nexus-agents 2.81.3 → 2.82.0

package/dist/{chunk-755EZIUF.js → chunk-4XNVJS5A.js}

@@ -7,10 +7,10 @@ import {
 import {
   getTokenEnvVars,
   resolveToken
-} from "./chunk-UZCDHAY3.js";
+} from "./chunk-G2DZBEMU.js";
 import {
   executeExpert
-} from "./chunk-SVKH6ASN.js";
+} from "./chunk-HMXQKDUV.js";
 import {
   EventTopics,
   NOOP_NOTIFIER,
@@ -36,7 +36,7 @@ import {
   withAccessPolicy,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-P4W7PV6L.js";
+} from "./chunk-FTT2IYYX.js";
 import {
   REGISTRY_PATH,
   getProjectRoot,
@@ -45,14 +45,14 @@ import {
   normalizeTopicToCanonical,
   savePapersRegistry,
   synthesizeResearch
-} from "./chunk-ERWTZSAR.js";
+} from "./chunk-2R5UUBGA.js";
 import {
   IssueTriage,
   sanitizeInput
-} from "./chunk-RLQZOEMX.js";
+} from "./chunk-HJUHDPXJ.js";
 import {
   generateSecurityPlan
-} from "./chunk-SZ7VPIRA.js";
+} from "./chunk-W2AIGD35.js";
 import {
   analyzeGitHubRepo
 } from "./chunk-7J7PNOJQ.js";
@@ -64,7 +64,7 @@ import {
   getContextForTask,
   inferTaskCategory,
   summarizeContextForPrompt
-} from "./chunk-4OPS2AUD.js";
+} from "./chunk-TXIUCEFT.js";
 import {
   DEFAULT_RELEVANCE_CONFIG,
   MemoryImportance,
@@ -72,19 +72,19 @@ import {
   generateHyphenId,
   generateUUID,
   getToolMemory
-} from "./chunk-PZEE6T5Y.js";
+} from "./chunk-U7JXQSEM.js";
 import {
   DEFAULT_TASK_TTL_MS,
   DEFAULT_TOOL_RATE_LIMITS,
   clampTaskTtl
-} from "./chunk-WLAQXITV.js";
+} from "./chunk-S36LIUV2.js";
 import {
   getAvailabilityCache,
   resolveFallback
-} from "./chunk-WZGCVCRQ.js";
+} from "./chunk-GNG7URCR.js";
 import {
   DEFAULTS
-} from "./chunk-V2KWEIV5.js";
+} from "./chunk-SHWGK7X6.js";
 import {
   resolveInsideRoot
 } from "./chunk-NUBSJGQZ.js";
@@ -100,7 +100,7 @@ import {
   getAvailableClis,
   sleep,
   withTimeout
-} from "./chunk-BMNWUPJO.js";
+} from "./chunk-2SQXJQTA.js";
 import {
   BUILT_IN_EXPERTS,
   BuiltInExpertTypeSchema,
@@ -112,7 +112,7 @@ import {
 } from "./chunk-PQHVC4BD.js";
 import {
   createSessionMemory
-} from "./chunk-PV3OEDLO.js";
+} from "./chunk-HVZ52LOL.js";
 import {
   AGENT_ROUTER_TIMEOUTS,
   API_TIMEOUTS,
@@ -182,7 +182,7 @@ import {
   resolveModelIdentitySync,
   toExpertTaskAnalysisResult,
   withStep
-} from "./chunk-LJIB6TNE.js";
+} from "./chunk-7VNVDFD5.js";
 import {
   getNexusDataDir,
   nexusDataPath
@@ -17713,7 +17713,7 @@ var ExperienceBuffer = class _ExperienceBuffer {
     }
     const totalReward = this.computeTotalReward(steps);
     const episode = {
-      id: crypto.randomUUID(),
+      id: getRandomProvider().uuid(),
       sessionId,
       steps: [...steps],
       totalReward,
@@ -19198,14 +19198,8 @@ async function runAllSteps(steps, context, stepExecutor, opts, state) {
 async function executeStepInQueue(step, context, stepExecutor, opts, state) {
   try {
     const result = await state.queue.add((signal) => {
-      const combined = new AbortController();
-      signal.addEventListener("abort", () => {
-        combined.abort();
-      });
-      state.abortController.signal.addEventListener("abort", () => {
-        combined.abort();
-      });
-      return executeStepWithTimeout(step, context, stepExecutor, combined.signal);
+      const combined = AbortSignal.any([signal, state.abortController.signal]);
+      return executeStepWithTimeout(step, context, stepExecutor, combined);
     });
     state.results.push(result);
     if (opts.failFast && result.status === "failed" && state.firstError === null) {
@@ -23494,10 +23488,10 @@ function calculateZStatistic(params) {
 function calculateDifferenceCI(p1, p2, total1, total2, confidence) {
   const difference = p1 - p2;
   const seDiff = Math.sqrt(p1 * (1 - p1) / (total1 || 1) + p2 * (1 - p2) / (total2 || 1));
-  const z107 = getZScore(confidence);
+  const z108 = getZScore(confidence);
   return {
-    lower: difference - z107 * seDiff,
-    upper: difference + z107 * seDiff,
+    lower: difference - z108 * seDiff,
+    upper: difference + z108 * seDiff,
     estimate: difference,
     confidence,
     n: total1 + total2,
@@ -23520,11 +23514,11 @@ function proportionConfidenceInterval(successes, total, options = {}) {
       standardError: 0
     };
   }
-  const z107 = getZScore(opts.confidence);
-  const z210 = z107 * z107;
+  const z108 = getZScore(opts.confidence);
+  const z210 = z108 * z108;
   const denominator = 1 + z210 / n;
   const center = (p + z210 / (2 * n)) / denominator;
-  const margin = z107 / denominator * Math.sqrt(p * (1 - p) / n + z210 / (4 * n * n));
+  const margin = z108 / denominator * Math.sqrt(p * (1 - p) / n + z210 / (4 * n * n));
   const lower = Math.max(0, center - margin);
   const upper = Math.min(1, center + margin);
   const standardError = Math.sqrt(p * (1 - p) / n);
@@ -23554,8 +23548,8 @@ function meanConfidenceInterval(values, options = {}) {
   const variance = values.reduce((sum, v) => sum + (v - mean) ** 2, 0) / (n - 1 || 1);
   const stdDev = Math.sqrt(variance);
   const standardError = stdDev / Math.sqrt(n);
-  const z107 = getZScore(opts.confidence);
-  const margin = z107 * standardError;
+  const z108 = getZScore(opts.confidence);
+  const margin = z108 * standardError;
   return {
     lower: mean - margin,
     upper: mean + margin,
@@ -26699,7 +26693,7 @@ async function populateUnifiedContextOnState(state) {
   try {
     const taskCandidate = state["task"];
     if (typeof taskCandidate !== "string" || taskCandidate === "") return;
-    const { getContextForTask: getContextForTask2, inferTaskCategory: inferTaskCategory2 } = await import("./context-retriever-KLJ5X4TL.js");
+    const { getContextForTask: getContextForTask2, inferTaskCategory: inferTaskCategory2 } = await import("./context-retriever-4JCGMWH7.js");
     const ctx = await getContextForTask2({
       task: taskCandidate,
       category: inferTaskCategory2(taskCandidate),
@@ -33428,9 +33422,22 @@ async function deriveOrchestratePolicy(taskText, deps, logger52) {
     }
     return policy;
   } catch (error) {
-    logger52.warn("access-policy: derivation failed, falling back to off", {
-      error: getErrorMessage(error)
+    logger52.warn("access-policy: derivation failed", {
+      mode,
+      error: getErrorMessage(error),
+      failClosed: mode === "enforce" || mode === "confirm_risky"
     });
+    if (mode === "enforce" || mode === "confirm_risky") {
+      return {
+        allowedTools: [],
+        allowedPathPatterns: [],
+        allowedOperations: [],
+        objectiveHash: "derivation-failed",
+        derivedAt: getTimeProvider().nowIso(),
+        source: "bypass",
+        mode
+      };
+    }
     return {
       allowedTools: "*",
       allowedPathPatterns: [],
@@ -33438,7 +33445,7 @@ async function deriveOrchestratePolicy(taskText, deps, logger52) {
       objectiveHash: "derivation-failed",
       derivedAt: getTimeProvider().nowIso(),
       source: "bypass",
-      mode: "off"
+      mode
     };
   }
 }
@@ -34183,6 +34190,8 @@ function instrumentV2Pipeline(input, logger52) {
   const tc = delegateInputToTaskContract(input);
   void executeDelegatePipeline(tc).then((m) => {
     logger52.info("V2 delegate pipeline", { ...m });
+  }).catch((error) => {
+    logger52.warn("V2 delegate instrumentation failed", { error: getErrorMessage(error) });
   });
 }
 function notifyAndRecord(opts) {
@@ -35633,9 +35642,22 @@ async function deriveExpertAccessPolicy(task, logger52) {
     }
     return policy;
   } catch (error) {
-    logger52?.warn("access-policy: derivation failed, falling back to off (expert)", {
-      error: getErrorMessage(error)
+    logger52?.warn("access-policy: derivation failed (expert)", {
+      mode,
+      error: getErrorMessage(error),
+      failClosed: mode === "enforce" || mode === "confirm_risky"
     });
+    if (mode === "enforce" || mode === "confirm_risky") {
+      return {
+        allowedTools: [],
+        allowedPathPatterns: [],
+        allowedOperations: [],
+        objectiveHash: "derivation-failed",
+        derivedAt: getTimeProvider().nowIso(),
+        source: "bypass",
+        mode
+      };
+    }
     return {
       allowedTools: "*",
       allowedPathPatterns: [],
@@ -35643,7 +35665,7 @@ async function deriveExpertAccessPolicy(task, logger52) {
       objectiveHash: "derivation-failed",
       derivedAt: getTimeProvider().nowIso(),
       source: "bypass",
-      mode: "off"
+      mode
     };
   }
 }
@@ -40477,7 +40499,7 @@ function registerRepoSecurityPlanTool(server, deps) {
 }
 
 // src/mcp/tools/search-codebase-tool.ts
-import { resolve as resolve9 } from "path";
+import { resolve as resolve9, sep as sep3 } from "path";
 import { z as z82 } from "zod";
 var SearchCodebaseInputSchema = z82.object({
   query: z82.string().min(1).max(200).describe("Search query (symbol name, keyword, or pattern)"),
@@ -40485,22 +40507,49 @@ var SearchCodebaseInputSchema = z82.object({
   limit: z82.number().min(1).max(50).optional().describe("Max results (default: 20)"),
   mode: z82.enum(["search", "summary", "list"]).optional().describe("search: find symbols. summary: file overview. list: list indexed files.")
 });
-var cachedIndex;
-var cachedDir = "";
-async function getIndex(dir) {
-  if (cachedIndex !== void 0 && cachedDir === dir) {
-    return cachedIndex;
+var MAX_CACHED_DIRS = 3;
+var INDEX_TTL_MS = 15 * 60 * 1e3;
+var indexCache = /* @__PURE__ */ new Map();
+var inflightIndex = /* @__PURE__ */ new Map();
+function getFromCache(dir) {
+  const entry = indexCache.get(dir);
+  if (entry === void 0) return void 0;
+  if (entry.expiresAt <= getTimeProvider().now()) {
+    indexCache.delete(dir);
+    return void 0;
+  }
+  indexCache.delete(dir);
+  indexCache.set(dir, entry);
+  return entry.index;
+}
+function putInCache(dir, index) {
+  indexCache.set(dir, { index, expiresAt: getTimeProvider().now() + INDEX_TTL_MS });
+  while (indexCache.size > MAX_CACHED_DIRS) {
+    const lruKey = indexCache.keys().next().value;
+    if (lruKey === void 0) break;
+    indexCache.delete(lruKey);
   }
-  const index = new CodebaseIndex(dir);
-  await index.index(4);
-  cachedIndex = index;
-  cachedDir = dir;
-  return index;
+}
+async function getIndex(dir) {
+  const cached = getFromCache(dir);
+  if (cached !== void 0) return cached;
+  const inflight = inflightIndex.get(dir);
+  if (inflight !== void 0) return inflight;
+  const promise = (async () => {
+    const index = new CodebaseIndex(dir);
+    await index.index(4);
+    putInCache(dir, index);
+    return index;
+  })().finally(() => {
+    inflightIndex.delete(dir);
+  });
+  inflightIndex.set(dir, promise);
+  return promise;
 }
 function resolveSearchDir(directory) {
   const dir = resolve9(directory ?? process.cwd());
   const cwdRoot = resolve9(".");
-  if (!dir.startsWith(cwdRoot)) {
+  if (dir !== cwdRoot && !dir.startsWith(cwdRoot + sep3)) {
     return { error: `Path traversal denied: directory must be within ${cwdRoot}` };
   }
   return { dir };
@@ -40586,7 +40635,7 @@ function registerSearchCodebaseTool(server, deps) {
 }
 
 // src/mcp/tools/extract-symbols-tool.ts
-import { resolve as resolve10 } from "path";
+import { resolve as resolve10, sep as sep4 } from "path";
 import { z as z83 } from "zod";
 var ExtractSymbolsInputSchema = z83.object({
   filePath: z83.string().min(1).max(500).describe("Path to TypeScript/JavaScript file to extract symbols from"),
@@ -40624,7 +40673,7 @@ async function extractSymbolsHandler(args, ctx) {
   const { filePath, mode } = parsed.data;
   const resolvedPath = resolve10(filePath);
   const cwdRoot = resolve10(".");
-  if (!resolvedPath.startsWith(cwdRoot)) {
+  if (resolvedPath !== cwdRoot && !resolvedPath.startsWith(cwdRoot + sep4)) {
     return toolStructuredError({
       errorCategory: "permission",
       message: `Path traversal denied: path must be within ${cwdRoot}`
@@ -40675,7 +40724,7 @@ function registerExtractSymbolsTool(server, deps) {
 
 // src/mcp/tools/query-trace-tool.ts
 import { readFile as readFile5, stat as stat3 } from "fs/promises";
-import { join as join8, resolve as resolve11, sep as sep3 } from "path";
+import { join as join8, resolve as resolve11, sep as sep5 } from "path";
 import { z as z84 } from "zod";
 var QueryTraceInputSchema = z84.object({
   runId: z84.string().min(1).max(128).regex(/^[a-zA-Z0-9_-]+$/, "runId must be alphanumeric, hyphens, or underscores").describe("Run ID to query traces for"),
@@ -40726,7 +40775,7 @@ async function queryTraceFromDisk(input, runsDir) {
   const tracePath = join8(dir, input.runId, "trace.jsonl");
   const resolvedDir = resolve11(dir);
   const resolvedTrace = resolve11(tracePath);
-  if (!resolvedTrace.startsWith(resolvedDir + sep3) && resolvedTrace !== resolvedDir) {
+  if (!resolvedTrace.startsWith(resolvedDir + sep5) && resolvedTrace !== resolvedDir) {
     return { runId: input.runId, ...EMPTY_RESPONSE };
   }
   try {
@@ -40940,6 +40989,12 @@ var AuditLogConfigSchema = z85.object({
   enableHashChain: z85.boolean().optional().default(true),
   enableCompression: z85.boolean().optional().default(false),
   flushIntervalMs: z85.number().positive().optional().default(1e3),
+  /**
+   * Maximum in-memory event queue depth before drop-oldest backpressure
+   * engages. Bounds memory under load when storage.write is slow or the flush
+   * timer is overlapping; see #2979.
+   */
+  maxQueueDepth: z85.number().positive().optional().default(1e4),
   // Filtering
   minSeverity: AuditSeveritySchema.optional().default("info"),
   categories: z85.array(AuditCategorySchema).optional()
@@ -41270,10 +41325,10 @@ var FileAuditStorage = class _FileAuditStorage {
 };
 
 // src/audit/audit-logger.ts
-import * as crypto2 from "crypto";
+import * as crypto from "crypto";
 function generateEventId() {
   const timestamp = getTimeProvider().now().toString(36);
-  const random = crypto2.randomBytes(6).toString("hex");
+  const random = crypto.randomBytes(6).toString("hex");
   return `aud_${timestamp}_${random}`;
 }
 function computeEventHash(event) {
@@ -41286,7 +41341,7 @@ function computeEventHash(event) {
     actor: event.actor,
     previousHash: event.previousHash
   });
-  return crypto2.createHash("sha256").update(data).digest("hex");
+  return crypto.createHash("sha256").update(data).digest("hex");
 }
 function verifyEvent(event, index, priorHash) {
   if (event.hash === void 0) {
@@ -41337,17 +41392,21 @@ var SYSTEM_ACTOR = {
   id: "nexus-agents",
   name: "Nexus Agents System"
 };
+var DROP_WARN_INTERVAL = 1e3;
 var AuditLogger = class {
   storage;
   logger;
   enableHashChain;
   minSeverity;
   categories;
+  maxQueueDepth;
   lastHash = null;
   eventQueue = [];
   flushTimer = null;
   flushIntervalMs;
   closed = false;
+  inFlightFlush = null;
+  droppedEventCount = 0;
   constructor(config, storage, logger52) {
     const validated = AuditLogConfigSchema.safeParse(config);
     if (!validated.success) {
@@ -41359,13 +41418,14 @@ var AuditLogger = class {
     this.minSeverity = validated.data.minSeverity;
     this.categories = validated.data.categories;
     this.flushIntervalMs = validated.data.flushIntervalMs;
+    this.maxQueueDepth = validated.data.maxQueueDepth;
     this.storage = storage ?? new FileAuditStorage(validated.data, this.logger);
     this.startFlushTimer();
     this.logger.info("AuditLogger initialized", { logDir: config.logDir });
   }
   startFlushTimer() {
     this.flushTimer = setInterval(() => {
-      this.flushQueue().catch((err2) => {
+      this.flush().catch((err2) => {
         this.logger.error("Audit flush failed", err2 instanceof Error ? err2 : void 0);
       });
     }, this.flushIntervalMs);
@@ -41417,6 +41477,19 @@ var AuditLogger = class {
     if (!this.shouldLog(input)) return;
     const event = this.createEvent(input);
     this.eventQueue.push(event);
+    if (this.eventQueue.length > this.maxQueueDepth) {
+      const dropCount = this.eventQueue.length - this.maxQueueDepth;
+      this.eventQueue.splice(0, dropCount);
+      const priorDropped = this.droppedEventCount;
+      this.droppedEventCount += dropCount;
+      const crossedThreshold = Math.floor(this.droppedEventCount / DROP_WARN_INTERVAL) > Math.floor(priorDropped / DROP_WARN_INTERVAL);
+      if (priorDropped === 0 || crossedThreshold) {
+        this.logger.warn("Audit event queue full; dropping oldest events", {
+          maxQueueDepth: this.maxQueueDepth,
+          totalDropped: this.droppedEventCount
+        });
+      }
+    }
     this.logger.debug("Audit event queued", {
       id: event.id,
       category: event.category,
@@ -41504,16 +41577,30 @@ var AuditLogger = class {
       metadata
     });
   }
-  async flushQueue() {
-    if (this.eventQueue.length === 0) return;
-    const events = this.eventQueue.splice(0, this.eventQueue.length);
-    for (const event of events) {
-      await this.storage.write(event);
+  async drainAndFlushOnce() {
+    if (this.eventQueue.length > 0) {
+      const events = this.eventQueue.splice(0, this.eventQueue.length);
+      for (const event of events) {
+        await this.storage.write(event);
+      }
     }
+    await this.storage.flush();
   }
+  /**
+   * Drain the in-memory queue to storage AND flush the storage's own buffer
+   * to disk. Concurrent calls are coalesced into a single in-flight promise
+   * so an overlapping flush-timer tick cannot spawn parallel drains (see
+   * #2979). A caller arriving while a flush is already running awaits the
+   * existing promise; their newly-queued events, if any, are picked up by
+   * the next flush.
+   */
   async flush() {
-    await this.flushQueue();
-    await this.storage.flush();
+    if (this.inFlightFlush !== null) return this.inFlightFlush;
+    const drain = this.drainAndFlushOnce().finally(() => {
+      this.inFlightFlush = null;
+    });
+    this.inFlightFlush = drain;
+    return drain;
   }
   async close() {
     if (this.closed) return;
@@ -41916,7 +42003,7 @@ async function tryIssueTriage(task) {
   try {
     const issueMatch = task.match(/github\.com\/([^/]+\/[^/]+)\/issues\/(\d+)/);
     if (issueMatch === null) return null;
-    const { createIssueTriage } = await import("./issue-triage-H5VLNGWU.js");
+    const { createIssueTriage } = await import("./issue-triage-T3SKNBH5.js");
     const triage = createIssueTriage();
     const owner = issueMatch[1] ?? "";
     const num = issueMatch[2] ?? "";
@@ -41944,7 +42031,7 @@ var VALID_TEMPLATES = /* @__PURE__ */ new Set([
 ]);
 async function classifyWithLLM(task) {
   try {
-    const { executeExpert: executeExpert2 } = await import("./expert-bridge-EKPDZKMD.js");
+    const { executeExpert: executeExpert2 } = await import("./expert-bridge-DJM5GAWZ.js");
     const prompt = [
       "Classify this task into exactly one pipeline template.",
       "Templates: dev (implementation/bug fix/refactor), research (investigate/evaluate/compare),",
@@ -42704,14 +42791,15 @@ function recordOutcome(args) {
     return;
   }
   try {
+    const nowMs = getTimeProvider().now();
     getOutcomeStore().append({
-      id: `pipeline-${args.taskId}-${String(Date.now())}`,
+      id: `pipeline-${args.taskId}-${String(nowMs)}`,
       cli: args.cli,
       category: args.category,
       model: "pipeline",
       success: args.success,
       durationMs: args.durationMs,
-      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      timestamp: new Date(nowMs).toISOString(),
       source: "delegate",
       routingStage: args.routingStage,
       retryCount: args.retryCount
@@ -42725,10 +42813,10 @@ var memoryInitPromise = null;
 async function initPipelineMemory() {
   if (cachedMemory !== null) return cachedMemory;
   try {
-    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-N76TNRSK.js");
+    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-MY6YS2VX.js");
     const { getLearningDir } = await import("./learning-persistence-NX2KHL5T.js");
     const mem = createSessionMemory2(getLearningDir());
-    mem.startSession(`pipeline-${String(Date.now())}`);
+    mem.startSession(`pipeline-${String(getTimeProvider().now())}`);
     cachedMemory = {
       recordLearning: (l) => {
         try {
@@ -42772,6 +42860,7 @@ function flushPipelineMemory() {
   void getPipelineMemoryAsync().then((m) => m?.flush());
 }
 var routingMemoryCache = null;
+var routingMemoryInitPromise = null;
 function recordRoutingExperience(category, success, durationMs) {
   const metrics = { durationMs, tokensUsed: 0 };
   const callRecord = (rm) => {
@@ -42781,12 +42870,17 @@ function recordRoutingExperience(category, success, durationMs) {
     callRecord(routingMemoryCache);
     return;
   }
-  void import("./routing-memory-QKQ3OGWW.js").then(({ createRoutingMemory }) => {
-    routingMemoryCache = createRoutingMemory();
-    callRecord(routingMemoryCache);
+  routingMemoryInitPromise ??= import("./routing-memory-AAH7NIHD.js").then(({ createRoutingMemory }) => {
+    routingMemoryCache ??= createRoutingMemory();
+    return routingMemoryCache;
   }).catch((error) => {
+    routingMemoryInitPromise = null;
     const msg = error instanceof Error ? error.message : String(error);
     logger38.debug("Routing memory init failed; continuing without it", { error: msg });
+    return null;
+  });
+  void routingMemoryInitPromise.then((rm) => {
+    if (rm !== null) callRecord(rm);
   });
 }
 async function postProgress(config, stage, message) {
@@ -42810,7 +42904,7 @@ ${text}` : "";
 }
 async function getWeatherContext() {
   try {
-    const { generateWeatherReport: generateWeatherReport2 } = await import("./weather-report-IXPYIYE4.js");
+    const { generateWeatherReport: generateWeatherReport2 } = await import("./weather-report-O3Z3BBAX.js");
     const report = generateWeatherReport2({ includeAdaptive: true });
     const mappings = "recommendedMappings" in report ? report.recommendedMappings : [];
     if (!Array.isArray(mappings) || mappings.length === 0) return "";
@@ -42828,7 +42922,7 @@ ${lines}
 }
 async function getMemoryContext(task) {
   try {
-    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-N76TNRSK.js");
+    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-MY6YS2VX.js");
     const { getLearningDir } = await import("./learning-persistence-NX2KHL5T.js");
     const memory = createSessionMemory2(getLearningDir(), { maxLearningsInContext: 10 });
     const learnings = memory.searchLearnings(task.slice(0, 200));
@@ -42934,7 +43028,7 @@ ${contextBlock}`;
       const strategy = config.votingStrategy ?? "higher_order";
       await postProgress(config, "Vote", `Running consensus with ${strategy} strategy...`);
       try {
-        const { executeVoting } = await import("./consensus-vote-VBXLXVFF.js");
+        const { executeVoting } = await import("./consensus-vote-KKAIFULI.js");
         const votingResult = await executeVoting(
           {
             proposal: plan.slice(0, 4e3),
@@ -43131,6 +43225,7 @@ function extractIssues(text) {
 // src/pipeline/pipeline-checkpoint.ts
 import * as fs10 from "fs";
 import * as path9 from "path";
+import { z as z90 } from "zod";
 var logger39 = createLogger({ component: "pipeline-checkpoint" });
 var SESSION_ID_REGEX = /^[a-zA-Z0-9_-]{1,128}$/;
 function validateSessionId(sessionId) {
@@ -43178,14 +43273,65 @@ function loadCheckpointState(sessionId, customDir) {
     return null;
   }
 }
+var PipelineStageSchema = z90.enum([
+  "research",
+  "plan",
+  "vote",
+  "decompose",
+  "implement",
+  "security"
+]);
+var PipelineStageDataSchema = z90.discriminatedUnion("type", [
+  z90.object({ type: z90.literal("research"), text: z90.string() }),
+  z90.object({ type: z90.literal("plan"), text: z90.string(), iterations: z90.number() }),
+  z90.object({
+    type: z90.literal("vote"),
+    approved: z90.boolean(),
+    conditional: z90.boolean(),
+    conditions: z90.array(z90.string()).optional(),
+    caveats: z90.array(z90.string()).optional(),
+    iterations: z90.number()
+  }),
+  // PipelineTask shape is loose at the persistence layer — capture as
+  // `z.unknown()` and trust the downstream consumer's narrower validation.
+  z90.object({ type: z90.literal("decompose"), tasks: z90.array(z90.unknown()) }),
+  z90.object({ type: z90.literal("implement"), tasks: z90.array(z90.unknown()) }),
+  z90.object({ type: z90.literal("security"), passed: z90.boolean() })
+]);
+var PipelineCheckpointEntrySchema = z90.object({
+  sessionId: z90.string(),
+  stage: PipelineStageSchema,
+  timestamp: z90.string(),
+  data: PipelineStageDataSchema
+});
 function rebuildState(lines) {
   const state = {};
+  let skippedCount = 0;
+  let firstSkipReason;
   for (const line of lines) {
+    let parsed;
     try {
-      const entry = JSON.parse(line);
-      applyEntry(state, entry);
-    } catch {
+      parsed = JSON.parse(line);
+    } catch (error) {
+      skippedCount++;
+      firstSkipReason ??= `JSON.parse failed: ${error instanceof Error ? error.message : String(error)}`;
+      continue;
     }
+    const result = PipelineCheckpointEntrySchema.safeParse(parsed);
+    if (!result.success) {
+      skippedCount++;
+      firstSkipReason ??= `schema validation failed: ${result.error.message}`;
+      continue;
+    }
+    applyEntry(state, result.data);
+  }
+  if (skippedCount > 0) {
+    logger39.warn("Skipped malformed checkpoint lines during state rebuild", {
+      skippedCount,
+      totalLines: lines.length,
+      firstSkipReason,
+      recovered: state.lastCompletedStage
+    });
   }
   return state;
 }
@@ -43356,7 +43502,9 @@ function reinforcePlanBeliefs(bm, task, iterations) {
 function applyPipelineHindsight(bm, task, sessionId, result) {
   if (bm === void 0) return;
   const record = {
-    hindsightId: `pipeline-${sessionId ?? "ephemeral"}-${Date.now().toString(36)}`,
+    // #2961: hindsightId is the persisted belief-store key — must go
+    // through the time provider so replay/snapshot tests reproduce.
+    hindsightId: `pipeline-${sessionId ?? "ephemeral"}-${getTimeProvider().now().toString(36)}`,
     taskId: sessionId ?? task.slice(0, 40),
     priorBeliefs: [],
     expectedOutcome: "Pipeline completes with all gates passed",
@@ -43828,7 +43976,7 @@ async function extractSymbolsForTask(task) {
 }
 async function queryResearchRegistry(task) {
   try {
-    const { synthesizeResearch: synthesizeResearch2 } = await import("./research-helpers-synthesize-XUTBDVI7.js");
+    const { synthesizeResearch: synthesizeResearch2 } = await import("./research-helpers-synthesize-Y3O76PY4.js");
     const topic = task.split(/[.!?\n]/).filter((s) => s.trim().length > 10)[0]?.trim();
     if (topic === void 0) return null;
     const result = await synthesizeResearch2(topic.slice(0, 50));
@@ -43913,7 +44061,7 @@ function createScanStageWrapper() {
       try {
         const slug = ctx.task.match(/([a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+)/)?.[1];
         if (slug !== void 0) {
-          const { generateSecurityPlan: generateSecurityPlan2 } = await import("./repo-security-plan-VJCWWPWO.js");
+          const { generateSecurityPlan: generateSecurityPlan2 } = await import("./repo-security-plan-V257RYTW.js");
           const plan = await generateSecurityPlan2({ repo: slug, maxScanners: 10 });
           const recs = plan.recommendations.slice(0, 5).map((r) => `${r.priority}: ${r.displayName} (${r.category})`).join("; ");
           ctx.sharedMemory.write("scan", "decision", { recommendations: recs });
@@ -43954,7 +44102,7 @@ function createAuditStageRegistry() {
 }
 
 // src/mcp/tools/pr-review-tool.ts
-import { z as z90 } from "zod";
+import { z as z91 } from "zod";
 
 // src/mcp/tools/pr-review-findings.ts
 import { parse as parseYaml3 } from "yaml";
@@ -44046,14 +44194,14 @@ var PR_REVIEW_ROLES = [
 ];
 var MAX_DIFF_LENGTH = 5e4;
 var MAX_DESCRIPTION_LENGTH = 1e4;
-var PrReviewInputSchema = z90.object({
-  prTitle: z90.string().min(1).max(500).describe("PR title"),
-  prDescription: z90.string().max(MAX_DESCRIPTION_LENGTH).optional().describe("PR body / description"),
-  prDiff: z90.string().min(1).max(MAX_DIFF_LENGTH).describe(`Unified diff text (max ${String(MAX_DIFF_LENGTH)} chars; truncate before calling)`),
-  repoContext: z90.string().max(2e3).optional().describe("Optional one-paragraph repo context (architecture, conventions)"),
-  baseRef: z90.string().max(200).optional().describe("Base branch ref (e.g. main)"),
-  headRef: z90.string().max(200).optional().describe("Head branch ref"),
-  simulate: z90.boolean().default(false).describe("Use simulated voters (testing only; never ship live with this true)")
+var PrReviewInputSchema = z91.object({
+  prTitle: z91.string().min(1).max(500).describe("PR title"),
+  prDescription: z91.string().max(MAX_DESCRIPTION_LENGTH).optional().describe("PR body / description"),
+  prDiff: z91.string().min(1).max(MAX_DIFF_LENGTH).describe(`Unified diff text (max ${String(MAX_DIFF_LENGTH)} chars; truncate before calling)`),
+  repoContext: z91.string().max(2e3).optional().describe("Optional one-paragraph repo context (architecture, conventions)"),
+  baseRef: z91.string().max(200).optional().describe("Base branch ref (e.g. main)"),
+  headRef: z91.string().max(200).optional().describe("Head branch ref"),
+  simulate: z91.boolean().default(false).describe("Use simulated voters (testing only; never ship live with this true)")
 });
 function mapVoteDecisionToPrDecision(voteDecision) {
   if (voteDecision === "reject") return "request_changes";
@@ -44219,27 +44367,27 @@ function registerPrReviewTool(server, deps) {
 }
 
 // src/mcp/tools/survey-oss-landscape.ts
-import { z as z91 } from "zod";
-var SurveyOssLandscapeInputSchema = z91.object({
-  query: z91.string().min(1).max(200).describe('Free-text search query, e.g. "cargo nextest replacement" or "OSS SBOM tools"'),
-  maxResults: z91.number().int().min(1).max(50).optional().default(10).describe("Maximum candidates to return (1-50; default 10)"),
-  minStars: z91.number().int().min(0).optional().default(0).describe("Minimum star count to include (default 0; useful for filtering noise)"),
-  language: z91.string().max(50).optional().describe('GitHub language filter, e.g. "rust" or "typescript"')
+import { z as z92 } from "zod";
+var SurveyOssLandscapeInputSchema = z92.object({
+  query: z92.string().min(1).max(200).describe('Free-text search query, e.g. "cargo nextest replacement" or "OSS SBOM tools"'),
+  maxResults: z92.number().int().min(1).max(50).optional().default(10).describe("Maximum candidates to return (1-50; default 10)"),
+  minStars: z92.number().int().min(0).optional().default(0).describe("Minimum star count to include (default 0; useful for filtering noise)"),
+  language: z92.string().max(50).optional().describe('GitHub language filter, e.g. "rust" or "typescript"')
 });
-var GitHubRepoSchema2 = z91.object({
-  full_name: z91.string().optional(),
-  html_url: z91.string().optional(),
-  description: z91.string().nullable().optional(),
-  stargazers_count: z91.number().optional(),
-  pushed_at: z91.string().nullable().optional(),
-  language: z91.string().nullable().optional(),
-  license: z91.object({
-    spdx_id: z91.string().nullable().optional()
+var GitHubRepoSchema2 = z92.object({
+  full_name: z92.string().optional(),
+  html_url: z92.string().optional(),
+  description: z92.string().nullable().optional(),
+  stargazers_count: z92.number().optional(),
+  pushed_at: z92.string().nullable().optional(),
+  language: z92.string().nullable().optional(),
+  license: z92.object({
+    spdx_id: z92.string().nullable().optional()
   }).nullable().optional()
 });
-var GitHubSearchResponseSchema2 = z91.object({
-  total_count: z91.number().optional(),
-  items: z91.array(GitHubRepoSchema2).optional()
+var GitHubSearchResponseSchema2 = z92.object({
+  total_count: z92.number().optional(),
+  items: z92.array(GitHubRepoSchema2).optional()
 });
 var GITHUB_SEARCH_BASE = "https://api.github.com/search/repositories";
 function buildGithubQuery(input) {
@@ -44366,11 +44514,11 @@ function createSurveyHandler(deps) {
   };
 }
 var SURVEY_OUTPUT_SCHEMA = {
-  query: z91.string(),
-  totalFound: z91.number(),
-  candidates: z91.array(z91.unknown()),
-  sourcesQueried: z91.array(z91.string()),
-  sourcesFailed: z91.array(z91.string())
+  query: z92.string(),
+  totalFound: z92.number(),
+  candidates: z92.array(z92.unknown()),
+  sourcesQueried: z92.array(z92.string()),
+  sourcesFailed: z92.array(z92.string())
 };
 var SURVEY_DESCRIPTION = 'Transient OSS project search. Returns a ranked list of GitHub repositories with license, last-commit, star-count, and one-line description. Does NOT persist to the research registry \u2014 use `research_add_source` for that. Best for one-off engineering decisions like "what tools exist in this space?".';
 function registerSurveyOssLandscapeTool(server, deps) {
@@ -44399,7 +44547,7 @@ function registerSurveyOssLandscapeTool(server, deps) {
 }
 
 // src/mcp/tools/vendor-publishing-audit.ts
-import { z as z92 } from "zod";
+import { z as z93 } from "zod";
 
 // src/mcp/tools/vendor-publishing-seed.ts
 var VENDOR_PUBLISHING_SEED = {
@@ -44472,8 +44620,8 @@ function listKnownVendors() {
 }
 
 // src/mcp/tools/vendor-publishing-audit.ts
-var VendorPublishingAuditInputSchema = z92.object({
-  vendor: z92.string().min(1).max(50).toLowerCase().describe('Vendor identifier, lowercase. e.g. "ubuntu", "debian", "fedora"')
+var VendorPublishingAuditInputSchema = z93.object({
+  vendor: z93.string().min(1).max(50).toLowerCase().describe('Vendor identifier, lowercase. e.g. "ubuntu", "debian", "fedora"')
 });
 function lookupVendor(vendor) {
   if (isKnownVendor(vendor)) {
@@ -44505,20 +44653,20 @@ function createVendorPublishingAuditHandler(deps) {
   };
 }
 var VENDOR_PUBLISHING_OUTPUT_SCHEMA = {
-  vendor: z92.string(),
-  known: z92.boolean(),
+  vendor: z93.string(),
+  known: z93.boolean(),
   // Fields below populate when known=true; permissive optional for known=false.
-  sha256SumsUrlPattern: z92.string().optional(),
-  sha256SumsSignatureUrlPattern: z92.string().optional(),
-  signaturePattern: z92.string().optional(),
-  gpgKeys: z92.array(z92.unknown()).optional(),
-  releaseCadence: z92.string().optional(),
-  keyRotationNotes: z92.string().optional(),
-  vendorDocUrl: z92.string().optional(),
-  citedAt: z92.string().optional(),
+  sha256SumsUrlPattern: z93.string().optional(),
+  sha256SumsSignatureUrlPattern: z93.string().optional(),
+  signaturePattern: z93.string().optional(),
+  gpgKeys: z93.array(z93.unknown()).optional(),
+  releaseCadence: z93.string().optional(),
+  keyRotationNotes: z93.string().optional(),
+  vendorDocUrl: z93.string().optional(),
+  citedAt: z93.string().optional(),
   // Fields below populate when known=false.
-  message: z92.string().optional(),
-  knownVendors: z92.array(z92.string()).optional()
+  message: z93.string().optional(),
+  knownVendors: z93.array(z93.string()).optional()
 };
 var VENDOR_PUBLISHING_DESCRIPTION = "Look up a vendor's published-artifact signing infrastructure: GPG key fingerprints, SHA256SUMS URL pattern, signature shape (clearsigned / detached / detached-on-iso), release cadence, key rotation notes, and the vendor doc citation. Static lookup against a curated seed dataset; the vendor doc URL is the authoritative source. Returns `{known: false, knownVendors: [...]}` for vendors without a seed entry. v1 covers ubuntu, debian, fedora.";
 function registerVendorPublishingAuditTool(server, deps) {
@@ -44547,17 +44695,17 @@ function registerVendorPublishingAuditTool(server, deps) {
 }
 
 // src/mcp/tools/compare-data-feeds.ts
-import { z as z93 } from "zod";
+import { z as z94 } from "zod";
 import * as path10 from "path";
 import * as fs11 from "fs";
 import * as yaml3 from "yaml";
-var CompareDataFeedsInputSchema = z93.object({
-  feedAPath: z93.string().min(1).max(1e3).describe("Filesystem path to feed A (YAML or JSON, auto-detected by extension)"),
-  feedBPath: z93.string().min(1).max(1e3).describe("Filesystem path to feed B"),
-  keyPath: z93.string().min(1).max(200).describe(
+var CompareDataFeedsInputSchema = z94.object({
+  feedAPath: z94.string().min(1).max(1e3).describe("Filesystem path to feed A (YAML or JSON, auto-detected by extension)"),
+  feedBPath: z94.string().min(1).max(1e3).describe("Filesystem path to feed B"),
+  keyPath: z94.string().min(1).max(200).describe(
     'Dotted path to the entry key, e.g. "id" or "name". Each entry must have this field.'
   ),
-  compareFields: z93.array(z93.string().min(1).max(200)).max(20).optional().describe(
+  compareFields: z94.array(z94.string().min(1).max(200)).max(20).optional().describe(
     'Optional dotted field paths to compare across matched entries (e.g. ["license", "sha256"])'
   )
 });
@@ -44681,7 +44829,7 @@ function buildSummary(feedAPath, feedBPath, diff, fieldDiffs, fields) {
 function loadFeed(feedPath) {
   const resolved = path10.resolve(feedPath);
   const cwdRoot = path10.resolve(".");
-  if (!resolved.startsWith(cwdRoot)) {
+  if (resolved !== cwdRoot && !resolved.startsWith(cwdRoot + path10.sep)) {
     throw new Error(`Path traversal denied: ${feedPath} must be within ${cwdRoot}`);
   }
   if (!fs11.existsSync(resolved)) {
@@ -44741,24 +44889,24 @@ function createCompareDataFeedsHandler(deps) {
   };
 }
 var COMPARE_OUTPUT_SCHEMA = {
-  feedAPath: z93.string(),
-  feedBPath: z93.string(),
-  keyPath: z93.string(),
-  counts: z93.object({
-    entriesInA: z93.number(),
-    entriesInB: z93.number(),
-    onlyInA: z93.number(),
-    onlyInB: z93.number(),
-    inBoth: z93.number(),
-    fieldDifferences: z93.number()
+  feedAPath: z94.string(),
+  feedBPath: z94.string(),
+  keyPath: z94.string(),
+  counts: z94.object({
+    entriesInA: z94.number(),
+    entriesInB: z94.number(),
+    onlyInA: z94.number(),
+    onlyInB: z94.number(),
+    inBoth: z94.number(),
+    fieldDifferences: z94.number()
   }),
-  coverage: z93.object({
-    onlyInA: z93.array(z93.string()),
-    onlyInB: z93.array(z93.string()),
-    inBoth: z93.array(z93.string())
+  coverage: z94.object({
+    onlyInA: z94.array(z94.string()),
+    onlyInB: z94.array(z94.string()),
+    inBoth: z94.array(z94.string())
   }),
-  fieldDifferences: z93.array(z93.unknown()),
-  summary: z93.string()
+  fieldDifferences: z94.array(z94.unknown()),
+  summary: z94.string()
 };
 var COMPARE_DESCRIPTION = "Diff two upstream data feeds (YAML or JSON files) along coverage and per-field axes. Returns which entries exist in A, B, both, plus optional field-level diffs across matched entries. v1 takes file paths only (no URL fetch \u2014 that needs an SSRF design pass). Both feeds must be a top-level array OR a top-level object with exactly one array field.";
 function registerCompareDataFeedsTool(server, deps) {
@@ -44789,7 +44937,7 @@ function registerCompareDataFeedsTool(server, deps) {
 // src/mcp/tools/improvement-review.ts
 import { execFile as execFile3 } from "child_process";
 import { promisify as promisify3 } from "util";
-import { z as z94 } from "zod";
+import { z as z95 } from "zod";
 
 // src/governance/fitness-score.ts
 import { existsSync as existsSync11, readFileSync as readFileSync9, readdirSync as readdirSync2, statSync as statSync2 } from "fs";
@@ -45366,13 +45514,13 @@ function calculateFitnessScore(version) {
 
 // src/mcp/tools/improvement-review.ts
 var execFileAsync3 = promisify3(execFile3);
-var ImprovementReviewInputSchema = z94.object({
-  lookbackDays: z94.number().int().min(1).max(90).optional().default(7).describe("Lookback window for outcome data, in days. Default 7."),
-  fileIssues: z94.boolean().optional().default(false).describe(
+var ImprovementReviewInputSchema = z95.object({
+  lookbackDays: z95.number().int().min(1).max(90).optional().default(7).describe("Lookback window for outcome data, in days. Default 7."),
+  fileIssues: z95.boolean().optional().default(false).describe(
     "When true, file candidate issues via `gh issue create` for crossed thresholds (rate-limited to 5 per run, deduped against open issues). When false (default), return signals only."
   ),
-  minSampleSize: z94.number().int().min(1).max(1e3).optional().default(5).describe("Minimum sample size before a CLI/category signal can fire."),
-  fitnessFloor: z94.number().int().min(0).max(100).optional().default(90).describe("Fitness score below this threshold triggers a tech-debt signal.")
+  minSampleSize: z95.number().int().min(1).max(1e3).optional().default(5).describe("Minimum sample size before a CLI/category signal can fire."),
+  fitnessFloor: z95.number().int().min(0).max(100).optional().default(90).describe("Fitness score below this threshold triggers a tech-debt signal.")
 });
 var MAX_ISSUES_PER_RUN = 5;
 var HOUR_MS = 60 * 60 * 1e3;
@@ -45640,12 +45788,12 @@ async function reviewHandler(args, ctx) {
 }
 var description = "Periodic threshold-gated observability-driven improvement loop. Reads OutcomeStore + fitness audit, surfaces patterns crossing documented thresholds as candidate findings. When fileIssues=true, files candidate GitHub issues via `gh issue create` (rate-limited to 5 per run, deduped against open issues). Never auto-merges. Replaces the deleted self-development engine (#2402).";
 var TOOL_INPUT_SCHEMA = {
-  lookbackDays: z94.number().int().min(1).max(90).optional().describe("Lookback window for outcome data, in days. Default 7."),
-  fileIssues: z94.boolean().optional().describe(
+  lookbackDays: z95.number().int().min(1).max(90).optional().describe("Lookback window for outcome data, in days. Default 7."),
+  fileIssues: z95.boolean().optional().describe(
     "When true, file candidate issues for crossed thresholds (default false \u2014 return signals only)"
   ),
-  minSampleSize: z94.number().int().min(1).max(1e3).optional().describe("Minimum sample size before a CLI/category signal fires (default 5)."),
-  fitnessFloor: z94.number().int().min(0).max(100).optional().describe("Fitness score below this threshold triggers a tech-debt signal (default 90).")
+  minSampleSize: z95.number().int().min(1).max(1e3).optional().describe("Minimum sample size before a CLI/category signal fires (default 5)."),
+  fitnessFloor: z95.number().int().min(0).max(100).optional().describe("Fitness score below this threshold triggers a tech-debt signal (default 90).")
 };
 function registerImprovementReviewTool(server, deps) {
   const logger52 = deps.logger ?? createLogger({ tool: "improvement_review" });
@@ -45673,9 +45821,9 @@ function registerImprovementReviewTool(server, deps) {
 }
 
 // src/mcp/tools/query-task-state-tool.ts
-import { z as z95 } from "zod";
-var QueryTaskStateInputSchema = z95.object({
-  taskId: z95.string().min(1).max(128).describe("Task ID whose structured state log should be read")
+import { z as z96 } from "zod";
+var QueryTaskStateInputSchema = z96.object({
+  taskId: z96.string().min(1).max(128).describe("Task ID whose structured state log should be read")
 });
 function queryTaskStateHandler(args, ctx) {
   const parsed = QueryTaskStateInputSchema.safeParse(args);
@@ -45710,7 +45858,7 @@ function queryTaskStateHandler(args, ctx) {
 function registerQueryTaskStateTool(server, deps) {
   const logger52 = deps.logger ?? createLogger({ tool: "query_task_state" });
   const toolSchema = {
-    taskId: z95.string().min(1).max(128).describe("Task ID whose structured state log should be read")
+    taskId: z96.string().min(1).max(128).describe("Task ID whose structured state log should be read")
   };
   const description2 = "Read the structured state log for a task ID and return the current snapshot. Includes Magentic-One Task Ledger (facts/guesses/openQuestions) and Progress Ledger (per-step reflections with suggestedAction) when orchestrators have written them. Structured state is only written when NEXUS_TASK_STATE_ENABLED=1 was set during the orchestrate invocation.";
   const secureHandler = createSecureHandler(queryTaskStateHandler, {
@@ -45734,9 +45882,9 @@ function registerQueryTaskStateTool(server, deps) {
 // src/mcp/tools/verify-audit-chain-tool.ts
 import * as fs12 from "fs/promises";
 import * as path11 from "path";
-import { z as z96 } from "zod";
-var VerifyAuditChainInputSchema = z96.object({
-  logDir: z96.string().min(1).max(512).describe(
+import { z as z97 } from "zod";
+var VerifyAuditChainInputSchema = z97.object({
+  logDir: z97.string().min(1).max(512).describe(
     "Filesystem path to the FileAuditStorage log directory. Tool reads all `audit-*.jsonl` files in lexicographic order and verifies the combined chain."
   )
 });
@@ -45813,7 +45961,7 @@ async function handler2(args, ctx) {
 function registerVerifyAuditChainTool(server, deps) {
   const logger52 = deps.logger ?? createLogger({ tool: "verify_audit_chain" });
   const toolSchema = {
-    logDir: z96.string().min(1).max(512).describe(
+    logDir: z97.string().min(1).max(512).describe(
       "Filesystem path to the FileAuditStorage log directory. Tool reads all `audit-*.jsonl` files and verifies the combined hash chain."
     )
   };
@@ -45837,18 +45985,18 @@ function registerVerifyAuditChainTool(server, deps) {
 }
 
 // src/mcp/tools/pipeline-tool.ts
-import { z as z97 } from "zod";
+import { z as z98 } from "zod";
 import * as fs13 from "fs";
 import * as path12 from "path";
-var PipelineInputSchema = z97.object({
+var PipelineInputSchema = z98.object({
   /** The task to execute. */
-  task: z97.string().min(5).max(1e4).describe("Task description \u2014 pipeline template auto-selected based on content"),
+  task: z98.string().min(5).max(1e4).describe("Task description \u2014 pipeline template auto-selected based on content"),
   /** Path to a spec file (.md, .yaml) to use as task input. */
-  specFile: z97.string().max(500).optional().describe("Path to a spec file \u2014 content prepended to task for greenfield projects"),
+  specFile: z98.string().max(500).optional().describe("Path to a spec file \u2014 content prepended to task for greenfield projects"),
   /** Override template — see `listTemplateIds()` for the canonical list (#2728). Auto-detected if omitted. */
-  template: z97.string().max(50).optional().describe(`Pipeline template override. Available: ${listTemplateIds().join(", ")}`),
+  template: z98.string().max(50).optional().describe(`Pipeline template override. Available: ${listTemplateIds().join(", ")}`),
   /** Voting strategy for consensus stages. */
-  votingStrategy: z97.enum([
+  votingStrategy: z98.enum([
     "simple_majority",
     "supermajority",
     "unanimous",
@@ -45859,13 +46007,13 @@ var PipelineInputSchema = z97.object({
     "Voting strategy for plan approval. simple_majority (default), supermajority (67%), unanimous, higher_order (Bayesian), proof_of_learning, opinion_wise"
   ),
   /** Use 3 agents instead of 6 for faster voting. */
-  quickMode: z97.boolean().default(false).describe("Use 3 agents instead of 6 for faster consensus voting"),
+  quickMode: z98.boolean().default(false).describe("Use 3 agents instead of 6 for faster consensus voting"),
   /** Maximum execution time per stage in milliseconds (min 30s, max 600s). */
-  timeoutMs: z97.number().int().min(3e4).max(6e5).optional().describe("Max time per stage in ms (30000-600000). Default: varies by stage complexity"),
+  timeoutMs: z98.number().int().min(3e4).max(6e5).optional().describe("Max time per stage in ms (30000-600000). Default: varies by stage complexity"),
   /** Stop after planning/voting (no implementation). */
-  dryRun: z97.boolean().default(false).describe("Stop after vote stage (no implementation)"),
+  dryRun: z98.boolean().default(false).describe("Stop after vote stage (no implementation)"),
   /** TESTS ONLY — random output, must not be used for real decisions. (#2319) */
-  simulateVotes: z97.boolean().default(false).describe("TESTS ONLY \u2014 random output, must not be used for real decisions (#2319)")
+  simulateVotes: z98.boolean().default(false).describe("TESTS ONLY \u2014 random output, must not be used for real decisions (#2319)")
 });
 function buildOutput2(result) {
   return {
@@ -45884,7 +46032,7 @@ async function resolveTask(task, specFile) {
   if (specFile === void 0) return task;
   const resolved = path12.resolve(specFile);
   const cwdRoot = path12.resolve(".");
-  if (!resolved.startsWith(cwdRoot)) {
+  if (resolved !== cwdRoot && !resolved.startsWith(cwdRoot + path12.sep)) {
     throw new Error(`Path traversal denied: specFile must be within ${cwdRoot}`);
   }
   try {
@@ -45967,7 +46115,7 @@ function registerPipelineTool(server, deps) {
 }
 
 // src/mcp/tools/supply-chain-tradeoff-panel.ts
-import { z as z98 } from "zod";
+import { z as z99 } from "zod";
 var DEFAULT_AXES = [
   "build_time_determinism",
   "supply_chain_risk",
@@ -45977,17 +46125,270 @@ var MAX_AXES = 6;
 var MAX_AXIS_NAME_LENGTH = 64;
 var MAX_PROPOSAL_LENGTH = 4e3;
 var MAX_CONTEXT_LENGTH = 4e3;
-var SupplyChainTradeoffPanelInputSchema = z98.object({
-  proposal: z98.string().min(1).max(MAX_PROPOSAL_LENGTH).describe('The proposal under tradeoff review (e.g. "Should aegis-boot adopt cargo-nextest?")'),
-  axes: z98.array(z98.string().min(1).max(MAX_AXIS_NAME_LENGTH)).min(1).max(MAX_AXES).optional().describe(
+var FULL_PANEL = [
+  "architect",
+  "security",
+  "devex",
+  "ai_ml",
+  "pm",
+  "catfish",
+  "scope_steward"
+];
+var QUICK_PANEL = ["architect", "security", "scope_steward"];
+var SupplyChainTradeoffPanelInputSchema = z99.object({
+  proposal: z99.string().min(1).max(MAX_PROPOSAL_LENGTH).describe('The proposal under tradeoff review (e.g. "Should aegis-boot adopt cargo-nextest?")'),
+  axes: z99.array(z99.string().min(1).max(MAX_AXIS_NAME_LENGTH)).min(1).max(MAX_AXES).optional().describe(
     `Tradeoff axes to evaluate. Default: ${DEFAULT_AXES.join(", ")}. Custom axes accepted; max ${String(MAX_AXES)}.`
   ),
-  context: z98.string().max(MAX_CONTEXT_LENGTH).optional().describe(
+  context: z99.string().max(MAX_CONTEXT_LENGTH).optional().describe(
     "Optional context: relevant repo state, dependency tree, vendor publishing patterns, etc."
   ),
-  quickMode: z98.boolean().optional().default(false).describe("Use 3 voters (architect, security, scope_steward) instead of 7"),
-  simulate: z98.boolean().optional().default(false).describe("Use simulated voters (testing only)")
+  quickMode: z99.boolean().optional().default(false).describe("Use 3 voters (architect, security, scope_steward) instead of 7"),
+  simulate: z99.boolean().optional().default(false).describe("Use simulated voters (testing only)")
 });
+function buildTradeoffProposal(input) {
+  const axes = input.axes ?? DEFAULT_AXES;
+  const parts = [];
+  parts.push(`# Supply-Chain Tradeoff Review
+
+`);
+  parts.push(`**Proposal:** ${input.proposal}
+`);
+  if (input.context !== void 0 && input.context !== "") {
+    parts.push(`
+**Context:**
+${input.context}
+`);
+  }
+  parts.push(`
+## Axes
+
+Evaluate the proposal along EACH of these axes independently:
+`);
+  for (const axis of axes) parts.push(`- \`${axis}\`
+`);
+  parts.push(`
+## Your task
+
+`);
+  parts.push(
+    `For each axis, decide approve / reject / abstain with a one-line reason. It is normal \u2014 and expected \u2014 for the verdict to differ across axes (a proposal can be a win on update cadence and a loss on supply-chain risk).
+
+`
+  );
+  parts.push(`After your reasoning, emit a JSON block with this exact shape:
+
+`);
+  parts.push("```json\n");
+  parts.push('{\n  "axes": {\n');
+  axes.forEach((axis, idx) => {
+    const comma = idx < axes.length - 1 ? "," : "";
+    parts.push(`    "${axis}": {"decision": "approve|reject|abstain", "reason": "..."}${comma}
+`);
+  });
+  parts.push("  }\n}\n");
+  parts.push("```\n\n");
+  parts.push(
+    `Your overall vote (approve/reject/abstain) should reflect: approve if MOST axes are approve; reject if any axis is a strong reject; abstain otherwise.
+`
+  );
+  return parts.join("");
+}
+function extractJsonBlock(reasoning) {
+  const fenced = /```json\s*\n([\s\S]*?)\n```/.exec(reasoning);
+  if (fenced !== null) return fenced[1];
+  const start = reasoning.indexOf("{");
+  if (start === -1) return void 0;
+  let depth = 0;
+  for (let i = start; i < reasoning.length; i++) {
+    if (reasoning[i] === "{") depth++;
+    else if (reasoning[i] === "}") {
+      depth--;
+      if (depth === 0) {
+        const candidate = reasoning.slice(start, i + 1);
+        if (candidate.includes("axes") || candidate.includes("axis")) return candidate;
+      }
+    }
+  }
+  return void 0;
+}
+function isValidAxisDecision(d) {
+  return d === "approve" || d === "reject" || d === "abstain";
+}
+function safeJsonParse2(raw) {
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return void 0;
+  }
+}
+function resolveAxesContainer(parsed) {
+  if (typeof parsed !== "object" || parsed === null) return void 0;
+  const root = parsed;
+  const axesObj = root.axes ?? parsed;
+  if (typeof axesObj !== "object") return void 0;
+  return axesObj;
+}
+function parseSingleAxisEntry(entry) {
+  if (typeof entry !== "object" || entry === null) return void 0;
+  const e = entry;
+  if (!isValidAxisDecision(e.decision)) return void 0;
+  return { decision: e.decision, reason: typeof e.reason === "string" ? e.reason : "" };
+}
+function parseAxisVerdicts(reasoning, axes) {
+  const block = extractJsonBlock(reasoning);
+  if (block === void 0) return {};
+  const parsed = safeJsonParse2(block);
+  const container = resolveAxesContainer(parsed);
+  if (container === void 0) return {};
+  const out = {};
+  for (const axis of axes) {
+    const entry = parseSingleAxisEntry(container[axis]);
+    if (entry !== void 0) out[axis] = entry;
+  }
+  return out;
+}
+function aggregateAxis(axis, votes) {
+  const valid = votes.filter((v) => v.source !== "error" && axis in v.axisVotes);
+  let approveCount = 0;
+  let rejectCount = 0;
+  let abstainCount = 0;
+  const supporters = [];
+  const reasons = [];
+  for (const v of valid) {
+    const entry = v.axisVotes[axis];
+    if (entry === void 0) continue;
+    if (entry.decision === "approve") {
+      approveCount++;
+      supporters.push(v.role);
+    } else if (entry.decision === "reject") {
+      rejectCount++;
+    } else {
+      abstainCount++;
+    }
+    if (entry.reason !== "") reasons.push(`${v.role}: ${entry.reason}`);
+  }
+  const decision = decideAxis(approveCount, rejectCount, abstainCount);
+  const total = approveCount + rejectCount + abstainCount;
+  const confidence = total === 0 ? 0 : Math.max(approveCount, rejectCount) / total;
+  return {
+    axis,
+    decision,
+    confidence,
+    approveCount,
+    rejectCount,
+    abstainCount,
+    summary: reasons.slice(0, 3).join(" | "),
+    supportingVoters: supporters
+  };
+}
+function decideAxis(approve, reject, abstain) {
+  const total = approve + reject + abstain;
+  if (total === 0) return "unknown";
+  if (approve > reject && approve > abstain) return "approve";
+  if (reject > approve && reject > abstain) return "reject";
+  if (approve === reject && approve > 0) return "mixed";
+  return "mixed";
+}
+function aggregatePanel(verdicts) {
+  if (verdicts.length === 0) return "mixed";
+  const allApprove = verdicts.every((v) => v.decision === "approve");
+  if (allApprove) return "approve";
+  const anyReject = verdicts.some((v) => v.decision === "reject");
+  if (anyReject) return "reject";
+  return "mixed";
+}
+function buildRecommendation(decision, verdicts) {
+  if (decision === "approve") {
+    return `Approve: all ${String(verdicts.length)} axes approve.`;
+  }
+  if (decision === "reject") {
+    const blockers = verdicts.filter((v) => v.decision === "reject").map((v) => v.axis).join(", ");
+    return `Reject: blocking concerns on ${blockers}.`;
+  }
+  const wins = verdicts.filter((v) => v.decision === "approve").map((v) => v.axis);
+  const losses = verdicts.filter((v) => v.decision === "reject" || v.decision === "mixed" || v.decision === "unknown").map((v) => v.axis);
+  return `Mixed: wins on ${wins.join(", ") || "(none)"}; concerns on ${losses.join(", ") || "(none)"}. Apply judgment.`;
+}
+function toPanelVote(result, axes) {
+  const axisVotes = parseAxisVerdicts(result.vote.reasoning, axes);
+  return {
+    role: result.role,
+    overallDecision: result.vote.decision,
+    axisVotes,
+    reasoning: result.vote.reasoning,
+    source: result.source,
+    cli: result.cli,
+    ...result.error !== void 0 && { errorMessage: result.error }
+  };
+}
+async function tradeoffPanelHandler(args, ctx) {
+  const parsed = SupplyChainTradeoffPanelInputSchema.safeParse(args);
+  if (!parsed.success) {
+    return toolStructuredError({
+      errorCategory: "validation",
+      message: `Validation error: ${formatZodError(parsed.error)}`
+    });
+  }
+  const input = parsed.data;
+  const axes = input.axes ?? DEFAULT_AXES;
+  const roles = input.quickMode ? QUICK_PANEL : FULL_PANEL;
+  const start = Date.now();
+  try {
+    const proposal = buildTradeoffProposal(input);
+    const voteResults = await collectRealVotes({
+      roles,
+      proposal,
+      simulate: input.simulate,
+      logger: ctx.logger
+    });
+    const votes = voteResults.map((r) => toPanelVote(r, axes));
+    const axisVerdicts = axes.map((a) => aggregateAxis(a, votes));
+    const decision = aggregatePanel(axisVerdicts);
+    const recommendation = buildRecommendation(decision, axisVerdicts);
+    const voterErrors = votes.filter((v) => v.source === "error").length;
+    const response = {
+      proposal: input.proposal,
+      axes,
+      decision,
+      axisVerdicts,
+      recommendation,
+      votes,
+      voterErrors,
+      durationMs: Date.now() - start
+    };
+    return toolSuccess(JSON.stringify(response, null, 2));
+  } catch (error) {
+    return toolStructuredError({
+      errorCategory: "internal",
+      message: `Tradeoff panel failed: ${getErrorMessage(error)}`
+    });
+  }
+}
+function registerSupplyChainTradeoffPanelTool(server, deps) {
+  const logger52 = deps.logger ?? createLogger({ tool: "supply_chain_tradeoff_panel" });
+  const description2 = "Run a structured per-axis tradeoff vote on an engineering proposal (#2294). Default axes: build_time_determinism / supply_chain_risk / update_cadence. Voters answer EACH axis independently; aggregator surfaces per-axis verdicts so legitimate tradeoffs are not masked by a single approve/reject.";
+  const secureHandler = createSecureHandler(tradeoffPanelHandler, {
+    toolName: "supply_chain_tradeoff_panel",
+    rateLimiter: deps.rateLimiter,
+    logger: logger52
+  });
+  const timeoutMs = getToolTimeout("supply_chain_tradeoff_panel", deps.security);
+  const wrappedHandler = wrapToolWithTimeout("supply_chain_tradeoff_panel", secureHandler, {
+    timeoutMs,
+    logger: logger52
+  });
+  server.registerTool(
+    "supply_chain_tradeoff_panel",
+    {
+      description: description2,
+      inputSchema: SupplyChainTradeoffPanelInputSchema.shape,
+      annotations: getToolAnnotations("supply_chain_tradeoff_panel")
+    },
+    toSdkCallback(wrappedHandler)
+  );
+  logger52.info("Registered supply_chain_tradeoff_panel tool");
+}
 
 // src/mcp/tools/tool-annotations.ts
 var TOOL_ANNOTATIONS = {
@@ -46343,6 +46744,152 @@ var TOOL_ANNOTATIONS = {
       },
       { category: "implicit", description: "Consumes rate limit quota" }
     ]
+  },
+  research_add_source: {
+    annotations: {
+      title: "Research Add Source",
+      readOnlyHint: false,
+      destructiveHint: false,
+      idempotentHint: false,
+      openWorldHint: true
+    },
+    sideEffects: [
+      { category: "explicit", description: "Adds a non-paper source to the research registry" },
+      { category: "coupling", description: "New entries affect research_discover/research_query" }
+    ]
+  },
+  research_synthesize: {
+    annotations: {
+      title: "Research Synthesize",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: false
+    },
+    sideEffects: [{ category: "implicit", description: "Reads research catalog + alignment map" }]
+  },
+  query_task_state: {
+    annotations: {
+      title: "Query Task State",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: false
+    },
+    sideEffects: [
+      { category: "implicit", description: "Reads the structured task-state log (#2278)" }
+    ]
+  },
+  verify_audit_chain: {
+    annotations: {
+      title: "Verify Audit Chain",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: false
+    },
+    sideEffects: [
+      {
+        category: "implicit",
+        description: "Reads the immutable audit log and verifies the hash chain"
+      }
+    ]
+  },
+  extract_symbols: {
+    annotations: {
+      title: "Extract Symbols",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: false
+    },
+    sideEffects: [{ category: "implicit", description: "Reads source files and walks their ASTs" }]
+  },
+  search_codebase: {
+    annotations: {
+      title: "Search Codebase",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: false
+    },
+    sideEffects: [
+      {
+        category: "implicit",
+        description: "Reads source files and builds an in-memory symbol index"
+      }
+    ]
+  },
+  run_dev_pipeline: {
+    annotations: {
+      title: "Run Dev Pipeline",
+      readOnlyHint: false,
+      destructiveHint: false,
+      idempotentHint: false,
+      openWorldHint: true
+    },
+    sideEffects: [
+      {
+        category: "explicit",
+        description: "Executes the V2 dev pipeline (delegates to CLI adapters)"
+      },
+      {
+        category: "implicit",
+        description: "Consumes API tokens; persists outcomes and checkpoints"
+      },
+      {
+        category: "coupling",
+        description: "Writes routing/learning state consumed by future runs"
+      }
+    ]
+  },
+  run_pipeline: {
+    annotations: {
+      title: "Run Pipeline",
+      readOnlyHint: false,
+      destructiveHint: false,
+      idempotentHint: false,
+      openWorldHint: true
+    },
+    sideEffects: [
+      { category: "explicit", description: "Executes a generic V2 pipeline TaskContract" },
+      { category: "implicit", description: "Consumes API tokens; emits pipeline events" },
+      { category: "coupling", description: "Writes policy/audit state consumed by other tools" }
+    ]
+  },
+  pr_review: {
+    annotations: {
+      title: "PR Review",
+      readOnlyHint: false,
+      destructiveHint: false,
+      idempotentHint: false,
+      openWorldHint: true
+    },
+    sideEffects: [
+      {
+        category: "explicit",
+        description: "Runs multi-voter PR review with verification gate (#2233)"
+      },
+      { category: "implicit", description: "Consumes API tokens across voter CLIs" },
+      { category: "coupling", description: "Records voter outcomes for weather report" }
+    ]
+  },
+  supply_chain_tradeoff_panel: {
+    annotations: {
+      title: "Supply-chain Tradeoff Panel",
+      readOnlyHint: false,
+      destructiveHint: false,
+      idempotentHint: false,
+      openWorldHint: true
+    },
+    sideEffects: [
+      {
+        category: "explicit",
+        description: "Runs per-axis tradeoff vote (build_time_determinism / supply_chain_risk / update_cadence) (#2294)"
+      },
+      { category: "implicit", description: "Consumes API tokens across voter CLIs" },
+      { category: "coupling", description: "Records voter outcomes for weather report" }
+    ]
   }
 };
 function getMcpAnnotations(toolName) {
@@ -46593,40 +47140,40 @@ var RiskLevel = /* @__PURE__ */ ((RiskLevel2) => {
 })(RiskLevel || {});
 
 // src/mcp/safety/stpa-schemas.ts
-import { z as z99 } from "zod";
-var HazardCategorySchema = z99.enum(HazardCategory);
-var HazardSeveritySchema = z99.enum(HazardSeverity);
-var ConstraintPrioritySchema = z99.enum(ConstraintPriority);
-var RiskLevelSchema = z99.enum(RiskLevel);
-var TriggerPatternSchema = z99.object({
-  parameter: z99.string().min(1),
-  matchType: z99.enum(["contains", "regex", "equals", "startsWith", "endsWith"]),
-  pattern: z99.string(),
-  reason: z99.string()
+import { z as z100 } from "zod";
+var HazardCategorySchema = z100.enum(HazardCategory);
+var HazardSeveritySchema = z100.enum(HazardSeverity);
+var ConstraintPrioritySchema = z100.enum(ConstraintPriority);
+var RiskLevelSchema = z100.enum(RiskLevel);
+var TriggerPatternSchema = z100.object({
+  parameter: z100.string().min(1),
+  matchType: z100.enum(["contains", "regex", "equals", "startsWith", "endsWith"]),
+  pattern: z100.string(),
+  reason: z100.string()
 });
-var HazardSchema = z99.object({
-  id: z99.string().min(1),
-  description: z99.string(),
+var HazardSchema = z100.object({
+  id: z100.string().min(1),
+  description: z100.string(),
   category: HazardCategorySchema,
   severity: HazardSeveritySchema,
-  likelihood: z99.enum(["almost_certain", "likely", "possible", "unlikely", "rare"]),
-  triggerConditions: z99.array(z99.string()),
-  consequences: z99.array(z99.string())
+  likelihood: z100.enum(["almost_certain", "likely", "possible", "unlikely", "rare"]),
+  triggerConditions: z100.array(z100.string()),
+  consequences: z100.array(z100.string())
 });
-var UnsafeControlActionSchema = z99.object({
-  id: z99.string().min(1),
-  toolName: z99.string().min(1),
-  type: z99.enum(["not_provided", "provided_causes_hazard", "wrong_timing", "wrong_duration"]),
-  description: z99.string(),
-  unsafeContext: z99.string(),
-  relatedHazards: z99.array(z99.string()),
-  triggerPatterns: z99.array(TriggerPatternSchema).optional()
+var UnsafeControlActionSchema = z100.object({
+  id: z100.string().min(1),
+  toolName: z100.string().min(1),
+  type: z100.enum(["not_provided", "provided_causes_hazard", "wrong_timing", "wrong_duration"]),
+  description: z100.string(),
+  unsafeContext: z100.string(),
+  relatedHazards: z100.array(z100.string()),
+  triggerPatterns: z100.array(TriggerPatternSchema).optional()
 });
-var SafetyConstraintSchema = z99.object({
-  id: z99.string().min(1),
-  description: z99.string(),
-  mitigates: z99.array(z99.string()),
-  enforcement: z99.enum([
+var SafetyConstraintSchema = z100.object({
+  id: z100.string().min(1),
+  description: z100.string(),
+  mitigates: z100.array(z100.string()),
+  enforcement: z100.enum([
     "prevent",
     "require_confirmation",
     "alert",
@@ -46634,54 +47181,54 @@ var SafetyConstraintSchema = z99.object({
     "rate_limit",
     "require_privilege"
   ]),
-  validationFunction: z99.string().optional(),
+  validationFunction: z100.string().optional(),
   priority: ConstraintPrioritySchema
 });
-var PropertySchemaSchema = z99.object({
-  type: z99.string(),
-  description: z99.string().optional(),
-  enum: z99.array(z99.unknown()).optional(),
-  pattern: z99.string().optional(),
-  minimum: z99.number().optional(),
-  maximum: z99.number().optional()
+var PropertySchemaSchema = z100.object({
+  type: z100.string(),
+  description: z100.string().optional(),
+  enum: z100.array(z100.unknown()).optional(),
+  pattern: z100.string().optional(),
+  minimum: z100.number().optional(),
+  maximum: z100.number().optional()
 });
-var ToolInputSchemaSchema = z99.object({
-  type: z99.string(),
-  properties: z99.record(z99.string(), PropertySchemaSchema).optional(),
-  required: z99.array(z99.string()).optional(),
-  additionalProperties: z99.boolean().optional()
+var ToolInputSchemaSchema = z100.object({
+  type: z100.string(),
+  properties: z100.record(z100.string(), PropertySchemaSchema).optional(),
+  required: z100.array(z100.string()).optional(),
+  additionalProperties: z100.boolean().optional()
 });
-var ToolDefinitionSchema = z99.object({
-  name: z99.string().min(1),
-  description: z99.string(),
+var ToolDefinitionSchema = z100.object({
+  name: z100.string().min(1),
+  description: z100.string(),
   inputSchema: ToolInputSchemaSchema
 });
-var AnalysisConfigurationSchema = z99.object({
-  includeLowSeverity: z99.boolean().default(true),
-  generateAllConstraints: z99.boolean().default(true),
-  checkInteractions: z99.boolean().default(true),
-  maxHazardsPerTool: z99.number().int().min(1).max(100).default(50),
-  categories: z99.array(HazardCategorySchema).default([])
+var AnalysisConfigurationSchema = z100.object({
+  includeLowSeverity: z100.boolean().default(true),
+  generateAllConstraints: z100.boolean().default(true),
+  checkInteractions: z100.boolean().default(true),
+  maxHazardsPerTool: z100.number().int().min(1).max(100).default(50),
+  categories: z100.array(HazardCategorySchema).default([])
 });
-var ConstraintViolationSchema = z99.object({
-  constraintId: z99.string().min(1),
-  constraintDescription: z99.string(),
+var ConstraintViolationSchema = z100.object({
+  constraintId: z100.string().min(1),
+  constraintDescription: z100.string(),
   severity: HazardSeveritySchema,
-  details: z99.string(),
-  remediation: z99.string()
+  details: z100.string(),
+  remediation: z100.string()
 });
-var ValidationWarningSchema = z99.object({
-  code: z99.string().min(1),
-  message: z99.string(),
-  affected: z99.string()
+var ValidationWarningSchema = z100.object({
+  code: z100.string().min(1),
+  message: z100.string(),
+  affected: z100.string()
 });
-var ValidationResultSchema = z99.object({
-  valid: z99.boolean(),
-  toolName: z99.string().min(1),
-  violations: z99.array(ConstraintViolationSchema),
-  passed: z99.array(z99.string()),
-  warnings: z99.array(ValidationWarningSchema),
-  validatedAt: z99.date()
+var ValidationResultSchema = z100.object({
+  valid: z100.boolean(),
+  toolName: z100.string().min(1),
+  violations: z100.array(ConstraintViolationSchema),
+  passed: z100.array(z100.string()),
+  warnings: z100.array(ValidationWarningSchema),
+  validatedAt: z100.date()
 });
 
 // src/mcp/safety/stpa-types.ts
@@ -47766,53 +48313,53 @@ var GeminiResponseParser = class {
 };
 
 // src/cli-adapters/router-types.ts
-import { z as z100 } from "zod";
-var RouterConfigSchema = z100.object({
-  minCapacityThreshold: z100.number().min(0).max(1).default(0.1),
-  preferCostEfficient: z100.boolean().default(false),
-  maxDecisionTimeMs: z100.number().min(1).max(1e3).default(100)
+import { z as z101 } from "zod";
+var RouterConfigSchema = z101.object({
+  minCapacityThreshold: z101.number().min(0).max(1).default(0.1),
+  preferCostEfficient: z101.boolean().default(false),
+  maxDecisionTimeMs: z101.number().min(1).max(1e3).default(100)
 });
 
 // src/cli-adapters/agreement-cascade-types.ts
-import { z as z101 } from "zod";
-var AgreementCascadeConfigSchema = z101.object({
-  agreementThreshold: z101.number().min(0.5).max(1).default(0.7),
-  maxStages: z101.number().int().min(1).max(5).default(3),
-  modelTimeoutMs: z101.number().int().min(1e3).max(3e5).default(6e4)
+import { z as z102 } from "zod";
+var AgreementCascadeConfigSchema = z102.object({
+  agreementThreshold: z102.number().min(0.5).max(1).default(0.7),
+  maxStages: z102.number().int().min(1).max(5).default(3),
+  modelTimeoutMs: z102.number().int().min(1e3).max(3e5).default(6e4)
 });
 
 // src/cli-adapters/agreement-cascade-router.ts
 var logger43 = createLogger({ component: "agreement-cascade-router" });
 
 // src/cli-adapters/daao-types.ts
-import { z as z102 } from "zod";
-var EncodedFeaturesSchema = z102.object({
+import { z as z103 } from "zod";
+var EncodedFeaturesSchema = z103.object({
   /** Lexical complexity score (vocabulary diversity, rare words) */
-  lexicalComplexity: z102.number().min(0).max(1),
+  lexicalComplexity: z103.number().min(0).max(1),
   /** Syntactic complexity score (sentence structure, nesting) */
-  syntacticComplexity: z102.number().min(0).max(1),
+  syntacticComplexity: z103.number().min(0).max(1),
   /** Semantic density score (concept density, abstraction level) */
-  semanticDensity: z102.number().min(0).max(1),
+  semanticDensity: z103.number().min(0).max(1),
   /** Technical specificity (domain-specific terminology) */
-  technicalSpecificity: z102.number().min(0).max(1),
+  technicalSpecificity: z103.number().min(0).max(1),
   /** Task scope (breadth of requirements) */
-  taskScope: z102.number().min(0).max(1),
+  taskScope: z103.number().min(0).max(1),
   /** Constraint complexity (constraints, edge cases, requirements) */
-  constraintComplexity: z102.number().min(0).max(1),
+  constraintComplexity: z103.number().min(0).max(1),
   /** Ambiguity level (inverse - higher means more clear/specific) */
-  clarity: z102.number().min(0).max(1),
+  clarity: z103.number().min(0).max(1),
   /** Output complexity expectation */
-  outputComplexity: z102.number().min(0).max(1)
+  outputComplexity: z103.number().min(0).max(1)
 });
-var FeatureWeightsSchema = z102.object({
-  lexicalComplexity: z102.number().min(0).max(1),
-  syntacticComplexity: z102.number().min(0).max(1),
-  semanticDensity: z102.number().min(0).max(1),
-  technicalSpecificity: z102.number().min(0).max(1),
-  taskScope: z102.number().min(0).max(1),
-  constraintComplexity: z102.number().min(0).max(1),
-  clarity: z102.number().min(0).max(1),
-  outputComplexity: z102.number().min(0).max(1)
+var FeatureWeightsSchema = z103.object({
+  lexicalComplexity: z103.number().min(0).max(1),
+  syntacticComplexity: z103.number().min(0).max(1),
+  semanticDensity: z103.number().min(0).max(1),
+  technicalSpecificity: z103.number().min(0).max(1),
+  taskScope: z103.number().min(0).max(1),
+  constraintComplexity: z103.number().min(0).max(1),
+  clarity: z103.number().min(0).max(1),
+  outputComplexity: z103.number().min(0).max(1)
 });
 var DEFAULT_FEATURE_WEIGHTS = {
   lexicalComplexity: 0.1,
@@ -47834,50 +48381,50 @@ var DEFAULT_DAAO_TIER_TO_CLIS = {
   balanced: ["codex", "opencode", "gemini", "claude"],
   powerful: ["claude", "codex", "opencode", "gemini"]
 };
-var DAAOConfigSchema = z102.object({
+var DAAOConfigSchema = z103.object({
   /** Difficulty thresholds for level classification */
-  thresholds: z102.object({
-    easyUpperBound: z102.number().min(0).max(1),
-    hardLowerBound: z102.number().min(0).max(1)
+  thresholds: z103.object({
+    easyUpperBound: z103.number().min(0).max(1),
+    hardLowerBound: z103.number().min(0).max(1)
   }).default(DEFAULT_DAAO_THRESHOLDS),
   /** Feature weights for difficulty aggregation */
   weights: FeatureWeightsSchema.default(DEFAULT_FEATURE_WEIGHTS),
   /** Mapping from model tier to CLI preference order */
-  tierToClis: z102.record(
-    z102.enum(["fast", "balanced", "powerful"]),
-    z102.array(z102.enum(["claude", "gemini", "codex", "opencode"]))
+  tierToClis: z103.record(
+    z103.enum(["fast", "balanced", "powerful"]),
+    z103.array(z103.enum(["claude", "gemini", "codex", "opencode"]))
   ).default(DEFAULT_DAAO_TIER_TO_CLIS),
   /** Enable adaptive calibration from outcomes */
-  enableCalibration: z102.boolean().default(true),
+  enableCalibration: z103.boolean().default(true),
   /** Maximum outcomes to store for calibration */
-  maxCalibrationOutcomes: z102.number().int().positive().default(1e3),
+  maxCalibrationOutcomes: z103.number().int().positive().default(1e3),
   /** Minimum outcomes before applying calibration adjustments */
-  minCalibrationOutcomes: z102.number().int().positive().default(50),
+  minCalibrationOutcomes: z103.number().int().positive().default(50),
   /** Reconstruction error threshold for typical patterns */
-  typicalPatternThreshold: z102.number().min(0).max(1).default(0.3),
+  typicalPatternThreshold: z103.number().min(0).max(1).default(0.3),
   /** Verbose logging */
-  verbose: z102.boolean().default(false)
+  verbose: z103.boolean().default(false)
 });
 
 // src/cli-adapters/task-classifier.ts
-import { z as z103 } from "zod";
-var ClassificationPatternsSchema = z103.object({
-  code: z103.array(z103.string()).readonly(),
-  research: z103.array(z103.string()).readonly(),
-  documentation: z103.array(z103.string()).readonly(),
-  analysis: z103.array(z103.string()).readonly()
+import { z as z104 } from "zod";
+var ClassificationPatternsSchema = z104.object({
+  code: z104.array(z104.string()).readonly(),
+  research: z104.array(z104.string()).readonly(),
+  documentation: z104.array(z104.string()).readonly(),
+  analysis: z104.array(z104.string()).readonly()
 });
 
 // src/cli-adapters/response-cache-types.ts
-import { z as z104 } from "zod";
-var ResponseCacheConfigSchema = z104.object({
-  defaultTTL: z104.number().min(1e3).max(36e5).default(3e5),
+import { z as z105 } from "zod";
+var ResponseCacheConfigSchema = z105.object({
+  defaultTTL: z105.number().min(1e3).max(36e5).default(3e5),
   // 5 minutes
-  maxEntries: z104.number().min(10).max(1e5).default(1e3),
-  maxMemoryMB: z104.number().min(1).max(1e3).default(50),
-  cleanupInterval: z104.number().min(1e3).max(6e5).default(6e4),
+  maxEntries: z105.number().min(10).max(1e5).default(1e3),
+  maxMemoryMB: z105.number().min(1).max(1e3).default(50),
+  cleanupInterval: z105.number().min(1e3).max(6e5).default(6e4),
   // 1 minute
-  enableLogging: z104.boolean().default(false)
+  enableLogging: z105.boolean().default(false)
 });
 
 // src/cli-adapters/response-cache-utils.ts
@@ -47885,12 +48432,12 @@ import { createHash as createHash4 } from "crypto";
 var logger44 = createLogger({ component: "ResponseCacheUtils" });
 
 // src/cli-adapters/unified-routing-types.ts
-import { z as z105 } from "zod";
-var UnifiedRoutingDecisionSchema = z105.object({
-  selectedCli: z105.string(),
-  confidence: z105.number().min(0).max(1),
-  reason: z105.string(),
-  strategy: z105.enum([
+import { z as z106 } from "zod";
+var UnifiedRoutingDecisionSchema = z106.object({
+  selectedCli: z106.string(),
+  confidence: z106.number().min(0).max(1),
+  reason: z106.string(),
+  strategy: z106.enum([
     "composite",
     "quality",
     "budget",
@@ -47902,57 +48449,57 @@ var UnifiedRoutingDecisionSchema = z105.object({
     "linucb",
     "direct"
   ]),
-  decisionTimeMs: z105.number().nonnegative(),
-  alternatives: z105.array(z105.string()).readonly(),
-  stagesExecuted: z105.array(z105.string()).readonly(),
-  withinBudget: z105.boolean().optional(),
-  estimatedComplexity: z105.enum(["simple", "moderate", "complex", "expert"]).optional(),
-  estimatedTokens: z105.number().int().positive().optional(),
-  topsisScore: z105.number().optional(),
-  ucbScore: z105.number().optional(),
-  resolvedAtStage: z105.number().int().nonnegative().optional(),
-  consensusReached: z105.boolean().optional(),
-  agreementScore: z105.number().min(0).max(1).optional(),
-  metadata: z105.record(z105.string(), z105.unknown()).optional()
+  decisionTimeMs: z106.number().nonnegative(),
+  alternatives: z106.array(z106.string()).readonly(),
+  stagesExecuted: z106.array(z106.string()).readonly(),
+  withinBudget: z106.boolean().optional(),
+  estimatedComplexity: z106.enum(["simple", "moderate", "complex", "expert"]).optional(),
+  estimatedTokens: z106.number().int().positive().optional(),
+  topsisScore: z106.number().optional(),
+  ucbScore: z106.number().optional(),
+  resolvedAtStage: z106.number().int().nonnegative().optional(),
+  consensusReached: z106.boolean().optional(),
+  agreementScore: z106.number().min(0).max(1).optional(),
+  metadata: z106.record(z106.string(), z106.unknown()).optional()
 });
 
 // src/learning/outcome-feedback-types.ts
-import { z as z106 } from "zod";
-var QualitySignalsSchema = z106.object({
-  testsPass: z106.boolean().optional(),
-  lintErrors: z106.number().int().min(0).optional(),
-  userApproved: z106.boolean().optional(),
-  retryCount: z106.number().int().min(0).default(0),
-  completionRatio: z106.number().min(0).max(1).default(1),
-  validStructure: z106.boolean().optional(),
-  coherenceScore: z106.number().min(0).max(1).optional()
+import { z as z107 } from "zod";
+var QualitySignalsSchema = z107.object({
+  testsPass: z107.boolean().optional(),
+  lintErrors: z107.number().int().min(0).optional(),
+  userApproved: z107.boolean().optional(),
+  retryCount: z107.number().int().min(0).default(0),
+  completionRatio: z107.number().min(0).max(1).default(1),
+  validStructure: z107.boolean().optional(),
+  coherenceScore: z107.number().min(0).max(1).optional()
 });
-var RoutingDecisionSchema = z106.object({
-  id: z106.uuid(),
-  timestamp: z106.iso.datetime(),
-  query: z106.string(),
-  routerType: z106.enum(["linucb", "preference", "quality", "cascade", "topsis"]),
-  selectedModel: z106.string(),
-  selectedTier: z106.enum(["strong", "weak"]).optional(),
-  armIndex: z106.number().int().min(0).optional(),
-  banditContext: z106.record(z106.string(), z106.unknown()).optional(),
-  queryFeatures: z106.record(z106.string(), z106.unknown()).optional(),
-  ucbScore: z106.number().optional(),
-  confidence: z106.number().min(0).max(1).optional(),
-  traceId: z106.string(),
-  domain: z106.string().optional()
+var RoutingDecisionSchema = z107.object({
+  id: z107.uuid(),
+  timestamp: z107.iso.datetime(),
+  query: z107.string(),
+  routerType: z107.enum(["linucb", "preference", "quality", "cascade", "topsis"]),
+  selectedModel: z107.string(),
+  selectedTier: z107.enum(["strong", "weak"]).optional(),
+  armIndex: z107.number().int().min(0).optional(),
+  banditContext: z107.record(z107.string(), z107.unknown()).optional(),
+  queryFeatures: z107.record(z107.string(), z107.unknown()).optional(),
+  ucbScore: z107.number().optional(),
+  confidence: z107.number().min(0).max(1).optional(),
+  traceId: z107.string(),
+  domain: z107.string().optional()
 });
-var TaskOutcomeSchema = z106.object({
-  routingDecisionId: z106.uuid(),
-  timestamp: z106.iso.datetime(),
-  outcomeClass: z106.enum(["success", "partial", "failure", "timeout", "error"]),
-  success: z106.boolean(),
-  qualityScore: z106.number().min(0).max(1),
-  durationMs: z106.number().min(0),
-  tokenUsage: z106.number().int().min(0),
-  errorMessage: z106.string().optional(),
+var TaskOutcomeSchema = z107.object({
+  routingDecisionId: z107.uuid(),
+  timestamp: z107.iso.datetime(),
+  outcomeClass: z107.enum(["success", "partial", "failure", "timeout", "error"]),
+  success: z107.boolean(),
+  qualityScore: z107.number().min(0).max(1),
+  durationMs: z107.number().min(0),
+  tokenUsage: z107.number().int().min(0),
+  errorMessage: z107.string().optional(),
   qualitySignals: QualitySignalsSchema,
-  traceId: z106.string()
+  traceId: z107.string()
 });
 var DEFAULT_FEEDBACK_COLLECTOR_CONFIG = {
   maxPendingDecisions: 1e3,
@@ -47967,17 +48514,17 @@ var DEFAULT_FEEDBACK_COLLECTOR_CONFIG = {
   targetTokenUsage: 2e3,
   maxHistorySize: 1e4
 };
-var FeedbackCollectorConfigSchema = z106.object({
-  maxPendingDecisions: z106.number().int().positive().default(1e3),
-  pendingTimeoutMs: z106.number().positive().default(3e5),
-  enableAutoReward: z106.boolean().default(true),
-  qualityWeight: z106.number().min(0).max(1).default(0.5),
-  speedWeight: z106.number().min(0).max(1).default(0.2),
-  efficiencyWeight: z106.number().min(0).max(1).default(0.2),
-  retryPenalty: z106.number().min(0).max(1).default(0.1),
-  targetDurationMs: z106.number().positive().default(5e3),
-  targetTokenUsage: z106.number().positive().default(2e3),
-  maxHistorySize: z106.number().int().positive().default(1e4)
+var FeedbackCollectorConfigSchema = z107.object({
+  maxPendingDecisions: z107.number().int().positive().default(1e3),
+  pendingTimeoutMs: z107.number().positive().default(3e5),
+  enableAutoReward: z107.boolean().default(true),
+  qualityWeight: z107.number().min(0).max(1).default(0.5),
+  speedWeight: z107.number().min(0).max(1).default(0.2),
+  efficiencyWeight: z107.number().min(0).max(1).default(0.2),
+  retryPenalty: z107.number().min(0).max(1).default(0.1),
+  targetDurationMs: z107.number().positive().default(5e3),
+  targetTokenUsage: z107.number().positive().default(2e3),
+  maxHistorySize: z107.number().int().positive().default(1e4)
 });
 
 // src/learning/outcome-feedback-helpers.ts
@@ -49041,7 +49588,7 @@ function getPolicy(id) {
 // src/security/sandbox/sandbox-executor.ts
 import { execFile as execFile4 } from "child_process";
 import { promisify as promisify4 } from "util";
-import { resolve as resolve17, normalize as normalize2, sep as sep6 } from "path";
+import { resolve as resolve17, normalize as normalize2, sep as sep10 } from "path";
 var execFileAsync4 = promisify4(execFile4);
 var logger46 = createLogger({ component: "sandbox-executor" });
 function parseExecError(error) {
@@ -49124,7 +49671,7 @@ var PolicySandboxExecutor = class {
     const normalizedCwd = normalize2(resolve17(cwd));
     const isAllowed = policy.pathRules.some((rule) => {
       const normalizedRule = normalize2(resolve17(rule.path));
-      const isUnderRule = normalizedCwd === normalizedRule || normalizedCwd.startsWith(normalizedRule + sep6);
+      const isUnderRule = normalizedCwd === normalizedRule || normalizedCwd.startsWith(normalizedRule + sep10);
       return isUnderRule && rule.access !== "none";
     });
     if (!isAllowed) {
@@ -49524,7 +50071,7 @@ var GitHubTaskTracker = class {
   cachedProvider = null;
   async getProvider() {
     if (this.cachedProvider !== null) return this.cachedProvider;
-    const { createScmProvider } = await import("./factory-FTE7TDCT.js");
+    const { createScmProvider } = await import("./factory-DOWBGVAL.js");
     const result = await createScmProvider({ repo: this.config.repo ?? "" });
     if (!result.ok) throw new Error(`SCM provider error: ${result.error.message}`);
     this.cachedProvider = result.value;
@@ -50195,6 +50742,7 @@ export {
   aggregatePrDecisions,
   buildPrReviewProposal,
   registerPrReviewTool,
+  registerSupplyChainTradeoffPanelTool,
   createAnnotationsProxy,
   createToolObservabilityProxy,
   registerTools,
@@ -50229,4 +50777,4 @@ export {
   detectBackend,
   createTaskTracker
 };
-//# sourceMappingURL=chunk-755EZIUF.js.map
+//# sourceMappingURL=chunk-4XNVJS5A.js.map