nexus-agents 4.26.4 → 4.26.6

package/dist/{chunk-IXB3OLF6.js → chunk-ZE7QW5Z5.js}

@@ -1,14 +1,14 @@
 import {
   GitHubProvider,
   ScmError
-} from "./chunk-HIYOKVK6.js";
+} from "./chunk-PSZVTY77.js";
 import {
   resolveToken
-} from "./chunk-LKIC6CLQ.js";
+} from "./chunk-V353Q4L7.js";
 import {
   err,
   ok
-} from "./chunk-25U6VL2C.js";
+} from "./chunk-6Q4XUAE5.js";
 
 // src/scm/factory.ts
 async function createScmProvider(config) {
@@ -41,4 +41,4 @@ export {
   createScmProvider,
   createGitHubProvider
 };
-//# sourceMappingURL=chunk-IXB3OLF6.js.map
+//# sourceMappingURL=chunk-ZE7QW5Z5.js.map

package/dist/{cli-circuit-breaker-W75JE3I7.js → cli-circuit-breaker-MROWSOJ4.js}

@@ -3,8 +3,8 @@ import {
   createCliCircuitBreakerIntegration,
   getCliCircuitBreakerSnapshot,
   getDefaultCliCircuitBreakerRegistry
-} from "./chunk-NWUKB3CV.js";
-import "./chunk-25U6VL2C.js";
+} from "./chunk-Q245FDK6.js";
+import "./chunk-6Q4XUAE5.js";
 import "./chunk-GBHJ37V3.js";
 import "./chunk-OGHEKPLD.js";
 import "./chunk-ZPWHCABL.js";
@@ -14,4 +14,4 @@ export {
   getCliCircuitBreakerSnapshot,
   getDefaultCliCircuitBreakerRegistry
 };
-//# sourceMappingURL=cli-circuit-breaker-W75JE3I7.js.map
+//# sourceMappingURL=cli-circuit-breaker-MROWSOJ4.js.map

package/dist/cli.js

@@ -18,11 +18,11 @@ import {
   generateSummary,
   parseFindings,
   sumFindings
-} from "./chunk-QSZX2ZGH.js";
-import "./chunk-JEDX4UFN.js";
+} from "./chunk-45XIFAM3.js";
+import "./chunk-DETBD53N.js";
 import {
   runConfigInitSync
-} from "./chunk-AF2XUJGO.js";
+} from "./chunk-NHABZOSO.js";
 import {
   AuthHandler,
   CustomExpertDefinitionSchema,
@@ -152,8 +152,8 @@ import {
   validateNexusEnv,
   validateWorkflow,
   wrapInMarkdownFence
-} from "./chunk-HFYYTIO4.js";
-import "./chunk-XCW36OFH.js";
+} from "./chunk-3HVT3RY4.js";
+import "./chunk-QFO77VBC.js";
 import "./chunk-HFOQKCD2.js";
 import "./chunk-RSMG2DPB.js";
 import {
@@ -171,14 +171,14 @@ import {
   doctorCommand,
   initDataDirectories,
   runDoctor
-} from "./chunk-ILA3PMNY.js";
+} from "./chunk-GVD6K5FS.js";
 import {
   buildOpenAICompatAdapters,
   readOpenAICompatEnv
-} from "./chunk-QGCPZD5I.js";
+} from "./chunk-VCM2NHH7.js";
 import {
   shutdownExpertBridge
-} from "./chunk-OO6CO7TF.js";
+} from "./chunk-XEGZYUPX.js";
 import {
   ConsensusVoteInputSchema,
   DEFAULT_VOTE_TIMEOUT_MS,
@@ -189,29 +189,29 @@ import {
   mapOutcomeToDecision,
   recordAuthenticVote,
   registerConsensusVoteTool
-} from "./chunk-X3KWL3P3.js";
+} from "./chunk-XCJW3MZC.js";
 import {
   loadUsageEvents,
   rollupByModel
-} from "./chunk-PUTZRPWH.js";
+} from "./chunk-NAL4EHFM.js";
 import {
   allOf,
   anyOf
 } from "./chunk-OQB3XC5O.js";
 import {
   synthesizeResearch
-} from "./chunk-SBMWUJ2C.js";
+} from "./chunk-I6JRNQ6S.js";
 import {
   classifyTrust,
   createFullGitHubProvider,
   evaluatePolicy,
   parsePRUrl
-} from "./chunk-HTCNLQRG.js";
-import "./chunk-HIYOKVK6.js";
+} from "./chunk-FQQOROWP.js";
+import "./chunk-PSZVTY77.js";
 import {
   ReputationCache,
   sanitizeInput
-} from "./chunk-34SWU4YI.js";
+} from "./chunk-UBWHBW7S.js";
 import {
   ImprovementReviewInputSchema,
   calculateFitnessScore,
@@ -225,20 +225,20 @@ import {
   registerImprovementReviewTool,
   runImprovementReview,
   scanForSecrets
-} from "./chunk-UIO2JU6C.js";
+} from "./chunk-FOEWSYSN.js";
 import {
   createDefaultPolicyFirewall,
   setGlobalPolicyFirewall,
   stagePolicyFirewallForRollout
-} from "./chunk-N22C2AYX.js";
+} from "./chunk-O3DWYQ4Y.js";
 import {
   VERSION
-} from "./chunk-434VMKQZ.js";
-import "./chunk-CTXFH2XP.js";
+} from "./chunk-64OC7AXT.js";
+import "./chunk-MJQVSJZB.js";
 import {
   createUnifiedRegistry,
   getGlobalRegistry
-} from "./chunk-UTAK4MNO.js";
+} from "./chunk-N3SKF4YT.js";
 import {
   CodebaseIndexSchema,
   PaperStatusSchema,
@@ -264,24 +264,24 @@ import {
   loadSourcesRegistry,
   rankDiscoveredItems,
   saveSourcesRegistry
-} from "./chunk-OT56GRYX.js";
+} from "./chunk-B5LCD3AL.js";
 import {
   loadPapersRegistry,
   loadTechniquesRegistry,
   savePapersRegistry
-} from "./chunk-IHKJ3MKE.js";
+} from "./chunk-TB3QGUDW.js";
 import {
   resolveToken
-} from "./chunk-LKIC6CLQ.js";
+} from "./chunk-V353Q4L7.js";
 import {
   MemoryError,
   shutdownToolMemory
-} from "./chunk-WDXEUX3J.js";
+} from "./chunk-PU2NTY6U.js";
 import {
   capitalize,
   capitalizeKebab
 } from "./chunk-6T3EPABN.js";
-import "./chunk-EBIO5D7A.js";
+import "./chunk-N3NC2XCW.js";
 import {
   BUILT_IN_EXPERTS
 } from "./chunk-YPNQPT2F.js";
@@ -294,19 +294,19 @@ import {
   isRecord,
   probeAllClis,
   readSubprocessDepth
-} from "./chunk-ZND353OI.js";
-import "./chunk-R557Z7T2.js";
+} from "./chunk-IED5SFCF.js";
+import "./chunk-QUVWKVKU.js";
 import {
   DEFAULTS
-} from "./chunk-VX3RWQTI.js";
-import "./chunk-XKIDI5HO.js";
+} from "./chunk-2YI27D27.js";
+import "./chunk-2BTGJXVN.js";
 import {
   nexusMkdtempSync
 } from "./chunk-4OW67KT2.js";
-import "./chunk-VIRZFYWD.js";
+import "./chunk-X4DJYX63.js";
 import "./chunk-QZUG667L.js";
-import "./chunk-2DW2NDIG.js";
-import "./chunk-NWUKB3CV.js";
+import "./chunk-OBMDRABJ.js";
+import "./chunk-Q245FDK6.js";
 import {
   API_TIMEOUTS,
   AgentCapability,
@@ -383,7 +383,7 @@ import {
   validateTimeout,
   writeEmptyLine,
   writeLine
-} from "./chunk-25U6VL2C.js";
+} from "./chunk-6Q4XUAE5.js";
 import "./chunk-GBHJ37V3.js";
 import {
   applyPortableMode,
@@ -4422,7 +4422,7 @@ ${file.patch}
         violations: policyResult.violations
       });
     }
-    const { formatReviewComment: formatReviewComment2 } = await import("./pr-reviewer-helpers-XQLJH7KV.js");
+    const { formatReviewComment: formatReviewComment2 } = await import("./pr-reviewer-helpers-2ZWQ7PHT.js");
     const body = formatReviewComment2(result);
     const postResult = await provider.createReview(pr.prNumber, body, result.decision);
     if (!postResult.ok) {
@@ -19551,7 +19551,7 @@ function startImprovementReviewScheduler(options) {
   let running = false;
   const runOnce = async () => {
     try {
-      const { runImprovementReview: runImprovementReview2, ImprovementReviewInputSchema: ImprovementReviewInputSchema2 } = await import("./improvement-review-PMIXFB4B.js");
+      const { runImprovementReview: runImprovementReview2, ImprovementReviewInputSchema: ImprovementReviewInputSchema2 } = await import("./improvement-review-XUNTLWEJ.js");
       const input = ImprovementReviewInputSchema2.parse({ fileIssues });
       const result = await runImprovementReview2(input, { logger: logger22 });
       logger22.info("Scheduled improvement_review complete", {
@@ -20059,9 +20059,16 @@ function buildStandardDeps(ctx, toolName) {
     logger: ctx.logger,
     rateLimiter: ctx.rateLimiterFactory.getForTool(toolName),
     ...ctx.securityConfig !== void 0 && { security: ctx.securityConfig },
-    // #3710: only run_dev_pipeline consumes the durable auditLogger — thread it
-    // so its consensus→execute policy gate persists decisions to the shared chain.
-    ...toolName === "run_dev_pipeline" && ctx.auditLogger !== void 0 ? { auditLogger: ctx.auditLogger } : {}
+    // #3710 threaded this for `run_dev_pipeline` alone, because it was then the
+    // only tool consuming a durable auditLogger. #4987 changed that: the MCP
+    // `PolicyFirewall` now evaluates rules on EVERY tool, and
+    // `secure-handler.ts:261` emits the policy decision only `if (pResult &&
+    // config.auditLogger)`. Withholding the logger left that emit unreachable
+    // for the 38 tools registered through `standardHandler` — a policy denial
+    // on any of them could never reach the chain, in enforce mode or warn
+    // (#4991). Threading it does not emit anything on its own; it makes the
+    // existing emit reachable.
+    ...ctx.auditLogger !== void 0 ? { auditLogger: ctx.auditLogger } : {}
   };
 }
 function standardHandler(name, register) {
@@ -21617,7 +21624,7 @@ function adaptConfigToLibrary(config) {
 }
 function createBeliefPromoter() {
   return async (event) => {
-    const { getToolMemory } = await import("./tool-memory-RVDSUV4C.js");
+    const { getToolMemory } = await import("./tool-memory-RG6SNNZP.js");
     const tm = getToolMemory();
     await tm.recordBelief(
       `skill:${event.name}`,
@@ -22838,7 +22845,7 @@ async function handleResearchCommand(args) {
   }
 }
 async function handleRegistryCommand(args) {
-  const { registryCommand, isValidRegistrySubcommand, formatRegistryUsage } = await import("./registry-command-5HQAN2HK.js");
+  const { registryCommand, isValidRegistrySubcommand, formatRegistryUsage } = await import("./registry-command-3EM2YUYM.js");
   const subcommand = args.subcommand;
   if (!isValidRegistrySubcommand(subcommand)) {
     process.stdout.write(`${formatRegistryUsage()}
@@ -22886,12 +22893,12 @@ async function handleVerifyCommand(args) {
 async function handleDoctorCommand(args) {
   const exitCode = await doctorCommand({ fix: args.options.fix });
   if (args.options.deep) {
-    const { runDeepDiagnostics: runDeepDiagnostics2, formatDeepDiagnostics: formatDeepDiagnostics2 } = await import("./doctor-deep-LKKCVX7Q.js");
+    const { runDeepDiagnostics: runDeepDiagnostics2, formatDeepDiagnostics: formatDeepDiagnostics2 } = await import("./doctor-deep-HZR7I2MR.js");
     const diag = runDeepDiagnostics2();
     process.stdout.write(formatDeepDiagnostics2(diag) + "\n");
   }
   if (args.options.live) {
-    const { runLiveReadiness, formatLiveReadiness } = await import("./doctor-live-IK7NIKRD.js");
+    const { runLiveReadiness, formatLiveReadiness } = await import("./doctor-live-MFE4Z5FD.js");
     const report = await runLiveReadiness();
     process.stdout.write(formatLiveReadiness(report) + "\n");
     if (report.some((r) => r.levels.serves.status === "failed")) {
@@ -22944,7 +22951,7 @@ async function runInitPortableFlow(args) {
   return cliExit(result.success ? EXIT_CODES.SUCCESS : EXIT_CODES.SERVER_START_FAILED);
 }
 async function runInitOpencodeFlow(args) {
-  const { runInitOpencode } = await import("./init-opencode-5OAOBTRG.js");
+  const { runInitOpencode } = await import("./init-opencode-TCWUATHV.js");
   const opencodePath = args.options.opencode;
   if (opencodePath === void 0 || opencodePath === "") {
     process.stderr.write("Error: --opencode requires a path argument.\n");
@@ -22970,7 +22977,7 @@ async function runInitOpencodeFlow(args) {
   return cliExit(EXIT_CODES.SUCCESS);
 }
 async function renderOpencodeValidate(opencodePath) {
-  const { runOpencodeValidate } = await import("./init-opencode-5OAOBTRG.js");
+  const { runOpencodeValidate } = await import("./init-opencode-TCWUATHV.js");
   const result = await runOpencodeValidate(opencodePath);
   if (!result.ok) {
     process.stderr.write(`init --opencode --validate: ${result.reason ?? "failed"}
@@ -23009,7 +23016,7 @@ async function handleSetupCommandAsync(args) {
   return cliExitFromStatus(exitCode);
 }
 async function runCustomApiSetup(args) {
-  const { configureCustomApi } = await import("./setup-custom-api-G2MGHNZD.js");
+  const { configureCustomApi } = await import("./setup-custom-api-HPJTWKC5.js");
   const baseUrl = args.options.customApi;
   if (baseUrl === void 0) return EXIT_CODES.SERVER_START_FAILED;
   const input = {