nexus-agents 2.90.0 → 2.92.0

package/dist/{chunk-L3S7HOAS.js → chunk-L6JZCAFH.js}

@@ -3,332 +3,22 @@ import {
   ScmError
 } from "./chunk-EFHZHCF2.js";
 import {
-  CACHE_TIMEOUTS,
+  ROLE_DEFAULT_TRUST,
+  ReputationCache,
+  TRUST_TIER_NUMERIC,
+  TrustTierSchema,
+  assessReputation,
+  gateWithReputation,
+  resolveReputationGatingMode,
+  sanitizeInput
+} from "./chunk-NR4NSTJH.js";
+import {
   createLogger,
   err,
   getTimeProvider,
   ok
 } from "./chunk-W5I6L4UT.js";
 
-// src/security/trust-types.ts
-import { z } from "zod";
-var TrustTierSchema = z.enum(["1", "2", "3", "4"]);
-var TRUST_TIER_NUMERIC = {
-  "1": 1,
-  "2": 2,
-  "3": 3,
-  "4": 4
-};
-var GitHubUserRoleSchema = z.enum([
-  "owner",
-  "maintainer",
-  "collaborator",
-  "contributor",
-  "member",
-  "unknown"
-]);
-var ROLE_DEFAULT_TRUST = {
-  owner: "1",
-  maintainer: "1",
-  collaborator: "2",
-  contributor: "2",
-  member: "3",
-  unknown: "3"
-};
-var InjectionFlagSchema = z.enum([
-  "authority_claim",
-  "instruction_pattern",
-  "system_prompt_manipulation",
-  "hidden_content",
-  "urgency_manipulation",
-  "fake_conversation",
-  "base64_encoded",
-  "external_link_instruction"
-]);
-var StrippedElementSchema = z.object({
-  /** Type of element stripped. */
-  tag: z.string().min(1),
-  /** Reason for stripping. */
-  reason: z.string().min(1),
-  /** Start index in original content. */
-  startIndex: z.number().int().nonnegative(),
-  /** Length of stripped content. */
-  length: z.number().int().positive()
-});
-var SanitizedInputSchema = z.object({
-  /** Sanitized content with dangerous elements removed. */
-  content: z.string(),
-  /** Original content before sanitization (for audit). */
-  originalLength: z.number().int().nonnegative(),
-  /** Assigned trust tier based on user role and content analysis. */
-  trustTier: TrustTierSchema,
-  /** GitHub user role of the input source. */
-  userRole: GitHubUserRoleSchema,
-  /** Injection patterns detected in content. */
-  injectionFlags: z.array(InjectionFlagSchema),
-  /** Elements stripped during sanitization (audit trail). */
-  strippedElements: z.array(StrippedElementSchema),
-  /** Whether any dangerous content was detected and stripped. */
-  wasModified: z.boolean(),
-  /** Timestamp of sanitization (ISO 8601). */
-  sanitizedAt: z.iso.datetime()
-});
-var SanitizerConfigSchema = z.object({
-  /** GitHub usernames that are always Tier 1 (allowlisted maintainers). */
-  allowlistedMaintainers: z.array(z.string().min(1)).default([]),
-  /** Whether to fail open (log only) or fail closed (block). Phase 1 = open. */
-  failOpen: z.boolean().default(true),
-  /** Maximum input length before truncation. */
-  maxInputLength: z.number().int().positive().default(5e4)
-});
-
-// src/security/input-sanitizer.ts
-var DANGEROUS_HTML_PATTERN = /<(picture|source|img)\b[^>]*>[\s\S]*?<\/\1>|<(picture|source|img)\b[^>]*\/?>/gi;
-var XML_INJECTION_PATTERN = /<\/?(system|human|assistant|instructions|user|prompt|context|tool_use|tool_result)\b[^>]*>/gi;
-var HTML_COMMENT_PATTERN = /<!--[\s\S]*?-->/g;
-var INJECTION_PATTERNS = [
-  {
-    flag: "authority_claim",
-    pattern: /\b(as (?:a|the) (?:maintainer|admin|owner|security lead|repo owner|developer))\b/i
-  },
-  {
-    flag: "authority_claim",
-    pattern: /\b(i(?:'m| am) the (?:repo |project )?(?:owner|maintainer|admin))\b/i
-  },
-  {
-    flag: "instruction_pattern",
-    pattern: /\b(please (?:close|merge|label|mark|apply|delete|remove|approve|reject))\b/i
-  },
-  {
-    flag: "instruction_pattern",
-    pattern: /\b(you (?:should|must|need to) (?:close|merge|label|apply|delete))\b/i
-  },
-  {
-    flag: "system_prompt_manipulation",
-    pattern: /\b(ignore (?:all )?previous (?:instructions|rules|prompts))\b/i
-  },
-  {
-    flag: "system_prompt_manipulation",
-    pattern: /\b(forget (?:your |all )?(?:instructions|rules|safety))\b/i
-  },
-  {
-    flag: "system_prompt_manipulation",
-    pattern: /\b(new (?:instructions|rules|system prompt|directives))\b/i
-  },
-  {
-    flag: "urgency_manipulation",
-    pattern: /\b(critical|emergency|urgent|must act now|immediately|time[- ]?sensitive)\b/i
-  },
-  {
-    flag: "fake_conversation",
-    pattern: /<(?:assistant|human|user|system)>/i
-  },
-  // base64_encoded is detected separately by `looksLikeBase64Payload` below.
-  // The lookahead-based regex it replaced exhibited catastrophic backtracking
-  // on long hex-only inputs (#2191) — see `looksLikeBase64Payload` for the
-  // two-phase rewrite that preserves the #1811 SHA-hash false-positive guard.
-  {
-    flag: "external_link_instruction",
-    pattern: /(?:apply|run|execute|install)\s+(?:this\s+)?(?:from\s+)?https?:\/\//i
-  }
-];
-var BASE64_RUN_GLOBAL = /[A-Za-z0-9+/]{40,}={0,2}/g;
-var BASE64_DISCRIMINATOR = /[g-zG-Z+/=]/;
-function looksLikeBase64Payload(content) {
-  for (const match of content.matchAll(BASE64_RUN_GLOBAL)) {
-    if (BASE64_DISCRIMINATOR.test(match[0])) return true;
-  }
-  return false;
-}
-var DANGEROUS_TAG_NAMES = "picture|source|img|system|human|assistant|instructions|user|prompt|context|tool_use|tool_result";
-var ENCODED_DANGEROUS_TAG_PATTERN = new RegExp(
-  `&(?:lt|#0*60|#x0*3c);\\s*\\/?\\s*(?:${DANGEROUS_TAG_NAMES})\\b`,
-  "i"
-);
-function decodeEntities(content) {
-  return content.replace(/&#(\d+);/g, (_match, dec) => {
-    const code = Number.parseInt(dec, 10);
-    return Number.isFinite(code) ? String.fromCodePoint(code) : _match;
-  }).replace(/&#x([0-9a-f]+);/gi, (_match, hex) => {
-    const code = Number.parseInt(hex, 16);
-    return Number.isFinite(code) ? String.fromCodePoint(code) : _match;
-  }).replace(/&lt;/gi, "<").replace(/&gt;/gi, ">").replace(/&quot;/gi, '"').replace(/&apos;/gi, "'").replace(/&amp;/gi, "&");
-}
-function applyEntityEvasionDefense(content) {
-  if (!ENCODED_DANGEROUS_TAG_PATTERN.test(content)) {
-    return { cleaned: content, stripped: [] };
-  }
-  const decoded = decodeEntities(content);
-  return {
-    cleaned: decoded,
-    stripped: [
-      {
-        tag: "&\u2026;",
-        reason: "HTML entity-encoded dangerous tag decoded for stripping (CWE-79)",
-        startIndex: 0,
-        length: content.length
-      }
-    ]
-  };
-}
-function stripDangerousHtml(content) {
-  const stripped = [];
-  let cleaned = content;
-  const MAX_PASSES = 5;
-  for (let pass = 0; pass < MAX_PASSES; pass++) {
-    DANGEROUS_HTML_PATTERN.lastIndex = 0;
-    if (!DANGEROUS_HTML_PATTERN.test(cleaned)) break;
-    cleaned = cleaned.replace(DANGEROUS_HTML_PATTERN, (match, _g1, _g2, offset) => {
-      stripped.push({
-        tag: match.slice(0, 30) + (match.length > 30 ? "..." : ""),
-        reason: "Dangerous HTML tag (Trail of Bits injection vector)",
-        startIndex: offset,
-        length: match.length
-      });
-      return "";
-    });
-  }
-  return { cleaned, stripped };
-}
-function stripXmlTags(content) {
-  const stripped = [];
-  let cleaned = content;
-  const MAX_PASSES = 5;
-  for (let pass = 0; pass < MAX_PASSES; pass++) {
-    XML_INJECTION_PATTERN.lastIndex = 0;
-    if (!XML_INJECTION_PATTERN.test(cleaned)) break;
-    cleaned = cleaned.replace(XML_INJECTION_PATTERN, (match, _g1, offset) => {
-      stripped.push({
-        tag: match,
-        reason: "XML-like conversation injection tag",
-        startIndex: offset,
-        length: match.length
-      });
-      return "";
-    });
-  }
-  return { cleaned, stripped };
-}
-function stripHtmlComments(content) {
-  const stripped = [];
-  let cleaned = content;
-  const MAX_PASSES = 5;
-  for (let pass = 0; pass < MAX_PASSES; pass++) {
-    HTML_COMMENT_PATTERN.lastIndex = 0;
-    const prevLength = cleaned.length;
-    cleaned = cleaned.replace(HTML_COMMENT_PATTERN, (match, offset) => {
-      const hasInstruction = /\b(ignore|execute|close|merge|delete|apply)\b/i.test(match);
-      if (!hasInstruction) return match;
-      stripped.push({
-        tag: "<!-- ... -->",
-        reason: "HTML comment with instruction-like content",
-        startIndex: offset,
-        length: match.length
-      });
-      return "";
-    });
-    if (cleaned.length === prevLength) break;
-  }
-  let searchFrom = 0;
-  while (searchFrom < cleaned.length) {
-    const openIdx = cleaned.indexOf("<!--", searchFrom);
-    if (openIdx === -1) break;
-    const closeIdx = cleaned.indexOf("-->", openIdx + 4);
-    if (closeIdx === -1) {
-      stripped.push({
-        tag: "<!--",
-        reason: "Unclosed HTML comment (potential injection vector)",
-        startIndex: openIdx,
-        length: cleaned.length - openIdx
-      });
-      cleaned = cleaned.slice(0, openIdx);
-      break;
-    }
-    searchFrom = closeIdx + 3;
-  }
-  return { cleaned, stripped };
-}
-function detectInjectionPatterns(content) {
-  const flags = /* @__PURE__ */ new Set();
-  for (const { flag, pattern } of INJECTION_PATTERNS) {
-    pattern.lastIndex = 0;
-    if (pattern.test(content)) {
-      flags.add(flag);
-    }
-  }
-  if (looksLikeBase64Payload(content)) {
-    flags.add("base64_encoded");
-  }
-  return Array.from(flags);
-}
-function normalizeRole(userRole) {
-  const lower = userRole.toLowerCase();
-  if (lower in ROLE_DEFAULT_TRUST) return lower;
-  return "unknown";
-}
-function assignTrustTier(userRole, injectionFlags, allowlisted) {
-  if (allowlisted) return "1";
-  const normalizedRole = normalizeRole(userRole);
-  const baseTier = ROLE_DEFAULT_TRUST[normalizedRole];
-  const hostileFlags = ["system_prompt_manipulation", "fake_conversation"];
-  if (injectionFlags.some((f) => hostileFlags.includes(f))) return "4";
-  if (injectionFlags.includes("authority_claim") && normalizedRole !== "owner" && normalizedRole !== "maintainer") {
-    return "4";
-  }
-  return baseTier;
-}
-function sanitizeInput(content, userRole, username, config) {
-  const cfg = SanitizerConfigSchema.parse(config ?? {});
-  const truncated = content.slice(0, cfg.maxInputLength);
-  const allowlisted = cfg.allowlistedMaintainers.includes(username);
-  try {
-    const entityDecoded = applyEntityEvasionDefense(truncated);
-    const html = stripDangerousHtml(entityDecoded.cleaned);
-    const xml = stripXmlTags(html.cleaned);
-    const comments = stripHtmlComments(xml.cleaned);
-    const allStripped = [
-      ...entityDecoded.stripped,
-      ...html.stripped,
-      ...xml.stripped,
-      ...comments.stripped
-    ];
-    const injectionFlags = detectInjectionPatterns(truncated);
-    const trustTier = assignTrustTier(userRole, injectionFlags, allowlisted);
-    return {
-      content: comments.cleaned,
-      originalLength: content.length,
-      trustTier,
-      userRole,
-      injectionFlags,
-      strippedElements: allStripped,
-      wasModified: allStripped.length > 0,
-      sanitizedAt: (/* @__PURE__ */ new Date()).toISOString()
-    };
-  } catch (err2) {
-    return buildFailClosedResult(err2, content, truncated, userRole, allowlisted);
-  }
-}
-function buildFailClosedResult(err2, originalContent, truncated, userRole, allowlisted) {
-  const message = err2 instanceof Error ? err2.message : String(err2);
-  return {
-    content: "",
-    originalLength: originalContent.length,
-    trustTier: allowlisted ? "1" : "4",
-    userRole,
-    injectionFlags: [],
-    strippedElements: [
-      {
-        tag: "(pipeline-failure)",
-        reason: `Sanitizer pipeline threw; input discarded as fail-closed: ${message}`,
-        startIndex: 0,
-        length: truncated.length
-      }
-    ],
-    wasModified: true,
-    sanitizedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-}
-
 // src/security/trust-classifier.ts
 function mapAuthorAssociation(association) {
   switch (association.toUpperCase()) {
@@ -413,106 +103,106 @@ function getRequiredTrustTier(actionType) {
 }
 
 // src/security/policy-gate.ts
-import { z as z3 } from "zod";
+import { z as z2 } from "zod";
 
 // src/security/action-schema.ts
-import { z as z2 } from "zod";
-var RepoFileSource = z2.object({
-  type: z2.literal("repoFile"),
-  path: z2.string().min(1),
-  line: z2.number().int().positive().optional(),
-  commit: z2.string().regex(/^[a-f0-9]{7,40}$/).optional()
+import { z } from "zod";
+var RepoFileSource = z.object({
+  type: z.literal("repoFile"),
+  path: z.string().min(1),
+  line: z.number().int().positive().optional(),
+  commit: z.string().regex(/^[a-f0-9]{7,40}$/).optional()
 });
-var IssueCommentSource = z2.object({
-  type: z2.literal("issueComment"),
-  issueNumber: z2.number().int().positive(),
-  commentId: z2.number().int().positive(),
-  author: z2.string().min(1),
+var IssueCommentSource = z.object({
+  type: z.literal("issueComment"),
+  issueNumber: z.number().int().positive(),
+  commentId: z.number().int().positive(),
+  author: z.string().min(1),
   authorTrustTier: TrustTierSchema
 });
-var CIResultSource = z2.object({
-  type: z2.literal("ciResult"),
-  runId: z2.number().int().positive(),
-  status: z2.enum(["pass", "fail"]),
-  job: z2.string().min(1)
+var CIResultSource = z.object({
+  type: z.literal("ciResult"),
+  runId: z.number().int().positive(),
+  status: z.enum(["pass", "fail"]),
+  job: z.string().min(1)
 });
-var PolicyDocSource = z2.object({
-  type: z2.literal("policyDoc"),
-  path: z2.string().min(1),
-  section: z2.string().min(1)
+var PolicyDocSource = z.object({
+  type: z.literal("policyDoc"),
+  path: z.string().min(1),
+  section: z.string().min(1)
 });
-var MaintainerCommandSource = z2.object({
-  type: z2.literal("maintainerCommand"),
-  username: z2.string().min(1),
-  commentId: z2.number().int().positive()
+var MaintainerCommandSource = z.object({
+  type: z.literal("maintainerCommand"),
+  username: z.string().min(1),
+  commentId: z.number().int().positive()
 });
-var SourceCitationSchema = z2.discriminatedUnion("type", [
+var SourceCitationSchema = z.discriminatedUnion("type", [
   RepoFileSource,
   IssueCommentSource,
   CIResultSource,
   PolicyDocSource,
   MaintainerCommandSource
 ]);
-var SummarizeIssueAction = z2.object({
-  type: z2.literal("SummarizeIssue"),
-  summary: z2.string().min(10).max(2e3),
-  sources: z2.array(SourceCitationSchema).min(1).max(20)
+var SummarizeIssueAction = z.object({
+  type: z.literal("SummarizeIssue"),
+  summary: z.string().min(10).max(2e3),
+  sources: z.array(SourceCitationSchema).min(1).max(20)
 });
-var ProposeLabelsAction = z2.object({
-  type: z2.literal("ProposeLabels"),
-  labels: z2.array(z2.string()).min(1).max(5),
-  reason: z2.string().min(10).max(500),
-  sources: z2.array(SourceCitationSchema).min(1).max(20)
+var ProposeLabelsAction = z.object({
+  type: z.literal("ProposeLabels"),
+  labels: z.array(z.string()).min(1).max(5),
+  reason: z.string().min(10).max(500),
+  sources: z.array(SourceCitationSchema).min(1).max(20)
 });
-var DraftReplyAction = z2.object({
-  type: z2.literal("DraftReply"),
-  body: z2.string().min(10).max(2e3),
-  requiresApproval: z2.literal(true),
-  sources: z2.array(SourceCitationSchema).min(1).max(20)
+var DraftReplyAction = z.object({
+  type: z.literal("DraftReply"),
+  body: z.string().min(10).max(2e3),
+  requiresApproval: z.literal(true),
+  sources: z.array(SourceCitationSchema).min(1).max(20)
 });
-var RequestHumanApprovalAction = z2.object({
-  type: z2.literal("RequestHumanApproval"),
-  reason: z2.string().min(10).max(500),
-  context: z2.string().min(10).max(2e3)
+var RequestHumanApprovalAction = z.object({
+  type: z.literal("RequestHumanApproval"),
+  reason: z.string().min(10).max(500),
+  context: z.string().min(10).max(2e3)
 });
-var GeneratePatchPlanAction = z2.object({
-  type: z2.literal("GeneratePatchPlan"),
-  files: z2.array(
-    z2.object({
-      path: z2.string().min(1),
-      operation: z2.enum(["modify", "create", "delete"]),
-      description: z2.string().min(10).max(500)
+var GeneratePatchPlanAction = z.object({
+  type: z.literal("GeneratePatchPlan"),
+  files: z.array(
+    z.object({
+      path: z.string().min(1),
+      operation: z.enum(["modify", "create", "delete"]),
+      description: z.string().min(10).max(500)
     })
   ).min(1).max(10),
-  rationale: z2.string().min(10).max(1e3),
-  requiresApproval: z2.literal(true),
-  sources: z2.array(SourceCitationSchema).min(2).max(20)
+  rationale: z.string().min(10).max(1e3),
+  requiresApproval: z.literal(true),
+  sources: z.array(SourceCitationSchema).min(2).max(20)
 });
-var ClassifyIssueAction = z2.object({
-  type: z2.literal("ClassifyIssue"),
-  category: z2.enum(["bug", "feature", "question", "documentation", "security", "performance"]),
-  confidence: z2.number().min(0).max(1),
-  sources: z2.array(SourceCitationSchema).min(1).max(20)
+var ClassifyIssueAction = z.object({
+  type: z.literal("ClassifyIssue"),
+  category: z.enum(["bug", "feature", "question", "documentation", "security", "performance"]),
+  confidence: z.number().min(0).max(1),
+  sources: z.array(SourceCitationSchema).min(1).max(20)
 });
-var IdentifyDuplicatesAction = z2.object({
-  type: z2.literal("IdentifyDuplicates"),
-  candidates: z2.array(z2.number().int().positive()).min(1).max(10),
-  similarity: z2.array(z2.number().min(0).max(1)),
-  sources: z2.array(SourceCitationSchema).min(1).max(20)
+var IdentifyDuplicatesAction = z.object({
+  type: z.literal("IdentifyDuplicates"),
+  candidates: z.array(z.number().int().positive()).min(1).max(10),
+  similarity: z.array(z.number().min(0).max(1)),
+  sources: z.array(SourceCitationSchema).min(1).max(20)
 });
-var RefuseActionAction = z2.object({
-  type: z2.literal("RefuseAction"),
-  reason: z2.string().min(10).max(500),
-  escalateTo: z2.enum(["maintainer", "security"])
+var RefuseActionAction = z.object({
+  type: z.literal("RefuseAction"),
+  reason: z.string().min(10).max(500),
+  escalateTo: z.enum(["maintainer", "security"])
 });
-var HandoffMessageAction = z2.object({
-  type: z2.literal("HandoffMessage"),
-  targetCapability: z2.string().min(1).max(100),
-  reason: z2.string().min(5).max(500),
-  inputTrustTier: z2.enum(["1", "2", "3", "4"]),
-  sources: z2.array(SourceCitationSchema).min(1).max(20)
+var HandoffMessageAction = z.object({
+  type: z.literal("HandoffMessage"),
+  targetCapability: z.string().min(1).max(100),
+  reason: z.string().min(5).max(500),
+  inputTrustTier: z.enum(["1", "2", "3", "4"]),
+  sources: z.array(SourceCitationSchema).min(1).max(20)
 });
-var AgentActionSchema = z2.discriminatedUnion("type", [
+var AgentActionSchema = z.discriminatedUnion("type", [
   SummarizeIssueAction,
   ProposeLabelsAction,
   DraftReplyAction,
@@ -564,13 +254,13 @@ function requiresCitation(actionType) {
 }
 
 // src/security/policy-gate.ts
-var ViolationSchema = z3.object({
+var ViolationSchema = z2.object({
   /** Machine-readable rule identifier. */
-  rule: z3.string().min(1),
+  rule: z2.string().min(1),
   /** Human-readable description of the violation. */
-  message: z3.string().min(1),
+  message: z2.string().min(1),
   /** Severity: 'block' prevents execution, 'warn' logs only. */
-  severity: z3.enum(["block", "warn"])
+  severity: z2.enum(["block", "warn"])
 });
 function getActionSources(action) {
   if ("sources" in action) {
@@ -802,193 +492,6 @@ function getCorroborationRules(actionType) {
   return ACTION_CORROBORATION_RULES[actionType];
 }
 
-// src/security/reputation-model.ts
-import { z as z4 } from "zod";
-var SuspiciousSignalSchema = z4.enum([
-  "new_account",
-  "no_prior_contributions",
-  "injection_patterns_detected",
-  "rapid_comments",
-  "mismatched_authority_claim"
-]);
-var DAYS_PER_YEAR_APPROX = 36.5;
-var SUSPICIOUS_THRESHOLDS = {
-  /** Account younger than this (days) is flagged. */
-  newAccountDays: 30,
-  /** Fewer contributions than this is flagged. */
-  minContributions: 1,
-  /** More comments than this in the window triggers rapid-comment flag. */
-  rapidCommentThreshold: 5,
-  /** Time window (minutes) for rapid comment detection. */
-  rapidCommentWindowMinutes: 10
-};
-var DEFAULT_TTL_MS = CACHE_TIMEOUTS.reputationTtlMs;
-var DEFAULT_MAX_SIZE = 1e3;
-var ReputationCache = class {
-  cache = /* @__PURE__ */ new Map();
-  ttlMs;
-  maxSize;
-  constructor(ttlMs = DEFAULT_TTL_MS, maxSize = DEFAULT_MAX_SIZE) {
-    this.ttlMs = ttlMs;
-    this.maxSize = maxSize;
-  }
-  get(username) {
-    const entry = this.cache.get(username);
-    if (entry === void 0) return void 0;
-    if (getTimeProvider().now() > entry.expiresAt) {
-      this.cache.delete(username);
-      return void 0;
-    }
-    return entry.assessment;
-  }
-  set(username, assessment) {
-    if (this.cache.size >= this.maxSize && !this.cache.has(username)) {
-      this.evictOldest();
-    }
-    this.cache.set(username, {
-      assessment,
-      expiresAt: getTimeProvider().now() + this.ttlMs
-    });
-  }
-  /** Evict a batch of oldest entries (10% of maxSize, minimum 1). */
-  evictOldest() {
-    const batchSize = Math.max(1, Math.floor(this.maxSize * 0.1));
-    const keys = this.cache.keys();
-    for (let i = 0; i < batchSize; i++) {
-      const next = keys.next();
-      if (next.done === true) break;
-      this.cache.delete(next.value);
-    }
-  }
-  clear() {
-    this.cache.clear();
-  }
-  get size() {
-    return this.cache.size;
-  }
-};
-var HOSTILE_INJECTION_FLAGS = [
-  "system_prompt_manipulation",
-  "fake_conversation",
-  "authority_claim",
-  "hidden_content"
-];
-function hasHostileInjection(flags) {
-  return flags.some((f) => HOSTILE_INJECTION_FLAGS.includes(f));
-}
-function isRapidCommenting(m) {
-  return m.recentCommentCount !== void 0 && m.recentCommentWindowMinutes !== void 0 && m.recentCommentCount > SUSPICIOUS_THRESHOLDS.rapidCommentThreshold && m.recentCommentWindowMinutes <= SUSPICIOUS_THRESHOLDS.rapidCommentWindowMinutes;
-}
-function isMismatchedAuthority(m) {
-  if (!m.injectionFlags.includes("authority_claim")) return false;
-  const association = m.authorAssociation.toUpperCase();
-  return association !== "OWNER" && association !== "MEMBER";
-}
-function detectSuspiciousSignals(metadata) {
-  const signals = [];
-  const { accountAgeDays, priorContributions } = metadata;
-  if (accountAgeDays !== void 0 && accountAgeDays < SUSPICIOUS_THRESHOLDS.newAccountDays) {
-    signals.push("new_account");
-  }
-  if (priorContributions !== void 0 && priorContributions < SUSPICIOUS_THRESHOLDS.minContributions) {
-    signals.push("no_prior_contributions");
-  }
-  if (hasHostileInjection(metadata.injectionFlags)) signals.push("injection_patterns_detected");
-  if (isRapidCommenting(metadata)) signals.push("rapid_comments");
-  if (isMismatchedAuthority(metadata)) signals.push("mismatched_authority_claim");
-  return signals;
-}
-function calculateReputationScore(metadata, signals, userRole) {
-  let score = 50;
-  const roleBonus = {
-    owner: 40,
-    maintainer: 35,
-    collaborator: 25,
-    contributor: 15,
-    member: 5,
-    unknown: 0
-  };
-  score += roleBonus[userRole];
-  if (metadata.accountAgeDays !== void 0) {
-    score += Math.min(metadata.accountAgeDays / DAYS_PER_YEAR_APPROX, 10);
-  }
-  if (metadata.priorContributions !== void 0) {
-    score += Math.min(metadata.priorContributions, 10);
-  }
-  const signalPenalty = {
-    new_account: -15,
-    no_prior_contributions: -10,
-    injection_patterns_detected: -25,
-    rapid_comments: -20,
-    mismatched_authority_claim: -30
-  };
-  for (const signal of signals) {
-    score += signalPenalty[signal];
-  }
-  return Math.max(0, Math.min(100, Math.round(score)));
-}
-function mapRole(association) {
-  switch (association.toUpperCase()) {
-    case "OWNER":
-      return "owner";
-    case "MEMBER":
-      return "member";
-    case "COLLABORATOR":
-      return "collaborator";
-    case "CONTRIBUTOR":
-      return "contributor";
-    default:
-      return "unknown";
-  }
-}
-function determineEffectiveTier(userRole, signals) {
-  const baseTier = ROLE_DEFAULT_TRUST[userRole];
-  const hostileSignals = [
-    "injection_patterns_detected",
-    "mismatched_authority_claim"
-  ];
-  if (signals.some((s) => hostileSignals.includes(s))) return "4";
-  if (signals.length >= 2) {
-    const baseNumeric = TRUST_TIER_NUMERIC[baseTier];
-    const downgraded = Math.min(baseNumeric + 1, 4);
-    return String(downgraded);
-  }
-  return baseTier;
-}
-function assessReputation(metadata, cache) {
-  const cached = cache?.get(metadata.username);
-  if (cached !== void 0) return cached;
-  const userRole = mapRole(metadata.authorAssociation);
-  const signals = detectSuspiciousSignals(metadata);
-  const score = calculateReputationScore(metadata, signals, userRole);
-  const effectiveTier = determineEffectiveTier(userRole, signals);
-  const assessment = {
-    username: metadata.username,
-    userRole,
-    suspiciousSignals: signals,
-    isSuspicious: signals.length > 0,
-    effectiveTrustTier: effectiveTier,
-    reputationScore: score,
-    reason: buildReason(userRole, signals, effectiveTier),
-    assessedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  cache?.set(metadata.username, assessment);
-  return assessment;
-}
-function reconcileTrustTier(classifierTier, reputation) {
-  if (classifierTier === "1") return "1";
-  const repTier = reputation?.effectiveTrustTier;
-  if (repTier === void 0) return classifierTier;
-  return TRUST_TIER_NUMERIC[repTier] > TRUST_TIER_NUMERIC[classifierTier] ? repTier : classifierTier;
-}
-function buildReason(role, signals, tier) {
-  if (signals.length === 0) {
-    return `Role ${role} \u2192 Tier ${tier} (no suspicious signals)`;
-  }
-  const signalList = signals.join(", ");
-  return `Role ${role} \u2192 Tier ${tier} (signals: ${signalList})`;
-}
-
 // src/scm/url-parsers.ts
 function parsePRUrl(url) {
   const httpPattern = /github\.com\/([^/]+)\/([^/]+)\/pull\/(\d+)/;
@@ -1244,7 +747,7 @@ function createFullGitHubProvider(repo) {
 }
 
 // src/dogfooding/issue-triage-types.ts
-import { z as z5 } from "zod";
+import { z as z3 } from "zod";
 var CATEGORY_DISPLAY_NAMES = {
   bug: "Bug Report",
   feature: "Feature Request",
@@ -1266,11 +769,11 @@ var DEFAULT_ISSUE_TRIAGE_CONFIG = {
   maxComments: 50,
   enableReputation: true
 };
-var IssueTriageConfigSchema = z5.object({
-  dryRun: z5.boolean().default(true),
-  githubToken: z5.string().optional(),
-  maxComments: z5.number().int().min(1).max(100).default(50),
-  enableReputation: z5.boolean().default(true)
+var IssueTriageConfigSchema = z3.object({
+  dryRun: z3.boolean().default(true),
+  githubToken: z3.string().optional(),
+  maxComments: z3.number().int().min(1).max(100).default(50),
+  enableReputation: z3.boolean().default(true)
 });
 
 // src/dogfooding/issue-triage-helpers.ts
@@ -1396,18 +899,33 @@ var IssueTriage = class {
     const { owner, repo, issueNumber } = parseResult.value;
     const fetchResult = await this.fetchIssueData(owner, repo, issueNumber);
     if (!fetchResult.ok) return fetchResult;
-    const { issue: issueResult, comments } = fetchResult.value;
+    const { issue: issueResult, comments, accountAgeDays } = fetchResult.value;
     const safeTitle = this.sanitizeContent(issueResult.title, issueResult.author);
     const safeBody = this.sanitizeContent(issueResult.body, issueResult.author);
     const trustResult = this.classifyAuthor(issueResult);
-    const reputation = this.assessAuthorReputation(issueResult, comments);
+    const reputation = this.assessAuthorReputation(issueResult, comments, accountAgeDays);
+    const gateDecision = gateWithReputation(
+      trustResult.trustTier,
+      reputation,
+      resolveReputationGatingMode()
+    );
+    if (gateDecision.demotionSuppressed) {
+      logger2.warn("Reputation demotion suppressed by gating mode (would block under enforce)", {
+        issueNumber,
+        author: issueResult.author,
+        mode: gateDecision.mode,
+        classifierTier: trustResult.trustTier,
+        reconciledTier: gateDecision.reconciledTier
+      });
+    }
     const actions = this.generateActions(safeTitle, safeBody, issueResult, trustResult);
-    const validatedActions = this.validateActions(actions, trustResult, reputation);
+    const validatedActions = this.validateActions(actions, gateDecision);
     const result = this.buildResult({
       issue: issueResult,
       actions: validatedActions,
       trustResult,
       reputation,
+      gateDecision,
       safeContent: { title: safeTitle, body: safeBody },
       startTime
     });
@@ -1450,12 +968,12 @@ var IssueTriage = class {
    * This is one of the two NEW security module wirings completing #828.
    * (Source: Issue #828 — reputation-model wiring)
    */
-  assessAuthorReputation(issue, comments) {
+  assessAuthorReputation(issue, comments, accountAgeDays) {
     if (!this.config.enableReputation) return void 0;
     const sanitizeResult = sanitizeInput(issue.body, "unknown", issue.author);
     const metadata = {
       username: issue.author,
-      accountAgeDays: estimateAccountAge(issue.createdAt),
+      ...accountAgeDays !== void 0 ? { accountAgeDays } : {},
       priorContributions: countAuthorComments(issue.author, comments),
       recentCommentCount: countRecentComments(issue.author, comments),
       recentCommentWindowMinutes: 10,
@@ -1501,9 +1019,9 @@ var IssueTriage = class {
    * This completes the #828 wiring by integrating corroboration-validator.
    * (Source: Issue #828 — policy-gate + corroboration-validator wiring)
    */
-  validateActions(actions, trustResult, reputation) {
+  validateActions(actions, gateDecision) {
     const context = {
-      inputTrustTier: reconcileTrustTier(trustResult.trustTier, reputation),
+      inputTrustTier: gateDecision.enforcedTier,
       hasWriteAccess: !this.config.dryRun,
       hasSecretAccess: false
     };
@@ -1531,7 +1049,7 @@ var IssueTriage = class {
    * Builds the final triage result.
    */
   buildResult(opts) {
-    const { issue, actions, trustResult, reputation, safeContent, startTime } = opts;
+    const { issue, actions, trustResult, reputation, gateDecision, safeContent, startTime } = opts;
     const [category, confidence] = categorizeIssue(safeContent.title, safeContent.body);
     const isTier1 = trustResult.trustTier === "1";
     const trustAssessment = {
@@ -1540,7 +1058,13 @@ var IssueTriage = class {
       isAllowlisted: trustResult.isAllowlisted,
       reputationScore: reputation?.reputationScore,
       suspiciousSignals: isTier1 ? [] : reputation?.suspiciousSignals ?? [],
-      isSuspicious: isTier1 ? false : reputation?.isSuspicious ?? false
+      isSuspicious: isTier1 ? false : reputation?.isSuspicious ?? false,
+      // #3122: surface both the enforced tier (what the gate used) and the
+      // reconciled tier (what reputation computed) so telemetry can't mistake
+      // a would-be demotion for an enforced one.
+      enforcedTrustTier: gateDecision.enforcedTier,
+      reputationReconciledTier: gateDecision.reconciledTier,
+      gatingMode: gateDecision.mode
     };
     return {
       issueNumber: issue.number,
@@ -1591,13 +1115,28 @@ var IssueTriage = class {
       authorAssociation: c.authorAssociation,
       createdAt: c.createdAt
     })) : [];
-    return ok({ issue, comments });
+    const accountAgeDays = await this.fetchAccountAgeDays(provider, detail.author);
+    return ok(
+      accountAgeDays !== void 0 ? { issue, comments, accountAgeDays } : { issue, comments }
+    );
+  }
+  /**
+   * Best-effort lookup of a GitHub user's account age in days. Returns
+   * `undefined` if the user-metadata fetch fails or the creation date can't be
+   * parsed (#3121) — callers must treat absence as "unknown", not "benign".
+   */
+  async fetchAccountAgeDays(provider, username) {
+    try {
+      const result = await provider.fetchUserMetadata(username);
+      if (!result.ok) return void 0;
+      const createdMs = Date.parse(result.value.createdAt);
+      if (!Number.isFinite(createdMs)) return void 0;
+      return Math.floor((getTimeProvider().now() - createdMs) / 864e5);
+    } catch {
+      return void 0;
+    }
   }
 };
-var DEFAULT_ACCOUNT_AGE_DAYS = 365;
-function estimateAccountAge(_createdAt) {
-  return DEFAULT_ACCOUNT_AGE_DAYS;
-}
 function countAuthorComments(author, comments) {
   return comments.filter((c) => c.author === author).length;
 }
@@ -1632,15 +1171,6 @@ function createIssueTriage(config) {
 }
 
 export {
-  TrustTierSchema,
-  TRUST_TIER_NUMERIC,
-  GitHubUserRoleSchema,
-  ROLE_DEFAULT_TRUST,
-  InjectionFlagSchema,
-  StrippedElementSchema,
-  SanitizedInputSchema,
-  SanitizerConfigSchema,
-  sanitizeInput,
   mapAuthorAssociation,
   classifyTrust,
   canInfluenceDecisions,
@@ -1657,10 +1187,6 @@ export {
   canProceed,
   validateCorroboration,
   getCorroborationRules,
-  SuspiciousSignalSchema,
-  ReputationCache,
-  assessReputation,
-  reconcileTrustTier,
   parsePRUrl,
   GitHubReviewer,
   GitHubUserInfo,
@@ -1669,4 +1195,4 @@ export {
   IssueTriage,
   createIssueTriage
 };
-//# sourceMappingURL=chunk-L3S7HOAS.js.map
+//# sourceMappingURL=chunk-L6JZCAFH.js.map