nexus-agents 4.22.0 → 4.22.2

package/dist/cli.js

@@ -18,11 +18,11 @@ import {
   generateSummary,
   parseFindings,
   sumFindings
-} from "./chunk-26VBDXT7.js";
-import "./chunk-BZTFS7FN.js";
+} from "./chunk-BK3NHWSW.js";
+import "./chunk-JV6SMJMJ.js";
 import {
   runConfigInitSync
-} from "./chunk-QWTDGESS.js";
+} from "./chunk-FVUQY73A.js";
 import {
   AuthHandler,
   CustomExpertDefinitionSchema,
@@ -153,8 +153,8 @@ import {
   validateNexusEnv,
   validateWorkflow,
   wrapInMarkdownFence
-} from "./chunk-RNMJUIPI.js";
-import "./chunk-VZHZFAYL.js";
+} from "./chunk-BG2LQ5I2.js";
+import "./chunk-QRG7UR2F.js";
 import "./chunk-HFOQKCD2.js";
 import "./chunk-RSMG2DPB.js";
 import {
@@ -173,14 +173,14 @@ import {
   doctorCommand,
   initDataDirectories,
   runDoctor
-} from "./chunk-IIJSUNEK.js";
+} from "./chunk-JDWXD3YZ.js";
 import {
   buildOpenAICompatAdapters,
   readOpenAICompatEnv
-} from "./chunk-LYI5GXON.js";
+} from "./chunk-RE2GYZRK.js";
 import {
   shutdownExpertBridge
-} from "./chunk-KASC5XK7.js";
+} from "./chunk-PSXX2GBZ.js";
 import {
   ConsensusVoteInputSchema,
   DEFAULT_VOTE_TIMEOUT_MS,
@@ -191,29 +191,29 @@ import {
   mapOutcomeToDecision,
   recordAuthenticVote,
   registerConsensusVoteTool
-} from "./chunk-G2USF7DN.js";
+} from "./chunk-W2DYH4WL.js";
 import {
   loadUsageEvents,
   rollupByModel
-} from "./chunk-ZDLWHEFZ.js";
+} from "./chunk-TBXAEAKP.js";
 import {
   allOf,
   anyOf
 } from "./chunk-OQB3XC5O.js";
 import {
   synthesizeResearch
-} from "./chunk-S3EAMH4I.js";
+} from "./chunk-H7CV35LZ.js";
 import {
   classifyTrust,
   createFullGitHubProvider,
   evaluatePolicy,
   parsePRUrl
-} from "./chunk-MDVHI3PP.js";
-import "./chunk-Z6W6G35I.js";
+} from "./chunk-6U3LS57H.js";
+import "./chunk-KDUSLLZM.js";
 import {
   ReputationCache,
   sanitizeInput
-} from "./chunk-HWBUN7WP.js";
+} from "./chunk-GMJQ6QMZ.js";
 import {
   ImprovementReviewInputSchema,
   calculateFitnessScore,
@@ -227,17 +227,17 @@ import {
   registerImprovementReviewTool,
   runImprovementReview,
   scanForSecrets
-} from "./chunk-PT3QWCKF.js";
+} from "./chunk-MM7BINTV.js";
 import {
   createDefaultPolicyFirewall,
   setGlobalPolicyFirewall,
   stagePolicyFirewallForRollout
-} from "./chunk-JJC5YKBH.js";
-import "./chunk-NF7GW4QQ.js";
+} from "./chunk-D6ZTSN34.js";
+import "./chunk-X7MLVGJV.js";
 import {
   createUnifiedRegistry,
   getGlobalRegistry
-} from "./chunk-AQV5RKO7.js";
+} from "./chunk-V533P6BT.js";
 import {
   CodebaseIndexSchema,
   PaperStatusSchema,
@@ -263,24 +263,24 @@ import {
   loadSourcesRegistry,
   rankDiscoveredItems,
   saveSourcesRegistry
-} from "./chunk-3AAAEN6N.js";
+} from "./chunk-IK6JPHMX.js";
 import {
   loadPapersRegistry,
   loadTechniquesRegistry,
   savePapersRegistry
-} from "./chunk-7B5YTCHU.js";
+} from "./chunk-P422WQJM.js";
 import {
   resolveToken
-} from "./chunk-AJM6RCCB.js";
+} from "./chunk-XYWCZNFC.js";
 import {
   MemoryError,
   shutdownToolMemory
-} from "./chunk-HVCYICUX.js";
+} from "./chunk-EU7S5CDW.js";
 import {
   capitalize,
   capitalizeKebab
 } from "./chunk-6T3EPABN.js";
-import "./chunk-6MVRXQ6V.js";
+import "./chunk-DGLAEH7Y.js";
 import {
   BUILT_IN_EXPERTS
 } from "./chunk-YPNQPT2F.js";
@@ -293,19 +293,19 @@ import {
   isRecord,
   probeAllClis,
   readSubprocessDepth
-} from "./chunk-C67BIG35.js";
-import "./chunk-TV3L3GME.js";
+} from "./chunk-JM42KPWJ.js";
+import "./chunk-CBORIR4Y.js";
 import {
   DEFAULTS
-} from "./chunk-M4BAGHYQ.js";
-import "./chunk-2SXZIUEA.js";
+} from "./chunk-TMKBZG3W.js";
+import "./chunk-ICGYXBS6.js";
 import {
   nexusMkdtempSync
 } from "./chunk-RQV5ZUXT.js";
-import "./chunk-PAZLJC46.js";
+import "./chunk-RMTTKP4L.js";
 import "./chunk-QZUG667L.js";
-import "./chunk-MNPD6TMW.js";
-import "./chunk-BDEWOJL4.js";
+import "./chunk-MTGMOLRO.js";
+import "./chunk-SBLLJXJO.js";
 import {
   API_TIMEOUTS,
   AgentCapability,
@@ -382,7 +382,7 @@ import {
   validateTimeout,
   writeEmptyLine,
   writeLine
-} from "./chunk-IDLQNS5U.js";
+} from "./chunk-2SVIHHNJ.js";
 import "./chunk-HHLCAWAV.js";
 import {
   applyPortableMode,
@@ -4421,7 +4421,7 @@ ${file.patch}
         violations: policyResult.violations
       });
     }
-    const { formatReviewComment: formatReviewComment2 } = await import("./pr-reviewer-helpers-VKQR2T3Y.js");
+    const { formatReviewComment: formatReviewComment2 } = await import("./pr-reviewer-helpers-Q6GRH5PP.js");
     const body = formatReviewComment2(result);
     const postResult = await provider.createReview(pr.prNumber, body, result.decision);
     if (!postResult.ok) {
@@ -19553,7 +19553,7 @@ function startImprovementReviewScheduler(options) {
   let running = false;
   const runOnce = async () => {
     try {
-      const { runImprovementReview: runImprovementReview2, ImprovementReviewInputSchema: ImprovementReviewInputSchema2 } = await import("./improvement-review-W6HJIQLG.js");
+      const { runImprovementReview: runImprovementReview2, ImprovementReviewInputSchema: ImprovementReviewInputSchema2 } = await import("./improvement-review-DKCVIJSF.js");
       const input = ImprovementReviewInputSchema2.parse({ fileIssues });
       const result = await runImprovementReview2(input, { logger: logger22 });
       logger22.info("Scheduled improvement_review complete", {
@@ -21620,7 +21620,7 @@ function adaptConfigToLibrary(config) {
 }
 function createBeliefPromoter() {
   return async (event) => {
-    const { getToolMemory } = await import("./tool-memory-QCZKITSG.js");
+    const { getToolMemory } = await import("./tool-memory-LYKMCW7U.js");
     const tm = getToolMemory();
     await tm.recordBelief(
       `skill:${event.name}`,
@@ -21808,17 +21808,23 @@ function getAuthValues(config) {
   const method = configAuth?.method ?? process.env["NEXUS_AUTH_METHOD"] ?? "none";
   return { enabled, method };
 }
+function warnIfAuditDisabled(auditEnabled, logger22) {
+  if (auditEnabled) return;
+  logger22.warn(
+    "Audit logging is disabled \u2014 no tamper-evident event chain is being written. Set security.audit.enabled: true to enable it."
+  );
+}
 function logSecurityConfig(logger22, config) {
   const policyFirewall = createConfiguredPolicyFirewall(logger22, config);
   const authVals = getAuthValues(config);
   const policyVals = getPolicyValues(config);
   const rateLimitVals = getRateLimitValues(config);
+  const auditEnabled = config?.security?.audit?.enabled === true;
   logger22.info("Security configuration", {
     // #4888: named `configuredPolicyMode`, not `policyMode`. This runs at
-    // startup, before `stagePolicyFirewallForRollout` decides the mode that
-    // will actually apply — which is `warn` unless the operator opted in. A
-    // field called `policyMode` reading `enforce` here would claim an
-    // enforcement the staged rollout does not perform.
+    // startup, before `stagePolicyFirewallForRollout` forces the firewall to
+    // `warn` — the mode that actually applies. A field called `policyMode`
+    // reading `enforce` here would claim an enforcement that does not happen.
     configuredPolicyMode: policyVals.mode,
     defaultExecutionMode: policyVals.defaultExec,
     policyRuleCount: policyFirewall.getRules().length,
@@ -21826,8 +21832,15 @@ function logSecurityConfig(logger22, config) {
     authMethod: authVals.method,
     rateLimitEnabled: rateLimitVals.enabled,
     rateLimitRequestsPerMinute: rateLimitVals.rpm,
+    // #4990: audit was the only security control missing from this line, and
+    // `initializeAuditLogger` announces its absence at `debug` — dropped at the
+    // default level. So the tamper-evident chain the docs lead with could be
+    // off while the startup log confirmed four other controls and said nothing
+    // about this one, which reads as fine rather than absent.
+    auditEnabled,
     allowedPaths: config?.security?.allowedPaths ?? ["./"]
   });
+  warnIfAuditDisabled(auditEnabled, logger22);
   if (!authVals.enabled) {
     logger22.warn(
       "Authentication explicitly disabled \u2014 network-exposed endpoints are unprotected. Remove NEXUS_AUTH_ENABLED=false to re-enable."
@@ -22828,7 +22841,7 @@ async function handleResearchCommand(args) {
   }
 }
 async function handleRegistryCommand(args) {
-  const { registryCommand, isValidRegistrySubcommand, formatRegistryUsage } = await import("./registry-command-ALLKEWVO.js");
+  const { registryCommand, isValidRegistrySubcommand, formatRegistryUsage } = await import("./registry-command-BYRGRQ3I.js");
   const subcommand = args.subcommand;
   if (!isValidRegistrySubcommand(subcommand)) {
     process.stdout.write(`${formatRegistryUsage()}
@@ -22876,12 +22889,12 @@ async function handleVerifyCommand(args) {
 async function handleDoctorCommand(args) {
   const exitCode = await doctorCommand({ fix: args.options.fix });
   if (args.options.deep) {
-    const { runDeepDiagnostics: runDeepDiagnostics2, formatDeepDiagnostics: formatDeepDiagnostics2 } = await import("./doctor-deep-IWQUV5IH.js");
+    const { runDeepDiagnostics: runDeepDiagnostics2, formatDeepDiagnostics: formatDeepDiagnostics2 } = await import("./doctor-deep-MIQ5QYUL.js");
     const diag = runDeepDiagnostics2();
     process.stdout.write(formatDeepDiagnostics2(diag) + "\n");
   }
   if (args.options.live) {
-    const { runLiveReadiness, formatLiveReadiness } = await import("./doctor-live-MJSBAH5J.js");
+    const { runLiveReadiness, formatLiveReadiness } = await import("./doctor-live-IAERE7DO.js");
     const report = await runLiveReadiness();
     process.stdout.write(formatLiveReadiness(report) + "\n");
     if (report.some((r) => r.levels.serves.status === "failed")) {
@@ -22934,7 +22947,7 @@ async function runInitPortableFlow(args) {
   return cliExit(result.success ? EXIT_CODES.SUCCESS : EXIT_CODES.SERVER_START_FAILED);
 }
 async function runInitOpencodeFlow(args) {
-  const { runInitOpencode } = await import("./init-opencode-TCP3OSFK.js");
+  const { runInitOpencode } = await import("./init-opencode-CM2HL2PI.js");
   const opencodePath = args.options.opencode;
   if (opencodePath === void 0 || opencodePath === "") {
     process.stderr.write("Error: --opencode requires a path argument.\n");
@@ -22960,7 +22973,7 @@ async function runInitOpencodeFlow(args) {
   return cliExit(EXIT_CODES.SUCCESS);
 }
 async function renderOpencodeValidate(opencodePath) {
-  const { runOpencodeValidate } = await import("./init-opencode-TCP3OSFK.js");
+  const { runOpencodeValidate } = await import("./init-opencode-CM2HL2PI.js");
   const result = await runOpencodeValidate(opencodePath);
   if (!result.ok) {
     process.stderr.write(`init --opencode --validate: ${result.reason ?? "failed"}
@@ -22999,7 +23012,7 @@ async function handleSetupCommandAsync(args) {
   return cliExitFromStatus(exitCode);
 }
 async function runCustomApiSetup(args) {
-  const { configureCustomApi } = await import("./setup-custom-api-TKMWDJJW.js");
+  const { configureCustomApi } = await import("./setup-custom-api-OZ3QCQTJ.js");
   const baseUrl = args.options.customApi;
   if (baseUrl === void 0) return EXIT_CODES.SERVER_START_FAILED;
   const input = {