nexus-agents 8.42.13 → 8.43.0

package/dist/{chunk-UC4HIW3U.js → chunk-5CO7TEYR.js}

@@ -1,7 +1,7 @@
 import {
   getRandomProvider,
   getTimeProvider
-} from "./chunk-EPX75GNG.js";
+} from "./chunk-BTWPTJF3.js";
 
 // src/utils/id-utils.ts
 import { randomUUID } from "node:crypto";
@@ -24,4 +24,4 @@ export {
   generateHyphenId,
   generateUUID
 };
-//# sourceMappingURL=chunk-UC4HIW3U.js.map
+//# sourceMappingURL=chunk-5CO7TEYR.js.map

package/dist/{chunk-YPY3SKVB.js → chunk-6HMACBA3.js}

@@ -1,6 +1,6 @@
 import {
   getErrorMessage
-} from "./chunk-EPX75GNG.js";
+} from "./chunk-BTWPTJF3.js";
 
 // src/cli/setup-config.ts
 import { copyFileSync, existsSync, mkdirSync, writeFileSync } from "node:fs";
@@ -77,4 +77,4 @@ function ensureBackup(outputPath) {
 export {
   runConfigInitSync
 };
-//# sourceMappingURL=chunk-YPY3SKVB.js.map
+//# sourceMappingURL=chunk-6HMACBA3.js.map

package/dist/{chunk-CBKAHM7G.js → chunk-AJFJYLUF.js}

@@ -1,9 +1,9 @@
 import {
   VERSION
-} from "./chunk-KWY4GSGQ.js";
+} from "./chunk-LV3XDNDM.js";
 import {
   emitClawGuardViolation
-} from "./chunk-DN63HNKL.js";
+} from "./chunk-MLG2PR6E.js";
 import {
   CACHE_TIMEOUTS,
   MCP_TIMEOUTS,
@@ -19,7 +19,7 @@ import {
   getTimeProvider,
   ok,
   resolveToolClassGuardMs
-} from "./chunk-EPX75GNG.js";
+} from "./chunk-BTWPTJF3.js";
 import {
   getNexusDataDir
 } from "./chunk-JVNJJ2VL.js";
@@ -1544,14 +1544,20 @@ function checkAccess(toolName, policy, args) {
   }
   if (policy.allowedTools === "*") return { decision: "allow" };
   if (policy.allowedTools.length === 0) {
+    const refuseVerb = policy.refuseVerbMatched;
     return {
       decision: "unmeasured",
-      reason: `allowlist arm did not run for tool "${toolName}": the derived policy (source "${policy.source}", mode "${policy.mode}") carries an empty allowedTools, and no producer emits tool names (#5022)`
+      reason: `allowlist arm did not run for tool "${toolName}": the derived policy (source "${policy.source}", mode "${policy.mode}") carries an empty allowedTools, and no producer emits tool names (#5022)${refuseVerbNote(refuseVerb)}`,
+      ...refuseVerb !== void 0 && { refuseVerbMatched: refuseVerb }
     };
   }
   if (policy.allowedTools.includes(toolName)) return { decision: "allow" };
   return decideOnViolation(toolName, policy.mode);
 }
+function refuseVerbNote(refuseVerb) {
+  if (refuseVerb === void 0) return "";
+  return `; the objective matched the destructive verb "${refuseVerb}", which this verdict does NOT deny (#5895)`;
+}
 function decideOnViolation(toolName, mode) {
   if (mode === "audit") {
     return {
@@ -1635,7 +1641,12 @@ function createAccessPolicyChainMiddleware(toolName) {
         reason: decision.reason,
         policySource: policy.source,
         mode: policy.mode,
-        requestId: ctx.requestContext.requestId
+        requestId: ctx.requestContext.requestId,
+        // #5895: a stable field, so a future counter keys on this rather than
+        // parsing `reason`. Absent unless the objective matched a refuse verb.
+        ...decision.refuseVerbMatched !== void 0 && {
+          refuseVerbMatched: decision.refuseVerbMatched
+        }
       });
       return next(args, ctx);
     }
@@ -2306,4 +2317,4 @@ export {
   VOTING_THRESHOLDS,
   ConsensusMetricsSchema
 };
-//# sourceMappingURL=chunk-CBKAHM7G.js.map
+//# sourceMappingURL=chunk-AJFJYLUF.js.map