nexus-agents 8.126.3 → 8.126.5

package/dist/{ast-rule-runner-QH55AOYW.js → ast-rule-runner-SMIJDVR5.js}

@@ -9,8 +9,9 @@ import {
   getBuiltInAstRulesPath,
   loadRules,
   runAstQaRules
-} from "./chunk-XKWRAEIM.js";
-import "./chunk-GKNT3TPN.js";
+} from "./chunk-6PPS7JPU.js";
+import "./chunk-3ZWQJBH7.js";
+import "./chunk-XBEKMUTO.js";
 import "./chunk-UE7A2XHM.js";
 import "./chunk-LWOX65CP.js";
 import "./chunk-PX6F3LHL.js";
@@ -26,4 +27,4 @@ export {
   loadRules,
   runAstQaRules
 };
-//# sourceMappingURL=ast-rule-runner-QH55AOYW.js.map
+//# sourceMappingURL=ast-rule-runner-SMIJDVR5.js.map

package/dist/{child-mcp-config-7OS34LIX.js → child-mcp-config-GAHKV6IM.js}

@@ -3,7 +3,8 @@ import {
 } from "./chunk-OITVVSWO.js";
 import {
   createLogger
-} from "./chunk-GKNT3TPN.js";
+} from "./chunk-3ZWQJBH7.js";
+import "./chunk-XBEKMUTO.js";
 import "./chunk-UE7A2XHM.js";
 import "./chunk-LWOX65CP.js";
 import "./chunk-PX6F3LHL.js";
@@ -49,4 +50,4 @@ async function generateMcpConfig(options) {
 export {
   generateMcpConfig
 };
-//# sourceMappingURL=child-mcp-config-7OS34LIX.js.map
+//# sourceMappingURL=child-mcp-config-GAHKV6IM.js.map

package/dist/{child-mcp-config-7OS34LIX.js.map → child-mcp-config-GAHKV6IM.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/cli-adapters/child-mcp-config.ts"],"sourcesContent":["/**\n * nexus-agents/cli-adapters - Child CLI MCP Config Generator\n *\n * Generates MCP server configuration for child Claude CLI sessions so\n * spawned agents can call back into nexus-agents' MCP tools (memory,\n * research, etc.). Used by `pipeline/expert-bridge.ts` to give expert\n * agents tool access. Originally lived under `swe-bench/` (#1413);\n * relocated here in #2515 — the helper is generic CLI-spawn\n * infrastructure, not benchmark-specific.\n *\n * The generated config grants NO tool approvals. It only tells the child\n * where the nexus-agents MCP server is; whether an expert may actually call\n * one of its tools follows the host's Claude permission settings (for\n * example `defaultMode`). Measured 2026-09-24: in auto mode the calls run,\n * in default mode they are refused (#6784). An unused `allowedTools` list\n * that read like a guard but was never passed to the CLI was removed then.\n *\n * @module cli-adapters/child-mcp-config\n */\n\nimport { writeFile, rm } from 'node:fs/promises';\nimport { nexusMkdtemp } from '../config/nexus-tmp-dir.js';\nimport { join } from 'node:path';\nimport { createLogger } from '../core/index.js';\n\nconst logger = createLogger({ component: 'swe-bench-mcp-config' });\n\n/**\n * MCP server entry in Claude CLI config format.\n */\ninterface McpServerEntry {\n  readonly command: string;\n  readonly args: readonly string[];\n  readonly env?: Readonly<Record<string, string>>;\n}\n\n/**\n * MCP config file format for Claude CLI (--mcp-config).\n */\ninterface McpConfigFile {\n  readonly mcpServers: Readonly<Record<string, McpServerEntry>>;\n}\n\n/**\n * Options for generating MCP config.\n */\nexport interface McpConfigOptions {\n  /** Path to nexus-agents CLI entry point. */\n  readonly cliPath?: string;\n  /** Additional environment variables for the MCP server. */\n  readonly env?: Readonly<Record<string, string>>;\n}\n\n/**\n * Resolves the nexus-agents CLI path.\n * Uses the built dist/cli.js relative to this package.\n */\nfunction resolveCliPath(override?: string): string {\n  if (override !== undefined) return override;\n  // Resolve relative to this file: src/swe-bench/ → dist/cli.js\n  // At runtime we're in dist/swe-bench/, so go up one level\n  const distDir = join(__dirname, '..');\n  return join(distDir, 'cli.js');\n}\n\n/**\n * Env marker naming a child server (#6795). The child's stdio caller is an\n * expert CLI driven by a model, not the operator, so the child must not\n * measure it at tier 1; `connectTransport` reads this and records the caller\n * as unmeasured.\n */\nconst MCP_CHILD_ENV = 'NEXUS_MCP_CHILD';\n\n/**\n * Builds the MCP config object for a nexus-agents server.\n */\nfunction buildConfig(options?: McpConfigOptions): McpConfigFile {\n  const cliPath = resolveCliPath(options?.cliPath);\n\n  const entry: McpServerEntry = {\n    command: 'node',\n    args: [cliPath, '--mode=server'],\n    // The child marker is applied LAST so caller-supplied env cannot unset it.\n    env: { ...options?.env, [MCP_CHILD_ENV]: '1' },\n  };\n\n  return {\n    mcpServers: {\n      'nexus-agents': entry,\n    },\n  };\n}\n\n/**\n * Generated MCP config with path and cleanup function.\n */\nexport interface GeneratedMcpConfig {\n  /** Path to the generated config file. */\n  readonly configPath: string;\n  /** Cleanup function to remove temp files. */\n  readonly cleanup: () => Promise<void>;\n}\n\n/**\n * Generates an MCP config file for Claude CLI child sessions.\n *\n * Creates a temporary JSON file that can be passed to `claude --mcp-config`.\n * Returns the file path and a cleanup function.\n */\nexport async function generateMcpConfig(options?: McpConfigOptions): Promise<GeneratedMcpConfig> {\n  const config = buildConfig(options);\n\n  const tempDir = await nexusMkdtemp('nexus-mcp-');\n  const configPath = join(tempDir, 'mcp-config.json');\n\n  await writeFile(configPath, JSON.stringify(config, null, 2), 'utf-8');\n\n  const cleanup = async (): Promise<void> => {\n    await rm(tempDir, { recursive: true, force: true }).catch((e: unknown) => {\n      logger.debug('Best-effort cleanup failed', {\n        error: e instanceof Error ? e.message : String(e),\n      });\n    });\n  };\n\n  return { configPath, cleanup };\n}\n"],"mappings":";;;;;;;;;;;AAoBA,SAAS,WAAW,UAAU;AAE9B,SAAS,YAAY;AAGrB,IAAM,SAAS,aAAa,EAAE,WAAW,uBAAuB,CAAC;AAgCjE,SAAS,eAAe,UAA2B;AACjD,MAAI,aAAa,OAAW,QAAO;AAGnC,QAAM,UAAU,KAAK,WAAW,IAAI;AACpC,SAAO,KAAK,SAAS,QAAQ;AAC/B;AAQA,IAAM,gBAAgB;AAKtB,SAAS,YAAY,SAA2C;AAC9D,QAAM,UAAU,eAAe,SAAS,OAAO;AAE/C,QAAM,QAAwB;AAAA,IAC5B,SAAS;AAAA,IACT,MAAM,CAAC,SAAS,eAAe;AAAA;AAAA,IAE/B,KAAK,EAAE,GAAG,SAAS,KAAK,CAAC,aAAa,GAAG,IAAI;AAAA,EAC/C;AAEA,SAAO;AAAA,IACL,YAAY;AAAA,MACV,gBAAgB;AAAA,IAClB;AAAA,EACF;AACF;AAkBA,eAAsB,kBAAkB,SAAyD;AAC/F,QAAM,SAAS,YAAY,OAAO;AAElC,QAAM,UAAU,MAAM,aAAa,YAAY;AAC/C,QAAM,aAAa,KAAK,SAAS,iBAAiB;AAElD,QAAM,UAAU,YAAY,KAAK,UAAU,QAAQ,MAAM,CAAC,GAAG,OAAO;AAEpE,QAAM,UAAU,YAA2B;AACzC,UAAM,GAAG,SAAS,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC,EAAE,MAAM,CAAC,MAAe;AACxE,aAAO,MAAM,8BAA8B;AAAA,QACzC,OAAO,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC;AAAA,MAClD,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAEA,SAAO,EAAE,YAAY,QAAQ;AAC/B;","names":[]}
+{"version":3,"sources":["../src/cli-adapters/child-mcp-config.ts"],"sourcesContent":["/**\n * nexus-agents/cli-adapters - Child CLI MCP Config Generator\n *\n * Generates MCP server configuration for child Claude CLI sessions so\n * spawned agents can call back into nexus-agents' MCP tools (memory,\n * research, etc.). Used by `pipeline/expert-bridge.ts` to give expert\n * agents tool access. Originally lived under `swe-bench/` (#1413);\n * relocated here in #2515 — the helper is generic CLI-spawn\n * infrastructure, not benchmark-specific.\n *\n * The generated config grants NO tool approvals. It only tells the child\n * where the nexus-agents MCP server is; whether an expert may actually call\n * one of its tools follows the host's Claude permission settings (for\n * example `defaultMode`). Measured 2026-09-24: in auto mode the calls run,\n * in default mode they are refused (#6784). An unused `allowedTools` list\n * that read like a guard but was never passed to the CLI was removed then.\n *\n * @module cli-adapters/child-mcp-config\n */\n\nimport { writeFile, rm } from 'node:fs/promises';\nimport { nexusMkdtemp } from '../config/nexus-tmp-dir.js';\nimport { join } from 'node:path';\nimport { createLogger } from '../core/index.js';\n\nconst logger = createLogger({ component: 'swe-bench-mcp-config' });\n\n/**\n * MCP server entry in Claude CLI config format.\n */\ninterface McpServerEntry {\n  readonly command: string;\n  readonly args: readonly string[];\n  readonly env?: Readonly<Record<string, string>>;\n}\n\n/**\n * MCP config file format for Claude CLI (--mcp-config).\n */\ninterface McpConfigFile {\n  readonly mcpServers: Readonly<Record<string, McpServerEntry>>;\n}\n\n/**\n * Options for generating MCP config.\n */\nexport interface McpConfigOptions {\n  /** Path to nexus-agents CLI entry point. */\n  readonly cliPath?: string;\n  /** Additional environment variables for the MCP server. */\n  readonly env?: Readonly<Record<string, string>>;\n}\n\n/**\n * Resolves the nexus-agents CLI path.\n * Uses the built dist/cli.js relative to this package.\n */\nfunction resolveCliPath(override?: string): string {\n  if (override !== undefined) return override;\n  // Resolve relative to this file: src/swe-bench/ → dist/cli.js\n  // At runtime we're in dist/swe-bench/, so go up one level\n  const distDir = join(__dirname, '..');\n  return join(distDir, 'cli.js');\n}\n\n/**\n * Env marker naming a child server (#6795). The child's stdio caller is an\n * expert CLI driven by a model, not the operator, so the child must not\n * measure it at tier 1; `connectTransport` reads this and records the caller\n * as unmeasured.\n */\nconst MCP_CHILD_ENV = 'NEXUS_MCP_CHILD';\n\n/**\n * Builds the MCP config object for a nexus-agents server.\n */\nfunction buildConfig(options?: McpConfigOptions): McpConfigFile {\n  const cliPath = resolveCliPath(options?.cliPath);\n\n  const entry: McpServerEntry = {\n    command: 'node',\n    args: [cliPath, '--mode=server'],\n    // The child marker is applied LAST so caller-supplied env cannot unset it.\n    env: { ...options?.env, [MCP_CHILD_ENV]: '1' },\n  };\n\n  return {\n    mcpServers: {\n      'nexus-agents': entry,\n    },\n  };\n}\n\n/**\n * Generated MCP config with path and cleanup function.\n */\nexport interface GeneratedMcpConfig {\n  /** Path to the generated config file. */\n  readonly configPath: string;\n  /** Cleanup function to remove temp files. */\n  readonly cleanup: () => Promise<void>;\n}\n\n/**\n * Generates an MCP config file for Claude CLI child sessions.\n *\n * Creates a temporary JSON file that can be passed to `claude --mcp-config`.\n * Returns the file path and a cleanup function.\n */\nexport async function generateMcpConfig(options?: McpConfigOptions): Promise<GeneratedMcpConfig> {\n  const config = buildConfig(options);\n\n  const tempDir = await nexusMkdtemp('nexus-mcp-');\n  const configPath = join(tempDir, 'mcp-config.json');\n\n  await writeFile(configPath, JSON.stringify(config, null, 2), 'utf-8');\n\n  const cleanup = async (): Promise<void> => {\n    await rm(tempDir, { recursive: true, force: true }).catch((e: unknown) => {\n      logger.debug('Best-effort cleanup failed', {\n        error: e instanceof Error ? e.message : String(e),\n      });\n    });\n  };\n\n  return { configPath, cleanup };\n}\n"],"mappings":";;;;;;;;;;;;AAoBA,SAAS,WAAW,UAAU;AAE9B,SAAS,YAAY;AAGrB,IAAM,SAAS,aAAa,EAAE,WAAW,uBAAuB,CAAC;AAgCjE,SAAS,eAAe,UAA2B;AACjD,MAAI,aAAa,OAAW,QAAO;AAGnC,QAAM,UAAU,KAAK,WAAW,IAAI;AACpC,SAAO,KAAK,SAAS,QAAQ;AAC/B;AAQA,IAAM,gBAAgB;AAKtB,SAAS,YAAY,SAA2C;AAC9D,QAAM,UAAU,eAAe,SAAS,OAAO;AAE/C,QAAM,QAAwB;AAAA,IAC5B,SAAS;AAAA,IACT,MAAM,CAAC,SAAS,eAAe;AAAA;AAAA,IAE/B,KAAK,EAAE,GAAG,SAAS,KAAK,CAAC,aAAa,GAAG,IAAI;AAAA,EAC/C;AAEA,SAAO;AAAA,IACL,YAAY;AAAA,MACV,gBAAgB;AAAA,IAClB;AAAA,EACF;AACF;AAkBA,eAAsB,kBAAkB,SAAyD;AAC/F,QAAM,SAAS,YAAY,OAAO;AAElC,QAAM,UAAU,MAAM,aAAa,YAAY;AAC/C,QAAM,aAAa,KAAK,SAAS,iBAAiB;AAElD,QAAM,UAAU,YAAY,KAAK,UAAU,QAAQ,MAAM,CAAC,GAAG,OAAO;AAEpE,QAAM,UAAU,YAA2B;AACzC,UAAM,GAAG,SAAS,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC,EAAE,MAAM,CAAC,MAAe;AACxE,aAAO,MAAM,8BAA8B;AAAA,QACzC,OAAO,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC;AAAA,MAClD,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAEA,SAAO,EAAE,YAAY,QAAQ;AAC/B;","names":[]}

package/dist/{chunk-X52J2EI3.js → chunk-3CFROGBP.js}

@@ -6,13 +6,13 @@ import {
   createGraphAuditBridge,
   emitPipelinePolicyEvent,
   readActionRefusal
-} from "./chunk-F5GNFGJA.js";
+} from "./chunk-HNJTJE6A.js";
 import {
   withPrerequisite
-} from "./chunk-NC5GV7EC.js";
+} from "./chunk-5NFCIY5V.js";
 import {
   generateSecurityPlan
-} from "./chunk-BKEMABRA.js";
+} from "./chunk-I7URLQM7.js";
 import {
   analyzeGitHubRepo
 } from "./chunk-4GDMHCKX.js";
@@ -20,11 +20,10 @@ import {
   CodebaseIndex,
   DEFAULT_INDEX_MAX_DEPTH,
   MAX_INDEX_MAX_DEPTH,
-  SUPPORTED_EXTENSIONS,
   extractSymbolIndexResult,
   extractSymbols,
   findSourceFiles
-} from "./chunk-7ETWTSTB.js";
+} from "./chunk-3UWT434E.js";
 import {
   FINDING_SEVERITY_LEVELS,
   SARIF_LEVEL_MAP,
@@ -32,7 +31,7 @@ import {
 } from "./chunk-WDAND5YU.js";
 import {
   sanitizeInput
-} from "./chunk-6QI7J3I2.js";
+} from "./chunk-A3QBUBVT.js";
 import {
   BUILT_IN_EXPERTS,
   BuiltInExpertTypeSchema,
@@ -42,10 +41,10 @@ import {
 import {
   DEFAULT_TASK_TTL_MS,
   clampTaskTtl
-} from "./chunk-RBZ23TGL.js";
+} from "./chunk-43YEAMED.js";
 import {
   executeExpert
-} from "./chunk-UOC22N3S.js";
+} from "./chunk-RG6DJ7FF.js";
 import {
   DEPRECATED_MODE_ALIAS_INPUT,
   JobStatusSchema,
@@ -97,7 +96,7 @@ import {
   withFileLock,
   withWarnings,
   writeJobCancelled
-} from "./chunk-H2EUKN6W.js";
+} from "./chunk-4N3XAYN7.js";
 import {
   NOOP_NOTIFIER,
   RateLimiter,
@@ -123,12 +122,12 @@ import {
   toolSuccessStructured,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-FKXV6BST.js";
+} from "./chunk-5WSMU5OA.js";
 import {
   VERSION,
   createRequestContext,
   measuredTrustTier
-} from "./chunk-Q2RC2IMA.js";
+} from "./chunk-JFNPXM6W.js";
 import {
   allOf,
   anyOf
@@ -136,16 +135,16 @@ import {
 import {
   normalizeTopicToCanonical,
   synthesizeResearch
-} from "./chunk-D4AOKDGO.js";
+} from "./chunk-KHSP7CNX.js";
 import {
   isGatewayModelAdapter
-} from "./chunk-VOSNQ34O.js";
+} from "./chunk-TVODJINW.js";
 import {
   EventTopics,
   createEvent,
   getGlobalEventBus,
   getGlobalRegistry
-} from "./chunk-XDTJIBXF.js";
+} from "./chunk-RUSE5YQQ.js";
 import {
   IDENTIFIER_RE,
   LANG_VALUES,
@@ -178,18 +177,18 @@ import {
   parseRegistry,
   sourceExistsInRegistry,
   summarizeContextForPrompt
-} from "./chunk-BECYVDRX.js";
+} from "./chunk-ZCAQSRG6.js";
 import {
   getTokenEnvVars,
   resolveToken
-} from "./chunk-ZPSOD4QH.js";
+} from "./chunk-V6YTNHPR.js";
 import {
   REGISTRY_PATH,
   getProjectRoot,
   loadPapersRegistry,
   loadTechniquesRegistry,
   resolveRegistryRoot
-} from "./chunk-EC7UBSAY.js";
+} from "./chunk-4X5EZH4H.js";
 import {
   DEFAULT_RELEVANCE_CONFIG,
   MemoryImportance,
@@ -197,7 +196,7 @@ import {
   calculateTextJaccardSimilarity,
   getToolMemory,
   memoryTrustTierTag
-} from "./chunk-FOYPZEKN.js";
+} from "./chunk-FZ443QJ5.js";
 import {
   EXTERNAL_CONTENT_TRUST_TIER,
   resolveContentTrustProvenance,
@@ -210,7 +209,7 @@ import {
 } from "./chunk-SX5DB6UR.js";
 import {
   createSessionMemory
-} from "./chunk-NHHYFA64.js";
+} from "./chunk-KKXKB7TF.js";
 import {
   TrustTierSchema
 } from "./chunk-CJKHQ6MV.js";
@@ -230,10 +229,10 @@ import {
   terminateProcessTree,
   trackProcessTree,
   withTimeout
-} from "./chunk-DM4UXA47.js";
+} from "./chunk-LLUIP44A.js";
 import {
   DEFAULTS
-} from "./chunk-2R6E5HBT.js";
+} from "./chunk-FUPEQAFF.js";
 import {
   DEFAULT_EXECUTION_MODE,
   DEFAULT_TOOL_RATE_LIMITS,
@@ -244,27 +243,27 @@ import {
   getAvailabilityCache,
   getCliForModelId,
   resolveFallback
-} from "./chunk-XAXTHF4V.js";
+} from "./chunk-JPFZZ7WO.js";
 import {
   BaseAdapter,
   createStream,
   parseGatewayExtraHeaders,
   requireApiKey,
   validateApiKeyPresence
-} from "./chunk-6IPZIHKS.js";
+} from "./chunk-TMVBH63B.js";
 import {
   resolveGatewayEnv
-} from "./chunk-LXGONOUN.js";
+} from "./chunk-RQ53DZD7.js";
 import {
   sanitizeErrorDetails
-} from "./chunk-SVMK6IZX.js";
+} from "./chunk-SWTB5L34.js";
 import {
   generateHyphenId,
   generateUUID
-} from "./chunk-MGYECR4N.js";
+} from "./chunk-APTXCM3Z.js";
 import {
   getDefaultCliCircuitBreakerRegistry
-} from "./chunk-JW7KFY6I.js";
+} from "./chunk-KA4MRN7D.js";
 import {
   AGENT_ROUTER_TIMEOUTS,
   API_TIMEOUTS,
@@ -384,6 +383,7 @@ import {
   raceAbort,
   rankStrategiesByManifest,
   recordRoutingGaps,
+  recordToolRefusal,
   researchContextFromText,
   resolveClassGuardMs,
   resolveInsideRoot,
@@ -398,7 +398,10 @@ import {
   throwIfAborted,
   toExpertTaskAnalysisResult,
   withStep
-} from "./chunk-GKNT3TPN.js";
+} from "./chunk-3ZWQJBH7.js";
+import {
+  SUPPORTED_EXTENSIONS
+} from "./chunk-XBEKMUTO.js";
 import {
   ensureLearningDir,
   getMetaOutcomesFile,
@@ -1172,6 +1175,8 @@ var NexusEnvSchema = z10.object({
   // now go through the same helper, so the schema tells the truth about them.
   NEXUS_BUDGET_ENFORCE: boolLooseStr.optional(),
   NEXUS_CONTEXT_RETRIEVER_INJECT: boolLooseStr.optional(),
+  // Exact opt-in: inferred gaps otherwise remain report-only (#6930).
+  NEXUS_CAPABILITY_GAP_INFERRED: z10.enum(["0", "1"]).optional(),
   NEXUS_DYNAMIC_MODELS: boolLooseStr.optional(),
   NEXUS_GITIGNORE_AUTO: boolLooseStr.optional(),
   NEXUS_SUBPROCESS_ENV_ALLOWLIST: boolLooseStr.optional(),
@@ -30403,7 +30408,7 @@ function execIdFields(executionId) {
 async function populateUnifiedContextOnState(state, options) {
   const taskCandidate = state["task"];
   if (typeof taskCandidate !== "string" || taskCandidate === "") return;
-  const { getContextForTask: getContextForTask2, inferTaskCategory: inferTaskCategory2 } = await import("./context-retriever-B22QJPZD.js");
+  const { getContextForTask: getContextForTask2, inferTaskCategory: inferTaskCategory2 } = await import("./context-retriever-AYCAY2U2.js");
   const category = inferTaskCategory2(taskCandidate);
   const executionId = options?.executionId;
   const execFields = execIdFields(executionId);
@@ -31580,12 +31585,9 @@ var CapabilityGapSummarySchema = z58.object({
   /**
    * Whether a capability-gap detector actually ran (#5919).
    *
-   * `buildBaseTaskContract` writes `allSatisfied: true` with an EMPTY
-   * `available` set — a verdict from a detector that never ran, on the
-   * `orchestrate` and `delegate_to_model` paths. Nothing reads it today, which
-   * is camouflage rather than safety: it is the same shape as #5896's
-   * ValidationHarness, where a missing consumer let a hard-coded verdict sit
-   * until someone eventually trusted it.
+   * `buildBaseTaskContract` runs the canonical detector on inferred
+   * requirements for both entry points. Its report describes registry support,
+   * not observed tool execution; inferred gaps retain their origin (#5923).
    *
    * Named for the vocabulary this repo already uses for exactly this —
    * `tokensMeasured`, `policyEvaluated`, `routerTypeMeasured`. A consumer that
@@ -32440,34 +32442,36 @@ function createDefaultPolicyEngine() {
 // src/pipeline/task-contract-builders.ts
 import { randomUUID as randomUUID9 } from "node:crypto";
 var sharedAnalyzer;
-function analyzeForContract(task) {
+function analyzeTask(task) {
   sharedAnalyzer ??= createSharedTaskAnalyzer();
-  const result = sharedAnalyzer.analyze(task);
-  return {
-    complexity: result.complexity,
-    taskType: result.taskType,
-    ambiguityScore: result.ambiguityScore
-  };
+  return sharedAnalyzer.analyze(task);
 }
 function buildBaseTaskContract(input) {
+  const analysis = analyzeTask(input.task);
+  const report = detectCapabilityGaps(analysis.requiredCapabilities);
   const now = Date.now();
   return {
     id: `${input.idPrefix}-${randomUUID9().slice(0, 8)}`,
     description: input.task,
     status: "approved",
-    analysis: input.analysis,
-    constraints: { scope: [] },
-    requiredCapabilities: { tools: [], experts: [] },
+    analysis: input.analysis ?? {
+      complexity: analysis.complexity,
+      taskType: analysis.taskType,
+      ambiguityScore: analysis.ambiguityScore
+    },
+    constraints: { ...analysis.constraints, scope: [...analysis.constraints.scope] },
+    requiredCapabilities: {
+      tools: [...analysis.requiredCapabilities.tools],
+      experts: [...analysis.requiredCapabilities.experts]
+    },
     capabilityGaps: {
-      available: { tools: [], experts: [] },
-      gaps: [],
-      // NOT a measurement (#5919). No detector runs here, so `allSatisfied`
-      // carries no information — `gapsMeasured` is what says so. Wiring
-      // `capability-gap-detector.ts` in is the follow-up; its cost on this hot
-      // path has not been measured, and asserting an unmeasured verdict is the
-      // part that had to stop now.
-      allSatisfied: true,
-      gapsMeasured: false
+      available: {
+        tools: [...report.available.tools],
+        experts: [...report.available.experts]
+      },
+      gaps: [...report.gaps],
+      allSatisfied: report.allSatisfied,
+      gapsMeasured: true
     },
     artifacts: [],
     metadata: { ...input.metadata },
@@ -32502,9 +32506,6 @@ function delegateInputToTaskContract(input, opts = {}) {
   return buildBaseTaskContract({
     idPrefix: "delegate",
     task: input.task,
-    // Derived, not asserted (#5924). This was a literal — every task through
-    // this entry point recorded `moderate/routing/0.1` whatever it actually was.
-    analysis: analyzeForContract(input.task),
     metadata
   });
 }
@@ -32594,9 +32595,6 @@ function orchestrateInputToTaskContract(input, opts = {}) {
   return buildBaseTaskContract({
     idPrefix: "orchestrate",
     task: input.task,
-    // Derived, not asserted (#5924). This was a literal — every task through
-    // this entry point recorded `high/orchestration/0.3` whatever it actually was.
-    analysis: analyzeForContract(input.task),
     metadata
   });
 }
@@ -37646,7 +37644,7 @@ var TOOL_SCHEMA = {
 function hasKeyword(text, keywords) {
   return keywords.some((k) => text.includes(k));
 }
-function analyzeTask(task) {
+function analyzeTask2(task) {
   const taskLower = task.toLowerCase();
   const estimatedTokens = Math.ceil(task.length / 4) * 2;
   return {
@@ -38055,7 +38053,7 @@ function notifyAndRecord(opts) {
 }
 async function tryCompositeRoute(deps, ctx, opts) {
   if (deps.router === void 0) return null;
-  const requirements = analyzeTask(opts.task);
+  const requirements = analyzeTask2(opts.task);
   const routerResult = await routeViaCompositeRouter(
     opts.task,
     deps.router,
@@ -38100,7 +38098,7 @@ function createDelegateHandler(deps) {
     if (compositeResult !== null) {
       return compositeResult;
     }
-    const requirements = analyzeTask(input.task);
+    const requirements = analyzeTask2(input.task);
     const billingMode = input.billing_mode ?? DEFAULTS.PROVIDER_DEFAULTS.billingMode;
     const selection = selectModel(input, requirements, billingMode);
     const output2 = buildDelegateOutput(selection, requirements);
@@ -43549,29 +43547,6 @@ function registerSearchCodebaseTool(server, deps) {
 // src/mcp/tools/extract-symbols-tool.ts
 import { extname as extname3 } from "node:path";
 import { z as z91 } from "zod";
-
-// src/core/task-analysis/tool-refusal-gap.ts
-function toolRefusalGapName(tool, capability) {
-  return `${tool}:${capability}`.toLowerCase();
-}
-function recordToolRefusal(refusal, context, ledger = getGapLedger()) {
-  const capability = refusal.capability.trim();
-  if (capability === "") return;
-  const report = {
-    gaps: [
-      {
-        type: "tool_refusal",
-        name: toolRefusalGapName(refusal.tool, capability),
-        suggestion: refusal.suggestion
-      }
-    ],
-    available: { tools: [], experts: [] },
-    allSatisfied: false
-  };
-  ledger.record(report, context);
-}
-
-// src/mcp/tools/extract-symbols-tool.ts
 var DEFAULT_EXTRACT_MAX_CHARS = 2e4;
 var DEFAULT_EXTRACT_MAX_SYMBOLS = 200;
 var ExtractSymbolsInputSchema = z91.object({
@@ -46655,7 +46630,7 @@ async function tryIssueTriage(task) {
   try {
     const issueMatch = task.match(/github\.com\/([^/]+\/[^/]+)\/issues\/(\d+)/);
     if (issueMatch === null) return null;
-    const { createIssueTriage } = await import("./issue-triage-R523TPSU.js");
+    const { createIssueTriage } = await import("./issue-triage-GZHF4HGZ.js");
     const triage = createIssueTriage();
     const owner = issueMatch[1] ?? "";
     const num2 = issueMatch[2] ?? "";
@@ -46683,7 +46658,7 @@ var VALID_TEMPLATES = /* @__PURE__ */ new Set([
 ]);
 async function classifyWithLLM(task) {
   try {
-    const { executeExpert: executeExpert2 } = await import("./expert-bridge-HEN47NON.js");
+    const { executeExpert: executeExpert2 } = await import("./expert-bridge-6ICNND52.js");
     const prompt = [
       "Classify this task into exactly one pipeline template.",
       "Templates: dev (implementation/bug fix/refactor), research (investigate/evaluate/compare),",
@@ -47057,7 +47032,7 @@ function buildVotingInput(plan, config) {
 }
 async function executeSingleVote(plan, config, log) {
   try {
-    const { executeVoting } = await import("./consensus-vote-HWUNGKTW.js");
+    const { executeVoting } = await import("./consensus-vote-V56W3QW5.js");
     const input = buildVotingInput(plan, config);
     const result = await executeVoting(input, log);
     return parseVotingResult(result);
@@ -47925,7 +47900,7 @@ var memoryInitPromise = null;
 async function initPipelineMemory() {
   if (cachedMemory !== null) return cachedMemory;
   try {
-    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-RWJV5SWQ.js");
+    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-H35YIL36.js");
     const { getLearningDir } = await import("./learning-persistence-FB4U5AX2.js");
     const mem = createSessionMemory2(getLearningDir());
     mem.startSession(`pipeline-${String(getTimeProvider().now())}`);
@@ -47987,7 +47962,7 @@ function recordRoutingExperience(category, success, durationMs, tokensUsed = 0,
     callRecord(routingMemoryCache);
     return;
   }
-  routingMemoryInitPromise ??= import("./routing-memory-M3O4WVIT.js").then(({ createRoutingMemory }) => {
+  routingMemoryInitPromise ??= import("./routing-memory-MZ4LIUQH.js").then(({ createRoutingMemory }) => {
     routingMemoryCache ??= createRoutingMemory();
     return routingMemoryCache;
   }).catch((error) => {
@@ -48204,7 +48179,7 @@ function createVoteStage({ config, startStage }) {
     const strategy = config.votingStrategy ?? "higher_order";
     await postProgress(config, "Vote", `Running consensus with ${strategy} strategy...`);
     try {
-      const { executeVoting } = await import("./consensus-vote-HWUNGKTW.js");
+      const { executeVoting } = await import("./consensus-vote-V56W3QW5.js");
       const proposal = buildVoteProposal(plan, research);
       const votingResult = await executeVoting(
         {
@@ -49063,7 +49038,7 @@ ${text}` : "";
 }
 async function getWeatherContext() {
   try {
-    const { generateWeatherReport: generateWeatherReport2 } = await import("./weather-report-QYBKW7YM.js");
+    const { generateWeatherReport: generateWeatherReport2 } = await import("./weather-report-OJ6GGBXO.js");
     const report = generateWeatherReport2({ includeAdaptive: true });
     const mappings = "recommendedMappings" in report ? report.recommendedMappings : [];
     if (!Array.isArray(mappings) || mappings.length === 0) return "";
@@ -49081,7 +49056,7 @@ ${lines}
 }
 async function getMemoryContext(task) {
   try {
-    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-RWJV5SWQ.js");
+    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-H35YIL36.js");
     const { getLearningDir } = await import("./learning-persistence-FB4U5AX2.js");
     const memory = createSessionMemory2(getLearningDir(), { maxLearningsInContext: 10 });
     const learnings = memory.searchLearnings(task.slice(0, 200));
@@ -49722,7 +49697,7 @@ function createScaffoldStageWrapper() {
 }
 async function searchCodebaseForTask(task) {
   try {
-    const { CodebaseIndex: CodebaseIndex2 } = await import("./codebase-search-7YYPTFPL.js");
+    const { CodebaseIndex: CodebaseIndex2 } = await import("./codebase-search-VMKI7FW4.js");
     const index = new CodebaseIndex2(process.cwd());
     const terms = task.toLowerCase().split(/\s+/).filter((w) => w.length > 4).slice(0, 3);
     if (terms.length === 0) return null;
@@ -49737,7 +49712,7 @@ async function searchCodebaseForTask(task) {
 }
 async function queryResearchRegistry(task) {
   try {
-    const { synthesizeResearch: synthesizeResearch2 } = await import("./research-helpers-synthesize-SV22X3ZE.js");
+    const { synthesizeResearch: synthesizeResearch2 } = await import("./research-helpers-synthesize-ZCGNK2ZB.js");
     const topic = task.split(/[.!?\n]/).filter((s) => s.trim().length > 10)[0]?.trim();
     if (topic === void 0) return null;
     const result = await synthesizeResearch2(topic.slice(0, 50));
@@ -49808,7 +49783,7 @@ function createScanStageWrapper() {
       try {
         const slug = ctx.task.match(/([a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+)/)?.[1];
         if (slug !== void 0) {
-          const { generateSecurityPlan: generateSecurityPlan2 } = await import("./repo-security-plan-UPWNMHDF.js");
+          const { generateSecurityPlan: generateSecurityPlan2 } = await import("./repo-security-plan-H4NMHMWD.js");
           const plan = await generateSecurityPlan2({ repo: slug, maxScanners: 10 });
           const recs = plan.recommendations.slice(0, 5).map((r) => `${r.priority}: ${r.displayName} (${r.category})`).join("; ");
           return output(PIPELINE_STATE_KEYS.FINDINGS, recs, getTimeProvider().now() - start, true);
@@ -52853,11 +52828,9 @@ function createMetaOrchestrator(options) {
       if (shadowSelector !== void 0 && shadowSink !== void 0) {
         recordShadow(shadowSelector, shadowSink, decision, timestamp, logger59);
       }
-      if (gapLedger !== void 0 && decision.capabilityGaps !== void 0) {
-        gapLedger.record(decision.capabilityGaps, {
-          goal: input.goal,
-          decisionId: decision.decisionId
-        });
+      if (gapLedger !== void 0) {
+        const context = { goal: input.goal, decisionId: decision.decisionId };
+        recordRoutingGaps(decision, context, gapLedger);
       }
       logSelection(logger59, decision, forced);
       return decision;
@@ -53455,7 +53428,7 @@ var GitHubTaskTracker = class {
   cachedProvider = null;
   async getProvider() {
     if (this.cachedProvider !== null) return this.cachedProvider;
-    const { createScmProvider } = await import("./factory-XFIXK3N5.js");
+    const { createScmProvider } = await import("./factory-P4NMFJF2.js");
     const result = await createScmProvider({ repo: this.config.repo ?? "" });
     if (!result.ok) throw new Error(`SCM provider error: ${result.error.message}`);
     this.cachedProvider = result.value;
@@ -54498,7 +54471,7 @@ function withCatalogueCaveat(report) {
 var GATEWAY_TRANSPORT = "gateway";
 var GATEWAY_API_ARM = "api:custom-openai";
 async function gatewaySource(apiArm) {
-  const { discoverModels, readOpenAICompatEnv } = await import("./openai-compat-adapter-U4EOZYHJ.js");
+  const { discoverModels, readOpenAICompatEnv } = await import("./openai-compat-adapter-QXBN3VJU.js");
   const config = readOpenAICompatEnv();
   if (config !== null) {
     return {
@@ -54517,7 +54490,7 @@ async function gatewaySource(apiArm) {
 }
 async function defaultSources(includeOpenRouter, adaptersFactory) {
   const adapters = new Map(
-    adaptersFactory !== void 0 ? adaptersFactory() : (await import("./factory-6EQIV2HF.js")).createAllAdapters()
+    adaptersFactory !== void 0 ? adaptersFactory() : (await import("./factory-MBS6QSZM.js")).createAllAdapters()
   );
   const apiArm = adapters.get(GATEWAY_API_ARM);
   adapters.delete(GATEWAY_API_ARM);
@@ -57668,7 +57641,7 @@ export {
   MODEL_CAPABILITIES2 as MODEL_CAPABILITIES,
   DelegateInputSchema,
   DelegateOutputSchema,
-  analyzeTask,
+  analyzeTask2 as analyzeTask,
   selectModel,
   registerDelegateToModelTool,
   runConsensusGate,
@@ -57824,4 +57797,4 @@ export {
   startPipelineEventBridge,
   shutdownPipelineEventBridge
 };
-//# sourceMappingURL=chunk-X52J2EI3.js.map
+//# sourceMappingURL=chunk-3CFROGBP.js.map