nexus-agents 4.26.6 → 4.26.7

package/dist/{chunk-GVD6K5FS.js → chunk-DJWIO7OX.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-OQB3XC5O.js";
 import {
   VERSION
-} from "./chunk-64OC7AXT.js";
+} from "./chunk-VK42NFA3.js";
 import {
   capitalize
 } from "./chunk-6T3EPABN.js";
@@ -1201,7 +1201,7 @@ async function runDoctorFix(result) {
   writeLine2("\u2500".repeat(40));
   let fixCount = 0;
   if (!result.dataDirectory.rootExists || result.dataDirectory.subdirectories.some((d) => !d.exists || !d.writable)) {
-    const { initDataDirectories: initDataDirectories2, describeDataDirFix: describeDataDirFix2 } = await import("./setup-data-dir-OSD2RLLS.js");
+    const { initDataDirectories: initDataDirectories2, describeDataDirFix: describeDataDirFix2 } = await import("./setup-data-dir-5PVWTCFL.js");
     const outcome = describeDataDirFix2(initDataDirectories2());
     writeLine2(outcome.line);
     if (outcome.counted) fixCount++;
@@ -1303,4 +1303,4 @@ export {
   startStdioServer,
   closeServer
 };
-//# sourceMappingURL=chunk-GVD6K5FS.js.map
+//# sourceMappingURL=chunk-DJWIO7OX.js.map

package/dist/{chunk-FOEWSYSN.js → chunk-ICJI6AIF.js}

@@ -7,7 +7,7 @@ import {
   toolStructuredError,
   toolSuccessStructured,
   wrapToolWithTimeout
-} from "./chunk-O3DWYQ4Y.js";
+} from "./chunk-TBKGR6GC.js";
 import {
   JsonlStore,
   SECURITY_KEYWORDS,
@@ -2132,4 +2132,4 @@ export {
   runImprovementReview,
   registerImprovementReviewTool
 };
-//# sourceMappingURL=chunk-FOEWSYSN.js.map
+//# sourceMappingURL=chunk-ICJI6AIF.js.map

package/dist/{chunk-XCJW3MZC.js → chunk-KHAB3HWK.js}

@@ -23,7 +23,7 @@ import {
   toolSuccessStructured,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-O3DWYQ4Y.js";
+} from "./chunk-TBKGR6GC.js";
 import {
   assessPanelIndependence,
   countDistinctModels,
@@ -6779,4 +6779,4 @@ export {
   CONSENSUS_VOTE_TOOL_SCHEMA,
   registerConsensusVoteTool
 };
-//# sourceMappingURL=chunk-XCJW3MZC.js.map
+//# sourceMappingURL=chunk-KHAB3HWK.js.map

package/dist/{chunk-O3DWYQ4Y.js → chunk-TBKGR6GC.js}

@@ -1,6 +1,6 @@
 import {
   VERSION
-} from "./chunk-64OC7AXT.js";
+} from "./chunk-VK42NFA3.js";
 import {
   emitClawGuardViolation
 } from "./chunk-MJQVSJZB.js";
@@ -1328,6 +1328,12 @@ function checkAccess(toolName, policy, args) {
     };
   }
   if (policy.allowedTools === "*") return { decision: "allow" };
+  if (policy.allowedTools.length === 0) {
+    return {
+      decision: "unmeasured",
+      reason: `allowlist arm did not run for tool "${toolName}": the derived policy (source "${policy.source}", mode "${policy.mode}") carries an empty allowedTools, and no producer emits tool names (#5022)`
+    };
+  }
   if (policy.allowedTools.includes(toolName)) return { decision: "allow" };
   return decideOnViolation(toolName, policy.mode);
 }
@@ -1417,6 +1423,16 @@ function createAccessPolicyChainMiddleware(toolName) {
     if (decision.decision === "allow") {
       return next(args, ctx);
     }
+    if (decision.decision === "unmeasured") {
+      ctx.logger.info("access-policy: allowlist unmeasured", {
+        tool: toolName,
+        reason: decision.reason,
+        policySource: policy.source,
+        mode: policy.mode,
+        requestId: ctx.requestContext.requestId
+      });
+      return next(args, ctx);
+    }
     if (decision.decision === "log-and-allow") {
       ctx.logger.warn("access-policy: audit violation", {
         tool: toolName,
@@ -1433,7 +1449,7 @@ function createAccessPolicyChainMiddleware(toolName) {
       });
       return next(args, ctx);
     }
-    ctx.logger.info("access-policy: tool call denied", {
+    ctx.logger.warn("access-policy: tool call denied", {
       tool: toolName,
       reason: decision.reason,
       matchedRule: decision.matchedRule,
@@ -2068,4 +2084,4 @@ export {
   VOTING_THRESHOLDS,
   ConsensusMetricsSchema
 };
-//# sourceMappingURL=chunk-O3DWYQ4Y.js.map
+//# sourceMappingURL=chunk-TBKGR6GC.js.map