nexus-agents 4.1.1 → 4.1.3

package/dist/{chunk-ZBLX5SPO.js → chunk-HKHOJHQO.js}

@@ -8,7 +8,7 @@ import {
   checkSqlite,
   defaultConfig,
   initDataDirectories
-} from "./chunk-RCSHGEIL.js";
+} from "./chunk-MBVEKLJO.js";
 import {
   BUILT_IN_EXPERTS
 } from "./chunk-YPNQPT2F.js";
@@ -2001,4 +2001,4 @@ export {
   setupCommand,
   setupCommandAsync
 };
-//# sourceMappingURL=chunk-ZBLX5SPO.js.map
+//# sourceMappingURL=chunk-HKHOJHQO.js.map

package/dist/{chunk-RCSHGEIL.js → chunk-MBVEKLJO.js}

@@ -52,7 +52,7 @@ import {
 } from "./chunk-OQLFRJCW.js";
 
 // src/version.ts
-var VERSION = true ? "4.1.1" : "dev";
+var VERSION = true ? "4.1.3" : "dev";
 
 // src/config/schemas-core.ts
 import { z } from "zod";
@@ -2339,7 +2339,7 @@ async function runDoctorFix(result) {
   writeLine2("\u2500".repeat(40));
   let fixCount = 0;
   if (!result.dataDirectory.rootExists || result.dataDirectory.subdirectories.some((d) => !d.exists || !d.writable)) {
-    const { runSetup } = await import("./setup-command-S2VR7PE7.js");
+    const { runSetup } = await import("./setup-command-HEDE6RSE.js");
     const setupResult = runSetup({
       skipMcp: true,
       skipRules: true,
@@ -2452,4 +2452,4 @@ export {
   startStdioServer,
   closeServer
 };
-//# sourceMappingURL=chunk-RCSHGEIL.js.map
+//# sourceMappingURL=chunk-MBVEKLJO.js.map

package/dist/{chunk-UFWTULMJ.js → chunk-ZZLKJ3OB.js}

@@ -22,7 +22,7 @@ import {
   DEFAULT_TASK_TTL_MS,
   DEFAULT_TOOL_RATE_LIMITS,
   clampTaskTtl
-} from "./chunk-RCSHGEIL.js";
+} from "./chunk-MBVEKLJO.js";
 import {
   executeExpert
 } from "./chunk-4Z2Z52C7.js";
@@ -44545,7 +44545,10 @@ function buildHarnessResult(planResult, tasks) {
     tasks,
     voteIterations: planResult.iterations,
     qaIterations: 0,
-    securityPassed: false
+    // Harness mode hands the tasks back for someone else to implement, so the
+    // scan never ran. `securityPassed: false` alone would read as a rejection.
+    securityPassed: false,
+    securityRan: false
   };
 }
 async function runImplSecurityPhase(planResult, tasks, stages, sid, qualityGateMode) {
@@ -44560,7 +44563,9 @@ async function runImplSecurityPhase(planResult, tasks, stages, sid, qualityGateM
       tasks: implResult.completedTasks.length > 0 ? implResult.completedTasks : tasks,
       voteIterations: planResult.iterations,
       qaIterations: implResult.totalIterations,
-      securityPassed: false
+      // The gate short-circuited before the scan — absence, not a verdict.
+      securityPassed: false,
+      securityRan: false
     };
   }
   const security = await withStep(
@@ -44581,7 +44586,8 @@ async function runImplSecurityPhase(planResult, tasks, stages, sid, qualityGateM
     tasks: implResult.completedTasks.length > 0 ? implResult.completedTasks : tasks,
     voteIterations: planResult.iterations,
     qaIterations: implResult.totalIterations,
-    securityPassed: security.passed
+    securityPassed: security.passed,
+    securityRan: true
   };
 }
 async function runQualityGateStage(stages, mode) {
@@ -48442,6 +48448,8 @@ async function loadAuditEvents(dir, logger59) {
   const entries = await fs9.readdir(dir);
   const auditFiles = entries.filter((name) => name.startsWith("audit-") && name.endsWith(".jsonl")).sort();
   const events = [];
+  let skippedLines = 0;
+  let unreadableFiles = 0;
   for (const filename of auditFiles) {
     const fullPath = path8.join(dir, filename);
     let content;
@@ -48450,6 +48458,7 @@ async function loadAuditEvents(dir, logger59) {
     } catch (cause) {
       const msg = cause instanceof Error ? cause.message : String(cause);
       logger59.warn("Skipping unreadable audit log file", { filename, error: msg });
+      unreadableFiles++;
       continue;
     }
     for (const line of content.split("\n")) {
@@ -48464,14 +48473,16 @@ async function loadAuditEvents(dir, logger59) {
             filename,
             error: validated.error.message
           });
+          skippedLines++;
         }
       } catch (cause) {
         const msg = cause instanceof Error ? cause.message : String(cause);
         logger59.warn("Skipping unparseable audit event", { filename, error: msg });
+        skippedLines++;
       }
     }
   }
-  return { events, fileCount: auditFiles.length };
+  return { events, fileCount: auditFiles.length, skippedLines, unreadableFiles };
 }
 async function handler2(args, ctx) {
   const parsed = VerifyAuditChainInputSchema.safeParse(args);
@@ -48498,12 +48509,17 @@ async function handler2(args, ctx) {
       message: `logDir "${resolvedDir}" is not a directory`
     });
   }
-  const { events, fileCount } = await loadAuditEvents(resolvedDir, ctx.logger);
+  const { events, fileCount, skippedLines, unreadableFiles } = await loadAuditEvents(
+    resolvedDir,
+    ctx.logger
+  );
   const verification = verifyChain(events);
   const response = {
     logDir: resolvedDir,
     fileCount,
     eventCount: events.length,
+    ...skippedLines > 0 ? { skippedLines } : {},
+    ...unreadableFiles > 0 ? { unreadableFiles } : {},
     verification
   };
   return toolSuccess(JSON.stringify(response, null, 2));
@@ -48515,7 +48531,7 @@ function registerVerifyAuditChainTool(server, deps) {
       "Filesystem path to the FileAuditStorage log directory. Tool reads all `audit-*.jsonl` files and verifies the combined hash chain."
     )
   };
-  const description = "Verify the hash chain of a persisted FileAuditStorage audit log. Reads all `audit-*.jsonl` files in the given directory, parses events, and runs `verifyChain()` to detect tampering. Returns a structured result with eventCount, fileCount, and one of three tamper signals if detected (hash_mismatch, previous_hash_mismatch, missing_hash). Read-only \u2014 never writes or deletes events.";
+  const description = "Verify the hash chain of a persisted FileAuditStorage audit log. Reads all `audit-*.jsonl` files in the given directory, parses events, and runs `verifyChain()` to detect tampering. Returns a structured result with eventCount, fileCount, and one of three tamper signals if detected (hash_mismatch, previous_hash_mismatch, missing_hash). Reports skippedLines/unreadableFiles when part of the log could not be read, so a verdict over a partial log is never mistaken for a complete one. Read-only \u2014 never writes or deletes events.";
   const secureHandler = createSecureHandler(handler2, {
     toolName: "verify_audit_chain",
     rateLimiter: deps.rateLimiter,
@@ -49766,6 +49782,13 @@ function buildStructuredOutput(result, simulated) {
     ...simulated ? { simulated: true } : {},
     completed: result.completed,
     securityPassed: result.securityPassed,
+    // #4772: these two are what make `completed: false` legible. Without them a
+    // caller cannot tell a failed planner from a successful dry run, or a
+    // security rejection from a gate that never ran — which is the whole point
+    // of the fields. They were added to DevPipelineResult and then not listed
+    // here, so they never reached the MCP surface.
+    ...result.securityRan !== void 0 ? { securityRan: result.securityRan } : {},
+    ...result.planStatus !== void 0 ? { planStatus: result.planStatus } : {},
     voteIterations: result.voteIterations,
     qaIterations: result.qaIterations,
     plan: result.plan,
@@ -50237,13 +50260,26 @@ function detectEngineFailure(result) {
   const record = result;
   if (record["success"] === false) {
     const detail = typeof record["error"] === "string" ? record["error"] : "no error message";
-    return `Engine reported failure: ${detail}`;
+    return { message: `Engine reported failure: ${detail}` };
   }
   if (record["completed"] === false) {
-    return "Engine reported failure: the dev pipeline did not complete";
+    return { message: describeIncompletePipeline(record), detail: record };
   }
   return null;
 }
+function describeIncompletePipeline(record) {
+  const prefix = "Engine reported failure:";
+  if (record["planStatus"] === "empty") {
+    return `${prefix} the planner returned no plan, so nothing was built`;
+  }
+  if (record["securityRan"] === true) {
+    return `${prefix} the security gate rejected the change`;
+  }
+  if (record["securityRan"] === false) {
+    return `${prefix} the run stopped before the security gate, which never ran`;
+  }
+  return `${prefix} the dev pipeline did not complete`;
+}
 async function executeRunBody(input, logger59, trustTier, gatewayAdapters) {
   try {
     const exec2 = await executeGoal(input, {
@@ -50262,7 +50298,11 @@ async function executeRunBody(input, logger59, trustTier, gatewayAdapters) {
         decisionId: exec2.decisionId,
         strategy: exec2.strategy
       });
-      return toolStructuredError({ errorCategory: "business", message: engineFailure });
+      return toolStructuredError({
+        errorCategory: "business",
+        message: engineFailure.message,
+        ...engineFailure.detail !== void 0 ? { detail: engineFailure.detail } : {}
+      });
     }
     return toolSuccess(JSON.stringify(exec2, null, 2));
   } catch (err2) {
@@ -54416,4 +54456,4 @@ export {
   shutdownFeedbackSubscriber,
   createEventBusBridge
 };
-//# sourceMappingURL=chunk-UFWTULMJ.js.map
+//# sourceMappingURL=chunk-ZZLKJ3OB.js.map