nexus-agents 8.28.8 → 8.28.9

package/dist/{chunk-T4NMCY3E.js → chunk-F2OVYZWF.js}

@@ -21,7 +21,7 @@ import {
 import {
   DEFAULT_TASK_TTL_MS,
   clampTaskTtl
-} from "./chunk-IKGRS6I3.js";
+} from "./chunk-LFQPDMW4.js";
 import {
   executeExpert
 } from "./chunk-LE5GD6MT.js";
@@ -55,7 +55,7 @@ import {
   toJobSummary,
   updateStage,
   writeJobCancelled
-} from "./chunk-RQXTL7D7.js";
+} from "./chunk-MU374IAT.js";
 import {
   allOf,
   anyOf
@@ -75,7 +75,7 @@ import {
 } from "./chunk-J5DOKTMY.js";
 import {
   withPrerequisite
-} from "./chunk-6QRX5DXU.js";
+} from "./chunk-J42YVGO6.js";
 import {
   NOOP_NOTIFIER,
   RateLimiter,
@@ -100,7 +100,7 @@ import {
   withAuditTrail,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-IXAPDTFG.js";
+} from "./chunk-OQCVMQVW.js";
 import {
   createAuditTrail,
   createGraphAuditBridge,
@@ -45695,7 +45695,7 @@ function buildVotingInput(plan, config) {
 }
 async function executeSingleVote(plan, config, log) {
   try {
-    const { executeVoting } = await import("./consensus-vote-ZIRXZ27E.js");
+    const { executeVoting } = await import("./consensus-vote-WRR62CRC.js");
     const input = buildVotingInput(plan, config);
     const result = await executeVoting(input, log);
     return parseVotingResult(result);
@@ -47487,7 +47487,7 @@ ${contextBlock}`;
       const strategy = config.votingStrategy ?? "higher_order";
       await postProgress(config, "Vote", `Running consensus with ${strategy} strategy...`);
       try {
-        const { executeVoting } = await import("./consensus-vote-ZIRXZ27E.js");
+        const { executeVoting } = await import("./consensus-vote-WRR62CRC.js");
         const votingResult = await executeVoting(
           {
             proposal: buildVoteProposal(plan, research),
@@ -56207,4 +56207,4 @@ export {
   shutdownFeedbackSubscriber,
   createEventBusBridge
 };
-//# sourceMappingURL=chunk-T4NMCY3E.js.map
+//# sourceMappingURL=chunk-F2OVYZWF.js.map

package/dist/{chunk-6QRX5DXU.js → chunk-J42YVGO6.js}

@@ -7,7 +7,7 @@ import {
   toolStructuredError,
   toolSuccessStructured,
   wrapToolWithTimeout
-} from "./chunk-IXAPDTFG.js";
+} from "./chunk-OQCVMQVW.js";
 import {
   JsonlStore,
   SECURITY_KEYWORDS,
@@ -2159,4 +2159,4 @@ export {
   runImprovementReview,
   registerImprovementReviewTool
 };
-//# sourceMappingURL=chunk-6QRX5DXU.js.map
+//# sourceMappingURL=chunk-J42YVGO6.js.map

package/dist/{chunk-IKGRS6I3.js → chunk-LFQPDMW4.js}

@@ -8,7 +8,7 @@ import {
   NODE_ENGINE_RANGE,
   VERSION,
   isNodeVersionSupported
-} from "./chunk-THQTN3P7.js";
+} from "./chunk-QIWQU3CB.js";
 import {
   capitalize
 } from "./chunk-7LP6VJRP.js";
@@ -1228,7 +1228,7 @@ async function runDoctorFix(result) {
   writeLine2("\u2500".repeat(40));
   let fixCount = 0;
   if (!result.dataDirectory.rootExists || result.dataDirectory.subdirectories.some((d) => !d.exists || !d.writable)) {
-    const { initDataDirectories: initDataDirectories2, describeDataDirFix: describeDataDirFix2 } = await import("./setup-data-dir-43IEDUU2.js");
+    const { initDataDirectories: initDataDirectories2, describeDataDirFix: describeDataDirFix2 } = await import("./setup-data-dir-AED6VSRL.js");
     const outcome = describeDataDirFix2(initDataDirectories2());
     writeLine2(outcome.line);
     if (outcome.counted) fixCount++;
@@ -1330,4 +1330,4 @@ export {
   startStdioServer,
   closeServer
 };
-//# sourceMappingURL=chunk-IKGRS6I3.js.map
+//# sourceMappingURL=chunk-LFQPDMW4.js.map

package/dist/{chunk-RQXTL7D7.js → chunk-MU374IAT.js}

@@ -23,10 +23,10 @@ import {
   toolSuccessStructured,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-IXAPDTFG.js";
+} from "./chunk-OQCVMQVW.js";
 import {
   VERSION
-} from "./chunk-THQTN3P7.js";
+} from "./chunk-QIWQU3CB.js";
 import {
   assessPanelIndependence,
   countDistinctModels,
@@ -7683,4 +7683,4 @@ export {
   CONSENSUS_VOTE_TOOL_SCHEMA,
   registerConsensusVoteTool
 };
-//# sourceMappingURL=chunk-RQXTL7D7.js.map
+//# sourceMappingURL=chunk-MU374IAT.js.map

package/dist/{chunk-IXAPDTFG.js → chunk-OQCVMQVW.js}

@@ -1,6 +1,6 @@
 import {
   VERSION
-} from "./chunk-THQTN3P7.js";
+} from "./chunk-QIWQU3CB.js";
 import {
   emitClawGuardViolation
 } from "./chunk-JANMYVKT.js";
@@ -651,6 +651,37 @@ function measuredTrustTier(context) {
   return derivable ? context.trustTier : void 0;
 }
 
+// src/mcp/middleware/secure-handler-rate-limit.ts
+function rateLimitError(nextTokenMs) {
+  return toolStructuredError({
+    errorCategory: "transient",
+    message: `Rate limit exceeded. Try again in ${String(nextTokenMs)}ms.`
+  });
+}
+function checkRateLimit(rateLimiter, logger) {
+  const acquired = rateLimiter.tryAcquire();
+  if (!acquired) {
+    const state = rateLimiter.getState();
+    logger.warn("Rate limit exceeded");
+    return { error: rateLimitError(state.nextTokenMs), state };
+  }
+  return null;
+}
+function emitRateLimitAudit(auditLogger, toolName, ctx, state) {
+  const actor = actorFromContext(ctx);
+  auditLogger.logRateLimitViolation({
+    toolName,
+    actor,
+    // The bucket is empty at denial time, so the tokens spent out of it are
+    // `capacity - tokens`. Both numbers are measured from the limiter that
+    // denied this call; they were hard-coded to 0/0 before #5577, which made
+    // every durable record read "Rate limit exceeded: 0/0 requests".
+    currentRate: Math.round(state.capacity - state.tokens),
+    limitRate: state.capacity,
+    requestId: ctx.requestId
+  });
+}
+
 // src/mcp/middleware/tool-input-sanitizer.ts
 var XML_INJECTION_PATTERN = /<\/?(system|human|assistant|instructions|user|prompt|context|tool_use|tool_result)\b[^>]*>/gi;
 var INJECTION_DETECTORS = [
@@ -864,12 +895,6 @@ function setSecureHandlerAuditLogger(logger, auditLogger) {
   if (auditLogger === void 0) registrationAuditLoggers.delete(logger);
   else registrationAuditLoggers.set(logger, auditLogger);
 }
-function rateLimitError(nextTokenMs) {
-  return toolStructuredError({
-    errorCategory: "transient",
-    message: `Rate limit exceeded. Try again in ${String(nextTokenMs)}ms.`
-  });
-}
 function policyDeniedError(reason, requestId) {
   return toolStructuredError({
     errorCategory: "permission",
@@ -923,15 +948,6 @@ function checkInputSize(args, logger, requestId) {
   }
   return null;
 }
-function checkRateLimit(rateLimiter, logger) {
-  const acquired = rateLimiter.tryAcquire();
-  if (!acquired) {
-    const state = rateLimiter.getState();
-    logger.warn("Rate limit exceeded");
-    return rateLimitError(state.nextTokenMs);
-  }
-  return null;
-}
 function checkPolicy(opts) {
   const ctxOpts = {
     mode: opts.mode,
@@ -1009,16 +1025,6 @@ function emitToolAudit({
     ...nearMiss ? { policyDecision: "would_deny" } : {}
   });
 }
-function emitRateLimitAudit(auditLogger, toolName, ctx) {
-  const actor = actorFromContext(ctx);
-  auditLogger.logRateLimitViolation({
-    toolName,
-    actor,
-    currentRate: 0,
-    limitRate: 0,
-    requestId: ctx.requestId
-  });
-}
 function checkSecurityTier(config, sanitizeResult, logger) {
   const tier = config.securityTier ?? "standard";
   if (tier === "standard" || sanitizeResult.detectedPatterns.length === 0) {
@@ -1054,11 +1060,11 @@ function runPreChecks(config, args, mode, requestContext, logger) {
   const tierError = checkSecurityTier(config, sanitizeResult, logger);
   if (tierError !== null) return { error: tierError, sanitizedArgs, nearMiss: false, sanitization };
   if (config.rateLimiter) {
-    const rlResult = checkRateLimit(config.rateLimiter, logger);
-    if (rlResult) {
+    const denial = checkRateLimit(config.rateLimiter, logger);
+    if (denial) {
       if (config.auditLogger)
-        emitRateLimitAudit(config.auditLogger, config.toolName, requestContext);
-      return { error: rlResult, sanitizedArgs, nearMiss: false, sanitization };
+        emitRateLimitAudit(config.auditLogger, config.toolName, requestContext, denial.state);
+      return { error: denial.error, sanitizedArgs, nearMiss: false, sanitization };
     }
   }
   const policy = runPolicyCheck(config, sanitizedArgs, mode, logger, requestContext);
@@ -2217,13 +2223,13 @@ export {
   logToolInvocationAudit,
   logPolicyAudit,
   logRateLimitAudit,
-  sanitizeToolInput,
   defaultRetryable,
   coarsenFailureCategory,
   toolSuccess,
   toolSuccessStructured,
   toolStructuredError,
   toolError,
+  sanitizeToolInput,
   setGlobalPolicyFirewall,
   stagePolicyFirewallForRollout,
   setSecureHandlerAuditLogger,
@@ -2255,4 +2261,4 @@ export {
   VOTING_THRESHOLDS,
   ConsensusMetricsSchema
 };
-//# sourceMappingURL=chunk-IXAPDTFG.js.map
+//# sourceMappingURL=chunk-OQCVMQVW.js.map