nexus-agents 2.176.1 → 2.176.2

package/dist/{chunk-2AFKZAXN.js → chunk-6HBMN6GZ.js}

@@ -21,7 +21,7 @@ import {
   DEFAULT_TASK_TTL_MS,
   DEFAULT_TOOL_RATE_LIMITS,
   clampTaskTtl
-} from "./chunk-OKERZLJQ.js";
+} from "./chunk-LGBCHTC6.js";
 import {
   executeExpert
 } from "./chunk-G5URP3V7.js";
@@ -46565,6 +46565,18 @@ function buildPrReviewRecord(input) {
   };
   return { ...payload, hash: computePrReviewRecordHash(payload) };
 }
+function isUnderTestRunner() {
+  return process.env["VITEST"] !== void 0 || process.env["NODE_ENV"] === "test";
+}
+function assertNotSourceCheckoutWrite(filePath) {
+  if (!isUnderTestRunner()) return;
+  const here = findRepoRoot(process.cwd());
+  if (here === null) return;
+  if (resolve13(filePath) !== resolve13(join9(here, PR_REVIEW_RECORDS_REL_PATH))) return;
+  throw new Error(
+    `Refusing to write ${filePath} from a test run (#4415): this is the source checkout's tracked, hash-chained audit file, and a fabricated record that chains cleanly is indistinguishable from a real verdict. Pass repoPath to a throwaway repo, or set NEXUS_PR_REVIEW_RECORDS_PATH.`
+  );
+}
 function resolvePrReviewRecordsPath(repoPathOverride) {
   const envPath = process.env[PR_REVIEW_RECORDS_PATH_ENV];
   if (envPath !== void 0 && envPath.trim() !== "") {
@@ -46619,6 +46631,7 @@ function persistPrReviewRecord(opts) {
     });
     return void 0;
   }
+  assertNotSourceCheckoutWrite(filePath);
   try {
     mkdirSync6(dirname4(filePath), { recursive: true });
     const { maxSequence, lastHash } = readPrReviewLedgerTip(filePath, logger58);
@@ -54123,4 +54136,4 @@ export {
   shutdownFeedbackSubscriber,
   createEventBusBridge
 };
-//# sourceMappingURL=chunk-2AFKZAXN.js.map
+//# sourceMappingURL=chunk-6HBMN6GZ.js.map