nexus-agents 11.4.3 → 11.4.5

package/dist/{chunk-PDO4WGCB.js → chunk-2OEWVP7N.js}

@@ -7,7 +7,7 @@ import {
   toSdkCallback,
   toolStructuredError,
   wrapToolWithTimeout
-} from "./chunk-VX2YWNOH.js";
+} from "./chunk-OF6RWX7Z.js";
 import {
   JsonlStore,
   SECURITY_KEYWORDS,
@@ -2435,4 +2435,4 @@ export {
   runImprovementReview,
   registerImprovementReviewTool
 };
-//# sourceMappingURL=chunk-PDO4WGCB.js.map
+//# sourceMappingURL=chunk-2OEWVP7N.js.map

package/dist/{chunk-7HCHQ4OF.js → chunk-6FE3EMVK.js}

@@ -58,7 +58,7 @@ import {
   updateStage,
   withFileLock,
   writeJobCancelled
-} from "./chunk-6BT545RE.js";
+} from "./chunk-N7JSM5IO.js";
 import {
   normalizeTopicToCanonical,
   synthesizeResearch
@@ -77,7 +77,7 @@ import {
 } from "./chunk-773AZVR3.js";
 import {
   withPrerequisite
-} from "./chunk-PDO4WGCB.js";
+} from "./chunk-2OEWVP7N.js";
 import {
   NOOP_NOTIFIER,
   RateLimiter,
@@ -105,7 +105,7 @@ import {
   toolSuccess,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-VX2YWNOH.js";
+} from "./chunk-OF6RWX7Z.js";
 import {
   generateSecurityPlan
 } from "./chunk-6ZTMMN2N.js";
@@ -187,7 +187,7 @@ import {
 import {
   DEFAULT_TASK_TTL_MS,
   clampTaskTtl
-} from "./chunk-4X6ALHTU.js";
+} from "./chunk-DB2QJTJU.js";
 import {
   allOf,
   anyOf
@@ -196,7 +196,7 @@ import {
   VERSION,
   createRequestContext,
   measuredTrustTier
-} from "./chunk-XF5HANZV.js";
+} from "./chunk-I45YACKW.js";
 import {
   BWRAP_READ_ONLY_ARGS,
   CliDetectionCache,
@@ -46682,7 +46682,7 @@ function buildVotingInput(plan, config) {
 }
 async function executeSingleVote(plan, config, log) {
   try {
-    const { executeVoting } = await import("./consensus-vote-CWQDVRIM.js");
+    const { executeVoting } = await import("./consensus-vote-E745BE4Z.js");
     const input = buildVotingInput(plan, config);
     const result = await executeVoting(input, log);
     return parseVotingResult(result);
@@ -47628,6 +47628,7 @@ async function withDevPipelineWorkspace(stages, run, install = installDependenci
     const dependencies = await provisionDependencies(scratch.path, install, sandbox.wrapper);
     const bound = stages.withWorkspace({
       directory: join13(scratch.path, relative4(repoRoot, directory)),
+      root: scratch.path,
       baseline: { sha: baseSha, directory: repoRoot },
       dependencies,
       wrapper: sandbox.wrapper
@@ -48525,7 +48526,7 @@ function createVoteStage({ config, startStage }) {
     const strategy = config.votingStrategy ?? "higher_order";
     await postProgress(config, "Vote", `Running consensus with ${strategy} strategy...`);
     try {
-      const { executeVoting } = await import("./consensus-vote-CWQDVRIM.js");
+      const { executeVoting } = await import("./consensus-vote-E745BE4Z.js");
       const proposal = buildVoteProposal(plan, research);
       const votingResult = await executeVoting(
         {
@@ -49012,6 +49013,8 @@ var COMPLETE_SCAN_FLAGS = [
   // Avoid mutable ignore files and hidden-ancestor skips in scratch worktrees.
   // Unsupported scanner versions fail closed on this explicitly pinned flag.
   "--x-ignore-semgrepignore-files",
+  // Must exclude nothing the dev pipeline captures (PATCH_PATHS in
+  // pipeline/dev-pipeline-workspace.ts), or a captured file ships unscanned.
   "--exclude=node_modules",
   "--exclude=.git"
 ];
@@ -49661,7 +49664,13 @@ function checkSecurityScan(targetDir, rulesets = ["p/default"], config = {}) {
         durationMs: Date.now() - start
       };
     }
-    const gateResult = await runSecurityPipeline(result, targetDir, config, start, signal);
+    const gateResult = await runSecurityPipeline(
+      result,
+      config.dependencyTarget ?? targetDir,
+      config,
+      start,
+      signal
+    );
     if (gateResult.verdict === "fail") return gateResult;
     if (result.parseDiagnostics !== void 0 && result.parseDiagnostics.length > 0) {
       return {
@@ -49677,7 +49686,7 @@ function checkSecurityScan(targetDir, rulesets = ["p/default"], config = {}) {
 async function runBaselineGate(target, rulesets, config, signal) {
   const start = Date.now();
   const comparison = await compareSecurityBaseline(target, rulesets, config, signal);
-  const osv = comparison.complete ? await runOsvCheck(target, config.enableOsv ?? true, signal) : OSV_EMPTY;
+  const osv = comparison.complete ? await runOsvCheck(config.dependencyTarget ?? target, config.enableOsv ?? true, signal) : OSV_EMPTY;
   throwIfAborted(signal, "Security baseline scan aborted");
   const osvFailed = osv.vulnerabilities.some((v) => v.severity === "CRITICAL");
   const details = comparison.complete ? `Base ${String(comparison.baseCount)}, worktree ${String(comparison.worktreeCount)} findings; ${String(comparison.introducedBlockingCount)} introduced blocking; ${buildScanSummary(comparison.worktreeCount ?? 0, comparison.introducedBlockingCount ?? 0, osv.vulnerabilities.length, osv)}` : `Security comparison incomplete: ${comparison.errors.join("; ")}`;
@@ -50402,15 +50411,16 @@ function createQualityGateStage({
   };
 }
 function createSecurityScanStage(deps) {
-  const { config, startStage, workspaceDependencies, wrapper } = deps;
+  const { config, startStage, workspaceDependencies, workspaceRoot, wrapper } = deps;
   return async (signal) => {
     startStage("security");
     const start = getTimeProvider().now();
-    const target = config.scanTarget ?? process.cwd();
+    const target = workspaceRoot ?? config.scanTarget ?? process.cwd();
     await postProgress(config, "Security", `Scanning ${target}...`);
     const scratchBound = workspaceDependencies !== void 0;
     const check = checkSecurityScan(target, void 0, {
       baseline: config.securityBaseline,
+      dependencyTarget: config.scanTarget,
       env: scratchBound ? hermeticGitEnv() : void 0,
       root: scratchBound ? target : void 0,
       wrapper
@@ -50459,10 +50469,17 @@ function createAgentStages(config = {}) {
     decompose: createDecomposeStage(deps),
     ...createExecutionStages(deps),
     // #6794: execution closures share the same guard and scratch directory.
-    withWorkspace: ({ directory, dependencies: workspaceDependencies, wrapper, baseline }) => {
+    withWorkspace: ({
+      directory,
+      root,
+      dependencies: workspaceDependencies,
+      wrapper,
+      baseline
+    }) => {
       const bound = {
         ...deps,
         workspaceDependencies,
+        workspaceRoot: root,
         wrapper,
         config: { ...config, scanTarget: directory, securityBaseline: baseline }
       };
@@ -59168,4 +59185,4 @@ export {
   initializeSandbox,
   getSandboxMode
 };
-//# sourceMappingURL=chunk-7HCHQ4OF.js.map
+//# sourceMappingURL=chunk-6FE3EMVK.js.map