nexus-agents 7.0.1 → 8.0.0

package/dist/{chunk-HA2MM4C2.js → chunk-LOYIV3HG.js}

@@ -1,9 +1,9 @@
 import {
   generateSecurityPlan
-} from "./chunk-VYAXMVI5.js";
+} from "./chunk-DEYXS6IZ.js";
 import {
   analyzeGitHubRepo
-} from "./chunk-HFOQKCD2.js";
+} from "./chunk-DGWT7DXX.js";
 import {
   CodebaseIndex,
   DEFAULT_INDEX_MAX_DEPTH,
@@ -12,7 +12,7 @@ import {
   extractSymbolIndexResult,
   extractSymbols,
   findSourceFiles
-} from "./chunk-RSMG2DPB.js";
+} from "./chunk-64GMIUM5.js";
 import {
   FINDING_SEVERITY_LEVELS,
   SARIF_LEVEL_MAP,
@@ -21,10 +21,10 @@ import {
 import {
   DEFAULT_TASK_TTL_MS,
   clampTaskTtl
-} from "./chunk-UJPVBDYG.js";
+} from "./chunk-5FBPGOKA.js";
 import {
   executeExpert
-} from "./chunk-KJWD2V4K.js";
+} from "./chunk-JFE3JT5Q.js";
 import {
   JobStatusSchema,
   VOTER_ROLES,
@@ -47,24 +47,24 @@ import {
   simulationDeniedResult,
   toJobSummary,
   writeJobCancelled
-} from "./chunk-SS5FADQN.js";
+} from "./chunk-EXAULYXZ.js";
 import {
   allOf
 } from "./chunk-OQB3XC5O.js";
 import {
   normalizeTopicToCanonical,
   synthesizeResearch
-} from "./chunk-UVO673OY.js";
+} from "./chunk-DBDXS7PE.js";
 import {
   IssueTriage
-} from "./chunk-Q6IODDEA.js";
+} from "./chunk-LVSKLVYC.js";
 import {
   resolveEnvMode,
   sanitizeInput
-} from "./chunk-RLBJTZHA.js";
+} from "./chunk-AHTOZ2UR.js";
 import {
   withPrerequisite
-} from "./chunk-6E2M3P5A.js";
+} from "./chunk-3GMYW66U.js";
 import {
   NOOP_NOTIFIER,
   RateLimiter,
@@ -78,6 +78,7 @@ import {
   getToolAnnotations,
   getToolTimeout,
   measuredTrustTier,
+  sanitizeToolInput,
   toSdkCallback,
   toSdkCallbackWithBudgetCheck,
   toolError,
@@ -88,18 +89,18 @@ import {
   withAuditTrail,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-PDMWQ2NK.js";
+} from "./chunk-OYWFWMLH.js";
 import {
   createAuditTrail,
   createGraphAuditBridge,
   emitPipelinePolicyEvent
-} from "./chunk-6Q3KSZVI.js";
+} from "./chunk-MWS56UFF.js";
 import {
   EventTopics,
   createEvent,
   getGlobalEventBus,
   getGlobalRegistry
-} from "./chunk-D6TL5GZV.js";
+} from "./chunk-HKKLVWRO.js";
 import {
   IDENTIFIER_RE,
   LANG_VALUES,
@@ -132,29 +133,29 @@ import {
   parseRegistry,
   sourceExistsInRegistry,
   summarizeContextForPrompt
-} from "./chunk-QAHGHWC7.js";
+} from "./chunk-WIJ5J7AH.js";
 import {
   loadPapersRegistry,
   loadTechniquesRegistry,
   resolveInsideRoot
-} from "./chunk-K2AWJGQO.js";
+} from "./chunk-FSY2TYFX.js";
 import {
   getTokenEnvVars,
   resolveToken
-} from "./chunk-XZEYSIGG.js";
+} from "./chunk-LOKTE5WE.js";
 import {
   DEFAULT_RELEVANCE_CONFIG,
   MemoryImportance,
   calculateTextJaccardSimilarity,
   getToolMemory
-} from "./chunk-7U7HAYPB.js";
+} from "./chunk-R4B4UJ6F.js";
 import {
   STOPWORDS,
   truncateWithInfo
 } from "./chunk-6T3EPABN.js";
 import {
   createSessionMemory
-} from "./chunk-JNZ3D5B5.js";
+} from "./chunk-AL5E5T3O.js";
 import {
   BUILT_IN_EXPERTS,
   BuiltInExpertTypeSchema,
@@ -163,7 +164,7 @@ import {
 } from "./chunk-43SVUIPL.js";
 import {
   getMemoryRegistry
-} from "./chunk-KSQSWEFH.js";
+} from "./chunk-54Z2II7G.js";
 import {
   CliDetectionCache,
   asRecord,
@@ -172,25 +173,25 @@ import {
   getAvailableClis,
   sleep,
   withTimeout
-} from "./chunk-BTWKDT4F.js";
+} from "./chunk-YJ7Q2NHE.js";
 import {
   BaseAdapter,
   createStream,
   requireApiKey,
   validateApiKeyPresence
-} from "./chunk-LVYRGNOC.js";
+} from "./chunk-DWUF5YWG.js";
 import {
   DEFAULTS
-} from "./chunk-ZD4VEHEG.js";
+} from "./chunk-H6BUSSTF.js";
 import {
   getAvailabilityCache,
   getCliForModelId,
   resolveFallback
-} from "./chunk-6GYTTWNM.js";
+} from "./chunk-FVHUWXM2.js";
 import {
   generateHyphenId,
   generateUUID
-} from "./chunk-33FI7W3G.js";
+} from "./chunk-L2PDPA23.js";
 import {
   AGENT_ROUTER_TIMEOUTS,
   API_TIMEOUTS,
@@ -296,18 +297,18 @@ import {
   selectStrategyByManifest,
   toExpertTaskAnalysisResult,
   withStep
-} from "./chunk-Y742U2YM.js";
+} from "./chunk-J7SPTP2E.js";
 import {
   ensureLearningDir,
   getMetaOutcomesFile,
   isPersistenceEnabled
-} from "./chunk-GBHJ37V3.js";
+} from "./chunk-ITCKXMOH.js";
 import {
   findRepoRoot,
   getNexusDataDir,
   nexusDataPath,
   nexusDataPathEnsure
-} from "./chunk-OGHEKPLD.js";
+} from "./chunk-MM223CVS.js";
 
 // src/config/schemas-core.ts
 import { z } from "zod";
@@ -1415,8 +1416,8 @@ function getConfigManager() {
 }
 
 // src/config/config-loader.ts
-import { readFileSync, existsSync } from "fs";
-import { resolve, join } from "path";
+import { readFileSync, existsSync } from "node:fs";
+import { resolve, join } from "node:path";
 import * as yaml from "yaml";
 var DEFAULT_CONFIG_FILE = "nexus-agents.yaml";
 var ALTERNATE_CONFIG_FILE = "nexus-agents.yml";
@@ -1952,7 +1953,7 @@ var RateLimiter2 = class {
    * Sleeps for the specified duration.
    */
   sleep(ms) {
-    return new Promise((resolve22) => setTimeout(resolve22, ms));
+    return new Promise((resolve21) => setTimeout(resolve21, ms));
   }
   /**
    * Returns the current number of available tokens.
@@ -2212,7 +2213,7 @@ var AbortError = class extends Error {
 function raceAbort(promise, signal) {
   if (signal === void 0) return promise;
   if (signal.aborted) return Promise.reject(new AbortError());
-  return new Promise((resolve22, reject) => {
+  return new Promise((resolve21, reject) => {
     const onAbort = () => {
       reject(new AbortError());
     };
@@ -2220,7 +2221,7 @@ function raceAbort(promise, signal) {
     promise.then(
       (value) => {
         signal.removeEventListener("abort", onAbort);
-        resolve22(value);
+        resolve21(value);
       },
       (error) => {
         signal.removeEventListener("abort", onAbort);
@@ -5180,13 +5181,13 @@ function makeCancelError(taskId) {
 }
 function executeWithTimeout(params) {
   const { task, maxDurationMs, executeTask, transformError, signal } = params;
-  return new Promise((resolve22) => {
+  return new Promise((resolve21) => {
     let settled = false;
     const settle = (result) => {
       if (settled) return;
       settled = true;
       clearTimeout(timeoutId);
-      resolve22(result);
+      resolve21(result);
     };
     const timeoutId = setTimeout(() => {
       settle(
@@ -9951,10 +9952,6 @@ function wrapInMarkdownFence(diagram, title) {
   return parts.join("\n");
 }
 
-// src/utils/resolve-project-root.ts
-import { existsSync as existsSync2 } from "fs";
-import { dirname, join as join2, resolve as resolve2 } from "path";
-
 // src/agents/tech-lead-collaboration.ts
 var DEFAULT_COLLAB_CONFIG = {
   enableCollaborativeSynthesis: true,
@@ -10693,13 +10690,13 @@ var WaveScheduler = class {
   }
   async withTimeout(promise, timeoutMs, taskId) {
     if (timeoutMs <= 0) return promise;
-    return new Promise((resolve22, reject) => {
+    return new Promise((resolve21, reject) => {
       const timer = setTimeout(() => {
         reject(new Error(`Task ${taskId} timed out after ${String(timeoutMs)}ms`));
       }, timeoutMs);
       promise.then((result) => {
         clearTimeout(timer);
-        resolve22(result);
+        resolve21(result);
       }).catch((error) => {
         clearTimeout(timer);
         reject(error instanceof Error ? error : new Error(String(error)));
@@ -16248,7 +16245,7 @@ var STOP_WORDS2 = /* @__PURE__ */ new Set([
 ]);
 
 // src/agents/skills/skill-library.ts
-import { randomUUID } from "crypto";
+import { randomUUID } from "node:crypto";
 
 // src/agents/skills/skill-search.ts
 function extractKeywords2(text, stopWords) {
@@ -17975,7 +17972,7 @@ var ManifestSchema2 = z32.object({
 });
 async function resolveImportPath(source) {
   if (source.startsWith("./") || source.startsWith("/") || source.startsWith("../")) {
-    const pathModule = await import("path");
+    const pathModule = await import("node:path");
     return pathModule.resolve(process.cwd(), source);
   }
   return source;
@@ -18479,8 +18476,8 @@ var Semaphore = class {
       this.available -= 1;
       return Promise.resolve();
     }
-    return new Promise((resolve22) => {
-      this.waiters.push(resolve22);
+    return new Promise((resolve21) => {
+      this.waiters.push(resolve21);
     });
   }
   release() {
@@ -18825,8 +18822,8 @@ function createContextItem(id, content, source, relevance, timestamp) {
 }
 
 // src/agents/wave-checkpoint-persistence.ts
-import * as fs from "fs";
-import * as path from "path";
+import * as fs from "node:fs";
+import * as path from "node:path";
 
 // src/agents/wave-checkpoint-types.ts
 import { z as z39 } from "zod";
@@ -18887,7 +18884,7 @@ var DEFAULT_SICA_CONFIG2 = {
 };
 
 // src/agents/self-improving/sica-version-manager.ts
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID2 } from "node:crypto";
 var SicaVersionManager = class {
   config;
   logger;
@@ -19139,10 +19136,10 @@ var SicaVersionManager = class {
 };
 
 // src/agents/self-improving/sica-agent.ts
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID4 } from "node:crypto";
 
 // src/agents/self-improving/sica-agent-helpers.ts
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID3 } from "node:crypto";
 function estimateQuality(result) {
   const output2 = result.output;
   if (typeof output2 !== "string") return 0.5;
@@ -20863,7 +20860,7 @@ function calculateCompactionScore(hubAgents) {
 }
 
 // src/agents/orchestration/puppeteer-helpers.ts
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID5 } from "node:crypto";
 function generateSessionId() {
   return `puppeteer-${randomUUID5().slice(0, 8)}`;
 }
@@ -21129,7 +21126,7 @@ function createPolicyForMode(policyMode) {
 }
 
 // src/agents/orchestration/puppeteer-events.ts
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID6 } from "node:crypto";
 var PuppeteerTopics = {
   /** Orchestration session started */
   STARTED: "puppeteer.started",
@@ -21904,9 +21901,9 @@ var ExpertPool = class {
     if (this.active < this.capacity) {
       return this.issuePermit();
     }
-    return new Promise((resolve22, reject) => {
+    return new Promise((resolve21, reject) => {
       const timer = setTimeout(() => {
-        const idx = this.queue.findIndex((e) => e.resolve === resolve22);
+        const idx = this.queue.findIndex((e) => e.resolve === resolve21);
         if (idx !== -1) {
           this.queue.splice(idx, 1);
         }
@@ -21916,7 +21913,7 @@ var ExpertPool = class {
           )
         );
       }, this.acquireTimeoutMs);
-      this.queue.push({ resolve: resolve22, reject, timer });
+      this.queue.push({ resolve: resolve21, reject, timer });
     });
   }
   /** Release a permit back to the pool. */
@@ -22278,8 +22275,8 @@ function getTopologicalOrder(workflow) {
 }
 
 // src/workflows/workflow-parser.ts
-import * as fs2 from "fs/promises";
-import * as path2 from "path";
+import * as fs2 from "node:fs/promises";
+import * as path2 from "node:path";
 import * as yaml2 from "yaml";
 var MAX_FILE_SIZE_BYTES = 1024 * 1024;
 var SUPPORTED_EXTENSIONS2 = [".yaml", ".yml", ".json"];
@@ -22500,8 +22497,8 @@ var TaskQueue = class {
     if (this.cancelled) {
       return Promise.reject(new Error("Queue has been cancelled"));
     }
-    return new Promise((resolve22, reject) => {
-      this.queue.push({ task, resolve: resolve22, reject });
+    return new Promise((resolve21, reject) => {
+      this.queue.push({ task, resolve: resolve21, reject });
       this.processNext();
     });
   }
@@ -22777,16 +22774,16 @@ async function executeStepWithTimeout(step, context, stepExecutor, signal) {
   return executeWithTimeout2(step, stepContext, stepExecutor, stepTimeout, startTime);
 }
 function executeWithTimeout2(step, context, executor, timeout, startTime) {
-  return new Promise((resolve22) => {
+  return new Promise((resolve21) => {
     const timeoutId = setTimeout(() => {
-      resolve22(createTimeoutResult(step.id, getTimeProvider().now() - startTime, timeout));
+      resolve21(createTimeoutResult(step.id, getTimeProvider().now() - startTime, timeout));
     }, timeout);
     executor(step, context).then((result) => {
       clearTimeout(timeoutId);
-      resolve22(result);
+      resolve21(result);
     }).catch((error) => {
       clearTimeout(timeoutId);
-      resolve22(createErrorResult(step.id, getTimeProvider().now() - startTime, error));
+      resolve21(createErrorResult(step.id, getTimeProvider().now() - startTime, error));
     });
   });
 }
@@ -23038,11 +23035,11 @@ var TEMPLATE_KEYWORDS = {
 };
 
 // src/workflows/template-loader.ts
-import { readFile as readFile2, readdir, stat as stat2 } from "fs/promises";
-import { existsSync as existsSync4 } from "fs";
-import { join as join4, basename, extname as extname2, resolve as resolve5, sep } from "path";
-import { fileURLToPath } from "url";
-import { dirname as dirname2 } from "path";
+import { readFile as readFile2, readdir, stat as stat2 } from "node:fs/promises";
+import { existsSync as existsSync3 } from "node:fs";
+import { join as join3, basename, extname as extname2, resolve as resolve4, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+import { dirname } from "node:path";
 import { parse as parseYaml2 } from "yaml";
 function validatePath3(userPath, allowedRoot) {
   const resolved = resolveInsideRoot(userPath, allowedRoot);
@@ -23050,7 +23047,7 @@ function validatePath3(userPath, allowedRoot) {
     return {
       ok: false,
       error: new SecurityError("Path traversal detected: path escapes allowed root directory", {
-        context: { userPath, allowedRoot: resolve5(allowedRoot) }
+        context: { userPath, allowedRoot: resolve4(allowedRoot) }
       })
     };
   }
@@ -23058,32 +23055,32 @@ function validatePath3(userPath, allowedRoot) {
 }
 function getBuiltInTemplatesPath() {
   const currentFile = fileURLToPath(import.meta.url);
-  const currentDir = dirname2(currentFile);
+  const currentDir = dirname(currentFile);
   if (currentFile.includes(`${sep}dist${sep}`) || currentFile.endsWith(`${sep}dist`)) {
     const distIndex = currentFile.lastIndexOf(`${sep}dist${sep}`);
     if (distIndex !== -1) {
       const distDir = currentFile.substring(0, distIndex + 5);
-      const bundledPath = join4(distDir, "workflows", "templates");
-      if (existsSync4(bundledPath)) {
+      const bundledPath = join3(distDir, "workflows", "templates");
+      if (existsSync3(bundledPath)) {
         return bundledPath;
       }
     }
   }
   const possiblePaths = [
     // Unbundled: relative to template-loader.ts in src/workflows/
-    join4(currentDir, "templates"),
+    join3(currentDir, "templates"),
     // Bundled: relative to dist/ directory
-    join4(currentDir, "workflows", "templates"),
+    join3(currentDir, "workflows", "templates"),
     // Bundled chunk: may be in dist/ with workflows/templates as sibling
-    join4(dirname2(currentDir), "workflows", "templates"),
-    join4(dirname2(currentDir), "dist", "workflows", "templates")
+    join3(dirname(currentDir), "workflows", "templates"),
+    join3(dirname(currentDir), "dist", "workflows", "templates")
   ];
   for (const path12 of possiblePaths) {
-    if (existsSync4(path12)) {
+    if (existsSync3(path12)) {
       return path12;
     }
   }
-  return join4(currentDir, "templates");
+  return join3(currentDir, "templates");
 }
 function createValidationError(errors) {
   const firstError = errors[0];
@@ -23165,7 +23162,7 @@ async function loadTemplatesFromDirectory(directoryPath) {
   const templates = [];
   const errors = [];
   try {
-    const resolvedDirectory = resolve5(directoryPath);
+    const resolvedDirectory = resolve4(directoryPath);
     const stats = await stat2(resolvedDirectory);
     if (!stats.isDirectory()) {
       errors.push(new ParseError(`${resolvedDirectory} is not a directory`));
@@ -25185,9 +25182,9 @@ function withLogging(toolName, handler3, logger58) {
 }
 
 // src/mcp/middleware/auth-handler.ts
-import { randomBytes, timingSafeEqual } from "crypto";
-import { readFileSync as readFileSync3, writeFileSync, existsSync as existsSync5, mkdirSync as mkdirSync2 } from "fs";
-import { dirname as dirname3 } from "path";
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { readFileSync as readFileSync3, writeFileSync, existsSync as existsSync4, mkdirSync as mkdirSync2 } from "node:fs";
+import { dirname as dirname2 } from "node:path";
 var DEFAULT_AUTH_SUBDIR = "auth";
 var DEFAULT_TOKEN_FILE = "server-token";
 var TOKEN_LENGTH_BYTES = 32;
@@ -25199,7 +25196,7 @@ function generateSecureToken() {
 }
 function readStoredToken(tokenPath) {
   try {
-    if (!existsSync5(tokenPath)) {
+    if (!existsSync4(tokenPath)) {
       return void 0;
     }
     return readFileSync3(tokenPath, "utf-8").trim();
@@ -25208,8 +25205,8 @@ function readStoredToken(tokenPath) {
   }
 }
 function writeToken(tokenPath, token) {
-  const dir = dirname3(tokenPath);
-  if (!existsSync5(dir)) {
+  const dir = dirname2(tokenPath);
+  if (!existsSync4(dir)) {
     mkdirSync2(dir, { recursive: true, mode: 448 });
   }
   writeFileSync(tokenPath, token + "\n", { mode: 384 });
@@ -25367,7 +25364,7 @@ async function withToolError(prefix, logger58, fn) {
 }
 
 // src/mcp/middleware/spawn-depth-guard.ts
-import { AsyncLocalStorage } from "async_hooks";
+import { AsyncLocalStorage } from "node:async_hooks";
 var logger13 = createLogger({ component: "spawn-depth-guard" });
 var MAX_SPAWN_DEPTH = 3;
 var depthStorage = new AsyncLocalStorage();
@@ -25769,7 +25766,7 @@ function createInteractionGraph() {
 }
 
 // src/observability/swarm-observer.ts
-import { randomUUID as randomUUID7 } from "crypto";
+import { randomUUID as randomUUID7 } from "node:crypto";
 
 // src/observability/swarm-observer-helpers.ts
 function calculateSeverity(queuedMessages, blockedAgents) {
@@ -28848,7 +28845,7 @@ var RunWorkflowInputSchema = z56.object({
 });
 
 // src/mcp/tools/run-workflow-helpers.ts
-import { resolve as resolve6, sep as sep2 } from "path";
+import { resolve as resolve5, sep as sep2 } from "node:path";
 function isFilePath(template) {
   return template.includes("/") || template.includes("\\") || template.endsWith(".yaml") || template.endsWith(".yml");
 }
@@ -28861,9 +28858,9 @@ function validateWorkflowPath(userPath, allowedRoots) {
       })
     };
   }
-  const resolvedPath = resolve6(userPath);
+  const resolvedPath = resolve5(userPath);
   for (const root of allowedRoots) {
-    const resolvedRoot = resolve6(root);
+    const resolvedRoot = resolve5(root);
     if (resolvedPath === resolvedRoot || resolvedPath.startsWith(resolvedRoot + sep2)) {
       return { ok: true, value: resolvedPath };
     }
@@ -28871,7 +28868,7 @@ function validateWorkflowPath(userPath, allowedRoots) {
   return {
     ok: false,
     error: new SecurityError("Path traversal detected: path escapes allowed directories", {
-      context: { userPath, allowedDirectories: allowedRoots.map((r) => resolve6(r)) }
+      context: { userPath, allowedDirectories: allowedRoots.map((r) => resolve5(r)) }
     })
   };
 }
@@ -29047,11 +29044,11 @@ function formatValidationErrors(validation) {
 }
 
 // src/mcp/tools/run-workflow.ts
-import { randomUUID as randomUUID8 } from "crypto";
+import { randomUUID as randomUUID8 } from "node:crypto";
 function resolveExecutionEngineOrError(deps, workflowName) {
   try {
-    const resolve22 = deps.resolveExecutionEngine ?? (() => deps.workflowEngine);
-    return { ok: true, value: resolve22() };
+    const resolve21 = deps.resolveExecutionEngine ?? (() => deps.workflowEngine);
+    return { ok: true, value: resolve21() };
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     deps.logger?.error(
@@ -29692,7 +29689,7 @@ function execIdFields(executionId) {
 async function populateUnifiedContextOnState(state, options) {
   const taskCandidate = state["task"];
   if (typeof taskCandidate !== "string" || taskCandidate === "") return;
-  const { getContextForTask: getContextForTask2, inferTaskCategory: inferTaskCategory2 } = await import("./context-retriever-3OO6N4V6.js");
+  const { getContextForTask: getContextForTask2, inferTaskCategory: inferTaskCategory2 } = await import("./context-retriever-CCVDD7TO.js");
   const category = inferTaskCategory2(taskCandidate);
   const executionId = options?.executionId;
   const execFields = execIdFields(executionId);
@@ -30189,13 +30186,13 @@ function dedupe(ids) {
   return [...new Set(ids)];
 }
 async function withTimeout3(promise, ms) {
-  return new Promise((resolve22, reject) => {
+  return new Promise((resolve21, reject) => {
     const timer = setTimeout(() => {
       reject(new Error(`Node timed out after ${String(ms)}ms`));
     }, ms);
     promise.then((result) => {
       clearTimeout(timer);
-      resolve22(result);
+      resolve21(result);
     }).catch((error) => {
       clearTimeout(timer);
       reject(error instanceof Error ? error : new Error(String(error)));
@@ -31119,14 +31116,14 @@ function emitPipelineStageEvent(prefix, stage, status, details) {
 }
 
 // src/pipeline/trace-writer.ts
-import { mkdir, writeFile, rename, unlink } from "fs/promises";
-import { join as join5 } from "path";
+import { mkdir, writeFile, rename, unlink } from "node:fs/promises";
+import { join as join4 } from "node:path";
 var logger22 = createLogger({ component: "TraceWriter" });
 var MAX_BUFFER_SIZE = 5e4;
 var TraceWriter = class {
   constructor(bus, options) {
     this.options = options;
-    this.runDir = join5(options.runsDir, options.runId);
+    this.runDir = join4(options.runsDir, options.runId);
     this.maxBuffer = options.maxBufferSize ?? MAX_BUFFER_SIZE;
     this.unsubscribe = bus.subscribe({}, (event) => {
       if (!this.stopped) {
@@ -31148,7 +31145,7 @@ var TraceWriter = class {
     if (this.buffer.length === 0) return;
     await mkdir(this.runDir, { recursive: true });
     const lines = this.buffer.map((e) => JSON.stringify(e)).join("\n");
-    const tracePath = join5(this.runDir, "trace.jsonl");
+    const tracePath = join4(this.runDir, "trace.jsonl");
     const traceTmp = `${tracePath}.tmp.${String(process.pid)}`;
     try {
       await writeFile(traceTmp, lines + "\n", "utf-8");
@@ -31161,7 +31158,7 @@ var TraceWriter = class {
       throw err2;
     }
     const indexContent = this.buildIndex();
-    const indexPath = join5(this.runDir, "index.md");
+    const indexPath = join4(this.runDir, "index.md");
     const indexTmp = `${indexPath}.tmp.${String(process.pid)}`;
     try {
       await writeFile(indexTmp, indexContent, "utf-8");
@@ -31585,7 +31582,7 @@ function createDefaultPolicyEngine() {
 }
 
 // src/pipeline/task-contract-builders.ts
-import { randomUUID as randomUUID9 } from "crypto";
+import { randomUUID as randomUUID9 } from "node:crypto";
 function buildBaseTaskContract(input) {
   const now = Date.now();
   return {
@@ -31795,7 +31792,7 @@ async function executeOrchestratePipeline(task) {
 }
 
 // src/orchestration/orchestrator-factory.ts
-import { randomUUID as randomUUID10 } from "crypto";
+import { randomUUID as randomUUID10 } from "node:crypto";
 
 // src/orchestration/orchestrator-adapters.ts
 function generateId2(prefix) {
@@ -32649,11 +32646,11 @@ function createMockOrchestrator() {
 async function raceAgainstDeadline(promise, deadlineMs, onTimeout) {
   const startedAt = Date.now();
   let timer;
-  const timeoutP = new Promise((resolve22, reject) => {
+  const timeoutP = new Promise((resolve21, reject) => {
     timer = setTimeout(
       () => {
         try {
-          resolve22(onTimeout(Date.now() - startedAt));
+          resolve21(onTimeout(Date.now() - startedAt));
         } catch (err2) {
           reject(err2 instanceof Error ? err2 : new Error(String(err2)));
         }
@@ -32784,7 +32781,7 @@ function createSicaOrchestratorAdapter(sicaAgent, _logger) {
 }
 
 // src/mcp/tools/research-auto-catalog.ts
-import * as fs3 from "fs";
+import * as fs3 from "node:fs";
 import { z as z61 } from "zod";
 var CATALOG_SUBDIR = "research";
 var CATALOG_FILE = "pending-catalog.json";
@@ -33856,11 +33853,11 @@ function createWorkerTask(entry, taskIndex, waveNumber, opts) {
     const staggerSlot = taskIndex % opts.maxConcurrency;
     const staggerMs = staggerSlot * opts.staggerDelayMs;
     if (staggerMs > 0) {
-      await new Promise((resolve22) => setTimeout(resolve22, staggerMs));
+      await new Promise((resolve21) => setTimeout(resolve21, staggerMs));
     }
     const spacingDelay = opts.failureTracker.getSpacingDelay(entry.role);
     if (spacingDelay > 0) {
-      await new Promise((resolve22) => setTimeout(resolve22, spacingDelay));
+      await new Promise((resolve21) => setTimeout(resolve21, spacingDelay));
     }
     const timeoutMs = opts.options.workerTimeoutMs ?? getExpertTaskTimeout(entry.subTask);
     const result = await executeSafe({
@@ -33912,7 +33909,7 @@ async function maybeDelayForRateLimit(results, waveIdx, totalWaves) {
   );
   if (hasRateLimit) {
     logger27.warn("Rate-limit detected \u2014 delaying next wave", { delayMs: RATE_LIMIT_WAVE_DELAY_MS });
-    await new Promise((resolve22) => setTimeout(resolve22, RATE_LIMIT_WAVE_DELAY_MS));
+    await new Promise((resolve21) => setTimeout(resolve21, RATE_LIMIT_WAVE_DELAY_MS));
   }
 }
 function emitWaveStarted(ctx, workerCount, roles) {
@@ -34010,7 +34007,7 @@ async function maybeRetryAfterTriage(opts) {
   }
   const useAltCli = triage.action === "retry_different_cli" && altExecuteWorker !== void 0;
   if (triage.action === "retry_different_cli") {
-    await new Promise((resolve22) => setTimeout(resolve22, RATE_LIMIT_SPACING_MS));
+    await new Promise((resolve21) => setTimeout(resolve21, RATE_LIMIT_SPACING_MS));
   }
   const retryTimeout = triage.action === "extend_timeout" ? Math.min(timeoutMs * TIMEOUT_EXTENSION_FACTOR, MAX_WORKER_TIMEOUT_MS) : timeoutMs;
   const retryExecutor = useAltCli ? altExecuteWorker : executeWorker;
@@ -35617,7 +35614,7 @@ function resolveAccessPolicyMode(env = process.env) {
 }
 
 // src/security/access-constraint-deriver/deriver.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash2 } from "node:crypto";
 
 // src/security/access-constraint-deriver/cache.ts
 var DEFAULT_MAX_ENTRIES = 256;
@@ -36166,8 +36163,8 @@ function createDurableAuditTrail(auditLogger) {
 }
 
 // src/context/structured-task-state.ts
-import * as fs4 from "fs";
-import * as path3 from "path";
+import * as fs4 from "node:fs";
+import * as path3 from "node:path";
 
 // src/context/structured-task-state-types.ts
 import { z as z65 } from "zod";
@@ -39876,11 +39873,11 @@ function registerExecuteExpertTool(server, deps) {
 import { z as z70 } from "zod";
 
 // src/research/negative-results.ts
-import { readFileSync as readFileSync6 } from "fs";
-import { resolve as resolve8 } from "path";
+import { readFileSync as readFileSync6 } from "node:fs";
+import { resolve as resolve7 } from "node:path";
 import yaml3 from "yaml";
 var logger34 = createLogger({ component: "negative-results" });
-var REGISTRY_PATH = resolve8("docs/research/registry/negative-results.yaml");
+var REGISTRY_PATH = resolve7("docs/research/registry/negative-results.yaml");
 var cachedResults;
 function loadNegativeResults() {
   if (cachedResults !== void 0) return cachedResults;
@@ -41431,7 +41428,7 @@ function recordTriageOutcome(success, durationMs, errorMsg) {
 
 // src/mcp/tools/run-graph-workflow.ts
 import { z as z78 } from "zod";
-import { randomUUID as randomUUID11 } from "crypto";
+import { randomUUID as randomUUID11 } from "node:crypto";
 var RunGraphWorkflowInputSchema = z78.object({
   workflow: z78.string().min(1).max(100).describe("Name of the predefined graph workflow to execute"),
   inputs: z78.record(z78.string(), z78.unknown()).optional().default({}).describe("Input values for the workflow"),
@@ -42169,7 +42166,7 @@ function suggestImprovement(criterion) {
 
 // src/mcp/tools/execute-spec-tool.ts
 import { z as z79 } from "zod";
-import { randomUUID as randomUUID12 } from "crypto";
+import { randomUUID as randomUUID12 } from "node:crypto";
 var ExecuteSpecInputSchema = z79.object({
   spec: z79.string().min(1).max(5e4).describe("Markdown specification to execute"),
   dryRun: z79.boolean().optional().default(false).describe("Parse and decompose only"),
@@ -43150,7 +43147,7 @@ function registerRepoSecurityPlanTool(server, deps) {
 }
 
 // src/mcp/tools/search-codebase-tool.ts
-import { resolve as resolve9, sep as sep3 } from "path";
+import { resolve as resolve8, sep as sep3 } from "node:path";
 import { z as z90 } from "zod";
 var SearchCodebaseInputSchema = z90.object({
   query: z90.string().min(1).max(200).describe("Search query (symbol name, keyword, or pattern)"),
@@ -43205,8 +43202,8 @@ async function getIndex(dir, maxDepth) {
   return promise;
 }
 function resolveSearchDir(directory) {
-  const dir = resolve9(directory ?? process.cwd());
-  const cwdRoot = resolve9(".");
+  const dir = resolve8(directory ?? process.cwd());
+  const cwdRoot = resolve8(".");
   if (dir !== cwdRoot && !dir.startsWith(cwdRoot + sep3)) {
     return { error: `Path traversal denied: directory must be within ${cwdRoot}` };
   }
@@ -43304,7 +43301,7 @@ function registerSearchCodebaseTool(server, deps) {
 }
 
 // src/mcp/tools/extract-symbols-tool.ts
-import { extname as extname3, resolve as resolve10, sep as sep4 } from "path";
+import { extname as extname3, resolve as resolve9, sep as sep4 } from "node:path";
 import { z as z91 } from "zod";
 
 // src/core/task-analysis/tool-refusal-gap.ts
@@ -43426,8 +43423,8 @@ async function extractSymbolsHandler(args, ctx) {
     });
   }
   const { filePath, mode, maxChars, maxSymbols } = parsed.data;
-  const resolvedPath = resolve10(filePath);
-  const cwdRoot = resolve10(".");
+  const resolvedPath = resolve9(filePath);
+  const cwdRoot = resolve9(".");
   if (resolvedPath !== cwdRoot && !resolvedPath.startsWith(cwdRoot + sep4)) {
     return toolStructuredError({
       errorCategory: "permission",
@@ -43510,8 +43507,8 @@ function registerExtractSymbolsTool(server, deps) {
 }
 
 // src/mcp/tools/search-usages-tool.ts
-import { readFile as readFile3 } from "fs/promises";
-import { relative, resolve as resolve11, sep as sep5 } from "path";
+import { readFile as readFile3 } from "node:fs/promises";
+import { relative, resolve as resolve10, sep as sep5 } from "node:path";
 import { z as z92 } from "zod";
 var DEFAULT_USAGES_LIMIT = 50;
 var MAX_USAGES_LIMIT = 500;
@@ -43531,8 +43528,8 @@ var SearchUsagesInputSchema = z92.object({
   maxDepth: z92.number().int().min(1).max(MAX_USAGES_MAX_DEPTH).optional().describe(`Directory walk depth for dir scope (default ${String(DEFAULT_USAGES_MAX_DEPTH)}).`)
 });
 function resolveWithinCwd(target) {
-  const resolved = resolve11(target);
-  const cwdRoot = resolve11(".");
+  const resolved = resolve10(target);
+  const cwdRoot = resolve10(".");
   if (resolved !== cwdRoot && !resolved.startsWith(cwdRoot + sep5)) {
     return { error: `Path traversal denied: scope must be within ${cwdRoot}` };
   }
@@ -43542,7 +43539,7 @@ async function resolveFileScope(input) {
   if (input.path !== void 0) {
     const guard2 = resolveWithinCwd(input.path);
     if ("error" in guard2) return guard2;
-    return { files: [guard2.resolved], root: resolve11(".") };
+    return { files: [guard2.resolved], root: resolve10(".") };
   }
   const guard = resolveWithinCwd(input.dir ?? process.cwd());
   if ("error" in guard) return guard;
@@ -43637,8 +43634,8 @@ function registerSearchUsagesTool(server, deps) {
 }
 
 // src/mcp/tools/query-trace-tool.ts
-import { readFile as readFile4, stat as stat3 } from "fs/promises";
-import { join as join7, resolve as resolve12, sep as sep6 } from "path";
+import { readFile as readFile4, stat as stat3 } from "node:fs/promises";
+import { join as join6, resolve as resolve11, sep as sep6 } from "node:path";
 import { z as z93 } from "zod";
 var QueryTraceInputSchema = z93.object({
   runId: z93.string().min(1).max(128).regex(/^[a-zA-Z0-9_-]+$/, "runId must be alphanumeric, hyphens, or underscores").describe("Run ID to query traces for"),
@@ -43686,9 +43683,9 @@ var EMPTY_RESPONSE = {
 };
 async function queryTraceFromDisk(input, runsDir) {
   const dir = runsDir ?? getDefaultRunsDir();
-  const tracePath = join7(dir, input.runId, "trace.jsonl");
-  const resolvedDir = resolve12(dir);
-  const resolvedTrace = resolve12(tracePath);
+  const tracePath = join6(dir, input.runId, "trace.jsonl");
+  const resolvedDir = resolve11(dir);
+  const resolvedTrace = resolve11(tracePath);
   if (!resolvedTrace.startsWith(resolvedDir + sep6) && resolvedTrace !== resolvedDir) {
     return { runId: input.runId, ...EMPTY_RESPONSE };
   }
@@ -44308,8 +44305,8 @@ var AuditQueryCriteriaSchema = z97.object({
 });
 
 // src/audit/audit-storage-queries.ts
-import * as fs5 from "fs";
-import * as readline from "readline";
+import * as fs5 from "node:fs";
+import * as readline from "node:readline";
 function matchesTimeRange(event, criteria) {
   if (criteria.startTime !== void 0 && new Date(event.timestamp) < criteria.startTime)
     return false;
@@ -44389,8 +44386,8 @@ var InMemoryAuditStorage = class {
 };
 
 // src/audit/audit-storage.ts
-import * as fs6 from "fs";
-import * as path4 from "path";
+import * as fs6 from "node:fs";
+import * as path4 from "node:path";
 function validateLogDir(logDir, allowedRoot) {
   const resolvedRoot = path4.resolve(allowedRoot);
   const resolvedLogDir = path4.resolve(allowedRoot, logDir);
@@ -44565,27 +44562,27 @@ var FileAuditStorage = class _FileAuditStorage {
     const data = this.writeBuffer.join("");
     this.writeBuffer = [];
     const stream = this.writeStream;
-    return new Promise((resolve22, reject) => {
+    return new Promise((resolve21, reject) => {
       stream.write(data, (err2) => {
         if (err2 !== void 0 && err2 !== null) {
           reject(new AuditError("Failed to flush audit log", { cause: err2 }));
         } else {
-          resolve22();
+          resolve21();
         }
       });
     });
   }
   async close() {
     await this.flush();
-    return new Promise((resolve22) => {
+    return new Promise((resolve21) => {
       if (this.writeStream === null) {
-        resolve22();
+        resolve21();
         return;
       }
       this.writeStream.end(() => {
         this.writeStream = null;
         this.logger.info("Audit storage closed");
-        resolve22();
+        resolve21();
       });
     });
   }
@@ -44619,7 +44616,7 @@ var FileAuditStorage = class _FileAuditStorage {
 };
 
 // src/audit/audit-logger.ts
-import * as crypto from "crypto";
+import * as crypto from "node:crypto";
 
 // src/audit/tier-transition-hash.ts
 function hasTierTransitionPayload(event) {
@@ -45572,7 +45569,7 @@ async function tryIssueTriage(task) {
   try {
     const issueMatch = task.match(/github\.com\/([^/]+\/[^/]+)\/issues\/(\d+)/);
     if (issueMatch === null) return null;
-    const { createIssueTriage } = await import("./issue-triage-2LNYGQRJ.js");
+    const { createIssueTriage } = await import("./issue-triage-IVYGGNB4.js");
     const triage = createIssueTriage();
     const owner = issueMatch[1] ?? "";
     const num = issueMatch[2] ?? "";
@@ -45600,7 +45597,7 @@ var VALID_TEMPLATES = /* @__PURE__ */ new Set([
 ]);
 async function classifyWithLLM(task) {
   try {
-    const { executeExpert: executeExpert2 } = await import("./expert-bridge-PWRVRFDG.js");
+    const { executeExpert: executeExpert2 } = await import("./expert-bridge-7LGHU7IL.js");
     const prompt = [
       "Classify this task into exactly one pipeline template.",
       "Templates: dev (implementation/bug fix/refactor), research (investigate/evaluate/compare),",
@@ -45706,8 +45703,8 @@ function ensureRunnableTemplate(template, stages) {
 }
 
 // src/pipeline/pipeline-checkpoint.ts
-import * as fs7 from "fs";
-import * as path5 from "path";
+import * as fs7 from "node:fs";
+import * as path5 from "node:path";
 import { z as z98 } from "zod";
 var logger40 = createLogger({ component: "pipeline-checkpoint" });
 var SESSION_ID_REGEX = /^[a-zA-Z0-9_-]{1,128}$/;
@@ -46691,13 +46688,13 @@ function resolveConfidence(rule) {
 }
 
 // src/mcp/tools/security-scan.ts
-import * as path6 from "path";
+import * as path6 from "node:path";
 var logger43 = createLogger({ component: "security-scan" });
 var SCAN_TIMEOUT_MS = 3e5;
 async function isSemgrepAvailable() {
   try {
-    const { execFile: execFile2 } = await import("child_process");
-    const { promisify: promisify2 } = await import("util");
+    const { execFile: execFile2 } = await import("node:child_process");
+    const { promisify: promisify2 } = await import("node:util");
     const exec2 = promisify2(execFile2);
     await exec2("semgrep", ["--version"], { timeout: 1e4 });
     return true;
@@ -46706,8 +46703,8 @@ async function isSemgrepAvailable() {
   }
 }
 async function runSemgrep(targetDir, rulesets) {
-  const { execFile: execFile2 } = await import("child_process");
-  const { promisify: promisify2 } = await import("util");
+  const { execFile: execFile2 } = await import("node:child_process");
+  const { promisify: promisify2 } = await import("node:util");
   const exec2 = promisify2(execFile2);
   const args = ["--sarif", "--quiet", ...rulesets.flatMap((r) => ["--config", r]), targetDir];
   const { stdout } = await exec2("semgrep", args, {
@@ -46920,8 +46917,8 @@ var OSV_DEPENDENCY_CAP = 20;
 async function runOsvCheck(targetDir, enabled) {
   if (!enabled) return OSV_EMPTY;
   try {
-    const fs13 = await import("fs");
-    const path12 = await import("path");
+    const fs13 = await import("node:fs");
+    const path12 = await import("node:path");
     const pkgPath = path12.join(targetDir, "package.json");
     if (!fs13.existsSync(pkgPath)) return OSV_EMPTY;
     const pkg = JSON.parse(fs13.readFileSync(pkgPath, "utf-8"));
@@ -46980,8 +46977,8 @@ function buildScanSummary(total, blocking, osvCount, osv, sarifParseErrors = 0)
 }
 
 // src/security/quality-gate-commands.ts
-import { existsSync as existsSync10, readFileSync as readFileSync8 } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync8 } from "node:fs";
+import { join as join9 } from "node:path";
 var LOCKFILES = [
   { file: "pnpm-lock.yaml", manager: "pnpm" },
   { file: "yarn.lock", manager: "yarn" },
@@ -46996,13 +46993,13 @@ var SCRIPT_CANDIDATES = {
 };
 function detectPackageManager(projectDir) {
   for (const { file, manager } of LOCKFILES) {
-    if (existsSync10(join10(projectDir, file))) return manager;
+    if (existsSync9(join9(projectDir, file))) return manager;
   }
   return "npm";
 }
 function readScripts(projectDir) {
-  const manifest = join10(projectDir, "package.json");
-  if (!existsSync10(manifest)) return void 0;
+  const manifest = join9(projectDir, "package.json");
+  if (!existsSync9(manifest)) return void 0;
   try {
     const parsed = JSON.parse(readFileSync8(manifest, "utf-8"));
     if (typeof parsed !== "object" || parsed === null) return void 0;
@@ -47045,8 +47042,8 @@ function resolveCheckCommand(projectDir, check) {
 async function runCommandCheck(name, command, args, cwd) {
   const start = Date.now();
   try {
-    const { execFile: execFile2 } = await import("child_process");
-    const { promisify: promisify2 } = await import("util");
+    const { execFile: execFile2 } = await import("node:child_process");
+    const { promisify: promisify2 } = await import("node:util");
     const exec2 = promisify2(execFile2);
     await exec2(command, [...args], { timeout: 12e4, cwd });
     return {
@@ -47291,8 +47288,8 @@ var memoryInitPromise = null;
 async function initPipelineMemory() {
   if (cachedMemory !== null) return cachedMemory;
   try {
-    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-YQQVPLKM.js");
-    const { getLearningDir } = await import("./learning-persistence-7O5QYDM7.js");
+    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-GYIEP7MM.js");
+    const { getLearningDir } = await import("./learning-persistence-7N5SZHNX.js");
     const mem = createSessionMemory2(getLearningDir());
     mem.startSession(`pipeline-${String(getTimeProvider().now())}`);
     cachedMemory = {
@@ -47353,7 +47350,7 @@ function recordRoutingExperience(category, success, durationMs, tokensUsed = 0,
     callRecord(routingMemoryCache);
     return;
   }
-  routingMemoryInitPromise ??= import("./routing-memory-2SMMUPTB.js").then(({ createRoutingMemory }) => {
+  routingMemoryInitPromise ??= import("./routing-memory-BBHAEJUL.js").then(({ createRoutingMemory }) => {
     routingMemoryCache ??= createRoutingMemory();
     return routingMemoryCache;
   }).catch((error) => {
@@ -47387,7 +47384,7 @@ ${text}` : "";
 }
 async function getWeatherContext() {
   try {
-    const { generateWeatherReport: generateWeatherReport2 } = await import("./weather-report-6AVPMHHM.js");
+    const { generateWeatherReport: generateWeatherReport2 } = await import("./weather-report-ZLQGZUDL.js");
     const report = generateWeatherReport2({ includeAdaptive: true });
     const mappings = "recommendedMappings" in report ? report.recommendedMappings : [];
     if (!Array.isArray(mappings) || mappings.length === 0) return "";
@@ -47405,8 +47402,8 @@ ${lines}
 }
 async function getMemoryContext(task) {
   try {
-    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-YQQVPLKM.js");
-    const { getLearningDir } = await import("./learning-persistence-7O5QYDM7.js");
+    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-GYIEP7MM.js");
+    const { getLearningDir } = await import("./learning-persistence-7N5SZHNX.js");
     const memory = createSessionMemory2(getLearningDir(), { maxLearningsInContext: 10 });
     const learnings = memory.searchLearnings(task.slice(0, 200));
     if (learnings.length === 0) return "";
@@ -47524,7 +47521,7 @@ ${contextBlock}`;
       const strategy = config.votingStrategy ?? "higher_order";
       await postProgress(config, "Vote", `Running consensus with ${strategy} strategy...`);
       try {
-        const { executeVoting } = await import("./consensus-vote-355WNDBN.js");
+        const { executeVoting } = await import("./consensus-vote-57SKG3EN.js");
         const votingResult = await executeVoting(
           {
             proposal: buildVoteProposal(plan, research),
@@ -47938,7 +47935,7 @@ function createScaffoldStageWrapper() {
 }
 async function searchCodebaseForTask(task) {
   try {
-    const { CodebaseIndex: CodebaseIndex2 } = await import("./codebase-search-RHBGEWXK.js");
+    const { CodebaseIndex: CodebaseIndex2 } = await import("./codebase-search-3D4TW3KR.js");
     const index = new CodebaseIndex2(process.cwd());
     const terms = task.toLowerCase().split(/\s+/).filter((w) => w.length > 4).slice(0, 3);
     if (terms.length === 0) return null;
@@ -47953,7 +47950,7 @@ async function searchCodebaseForTask(task) {
 }
 async function queryResearchRegistry(task) {
   try {
-    const { synthesizeResearch: synthesizeResearch2 } = await import("./research-helpers-synthesize-QY3DDHTD.js");
+    const { synthesizeResearch: synthesizeResearch2 } = await import("./research-helpers-synthesize-NQMSFDMD.js");
     const topic = task.split(/[.!?\n]/).filter((s) => s.trim().length > 10)[0]?.trim();
     if (topic === void 0) return null;
     const result = await synthesizeResearch2(topic.slice(0, 50));
@@ -48005,7 +48002,7 @@ function createAnalyzeStageWrapper() {
             true
           );
         }
-        const { analyzeGitHubRepo: analyzeGitHubRepo2 } = await import("./repo-analyze-UJOWFGNM.js");
+        const { analyzeGitHubRepo: analyzeGitHubRepo2 } = await import("./repo-analyze-DI65XOTQ.js");
         const analysis = await analyzeGitHubRepo2({ repo: slug, depth: "deep" });
         const summary = `Language: ${String(analysis.language)}, Framework: ${String(analysis.framework)}, CI: ${String(analysis.ciProvider)}, Security: ${analysis.securityTooling.join(", ") || "none"}`;
         return output(PIPELINE_STATE_KEYS.RESEARCH, summary, getTimeProvider().now() - start, true);
@@ -48024,7 +48021,7 @@ function createScanStageWrapper() {
       try {
         const slug = ctx.task.match(/([a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+)/)?.[1];
         if (slug !== void 0) {
-          const { generateSecurityPlan: generateSecurityPlan2 } = await import("./repo-security-plan-SZU4O2TN.js");
+          const { generateSecurityPlan: generateSecurityPlan2 } = await import("./repo-security-plan-LS5GCASE.js");
           const plan = await generateSecurityPlan2({ repo: slug, maxScanners: 10 });
           const recs = plan.recommendations.slice(0, 5).map((r) => `${r.priority}: ${r.displayName} (${r.category})`).join("; ");
           return output(PIPELINE_STATE_KEYS.FINDINGS, recs, getTimeProvider().now() - start, true);
@@ -48065,7 +48062,7 @@ function createAuditStageRegistry() {
 
 // src/mcp/tools/pr-review-tool.ts
 import { z as z102 } from "zod";
-import { randomUUID as randomUUID13 } from "crypto";
+import { randomUUID as randomUUID13 } from "node:crypto";
 
 // src/mcp/tools/pr-review-findings.ts
 import { parse as parseYaml3 } from "yaml";
@@ -48148,7 +48145,7 @@ var FINDINGS_FORMAT_INSTRUCTIONS = `If you have one or more findings (claims tha
 A finding only triggers request_changes if ALL FOUR gate checks are 'passed' AND named_assertion is substantive (>10 chars, naming a concrete failure). Findings missing any of those surface as informational only \u2014 they do not block the merge. This is the #2225 verification gate; the 2026-04-25 audit found a 100% false-positive rate when this gate was not enforced.`;
 
 // src/audit/reviewed-diff-hash.ts
-import * as crypto2 from "crypto";
+import * as crypto2 from "node:crypto";
 var MAX_REVIEWED_DIFF_BYTES = 5e4;
 var CANONICAL_GIT_DIFF_ARGS = Object.freeze([
   "-c",
@@ -48175,11 +48172,11 @@ function reviewedDiffWasTruncated(diff) {
 }
 
 // src/audit/pr-review-record-store.ts
-import { appendFileSync as appendFileSync4, existsSync as existsSync11, mkdirSync as mkdirSync6, readFileSync as readFileSync9 } from "fs";
-import { dirname as dirname4, isAbsolute, join as join11, resolve as resolve15 } from "path";
+import { appendFileSync as appendFileSync4, existsSync as existsSync10, mkdirSync as mkdirSync6, readFileSync as readFileSync9 } from "node:fs";
+import { dirname as dirname3, isAbsolute, join as join10, resolve as resolve14 } from "node:path";
 
 // src/audit/pr-review-record.ts
-import * as crypto3 from "crypto";
+import * as crypto3 from "node:crypto";
 import { z as z101 } from "zod";
 var PrReviewVerdictSchema = z101.enum(["approve", "request_changes", "abstain"]);
 var PrReviewVoteCountsSchema = z101.object({
@@ -48351,7 +48348,7 @@ function assertNotSourceCheckoutWrite(filePath) {
   if (!isUnderTestRunner()) return;
   const here = findRepoRoot(process.cwd());
   if (here === null) return;
-  if (resolve15(filePath) !== resolve15(join11(here, PR_REVIEW_RECORDS_REL_PATH))) return;
+  if (resolve14(filePath) !== resolve14(join10(here, PR_REVIEW_RECORDS_REL_PATH))) return;
   throw new Error(
     `Refusing to write ${filePath} from a test run (#4415): this is the source checkout's tracked, hash-chained audit file, and a fabricated record that chains cleanly is indistinguishable from a real verdict. Pass repoPath to a throwaway repo, or set NEXUS_PR_REVIEW_RECORDS_PATH.`
   );
@@ -48359,20 +48356,20 @@ function assertNotSourceCheckoutWrite(filePath) {
 function resolvePrReviewRecordsPath(repoPathOverride) {
   const envPath = process.env[PR_REVIEW_RECORDS_PATH_ENV];
   if (envPath !== void 0 && envPath.trim() !== "") {
-    return isAbsolute(envPath) ? envPath : resolve15(envPath);
+    return isAbsolute(envPath) ? envPath : resolve14(envPath);
   }
   if (repoPathOverride !== void 0 && repoPathOverride.trim() !== "") {
     const overrideRoot = findRepoRoot(repoPathOverride);
-    if (overrideRoot !== null) return join11(overrideRoot, PR_REVIEW_RECORDS_REL_PATH);
+    if (overrideRoot !== null) return join10(overrideRoot, PR_REVIEW_RECORDS_REL_PATH);
   }
   const root = findRepoRoot(process.cwd());
   if (root === null) return void 0;
-  return join11(root, PR_REVIEW_RECORDS_REL_PATH);
+  return join10(root, PR_REVIEW_RECORDS_REL_PATH);
 }
 function readPrReviewRecords(filePath) {
   const records = [];
   const invalidLines = [];
-  if (!existsSync11(filePath)) return { records, invalidLines };
+  if (!existsSync10(filePath)) return { records, invalidLines };
   const lines = readFileSync9(filePath, "utf-8").split("\n").filter((l) => l.trim() !== "");
   for (const [i, line] of lines.entries()) {
     try {
@@ -48386,7 +48383,7 @@ function readPrReviewRecords(filePath) {
   return { records, invalidLines };
 }
 function readPrReviewLedgerTip(filePath, logger58) {
-  if (!existsSync11(filePath)) return { maxSequence: -1, lastHash: void 0 };
+  if (!existsSync10(filePath)) return { maxSequence: -1, lastHash: void 0 };
   try {
     const { records } = readPrReviewRecords(filePath);
     if (records.length === 0) return { maxSequence: -1, lastHash: void 0 };
@@ -48412,7 +48409,7 @@ function persistPrReviewRecord(opts) {
   }
   assertNotSourceCheckoutWrite(filePath);
   try {
-    mkdirSync6(dirname4(filePath), { recursive: true });
+    mkdirSync6(dirname3(filePath), { recursive: true });
     const { maxSequence, lastHash } = readPrReviewLedgerTip(filePath, logger58);
     const record = buildPrReviewRecord({
       ...opts,
@@ -48829,32 +48826,45 @@ function absoluteQuorumApprove(reviews, valid) {
   return { decision: "approve", verified: true };
 }
 function buildPrReviewProposal(input) {
+  const sanitizeResult = sanitizeToolInput({
+    prTitle: input.prTitle,
+    prDescription: input.prDescription,
+    prDiff: input.prDiff,
+    repoContext: input.repoContext
+  });
+  const safe = sanitizeResult.sanitized;
   const parts = [];
   parts.push(`# Pull Request Review
 `);
-  parts.push(`**Title:** ${input.prTitle}
+  if (sanitizeResult.commentsRemoved > 0) {
+    parts.push(
+      `> **Note:** ${String(sanitizeResult.commentsRemoved)} HTML comment(s) were removed from the untrusted fields below before you saw them (#5258). Comments are invisible in rendered markdown, so they are stripped rather than trusted. This is routine \u2014 GitHub's default PR template contains one \u2014 and is not by itself evidence of an attack.
+`
+    );
+  }
+  parts.push(`**Title:** ${safe.prTitle}
 `);
   if (input.baseRef !== void 0 && input.headRef !== void 0) {
     parts.push(`**Branches:** ${input.headRef} \u2192 ${input.baseRef}
 `);
   }
-  if (input.repoContext !== void 0 && input.repoContext !== "") {
+  if (safe.repoContext !== void 0 && safe.repoContext !== "") {
     parts.push(`
 **Repo context:**
-${input.repoContext}
+${safe.repoContext}
 `);
   }
-  if (input.prDescription !== void 0 && input.prDescription !== "") {
+  if (safe.prDescription !== void 0 && safe.prDescription !== "") {
     parts.push(`
 **Description:**
-${input.prDescription}
+${safe.prDescription}
 `);
   }
   parts.push(`
 ## Diff
 
 \`\`\`diff
-${input.prDiff}
+${safe.prDiff}
 \`\`\`
 `);
   parts.push(`
@@ -49343,8 +49353,8 @@ function registerVendorPublishingAuditTool(server, deps) {
 
 // src/mcp/tools/compare-data-feeds.ts
 import { z as z105 } from "zod";
-import * as path7 from "path";
-import * as fs8 from "fs";
+import * as path7 from "node:path";
+import * as fs8 from "node:fs";
 import * as yaml4 from "yaml";
 var CompareDataFeedsInputSchema = z105.object({
   feedAPath: z105.string().min(1).max(1e3).describe("Filesystem path to feed A (YAML or JSON, auto-detected by extension)"),
@@ -49644,7 +49654,7 @@ function registerQueryTaskStateTool(server, deps) {
 import { z as z109 } from "zod";
 
 // src/mcp/tools/ci-health-log.ts
-import { appendFileSync as appendFileSync5, existsSync as existsSync13, readFileSync as readFileSync11, statSync as statSync2, writeFileSync as writeFileSync3 } from "fs";
+import { appendFileSync as appendFileSync5, existsSync as existsSync12, readFileSync as readFileSync11, statSync as statSync2, writeFileSync as writeFileSync3 } from "node:fs";
 import { z as z108 } from "zod";
 
 // src/mcp/tools/ci-health-types.ts
@@ -49911,7 +49921,7 @@ function registerCiHealthCheckTool(server, deps) {
 }
 
 // src/mcp/tools/quality-gate-tool.ts
-import { statSync as statSync3 } from "fs";
+import { statSync as statSync3 } from "node:fs";
 import { z as z110 } from "zod";
 var QualityCheckSchema = z110.enum(["typecheck", "lint", "tests", "build", "security"]);
 var DEFAULT_CHECKS = ["typecheck", "lint", "tests"];
@@ -50030,8 +50040,8 @@ function registerRunQualityGateTool(server, deps) {
 }
 
 // src/mcp/tools/verify-audit-chain-tool.ts
-import * as fs9 from "fs/promises";
-import * as path8 from "path";
+import * as fs9 from "node:fs/promises";
+import * as path8 from "node:path";
 import { z as z111 } from "zod";
 var VerifyAuditChainInputSchema = z111.object({
   logDir: z111.string().min(1).max(512).describe(
@@ -50154,9 +50164,9 @@ var RESEARCH_BUDGET_MS = 2e4;
 var RESEARCH_TIMED_OUT = /* @__PURE__ */ Symbol("research-budget-exceeded");
 async function withResearchBudget(p, ms) {
   let timer;
-  const budget = new Promise((resolve22) => {
+  const budget = new Promise((resolve21) => {
     timer = setTimeout(() => {
-      resolve22(RESEARCH_TIMED_OUT);
+      resolve21(RESEARCH_TIMED_OUT);
     }, ms);
   });
   try {
@@ -50258,7 +50268,7 @@ function registerSuggestResearchTasksTool(server, deps) {
 
 // src/mcp/tools/run-tool.ts
 import { z as z116 } from "zod";
-import { randomUUID as randomUUID17 } from "crypto";
+import { randomUUID as randomUUID17 } from "node:crypto";
 
 // src/orchestration/meta-dispatcher.ts
 var MetaDispatchError = class extends Error {
@@ -50476,7 +50486,7 @@ function classifyDispatchError(err2) {
 }
 
 // src/orchestration/meta-orchestrator.ts
-import { randomUUID as randomUUID14 } from "crypto";
+import { randomUUID as randomUUID14 } from "node:crypto";
 
 // src/orchestration/meta-orchestrator-routing.ts
 function reasoningFor(selection, routing) {
@@ -50651,7 +50661,7 @@ function createMetaOrchestrator(options) {
 }
 
 // src/orchestration/meta-shadow-selector.ts
-import { appendFileSync as appendFileSync6, existsSync as existsSync14, readFileSync as readFileSync12 } from "fs";
+import { appendFileSync as appendFileSync6, existsSync as existsSync13, readFileSync as readFileSync12 } from "node:fs";
 import { z as z113 } from "zod";
 var SHADOW_STRATEGY_ARMS = [
   "single-shot",
@@ -50776,7 +50786,7 @@ function hydrateShadowSelector(selector) {
   const hydratable = selector;
   if (typeof hydratable.recordFromContext !== "function") return 0;
   const file = getMetaOutcomesFile();
-  if (!existsSync14(file)) return 0;
+  if (!existsSync13(file)) return 0;
   let replayed = 0;
   try {
     const cutoff = Date.now() - HYDRATE_LOOKBACK_MS;
@@ -51145,17 +51155,17 @@ function evaluateMetaStrategyReadiness(result, config = DEFAULT_META_STRATEGY_RE
 
 // src/mcp/tools/dev-pipeline-tool.ts
 import { z as z114 } from "zod";
-import * as fs11 from "fs";
-import * as path10 from "path";
-import { randomUUID as randomUUID15 } from "crypto";
+import * as fs11 from "node:fs";
+import * as path10 from "node:path";
+import { randomUUID as randomUUID15 } from "node:crypto";
 
 // src/pipeline/task-tracker.ts
-import * as fs10 from "fs";
-import * as path9 from "path";
+import * as fs10 from "node:fs";
+import * as path9 from "node:path";
 var logger48 = createLogger({ component: "task-tracker" });
 async function exec(cmd, args, timeout = 15e3) {
-  const { execFile: execFile2 } = await import("child_process");
-  const { promisify: promisify2 } = await import("util");
+  const { execFile: execFile2 } = await import("node:child_process");
+  const { promisify: promisify2 } = await import("node:util");
   const run = promisify2(execFile2);
   const { stdout } = await run(cmd, [...args], { timeout });
   return stdout.trim();
@@ -51168,7 +51178,7 @@ var GitHubTaskTracker = class {
   cachedProvider = null;
   async getProvider() {
     if (this.cachedProvider !== null) return this.cachedProvider;
-    const { createScmProvider } = await import("./factory-UFKRSADE.js");
+    const { createScmProvider } = await import("./factory-SF6ZPN6D.js");
     const result = await createScmProvider({ repo: this.config.repo ?? "" });
     if (!result.ok) throw new Error(`SCM provider error: ${result.error.message}`);
     this.cachedProvider = result.value;
@@ -51558,9 +51568,9 @@ function registerDevPipelineTool(server, deps) {
 
 // src/mcp/tools/pipeline-tool.ts
 import { z as z115 } from "zod";
-import * as fs12 from "fs";
-import * as path11 from "path";
-import { randomUUID as randomUUID16 } from "crypto";
+import * as fs12 from "node:fs";
+import * as path11 from "node:path";
+import { randomUUID as randomUUID16 } from "node:crypto";
 var PIPELINE_ASYNC_HINT = "A full run_pipeline run can exceed the synchronous MCP request timeout. Retry with `dispatch: 'async'` to get a jobId immediately, then poll get_job_result({ jobId }) for the result.";
 var PipelineInputSchema = z115.object({
   /** The task to execute. */
@@ -52083,7 +52093,7 @@ async function probeSource(source, includeModelIds) {
   }
 }
 async function defaultSources(includeOpenRouter) {
-  const { createAllAdapters: createAllAdapters2 } = await import("./factory-3BZDQQYM.js");
+  const { createAllAdapters: createAllAdapters2 } = await import("./factory-5URERSHK.js");
   const adapters = createAllAdapters2();
   return buildDefaultModelSources(adapters, { includeOpenRouter });
 }
@@ -52186,7 +52196,7 @@ var VoterEvalVerdictQuerySchema = z118.object({
 
 // src/mcp/tools/supply-chain-tradeoff-panel.ts
 import { z as z119 } from "zod";
-import { randomUUID as randomUUID18 } from "crypto";
+import { randomUUID as randomUUID18 } from "node:crypto";
 var DEFAULT_AXES = [
   "build_time_determinism",
   "supply_chain_risk",
@@ -53926,7 +53936,6 @@ var ResponseCacheConfigSchema = z124.object({
 });
 
 // src/cli-adapters/response-cache-utils.ts
-import { createHash as createHash6 } from "crypto";
 var logger51 = createLogger({ component: "ResponseCacheUtils" });
 
 // src/cli-adapters/unified-routing-types.ts
@@ -54026,7 +54035,7 @@ var FeedbackCollectorConfigSchema = z126.object({
 });
 
 // src/learning/outcome-feedback-helpers.ts
-import { randomUUID as randomUUID19 } from "crypto";
+import { randomUUID as randomUUID19 } from "node:crypto";
 function countOutcomesByClass(outcomes) {
   const counts = {
     success: 0,
@@ -54345,7 +54354,7 @@ var DEFAULT_FEEDBACK_INTEGRATION_CONFIG = {
 };
 
 // src/learning/feedback-integration.ts
-import { randomUUID as randomUUID20 } from "crypto";
+import { randomUUID as randomUUID20 } from "node:crypto";
 var STEP_QUALITY_SCORING = {
   /** Base score for successful steps. */
   successBase: 0.8,
@@ -55095,9 +55104,9 @@ function getPolicy(id) {
 }
 
 // src/security/sandbox/sandbox-executor.ts
-import { execFile } from "child_process";
-import { promisify } from "util";
-import { resolve as resolve21, normalize as normalize2, sep as sep12 } from "path";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { resolve as resolve20, normalize as normalize2, sep as sep12 } from "node:path";
 var execFileAsync = promisify(execFile);
 var logger53 = createLogger({ component: "sandbox-executor" });
 function parseExecError(error) {
@@ -55177,9 +55186,9 @@ var PolicySandboxExecutor = class {
    */
   validateCwd(cwd, policy) {
     if (cwd === void 0) return null;
-    const normalizedCwd = normalize2(resolve21(cwd));
+    const normalizedCwd = normalize2(resolve20(cwd));
     const isAllowed = policy.pathRules.some((rule) => {
-      const normalizedRule = normalize2(resolve21(rule.path));
+      const normalizedRule = normalize2(resolve20(rule.path));
       const isUnderRule = normalizedCwd === normalizedRule || normalizedCwd.startsWith(normalizedRule + sep12);
       return isUnderRule && rule.access !== "none";
     });
@@ -56155,4 +56164,4 @@ export {
   shutdownFeedbackSubscriber,
   createEventBusBridge
 };
-//# sourceMappingURL=chunk-HA2MM4C2.js.map
+//# sourceMappingURL=chunk-LOYIV3HG.js.map