nexus-agents 4.20.0 → 4.22.0

package/dist/{chunk-EI3AC7X2.js → chunk-HVCYICUX.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-6T3EPABN.js";
 import {
   SessionMemory
-} from "./chunk-SHMGRIYH.js";
+} from "./chunk-6MVRXQ6V.js";
 import {
   StatsOnlyAdapter,
   ensureSharedMemoryRegistry
@@ -15,7 +15,7 @@ import {
 } from "./chunk-KSQSWEFH.js";
 import {
   generateId
-} from "./chunk-HBTUFRGO.js";
+} from "./chunk-MNPD6TMW.js";
 import {
   ErrorCode,
   NexusError,
@@ -28,7 +28,7 @@ import {
   getTimeProvider,
   ok,
   setSharedMobiMemDbPathResolver
-} from "./chunk-TKI4VCS6.js";
+} from "./chunk-IDLQNS5U.js";
 import {
   nexusDataPath
 } from "./chunk-NBMWONHE.js";
@@ -5550,4 +5550,4 @@ export {
   reinitializeMemoryBackends,
   ToolMemoryManager
 };
-//# sourceMappingURL=chunk-EI3AC7X2.js.map
+//# sourceMappingURL=chunk-HVCYICUX.js.map

package/dist/{chunk-MY33A5CO.js → chunk-HWBUN7WP.js}

@@ -2,7 +2,7 @@ import {
   CACHE_TIMEOUTS,
   createLogger,
   getTimeProvider
-} from "./chunk-TKI4VCS6.js";
+} from "./chunk-IDLQNS5U.js";
 
 // src/security/trust-types.ts
 import { z } from "zod";
@@ -560,4 +560,4 @@ export {
   resolveReputationGatingMode,
   gateWithReputation
 };
-//# sourceMappingURL=chunk-MY33A5CO.js.map
+//# sourceMappingURL=chunk-HWBUN7WP.js.map

package/dist/{chunk-TKI4VCS6.js → chunk-IDLQNS5U.js}

@@ -2623,7 +2623,7 @@ function setDefaultRegistry(registry) {
 }
 async function reloadDefaultRegistry() {
   globalRegistry = buildDefaultRegistry();
-  const { resetGlobalRegistry } = await import("./unified-registry-5GGXSFFS.js");
+  const { resetGlobalRegistry } = await import("./unified-registry-63G7RTA6.js");
   resetGlobalRegistry();
   return globalRegistry;
 }
@@ -15116,7 +15116,7 @@ var CompositeRouter = class _CompositeRouter {
    */
   async consultUnifiedContext(task) {
     try {
-      const { getContextForTask, inferTaskCategory } = await import("./context-retriever-Y7FS4RCN.js");
+      const { getContextForTask, inferTaskCategory } = await import("./context-retriever-QAZWTGAT.js");
       const ctx = await getContextForTask({
         task: task.content,
         category: inferTaskCategory(task.content),
@@ -16709,4 +16709,4 @@ export {
   AgentCapability,
   OrchestratorError
 };
-//# sourceMappingURL=chunk-TKI4VCS6.js.map
+//# sourceMappingURL=chunk-IDLQNS5U.js.map

package/dist/{chunk-SD42OJST.js → chunk-IIJSUNEK.js}

@@ -1,6 +1,6 @@
 import {
   readOpenAICompatEnv
-} from "./chunk-3CU6PDLQ.js";
+} from "./chunk-LYI5GXON.js";
 import {
   allOf
 } from "./chunk-OQB3XC5O.js";
@@ -10,7 +10,7 @@ import {
 import {
   createAllAdapters,
   probeCli
-} from "./chunk-3WKO7D53.js";
+} from "./chunk-C67BIG35.js";
 import {
   getNexusTmpDir
 } from "./chunk-RQV5ZUXT.js";
@@ -25,7 +25,7 @@ import {
   ok,
   symbols,
   writeLine
-} from "./chunk-TKI4VCS6.js";
+} from "./chunk-IDLQNS5U.js";
 import {
   getLearningDir,
   getOutcomesFile,
@@ -170,7 +170,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 
 // src/version.ts
-var VERSION = true ? "4.20.0" : "dev";
+var VERSION = true ? "4.22.0" : "dev";
 
 // src/mcp/task-store.ts
 import { InMemoryTaskStore } from "@modelcontextprotocol/sdk/experimental/tasks";
@@ -1201,13 +1201,13 @@ async function runDoctorFix(result) {
   writeLine2("\u2500".repeat(40));
   let fixCount = 0;
   if (!result.dataDirectory.rootExists || result.dataDirectory.subdirectories.some((d) => !d.exists || !d.writable)) {
-    const { initDataDirectories: initDataDirectories2, describeDataDirFix: describeDataDirFix2 } = await import("./setup-data-dir-4IBG3QPA.js");
+    const { initDataDirectories: initDataDirectories2, describeDataDirFix: describeDataDirFix2 } = await import("./setup-data-dir-HTZZ5FII.js");
     const outcome = describeDataDirFix2(initDataDirectories2());
     writeLine2(outcome.line);
     if (outcome.counted) fixCount++;
   }
   if (!result.configFile.found) {
-    const { runConfigInitSync } = await import("./setup-config-N6WDWBUU.js");
+    const { runConfigInitSync } = await import("./setup-config-26GAKOC3.js");
     const configResult = runConfigInitSync(process.cwd(), false, false);
     if (configResult.success && configResult.created) {
       writeLine2(`\u2713 Generated config: ${configResult.path}`);
@@ -1304,4 +1304,4 @@ export {
   startStdioServer,
   closeServer
 };
-//# sourceMappingURL=chunk-SD42OJST.js.map
+//# sourceMappingURL=chunk-IIJSUNEK.js.map

package/dist/{chunk-EQG2GVM7.js → chunk-JJC5YKBH.js}

@@ -1,6 +1,6 @@
 import {
   emitClawGuardViolation
-} from "./chunk-Q2VYGOSY.js";
+} from "./chunk-NF7GW4QQ.js";
 import {
   CACHE_TIMEOUTS,
   MCP_TIMEOUTS,
@@ -16,7 +16,7 @@ import {
   getTimeProvider,
   ok,
   resolveToolClassGuardMs
-} from "./chunk-TKI4VCS6.js";
+} from "./chunk-IDLQNS5U.js";
 import {
   getNexusDataDir
 } from "./chunk-NBMWONHE.js";
@@ -719,6 +719,26 @@ function logSanitizationResult(result, logger, toolName) {
   }
 }
 
+// src/mcp/middleware/policy-registry.ts
+var globalPolicyFirewall;
+function getGlobalPolicyFirewall() {
+  return globalPolicyFirewall;
+}
+function setGlobalPolicyFirewall(firewall) {
+  globalPolicyFirewall = firewall;
+}
+function stagePolicyFirewallForRollout(firewall, logger) {
+  const configuredMode = firewall.getMode();
+  if (configuredMode !== "warn") {
+    firewall.setMode("warn");
+  }
+  logger.info("MCP policy firewall wired in warn mode \u2014 denials are logged, not applied", {
+    configuredMode,
+    ruleCount: firewall.getRules().length
+  });
+  return firewall;
+}
+
 // src/mcp/middleware/secure-handler.ts
 function rateLimitError(nextTokenMs) {
   return toolStructuredError({
@@ -804,6 +824,23 @@ function checkPolicy(opts) {
   opts.logger.debug("Policy check passed", { reason: decision.reason });
   return null;
 }
+function runPolicyCheck(config, sanitizedArgs, mode, logger, requestContext) {
+  const firewall = config.policyFirewall ?? getGlobalPolicyFirewall();
+  if (!firewall) return null;
+  const pResult = checkPolicy({
+    firewall,
+    toolName: config.toolName,
+    args: sanitizedArgs,
+    mode,
+    allowedPaths: config.allowedPaths,
+    logger,
+    requestId: requestContext.requestId
+  });
+  if (pResult && config.auditLogger) {
+    emitPolicyAudit(config.auditLogger, config.toolName, requestContext, "policy denied");
+  }
+  return pResult;
+}
 async function executeHandler(handler, args, ctx, logger) {
   const startTime = getTimeProvider().now();
   const result = handler.length >= 2 ? await handler(args, ctx) : await handler(args);
@@ -887,22 +924,8 @@ function runPreChecks(config, args, mode, requestContext, logger) {
       return { error: rlResult, sanitizedArgs };
     }
   }
-  if (config.policyFirewall) {
-    const pResult = checkPolicy({
-      firewall: config.policyFirewall,
-      toolName: config.toolName,
-      args: sanitizedArgs,
-      mode,
-      allowedPaths: config.allowedPaths,
-      logger,
-      requestId: requestContext.requestId
-    });
-    if (pResult) {
-      if (config.auditLogger)
-        emitPolicyAudit(config.auditLogger, config.toolName, requestContext, "policy denied");
-      return { error: pResult, sanitizedArgs };
-    }
-  }
+  const pResult = runPolicyCheck(config, sanitizedArgs, mode, logger, requestContext);
+  if (pResult) return { error: pResult, sanitizedArgs };
   return { error: null, sanitizedArgs };
 }
 function createSecureHandler(handler, config) {
@@ -2014,6 +2037,8 @@ export {
   toolSuccessStructured,
   toolStructuredError,
   toolError,
+  setGlobalPolicyFirewall,
+  stagePolicyFirewallForRollout,
   createSecureHandler,
   createMcpNotifier,
   NOOP_NOTIFIER,
@@ -2042,4 +2067,4 @@ export {
   VOTING_THRESHOLDS,
   ConsensusMetricsSchema
 };
-//# sourceMappingURL=chunk-EQG2GVM7.js.map
+//# sourceMappingURL=chunk-JJC5YKBH.js.map