nexus-agents 8.22.2 → 8.22.4

package/dist/cli.js

@@ -23,11 +23,11 @@ import {
   parseExpertReview,
   reviewPostingBlock,
   sumFindings
-} from "./chunk-HZ3R63IV.js";
-import "./chunk-P3WRF3A7.js";
+} from "./chunk-KIAMP743.js";
+import "./chunk-4E6T32D3.js";
 import {
   runConfigInitSync
-} from "./chunk-ZWI54SPH.js";
+} from "./chunk-KAWGEKXW.js";
 import {
   AuthHandler,
   CustomExpertDefinitionSchema,
@@ -157,11 +157,11 @@ import {
   validateNexusEnv,
   validateWorkflow,
   wrapInMarkdownFence
-} from "./chunk-SX5EZNPS.js";
-import "./chunk-XS423Y73.js";
+} from "./chunk-SZUUY4MP.js";
+import "./chunk-22EEMQUS.js";
 import "./chunk-DGWT7DXX.js";
 import "./chunk-64GMIUM5.js";
-import "./chunk-BAWRHK4W.js";
+import "./chunk-BTZ7BKID.js";
 import {
   CATEGORY_DISPLAY_NAMES,
   DEFAULT_PR_REVIEW_CONFIG
@@ -177,14 +177,14 @@ import {
   doctorCommand,
   initDataDirectories,
   runDoctor
-} from "./chunk-2RUDLEIT.js";
+} from "./chunk-3GFNNZTS.js";
 import {
   buildOpenAICompatAdapters,
   readOpenAICompatEnv
-} from "./chunk-QWYY5DD6.js";
+} from "./chunk-OUOBB5XR.js";
 import {
   shutdownExpertBridge
-} from "./chunk-RZUYKWEY.js";
+} from "./chunk-CN3VAMQD.js";
 import {
   ConsensusVoteInputSchema,
   DEFAULT_VOTE_TIMEOUT_MS,
@@ -196,18 +196,18 @@ import {
   recordAuthenticVote,
   registerConsensusVoteTool,
   toRecordDecision
-} from "./chunk-BKE522YB.js";
+} from "./chunk-ZV4XS5LW.js";
 import {
   loadUsageEvents,
   rollupByModel
-} from "./chunk-P4QYPDTB.js";
+} from "./chunk-QEZGPM4S.js";
 import {
   allOf,
   anyOf
 } from "./chunk-OQB3XC5O.js";
 import {
   synthesizeResearch
-} from "./chunk-NG7T6DN5.js";
+} from "./chunk-5O5FKZUU.js";
 import {
   DRAFT_REPLY_BODY_MAX_LENGTH,
   configureUntrustedInputFirewall,
@@ -217,12 +217,12 @@ import {
   runUntrustedInputFirewall,
   validateAgentAction,
   validateCorroboration
-} from "./chunk-KCDE6VIZ.js";
-import "./chunk-6IOI5SK3.js";
+} from "./chunk-V52KBX67.js";
+import "./chunk-4XBYQAED.js";
 import {
   ReputationCache,
   sanitizeInput
-} from "./chunk-BU5LR2JJ.js";
+} from "./chunk-OYTRYITB.js";
 import {
   ImprovementReviewInputSchema,
   calculateFitnessScore,
@@ -236,20 +236,22 @@ import {
   registerImprovementReviewTool,
   runImprovementReview,
   scanForSecrets
-} from "./chunk-OPWJJXZU.js";
+} from "./chunk-AXZJNY4F.js";
 import {
   createDefaultPolicyFirewall,
   setGlobalPolicyFirewall,
   stagePolicyFirewallForRollout
-} from "./chunk-GHBR6ZG3.js";
+} from "./chunk-XNZHNPAX.js";
 import {
-  VERSION
-} from "./chunk-X76M44I2.js";
-import "./chunk-3MSPZLGF.js";
+  NODE_ENGINE_RANGE,
+  VERSION,
+  isNodeVersionSupported
+} from "./chunk-5HAGSY6E.js";
+import "./chunk-YOT4GWJV.js";
 import {
   createUnifiedRegistry,
   getGlobalRegistry
-} from "./chunk-JNCOVP77.js";
+} from "./chunk-4O7NQB46.js";
 import {
   CodebaseIndexSchema,
   PaperStatusSchema,
@@ -275,26 +277,26 @@ import {
   loadSourcesRegistry,
   rankDiscoveredItems,
   saveSourcesRegistry
-} from "./chunk-3R5TFUS5.js";
+} from "./chunk-PMO7TY2K.js";
 import {
   loadPapersRegistry,
   loadTechniquesRegistry,
   savePapersRegistry
-} from "./chunk-R2CDVI4E.js";
+} from "./chunk-C2EZXKVE.js";
 import {
   resolveToken
-} from "./chunk-HILA36W2.js";
+} from "./chunk-UOKUUBJP.js";
 import {
   MemoryError,
   configureToolMemory,
   shutdownToolMemory
-} from "./chunk-CY6KGPAP.js";
+} from "./chunk-JC3O7WTI.js";
 import {
   capitalize,
   capitalizeKebab,
   truncateText
 } from "./chunk-7LP6VJRP.js";
-import "./chunk-SRC2TLRU.js";
+import "./chunk-W5WSXEAB.js";
 import {
   BUILT_IN_EXPERTS
 } from "./chunk-43SVUIPL.js";
@@ -306,20 +308,21 @@ import {
   getAvailableClis,
   isRecord,
   probeAllClis,
-  readSubprocessDepth
-} from "./chunk-52QVQASD.js";
-import "./chunk-DW3RU6GC.js";
+  readSubprocessDepth,
+  safeJsonParse
+} from "./chunk-TPBPFBO3.js";
+import "./chunk-3VBOYUPH.js";
 import {
   DEFAULTS
-} from "./chunk-2IJOZA75.js";
-import "./chunk-HSOZPMQN.js";
+} from "./chunk-GEKIA6CI.js";
+import "./chunk-Q5J7PV3G.js";
 import {
   nexusMkdtempSync
 } from "./chunk-DKHBIJO4.js";
-import "./chunk-V2RNDE4R.js";
+import "./chunk-UWE6AN65.js";
 import "./chunk-QZUG667L.js";
-import "./chunk-OFLMRACR.js";
-import "./chunk-FCIAKQNN.js";
+import "./chunk-CHP7WNJS.js";
+import "./chunk-OZD3IGK6.js";
 import {
   API_TIMEOUTS,
   AgentCapability,
@@ -397,7 +400,7 @@ import {
   validateTimeout,
   writeEmptyLine,
   writeLine
-} from "./chunk-NNM6ZIXQ.js";
+} from "./chunk-QOKSFHWH.js";
 import "./chunk-7WJGV5DN.js";
 import {
   applyPortableMode,
@@ -4451,7 +4454,7 @@ Provide a structured review with:
    * (Source: Issue #828 — Wire policy gate into production pipeline)
    */
   async postReviewToGitHub(provider, pr, result, gateDecision) {
-    const { formatReviewComment: formatReviewComment2 } = await import("./pr-reviewer-helpers-2ZSPMIG4.js");
+    const { formatReviewComment: formatReviewComment2 } = await import("./pr-reviewer-helpers-3VQNHIXI.js");
     const formattedBody = formatReviewComment2(result);
     const body = truncateText(formattedBody, DRAFT_REPLY_BODY_MAX_LENGTH, "\u2026[review truncated]");
     const sources = pr.files.slice(0, 20).map((file) => ({ type: "repoFile", path: file.filename }));
@@ -10086,12 +10089,13 @@ async function handleStatusCommand(args, options) {
     format
   };
   const result = await getResearchStatus(statusOptions);
-  return formatStatusResult(result, format);
+  const text = formatStatusResult(result, format);
+  return result.success ? text : failure(text);
 }
 async function handleOverlapCommand(args, options) {
   const techniqueId = args[0];
   if (techniqueId === void 0 || techniqueId === "") {
-    return "Error: technique-id is required for overlap command";
+    return failure("Error: technique-id is required for overlap command");
   }
   const format = optString(options, "format") ?? "table";
   const overlapOptions = {
@@ -10100,12 +10104,13 @@ async function handleOverlapCommand(args, options) {
     format
   };
   const result = await findOverlaps(overlapOptions);
-  return formatOverlapResult(result, format);
+  const text = formatOverlapResult(result, format);
+  return result.success ? text : failure(text);
 }
 async function handleAddCommand(args, options) {
   const arxivId = args[0];
   if (arxivId === void 0 || arxivId === "") {
-    return "Error: arxiv-id is required for add command";
+    return failure("Error: arxiv-id is required for add command");
   }
   const topic = optString(options, "topic");
   const priority = optString(options, "priority");
@@ -10169,7 +10174,7 @@ function renderDiscoverResponse(response) {
 async function handleDiscoverCommand(args, options) {
   const topic = args[0] ?? optString(options, "topic");
   if (topic === void 0 || topic === "") {
-    return "Error: --topic is required for discover command";
+    return failure("Error: --topic is required for discover command");
   }
   const parsed = ResearchDiscoverInputSchema.safeParse({
     topic,
@@ -10179,7 +10184,7 @@ async function handleDiscoverCommand(args, options) {
     }
   });
   if (!parsed.success) {
-    return `Error: ${parsed.error.issues.map((i) => i.message).join("; ")}`;
+    return failure(`Error: ${parsed.error.issues.map((i) => i.message).join("; ")}`);
   }
   const logger22 = createLogger({ component: "cli-research-discover" });
   const response = await executeDiscovery(parsed.data, logger22);
@@ -10188,7 +10193,7 @@ async function handleDiscoverCommand(args, options) {
 async function handleReviewCommand(args, options) {
   const topic = args[0] ?? optString(options, "topic");
   if (topic === void 0 || topic === "") {
-    return "Error: --topic is required for review command";
+    return failure("Error: --topic is required for review command");
   }
   const maxResults = optNumber(options, "maxResults") ?? 10;
   const createIssues = optBoolean(options, "createIssues");
@@ -10208,7 +10213,7 @@ async function handleSynthesizeCommand(args, options) {
   const topic = args[0] ?? optString(options, "topic");
   const result = await synthesizeResearch(topic);
   if (!result.ok) {
-    return `Error: ${result.error.message}`;
+    return failure(`Error: ${result.error.message}`);
   }
   return formatSynthesisResult(result.value);
 }
@@ -10325,26 +10330,25 @@ var VALID_SUBCOMMANDS = [
 function isValidResearchSubcommand(value) {
   return value !== void 0 && VALID_SUBCOMMANDS.includes(value);
 }
+function failure(text) {
+  return { text, exitCode: 1 };
+}
 function ok2(handler) {
-  return async (args, options) => ({
-    text: await handler(args, options),
-    exitCode: 0
-  });
+  return async (args, options) => {
+    const result = await handler(args, options);
+    if (typeof result !== "string") return result;
+    return { text: result, exitCode: result.startsWith("Error:") ? 1 : 0 };
+  };
 }
 async function handleIndexCommand(args) {
   const indexOptions = parseResearchIndexArgs(args);
   const result = await researchIndexCommand(indexOptions);
   return { text: result.message, exitCode: result.exitCode };
 }
-async function handleAddCommandWithExit(args, options) {
-  const text = await handleAddCommand(args, options);
-  const exitCode = text.startsWith("Error:") ? 1 : 0;
-  return { text, exitCode };
-}
 var SUBCOMMAND_HANDLERS = {
   status: ok2(handleStatusCommand),
   overlap: ok2(handleOverlapCommand),
-  add: handleAddCommandWithExit,
+  add: ok2(handleAddCommand),
   stats: ok2((_args, options) => handleStatsCommand(options)),
   refresh: ok2((_args, options) => handleRefreshCommand(options)),
   check: ok2(() => handleCheckCommand()),
@@ -11860,7 +11864,7 @@ function probeGrammars(register, parse6, probes = GRAMMAR_PROBES) {
 }
 async function loadGrammarModules() {
   const [{ ensurePolyglotLangs }, napi] = await Promise.all([
-    import("./ast-rule-runner-UMOL7AO3.js"),
+    import("./ast-rule-runner-G6IOGUCV.js"),
     import("@ast-grep/napi")
   ]);
   return { register: ensurePolyglotLangs, parse: napi.parse };
@@ -11882,26 +11886,18 @@ async function checkNativeGrammars(load = loadGrammarModules) {
 // src/cli/verify-command.ts
 function checkNodeVersion() {
   const version = process.version;
-  const major = parseInt(version.slice(1).split(".")[0] ?? "0", 10);
-  if (major >= 22) {
-    return {
-      name: "Node.js Version",
-      passed: true,
-      message: `${version} (LTS)`
-    };
-  }
-  if (major >= 18) {
+  if (isNodeVersionSupported(version)) {
     return {
       name: "Node.js Version",
       passed: true,
-      message: `${version} (supported, recommend 22.x LTS)`
+      message: `${version} (supported)`
     };
   }
   return {
     name: "Node.js Version",
     passed: false,
-    message: `${version} (unsupported)`,
-    fix: "Install Node.js 22.x LTS from https://nodejs.org"
+    message: `${version} (unsupported; requires Node.js ${NODE_ENGINE_RANGE})`,
+    fix: `Install Node.js ${NODE_ENGINE_RANGE} from https://nodejs.org`
   };
 }
 function checkPackageExports() {
@@ -16882,6 +16878,7 @@ import { readFileSync as readFileSync12 } from "node:fs";
 // src/cli/release-validate-helpers.ts
 import { execSync as execSync5 } from "node:child_process";
 import { existsSync as existsSync15, readFileSync as readFileSync11 } from "node:fs";
+import { z as z9 } from "zod";
 
 // src/cli/release-secret-scan.ts
 import { execSync as execSync4 } from "node:child_process";
@@ -16905,24 +16902,77 @@ function scanRecentCommitsForSecrets(options = {}) {
 }
 
 // src/cli/release-validate-helpers.ts
-async function validateSecurity(options) {
-  const startTime = Date.now();
-  const findings = [];
+var NPM_AUDIT_REPORT_SCHEMA = z9.object({
+  metadata: z9.object({
+    vulnerabilities: z9.object({
+      moderate: z9.number().int().nonnegative(),
+      high: z9.number().int().nonnegative(),
+      critical: z9.number().int().nonnegative()
+    })
+  })
+});
+function parseNpmAuditCounts(output2) {
+  const parsed = NPM_AUDIT_REPORT_SCHEMA.safeParse(safeJsonParse(output2));
+  return parsed.success ? parsed.data.metadata.vulnerabilities : void 0;
+}
+function createNpmAuditFinding(counts) {
+  const severeCounts = [
+    ...counts.high > 0 ? [`${String(counts.high)} high`] : [],
+    ...counts.critical > 0 ? [`${String(counts.critical)} critical`] : []
+  ];
+  if (severeCounts.length > 0) {
+    return {
+      severity: "error",
+      category: "security",
+      title: `npm audit found ${severeCounts.join(" and ")} vulnerabilities`,
+      description: "npm audit reported high or critical vulnerabilities.",
+      remediation: "Run npm audit fix or review and update vulnerable dependencies."
+    };
+  }
+  if (counts.moderate === 0) return void 0;
+  return {
+    severity: "warning",
+    category: "security",
+    title: `npm audit found ${String(counts.moderate)} moderate vulnerabilities`,
+    description: "npm audit reported moderate vulnerabilities.",
+    remediation: "Review and update vulnerable dependencies."
+  };
+}
+function unavailableNpmAuditFinding(reason) {
+  return {
+    severity: "error",
+    category: "security",
+    title: `npm audit unavailable: ${reason}`,
+    description: "npm audit did not produce a valid vulnerability report.",
+    remediation: "Restore npm audit availability and rerun release validation."
+  };
+}
+function getErrorStdout(error) {
+  if (typeof error !== "object" || error === null || !("stdout" in error)) return void 0;
+  return typeof error.stdout === "string" ? error.stdout : void 0;
+}
+function runNpmAudit() {
   try {
-    execSync5("npm audit --audit-level=high 2>/dev/null", {
+    const output2 = execSync5("npm audit --json --audit-level=high", {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
       timeout: CLI_SUBPROCESS_TIMEOUTS.ghCommandMs
     });
-  } catch {
-    findings.push({
-      severity: "warning",
-      category: "security",
-      title: "npm audit has findings",
-      description: "npm audit reported high or critical vulnerabilities.",
-      remediation: "Run npm audit fix or review and update vulnerable dependencies."
-    });
+    const counts = parseNpmAuditCounts(output2);
+    return counts === void 0 ? unavailableNpmAuditFinding("invalid JSON response") : createNpmAuditFinding(counts);
+  } catch (error) {
+    const stdout = getErrorStdout(error);
+    const counts = stdout === void 0 ? void 0 : parseNpmAuditCounts(stdout);
+    if (counts !== void 0) return createNpmAuditFinding(counts);
+    const reason = error instanceof Error ? error.message : String(error);
+    return unavailableNpmAuditFinding(reason);
   }
+}
+async function validateSecurity(options) {
+  const startTime = Date.now();
+  const findings = [];
+  const auditFinding = runNpmAudit();
+  if (auditFinding !== void 0) findings.push(auditFinding);
   if (existsSync15(".env")) {
     findings.push({
       severity: "error",
@@ -19672,7 +19722,7 @@ function startImprovementReviewScheduler(options) {
   let running = false;
   const runOnce = async () => {
     try {
-      const { runImprovementReview: runImprovementReview2, ImprovementReviewInputSchema: ImprovementReviewInputSchema2 } = await import("./improvement-review-F7CCW4HQ.js");
+      const { runImprovementReview: runImprovementReview2, ImprovementReviewInputSchema: ImprovementReviewInputSchema2 } = await import("./improvement-review-RX23MLAD.js");
       const input = ImprovementReviewInputSchema2.parse({ fileIssues });
       const result = await runImprovementReview2(input, { logger: logger22 });
       logger22.info("Scheduled improvement_review complete", {
@@ -20105,8 +20155,8 @@ async function initUpstreamServers(gatewayConfig, server, logger22) {
     servers: upstreamServers.length,
     tools: tools.length
   });
-  const { z: z14 } = await import("zod");
-  const passthroughSchema = z14.looseObject({});
+  const { z: z15 } = await import("zod");
+  const passthroughSchema = z15.looseObject({});
   for (const tool of tools) {
     const toolName = tool.name;
     const desc = tool.description ?? `Upstream tool: ${toolName}`;
@@ -21758,7 +21808,7 @@ function adaptConfigToLibrary(config) {
 }
 function createBeliefPromoter() {
   return async (event) => {
-    const { getToolMemory } = await import("./tool-memory-YV64LYJ3.js");
+    const { getToolMemory } = await import("./tool-memory-CLV7MXC4.js");
     const tm = getToolMemory();
     await tm.recordBelief(
       `skill:${event.name}`,
@@ -22503,7 +22553,8 @@ var RESEARCH_HELP = {
   ],
   flags: [
     { flag: "--format=<fmt>", description: "Output format: table, json", defaultValue: "table" },
-    { flag: "-o, --output=<path>", description: "Custom output path for refresh" }
+    { flag: "-o, --output=<path>", description: "Custom output path for refresh" },
+    { flag: "--source=<source>", description: "Discovery source for the discover subcommand" }
   ]
 };
 var FITNESS_AUDIT_HELP = {
@@ -22648,6 +22699,15 @@ function printResearchUsage() {
   process.stdout.write("  discover         Discover papers/repos from external sources\n");
   process.stdout.write("  review           Discover, score, and rank research findings\n");
   process.stdout.write("  prioritize       Rank actionable techniques by priority\n");
+  const flags = getCommandHelp("research")?.flags ?? [];
+  if (flags.length > 0) {
+    process.stdout.write("Options:\n");
+    for (const entry of flags) {
+      const suffix = entry.defaultValue === void 0 ? "" : ` (default: ${entry.defaultValue})`;
+      process.stdout.write(`  ${entry.flag}  ${entry.description}${suffix}
+`);
+    }
+  }
 }
 
 // src/cli-command-suggester.ts
@@ -22968,6 +23028,16 @@ async function handleResearchCommand(args) {
   if (args.options.dryRun) {
     options["dryRun"] = true;
   }
+  if (args.options.source !== void 0) {
+    const source = ResearchDiscoverInputSchema.shape.source.safeParse(args.options.source);
+    if (!source.success) {
+      const message = `Invalid research source: ${args.options.source}`;
+      process.stdout.write(`Error: ${message}
+`);
+      return cliExit(EXIT_CODES.INVALID_ARGS, message);
+    }
+    options["source"] = source.data;
+  }
   try {
     const result = await researchCommand(subcommand, positionalArgs, options);
     process.stdout.write(result.text + "\n");
@@ -22980,7 +23050,7 @@ async function handleResearchCommand(args) {
   }
 }
 async function handleRegistryCommand(args) {
-  const { registryCommand, isValidRegistrySubcommand, formatRegistryUsage } = await import("./registry-command-SD3YGORZ.js");
+  const { registryCommand, isValidRegistrySubcommand, formatRegistryUsage } = await import("./registry-command-GAL4MBUA.js");
   const subcommand = args.subcommand;
   if (!isValidRegistrySubcommand(subcommand)) {
     process.stdout.write(`${formatRegistryUsage()}
@@ -23028,12 +23098,12 @@ async function handleVerifyCommand(args) {
 async function handleDoctorCommand(args) {
   const exitCode = await doctorCommand({ fix: args.options.fix });
   if (args.options.deep) {
-    const { runDeepDiagnostics: runDeepDiagnostics2, formatDeepDiagnostics: formatDeepDiagnostics2 } = await import("./doctor-deep-WFHCOZJY.js");
+    const { runDeepDiagnostics: runDeepDiagnostics2, formatDeepDiagnostics: formatDeepDiagnostics2 } = await import("./doctor-deep-FDASNUC6.js");
     const diag = runDeepDiagnostics2();
     process.stdout.write(formatDeepDiagnostics2(diag) + "\n");
   }
   if (args.options.live) {
-    const { runLiveReadiness, formatLiveReadiness } = await import("./doctor-live-LR2TJT45.js");
+    const { runLiveReadiness, formatLiveReadiness } = await import("./doctor-live-M2A46PS3.js");
     const report = await runLiveReadiness();
     process.stdout.write(formatLiveReadiness(report) + "\n");
     if (report.some((r) => r.levels.serves.status === "failed")) {
@@ -23086,7 +23156,7 @@ async function runInitPortableFlow(args) {
   return cliExit(result.success ? EXIT_CODES.SUCCESS : EXIT_CODES.SERVER_START_FAILED);
 }
 async function runInitOpencodeFlow(args) {
-  const { runInitOpencode } = await import("./init-opencode-EEOVDBRF.js");
+  const { runInitOpencode } = await import("./init-opencode-2PVLMIJK.js");
   const opencodePath = args.options.opencode;
   if (opencodePath === void 0 || opencodePath === "") {
     process.stderr.write("Error: --opencode requires a path argument.\n");
@@ -23112,7 +23182,7 @@ async function runInitOpencodeFlow(args) {
   return cliExit(EXIT_CODES.SUCCESS);
 }
 async function renderOpencodeValidate(opencodePath) {
-  const { runOpencodeValidate } = await import("./init-opencode-EEOVDBRF.js");
+  const { runOpencodeValidate } = await import("./init-opencode-2PVLMIJK.js");
   const result = await runOpencodeValidate(opencodePath);
   if (!result.ok) {
     process.stderr.write(`init --opencode --validate: ${result.reason ?? "failed"}
@@ -23151,7 +23221,7 @@ async function handleSetupCommandAsync(args) {
   return cliExitFromStatus(exitCode);
 }
 async function runCustomApiSetup(args) {
-  const { configureCustomApi } = await import("./setup-custom-api-7CCRA6AP.js");
+  const { configureCustomApi } = await import("./setup-custom-api-T47OPCDE.js");
   const baseUrl = args.options.customApi;
   if (baseUrl === void 0) return EXIT_CODES.SERVER_START_FAILED;
   const input = {
@@ -24591,8 +24661,8 @@ ${colors.green}${symbols.check} All thresholds passed${colors.reset}`);
   }
   writeLine5(`
 ${colors.red}${symbols.cross} Threshold validation failed:${colors.reset}`);
-  for (const failure of failures) {
-    writeLine5(`  ${colors.red}${symbols.bullet} ${failure}${colors.reset}`);
+  for (const failure2 of failures) {
+    writeLine5(`  ${colors.red}${symbols.bullet} ${failure2}${colors.reset}`);
   }
   return false;
 }
@@ -25706,7 +25776,7 @@ import { writeFile as writeFile5, mkdir as mkdir4 } from "node:fs/promises";
 import { join as join21, dirname as dirname9 } from "node:path";
 
 // src/mcp/tools/improvement-remediation-capability.ts
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 var PHASE_CAPABILITIES = {
   research: /* @__PURE__ */ new Set(["untrusted-input", "secrets"]),
   implement: /* @__PURE__ */ new Set(["repo-write", "secrets"])
@@ -25747,7 +25817,7 @@ var CapabilityLedger = class {
     }
   }
 };
-var RemediationActionKindSchema = z9.enum([
+var RemediationActionKindSchema = z10.enum([
   "investigate",
   "adjust-routing",
   "add-test",
@@ -25755,17 +25825,17 @@ var RemediationActionKindSchema = z9.enum([
   "update-docs",
   "fix-bug"
 ]);
-var RemediationStepSchema = z9.object({
+var RemediationStepSchema = z10.object({
   kind: RemediationActionKindSchema,
-  description: z9.string().min(1).max(500),
+  description: z10.string().min(1).max(500),
   /** Optional path hint; bounded inert string, validated for traversal at use. */
-  targetPath: z9.string().min(1).max(300).optional()
+  targetPath: z10.string().min(1).max(300).optional()
 }).strict();
-var RemediationPlanSchema = z9.object({
+var RemediationPlanSchema = z10.object({
   /** Source signal key (mirrors ImprovementSignal.signalKey). */
-  signalKey: z9.string().min(1).max(200),
+  signalKey: z10.string().min(1).max(200),
   /** Signal category (mirrors SignalCategory; 'tool-fitness' #3852, 'perf-regression' #3692). */
-  category: z9.enum([
+  category: z10.enum([
     "routing",
     "tech-debt",
     "bug",
@@ -25774,8 +25844,8 @@ var RemediationPlanSchema = z9.object({
     "tool-fitness",
     "perf-regression"
   ]),
-  summary: z9.string().min(1).max(1e3),
-  steps: z9.array(RemediationStepSchema).min(1).max(20)
+  summary: z10.string().min(1).max(1e3),
+  steps: z10.array(RemediationStepSchema).min(1).max(20)
 }).strict();
 function parseRemediationPlan(raw) {
   const result = RemediationPlanSchema.safeParse(raw);
@@ -25905,25 +25975,25 @@ function makeGhPrCreator() {
 }
 
 // src/mcp/tools/remediation-review.ts
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 function soakRefOf(record) {
   return `${record.signalKey}::${record.timestamp}`;
 }
-var ReviewRecordSchema = z10.object({
+var ReviewRecordSchema = z11.object({
   /** Reference to the reviewed soak selection (`signalKey::timestamp`). */
-  soakRef: z10.string(),
+  soakRef: z11.string(),
   /** ISO-8601 time the review was recorded. */
-  reviewedAt: z10.string(),
+  reviewedAt: z11.string(),
   /** Always true — a persisted record is, by construction, a review. */
-  reviewed: z10.literal(true),
+  reviewed: z11.literal(true),
   /** Whether the evaluator assessed the selection SOUND. */
-  sound: z10.boolean(),
+  sound: z11.boolean(),
   /** Named evaluator who performed the review (required — the gate's named-evaluator criterion). */
-  evaluator: z10.string().min(1),
+  evaluator: z11.string().min(1),
   /** Named owner accepting enforcement, recorded at sign-off time (optional per record). */
-  owner: z10.string().min(1).optional(),
+  owner: z11.string().min(1).optional(),
   /** Free-text note (secret-scrubbed). */
-  note: z10.string().optional()
+  note: z11.string().optional()
 });
 var REVIEW_MAX_RECORDS = 1e4;
 function getRemediationReviewFile() {
@@ -26069,12 +26139,12 @@ import { createHash as createHash3 } from "node:crypto";
 import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync11, rmSync as rmSync2, realpathSync as realpathSync2 } from "node:fs";
 import { dirname as dirname11, join as join22 } from "node:path";
 import { execFileSync as execFileSync5 } from "node:child_process";
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 
 // src/mcp/tools/codepr-guards.ts
 import { realpathSync } from "node:fs";
 import { isAbsolute as isAbsolute3, resolve as resolve13, relative as relative4, sep as sep3, dirname as dirname10, basename as basename5 } from "node:path";
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 function deny(reason, detail) {
   return { ok: false, reason, detail };
 }
@@ -26220,11 +26290,11 @@ function classifyPath(relPath) {
   }
   return { sensitive: false };
 }
-var BlastRadiusLimitsSchema = z11.object({
+var BlastRadiusLimitsSchema = z12.object({
   /** Max number of files the change may touch. Default 20. */
-  maxFiles: z11.number().int().positive().default(20),
+  maxFiles: z12.number().int().positive().default(20),
   /** Max total changed lines (added + removed across all files). Default 400. */
-  maxLines: z11.number().int().positive().default(400)
+  maxLines: z12.number().int().positive().default(400)
 }).strict();
 var DEFAULT_BLAST_RADIUS_LIMITS = Object.freeze(
   BlastRadiusLimitsSchema.parse({})
@@ -26302,13 +26372,13 @@ function auditAutonomousEvent(logger22, record) {
   }
   return { ok: true };
 }
-var ResourceBudgetLimitsSchema = z11.object({
+var ResourceBudgetLimitsSchema = z12.object({
   /** Wall-clock ceiling in ms. Default 600000 (10 min). */
-  maxWallClockMs: z11.number().int().positive().default(6e5),
+  maxWallClockMs: z12.number().int().positive().default(6e5),
   /** Token ceiling. Default 200000. */
-  maxTokens: z11.number().int().positive().default(2e5),
+  maxTokens: z12.number().int().positive().default(2e5),
   /** Tool-call ceiling. Default 200. */
-  maxToolCalls: z11.number().int().positive().default(200)
+  maxToolCalls: z12.number().int().positive().default(200)
 }).strict();
 var DEFAULT_RESOURCE_BUDGET_LIMITS = Object.freeze(
   ResourceBudgetLimitsSchema.parse({})
@@ -26368,19 +26438,19 @@ function runGuard(name, fn) {
 }
 
 // src/mcp/tools/codepr-orchestrator.ts
-var ProposedChangeSchema = z12.object({
+var ProposedChangeSchema = z13.object({
   /** Repo-relative path the change would write. */
-  relPath: z12.string().min(1),
+  relPath: z13.string().min(1),
   /** The full new file content. */
-  newContent: z12.string()
+  newContent: z13.string()
 }).strict();
-var CodePrRunInputSchema = z12.object({
+var CodePrRunInputSchema = z13.object({
   /** Correlates all audit events for this run. */
-  runId: z12.string().min(1),
+  runId: z13.string().min(1),
   /** Hash of the source signal (fitness/improvement) that triggered the run. */
-  sourceSignalHash: z12.string().min(1),
+  sourceSignalHash: z13.string().min(1),
   /** The proposed change set. */
-  changes: z12.array(ProposedChangeSchema).min(1)
+  changes: z13.array(ProposedChangeSchema).min(1)
 }).strict();
 var ORCHESTRATOR_USAGE_ZERO = { wallClockMs: 0, tokens: 0, toolCalls: 0 };
 function sha256(s) {
@@ -26591,20 +26661,20 @@ function planCodePrRun(input, logger22, options = {}) {
 }
 
 // src/mcp/tools/codepr-soak-store.ts
-import { z as z13 } from "zod";
-var CodePrSoakRecordSchema = z13.object({
+import { z as z14 } from "zod";
+var CodePrSoakRecordSchema = z14.object({
   /** ISO-8601 capture time. */
-  timestamp: z13.string(),
+  timestamp: z14.string(),
   /** Correlates the data point to the dry-run's orchestrator runId. */
-  runId: z13.string(),
+  runId: z14.string(),
   /** The improvement signal's stable key that triggered the dry-run. */
-  signalKey: z13.string(),
+  signalKey: z14.string(),
   /** True when the dry-run plan succeeded with ZERO guard denial. */
-  green: z13.boolean(),
+  green: z14.boolean(),
   /** The guard denial reason when `green` is false; omitted for a green plan. */
-  denialReason: z13.string().optional(),
+  denialReason: z14.string().optional(),
   /** Files the dry-run plan touched (0 on denial before the diff was realized). */
-  filesTouched: z13.number().int().nonnegative()
+  filesTouched: z14.number().int().nonnegative()
 }).strict();
 var CODEPR_SOAK_MAX_RECORDS = 1e4;
 function getCodePrSoakFile() {