nexus-agents 8.96.0 → 8.97.0

package/dist/{chunk-KQJHYWF5.js → chunk-GUEUV3ND.js}

@@ -21,7 +21,7 @@ import {
 import {
   DEFAULT_TASK_TTL_MS,
   clampTaskTtl
-} from "./chunk-WFFE7JSD.js";
+} from "./chunk-LFGVIWQ7.js";
 import {
   executeExpert
 } from "./chunk-FUU6LXIA.js";
@@ -70,9 +70,10 @@ import {
   simulationDeniedResult,
   toJobSummary,
   updateStage,
+  withFileLock,
   withWarnings,
   writeJobCancelled
-} from "./chunk-4LHLEHIS.js";
+} from "./chunk-AVGO46BN.js";
 import {
   allOf,
   anyOf
@@ -95,7 +96,7 @@ import {
 } from "./chunk-CYP33W2C.js";
 import {
   withPrerequisite
-} from "./chunk-5VW2Z25X.js";
+} from "./chunk-7TXK4ZU3.js";
 import {
   NOOP_NOTIFIER,
   RateLimiter,
@@ -123,10 +124,10 @@ import {
   toolSuccessStructured,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-GWVSAAW4.js";
+} from "./chunk-IR25EHPP.js";
 import {
   VERSION
-} from "./chunk-CSNLW5ZS.js";
+} from "./chunk-6I6JETP7.js";
 import {
   EventTopics,
   UNRESOLVED_MODEL_ID,
@@ -17404,7 +17405,7 @@ function wouldCreateCycle(from, to, getNode) {
   return canReach(to, from, /* @__PURE__ */ new Set(), getNode);
 }
 function findCyclePath(from, to, getNode) {
-  const path11 = [from, to];
+  const path12 = [from, to];
   const visited = /* @__PURE__ */ new Set([from]);
   const findPath = (current) => {
     if (current === from) return true;
@@ -17413,9 +17414,9 @@ function findCyclePath(from, to, getNode) {
     for (const depId of node.dependencies.keys()) {
       if (!visited.has(depId)) {
         visited.add(depId);
-        path11.push(depId);
+        path12.push(depId);
         if (findPath(depId)) return true;
-        path11.pop();
+        path12.pop();
       } else if (depId === from) {
         return true;
       }
@@ -17423,7 +17424,7 @@ function findCyclePath(from, to, getNode) {
     return false;
   };
   findPath(to);
-  return path11;
+  return path12;
 }
 function detectCycleDFS(nodeId, visited, stack, getNode) {
   visited.add(nodeId);
@@ -17442,29 +17443,29 @@ function detectCycleDFS(nodeId, visited, stack, getNode) {
   return false;
 }
 function findCycleFromNode(startId, getNode) {
-  const path11 = [];
+  const path12 = [];
   const visited = /* @__PURE__ */ new Set();
   const dfs = (nodeId) => {
-    if (path11.includes(nodeId)) {
-      const cycleStart = path11.indexOf(nodeId);
-      path11.splice(0, cycleStart);
-      path11.push(nodeId);
+    if (path12.includes(nodeId)) {
+      const cycleStart = path12.indexOf(nodeId);
+      path12.splice(0, cycleStart);
+      path12.push(nodeId);
       return true;
     }
     if (visited.has(nodeId)) return false;
     visited.add(nodeId);
-    path11.push(nodeId);
+    path12.push(nodeId);
     const node = getNode(nodeId);
     if (node) {
       for (const depId of node.dependencies.keys()) {
         if (dfs(depId)) return true;
       }
     }
-    path11.pop();
+    path12.pop();
     return false;
   };
   dfs(startId);
-  return path11;
+  return path12;
 }
 
 // src/agents/skills/skill-dependency-graph.ts
@@ -22447,18 +22448,18 @@ var DependencyGraph = class {
     }
     const startNode = firstNode;
     const visited = /* @__PURE__ */ new Set();
-    const path11 = [];
+    const path12 = [];
     const dfs = (nodeId) => {
-      if (path11.includes(nodeId)) {
-        const cycleStart = path11.indexOf(nodeId);
-        path11.splice(0, cycleStart);
+      if (path12.includes(nodeId)) {
+        const cycleStart = path12.indexOf(nodeId);
+        path12.splice(0, cycleStart);
         return true;
       }
       if (visited.has(nodeId)) {
         return false;
       }
       visited.add(nodeId);
-      path11.push(nodeId);
+      path12.push(nodeId);
       const node = this.nodes.get(nodeId);
       if (node) {
         for (const depId of node.dependencies) {
@@ -22469,11 +22470,11 @@ var DependencyGraph = class {
           }
         }
       }
-      path11.pop();
+      path12.pop();
       return false;
     };
     dfs(startNode);
-    return path11.length > 0 ? path11 : cycleNodes.slice(0, 3);
+    return path12.length > 0 ? path12 : cycleNodes.slice(0, 3);
   }
   /**
    * Gets the execution order (topologically sorted step IDs).
@@ -23328,9 +23329,9 @@ function getBuiltInTemplatesPath() {
     join3(dirname(currentDir), "workflows", "templates"),
     join3(dirname(currentDir), "dist", "workflows", "templates")
   ];
-  for (const path11 of possiblePaths) {
-    if (existsSync3(path11)) {
-      return path11;
+  for (const path12 of possiblePaths) {
+    if (existsSync3(path12)) {
+      return path12;
     }
   }
   return join3(currentDir, "templates");
@@ -23871,9 +23872,9 @@ function validateRequiredInputs(inputs, required) {
 }
 
 // src/workflows/expression-resolver-helpers.ts
-function getNestedValue(obj, path11) {
+function getNestedValue(obj, path12) {
   let current = obj;
-  for (const key of path11) {
+  for (const key of path12) {
     if (current === null || current === void 0) {
       return void 0;
     }
@@ -23884,24 +23885,24 @@ function getNestedValue(obj, path11) {
   }
   return current;
 }
-function resolveInputs(path11, context) {
-  const value = getNestedValue(context.inputs, path11);
+function resolveInputs(path12, context) {
+  const value = getNestedValue(context.inputs, path12);
   if (value === void 0) {
     return {
       success: false,
-      error: `Input '${path11.join(".")}' not found`
+      error: `Input '${path12.join(".")}' not found`
     };
   }
   return { success: true, value };
 }
-function validateStepPath(path11) {
-  if (path11.length < 2) {
+function validateStepPath(path12) {
+  if (path12.length < 2) {
     return {
       success: false,
       error: "Steps expression requires at least stepId and output"
     };
   }
-  if (path11[0] === void 0 || path11[1] === void 0) {
+  if (path12[0] === void 0 || path12[1] === void 0) {
     return {
       success: false,
       error: "Steps expression requires stepId and output"
@@ -23927,12 +23928,12 @@ function validateStepResult(stepId, outputKey, stepResult) {
   }
   return null;
 }
-function resolveSteps(path11, context) {
-  const pathError = validateStepPath(path11);
+function resolveSteps(path12, context) {
+  const pathError = validateStepPath(path12);
   if (pathError !== null) return pathError;
-  const stepId = path11[0] ?? "";
-  const outputKey = path11[1] ?? "";
-  const rest = path11.slice(2);
+  const stepId = path12[0] ?? "";
+  const outputKey = path12[1] ?? "";
+  const rest = path12.slice(2);
   const stepResult = context.stepResults.get(stepId);
   const earlyReturn = validateStepResult(stepId, outputKey, stepResult);
   if (earlyReturn !== null) return earlyReturn;
@@ -23948,15 +23949,15 @@ function resolveSteps(path11, context) {
   }
   return { success: true, value };
 }
-function resolveVariables(path11, context) {
-  if (path11.length === 0) {
+function resolveVariables(path12, context) {
+  if (path12.length === 0) {
     return {
       success: false,
       error: "Variables expression requires a variable name"
     };
   }
-  const varName = path11[0];
-  const rest = path11.slice(1);
+  const varName = path12[0];
+  const rest = path12.slice(1);
   if (varName === void 0) {
     return {
       success: false,
@@ -25000,8 +25001,8 @@ var WorkflowEngine = class {
     this.config = resolveConfig2(config);
   }
   /** Load workflow template from file. */
-  async loadTemplate(path11) {
-    return this.deps.loadWorkflowFile(path11);
+  async loadTemplate(path12) {
+    return this.deps.loadWorkflowFile(path12);
   }
   /**
    * Execute a workflow with inputs.
@@ -25130,8 +25131,8 @@ var WorkflowEngine = class {
     }
     return Promise.resolve(templates);
   }
-  createTemplate(workflow, path11, category) {
-    const t = { name: workflow.name, version: workflow.version, path: path11, category };
+  createTemplate(workflow, path12, category) {
+    const t = { name: workflow.name, version: workflow.version, path: path12, category };
     if (workflow.description !== void 0) t.description = workflow.description;
     return t;
   }
@@ -25438,8 +25439,8 @@ function createParseWorkflow() {
   };
 }
 function createLoadWorkflowFile() {
-  return async (path11) => {
-    const result = await loadWorkflowFile(path11);
+  return async (path12) => {
+    const result = await loadWorkflowFile(path12);
     if (!result.ok) {
       if (result.error instanceof ParseError) {
         return result;
@@ -31016,31 +31017,31 @@ var GraphBuilder = class {
     }
     const visited = /* @__PURE__ */ new Set();
     const stack = /* @__PURE__ */ new Set();
-    const path11 = [];
+    const path12 = [];
     for (const nodeId of this.nodes.keys()) {
-      const cycle = this.dfs(nodeId, adj, visited, stack, path11);
+      const cycle = this.dfs(nodeId, adj, visited, stack, path12);
       if (cycle !== void 0) return cycle;
     }
     return void 0;
   }
-  dfs(nodeId, adj, visited, stack, path11) {
+  dfs(nodeId, adj, visited, stack, path12) {
     if (stack.has(nodeId)) {
-      const cycleStart = path11.indexOf(nodeId);
-      const cyclePath = path11.slice(cycleStart);
+      const cycleStart = path12.indexOf(nodeId);
+      const cyclePath = path12.slice(cycleStart);
       cyclePath.push(nodeId);
       return { type: "cycle_detected", path: cyclePath };
     }
     if (visited.has(nodeId)) return void 0;
     visited.add(nodeId);
     stack.add(nodeId);
-    path11.push(nodeId);
+    path12.push(nodeId);
     const neighbors = adj.get(nodeId) ?? [];
     for (const neighbor of neighbors) {
-      const cycle = this.dfs(neighbor, adj, visited, stack, path11);
+      const cycle = this.dfs(neighbor, adj, visited, stack, path12);
       if (cycle !== void 0) return cycle;
     }
     stack.delete(nodeId);
-    path11.pop();
+    path12.pop();
     return void 0;
   }
   checkReachability() {
@@ -32008,8 +32009,8 @@ function extractModelAttribution(event) {
   };
 }
 function extractRoutingAttribution(event) {
-  const path11 = event.decisionPath !== void 0 ? [...event.decisionPath] : void 0;
-  return { modelId: event.selectedModel, reasoning: event.reasoning, decisionPath: path11 };
+  const path12 = event.decisionPath !== void 0 ? [...event.decisionPath] : void 0;
+  return { modelId: event.selectedModel, reasoning: event.reasoning, decisionPath: path12 };
 }
 function extractPipelineAttribution(event) {
   if (event.type === "pipeline.completed") {
@@ -41761,12 +41762,12 @@ function extractFileReferences(markdown) {
   let match;
   FILE_REF_PATTERN.lastIndex = 0;
   while ((match = FILE_REF_PATTERN.exec(markdown)) !== null) {
-    const path11 = match[1];
-    if (path11 === void 0 || seen.has(path11)) continue;
-    seen.add(path11);
+    const path12 = match[1];
+    if (path12 === void 0 || seen.has(path12)) continue;
+    seen.add(path12);
     const lineStr = match[2];
     const line = lineStr !== void 0 ? parseInt(lineStr, 10) : void 0;
-    refs.push(line !== void 0 ? { path: path11, line } : { path: path11 });
+    refs.push(line !== void 0 ? { path: path12, line } : { path: path12 });
   }
   return refs;
 }
@@ -44509,11 +44510,54 @@ var InMemoryAuditStorage = class {
 // src/audit/audit-storage.ts
 import * as fs5 from "node:fs";
 import * as os from "node:os";
+import * as path4 from "node:path";
+
+// src/audit/audit-chain-tail.ts
+import { open } from "node:fs/promises";
 import * as path3 from "node:path";
+var TAIL_CHUNK_BYTES = 64 * 1024;
+async function lastEventIn(filePath) {
+  const handle = await open(filePath, "r");
+  try {
+    const { size } = await handle.stat();
+    for (let window = TAIL_CHUNK_BYTES; ; window *= 2) {
+      const start = Math.max(0, size - window);
+      const buffer = Buffer.alloc(size - start);
+      await handle.read(buffer, 0, buffer.length, start);
+      const lines = buffer.toString("utf-8").split("\n");
+      const whole = start === 0 ? lines : lines.slice(1);
+      for (let i = whole.length - 1; i >= 0; i--) {
+        const event = parseEvent(whole[i] ?? "");
+        if (event !== null) return event;
+      }
+      if (start === 0) return null;
+    }
+  } finally {
+    await handle.close();
+  }
+}
+function parseEvent(line) {
+  if (line.trim().length === 0) return null;
+  try {
+    const parsed = AuditEventSchema.safeParse(JSON.parse(line));
+    return parsed.success ? { hash: parsed.data.hash } : null;
+  } catch {
+    return null;
+  }
+}
+async function readChainTailHash(logDir, fileNamesNewestFirst) {
+  for (const name of fileNamesNewestFirst) {
+    const last = await lastEventIn(path3.join(logDir, name));
+    if (last !== null) return last.hash;
+  }
+  return void 0;
+}
+
+// src/audit/audit-storage.ts
 function validateLogDir(logDir, allowedRoot) {
-  const resolvedRoot = path3.resolve(allowedRoot);
-  const resolvedLogDir = path3.resolve(allowedRoot, logDir);
-  if (!resolvedLogDir.startsWith(resolvedRoot + path3.sep) && resolvedLogDir !== resolvedRoot) {
+  const resolvedRoot = path4.resolve(allowedRoot);
+  const resolvedLogDir = path4.resolve(allowedRoot, logDir);
+  if (!resolvedLogDir.startsWith(resolvedRoot + path4.sep) && resolvedLogDir !== resolvedRoot) {
     return {
       ok: false,
       error: new SecurityError("Path traversal detected: logDir escapes allowed root directory", {
@@ -44536,8 +44580,8 @@ function validateLogDirBasic(logDir) {
       };
     }
   }
-  const resolved = path3.resolve(logDir);
-  if (isRefusedSystemPath(resolved, path3.resolve(os.homedir()))) {
+  const resolved = path4.resolve(logDir);
+  if (isRefusedSystemPath(resolved, path4.resolve(os.homedir()))) {
     return {
       ok: false,
       error: new SecurityError("logDir cannot be a system directory", {
@@ -44550,12 +44594,12 @@ function validateLogDirBasic(logDir) {
 var ALWAYS_REFUSED_DIRS = ["/etc", "/usr", "/bin", "/sbin", "/proc", "/sys"];
 var REFUSED_OUTSIDE_HOME_DIRS = ["/root", "/var"];
 function isWithin(child, parent) {
-  const rel = path3.relative(parent, child);
-  return rel === "" || rel !== ".." && !rel.startsWith(".." + path3.sep) && !path3.isAbsolute(rel);
+  const rel = path4.relative(parent, child);
+  return rel === "" || rel !== ".." && !rel.startsWith(".." + path4.sep) && !path4.isAbsolute(rel);
 }
 function isRefusedSystemPath(resolved, home) {
   if (ALWAYS_REFUSED_DIRS.some((dir) => isWithin(resolved, dir))) return true;
-  const homeGrants = home !== path3.parse(home).root && isWithin(resolved, home);
+  const homeGrants = home !== path4.parse(home).root && isWithin(resolved, home);
   return REFUSED_OUTSIDE_HOME_DIRS.some((dir) => isWithin(resolved, dir)) && !homeGrants;
 }
 var FileAuditStorage = class _FileAuditStorage {
@@ -44636,7 +44680,7 @@ var FileAuditStorage = class _FileAuditStorage {
     const existingFiles = this.getExistingLogFiles();
     const latestFileName = existingFiles[0];
     if (existingFiles.length > 0 && latestFileName !== void 0) {
-      const latestFile = path3.join(this.logDir, latestFileName);
+      const latestFile = path4.join(this.logDir, latestFileName);
       const stats = fs5.statSync(latestFile);
       if (stats.size < this.maxFileSizeBytes) {
         this.currentFile = latestFile;
@@ -44659,8 +44703,9 @@ var FileAuditStorage = class _FileAuditStorage {
       this.writeStream.end();
       this.writeStream = null;
     }
-    this.currentFile = path3.join(this.logDir, this.generateFileName());
+    this.currentFile = path4.join(this.logDir, this.generateFileName());
     this.currentFileSize = 0;
+    fs5.closeSync(fs5.openSync(this.currentFile, "a"));
     this.openWriteStream();
     this.logger.debug("Rotated audit log file", { file: this.currentFile });
     this.pruneOldFiles();
@@ -44670,7 +44715,7 @@ var FileAuditStorage = class _FileAuditStorage {
     if (files.length > this.maxFiles) {
       const filesToDelete = files.slice(this.maxFiles);
       for (const file of filesToDelete) {
-        const filePath = path3.join(this.logDir, file);
+        const filePath = path4.join(this.logDir, file);
         fs5.unlinkSync(filePath);
         this.logger.info("Pruned old audit log", { file });
       }
@@ -44702,6 +44747,60 @@ var FileAuditStorage = class _FileAuditStorage {
       });
     });
   }
+  /**
+   * Append a chained batch under the cross-process lock (#6546). The tail
+   * read, the seal and the flush to disk all happen while the lock is held,
+   * so two processes can neither both chain from the same tail (a fork) nor
+   * interleave lines between another process's read and write.
+   */
+  async appendChained(seal) {
+    await withFileLock(path4.join(this.logDir, `${this.filePrefix}.lock`), async () => {
+      this.adoptLatestFile();
+      this.terminateTornLine();
+      const tailHash = await readChainTailHash(this.logDir, this.getExistingLogFiles());
+      for (const event of seal(tailHash)) await this.write(event);
+      await this.flush();
+    });
+  }
+  /**
+   * Under the append lock, follow whichever file is newest now: another
+   * process may have rotated or appended since this one last wrote. Appending
+   * to an older file would place this batch BEFORE events it chains after.
+   */
+  adoptLatestFile() {
+    const latest = this.getExistingLogFiles()[0];
+    if (latest === void 0) {
+      this.rotateFile();
+      return;
+    }
+    const latestPath = path4.join(this.logDir, latest);
+    if (latestPath !== this.currentFile) {
+      this.writeStream?.end();
+      this.writeStream = null;
+      this.currentFile = latestPath;
+      this.openWriteStream();
+    }
+    this.currentFileSize = fs5.statSync(latestPath).size;
+  }
+  /**
+   * Under the append lock: if a writer crashed mid-line, end that line before
+   * appending, or the next event would be glued onto it and lost with it. The
+   * torn line itself is left in place — the verifier still counts it as
+   * skipped — and the tail read links the new batch past it.
+   */
+  terminateTornLine() {
+    if (this.currentFile === null || this.currentFileSize === 0) return;
+    const last = Buffer.alloc(1);
+    const fd = fs5.openSync(this.currentFile, "r");
+    try {
+      fs5.readSync(fd, last, 0, 1, this.currentFileSize - 1);
+    } finally {
+      fs5.closeSync(fd);
+    }
+    if (last[0] === 10) return;
+    fs5.appendFileSync(this.currentFile, "\n");
+    this.currentFileSize += 1;
+  }
   async close() {
     await this.flush();
     return new Promise((resolve19) => {
@@ -44724,7 +44823,7 @@ var FileAuditStorage = class _FileAuditStorage {
     let skipped = 0;
     for (const file of files) {
       if (results.length >= limit) break;
-      const filePath = path3.join(this.logDir, file);
+      const filePath = path4.join(this.logDir, file);
       const events = await readAuditFile({
         filePath,
         criteria,
@@ -44980,14 +45079,30 @@ var AuditLogger = class {
       policyName: input.policyName,
       policyDecision: input.policyDecision,
       violationType: input.violationType,
-      previousHash: this.enableHashChain ? this.lastHash ?? void 0 : void 0
+      // Linked at flush time by sealChain (#6546), not here.
+      previousHash: void 0
     };
     if (hasTierTransitionPayload(event)) event.hashVersion = AUDIT_HASH_VERSION_TIER_TRANSITION;
-    if (this.enableHashChain) {
+    return JSON.parse(JSON.stringify(event));
+  }
+  /**
+   * Link `events` onto the chain whose head is `tailHash` (#6546).
+   *
+   * Runs at flush time, not at log() time: the head of a shared log is only
+   * known under the storage's cross-process lock, after reading the last
+   * persisted event. `tailHash` undefined is the empty case — a fresh log —
+   * and the first event is then a genesis event with no `previousHash`.
+   */
+  sealChain(events, tailHash) {
+    if (!this.enableHashChain) return events;
+    let prior = tailHash;
+    for (const event of events) {
+      event.previousHash = prior;
       event.hash = computeEventHash(event);
-      this.lastHash = event.hash;
+      prior = event.hash;
     }
-    return event;
+    this.lastHash = prior ?? null;
+    return events;
   }
   log(input) {
     if (this.closed) {
@@ -44995,7 +45110,13 @@ var AuditLogger = class {
       return;
     }
     if (!this.shouldLog(input)) return;
-    const event = this.createEvent(input);
+    let event;
+    try {
+      event = this.createEvent(input);
+    } catch (err2) {
+      this.recordPersistFailure(err2);
+      return;
+    }
     this.eventQueue.push(event);
     if (this.eventQueue.length > this.maxQueueDepth) {
       const dropCount = this.eventQueue.length - this.maxQueueDepth;
@@ -45196,7 +45317,20 @@ var AuditLogger = class {
   async drainAndFlushOnce() {
     if (this.eventQueue.length > 0) {
       const events = this.eventQueue.splice(0, this.eventQueue.length);
-      for (const event of events) {
+      if (this.storage.appendChained !== void 0) {
+        const progress = { sealed: false };
+        try {
+          await this.storage.appendChained((tailHash) => {
+            progress.sealed = true;
+            return this.sealChain(events, tailHash);
+          });
+        } catch (err2) {
+          if (!progress.sealed) this.eventQueue.unshift(...events);
+          throw err2;
+        }
+        return;
+      }
+      for (const event of this.sealChain(events, this.lastHash ?? void 0)) {
         await this.storage.write(event);
       }
     }
@@ -45535,8 +45669,8 @@ function computePrReviewRecordHash(payload) {
 }
 
 // src/audit/pr-review-record-store.ts
-import { appendFileSync as appendFileSync2, existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync6 } from "node:fs";
-import { dirname as dirname3, isAbsolute as isAbsolute2, join as join9, resolve as resolve11 } from "node:path";
+import { appendFileSync as appendFileSync3, existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync6 } from "node:fs";
+import { dirname as dirname3, isAbsolute as isAbsolute2, join as join10, resolve as resolve11 } from "node:path";
 var PR_REVIEW_RECORDS_REL_PATH = "governance/pr-review-records.jsonl";
 var PR_REVIEW_RECORDS_PATH_ENV = "NEXUS_PR_REVIEW_RECORDS_PATH";
 var MAX_SUMMARY_RECORD_CHARS = 500;
@@ -45575,11 +45709,11 @@ function resolvePrReviewRecordsPath(repoPathOverride) {
   }
   if (repoPathOverride !== void 0 && repoPathOverride.trim() !== "") {
     const overrideRoot = findRepoRoot(repoPathOverride);
-    if (overrideRoot !== null) return join9(overrideRoot, PR_REVIEW_RECORDS_REL_PATH);
+    if (overrideRoot !== null) return join10(overrideRoot, PR_REVIEW_RECORDS_REL_PATH);
   }
   const root = findRepoRoot(process.cwd());
   if (root === null) return void 0;
-  return join9(root, PR_REVIEW_RECORDS_REL_PATH);
+  return join10(root, PR_REVIEW_RECORDS_REL_PATH);
 }
 function readPrReviewRecords(filePath) {
   const records = [];
@@ -45631,7 +45765,7 @@ function persistPrReviewRecord(opts) {
       sequence: maxSequence + 1,
       previousHash: lastHash
     });
-    appendFileSync2(
+    appendFileSync3(
       filePath,
       serializeValidatedRecord(PrReviewRecordSchema, record, "pr-review"),
       "utf-8"
@@ -46332,7 +46466,7 @@ function ensureRunnableTemplate(template, stages) {
 
 // src/pipeline/pipeline-checkpoint.ts
 import * as fs6 from "node:fs";
-import * as path4 from "node:path";
+import * as path5 from "node:path";
 import { z as z99 } from "zod";
 var logger39 = createLogger({ component: "pipeline-checkpoint" });
 var SESSION_ID_REGEX = /^[a-zA-Z0-9_-]{1,128}$/;
@@ -46345,7 +46479,7 @@ function getCheckpointPath(sessionId, customDir) {
     logger39.warn("Checkpoint directory unavailable", { error: dirResult.error.message });
     return null;
   }
-  return path4.join(dirResult.value, `pipeline-${sessionId}.jsonl`);
+  return path5.join(dirResult.value, `pipeline-${sessionId}.jsonl`);
 }
 function saveStageCheckpoint(sessionId, stage, data, customDir) {
   if (!validateSessionId(sessionId)) {
@@ -46599,7 +46733,7 @@ function buildVotingInput(plan, config) {
 }
 async function executeSingleVote(plan, config, log) {
   try {
-    const { executeVoting } = await import("./consensus-vote-BBLGVUVU.js");
+    const { executeVoting } = await import("./consensus-vote-44KYPBV4.js");
     const input = buildVotingInput(plan, config);
     const result = await executeVoting(input, log);
     return parseVotingResult(result);
@@ -47565,7 +47699,7 @@ function createVoteStage({ config, startStage }) {
     const strategy = config.votingStrategy ?? "higher_order";
     await postProgress(config, "Vote", `Running consensus with ${strategy} strategy...`);
     try {
-      const { executeVoting } = await import("./consensus-vote-BBLGVUVU.js");
+      const { executeVoting } = await import("./consensus-vote-44KYPBV4.js");
       const votingResult = await executeVoting(
         {
           proposal: buildVoteProposal(plan, research),
@@ -47688,8 +47822,8 @@ function parseEnvelope(json) {
 }
 function describeZodError(error) {
   return error.issues.slice(0, 3).map((issue) => {
-    const path11 = issue.path.length > 0 ? issue.path.join(".") : "(root)";
-    return `${path11}: ${issue.message}`;
+    const path12 = issue.path.length > 0 ? issue.path.join(".") : "(root)";
+    return `${path12}: ${issue.message}`;
   }).join("; ");
 }
 function parseSarif(sarifJson, maxFindings = 100) {
@@ -47868,7 +48002,7 @@ function resolveConfidence(rule) {
 }
 
 // src/mcp/tools/security-scan.ts
-import * as path5 from "node:path";
+import * as path6 from "node:path";
 var logger46 = createLogger({ component: "security-scan" });
 var SCAN_TIMEOUT_MS = 3e5;
 async function isSemgrepAvailable() {
@@ -47895,9 +48029,9 @@ async function runSemgrep(targetDir, rulesets) {
   return stdout;
 }
 function validateTargetPath(target) {
-  const root = path5.resolve(process.cwd());
-  const resolved = path5.resolve(root, target);
-  if (resolved !== root && !resolved.startsWith(root + path5.sep)) {
+  const root = path6.resolve(process.cwd());
+  const resolved = path6.resolve(root, target);
+  if (resolved !== root && !resolved.startsWith(root + path6.sep)) {
     throw new Error(`Invalid target path: must resolve inside ${root} (got ${resolved})`);
   }
   return resolved;
@@ -48098,8 +48232,8 @@ async function runOsvCheck(targetDir, enabled) {
   if (!enabled) return OSV_EMPTY;
   try {
     const fs12 = await import("node:fs");
-    const path11 = await import("node:path");
-    const pkgPath = path11.join(targetDir, "package.json");
+    const path12 = await import("node:path");
+    const pkgPath = path12.join(targetDir, "package.json");
     if (!fs12.existsSync(pkgPath)) return OSV_EMPTY;
     const pkg = JSON.parse(fs12.readFileSync(pkgPath, "utf-8"));
     const declared = Object.keys(pkg.dependencies ?? {}).length;
@@ -48158,7 +48292,7 @@ function buildScanSummary(total, blocking, osvCount, osv, sarifParseErrors = 0)
 
 // src/security/quality-gate-commands.ts
 import { existsSync as existsSync9, readFileSync as readFileSync8 } from "node:fs";
-import { join as join11 } from "node:path";
+import { join as join12 } from "node:path";
 var LOCKFILES = [
   { file: "pnpm-lock.yaml", manager: "pnpm" },
   { file: "yarn.lock", manager: "yarn" },
@@ -48173,12 +48307,12 @@ var SCRIPT_CANDIDATES = {
 };
 function detectPackageManager(projectDir) {
   for (const { file, manager } of LOCKFILES) {
-    if (existsSync9(join11(projectDir, file))) return manager;
+    if (existsSync9(join12(projectDir, file))) return manager;
   }
   return "npm";
 }
 function readScripts(projectDir) {
-  const manifest = join11(projectDir, "package.json");
+  const manifest = join12(projectDir, "package.json");
   if (!existsSync9(manifest)) return void 0;
   try {
     const parsed = JSON.parse(readFileSync8(manifest, "utf-8"));
@@ -49245,8 +49379,8 @@ var SENSITIVE_PATH_PATTERNS = Object.freeze([
   "permission",
   "sql"
 ]);
-function isSensitivePath(path11) {
-  const lower = path11.toLowerCase();
+function isSensitivePath(path12) {
+  const lower = path12.toLowerCase();
   return SENSITIVE_PATH_PATTERNS.some((p) => lower.includes(p));
 }
 function byteLen(text) {
@@ -50391,7 +50525,7 @@ function registerVendorPublishingAuditTool(server, deps) {
 
 // src/mcp/tools/compare-data-feeds.ts
 import { z as z105 } from "zod";
-import * as path6 from "node:path";
+import * as path7 from "node:path";
 import * as fs7 from "node:fs";
 import * as yaml4 from "yaml";
 var CompareDataFeedsInputSchema = z105.object({
@@ -50415,7 +50549,7 @@ function readDottedPath(obj, dottedPath) {
   return cursor;
 }
 function parseFeedContent(content, sourcePath) {
-  const ext = path6.extname(sourcePath).toLowerCase();
+  const ext = path7.extname(sourcePath).toLowerCase();
   if (ext === ".json") {
     return JSON.parse(content);
   }
@@ -50522,9 +50656,9 @@ function buildSummary(feedAPath, feedBPath, diff, fieldDiffs, fields) {
   return lines.join("\n");
 }
 function loadFeed(feedPath) {
-  const resolved = path6.resolve(feedPath);
-  const cwdRoot = path6.resolve(".");
-  if (resolved !== cwdRoot && !resolved.startsWith(cwdRoot + path6.sep)) {
+  const resolved = path7.resolve(feedPath);
+  const cwdRoot = path7.resolve(".");
+  if (resolved !== cwdRoot && !resolved.startsWith(cwdRoot + path7.sep)) {
     throw new Error(`Path traversal denied: ${feedPath} must be within ${cwdRoot}`);
   }
   if (!fs7.existsSync(resolved)) {
@@ -50692,7 +50826,7 @@ function registerQueryTaskStateTool(server, deps) {
 import { z as z109 } from "zod";
 
 // src/mcp/tools/ci-health-log.ts
-import { appendFileSync as appendFileSync4, existsSync as existsSync11, readFileSync as readFileSync10, statSync as statSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { appendFileSync as appendFileSync5, existsSync as existsSync11, readFileSync as readFileSync10, statSync as statSync2, writeFileSync as writeFileSync3 } from "node:fs";
 import { z as z108 } from "zod";
 
 // src/mcp/tools/ci-health-types.ts
@@ -50724,17 +50858,17 @@ function maxLogBytes() {
   const n = Number.parseInt(raw, 10);
   return Number.isFinite(n) && n > 0 ? n : DEFAULT_CI_HEALTH_MAX_BYTES;
 }
-function capLogSize(path11) {
+function capLogSize(path12) {
   const max = maxLogBytes();
   let size;
   try {
-    size = statSync2(path11).size;
+    size = statSync2(path12).size;
   } catch {
     return;
   }
   if (size <= max) return;
   try {
-    const lines = readFileSync10(path11, "utf-8").split("\n").filter((l) => l !== "");
+    const lines = readFileSync10(path12, "utf-8").split("\n").filter((l) => l !== "");
     const kept = [];
     let bytes2 = 0;
     for (let i = lines.length - 1; i >= 0; i--) {
@@ -50746,7 +50880,7 @@ function capLogSize(path11) {
       bytes2 += lineBytes;
     }
     kept.reverse();
-    writeFileSync3(path11, kept.length > 0 ? `${kept.join("\n")}
+    writeFileSync3(path12, kept.length > 0 ? `${kept.join("\n")}
 ` : "");
     logger51.warn("ci-health log exceeded size cap \u2014 dropped oldest events", {
       maxBytes: max,
@@ -50767,10 +50901,10 @@ function appendCiHealthEvent(event) {
     ...event
   };
   try {
-    const path11 = logFilePath();
-    appendFileSync4(path11, `${JSON.stringify(record)}
+    const path12 = logFilePath();
+    appendFileSync5(path12, `${JSON.stringify(record)}
 `);
-    capLogSize(path11);
+    capLogSize(path12);
   } catch (err2) {
     logger51.warn("Failed to append ci-health event", {
       error: err2 instanceof Error ? err2.message : String(err2)
@@ -51079,7 +51213,7 @@ function registerRunQualityGateTool(server, deps) {
 
 // src/mcp/tools/verify-audit-chain-tool.ts
 import * as fs8 from "node:fs/promises";
-import * as path7 from "node:path";
+import * as path8 from "node:path";
 import { z as z111 } from "zod";
 
 // src/cli-server-auth.ts
@@ -51295,7 +51429,7 @@ async function loadAuditEvents(dir, logger60, filePrefix = DEFAULT_AUDIT_FILE_PR
   let skippedLines = 0;
   let unreadableFiles = 0;
   for (const filename of auditFiles) {
-    const fullPath = path7.join(dir, filename);
+    const fullPath = path8.join(dir, filename);
     let content;
     try {
       content = await fs8.readFile(fullPath, "utf-8");
@@ -51319,7 +51453,7 @@ async function handler2(args, ctx) {
       message: `Validation error: ${formatZodError(parsed.error)}`
     });
   }
-  const resolvedDir = path7.resolve(parsed.data.logDir);
+  const resolvedDir = path8.resolve(parsed.data.logDir);
   let dirStats;
   try {
     dirStats = await fs8.stat(resolvedDir);
@@ -51975,7 +52109,7 @@ function createMetaOrchestrator(options) {
 }
 
 // src/orchestration/meta-shadow-selector.ts
-import { appendFileSync as appendFileSync5, existsSync as existsSync12, readFileSync as readFileSync11 } from "node:fs";
+import { appendFileSync as appendFileSync6, existsSync as existsSync12, readFileSync as readFileSync11 } from "node:fs";
 import { z as z113 } from "zod";
 var SHADOW_STRATEGY_ARMS = [
   "single-shot",
@@ -52091,7 +52225,7 @@ function persistMetaOutcome(strategy, decision, success) {
   };
   try {
     ensureLearningDir();
-    appendFileSync5(getMetaOutcomesFile(), JSON.stringify(record) + "\n", "utf-8");
+    appendFileSync6(getMetaOutcomesFile(), JSON.stringify(record) + "\n", "utf-8");
   } catch (err2) {
     persistLogger.warn("Failed to persist meta-outcome (ignored)", {
       error: getErrorMessage(err2)
@@ -52472,12 +52606,12 @@ function evaluateMetaStrategyReadiness(result, config = DEFAULT_META_STRATEGY_RE
 // src/mcp/tools/dev-pipeline-tool.ts
 import { z as z114 } from "zod";
 import * as fs10 from "node:fs";
-import * as path9 from "node:path";
+import * as path10 from "node:path";
 import { randomUUID as randomUUID15 } from "node:crypto";
 
 // src/pipeline/task-tracker.ts
 import * as fs9 from "node:fs";
-import * as path8 from "node:path";
+import * as path9 from "node:path";
 var logger52 = createLogger({ component: "task-tracker" });
 async function exec(cmd, args, timeout = 15e3) {
   const { execFile: execFile2 } = await import("node:child_process");
@@ -52557,8 +52691,8 @@ var JsonTaskTracker = class {
   outputPath;
   constructor(config) {
     const dir = config.outputDir ?? nexusDataPath("pipeline");
-    this.outputPath = path8.resolve(dir, "tasks.json");
-    fs9.mkdirSync(path8.dirname(this.outputPath), { recursive: true });
+    this.outputPath = path9.resolve(dir, "tasks.json");
+    fs9.mkdirSync(path9.dirname(this.outputPath), { recursive: true });
   }
   async createTask(title, body) {
     const id = String(this.nextId++);
@@ -52710,9 +52844,9 @@ async function resolveTaskInput(input) {
     return input.task;
   }
   if (input.planFile !== void 0) {
-    const resolved = path9.resolve(input.planFile);
-    const cwdRoot = path9.resolve(".");
-    if (resolved !== cwdRoot && !resolved.startsWith(cwdRoot + path9.sep)) {
+    const resolved = path10.resolve(input.planFile);
+    const cwdRoot = path10.resolve(".");
+    if (resolved !== cwdRoot && !resolved.startsWith(cwdRoot + path10.sep)) {
       throw new Error(`Path traversal denied: planFile must be within ${cwdRoot}`);
     }
     try {
@@ -52943,7 +53077,7 @@ function registerDevPipelineTool(server, deps) {
 // src/mcp/tools/pipeline-tool.ts
 import { z as z115 } from "zod";
 import * as fs11 from "node:fs";
-import * as path10 from "node:path";
+import * as path11 from "node:path";
 import { randomUUID as randomUUID16 } from "node:crypto";
 var PIPELINE_ASYNC_HINT = "A full run_pipeline run can exceed the synchronous MCP request timeout. Retry with `dispatch: 'async'` to get a jobId immediately, then poll get_job_result({ jobId }) for the result.";
 var PipelineInputSchema = z115.object({
@@ -53006,9 +53140,9 @@ function buildOutput3(result, simulated) {
 }
 async function resolveTask(task, specFile) {
   if (specFile === void 0) return task;
-  const resolved = path10.resolve(specFile);
-  const cwdRoot = path10.resolve(".");
-  if (resolved !== cwdRoot && !resolved.startsWith(cwdRoot + path10.sep)) {
+  const resolved = path11.resolve(specFile);
+  const cwdRoot = path11.resolve(".");
+  if (resolved !== cwdRoot && !resolved.startsWith(cwdRoot + path11.sep)) {
     throw new Error(`Path traversal denied: specFile must be within ${cwdRoot}`);
   }
   try {
@@ -56798,4 +56932,4 @@ export {
   startPipelineEventBridge,
   shutdownPipelineEventBridge
 };
-//# sourceMappingURL=chunk-KQJHYWF5.js.map
+//# sourceMappingURL=chunk-GUEUV3ND.js.map