nexus-agents 8.7.1 → 8.8.1

package/dist/{ast-rule-runner-EX3ZL4BZ.js → ast-rule-runner-WANOR3MX.js}

@@ -9,10 +9,10 @@ import {
   getBuiltInAstRulesPath,
   loadRules,
   runAstQaRules
-} from "./chunk-JWWNTXSI.js";
-import "./chunk-HCN3FRNG.js";
-import "./chunk-ITCKXMOH.js";
-import "./chunk-MM223CVS.js";
+} from "./chunk-3XQK4MEF.js";
+import "./chunk-ERL3XHQO.js";
+import "./chunk-7WJGV5DN.js";
+import "./chunk-J7QCZRVK.js";
 import "./chunk-ZPWHCABL.js";
 export {
   AST_RULE_LANGUAGES,
@@ -26,4 +26,4 @@ export {
   loadRules,
   runAstQaRules
 };
-//# sourceMappingURL=ast-rule-runner-EX3ZL4BZ.js.map
+//# sourceMappingURL=ast-rule-runner-WANOR3MX.js.map

package/dist/{child-mcp-config-25OKN6ZQ.js → child-mcp-config-N4HLLCEH.js}

@@ -1,11 +1,11 @@
 import {
   nexusMkdtemp
-} from "./chunk-4HXPNLZS.js";
+} from "./chunk-DKHBIJO4.js";
 import {
   createLogger
-} from "./chunk-HCN3FRNG.js";
-import "./chunk-ITCKXMOH.js";
-import "./chunk-MM223CVS.js";
+} from "./chunk-ERL3XHQO.js";
+import "./chunk-7WJGV5DN.js";
+import "./chunk-J7QCZRVK.js";
 import "./chunk-ZPWHCABL.js";
 
 // src/cli-adapters/child-mcp-config.ts
@@ -62,4 +62,4 @@ export {
   generateMcpConfig,
   getDefaultAllowedTools
 };
-//# sourceMappingURL=child-mcp-config-25OKN6ZQ.js.map
+//# sourceMappingURL=child-mcp-config-N4HLLCEH.js.map

package/dist/{chunk-CDZ7OWH6.js → chunk-276GRITW.js}

@@ -1,10 +1,10 @@
 import {
   createAutoAdapter
-} from "./chunk-YOEB6RVH.js";
+} from "./chunk-7QQ5F7T5.js";
 import {
   getDefaultCliCircuitBreakerRegistry,
   mapModelErrorToCategory
-} from "./chunk-AQZSXWPJ.js";
+} from "./chunk-VADACTVB.js";
 import {
   CLI_NAMES,
   CircularBuffer,
@@ -24,7 +24,7 @@ import {
   recordRateLimitEvent,
   resolveModelIdentitySync,
   toRateLimitError
-} from "./chunk-HCN3FRNG.js";
+} from "./chunk-ERL3XHQO.js";
 
 // src/config/model-equivalence.ts
 function canonicalModelKey(modelId) {
@@ -904,4 +904,4 @@ export {
   getGlobalRegistry,
   resetGlobalRegistry
 };
-//# sourceMappingURL=chunk-CDZ7OWH6.js.map
+//# sourceMappingURL=chunk-276GRITW.js.map

package/dist/{chunk-CVXYAPJB.js → chunk-3CLKYFE3.js}

@@ -1,15 +1,22 @@
 import {
   ParseError,
   SecurityError,
+  createLogger,
   err,
   getErrorMessage,
   ok,
   parseBoolEnv
-} from "./chunk-HCN3FRNG.js";
+} from "./chunk-ERL3XHQO.js";
+import {
+  findRepoRoot,
+  getActiveWorkspaceRoot,
+  isRepoRoot
+} from "./chunk-J7QCZRVK.js";
 
 // src/cli/research-helpers-io.ts
 import * as fs2 from "node:fs/promises";
-import { join, resolve as resolve3 } from "node:path";
+import { realpathSync, statSync } from "node:fs";
+import { dirname as dirname2, join, resolve as resolve3 } from "node:path";
 
 // src/security/safe-path.ts
 import { resolve, sep } from "node:path";
@@ -84,8 +91,67 @@ async function ensureRegistryFile(rootDir, filename) {
 var REGISTRY_PATH = "docs/research/registry";
 var TECHNIQUES_FILE = "techniques.yaml";
 var PAPERS_FILE = "papers.yaml";
+var logger = createLogger({ component: "research-registry-root" });
+var registryRootByOrigin = /* @__PURE__ */ new Map();
+var warnedCwdFallback = false;
+function hasRegistryDir(dir) {
+  try {
+    return statSync(join(dir, REGISTRY_PATH)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function findRegistryAncestor(start) {
+  let current;
+  let startDev;
+  try {
+    current = realpathSync(start);
+    startDev = statSync(current).dev;
+  } catch {
+    return null;
+  }
+  for (let depth = 0; depth < 64; depth++) {
+    if (hasRegistryDir(current)) return current;
+    if (isRepoRoot(current)) return null;
+    const parent = dirname2(current);
+    if (parent === current) return null;
+    try {
+      if (statSync(parent).dev !== startDev) return null;
+    } catch {
+      return null;
+    }
+    current = parent;
+  }
+  return null;
+}
+function resolveRegistryRoot(rootDir) {
+  if (rootDir !== void 0) return resolve3(rootDir);
+  const origin = getActiveWorkspaceRoot() ?? process.cwd();
+  const memoised = registryRootByOrigin.get(origin);
+  if (memoised !== void 0) return memoised;
+  const discovered = findRegistryAncestor(origin) ?? findRepoRoot(origin);
+  if (discovered !== null) {
+    registryRootByOrigin.set(origin, discovered);
+    return discovered;
+  }
+  let fallback;
+  try {
+    fallback = realpathSync(origin);
+  } catch {
+    fallback = resolve3(origin);
+  }
+  if (!warnedCwdFallback) {
+    warnedCwdFallback = true;
+    logger.warn(
+      "No research registry or git repo found above the working directory; using cwd as the research registry root",
+      { cwd: fallback, registryPath: REGISTRY_PATH }
+    );
+  }
+  registryRootByOrigin.set(origin, fallback);
+  return fallback;
+}
 function getProjectRoot() {
-  return process.cwd();
+  return resolveRegistryRoot();
 }
 function validatePath(constructedPath, allowedRoot) {
   const resolved = resolveInsideRoot(constructedPath, allowedRoot);
@@ -100,7 +166,7 @@ function validatePath(constructedPath, allowedRoot) {
   return { ok: true, value: resolved };
 }
 async function loadTechniquesRegistry(rootDir) {
-  const root = rootDir ?? process.cwd();
+  const root = resolveRegistryRoot(rootDir);
   const filePath = join(root, REGISTRY_PATH, TECHNIQUES_FILE);
   const pathValidation = validatePath(filePath, root);
   if (!pathValidation.ok) {
@@ -116,7 +182,7 @@ async function loadTechniquesRegistry(rootDir) {
   }
 }
 async function loadPapersRegistry(rootDir) {
-  const root = rootDir ?? process.cwd();
+  const root = resolveRegistryRoot(rootDir);
   const filePath = join(root, REGISTRY_PATH, PAPERS_FILE);
   const pathValidation = validatePath(filePath, root);
   if (!pathValidation.ok) {
@@ -132,7 +198,7 @@ async function loadPapersRegistry(rootDir) {
   }
 }
 async function savePapersRegistry(registry, rootDir) {
-  const root = rootDir ?? process.cwd();
+  const root = resolveRegistryRoot(rootDir);
   const filePath = join(root, REGISTRY_PATH, PAPERS_FILE);
   const pathValidation = validatePath(filePath, root);
   if (!pathValidation.ok) {
@@ -151,9 +217,10 @@ async function savePapersRegistry(registry, rootDir) {
 export {
   resolveInsideRoot,
   REGISTRY_PATH,
+  resolveRegistryRoot,
   getProjectRoot,
   loadTechniquesRegistry,
   loadPapersRegistry,
   savePapersRegistry
 };
-//# sourceMappingURL=chunk-CVXYAPJB.js.map
+//# sourceMappingURL=chunk-3CLKYFE3.js.map

package/dist/chunk-3CLKYFE3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/research-helpers-io.ts","../src/security/safe-path.ts","../src/cli/research-scaffold.ts"],"sourcesContent":["/**\n * Research Registry I/O Operations\n *\n * File operations for loading and saving research registry YAML files.\n * Includes path traversal protection per Issue #353.\n *\n * @see docs/research/RESEARCH_INDEX.md\n * @see Issue #237 (Epic #225)\n * @see Issue #353 (Security - Path traversal fix)\n * @see Issue #5053 (Registry root resolution — workspace/repo root, not cwd)\n */\n\nimport * as fs from 'node:fs/promises';\nimport { realpathSync, statSync } from 'node:fs';\nimport { dirname, join, resolve } from 'node:path';\nimport { resolveInsideRoot } from '../security/safe-path.js';\nimport { parse as parseYaml, stringify as stringifyYaml } from 'yaml';\nimport type { Result } from '../core/index.js';\nimport { SecurityError, createLogger, getErrorMessage } from '../core/index.js';\nimport { getActiveWorkspaceRoot } from '../config/nexus-data-dir.js';\nimport { findRepoRoot, isRepoRoot } from '../config/repo-root-detection.js';\nimport { ParseError } from '../core/types/workflow.js';\nimport type { TechniquesRegistry, PapersRegistry } from './research-types.js';\nimport { ensureRegistryFile } from './research-scaffold.js';\n\n// =============================================================================\n// CONSTANTS\n// =============================================================================\n\n/** Path to research registry directory relative to project root */\nexport const REGISTRY_PATH = 'docs/research/registry';\n\n/** Filename for techniques registry */\nexport const TECHNIQUES_FILE = 'techniques.yaml';\n\n/** Filename for papers registry */\nexport const PAPERS_FILE = 'papers.yaml';\n\n// =============================================================================\n// PROJECT ROOT\n// =============================================================================\n\nconst logger = createLogger({ component: 'research-registry-root' });\n\n/**\n * Per-process memo of discovered registry roots (#5053), keyed on the origin\n * the walk started from (the active workspace root, else cwd). The MCP server\n * fetches its client's `roots` asynchronously after `initialized`, so a\n * `research_*` call can land before — or a `roots/list_changed` after — the\n * workspace root is known; keying on the origin means a changed origin\n * resolves afresh instead of inheriting the first caller's cwd-derived root.\n */\nconst registryRootByOrigin = new Map<string, string>();\n/** The cwd-fallback warning fires once per process overall, not per origin. */\nlet warnedCwdFallback = false;\n\n// @export-no-consumer-yet — see #5053. Test-only reset hook for the per-origin\n// memo and the one-shot cwd warning, the same shape as the data-dir module's\n// `_reset*ForTests` helpers; no production consumer is intended.\n/** Test helper — clears the registry-root memo and the one-shot warning. */\nexport function _resetRegistryRootForTests(): void {\n  registryRootByOrigin.clear();\n  warnedCwdFallback = false;\n}\n\n/** True iff `<dir>/docs/research/registry` exists as a directory. */\nfunction hasRegistryDir(dir: string): boolean {\n  try {\n    return statSync(join(dir, REGISTRY_PATH)).isDirectory();\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Walks upward from `start` looking for the nearest ancestor (inclusive) that\n * already contains `docs/research/registry`, searching only within the\n * enclosing git repo: the walk ends at the first directory that `isRepoRoot`\n * (after checking that directory itself), so a nested checkout never adopts —\n * or writes into — an outer repo's registry. Mirrors `findRepoRoot`'s other\n * defenses: bounded depth, stops at the filesystem root, and refuses to cross\n * a mount point so a sandboxed workdir cannot pick up a host-side registry.\n */\nfunction findRegistryAncestor(start: string): string | null {\n  let current: string;\n  let startDev: number;\n  try {\n    current = realpathSync(start);\n    startDev = statSync(current).dev;\n  } catch {\n    return null;\n  }\n  for (let depth = 0; depth < 64; depth++) {\n    if (hasRegistryDir(current)) return current;\n    if (isRepoRoot(current)) return null;\n    const parent = dirname(current);\n    if (parent === current) return null;\n    try {\n      if (statSync(parent).dev !== startDev) return null;\n    } catch {\n      return null;\n    }\n    current = parent;\n  }\n  return null;\n}\n\n/**\n * Resolves the directory that owns `docs/research/registry` (#5053).\n *\n * Resolution order:\n *  1. An explicit `rootDir` argument wins outright (resolved, never memoised).\n *  2. The nearest ancestor of the active workspace root (MCP `roots`, #3991)\n *     — or of `process.cwd()` when none is set — that already contains\n *     `docs/research/registry`, without crossing a repo boundary: the search\n *     stops at the enclosing repo root, so a nested checkout never resolves\n *     to an outer repo's registry.\n *  3. Otherwise the enclosing git repo root via `findRepoRoot`, so the\n *     first-run scaffold (#2470) lands at the repo root rather than below it.\n *  4. Otherwise cwd, with a warning emitted once per process: nothing above\n *     cwd identifies a project, so cwd is a guess rather than a discovery.\n *\n * Steps 2–4 are memoised per origin (workspace root or cwd), so a workspace\n * root that arrives after the first call — MCP roots are fetched after\n * `initialized` — is honoured rather than shadowed by an earlier cwd-derived\n * result. Before this resolver every helper defaulted to cwd, so a server\n * started inside `packages/nexus-agents` read (and scaffolded) a shadow\n * registry there instead of the repo's.\n */\nexport function resolveRegistryRoot(rootDir?: string): string {\n  if (rootDir !== undefined) return resolve(rootDir);\n\n  const origin = getActiveWorkspaceRoot() ?? process.cwd();\n  const memoised = registryRootByOrigin.get(origin);\n  if (memoised !== undefined) return memoised;\n\n  const discovered = findRegistryAncestor(origin) ?? findRepoRoot(origin);\n  if (discovered !== null) {\n    registryRootByOrigin.set(origin, discovered);\n    return discovered;\n  }\n\n  let fallback: string;\n  try {\n    fallback = realpathSync(origin);\n  } catch {\n    fallback = resolve(origin);\n  }\n  if (!warnedCwdFallback) {\n    warnedCwdFallback = true;\n    logger.warn(\n      'No research registry or git repo found above the working directory; using cwd as the research registry root',\n      { cwd: fallback, registryPath: REGISTRY_PATH }\n    );\n  }\n  registryRootByOrigin.set(origin, fallback);\n  return fallback;\n}\n\n/**\n * Get the project root directory that owns the research registry.\n * Delegates to {@link resolveRegistryRoot} — no longer bare `process.cwd()`.\n */\nexport function getProjectRoot(): string {\n  return resolveRegistryRoot();\n}\n\n// =============================================================================\n// PATH VALIDATION\n// =============================================================================\n\n/**\n * Validates that a constructed path stays within the allowed root directory.\n * Prevents path traversal attacks (e.g., ../../../etc/passwd).\n *\n * @param constructedPath - The full path to validate\n * @param allowedRoot - The root directory that paths must be within\n * @returns Result with validated absolute path or SecurityError\n */\nfunction validatePath(constructedPath: string, allowedRoot: string): Result<string, SecurityError> {\n  const resolved = resolveInsideRoot(constructedPath, allowedRoot);\n  if (resolved === null) {\n    return {\n      ok: false,\n      error: new SecurityError('Path traversal detected: path escapes allowed root directory', {\n        context: { constructedPath, allowedRoot: resolve(allowedRoot) },\n      }),\n    };\n  }\n  return { ok: true, value: resolved };\n}\n\n// =============================================================================\n// LOAD OPERATIONS\n// =============================================================================\n\n/**\n * Load techniques registry from YAML file.\n * Validates path to prevent directory traversal attacks.\n *\n * @param rootDir - Project root directory (defaults to the resolved registry root, see {@link resolveRegistryRoot})\n * @returns Result with TechniquesRegistry or SecurityError/ParseError\n */\nexport async function loadTechniquesRegistry(\n  rootDir?: string\n): Promise<Result<TechniquesRegistry, SecurityError | ParseError>> {\n  const root = resolveRegistryRoot(rootDir);\n  const filePath = join(root, REGISTRY_PATH, TECHNIQUES_FILE);\n\n  const pathValidation = validatePath(filePath, root);\n  if (!pathValidation.ok) {\n    return pathValidation;\n  }\n\n  // #2470: try to scaffold an empty techniques.yaml on first run so research_*\n  // workflows don't error on a fresh install. No-op when file exists.\n  // When scaffold refuses (e.g. <rootDir>/docs/ doesn't exist, or\n  // NEXUS_NO_SCAFFOLD=1), fall through and let readFile produce the original\n  // ENOENT error — that's the existing contract.\n  await ensureRegistryFile(root, TECHNIQUES_FILE);\n\n  try {\n    const content = await fs.readFile(pathValidation.value, 'utf-8');\n    return { ok: true, value: parseYaml(content) as TechniquesRegistry };\n  } catch (error) {\n    const message = getErrorMessage(error);\n    return { ok: false, error: new ParseError(`Failed to load techniques registry: ${message}`) };\n  }\n}\n\n/**\n * Load papers registry from YAML file.\n * Validates path to prevent directory traversal attacks.\n *\n * @param rootDir - Project root directory (defaults to the resolved registry root, see {@link resolveRegistryRoot})\n * @returns Result with PapersRegistry or SecurityError/ParseError\n */\nexport async function loadPapersRegistry(\n  rootDir?: string\n): Promise<Result<PapersRegistry, SecurityError | ParseError>> {\n  const root = resolveRegistryRoot(rootDir);\n  const filePath = join(root, REGISTRY_PATH, PAPERS_FILE);\n\n  const pathValidation = validatePath(filePath, root);\n  if (!pathValidation.ok) {\n    return pathValidation;\n  }\n\n  // #2470: try to scaffold an empty papers.yaml on first run so research_*\n  // workflows don't error on a fresh install. No-op when file exists; falls\n  // through silently when scaffold refuses (no docs/ root, or NEXUS_NO_SCAFFOLD).\n  await ensureRegistryFile(root, PAPERS_FILE);\n\n  try {\n    const content = await fs.readFile(pathValidation.value, 'utf-8');\n    return { ok: true, value: parseYaml(content) as PapersRegistry };\n  } catch (error) {\n    const message = getErrorMessage(error);\n    return { ok: false, error: new ParseError(`Failed to load papers registry: ${message}`) };\n  }\n}\n\n// =============================================================================\n// SAVE OPERATIONS\n// =============================================================================\n\n/**\n * Save techniques registry to YAML file.\n * Validates path to prevent directory traversal attacks.\n *\n * @param registry - The techniques registry to save\n * @param rootDir - Project root directory (defaults to the resolved registry root, see {@link resolveRegistryRoot})\n * @returns Result with void on success or SecurityError/ParseError on failure\n */\nexport async function saveTechniquesRegistry(\n  registry: TechniquesRegistry,\n  rootDir?: string\n): Promise<Result<void, SecurityError | ParseError>> {\n  const root = resolveRegistryRoot(rootDir);\n  const filePath = join(root, REGISTRY_PATH, TECHNIQUES_FILE);\n\n  const pathValidation = validatePath(filePath, root);\n  if (!pathValidation.ok) {\n    return pathValidation;\n  }\n\n  try {\n    const content = stringifyYaml(registry, { lineWidth: 100 });\n    await fs.writeFile(pathValidation.value, content, 'utf-8');\n    return { ok: true, value: undefined };\n  } catch (error) {\n    const message = getErrorMessage(error);\n    return { ok: false, error: new ParseError(`Failed to save techniques registry: ${message}`) };\n  }\n}\n\n/**\n * Save papers registry to YAML file.\n * Validates path to prevent directory traversal attacks.\n *\n * @param registry - The papers registry to save\n * @param rootDir - Project root directory (defaults to the resolved registry root, see {@link resolveRegistryRoot})\n * @returns Result with void on success or SecurityError/ParseError on failure\n */\nexport async function savePapersRegistry(\n  registry: PapersRegistry,\n  rootDir?: string\n): Promise<Result<void, SecurityError | ParseError>> {\n  const root = resolveRegistryRoot(rootDir);\n  const filePath = join(root, REGISTRY_PATH, PAPERS_FILE);\n\n  const pathValidation = validatePath(filePath, root);\n  if (!pathValidation.ok) {\n    return pathValidation;\n  }\n\n  try {\n    const content = stringifyYaml(registry, { lineWidth: 100 });\n    await fs.writeFile(pathValidation.value, content, 'utf-8');\n    return { ok: true, value: undefined };\n  } catch (error) {\n    const message = getErrorMessage(error);\n    return { ok: false, error: new ParseError(`Failed to save papers registry: ${message}`) };\n  }\n}\n","/**\n * Safe Path — Path traversal guards for scanner-controlled inputs (#1813, #1814)\n *\n * When reading files whose path comes from untrusted input (e.g., SARIF\n * scanner output), we must verify the resolved path stays within the\n * workspace root. Without this, a malicious scanner can cause arbitrary\n * file reads whose contents are exfiltrated via downstream LLM prompts\n * (CWE-22).\n *\n * Shared helper to prevent the finding-triage/fix-generator drift that\n * required two separate fixes.\n *\n * @module security/safe-path\n */\n\nimport { resolve, sep } from 'node:path';\n\n/**\n * Resolve a scanner-supplied path against the workspace root, returning null\n * if it escapes. Null means the caller must fall back to a safe alternative\n * (e.g., scanner-provided snippet) rather than reading the file.\n *\n * @param filePath - Scanner-supplied path (may be relative or absolute)\n * @param root - Workspace root (defaults to process.cwd())\n * @returns Resolved absolute path if inside root, null otherwise\n */\nexport function resolveInsideRoot(filePath: string, root: string = process.cwd()): string | null {\n  const resolvedRoot = resolve(root);\n  const resolved = resolve(resolvedRoot, filePath);\n  if (resolved === resolvedRoot) return resolved;\n  if (resolved.startsWith(resolvedRoot + sep)) return resolved;\n  return null;\n}\n","/**\n * research-scaffold — auto-create empty research registry files when missing.\n *\n * On a fresh install or in a sandboxed environment where the project doesn't\n * have `docs/research/registry/`, the research workflows previously errored\n * with `Failed to load papers registry: ENOENT`. The user has no idea what\n * to do.\n *\n * This module provides `ensureResearchRegistry()`: idempotent scaffolding\n * that creates empty YAML registries on ENOENT, announces what it did to\n * stderr (so the operator knows), and returns the path that's now safe to\n * read.\n *\n * Source: Issue #2470 (epic #2467 child).\n */\n\nimport * as fs from 'node:fs/promises';\nimport { existsSync } from 'node:fs';\nimport { dirname, resolve } from 'node:path';\nimport { stringify as stringifyYaml } from 'yaml';\n\nimport type { Result } from '../core/index.js';\nimport { ok, err, getErrorMessage } from '../core/index.js';\nimport { ParseError } from '../core/types/workflow.js';\n\nimport {\n  REGISTRY_PATH,\n  PAPERS_FILE,\n  TECHNIQUES_FILE,\n  resolveRegistryRoot,\n} from './research-helpers-io.js';\nimport { parseBoolEnv } from '../config/defaults-env.js';\n\n/**\n * Names of the registry files this scaffolder knows how to create.\n * `sources.yaml` and `alignments.yaml` live alongside but are populated by\n * different code paths; this scaffolder only owns the two YAML registries\n * that block `research_query` / `research_synthesize` on a fresh install.\n */\ntype ScaffoldedFile = typeof PAPERS_FILE | typeof TECHNIQUES_FILE;\n\nconst SCHEMA_VERSION = '1.0';\n\nconst ANNOUNCED = new Set<string>();\n\nfunction announceOnce(path: string, kind: ScaffoldedFile): void {\n  // De-dupe so that running multiple research commands in one session\n  // produces one announcement per scaffolded file, not per call.\n  if (ANNOUNCED.has(path)) return;\n  ANNOUNCED.add(path);\n  process.stderr.write(\n    `[scaffold] Created empty ${kind} at ${path}; add entries via 'nexus-agents research add' or research_add MCP tool.\\n`\n  );\n}\n\n/**\n * Operator opt-out. When set, scaffolding errors loudly with an actionable\n * message instead of silently writing files. Useful for CI and for\n * environments that want strict \"fail when state is wrong\" semantics.\n */\nfunction scaffoldDisabled(): boolean {\n  return parseBoolEnv('NEXUS_NO_SCAFFOLD', false);\n}\n\nfunction emptyPapersYaml(): string {\n  return stringifyYaml({ schema_version: SCHEMA_VERSION, papers: {} });\n}\n\nfunction emptyTechniquesYaml(): string {\n  return stringifyYaml({ schema_version: SCHEMA_VERSION, techniques: {} });\n}\n\n/**\n * Create the registry directory + an empty YAML file if either is missing.\n * Idempotent: existing files are left untouched.\n *\n * Scaffolds only when `<rootDir>/docs/` already exists. That guard keeps\n * tests, vitest's package cwd, and random scratch directories from getting\n * a `docs/research/` subtree implicitly. Operators on a real project root\n * (which always has `docs/`, either from cloning the repo or running\n * `nexus-agents init`) still get the auto-create behavior the issue asks for.\n *\n * Returns the resolved file path on success, or a ParseError when scaffolding\n * is disabled / refused (so the caller can pass the error through unchanged\n * for backwards compat with existing call sites).\n */\nexport async function ensureRegistryFile(\n  rootDir: string,\n  filename: ScaffoldedFile\n): Promise<Result<string, ParseError>> {\n  const filePath = resolve(rootDir, REGISTRY_PATH, filename);\n\n  if (existsSync(filePath)) return ok(filePath);\n\n  if (scaffoldDisabled()) {\n    return err(\n      new ParseError(\n        `Registry file missing: ${filePath}. Scaffolding disabled (NEXUS_NO_SCAFFOLD=1). Create the file manually or unset the env var.`\n      )\n    );\n  }\n\n  // Refuse to create a docs/ subtree in directories that aren't already\n  // documented project roots. The presence of `<rootDir>/docs/` is the\n  // strong signal we use.\n  if (!existsSync(resolve(rootDir, 'docs'))) {\n    return err(\n      new ParseError(\n        `Registry file missing: ${filePath}. ${rootDir}/docs/ does not exist; ` +\n          `refusing to create a Nexus subtree in a non-documented root. ` +\n          `Run 'nexus-agents init' first, or create ${rootDir}/docs/ manually.`\n      )\n    );\n  }\n\n  try {\n    await fs.mkdir(dirname(filePath), { recursive: true });\n    const content = filename === PAPERS_FILE ? emptyPapersYaml() : emptyTechniquesYaml();\n    await fs.writeFile(filePath, content, 'utf-8');\n    announceOnce(filePath, filename);\n    return ok(filePath);\n  } catch (e: unknown) {\n    return err(\n      new ParseError(\n        `Failed to scaffold ${filename} at ${filePath}: ${getErrorMessage(e)}. Set NEXUS_NO_SCAFFOLD=1 and create manually if scaffolding is unwanted.`\n      )\n    );\n  }\n}\n\n/**\n * Convenience: scaffold both papers.yaml and techniques.yaml. Used by the\n * research workflow startup paths that need both registries available.\n * Without an explicit `rootDir` the files land at the resolved registry root\n * (#5053), never at a bare cwd below it.\n */\nexport async function ensureResearchRegistry(rootDir?: string): Promise<Result<void, ParseError>> {\n  const root = resolveRegistryRoot(rootDir);\n  const papers = await ensureRegistryFile(root, PAPERS_FILE);\n  if (!papers.ok) return papers;\n  const techniques = await ensureRegistryFile(root, TECHNIQUES_FILE);\n  if (!techniques.ok) return techniques;\n  return ok(undefined);\n}\n\n/**\n * Test-only reset of the announcement de-dupe set. Production code never\n * needs this; tests do because Vitest reuses process state across files.\n */\nexport function _resetAnnouncedForTests(): void {\n  ANNOUNCED.clear();\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAYA,YAAYA,SAAQ;AACpB,SAAS,cAAc,gBAAgB;AACvC,SAAS,WAAAC,UAAS,MAAM,WAAAC,gBAAe;;;ACCvC,SAAS,SAAS,WAAW;AAWtB,SAAS,kBAAkB,UAAkB,OAAe,QAAQ,IAAI,GAAkB;AAC/F,QAAM,eAAe,QAAQ,IAAI;AACjC,QAAM,WAAW,QAAQ,cAAc,QAAQ;AAC/C,MAAI,aAAa,aAAc,QAAO;AACtC,MAAI,SAAS,WAAW,eAAe,GAAG,EAAG,QAAO;AACpD,SAAO;AACT;;;ADhBA,SAAS,SAAS,WAAW,aAAaC,sBAAqB;;;AEA/D,YAAY,QAAQ;AACpB,SAAS,kBAAkB;AAC3B,SAAS,SAAS,WAAAC,gBAAe;AACjC,SAAS,aAAa,qBAAqB;AAsB3C,IAAM,iBAAiB;AAEvB,IAAM,YAAY,oBAAI,IAAY;AAElC,SAAS,aAAa,MAAc,MAA4B;AAG9D,MAAI,UAAU,IAAI,IAAI,EAAG;AACzB,YAAU,IAAI,IAAI;AAClB,UAAQ,OAAO;AAAA,IACb,4BAA4B,IAAI,OAAO,IAAI;AAAA;AAAA,EAC7C;AACF;AAOA,SAAS,mBAA4B;AACnC,SAAO,aAAa,qBAAqB,KAAK;AAChD;AAEA,SAAS,kBAA0B;AACjC,SAAO,cAAc,EAAE,gBAAgB,gBAAgB,QAAQ,CAAC,EAAE,CAAC;AACrE;AAEA,SAAS,sBAA8B;AACrC,SAAO,cAAc,EAAE,gBAAgB,gBAAgB,YAAY,CAAC,EAAE,CAAC;AACzE;AAgBA,eAAsB,mBACpB,SACA,UACqC;AACrC,QAAM,WAAWC,SAAQ,SAAS,eAAe,QAAQ;AAEzD,MAAI,WAAW,QAAQ,EAAG,QAAO,GAAG,QAAQ;AAE5C,MAAI,iBAAiB,GAAG;AACtB,WAAO;AAAA,MACL,IAAI;AAAA,QACF,0BAA0B,QAAQ;AAAA,MACpC;AAAA,IACF;AAAA,EACF;AAKA,MAAI,CAAC,WAAWA,SAAQ,SAAS,MAAM,CAAC,GAAG;AACzC,WAAO;AAAA,MACL,IAAI;AAAA,QACF,0BAA0B,QAAQ,KAAK,OAAO,gIAEA,OAAO;AAAA,MACvD;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,UAAS,SAAM,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AACrD,UAAM,UAAU,aAAa,cAAc,gBAAgB,IAAI,oBAAoB;AACnF,UAAS,aAAU,UAAU,SAAS,OAAO;AAC7C,iBAAa,UAAU,QAAQ;AAC/B,WAAO,GAAG,QAAQ;AAAA,EACpB,SAAS,GAAY;AACnB,WAAO;AAAA,MACL,IAAI;AAAA,QACF,sBAAsB,QAAQ,OAAO,QAAQ,KAAK,gBAAgB,CAAC,CAAC;AAAA,MACtE;AAAA,IACF;AAAA,EACF;AACF;;;AFlGO,IAAM,gBAAgB;AAGtB,IAAM,kBAAkB;AAGxB,IAAM,cAAc;AAM3B,IAAM,SAAS,aAAa,EAAE,WAAW,yBAAyB,CAAC;AAUnE,IAAM,uBAAuB,oBAAI,IAAoB;AAErD,IAAI,oBAAoB;AAYxB,SAAS,eAAe,KAAsB;AAC5C,MAAI;AACF,WAAO,SAAS,KAAK,KAAK,aAAa,CAAC,EAAE,YAAY;AAAA,EACxD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAWA,SAAS,qBAAqB,OAA8B;AAC1D,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,cAAU,aAAa,KAAK;AAC5B,eAAW,SAAS,OAAO,EAAE;AAAA,EAC/B,QAAQ;AACN,WAAO;AAAA,EACT;AACA,WAAS,QAAQ,GAAG,QAAQ,IAAI,SAAS;AACvC,QAAI,eAAe,OAAO,EAAG,QAAO;AACpC,QAAI,WAAW,OAAO,EAAG,QAAO;AAChC,UAAM,SAASC,SAAQ,OAAO;AAC9B,QAAI,WAAW,QAAS,QAAO;AAC/B,QAAI;AACF,UAAI,SAAS,MAAM,EAAE,QAAQ,SAAU,QAAO;AAAA,IAChD,QAAQ;AACN,aAAO;AAAA,IACT;AACA,cAAU;AAAA,EACZ;AACA,SAAO;AACT;AAwBO,SAAS,oBAAoB,SAA0B;AAC5D,MAAI,YAAY,OAAW,QAAOC,SAAQ,OAAO;AAEjD,QAAM,SAAS,uBAAuB,KAAK,QAAQ,IAAI;AACvD,QAAM,WAAW,qBAAqB,IAAI,MAAM;AAChD,MAAI,aAAa,OAAW,QAAO;AAEnC,QAAM,aAAa,qBAAqB,MAAM,KAAK,aAAa,MAAM;AACtE,MAAI,eAAe,MAAM;AACvB,yBAAqB,IAAI,QAAQ,UAAU;AAC3C,WAAO;AAAA,EACT;AAEA,MAAI;AACJ,MAAI;AACF,eAAW,aAAa,MAAM;AAAA,EAChC,QAAQ;AACN,eAAWA,SAAQ,MAAM;AAAA,EAC3B;AACA,MAAI,CAAC,mBAAmB;AACtB,wBAAoB;AACpB,WAAO;AAAA,MACL;AAAA,MACA,EAAE,KAAK,UAAU,cAAc,cAAc;AAAA,IAC/C;AAAA,EACF;AACA,uBAAqB,IAAI,QAAQ,QAAQ;AACzC,SAAO;AACT;AAMO,SAAS,iBAAyB;AACvC,SAAO,oBAAoB;AAC7B;AAcA,SAAS,aAAa,iBAAyB,aAAoD;AACjG,QAAM,WAAW,kBAAkB,iBAAiB,WAAW;AAC/D,MAAI,aAAa,MAAM;AACrB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,OAAO,IAAI,cAAc,gEAAgE;AAAA,QACvF,SAAS,EAAE,iBAAiB,aAAaA,SAAQ,WAAW,EAAE;AAAA,MAChE,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO,EAAE,IAAI,MAAM,OAAO,SAAS;AACrC;AAaA,eAAsB,uBACpB,SACiE;AACjE,QAAM,OAAO,oBAAoB,OAAO;AACxC,QAAM,WAAW,KAAK,MAAM,eAAe,eAAe;AAE1D,QAAM,iBAAiB,aAAa,UAAU,IAAI;AAClD,MAAI,CAAC,eAAe,IAAI;AACtB,WAAO;AAAA,EACT;AAOA,QAAM,mBAAmB,MAAM,eAAe;AAE9C,MAAI;AACF,UAAM,UAAU,MAAS,aAAS,eAAe,OAAO,OAAO;AAC/D,WAAO,EAAE,IAAI,MAAM,OAAO,UAAU,OAAO,EAAwB;AAAA,EACrE,SAAS,OAAO;AACd,UAAM,UAAU,gBAAgB,KAAK;AACrC,WAAO,EAAE,IAAI,OAAO,OAAO,IAAI,WAAW,uCAAuC,OAAO,EAAE,EAAE;AAAA,EAC9F;AACF;AASA,eAAsB,mBACpB,SAC6D;AAC7D,QAAM,OAAO,oBAAoB,OAAO;AACxC,QAAM,WAAW,KAAK,MAAM,eAAe,WAAW;AAEtD,QAAM,iBAAiB,aAAa,UAAU,IAAI;AAClD,MAAI,CAAC,eAAe,IAAI;AACtB,WAAO;AAAA,EACT;AAKA,QAAM,mBAAmB,MAAM,WAAW;AAE1C,MAAI;AACF,UAAM,UAAU,MAAS,aAAS,eAAe,OAAO,OAAO;AAC/D,WAAO,EAAE,IAAI,MAAM,OAAO,UAAU,OAAO,EAAoB;AAAA,EACjE,SAAS,OAAO;AACd,UAAM,UAAU,gBAAgB,KAAK;AACrC,WAAO,EAAE,IAAI,OAAO,OAAO,IAAI,WAAW,mCAAmC,OAAO,EAAE,EAAE;AAAA,EAC1F;AACF;AA4CA,eAAsB,mBACpB,UACA,SACmD;AACnD,QAAM,OAAO,oBAAoB,OAAO;AACxC,QAAM,WAAW,KAAK,MAAM,eAAe,WAAW;AAEtD,QAAM,iBAAiB,aAAa,UAAU,IAAI;AAClD,MAAI,CAAC,eAAe,IAAI;AACtB,WAAO;AAAA,EACT;AAEA,MAAI;AACF,UAAM,UAAUC,eAAc,UAAU,EAAE,WAAW,IAAI,CAAC;AAC1D,UAAS,cAAU,eAAe,OAAO,SAAS,OAAO;AACzD,WAAO,EAAE,IAAI,MAAM,OAAO,OAAU;AAAA,EACtC,SAAS,OAAO;AACd,UAAM,UAAU,gBAAgB,KAAK;AACrC,WAAO,EAAE,IAAI,OAAO,OAAO,IAAI,WAAW,mCAAmC,OAAO,EAAE,EAAE;AAAA,EAC1F;AACF;","names":["fs","dirname","resolve","stringifyYaml","resolve","resolve","dirname","resolve","stringifyYaml"]}

package/dist/{chunk-JWWNTXSI.js → chunk-3XQK4MEF.js}

@@ -3,7 +3,7 @@ import {
   ValidationError,
   createLogger,
   formatZodError
-} from "./chunk-HCN3FRNG.js";
+} from "./chunk-ERL3XHQO.js";
 
 // src/security/ast-rule-runner.ts
 import { existsSync } from "node:fs";
@@ -241,4 +241,4 @@ export {
   collectAstQaFindings,
   runAstQaRules
 };
-//# sourceMappingURL=chunk-JWWNTXSI.js.map
+//# sourceMappingURL=chunk-3XQK4MEF.js.map

package/dist/{chunk-JWDVKO3Q.js → chunk-3YKFLM2B.js}

@@ -1,6 +1,6 @@
 import {
   getTimeProvider
-} from "./chunk-HCN3FRNG.js";
+} from "./chunk-ERL3XHQO.js";
 
 // src/security/audit-trail.ts
 var MAX_EVENTS = 1e4;
@@ -205,4 +205,4 @@ export {
   createGraphAuditBridge,
   createAuditTrail
 };
-//# sourceMappingURL=chunk-JWDVKO3Q.js.map
+//# sourceMappingURL=chunk-3YKFLM2B.js.map

package/dist/{chunk-4WB3SB7K.js → chunk-64VMTY3M.js}

@@ -1,6 +1,6 @@
 import {
   getErrorMessage
-} from "./chunk-HCN3FRNG.js";
+} from "./chunk-ERL3XHQO.js";
 
 // src/cli/setup-config.ts
 import { copyFileSync, existsSync, mkdirSync, writeFileSync } from "node:fs";
@@ -77,4 +77,4 @@ function ensureBackup(outputPath) {
 export {
   runConfigInitSync
 };
-//# sourceMappingURL=chunk-4WB3SB7K.js.map
+//# sourceMappingURL=chunk-64VMTY3M.js.map

package/dist/{chunk-LRXMR353.js → chunk-6HETGJSB.js}

@@ -3,10 +3,10 @@ import {
   createLogger,
   getDefaultRegistry,
   roundToMicroUsd
-} from "./chunk-HCN3FRNG.js";
+} from "./chunk-ERL3XHQO.js";
 import {
   getNexusDataDir
-} from "./chunk-MM223CVS.js";
+} from "./chunk-J7QCZRVK.js";
 
 // src/learning/usage-log.ts
 import { z } from "zod";
@@ -176,4 +176,4 @@ export {
   loadUsageEvents,
   rollupByModel
 };
-//# sourceMappingURL=chunk-LRXMR353.js.map
+//# sourceMappingURL=chunk-6HETGJSB.js.map

package/dist/{chunk-ODBLHHTP.js → chunk-6URMW3DB.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-YYJFZ7TO.js";
 import {
   nexusDataPath
-} from "./chunk-MM223CVS.js";
+} from "./chunk-J7QCZRVK.js";
 
 // src/mcp/tools/tool-memory-registry-adapters.ts
 var DEFAULT_SEARCH_LIMIT = 10;
@@ -93,4 +93,4 @@ export {
   StatsOnlyAdapter,
   ensureSharedMemoryRegistry
 };
-//# sourceMappingURL=chunk-ODBLHHTP.js.map
+//# sourceMappingURL=chunk-6URMW3DB.js.map

package/dist/{chunk-NJ66YYG5.js → chunk-7AU5WLAJ.js}

@@ -4,7 +4,7 @@ import {
 import {
   createLogger,
   getTimeProvider
-} from "./chunk-HCN3FRNG.js";
+} from "./chunk-ERL3XHQO.js";
 
 // src/mcp/tools/scanner-registry-fetcher.ts
 import { z } from "zod";
@@ -721,4 +721,4 @@ export {
   generateSecurityPlan,
   buildPlanFromAnalysis
 };
-//# sourceMappingURL=chunk-NJ66YYG5.js.map
+//# sourceMappingURL=chunk-7AU5WLAJ.js.map

package/dist/{chunk-5I47G22O.js → chunk-7J7UYJXC.js}

@@ -1,11 +1,11 @@
 import {
   resolveCliSlot
-} from "./chunk-THKP4RUM.js";
+} from "./chunk-TZWJ7QLW.js";
 import {
   createLogger,
   getTimeProvider,
   isRateLimitText
-} from "./chunk-HCN3FRNG.js";
+} from "./chunk-ERL3XHQO.js";
 
 // src/pipeline/expert-bridge.ts
 function resolveCliFromModelString(model) {
@@ -21,7 +21,7 @@ async function getMcpConfigPath() {
   if (cachedMcpConfigPath !== null) return cachedMcpConfigPath;
   mcpConfigInitPromise ??= (async () => {
     try {
-      const { generateMcpConfig } = await import("./child-mcp-config-25OKN6ZQ.js");
+      const { generateMcpConfig } = await import("./child-mcp-config-N4HLLCEH.js");
       const config = await generateMcpConfig();
       cachedMcpConfigPath = config.configPath;
       cachedMcpConfigCleanup = config.cleanup;
@@ -93,8 +93,8 @@ var routerInitPromise = null;
 async function getRouter() {
   if (cachedRouter !== null) return cachedRouter;
   routerInitPromise ??= (async () => {
-    const { createAllAdapters } = await import("./factory-IOQC3B5Y.js");
-    const { createCompositeRouter } = await import("./composite-router-7TJ2CPZ3.js");
+    const { createAllAdapters } = await import("./factory-ROTP63IZ.js");
+    const { createCompositeRouter } = await import("./composite-router-VAVDLJGT.js");
     const adapters = createAllAdapters();
     if (adapters.size === 0) {
       routerInitPromise = null;
@@ -102,7 +102,7 @@ async function getRouter() {
     }
     cachedRouter = adaptCompositeRouter(createCompositeRouter(adapters));
     try {
-      const { createCliCircuitBreakerIntegration } = await import("./cli-circuit-breaker-55QP7IJF.js");
+      const { createCliCircuitBreakerIntegration } = await import("./cli-circuit-breaker-AAHYLFXZ.js");
       cachedCircuitBreaker = createCliCircuitBreakerIntegration([...adapters.values()]);
     } catch (error) {
       const msg = error instanceof Error ? error.message : String(error);
@@ -213,4 +213,4 @@ export {
   tokenSplitFromUsage,
   executeExpert
 };
-//# sourceMappingURL=chunk-5I47G22O.js.map
+//# sourceMappingURL=chunk-7J7UYJXC.js.map

package/dist/{chunk-YOEB6RVH.js → chunk-7QQ5F7T5.js}

@@ -5,34 +5,34 @@ import {
   planOptionalParams,
   requireApiKey,
   validateApiKeyPresence
-} from "./chunk-7NW6RNJK.js";
+} from "./chunk-FKKVZRSY.js";
 import {
   CUSTOM_API_DEFAULT_MODEL
-} from "./chunk-JKNVGOQH.js";
+} from "./chunk-QCSXKQTK.js";
 import {
   CUSTOM_API_BASE_URL_ENV,
   PROVIDER_ENV_KEYS,
   assertCustomApiHostResolvesPublic,
   validateCustomApiBaseUrl
-} from "./chunk-YAQ6OYOI.js";
+} from "./chunk-F2GERNMF.js";
 import {
   nexusMkdtempSync
-} from "./chunk-4HXPNLZS.js";
+} from "./chunk-DKHBIJO4.js";
 import {
   getAvailabilityCache
-} from "./chunk-THKP4RUM.js";
+} from "./chunk-TZWJ7QLW.js";
 import {
   extractSystemPrompt
 } from "./chunk-QZUG667L.js";
 import {
   generateHyphenId
-} from "./chunk-UVUZMLEJ.js";
+} from "./chunk-WXU4Y5T3.js";
 import {
   CliCircuitBreaker,
   DEFAULT_CIRCUIT_BREAKER_CONFIG,
   getCliCircuitBreakerSnapshot,
   getDefaultCliCircuitBreakerRegistry
-} from "./chunk-AQZSXWPJ.js";
+} from "./chunk-VADACTVB.js";
 import {
   CLI_SUBPROCESS_TIMEOUTS,
   CLI_TIMEOUTS,
@@ -72,7 +72,7 @@ import {
   resolveCliAlias,
   resolveRetryAfterMs,
   retryAfterMsFromContext
-} from "./chunk-HCN3FRNG.js";
+} from "./chunk-ERL3XHQO.js";
 
 // src/cli-adapters/cli-to-model-adapter.ts
 var CliToModelAdapter = class {
@@ -4946,4 +4946,4 @@ export {
   SdkAdapter,
   createAutoAdapter
 };
-//# sourceMappingURL=chunk-YOEB6RVH.js.map
+//# sourceMappingURL=chunk-7QQ5F7T5.js.map

package/dist/{chunk-ITCKXMOH.js → chunk-7WJGV5DN.js}

@@ -1,6 +1,6 @@
 import {
   getNexusDataDir
-} from "./chunk-MM223CVS.js";
+} from "./chunk-J7QCZRVK.js";
 
 // src/config/learning-persistence.ts
 import { mkdirSync } from "node:fs";
@@ -45,4 +45,4 @@ export {
   isPersistenceEnabled,
   ensureLearningDir
 };
-//# sourceMappingURL=chunk-ITCKXMOH.js.map
+//# sourceMappingURL=chunk-7WJGV5DN.js.map

package/dist/{chunk-PFMNPQI7.js → chunk-AOS7F4QR.js}

@@ -2,7 +2,7 @@ import {
   TASK_CATEGORIES,
   getAdaptiveBonus,
   getOutcomeStore
-} from "./chunk-HCN3FRNG.js";
+} from "./chunk-ERL3XHQO.js";
 
 // src/cli/doctor-deep.ts
 var CLI_NAMES = ["claude", "gemini", "codex", "opencode"];
@@ -106,4 +106,4 @@ export {
   runDeepDiagnostics,
   formatDeepDiagnostics
 };
-//# sourceMappingURL=chunk-PFMNPQI7.js.map
+//# sourceMappingURL=chunk-AOS7F4QR.js.map

package/dist/{chunk-4HXPNLZS.js → chunk-DKHBIJO4.js}

@@ -1,6 +1,6 @@
 import {
   nexusDataPathEnsure
-} from "./chunk-MM223CVS.js";
+} from "./chunk-J7QCZRVK.js";
 
 // src/config/nexus-tmp-dir.ts
 import { mkdirSync, mkdtempSync } from "node:fs";
@@ -36,4 +36,4 @@ export {
   nexusMkdtempSync,
   nexusMkdtemp
 };
-//# sourceMappingURL=chunk-4HXPNLZS.js.map
+//# sourceMappingURL=chunk-DKHBIJO4.js.map

package/dist/chunk-DROYVWGE.js

@@ -0,0 +1,7 @@
+// src/version.ts
+var VERSION = true ? "8.8.1" : "dev";
+
+export {
+  VERSION
+};
+//# sourceMappingURL=chunk-DROYVWGE.js.map