nexus-agents 2.169.0 → 2.171.0

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   createGitHubProvider,
   createScmProvider
-} from "./chunk-CHF63T3L.js";
+} from "./chunk-25CWEJ2M.js";
 import {
   ALLOWED_COMMANDS,
   ARTIFACT_TYPES,
@@ -522,7 +522,7 @@ import {
   validateWorkflow,
   validateWorkflowDependencies,
   withLogging
-} from "./chunk-N7FIUFQL.js";
+} from "./chunk-YIQ5Z7LV.js";
 import {
   FALLBACK_SCANNER_DATA,
   buildPlanFromAnalysis,
@@ -530,7 +530,7 @@ import {
   generateSecurityPlan,
   getRegistryManifest,
   resolveScannerData
-} from "./chunk-HNNSCTOI.js";
+} from "./chunk-B4XT3B2E.js";
 import {
   analyzeGitHubRepo,
   analyzeRepo,
@@ -556,20 +556,20 @@ import {
   getKnownNexusVarNames,
   startStdioServer,
   validateNexusEnv
-} from "./chunk-ROCNXZBC.js";
+} from "./chunk-E53VLN73.js";
 import {
   OPENAI_MODELS,
   OPENAI_MODEL_ALIASES,
   OpenAIAdapter,
   createOpenAIAdapter
-} from "./chunk-3ON2P4WL.js";
+} from "./chunk-DLVDFJXU.js";
 import {
   CliCircuitBreakerIntegration,
   createCliCircuitBreakerIntegration
-} from "./chunk-PZF67XDY.js";
+} from "./chunk-IK7POCXO.js";
 import {
   executeExpert
-} from "./chunk-4G5W5EPU.js";
+} from "./chunk-GJRLIANS.js";
 import {
   AgentFindingSchema,
   ConsensusEngine,
@@ -618,9 +618,9 @@ import {
   generateProposalId,
   parseAgentPairKey,
   registerConsensusVoteTool
-} from "./chunk-F6HJJG3E.js";
-import "./chunk-TB26XNJH.js";
-import "./chunk-7S43YASS.js";
+} from "./chunk-SZ3CRNPI.js";
+import "./chunk-7AJWIOMT.js";
+import "./chunk-DYFF72HX.js";
 import {
   AgentActionSchema,
   GitHubReviewer,
@@ -642,11 +642,11 @@ import {
   requiresCorroboration,
   validateAgentAction,
   validateCorroboration
-} from "./chunk-R46SBPLH.js";
+} from "./chunk-RQGORCFM.js";
 import {
   GitHubProvider,
   ScmError
-} from "./chunk-RO23OT47.js";
+} from "./chunk-RAK6PTNM.js";
 import {
   GitHubUserRoleSchema,
   InjectionFlagSchema,
@@ -661,11 +661,11 @@ import {
   assessReputation,
   reconcileTrustTier,
   sanitizeInput
-} from "./chunk-SX4E2W3Z.js";
+} from "./chunk-CEDSYAAI.js";
 import {
   ImprovementReviewInputSchema,
   registerImprovementReviewTool
-} from "./chunk-EQRN5FRZ.js";
+} from "./chunk-SCHMBRK4.js";
 import {
   AgentPerformanceSchema,
   ConsensusAlgorithmSchema,
@@ -701,7 +701,7 @@ import {
   toolSuccess,
   toolSuccessStructured,
   validateToolInput
-} from "./chunk-IQC2K3KY.js";
+} from "./chunk-KP4ZXW3B.js";
 import {
   AuditTrail,
   MAX_STRIPPED_ELEMENTS_PER_EVENT,
@@ -713,7 +713,7 @@ import {
   emitReputationEvent,
   emitSanitizationEvent,
   emitTrustEvent
-} from "./chunk-BWG54OJS.js";
+} from "./chunk-BTH745HU.js";
 import {
   PersistentStrategyDistiller,
   RulesSnapshotSchema,
@@ -721,19 +721,19 @@ import {
   TokenCounter,
   TokenCounterProvider,
   createTokenCounter
-} from "./chunk-XGNB7LQB.js";
+} from "./chunk-QBOTSJ7S.js";
 import {
   getTokenEnvVars,
   hasToken,
   resolveToken
-} from "./chunk-3JH3FMEJ.js";
-import "./chunk-HAVBBSYN.js";
+} from "./chunk-Y7JDXVJA.js";
+import "./chunk-ZSWXEDI6.js";
 import "./chunk-NUBSJGQZ.js";
 import {
   MemoryError
-} from "./chunk-Q3UMNYV2.js";
+} from "./chunk-LFKCJQ7G.js";
 import "./chunk-6T3EPABN.js";
-import "./chunk-W76DOL27.js";
+import "./chunk-O4J34GZT.js";
 import {
   BUILT_IN_EXPERTS,
   BuiltInExpertTypeSchema,
@@ -752,7 +752,7 @@ import {
   resetGlobalRegistry,
   withModelNotFoundFallback,
   wrapResilientWithFallback
-} from "./chunk-P7MYTCE6.js";
+} from "./chunk-Z5GJ4FXW.js";
 import {
   BaseCliAdapter,
   CLAUDE_MODELS,
@@ -787,7 +787,7 @@ import {
   isCliAvailable,
   isRetryableError,
   sleep
-} from "./chunk-NT3KCLT6.js";
+} from "./chunk-5UDKUPZB.js";
 import {
   AdapterModelError,
   BaseAdapter,
@@ -811,12 +811,12 @@ import {
   transformStream,
   validateApiKeyPresence,
   withTimeout
-} from "./chunk-MCT7JJF6.js";
+} from "./chunk-4KVAHGMB.js";
 import {
   DEFAULTS,
   PROVIDER_ENV_KEYS
-} from "./chunk-JCJHQSAY.js";
-import "./chunk-DSMSYENI.js";
+} from "./chunk-QFS5VOB6.js";
+import "./chunk-76Q63KJM.js";
 import {
   AvailabilityCache,
   filterAvailableModels,
@@ -825,9 +825,9 @@ import {
   getFallbackChain,
   resetAvailabilityCache,
   resolveFallback
-} from "./chunk-T3VD32JY.js";
+} from "./chunk-SUWN54CK.js";
 import "./chunk-QZUG667L.js";
-import "./chunk-OOFPDA3B.js";
+import "./chunk-IC3NZHPT.js";
 import {
   AgentCapability,
   AgentError,
@@ -905,7 +905,7 @@ import {
   toError,
   unwrap,
   unwrapOr
-} from "./chunk-QXSR5KPG.js";
+} from "./chunk-QBCWORAK.js";
 import "./chunk-AXTD4TFK.js";
 import "./chunk-DHVMSIT5.js";
 import "./chunk-ZPWHCABL.js";
@@ -1272,7 +1272,7 @@ var RateLimiter2 = class {
    * Sleeps for the specified duration.
    */
   sleep(ms) {
-    return new Promise((resolve2) => setTimeout(resolve2, ms));
+    return new Promise((resolve3) => setTimeout(resolve3, ms));
   }
   /**
    * Returns the current number of available tokens.
@@ -1532,7 +1532,7 @@ var AbortError = class extends Error {
 function raceAbort(promise, signal) {
   if (signal === void 0) return promise;
   if (signal.aborted) return Promise.reject(new AbortError());
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     const onAbort = () => {
       reject(new AbortError());
     };
@@ -1540,7 +1540,7 @@ function raceAbort(promise, signal) {
     promise.then(
       (value) => {
         signal.removeEventListener("abort", onAbort);
-        resolve2(value);
+        resolve3(value);
       },
       (error) => {
         signal.removeEventListener("abort", onAbort);
@@ -4154,47 +4154,271 @@ function createGitHubAdapter() {
   };
 }
 
-// src/orchestration/spec-parser-types.ts
+// src/security/ast-rule-runner.ts
+import { existsSync as existsSync2 } from "fs";
+import { readdir, readFile, stat } from "fs/promises";
+import { dirname, extname, join as join2, relative, resolve as resolve2, sep } from "path";
+import { fileURLToPath } from "url";
+import { parse, registerDynamicLanguage } from "@ast-grep/napi";
+import goLangRegistration from "@ast-grep/lang-go";
+import pythonLangRegistration from "@ast-grep/lang-python";
+import { parse as parseYaml } from "yaml";
 import { z as z8 } from "zod";
-var IssueReferenceSchema = z8.object({
+var polyglotLangsRegistered = false;
+function ensurePolyglotLangs() {
+  if (polyglotLangsRegistered) return;
+  registerDynamicLanguage({ python: pythonLangRegistration, go: goLangRegistration });
+  polyglotLangsRegistered = true;
+}
+var AST_RULE_LANGUAGES = ["python", "go"];
+var AST_RULE_SEVERITIES = ["error", "warning", "info"];
+var RuleFileSchema = z8.object({
+  id: z8.string().min(1),
+  language: z8.enum(AST_RULE_LANGUAGES),
+  severity: z8.enum(AST_RULE_SEVERITIES),
+  message: z8.string().min(1),
+  rule: z8.record(z8.string(), z8.unknown())
+});
+var MAX_SNIPPET_CHARS = 200;
+var DEFAULT_AST_QA_LIMIT = 200;
+var MAX_AST_QA_LIMIT = 2e3;
+var AST_QA_MAX_DEPTH = 24;
+var MAX_FILES_SCANNED = 5e3;
+var logger5 = createLogger({ component: "ast-rule-runner" });
+async function loadRules(dir) {
+  let entries;
+  try {
+    entries = (await readdir(dir)).filter((f) => f.endsWith(".yml") || f.endsWith(".yaml")).sort();
+  } catch (caught) {
+    const e = caught instanceof Error ? caught : new Error(String(caught));
+    throw new ValidationError(`ast-rule-runner: cannot read rules dir ${dir}: ${e.message}`, {
+      cause: e
+    });
+  }
+  const rules = [];
+  for (const file of entries) {
+    const path2 = join2(dir, file);
+    const raw = await readFile(path2, "utf8");
+    let parsed;
+    try {
+      parsed = parseYaml(raw);
+    } catch (caught) {
+      const e = caught instanceof Error ? caught : new Error(String(caught));
+      throw new ValidationError(`ast-rule-runner: malformed YAML in ${path2}: ${e.message}`, {
+        cause: e
+      });
+    }
+    const result = RuleFileSchema.safeParse(parsed);
+    if (!result.success) {
+      throw new ValidationError(
+        `ast-rule-runner: invalid rule file ${path2}: ${formatZodError(result.error)}`
+      );
+    }
+    rules.push(result.data);
+  }
+  return rules;
+}
+function getBuiltInAstRulesPath() {
+  const currentFile = fileURLToPath(import.meta.url);
+  const currentDir = dirname(currentFile);
+  if (currentFile.includes(`${sep}dist${sep}`) || currentFile.endsWith(`${sep}dist`)) {
+    const distIndex = currentFile.lastIndexOf(`${sep}dist${sep}`);
+    if (distIndex !== -1) {
+      const distDir = currentFile.substring(0, distIndex + 5);
+      const bundledPath = join2(distDir, "security", "ast-rules");
+      if (existsSync2(bundledPath)) return bundledPath;
+    }
+  }
+  const possiblePaths = [
+    join2(currentDir, "ast-rules"),
+    // Unbundled: sibling of this file in src/security/
+    join2(currentDir, "security", "ast-rules"),
+    // Bundled chunk: dist/security sibling
+    join2(dirname(currentDir), "security", "ast-rules")
+  ];
+  for (const path2 of possiblePaths) {
+    if (existsSync2(path2)) return path2;
+  }
+  return join2(currentDir, "ast-rules");
+}
+function resolveWithinCwd(target) {
+  const resolved = resolve2(target);
+  const cwdRoot = resolve2(".");
+  if (resolved !== cwdRoot && !resolved.startsWith(cwdRoot + sep)) {
+    return { error: `Path traversal denied: scope must be within ${cwdRoot}` };
+  }
+  return { resolved };
+}
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", "dist", ".git"]);
+var POLYGLOT_EXT_TO_LANG = {
+  ".py": "python",
+  ".go": "go"
+};
+function inferRuleLang(file) {
+  return POLYGLOT_EXT_TO_LANG[extname(file).toLowerCase()] ?? null;
+}
+async function findPolyglotFiles(dir, maxDepth) {
+  if (maxDepth <= 0) return [];
+  const out = [];
+  let entries;
+  try {
+    entries = await readdir(dir, { withFileTypes: true });
+  } catch (caught) {
+    const e = caught instanceof Error ? caught : new Error(String(caught));
+    logger5.warn(`ast-rule-runner: skipped unreadable directory ${dir}: ${e.message}`);
+    return out;
+  }
+  for (const entry of entries) {
+    const fullPath = join2(dir, entry.name);
+    if (entry.isDirectory() && !SKIP_DIRS.has(entry.name)) {
+      out.push(...await findPolyglotFiles(fullPath, maxDepth - 1));
+    } else if (entry.isFile() && inferRuleLang(entry.name) !== null) {
+      out.push(fullPath);
+    }
+  }
+  return out;
+}
+function langToParseArg(lang) {
+  ensurePolyglotLangs();
+  return lang;
+}
+function scanFile(src, lang, applicable, budget) {
+  const { rel, limit, alreadyFound } = budget;
+  const root = parse(langToParseArg(lang), src).root();
+  const lines = src.split("\n");
+  const findings = [];
+  let total = 0;
+  for (const rule of applicable) {
+    const config = { rule: rule.rule };
+    for (const node of root.findAll(config)) {
+      total += 1;
+      if (alreadyFound + findings.length < limit) {
+        const { start } = node.range();
+        const rawLine = lines[start.line] ?? node.text();
+        findings.push({
+          ruleId: rule.id,
+          severity: rule.severity,
+          message: rule.message,
+          file: rel,
+          line: start.line + 1,
+          column: start.column + 1,
+          snippet: rawLine.trim().slice(0, MAX_SNIPPET_CHARS)
+        });
+      }
+    }
+  }
+  return { findings, total };
+}
+async function assertScanRootIsDirectory(resolved) {
+  let rootStat;
+  try {
+    rootStat = await stat(resolved);
+  } catch (caught) {
+    const e = caught instanceof Error ? caught : new Error(String(caught));
+    throw new ValidationError(`ast-rule-runner: cannot read targetDir ${resolved}: ${e.message}`, {
+      cause: e
+    });
+  }
+  if (!rootStat.isDirectory()) {
+    throw new ValidationError(
+      `ast-rule-runner: targetDir must be a directory, got a non-directory path: ${resolved}`
+    );
+  }
+}
+async function resolveScanFiles(root) {
+  const discovered = await findPolyglotFiles(root, AST_QA_MAX_DEPTH);
+  const files = discovered.slice(0, MAX_FILES_SCANNED);
+  const filesSkipped = discovered.length - files.length;
+  const filesTruncated = filesSkipped > 0;
+  if (filesTruncated) {
+    logger5.warn(
+      `ast-rule-runner: ${String(filesSkipped)} file(s) NOT scanned \u2014 file cap ${String(MAX_FILES_SCANNED)} exceeded (discovered=${String(discovered.length)}). Scan is PARTIAL; do not treat findings as exhaustive.`
+    );
+  }
+  return { files, filesSkipped, filesTruncated };
+}
+async function collectAstQaFindings(opts) {
+  const guard = resolveWithinCwd(opts.targetDir);
+  if ("error" in guard) {
+    throw new SecurityError(guard.error);
+  }
+  await assertScanRootIsDirectory(guard.resolved);
+  const rulesDir = opts.rulesDir ?? getBuiltInAstRulesPath();
+  const rules = await loadRules(rulesDir);
+  const limit = Math.min(Math.max(opts.limit ?? DEFAULT_AST_QA_LIMIT, 1), MAX_AST_QA_LIMIT);
+  const { files, filesSkipped, filesTruncated } = await resolveScanFiles(guard.resolved);
+  const findings = [];
+  let total = 0;
+  for (const file of files) {
+    const lang = inferRuleLang(file);
+    if (lang === null) continue;
+    const applicable = rules.filter((r) => r.language === lang);
+    if (applicable.length === 0) continue;
+    let src;
+    try {
+      src = await readFile(file, "utf8");
+    } catch {
+      logger5.warn(`ast-rule-runner: skipped unreadable file ${file}`);
+      continue;
+    }
+    const rel = relative(guard.resolved, file) || file;
+    const scanned = scanFile(src, lang, applicable, { rel, limit, alreadyFound: findings.length });
+    findings.push(...scanned.findings);
+    total += scanned.total;
+  }
+  if (total > findings.length) {
+    logger5.warn(
+      `ast-rule-runner: ${String(total - findings.length)} finding(s) omitted beyond limit=${String(limit)} (total=${String(total)})`
+    );
+  }
+  return { findings, total, limit, filesScanned: files.length, filesSkipped, filesTruncated };
+}
+async function runAstQaRules(opts) {
+  const { findings } = await collectAstQaFindings(opts);
+  return findings;
+}
+
+// src/orchestration/spec-parser-types.ts
+import { z as z9 } from "zod";
+var IssueReferenceSchema = z9.object({
   /** Issue/PR number */
-  number: z8.number().int().positive(),
+  number: z9.number().int().positive(),
   /** Raw text (e.g., "#123") */
-  raw: z8.string()
+  raw: z9.string()
 });
-var FileReferenceSchema = z8.object({
+var FileReferenceSchema = z9.object({
   /** File path (e.g., "src/foo.ts") */
-  path: z8.string(),
+  path: z9.string(),
   /** Optional line number */
-  line: z8.number().int().positive().optional()
+  line: z9.number().int().positive().optional()
 });
-var TechStackSchema = z8.object({
+var TechStackSchema = z9.object({
   /** Programming language */
-  language: z8.string().optional(),
+  language: z9.string().optional(),
   /** Framework or library */
-  framework: z8.string().optional(),
+  framework: z9.string().optional(),
   /** Package manager */
-  packageManager: z8.string().optional()
+  packageManager: z9.string().optional()
 });
-var ParsedSpecSchema = z8.object({
+var ParsedSpecSchema = z9.object({
   /** Spec title (from first H1 or H2 heading) */
-  title: z8.string().min(1),
+  title: z9.string().min(1),
   /** Overview/description text */
-  overview: z8.string(),
+  overview: z9.string(),
   /** List of requirements */
-  requirements: z8.array(z8.string()),
+  requirements: z9.array(z9.string()),
   /** Acceptance criteria (checklist items) */
-  acceptanceCriteria: z8.array(z8.string()),
+  acceptanceCriteria: z9.array(z9.string()),
   /** Constraints or limitations */
-  constraints: z8.array(z8.string()),
+  constraints: z9.array(z9.string()),
   /** Issue/PR references found in the spec */
-  issueReferences: z8.array(IssueReferenceSchema),
+  issueReferences: z9.array(IssueReferenceSchema),
   /** File path references found in the spec */
-  fileReferences: z8.array(FileReferenceSchema),
+  fileReferences: z9.array(FileReferenceSchema),
   /** Sections that were missing from the spec */
-  missingSections: z8.array(z8.string()),
+  missingSections: z9.array(z9.string()),
   /** Raw markdown source */
-  rawMarkdown: z8.string(),
+  rawMarkdown: z9.string(),
   /** Inferred technology stack */
   techStack: TechStackSchema.optional()
 });
@@ -4210,138 +4434,138 @@ var KNOWN_SECTIONS = [
 ];
 
 // src/orchestration/spec-decomposer-types.ts
-import { z as z9 } from "zod";
-var SubtaskTypeSchema = z9.enum(["code", "test", "docs", "config", "refactor"]);
-var ComplexityLevelSchema = z9.enum(["simple", "moderate", "complex", "expert"]);
-var SubtaskNodeSchema = z9.object({
+import { z as z10 } from "zod";
+var SubtaskTypeSchema = z10.enum(["code", "test", "docs", "config", "refactor"]);
+var ComplexityLevelSchema = z10.enum(["simple", "moderate", "complex", "expert"]);
+var SubtaskNodeSchema = z10.object({
   /** Unique identifier for this subtask */
-  id: z9.string().min(1),
+  id: z10.string().min(1),
   /** Human-readable description of what this subtask does */
-  description: z9.string().min(1),
+  description: z10.string().min(1),
   /** The type of work */
   type: SubtaskTypeSchema,
   /** Estimated complexity */
   complexity: ComplexityLevelSchema,
   /** Required capabilities for the executing agent */
-  capabilities: z9.array(z9.string()),
+  capabilities: z10.array(z10.string()),
   /** IDs of subtasks this depends on */
-  dependsOn: z9.array(z9.string()),
+  dependsOn: z10.array(z10.string()),
   /** Source requirement text that generated this subtask */
-  sourceRequirement: z9.string().optional()
+  sourceRequirement: z10.string().optional()
 });
-var DagEdgeSchema = z9.object({
+var DagEdgeSchema = z10.object({
   /** Source subtask ID */
-  from: z9.string().min(1),
+  from: z10.string().min(1),
   /** Target subtask ID */
-  to: z9.string().min(1)
+  to: z10.string().min(1)
 });
-var TaskDagSchema = z9.object({
+var TaskDagSchema = z10.object({
   /** All subtask nodes */
-  nodes: z9.array(SubtaskNodeSchema),
+  nodes: z10.array(SubtaskNodeSchema),
   /** Dependency edges (from must complete before to) */
-  edges: z9.array(DagEdgeSchema),
+  edges: z10.array(DagEdgeSchema),
   /** Subtask IDs that can execute in parallel (no dependencies) */
-  roots: z9.array(z9.string()),
+  roots: z10.array(z10.string()),
   /** Total estimated complexity across all subtasks */
   totalComplexity: ComplexityLevelSchema,
   /** Source spec title for traceability */
-  specTitle: z9.string()
+  specTitle: z10.string()
 });
 
 // src/orchestration/scenario-validator-types.ts
-import { z as z10 } from "zod";
-var CriterionResultSchema = z10.object({
+import { z as z11 } from "zod";
+var CriterionResultSchema = z11.object({
   /** The original acceptance criterion text */
-  criterion: z10.string(),
+  criterion: z11.string(),
   /** Whether this criterion was satisfied */
-  met: z10.boolean(),
+  met: z11.boolean(),
   /** Which result(s) matched this criterion */
-  matchedResults: z10.array(z10.string())
+  matchedResults: z11.array(z11.string())
 });
-var ScenarioResultSchema = z10.object({
+var ScenarioResultSchema = z11.object({
   /** Satisfaction score from 0 (none met) to 1 (all met) */
-  satisfaction: z10.number().min(0).max(1),
+  satisfaction: z11.number().min(0).max(1),
   /** Total acceptance criteria count */
-  totalCriteria: z10.number().int().nonnegative(),
+  totalCriteria: z11.number().int().nonnegative(),
   /** Number of criteria met */
-  metCount: z10.number().int().nonnegative(),
+  metCount: z11.number().int().nonnegative(),
   /** Per-criterion results */
-  criteria: z10.array(CriterionResultSchema),
+  criteria: z11.array(CriterionResultSchema),
   /** Whether all criteria are met */
-  allMet: z10.boolean()
+  allMet: z11.boolean()
 });
 
 // src/orchestration/parallel-exploration-types.ts
-import { z as z11 } from "zod";
-var ParallelExplorationConfigSchema = z11.object({
+import { z as z12 } from "zod";
+var ParallelExplorationConfigSchema = z12.object({
   /** Max CLIs to dispatch to in parallel (default: 3) */
-  maxParallelClis: z11.number().int().min(1).max(4).default(3),
+  maxParallelClis: z12.number().int().min(1).max(4).default(3),
   /** Timeout per CLI invocation in ms (default: explorationMs from centralized timeouts). */
-  perCliTimeoutMs: z11.number().int().min(1e3).max(3e5).default(PER_CLI_TASK_TIMEOUTS.explorationMs),
+  perCliTimeoutMs: z12.number().int().min(1e3).max(3e5).default(PER_CLI_TASK_TIMEOUTS.explorationMs),
   /** Maximum output chars per CLI response (default: 8000, raised from 4k for exploration depth). */
-  maxOutputCharsPerCli: z11.number().int().min(100).max(2e4).default(8e3)
+  maxOutputCharsPerCli: z12.number().int().min(100).max(2e4).default(8e3)
 });
 
 // src/orchestration/triangulated-review-types.ts
-import { z as z12 } from "zod";
-var TriangulatedReviewConfigSchema = z12.object({
+import { z as z13 } from "zod";
+var TriangulatedReviewConfigSchema = z13.object({
   /** Max CLIs to dispatch to (default: 3). */
-  maxClis: z12.number().int().min(1).max(4).default(3),
+  maxClis: z13.number().int().min(1).max(4).default(3),
   /** Per-CLI timeout in ms (default from config/timeouts.ts, Issue #984). */
-  perCliTimeoutMs: z12.number().int().min(PER_CLI_TASK_TIMEOUTS.minMs).max(PER_CLI_TASK_TIMEOUTS.maxMs).default(PER_CLI_TASK_TIMEOUTS.defaultMs),
+  perCliTimeoutMs: z13.number().int().min(PER_CLI_TASK_TIMEOUTS.minMs).max(PER_CLI_TASK_TIMEOUTS.maxMs).default(PER_CLI_TASK_TIMEOUTS.defaultMs),
   /** Max chars per CLI response (default: 8000). */
-  maxOutputCharsPerCli: z12.number().int().min(100).max(3e4).default(8e3),
+  maxOutputCharsPerCli: z13.number().int().min(100).max(3e4).default(8e3),
   /** Line proximity for dedup: findings within N lines are considered same (default: 5). */
-  lineProximity: z12.number().int().min(0).max(50).default(5)
+  lineProximity: z13.number().int().min(0).max(50).default(5)
 });
 
 // src/orchestration/triangulated-review.ts
 var moduleLogger = createLogger({ component: "triangulated-review" });
 
 // src/orchestration/consensus-plan-types.ts
-import { z as z13 } from "zod";
-var PlanStepSchema = z13.object({
+import { z as z14 } from "zod";
+var PlanStepSchema = z14.object({
   /** Step description. */
-  description: z13.string(),
+  description: z14.string(),
   /** Estimated complexity: low, medium, high. */
-  complexity: z13.enum(["low", "medium", "high"]).default("medium"),
+  complexity: z14.enum(["low", "medium", "high"]).default("medium"),
   /** Dependencies on other step indices. */
-  dependencies: z13.array(z13.number().int().min(0)).default([])
+  dependencies: z14.array(z14.number().int().min(0)).default([])
 });
-var PlanRiskSchema = z13.object({
+var PlanRiskSchema = z14.object({
   /** Risk description. */
-  description: z13.string(),
+  description: z14.string(),
   /** Impact level. */
-  impact: z13.enum(["low", "medium", "high"]).default("medium"),
+  impact: z14.enum(["low", "medium", "high"]).default("medium"),
   /** Mitigation strategy. */
-  mitigation: z13.string().default("")
+  mitigation: z14.string().default("")
 });
-var ConsensusPlanConfigSchema = z13.object({
+var ConsensusPlanConfigSchema = z14.object({
   /** Max CLIs to dispatch to (default: 3). */
-  maxClis: z13.number().int().min(1).max(4).default(3),
+  maxClis: z14.number().int().min(1).max(4).default(3),
   /** Per-CLI timeout in ms (default from config/timeouts.ts, Issue #984). */
-  perCliTimeoutMs: z13.number().int().min(PER_CLI_TASK_TIMEOUTS.minMs).max(PER_CLI_TASK_TIMEOUTS.maxMs).default(PER_CLI_TASK_TIMEOUTS.defaultMs),
+  perCliTimeoutMs: z14.number().int().min(PER_CLI_TASK_TIMEOUTS.minMs).max(PER_CLI_TASK_TIMEOUTS.maxMs).default(PER_CLI_TASK_TIMEOUTS.defaultMs),
   /** Max chars per CLI response (default: 8000). */
-  maxOutputCharsPerCli: z13.number().int().min(100).max(3e4).default(8e3)
+  maxOutputCharsPerCli: z14.number().int().min(100).max(3e4).default(8e3)
 });
 
 // src/orchestration/consensus-plan.ts
 var moduleLogger2 = createLogger({ component: "consensus-plan" });
 
 // src/agents/observability/orchestration-observer-types.ts
-import { z as z14 } from "zod";
-var AgentStateSchema = z14.enum(["idle", "thinking", "executing", "waiting", "error"]);
-var OrchestrationObserverConfigSchema = z14.object({
+import { z as z15 } from "zod";
+var AgentStateSchema = z15.enum(["idle", "thinking", "executing", "waiting", "error"]);
+var OrchestrationObserverConfigSchema = z15.object({
   /** Maximum routing decisions to retain in history */
-  maxRoutingHistory: z14.number().positive().optional().default(100),
+  maxRoutingHistory: z15.number().positive().optional().default(100),
   /** Maximum session metrics to retain */
-  maxSessionHistory: z14.number().positive().optional().default(50),
+  maxSessionHistory: z15.number().positive().optional().default(50),
   /** Metrics update interval in ms */
-  metricsUpdateIntervalMs: z14.number().positive().optional().default(5e3),
+  metricsUpdateIntervalMs: z15.number().positive().optional().default(5e3),
   /** Enable detailed event logging */
-  verboseLogging: z14.boolean().optional().default(false),
+  verboseLogging: z15.boolean().optional().default(false),
   /** Token cost rates per model (USD per 1K tokens) */
-  tokenCostRates: z14.record(z14.string(), z14.number().nonnegative()).optional().default({
+  tokenCostRates: z15.record(z15.string(), z15.number().nonnegative()).optional().default({
     claude: 0.015,
     gemini: 1e-3,
     codex: 0.01
@@ -4568,7 +4792,7 @@ var DEFAULT_BENCHMARK_CONFIG = {
 
 // src/benchmarks/benchmark-runner.ts
 import { cpus, totalmem, platform, arch } from "os";
-var logger5 = createLogger({ component: "benchmark-runner" });
+var logger6 = createLogger({ component: "benchmark-runner" });
 var LatencySampler = class {
   samples = [];
   startTimes = /* @__PURE__ */ new Map();
@@ -4664,11 +4888,11 @@ async function runOperationBenchmark(operation, datasetSize, fn, config = {}) {
   const startTime = getTimeProvider().now();
   const startMemory = process.memoryUsage().heapUsed;
   let peakMemory = startMemory;
-  logger5.debug("Running warmup", { operation, iterations: cfg.warmupIterations });
+  logger6.debug("Running warmup", { operation, iterations: cfg.warmupIterations });
   for (let i = 0; i < cfg.warmupIterations; i++) {
     await fn();
   }
-  logger5.debug("Running measurements", { operation, iterations: cfg.measurementIterations });
+  logger6.debug("Running measurements", { operation, iterations: cfg.measurementIterations });
   for (let i = 0; i < cfg.measurementIterations; i++) {
     const id = `op-${String(i)}`;
     sampler.start(id);
@@ -4793,7 +5017,7 @@ ${"=".repeat(60)}`);
 }
 
 // src/benchmarks/memory-benchmarks.ts
-var logger6 = createLogger({ component: "memory-benchmarks" });
+var logger7 = createLogger({ component: "memory-benchmarks" });
 var DEFAULT_MEMORY_BENCHMARK_CONFIG = {
   ...DEFAULT_BENCHMARK_CONFIG,
   contentSizeBytes: 1024,
@@ -4901,9 +5125,9 @@ async function benchmarkPrune(backend, data, config) {
 async function runMemoryBenchmarks(backend, name, config = {}) {
   const cfg = { ...DEFAULT_MEMORY_BENCHMARK_CONFIG, ...config };
   const operations = [];
-  logger6.info("Starting memory benchmarks", { name, sizes: cfg.datasetSizes });
+  logger7.info("Starting memory benchmarks", { name, sizes: cfg.datasetSizes });
   for (const size of cfg.datasetSizes) {
-    logger6.info("Running benchmarks for dataset size", { size });
+    logger7.info("Running benchmarks for dataset size", { size });
     const data = generateTestData(size, cfg);
     try {
       const futureDate = new Date(getTimeProvider().now() + 365 * 24 * 60 * 60 * 1e3);
@@ -4917,7 +5141,7 @@ async function runMemoryBenchmarks(backend, name, config = {}) {
   }
   const environment = getBenchmarkEnvironment();
   const summary = createBenchmarkSummary(operations, cfg);
-  logger6.info("Benchmarks complete", {
+  logger7.info("Benchmarks complete", {
     name,
     passed: summary.passed,
     avgP95: summary.avgP95Latency,
@@ -4963,7 +5187,7 @@ function compareBenchmarks(baseline, current) {
 }
 
 // src/benchmarks/token-benchmark.ts
-var logger7 = createLogger({ component: "token-benchmark" });
+var logger8 = createLogger({ component: "token-benchmark" });
 var CHARS_PER_TOKEN = 4;
 function estimateTokens2(text) {
   return Math.ceil(text.length / CHARS_PER_TOKEN);
@@ -4981,7 +5205,7 @@ async function runTokenBenchmark(backend, config = {}) {
   const cfg = { ...DEFAULT_MEMORY_BENCHMARK_CONFIG, ...config };
   const results = [];
   for (const size of cfg.datasetSizes) {
-    logger7.info("Running token benchmark", { size });
+    logger8.info("Running token benchmark", { size });
     const data = generateTestData(size, cfg);
     for (const entry of data.entries) {
       await backend.store(entry.key, entry.content, {
@@ -5014,15 +5238,15 @@ async function runTokenBenchmark(backend, config = {}) {
 }
 
 // src/benchmarks/consolidation-benchmark.ts
-var logger8 = createLogger({ component: "consolidation-benchmark" });
+var logger9 = createLogger({ component: "consolidation-benchmark" });
 async function runConsolidationBenchmark(operations, config = {}) {
   const cfg = { ...DEFAULT_MEMORY_BENCHMARK_CONFIG, ...config };
   const benchmarks = [];
-  logger8.info("Starting consolidation benchmarks", {
+  logger9.info("Starting consolidation benchmarks", {
     operationCount: operations.length
   });
   for (const op of operations) {
-    logger8.info("Benchmarking consolidation operation", { name: op.name });
+    logger9.info("Benchmarking consolidation operation", { name: op.name });
     const benchmark = await runOperationBenchmark(
       op.name,
       0,
@@ -5137,7 +5361,7 @@ function formatBenchmarkReport(report) {
 }
 
 // src/benchmarks/adapter-latency-benchmark.ts
-var logger9 = createLogger({ component: "adapter-latency-benchmark" });
+var logger10 = createLogger({ component: "adapter-latency-benchmark" });
 var DEFAULT_ADAPTER_LATENCY_CONFIG = {
   warmupIterations: 3,
   measurementIterations: 10,
@@ -5187,7 +5411,7 @@ async function benchmarkScenario(adapter, scenario, config) {
   const errors = [];
   let successCount = 0;
   let failureCount = 0;
-  logger9.info("Benchmarking scenario", {
+  logger10.info("Benchmarking scenario", {
     adapter: adapter.name,
     scenario: scenario.name,
     warmup: config.warmupIterations,
@@ -5554,45 +5778,45 @@ function matchesArtifactFilter(artifact, filter) {
 }
 
 // src/pipeline/trace-schema.ts
-import { z as z15 } from "zod";
-var ExecutionTraceEntrySchema = z15.object({
+import { z as z16 } from "zod";
+var ExecutionTraceEntrySchema = z16.object({
   /** Unix timestamp (ms). */
-  timestamp: z15.number(),
+  timestamp: z16.number(),
   /** Run identifier (typically TaskContract.id). */
-  runId: z15.string().min(1),
+  runId: z16.string().min(1),
   /** Pipeline event type that produced this trace entry. */
-  eventType: z15.string().min(1),
+  eventType: z16.string().min(1),
   /** Execution ID for pipeline correlation. */
-  executionId: z15.string().optional(),
+  executionId: z16.string().optional(),
   /** Graph node or stage that produced this event. */
-  nodeId: z15.string().optional(),
+  nodeId: z16.string().optional(),
   /** Agent that executed this step. */
-  agentId: z15.string().optional(),
+  agentId: z16.string().optional(),
   /** Model used for this step. */
-  modelId: z15.string().optional(),
+  modelId: z16.string().optional(),
   /** Agent role (e.g., code_expert, security_expert). */
-  role: z15.string().optional(),
+  role: z16.string().optional(),
   /** Duration in milliseconds. */
-  durationMs: z15.number().optional(),
+  durationMs: z16.number().optional(),
   /** Human-readable model selection reasoning. */
-  reasoning: z15.string().optional(),
+  reasoning: z16.string().optional(),
   /** Routing decision path (stage:result pairs). */
-  decisionPath: z15.array(z15.string()).optional(),
+  decisionPath: z16.array(z16.string()).optional(),
   /** Error classification. */
-  errorTaxonomy: z15.enum(["retriable", "fatal"]).optional(),
+  errorTaxonomy: z16.enum(["retriable", "fatal"]).optional(),
   /** Error message if this is a failure event. */
-  error: z15.string().optional(),
+  error: z16.string().optional(),
   /** Wave number (1-based) for wave dispatch events. */
-  waveNumber: z15.number().optional(),
+  waveNumber: z16.number().optional(),
   /** Total waves in the dispatch plan. */
-  totalWaves: z15.number().optional(),
+  totalWaves: z16.number().optional(),
   /** Number of workers in this wave. */
-  workerCount: z15.number().optional()
+  workerCount: z16.number().optional()
 });
 
 // src/security/quality-gate-types.ts
-import { z as z16 } from "zod";
-var PipelineStageSchema = z16.enum([
+import { z as z17 } from "zod";
+var PipelineStageSchema = z17.enum([
   "research",
   "plan",
   "vote",
@@ -5601,20 +5825,20 @@ var PipelineStageSchema = z16.enum([
   "qa",
   "ship"
 ]);
-var GateVerdictSchema = z16.enum(["pass", "fail", "skip"]);
-var GateCheckResultSchema = z16.object({
+var GateVerdictSchema = z17.enum(["pass", "fail", "skip"]);
+var GateCheckResultSchema = z17.object({
   /** Name of the check (e.g., 'tests_pass', 'lint_clean'). */
-  name: z16.string().min(1),
+  name: z17.string().min(1),
   /** Pass/fail/skip verdict. */
   verdict: GateVerdictSchema,
   /** Human-readable details. */
-  details: z16.string().max(500),
+  details: z17.string().max(500),
   /** Duration of the check in ms. */
-  durationMs: z16.number().nonnegative().optional()
+  durationMs: z17.number().nonnegative().optional()
 });
 
 // src/pipeline/quality-pipeline.ts
-var logger10 = createLogger({ component: "quality-pipeline" });
+var logger11 = createLogger({ component: "quality-pipeline" });
 
 // src/pipeline/iterative-consensus.ts
 var defaultLogger = createLogger({ component: "iterative-consensus" });
@@ -5715,7 +5939,7 @@ function buildVotingInput(plan, config) {
 }
 async function executeSingleVote(plan, config, log) {
   try {
-    const { executeVoting } = await import("./consensus-vote-FEDF24T5.js");
+    const { executeVoting } = await import("./consensus-vote-KF6M7NZJ.js");
     const input = buildVotingInput(plan, config);
     const result = await executeVoting(input, log);
     return parseVotingResult(result);
@@ -5748,10 +5972,12 @@ function parseVotingResult(result) {
 }
 
 // src/replay/replay-executor.ts
-var logger11 = createLogger({ component: "ReplayExecutor" });
+var logger12 = createLogger({ component: "ReplayExecutor" });
 export {
   ALLOWED_COMMANDS,
   ARTIFACT_TYPES,
+  AST_RULE_LANGUAGES,
+  AST_RULE_SEVERITIES,
   AUDIT_PIPELINE_TEMPLATE,
   AbTestTracker,
   ActivationStrategySchema,
@@ -5862,6 +6088,7 @@ export {
   DECEPTION_CATEGORY,
   DEFAULT_ACTIVATION_OPTIONS,
   DEFAULT_ADAPTER_LATENCY_CONFIG,
+  DEFAULT_AST_QA_LIMIT,
   DEFAULT_BENCHMARK_CONFIG,
   DEFAULT_BUDGET,
   DEFAULT_COLLECT_STREAM_MAX_CHUNKS,
@@ -5994,8 +6221,10 @@ export {
   LoadedSkillSetSchema,
   LoggingConfigSchema,
   MANIPULATION_CATEGORY,
+  MAX_AST_QA_LIMIT,
   MAX_DIFF_LENGTH,
   MAX_EXECUTION_TIME_MS,
+  MAX_FILES_SCANNED,
   MEM0_TARGETS,
   MIN_EXPERTS_FOR_PATTERN,
   MODEL_CAPABILITIES,
@@ -6284,6 +6513,7 @@ export {
   calculateBackoffDelay as cliCalculateBackoffDelay,
   categorizeError as cliCategorizeError,
   closeServer,
+  collectAstQaFindings,
   collectRealVotes,
   collectStream,
   compareBenchmarks,
@@ -6433,6 +6663,7 @@ export {
   emitStateUpdated,
   emitStepCompleted,
   emitTrustEvent,
+  ensurePolyglotLangs,
   err,
   estimateTokens2 as estimateBenchmarkTokens,
   estimateTaskComplexity,
@@ -6476,6 +6707,7 @@ export {
   getAvailableClis,
   getAvailableRoles,
   getBenchmarkEnvironment,
+  getBuiltInAstRulesPath,
   getBuiltInTemplates,
   getBuiltInTemplatesPath,
   getBuiltInTemplatesWithMetadata,
@@ -6536,6 +6768,7 @@ export {
   isZodError,
   listTemplateIds,
   loadCheckpointState,
+  loadRules,
   loadTemplateFile,
   loadTemplatesFromDirectory,
   loadWorkflowFile,
@@ -6626,6 +6859,7 @@ export {
   resultToOutcome,
   runAdapterLatencyBenchmark,
   runAdaptiveOrchestrator,
+  runAstQaRules,
   runBenchmark,
   runConsensusGate,
   runConsolidationBenchmark,