nexus-agents 8.48.0 → 8.48.1

package/dist/{ast-rule-runner-74D2KNCC.js → ast-rule-runner-SUEOULTY.js}

@@ -9,8 +9,8 @@ import {
   getBuiltInAstRulesPath,
   loadRules,
   runAstQaRules
-} from "./chunk-KRPSDJOP.js";
-import "./chunk-AZPM542H.js";
+} from "./chunk-NEKNNWPU.js";
+import "./chunk-VKBFV6OD.js";
 import "./chunk-MTYJPPIG.js";
 import "./chunk-BTYRPZON.js";
 import "./chunk-ZPWHCABL.js";
@@ -26,4 +26,4 @@ export {
   loadRules,
   runAstQaRules
 };
-//# sourceMappingURL=ast-rule-runner-74D2KNCC.js.map
+//# sourceMappingURL=ast-rule-runner-SUEOULTY.js.map

package/dist/{child-mcp-config-KTR6MPNZ.js → child-mcp-config-Y3GST6L4.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-T46RV7Y7.js";
 import {
   createLogger
-} from "./chunk-AZPM542H.js";
+} from "./chunk-VKBFV6OD.js";
 import "./chunk-MTYJPPIG.js";
 import "./chunk-BTYRPZON.js";
 import "./chunk-ZPWHCABL.js";
@@ -60,4 +60,4 @@ export {
   generateMcpConfig,
   getDefaultAllowedTools
 };
-//# sourceMappingURL=child-mcp-config-KTR6MPNZ.js.map
+//# sourceMappingURL=child-mcp-config-Y3GST6L4.js.map

package/dist/{chunk-7XT6WVSB.js → chunk-2CB4RKGK.js}

@@ -4,7 +4,7 @@ import {
   getErrorMessage,
   getTimeProvider,
   ok
-} from "./chunk-AZPM542H.js";
+} from "./chunk-VKBFV6OD.js";
 
 // src/context/session-memory.ts
 import * as fs from "node:fs";
@@ -370,4 +370,4 @@ export {
   SessionMemory,
   createSessionMemory
 };
-//# sourceMappingURL=chunk-7XT6WVSB.js.map
+//# sourceMappingURL=chunk-2CB4RKGK.js.map

package/dist/{chunk-7I3LY4HJ.js → chunk-4Y5TFSYP.js}

@@ -2,7 +2,7 @@ import {
   CACHE_TIMEOUTS,
   createLogger,
   getTimeProvider
-} from "./chunk-AZPM542H.js";
+} from "./chunk-VKBFV6OD.js";
 
 // src/security/trust-types.ts
 import { z } from "zod";
@@ -610,4 +610,4 @@ export {
   resolveReputationGatingMode,
   gateWithReputation
 };
-//# sourceMappingURL=chunk-7I3LY4HJ.js.map
+//# sourceMappingURL=chunk-4Y5TFSYP.js.map

package/dist/{chunk-DVBGHGU3.js → chunk-53EL53NC.js}

@@ -2,7 +2,7 @@ import {
   createLogger,
   err,
   ok
-} from "./chunk-AZPM542H.js";
+} from "./chunk-VKBFV6OD.js";
 
 // src/scm/token-resolver.ts
 import { execFile } from "node:child_process";
@@ -87,4 +87,4 @@ export {
   hasToken,
   getTokenEnvVars
 };
-//# sourceMappingURL=chunk-DVBGHGU3.js.map
+//# sourceMappingURL=chunk-53EL53NC.js.map

package/dist/{chunk-CJ5FEUI2.js → chunk-6AX4544S.js}

@@ -10,13 +10,13 @@ import {
 import {
   assessReputation,
   sanitizeInput
-} from "./chunk-7I3LY4HJ.js";
+} from "./chunk-4Y5TFSYP.js";
 import {
   createLogger,
   err,
   getTimeProvider,
   ok
-} from "./chunk-AZPM542H.js";
+} from "./chunk-VKBFV6OD.js";
 
 // src/dogfooding/pr-reviewer-helpers.ts
 import { randomUUID } from "node:crypto";
@@ -416,4 +416,4 @@ export {
   createFailedReview,
   reviewPostingBlock
 };
-//# sourceMappingURL=chunk-CJ5FEUI2.js.map
+//# sourceMappingURL=chunk-6AX4544S.js.map

package/dist/{chunk-QOKB6MWY.js → chunk-6GKP2RLC.js}

@@ -1,10 +1,10 @@
 import {
   createAutoAdapter
-} from "./chunk-SBCEQWUN.js";
+} from "./chunk-GFW5IMOF.js";
 import {
   getDefaultCliCircuitBreakerRegistry,
   mapModelErrorToCategory
-} from "./chunk-DF6M73XJ.js";
+} from "./chunk-N56KU4KM.js";
 import {
   CLI_NAMES,
   CircularBuffer,
@@ -24,7 +24,7 @@ import {
   recordRateLimitEvent,
   resolveModelIdentitySync,
   toRateLimitError
-} from "./chunk-AZPM542H.js";
+} from "./chunk-VKBFV6OD.js";
 
 // src/config/model-equivalence.ts
 function canonicalModelKey(modelId) {
@@ -909,4 +909,4 @@ export {
   getGlobalRegistry,
   resetGlobalRegistry
 };
-//# sourceMappingURL=chunk-QOKB6MWY.js.map
+//# sourceMappingURL=chunk-6GKP2RLC.js.map

package/dist/{chunk-7YHOHQJR.js → chunk-A4WAADEC.js}

@@ -1,17 +1,17 @@
 import {
   computeCostDetail,
   recordUsageEvent
-} from "./chunk-TE6UUPOA.js";
+} from "./chunk-PJKJF6FQ.js";
 import {
   BaseAdapter,
   createStream,
   planOptionalParams,
   requireApiKey,
   validateApiKeyPresence
-} from "./chunk-R247RR7W.js";
+} from "./chunk-YLTUPAKL.js";
 import {
   assertCustomApiHostResolvesPublic
-} from "./chunk-YPU4OHBU.js";
+} from "./chunk-VDBBLFZR.js";
 import {
   ConfigError,
   ModelCapability,
@@ -22,7 +22,7 @@ import {
   getTimeProvider,
   getTokenEstimator,
   ok
-} from "./chunk-AZPM542H.js";
+} from "./chunk-VKBFV6OD.js";
 
 // src/adapters/openai-types.ts
 var OPENAI_MODELS = {
@@ -842,4 +842,4 @@ export {
   discoverModels,
   buildOpenAICompatAdapters
 };
-//# sourceMappingURL=chunk-7YHOHQJR.js.map
+//# sourceMappingURL=chunk-A4WAADEC.js.map

package/dist/{chunk-2SINF73A.js → chunk-A7GKD65R.js}

@@ -1,9 +1,9 @@
 import {
   VERSION
-} from "./chunk-LO36HW55.js";
+} from "./chunk-OUEZ4AMS.js";
 import {
   emitClawGuardViolation
-} from "./chunk-JOVBHYWW.js";
+} from "./chunk-MOVW4ZFU.js";
 import {
   CACHE_TIMEOUTS,
   MCP_TIMEOUTS,
@@ -19,7 +19,7 @@ import {
   getTimeProvider,
   ok,
   resolveToolClassGuardMs
-} from "./chunk-AZPM542H.js";
+} from "./chunk-VKBFV6OD.js";
 import {
   getNexusDataDir
 } from "./chunk-BTYRPZON.js";
@@ -2360,4 +2360,4 @@ export {
   VOTING_THRESHOLDS,
   ConsensusMetricsSchema
 };
-//# sourceMappingURL=chunk-2SINF73A.js.map
+//# sourceMappingURL=chunk-A7GKD65R.js.map

package/dist/{chunk-USBSYHBT.js → chunk-BDYBNBGJ.js}

@@ -7,7 +7,7 @@ import {
   toolStructuredError,
   toolSuccessStructured,
   wrapToolWithTimeout
-} from "./chunk-2SINF73A.js";
+} from "./chunk-A7GKD65R.js";
 import {
   JsonlStore,
   SECURITY_KEYWORDS,
@@ -20,7 +20,7 @@ import {
   getTimeProvider,
   isDeclaredNeverDeprecate,
   isRegisteredToolName
-} from "./chunk-AZPM542H.js";
+} from "./chunk-VKBFV6OD.js";
 import {
   getNexusDataDir,
   nexusDataPath
@@ -2173,4 +2173,4 @@ export {
   runImprovementReview,
   registerImprovementReviewTool
 };
-//# sourceMappingURL=chunk-USBSYHBT.js.map
+//# sourceMappingURL=chunk-BDYBNBGJ.js.map

package/dist/{chunk-X7EXIH67.js → chunk-CE6OZA5X.js}

@@ -1,14 +1,14 @@
 import {
   GitHubProvider,
   ScmError
-} from "./chunk-5ONSIV4D.js";
+} from "./chunk-RCTVIHUT.js";
 import {
   resolveToken
-} from "./chunk-DVBGHGU3.js";
+} from "./chunk-53EL53NC.js";
 import {
   err,
   ok
-} from "./chunk-AZPM542H.js";
+} from "./chunk-VKBFV6OD.js";
 
 // src/scm/factory.ts
 async function createScmProvider(config) {
@@ -41,4 +41,4 @@ export {
   createScmProvider,
   createGitHubProvider
 };
-//# sourceMappingURL=chunk-X7EXIH67.js.map
+//# sourceMappingURL=chunk-CE6OZA5X.js.map

package/dist/{chunk-RBNJYWQ6.js → chunk-F6LB2JEI.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-7LP6VJRP.js";
 import {
   SessionMemory
-} from "./chunk-7XT6WVSB.js";
+} from "./chunk-2CB4RKGK.js";
 import {
   StatsOnlyAdapter,
   ensureSharedMemoryRegistry
@@ -15,7 +15,7 @@ import {
 } from "./chunk-MUJCGBZW.js";
 import {
   generateId
-} from "./chunk-62CSX5QU.js";
+} from "./chunk-P6D43B4F.js";
 import {
   ErrorCode,
   NexusError,
@@ -29,7 +29,7 @@ import {
   ok,
   openSqliteDatabase,
   setSharedMobiMemDbPathResolver
-} from "./chunk-AZPM542H.js";
+} from "./chunk-VKBFV6OD.js";
 import {
   nexusDataPath
 } from "./chunk-BTYRPZON.js";
@@ -5825,4 +5825,4 @@ export {
   reinitializeMemoryBackends,
   ToolMemoryManager
 };
-//# sourceMappingURL=chunk-RBNJYWQ6.js.map
+//# sourceMappingURL=chunk-F6LB2JEI.js.map

package/dist/{chunk-GLDBWMOB.js → chunk-FASXNWT3.js}

@@ -5,13 +5,13 @@ import {
   loadTechniquesRegistry,
   resolveInsideRoot,
   savePapersRegistry
-} from "./chunk-ODPVHHUW.js";
+} from "./chunk-WNEVQONR.js";
 import {
   resolveToken
-} from "./chunk-DVBGHGU3.js";
+} from "./chunk-53EL53NC.js";
 import {
   getToolMemory
-} from "./chunk-RBNJYWQ6.js";
+} from "./chunk-F6LB2JEI.js";
 import {
   capitalizeWords,
   tokenizeFiltered,
@@ -40,7 +40,7 @@ import {
   ok,
   registerPersistentDistillerFactory,
   sigmoidConfidence
-} from "./chunk-AZPM542H.js";
+} from "./chunk-VKBFV6OD.js";
 import {
   ensureLearningDir,
   getRulesFile
@@ -4238,4 +4238,4 @@ export {
   DEFAULT_CONTEXT_BUDGET_TOKENS,
   getContextPromptPrefix
 };
-//# sourceMappingURL=chunk-GLDBWMOB.js.map
+//# sourceMappingURL=chunk-FASXNWT3.js.map

package/dist/{chunk-SBCEQWUN.js → chunk-GFW5IMOF.js}

@@ -5,34 +5,34 @@ import {
   planOptionalParams,
   requireApiKey,
   validateApiKeyPresence
-} from "./chunk-R247RR7W.js";
+} from "./chunk-YLTUPAKL.js";
 import {
   CUSTOM_API_DEFAULT_MODEL
-} from "./chunk-L7DROS6X.js";
+} from "./chunk-ZWJOB76B.js";
 import {
   CUSTOM_API_BASE_URL_ENV,
   PROVIDER_ENV_KEYS,
   assertCustomApiHostResolvesPublic,
   validateCustomApiBaseUrl
-} from "./chunk-YPU4OHBU.js";
+} from "./chunk-VDBBLFZR.js";
 import {
   nexusMkdtempSync
 } from "./chunk-T46RV7Y7.js";
 import {
   getAvailabilityCache
-} from "./chunk-4TE5DJHO.js";
+} from "./chunk-KITJQPDR.js";
 import {
   extractSystemPrompt
 } from "./chunk-QZUG667L.js";
 import {
   generateHyphenId
-} from "./chunk-62CSX5QU.js";
+} from "./chunk-P6D43B4F.js";
 import {
   CliCircuitBreaker,
   DEFAULT_CIRCUIT_BREAKER_CONFIG,
   getCliCircuitBreakerSnapshot,
   getDefaultCliCircuitBreakerRegistry
-} from "./chunk-DF6M73XJ.js";
+} from "./chunk-N56KU4KM.js";
 import {
   CLI_SUBPROCESS_TIMEOUTS,
   CLI_TIMEOUTS,
@@ -73,7 +73,7 @@ import {
   resolveCliModelName,
   resolveRetryAfterMs,
   retryAfterMsFromContext
-} from "./chunk-AZPM542H.js";
+} from "./chunk-VKBFV6OD.js";
 import {
   parseBoolValue
 } from "./chunk-BTYRPZON.js";
@@ -4992,4 +4992,4 @@ export {
   SdkAdapter,
   createAutoAdapter
 };
-//# sourceMappingURL=chunk-SBCEQWUN.js.map
+//# sourceMappingURL=chunk-GFW5IMOF.js.map

package/dist/{chunk-7QY3RIIY.js → chunk-GLDK3R2H.js}

@@ -1,11 +1,11 @@
 import {
   resolveCliSlot
-} from "./chunk-4TE5DJHO.js";
+} from "./chunk-KITJQPDR.js";
 import {
   createLogger,
   getTimeProvider,
   isRateLimitText
-} from "./chunk-AZPM542H.js";
+} from "./chunk-VKBFV6OD.js";
 
 // src/pipeline/expert-bridge.ts
 function resolveCliFromModelString(model) {
@@ -21,7 +21,7 @@ async function getMcpConfigPath() {
   if (cachedMcpConfigPath !== null) return cachedMcpConfigPath;
   mcpConfigInitPromise ??= (async () => {
     try {
-      const { generateMcpConfig } = await import("./child-mcp-config-KTR6MPNZ.js");
+      const { generateMcpConfig } = await import("./child-mcp-config-Y3GST6L4.js");
       const config = await generateMcpConfig();
       cachedMcpConfigPath = config.configPath;
       cachedMcpConfigCleanup = config.cleanup;
@@ -93,8 +93,8 @@ var routerInitPromise = null;
 async function getRouter() {
   if (cachedRouter !== null) return cachedRouter;
   routerInitPromise ??= (async () => {
-    const { createAllAdapters } = await import("./factory-GESVEWDP.js");
-    const { createCompositeRouter } = await import("./composite-router-JLXK7CPT.js");
+    const { createAllAdapters } = await import("./factory-K6QWZRX3.js");
+    const { createCompositeRouter } = await import("./composite-router-XPWI4EAG.js");
     const adapters = createAllAdapters();
     if (adapters.size === 0) {
       routerInitPromise = null;
@@ -102,7 +102,7 @@ async function getRouter() {
     }
     cachedRouter = adaptCompositeRouter(createCompositeRouter(adapters));
     try {
-      const { createCliCircuitBreakerIntegration } = await import("./cli-circuit-breaker-QZLD2EOM.js");
+      const { createCliCircuitBreakerIntegration } = await import("./cli-circuit-breaker-BDQFZL7E.js");
       cachedCircuitBreaker = createCliCircuitBreakerIntegration([...adapters.values()]);
     } catch (error) {
       const msg = error instanceof Error ? error.message : String(error);
@@ -213,4 +213,4 @@ export {
   tokenSplitFromUsage,
   executeExpert
 };
-//# sourceMappingURL=chunk-7QY3RIIY.js.map
+//# sourceMappingURL=chunk-GLDK3R2H.js.map

package/dist/{chunk-F6HORFHH.js → chunk-GTCZLDKW.js}

@@ -1,6 +1,6 @@
 import {
   getErrorMessage
-} from "./chunk-AZPM542H.js";
+} from "./chunk-VKBFV6OD.js";
 
 // src/cli/setup-config.ts
 import { copyFileSync, existsSync, mkdirSync, writeFileSync } from "node:fs";
@@ -77,4 +77,4 @@ function ensureBackup(outputPath) {
 export {
   runConfigInitSync
 };
-//# sourceMappingURL=chunk-F6HORFHH.js.map
+//# sourceMappingURL=chunk-GTCZLDKW.js.map

package/dist/{chunk-TRV4NNEE.js → chunk-HBCY7CEH.js}

@@ -1,7 +1,7 @@
 import {
   computeCostDetail,
   priceBasisOf
-} from "./chunk-TE6UUPOA.js";
+} from "./chunk-PJKJF6FQ.js";
 import {
   allOf
 } from "./chunk-OQB3XC5O.js";
@@ -23,26 +23,26 @@ import {
   toolSuccessStructured,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-2SINF73A.js";
+} from "./chunk-A7GKD65R.js";
 import {
   VERSION
-} from "./chunk-LO36HW55.js";
+} from "./chunk-OUEZ4AMS.js";
 import {
   assessPanelIndependence,
   countDistinctModels,
   createEvent,
   getGlobalRegistry
-} from "./chunk-QOKB6MWY.js";
+} from "./chunk-6GKP2RLC.js";
 import {
   getToolMemory
-} from "./chunk-RBNJYWQ6.js";
+} from "./chunk-F6LB2JEI.js";
 import {
   authRemediation,
   delay,
   getAvailableClis,
   sleep,
   withTimeout
-} from "./chunk-SBCEQWUN.js";
+} from "./chunk-GFW5IMOF.js";
 import {
   AgentError,
   CLI_NAMES,
@@ -58,6 +58,7 @@ import {
   err,
   formatPercentage,
   formatZodError,
+  formatZodIssueWithRoot,
   getErrorMessage,
   getMcpSafeDeadlineMs,
   getOutcomeStore,
@@ -70,7 +71,7 @@ import {
   registerPersistentOutcomeStoreFactory,
   resolveClassGuardMs,
   resolveVoteTimeout
-} from "./chunk-AZPM542H.js";
+} from "./chunk-VKBFV6OD.js";
 import {
   ensureLearningDir,
   getOutcomesFile
@@ -5155,6 +5156,25 @@ function applyErrorPolicy(votes, policy) {
 import { appendFileSync as appendFileSync2, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2 } from "node:fs";
 import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
 
+// src/audit/ledger-append.ts
+var UNREADABLE_RECORD_PREFIX = "refusing to persist an unreadable";
+function serializeValidatedRecord(schema, record, ledgerName) {
+  const parsed = schema.safeParse(record);
+  if (!parsed.success) {
+    const paths = parsed.error.issues.map(formatZodIssueWithRoot).join("; ");
+    throw new Error(`${UNREADABLE_RECORD_PREFIX} ${ledgerName} record: ${paths}`);
+  }
+  const line = JSON.stringify(record);
+  const roundTrip = schema.safeParse(JSON.parse(line));
+  if (!roundTrip.success) {
+    const paths = roundTrip.error.issues.map(formatZodIssueWithRoot).join("; ");
+    throw new Error(
+      `${UNREADABLE_RECORD_PREFIX} ${ledgerName} record: JSON round-trip changed it \u2014 ${paths}`
+    );
+  }
+  return line + "\n";
+}
+
 // src/audit/vote-record.ts
 import * as crypto from "node:crypto";
 import { z as z7 } from "zod";
@@ -5421,7 +5441,13 @@ var VOTE_RECORDS_FILENAME = "vote-records.jsonl";
 var VOTE_RECORDS_PATH_ENV = "NEXUS_VOTE_RECORDS_PATH";
 var MAX_PROPOSAL_RECORD_CHARS = 500;
 function voteRecordWriteFailedMessage(path2) {
-  return `Authentic vote record NOT persisted: the resolved data directory is not writable (${path2}). Check filesystem permissions on the .nexus-agents data dir, or set ${VOTE_RECORDS_PATH_ENV} to a writable absolute file path. See server logs for the underlying filesystem error.`;
+  return (
+    // #6054: `undefined` from the store now has TWO causes — an unwritable path,
+    // or a record the read schema would reject (refused before it became
+    // durable). This text reaches the MCP caller, so it must not assert the
+    // filesystem cause it cannot distinguish; the server log names which.
+    `Authentic vote record NOT persisted (${path2}). Either the resolved data directory is not writable, or the record was refused because the read schema would reject it. The server log line "Failed to persist authentic vote record" carries the cause \u2014 a filesystem error, or the offending field. For the path case, check permissions on the .nexus-agents data dir or set ${VOTE_RECORDS_PATH_ENV} to a writable absolute file path.`
+  );
 }
 function outcomeToDecision(result, votes, errorVoided) {
   const errorCount = votes.filter((v) => v.source === "error").length;
@@ -5592,7 +5618,7 @@ function persistVoteRecord(opts) {
       sequence: maxSequence + 1,
       previousHash: lastHash
     });
-    appendFileSync2(filePath, JSON.stringify(record) + "\n", "utf-8");
+    appendFileSync2(filePath, serializeValidatedRecord(VoteRecordSchema, record, "vote"), "utf-8");
     logger11.info("Persisted authentic vote record", {
       id: record.id,
       decision: record.decision,
@@ -7310,7 +7336,7 @@ function logPartialProposal(bounded, log) {
 }
 async function runContrarianCheck(proposal, log) {
   try {
-    const { executeExpert } = await import("./expert-bridge-VKTP3RAL.js");
+    const { executeExpert } = await import("./expert-bridge-GK7M6JDD.js");
     const bounded = boundArtifactForReview(proposal, CONTRARIAN_PROPOSAL_BUDGET, "proposal");
     logPartialProposal(bounded, log);
     const result = await executeExpert("architecture", buildContrarianPrompt(bounded));
@@ -7893,6 +7919,7 @@ export {
   ConsensusVoteInputSchema,
   toRecordDecision,
   mapOutcomeToDecision,
+  serializeValidatedRecord,
   recordAuthenticVote,
   recordDecisionCost,
   checkSimulationAllowed,
@@ -7908,4 +7935,4 @@ export {
   CONSENSUS_VOTE_TOOL_SCHEMA,
   registerConsensusVoteTool
 };
-//# sourceMappingURL=chunk-TRV4NNEE.js.map
+//# sourceMappingURL=chunk-HBCY7CEH.js.map