nexus-agents 2.91.0 → 2.92.1

package/dist/{chunk-X2M7OF27.js → chunk-OK6U5N5Y.js}

@@ -7,6 +7,7 @@ var DEFAULT_PR_REVIEW_CONFIG = {
   minSeverity: "low",
   enableInlineComments: true,
   dryRun: false,
+  enableReputation: true,
   modelConfig: {
     temperature: 0.3,
     maxTokens: 8192
@@ -28,6 +29,7 @@ var PRReviewConfigSchema = z.object({
   minSeverity: z.enum(["critical", "high", "medium", "low", "info"]).default("low"),
   enableInlineComments: z.boolean().default(true),
   dryRun: z.boolean().default(false),
+  enableReputation: z.boolean().default(true),
   githubToken: z.string().optional(),
   modelConfig: z.object({
     temperature: z.number().min(0).max(2).default(0.3),
@@ -69,4 +71,4 @@ export {
   SEVERITY_EMOJI,
   DECISION_EMOJI
 };
-//# sourceMappingURL=chunk-X2M7OF27.js.map
+//# sourceMappingURL=chunk-OK6U5N5Y.js.map

package/dist/chunk-OK6U5N5Y.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/dogfooding/pr-review-types.ts"],"sourcesContent":["/**\n * nexus-agents/dogfooding - PR Review Types\n *\n * Type definitions for automated pull request review using\n * multi-agent collaboration.\n *\n * @module dogfooding/pr-review-types\n * (Source: Issue #161, Alignment Roadmap Phase 3)\n */\n\nimport { z } from 'zod';\nimport type { FullCapableProvider } from '../scm/types.js';\n\n/**\n * Pull request file change information.\n */\nexport interface PRFileChange {\n  /** File path */\n  readonly filename: string;\n  /** Change status */\n  readonly status: 'added' | 'removed' | 'modified' | 'renamed' | 'copied';\n  /** Number of additions */\n  readonly additions: number;\n  /** Number of deletions */\n  readonly deletions: number;\n  /** File patch/diff content */\n  readonly patch?: string | undefined;\n  /** Previous filename if renamed */\n  readonly previousFilename?: string | undefined;\n}\n\n/**\n * Pull request metadata from GitHub API.\n */\nexport interface PRMetadata {\n  /** PR number */\n  readonly number: number;\n  /** PR title */\n  readonly title: string;\n  /** PR description/body */\n  readonly body: string;\n  /** Author username */\n  readonly author: string;\n  /** GitHub API author_association (e.g., 'OWNER', 'COLLABORATOR', 'NONE') */\n  readonly authorAssociation: string;\n  /** Base branch */\n  readonly base: string;\n  /** Head branch */\n  readonly head: string;\n  /** Repository owner */\n  readonly owner: string;\n  /** Repository name */\n  readonly repo: string;\n  /** PR URL */\n  readonly url: string;\n  /** Whether PR is draft */\n  readonly draft: boolean;\n  /** PR labels */\n  readonly labels: readonly string[];\n  /** Changed files */\n  readonly files: readonly PRFileChange[];\n  /** Total additions */\n  readonly additions: number;\n  /** Total deletions */\n  readonly deletions: number;\n  /** Commit SHA of head */\n  readonly headSha: string;\n}\n\n/**\n * Review severity levels.\n */\nexport type ReviewSeverity = 'critical' | 'high' | 'medium' | 'low' | 'info';\n\n/**\n * Review category for organizing findings.\n */\nexport type ReviewCategory =\n  | 'security'\n  | 'performance'\n  | 'code_quality'\n  | 'testing'\n  | 'documentation'\n  | 'architecture';\n\n/**\n * Individual review finding from an expert.\n */\nexport interface ReviewFinding {\n  /** Unique finding ID */\n  readonly id: string;\n  /** Category of finding */\n  readonly category: ReviewCategory;\n  /** Severity level */\n  readonly severity: ReviewSeverity;\n  /** Finding title */\n  readonly title: string;\n  /** Detailed description */\n  readonly description: string;\n  /** Affected file (if applicable) */\n  readonly file?: string | undefined;\n  /** Line number (if applicable) */\n  readonly line?: number | undefined;\n  /** Suggested fix */\n  readonly suggestion?: string | undefined;\n  /** Expert that found this issue */\n  readonly expertId: string;\n  /** Confidence score (0-1) */\n  readonly confidence: number;\n}\n\n/**\n * Review result from a single expert agent.\n */\nexport interface ExpertReviewResult {\n  /** Expert ID */\n  readonly expertId: string;\n  /** Expert role/type */\n  readonly expertType: string;\n  /** Overall approval */\n  readonly approved: boolean;\n  /** Review summary */\n  readonly summary: string;\n  /** Individual findings */\n  readonly findings: readonly ReviewFinding[];\n  /** Execution time in ms */\n  readonly durationMs: number;\n  /** Confidence in review (0-1) */\n  readonly confidence: number;\n}\n\n/**\n * Aggregated review decision after multi-agent debate.\n */\nexport type ReviewDecision = 'approve' | 'request_changes' | 'comment';\n\n/**\n * Complete PR review result from multi-agent collaboration.\n */\n/**\n * Trust + reputation assessment of the PR author, surfaced for observability\n * (#3123, epic #3118 Phase 5). Mirrors `issue_triage`'s assessment.\n */\nexport interface PRTrustAssessment {\n  /** Classifier trust tier (1-4) from author association. */\n  readonly trustTier: string;\n  /** Author's GitHub role. */\n  readonly userRole: string;\n  /** Whether the author is on the maintainer allowlist. */\n  readonly isAllowlisted: boolean;\n  /** Reputation score (0-100) when reputation is enabled. */\n  readonly reputationScore?: number | undefined;\n  /** Suspicious signals detected (e.g. `new_account`, `injection_patterns_detected`). */\n  readonly suspiciousSignals: readonly string[];\n  /** Whether the author is flagged as suspicious. */\n  readonly isSuspicious: boolean;\n  /** Tier the policy gate ACTUALLY enforced (== trustTier under audit/off). */\n  readonly enforcedTrustTier?: string | undefined;\n  /** Tier reputation reconciliation computed — what enforce mode WOULD gate on. */\n  readonly reputationReconciledTier?: string | undefined;\n  /** Reputation-gating rollout mode applied: `off` | `audit` | `enforce`. */\n  readonly gatingMode?: string | undefined;\n}\n\n/**\n * Result of fetching PR data plus best-effort author signals (#3133).\n */\nexport interface PRFetchData {\n  readonly metadata: PRMetadata;\n  readonly provider: FullCapableProvider;\n  /** Author's real account age in days, when the lookup succeeded (#3133). */\n  readonly accountAgeDays?: number;\n}\n\nexport interface PRReviewResult {\n  /** Pull request number */\n  readonly prNumber: number;\n  /** Repository full name (owner/repo) */\n  readonly repository: string;\n  /** Overall decision */\n  readonly decision: ReviewDecision;\n  /** Executive summary */\n  readonly summary: string;\n  /** Individual expert reviews */\n  readonly expertReviews: readonly ExpertReviewResult[];\n  /** Aggregated findings by severity */\n  readonly findingsBySeverity: Readonly<Record<ReviewSeverity, number>>;\n  /** Aggregated findings by category */\n  readonly findingsByCategory: Readonly<Record<ReviewCategory, number>>;\n  /** Total execution time in ms */\n  readonly totalDurationMs: number;\n  /** Number of experts that participated */\n  readonly expertCount: number;\n  /** Consensus score (0-1) */\n  readonly consensusScore: number;\n  /** Debate rounds completed */\n  readonly debateRounds: number;\n  /** Timestamp of review */\n  readonly timestamp: string;\n  /** Author trust + reputation assessment (#3123). */\n  readonly trustAssessment: PRTrustAssessment;\n}\n\n/**\n * Configuration for PR review.\n */\nexport interface PRReviewConfig {\n  /** Experts to include in review */\n  readonly experts: readonly ReviewCategory[];\n  /** Maximum debate rounds */\n  readonly maxDebateRounds: number;\n  /** Consensus threshold (0-1) */\n  readonly consensusThreshold: number;\n  /** Minimum severity to report */\n  readonly minSeverity: ReviewSeverity;\n  /** Whether to post inline comments */\n  readonly enableInlineComments: boolean;\n  /** Whether to run in dry-run mode (no GitHub posting) */\n  readonly dryRun: boolean;\n  /** Whether to assess author reputation and gate on it (#3123). */\n  readonly enableReputation: boolean;\n  /** GitHub token for API access */\n  readonly githubToken?: string | undefined;\n  /** Model adapter configuration */\n  readonly modelConfig?: {\n    readonly temperature?: number;\n    readonly maxTokens?: number;\n  };\n}\n\n/**\n * Default PR review configuration.\n */\nexport const DEFAULT_PR_REVIEW_CONFIG: PRReviewConfig = {\n  experts: ['security', 'code_quality', 'testing'],\n  maxDebateRounds: 3,\n  consensusThreshold: 0.7,\n  minSeverity: 'low',\n  enableInlineComments: true,\n  dryRun: false,\n  enableReputation: true,\n  modelConfig: {\n    temperature: 0.3,\n    maxTokens: 8192,\n  },\n};\n\n/**\n * Zod schema for PR review configuration.\n */\nexport const PRReviewConfigSchema = z.object({\n  experts: z\n    .array(\n      z.enum([\n        'security',\n        'performance',\n        'code_quality',\n        'testing',\n        'documentation',\n        'architecture',\n      ])\n    )\n    .default(['security', 'code_quality', 'testing']),\n  maxDebateRounds: z.number().int().min(1).max(10).default(3),\n  consensusThreshold: z.number().min(0).max(1).default(0.7),\n  minSeverity: z.enum(['critical', 'high', 'medium', 'low', 'info']).default('low'),\n  enableInlineComments: z.boolean().default(true),\n  dryRun: z.boolean().default(false),\n  enableReputation: z.boolean().default(true),\n  githubToken: z.string().optional(),\n  modelConfig: z\n    .object({\n      temperature: z.number().min(0).max(2).default(0.3),\n      maxTokens: z.number().int().positive().default(8192),\n    })\n    .optional(),\n});\n\n/**\n * Severity order for comparison.\n */\nexport const SEVERITY_ORDER: Record<ReviewSeverity, number> = {\n  critical: 5,\n  high: 4,\n  medium: 3,\n  low: 2,\n  info: 1,\n};\n\n/**\n * Category display names.\n */\nexport const CATEGORY_DISPLAY_NAMES: Record<ReviewCategory, string> = {\n  security: 'Security',\n  performance: 'Performance',\n  code_quality: 'Code Quality',\n  testing: 'Testing',\n  documentation: 'Documentation',\n  architecture: 'Architecture',\n};\n\n/**\n * Severity emoji for GitHub comments.\n */\nexport const SEVERITY_EMOJI: Record<ReviewSeverity, string> = {\n  critical: ':rotating_light:',\n  high: ':warning:',\n  medium: ':yellow_circle:',\n  low: ':large_blue_circle:',\n  info: ':information_source:',\n};\n\n/**\n * Decision emoji for GitHub comments.\n */\nexport const DECISION_EMOJI: Record<ReviewDecision, string> = {\n  approve: ':white_check_mark:',\n  request_changes: ':x:',\n  comment: ':speech_balloon:',\n};\n"],"mappings":";AAUA,SAAS,SAAS;AA+NX,IAAM,2BAA2C;AAAA,EACtD,SAAS,CAAC,YAAY,gBAAgB,SAAS;AAAA,EAC/C,iBAAiB;AAAA,EACjB,oBAAoB;AAAA,EACpB,aAAa;AAAA,EACb,sBAAsB;AAAA,EACtB,QAAQ;AAAA,EACR,kBAAkB;AAAA,EAClB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,WAAW;AAAA,EACb;AACF;AAKO,IAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,SAAS,EACN;AAAA,IACC,EAAE,KAAK;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,EACC,QAAQ,CAAC,YAAY,gBAAgB,SAAS,CAAC;AAAA,EAClD,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC;AAAA,EAC1D,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,QAAQ,GAAG;AAAA,EACxD,aAAa,EAAE,KAAK,CAAC,YAAY,QAAQ,UAAU,OAAO,MAAM,CAAC,EAAE,QAAQ,KAAK;AAAA,EAChF,sBAAsB,EAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA,EAC9C,QAAQ,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACjC,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA,EAC1C,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,aAAa,EACV,OAAO;AAAA,IACN,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,QAAQ,GAAG;AAAA,IACjD,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACrD,CAAC,EACA,SAAS;AACd,CAAC;AAKM,IAAM,iBAAiD;AAAA,EAC5D,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,KAAK;AAAA,EACL,MAAM;AACR;AAKO,IAAM,yBAAyD;AAAA,EACpE,UAAU;AAAA,EACV,aAAa;AAAA,EACb,cAAc;AAAA,EACd,SAAS;AAAA,EACT,eAAe;AAAA,EACf,cAAc;AAChB;AAKO,IAAM,iBAAiD;AAAA,EAC5D,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,KAAK;AAAA,EACL,MAAM;AACR;AAKO,IAAM,iBAAiD;AAAA,EAC5D,SAAS;AAAA,EACT,iBAAiB;AAAA,EACjB,SAAS;AACX;","names":[]}

package/dist/{chunk-DH4V6S5K.js → chunk-ZNR3ZVC6.js}

@@ -40,7 +40,7 @@ import {
 } from "./chunk-CH7QIDHQ.js";
 
 // src/version.ts
-var VERSION = true ? "2.91.0" : "dev";
+var VERSION = true ? "2.92.1" : "dev";
 
 // src/config/schemas-core.ts
 import { z } from "zod";
@@ -2096,7 +2096,7 @@ async function runDoctorFix(result) {
   writeLine2("\u2500".repeat(40));
   let fixCount = 0;
   if (!result.dataDirectory.rootExists || result.dataDirectory.subdirectories.some((d) => !d.exists || !d.writable)) {
-    const { runSetup } = await import("./setup-command-B5QPHCKY.js");
+    const { runSetup } = await import("./setup-command-AZAWBZOP.js");
     const setupResult = runSetup({
       skipMcp: true,
       skipRules: true,
@@ -2208,4 +2208,4 @@ export {
   startStdioServer,
   closeServer
 };
-//# sourceMappingURL=chunk-DH4V6S5K.js.map
+//# sourceMappingURL=chunk-ZNR3ZVC6.js.map

package/dist/cli.js

@@ -7,11 +7,13 @@ import {
   determineApproval,
   determineDecision,
   extractSummary,
+  fetchAccountAgeDays,
   formatReviewComment,
+  gatePRAuthor,
   generateSummary,
   parseFindings,
   sumFindings
-} from "./chunk-3RZWLQSC.js";
+} from "./chunk-G5XKEUAP.js";
 import "./chunk-AQTHLUCP.js";
 import {
   buildOpenAICompatAdapters,
@@ -22,7 +24,7 @@ import {
 import {
   setupCommandAsync,
   verifyCommand
-} from "./chunk-W7YQOXCJ.js";
+} from "./chunk-74AO4RKT.js";
 import "./chunk-2SMTCNXP.js";
 import {
   AuthHandler,
@@ -162,14 +164,14 @@ import {
   validateCommand,
   validateWorkflow,
   wrapInMarkdownFence
-} from "./chunk-PLFKZUVT.js";
+} from "./chunk-G3CYK3WA.js";
 import {
   resolveToken
 } from "./chunk-EAT4GTMT.js";
 import {
   CATEGORY_DISPLAY_NAMES,
   DEFAULT_PR_REVIEW_CONFIG
-} from "./chunk-X2M7OF27.js";
+} from "./chunk-OK6U5N5Y.js";
 import "./chunk-E6W4Z6GN.js";
 import "./chunk-3LKW4IEW.js";
 import {
@@ -205,10 +207,13 @@ import {
   classifyTrust,
   createFullGitHubProvider,
   evaluatePolicy,
-  parsePRUrl,
-  sanitizeInput
-} from "./chunk-6IV43POQ.js";
+  parsePRUrl
+} from "./chunk-L6JZCAFH.js";
 import "./chunk-EFHZHCF2.js";
+import {
+  ReputationCache,
+  sanitizeInput
+} from "./chunk-NR4NSTJH.js";
 import "./chunk-57HMLBYN.js";
 import "./chunk-HFOQKCD2.js";
 import "./chunk-3ACDP4E6.js";
@@ -235,7 +240,7 @@ import {
   loadConfig,
   runDoctor,
   validateNexusEnv
-} from "./chunk-DH4V6S5K.js";
+} from "./chunk-ZNR3ZVC6.js";
 import "./chunk-SFZESA5O.js";
 import "./chunk-6Q33PBXC.js";
 import {
@@ -2840,10 +2845,12 @@ var PRReviewer = class {
   config;
   observer;
   adapter;
+  reputationCache;
   constructor(config, adapter) {
     this.config = { ...DEFAULT_PR_REVIEW_CONFIG, ...config };
     this.observer = new SwarmObserver();
     this.adapter = adapter ?? void 0;
+    this.reputationCache = new ReputationCache();
   }
   /**
    * Reviews a pull request using multi-agent collaboration.
@@ -2857,7 +2864,7 @@ var PRReviewer = class {
     const { owner, repo, prNumber } = parseResult.value;
     const fetchResult = await this.fetchPRData(owner, repo, prNumber);
     if (!fetchResult.ok) return fetchResult;
-    const { metadata: prMetadata, provider } = fetchResult.value;
+    const { metadata: prMetadata, provider, accountAgeDays } = fetchResult.value;
     const trustResult = this.classifyPRAuthor(prMetadata);
     logger2.info("PR author trust classified", {
       prNumber,
@@ -2866,10 +2873,17 @@ var PRReviewer = class {
       userRole: trustResult.userRole,
       isAllowlisted: trustResult.isAllowlisted
     });
+    const { gateDecision, trustAssessment } = gatePRAuthor(
+      prMetadata,
+      trustResult,
+      accountAgeDays,
+      this.reputationCache,
+      this.config.enableReputation
+    );
     const expertReviews = await this.runExpertReviews(prMetadata, traceId);
-    const result = this.aggregateReviews(prMetadata, expertReviews, startTime);
+    const result = this.aggregateReviews(prMetadata, expertReviews, startTime, trustAssessment);
     if (!this.config.dryRun) {
-      await this.postReviewToGitHub(provider, parseResult.value, result, trustResult);
+      await this.postReviewToGitHub(provider, parseResult.value, result, gateDecision);
     }
     logger2.info("PR review completed", {
       prNumber,
@@ -3053,7 +3067,7 @@ ${file.patch}
   /**
    * Aggregates individual expert reviews into final result.
    */
-  aggregateReviews(pr, reviews, startTime) {
+  aggregateReviews(pr, reviews, startTime, trustAssessment) {
     const allFindings = reviews.flatMap((r) => r.findings);
     const decision = determineDecision(reviews, allFindings);
     const consensusScore = calculateConsensus(reviews);
@@ -3069,7 +3083,8 @@ ${file.patch}
       expertCount: reviews.length,
       consensusScore,
       debateRounds: 1,
-      timestamp: getTimeProvider().nowIso()
+      timestamp: getTimeProvider().nowIso(),
+      trustAssessment
     };
   }
   /**
@@ -3079,8 +3094,8 @@ ${file.patch}
    * from the untrusted PR author.
    * (Source: Issue #828 — Wire policy gate into production pipeline)
    */
-  async postReviewToGitHub(provider, pr, result, trustResult) {
-    const policyResult = this.auditReviewAction(trustResult);
+  async postReviewToGitHub(provider, pr, result, gateDecision) {
+    const policyResult = this.auditReviewAction(gateDecision.enforcedTier);
     if (policyResult.hasRuleOfTwoViolation) {
       logger2.warn("Rule of Two: review posting blocked", {
         prNumber: pr.prNumber,
@@ -3094,17 +3109,20 @@ ${file.patch}
         violations: policyResult.violations
       });
     }
-    const { formatReviewComment: formatReviewComment2 } = await import("./pr-reviewer-helpers-WYPUYQ2U.js");
+    const { formatReviewComment: formatReviewComment2 } = await import("./pr-reviewer-helpers-RBUEJI6V.js");
     const body = formatReviewComment2(result);
     const postResult = await provider.createReview(pr.prNumber, body, result.decision);
     if (!postResult.ok) {
       logger2.error("Failed to post review", postResult.error);
     }
   }
-  /** Audits review posting against the policy gate for logging. */
-  auditReviewAction(trustResult) {
+  /**
+   * Audits review posting against the policy gate. Gates on the reputation-
+   * reconciled `enforcedTier` (#3123) rather than the raw classifier tier.
+   */
+  auditReviewAction(enforcedTier) {
     const context = {
-      inputTrustTier: trustResult.trustTier,
+      inputTrustTier: enforcedTier,
       hasWriteAccess: true,
       hasSecretAccess: true
     };
@@ -3135,6 +3153,7 @@ ${file.patch}
     const detailResult = await provider.getPullRequestDetail(prNumber);
     if (!detailResult.ok) return err(detailResult.error);
     const detail = detailResult.value;
+    const accountAgeDays = this.config.enableReputation ? await fetchAccountAgeDays(provider, detail.author) : void 0;
     const metadata = {
       number: detail.number,
       title: detail.title,
@@ -3160,7 +3179,11 @@ ${file.patch}
       additions: detail.additions,
       deletions: detail.deletions
     };
-    return ok({ metadata, provider });
+    return ok({
+      metadata,
+      provider,
+      ...accountAgeDays !== void 0 ? { accountAgeDays } : {}
+    });
   }
   /**
    * Gets the SwarmObserver for debugging.