nexus-agents 4.14.1 → 4.14.3

package/dist/{child-mcp-config-E5YGOYIM.js → child-mcp-config-APH7KTWD.js}

@@ -1,11 +1,11 @@
 import {
   nexusMkdtemp
-} from "./chunk-SNJNRDKZ.js";
+} from "./chunk-RQV5ZUXT.js";
 import {
   createLogger
-} from "./chunk-TYNKSYWN.js";
-import "./chunk-2HUC6NZN.js";
-import "./chunk-OQLFRJCW.js";
+} from "./chunk-BRPWBUSX.js";
+import "./chunk-HHLCAWAV.js";
+import "./chunk-NBMWONHE.js";
 import "./chunk-ZPWHCABL.js";
 
 // src/cli-adapters/child-mcp-config.ts
@@ -62,4 +62,4 @@ export {
   generateMcpConfig,
   getDefaultAllowedTools
 };
-//# sourceMappingURL=child-mcp-config-E5YGOYIM.js.map
+//# sourceMappingURL=child-mcp-config-APH7KTWD.js.map

package/dist/{chunk-3U3AAMAU.js → chunk-25ZTN5RI.js}

@@ -2,7 +2,7 @@ import {
   createLogger,
   err,
   ok
-} from "./chunk-TYNKSYWN.js";
+} from "./chunk-BRPWBUSX.js";
 
 // src/scm/token-resolver.ts
 import { execFile } from "child_process";
@@ -87,4 +87,4 @@ export {
   hasToken,
   getTokenEnvVars
 };
-//# sourceMappingURL=chunk-3U3AAMAU.js.map
+//# sourceMappingURL=chunk-25ZTN5RI.js.map

package/dist/{chunk-KQU3HO7T.js → chunk-3FRBJFOX.js}

@@ -1,6 +1,6 @@
 import {
   getTimeProvider
-} from "./chunk-TYNKSYWN.js";
+} from "./chunk-BRPWBUSX.js";
 
 // src/security/audit-trail.ts
 var MAX_EVENTS = 1e4;
@@ -205,4 +205,4 @@ export {
   createGraphAuditBridge,
   createAuditTrail
 };
-//# sourceMappingURL=chunk-KQU3HO7T.js.map
+//# sourceMappingURL=chunk-3FRBJFOX.js.map

package/dist/{chunk-45X7AGDF.js → chunk-5DT2LK7C.js}

@@ -1,7 +1,7 @@
 import {
   GitHubProvider,
   ScmError
-} from "./chunk-OC5EBGLD.js";
+} from "./chunk-7PCOAMGG.js";
 import {
   ROLE_DEFAULT_TRUST,
   ReputationCache,
@@ -11,20 +11,20 @@ import {
   gateWithReputation,
   resolveReputationGatingMode,
   sanitizeInput
-} from "./chunk-IMI6LRZ2.js";
+} from "./chunk-FLX3LARU.js";
 import {
   emitPolicyEvent
-} from "./chunk-KQU3HO7T.js";
+} from "./chunk-3FRBJFOX.js";
 import {
   hasToken
-} from "./chunk-3U3AAMAU.js";
+} from "./chunk-25ZTN5RI.js";
 import {
   CLI_SUBPROCESS_TIMEOUTS,
   createLogger,
   err,
   getTimeProvider,
   ok
-} from "./chunk-TYNKSYWN.js";
+} from "./chunk-BRPWBUSX.js";
 
 // src/security/trust-classifier.ts
 function mapAuthorAssociation(association) {
@@ -1247,4 +1247,4 @@ export {
   IssueTriage,
   createIssueTriage
 };
-//# sourceMappingURL=chunk-45X7AGDF.js.map
+//# sourceMappingURL=chunk-5DT2LK7C.js.map

package/dist/{chunk-RGX43IEW.js → chunk-5WDKJA6B.js}

@@ -8,7 +8,7 @@ import {
   getTimeProvider,
   isRateLimitText,
   ok
-} from "./chunk-TYNKSYWN.js";
+} from "./chunk-BRPWBUSX.js";
 
 // src/cli-adapters/circuit-breaker-types.ts
 var CircuitErrorCode = {
@@ -540,4 +540,4 @@ export {
   CliCircuitBreakerIntegration,
   createCliCircuitBreakerIntegration
 };
-//# sourceMappingURL=chunk-RGX43IEW.js.map
+//# sourceMappingURL=chunk-5WDKJA6B.js.map

package/dist/{chunk-SMPLE7KA.js → chunk-6DPOX5GU.js}

@@ -1,9 +1,9 @@
 import {
   getDefaultRegistry
-} from "./chunk-TYNKSYWN.js";
+} from "./chunk-BRPWBUSX.js";
 import {
   getNexusDataDir
-} from "./chunk-OQLFRJCW.js";
+} from "./chunk-NBMWONHE.js";
 
 // src/learning/usage-log.ts
 import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync } from "fs";
@@ -128,4 +128,4 @@ export {
   loadUsageEvents,
   rollupByModel
 };
-//# sourceMappingURL=chunk-SMPLE7KA.js.map
+//# sourceMappingURL=chunk-6DPOX5GU.js.map

package/dist/{chunk-6IDZUUC5.js → chunk-75J5CYUV.js}

@@ -1,6 +1,6 @@
 import {
   emitClawGuardViolation
-} from "./chunk-KQU3HO7T.js";
+} from "./chunk-3FRBJFOX.js";
 import {
   CACHE_TIMEOUTS,
   MCP_TIMEOUTS,
@@ -16,10 +16,10 @@ import {
   getTimeProvider,
   ok,
   resolveToolClassGuardMs
-} from "./chunk-TYNKSYWN.js";
+} from "./chunk-BRPWBUSX.js";
 import {
   getNexusDataDir
-} from "./chunk-OQLFRJCW.js";
+} from "./chunk-NBMWONHE.js";
 
 // src/mcp/middleware/validation.ts
 function validateToolInput(schema, args) {
@@ -2042,4 +2042,4 @@ export {
   VOTING_THRESHOLDS,
   ConsensusMetricsSchema
 };
-//# sourceMappingURL=chunk-6IDZUUC5.js.map
+//# sourceMappingURL=chunk-75J5CYUV.js.map

package/dist/{chunk-7ERIPG4P.js → chunk-7K4UQJD3.js}

@@ -13,7 +13,7 @@ import {
   lookupInTreeCapability,
   ok,
   resolveRetryAfterMs
-} from "./chunk-TYNKSYWN.js";
+} from "./chunk-BRPWBUSX.js";
 
 // src/config/model-parameter-support.ts
 function parseClaudeMajorMinor(bareId) {
@@ -834,4 +834,4 @@ export {
   DEFAULT_COLLECT_STREAM_MAX_CHUNKS,
   collectStream
 };
-//# sourceMappingURL=chunk-7ERIPG4P.js.map
+//# sourceMappingURL=chunk-7K4UQJD3.js.map

package/dist/{chunk-OC5EBGLD.js → chunk-7PCOAMGG.js}

@@ -4,7 +4,7 @@ import {
   err,
   getErrorMessage,
   ok
-} from "./chunk-TYNKSYWN.js";
+} from "./chunk-BRPWBUSX.js";
 
 // src/scm/types.ts
 var ScmError = class extends Error {
@@ -263,4 +263,4 @@ export {
   ScmError,
   GitHubProvider
 };
-//# sourceMappingURL=chunk-OC5EBGLD.js.map
+//# sourceMappingURL=chunk-7PCOAMGG.js.map

package/dist/{chunk-CEHYUQTT.js → chunk-7RRQSUX4.js}

@@ -7,7 +7,7 @@ import {
   toolStructuredError,
   toolSuccessStructured,
   wrapToolWithTimeout
-} from "./chunk-6IDZUUC5.js";
+} from "./chunk-75J5CYUV.js";
 import {
   JsonlStore,
   SECURITY_KEYWORDS,
@@ -19,11 +19,11 @@ import {
   getPipelineEventBus,
   getTimeProvider,
   isDeclaredNeverDeprecate
-} from "./chunk-TYNKSYWN.js";
+} from "./chunk-BRPWBUSX.js";
 import {
   getNexusDataDir,
   nexusDataPath
-} from "./chunk-OQLFRJCW.js";
+} from "./chunk-NBMWONHE.js";
 
 // src/mcp/tools/improvement-review.ts
 import { execFile as execFile2 } from "child_process";
@@ -2132,4 +2132,4 @@ export {
   runImprovementReview,
   registerImprovementReviewTool
 };
-//# sourceMappingURL=chunk-CEHYUQTT.js.map
+//# sourceMappingURL=chunk-7RRQSUX4.js.map

package/dist/{chunk-HW3BCQKG.js → chunk-BI6L5HAS.js}

@@ -11,7 +11,7 @@ import {
   createGetRetryConfig,
   createGetTimeout,
   createGetToolRateLimit
-} from "./chunk-TYNKSYWN.js";
+} from "./chunk-BRPWBUSX.js";
 
 // src/config/defaults.ts
 var CUSTOM_API_DEFAULT_MODEL = "gpt-5.5";
@@ -230,4 +230,4 @@ export {
   CUSTOM_API_DEFAULT_MODEL,
   DEFAULTS
 };
-//# sourceMappingURL=chunk-HW3BCQKG.js.map
+//# sourceMappingURL=chunk-BI6L5HAS.js.map

package/dist/{chunk-TYNKSYWN.js → chunk-BRPWBUSX.js}

@@ -3,10 +3,10 @@ import {
   getDecisionCostFile,
   getModelSelectionShadowFile,
   isPersistenceEnabled
-} from "./chunk-2HUC6NZN.js";
+} from "./chunk-HHLCAWAV.js";
 import {
   nexusDataPath
-} from "./chunk-OQLFRJCW.js";
+} from "./chunk-NBMWONHE.js";
 import {
   __require
 } from "./chunk-ZPWHCABL.js";
@@ -2623,7 +2623,7 @@ function setDefaultRegistry(registry) {
 }
 async function reloadDefaultRegistry() {
   globalRegistry = buildDefaultRegistry();
-  const { resetGlobalRegistry } = await import("./unified-registry-H44QDVXY.js");
+  const { resetGlobalRegistry } = await import("./unified-registry-NZUP46HN.js");
   resetGlobalRegistry();
   return globalRegistry;
 }
@@ -10194,7 +10194,7 @@ async function attachOutcomeStoreToRegistry(store) {
   try {
     const { getMemoryRegistry } = await import("./dist-IKZ53APZ.js");
     const { OutcomeStoreAdapter } = await import("./outcome-store-adapter-K4L3RUJE.js");
-    const { ensureSharedMemoryRegistry } = await import("./tool-memory-registry-adapters-QEC3YHB2.js");
+    const { ensureSharedMemoryRegistry } = await import("./tool-memory-registry-adapters-UMPIJLHS.js");
     ensureSharedMemoryRegistry();
     getMemoryRegistry().attach("outcomes", new OutcomeStoreAdapter(store));
   } catch {
@@ -15079,7 +15079,7 @@ var CompositeRouter = class _CompositeRouter {
    */
   async consultUnifiedContext(task) {
     try {
-      const { getContextForTask, inferTaskCategory } = await import("./context-retriever-5S6NTZRG.js");
+      const { getContextForTask, inferTaskCategory } = await import("./context-retriever-4AQ3X4BA.js");
       const ctx = await getContextForTask({
         task: task.content,
         category: inferTaskCategory(task.content),
@@ -16670,4 +16670,4 @@ export {
   AgentCapability,
   OrchestratorError
 };
-//# sourceMappingURL=chunk-TYNKSYWN.js.map
+//# sourceMappingURL=chunk-BRPWBUSX.js.map

package/dist/{chunk-6MSKPFFM.js → chunk-BV4L3SWR.js}

@@ -1,11 +1,11 @@
 import {
   resolveCliSlot
-} from "./chunk-PWUPYWJE.js";
+} from "./chunk-WJA3TLFH.js";
 import {
   createLogger,
   getTimeProvider,
   isRateLimitText
-} from "./chunk-TYNKSYWN.js";
+} from "./chunk-BRPWBUSX.js";
 
 // src/pipeline/expert-bridge.ts
 function resolveCliFromModelString(model) {
@@ -21,7 +21,7 @@ async function getMcpConfigPath() {
   if (cachedMcpConfigPath !== null) return cachedMcpConfigPath;
   mcpConfigInitPromise ??= (async () => {
     try {
-      const { generateMcpConfig } = await import("./child-mcp-config-E5YGOYIM.js");
+      const { generateMcpConfig } = await import("./child-mcp-config-APH7KTWD.js");
       const config = await generateMcpConfig();
       cachedMcpConfigPath = config.configPath;
       cachedMcpConfigCleanup = config.cleanup;
@@ -93,8 +93,8 @@ var routerInitPromise = null;
 async function getRouter() {
   if (cachedRouter !== null) return cachedRouter;
   routerInitPromise ??= (async () => {
-    const { createAllAdapters } = await import("./factory-ZXDSU5MF.js");
-    const { createCompositeRouter } = await import("./composite-router-JFRT5WIU.js");
+    const { createAllAdapters } = await import("./factory-3C6ZJRL5.js");
+    const { createCompositeRouter } = await import("./composite-router-RGDD4TNU.js");
     const adapters = createAllAdapters();
     if (adapters.size === 0) {
       routerInitPromise = null;
@@ -102,7 +102,7 @@ async function getRouter() {
     }
     cachedRouter = adaptCompositeRouter(createCompositeRouter(adapters));
     try {
-      const { createCliCircuitBreakerIntegration } = await import("./cli-circuit-breaker-D4LO2S5C.js");
+      const { createCliCircuitBreakerIntegration } = await import("./cli-circuit-breaker-KMEJKQHZ.js");
       cachedCircuitBreaker = createCliCircuitBreakerIntegration([...adapters.values()]);
     } catch (error) {
       const msg = error instanceof Error ? error.message : String(error);
@@ -213,4 +213,4 @@ export {
   tokenSplitFromUsage,
   executeExpert
 };
-//# sourceMappingURL=chunk-6MSKPFFM.js.map
+//# sourceMappingURL=chunk-BV4L3SWR.js.map

package/dist/{chunk-XSOMMTPM.js → chunk-CBFZSAUL.js}

@@ -1,10 +1,10 @@
 import {
   createAutoAdapter
-} from "./chunk-SJMQFZCV.js";
+} from "./chunk-JUZRCQJI.js";
 import {
   getDefaultCliCircuitBreakerRegistry,
   mapModelErrorToCategory
-} from "./chunk-RGX43IEW.js";
+} from "./chunk-5WDKJA6B.js";
 import {
   CLI_NAMES,
   CircularBuffer,
@@ -22,7 +22,7 @@ import {
   ok,
   recordRateLimitEvent,
   toRateLimitError
-} from "./chunk-TYNKSYWN.js";
+} from "./chunk-BRPWBUSX.js";
 
 // src/agents/collaboration/event-bus-helpers.ts
 import { randomUUID } from "crypto";
@@ -863,4 +863,4 @@ export {
   getGlobalRegistry,
   resetGlobalRegistry
 };
-//# sourceMappingURL=chunk-XSOMMTPM.js.map
+//# sourceMappingURL=chunk-CBFZSAUL.js.map

package/dist/{chunk-XHDAHIAJ.js → chunk-CD24GOBY.js}

@@ -4,7 +4,7 @@ import {
 import {
   createLogger,
   getTimeProvider
-} from "./chunk-TYNKSYWN.js";
+} from "./chunk-BRPWBUSX.js";
 
 // src/mcp/tools/scanner-registry-fetcher.ts
 import { z } from "zod";
@@ -721,4 +721,4 @@ export {
   generateSecurityPlan,
   buildPlanFromAnalysis
 };
-//# sourceMappingURL=chunk-XHDAHIAJ.js.map
+//# sourceMappingURL=chunk-CD24GOBY.js.map

package/dist/{chunk-LRUPAIVW.js → chunk-FEC3PFSO.js}

@@ -1,6 +1,6 @@
 import {
   getErrorMessage
-} from "./chunk-TYNKSYWN.js";
+} from "./chunk-BRPWBUSX.js";
 
 // src/cli/setup-config.ts
 import { copyFileSync, existsSync, mkdirSync, writeFileSync } from "fs";
@@ -77,4 +77,4 @@ function ensureBackup(outputPath) {
 export {
   runConfigInitSync
 };
-//# sourceMappingURL=chunk-LRUPAIVW.js.map
+//# sourceMappingURL=chunk-FEC3PFSO.js.map

package/dist/{chunk-IMI6LRZ2.js → chunk-FLX3LARU.js}

@@ -2,7 +2,7 @@ import {
   CACHE_TIMEOUTS,
   createLogger,
   getTimeProvider
-} from "./chunk-TYNKSYWN.js";
+} from "./chunk-BRPWBUSX.js";
 
 // src/security/trust-types.ts
 import { z } from "zod";
@@ -560,4 +560,4 @@ export {
   resolveReputationGatingMode,
   gateWithReputation
 };
-//# sourceMappingURL=chunk-IMI6LRZ2.js.map
+//# sourceMappingURL=chunk-FLX3LARU.js.map

package/dist/{chunk-R4TX27OZ.js → chunk-FZ7ACQTB.js}

@@ -3,7 +3,7 @@ import {
   createLogger,
   err,
   ok
-} from "./chunk-TYNKSYWN.js";
+} from "./chunk-BRPWBUSX.js";
 
 // src/adapters/sdk/types.ts
 var PROVIDER_ENV_KEYS = {
@@ -227,4 +227,4 @@ export {
   validateCustomApiBaseUrl,
   assertCustomApiHostResolvesPublic
 };
-//# sourceMappingURL=chunk-R4TX27OZ.js.map
+//# sourceMappingURL=chunk-FZ7ACQTB.js.map

package/dist/{chunk-M5KWBRUY.js → chunk-HHHB3R7L.js}

@@ -4,7 +4,7 @@ import {
   getErrorMessage,
   getTimeProvider,
   ok
-} from "./chunk-TYNKSYWN.js";
+} from "./chunk-BRPWBUSX.js";
 
 // src/context/session-memory.ts
 import * as fs from "fs";
@@ -352,4 +352,4 @@ export {
   SessionMemory,
   createSessionMemory
 };
-//# sourceMappingURL=chunk-M5KWBRUY.js.map
+//# sourceMappingURL=chunk-HHHB3R7L.js.map

package/dist/{chunk-2HUC6NZN.js → chunk-HHLCAWAV.js}

@@ -1,6 +1,6 @@
 import {
   getNexusDataDir
-} from "./chunk-OQLFRJCW.js";
+} from "./chunk-NBMWONHE.js";
 
 // src/config/learning-persistence.ts
 import { mkdirSync } from "fs";
@@ -45,4 +45,4 @@ export {
   isPersistenceEnabled,
   ensureLearningDir
 };
-//# sourceMappingURL=chunk-2HUC6NZN.js.map
+//# sourceMappingURL=chunk-HHLCAWAV.js.map

package/dist/{chunk-HGO7LVRL.js → chunk-JGQ3YQP5.js}

@@ -1,14 +1,14 @@
 import {
   GitHubProvider,
   ScmError
-} from "./chunk-OC5EBGLD.js";
+} from "./chunk-7PCOAMGG.js";
 import {
   resolveToken
-} from "./chunk-3U3AAMAU.js";
+} from "./chunk-25ZTN5RI.js";
 import {
   err,
   ok
-} from "./chunk-TYNKSYWN.js";
+} from "./chunk-BRPWBUSX.js";
 
 // src/scm/factory.ts
 async function createScmProvider(config) {
@@ -41,4 +41,4 @@ export {
   createScmProvider,
   createGitHubProvider
 };
-//# sourceMappingURL=chunk-HGO7LVRL.js.map
+//# sourceMappingURL=chunk-JGQ3YQP5.js.map

package/dist/{chunk-SJMQFZCV.js → chunk-JUZRCQJI.js}

@@ -5,34 +5,34 @@ import {
   planOptionalParams,
   requireApiKey,
   validateApiKeyPresence
-} from "./chunk-7ERIPG4P.js";
+} from "./chunk-7K4UQJD3.js";
 import {
   CUSTOM_API_DEFAULT_MODEL
-} from "./chunk-HW3BCQKG.js";
+} from "./chunk-BI6L5HAS.js";
 import {
   CUSTOM_API_BASE_URL_ENV,
   PROVIDER_ENV_KEYS,
   assertCustomApiHostResolvesPublic,
   validateCustomApiBaseUrl
-} from "./chunk-R4TX27OZ.js";
+} from "./chunk-FZ7ACQTB.js";
 import {
   nexusMkdtempSync
-} from "./chunk-SNJNRDKZ.js";
+} from "./chunk-RQV5ZUXT.js";
 import {
   getAvailabilityCache
-} from "./chunk-PWUPYWJE.js";
+} from "./chunk-WJA3TLFH.js";
 import {
   extractSystemPrompt
 } from "./chunk-QZUG667L.js";
 import {
   generateHyphenId
-} from "./chunk-LVA53Q4Y.js";
+} from "./chunk-TCKP3H54.js";
 import {
   CliCircuitBreaker,
   DEFAULT_CIRCUIT_BREAKER_CONFIG,
   getCliCircuitBreakerSnapshot,
   getDefaultCliCircuitBreakerRegistry
-} from "./chunk-RGX43IEW.js";
+} from "./chunk-5WDKJA6B.js";
 import {
   CLI_SUBPROCESS_TIMEOUTS,
   CLI_TIMEOUTS,
@@ -72,7 +72,7 @@ import {
   resolveCliAlias,
   resolveRetryAfterMs,
   retryAfterMsFromContext
-} from "./chunk-TYNKSYWN.js";
+} from "./chunk-BRPWBUSX.js";
 
 // src/cli-adapters/cli-to-model-adapter.ts
 var CliToModelAdapter = class {
@@ -4885,4 +4885,4 @@ export {
   SdkAdapter,
   createAutoAdapter
 };
-//# sourceMappingURL=chunk-SJMQFZCV.js.map
+//# sourceMappingURL=chunk-JUZRCQJI.js.map

package/dist/{chunk-XIIUIBSX.js → chunk-KGFFEQTN.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-KSQSWEFH.js";
 import {
   nexusDataPath
-} from "./chunk-OQLFRJCW.js";
+} from "./chunk-NBMWONHE.js";
 
 // src/mcp/tools/tool-memory-registry-adapters.ts
 var DEFAULT_SEARCH_LIMIT = 10;
@@ -93,4 +93,4 @@ export {
   StatsOnlyAdapter,
   ensureSharedMemoryRegistry
 };
-//# sourceMappingURL=chunk-XIIUIBSX.js.map
+//# sourceMappingURL=chunk-KGFFEQTN.js.map

package/dist/{chunk-DJ2NGRHS.js → chunk-MVLURKBG.js}

@@ -1,6 +1,3 @@
-import {
-  resolveInsideRoot
-} from "./chunk-NUBSJGQZ.js";
 import {
   ParseError,
   SecurityError,
@@ -8,17 +5,29 @@ import {
   getErrorMessage,
   ok,
   parseBoolEnv
-} from "./chunk-TYNKSYWN.js";
+} from "./chunk-BRPWBUSX.js";
 
 // src/cli/research-helpers-io.ts
 import * as fs2 from "fs/promises";
-import { join, resolve as resolve2 } from "path";
+import { join, resolve as resolve3 } from "path";
+
+// src/security/safe-path.ts
+import { resolve, sep } from "path";
+function resolveInsideRoot(filePath, root = process.cwd()) {
+  const resolvedRoot = resolve(root);
+  const resolved = resolve(resolvedRoot, filePath);
+  if (resolved === resolvedRoot) return resolved;
+  if (resolved.startsWith(resolvedRoot + sep)) return resolved;
+  return null;
+}
+
+// src/cli/research-helpers-io.ts
 import { parse as parseYaml, stringify as stringifyYaml2 } from "yaml";
 
 // src/cli/research-scaffold.ts
 import * as fs from "fs/promises";
 import { existsSync } from "fs";
-import { dirname, resolve } from "path";
+import { dirname, resolve as resolve2 } from "path";
 import { stringify as stringifyYaml } from "yaml";
 var SCHEMA_VERSION = "1.0";
 var ANNOUNCED = /* @__PURE__ */ new Set();
@@ -40,7 +49,7 @@ function emptyTechniquesYaml() {
   return stringifyYaml({ schema_version: SCHEMA_VERSION, techniques: {} });
 }
 async function ensureRegistryFile(rootDir, filename) {
-  const filePath = resolve(rootDir, REGISTRY_PATH, filename);
+  const filePath = resolve2(rootDir, REGISTRY_PATH, filename);
   if (existsSync(filePath)) return ok(filePath);
   if (scaffoldDisabled()) {
     return err(
@@ -49,7 +58,7 @@ async function ensureRegistryFile(rootDir, filename) {
       )
     );
   }
-  if (!existsSync(resolve(rootDir, "docs"))) {
+  if (!existsSync(resolve2(rootDir, "docs"))) {
     return err(
       new ParseError(
         `Registry file missing: ${filePath}. ${rootDir}/docs/ does not exist; refusing to create a Nexus subtree in a non-documented root. Run 'nexus-agents init' first, or create ${rootDir}/docs/ manually.`
@@ -84,7 +93,7 @@ function validatePath(constructedPath, allowedRoot) {
     return {
       ok: false,
       error: new SecurityError("Path traversal detected: path escapes allowed root directory", {
-        context: { constructedPath, allowedRoot: resolve2(allowedRoot) }
+        context: { constructedPath, allowedRoot: resolve3(allowedRoot) }
       })
     };
   }
@@ -140,10 +149,11 @@ async function savePapersRegistry(registry, rootDir) {
 }
 
 export {
+  resolveInsideRoot,
   REGISTRY_PATH,
   getProjectRoot,
   loadTechniquesRegistry,
   loadPapersRegistry,
   savePapersRegistry
 };
-//# sourceMappingURL=chunk-DJ2NGRHS.js.map
+//# sourceMappingURL=chunk-MVLURKBG.js.map