nexus-agents 4.22.0 → 4.22.1

package/dist/cli.js

@@ -153,7 +153,7 @@ import {
   validateNexusEnv,
   validateWorkflow,
   wrapInMarkdownFence
-} from "./chunk-RNMJUIPI.js";
+} from "./chunk-UTJRTD7H.js";
 import "./chunk-VZHZFAYL.js";
 import "./chunk-HFOQKCD2.js";
 import "./chunk-RSMG2DPB.js";
@@ -173,7 +173,7 @@ import {
   doctorCommand,
   initDataDirectories,
   runDoctor
-} from "./chunk-IIJSUNEK.js";
+} from "./chunk-CMXVOO4L.js";
 import {
   buildOpenAICompatAdapters,
   readOpenAICompatEnv
@@ -21808,17 +21808,23 @@ function getAuthValues(config) {
   const method = configAuth?.method ?? process.env["NEXUS_AUTH_METHOD"] ?? "none";
   return { enabled, method };
 }
+function warnIfAuditDisabled(auditEnabled, logger22) {
+  if (auditEnabled) return;
+  logger22.warn(
+    "Audit logging is disabled \u2014 no tamper-evident event chain is being written. Set security.audit.enabled: true to enable it."
+  );
+}
 function logSecurityConfig(logger22, config) {
   const policyFirewall = createConfiguredPolicyFirewall(logger22, config);
   const authVals = getAuthValues(config);
   const policyVals = getPolicyValues(config);
   const rateLimitVals = getRateLimitValues(config);
+  const auditEnabled = config?.security?.audit?.enabled === true;
   logger22.info("Security configuration", {
     // #4888: named `configuredPolicyMode`, not `policyMode`. This runs at
-    // startup, before `stagePolicyFirewallForRollout` decides the mode that
-    // will actually apply — which is `warn` unless the operator opted in. A
-    // field called `policyMode` reading `enforce` here would claim an
-    // enforcement the staged rollout does not perform.
+    // startup, before `stagePolicyFirewallForRollout` forces the firewall to
+    // `warn` — the mode that actually applies. A field called `policyMode`
+    // reading `enforce` here would claim an enforcement that does not happen.
     configuredPolicyMode: policyVals.mode,
     defaultExecutionMode: policyVals.defaultExec,
     policyRuleCount: policyFirewall.getRules().length,
@@ -21826,8 +21832,15 @@ function logSecurityConfig(logger22, config) {
     authMethod: authVals.method,
     rateLimitEnabled: rateLimitVals.enabled,
     rateLimitRequestsPerMinute: rateLimitVals.rpm,
+    // #4990: audit was the only security control missing from this line, and
+    // `initializeAuditLogger` announces its absence at `debug` — dropped at the
+    // default level. So the tamper-evident chain the docs lead with could be
+    // off while the startup log confirmed four other controls and said nothing
+    // about this one, which reads as fine rather than absent.
+    auditEnabled,
     allowedPaths: config?.security?.allowedPaths ?? ["./"]
   });
+  warnIfAuditDisabled(auditEnabled, logger22);
   if (!authVals.enabled) {
     logger22.warn(
       "Authentication explicitly disabled \u2014 network-exposed endpoints are unprotected. Remove NEXUS_AUTH_ENABLED=false to re-enable."