min(0.5).max(1).default(0.7),
+  maxStages: z112.number().int().min(1).max(5).default(3),
+  modelTimeoutMs: z112.number().int().min(1e3).max(3e5).default(6e4)
 });
 
 // src/cli-adapters/agreement-cascade-router.ts
 var logger49 = createLogger({ component: "agreement-cascade-router" });
 
 // src/cli-adapters/task-classifier.ts
-import { z as z112 } from "zod";
-var ClassificationPatternsSchema = z112.object({
-  code: z112.array(z112.string()).readonly(),
-  research: z112.array(z112.string()).readonly(),
-  documentation: z112.array(z112.string()).readonly(),
-  analysis: z112.array(z112.string()).readonly()
+import { z as z113 } from "zod";
+var ClassificationPatternsSchema = z113.object({
+  code: z113.array(z113.string()).readonly(),
+  research: z113.array(z113.string()).readonly(),
+  documentation: z113.array(z113.string()).readonly(),
+  analysis: z113.array(z113.string()).readonly()
 });
 
 // src/cli-adapters/response-cache-types.ts
-import { z as z113 } from "zod";
-var ResponseCacheConfigSchema = z113.object({
-  defaultTTL: z113.number().min(1e3).max(36e5).default(3e5),
+import { z as z114 } from "zod";
+var ResponseCacheConfigSchema = z114.object({
+  defaultTTL: z114.number().min(1e3).max(36e5).default(3e5),
   // 5 minutes
-  maxEntries: z113.number().min(10).max(1e5).default(1e3),
-  maxMemoryMB: z113.number().min(1).max(1e3).default(50),
-  cleanupInterval: z113.number().min(1e3).max(6e5).default(6e4),
+  maxEntries: z114.number().min(10).max(1e5).default(1e3),
+  maxMemoryMB: z114.number().min(1).max(1e3).default(50),
+  cleanupInterval: z114.number().min(1e3).max(6e5).default(6e4),
   // 1 minute
-  enableLogging: z113.boolean().default(false)
+  enableLogging: z114.boolean().default(false)
 });
 
 // src/cli-adapters/response-cache-utils.ts
@@ -49679,12 +49890,12 @@ import { createHash as createHash6 } from "crypto";
 var logger50 = createLogger({ component: "ResponseCacheUtils" });
 
 // src/cli-adapters/unified-routing-types.ts
-import { z as z114 } from "zod";
-var UnifiedRoutingDecisionSchema = z114.object({
-  selectedCli: z114.string(),
-  confidence: z114.number().min(0).max(1),
-  reason: z114.string(),
-  strategy: z114.enum([
+import { z as z115 } from "zod";
+var UnifiedRoutingDecisionSchema = z115.object({
+  selectedCli: z115.string(),
+  confidence: z115.number().min(0).max(1),
+  reason: z115.string(),
+  strategy: z115.enum([
     "composite",
     "quality",
     "budget",
@@ -49696,57 +49907,57 @@ var UnifiedRoutingDecisionSchema = z114.object({
     "linucb",
     "direct"
   ]),
-  decisionTimeMs: z114.number().nonnegative(),
-  alternatives: z114.array(z114.string()).readonly(),
-  stagesExecuted: z114.array(z114.string()).readonly(),
-  withinBudget: z114.boolean().optional(),
-  estimatedComplexity: z114.enum(["simple", "moderate", "complex", "expert"]).optional(),
-  estimatedTokens: z114.number().int().positive().optional(),
-  topsisScore: z114.number().optional(),
-  ucbScore: z114.number().optional(),
-  resolvedAtStage: z114.number().int().nonnegative().optional(),
-  consensusReached: z114.boolean().optional(),
-  agreementScore: z114.number().min(0).max(1).optional(),
-  metadata: z114.record(z114.string(), z114.unknown()).optional()
+  decisionTimeMs: z115.number().nonnegative(),
+  alternatives: z115.array(z115.string()).readonly(),
+  stagesExecuted: z115.array(z115.string()).readonly(),
+  withinBudget: z115.boolean().optional(),
+  estimatedComplexity: z115.enum(["simple", "moderate", "complex", "expert"]).optional(),
+  estimatedTokens: z115.number().int().positive().optional(),
+  topsisScore: z115.number().optional(),
+  ucbScore: z115.number().optional(),
+  resolvedAtStage: z115.number().int().nonnegative().optional(),
+  consensusReached: z115.boolean().optional(),
+  agreementScore: z115.number().min(0).max(1).optional(),
+  metadata: z115.record(z115.string(), z115.unknown()).optional()
 });
 
 // src/learning/outcome-feedback-types.ts
-import { z as z115 } from "zod";
-var QualitySignalsSchema = z115.object({
-  testsPass: z115.boolean().optional(),
-  lintErrors: z115.number().int().min(0).optional(),
-  userApproved: z115.boolean().optional(),
-  retryCount: z115.number().int().min(0).default(0),
-  completionRatio: z115.number().min(0).max(1).default(1),
-  validStructure: z115.boolean().optional(),
-  coherenceScore: z115.number().min(0).max(1).optional()
+import { z as z116 } from "zod";
+var QualitySignalsSchema = z116.object({
+  testsPass: z116.boolean().optional(),
+  lintErrors: z116.number().int().min(0).optional(),
+  userApproved: z116.boolean().optional(),
+  retryCount: z116.number().int().min(0).default(0),
+  completionRatio: z116.number().min(0).max(1).default(1),
+  validStructure: z116.boolean().optional(),
+  coherenceScore: z116.number().min(0).max(1).optional()
 });
-var RoutingDecisionSchema = z115.object({
-  id: z115.uuid(),
-  timestamp: z115.iso.datetime(),
-  query: z115.string(),
-  routerType: z115.enum(["linucb", "preference", "quality", "cascade", "topsis"]),
-  selectedModel: z115.string(),
-  selectedTier: z115.enum(["strong", "weak"]).optional(),
-  armIndex: z115.number().int().min(0).optional(),
-  banditContext: z115.record(z115.string(), z115.unknown()).optional(),
-  queryFeatures: z115.record(z115.string(), z115.unknown()).optional(),
-  ucbScore: z115.number().optional(),
-  confidence: z115.number().min(0).max(1).optional(),
-  traceId: z115.string(),
-  domain: z115.string().optional()
+var RoutingDecisionSchema = z116.object({
+  id: z116.uuid(),
+  timestamp: z116.iso.datetime(),
+  query: z116.string(),
+  routerType: z116.enum(["linucb", "preference", "quality", "cascade", "topsis"]),
+  selectedModel: z116.string(),
+  selectedTier: z116.enum(["strong", "weak"]).optional(),
+  armIndex: z116.number().int().min(0).optional(),
+  banditContext: z116.record(z116.string(), z116.unknown()).optional(),
+  queryFeatures: z116.record(z116.string(), z116.unknown()).optional(),
+  ucbScore: z116.number().optional(),
+  confidence: z116.number().min(0).max(1).optional(),
+  traceId: z116.string(),
+  domain: z116.string().optional()
 });
-var TaskOutcomeSchema = z115.object({
-  routingDecisionId: z115.uuid(),
-  timestamp: z115.iso.datetime(),
-  outcomeClass: z115.enum(["success", "partial", "failure", "timeout", "error"]),
-  success: z115.boolean(),
-  qualityScore: z115.number().min(0).max(1),
-  durationMs: z115.number().min(0),
-  tokenUsage: z115.number().int().min(0),
-  errorMessage: z115.string().optional(),
+var TaskOutcomeSchema = z116.object({
+  routingDecisionId: z116.uuid(),
+  timestamp: z116.iso.datetime(),
+  outcomeClass: z116.enum(["success", "partial", "failure", "timeout", "error"]),
+  success: z116.boolean(),
+  qualityScore: z116.number().min(0).max(1),
+  durationMs: z116.number().min(0),
+  tokenUsage: z116.number().int().min(0),
+  errorMessage: z116.string().optional(),
   qualitySignals: QualitySignalsSchema,
-  traceId: z115.string()
+  traceId: z116.string()
 });
 var DEFAULT_FEEDBACK_COLLECTOR_CONFIG = {
   maxPendingDecisions: 1e3,
@@ -49761,17 +49972,17 @@ var DEFAULT_FEEDBACK_COLLECTOR_CONFIG = {
   targetTokenUsage: 2e3,
   maxHistorySize: 1e4
 };
-var FeedbackCollectorConfigSchema = z115.object({
-  maxPendingDecisions: z115.number().int().positive().default(1e3),
-  pendingTimeoutMs: z115.number().positive().default(3e5),
-  enableAutoReward: z115.boolean().default(true),
-  qualityWeight: z115.number().min(0).max(1).default(0.5),
-  speedWeight: z115.number().min(0).max(1).default(0.2),
-  efficiencyWeight: z115.number().min(0).max(1).default(0.2),
-  retryPenalty: z115.number().min(0).max(1).default(0.1),
-  targetDurationMs: z115.number().positive().default(5e3),
-  targetTokenUsage: z115.number().positive().default(2e3),
-  maxHistorySize: z115.number().int().positive().default(1e4)
+var FeedbackCollectorConfigSchema = z116.object({
+  maxPendingDecisions: z116.number().int().positive().default(1e3),
+  pendingTimeoutMs: z116.number().positive().default(3e5),
+  enableAutoReward: z116.boolean().default(true),
+  qualityWeight: z116.number().min(0).max(1).default(0.5),
+  speedWeight: z116.number().min(0).max(1).default(0.2),
+  efficiencyWeight: z116.number().min(0).max(1).default(0.2),
+  retryPenalty: z116.number().min(0).max(1).default(0.1),
+  targetDurationMs: z116.number().positive().default(5e3),
+  targetTokenUsage: z116.number().positive().default(2e3),
+  maxHistorySize: z116.number().int().positive().default(1e4)
 });
 
 // src/learning/outcome-feedback-helpers.ts
@@ -50836,7 +51047,7 @@ function getPolicy(id) {
 // src/security/sandbox/sandbox-executor.ts
 import { execFile } from "child_process";
 import { promisify } from "util";
-import { resolve as resolve18, normalize as normalize2, sep as sep11 } from "path";
+import { resolve as resolve19, normalize as normalize2, sep as sep12 } from "path";
 var execFileAsync = promisify(execFile);
 var logger52 = createLogger({ component: "sandbox-executor" });
 function parseExecError(error) {
@@ -50916,10 +51127,10 @@ var PolicySandboxExecutor = class {
    */
   validateCwd(cwd, policy) {
     if (cwd === void 0) return null;
-    const normalizedCwd = normalize2(resolve18(cwd));
+    const normalizedCwd = normalize2(resolve19(cwd));
     const isAllowed = policy.pathRules.some((rule) => {
-      const normalizedRule = normalize2(resolve18(rule.path));
-      const isUnderRule = normalizedCwd === normalizedRule || normalizedCwd.startsWith(normalizedRule + sep11);
+      const normalizedRule = normalize2(resolve19(rule.path));
+      const isUnderRule = normalizedCwd === normalizedRule || normalizedCwd.startsWith(normalizedRule + sep12);
       return isUnderRule && rule.access !== "none";
     });
     if (!isAllowed) {
@@ -51823,6 +52034,8 @@ export {
   registerSearchCodebaseTool,
   ExtractSymbolsInputSchema,
   registerExtractSymbolsTool,
+  SearchUsagesInputSchema,
+  registerSearchUsagesTool,
   QueryTraceInputSchema,
   registerQueryTraceTool,
   registerQueryTaskStateTool,
@@ -51920,4 +52133,4 @@ export {
   shutdownFeedbackSubscriber,
   createEventBusBridge
 };
-//# sourceMappingURL=chunk-2S7T66IQ.js.map
+//# sourceMappingURL=chunk-N7FIUFQL.js.map