nexus-agents 4.26.6 → 4.26.8

package/dist/{chunk-XCJW3MZC.js → chunk-5ZLAA73M.js}

@@ -23,7 +23,7 @@ import {
   toolSuccessStructured,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-O3DWYQ4Y.js";
+} from "./chunk-AU6QDTRD.js";
 import {
   assessPanelIndependence,
   countDistinctModels,
@@ -6779,4 +6779,4 @@ export {
   CONSENSUS_VOTE_TOOL_SCHEMA,
   registerConsensusVoteTool
 };
-//# sourceMappingURL=chunk-XCJW3MZC.js.map
+//# sourceMappingURL=chunk-5ZLAA73M.js.map

package/dist/{chunk-O3DWYQ4Y.js → chunk-AU6QDTRD.js}

@@ -1,6 +1,6 @@
 import {
   VERSION
-} from "./chunk-64OC7AXT.js";
+} from "./chunk-EXS7P2VP.js";
 import {
   emitClawGuardViolation
 } from "./chunk-MJQVSJZB.js";
@@ -571,6 +571,7 @@ function toolError(message) {
 }
 
 // src/mcp/middleware/request-context.ts
+import { AsyncLocalStorage } from "async_hooks";
 import { randomBytes } from "crypto";
 function generateRequestId() {
   const bytes = randomBytes(8);
@@ -604,7 +605,7 @@ function deriveTrustTier(caller) {
 function createRequestContext(options) {
   const caller = options.caller ?? {};
   const context = {
-    requestId: generateRequestId(),
+    requestId: options.inheritRequestId ?? generateRequestId(),
     timestamp: formatTimestamp(),
     toolName: options.toolName,
     caller,
@@ -614,6 +615,21 @@ function createRequestContext(options) {
   };
   return Object.freeze(context);
 }
+var requestContextStorage = new AsyncLocalStorage();
+function runWithRequestContext(context, fn) {
+  const holder = { context, settled: false };
+  return requestContextStorage.run(
+    holder,
+    () => fn().finally(() => {
+      holder.settled = true;
+    })
+  );
+}
+function getCurrentRequestContext() {
+  const holder = requestContextStorage.getStore();
+  if (holder === void 0 || holder.settled) return void 0;
+  return holder.context;
+}
 function contextForLogging(ctx) {
   return {
     requestId: ctx.requestId,
@@ -832,9 +848,10 @@ function runPolicyCheck(config, sanitizedArgs, mode, logger, requestContext) {
   }
   return pResult;
 }
-async function executeHandler(handler, args, ctx, logger) {
+async function executeHandler(handler, args, ctx, logger, logLifecycle) {
   const startTime = getTimeProvider().now();
   const result = handler.length >= 2 ? await handler(args, ctx) : await handler(args);
+  if (!logLifecycle) return result;
   const durationMs = getTimeProvider().now() - startTime;
   if (result.isError === true) {
     logger.warn("Tool execution completed with error", { durationMs });
@@ -927,9 +944,13 @@ function createSecureHandler(handler, config) {
       toolName: config.toolName,
       ...config.callerInfo && { caller: config.callerInfo }
     };
-    const requestContext = createRequestContext(ctxOpts);
+    const ambient = getCurrentRequestContext();
+    const inherited = ambient?.toolName === config.toolName ? ambient : void 0;
+    const requestContext = inherited === void 0 ? createRequestContext(ctxOpts) : createRequestContext({ ...ctxOpts, inheritRequestId: inherited.requestId });
     const requestLogger = logger.child(contextForLogging(requestContext));
-    requestLogger.info("Tool invocation started");
+    if (inherited === void 0) {
+      requestLogger.info("Tool invocation started");
+    }
     const { error: preCheckError, sanitizedArgs } = runPreChecks(
       config,
       args,
@@ -938,17 +959,23 @@ function createSecureHandler(handler, config) {
       requestLogger
     );
     if (preCheckError) return preCheckError;
-    return executeAndAudit(handler, sanitizedArgs, requestContext, requestLogger, config);
+    return executeAndAudit(handler, sanitizedArgs, config, {
+      requestContext,
+      requestLogger,
+      logLifecycle: inherited === void 0
+    });
   };
 }
-async function executeAndAudit(handler, sanitizedArgs, requestContext, requestLogger, config) {
+async function executeAndAudit(handler, sanitizedArgs, config, invocation) {
+  const { requestContext, requestLogger } = invocation;
   const execStartTime = getTimeProvider().now();
   try {
     const result = await executeHandler(
       handler,
       sanitizedArgs,
       { requestContext, logger: requestLogger },
-      requestLogger
+      requestLogger,
+      invocation.logLifecycle
     );
     sanitizeToolResult(result, requestLogger);
     if (config.auditLogger) {
@@ -978,7 +1005,7 @@ async function executeAndAudit(handler, sanitizedArgs, requestContext, requestLo
 }
 
 // src/mcp/mcp-notifier.ts
-import { AsyncLocalStorage } from "async_hooks";
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
 var internalLogger = createLogger({ component: "mcp-notifier" });
 function createMcpNotifier(server) {
   function send(level, logger, data) {
@@ -1015,8 +1042,8 @@ var NOOP_NOTIFIER = {
   debug: () => void 0,
   warn: () => void 0
 };
-var progressContextStorage = new AsyncLocalStorage();
-var abortSignalStorage = new AsyncLocalStorage();
+var progressContextStorage = new AsyncLocalStorage2();
+var abortSignalStorage = new AsyncLocalStorage2();
 async function withProgressHeartbeat(toolName, notifier, operation, intervalMs = 15e3) {
   const startTime = Date.now();
   let beatCount = 0;
@@ -1328,6 +1355,12 @@ function checkAccess(toolName, policy, args) {
     };
   }
   if (policy.allowedTools === "*") return { decision: "allow" };
+  if (policy.allowedTools.length === 0) {
+    return {
+      decision: "unmeasured",
+      reason: `allowlist arm did not run for tool "${toolName}": the derived policy (source "${policy.source}", mode "${policy.mode}") carries an empty allowedTools, and no producer emits tool names (#5022)`
+    };
+  }
   if (policy.allowedTools.includes(toolName)) return { decision: "allow" };
   return decideOnViolation(toolName, policy.mode);
 }
@@ -1359,9 +1392,9 @@ function decideOnViolation(toolName, mode) {
 }
 
 // src/security/access-constraint-deriver/mcp-guard.ts
-import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
-var accessPolicyStorage = new AsyncLocalStorage2();
-var auditTrailStorage = new AsyncLocalStorage2();
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
+var accessPolicyStorage = new AsyncLocalStorage3();
+var auditTrailStorage = new AsyncLocalStorage3();
 var MAX_WARNING_LEN = 500;
 function withAuditTrail(trail, fn) {
   return auditTrailStorage.run(trail, fn);
@@ -1417,6 +1450,16 @@ function createAccessPolicyChainMiddleware(toolName) {
     if (decision.decision === "allow") {
       return next(args, ctx);
     }
+    if (decision.decision === "unmeasured") {
+      ctx.logger.info("access-policy: allowlist unmeasured", {
+        tool: toolName,
+        reason: decision.reason,
+        policySource: policy.source,
+        mode: policy.mode,
+        requestId: ctx.requestContext.requestId
+      });
+      return next(args, ctx);
+    }
     if (decision.decision === "log-and-allow") {
       ctx.logger.warn("access-policy: audit violation", {
         tool: toolName,
@@ -1433,7 +1476,7 @@ function createAccessPolicyChainMiddleware(toolName) {
       });
       return next(args, ctx);
     }
-    ctx.logger.info("access-policy: tool call denied", {
+    ctx.logger.warn("access-policy: tool call denied", {
       tool: toolName,
       reason: decision.reason,
       matchedRule: decision.matchedRule,
@@ -1626,7 +1669,10 @@ function createMiddlewareChain(config) {
       const requestContext = createRequestContext({ toolName: config.toolName });
       const requestLogger = logger.child(contextForLogging(requestContext));
       const ctx = { requestContext, logger: requestLogger };
-      return composed(args, ctx, (finalArgs, finalCtx) => handler(finalArgs, finalCtx));
+      return runWithRequestContext(
+        requestContext,
+        () => composed(args, ctx, (finalArgs, finalCtx) => handler(finalArgs, finalCtx))
+      );
     };
   };
 }
@@ -2068,4 +2114,4 @@ export {
   VOTING_THRESHOLDS,
   ConsensusMetricsSchema
 };
-//# sourceMappingURL=chunk-O3DWYQ4Y.js.map
+//# sourceMappingURL=chunk-AU6QDTRD.js.map