nexus-agents 4.26.5 → 4.26.7

package/dist/{chunk-G63PWIMA.js → chunk-B5LCD3AL.js}

@@ -5,13 +5,13 @@ import {
   loadTechniquesRegistry,
   resolveInsideRoot,
   savePapersRegistry
-} from "./chunk-Y5QSPX6V.js";
+} from "./chunk-TB3QGUDW.js";
 import {
   resolveToken
-} from "./chunk-CCQG5CLO.js";
+} from "./chunk-V353Q4L7.js";
 import {
   getToolMemory
-} from "./chunk-7CEIKID3.js";
+} from "./chunk-PU2NTY6U.js";
 import {
   capitalizeWords,
   tokenizeFiltered,
@@ -37,7 +37,7 @@ import {
   getTimeProvider,
   ok,
   registerPersistentDistillerFactory
-} from "./chunk-H7ERWFBU.js";
+} from "./chunk-6Q4XUAE5.js";
 import {
   ensureLearningDir,
   getRulesFile
@@ -4132,4 +4132,4 @@ export {
   DEFAULT_CONTEXT_BUDGET_TOKENS,
   getContextPromptPrefix
 };
-//# sourceMappingURL=chunk-G63PWIMA.js.map
+//# sourceMappingURL=chunk-B5LCD3AL.js.map

package/dist/{chunk-RDSC7H4M.js → chunk-DETBD53N.js}

@@ -2,7 +2,7 @@ import {
   TASK_CATEGORIES,
   getAdaptiveBonus,
   getOutcomeStore
-} from "./chunk-H7ERWFBU.js";
+} from "./chunk-6Q4XUAE5.js";
 
 // src/cli/doctor-deep.ts
 var CLI_NAMES = ["claude", "gemini", "codex", "opencode"];
@@ -106,4 +106,4 @@ export {
   runDeepDiagnostics,
   formatDeepDiagnostics
 };
-//# sourceMappingURL=chunk-RDSC7H4M.js.map
+//# sourceMappingURL=chunk-DETBD53N.js.map

package/dist/{chunk-SXJAOQAV.js → chunk-DJWIO7OX.js}

@@ -1,19 +1,19 @@
 import {
   readOpenAICompatEnv
-} from "./chunk-43YTWIE7.js";
+} from "./chunk-VCM2NHH7.js";
 import {
   allOf
 } from "./chunk-OQB3XC5O.js";
 import {
   VERSION
-} from "./chunk-TVRGBIMW.js";
+} from "./chunk-VK42NFA3.js";
 import {
   capitalize
 } from "./chunk-6T3EPABN.js";
 import {
   createAllAdapters,
   probeCli
-} from "./chunk-SVYZX4AY.js";
+} from "./chunk-IED5SFCF.js";
 import {
   getNexusTmpDir
 } from "./chunk-4OW67KT2.js";
@@ -28,7 +28,7 @@ import {
   ok,
   symbols,
   writeLine
-} from "./chunk-H7ERWFBU.js";
+} from "./chunk-6Q4XUAE5.js";
 import {
   getLearningDir,
   getOutcomesFile,
@@ -1201,13 +1201,13 @@ async function runDoctorFix(result) {
   writeLine2("\u2500".repeat(40));
   let fixCount = 0;
   if (!result.dataDirectory.rootExists || result.dataDirectory.subdirectories.some((d) => !d.exists || !d.writable)) {
-    const { initDataDirectories: initDataDirectories2, describeDataDirFix: describeDataDirFix2 } = await import("./setup-data-dir-ET7UVBN6.js");
+    const { initDataDirectories: initDataDirectories2, describeDataDirFix: describeDataDirFix2 } = await import("./setup-data-dir-5PVWTCFL.js");
     const outcome = describeDataDirFix2(initDataDirectories2());
     writeLine2(outcome.line);
     if (outcome.counted) fixCount++;
   }
   if (!result.configFile.found) {
-    const { runConfigInitSync } = await import("./setup-config-SXTHNRE7.js");
+    const { runConfigInitSync } = await import("./setup-config-WC566QZ2.js");
     const configResult = runConfigInitSync(process.cwd(), false, false);
     if (configResult.success && configResult.created) {
       writeLine2(`\u2713 Generated config: ${configResult.path}`);
@@ -1303,4 +1303,4 @@ export {
   startStdioServer,
   closeServer
 };
-//# sourceMappingURL=chunk-SXJAOQAV.js.map
+//# sourceMappingURL=chunk-DJWIO7OX.js.map

package/dist/{chunk-X4MAMDN3.js → chunk-FQQOROWP.js}

@@ -1,7 +1,7 @@
 import {
   GitHubProvider,
   ScmError
-} from "./chunk-2RZSQMWZ.js";
+} from "./chunk-PSZVTY77.js";
 import {
   ROLE_DEFAULT_TRUST,
   ReputationCache,
@@ -11,20 +11,20 @@ import {
   gateWithReputation,
   resolveReputationGatingMode,
   sanitizeInput
-} from "./chunk-LC5QW4Q7.js";
+} from "./chunk-UBWHBW7S.js";
 import {
   emitPolicyEvent
-} from "./chunk-LZLYJBA6.js";
+} from "./chunk-MJQVSJZB.js";
 import {
   hasToken
-} from "./chunk-CCQG5CLO.js";
+} from "./chunk-V353Q4L7.js";
 import {
   CLI_SUBPROCESS_TIMEOUTS,
   createLogger,
   err,
   getTimeProvider,
   ok
-} from "./chunk-H7ERWFBU.js";
+} from "./chunk-6Q4XUAE5.js";
 
 // src/security/trust-classifier.ts
 function mapAuthorAssociation(association) {
@@ -1247,4 +1247,4 @@ export {
   IssueTriage,
   createIssueTriage
 };
-//# sourceMappingURL=chunk-X4MAMDN3.js.map
+//# sourceMappingURL=chunk-FQQOROWP.js.map

package/dist/{chunk-XZZJZM7R.js → chunk-I6JRNQ6S.js}

@@ -1,9 +1,9 @@
 import {
   loadPapersRegistry
-} from "./chunk-Y5QSPX6V.js";
+} from "./chunk-TB3QGUDW.js";
 import {
   getErrorMessage
-} from "./chunk-H7ERWFBU.js";
+} from "./chunk-6Q4XUAE5.js";
 
 // src/cli/research-helpers-synthesize.ts
 import { z } from "zod";
@@ -886,4 +886,4 @@ export {
   AttributedInsightSchema,
   synthesizeResearch
 };
-//# sourceMappingURL=chunk-XZZJZM7R.js.map
+//# sourceMappingURL=chunk-I6JRNQ6S.js.map

package/dist/{chunk-KCYHOYDW.js → chunk-ICJI6AIF.js}

@@ -7,7 +7,7 @@ import {
   toolStructuredError,
   toolSuccessStructured,
   wrapToolWithTimeout
-} from "./chunk-2I3LUNYC.js";
+} from "./chunk-TBKGR6GC.js";
 import {
   JsonlStore,
   SECURITY_KEYWORDS,
@@ -19,7 +19,7 @@ import {
   getPipelineEventBus,
   getTimeProvider,
   isDeclaredNeverDeprecate
-} from "./chunk-H7ERWFBU.js";
+} from "./chunk-6Q4XUAE5.js";
 import {
   getNexusDataDir,
   nexusDataPath
@@ -2132,4 +2132,4 @@ export {
   runImprovementReview,
   registerImprovementReviewTool
 };
-//# sourceMappingURL=chunk-KCYHOYDW.js.map
+//# sourceMappingURL=chunk-ICJI6AIF.js.map

package/dist/{chunk-SVYZX4AY.js → chunk-IED5SFCF.js}

@@ -5,34 +5,34 @@ import {
   planOptionalParams,
   requireApiKey,
   validateApiKeyPresence
-} from "./chunk-BVH72GYG.js";
+} from "./chunk-QUVWKVKU.js";
 import {
   CUSTOM_API_DEFAULT_MODEL
-} from "./chunk-54GGV2GR.js";
+} from "./chunk-2YI27D27.js";
 import {
   CUSTOM_API_BASE_URL_ENV,
   PROVIDER_ENV_KEYS,
   assertCustomApiHostResolvesPublic,
   validateCustomApiBaseUrl
-} from "./chunk-EIWR7MIQ.js";
+} from "./chunk-2BTGJXVN.js";
 import {
   nexusMkdtempSync
 } from "./chunk-4OW67KT2.js";
 import {
   getAvailabilityCache
-} from "./chunk-3BEI2ASZ.js";
+} from "./chunk-X4DJYX63.js";
 import {
   extractSystemPrompt
 } from "./chunk-QZUG667L.js";
 import {
   generateHyphenId
-} from "./chunk-SUIEUXHI.js";
+} from "./chunk-OBMDRABJ.js";
 import {
   CliCircuitBreaker,
   DEFAULT_CIRCUIT_BREAKER_CONFIG,
   getCliCircuitBreakerSnapshot,
   getDefaultCliCircuitBreakerRegistry
-} from "./chunk-CZBBYHG7.js";
+} from "./chunk-Q245FDK6.js";
 import {
   CLI_SUBPROCESS_TIMEOUTS,
   CLI_TIMEOUTS,
@@ -72,7 +72,7 @@ import {
   resolveCliAlias,
   resolveRetryAfterMs,
   retryAfterMsFromContext
-} from "./chunk-H7ERWFBU.js";
+} from "./chunk-6Q4XUAE5.js";
 
 // src/cli-adapters/cli-to-model-adapter.ts
 var CliToModelAdapter = class {
@@ -4903,4 +4903,4 @@ export {
   SdkAdapter,
   createAutoAdapter
 };
-//# sourceMappingURL=chunk-SVYZX4AY.js.map
+//# sourceMappingURL=chunk-IED5SFCF.js.map

package/dist/{chunk-K3EAAC4F.js → chunk-KHAB3HWK.js}

@@ -1,7 +1,7 @@
 import {
   computeCostDetail,
   priceBasisOf
-} from "./chunk-P3PTJNMD.js";
+} from "./chunk-NAL4EHFM.js";
 import {
   allOf
 } from "./chunk-OQB3XC5O.js";
@@ -23,22 +23,22 @@ import {
   toolSuccessStructured,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-2I3LUNYC.js";
+} from "./chunk-TBKGR6GC.js";
 import {
   assessPanelIndependence,
   countDistinctModels,
   createEvent,
   getGlobalRegistry
-} from "./chunk-OKTN5AP2.js";
+} from "./chunk-N3SKF4YT.js";
 import {
   getToolMemory
-} from "./chunk-7CEIKID3.js";
+} from "./chunk-PU2NTY6U.js";
 import {
   authRemediation,
   delay,
   getAvailableClis,
   withTimeout
-} from "./chunk-SVYZX4AY.js";
+} from "./chunk-IED5SFCF.js";
 import {
   AgentError,
   CLI_NAMES,
@@ -66,7 +66,7 @@ import {
   registerPersistentOutcomeStoreFactory,
   resolveClassGuardMs,
   resolveVoteTimeout
-} from "./chunk-H7ERWFBU.js";
+} from "./chunk-6Q4XUAE5.js";
 import {
   ensureLearningDir,
   getOutcomesFile
@@ -6199,7 +6199,7 @@ async function processVotesWithCascade(engineVotes, opts) {
 var CONTRARIAN_ESCALATION_THRESHOLD = 0.8;
 async function runContrarianCheck(proposal, log) {
   try {
-    const { executeExpert } = await import("./expert-bridge-HMDWC6FW.js");
+    const { executeExpert } = await import("./expert-bridge-V2O6X3DO.js");
     const prompt = [
       "You are a contrarian analyst. Your job is to find reasons this proposal should be REJECTED.",
       "Look for: YAGNI (not needed), MISALIGNED (wrong tech/architecture), SECURITY_RISK, SCOPE_CREEP.",
@@ -6779,4 +6779,4 @@ export {
   CONSENSUS_VOTE_TOOL_SCHEMA,
   registerConsensusVoteTool
 };
-//# sourceMappingURL=chunk-K3EAAC4F.js.map
+//# sourceMappingURL=chunk-KHAB3HWK.js.map

package/dist/{chunk-LZLYJBA6.js → chunk-MJQVSJZB.js}

@@ -1,6 +1,6 @@
 import {
   getTimeProvider
-} from "./chunk-H7ERWFBU.js";
+} from "./chunk-6Q4XUAE5.js";
 
 // src/security/audit-trail.ts
 var MAX_EVENTS = 1e4;
@@ -205,4 +205,4 @@ export {
   createGraphAuditBridge,
   createAuditTrail
 };
-//# sourceMappingURL=chunk-LZLYJBA6.js.map
+//# sourceMappingURL=chunk-MJQVSJZB.js.map

package/dist/{chunk-JITZV5JF.js → chunk-N3NC2XCW.js}

@@ -4,7 +4,7 @@ import {
   getErrorMessage,
   getTimeProvider,
   ok
-} from "./chunk-H7ERWFBU.js";
+} from "./chunk-6Q4XUAE5.js";
 
 // src/context/session-memory.ts
 import * as fs from "fs";
@@ -352,4 +352,4 @@ export {
   SessionMemory,
   createSessionMemory
 };
-//# sourceMappingURL=chunk-JITZV5JF.js.map
+//# sourceMappingURL=chunk-N3NC2XCW.js.map

package/dist/{chunk-OKTN5AP2.js → chunk-N3SKF4YT.js}

@@ -1,10 +1,10 @@
 import {
   createAutoAdapter
-} from "./chunk-SVYZX4AY.js";
+} from "./chunk-IED5SFCF.js";
 import {
   getDefaultCliCircuitBreakerRegistry,
   mapModelErrorToCategory
-} from "./chunk-CZBBYHG7.js";
+} from "./chunk-Q245FDK6.js";
 import {
   CLI_NAMES,
   CircularBuffer,
@@ -23,7 +23,7 @@ import {
   recordRateLimitEvent,
   resolveModelIdentitySync,
   toRateLimitError
-} from "./chunk-H7ERWFBU.js";
+} from "./chunk-6Q4XUAE5.js";
 
 // src/config/model-equivalence.ts
 function canonicalModelKey(modelId) {
@@ -895,4 +895,4 @@ export {
   getGlobalRegistry,
   resetGlobalRegistry
 };
-//# sourceMappingURL=chunk-OKTN5AP2.js.map
+//# sourceMappingURL=chunk-N3SKF4YT.js.map

package/dist/{chunk-P3PTJNMD.js → chunk-NAL4EHFM.js}

@@ -1,6 +1,6 @@
 import {
   getDefaultRegistry
-} from "./chunk-H7ERWFBU.js";
+} from "./chunk-6Q4XUAE5.js";
 import {
   getNexusDataDir
 } from "./chunk-OGHEKPLD.js";
@@ -128,4 +128,4 @@ export {
   loadUsageEvents,
   rollupByModel
 };
-//# sourceMappingURL=chunk-P3PTJNMD.js.map
+//# sourceMappingURL=chunk-NAL4EHFM.js.map

package/dist/{chunk-OHNTYNWU.js → chunk-NHABZOSO.js}

@@ -1,6 +1,6 @@
 import {
   getErrorMessage
-} from "./chunk-H7ERWFBU.js";
+} from "./chunk-6Q4XUAE5.js";
 
 // src/cli/setup-config.ts
 import { copyFileSync, existsSync, mkdirSync, writeFileSync } from "fs";
@@ -77,4 +77,4 @@ function ensureBackup(outputPath) {
 export {
   runConfigInitSync
 };
-//# sourceMappingURL=chunk-OHNTYNWU.js.map
+//# sourceMappingURL=chunk-NHABZOSO.js.map

package/dist/{chunk-SUIEUXHI.js → chunk-OBMDRABJ.js}

@@ -1,7 +1,7 @@
 import {
   getRandomProvider,
   getTimeProvider
-} from "./chunk-H7ERWFBU.js";
+} from "./chunk-6Q4XUAE5.js";
 
 // src/utils/id-utils.ts
 import { randomUUID } from "crypto";
@@ -24,4 +24,4 @@ export {
   generateHyphenId,
   generateUUID
 };
-//# sourceMappingURL=chunk-SUIEUXHI.js.map
+//# sourceMappingURL=chunk-OBMDRABJ.js.map

package/dist/{chunk-2RZSQMWZ.js → chunk-PSZVTY77.js}

@@ -4,7 +4,7 @@ import {
   err,
   getErrorMessage,
   ok
-} from "./chunk-H7ERWFBU.js";
+} from "./chunk-6Q4XUAE5.js";
 
 // src/scm/types.ts
 var ScmError = class extends Error {
@@ -263,4 +263,4 @@ export {
   ScmError,
   GitHubProvider
 };
-//# sourceMappingURL=chunk-2RZSQMWZ.js.map
+//# sourceMappingURL=chunk-PSZVTY77.js.map

package/dist/{chunk-7CEIKID3.js → chunk-PU2NTY6U.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-6T3EPABN.js";
 import {
   SessionMemory
-} from "./chunk-JITZV5JF.js";
+} from "./chunk-N3NC2XCW.js";
 import {
   StatsOnlyAdapter,
   ensureSharedMemoryRegistry
@@ -15,7 +15,7 @@ import {
 } from "./chunk-KSQSWEFH.js";
 import {
   generateId
-} from "./chunk-SUIEUXHI.js";
+} from "./chunk-OBMDRABJ.js";
 import {
   ErrorCode,
   NexusError,
@@ -28,7 +28,7 @@ import {
   getTimeProvider,
   ok,
   setSharedMobiMemDbPathResolver
-} from "./chunk-H7ERWFBU.js";
+} from "./chunk-6Q4XUAE5.js";
 import {
   nexusDataPath
 } from "./chunk-OGHEKPLD.js";
@@ -5608,4 +5608,4 @@ export {
   reinitializeMemoryBackends,
   ToolMemoryManager
 };
-//# sourceMappingURL=chunk-7CEIKID3.js.map
+//# sourceMappingURL=chunk-PU2NTY6U.js.map

package/dist/{chunk-CZBBYHG7.js → chunk-Q245FDK6.js}

@@ -8,7 +8,7 @@ import {
   getTimeProvider,
   isRateLimitText,
   ok
-} from "./chunk-H7ERWFBU.js";
+} from "./chunk-6Q4XUAE5.js";
 
 // src/cli-adapters/circuit-breaker-types.ts
 var CircuitErrorCode = {
@@ -541,4 +541,4 @@ export {
   CliCircuitBreakerIntegration,
   createCliCircuitBreakerIntegration
 };
-//# sourceMappingURL=chunk-CZBBYHG7.js.map
+//# sourceMappingURL=chunk-Q245FDK6.js.map

package/dist/{chunk-AQQGT5S7.js → chunk-QFO77VBC.js}

@@ -4,7 +4,7 @@ import {
 import {
   createLogger,
   getTimeProvider
-} from "./chunk-H7ERWFBU.js";
+} from "./chunk-6Q4XUAE5.js";
 
 // src/mcp/tools/scanner-registry-fetcher.ts
 import { z } from "zod";
@@ -721,4 +721,4 @@ export {
   generateSecurityPlan,
   buildPlanFromAnalysis
 };
-//# sourceMappingURL=chunk-AQQGT5S7.js.map
+//# sourceMappingURL=chunk-QFO77VBC.js.map

package/dist/{chunk-BVH72GYG.js → chunk-QUVWKVKU.js}

@@ -13,7 +13,7 @@ import {
   lookupInTreeCapability,
   ok,
   resolveRetryAfterMs
-} from "./chunk-H7ERWFBU.js";
+} from "./chunk-6Q4XUAE5.js";
 
 // src/config/model-parameter-support.ts
 function parseClaudeMajorMinor(bareId) {
@@ -834,4 +834,4 @@ export {
   DEFAULT_COLLECT_STREAM_MAX_CHUNKS,
   collectStream
 };
-//# sourceMappingURL=chunk-BVH72GYG.js.map
+//# sourceMappingURL=chunk-QUVWKVKU.js.map

package/dist/{chunk-Y5QSPX6V.js → chunk-TB3QGUDW.js}

@@ -5,7 +5,7 @@ import {
   getErrorMessage,
   ok,
   parseBoolEnv
-} from "./chunk-H7ERWFBU.js";
+} from "./chunk-6Q4XUAE5.js";
 
 // src/cli/research-helpers-io.ts
 import * as fs2 from "fs/promises";
@@ -156,4 +156,4 @@ export {
   loadPapersRegistry,
   savePapersRegistry
 };
-//# sourceMappingURL=chunk-Y5QSPX6V.js.map
+//# sourceMappingURL=chunk-TB3QGUDW.js.map

package/dist/{chunk-2I3LUNYC.js → chunk-TBKGR6GC.js}

@@ -1,9 +1,9 @@
 import {
   VERSION
-} from "./chunk-TVRGBIMW.js";
+} from "./chunk-VK42NFA3.js";
 import {
   emitClawGuardViolation
-} from "./chunk-LZLYJBA6.js";
+} from "./chunk-MJQVSJZB.js";
 import {
   CACHE_TIMEOUTS,
   MCP_TIMEOUTS,
@@ -19,7 +19,7 @@ import {
   getTimeProvider,
   ok,
   resolveToolClassGuardMs
-} from "./chunk-H7ERWFBU.js";
+} from "./chunk-6Q4XUAE5.js";
 import {
   getNexusDataDir
 } from "./chunk-OGHEKPLD.js";
@@ -1328,6 +1328,12 @@ function checkAccess(toolName, policy, args) {
     };
   }
   if (policy.allowedTools === "*") return { decision: "allow" };
+  if (policy.allowedTools.length === 0) {
+    return {
+      decision: "unmeasured",
+      reason: `allowlist arm did not run for tool "${toolName}": the derived policy (source "${policy.source}", mode "${policy.mode}") carries an empty allowedTools, and no producer emits tool names (#5022)`
+    };
+  }
   if (policy.allowedTools.includes(toolName)) return { decision: "allow" };
   return decideOnViolation(toolName, policy.mode);
 }
@@ -1417,6 +1423,16 @@ function createAccessPolicyChainMiddleware(toolName) {
     if (decision.decision === "allow") {
       return next(args, ctx);
     }
+    if (decision.decision === "unmeasured") {
+      ctx.logger.info("access-policy: allowlist unmeasured", {
+        tool: toolName,
+        reason: decision.reason,
+        policySource: policy.source,
+        mode: policy.mode,
+        requestId: ctx.requestContext.requestId
+      });
+      return next(args, ctx);
+    }
     if (decision.decision === "log-and-allow") {
       ctx.logger.warn("access-policy: audit violation", {
         tool: toolName,
@@ -1433,7 +1449,7 @@ function createAccessPolicyChainMiddleware(toolName) {
       });
       return next(args, ctx);
     }
-    ctx.logger.info("access-policy: tool call denied", {
+    ctx.logger.warn("access-policy: tool call denied", {
       tool: toolName,
       reason: decision.reason,
       matchedRule: decision.matchedRule,
@@ -2068,4 +2084,4 @@ export {
   VOTING_THRESHOLDS,
   ConsensusMetricsSchema
 };
-//# sourceMappingURL=chunk-2I3LUNYC.js.map
+//# sourceMappingURL=chunk-TBKGR6GC.js.map