nexus-agents 2.153.0 → 2.154.0

package/dist/{chunk-EJXJNWV6.js → chunk-25F6LRU2.js}

@@ -42,7 +42,7 @@ import {
 } from "./chunk-DHVMSIT5.js";
 
 // src/version.ts
-var VERSION = true ? "2.153.0" : "dev";
+var VERSION = true ? "2.154.0" : "dev";
 
 // src/config/schemas-core.ts
 import { z } from "zod";
@@ -2132,7 +2132,7 @@ async function runDoctorFix(result) {
   writeLine2("\u2500".repeat(40));
   let fixCount = 0;
   if (!result.dataDirectory.rootExists || result.dataDirectory.subdirectories.some((d) => !d.exists || !d.writable)) {
-    const { runSetup } = await import("./setup-command-4WFSYJK2.js");
+    const { runSetup } = await import("./setup-command-OAJCXIMR.js");
     const setupResult = runSetup({
       skipMcp: true,
       skipRules: true,
@@ -2245,4 +2245,4 @@ export {
   startStdioServer,
   closeServer
 };
-//# sourceMappingURL=chunk-EJXJNWV6.js.map
+//# sourceMappingURL=chunk-25F6LRU2.js.map

package/dist/{chunk-HTXQVLOI.js → chunk-6VYNHHII.js}

@@ -8,7 +8,7 @@ import {
   checkSqlite,
   defaultConfig,
   initDataDirectories
-} from "./chunk-EJXJNWV6.js";
+} from "./chunk-25F6LRU2.js";
 import {
   BUILT_IN_EXPERTS
 } from "./chunk-ZM4O442V.js";
@@ -2000,4 +2000,4 @@ export {
   setupCommand,
   setupCommandAsync
 };
-//# sourceMappingURL=chunk-HTXQVLOI.js.map
+//# sourceMappingURL=chunk-6VYNHHII.js.map

package/dist/{chunk-C6S6L5WB.js → chunk-KNVO4P4W.js}

@@ -18,7 +18,7 @@ import {
   DEFAULT_TASK_TTL_MS,
   DEFAULT_TOOL_RATE_LIMITS,
   clampTaskTtl
-} from "./chunk-EJXJNWV6.js";
+} from "./chunk-25F6LRU2.js";
 import {
   executeExpert
 } from "./chunk-JYHSZDKL.js";
@@ -44328,7 +44328,8 @@ function persistPrReviewRecord(opts) {
 
 // src/mcp/tools/pr-review-record-producer.ts
 function buildAndPersist(prNumber, baseSha, args) {
-  const { input, aggregate, counts, reviewCount, logger: logger58 } = args;
+  const { input, aggregate, counts, reviewCount, logger: logger58, coverage } = args;
+  const coverageSuffix = coverage?.partial === true ? ` [partial coverage: ${String(coverage.reviewedFiles)}/${String(coverage.totalFiles)} files reviewed, dropped: ${coverage.droppedFiles.join(", ")}]` : "";
   if (reviewedDiffWasTruncated(input.prDiff)) {
     logger58.warn(
       "Reviewed diff exceeds the hash byte cap; content past it is unbound in reviewedDiffHash",
@@ -44348,7 +44349,7 @@ function buildAndPersist(prNumber, baseSha, args) {
       error: counts.errorCount,
       total: reviewCount
     },
-    summary: `${aggregate.decision} (${String(counts.approveCount)} approve / ${String(counts.requestChangesCount)} request_changes / ${String(counts.abstainCount)} abstain) \u2014 ${input.prTitle}`,
+    summary: `${aggregate.decision} (${String(counts.approveCount)} approve / ${String(counts.requestChangesCount)} request_changes / ${String(counts.abstainCount)} abstain) \u2014 ${input.prTitle}${coverageSuffix}`,
     logger: logger58
   });
   if (record === void 0) {
@@ -44403,6 +44404,133 @@ function persistReviewRecord(args) {
   }
 }
 
+// src/mcp/tools/pr-review-diff-budget.ts
+var SENSITIVE_PATH_PATTERNS = Object.freeze([
+  "auth",
+  "crypto",
+  "secret",
+  "credential",
+  "security",
+  "exec",
+  "spawn",
+  "password",
+  "token",
+  ".env",
+  "permission",
+  "sql"
+]);
+function isSensitivePath(path12) {
+  const lower = path12.toLowerCase();
+  return SENSITIVE_PATH_PATTERNS.some((p) => lower.includes(p));
+}
+function byteLen(text) {
+  return Buffer.byteLength(text, "utf-8");
+}
+function extractPath(fileText) {
+  const nl = fileText.indexOf("\n");
+  const firstLine = nl === -1 ? fileText : fileText.slice(0, nl);
+  const m = /^diff --git a\/(.+?) b\/(.+)$/.exec(firstLine);
+  if (m !== null) return m[2];
+  return firstLine.replace(/^diff --git\s*/, "").trim();
+}
+function splitByFile(diff) {
+  if (diff.length === 0) return [];
+  const headerRe = /^diff --git .*$/gm;
+  const starts = [];
+  let m;
+  while ((m = headerRe.exec(diff)) !== null) {
+    starts.push(m.index);
+  }
+  if (starts.length === 0) {
+    return [{ path: "(unstructured)", text: diff, bytes: byteLen(diff) }];
+  }
+  const files = [];
+  const firstStart = starts[0];
+  if (firstStart > 0) {
+    const text = diff.slice(0, firstStart);
+    files.push({ path: "(preamble)", text, bytes: byteLen(text) });
+  }
+  for (let i = 0; i < starts.length; i++) {
+    const start = starts[i];
+    const end = i + 1 < starts.length ? starts[i + 1] : diff.length;
+    const text = diff.slice(start, end);
+    files.push({ path: extractPath(text), text, bytes: byteLen(text) });
+  }
+  return files;
+}
+function truncateWithMarker(file, budget) {
+  const marker = `
+[... TRUNCATED: file ${file.path} is ${String(file.bytes)} bytes, over the ${String(budget)}-byte review budget; showing a partial prefix \u2014 this file is listed in droppedFiles as partially-seen ...]
+`;
+  const room = Math.max(0, budget - byteLen(marker));
+  const prefix = Buffer.from(file.text, "utf-8").subarray(0, room).toString("utf-8");
+  return prefix + marker;
+}
+function securityFirstPack(files, budget) {
+  const sensitive = files.filter((f) => isSensitivePath(f.path));
+  const rest = files.filter((f) => !isSensitivePath(f.path));
+  const ordered = [...sensitive, ...rest];
+  const segments = [];
+  const reviewedFiles = [];
+  const droppedFiles = [];
+  let used = 0;
+  for (let i = 0; i < ordered.length; i++) {
+    const file = ordered[i];
+    if (used + file.bytes <= budget) {
+      segments.push(file.text);
+      reviewedFiles.push(file.path);
+      used += file.bytes;
+      continue;
+    }
+    if (used === 0) {
+      segments.push(truncateWithMarker(file, budget));
+      reviewedFiles.push(file.path);
+      droppedFiles.push(file.path);
+    } else {
+      droppedFiles.push(file.path);
+    }
+    for (let j = i + 1; j < ordered.length; j++) {
+      droppedFiles.push(ordered[j].path);
+    }
+    break;
+  }
+  return {
+    packed: segments.join(""),
+    reviewedFiles,
+    totalFiles: files.length,
+    droppedFiles,
+    partial: droppedFiles.length > 0
+  };
+}
+function packDiffForReview(prDiff, budget) {
+  if (prDiff.length <= budget) {
+    return { coverage: void 0, packedDiff: prDiff, note: "" };
+  }
+  const pack = securityFirstPack(splitByFile(prDiff), budget);
+  const coverage = {
+    reviewedFiles: pack.reviewedFiles.length,
+    totalFiles: pack.totalFiles,
+    droppedFiles: pack.droppedFiles,
+    partial: pack.partial,
+    strategy: "budget"
+  };
+  const note = pack.partial ? `> NOTE: partial review \u2014 ${String(pack.reviewedFiles.length)} of ${String(pack.totalFiles)} files reviewed (security-prioritized; lowest-priority dropped): ${pack.droppedFiles.join(", ")}
+
+` : "";
+  return { coverage, packedDiff: pack.packed, note };
+}
+function applyPartialCoverageGate(aggregate, coverage) {
+  if (coverage?.partial !== true) return aggregate;
+  if (aggregate.decision === "approve" && aggregate.verified) {
+    return {
+      decision: "abstain",
+      verified: false,
+      reason: `no_quorum: partial diff \u2014 ${String(coverage.reviewedFiles)} of ${String(coverage.totalFiles)} files reviewed`
+    };
+  }
+  return aggregate;
+}
+
 // src/mcp/tools/pr-review-tool.ts
 var PR_REVIEW_ROLES = [
   "architect",
@@ -44412,13 +44540,16 @@ var PR_REVIEW_ROLES = [
   "scope_steward"
 ];
 var MAX_DIFF_LENGTH = 5e4;
+var MAX_DIFF_INPUT_LENGTH = 2e6;
 var MAX_REPO_CONTEXT_LENGTH = 2e3;
 var MAX_DESCRIPTION_LENGTH = 1e4;
 var PR_REVIEW_ASYNC_HINT = "A pr_review run fans out to 5 live LLM voters and can exceed the synchronous MCP request timeout. Retry with `dispatch: 'async'` to get a jobId immediately, then poll get_job_result({ jobId }) for the result.";
 var PrReviewInputSchema = z91.object({
   prTitle: z91.string().min(1).max(500).describe("PR title"),
   prDescription: z91.string().max(MAX_DESCRIPTION_LENGTH).optional().describe("PR body / description"),
-  prDiff: z91.string().min(1).max(MAX_DIFF_LENGTH).describe(`Unified diff text (max ${String(MAX_DIFF_LENGTH)} chars; truncate before calling)`),
+  prDiff: z91.string().min(1).max(MAX_DIFF_INPUT_LENGTH).describe(
+    `Unified diff text (max ${String(MAX_DIFF_INPUT_LENGTH)} chars). No need to truncate before calling: diffs over ${String(MAX_DIFF_LENGTH)} chars are security-prioritized and PARTIALLY reviewed (lowest-priority whole files dropped; coverage reported on the response, and a partial review can block but never verified-approve).`
+  ),
   repoContext: z91.string().max(MAX_REPO_CONTEXT_LENGTH).optional().describe(
     `Optional one-paragraph repo context (architecture, conventions; max ${String(MAX_REPO_CONTEXT_LENGTH)} chars; trim before calling)`
   ),
@@ -44591,19 +44722,36 @@ function summarizeReviews(reviews) {
     errorCount: reviews.filter((r) => r.source === "error").length
   };
 }
-function aggregateWithTelemetry(reviews, errorPolicy, errorCount, logger58) {
-  const aggregate = aggregatePrDecisions(reviews, errorPolicy);
-  if (aggregate.reason !== void 0) {
+function resolveAggregate(reviews, input, errorCount, coverage, logger58) {
+  const preGate = aggregatePrDecisions(reviews, input.errorPolicy);
+  if (preGate.reason !== void 0) {
     logger58.warn("pr_review degraded to no_quorum under absolute_quorum (#4132)", {
-      reason: aggregate.reason,
+      reason: preGate.reason,
       errorCount
     });
   }
+  const aggregate = applyPartialCoverageGate(preGate, coverage);
+  if (aggregate !== preGate) {
+    logger58.warn(
+      "pr_review partial review barred from verified-approve \u2014 degraded to no_quorum (#4140)",
+      { reason: aggregate.reason }
+    );
+  }
   return aggregate;
 }
+function preparePanelProposal(input, logger58) {
+  const { coverage, packedDiff, note } = packDiffForReview(input.prDiff, MAX_DIFF_LENGTH);
+  const body = coverage === void 0 ? input : { ...input, prDiff: packedDiff };
+  if (coverage?.partial === true) {
+    logger58.warn(
+      `pr_review diff over budget \u2014 reviewed ${String(coverage.reviewedFiles)} of ${String(coverage.totalFiles)} files, dropped ${String(coverage.droppedFiles.length)}`
+    );
+  }
+  return { proposal: note + buildPrReviewProposal(body), coverage };
+}
 async function executePrReviewBody(input, logger58, gatewayAdapters) {
   const start = Date.now();
-  const proposal = buildPrReviewProposal(input);
+  const { proposal, coverage } = preparePanelProposal(input, logger58);
   const voteResults = await collectRealVotes({
     roles: PR_REVIEW_ROLES,
     proposal,
@@ -44613,7 +44761,7 @@ async function executePrReviewBody(input, logger58, gatewayAdapters) {
   });
   const reviews = voteResults.map(toPrReviewVote);
   const counts = summarizeReviews(reviews);
-  const aggregate = aggregateWithTelemetry(reviews, input.errorPolicy, counts.errorCount, logger58);
+  const aggregate = resolveAggregate(reviews, input, counts.errorCount, coverage, logger58);
   let costSummary;
   try {
     costSummary = recordDecisionCost({
@@ -44631,7 +44779,8 @@ async function executePrReviewBody(input, logger58, gatewayAdapters) {
     aggregate,
     counts,
     reviewCount: reviews.length,
-    logger: logger58
+    logger: logger58,
+    ...coverage !== void 0 ? { coverage } : {}
   });
   const response = {
     summary: aggregate.decision,
@@ -44640,7 +44789,8 @@ async function executePrReviewBody(input, logger58, gatewayAdapters) {
     reviews,
     totalDurationMs: Date.now() - start,
     ...costSummary !== void 0 ? { costSummary } : {},
-    recordOutcome: recordOutcome3
+    recordOutcome: recordOutcome3,
+    ...coverage !== void 0 ? { coverage } : {}
   };
   return toolSuccess(JSON.stringify(response, null, 2));
 }
@@ -51296,4 +51446,4 @@ export {
   shutdownFeedbackSubscriber,
   createEventBusBridge
 };
-//# sourceMappingURL=chunk-C6S6L5WB.js.map
+//# sourceMappingURL=chunk-KNVO4P4W.js.map