nexus-agents 8.55.8 → 8.56.0

package/dist/{chunk-WL336Y4R.js → chunk-5W55WXLY.js}

@@ -7,7 +7,7 @@ import {
   toolStructuredError,
   toolSuccessStructured,
   wrapToolWithTimeout
-} from "./chunk-MUSPT4J4.js";
+} from "./chunk-BWP3RTR2.js";
 import {
   JsonlStore,
   SECURITY_KEYWORDS,
@@ -2278,4 +2278,4 @@ export {
   runImprovementReview,
   registerImprovementReviewTool
 };
-//# sourceMappingURL=chunk-WL336Y4R.js.map
+//# sourceMappingURL=chunk-5W55WXLY.js.map

package/dist/{chunk-MUSPT4J4.js → chunk-BWP3RTR2.js}

@@ -1,6 +1,6 @@
 import {
   VERSION
-} from "./chunk-ZBZSSNRB.js";
+} from "./chunk-UURJGJTW.js";
 import {
   emitClawGuardViolation
 } from "./chunk-VZSMNIRN.js";
@@ -2378,4 +2378,4 @@ export {
   DEFAULT_CONSENSUS_CONFIG,
   ConsensusMetricsSchema
 };
-//# sourceMappingURL=chunk-MUSPT4J4.js.map
+//# sourceMappingURL=chunk-BWP3RTR2.js.map

package/dist/{chunk-DZHGR5UO.js → chunk-HXITPFTR.js}

@@ -21,7 +21,7 @@ import {
 import {
   DEFAULT_TASK_TTL_MS,
   clampTaskTtl
-} from "./chunk-IEF3YTEH.js";
+} from "./chunk-M2ZQXDSO.js";
 import {
   executeExpert
 } from "./chunk-QMGMD6JB.js";
@@ -62,7 +62,7 @@ import {
   toJobSummary,
   updateStage,
   writeJobCancelled
-} from "./chunk-4XRGCSFR.js";
+} from "./chunk-MO6FSEFJ.js";
 import {
   allOf,
   anyOf
@@ -82,7 +82,7 @@ import {
 } from "./chunk-RNWUIQTZ.js";
 import {
   withPrerequisite
-} from "./chunk-WL336Y4R.js";
+} from "./chunk-5W55WXLY.js";
 import {
   NOOP_NOTIFIER,
   RateLimiter,
@@ -107,7 +107,7 @@ import {
   withAuditTrail,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-MUSPT4J4.js";
+} from "./chunk-BWP3RTR2.js";
 import {
   createAuditTrail,
   createGraphAuditBridge,
@@ -46182,7 +46182,7 @@ function buildVotingInput(plan, config) {
 }
 async function executeSingleVote(plan, config, log) {
   try {
-    const { executeVoting } = await import("./consensus-vote-CJKMBM47.js");
+    const { executeVoting } = await import("./consensus-vote-JHCRRDH5.js");
     const input = buildVotingInput(plan, config);
     const result = await executeVoting(input, log);
     return parseVotingResult(result);
@@ -47980,7 +47980,7 @@ ${contextBlock}`;
       const strategy = config.votingStrategy ?? "higher_order";
       await postProgress(config, "Vote", `Running consensus with ${strategy} strategy...`);
       try {
-        const { executeVoting } = await import("./consensus-vote-CJKMBM47.js");
+        const { executeVoting } = await import("./consensus-vote-JHCRRDH5.js");
         const votingResult = await executeVoting(
           {
             proposal: buildVoteProposal(plan, research),
@@ -57179,4 +57179,4 @@ export {
   startPipelineEventBridge,
   shutdownPipelineEventBridge
 };
-//# sourceMappingURL=chunk-DZHGR5UO.js.map
+//# sourceMappingURL=chunk-HXITPFTR.js.map

package/dist/{chunk-IEF3YTEH.js → chunk-M2ZQXDSO.js}

@@ -11,7 +11,7 @@ import {
   NODE_ENGINE_RANGE,
   VERSION,
   isNodeVersionSupported
-} from "./chunk-ZBZSSNRB.js";
+} from "./chunk-UURJGJTW.js";
 import {
   claimGlobalRegistry
 } from "./chunk-BXP5K5TU.js";
@@ -1314,7 +1314,7 @@ async function runDoctorFix(result) {
   writeLine2("\u2500".repeat(40));
   let fixCount = 0;
   if (!result.dataDirectory.rootExists || result.dataDirectory.subdirectories.some((d) => !d.exists || !d.writable)) {
-    const { initDataDirectories: initDataDirectories2, describeDataDirFix: describeDataDirFix2 } = await import("./setup-data-dir-YKEJYHAI.js");
+    const { initDataDirectories: initDataDirectories2, describeDataDirFix: describeDataDirFix2 } = await import("./setup-data-dir-RXY2PWDX.js");
     const outcome = describeDataDirFix2(initDataDirectories2());
     writeLine2(outcome.line);
     if (outcome.counted) fixCount++;
@@ -1416,4 +1416,4 @@ export {
   startStdioServer,
   closeServer
 };
-//# sourceMappingURL=chunk-IEF3YTEH.js.map
+//# sourceMappingURL=chunk-M2ZQXDSO.js.map

package/dist/{chunk-4XRGCSFR.js → chunk-MO6FSEFJ.js}

@@ -25,10 +25,10 @@ import {
   toolSuccessStructured,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-MUSPT4J4.js";
+} from "./chunk-BWP3RTR2.js";
 import {
   VERSION
-} from "./chunk-ZBZSSNRB.js";
+} from "./chunk-UURJGJTW.js";
 import {
   UNRESOLVED_MODEL_ID,
   assessPanelIndependence,
@@ -6765,31 +6765,164 @@ function warnOnce(toolName, logger11) {
 }
 
 // src/mcp/jobs/job-result-store.ts
-import { existsSync as existsSync4, readFileSync as readFileSync5, readdirSync, writeFileSync as writeFileSync3, chmodSync } from "node:fs";
+import {
+  existsSync as existsSync5,
+  readFileSync as readFileSync6,
+  readdirSync,
+  unlinkSync as unlinkSync2,
+  writeFileSync as writeFileSync4,
+  chmodSync
+} from "node:fs";
+import { z as z10 } from "zod";
+
+// src/mcp/jobs/job-idempotency.ts
+import { createHash as createHash2, randomUUID } from "node:crypto";
+import { existsSync as existsSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "node:fs";
 import { z as z9 } from "zod";
-var logger7 = createLogger({ component: "job-result-store" });
-var JobStatusSchema = z9.enum(["pending", "complete", "failed", "cancelled"]);
-var JobResultSchema = z9.object({
-  /** Format version. Currently `1` — bump if the shape changes. */
+var logger7 = createLogger({ component: "job-idempotency" });
+var IdempotencyIndexEntrySchema = z9.object({
   v: z9.literal(1),
+  /** MCP tool name (e.g. `orchestrate`, `run_workflow`, `consensus_vote`). */
+  tool: z9.string().min(1),
+  /** Caller-supplied idempotency key. */
+  key: z9.string().min(1),
+  /** sha256 of the canonical input JSON. */
+  inputsHash: z9.string().length(64),
+  /** Existing jobId for this (tool, key, inputs) tuple. */
   jobId: z9.string().min(1),
+  /** ISO timestamp of first dispatch. */
+  createdAt: z9.iso.datetime()
+});
+function sha256Hex(input) {
+  return createHash2("sha256").update(input).digest("hex");
+}
+function canonicalJsonStringify(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(canonicalJsonStringify).join(",")}]`;
+  const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+  return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalJsonStringify(v)}`).join(",")}}`;
+}
+function computeInputsHash(inputs) {
+  return sha256Hex(canonicalJsonStringify(inputs));
+}
+function indexFilePath(tool, key) {
+  const filename = `key-${sha256Hex(`${tool}:${key}`)}.json`;
+  return nexusDataPathEnsure("jobs", filename);
+}
+function indexFilePathReadOnly(tool, key) {
+  const filename = `key-${sha256Hex(`${tool}:${key}`)}.json`;
+  return nexusDataPath("jobs", filename);
+}
+function resolveIdempotency(tool, idempotencyKey, inputs, randomFallback = randomUUID) {
+  if (idempotencyKey === void 0 || idempotencyKey === "") {
+    return { kind: "fresh", jobId: randomFallback() };
+  }
+  const incomingInputsHash = computeInputsHash(inputs);
+  const path2 = indexFilePathReadOnly(tool, idempotencyKey);
+  if (existsSync4(path2)) {
+    const entry = readIndexEntry(path2);
+    if (entry !== null) {
+      if (entry.inputsHash === incomingInputsHash) {
+        return { kind: "replay", jobId: entry.jobId, entry };
+      }
+      return {
+        kind: "collision",
+        existingInputsHash: entry.inputsHash,
+        incomingInputsHash,
+        existingJobId: entry.jobId
+      };
+    }
+    logger7.warn("Idempotency index file unreadable; treating as fresh dispatch", { tool, path: path2 });
+  }
+  const jobId = `job-${tool}-${sha256Hex(`${tool}:${idempotencyKey}:${incomingInputsHash}`).slice(0, 16)}`;
+  return { kind: "fresh", jobId };
+}
+function registerIdempotentJob(params) {
+  const path2 = indexFilePath(params.tool, params.idempotencyKey);
+  if (existsSync4(path2)) {
+    logger7.debug("Idempotency index entry already present; skipping write", {
+      tool: params.tool,
+      jobId: params.jobId
+    });
+    return;
+  }
+  const entry = {
+    v: 1,
+    tool: params.tool,
+    key: params.idempotencyKey,
+    inputsHash: computeInputsHash(params.inputs),
+    jobId: params.jobId,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  writeFileSync3(path2, JSON.stringify(entry, null, 2));
+  logger7.debug("Wrote idempotency index entry", { tool: params.tool, jobId: params.jobId });
+}
+function shortCircuitOrFreshJobId(params) {
+  const r = resolveIdempotency(
+    params.tool,
+    params.idempotencyKey,
+    params.inputs,
+    params.freshJobId
+  );
+  if (r.kind === "collision") {
+    return { kind: "shortCircuit", value: params.collisionEnvelope(r.existingJobId) };
+  }
+  if (r.kind === "replay") {
+    return { kind: "shortCircuit", value: params.replayEnvelope(r.jobId) };
+  }
+  return { kind: "continue", jobId: r.jobId };
+}
+function readIndexEntry(path2) {
+  try {
+    const raw = JSON.parse(readFileSync5(path2, "utf-8"));
+    const parsed = IdempotencyIndexEntrySchema.safeParse(raw);
+    if (!parsed.success) {
+      logger7.warn("Idempotency index file failed schema check", { path: path2 });
+      return null;
+    }
+    return parsed.data;
+  } catch (err2) {
+    logger7.warn("Idempotency index file read failed", {
+      path: path2,
+      error: err2 instanceof Error ? err2.message : String(err2)
+    });
+    return null;
+  }
+}
+
+// src/mcp/jobs/job-result-store.ts
+var logger8 = createLogger({ component: "job-result-store" });
+var JobStatusSchema = z10.enum(["pending", "complete", "failed", "cancelled"]);
+var JobResultSchema = z10.object({
+  /** Format version. Currently `1` — bump if the shape changes. */
+  v: z10.literal(1),
+  jobId: z10.string().min(1),
   /** Tool that was invoked (e.g. `orchestrate`). */
-  toolName: z9.string().min(1),
+  toolName: z10.string().min(1),
   status: JobStatusSchema,
-  createdAt: z9.iso.datetime(),
+  createdAt: z10.iso.datetime(),
   /** Set when the job leaves `pending` — either via `complete` or `failed` or `cancelled`. */
-  completedAt: z9.iso.datetime().optional(),
+  completedAt: z10.iso.datetime().optional(),
   /**
    * Structured payload the synchronous mode would have returned. Present
    * only when `status === 'complete'`. Shape is tool-specific — readers
    * cast to the tool's known output type after status check.
    */
-  result: z9.unknown().optional(),
+  result: z10.unknown().optional(),
   /**
    * Failure message when `status === 'failed'`. Cannot be paired with
    * `result` — the discriminator is `status`.
    */
-  error: z9.string().optional(),
+  error: z10.string().optional(),
+  /**
+   * Machine-readable reason for a `failed` record that was NOT settled by the
+   * process that ran the job (#6224). `abandoned` is written only by
+   * {@link pruneJobRecords}: the record was `pending` past the runaway guard
+   * (so no live process could still own it) AND past the retention window, and
+   * the sweep rewrote it rather than deleting it. Absent on every record the
+   * job's own process wrote — `error` alone carries those failures.
+   */
+  errorKind: z10.literal("abandoned").optional(),
   /**
    * Whether the tool's `run` callback accepts `runAsJob`'s `AbortSignal`
    * (#4972).
@@ -6805,7 +6938,7 @@ var JobResultSchema = z9.object({
    * "cancellation can reach this tool", not "the work stopped". Absent means
    * the writer did not report it, which is not the same as `false`.
    */
-  signalAccepted: z9.boolean().optional(),
+  signalAccepted: z10.boolean().optional(),
   /**
    * `VERSION` of the nexus-agents process that WROTE this record (#5008) —
    * i.e. the build that ran the job, not the build that reads it back.
@@ -6826,28 +6959,36 @@ var JobResultSchema = z9.object({
    * `'dev'` — readers MUST run it through {@link isMeasuredBuildVersion}
    * before treating two stamps as comparable.
    */
-  producerVersion: z9.string().optional()
+  producerVersion: z10.string().optional()
 });
 var UNMEASURED_BUILD_VERSION = "dev";
 function isMeasuredBuildVersion(version) {
   return version !== void 0 && version !== "" && version !== UNMEASURED_BUILD_VERSION;
 }
+var ASYNC_JOB_BODY_CLASS = "async-job-body";
+var ABANDONED_TERMINAL_WRITE_SLACK_MS = 3e4;
 function isAbandonedJob(record, nowMs) {
+  return isAbandonedAt(record, nowMs, abandonedAfterMs());
+}
+function abandonedAfterMs() {
+  return resolveClassGuardMs(ASYNC_JOB_BODY_CLASS) + ABANDONED_TERMINAL_WRITE_SLACK_MS;
+}
+function isAbandonedAt(record, nowMs, abandonedAfter) {
   if (record.status !== "pending") return false;
   const startedMs = Date.parse(record.createdAt);
-  return nowMs - startedMs > OPERATION_CLASSES["async-job-body"].guardMs;
+  return nowMs - startedMs > abandonedAfter;
 }
 function jobResultPath(jobId) {
   return nexusDataPathEnsure("jobs", `result-${jobId}.json`);
 }
 function persistJobRecord(path2, record) {
-  writeFileSync3(path2, JSON.stringify(record, null, 2), { mode: 384 });
+  writeFileSync4(path2, JSON.stringify(record, null, 2), { mode: 384 });
   chmodSync(path2, 384);
 }
 function writeJobPending(jobId, toolName, signalAccepted, producerVersion = VERSION) {
   const path2 = jobResultPath(jobId);
-  if (existsSync4(path2)) {
-    logger7.debug("Job result file already exists \u2014 leaving in place", { jobId });
+  if (existsSync5(path2)) {
+    logger8.debug("Job result file already exists \u2014 leaving in place", { jobId });
     return;
   }
   const record = {
@@ -6860,12 +7001,12 @@ function writeJobPending(jobId, toolName, signalAccepted, producerVersion = VERS
     producerVersion
   };
   persistJobRecord(path2, record);
-  logger7.debug("Wrote pending job record", { jobId, toolName, signalAccepted });
+  logger8.debug("Wrote pending job record", { jobId, toolName, signalAccepted });
 }
 function writeJobComplete(jobId, toolName, result, producerVersion = VERSION) {
   const existing = readJobResult(jobId);
   if (existing?.status === "cancelled") {
-    logger7.debug("Skipping complete write \u2014 job already cancelled (preserving cancellation)", {
+    logger8.debug("Skipping complete write \u2014 job already cancelled (preserving cancellation)", {
       jobId,
       toolName
     });
@@ -6882,12 +7023,12 @@ function writeJobComplete(jobId, toolName, result, producerVersion = VERSION) {
     producerVersion
   };
   persistJobRecord(jobResultPath(jobId), record);
-  logger7.debug("Wrote complete job record", { jobId, toolName });
+  logger8.debug("Wrote complete job record", { jobId, toolName });
 }
 function writeJobFailed(jobId, toolName, error, producerVersion = VERSION) {
   const existing = readJobResult(jobId);
   if (existing?.status === "cancelled") {
-    logger7.debug("Skipping failed write \u2014 job already cancelled (preserving cancellation)", {
+    logger8.debug("Skipping failed write \u2014 job already cancelled (preserving cancellation)", {
       jobId,
       toolName
     });
@@ -6904,7 +7045,7 @@ function writeJobFailed(jobId, toolName, error, producerVersion = VERSION) {
     producerVersion
   };
   persistJobRecord(jobResultPath(jobId), record);
-  logger7.debug("Wrote failed job record", { jobId, toolName, error });
+  logger8.debug("Wrote failed job record", { jobId, toolName, error });
 }
 function writeJobCancelled(jobId, toolName, reason, producerVersion = VERSION) {
   const record = {
@@ -6918,21 +7059,21 @@ function writeJobCancelled(jobId, toolName, reason, producerVersion = VERSION) {
     producerVersion
   };
   persistJobRecord(jobResultPath(jobId), record);
-  logger7.debug("Wrote cancelled job record", { jobId, toolName, reason });
+  logger8.debug("Wrote cancelled job record", { jobId, toolName, reason });
 }
 function readJobResult(jobId) {
   const path2 = nexusDataPath("jobs", `result-${jobId}.json`);
-  if (!existsSync4(path2)) return null;
+  if (!existsSync5(path2)) return null;
   try {
-    const raw = JSON.parse(readFileSync5(path2, "utf-8"));
+    const raw = JSON.parse(readFileSync6(path2, "utf-8"));
     const parsed = JobResultSchema.safeParse(raw);
     if (!parsed.success) {
-      logger7.warn("Job result file failed schema check", { jobId, path: path2 });
+      logger8.warn("Job result file failed schema check", { jobId, path: path2 });
       return null;
     }
     return parsed.data;
   } catch (err2) {
-    logger7.warn("Job result file unreadable", {
+    logger8.warn("Job result file unreadable", {
       jobId,
       path: path2,
       error: err2 instanceof Error ? err2.message : String(err2)
@@ -6952,14 +7093,14 @@ function toJobSummary(record) {
 }
 function listJobsWithDiagnostics() {
   const dir = nexusDataPath("jobs");
-  if (!existsSync4(dir)) {
+  if (!existsSync5(dir)) {
     return { jobs: [], diagnostics: { dirUnreadable: false, unparseableRecords: 0 } };
   }
   let entries;
   try {
     entries = readdirSync(dir);
   } catch (err2) {
-    logger7.warn("jobs directory unreadable", {
+    logger8.warn("jobs directory unreadable", {
       dir,
       error: err2 instanceof Error ? err2.message : String(err2)
     });
@@ -6984,6 +7125,94 @@ function listJobsWithDiagnostics() {
     diagnostics: { dirUnreadable: false, unparseableRecords }
   };
 }
+var JOB_RECORD_RETENTION_MS = 7 * 24 * 60 * 60 * 1e3;
+var JOB_PRUNE_SWEEP_INTERVAL_MS = 36e5;
+function pruneJobRecords(options) {
+  const dir = nexusDataPath("jobs");
+  if (!existsSync5(dir)) {
+    return { deleted: 0, markedAbandoned: 0, kept: 0, unreadable: 0, deletedKeys: 0 };
+  }
+  const entries = readdirSync(dir);
+  const sweep = {
+    nowMs: options.nowMs,
+    retentionMs: options.retentionMs,
+    dryRun: options.dryRun === true,
+    abandonedAfter: abandonedAfterMs()
+  };
+  const counts = { deleted: 0, markedAbandoned: 0, kept: 0, unreadable: 0, deletedKeys: 0 };
+  const removedJobIds = /* @__PURE__ */ new Set();
+  const keyEntries = entries.filter((entry) => /^key-.+\.json$/.test(entry));
+  for (const entry of entries) {
+    const jobId = /^result-(.+)\.json$/.exec(entry)?.[1];
+    if (jobId === void 0) continue;
+    const verdict = sweepRecord(jobId, entry, sweep);
+    counts[verdict] += 1;
+    if (verdict === "deleted") removedJobIds.add(jobId);
+  }
+  for (const entry of keyEntries) {
+    const verdict = sweepKeyEntry(entry, removedJobIds, sweep);
+    if (verdict !== null) counts[verdict] += 1;
+  }
+  logger8.debug("Job record sweep", { dir, ...counts, dryRun: sweep.dryRun });
+  return counts;
+}
+function sweepRecord(jobId, entry, sweep) {
+  const record = readJobResult(jobId);
+  if (record === null) return "unreadable";
+  const path2 = nexusDataPath("jobs", entry);
+  if (record.status === "pending") {
+    const pastGuard = isAbandonedAt(record, sweep.nowMs, sweep.abandonedAfter);
+    const pastWindow = isOlderThan(record.createdAt, sweep.nowMs, sweep.retentionMs);
+    if (!(pastGuard && pastWindow)) return "kept";
+    if (!sweep.dryRun) persistJobRecord(path2, abandonedRecord(record, sweep.nowMs));
+    return "markedAbandoned";
+  }
+  const settledAt = record.completedAt ?? record.createdAt;
+  if (!isOlderThan(settledAt, sweep.nowMs, sweep.retentionMs)) return "kept";
+  if (!sweep.dryRun) unlinkSync2(path2);
+  return "deleted";
+}
+function sweepKeyEntry(entry, removedJobIds, sweep) {
+  const path2 = nexusDataPath("jobs", entry);
+  const indexEntry = readIndexEntry(path2);
+  if (indexEntry === null) return "unreadable";
+  if (!isOlderThan(indexEntry.createdAt, sweep.nowMs, sweep.retentionMs)) return null;
+  const recordGone = removedJobIds.has(indexEntry.jobId) || !existsSync5(nexusDataPath("jobs", `result-${indexEntry.jobId}.json`));
+  if (!recordGone) return null;
+  if (!sweep.dryRun) unlinkSync2(path2);
+  return "deletedKeys";
+}
+function isOlderThan(isoTimestamp, nowMs, windowMs) {
+  return nowMs - Date.parse(isoTimestamp) > windowMs;
+}
+function abandonedRecord(record, nowMs) {
+  const producer = record.producerVersion ?? "unrecorded";
+  return {
+    ...record,
+    status: "failed",
+    completedAt: new Date(nowMs).toISOString(),
+    error: `abandoned: pending since ${record.createdAt} under producer ${producer}; no process settled it within the runaway guard, and the retention sweep marked it failed rather than deleting the evidence`,
+    errorKind: "abandoned",
+    producerVersion: VERSION
+  };
+}
+var lastSweepAtMsByDir = /* @__PURE__ */ new Map();
+function pruneJobRecordsIfDue(nowMs) {
+  const dir = nexusDataPath("jobs");
+  const lastSweepAtMs = lastSweepAtMsByDir.get(dir);
+  if (lastSweepAtMs !== void 0 && nowMs - lastSweepAtMs < JOB_PRUNE_SWEEP_INTERVAL_MS) {
+    return null;
+  }
+  lastSweepAtMsByDir.set(dir, nowMs);
+  try {
+    return pruneJobRecords({ nowMs, retentionMs: JOB_RECORD_RETENTION_MS });
+  } catch (err2) {
+    logger8.warn("Job record sweep failed", {
+      error: err2 instanceof Error ? err2.message : String(err2)
+    });
+    return null;
+  }
+}
 
 // src/mcp/jobs/job-abort-registry.ts
 var controllers = /* @__PURE__ */ new Map();
@@ -7003,121 +7232,6 @@ function unregisterJobAbort(jobId) {
   controllers.delete(jobId);
 }
 
-// src/mcp/jobs/job-idempotency.ts
-import { createHash as createHash2, randomUUID } from "node:crypto";
-import { existsSync as existsSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "node:fs";
-import { z as z10 } from "zod";
-var logger8 = createLogger({ component: "job-idempotency" });
-var IdempotencyIndexEntrySchema = z10.object({
-  v: z10.literal(1),
-  /** MCP tool name (e.g. `orchestrate`, `run_workflow`, `consensus_vote`). */
-  tool: z10.string().min(1),
-  /** Caller-supplied idempotency key. */
-  key: z10.string().min(1),
-  /** sha256 of the canonical input JSON. */
-  inputsHash: z10.string().length(64),
-  /** Existing jobId for this (tool, key, inputs) tuple. */
-  jobId: z10.string().min(1),
-  /** ISO timestamp of first dispatch. */
-  createdAt: z10.iso.datetime()
-});
-function sha256Hex(input) {
-  return createHash2("sha256").update(input).digest("hex");
-}
-function canonicalJsonStringify(value) {
-  if (value === null || typeof value !== "object") return JSON.stringify(value);
-  if (Array.isArray(value)) return `[${value.map(canonicalJsonStringify).join(",")}]`;
-  const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
-  return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalJsonStringify(v)}`).join(",")}}`;
-}
-function computeInputsHash(inputs) {
-  return sha256Hex(canonicalJsonStringify(inputs));
-}
-function indexFilePath(tool, key) {
-  const filename = `key-${sha256Hex(`${tool}:${key}`)}.json`;
-  return nexusDataPathEnsure("jobs", filename);
-}
-function indexFilePathReadOnly(tool, key) {
-  const filename = `key-${sha256Hex(`${tool}:${key}`)}.json`;
-  return nexusDataPath("jobs", filename);
-}
-function resolveIdempotency(tool, idempotencyKey, inputs, randomFallback = randomUUID) {
-  if (idempotencyKey === void 0 || idempotencyKey === "") {
-    return { kind: "fresh", jobId: randomFallback() };
-  }
-  const incomingInputsHash = computeInputsHash(inputs);
-  const path2 = indexFilePathReadOnly(tool, idempotencyKey);
-  if (existsSync5(path2)) {
-    const entry = readIndexEntry(path2);
-    if (entry !== null) {
-      if (entry.inputsHash === incomingInputsHash) {
-        return { kind: "replay", jobId: entry.jobId, entry };
-      }
-      return {
-        kind: "collision",
-        existingInputsHash: entry.inputsHash,
-        incomingInputsHash,
-        existingJobId: entry.jobId
-      };
-    }
-    logger8.warn("Idempotency index file unreadable; treating as fresh dispatch", { tool, path: path2 });
-  }
-  const jobId = `job-${tool}-${sha256Hex(`${tool}:${idempotencyKey}:${incomingInputsHash}`).slice(0, 16)}`;
-  return { kind: "fresh", jobId };
-}
-function registerIdempotentJob(params) {
-  const path2 = indexFilePath(params.tool, params.idempotencyKey);
-  if (existsSync5(path2)) {
-    logger8.debug("Idempotency index entry already present; skipping write", {
-      tool: params.tool,
-      jobId: params.jobId
-    });
-    return;
-  }
-  const entry = {
-    v: 1,
-    tool: params.tool,
-    key: params.idempotencyKey,
-    inputsHash: computeInputsHash(params.inputs),
-    jobId: params.jobId,
-    createdAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  writeFileSync4(path2, JSON.stringify(entry, null, 2));
-  logger8.debug("Wrote idempotency index entry", { tool: params.tool, jobId: params.jobId });
-}
-function shortCircuitOrFreshJobId(params) {
-  const r = resolveIdempotency(
-    params.tool,
-    params.idempotencyKey,
-    params.inputs,
-    params.freshJobId
-  );
-  if (r.kind === "collision") {
-    return { kind: "shortCircuit", value: params.collisionEnvelope(r.existingJobId) };
-  }
-  if (r.kind === "replay") {
-    return { kind: "shortCircuit", value: params.replayEnvelope(r.jobId) };
-  }
-  return { kind: "continue", jobId: r.jobId };
-}
-function readIndexEntry(path2) {
-  try {
-    const raw = JSON.parse(readFileSync6(path2, "utf-8"));
-    const parsed = IdempotencyIndexEntrySchema.safeParse(raw);
-    if (!parsed.success) {
-      logger8.warn("Idempotency index file failed schema check", { path: path2 });
-      return null;
-    }
-    return parsed.data;
-  } catch (err2) {
-    logger8.warn("Idempotency index file read failed", {
-      path: path2,
-      error: err2 instanceof Error ? err2.message : String(err2)
-    });
-    return null;
-  }
-}
-
 // src/mcp/jobs/job-concurrency.ts
 var logger9 = createLogger({ component: "job-concurrency" });
 var DEFAULT_JOB_CAPS = {
@@ -7793,6 +7907,7 @@ function runAsJob(params) {
     return env.busy(suggestRetryAfterMs(params.toolName), params.toolName);
   }
   const jobId = idempotency.jobId;
+  pruneJobRecordsIfDue(getTimeProvider().now());
   writeJobPending(jobId, params.toolName, params.run.length >= 3, params.producerVersion);
   if (params.idempotencyKey !== void 0 && params.idempotencyKey !== "") {
     registerIdempotentJob({
@@ -8532,6 +8647,8 @@ function registerConsensusVoteTool(server, deps) {
 
 export {
   VOTER_ROLES,
+  resolveIdempotency,
+  registerIdempotentJob,
   JobStatusSchema,
   isMeasuredBuildVersion,
   isAbandonedJob,
@@ -8539,9 +8656,9 @@ export {
   readJobResult,
   toJobSummary,
   listJobsWithDiagnostics,
+  JOB_RECORD_RETENTION_MS,
+  pruneJobRecords,
   abortJob,
-  resolveIdempotency,
-  registerIdempotentJob,
   listTaskStateIds,
   initTaskState,
   appendBlocker,
@@ -8630,4 +8747,4 @@ export {
   CONSENSUS_VOTE_TOOL_SCHEMA,
   registerConsensusVoteTool
 };
-//# sourceMappingURL=chunk-4XRGCSFR.js.map
+//# sourceMappingURL=chunk-MO6FSEFJ.js.map