nexus-agents 2.125.32 → 2.125.33

package/dist/{chunk-GNOKYH3I.js → chunk-EULSXFFY.js}

@@ -122,7 +122,7 @@ import {
   DEFAULT_TASK_TTL_MS,
   DEFAULT_TOOL_RATE_LIMITS,
   clampTaskTtl
-} from "./chunk-BDVRPKUV.js";
+} from "./chunk-ZCLKSAWQ.js";
 import {
   resolveInsideRoot
 } from "./chunk-NUBSJGQZ.js";
@@ -41424,7 +41424,7 @@ async function runDevPipelineInner(task, stages, options, sid, prior) {
     logger38.info("Dry run \u2014 stopping after plan+vote");
     return buildDryRunResult(planResult);
   }
-  enforceConsensusExecutePolicy(sid);
+  enforceConsensusExecutePolicy(sid, options?.trustTier);
   const tasks = await runOrResumeDecompose(prior, planResult.plan, stages, {
     conditional: planResult.conditional,
     conditions: planResult.conditions,
@@ -41445,16 +41445,17 @@ async function runDevPipelineInner(task, stages, options, sid, prior) {
   applyPipelineHindsight(bm, task, sid, result);
   return result;
 }
-function enforceConsensusExecutePolicy(sessionId) {
+function enforceConsensusExecutePolicy(sessionId, trustTier) {
   const mode = getGateEnforcementMode();
   if (mode === "off") return;
   const context = {
     taskId: sessionId ?? "dev-pipeline",
     stageId: "consensus-to-execute",
     stageType: "execute",
-    // No trustTier in dev-pipeline metadata → engine defaults missing tier to
-    // untrusted (fail-closed). Safe under WARN (the default); block is opt-in.
-    pipelineState: {}
+    // Inline narrowing of the threaded tier into the typed snapshot (#3712):
+    // only a real string tier populates it; undefined keeps the snapshot empty
+    // so the engine fail-closes to untrusted (4). Absence = untrusted.
+    pipelineState: typeof trustTier === "string" ? { trustTier } : {}
   };
   const result = evaluatePipelinePolicy(
     { engine: createDefaultPolicyEngine(), mode, eventBus: getPipelineEventBus() },
@@ -45664,10 +45665,10 @@ async function createStages(input) {
     }
   });
 }
-async function runDevPipelineForGoal(goal) {
+async function runDevPipelineForGoal(goal, trustTier) {
   const input = DevPipelineInputSchema.parse({ task: goal });
   const stages = await createStages(input);
-  return runDevPipeline(goal, stages);
+  return runDevPipeline(goal, stages, trustTier !== void 0 ? { trustTier } : void 0);
 }
 function buildStructuredOutput(result) {
   return {
@@ -45686,7 +45687,7 @@ function buildStructuredOutput(result) {
   };
 }
 var RUN_DEV_PIPELINE_DESCRIPTION = "Run the multi-agent development pipeline. Accepts direct task instructions, a plan file, or a spec file. Supports dry-run (plan+vote only).";
-async function runDevPipelineHandler(args, logger56) {
+async function runDevPipelineHandler(args, logger56, trustTier) {
   const parsed = DevPipelineInputSchema.safeParse(args);
   if (!parsed.success) {
     return toolStructuredError({
@@ -45705,7 +45706,8 @@ async function runDevPipelineHandler(args, logger56) {
       ...input.sessionId !== void 0 ? { sessionId: input.sessionId } : {},
       ...input.dryRun ? { dryRun: true } : {},
       ...input.mode === "harness" ? { mode: "harness" } : {},
-      ...input.qualityGate !== "off" ? { qualityGate: input.qualityGate } : {}
+      ...input.qualityGate !== "off" ? { qualityGate: input.qualityGate } : {},
+      ...trustTier !== void 0 ? { trustTier } : {}
     };
     const hasOptions = Object.keys(pipelineOptions).length > 0;
     const result = await runDevPipeline(taskText, stages, hasOptions ? pipelineOptions : void 0);
@@ -45721,7 +45723,7 @@ async function runDevPipelineHandler(args, logger56) {
 function registerDevPipelineTool(server, deps) {
   const logger56 = deps.logger ?? createLogger({ tool: "run_dev_pipeline" });
   const secureHandler = createSecureHandler(
-    (args) => runDevPipelineHandler(args, logger56),
+    (args, ctx) => runDevPipelineHandler(args, logger56, ctx.requestContext.trustTier),
     { toolName: "run_dev_pipeline", rateLimiter: deps.rateLimiter, logger: logger56 }
   );
   const timeoutMs = getToolTimeout("run_dev_pipeline", deps.security);
@@ -45967,12 +45969,14 @@ function routeGoal(input, logger56) {
     note: NOTE
   };
 }
-var DEFAULT_EXECUTORS = {
-  "dev-pipeline": (_decision, metaInput) => runDevPipelineForGoal(metaInput.goal),
-  pipeline: (_decision, metaInput) => runPipelineForGoal(metaInput.goal),
-  research: (_decision, metaInput) => runPipelineForGoal(metaInput.goal),
-  consensus: (_decision, metaInput) => runConsensusForGoal(metaInput.goal)
-};
+function buildDefaultExecutors(trustTier) {
+  return {
+    "dev-pipeline": (_decision, metaInput) => runDevPipelineForGoal(metaInput.goal, trustTier),
+    pipeline: (_decision, metaInput) => runPipelineForGoal(metaInput.goal),
+    research: (_decision, metaInput) => runPipelineForGoal(metaInput.goal),
+    consensus: (_decision, metaInput) => runConsensusForGoal(metaInput.goal)
+  };
+}
 function isShadowTrainEnabled() {
   return process.env["NEXUS_META_SHADOW_TRAIN"] === "1" && isPersistenceEnabled();
 }
@@ -45995,7 +45999,7 @@ async function executeGoal(input, opts = {}) {
   const decision = selectDecision(input, opts.logger);
   const onOutcome = opts.onOutcome ?? buildShadowTrainObserver(opts.logger);
   const dispatcher = createMetaDispatcher({
-    executors: opts.executors ?? DEFAULT_EXECUTORS,
+    executors: opts.executors ?? buildDefaultExecutors(opts.trustTier),
     ...opts.logger !== void 0 ? { logger: opts.logger } : {},
     ...opts.outcomeSink !== void 0 ? { outcomeSink: opts.outcomeSink } : {},
     ...onOutcome !== void 0 ? { onOutcome } : {}
@@ -46010,7 +46014,7 @@ async function executeGoal(input, opts = {}) {
     result: dispatch.result
   };
 }
-async function runHandler(args, logger56) {
+async function runHandler(args, logger56, trustTier) {
   const parsed = RunInputSchema.safeParse(args);
   if (!parsed.success) {
     return toolStructuredError({
@@ -46020,7 +46024,10 @@ async function runHandler(args, logger56) {
   }
   if (parsed.data.execute === true) {
     try {
-      const exec2 = await executeGoal(parsed.data, { logger: logger56 });
+      const exec2 = await executeGoal(parsed.data, {
+        logger: logger56,
+        ...trustTier !== void 0 ? { trustTier } : {}
+      });
       logger56.info("run: executed goal", {
         decisionId: exec2.decisionId,
         strategy: exec2.strategy,
@@ -46046,11 +46053,14 @@ async function runHandler(args, logger56) {
 var DESCRIPTION4 = "DEFAULT ENTRY POINT: give a goal and nexus-agents picks the right strategy (single-shot / dev-pipeline / pipeline / graph-workflow / orchestrate / consensus / spec / research) via the MetaOrchestrator. Default (execute:false) is read-only \u2014 returns the routing decision + recommendedTool. With execute:true it runs the selected strategy inline (currently wired: dev-pipeline, pipeline, research, consensus; others fail closed with a typed error) and returns the engine result, recording the outcome. Use forceStrategy to override. Prefer this over choosing a pipeline tool by hand \u2014 the specialized tools remain available as advanced force-strategy paths.";
 function registerRunTool(server, deps) {
   const logger56 = deps.logger ?? createLogger({ tool: "run" });
-  const secureHandler = createSecureHandler((args) => runHandler(args, logger56), {
-    toolName: "run",
-    rateLimiter: deps.rateLimiter,
-    logger: logger56
-  });
+  const secureHandler = createSecureHandler(
+    (args, ctx) => runHandler(args, logger56, ctx.requestContext.trustTier),
+    {
+      toolName: "run",
+      rateLimiter: deps.rateLimiter,
+      logger: logger56
+    }
+  );
   const timeoutMs = getToolTimeout("run", deps.security);
   const wrappedHandler = wrapToolWithTimeout("run", secureHandler, { timeoutMs, logger: logger56 });
   const annotations = getMcpAnnotations("run");
@@ -50096,4 +50106,4 @@ export {
   shutdownFeedbackSubscriber,
   createEventBusBridge
 };
-//# sourceMappingURL=chunk-GNOKYH3I.js.map
+//# sourceMappingURL=chunk-EULSXFFY.js.map