nexus-agents 4.26.9 → 4.28.0

package/dist/{chunk-O7LX6CCH.js → chunk-6OAWETHW.js}

@@ -23,7 +23,7 @@ import {
   toolSuccessStructured,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-YOGYNVAN.js";
+} from "./chunk-7V5V6H5C.js";
 import {
   assessPanelIndependence,
   countDistinctModels,
@@ -6779,4 +6779,4 @@ export {
   CONSENSUS_VOTE_TOOL_SCHEMA,
   registerConsensusVoteTool
 };
-//# sourceMappingURL=chunk-O7LX6CCH.js.map
+//# sourceMappingURL=chunk-6OAWETHW.js.map

package/dist/{chunk-YOGYNVAN.js → chunk-7V5V6H5C.js}

@@ -1,9 +1,9 @@
 import {
   VERSION
-} from "./chunk-ARR4ZJVE.js";
+} from "./chunk-D2E5PC2V.js";
 import {
   emitClawGuardViolation
-} from "./chunk-MJQVSJZB.js";
+} from "./chunk-RV57MIQU.js";
 import {
   CACHE_TIMEOUTS,
   MCP_TIMEOUTS,
@@ -1411,7 +1411,9 @@ function recordAuditModeViolation(input) {
       warning: input.warning.slice(0, MAX_WARNING_LEN),
       policySource: input.policySource,
       mode: input.mode,
-      requestId: input.requestId
+      requestId: input.requestId,
+      // Outside `warning`, so the 500-char cap above cannot eat it.
+      ...input.matchedRule !== void 0 && { matchedRule: input.matchedRule }
     });
   } catch {
   }
@@ -1422,17 +1424,6 @@ function withAccessPolicy(policy, fn) {
 function getActivePolicy() {
   return accessPolicyStorage.getStore();
 }
-function denyToToolResult(decision, requestId) {
-  return {
-    isError: true,
-    content: [
-      {
-        type: "text",
-        text: `access denied: ${decision.reason} (rule: ${decision.matchedRule}, request: ${requestId})`
-      }
-    ]
-  };
-}
 
 // src/security/access-constraint-deriver/chain-adapter.ts
 function toGuardArgs(args) {
@@ -1476,17 +1467,28 @@ function createAccessPolicyChainMiddleware(toolName) {
       });
       return next(args, ctx);
     }
-    ctx.logger.warn("access-policy: tool call denied", {
-      tool: toolName,
-      reason: decision.reason,
-      matchedRule: decision.matchedRule,
-      policySource: policy.source,
-      mode: policy.mode,
-      requestId: ctx.requestContext.requestId
-    });
-    return denyToToolResult(decision, ctx.requestContext.requestId);
+    reportAdvisoryViolation(toolName, decision, policy, ctx);
+    return next(args, ctx);
   };
 }
+function reportAdvisoryViolation(toolName, decision, policy, ctx) {
+  ctx.logger.warn("access-policy: advisory violation", {
+    tool: toolName,
+    reason: decision.reason,
+    matchedRule: decision.matchedRule,
+    policySource: policy.source,
+    mode: policy.mode,
+    requestId: ctx.requestContext.requestId
+  });
+  recordAuditModeViolation({
+    toolName,
+    warning: `[advisory: would have denied] ${decision.reason}`,
+    policySource: policy.source,
+    mode: policy.mode,
+    requestId: ctx.requestContext.requestId,
+    matchedRule: decision.matchedRule
+  });
+}
 
 // src/mcp/middleware/middleware-chain.ts
 function errorResult(category, message, requestId) {
@@ -2114,4 +2116,4 @@ export {
   VOTING_THRESHOLDS,
   ConsensusMetricsSchema
 };
-//# sourceMappingURL=chunk-YOGYNVAN.js.map
+//# sourceMappingURL=chunk-7V5V6H5C.js.map