nexus-agents 4.20.0 → 4.22.0

package/dist/{chunk-2GSHMVVW.js → chunk-S3EAMH4I.js}

@@ -1,9 +1,9 @@
 import {
   loadPapersRegistry
-} from "./chunk-SWCDZHUY.js";
+} from "./chunk-7B5YTCHU.js";
 import {
   getErrorMessage
-} from "./chunk-TKI4VCS6.js";
+} from "./chunk-IDLQNS5U.js";
 
 // src/cli/research-helpers-synthesize.ts
 import { z } from "zod";
@@ -876,4 +876,4 @@ export {
   AttributedInsightSchema,
   synthesizeResearch
 };
-//# sourceMappingURL=chunk-2GSHMVVW.js.map
+//# sourceMappingURL=chunk-S3EAMH4I.js.map

package/dist/{chunk-R54L73RR.js → chunk-TV3L3GME.js}

@@ -13,7 +13,7 @@ import {
   lookupInTreeCapability,
   ok,
   resolveRetryAfterMs
-} from "./chunk-TKI4VCS6.js";
+} from "./chunk-IDLQNS5U.js";
 
 // src/config/model-parameter-support.ts
 function parseClaudeMajorMinor(bareId) {
@@ -834,4 +834,4 @@ export {
   DEFAULT_COLLECT_STREAM_MAX_CHUNKS,
   collectStream
 };
-//# sourceMappingURL=chunk-R54L73RR.js.map
+//# sourceMappingURL=chunk-TV3L3GME.js.map

package/dist/{chunk-2D3KX7MD.js → chunk-VZHZFAYL.js}

@@ -4,7 +4,7 @@ import {
 import {
   createLogger,
   getTimeProvider
-} from "./chunk-TKI4VCS6.js";
+} from "./chunk-IDLQNS5U.js";
 
 // src/mcp/tools/scanner-registry-fetcher.ts
 import { z } from "zod";
@@ -721,4 +721,4 @@ export {
   generateSecurityPlan,
   buildPlanFromAnalysis
 };
-//# sourceMappingURL=chunk-2D3KX7MD.js.map
+//# sourceMappingURL=chunk-VZHZFAYL.js.map

package/dist/{chunk-BNWYB6E6.js → chunk-Z6W6G35I.js}

@@ -4,7 +4,7 @@ import {
   err,
   getErrorMessage,
   ok
-} from "./chunk-TKI4VCS6.js";
+} from "./chunk-IDLQNS5U.js";
 
 // src/scm/types.ts
 var ScmError = class extends Error {
@@ -263,4 +263,4 @@ export {
   ScmError,
   GitHubProvider
 };
-//# sourceMappingURL=chunk-BNWYB6E6.js.map
+//# sourceMappingURL=chunk-Z6W6G35I.js.map

package/dist/{chunk-JUXLSC52.js → chunk-ZDLWHEFZ.js}

@@ -1,6 +1,6 @@
 import {
   getDefaultRegistry
-} from "./chunk-TKI4VCS6.js";
+} from "./chunk-IDLQNS5U.js";
 import {
   getNexusDataDir
 } from "./chunk-NBMWONHE.js";
@@ -128,4 +128,4 @@ export {
   loadUsageEvents,
   rollupByModel
 };
-//# sourceMappingURL=chunk-JUXLSC52.js.map
+//# sourceMappingURL=chunk-ZDLWHEFZ.js.map

package/dist/{cli-circuit-breaker-VX7YIXHE.js → cli-circuit-breaker-NSXLDTKZ.js}

@@ -3,8 +3,8 @@ import {
   createCliCircuitBreakerIntegration,
   getCliCircuitBreakerSnapshot,
   getDefaultCliCircuitBreakerRegistry
-} from "./chunk-2AAG45CT.js";
-import "./chunk-TKI4VCS6.js";
+} from "./chunk-BDEWOJL4.js";
+import "./chunk-IDLQNS5U.js";
 import "./chunk-HHLCAWAV.js";
 import "./chunk-NBMWONHE.js";
 import "./chunk-ZPWHCABL.js";
@@ -14,4 +14,4 @@ export {
   getCliCircuitBreakerSnapshot,
   getDefaultCliCircuitBreakerRegistry
 };
-//# sourceMappingURL=cli-circuit-breaker-VX7YIXHE.js.map
+//# sourceMappingURL=cli-circuit-breaker-NSXLDTKZ.js.map

package/dist/cli.js

@@ -18,11 +18,11 @@ import {
   generateSummary,
   parseFindings,
   sumFindings
-} from "./chunk-3WGAPD5L.js";
-import "./chunk-MMDJ4TU6.js";
+} from "./chunk-26VBDXT7.js";
+import "./chunk-BZTFS7FN.js";
 import {
   runConfigInitSync
-} from "./chunk-EB3NZFSA.js";
+} from "./chunk-QWTDGESS.js";
 import {
   AuthHandler,
   CustomExpertDefinitionSchema,
@@ -153,8 +153,8 @@ import {
   validateNexusEnv,
   validateWorkflow,
   wrapInMarkdownFence
-} from "./chunk-XB4XNBNK.js";
-import "./chunk-2D3KX7MD.js";
+} from "./chunk-RNMJUIPI.js";
+import "./chunk-VZHZFAYL.js";
 import "./chunk-HFOQKCD2.js";
 import "./chunk-RSMG2DPB.js";
 import {
@@ -173,14 +173,14 @@ import {
   doctorCommand,
   initDataDirectories,
   runDoctor
-} from "./chunk-SD42OJST.js";
+} from "./chunk-IIJSUNEK.js";
 import {
   buildOpenAICompatAdapters,
   readOpenAICompatEnv
-} from "./chunk-3CU6PDLQ.js";
+} from "./chunk-LYI5GXON.js";
 import {
   shutdownExpertBridge
-} from "./chunk-3VJ2MSUU.js";
+} from "./chunk-KASC5XK7.js";
 import {
   ConsensusVoteInputSchema,
   DEFAULT_VOTE_TIMEOUT_MS,
@@ -191,29 +191,29 @@ import {
   mapOutcomeToDecision,
   recordAuthenticVote,
   registerConsensusVoteTool
-} from "./chunk-LTS4MLEO.js";
+} from "./chunk-G2USF7DN.js";
 import {
   loadUsageEvents,
   rollupByModel
-} from "./chunk-JUXLSC52.js";
+} from "./chunk-ZDLWHEFZ.js";
 import {
   allOf,
   anyOf
 } from "./chunk-OQB3XC5O.js";
 import {
   synthesizeResearch
-} from "./chunk-2GSHMVVW.js";
+} from "./chunk-S3EAMH4I.js";
 import {
   classifyTrust,
   createFullGitHubProvider,
   evaluatePolicy,
   parsePRUrl
-} from "./chunk-FBR5GT7E.js";
-import "./chunk-BNWYB6E6.js";
+} from "./chunk-MDVHI3PP.js";
+import "./chunk-Z6W6G35I.js";
 import {
   ReputationCache,
   sanitizeInput
-} from "./chunk-MY33A5CO.js";
+} from "./chunk-HWBUN7WP.js";
 import {
   ImprovementReviewInputSchema,
   calculateFitnessScore,
@@ -227,15 +227,17 @@ import {
   registerImprovementReviewTool,
   runImprovementReview,
   scanForSecrets
-} from "./chunk-UGIA52M7.js";
+} from "./chunk-PT3QWCKF.js";
 import {
-  createDefaultPolicyFirewall
-} from "./chunk-EQG2GVM7.js";
-import "./chunk-Q2VYGOSY.js";
+  createDefaultPolicyFirewall,
+  setGlobalPolicyFirewall,
+  stagePolicyFirewallForRollout
+} from "./chunk-JJC5YKBH.js";
+import "./chunk-NF7GW4QQ.js";
 import {
   createUnifiedRegistry,
   getGlobalRegistry
-} from "./chunk-XOC6DP35.js";
+} from "./chunk-AQV5RKO7.js";
 import {
   CodebaseIndexSchema,
   PaperStatusSchema,
@@ -261,24 +263,24 @@ import {
   loadSourcesRegistry,
   rankDiscoveredItems,
   saveSourcesRegistry
-} from "./chunk-7CGVYJQS.js";
+} from "./chunk-3AAAEN6N.js";
 import {
   loadPapersRegistry,
   loadTechniquesRegistry,
   savePapersRegistry
-} from "./chunk-SWCDZHUY.js";
+} from "./chunk-7B5YTCHU.js";
 import {
   resolveToken
-} from "./chunk-AZMXXJ5X.js";
+} from "./chunk-AJM6RCCB.js";
 import {
   MemoryError,
   shutdownToolMemory
-} from "./chunk-EI3AC7X2.js";
+} from "./chunk-HVCYICUX.js";
 import {
   capitalize,
   capitalizeKebab
 } from "./chunk-6T3EPABN.js";
-import "./chunk-SHMGRIYH.js";
+import "./chunk-6MVRXQ6V.js";
 import {
   BUILT_IN_EXPERTS
 } from "./chunk-YPNQPT2F.js";
@@ -291,19 +293,19 @@ import {
   isRecord,
   probeAllClis,
   readSubprocessDepth
-} from "./chunk-3WKO7D53.js";
-import "./chunk-R54L73RR.js";
+} from "./chunk-C67BIG35.js";
+import "./chunk-TV3L3GME.js";
 import {
   DEFAULTS
-} from "./chunk-SPU2PTV7.js";
-import "./chunk-JKWBSEL3.js";
+} from "./chunk-M4BAGHYQ.js";
+import "./chunk-2SXZIUEA.js";
 import {
   nexusMkdtempSync
 } from "./chunk-RQV5ZUXT.js";
-import "./chunk-5HGWH5WI.js";
+import "./chunk-PAZLJC46.js";
 import "./chunk-QZUG667L.js";
-import "./chunk-HBTUFRGO.js";
-import "./chunk-2AAG45CT.js";
+import "./chunk-MNPD6TMW.js";
+import "./chunk-BDEWOJL4.js";
 import {
   API_TIMEOUTS,
   AgentCapability,
@@ -380,7 +382,7 @@ import {
   validateTimeout,
   writeEmptyLine,
   writeLine
-} from "./chunk-TKI4VCS6.js";
+} from "./chunk-IDLQNS5U.js";
 import "./chunk-HHLCAWAV.js";
 import {
   applyPortableMode,
@@ -4419,7 +4421,7 @@ ${file.patch}
         violations: policyResult.violations
       });
     }
-    const { formatReviewComment: formatReviewComment2 } = await import("./pr-reviewer-helpers-JTONAPBK.js");
+    const { formatReviewComment: formatReviewComment2 } = await import("./pr-reviewer-helpers-VKQR2T3Y.js");
     const body = formatReviewComment2(result);
     const postResult = await provider.createReview(pr.prNumber, body, result.decision);
     if (!postResult.ok) {
@@ -19551,7 +19553,7 @@ function startImprovementReviewScheduler(options) {
   let running = false;
   const runOnce = async () => {
     try {
-      const { runImprovementReview: runImprovementReview2, ImprovementReviewInputSchema: ImprovementReviewInputSchema2 } = await import("./improvement-review-XPIA6KDL.js");
+      const { runImprovementReview: runImprovementReview2, ImprovementReviewInputSchema: ImprovementReviewInputSchema2 } = await import("./improvement-review-W6HJIQLG.js");
       const input = ImprovementReviewInputSchema2.parse({ fileIssues });
       const result = await runImprovementReview2(input, { logger: logger22 });
       logger22.info("Scheduled improvement_review complete", {
@@ -20045,10 +20047,13 @@ function logToolRegistration(logger22, allowlist, info) {
     executionMode: info.executionMode ?? "read-only"
   });
   if (info.policyFirewall !== void 0) {
-    logger22.warn(
-      "PolicyFirewall is configured but not wired to any tool \u2014 no policy middleware runs",
-      { configuredMode: info.policyFirewall.getMode() }
-    );
+    const mode = info.policyFirewall.getMode();
+    logger22.info("Policy firewall wired to locally registered tools", {
+      policyMode: mode,
+      denialsApplied: mode === "enforce",
+      coveredTools: activeTools.length,
+      upstreamProxiesUncovered: true
+    });
   }
 }
 function buildStandardDeps(ctx, toolName) {
@@ -20210,6 +20215,9 @@ function registerMcpTools(options) {
     logger: toolInfra.logger
   });
   setGlobalToolRateLimiterFactory(rateLimiterFactory);
+  if (policyFirewall !== void 0) {
+    setGlobalPolicyFirewall(stagePolicyFirewallForRollout(policyFirewall, logger22));
+  }
   initV2PipelineSubsystems(logger22, options.auditLogger);
   const gatewayOptions = { ...options, server: observableServer };
   const ctx = createToolContext(gatewayOptions, toolInfra, rateLimiterFactory);
@@ -21612,7 +21620,7 @@ function adaptConfigToLibrary(config) {
 }
 function createBeliefPromoter() {
   return async (event) => {
-    const { getToolMemory } = await import("./tool-memory-QIOKTGQT.js");
+    const { getToolMemory } = await import("./tool-memory-QCZKITSG.js");
     const tm = getToolMemory();
     await tm.recordBelief(
       `skill:${event.name}`,
@@ -21806,7 +21814,12 @@ function logSecurityConfig(logger22, config) {
   const policyVals = getPolicyValues(config);
   const rateLimitVals = getRateLimitValues(config);
   logger22.info("Security configuration", {
-    policyMode: policyVals.mode,
+    // #4888: named `configuredPolicyMode`, not `policyMode`. This runs at
+    // startup, before `stagePolicyFirewallForRollout` decides the mode that
+    // will actually apply — which is `warn` unless the operator opted in. A
+    // field called `policyMode` reading `enforce` here would claim an
+    // enforcement the staged rollout does not perform.
+    configuredPolicyMode: policyVals.mode,
     defaultExecutionMode: policyVals.defaultExec,
     policyRuleCount: policyFirewall.getRules().length,
     authEnabled: authVals.enabled,
@@ -22815,7 +22828,7 @@ async function handleResearchCommand(args) {
   }
 }
 async function handleRegistryCommand(args) {
-  const { registryCommand, isValidRegistrySubcommand, formatRegistryUsage } = await import("./registry-command-NFR5FYUP.js");
+  const { registryCommand, isValidRegistrySubcommand, formatRegistryUsage } = await import("./registry-command-ALLKEWVO.js");
   const subcommand = args.subcommand;
   if (!isValidRegistrySubcommand(subcommand)) {
     process.stdout.write(`${formatRegistryUsage()}
@@ -22863,12 +22876,12 @@ async function handleVerifyCommand(args) {
 async function handleDoctorCommand(args) {
   const exitCode = await doctorCommand({ fix: args.options.fix });
   if (args.options.deep) {
-    const { runDeepDiagnostics: runDeepDiagnostics2, formatDeepDiagnostics: formatDeepDiagnostics2 } = await import("./doctor-deep-FHMLBUAO.js");
+    const { runDeepDiagnostics: runDeepDiagnostics2, formatDeepDiagnostics: formatDeepDiagnostics2 } = await import("./doctor-deep-IWQUV5IH.js");
     const diag = runDeepDiagnostics2();
     process.stdout.write(formatDeepDiagnostics2(diag) + "\n");
   }
   if (args.options.live) {
-    const { runLiveReadiness, formatLiveReadiness } = await import("./doctor-live-H2CSOEWT.js");
+    const { runLiveReadiness, formatLiveReadiness } = await import("./doctor-live-MJSBAH5J.js");
     const report = await runLiveReadiness();
     process.stdout.write(formatLiveReadiness(report) + "\n");
     if (report.some((r) => r.levels.serves.status === "failed")) {
@@ -22921,7 +22934,7 @@ async function runInitPortableFlow(args) {
   return cliExit(result.success ? EXIT_CODES.SUCCESS : EXIT_CODES.SERVER_START_FAILED);
 }
 async function runInitOpencodeFlow(args) {
-  const { runInitOpencode } = await import("./init-opencode-RMQHV22F.js");
+  const { runInitOpencode } = await import("./init-opencode-TCP3OSFK.js");
   const opencodePath = args.options.opencode;
   if (opencodePath === void 0 || opencodePath === "") {
     process.stderr.write("Error: --opencode requires a path argument.\n");
@@ -22947,7 +22960,7 @@ async function runInitOpencodeFlow(args) {
   return cliExit(EXIT_CODES.SUCCESS);
 }
 async function renderOpencodeValidate(opencodePath) {
-  const { runOpencodeValidate } = await import("./init-opencode-RMQHV22F.js");
+  const { runOpencodeValidate } = await import("./init-opencode-TCP3OSFK.js");
   const result = await runOpencodeValidate(opencodePath);
   if (!result.ok) {
     process.stderr.write(`init --opencode --validate: ${result.reason ?? "failed"}
@@ -22986,7 +22999,7 @@ async function handleSetupCommandAsync(args) {
   return cliExitFromStatus(exitCode);
 }
 async function runCustomApiSetup(args) {
-  const { configureCustomApi } = await import("./setup-custom-api-LRRWPNLL.js");
+  const { configureCustomApi } = await import("./setup-custom-api-TKMWDJJW.js");
   const baseUrl = args.options.customApi;
   if (baseUrl === void 0) return EXIT_CODES.SERVER_START_FAILED;
   const input = {