nexus-agents 8.42.13 → 8.42.14

package/dist/{chunk-QJGVEG3R.js → chunk-G2XNQ3QR.js}

@@ -7,7 +7,7 @@ import {
   toolStructuredError,
   toolSuccessStructured,
   wrapToolWithTimeout
-} from "./chunk-CBKAHM7G.js";
+} from "./chunk-IOCYTKGI.js";
 import {
   JsonlStore,
   SECURITY_KEYWORDS,
@@ -2173,4 +2173,4 @@ export {
   runImprovementReview,
   registerImprovementReviewTool
 };
-//# sourceMappingURL=chunk-QJGVEG3R.js.map
+//# sourceMappingURL=chunk-G2XNQ3QR.js.map

package/dist/{chunk-CBKAHM7G.js → chunk-IOCYTKGI.js}

@@ -1,6 +1,6 @@
 import {
   VERSION
-} from "./chunk-KWY4GSGQ.js";
+} from "./chunk-PPGJJRGB.js";
 import {
   emitClawGuardViolation
 } from "./chunk-DN63HNKL.js";
@@ -1544,14 +1544,20 @@ function checkAccess(toolName, policy, args) {
   }
   if (policy.allowedTools === "*") return { decision: "allow" };
   if (policy.allowedTools.length === 0) {
+    const refuseVerb = policy.refuseVerbMatched;
     return {
       decision: "unmeasured",
-      reason: `allowlist arm did not run for tool "${toolName}": the derived policy (source "${policy.source}", mode "${policy.mode}") carries an empty allowedTools, and no producer emits tool names (#5022)`
+      reason: `allowlist arm did not run for tool "${toolName}": the derived policy (source "${policy.source}", mode "${policy.mode}") carries an empty allowedTools, and no producer emits tool names (#5022)${refuseVerbNote(refuseVerb)}`,
+      ...refuseVerb !== void 0 && { refuseVerbMatched: refuseVerb }
     };
   }
   if (policy.allowedTools.includes(toolName)) return { decision: "allow" };
   return decideOnViolation(toolName, policy.mode);
 }
+function refuseVerbNote(refuseVerb) {
+  if (refuseVerb === void 0) return "";
+  return `; the objective matched the destructive verb "${refuseVerb}", which this verdict does NOT deny (#5895)`;
+}
 function decideOnViolation(toolName, mode) {
   if (mode === "audit") {
     return {
@@ -1635,7 +1641,12 @@ function createAccessPolicyChainMiddleware(toolName) {
         reason: decision.reason,
         policySource: policy.source,
         mode: policy.mode,
-        requestId: ctx.requestContext.requestId
+        requestId: ctx.requestContext.requestId,
+        // #5895: a stable field, so a future counter keys on this rather than
+        // parsing `reason`. Absent unless the objective matched a refuse verb.
+        ...decision.refuseVerbMatched !== void 0 && {
+          refuseVerbMatched: decision.refuseVerbMatched
+        }
       });
       return next(args, ctx);
     }
@@ -2306,4 +2317,4 @@ export {
   VOTING_THRESHOLDS,
   ConsensusMetricsSchema
 };
-//# sourceMappingURL=chunk-CBKAHM7G.js.map
+//# sourceMappingURL=chunk-IOCYTKGI.js.map