nexus-agents 2.153.0 → 2.154.1

package/dist/{child-mcp-config-A7CWNREQ.js → child-mcp-config-5TDFQBX4.js}

@@ -1,6 +1,6 @@
 import {
   createLogger
-} from "./chunk-YJRZZBRO.js";
+} from "./chunk-N3Y6J2FL.js";
 import "./chunk-NL7SZQPW.js";
 import "./chunk-DHVMSIT5.js";
 import "./chunk-ZPWHCABL.js";
@@ -60,4 +60,4 @@ export {
   generateMcpConfig,
   getDefaultAllowedTools
 };
-//# sourceMappingURL=child-mcp-config-A7CWNREQ.js.map
+//# sourceMappingURL=child-mcp-config-5TDFQBX4.js.map

package/dist/{chunk-HIVRYAIJ.js → chunk-22MKYE4Y.js}

@@ -4,7 +4,7 @@ import {
   getErrorMessage,
   getTimeProvider,
   ok
-} from "./chunk-YJRZZBRO.js";
+} from "./chunk-N3Y6J2FL.js";
 
 // src/context/session-memory.ts
 import * as fs from "fs";
@@ -352,4 +352,4 @@ export {
   SessionMemory,
   createSessionMemory
 };
-//# sourceMappingURL=chunk-HIVRYAIJ.js.map
+//# sourceMappingURL=chunk-22MKYE4Y.js.map

package/dist/{chunk-C6S6L5WB.js → chunk-3P5WC7AV.js}

@@ -1,6 +1,6 @@
 import {
   generateSecurityPlan
-} from "./chunk-T2SGTVB4.js";
+} from "./chunk-52UVXXYA.js";
 import {
   analyzeGitHubRepo
 } from "./chunk-HFOQKCD2.js";
@@ -18,10 +18,10 @@ import {
   DEFAULT_TASK_TTL_MS,
   DEFAULT_TOOL_RATE_LIMITS,
   clampTaskTtl
-} from "./chunk-EJXJNWV6.js";
+} from "./chunk-RW5ZE7IC.js";
 import {
   executeExpert
-} from "./chunk-JYHSZDKL.js";
+} from "./chunk-F5R53HDK.js";
 import {
   JobStatusSchema,
   abortJob,
@@ -41,21 +41,21 @@ import {
   toJobSummary,
   warnIfSimulatedOutsideTests,
   writeJobCancelled
-} from "./chunk-447YUGJD.js";
+} from "./chunk-6LFKY2NE.js";
 import {
   normalizeTopicToCanonical,
   synthesizeResearch
-} from "./chunk-7ZMOF54O.js";
+} from "./chunk-DZCMTSNS.js";
 import {
   IssueTriage
-} from "./chunk-CBFG63WO.js";
+} from "./chunk-QERDNK6B.js";
 import {
   resolveEnvMode,
   sanitizeInput
-} from "./chunk-MF7KPK3C.js";
+} from "./chunk-VC7EUQH4.js";
 import {
   withPrerequisite
-} from "./chunk-XQ5LT7GT.js";
+} from "./chunk-TWXCQOZN.js";
 import {
   NOOP_NOTIFIER,
   RateLimiter,
@@ -78,12 +78,12 @@ import {
   withAuditTrail,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-LXTTRYAT.js";
+} from "./chunk-ZVGM3MPI.js";
 import {
   createAuditTrail,
   createGraphAuditBridge,
   emitPipelinePolicyEvent
-} from "./chunk-HQLZ7ORH.js";
+} from "./chunk-XDYOJQKC.js";
 import {
   addResearchPaper,
   addSourceToRegistry,
@@ -111,15 +111,15 @@ import {
   parseRegistry,
   sourceExistsInRegistry,
   summarizeContextForPrompt
-} from "./chunk-D7D24TFI.js";
+} from "./chunk-ZLNGFULQ.js";
 import {
   getTokenEnvVars,
   resolveToken
-} from "./chunk-G3MSANLH.js";
+} from "./chunk-J2P7FOEZ.js";
 import {
   loadPapersRegistry,
   loadTechniquesRegistry
-} from "./chunk-4QRPK34N.js";
+} from "./chunk-IZVRLJIX.js";
 import {
   resolveInsideRoot
 } from "./chunk-NUBSJGQZ.js";
@@ -128,14 +128,14 @@ import {
   MemoryImportance,
   calculateTextJaccardSimilarity,
   getToolMemory
-} from "./chunk-XXSV26SY.js";
+} from "./chunk-D4N7KBBT.js";
 import {
   STOPWORDS,
   truncateWithInfo
 } from "./chunk-6T3EPABN.js";
 import {
   createSessionMemory
-} from "./chunk-HIVRYAIJ.js";
+} from "./chunk-22MKYE4Y.js";
 import {
   BUILT_IN_EXPERTS,
   BuiltInExpertTypeSchema,
@@ -150,7 +150,7 @@ import {
   createEvent,
   getGlobalEventBus,
   getGlobalRegistry
-} from "./chunk-NZNLBIJD.js";
+} from "./chunk-MY22I2FD.js";
 import {
   CliDetectionCache,
   asRecord,
@@ -158,19 +158,19 @@ import {
   getAvailableClis,
   sleep,
   withTimeout
-} from "./chunk-MREJKQHH.js";
+} from "./chunk-PRMXFOWF.js";
 import {
   DEFAULTS
-} from "./chunk-AXKMXLOH.js";
+} from "./chunk-DJTWGM7I.js";
 import {
   getAvailabilityCache,
   getCliForModelId,
   resolveFallback
-} from "./chunk-XXBQ2XV4.js";
+} from "./chunk-BMHQATIA.js";
 import {
   generateHyphenId,
   generateUUID
-} from "./chunk-3D3CARMV.js";
+} from "./chunk-ZFUFS44V.js";
 import {
   AGENT_ROUTER_TIMEOUTS,
   API_TIMEOUTS,
@@ -262,7 +262,7 @@ import {
   selectStrategyByManifest,
   toExpertTaskAnalysisResult,
   withStep
-} from "./chunk-YJRZZBRO.js";
+} from "./chunk-N3Y6J2FL.js";
 import {
   ensureLearningDir,
   getMetaOutcomesFile,
@@ -26297,7 +26297,7 @@ function execIdFields(executionId) {
 async function populateUnifiedContextOnState(state, options) {
   const taskCandidate = state["task"];
   if (typeof taskCandidate !== "string" || taskCandidate === "") return;
-  const { getContextForTask: getContextForTask2, inferTaskCategory: inferTaskCategory2 } = await import("./context-retriever-SVEJE3IX.js");
+  const { getContextForTask: getContextForTask2, inferTaskCategory: inferTaskCategory2 } = await import("./context-retriever-FTLRG2N6.js");
   const category = inferTaskCategory2(taskCandidate);
   const executionId = options?.executionId;
   const execFields = execIdFields(executionId);
@@ -41571,7 +41571,7 @@ async function tryIssueTriage(task) {
   try {
     const issueMatch = task.match(/github\.com\/([^/]+\/[^/]+)\/issues\/(\d+)/);
     if (issueMatch === null) return null;
-    const { createIssueTriage } = await import("./issue-triage-LMG76MBJ.js");
+    const { createIssueTriage } = await import("./issue-triage-QOD3WWIM.js");
     const triage = createIssueTriage();
     const owner = issueMatch[1] ?? "";
     const num = issueMatch[2] ?? "";
@@ -41599,7 +41599,7 @@ var VALID_TEMPLATES = /* @__PURE__ */ new Set([
 ]);
 async function classifyWithLLM(task) {
   try {
-    const { executeExpert: executeExpert2 } = await import("./expert-bridge-Z4P6SWIU.js");
+    const { executeExpert: executeExpert2 } = await import("./expert-bridge-MJJDMA6Z.js");
     const prompt = [
       "Classify this task into exactly one pipeline template.",
       "Templates: dev (implementation/bug fix/refactor), research (investigate/evaluate/compare),",
@@ -43240,7 +43240,7 @@ var memoryInitPromise = null;
 async function initPipelineMemory() {
   if (cachedMemory !== null) return cachedMemory;
   try {
-    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-IKTVC2GW.js");
+    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-BFT6O2F7.js");
     const { getLearningDir } = await import("./learning-persistence-M3OTCCNI.js");
     const mem = createSessionMemory2(getLearningDir());
     mem.startSession(`pipeline-${String(getTimeProvider().now())}`);
@@ -43302,7 +43302,7 @@ function recordRoutingExperience(category, success, durationMs, tokensUsed = 0,
     callRecord(routingMemoryCache);
     return;
   }
-  routingMemoryInitPromise ??= import("./routing-memory-JRCIBKFH.js").then(({ createRoutingMemory }) => {
+  routingMemoryInitPromise ??= import("./routing-memory-VBJMY6PE.js").then(({ createRoutingMemory }) => {
     routingMemoryCache ??= createRoutingMemory();
     return routingMemoryCache;
   }).catch((error) => {
@@ -43336,7 +43336,7 @@ ${text}` : "";
 }
 async function getWeatherContext() {
   try {
-    const { generateWeatherReport: generateWeatherReport2 } = await import("./weather-report-64YXR6VN.js");
+    const { generateWeatherReport: generateWeatherReport2 } = await import("./weather-report-GLZ2LI7V.js");
     const report = generateWeatherReport2({ includeAdaptive: true });
     const mappings = "recommendedMappings" in report ? report.recommendedMappings : [];
     if (!Array.isArray(mappings) || mappings.length === 0) return "";
@@ -43354,7 +43354,7 @@ ${lines}
 }
 async function getMemoryContext(task) {
   try {
-    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-IKTVC2GW.js");
+    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-BFT6O2F7.js");
     const { getLearningDir } = await import("./learning-persistence-M3OTCCNI.js");
     const memory = createSessionMemory2(getLearningDir(), { maxLearningsInContext: 10 });
     const learnings = memory.searchLearnings(task.slice(0, 200));
@@ -43466,7 +43466,7 @@ ${contextBlock}`;
       const strategy = config.votingStrategy ?? "higher_order";
       await postProgress(config, "Vote", `Running consensus with ${strategy} strategy...`);
       try {
-        const { executeVoting } = await import("./consensus-vote-VPHFIIMN.js");
+        const { executeVoting } = await import("./consensus-vote-CQBTPJRD.js");
         const votingResult = await executeVoting(
           {
             proposal: buildVoteProposal(plan, research),
@@ -43903,7 +43903,7 @@ async function searchCodebaseForTask(task) {
 }
 async function queryResearchRegistry(task) {
   try {
-    const { synthesizeResearch: synthesizeResearch2 } = await import("./research-helpers-synthesize-OFOJXMLR.js");
+    const { synthesizeResearch: synthesizeResearch2 } = await import("./research-helpers-synthesize-DTNUWPRP.js");
     const topic = task.split(/[.!?\n]/).filter((s) => s.trim().length > 10)[0]?.trim();
     if (topic === void 0) return null;
     const result = await synthesizeResearch2(topic.slice(0, 50));
@@ -43974,7 +43974,7 @@ function createScanStageWrapper() {
       try {
         const slug = ctx.task.match(/([a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+)/)?.[1];
         if (slug !== void 0) {
-          const { generateSecurityPlan: generateSecurityPlan2 } = await import("./repo-security-plan-AT5IYRHN.js");
+          const { generateSecurityPlan: generateSecurityPlan2 } = await import("./repo-security-plan-ELSKPBOD.js");
           const plan = await generateSecurityPlan2({ repo: slug, maxScanners: 10 });
           const recs = plan.recommendations.slice(0, 5).map((r) => `${r.priority}: ${r.displayName} (${r.category})`).join("; ");
           return output(PIPELINE_STATE_KEYS.FINDINGS, recs, getTimeProvider().now() - start, true);
@@ -44328,7 +44328,8 @@ function persistPrReviewRecord(opts) {
 
 // src/mcp/tools/pr-review-record-producer.ts
 function buildAndPersist(prNumber, baseSha, args) {
-  const { input, aggregate, counts, reviewCount, logger: logger58 } = args;
+  const { input, aggregate, counts, reviewCount, logger: logger58, coverage } = args;
+  const coverageSuffix = coverage?.partial === true ? ` [partial coverage: ${String(coverage.reviewedFiles)}/${String(coverage.totalFiles)} files reviewed, dropped: ${coverage.droppedFiles.join(", ")}]` : "";
   if (reviewedDiffWasTruncated(input.prDiff)) {
     logger58.warn(
       "Reviewed diff exceeds the hash byte cap; content past it is unbound in reviewedDiffHash",
@@ -44348,7 +44349,7 @@ function buildAndPersist(prNumber, baseSha, args) {
       error: counts.errorCount,
       total: reviewCount
     },
-    summary: `${aggregate.decision} (${String(counts.approveCount)} approve / ${String(counts.requestChangesCount)} request_changes / ${String(counts.abstainCount)} abstain) \u2014 ${input.prTitle}`,
+    summary: `${aggregate.decision} (${String(counts.approveCount)} approve / ${String(counts.requestChangesCount)} request_changes / ${String(counts.abstainCount)} abstain) \u2014 ${input.prTitle}${coverageSuffix}`,
     logger: logger58
   });
   if (record === void 0) {
@@ -44403,6 +44404,133 @@ function persistReviewRecord(args) {
   }
 }
 
+// src/mcp/tools/pr-review-diff-budget.ts
+var SENSITIVE_PATH_PATTERNS = Object.freeze([
+  "auth",
+  "crypto",
+  "secret",
+  "credential",
+  "security",
+  "exec",
+  "spawn",
+  "password",
+  "token",
+  ".env",
+  "permission",
+  "sql"
+]);
+function isSensitivePath(path12) {
+  const lower = path12.toLowerCase();
+  return SENSITIVE_PATH_PATTERNS.some((p) => lower.includes(p));
+}
+function byteLen(text) {
+  return Buffer.byteLength(text, "utf-8");
+}
+function extractPath(fileText) {
+  const nl = fileText.indexOf("\n");
+  const firstLine = nl === -1 ? fileText : fileText.slice(0, nl);
+  const m = /^diff --git a\/(.+?) b\/(.+)$/.exec(firstLine);
+  if (m !== null) return m[2];
+  return firstLine.replace(/^diff --git\s*/, "").trim();
+}
+function splitByFile(diff) {
+  if (diff.length === 0) return [];
+  const headerRe = /^diff --git .*$/gm;
+  const starts = [];
+  let m;
+  while ((m = headerRe.exec(diff)) !== null) {
+    starts.push(m.index);
+  }
+  if (starts.length === 0) {
+    return [{ path: "(unstructured)", text: diff, bytes: byteLen(diff) }];
+  }
+  const files = [];
+  const firstStart = starts[0];
+  if (firstStart > 0) {
+    const text = diff.slice(0, firstStart);
+    files.push({ path: "(preamble)", text, bytes: byteLen(text) });
+  }
+  for (let i = 0; i < starts.length; i++) {
+    const start = starts[i];
+    const end = i + 1 < starts.length ? starts[i + 1] : diff.length;
+    const text = diff.slice(start, end);
+    files.push({ path: extractPath(text), text, bytes: byteLen(text) });
+  }
+  return files;
+}
+function truncateWithMarker(file, budget) {
+  const marker = `
+[... TRUNCATED: file ${file.path} is ${String(file.bytes)} bytes, over the ${String(budget)}-byte review budget; showing a partial prefix \u2014 this file is listed in droppedFiles as partially-seen ...]
+`;
+  const room = Math.max(0, budget - byteLen(marker));
+  const prefix = Buffer.from(file.text, "utf-8").subarray(0, room).toString("utf-8");
+  return prefix + marker;
+}
+function securityFirstPack(files, budget) {
+  const sensitive = files.filter((f) => isSensitivePath(f.path));
+  const rest = files.filter((f) => !isSensitivePath(f.path));
+  const ordered = [...sensitive, ...rest];
+  const segments = [];
+  const reviewedFiles = [];
+  const droppedFiles = [];
+  let used = 0;
+  for (let i = 0; i < ordered.length; i++) {
+    const file = ordered[i];
+    if (used + file.bytes <= budget) {
+      segments.push(file.text);
+      reviewedFiles.push(file.path);
+      used += file.bytes;
+      continue;
+    }
+    if (used === 0) {
+      segments.push(truncateWithMarker(file, budget));
+      reviewedFiles.push(file.path);
+      droppedFiles.push(file.path);
+    } else {
+      droppedFiles.push(file.path);
+    }
+    for (let j = i + 1; j < ordered.length; j++) {
+      droppedFiles.push(ordered[j].path);
+    }
+    break;
+  }
+  return {
+    packed: segments.join(""),
+    reviewedFiles,
+    totalFiles: files.length,
+    droppedFiles,
+    partial: droppedFiles.length > 0
+  };
+}
+function packDiffForReview(prDiff, budget) {
+  if (prDiff.length <= budget) {
+    return { coverage: void 0, packedDiff: prDiff, note: "" };
+  }
+  const pack = securityFirstPack(splitByFile(prDiff), budget);
+  const coverage = {
+    reviewedFiles: pack.reviewedFiles.length,
+    totalFiles: pack.totalFiles,
+    droppedFiles: pack.droppedFiles,
+    partial: pack.partial,
+    strategy: "budget"
+  };
+  const note = pack.partial ? `> NOTE: partial review \u2014 ${String(pack.reviewedFiles.length)} of ${String(pack.totalFiles)} files reviewed (security-prioritized; lowest-priority dropped): ${pack.droppedFiles.join(", ")}
+
+` : "";
+  return { coverage, packedDiff: pack.packed, note };
+}
+function applyPartialCoverageGate(aggregate, coverage) {
+  if (coverage?.partial !== true) return aggregate;
+  if (aggregate.decision === "approve" && aggregate.verified) {
+    return {
+      decision: "abstain",
+      verified: false,
+      reason: `no_quorum: partial diff \u2014 ${String(coverage.reviewedFiles)} of ${String(coverage.totalFiles)} files reviewed`
+    };
+  }
+  return aggregate;
+}
+
 // src/mcp/tools/pr-review-tool.ts
 var PR_REVIEW_ROLES = [
   "architect",
@@ -44412,13 +44540,16 @@ var PR_REVIEW_ROLES = [
   "scope_steward"
 ];
 var MAX_DIFF_LENGTH = 5e4;
+var MAX_DIFF_INPUT_LENGTH = 2e6;
 var MAX_REPO_CONTEXT_LENGTH = 2e3;
 var MAX_DESCRIPTION_LENGTH = 1e4;
 var PR_REVIEW_ASYNC_HINT = "A pr_review run fans out to 5 live LLM voters and can exceed the synchronous MCP request timeout. Retry with `dispatch: 'async'` to get a jobId immediately, then poll get_job_result({ jobId }) for the result.";
 var PrReviewInputSchema = z91.object({
   prTitle: z91.string().min(1).max(500).describe("PR title"),
   prDescription: z91.string().max(MAX_DESCRIPTION_LENGTH).optional().describe("PR body / description"),
-  prDiff: z91.string().min(1).max(MAX_DIFF_LENGTH).describe(`Unified diff text (max ${String(MAX_DIFF_LENGTH)} chars; truncate before calling)`),
+  prDiff: z91.string().min(1).max(MAX_DIFF_INPUT_LENGTH).describe(
+    `Unified diff text (max ${String(MAX_DIFF_INPUT_LENGTH)} chars). No need to truncate before calling: diffs over ${String(MAX_DIFF_LENGTH)} chars are security-prioritized and PARTIALLY reviewed (lowest-priority whole files dropped; coverage reported on the response, and a partial review can block but never verified-approve).`
+  ),
   repoContext: z91.string().max(MAX_REPO_CONTEXT_LENGTH).optional().describe(
     `Optional one-paragraph repo context (architecture, conventions; max ${String(MAX_REPO_CONTEXT_LENGTH)} chars; trim before calling)`
   ),
@@ -44591,19 +44722,36 @@ function summarizeReviews(reviews) {
     errorCount: reviews.filter((r) => r.source === "error").length
   };
 }
-function aggregateWithTelemetry(reviews, errorPolicy, errorCount, logger58) {
-  const aggregate = aggregatePrDecisions(reviews, errorPolicy);
-  if (aggregate.reason !== void 0) {
+function resolveAggregate(reviews, input, errorCount, coverage, logger58) {
+  const preGate = aggregatePrDecisions(reviews, input.errorPolicy);
+  if (preGate.reason !== void 0) {
     logger58.warn("pr_review degraded to no_quorum under absolute_quorum (#4132)", {
-      reason: aggregate.reason,
+      reason: preGate.reason,
       errorCount
     });
   }
+  const aggregate = applyPartialCoverageGate(preGate, coverage);
+  if (aggregate !== preGate) {
+    logger58.warn(
+      "pr_review partial review barred from verified-approve \u2014 degraded to no_quorum (#4140)",
+      { reason: aggregate.reason }
+    );
+  }
   return aggregate;
 }
+function preparePanelProposal(input, logger58) {
+  const { coverage, packedDiff, note } = packDiffForReview(input.prDiff, MAX_DIFF_LENGTH);
+  const body = coverage === void 0 ? input : { ...input, prDiff: packedDiff };
+  if (coverage?.partial === true) {
+    logger58.warn(
+      `pr_review diff over budget \u2014 reviewed ${String(coverage.reviewedFiles)} of ${String(coverage.totalFiles)} files, dropped ${String(coverage.droppedFiles.length)}`
+    );
+  }
+  return { proposal: note + buildPrReviewProposal(body), coverage };
+}
 async function executePrReviewBody(input, logger58, gatewayAdapters) {
   const start = Date.now();
-  const proposal = buildPrReviewProposal(input);
+  const { proposal, coverage } = preparePanelProposal(input, logger58);
   const voteResults = await collectRealVotes({
     roles: PR_REVIEW_ROLES,
     proposal,
@@ -44613,7 +44761,7 @@ async function executePrReviewBody(input, logger58, gatewayAdapters) {
   });
   const reviews = voteResults.map(toPrReviewVote);
   const counts = summarizeReviews(reviews);
-  const aggregate = aggregateWithTelemetry(reviews, input.errorPolicy, counts.errorCount, logger58);
+  const aggregate = resolveAggregate(reviews, input, counts.errorCount, coverage, logger58);
   let costSummary;
   try {
     costSummary = recordDecisionCost({
@@ -44631,7 +44779,8 @@ async function executePrReviewBody(input, logger58, gatewayAdapters) {
     aggregate,
     counts,
     reviewCount: reviews.length,
-    logger: logger58
+    logger: logger58,
+    ...coverage !== void 0 ? { coverage } : {}
   });
   const response = {
     summary: aggregate.decision,
@@ -44640,7 +44789,8 @@ async function executePrReviewBody(input, logger58, gatewayAdapters) {
     reviews,
     totalDurationMs: Date.now() - start,
     ...costSummary !== void 0 ? { costSummary } : {},
-    recordOutcome: recordOutcome3
+    recordOutcome: recordOutcome3,
+    ...coverage !== void 0 ? { coverage } : {}
   };
   return toolSuccess(JSON.stringify(response, null, 2));
 }
@@ -46460,7 +46610,7 @@ var GitHubTaskTracker = class {
   cachedProvider = null;
   async getProvider() {
     if (this.cachedProvider !== null) return this.cachedProvider;
-    const { createScmProvider } = await import("./factory-P7LP5K4O.js");
+    const { createScmProvider } = await import("./factory-RS462DMM.js");
     const result = await createScmProvider({ repo: this.config.repo ?? "" });
     if (!result.ok) throw new Error(`SCM provider error: ${result.error.message}`);
     this.cachedProvider = result.value;
@@ -47233,7 +47383,7 @@ async function probeSource(source, includeModelIds) {
   }
 }
 async function defaultSources(includeOpenRouter) {
-  const { createAllAdapters: createAllAdapters2 } = await import("./factory-COS3CBV3.js");
+  const { createAllAdapters: createAllAdapters2 } = await import("./factory-2XKATTCM.js");
   const adapters = createAllAdapters2();
   return buildDefaultModelSources(adapters, { includeOpenRouter });
 }
@@ -51296,4 +51446,4 @@ export {
   shutdownFeedbackSubscriber,
   createEventBusBridge
 };
-//# sourceMappingURL=chunk-C6S6L5WB.js.map
+//# sourceMappingURL=chunk-3P5WC7AV.js.map