nexus-agents 4.21.0 → 4.22.1

package/dist/{chunk-HSTJBWEB.js → chunk-CMXVOO4L.js}

@@ -170,7 +170,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 
 // src/version.ts
-var VERSION = true ? "4.21.0" : "dev";
+var VERSION = true ? "4.22.1" : "dev";
 
 // src/mcp/task-store.ts
 import { InMemoryTaskStore } from "@modelcontextprotocol/sdk/experimental/tasks";
@@ -1201,7 +1201,7 @@ async function runDoctorFix(result) {
   writeLine2("\u2500".repeat(40));
   let fixCount = 0;
   if (!result.dataDirectory.rootExists || result.dataDirectory.subdirectories.some((d) => !d.exists || !d.writable)) {
-    const { initDataDirectories: initDataDirectories2, describeDataDirFix: describeDataDirFix2 } = await import("./setup-data-dir-II6YK33Z.js");
+    const { initDataDirectories: initDataDirectories2, describeDataDirFix: describeDataDirFix2 } = await import("./setup-data-dir-BKIKRQCE.js");
     const outcome = describeDataDirFix2(initDataDirectories2());
     writeLine2(outcome.line);
     if (outcome.counted) fixCount++;
@@ -1304,4 +1304,4 @@ export {
   startStdioServer,
   closeServer
 };
-//# sourceMappingURL=chunk-HSTJBWEB.js.map
+//# sourceMappingURL=chunk-CMXVOO4L.js.map

package/dist/{chunk-WRJGJNPL.js → chunk-G2USF7DN.js}

@@ -22,7 +22,7 @@ import {
   toolSuccess,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-F6ZTTBI3.js";
+} from "./chunk-JJC5YKBH.js";
 import {
   assessPanelIndependence,
   countDistinctModels,
@@ -6749,4 +6749,4 @@ export {
   CONSENSUS_VOTE_TOOL_SCHEMA,
   registerConsensusVoteTool
 };
-//# sourceMappingURL=chunk-WRJGJNPL.js.map
+//# sourceMappingURL=chunk-G2USF7DN.js.map

package/dist/{chunk-F6ZTTBI3.js → chunk-JJC5YKBH.js}

@@ -719,6 +719,26 @@ function logSanitizationResult(result, logger, toolName) {
   }
 }
 
+// src/mcp/middleware/policy-registry.ts
+var globalPolicyFirewall;
+function getGlobalPolicyFirewall() {
+  return globalPolicyFirewall;
+}
+function setGlobalPolicyFirewall(firewall) {
+  globalPolicyFirewall = firewall;
+}
+function stagePolicyFirewallForRollout(firewall, logger) {
+  const configuredMode = firewall.getMode();
+  if (configuredMode !== "warn") {
+    firewall.setMode("warn");
+  }
+  logger.info("MCP policy firewall wired in warn mode \u2014 denials are logged, not applied", {
+    configuredMode,
+    ruleCount: firewall.getRules().length
+  });
+  return firewall;
+}
+
 // src/mcp/middleware/secure-handler.ts
 function rateLimitError(nextTokenMs) {
   return toolStructuredError({
@@ -804,6 +824,23 @@ function checkPolicy(opts) {
   opts.logger.debug("Policy check passed", { reason: decision.reason });
   return null;
 }
+function runPolicyCheck(config, sanitizedArgs, mode, logger, requestContext) {
+  const firewall = config.policyFirewall ?? getGlobalPolicyFirewall();
+  if (!firewall) return null;
+  const pResult = checkPolicy({
+    firewall,
+    toolName: config.toolName,
+    args: sanitizedArgs,
+    mode,
+    allowedPaths: config.allowedPaths,
+    logger,
+    requestId: requestContext.requestId
+  });
+  if (pResult && config.auditLogger) {
+    emitPolicyAudit(config.auditLogger, config.toolName, requestContext, "policy denied");
+  }
+  return pResult;
+}
 async function executeHandler(handler, args, ctx, logger) {
   const startTime = getTimeProvider().now();
   const result = handler.length >= 2 ? await handler(args, ctx) : await handler(args);
@@ -887,22 +924,8 @@ function runPreChecks(config, args, mode, requestContext, logger) {
       return { error: rlResult, sanitizedArgs };
     }
   }
-  if (config.policyFirewall) {
-    const pResult = checkPolicy({
-      firewall: config.policyFirewall,
-      toolName: config.toolName,
-      args: sanitizedArgs,
-      mode,
-      allowedPaths: config.allowedPaths,
-      logger,
-      requestId: requestContext.requestId
-    });
-    if (pResult) {
-      if (config.auditLogger)
-        emitPolicyAudit(config.auditLogger, config.toolName, requestContext, "policy denied");
-      return { error: pResult, sanitizedArgs };
-    }
-  }
+  const pResult = runPolicyCheck(config, sanitizedArgs, mode, logger, requestContext);
+  if (pResult) return { error: pResult, sanitizedArgs };
   return { error: null, sanitizedArgs };
 }
 function createSecureHandler(handler, config) {
@@ -2014,6 +2037,8 @@ export {
   toolSuccessStructured,
   toolStructuredError,
   toolError,
+  setGlobalPolicyFirewall,
+  stagePolicyFirewallForRollout,
   createSecureHandler,
   createMcpNotifier,
   NOOP_NOTIFIER,
@@ -2042,4 +2067,4 @@ export {
   VOTING_THRESHOLDS,
   ConsensusMetricsSchema
 };
-//# sourceMappingURL=chunk-F6ZTTBI3.js.map
+//# sourceMappingURL=chunk-JJC5YKBH.js.map