nexus-agents 2.89.2 → 2.91.0

package/dist/{chunk-5X7GAOVZ.js → chunk-DH4V6S5K.js}

@@ -40,7 +40,7 @@ import {
 } from "./chunk-CH7QIDHQ.js";
 
 // src/version.ts
-var VERSION = true ? "2.89.2" : "dev";
+var VERSION = true ? "2.91.0" : "dev";
 
 // src/config/schemas-core.ts
 import { z } from "zod";
@@ -2096,7 +2096,7 @@ async function runDoctorFix(result) {
   writeLine2("\u2500".repeat(40));
   let fixCount = 0;
   if (!result.dataDirectory.rootExists || result.dataDirectory.subdirectories.some((d) => !d.exists || !d.writable)) {
-    const { runSetup } = await import("./setup-command-MXUNSSNJ.js");
+    const { runSetup } = await import("./setup-command-B5QPHCKY.js");
     const setupResult = runSetup({
       skipMcp: true,
       skipRules: true,
@@ -2208,4 +2208,4 @@ export {
   startStdioServer,
   closeServer
 };
-//# sourceMappingURL=chunk-5X7GAOVZ.js.map
+//# sourceMappingURL=chunk-DH4V6S5K.js.map

package/dist/{chunk-44XYCZCU.js → chunk-PLFKZUVT.js}

@@ -55,7 +55,7 @@ import {
 import {
   IssueTriage,
   sanitizeInput
-} from "./chunk-IOXR6W24.js";
+} from "./chunk-6IV43POQ.js";
 import {
   generateSecurityPlan
 } from "./chunk-57HMLBYN.js";
@@ -82,7 +82,7 @@ import {
   DEFAULT_TASK_TTL_MS,
   DEFAULT_TOOL_RATE_LIMITS,
   clampTaskTtl
-} from "./chunk-5X7GAOVZ.js";
+} from "./chunk-DH4V6S5K.js";
 import {
   getAvailabilityCache,
   resolveFallback
@@ -42521,7 +42521,7 @@ async function tryIssueTriage(task) {
   try {
     const issueMatch = task.match(/github\.com\/([^/]+\/[^/]+)\/issues\/(\d+)/);
     if (issueMatch === null) return null;
-    const { createIssueTriage } = await import("./issue-triage-IJGC3VZJ.js");
+    const { createIssueTriage } = await import("./issue-triage-CDSHKFPP.js");
     const triage = createIssueTriage();
     const owner = issueMatch[1] ?? "";
     const num = issueMatch[2] ?? "";
@@ -51874,4 +51874,4 @@ export {
   detectBackend,
   createTaskTracker
 };
-//# sourceMappingURL=chunk-44XYCZCU.js.map
+//# sourceMappingURL=chunk-PLFKZUVT.js.map

package/dist/{chunk-SCZOD5XC.js → chunk-W7YQOXCJ.js}

@@ -8,7 +8,7 @@ import {
   checkSqlite,
   defaultConfig,
   initDataDirectories
-} from "./chunk-5X7GAOVZ.js";
+} from "./chunk-DH4V6S5K.js";
 import {
   probeAllClis
 } from "./chunk-X5BQF6HM.js";
@@ -1987,4 +1987,4 @@ export {
   setupCommand,
   setupCommandAsync
 };
-//# sourceMappingURL=chunk-SCZOD5XC.js.map
+//# sourceMappingURL=chunk-W7YQOXCJ.js.map

package/dist/cli.js

@@ -22,7 +22,7 @@ import {
 import {
   setupCommandAsync,
   verifyCommand
-} from "./chunk-SCZOD5XC.js";
+} from "./chunk-W7YQOXCJ.js";
 import "./chunk-2SMTCNXP.js";
 import {
   AuthHandler,
@@ -162,7 +162,7 @@ import {
   validateCommand,
   validateWorkflow,
   wrapInMarkdownFence
-} from "./chunk-44XYCZCU.js";
+} from "./chunk-PLFKZUVT.js";
 import {
   resolveToken
 } from "./chunk-EAT4GTMT.js";
@@ -207,7 +207,7 @@ import {
   evaluatePolicy,
   parsePRUrl,
   sanitizeInput
-} from "./chunk-IOXR6W24.js";
+} from "./chunk-6IV43POQ.js";
 import "./chunk-EFHZHCF2.js";
 import "./chunk-57HMLBYN.js";
 import "./chunk-HFOQKCD2.js";
@@ -235,7 +235,7 @@ import {
   loadConfig,
   runDoctor,
   validateNexusEnv
-} from "./chunk-5X7GAOVZ.js";
+} from "./chunk-DH4V6S5K.js";
 import "./chunk-SFZESA5O.js";
 import "./chunk-6Q33PBXC.js";
 import {

package/dist/index.d.ts

@@ -28025,10 +28025,17 @@ type SuspiciousSignal = z.infer<typeof SuspiciousSignalSchema>;
  */
 interface GitHubUserMetadata {
     readonly username: string;
-    readonly accountAgeDays: number;
-    readonly priorContributions: number;
-    readonly recentCommentCount: number;
-    readonly recentCommentWindowMinutes: number;
+    /**
+     * Account/activity fields are OPTIONAL (#3106). When a field is absent (the
+     * caller couldn't fetch it — e.g. the firewall before Phase 3 wiring), its
+     * signal is SKIPPED rather than fabricated: an unknown value must never be
+     * treated as benign (the old hardcoded `365`/`0`) nor as hostile. Only the
+     * `authorAssociation` + `injectionFlags` signals fire on absent activity data.
+     */
+    readonly accountAgeDays?: number;
+    readonly priorContributions?: number;
+    readonly recentCommentCount?: number;
+    readonly recentCommentWindowMinutes?: number;
     readonly authorAssociation: string;
     readonly injectionFlags: readonly InjectionFlag[];
 }
@@ -28329,6 +28336,14 @@ interface FirewallResult {
     readonly sanitized: SanitizedInput;
     readonly trust: ClassifyResult;
     readonly reputation?: ReputationAssessment;
+    /**
+     * The tier consumers should ENFORCE on (#3106): the classifier tier
+     * reconciled with the reputation assessment (demotion-only; Tier-1/allowlist
+     * wins; equals `trust.trustTier` when reputation is absent). Previously the
+     * reputation tier was computed but dropped — `trust.trustTier` alone left
+     * reputation unenforced.
+     */
+    readonly effectiveTrustTier: TrustTier;
     readonly atl: string;
     readonly auditEvents: readonly {
         readonly id: string;

package/dist/index.js

@@ -519,7 +519,7 @@ import {
   validateWorkflow,
   validateWorkflowDependencies,
   withLogging
-} from "./chunk-44XYCZCU.js";
+} from "./chunk-PLFKZUVT.js";
 import {
   getTokenEnvVars,
   hasToken,
@@ -688,12 +688,13 @@ import {
   isMutatingAction,
   isReadOnlyAction,
   mapAuthorAssociation,
+  reconcileTrustTier,
   requiresCitation,
   requiresCorroboration,
   sanitizeInput,
   validateAgentAction,
   validateCorroboration
-} from "./chunk-IOXR6W24.js";
+} from "./chunk-6IV43POQ.js";
 import {
   GitHubProvider,
   ScmError
@@ -737,7 +738,7 @@ import {
   getKnownNexusVarNames,
   startStdioServer,
   validateNexusEnv
-} from "./chunk-5X7GAOVZ.js";
+} from "./chunk-DH4V6S5K.js";
 import {
   AvailabilityCache,
   filterAvailableModels,
@@ -4183,12 +4184,14 @@ var HostileInputFirewall = class {
     const sanitized = this.runSanitization(meta);
     const trust = this.runClassification(meta, sanitized);
     const reputation = this.runReputation(meta, sanitized);
-    const atl = this.buildATL(meta, trust, sanitized, reputation);
+    const effectiveTrustTier = reconcileTrustTier(trust.trustTier, reputation);
+    const atl = this.buildATL(meta, effectiveTrustTier, sanitized, reputation);
     const auditEvents = this.auditTrail.query().map((e) => ({ id: e.id, type: e.type }));
     return ok({
       sanitized,
       trust,
       ...reputation !== void 0 ? { reputation } : {},
+      effectiveTrustTier,
       atl,
       auditEvents,
       durationMs: Date.now() - start
@@ -4266,10 +4269,6 @@ var HostileInputFirewall = class {
     if (!this.stages.reputationAssessment) return void 0;
     const metadata = {
       username: meta.username,
-      accountAgeDays: 365,
-      priorContributions: 0,
-      recentCommentCount: 0,
-      recentCommentWindowMinutes: 60,
       authorAssociation: meta.authorAssociation.toUpperCase(),
       injectionFlags: sanitized.injectionFlags
     };
@@ -4285,9 +4284,9 @@ var HostileInputFirewall = class {
     }
     return result;
   }
-  buildATL(meta, trust, sanitized, reputation) {
+  buildATL(meta, effectiveTrustTier, sanitized, reputation) {
     const data = {
-      tier: trust.trustTier,
+      tier: effectiveTrustTier,
       source: meta.sourceType,
       user: meta.username,
       sanitized: sanitized.wasModified,