nexus-agents 8.104.9 → 8.105.0

package/dist/{ast-rule-runner-ABFVZFIE.js → ast-rule-runner-SGQI3VOF.js}

@@ -9,8 +9,9 @@ import {
   getBuiltInAstRulesPath,
   loadRules,
   runAstQaRules
-} from "./chunk-I3KWRIK3.js";
-import "./chunk-SIQVWR3R.js";
+} from "./chunk-CWWJUQY6.js";
+import "./chunk-XEPZSDN5.js";
+import "./chunk-RPOGHHN7.js";
 import "./chunk-UE7A2XHM.js";
 import "./chunk-LWOX65CP.js";
 import "./chunk-PX6F3LHL.js";
@@ -26,4 +27,4 @@ export {
   loadRules,
   runAstQaRules
 };
-//# sourceMappingURL=ast-rule-runner-ABFVZFIE.js.map
+//# sourceMappingURL=ast-rule-runner-SGQI3VOF.js.map

package/dist/{child-mcp-config-L42WMRSO.js → child-mcp-config-6J647CLV.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-OITVVSWO.js";
 import {
   createLogger
-} from "./chunk-SIQVWR3R.js";
+} from "./chunk-RPOGHHN7.js";
 import "./chunk-UE7A2XHM.js";
 import "./chunk-LWOX65CP.js";
 import "./chunk-PX6F3LHL.js";
@@ -56,4 +56,4 @@ async function generateMcpConfig(options) {
 export {
   generateMcpConfig
 };
-//# sourceMappingURL=child-mcp-config-L42WMRSO.js.map
+//# sourceMappingURL=child-mcp-config-6J647CLV.js.map

package/dist/{chunk-6J3EIPB5.js → chunk-3NONAKKZ.js}

@@ -2,7 +2,7 @@ import {
   createLogger,
   err,
   ok
-} from "./chunk-SIQVWR3R.js";
+} from "./chunk-RPOGHHN7.js";
 
 // src/scm/token-resolver.ts
 import { execFile } from "node:child_process";
@@ -87,4 +87,4 @@ export {
   hasToken,
   getTokenEnvVars
 };
-//# sourceMappingURL=chunk-6J3EIPB5.js.map
+//# sourceMappingURL=chunk-3NONAKKZ.js.map

package/dist/{chunk-KJ3JOYAI.js → chunk-5MHIYVCE.js}

@@ -1,6 +1,6 @@
 import {
   resolveClassGuardMs
-} from "./chunk-SIQVWR3R.js";
+} from "./chunk-RPOGHHN7.js";
 
 // src/cli/cli-readiness.ts
 var READINESS_LEVELS = ["installed", "authenticated", "serves"];
@@ -16,6 +16,23 @@ function buildReadiness(cli, levels) {
   const reached = highestVerified(levels);
   return { cli, levels, ...reached !== void 0 ? { reached } : {} };
 }
+function buildGatewayReadiness(cli, gateway, serves) {
+  const notRun = {
+    status: "not-attempted",
+    reason: `the CLI is not run: gateway model ${gateway.gatewayModel} serves this slot`
+  };
+  const levels = { installed: notRun, authenticated: notRun, serves };
+  return { cli, levels, gateway, ...serves.status === "verified" ? { reached: "serves" } : {} };
+}
+function readinessSummary(readiness) {
+  const g = readiness.gateway;
+  if (g !== void 0) {
+    const why = g.cliState === "disabled" ? "CLI disabled by NEXUS_DISABLED_CLIS" : "CLI not available";
+    const verdict = readiness.reached === "serves" ? "serves" : "not ready";
+    return `served by gateway model ${g.gatewayModel} (${why}) \u2014 ${verdict}`;
+  }
+  return readiness.reached === void 0 ? "not ready" : `ready through "${readiness.reached}"`;
+}
 function formatReadiness(readiness) {
   const icon = (o) => {
     switch (o.status) {
@@ -36,8 +53,7 @@ function formatReadiness(readiness) {
     const detail = outcome.status === "verified" ? "" : ` \u2014 ${outcome.reason}`;
     return `      ${icon(outcome)} ${level}${detail}`;
   });
-  const summary = readiness.reached === void 0 ? "not ready" : `ready through "${readiness.reached}"`;
-  return [`  ${readiness.cli}: ${summary}`, ...lines].join("\n");
+  return [`  ${readiness.cli}: ${readinessSummary(readiness)}`, ...lines].join("\n");
 }
 var SERVES_PROBE_PROMPT = "Reply with the single word: ok";
 async function probeServes(adapter, timeoutMs = resolveClassGuardMs("interactive")) {
@@ -86,8 +102,9 @@ async function withDeadline(work, timeoutMs) {
 
 export {
   buildReadiness,
+  buildGatewayReadiness,
   formatReadiness,
   SERVES_PROBE_PROMPT,
   probeServes
 };
-//# sourceMappingURL=chunk-KJ3JOYAI.js.map
+//# sourceMappingURL=chunk-5MHIYVCE.js.map

package/dist/chunk-5MHIYVCE.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/cli-readiness.ts"],"sourcesContent":["/**\n * Readiness levels for a CLI adapter (#4376, #4351 criterion 7).\n *\n * Nothing in the tree could confirm that an adapter which *looks* healthy can\n * actually serve a completion. `healthCheck()` proves the binary exists at an\n * acceptable version; `cli-auth-probe` proves credentials are present and\n * unexpired, and says so explicitly — \"No live API calls.\" Neither proves the\n * adapter serves anything.\n *\n * That is the state #4351 reported: every voter returned `stop_sequence` with\n * zero tokens while every available check said healthy. The checks were not\n * wrong; they were answering a narrower question than the caller assumed.\n *\n * ## Levels, and what each one actually proves\n *\n * | level           | proves                                    | costs |\n * | --------------- | ----------------------------------------- | ----- |\n * | `installed`     | the binary exists at a supported version  | none  |\n * | `authenticated` | credentials are present and unexpired     | none  |\n * | `serves`        | a real completion came back with content  | quota |\n *\n * `serves` is the only level that can catch #4351, and the only one that\n * spends the resource it is measuring. It therefore runs **only when\n * explicitly invoked** (`doctor --live`). Decided by a 7-voter `higher_order`\n * panel on #4376 (5 of 6 approvers): the rejected alternative cached a probe\n * result behind a TTL on the default path, which is a stale measurement\n * presented as current readiness — the same defect this module exists to fix.\n *\n * ## Not-attempted is not a failure\n *\n * The load-bearing distinction. A level that was never run reports\n * `not-attempted`, never `failed`. A reader must be able to tell \"we checked\n * and it does not serve\" from \"we did not check\", because the second is the\n * default state of every run that does not pass `--live`, and reporting it as\n * either healthy or broken would be a claim nobody measured.\n *\n * @module cli/cli-readiness\n * (Source: Issue #4376)\n */\n\nimport { resolveClassGuardMs } from '../config/timeouts.js';\nimport type { CliName } from '../cli-adapters/types.js';\n\n/** Ordered weakest to strongest. Each level subsumes the ones before it. */\nexport const READINESS_LEVELS = ['installed', 'authenticated', 'serves'] as const;\n\nexport type ReadinessLevel = (typeof READINESS_LEVELS)[number];\n\n/** What a single level's check concluded. */\nexport type LevelOutcome =\n  | { readonly status: 'verified' }\n  | { readonly status: 'failed'; readonly reason: string }\n  /** Not run. Carries why, so the report can distinguish opt-out from error. */\n  | { readonly status: 'not-attempted'; readonly reason: string };\n\n/**\n * The slot is served by a gateway model, not the CLI (#6720). Its CLI levels\n * are not measured — the CLI is disabled or not available, and is not run —\n * so only `serves` says anything, and it says it about the gateway model.\n */\ninterface GatewayServedReadiness {\n  readonly gatewayModel: string;\n  /** Why the CLI does not serve the slot. */\n  readonly cliState: 'disabled' | 'not-available';\n}\n\nexport interface CliReadiness {\n  readonly cli: CliName;\n  readonly levels: Readonly<Record<ReadinessLevel, LevelOutcome>>;\n  /** Present when a gateway model serves the slot; the levels then describe it. */\n  readonly gateway?: GatewayServedReadiness;\n  /**\n   * The strongest level actually VERIFIED, or undefined when even `installed`\n   * failed. Never inferred from a level that was not attempted.\n   */\n  readonly reached?: ReadinessLevel;\n}\n\n/** Human-readable statement of what a level does and does not prove. */\nexport const LEVEL_MEANING: Readonly<Record<ReadinessLevel, string>> = {\n  installed: 'binary present at a supported version — proves nothing about auth or serving',\n  authenticated: 'credentials present and unexpired, read locally — no API call was made',\n  serves: 'a real completion returned content — the only level that proves the adapter works',\n};\n\n/**\n * The strongest verified level, stopping at the first gap.\n *\n * Stops rather than scanning for any verified level, because the ladder is\n * cumulative: a `serves` verification below a failed `authenticated` would\n * mean the two checks disagree, and reporting the higher one would paper over\n * that. A `not-attempted` level stops the ladder exactly like a failure —\n * absence of a check is not a pass.\n */\nexport function highestVerified(\n  levels: Readonly<Record<ReadinessLevel, LevelOutcome>>\n): ReadinessLevel | undefined {\n  let reached: ReadinessLevel | undefined;\n  for (const level of READINESS_LEVELS) {\n    if (levels[level].status !== 'verified') break;\n    reached = level;\n  }\n  return reached;\n}\n\n/** Assemble a readiness result, deriving `reached` from the outcomes. */\nexport function buildReadiness(\n  cli: CliName,\n  levels: Readonly<Record<ReadinessLevel, LevelOutcome>>\n): CliReadiness {\n  const reached = highestVerified(levels);\n  return { cli, levels, ...(reached !== undefined ? { reached } : {}) };\n}\n\n/**\n * Readiness of a slot a gateway model serves (#6720). `installed` and\n * `authenticated` are the CLI's rungs and were not run — the CLI is not what\n * serves — so they are `not-attempted` with that reason, and `reached` is\n * `serves` exactly when the gateway model's completion came back.\n */\nexport function buildGatewayReadiness(\n  cli: CliName,\n  gateway: GatewayServedReadiness,\n  serves: LevelOutcome\n): CliReadiness {\n  const notRun: LevelOutcome = {\n    status: 'not-attempted',\n    reason: `the CLI is not run: gateway model ${gateway.gatewayModel} serves this slot`,\n  };\n  const levels = { installed: notRun, authenticated: notRun, serves };\n  return { cli, levels, gateway, ...(serves.status === 'verified' ? { reached: 'serves' } : {}) };\n}\n\n/** The header of one readiness entry. */\nfunction readinessSummary(readiness: CliReadiness): string {\n  const g = readiness.gateway;\n  if (g !== undefined) {\n    const why =\n      g.cliState === 'disabled' ? 'CLI disabled by NEXUS_DISABLED_CLIS' : 'CLI not available';\n    const verdict = readiness.reached === 'serves' ? 'serves' : 'not ready';\n    return `served by gateway model ${g.gatewayModel} (${why}) — ${verdict}`;\n  }\n  return readiness.reached === undefined ? 'not ready' : `ready through \"${readiness.reached}\"`;\n}\n\n/**\n * Render one CLI's ladder, naming every level's state.\n *\n * Every level is printed, including the ones that did not run. A report that\n * silently omitted `serves` would read as a clean bill of health from a run\n * that never tested serving — which is precisely how #4351 went unnoticed.\n */\nexport function formatReadiness(readiness: CliReadiness): string {\n  // Exhaustive rather than a ternary chain (#4563): a new LevelOutcome status\n  // would otherwise fall into the '·' arm and render as \"not attempted\",\n  // quietly misreporting whatever the new state actually means.\n  const icon = (o: LevelOutcome): string => {\n    switch (o.status) {\n      case 'verified':\n        return '✓';\n      case 'failed':\n        return '✗';\n      case 'not-attempted':\n        return '·';\n      default: {\n        const exhaustive: never = o;\n        throw new Error(`Unhandled level outcome: ${JSON.stringify(exhaustive)}`);\n      }\n    }\n  };\n\n  const lines = READINESS_LEVELS.map((level) => {\n    const outcome = readiness.levels[level];\n    const detail = outcome.status === 'verified' ? '' : ` — ${outcome.reason}`;\n    return `      ${icon(outcome)} ${level}${detail}`;\n  });\n\n  return [`  ${readiness.cli}: ${readinessSummary(readiness)}`, ...lines].join('\\n');\n}\n\n/** The minimal adapter surface the `serves` probe needs. */\nexport interface ServesProbeTarget {\n  execute(task: {\n    content: string;\n    maxTokens?: number;\n  }): Promise<{ ok: true; value: { text: string } } | { ok: false; error: { message: string } }>;\n}\n\n/**\n * The smallest prompt that still proves generation happened.\n *\n * Short on purpose — this level spends real quota, so it asks for the least\n * that can distinguish \"served content\" from \"returned nothing\".\n */\nexport const SERVES_PROBE_PROMPT = 'Reply with the single word: ok';\n\n/**\n * Probe whether an adapter actually serves a completion.\n *\n * The check that matters is **non-empty content**, not a successful exit.\n * #4351's signature was every voter returning `stop_sequence` with zero\n * tokens: the call succeeded and produced nothing. An adapter that returns\n * `ok` with empty text has not served, and saying otherwise would reproduce\n * the exact reading that made the incident invisible.\n *\n * Bounded by the `interactive` operation-class guard. Found by running it: an\n * unbounded ladder over four adapters hung past two minutes with no output,\n * and a readiness check that never returns is worse than one that reports a\n * failure — the operator learns nothing either way, but waits for it. A\n * timeout is itself a legitimate not-ready result, not an error.\n *\n * @param adapter - The adapter to probe.\n * @param timeoutMs - Per-adapter ceiling; defaults to the interactive guard.\n */\nexport async function probeServes(\n  adapter: ServesProbeTarget,\n  timeoutMs: number = resolveClassGuardMs('interactive')\n): Promise<LevelOutcome> {\n  let result: Awaited<ReturnType<ServesProbeTarget['execute']>>;\n  try {\n    result = await withDeadline(\n      adapter.execute({ content: SERVES_PROBE_PROMPT, maxTokens: 16 }),\n      timeoutMs\n    );\n  } catch (caught: unknown) {\n    if (caught instanceof ProbeTimeout) {\n      return {\n        status: 'failed',\n        reason: `no response within ${String(Math.round(timeoutMs / 1000))}s`,\n      };\n    }\n    const message = caught instanceof Error ? caught.message : String(caught);\n    return { status: 'failed', reason: `probe threw: ${message}` };\n  }\n\n  if (!result.ok) {\n    return { status: 'failed', reason: result.error.message };\n  }\n  if (result.value.text.trim() === '') {\n    return {\n      status: 'failed',\n      reason: 'call succeeded but returned no content — the #4351 signature',\n    };\n  }\n  return { status: 'verified' };\n}\n\n/** Raised when a probe outlives its ceiling. */\nclass ProbeTimeout extends Error {}\n\n/**\n * Race a promise against a deadline.\n *\n * The underlying call is not cancelled — a CLI subprocess keeps running until\n * its own guard reaps it. What this bounds is how long the OPERATOR waits,\n * which is the thing that made an unbounded ladder unusable.\n */\nasync function withDeadline<T>(work: Promise<T>, timeoutMs: number): Promise<T> {\n  let timer: NodeJS.Timeout | undefined;\n  const deadline = new Promise<never>((_resolve, reject) => {\n    timer = setTimeout(() => {\n      reject(new ProbeTimeout());\n    }, timeoutMs);\n    // Deliberately NOT unref'd. An unref'd timer does not hold the event loop\n    // open, so if the probed call never settles and nothing else is pending,\n    // Node can exit at the await before the deadline fires — the guarantee\n    // voiding itself in precisely the case it exists for. `clearTimeout` in\n    // the finally is what stops it outliving a call that did settle.\n  });\n\n  try {\n    return await Promise.race([work, deadline]);\n  } finally {\n    if (timer !== undefined) clearTimeout(timer);\n  }\n}\n"],"mappings":";;;;;AA4CO,IAAM,mBAAmB,CAAC,aAAa,iBAAiB,QAAQ;AAkDhE,SAAS,gBACd,QAC4B;AAC5B,MAAI;AACJ,aAAW,SAAS,kBAAkB;AACpC,QAAI,OAAO,KAAK,EAAE,WAAW,WAAY;AACzC,cAAU;AAAA,EACZ;AACA,SAAO;AACT;AAGO,SAAS,eACd,KACA,QACc;AACd,QAAM,UAAU,gBAAgB,MAAM;AACtC,SAAO,EAAE,KAAK,QAAQ,GAAI,YAAY,SAAY,EAAE,QAAQ,IAAI,CAAC,EAAG;AACtE;AAQO,SAAS,sBACd,KACA,SACA,QACc;AACd,QAAM,SAAuB;AAAA,IAC3B,QAAQ;AAAA,IACR,QAAQ,qCAAqC,QAAQ,YAAY;AAAA,EACnE;AACA,QAAM,SAAS,EAAE,WAAW,QAAQ,eAAe,QAAQ,OAAO;AAClE,SAAO,EAAE,KAAK,QAAQ,SAAS,GAAI,OAAO,WAAW,aAAa,EAAE,SAAS,SAAS,IAAI,CAAC,EAAG;AAChG;AAGA,SAAS,iBAAiB,WAAiC;AACzD,QAAM,IAAI,UAAU;AACpB,MAAI,MAAM,QAAW;AACnB,UAAM,MACJ,EAAE,aAAa,aAAa,wCAAwC;AACtE,UAAM,UAAU,UAAU,YAAY,WAAW,WAAW;AAC5D,WAAO,2BAA2B,EAAE,YAAY,KAAK,GAAG,YAAO,OAAO;AAAA,EACxE;AACA,SAAO,UAAU,YAAY,SAAY,cAAc,kBAAkB,UAAU,OAAO;AAC5F;AASO,SAAS,gBAAgB,WAAiC;AAI/D,QAAM,OAAO,CAAC,MAA4B;AACxC,YAAQ,EAAE,QAAQ;AAAA,MAChB,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,SAAS;AACP,cAAM,aAAoB;AAC1B,cAAM,IAAI,MAAM,4BAA4B,KAAK,UAAU,UAAU,CAAC,EAAE;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AAEA,QAAM,QAAQ,iBAAiB,IAAI,CAAC,UAAU;AAC5C,UAAM,UAAU,UAAU,OAAO,KAAK;AACtC,UAAM,SAAS,QAAQ,WAAW,aAAa,KAAK,WAAM,QAAQ,MAAM;AACxE,WAAO,SAAS,KAAK,OAAO,CAAC,IAAI,KAAK,GAAG,MAAM;AAAA,EACjD,CAAC;AAED,SAAO,CAAC,KAAK,UAAU,GAAG,KAAK,iBAAiB,SAAS,CAAC,IAAI,GAAG,KAAK,EAAE,KAAK,IAAI;AACnF;AAgBO,IAAM,sBAAsB;AAoBnC,eAAsB,YACpB,SACA,YAAoB,oBAAoB,aAAa,GAC9B;AACvB,MAAI;AACJ,MAAI;AACF,aAAS,MAAM;AAAA,MACb,QAAQ,QAAQ,EAAE,SAAS,qBAAqB,WAAW,GAAG,CAAC;AAAA,MAC/D;AAAA,IACF;AAAA,EACF,SAAS,QAAiB;AACxB,QAAI,kBAAkB,cAAc;AAClC,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,QAAQ,sBAAsB,OAAO,KAAK,MAAM,YAAY,GAAI,CAAC,CAAC;AAAA,MACpE;AAAA,IACF;AACA,UAAM,UAAU,kBAAkB,QAAQ,OAAO,UAAU,OAAO,MAAM;AACxE,WAAO,EAAE,QAAQ,UAAU,QAAQ,gBAAgB,OAAO,GAAG;AAAA,EAC/D;AAEA,MAAI,CAAC,OAAO,IAAI;AACd,WAAO,EAAE,QAAQ,UAAU,QAAQ,OAAO,MAAM,QAAQ;AAAA,EAC1D;AACA,MAAI,OAAO,MAAM,KAAK,KAAK,MAAM,IAAI;AACnC,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,EACF;AACA,SAAO,EAAE,QAAQ,WAAW;AAC9B;AAGA,IAAM,eAAN,cAA2B,MAAM;AAAC;AASlC,eAAe,aAAgB,MAAkB,WAA+B;AAC9E,MAAI;AACJ,QAAM,WAAW,IAAI,QAAe,CAAC,UAAU,WAAW;AACxD,YAAQ,WAAW,MAAM;AACvB,aAAO,IAAI,aAAa,CAAC;AAAA,IAC3B,GAAG,SAAS;AAAA,EAMd,CAAC;AAED,MAAI;AACF,WAAO,MAAM,QAAQ,KAAK,CAAC,MAAM,QAAQ,CAAC;AAAA,EAC5C,UAAE;AACA,QAAI,UAAU,OAAW,cAAa,KAAK;AAAA,EAC7C;AACF;","names":[]}

package/dist/{chunk-D3KUSAVV.js → chunk-5NKP4DVA.js}

@@ -7,12 +7,12 @@ import {
   readGatewayTransport,
   requireApiKey,
   validateApiKeyPresence
-} from "./chunk-JBCG5X7E.js";
+} from "./chunk-SV45NVN2.js";
 import {
   assertCustomApiHostResolvesPublic,
   hostnameOf,
   redactApiKey
-} from "./chunk-PAUO5OFW.js";
+} from "./chunk-GGP3F7FG.js";
 import {
   sanitizeErrorDetails
 } from "./chunk-2NDA4DHW.js";
@@ -40,7 +40,7 @@ import {
   readModelAllowlist,
   recordUsageEvent,
   refineGatewayCatalog
-} from "./chunk-SIQVWR3R.js";
+} from "./chunk-RPOGHHN7.js";
 
 // src/adapters/openai-compat-adapter.ts
 import OpenAI2 from "openai";
@@ -1038,4 +1038,4 @@ export {
   createOpenAICompatAdapter,
   buildOpenAICompatAdapters
 };
-//# sourceMappingURL=chunk-D3KUSAVV.js.map
+//# sourceMappingURL=chunk-5NKP4DVA.js.map

package/dist/{chunk-N67B5VOS.js → chunk-75XDI2LH.js}

@@ -1,3 +1,6 @@
+import {
+  resolveInsideRoot
+} from "./chunk-XEPZSDN5.js";
 import {
   ParseError,
   SecurityError,
@@ -5,7 +8,7 @@ import {
   err,
   getErrorMessage,
   ok
-} from "./chunk-SIQVWR3R.js";
+} from "./chunk-RPOGHHN7.js";
 import {
   findRepoRoot,
   getActiveWorkspaceRoot,
@@ -14,104 +17,15 @@ import {
 } from "./chunk-LWOX65CP.js";
 
 // src/cli/research-helpers-io.ts
-import * as fs3 from "node:fs/promises";
-import { realpathSync as realpathSync2, statSync } from "node:fs";
-import { dirname as dirname3, join, resolve as resolve3 } from "node:path";
-
-// src/security/safe-path.ts
-import { resolve, sep, dirname, basename, isAbsolute, relative } from "node:path";
-import * as fs from "node:fs";
-function isEnoent(err2) {
-  return typeof err2 === "object" && err2 !== null && "code" in err2 && err2.code === "ENOENT";
-}
-function getRealpathSync() {
-  try {
-    const fn = fs.realpathSync;
-    if (typeof fn !== "function") {
-      return void 0;
-    }
-    return typeof fn.native === "function" ? (p) => fn.native(p) : (p) => fn(p);
-  } catch {
-    return void 0;
-  }
-}
-function canonicalizeRoot(root) {
-  const resolved = resolve(root);
-  const realpathFn = getRealpathSync();
-  if (realpathFn === void 0) {
-    return resolved;
-  }
-  try {
-    return realpathFn(resolved);
-  } catch {
-    return resolved;
-  }
-}
-function resolvePathWithSymlinks(targetPath) {
-  const realpathFn = getRealpathSync();
-  if (realpathFn === void 0) {
-    return targetPath;
-  }
-  let existing = targetPath;
-  const trailing = [];
-  for (; ; ) {
-    try {
-      const real = realpathFn(existing);
-      return trailing.length === 0 ? real : resolve(real, ...trailing.reverse());
-    } catch (err2) {
-      if (!isEnoent(err2)) {
-        return null;
-      }
-      if (isSymlink(existing)) {
-        return null;
-      }
-      const parent = dirname(existing);
-      if (parent === existing) {
-        return null;
-      }
-      trailing.push(basename(existing));
-      existing = parent;
-    }
-  }
-}
-function isSymlink(path) {
-  try {
-    return fs.lstatSync(path).isSymbolicLink();
-  } catch {
-    return false;
-  }
-}
-function isWithin(parent, child) {
-  if (child === parent) return true;
-  const rel = relative(parent, child);
-  if (rel === "") return true;
-  if (rel === ".." || rel.startsWith(".." + sep) || isAbsolute(rel)) return false;
-  return true;
-}
-function resolveInsideRoot(filePath, root = process.cwd()) {
-  const canonicalRoot = canonicalizeRoot(root);
-  const resolvedRoot = resolve(root);
-  const lexicalResolved = resolve(resolvedRoot, filePath);
-  if (!isWithin(resolvedRoot, lexicalResolved) && !isWithin(canonicalRoot, lexicalResolved)) {
-    return null;
-  }
-  const realCandidate = resolvePathWithSymlinks(lexicalResolved);
-  if (realCandidate === null) {
-    return null;
-  }
-  if (!isWithin(canonicalRoot, realCandidate)) {
-    return null;
-  }
-  return realCandidate;
-}
-
-// src/cli/research-helpers-io.ts
+import * as fs2 from "node:fs/promises";
+import { realpathSync, statSync } from "node:fs";
+import { dirname as dirname2, join, resolve as resolve2 } from "node:path";
 import { parse as parseYaml, stringify as stringifyYaml2 } from "yaml";
 
 // src/cli/research-scaffold.ts
-import * as fs2 from "node:fs/promises";
+import * as fs from "node:fs/promises";
 import { existsSync } from "node:fs";
-import { dirname as dirname2, resolve as resolve2 } from "node:path";
+import { dirname, resolve } from "node:path";
 import { stringify as stringifyYaml } from "yaml";
 var SCHEMA_VERSION = "1.0";
 var ANNOUNCED = /* @__PURE__ */ new Set();
@@ -133,7 +47,7 @@ function emptyTechniquesYaml() {
   return stringifyYaml({ schema_version: SCHEMA_VERSION, techniques: {} });
 }
 async function ensureRegistryFile(rootDir, filename) {
-  const filePath = resolve2(rootDir, REGISTRY_PATH, filename);
+  const filePath = resolve(rootDir, REGISTRY_PATH, filename);
   if (existsSync(filePath)) return ok(filePath);
   if (scaffoldDisabled()) {
     return err(
@@ -142,7 +56,7 @@ async function ensureRegistryFile(rootDir, filename) {
       )
     );
   }
-  if (!existsSync(resolve2(rootDir, "docs"))) {
+  if (!existsSync(resolve(rootDir, "docs"))) {
     return err(
       new ParseError(
         `Registry file missing: ${filePath}. ${rootDir}/docs/ does not exist; refusing to create a Nexus subtree in a non-documented root. Run 'nexus-agents init' first, or create ${rootDir}/docs/ manually.`
@@ -150,9 +64,9 @@ async function ensureRegistryFile(rootDir, filename) {
     );
   }
   try {
-    await fs2.mkdir(dirname2(filePath), { recursive: true });
+    await fs.mkdir(dirname(filePath), { recursive: true });
     const content = filename === PAPERS_FILE ? emptyPapersYaml() : emptyTechniquesYaml();
-    await fs2.writeFile(filePath, content, "utf-8");
+    await fs.writeFile(filePath, content, "utf-8");
     announceOnce(filePath, filename);
     return ok(filePath);
   } catch (e) {
@@ -182,7 +96,7 @@ function findRegistryAncestor(start) {
   let current;
   let startDev;
   try {
-    current = realpathSync2(start);
+    current = realpathSync(start);
     startDev = statSync(current).dev;
   } catch {
     return null;
@@ -190,7 +104,7 @@ function findRegistryAncestor(start) {
   for (let depth = 0; depth < 64; depth++) {
     if (hasRegistryDir(current)) return current;
     if (isRepoRoot(current)) return null;
-    const parent = dirname3(current);
+    const parent = dirname2(current);
     if (parent === current) return null;
     try {
       if (statSync(parent).dev !== startDev) return null;
@@ -202,7 +116,7 @@ function findRegistryAncestor(start) {
   return null;
 }
 function resolveRegistryRoot(rootDir) {
-  if (rootDir !== void 0) return resolve3(rootDir);
+  if (rootDir !== void 0) return resolve2(rootDir);
   const origin = getActiveWorkspaceRoot() ?? process.cwd();
   const memoised = registryRootByOrigin.get(origin);
   if (memoised !== void 0) return memoised;
@@ -213,9 +127,9 @@ function resolveRegistryRoot(rootDir) {
   }
   let fallback;
   try {
-    fallback = realpathSync2(origin);
+    fallback = realpathSync(origin);
   } catch {
-    fallback = resolve3(origin);
+    fallback = resolve2(origin);
   }
   if (!warnedCwdFallback) {
     warnedCwdFallback = true;
@@ -236,7 +150,7 @@ function validatePath(constructedPath, allowedRoot) {
     return {
       ok: false,
       error: new SecurityError("Path traversal detected: path escapes allowed root directory", {
-        context: { constructedPath, allowedRoot: resolve3(allowedRoot) }
+        context: { constructedPath, allowedRoot: resolve2(allowedRoot) }
       })
     };
   }
@@ -251,7 +165,7 @@ async function loadTechniquesRegistry(rootDir) {
   }
   await ensureRegistryFile(root, TECHNIQUES_FILE);
   try {
-    const content = await fs3.readFile(pathValidation.value, "utf-8");
+    const content = await fs2.readFile(pathValidation.value, "utf-8");
     return { ok: true, value: parseYaml(content) };
   } catch (error) {
     const message = getErrorMessage(error);
@@ -267,7 +181,7 @@ async function loadPapersRegistry(rootDir) {
   }
   await ensureRegistryFile(root, PAPERS_FILE);
   try {
-    const content = await fs3.readFile(pathValidation.value, "utf-8");
+    const content = await fs2.readFile(pathValidation.value, "utf-8");
     return { ok: true, value: parseYaml(content) };
   } catch (error) {
     const message = getErrorMessage(error);
@@ -283,7 +197,7 @@ async function savePapersRegistry(registry, rootDir) {
   }
   try {
     const content = stringifyYaml2(registry, { lineWidth: 100 });
-    await fs3.writeFile(pathValidation.value, content, "utf-8");
+    await fs2.writeFile(pathValidation.value, content, "utf-8");
     return { ok: true, value: void 0 };
   } catch (error) {
     const message = getErrorMessage(error);
@@ -292,7 +206,6 @@ async function savePapersRegistry(registry, rootDir) {
 }
 
 export {
-  resolveInsideRoot,
   REGISTRY_PATH,
   resolveRegistryRoot,
   getProjectRoot,
@@ -300,4 +213,4 @@ export {
   loadPapersRegistry,
   savePapersRegistry
 };
-//# sourceMappingURL=chunk-N67B5VOS.js.map
+//# sourceMappingURL=chunk-75XDI2LH.js.map

package/dist/chunk-75XDI2LH.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/research-helpers-io.ts","../src/cli/research-scaffold.ts"],"sourcesContent":["/**\n * Research Registry I/O Operations\n *\n * File operations for loading and saving research registry YAML files.\n * Includes path traversal protection per Issue #353.\n *\n * @see docs/research/RESEARCH_INDEX.md\n * @see Issue #237 (Epic #225)\n * @see Issue #353 (Security - Path traversal fix)\n * @see Issue #5053 (Registry root resolution — workspace/repo root, not cwd)\n */\n\nimport * as fs from 'node:fs/promises';\nimport { realpathSync, statSync } from 'node:fs';\nimport { dirname, join, resolve } from 'node:path';\nimport { resolveInsideRoot } from '../security/safe-path.js';\nimport { parse as parseYaml, stringify as stringifyYaml } from 'yaml';\nimport type { Result } from '../core/index.js';\nimport { SecurityError, createLogger, getErrorMessage } from '../core/index.js';\nimport { getActiveWorkspaceRoot } from '../config/nexus-data-dir.js';\nimport { findRepoRoot, isRepoRoot } from '../config/repo-root-detection.js';\nimport { ParseError } from '../core/types/workflow.js';\nimport type { TechniquesRegistry, PapersRegistry } from './research-types.js';\nimport { ensureRegistryFile } from './research-scaffold.js';\n\n// =============================================================================\n// CONSTANTS\n// =============================================================================\n\n/** Path to research registry directory relative to project root */\nexport const REGISTRY_PATH = 'docs/research/registry';\n\n/** Filename for techniques registry */\nexport const TECHNIQUES_FILE = 'techniques.yaml';\n\n/** Filename for papers registry */\nexport const PAPERS_FILE = 'papers.yaml';\n\n// =============================================================================\n// PROJECT ROOT\n// =============================================================================\n\nconst logger = createLogger({ component: 'research-registry-root' });\n\n/**\n * Per-process memo of discovered registry roots (#5053), keyed on the origin\n * the walk started from (the active workspace root, else cwd). The MCP server\n * fetches its client's `roots` asynchronously after `initialized`, so a\n * `research_*` call can land before — or a `roots/list_changed` after — the\n * workspace root is known; keying on the origin means a changed origin\n * resolves afresh instead of inheriting the first caller's cwd-derived root.\n */\nconst registryRootByOrigin = new Map<string, string>();\n/** The cwd-fallback warning fires once per process overall, not per origin. */\nlet warnedCwdFallback = false;\n\n// @export-no-consumer-yet — see #5053. Test-only reset hook for the per-origin\n// memo and the one-shot cwd warning, the same shape as the data-dir module's\n// `_reset*ForTests` helpers; no production consumer is intended.\n/** Test helper — clears the registry-root memo and the one-shot warning. */\nexport function _resetRegistryRootForTests(): void {\n  registryRootByOrigin.clear();\n  warnedCwdFallback = false;\n}\n\n/** True iff `<dir>/docs/research/registry` exists as a directory. */\nfunction hasRegistryDir(dir: string): boolean {\n  try {\n    return statSync(join(dir, REGISTRY_PATH)).isDirectory();\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Walks upward from `start` looking for the nearest ancestor (inclusive) that\n * already contains `docs/research/registry`, searching only within the\n * enclosing git repo: the walk ends at the first directory that `isRepoRoot`\n * (after checking that directory itself), so a nested checkout never adopts —\n * or writes into — an outer repo's registry. Mirrors `findRepoRoot`'s other\n * defenses: bounded depth, stops at the filesystem root, and refuses to cross\n * a mount point so a sandboxed workdir cannot pick up a host-side registry.\n */\nfunction findRegistryAncestor(start: string): string | null {\n  let current: string;\n  let startDev: number;\n  try {\n    current = realpathSync(start);\n    startDev = statSync(current).dev;\n  } catch {\n    return null;\n  }\n  for (let depth = 0; depth < 64; depth++) {\n    if (hasRegistryDir(current)) return current;\n    if (isRepoRoot(current)) return null;\n    const parent = dirname(current);\n    if (parent === current) return null;\n    try {\n      if (statSync(parent).dev !== startDev) return null;\n    } catch {\n      return null;\n    }\n    current = parent;\n  }\n  return null;\n}\n\n/**\n * Resolves the directory that owns `docs/research/registry` (#5053).\n *\n * Resolution order:\n *  1. An explicit `rootDir` argument wins outright (resolved, never memoised).\n *  2. The nearest ancestor of the active workspace root (MCP `roots`, #3991)\n *     — or of `process.cwd()` when none is set — that already contains\n *     `docs/research/registry`, without crossing a repo boundary: the search\n *     stops at the enclosing repo root, so a nested checkout never resolves\n *     to an outer repo's registry.\n *  3. Otherwise the enclosing git repo root via `findRepoRoot`, so the\n *     first-run scaffold (#2470) lands at the repo root rather than below it.\n *  4. Otherwise cwd, with a warning emitted once per process: nothing above\n *     cwd identifies a project, so cwd is a guess rather than a discovery.\n *\n * Steps 2–4 are memoised per origin (workspace root or cwd), so a workspace\n * root that arrives after the first call — MCP roots are fetched after\n * `initialized` — is honoured rather than shadowed by an earlier cwd-derived\n * result. Before this resolver every helper defaulted to cwd, so a server\n * started inside `packages/nexus-agents` read (and scaffolded) a shadow\n * registry there instead of the repo's.\n */\nexport function resolveRegistryRoot(rootDir?: string): string {\n  if (rootDir !== undefined) return resolve(rootDir);\n\n  const origin = getActiveWorkspaceRoot() ?? process.cwd();\n  const memoised = registryRootByOrigin.get(origin);\n  if (memoised !== undefined) return memoised;\n\n  const discovered = findRegistryAncestor(origin) ?? findRepoRoot(origin);\n  if (discovered !== null) {\n    registryRootByOrigin.set(origin, discovered);\n    return discovered;\n  }\n\n  let fallback: string;\n  try {\n    fallback = realpathSync(origin);\n  } catch {\n    fallback = resolve(origin);\n  }\n  if (!warnedCwdFallback) {\n    warnedCwdFallback = true;\n    logger.warn(\n      'No research registry or git repo found above the working directory; using cwd as the research registry root',\n      { cwd: fallback, registryPath: REGISTRY_PATH }\n    );\n  }\n  registryRootByOrigin.set(origin, fallback);\n  return fallback;\n}\n\n/**\n * Get the project root directory that owns the research registry.\n * Delegates to {@link resolveRegistryRoot} — no longer bare `process.cwd()`.\n */\nexport function getProjectRoot(): string {\n  return resolveRegistryRoot();\n}\n\n// =============================================================================\n// PATH VALIDATION\n// =============================================================================\n\n/**\n * Validates that a constructed path stays within the allowed root directory.\n * Prevents path traversal attacks (e.g., ../../../etc/passwd).\n *\n * @param constructedPath - The full path to validate\n * @param allowedRoot - The root directory that paths must be within\n * @returns Result with validated absolute path or SecurityError\n */\nfunction validatePath(constructedPath: string, allowedRoot: string): Result<string, SecurityError> {\n  const resolved = resolveInsideRoot(constructedPath, allowedRoot);\n  if (resolved === null) {\n    return {\n      ok: false,\n      error: new SecurityError('Path traversal detected: path escapes allowed root directory', {\n        context: { constructedPath, allowedRoot: resolve(allowedRoot) },\n      }),\n    };\n  }\n  return { ok: true, value: resolved };\n}\n\n// =============================================================================\n// LOAD OPERATIONS\n// =============================================================================\n\n/**\n * Load techniques registry from YAML file.\n * Validates path to prevent directory traversal attacks.\n *\n * @param rootDir - Project root directory (defaults to the resolved registry root, see {@link resolveRegistryRoot})\n * @returns Result with TechniquesRegistry or SecurityError/ParseError\n */\nexport async function loadTechniquesRegistry(\n  rootDir?: string\n): Promise<Result<TechniquesRegistry, SecurityError | ParseError>> {\n  const root = resolveRegistryRoot(rootDir);\n  const filePath = join(root, REGISTRY_PATH, TECHNIQUES_FILE);\n\n  const pathValidation = validatePath(filePath, root);\n  if (!pathValidation.ok) {\n    return pathValidation;\n  }\n\n  // #2470: try to scaffold an empty techniques.yaml on first run so research_*\n  // workflows don't error on a fresh install. No-op when file exists.\n  // When scaffold refuses (e.g. <rootDir>/docs/ doesn't exist, or\n  // NEXUS_NO_SCAFFOLD=1), fall through and let readFile produce the original\n  // ENOENT error — that's the existing contract.\n  await ensureRegistryFile(root, TECHNIQUES_FILE);\n\n  try {\n    const content = await fs.readFile(pathValidation.value, 'utf-8');\n    return { ok: true, value: parseYaml(content) as TechniquesRegistry };\n  } catch (error) {\n    const message = getErrorMessage(error);\n    return { ok: false, error: new ParseError(`Failed to load techniques registry: ${message}`) };\n  }\n}\n\n/**\n * Load papers registry from YAML file.\n * Validates path to prevent directory traversal attacks.\n *\n * @param rootDir - Project root directory (defaults to the resolved registry root, see {@link resolveRegistryRoot})\n * @returns Result with PapersRegistry or SecurityError/ParseError\n */\nexport async function loadPapersRegistry(\n  rootDir?: string\n): Promise<Result<PapersRegistry, SecurityError | ParseError>> {\n  const root = resolveRegistryRoot(rootDir);\n  const filePath = join(root, REGISTRY_PATH, PAPERS_FILE);\n\n  const pathValidation = validatePath(filePath, root);\n  if (!pathValidation.ok) {\n    return pathValidation;\n  }\n\n  // #2470: try to scaffold an empty papers.yaml on first run so research_*\n  // workflows don't error on a fresh install. No-op when file exists; falls\n  // through silently when scaffold refuses (no docs/ root, or NEXUS_NO_SCAFFOLD).\n  await ensureRegistryFile(root, PAPERS_FILE);\n\n  try {\n    const content = await fs.readFile(pathValidation.value, 'utf-8');\n    return { ok: true, value: parseYaml(content) as PapersRegistry };\n  } catch (error) {\n    const message = getErrorMessage(error);\n    return { ok: false, error: new ParseError(`Failed to load papers registry: ${message}`) };\n  }\n}\n\n// =============================================================================\n// SAVE OPERATIONS\n// =============================================================================\n\n/**\n * Save techniques registry to YAML file.\n * Validates path to prevent directory traversal attacks.\n *\n * @param registry - The techniques registry to save\n * @param rootDir - Project root directory (defaults to the resolved registry root, see {@link resolveRegistryRoot})\n * @returns Result with void on success or SecurityError/ParseError on failure\n */\nexport async function saveTechniquesRegistry(\n  registry: TechniquesRegistry,\n  rootDir?: string\n): Promise<Result<void, SecurityError | ParseError>> {\n  const root = resolveRegistryRoot(rootDir);\n  const filePath = join(root, REGISTRY_PATH, TECHNIQUES_FILE);\n\n  const pathValidation = validatePath(filePath, root);\n  if (!pathValidation.ok) {\n    return pathValidation;\n  }\n\n  try {\n    const content = stringifyYaml(registry, { lineWidth: 100 });\n    await fs.writeFile(pathValidation.value, content, 'utf-8');\n    return { ok: true, value: undefined };\n  } catch (error) {\n    const message = getErrorMessage(error);\n    return { ok: false, error: new ParseError(`Failed to save techniques registry: ${message}`) };\n  }\n}\n\n/**\n * Save papers registry to YAML file.\n * Validates path to prevent directory traversal attacks.\n *\n * @param registry - The papers registry to save\n * @param rootDir - Project root directory (defaults to the resolved registry root, see {@link resolveRegistryRoot})\n * @returns Result with void on success or SecurityError/ParseError on failure\n */\nexport async function savePapersRegistry(\n  registry: PapersRegistry,\n  rootDir?: string\n): Promise<Result<void, SecurityError | ParseError>> {\n  const root = resolveRegistryRoot(rootDir);\n  const filePath = join(root, REGISTRY_PATH, PAPERS_FILE);\n\n  const pathValidation = validatePath(filePath, root);\n  if (!pathValidation.ok) {\n    return pathValidation;\n  }\n\n  try {\n    const content = stringifyYaml(registry, { lineWidth: 100 });\n    await fs.writeFile(pathValidation.value, content, 'utf-8');\n    return { ok: true, value: undefined };\n  } catch (error) {\n    const message = getErrorMessage(error);\n    return { ok: false, error: new ParseError(`Failed to save papers registry: ${message}`) };\n  }\n}\n","/**\n * research-scaffold — auto-create empty research registry files when missing.\n *\n * On a fresh install or in a sandboxed environment where the project doesn't\n * have `docs/research/registry/`, the research workflows previously errored\n * with `Failed to load papers registry: ENOENT`. The user has no idea what\n * to do.\n *\n * This module provides `ensureResearchRegistry()`: idempotent scaffolding\n * that creates empty YAML registries on ENOENT, announces what it did to\n * stderr (so the operator knows), and returns the path that's now safe to\n * read.\n *\n * Source: Issue #2470 (epic #2467 child).\n */\n\nimport * as fs from 'node:fs/promises';\nimport { existsSync } from 'node:fs';\nimport { dirname, resolve } from 'node:path';\nimport { stringify as stringifyYaml } from 'yaml';\n\nimport type { Result } from '../core/index.js';\nimport { ok, err, getErrorMessage } from '../core/index.js';\nimport { ParseError } from '../core/types/workflow.js';\n\nimport {\n  REGISTRY_PATH,\n  PAPERS_FILE,\n  TECHNIQUES_FILE,\n  resolveRegistryRoot,\n} from './research-helpers-io.js';\nimport { parseBoolEnv } from '../config/defaults-env.js';\n\n/**\n * Names of the registry files this scaffolder knows how to create.\n * `sources.yaml` and `alignments.yaml` live alongside but are populated by\n * different code paths; this scaffolder only owns the two YAML registries\n * that block `research_query` / `research_synthesize` on a fresh install.\n */\ntype ScaffoldedFile = typeof PAPERS_FILE | typeof TECHNIQUES_FILE;\n\nconst SCHEMA_VERSION = '1.0';\n\nconst ANNOUNCED = new Set<string>();\n\nfunction announceOnce(path: string, kind: ScaffoldedFile): void {\n  // De-dupe so that running multiple research commands in one session\n  // produces one announcement per scaffolded file, not per call.\n  if (ANNOUNCED.has(path)) return;\n  ANNOUNCED.add(path);\n  process.stderr.write(\n    `[scaffold] Created empty ${kind} at ${path}; add entries via 'nexus-agents research add' or research_add MCP tool.\\n`\n  );\n}\n\n/**\n * Operator opt-out. When set, scaffolding errors loudly with an actionable\n * message instead of silently writing files. Useful for CI and for\n * environments that want strict \"fail when state is wrong\" semantics.\n */\nfunction scaffoldDisabled(): boolean {\n  return parseBoolEnv('NEXUS_NO_SCAFFOLD', false);\n}\n\nfunction emptyPapersYaml(): string {\n  return stringifyYaml({ schema_version: SCHEMA_VERSION, papers: {} });\n}\n\nfunction emptyTechniquesYaml(): string {\n  return stringifyYaml({ schema_version: SCHEMA_VERSION, techniques: {} });\n}\n\n/**\n * Create the registry directory + an empty YAML file if either is missing.\n * Idempotent: existing files are left untouched.\n *\n * Scaffolds only when `<rootDir>/docs/` already exists. That guard keeps\n * tests, vitest's package cwd, and random scratch directories from getting\n * a `docs/research/` subtree implicitly. Operators on a real project root\n * (which always has `docs/`, either from cloning the repo or running\n * `nexus-agents init`) still get the auto-create behavior the issue asks for.\n *\n * Returns the resolved file path on success, or a ParseError when scaffolding\n * is disabled / refused (so the caller can pass the error through unchanged\n * for backwards compat with existing call sites).\n */\nexport async function ensureRegistryFile(\n  rootDir: string,\n  filename: ScaffoldedFile\n): Promise<Result<string, ParseError>> {\n  const filePath = resolve(rootDir, REGISTRY_PATH, filename);\n\n  if (existsSync(filePath)) return ok(filePath);\n\n  if (scaffoldDisabled()) {\n    return err(\n      new ParseError(\n        `Registry file missing: ${filePath}. Scaffolding disabled (NEXUS_NO_SCAFFOLD=1). Create the file manually or unset the env var.`\n      )\n    );\n  }\n\n  // Refuse to create a docs/ subtree in directories that aren't already\n  // documented project roots. The presence of `<rootDir>/docs/` is the\n  // strong signal we use.\n  if (!existsSync(resolve(rootDir, 'docs'))) {\n    return err(\n      new ParseError(\n        `Registry file missing: ${filePath}. ${rootDir}/docs/ does not exist; ` +\n          `refusing to create a Nexus subtree in a non-documented root. ` +\n          `Run 'nexus-agents init' first, or create ${rootDir}/docs/ manually.`\n      )\n    );\n  }\n\n  try {\n    await fs.mkdir(dirname(filePath), { recursive: true });\n    const content = filename === PAPERS_FILE ? emptyPapersYaml() : emptyTechniquesYaml();\n    await fs.writeFile(filePath, content, 'utf-8');\n    announceOnce(filePath, filename);\n    return ok(filePath);\n  } catch (e: unknown) {\n    return err(\n      new ParseError(\n        `Failed to scaffold ${filename} at ${filePath}: ${getErrorMessage(e)}. Set NEXUS_NO_SCAFFOLD=1 and create manually if scaffolding is unwanted.`\n      )\n    );\n  }\n}\n\n/**\n * Convenience: scaffold both papers.yaml and techniques.yaml. Used by the\n * research workflow startup paths that need both registries available.\n * Without an explicit `rootDir` the files land at the resolved registry root\n * (#5053), never at a bare cwd below it.\n */\nexport async function ensureResearchRegistry(rootDir?: string): Promise<Result<void, ParseError>> {\n  const root = resolveRegistryRoot(rootDir);\n  const papers = await ensureRegistryFile(root, PAPERS_FILE);\n  if (!papers.ok) return papers;\n  const techniques = await ensureRegistryFile(root, TECHNIQUES_FILE);\n  if (!techniques.ok) return techniques;\n  return ok(undefined);\n}\n\n/**\n * Test-only reset of the announcement de-dupe set. Production code never\n * needs this; tests do because Vitest reuses process state across files.\n */\nexport function _resetAnnouncedForTests(): void {\n  ANNOUNCED.clear();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAYA,YAAYA,SAAQ;AACpB,SAAS,cAAc,gBAAgB;AACvC,SAAS,WAAAC,UAAS,MAAM,WAAAC,gBAAe;AAEvC,SAAS,SAAS,WAAW,aAAaC,sBAAqB;;;ACA/D,YAAY,QAAQ;AACpB,SAAS,kBAAkB;AAC3B,SAAS,SAAS,eAAe;AACjC,SAAS,aAAa,qBAAqB;AAsB3C,IAAM,iBAAiB;AAEvB,IAAM,YAAY,oBAAI,IAAY;AAElC,SAAS,aAAa,MAAc,MAA4B;AAG9D,MAAI,UAAU,IAAI,IAAI,EAAG;AACzB,YAAU,IAAI,IAAI;AAClB,UAAQ,OAAO;AAAA,IACb,4BAA4B,IAAI,OAAO,IAAI;AAAA;AAAA,EAC7C;AACF;AAOA,SAAS,mBAA4B;AACnC,SAAO,aAAa,qBAAqB,KAAK;AAChD;AAEA,SAAS,kBAA0B;AACjC,SAAO,cAAc,EAAE,gBAAgB,gBAAgB,QAAQ,CAAC,EAAE,CAAC;AACrE;AAEA,SAAS,sBAA8B;AACrC,SAAO,cAAc,EAAE,gBAAgB,gBAAgB,YAAY,CAAC,EAAE,CAAC;AACzE;AAgBA,eAAsB,mBACpB,SACA,UACqC;AACrC,QAAM,WAAW,QAAQ,SAAS,eAAe,QAAQ;AAEzD,MAAI,WAAW,QAAQ,EAAG,QAAO,GAAG,QAAQ;AAE5C,MAAI,iBAAiB,GAAG;AACtB,WAAO;AAAA,MACL,IAAI;AAAA,QACF,0BAA0B,QAAQ;AAAA,MACpC;AAAA,IACF;AAAA,EACF;AAKA,MAAI,CAAC,WAAW,QAAQ,SAAS,MAAM,CAAC,GAAG;AACzC,WAAO;AAAA,MACL,IAAI;AAAA,QACF,0BAA0B,QAAQ,KAAK,OAAO,gIAEA,OAAO;AAAA,MACvD;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,UAAS,SAAM,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AACrD,UAAM,UAAU,aAAa,cAAc,gBAAgB,IAAI,oBAAoB;AACnF,UAAS,aAAU,UAAU,SAAS,OAAO;AAC7C,iBAAa,UAAU,QAAQ;AAC/B,WAAO,GAAG,QAAQ;AAAA,EACpB,SAAS,GAAY;AACnB,WAAO;AAAA,MACL,IAAI;AAAA,QACF,sBAAsB,QAAQ,OAAO,QAAQ,KAAK,gBAAgB,CAAC,CAAC;AAAA,MACtE;AAAA,IACF;AAAA,EACF;AACF;;;ADlGO,IAAM,gBAAgB;AAGtB,IAAM,kBAAkB;AAGxB,IAAM,cAAc;AAM3B,IAAM,SAAS,aAAa,EAAE,WAAW,yBAAyB,CAAC;AAUnE,IAAM,uBAAuB,oBAAI,IAAoB;AAErD,IAAI,oBAAoB;AAYxB,SAAS,eAAe,KAAsB;AAC5C,MAAI;AACF,WAAO,SAAS,KAAK,KAAK,aAAa,CAAC,EAAE,YAAY;AAAA,EACxD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAWA,SAAS,qBAAqB,OAA8B;AAC1D,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,cAAU,aAAa,KAAK;AAC5B,eAAW,SAAS,OAAO,EAAE;AAAA,EAC/B,QAAQ;AACN,WAAO;AAAA,EACT;AACA,WAAS,QAAQ,GAAG,QAAQ,IAAI,SAAS;AACvC,QAAI,eAAe,OAAO,EAAG,QAAO;AACpC,QAAI,WAAW,OAAO,EAAG,QAAO;AAChC,UAAM,SAASC,SAAQ,OAAO;AAC9B,QAAI,WAAW,QAAS,QAAO;AAC/B,QAAI;AACF,UAAI,SAAS,MAAM,EAAE,QAAQ,SAAU,QAAO;AAAA,IAChD,QAAQ;AACN,aAAO;AAAA,IACT;AACA,cAAU;AAAA,EACZ;AACA,SAAO;AACT;AAwBO,SAAS,oBAAoB,SAA0B;AAC5D,MAAI,YAAY,OAAW,QAAOC,SAAQ,OAAO;AAEjD,QAAM,SAAS,uBAAuB,KAAK,QAAQ,IAAI;AACvD,QAAM,WAAW,qBAAqB,IAAI,MAAM;AAChD,MAAI,aAAa,OAAW,QAAO;AAEnC,QAAM,aAAa,qBAAqB,MAAM,KAAK,aAAa,MAAM;AACtE,MAAI,eAAe,MAAM;AACvB,yBAAqB,IAAI,QAAQ,UAAU;AAC3C,WAAO;AAAA,EACT;AAEA,MAAI;AACJ,MAAI;AACF,eAAW,aAAa,MAAM;AAAA,EAChC,QAAQ;AACN,eAAWA,SAAQ,MAAM;AAAA,EAC3B;AACA,MAAI,CAAC,mBAAmB;AACtB,wBAAoB;AACpB,WAAO;AAAA,MACL;AAAA,MACA,EAAE,KAAK,UAAU,cAAc,cAAc;AAAA,IAC/C;AAAA,EACF;AACA,uBAAqB,IAAI,QAAQ,QAAQ;AACzC,SAAO;AACT;AAMO,SAAS,iBAAyB;AACvC,SAAO,oBAAoB;AAC7B;AAcA,SAAS,aAAa,iBAAyB,aAAoD;AACjG,QAAM,WAAW,kBAAkB,iBAAiB,WAAW;AAC/D,MAAI,aAAa,MAAM;AACrB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,OAAO,IAAI,cAAc,gEAAgE;AAAA,QACvF,SAAS,EAAE,iBAAiB,aAAaA,SAAQ,WAAW,EAAE;AAAA,MAChE,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO,EAAE,IAAI,MAAM,OAAO,SAAS;AACrC;AAaA,eAAsB,uBACpB,SACiE;AACjE,QAAM,OAAO,oBAAoB,OAAO;AACxC,QAAM,WAAW,KAAK,MAAM,eAAe,eAAe;AAE1D,QAAM,iBAAiB,aAAa,UAAU,IAAI;AAClD,MAAI,CAAC,eAAe,IAAI;AACtB,WAAO;AAAA,EACT;AAOA,QAAM,mBAAmB,MAAM,eAAe;AAE9C,MAAI;AACF,UAAM,UAAU,MAAS,aAAS,eAAe,OAAO,OAAO;AAC/D,WAAO,EAAE,IAAI,MAAM,OAAO,UAAU,OAAO,EAAwB;AAAA,EACrE,SAAS,OAAO;AACd,UAAM,UAAU,gBAAgB,KAAK;AACrC,WAAO,EAAE,IAAI,OAAO,OAAO,IAAI,WAAW,uCAAuC,OAAO,EAAE,EAAE;AAAA,EAC9F;AACF;AASA,eAAsB,mBACpB,SAC6D;AAC7D,QAAM,OAAO,oBAAoB,OAAO;AACxC,QAAM,WAAW,KAAK,MAAM,eAAe,WAAW;AAEtD,QAAM,iBAAiB,aAAa,UAAU,IAAI;AAClD,MAAI,CAAC,eAAe,IAAI;AACtB,WAAO;AAAA,EACT;AAKA,QAAM,mBAAmB,MAAM,WAAW;AAE1C,MAAI;AACF,UAAM,UAAU,MAAS,aAAS,eAAe,OAAO,OAAO;AAC/D,WAAO,EAAE,IAAI,MAAM,OAAO,UAAU,OAAO,EAAoB;AAAA,EACjE,SAAS,OAAO;AACd,UAAM,UAAU,gBAAgB,KAAK;AACrC,WAAO,EAAE,IAAI,OAAO,OAAO,IAAI,WAAW,mCAAmC,OAAO,EAAE,EAAE;AAAA,EAC1F;AACF;AA4CA,eAAsB,mBACpB,UACA,SACmD;AACnD,QAAM,OAAO,oBAAoB,OAAO;AACxC,QAAM,WAAW,KAAK,MAAM,eAAe,WAAW;AAEtD,QAAM,iBAAiB,aAAa,UAAU,IAAI;AAClD,MAAI,CAAC,eAAe,IAAI;AACtB,WAAO;AAAA,EACT;AAEA,MAAI;AACF,UAAM,UAAUC,eAAc,UAAU,EAAE,WAAW,IAAI,CAAC;AAC1D,UAAS,cAAU,eAAe,OAAO,SAAS,OAAO;AACzD,WAAO,EAAE,IAAI,MAAM,OAAO,OAAU;AAAA,EACtC,SAAS,OAAO;AACd,UAAM,UAAU,gBAAgB,KAAK;AACrC,WAAO,EAAE,IAAI,OAAO,OAAO,IAAI,WAAW,mCAAmC,OAAO,EAAE,EAAE;AAAA,EAC1F;AACF;","names":["fs","dirname","resolve","stringifyYaml","dirname","resolve","stringifyYaml"]}

package/dist/{chunk-CCTSFRMO.js → chunk-ACE5NI5A.js}

@@ -1,28 +1,28 @@
 import {
   SERVES_PROBE_PROMPT
-} from "./chunk-KJ3JOYAI.js";
+} from "./chunk-5MHIYVCE.js";
 import {
   checkGatewayHealth,
   cliFailsVerdict,
   formatGatewaySlotWarnings,
   gatewayVerdict,
   printVoterTransportCheck
-} from "./chunk-VNUYAFKV.js";
+} from "./chunk-KRY5VIQW.js";
 import {
   NODE_ENGINE_RANGE,
   VERSION,
   isNodeVersionSupported
-} from "./chunk-XDIPNMNO.js";
+} from "./chunk-SDUKS5RF.js";
 import {
   allOf
 } from "./chunk-EZNIYU5T.js";
 import {
   readOpenAICompatEndpoint,
   readOpenAICompatEnv
-} from "./chunk-D3KUSAVV.js";
+} from "./chunk-5NKP4DVA.js";
 import {
   claimGlobalRegistry
-} from "./chunk-NR37NPJ5.js";
+} from "./chunk-E4OCHK7E.js";
 import {
   capitalize
 } from "./chunk-SX5DB6UR.js";
@@ -32,12 +32,12 @@ import {
   IN_FAMILY_FALLBACK_OPTION,
   codexMcpServerAvailable,
   createAllAdapters,
-  isCliDisabled,
+  isCliAdmitted,
   probeCli
-} from "./chunk-GOREKLDR.js";
+} from "./chunk-TDELDKWG.js";
 import {
   resolveGatewayEnv
-} from "./chunk-PAUO5OFW.js";
+} from "./chunk-GGP3F7FG.js";
 import {
   getNexusTmpDir
 } from "./chunk-OITVVSWO.js";
@@ -55,13 +55,14 @@ import {
   getErrorMessage,
   getInTreeCapabilitiesMatrix,
   getTimeProvider,
+  isCliDisabled,
   isDurableCapacityText,
   ok,
   resolveClassGuardMs,
   resolveGatewayCostDeclaration,
   symbols,
   writeLine
-} from "./chunk-SIQVWR3R.js";
+} from "./chunk-RPOGHHN7.js";
 import {
   getLearningDir,
   getOutcomesFile,
@@ -980,6 +981,7 @@ function createNotFoundResult(name, errorMsg) {
     // a determination nobody made; the auth line is not printed for an
     // uninstalled CLI anyway (#4661).
     authState: "unverified",
+    routerAdmits: false,
     installed: false,
     version: "N/A",
     versionStatus: "unsupported",
@@ -1012,6 +1014,7 @@ function createHealthyResult(name, health, authProbe, capacity) {
     versionStatus: health.versionStatus,
     authenticated,
     authState,
+    routerAdmits: isCliAdmitted(health, authProbe),
     ...authenticated && { authMethod: detectAuthMethod(name) },
     ...capacity !== void 0 && { capacity }
   };
@@ -1368,8 +1371,10 @@ async function doctorCommand(options = {}) {
   const result = await runDoctor({ gatewayProbe: options.probe === true });
   printDoctorResults(result);
   if (options.gateway === true || options.probe === true) {
-    const { formatGatewayReport } = await import("./doctor-gateway-report-TEM5VCBO.js");
-    for (const line of formatGatewayReport(result.gateway)) process.stdout.write(line + "\n");
+    const { formatGatewayReport } = await import("./doctor-gateway-report-WHI5WQ4N.js");
+    for (const line of formatGatewayReport(result.gateway, result.clis)) {
+      process.stdout.write(line + "\n");
+    }
   }
   if (options.fix === true) {
     await runDoctorFix(result);
@@ -1385,13 +1390,13 @@ async function runDoctorFix(result) {
   writeLine2("\u2500".repeat(40));
   let fixCount = 0;
   if (!result.dataDirectory.rootExists || result.dataDirectory.subdirectories.some((d) => !d.exists || !d.writable)) {
-    const { initDataDirectories: initDataDirectories2, describeDataDirFix: describeDataDirFix2 } = await import("./setup-data-dir-7FDJPPS3.js");
+    const { initDataDirectories: initDataDirectories2, describeDataDirFix: describeDataDirFix2 } = await import("./setup-data-dir-3WHFLPS4.js");
     const outcome = describeDataDirFix2(initDataDirectories2());
     writeLine2(outcome.line);
     if (outcome.counted) fixCount++;
   }
   if (!result.configFile.found) {
-    const { runConfigInitSync } = await import("./setup-config-G6KNCDHR.js");
+    const { runConfigInitSync } = await import("./setup-config-BOKVRB67.js");
     const configResult = runConfigInitSync(process.cwd(), false, false);
     if (configResult.success && configResult.created) {
       writeLine2(`\u2713 Generated config: ${configResult.path}`);
@@ -1487,4 +1492,4 @@ export {
   startStdioServer,
   closeServer
 };
-//# sourceMappingURL=chunk-CCTSFRMO.js.map
+//# sourceMappingURL=chunk-ACE5NI5A.js.map