nexus-agents 8.48.0 → 8.48.2

package/dist/{ast-rule-runner-74D2KNCC.js → ast-rule-runner-SUEOULTY.js}

@@ -9,8 +9,8 @@ import {
   getBuiltInAstRulesPath,
   loadRules,
   runAstQaRules
-} from "./chunk-KRPSDJOP.js";
-import "./chunk-AZPM542H.js";
+} from "./chunk-NEKNNWPU.js";
+import "./chunk-VKBFV6OD.js";
 import "./chunk-MTYJPPIG.js";
 import "./chunk-BTYRPZON.js";
 import "./chunk-ZPWHCABL.js";
@@ -26,4 +26,4 @@ export {
   loadRules,
   runAstQaRules
 };
-//# sourceMappingURL=ast-rule-runner-74D2KNCC.js.map
+//# sourceMappingURL=ast-rule-runner-SUEOULTY.js.map

package/dist/{child-mcp-config-KTR6MPNZ.js → child-mcp-config-Y3GST6L4.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-T46RV7Y7.js";
 import {
   createLogger
-} from "./chunk-AZPM542H.js";
+} from "./chunk-VKBFV6OD.js";
 import "./chunk-MTYJPPIG.js";
 import "./chunk-BTYRPZON.js";
 import "./chunk-ZPWHCABL.js";
@@ -60,4 +60,4 @@ export {
   generateMcpConfig,
   getDefaultAllowedTools
 };
-//# sourceMappingURL=child-mcp-config-KTR6MPNZ.js.map
+//# sourceMappingURL=child-mcp-config-Y3GST6L4.js.map

package/dist/{chunk-7XT6WVSB.js → chunk-2CB4RKGK.js}

@@ -4,7 +4,7 @@ import {
   getErrorMessage,
   getTimeProvider,
   ok
-} from "./chunk-AZPM542H.js";
+} from "./chunk-VKBFV6OD.js";
 
 // src/context/session-memory.ts
 import * as fs from "node:fs";
@@ -370,4 +370,4 @@ export {
   SessionMemory,
   createSessionMemory
 };
-//# sourceMappingURL=chunk-7XT6WVSB.js.map
+//# sourceMappingURL=chunk-2CB4RKGK.js.map

package/dist/{chunk-LO36HW55.js → chunk-2EH4T5I6.js}

@@ -1,6 +1,6 @@
 // src/version.ts
 import semver from "semver";
-var VERSION = true ? "8.48.0" : "dev";
+var VERSION = true ? "8.48.2" : "dev";
 var NODE_ENGINE_RANGE = ">=22.5.0";
 function isNodeVersionSupported(version) {
   return semver.satisfies(version, NODE_ENGINE_RANGE);
@@ -11,4 +11,4 @@ export {
   NODE_ENGINE_RANGE,
   isNodeVersionSupported
 };
-//# sourceMappingURL=chunk-LO36HW55.js.map
+//# sourceMappingURL=chunk-2EH4T5I6.js.map

package/dist/{chunk-7I3LY4HJ.js → chunk-4Y5TFSYP.js}

@@ -2,7 +2,7 @@ import {
   CACHE_TIMEOUTS,
   createLogger,
   getTimeProvider
-} from "./chunk-AZPM542H.js";
+} from "./chunk-VKBFV6OD.js";
 
 // src/security/trust-types.ts
 import { z } from "zod";
@@ -610,4 +610,4 @@ export {
   resolveReputationGatingMode,
   gateWithReputation
 };
-//# sourceMappingURL=chunk-7I3LY4HJ.js.map
+//# sourceMappingURL=chunk-4Y5TFSYP.js.map

package/dist/{chunk-DVBGHGU3.js → chunk-53EL53NC.js}

@@ -2,7 +2,7 @@ import {
   createLogger,
   err,
   ok
-} from "./chunk-AZPM542H.js";
+} from "./chunk-VKBFV6OD.js";
 
 // src/scm/token-resolver.ts
 import { execFile } from "node:child_process";
@@ -87,4 +87,4 @@ export {
   hasToken,
   getTokenEnvVars
 };
-//# sourceMappingURL=chunk-DVBGHGU3.js.map
+//# sourceMappingURL=chunk-53EL53NC.js.map

package/dist/{chunk-2SINF73A.js → chunk-5IB64MNO.js}

@@ -1,9 +1,9 @@
 import {
   VERSION
-} from "./chunk-LO36HW55.js";
+} from "./chunk-2EH4T5I6.js";
 import {
   emitClawGuardViolation
-} from "./chunk-JOVBHYWW.js";
+} from "./chunk-MOVW4ZFU.js";
 import {
   CACHE_TIMEOUTS,
   MCP_TIMEOUTS,
@@ -19,7 +19,7 @@ import {
   getTimeProvider,
   ok,
   resolveToolClassGuardMs
-} from "./chunk-AZPM542H.js";
+} from "./chunk-VKBFV6OD.js";
 import {
   getNexusDataDir
 } from "./chunk-BTYRPZON.js";
@@ -2360,4 +2360,4 @@ export {
   VOTING_THRESHOLDS,
   ConsensusMetricsSchema
 };
-//# sourceMappingURL=chunk-2SINF73A.js.map
+//# sourceMappingURL=chunk-5IB64MNO.js.map

package/dist/{chunk-CJ5FEUI2.js → chunk-6AX4544S.js}

@@ -10,13 +10,13 @@ import {
 import {
   assessReputation,
   sanitizeInput
-} from "./chunk-7I3LY4HJ.js";
+} from "./chunk-4Y5TFSYP.js";
 import {
   createLogger,
   err,
   getTimeProvider,
   ok
-} from "./chunk-AZPM542H.js";
+} from "./chunk-VKBFV6OD.js";
 
 // src/dogfooding/pr-reviewer-helpers.ts
 import { randomUUID } from "node:crypto";
@@ -416,4 +416,4 @@ export {
   createFailedReview,
   reviewPostingBlock
 };
-//# sourceMappingURL=chunk-CJ5FEUI2.js.map
+//# sourceMappingURL=chunk-6AX4544S.js.map

package/dist/{chunk-QOKB6MWY.js → chunk-6GKP2RLC.js}

@@ -1,10 +1,10 @@
 import {
   createAutoAdapter
-} from "./chunk-SBCEQWUN.js";
+} from "./chunk-GFW5IMOF.js";
 import {
   getDefaultCliCircuitBreakerRegistry,
   mapModelErrorToCategory
-} from "./chunk-DF6M73XJ.js";
+} from "./chunk-N56KU4KM.js";
 import {
   CLI_NAMES,
   CircularBuffer,
@@ -24,7 +24,7 @@ import {
   recordRateLimitEvent,
   resolveModelIdentitySync,
   toRateLimitError
-} from "./chunk-AZPM542H.js";
+} from "./chunk-VKBFV6OD.js";
 
 // src/config/model-equivalence.ts
 function canonicalModelKey(modelId) {
@@ -909,4 +909,4 @@ export {
   getGlobalRegistry,
   resetGlobalRegistry
 };
-//# sourceMappingURL=chunk-QOKB6MWY.js.map
+//# sourceMappingURL=chunk-6GKP2RLC.js.map

package/dist/{chunk-7YHOHQJR.js → chunk-A4WAADEC.js}

@@ -1,17 +1,17 @@
 import {
   computeCostDetail,
   recordUsageEvent
-} from "./chunk-TE6UUPOA.js";
+} from "./chunk-PJKJF6FQ.js";
 import {
   BaseAdapter,
   createStream,
   planOptionalParams,
   requireApiKey,
   validateApiKeyPresence
-} from "./chunk-R247RR7W.js";
+} from "./chunk-YLTUPAKL.js";
 import {
   assertCustomApiHostResolvesPublic
-} from "./chunk-YPU4OHBU.js";
+} from "./chunk-VDBBLFZR.js";
 import {
   ConfigError,
   ModelCapability,
@@ -22,7 +22,7 @@ import {
   getTimeProvider,
   getTokenEstimator,
   ok
-} from "./chunk-AZPM542H.js";
+} from "./chunk-VKBFV6OD.js";
 
 // src/adapters/openai-types.ts
 var OPENAI_MODELS = {
@@ -842,4 +842,4 @@ export {
   discoverModels,
   buildOpenAICompatAdapters
 };
-//# sourceMappingURL=chunk-7YHOHQJR.js.map
+//# sourceMappingURL=chunk-A4WAADEC.js.map

package/dist/{chunk-X7EXIH67.js → chunk-CE6OZA5X.js}

@@ -1,14 +1,14 @@
 import {
   GitHubProvider,
   ScmError
-} from "./chunk-5ONSIV4D.js";
+} from "./chunk-RCTVIHUT.js";
 import {
   resolveToken
-} from "./chunk-DVBGHGU3.js";
+} from "./chunk-53EL53NC.js";
 import {
   err,
   ok
-} from "./chunk-AZPM542H.js";
+} from "./chunk-VKBFV6OD.js";
 
 // src/scm/factory.ts
 async function createScmProvider(config) {
@@ -41,4 +41,4 @@ export {
   createScmProvider,
   createGitHubProvider
 };
-//# sourceMappingURL=chunk-X7EXIH67.js.map
+//# sourceMappingURL=chunk-CE6OZA5X.js.map

package/dist/{chunk-TRV4NNEE.js → chunk-DTUJCA6M.js}

@@ -1,7 +1,7 @@
 import {
   computeCostDetail,
   priceBasisOf
-} from "./chunk-TE6UUPOA.js";
+} from "./chunk-PJKJF6FQ.js";
 import {
   allOf
 } from "./chunk-OQB3XC5O.js";
@@ -23,26 +23,26 @@ import {
   toolSuccessStructured,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-2SINF73A.js";
+} from "./chunk-5IB64MNO.js";
 import {
   VERSION
-} from "./chunk-LO36HW55.js";
+} from "./chunk-2EH4T5I6.js";
 import {
   assessPanelIndependence,
   countDistinctModels,
   createEvent,
   getGlobalRegistry
-} from "./chunk-QOKB6MWY.js";
+} from "./chunk-6GKP2RLC.js";
 import {
   getToolMemory
-} from "./chunk-RBNJYWQ6.js";
+} from "./chunk-F6LB2JEI.js";
 import {
   authRemediation,
   delay,
   getAvailableClis,
   sleep,
   withTimeout
-} from "./chunk-SBCEQWUN.js";
+} from "./chunk-GFW5IMOF.js";
 import {
   AgentError,
   CLI_NAMES,
@@ -58,6 +58,7 @@ import {
   err,
   formatPercentage,
   formatZodError,
+  formatZodIssueWithRoot,
   getErrorMessage,
   getMcpSafeDeadlineMs,
   getOutcomeStore,
@@ -70,7 +71,7 @@ import {
   registerPersistentOutcomeStoreFactory,
   resolveClassGuardMs,
   resolveVoteTimeout
-} from "./chunk-AZPM542H.js";
+} from "./chunk-VKBFV6OD.js";
 import {
   ensureLearningDir,
   getOutcomesFile
@@ -5155,6 +5156,25 @@ function applyErrorPolicy(votes, policy) {
 import { appendFileSync as appendFileSync2, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2 } from "node:fs";
 import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
 
+// src/audit/ledger-append.ts
+var UNREADABLE_RECORD_PREFIX = "refusing to persist an unreadable";
+function serializeValidatedRecord(schema, record, ledgerName) {
+  const parsed = schema.safeParse(record);
+  if (!parsed.success) {
+    const paths = parsed.error.issues.map(formatZodIssueWithRoot).join("; ");
+    throw new Error(`${UNREADABLE_RECORD_PREFIX} ${ledgerName} record: ${paths}`);
+  }
+  const line = JSON.stringify(record);
+  const roundTrip = schema.safeParse(JSON.parse(line));
+  if (!roundTrip.success) {
+    const paths = roundTrip.error.issues.map(formatZodIssueWithRoot).join("; ");
+    throw new Error(
+      `${UNREADABLE_RECORD_PREFIX} ${ledgerName} record: JSON round-trip changed it \u2014 ${paths}`
+    );
+  }
+  return line + "\n";
+}
+
 // src/audit/vote-record.ts
 import * as crypto from "node:crypto";
 import { z as z7 } from "zod";
@@ -5226,6 +5246,21 @@ var VoterSummarySchema = z7.object({
    */
   retried: z7.literal(true).optional()
 }).strict();
+var VOTER_SUMMARY_KEYS = [
+  "role",
+  "decision",
+  "confidence",
+  "reasoning",
+  "reasoningTruncated",
+  "retried"
+];
+function projectVoterSummary(v) {
+  const out = {};
+  for (const key of VOTER_SUMMARY_KEYS) {
+    if (v[key] !== void 0) out[key] = v[key];
+  }
+  return out;
+}
 var VoteRecordCountsSchema = z7.object({
   approve: z7.number().int().nonnegative(),
   reject: z7.number().int().nonnegative(),
@@ -5394,18 +5429,7 @@ function computeVoteRecordHash(payload) {
     // fields: a pre-1.6 voter entry re-hashes byte-identical, so every
     // historical record still verifies, while editing or removing a stored
     // reasoning flips the hash.
-    voters: payload.voters.map((v) => ({
-      role: v.role,
-      decision: v.decision,
-      confidence: v.confidence,
-      ...v.reasoning !== void 0 ? { reasoning: v.reasoning } : {},
-      ...v.reasoningTruncated === true ? { reasoningTruncated: true } : {},
-      // #6050: hash-covered on the same append-when-present rule. Omitting it
-      // here would let a retried seat be edited to a clean one without moving
-      // the hash -- attesting to a claim about panel quality the chain does not
-      // actually cover.
-      ...v.retried === true ? { retried: true } : {}
-    })),
+    voters: payload.voters.map(projectVoterSummary),
     correlationId: payload.correlationId ?? null
   };
   const canonical = JSON.stringify(foldOptionalFields(base, payload));
@@ -5421,7 +5445,13 @@ var VOTE_RECORDS_FILENAME = "vote-records.jsonl";
 var VOTE_RECORDS_PATH_ENV = "NEXUS_VOTE_RECORDS_PATH";
 var MAX_PROPOSAL_RECORD_CHARS = 500;
 function voteRecordWriteFailedMessage(path2) {
-  return `Authentic vote record NOT persisted: the resolved data directory is not writable (${path2}). Check filesystem permissions on the .nexus-agents data dir, or set ${VOTE_RECORDS_PATH_ENV} to a writable absolute file path. See server logs for the underlying filesystem error.`;
+  return (
+    // #6054: `undefined` from the store now has TWO causes — an unwritable path,
+    // or a record the read schema would reject (refused before it became
+    // durable). This text reaches the MCP caller, so it must not assert the
+    // filesystem cause it cannot distinguish; the server log names which.
+    `Authentic vote record NOT persisted (${path2}). Either the resolved data directory is not writable, or the record was refused because the read schema would reject it. The server log line "Failed to persist authentic vote record" carries the cause \u2014 a filesystem error, or the offending field. For the path case, check permissions on the .nexus-agents data dir or set ${VOTE_RECORDS_PATH_ENV} to a writable absolute file path.`
+  );
 }
 function outcomeToDecision(result, votes, errorVoided) {
   const errorCount = votes.filter((v) => v.source === "error").length;
@@ -5592,7 +5622,7 @@ function persistVoteRecord(opts) {
       sequence: maxSequence + 1,
       previousHash: lastHash
     });
-    appendFileSync2(filePath, JSON.stringify(record) + "\n", "utf-8");
+    appendFileSync2(filePath, serializeValidatedRecord(VoteRecordSchema, record, "vote"), "utf-8");
     logger11.info("Persisted authentic vote record", {
       id: record.id,
       decision: record.decision,
@@ -7310,7 +7340,7 @@ function logPartialProposal(bounded, log) {
 }
 async function runContrarianCheck(proposal, log) {
   try {
-    const { executeExpert } = await import("./expert-bridge-VKTP3RAL.js");
+    const { executeExpert } = await import("./expert-bridge-GK7M6JDD.js");
     const bounded = boundArtifactForReview(proposal, CONTRARIAN_PROPOSAL_BUDGET, "proposal");
     logPartialProposal(bounded, log);
     const result = await executeExpert("architecture", buildContrarianPrompt(bounded));
@@ -7893,6 +7923,7 @@ export {
   ConsensusVoteInputSchema,
   toRecordDecision,
   mapOutcomeToDecision,
+  serializeValidatedRecord,
   recordAuthenticVote,
   recordDecisionCost,
   checkSimulationAllowed,
@@ -7908,4 +7939,4 @@ export {
   CONSENSUS_VOTE_TOOL_SCHEMA,
   registerConsensusVoteTool
 };
-//# sourceMappingURL=chunk-TRV4NNEE.js.map
+//# sourceMappingURL=chunk-DTUJCA6M.js.map