nexus-agents 2.92.2 → 2.92.4

package/dist/{chunk-NR4NSTJH.js → chunk-27CNQPQ4.js}

@@ -1,5 +1,6 @@
 import {
   CACHE_TIMEOUTS,
+  createLogger,
   getTimeProvider
 } from "./chunk-W5I6L4UT.js";
 
@@ -324,6 +325,18 @@ function buildFailClosedResult(err, originalContent, truncated, userRole, allowl
 
 // src/security/reputation-model.ts
 import { z as z2 } from "zod";
+
+// src/security/env-mode.ts
+var defaultLogger = createLogger({ component: "env-mode" });
+function resolveEnvMode(raw, schema, fallback, varName, logger = defaultLogger) {
+  if (typeof raw !== "string" || raw.length === 0) return fallback;
+  const parsed = schema.safeParse(raw.toLowerCase());
+  if (parsed.success) return parsed.data;
+  logger.warn(`Invalid ${varName} value \u2014 coercing to default`, { raw, default: fallback });
+  return fallback;
+}
+
+// src/security/reputation-model.ts
 var SuspiciousSignalSchema = z2.enum([
   "new_account",
   "no_prior_contributions",
@@ -504,10 +517,12 @@ function reconcileTrustTier(classifierTier, reputation) {
 var ReputationGatingModeSchema = z2.enum(["off", "audit", "enforce"]);
 var DEFAULT_REPUTATION_GATING_MODE = "audit";
 function resolveReputationGatingMode(env = process.env) {
-  const raw = env["NEXUS_REPUTATION_GATING"];
-  if (typeof raw !== "string" || raw.length === 0) return DEFAULT_REPUTATION_GATING_MODE;
-  const parsed = ReputationGatingModeSchema.safeParse(raw.toLowerCase());
-  return parsed.success ? parsed.data : DEFAULT_REPUTATION_GATING_MODE;
+  return resolveEnvMode(
+    env["NEXUS_REPUTATION_GATING"],
+    ReputationGatingModeSchema,
+    DEFAULT_REPUTATION_GATING_MODE,
+    "NEXUS_REPUTATION_GATING"
+  );
 }
 function gateWithReputation(classifierTier, reputation, mode) {
   const reconciledTier = mode === "off" ? classifierTier : reconcileTrustTier(classifierTier, reputation);
@@ -528,6 +543,7 @@ function buildReason(role, signals, tier) {
 }
 
 export {
+  resolveEnvMode,
   TrustTierSchema,
   TRUST_TIER_NUMERIC,
   GitHubUserRoleSchema,
@@ -544,4 +560,4 @@ export {
   resolveReputationGatingMode,
   gateWithReputation
 };
-//# sourceMappingURL=chunk-NR4NSTJH.js.map
+//# sourceMappingURL=chunk-27CNQPQ4.js.map

package/dist/chunk-27CNQPQ4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/security/trust-types.ts","../src/security/input-sanitizer.ts","../src/security/reputation-model.ts","../src/security/env-mode.ts"],"sourcesContent":["/**\n * nexus-agents/security - Trust Types\n *\n * Zod schemas and TypeScript types for the untrusted input hardening\n * framework. Defines trust tiers, sanitized input, user roles, and\n * injection detection flags.\n *\n * @module security/trust-types\n * (Source: Issue #818, #819 — Phase 1: Input Sanitization)\n */\n\nimport { z } from 'zod';\n\n// ============================================================================\n// Trust Tiers\n// ============================================================================\n\n/**\n * Trust tier classification for input sources.\n * Lower number = higher trust.\n *\n * 1 = Authoritative (repo files, CI, CLAUDE.md, allowlisted maintainers)\n * 2 = Semi-trusted (collaborator issue body, contributor PR metadata)\n * 3 = Untrusted (unknown user comments, non-collaborator issue body)\n * 4 = Hostile (injection patterns, hidden HTML, instruction-like content)\n */\nexport const TrustTierSchema = z.enum(['1', '2', '3', '4']);\nexport type TrustTier = z.infer<typeof TrustTierSchema>;\n\n/** Numeric trust tier for comparisons. Higher number = lower trust. */\nexport const TRUST_TIER_NUMERIC: Record<TrustTier, number> = {\n  '1': 1,\n  '2': 2,\n  '3': 3,\n  '4': 4,\n};\n\n// ============================================================================\n// GitHub User Roles\n// ============================================================================\n\n/**\n * GitHub user relationship to the repository.\n */\nexport const GitHubUserRoleSchema = z.enum([\n  'owner',\n  'maintainer',\n  'collaborator',\n  'contributor',\n  'member',\n  'unknown',\n]);\nexport type GitHubUserRole = z.infer<typeof GitHubUserRoleSchema>;\n\n/**\n * Default trust tier mapping for each GitHub role.\n * Can be overridden by injection pattern detection (downgrade only).\n */\nexport const ROLE_DEFAULT_TRUST: Record<GitHubUserRole, TrustTier> = {\n  owner: '1',\n  maintainer: '1',\n  collaborator: '2',\n  contributor: '2',\n  member: '3',\n  unknown: '3',\n};\n\n// ============================================================================\n// Injection Detection\n// ============================================================================\n\n/**\n * Categories of injection patterns detected in content.\n */\nexport const InjectionFlagSchema = z.enum([\n  'authority_claim',\n  'instruction_pattern',\n  'system_prompt_manipulation',\n  'hidden_content',\n  'urgency_manipulation',\n  'fake_conversation',\n  'base64_encoded',\n  'external_link_instruction',\n]);\nexport type InjectionFlag = z.infer<typeof InjectionFlagSchema>;\n\n/**\n * An element stripped during sanitization, preserved for audit trail.\n */\nexport const StrippedElementSchema = z.object({\n  /** Type of element stripped. */\n  tag: z.string().min(1),\n  /** Reason for stripping. */\n  reason: z.string().min(1),\n  /** Start index in original content. */\n  startIndex: z.number().int().nonnegative(),\n  /** Length of stripped content. */\n  length: z.number().int().positive(),\n});\nexport type StrippedElement = z.infer<typeof StrippedElementSchema>;\n\n// ============================================================================\n// Sanitized Input\n// ============================================================================\n\n/**\n * The result of sanitizing untrusted input.\n * Contains cleaned content, trust classification, and audit data.\n */\nexport const SanitizedInputSchema = z.object({\n  /** Sanitized content with dangerous elements removed. */\n  content: z.string(),\n  /** Original content before sanitization (for audit). */\n  originalLength: z.number().int().nonnegative(),\n  /** Assigned trust tier based on user role and content analysis. */\n  trustTier: TrustTierSchema,\n  /** GitHub user role of the input source. */\n  userRole: GitHubUserRoleSchema,\n  /** Injection patterns detected in content. */\n  injectionFlags: z.array(InjectionFlagSchema),\n  /** Elements stripped during sanitization (audit trail). */\n  strippedElements: z.array(StrippedElementSchema),\n  /** Whether any dangerous content was detected and stripped. */\n  wasModified: z.boolean(),\n  /** Timestamp of sanitization (ISO 8601). */\n  sanitizedAt: z.iso.datetime(),\n});\nexport type SanitizedInput = z.infer<typeof SanitizedInputSchema>;\n\n// ============================================================================\n// Configuration\n// ============================================================================\n\n/**\n * Configuration for the input sanitizer.\n */\nexport const SanitizerConfigSchema = z.object({\n  /** GitHub usernames that are always Tier 1 (allowlisted maintainers). */\n  allowlistedMaintainers: z.array(z.string().min(1)).default([]),\n  /** Whether to fail open (log only) or fail closed (block). Phase 1 = open. */\n  failOpen: z.boolean().default(true),\n  /** Maximum input length before truncation. */\n  maxInputLength: z.number().int().positive().default(50_000),\n});\nexport type SanitizerConfig = z.infer<typeof SanitizerConfigSchema>;\n","/**\n * nexus-agents/security - Input Sanitizer\n *\n * Sanitizes untrusted GitHub input by stripping dangerous HTML/XML tags,\n * detecting injection patterns, and producing a SanitizedInput result\n * with full audit trail.\n *\n * Defense layer 1 of the three-layer hardening architecture.\n * See: docs/architecture/UNTRUSTED_INPUT_HARDENING.md\n *\n * @module security/input-sanitizer\n * (Source: Issue #818, #819 — Phase 1: Input Sanitization)\n */\n\nimport type {\n  InjectionFlag,\n  SanitizedInput,\n  SanitizerConfig,\n  StrippedElement,\n  TrustTier,\n  GitHubUserRole,\n} from './trust-types.js';\nimport { ROLE_DEFAULT_TRUST, SanitizerConfigSchema } from './trust-types.js';\n\n// ============================================================================\n// Dangerous HTML Patterns (Trail of Bits / GitHub Copilot vectors)\n// ============================================================================\n\n/**\n * HTML tags to strip. These are known injection vectors:\n * - `<picture>` / `<source>`: Trail of Bits GitHub Copilot injection\n * - `<img>`: Can carry injection via alt text or onerror\n */\nconst DANGEROUS_HTML_PATTERN =\n  /<(picture|source|img)\\b[^>]*>[\\s\\S]*?<\\/\\1>|<(picture|source|img)\\b[^>]*\\/?>/gi;\n\n// ============================================================================\n// XML-like Tags (Conversation History Injection)\n// ============================================================================\n\n/**\n * XML-like tags that mimic conversation structure or system prompts.\n */\nconst XML_INJECTION_PATTERN =\n  /<\\/?(system|human|assistant|instructions|user|prompt|context|tool_use|tool_result)\\b[^>]*>/gi;\n\n// ============================================================================\n// HTML Comments with Instructions\n// ============================================================================\n\nconst HTML_COMMENT_PATTERN = /<!--[\\s\\S]*?-->/g;\n\n// ============================================================================\n// Injection Pattern Detectors\n// ============================================================================\n\ninterface PatternMatch {\n  flag: InjectionFlag;\n  pattern: RegExp;\n}\n\nconst INJECTION_PATTERNS: readonly PatternMatch[] = [\n  {\n    flag: 'authority_claim',\n    pattern: /\\b(as (?:a|the) (?:maintainer|admin|owner|security lead|repo owner|developer))\\b/i,\n  },\n  {\n    flag: 'authority_claim',\n    pattern: /\\b(i(?:'m| am) the (?:repo |project )?(?:owner|maintainer|admin))\\b/i,\n  },\n  {\n    flag: 'instruction_pattern',\n    pattern: /\\b(please (?:close|merge|label|mark|apply|delete|remove|approve|reject))\\b/i,\n  },\n  {\n    flag: 'instruction_pattern',\n    pattern: /\\b(you (?:should|must|need to) (?:close|merge|label|apply|delete))\\b/i,\n  },\n  {\n    flag: 'system_prompt_manipulation',\n    pattern: /\\b(ignore (?:all )?previous (?:instructions|rules|prompts))\\b/i,\n  },\n  {\n    flag: 'system_prompt_manipulation',\n    pattern: /\\b(forget (?:your |all )?(?:instructions|rules|safety))\\b/i,\n  },\n  {\n    flag: 'system_prompt_manipulation',\n    pattern: /\\b(new (?:instructions|rules|system prompt|directives))\\b/i,\n  },\n  {\n    flag: 'urgency_manipulation',\n    pattern: /\\b(critical|emergency|urgent|must act now|immediately|time[- ]?sensitive)\\b/i,\n  },\n  {\n    flag: 'fake_conversation',\n    pattern: /<(?:assistant|human|user|system)>/i,\n  },\n  // base64_encoded is detected separately by `looksLikeBase64Payload` below.\n  // The lookahead-based regex it replaced exhibited catastrophic backtracking\n  // on long hex-only inputs (#2191) — see `looksLikeBase64Payload` for the\n  // two-phase rewrite that preserves the #1811 SHA-hash false-positive guard.\n  {\n    flag: 'external_link_instruction',\n    pattern: /(?:apply|run|execute|install)\\s+(?:this\\s+)?(?:from\\s+)?https?:\\/\\//i,\n  },\n];\n\n/**\n * Two-phase base64-payload detection (#2191).\n *\n * The original `(?=[A-Za-z0-9+/]*[g-zG-Z+/=])[A-Za-z0-9+/]{40,}={0,2}` regex\n * was vulnerable to catastrophic backtracking — V8 took ~1.8s on a 50K\n * hex-only adversarial input. Splitting the check into two non-overlapping\n * phases removes the lookahead and makes the worst case linear.\n *\n *   Phase 1: find a 40+ run of base64-alphabet chars (no lookahead).\n *   Phase 2: confirm the matched substring contains a base64-discriminating\n *            char (g-z, G-Z, +, /, =) so SHA-1 / SHA-256 hex hashes don't\n *            false-positive (preserves #1811 behavior).\n *\n * Same detection coverage as the original; same false-positive resistance.\n */\nconst BASE64_RUN_GLOBAL = /[A-Za-z0-9+/]{40,}={0,2}/g;\nconst BASE64_DISCRIMINATOR = /[g-zG-Z+/=]/;\n\nfunction looksLikeBase64Payload(content: string): boolean {\n  // Iterate every 40+ base64-alphabet run rather than just the first one,\n  // so a long hex-only prefix doesn't mask a real base64 payload that\n  // appears later in the content.\n  for (const match of content.matchAll(BASE64_RUN_GLOBAL)) {\n    if (BASE64_DISCRIMINATOR.test(match[0])) return true;\n  }\n  return false;\n}\n\n// ============================================================================\n// HTML Entity Decoding (evasion defense)\n// ============================================================================\n\n/**\n * Dangerous-tag names we will still match after entity decoding.\n * Kept in sync with DANGEROUS_HTML_PATTERN and XML_INJECTION_PATTERN above.\n */\nconst DANGEROUS_TAG_NAMES =\n  'picture|source|img|system|human|assistant|instructions|user|prompt|context|tool_use|tool_result';\n\n/**\n * Detects whether the input contains entity-encoded forms of any dangerous\n * tag (&lt;picture, &#60;system, &#x3c;img …). Used as a cheap pre-check so\n * that benign content with legitimate entities (e.g. \"AT&amp;T\") is passed\n * through untouched and wasModified stays false.\n */\nconst ENCODED_DANGEROUS_TAG_PATTERN = new RegExp(\n  `&(?:lt|#0*60|#x0*3c);\\\\s*\\\\/?\\\\s*(?:${DANGEROUS_TAG_NAMES})\\\\b`,\n  'i'\n);\n\n/** Decodes the subset of HTML entities that can reconstruct tag syntax. */\nfunction decodeEntities(content: string): string {\n  return (\n    content\n      // Numeric (decimal) references\n      .replace(/&#(\\d+);/g, (_match, dec: string) => {\n        const code = Number.parseInt(dec, 10);\n        return Number.isFinite(code) ? String.fromCodePoint(code) : _match;\n      })\n      // Numeric (hex) references\n      .replace(/&#x([0-9a-f]+);/gi, (_match, hex: string) => {\n        const code = Number.parseInt(hex, 16);\n        return Number.isFinite(code) ? String.fromCodePoint(code) : _match;\n      })\n      // Named entities most relevant to tag reconstruction\n      .replace(/&lt;/gi, '<')\n      .replace(/&gt;/gi, '>')\n      .replace(/&quot;/gi, '\"')\n      .replace(/&apos;/gi, \"'\")\n      // &amp; must be decoded last so that &amp;lt; does not resurface as <\n      .replace(/&amp;/gi, '&')\n  );\n}\n\n/**\n * Runs decodeEntities only if the input contains an entity-encoded dangerous\n * tag. This keeps benign content with legitimate entities untouched.\n */\nfunction applyEntityEvasionDefense(content: string): {\n  cleaned: string;\n  stripped: StrippedElement[];\n} {\n  if (!ENCODED_DANGEROUS_TAG_PATTERN.test(content)) {\n    return { cleaned: content, stripped: [] };\n  }\n  const decoded = decodeEntities(content);\n  return {\n    cleaned: decoded,\n    stripped: [\n      {\n        tag: '&…;',\n        reason: 'HTML entity-encoded dangerous tag decoded for stripping (CWE-79)',\n        startIndex: 0,\n        length: content.length,\n      },\n    ],\n  };\n}\n\n// ============================================================================\n// Core Sanitization Functions\n// ============================================================================\n\n/** Strips dangerous HTML tags and records what was removed.\n * Loops until stable to prevent reconstructed patterns after removal (#1496). */\nfunction stripDangerousHtml(content: string): {\n  cleaned: string;\n  stripped: StrippedElement[];\n} {\n  const stripped: StrippedElement[] = [];\n  let cleaned = content;\n  const MAX_PASSES = 5;\n  for (let pass = 0; pass < MAX_PASSES; pass++) {\n    DANGEROUS_HTML_PATTERN.lastIndex = 0;\n    if (!DANGEROUS_HTML_PATTERN.test(cleaned)) break;\n    cleaned = cleaned.replace(DANGEROUS_HTML_PATTERN, (match, _g1, _g2, offset: number) => {\n      stripped.push({\n        tag: match.slice(0, 30) + (match.length > 30 ? '...' : ''),\n        reason: 'Dangerous HTML tag (Trail of Bits injection vector)',\n        startIndex: offset,\n        length: match.length,\n      });\n      return '';\n    });\n  }\n  return { cleaned, stripped };\n}\n\n/** Strips XML-like tags that mimic conversation structure.\n * Loops until stable to prevent reconstructed patterns after removal (#1496). */\nfunction stripXmlTags(content: string): {\n  cleaned: string;\n  stripped: StrippedElement[];\n} {\n  const stripped: StrippedElement[] = [];\n  let cleaned = content;\n  const MAX_PASSES = 5;\n  for (let pass = 0; pass < MAX_PASSES; pass++) {\n    XML_INJECTION_PATTERN.lastIndex = 0;\n    if (!XML_INJECTION_PATTERN.test(cleaned)) break;\n    cleaned = cleaned.replace(XML_INJECTION_PATTERN, (match, _g1, offset: number) => {\n      stripped.push({\n        tag: match,\n        reason: 'XML-like conversation injection tag',\n        startIndex: offset,\n        length: match.length,\n      });\n      return '';\n    });\n  }\n  return { cleaned, stripped };\n}\n\n/** Strips HTML comments that may contain hidden instructions.\n * Loops until stable to prevent reconstructed comment patterns (#1496). */\nfunction stripHtmlComments(content: string): {\n  cleaned: string;\n  stripped: StrippedElement[];\n} {\n  const stripped: StrippedElement[] = [];\n  let cleaned = content;\n  // Loop until stable: stripping may reveal new instruction-bearing comments\n  const MAX_PASSES = 5;\n  for (let pass = 0; pass < MAX_PASSES; pass++) {\n    HTML_COMMENT_PATTERN.lastIndex = 0;\n    const prevLength = cleaned.length;\n    cleaned = cleaned.replace(HTML_COMMENT_PATTERN, (match, offset: number) => {\n      const hasInstruction = /\\b(ignore|execute|close|merge|delete|apply)\\b/i.test(match);\n      if (!hasInstruction) return match;\n\n      stripped.push({\n        tag: '<!-- ... -->',\n        reason: 'HTML comment with instruction-like content',\n        startIndex: offset,\n        length: match.length,\n      });\n      return '';\n    });\n    if (cleaned.length === prevLength) break;\n  }\n  // Second pass: strip unclosed <!-- tags (incomplete comment injection)\n  let searchFrom = 0;\n  while (searchFrom < cleaned.length) {\n    const openIdx = cleaned.indexOf('<!--', searchFrom);\n    if (openIdx === -1) break;\n    const closeIdx = cleaned.indexOf('-->', openIdx + 4);\n    if (closeIdx === -1) {\n      stripped.push({\n        tag: '<!--',\n        reason: 'Unclosed HTML comment (potential injection vector)',\n        startIndex: openIdx,\n        length: cleaned.length - openIdx,\n      });\n      cleaned = cleaned.slice(0, openIdx);\n      break;\n    }\n    searchFrom = closeIdx + 3;\n  }\n  return { cleaned, stripped };\n}\n\n/** Detects injection patterns in content without modifying it. */\nfunction detectInjectionPatterns(content: string): InjectionFlag[] {\n  const flags = new Set<InjectionFlag>();\n  for (const { flag, pattern } of INJECTION_PATTERNS) {\n    // Reset lastIndex for global patterns\n    pattern.lastIndex = 0;\n    if (pattern.test(content)) {\n      flags.add(flag);\n    }\n  }\n  if (looksLikeBase64Payload(content)) {\n    flags.add('base64_encoded');\n  }\n  return Array.from(flags);\n}\n\n/** Lower-cases an arbitrary role literal and maps it to a known role. */\nfunction normalizeRole(userRole: string): GitHubUserRole {\n  const lower = userRole.toLowerCase();\n  if (lower in ROLE_DEFAULT_TRUST) return lower as GitHubUserRole;\n  return 'unknown';\n}\n\n/**\n * Assigns trust tier based on user role and injection analysis.\n * Injection patterns can only DOWNGRADE trust, never upgrade.\n */\nfunction assignTrustTier(\n  userRole: GitHubUserRole,\n  injectionFlags: readonly InjectionFlag[],\n  allowlisted: boolean\n): TrustTier {\n  if (allowlisted) return '1';\n\n  // Defensive lowercase — the type says GitHubUserRole, but callers\n  // sometimes cast an unnormalized GitHub author_association literal\n  // (e.g. 'OWNER', 'MEMBER') directly. Normalize here so the maintainer\n  // exemption below matches regardless of case (CWE-178).\n  const normalizedRole = normalizeRole(userRole);\n  const baseTier = ROLE_DEFAULT_TRUST[normalizedRole];\n\n  // Content with injection patterns is downgraded to Tier 4 (hostile)\n  const hostileFlags: InjectionFlag[] = ['system_prompt_manipulation', 'fake_conversation'];\n  if (injectionFlags.some((f) => hostileFlags.includes(f))) return '4';\n\n  // Content with authority claims from non-maintainers is suspicious\n  if (\n    injectionFlags.includes('authority_claim') &&\n    normalizedRole !== 'owner' &&\n    normalizedRole !== 'maintainer'\n  ) {\n    return '4';\n  }\n\n  return baseTier;\n}\n\n// ============================================================================\n// Public API\n// ============================================================================\n\n/**\n * Sanitizes untrusted GitHub input through the full Layer 1 pipeline:\n * 1. HTML stripping (picture/source/img tags)\n * 2. XML tag stripping (system/human/assistant)\n * 3. HTML comment stripping (instruction-bearing comments only)\n * 4. Injection pattern detection\n * 5. Trust tier assignment\n *\n * ⚠ **Use HostileInputFirewall.process() in agent code paths.** Calling\n * sanitizeInput() directly only runs Layer 1 — it does not evaluate the\n * Rule of Two (enforced in policy-gate.ts via evaluatePolicy) and does\n * not emit audit-trail events. An agent that processes untrusted input\n * while holding both write access and secrets violates the Rule of Two;\n * the policy gate is what catches this, and it only runs inside the\n * firewall pipeline. Direct use of this function is appropriate for\n * unit tests and pure content analysis, not for agent decision paths.\n *\n * @see packages/nexus-agents/src/security/firewall/firewall-pipeline.ts\n * @see packages/nexus-agents/src/security/policy-gate.ts\n * @param content - Raw untrusted content from GitHub\n * @param userRole - GitHub user's relationship to the repository\n * @param username - GitHub username (for allowlist check)\n * @param config - Optional sanitizer configuration\n * @returns SanitizedInput with cleaned content and audit data\n */\nexport function sanitizeInput(\n  content: string,\n  userRole: GitHubUserRole,\n  username: string,\n  config?: Partial<SanitizerConfig>\n): SanitizedInput {\n  const cfg = SanitizerConfigSchema.parse(config ?? {});\n  const truncated = content.slice(0, cfg.maxInputLength);\n  const allowlisted = cfg.allowlistedMaintainers.includes(username);\n\n  try {\n    // Pipeline: decode entity-encoded dangerous tags, then strip dangerous content\n    const entityDecoded = applyEntityEvasionDefense(truncated);\n    const html = stripDangerousHtml(entityDecoded.cleaned);\n    const xml = stripXmlTags(html.cleaned);\n    const comments = stripHtmlComments(xml.cleaned);\n    const allStripped = [\n      ...entityDecoded.stripped,\n      ...html.stripped,\n      ...xml.stripped,\n      ...comments.stripped,\n    ];\n\n    // Detect injection patterns on ORIGINAL content (before stripping)\n    const injectionFlags = detectInjectionPatterns(truncated);\n\n    // Assign trust tier\n    const trustTier = assignTrustTier(userRole, injectionFlags, allowlisted);\n\n    return {\n      content: comments.cleaned,\n      originalLength: content.length,\n      trustTier,\n      userRole,\n      injectionFlags,\n      strippedElements: allStripped,\n      wasModified: allStripped.length > 0,\n      sanitizedAt: new Date().toISOString(),\n    };\n  } catch (err: unknown) {\n    return buildFailClosedResult(err, content, truncated, userRole, allowlisted);\n  }\n}\n\n/**\n * Fail-closed result returned when the sanitizer pipeline throws.\n * Returns empty content at Tier-4 (or Tier-1 for allowlisted maintainers,\n * since their bypass is not regex-dependent) so downstream consumers\n * cannot act on untrusted content we could not validate.\n * CLAUDE.md: \"Fail closed on ambiguity.\"\n */\nfunction buildFailClosedResult(\n  err: unknown,\n  originalContent: string,\n  truncated: string,\n  userRole: GitHubUserRole,\n  allowlisted: boolean\n): SanitizedInput {\n  const message = err instanceof Error ? err.message : String(err);\n  return {\n    content: '',\n    originalLength: originalContent.length,\n    trustTier: allowlisted ? '1' : '4',\n    userRole,\n    injectionFlags: [],\n    strippedElements: [\n      {\n        tag: '(pipeline-failure)',\n        reason: `Sanitizer pipeline threw; input discarded as fail-closed: ${message}`,\n        startIndex: 0,\n        length: truncated.length,\n      },\n    ],\n    wasModified: true,\n    sanitizedAt: new Date().toISOString(),\n  };\n}\n","/**\n * nexus-agents/security - Reputation Model\n *\n * Lightweight trust model for GitHub users that assesses reputation\n * based on account age, contribution history, and behavioral signals.\n * Integrates with the trust classifier for comprehensive trust assessment.\n *\n * @module security/reputation-model\n * (Source: Issue #818, #824 — Phase 3: Reputation Model)\n */\n\nimport { z } from 'zod';\n\nimport { getTimeProvider } from '../core/index.js';\nimport { resolveEnvMode } from './env-mode.js';\nimport type { TrustTier, GitHubUserRole, InjectionFlag } from './trust-types.js';\nimport { TRUST_TIER_NUMERIC, ROLE_DEFAULT_TRUST } from './trust-types.js';\n\n// ============================================================================\n// Types\n// ============================================================================\n\n/**\n * Signals that indicate a suspicious actor.\n */\nexport const SuspiciousSignalSchema = z.enum([\n  'new_account',\n  'no_prior_contributions',\n  'injection_patterns_detected',\n  'rapid_comments',\n  'mismatched_authority_claim',\n]);\nexport type SuspiciousSignal = z.infer<typeof SuspiciousSignalSchema>;\n\n/**\n * GitHub user metadata for reputation assessment.\n */\nexport interface GitHubUserMetadata {\n  readonly username: string;\n  /**\n   * Account/activity fields are OPTIONAL (#3106). When a field is absent (the\n   * caller couldn't fetch it — e.g. the firewall before Phase 3 wiring), its\n   * signal is SKIPPED rather than fabricated: an unknown value must never be\n   * treated as benign (the old hardcoded `365`/`0`) nor as hostile. Only the\n   * `authorAssociation` + `injectionFlags` signals fire on absent activity data.\n   */\n  readonly accountAgeDays?: number;\n  readonly priorContributions?: number;\n  readonly recentCommentCount?: number;\n  readonly recentCommentWindowMinutes?: number;\n  readonly authorAssociation: string;\n  readonly injectionFlags: readonly InjectionFlag[];\n}\n\n/**\n * Result of a reputation assessment.\n */\nexport interface ReputationAssessment {\n  readonly username: string;\n  readonly userRole: GitHubUserRole;\n  readonly suspiciousSignals: readonly SuspiciousSignal[];\n  readonly isSuspicious: boolean;\n  readonly effectiveTrustTier: TrustTier;\n  readonly reputationScore: number;\n  readonly reason: string;\n  readonly assessedAt: string;\n}\n\n// ============================================================================\n// Configuration\n// ============================================================================\n\n/** Thresholds for suspicious behavior detection. */\n/** Approximate days per year, used to normalize account age to a 0–10 scale. */\nconst DAYS_PER_YEAR_APPROX = 36.5;\n\nconst SUSPICIOUS_THRESHOLDS = {\n  /** Account younger than this (days) is flagged. */\n  newAccountDays: 30,\n  /** Fewer contributions than this is flagged. */\n  minContributions: 1,\n  /** More comments than this in the window triggers rapid-comment flag. */\n  rapidCommentThreshold: 5,\n  /** Time window (minutes) for rapid comment detection. */\n  rapidCommentWindowMinutes: 10,\n} as const;\n\n// ============================================================================\n// Reputation Cache\n// ============================================================================\n\ninterface CacheEntry {\n  assessment: ReputationAssessment;\n  expiresAt: number;\n}\n\n// Canonical source: config/timeouts.ts (Issue #1046)\nimport { CACHE_TIMEOUTS } from '../config/timeouts.js';\n\nconst DEFAULT_TTL_MS: number = CACHE_TIMEOUTS.reputationTtlMs;\nconst DEFAULT_MAX_SIZE = 1000;\n\n/**\n * In-memory reputation cache with TTL and max size.\n * Reduces redundant assessments for the same user within a short window.\n * Evicts oldest entries when max size is exceeded.\n */\nexport class ReputationCache {\n  private readonly cache = new Map<string, CacheEntry>();\n  private readonly ttlMs: number;\n  private readonly maxSize: number;\n\n  constructor(ttlMs = DEFAULT_TTL_MS, maxSize = DEFAULT_MAX_SIZE) {\n    this.ttlMs = ttlMs;\n    this.maxSize = maxSize;\n  }\n\n  get(username: string): ReputationAssessment | undefined {\n    const entry = this.cache.get(username);\n    if (entry === undefined) return undefined;\n    if (getTimeProvider().now() > entry.expiresAt) {\n      this.cache.delete(username);\n      return undefined;\n    }\n    return entry.assessment;\n  }\n\n  set(username: string, assessment: ReputationAssessment): void {\n    if (this.cache.size >= this.maxSize && !this.cache.has(username)) {\n      this.evictOldest();\n    }\n    this.cache.set(username, {\n      assessment,\n      expiresAt: getTimeProvider().now() + this.ttlMs,\n    });\n  }\n\n  /** Evict a batch of oldest entries (10% of maxSize, minimum 1). */\n  private evictOldest(): void {\n    const batchSize = Math.max(1, Math.floor(this.maxSize * 0.1));\n    const keys = this.cache.keys();\n    for (let i = 0; i < batchSize; i++) {\n      const next = keys.next();\n      if (next.done === true) break;\n      this.cache.delete(next.value);\n    }\n  }\n\n  clear(): void {\n    this.cache.clear();\n  }\n\n  get size(): number {\n    return this.cache.size;\n  }\n}\n\n// ============================================================================\n// Suspicious Signal Detection\n// ============================================================================\n\n/** Only hostile-tier injection flags count — benign flags like\n * instruction_pattern (\"please remove\") must not trip the injection signal. */\nconst HOSTILE_INJECTION_FLAGS: readonly InjectionFlag[] = [\n  'system_prompt_manipulation',\n  'fake_conversation',\n  'authority_claim',\n  'hidden_content',\n];\n\nfunction hasHostileInjection(flags: readonly InjectionFlag[]): boolean {\n  return flags.some((f) => HOSTILE_INJECTION_FLAGS.includes(f));\n}\n\n/** Rapid-comment burst — only when both count and window are known (#3106). */\nfunction isRapidCommenting(m: GitHubUserMetadata): boolean {\n  return (\n    m.recentCommentCount !== undefined &&\n    m.recentCommentWindowMinutes !== undefined &&\n    m.recentCommentCount > SUSPICIOUS_THRESHOLDS.rapidCommentThreshold &&\n    m.recentCommentWindowMinutes <= SUSPICIOUS_THRESHOLDS.rapidCommentWindowMinutes\n  );\n}\n\n/** Authority claim from a non-maintainer role. */\nfunction isMismatchedAuthority(m: GitHubUserMetadata): boolean {\n  if (!m.injectionFlags.includes('authority_claim')) return false;\n  const association = m.authorAssociation.toUpperCase();\n  return association !== 'OWNER' && association !== 'MEMBER';\n}\n\n/** Detect all suspicious signals from user metadata. #3106: account/activity\n * signals are skipped when their data is absent — never fabricated. */\nfunction detectSuspiciousSignals(metadata: GitHubUserMetadata): SuspiciousSignal[] {\n  const signals: SuspiciousSignal[] = [];\n  const { accountAgeDays, priorContributions } = metadata;\n\n  if (accountAgeDays !== undefined && accountAgeDays < SUSPICIOUS_THRESHOLDS.newAccountDays) {\n    signals.push('new_account');\n  }\n  if (\n    priorContributions !== undefined &&\n    priorContributions < SUSPICIOUS_THRESHOLDS.minContributions\n  ) {\n    signals.push('no_prior_contributions');\n  }\n  if (hasHostileInjection(metadata.injectionFlags)) signals.push('injection_patterns_detected');\n  if (isRapidCommenting(metadata)) signals.push('rapid_comments');\n  if (isMismatchedAuthority(metadata)) signals.push('mismatched_authority_claim');\n\n  return signals;\n}\n\n/** Calculate a 0-100 reputation score. */\nfunction calculateReputationScore(\n  metadata: GitHubUserMetadata,\n  signals: readonly SuspiciousSignal[],\n  userRole: GitHubUserRole\n): number {\n  let score = 50; // baseline\n\n  // Role bonus\n  const roleBonus: Record<GitHubUserRole, number> = {\n    owner: 40,\n    maintainer: 35,\n    collaborator: 25,\n    contributor: 15,\n    member: 5,\n    unknown: 0,\n  };\n  score += roleBonus[userRole];\n\n  // Account age bonus (max +10). #3106: absent → no bonus (avoid NaN; an\n  // unknown account neither earns nor loses the age bonus).\n  if (metadata.accountAgeDays !== undefined) {\n    score += Math.min(metadata.accountAgeDays / DAYS_PER_YEAR_APPROX, 10);\n  }\n\n  // Contribution bonus (max +10). #3106: absent → no bonus.\n  if (metadata.priorContributions !== undefined) {\n    score += Math.min(metadata.priorContributions, 10);\n  }\n\n  // Suspicious signal penalties\n  const signalPenalty: Record<SuspiciousSignal, number> = {\n    new_account: -15,\n    no_prior_contributions: -10,\n    injection_patterns_detected: -25,\n    rapid_comments: -20,\n    mismatched_authority_claim: -30,\n  };\n  for (const signal of signals) {\n    score += signalPenalty[signal];\n  }\n\n  return Math.max(0, Math.min(100, Math.round(score)));\n}\n\n/** Map role string to GitHubUserRole. */\nfunction mapRole(association: string): GitHubUserRole {\n  switch (association.toUpperCase()) {\n    case 'OWNER':\n      return 'owner';\n    case 'MEMBER':\n      return 'member';\n    case 'COLLABORATOR':\n      return 'collaborator';\n    case 'CONTRIBUTOR':\n      return 'contributor';\n    default:\n      return 'unknown';\n  }\n}\n\n/** Determine effective trust tier from signals and role. */\nfunction determineEffectiveTier(\n  userRole: GitHubUserRole,\n  signals: readonly SuspiciousSignal[]\n): TrustTier {\n  const baseTier = ROLE_DEFAULT_TRUST[userRole];\n\n  // Hostile signals → Tier 4\n  const hostileSignals: SuspiciousSignal[] = [\n    'injection_patterns_detected',\n    'mismatched_authority_claim',\n  ];\n  if (signals.some((s) => hostileSignals.includes(s))) return '4';\n\n  // Multiple suspicious signals → downgrade by 1\n  if (signals.length >= 2) {\n    const baseNumeric = TRUST_TIER_NUMERIC[baseTier];\n    const downgraded = Math.min(baseNumeric + 1, 4);\n    return String(downgraded) as TrustTier;\n  }\n\n  return baseTier;\n}\n\n// ============================================================================\n// Public API\n// ============================================================================\n\n/**\n * Assess a GitHub user's reputation for trust classification.\n *\n * @param metadata - User metadata from GitHub API or local context.\n * @param cache - Optional cache instance for TTL-based deduplication.\n * @returns ReputationAssessment with trust tier and suspicious signals.\n */\nexport function assessReputation(\n  metadata: GitHubUserMetadata,\n  cache?: ReputationCache\n): ReputationAssessment {\n  // Check cache first\n  const cached = cache?.get(metadata.username);\n  if (cached !== undefined) return cached;\n\n  const userRole = mapRole(metadata.authorAssociation);\n  const signals = detectSuspiciousSignals(metadata);\n  const score = calculateReputationScore(metadata, signals, userRole);\n  const effectiveTier = determineEffectiveTier(userRole, signals);\n\n  const assessment: ReputationAssessment = {\n    username: metadata.username,\n    userRole,\n    suspiciousSignals: signals,\n    isSuspicious: signals.length > 0,\n    effectiveTrustTier: effectiveTier,\n    reputationScore: score,\n    reason: buildReason(userRole, signals, effectiveTier),\n    assessedAt: new Date().toISOString(),\n  };\n\n  cache?.set(metadata.username, assessment);\n  return assessment;\n}\n\n/**\n * Reconcile a trust-classifier tier with a reputation assessment into the\n * effective tier to enforce (#3119 / epic #3118). Demotion-only — reputation\n * can only RAISE the tier number (more restrictive), never lower it.\n *\n * Invariants:\n * - **Allowlist/Tier-1 wins**: a classifier Tier 1 (owner/allowlisted maintainer)\n *   is authoritative — reputation never demotes it.\n * - **Absent reputation → classifier tier**: no assessment (stage off / not\n *   fetched) keeps the classifier/role-default tier — never fabricate a benign\n *   tier, never escalate on mere absence (fetch-failure ≠ hostile signal).\n * - **Score is advisory**: only `effectiveTrustTier` participates; the 0–100\n *   `reputationScore` never moves the gate.\n */\nexport function reconcileTrustTier(\n  classifierTier: TrustTier,\n  reputation: ReputationAssessment | undefined\n): TrustTier {\n  if (classifierTier === '1') return '1';\n  const repTier = reputation?.effectiveTrustTier;\n  if (repTier === undefined) return classifierTier;\n  return TRUST_TIER_NUMERIC[repTier] > TRUST_TIER_NUMERIC[classifierTier]\n    ? repTier\n    : classifierTier;\n}\n\n// ============================================================================\n// Reputation gating rollout (#3122 / epic #3118 Phase 4)\n// ============================================================================\n\n/**\n * Rollout mode for reputation-based tier gating, mirroring\n * `NEXUS_ACCESS_POLICY_MODE` (#1977): `off` (no reputation effect), `audit`\n * (compute + report the would-be demotion but enforce the classifier tier), or\n * `enforce` (apply the demotion). Default `audit` — surface telemetry without\n * blocking until the false-positive rate is known, then flip to `enforce`.\n */\nexport const ReputationGatingModeSchema = z.enum(['off', 'audit', 'enforce']);\nexport type ReputationGatingMode = z.infer<typeof ReputationGatingModeSchema>;\n\n/** Default when `NEXUS_REPUTATION_GATING` is unset/invalid — audit (telemetry, no block). */\nexport const DEFAULT_REPUTATION_GATING_MODE: ReputationGatingMode = 'audit';\n\n/**\n * Resolve the gating mode from the environment (invalid → default + warn, never\n * throws — #3130). Delegates to the shared `resolveEnvMode` so this flag and\n * `NEXUS_ACCESS_POLICY_MODE` coerce identically.\n */\nexport function resolveReputationGatingMode(\n  env: NodeJS.ProcessEnv = process.env\n): ReputationGatingMode {\n  return resolveEnvMode(\n    env['NEXUS_REPUTATION_GATING'],\n    ReputationGatingModeSchema,\n    DEFAULT_REPUTATION_GATING_MODE,\n    'NEXUS_REPUTATION_GATING'\n  );\n}\n\n/** Outcome of applying the gating mode to a reputation assessment. */\nexport interface ReputationGateDecision {\n  /** Tier to actually enforce at the policy gate. */\n  readonly enforcedTier: TrustTier;\n  /** Tier reputation reconciliation computed (what `enforce` mode WOULD use). */\n  readonly reconciledTier: TrustTier;\n  /** True when reputation would demote but the mode (off/audit) did not enforce it. */\n  readonly demotionSuppressed: boolean;\n  readonly mode: ReputationGatingMode;\n}\n\n/**\n * Apply the rollout mode to a reputation assessment (#3122). `enforce` gates on\n * the reconciled (possibly demoted) tier; `audit`/`off` gate on the classifier\n * tier but report whether a demotion was suppressed (for telemetry). The\n * Tier-1/allowlist-wins and demotion-only invariants live in `reconcileTrustTier`,\n * so the allowlist remains the escape hatch in every mode.\n */\nexport function gateWithReputation(\n  classifierTier: TrustTier,\n  reputation: ReputationAssessment | undefined,\n  mode: ReputationGatingMode\n): ReputationGateDecision {\n  const reconciledTier =\n    mode === 'off' ? classifierTier : reconcileTrustTier(classifierTier, reputation);\n  const enforcedTier = mode === 'enforce' ? reconciledTier : classifierTier;\n  return {\n    enforcedTier,\n    reconciledTier,\n    demotionSuppressed: mode !== 'enforce' && reconciledTier !== classifierTier,\n    mode,\n  };\n}\n\n/** Build a human-readable reason string. */\nfunction buildReason(\n  role: GitHubUserRole,\n  signals: readonly SuspiciousSignal[],\n  tier: TrustTier\n): string {\n  if (signals.length === 0) {\n    return `Role ${role} → Tier ${tier} (no suspicious signals)`;\n  }\n  const signalList = signals.join(', ');\n  return `Role ${role} → Tier ${tier} (signals: ${signalList})`;\n}\n","/**\n * Shared resolver for `off`/`audit`/`enforce`-style security-mode env vars\n * (#3130). Both `resolveAccessPolicyMode` (ClawGuard, #1977) and\n * `resolveReputationGatingMode` (reputation gating, #3122) parse an enum env\n * var, coerce an invalid value to a safe default, and must NEVER throw — a\n * security layer must not fail-closed on a misconfiguration at startup.\n *\n * Previously the coercion was silent: a typo'd `enforce` (`enfroce`) degraded\n * to the default with no signal. This helper keeps the never-throw coercion but\n * emits a one-line `warn` so the misconfiguration is observable, and guarantees\n * both flags behave identically.\n *\n * @module security/env-mode\n */\n\nimport type { ZodType } from 'zod';\nimport { createLogger } from '../core/index.js';\nimport type { ILogger } from '../core/index.js';\n\nconst defaultLogger = createLogger({ component: 'env-mode' });\n\n/**\n * Resolve an enum-valued env var to one of its allowed values, coercing an\n * invalid/typo'd value to `fallback`. Unset or empty → `fallback` silently\n * (absence is normal, not a misconfiguration). A non-empty value that fails to\n * parse → `fallback` plus a `warn` (an explicit-but-invalid value is an operator\n * error worth surfacing). Never throws.\n *\n * @param raw     The raw env value (e.g. `process.env['NEXUS_X']`).\n * @param schema  Zod enum schema for the allowed values.\n * @param fallback Default returned when `raw` is absent/empty/invalid.\n * @param varName Env var name, for the warning message.\n * @param logger  Injectable for testing (defaults to the module logger).\n */\nexport function resolveEnvMode<T extends string>(\n  raw: string | undefined,\n  schema: ZodType<T>,\n  fallback: T,\n  varName: string,\n  logger: ILogger = defaultLogger\n): T {\n  if (typeof raw !== 'string' || raw.length === 0) return fallback;\n  const parsed = schema.safeParse(raw.toLowerCase());\n  if (parsed.success) return parsed.data;\n  logger.warn(`Invalid ${varName} value — coercing to default`, { raw, default: fallback });\n  return fallback;\n}\n"],"mappings":";;;;;;;AAWA,SAAS,SAAS;AAeX,IAAM,kBAAkB,EAAE,KAAK,CAAC,KAAK,KAAK,KAAK,GAAG,CAAC;AAInD,IAAM,qBAAgD;AAAA,EAC3D,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AACP;AASO,IAAM,uBAAuB,EAAE,KAAK;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAOM,IAAM,qBAAwD;AAAA,EACnE,OAAO;AAAA,EACP,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,aAAa;AAAA,EACb,QAAQ;AAAA,EACR,SAAS;AACX;AASO,IAAM,sBAAsB,EAAE,KAAK;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAMM,IAAM,wBAAwB,EAAE,OAAO;AAAA;AAAA,EAE5C,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAErB,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAExB,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AAAA,EAEzC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACpC,CAAC;AAWM,IAAM,uBAAuB,EAAE,OAAO;AAAA;AAAA,EAE3C,SAAS,EAAE,OAAO;AAAA;AAAA,EAElB,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AAAA,EAE7C,WAAW;AAAA;AAAA,EAEX,UAAU;AAAA;AAAA,EAEV,gBAAgB,EAAE,MAAM,mBAAmB;AAAA;AAAA,EAE3C,kBAAkB,EAAE,MAAM,qBAAqB;AAAA;AAAA,EAE/C,aAAa,EAAE,QAAQ;AAAA;AAAA,EAEvB,aAAa,EAAE,IAAI,SAAS;AAC9B,CAAC;AAUM,IAAM,wBAAwB,EAAE,OAAO;AAAA;AAAA,EAE5C,wBAAwB,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA;AAAA,EAE7D,UAAU,EAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA,EAElC,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAM;AAC5D,CAAC;;;AC9GD,IAAM,yBACJ;AASF,IAAM,wBACJ;AAMF,IAAM,uBAAuB;AAW7B,IAAM,qBAA8C;AAAA,EAClD;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AACF;AAiBA,IAAM,oBAAoB;AAC1B,IAAM,uBAAuB;AAE7B,SAAS,uBAAuB,SAA0B;AAIxD,aAAW,SAAS,QAAQ,SAAS,iBAAiB,GAAG;AACvD,QAAI,qBAAqB,KAAK,MAAM,CAAC,CAAC,EAAG,QAAO;AAAA,EAClD;AACA,SAAO;AACT;AAUA,IAAM,sBACJ;AAQF,IAAM,gCAAgC,IAAI;AAAA,EACxC,uCAAuC,mBAAmB;AAAA,EAC1D;AACF;AAGA,SAAS,eAAe,SAAyB;AAC/C,SACE,QAEG,QAAQ,aAAa,CAAC,QAAQ,QAAgB;AAC7C,UAAM,OAAO,OAAO,SAAS,KAAK,EAAE;AACpC,WAAO,OAAO,SAAS,IAAI,IAAI,OAAO,cAAc,IAAI,IAAI;AAAA,EAC9D,CAAC,EAEA,QAAQ,qBAAqB,CAAC,QAAQ,QAAgB;AACrD,UAAM,OAAO,OAAO,SAAS,KAAK,EAAE;AACpC,WAAO,OAAO,SAAS,IAAI,IAAI,OAAO,cAAc,IAAI,IAAI;AAAA,EAC9D,CAAC,EAEA,QAAQ,UAAU,GAAG,EACrB,QAAQ,UAAU,GAAG,EACrB,QAAQ,YAAY,GAAG,EACvB,QAAQ,YAAY,GAAG,EAEvB,QAAQ,WAAW,GAAG;AAE7B;AAMA,SAAS,0BAA0B,SAGjC;AACA,MAAI,CAAC,8BAA8B,KAAK,OAAO,GAAG;AAChD,WAAO,EAAE,SAAS,SAAS,UAAU,CAAC,EAAE;AAAA,EAC1C;AACA,QAAM,UAAU,eAAe,OAAO;AACtC,SAAO;AAAA,IACL,SAAS;AAAA,IACT,UAAU;AAAA,MACR;AAAA,QACE,KAAK;AAAA,QACL,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ,QAAQ,QAAQ;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AACF;AAQA,SAAS,mBAAmB,SAG1B;AACA,QAAM,WAA8B,CAAC;AACrC,MAAI,UAAU;AACd,QAAM,aAAa;AACnB,WAAS,OAAO,GAAG,OAAO,YAAY,QAAQ;AAC5C,2BAAuB,YAAY;AACnC,QAAI,CAAC,uBAAuB,KAAK,OAAO,EAAG;AAC3C,cAAU,QAAQ,QAAQ,wBAAwB,CAAC,OAAO,KAAK,KAAK,WAAmB;AACrF,eAAS,KAAK;AAAA,QACZ,KAAK,MAAM,MAAM,GAAG,EAAE,KAAK,MAAM,SAAS,KAAK,QAAQ;AAAA,QACvD,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ,QAAQ,MAAM;AAAA,MAChB,CAAC;AACD,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,SAAO,EAAE,SAAS,SAAS;AAC7B;AAIA,SAAS,aAAa,SAGpB;AACA,QAAM,WAA8B,CAAC;AACrC,MAAI,UAAU;AACd,QAAM,aAAa;AACnB,WAAS,OAAO,GAAG,OAAO,YAAY,QAAQ;AAC5C,0BAAsB,YAAY;AAClC,QAAI,CAAC,sBAAsB,KAAK,OAAO,EAAG;AAC1C,cAAU,QAAQ,QAAQ,uBAAuB,CAAC,OAAO,KAAK,WAAmB;AAC/E,eAAS,KAAK;AAAA,QACZ,KAAK;AAAA,QACL,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ,QAAQ,MAAM;AAAA,MAChB,CAAC;AACD,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,SAAO,EAAE,SAAS,SAAS;AAC7B;AAIA,SAAS,kBAAkB,SAGzB;AACA,QAAM,WAA8B,CAAC;AACrC,MAAI,UAAU;AAEd,QAAM,aAAa;AACnB,WAAS,OAAO,GAAG,OAAO,YAAY,QAAQ;AAC5C,yBAAqB,YAAY;AACjC,UAAM,aAAa,QAAQ;AAC3B,cAAU,QAAQ,QAAQ,sBAAsB,CAAC,OAAO,WAAmB;AACzE,YAAM,iBAAiB,iDAAiD,KAAK,KAAK;AAClF,UAAI,CAAC,eAAgB,QAAO;AAE5B,eAAS,KAAK;AAAA,QACZ,KAAK;AAAA,QACL,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ,QAAQ,MAAM;AAAA,MAChB,CAAC;AACD,aAAO;AAAA,IACT,CAAC;AACD,QAAI,QAAQ,WAAW,WAAY;AAAA,EACrC;AAEA,MAAI,aAAa;AACjB,SAAO,aAAa,QAAQ,QAAQ;AAClC,UAAM,UAAU,QAAQ,QAAQ,QAAQ,UAAU;AAClD,QAAI,YAAY,GAAI;AACpB,UAAM,WAAW,QAAQ,QAAQ,OAAO,UAAU,CAAC;AACnD,QAAI,aAAa,IAAI;AACnB,eAAS,KAAK;AAAA,QACZ,KAAK;AAAA,QACL,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ,QAAQ,QAAQ,SAAS;AAAA,MAC3B,CAAC;AACD,gBAAU,QAAQ,MAAM,GAAG,OAAO;AAClC;AAAA,IACF;AACA,iBAAa,WAAW;AAAA,EAC1B;AACA,SAAO,EAAE,SAAS,SAAS;AAC7B;AAGA,SAAS,wBAAwB,SAAkC;AACjE,QAAM,QAAQ,oBAAI,IAAmB;AACrC,aAAW,EAAE,MAAM,QAAQ,KAAK,oBAAoB;AAElD,YAAQ,YAAY;AACpB,QAAI,QAAQ,KAAK,OAAO,GAAG;AACzB,YAAM,IAAI,IAAI;AAAA,IAChB;AAAA,EACF;AACA,MAAI,uBAAuB,OAAO,GAAG;AACnC,UAAM,IAAI,gBAAgB;AAAA,EAC5B;AACA,SAAO,MAAM,KAAK,KAAK;AACzB;AAGA,SAAS,cAAc,UAAkC;AACvD,QAAM,QAAQ,SAAS,YAAY;AACnC,MAAI,SAAS,mBAAoB,QAAO;AACxC,SAAO;AACT;AAMA,SAAS,gBACP,UACA,gBACA,aACW;AACX,MAAI,YAAa,QAAO;AAMxB,QAAM,iBAAiB,cAAc,QAAQ;AAC7C,QAAM,WAAW,mBAAmB,cAAc;AAGlD,QAAM,eAAgC,CAAC,8BAA8B,mBAAmB;AACxF,MAAI,eAAe,KAAK,CAAC,MAAM,aAAa,SAAS,CAAC,CAAC,EAAG,QAAO;AAGjE,MACE,eAAe,SAAS,iBAAiB,KACzC,mBAAmB,WACnB,mBAAmB,cACnB;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AA+BO,SAAS,cACd,SACA,UACA,UACA,QACgB;AAChB,QAAM,MAAM,sBAAsB,MAAM,UAAU,CAAC,CAAC;AACpD,QAAM,YAAY,QAAQ,MAAM,GAAG,IAAI,cAAc;AACrD,QAAM,cAAc,IAAI,uBAAuB,SAAS,QAAQ;AAEhE,MAAI;AAEF,UAAM,gBAAgB,0BAA0B,SAAS;AACzD,UAAM,OAAO,mBAAmB,cAAc,OAAO;AACrD,UAAM,MAAM,aAAa,KAAK,OAAO;AACrC,UAAM,WAAW,kBAAkB,IAAI,OAAO;AAC9C,UAAM,cAAc;AAAA,MAClB,GAAG,cAAc;AAAA,MACjB,GAAG,KAAK;AAAA,MACR,GAAG,IAAI;AAAA,MACP,GAAG,SAAS;AAAA,IACd;AAGA,UAAM,iBAAiB,wBAAwB,SAAS;AAGxD,UAAM,YAAY,gBAAgB,UAAU,gBAAgB,WAAW;AAEvE,WAAO;AAAA,MACL,SAAS,SAAS;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB;AAAA,MACA;AAAA,MACA;AAAA,MACA,kBAAkB;AAAA,MAClB,aAAa,YAAY,SAAS;AAAA,MAClC,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,IACtC;AAAA,EACF,SAAS,KAAc;AACrB,WAAO,sBAAsB,KAAK,SAAS,WAAW,UAAU,WAAW;AAAA,EAC7E;AACF;AASA,SAAS,sBACP,KACA,iBACA,WACA,UACA,aACgB;AAChB,QAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,SAAO;AAAA,IACL,SAAS;AAAA,IACT,gBAAgB,gBAAgB;AAAA,IAChC,WAAW,cAAc,MAAM;AAAA,IAC/B;AAAA,IACA,gBAAgB,CAAC;AAAA,IACjB,kBAAkB;AAAA,MAChB;AAAA,QACE,KAAK;AAAA,QACL,QAAQ,6DAA6D,OAAO;AAAA,QAC5E,YAAY;AAAA,QACZ,QAAQ,UAAU;AAAA,MACpB;AAAA,IACF;AAAA,IACA,aAAa;AAAA,IACb,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,EACtC;AACF;;;AC5cA,SAAS,KAAAA,UAAS;;;ACQlB,IAAM,gBAAgB,aAAa,EAAE,WAAW,WAAW,CAAC;AAerD,SAAS,eACd,KACA,QACA,UACA,SACA,SAAkB,eACf;AACH,MAAI,OAAO,QAAQ,YAAY,IAAI,WAAW,EAAG,QAAO;AACxD,QAAM,SAAS,OAAO,UAAU,IAAI,YAAY,CAAC;AACjD,MAAI,OAAO,QAAS,QAAO,OAAO;AAClC,SAAO,KAAK,WAAW,OAAO,qCAAgC,EAAE,KAAK,SAAS,SAAS,CAAC;AACxF,SAAO;AACT;;;ADrBO,IAAM,yBAAyBC,GAAE,KAAK;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AA2CD,IAAM,uBAAuB;AAE7B,IAAM,wBAAwB;AAAA;AAAA,EAE5B,gBAAgB;AAAA;AAAA,EAEhB,kBAAkB;AAAA;AAAA,EAElB,uBAAuB;AAAA;AAAA,EAEvB,2BAA2B;AAC7B;AAcA,IAAM,iBAAyB,eAAe;AAC9C,IAAM,mBAAmB;AAOlB,IAAM,kBAAN,MAAsB;AAAA,EACV,QAAQ,oBAAI,IAAwB;AAAA,EACpC;AAAA,EACA;AAAA,EAEjB,YAAY,QAAQ,gBAAgB,UAAU,kBAAkB;AAC9D,SAAK,QAAQ;AACb,SAAK,UAAU;AAAA,EACjB;AAAA,EAEA,IAAI,UAAoD;AACtD,UAAM,QAAQ,KAAK,MAAM,IAAI,QAAQ;AACrC,QAAI,UAAU,OAAW,QAAO;AAChC,QAAI,gBAAgB,EAAE,IAAI,IAAI,MAAM,WAAW;AAC7C,WAAK,MAAM,OAAO,QAAQ;AAC1B,aAAO;AAAA,IACT;AACA,WAAO,MAAM;AAAA,EACf;AAAA,EAEA,IAAI,UAAkB,YAAwC;AAC5D,QAAI,KAAK,MAAM,QAAQ,KAAK,WAAW,CAAC,KAAK,MAAM,IAAI,QAAQ,GAAG;AAChE,WAAK,YAAY;AAAA,IACnB;AACA,SAAK,MAAM,IAAI,UAAU;AAAA,MACvB;AAAA,MACA,WAAW,gBAAgB,EAAE,IAAI,IAAI,KAAK;AAAA,IAC5C,CAAC;AAAA,EACH;AAAA;AAAA,EAGQ,cAAoB;AAC1B,UAAM,YAAY,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,UAAU,GAAG,CAAC;AAC5D,UAAM,OAAO,KAAK,MAAM,KAAK;AAC7B,aAAS,IAAI,GAAG,IAAI,WAAW,KAAK;AAClC,YAAM,OAAO,KAAK,KAAK;AACvB,UAAI,KAAK,SAAS,KAAM;AACxB,WAAK,MAAM,OAAO,KAAK,KAAK;AAAA,IAC9B;AAAA,EACF;AAAA,EAEA,QAAc;AACZ,SAAK,MAAM,MAAM;AAAA,EACnB;AAAA,EAEA,IAAI,OAAe;AACjB,WAAO,KAAK,MAAM;AAAA,EACpB;AACF;AAQA,IAAM,0BAAoD;AAAA,EACxD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,oBAAoB,OAA0C;AACrE,SAAO,MAAM,KAAK,CAAC,MAAM,wBAAwB,SAAS,CAAC,CAAC;AAC9D;AAGA,SAAS,kBAAkB,GAAgC;AACzD,SACE,EAAE,uBAAuB,UACzB,EAAE,+BAA+B,UACjC,EAAE,qBAAqB,sBAAsB,yBAC7C,EAAE,8BAA8B,sBAAsB;AAE1D;AAGA,SAAS,sBAAsB,GAAgC;AAC7D,MAAI,CAAC,EAAE,eAAe,SAAS,iBAAiB,EAAG,QAAO;AAC1D,QAAM,cAAc,EAAE,kBAAkB,YAAY;AACpD,SAAO,gBAAgB,WAAW,gBAAgB;AACpD;AAIA,SAAS,wBAAwB,UAAkD;AACjF,QAAM,UAA8B,CAAC;AACrC,QAAM,EAAE,gBAAgB,mBAAmB,IAAI;AAE/C,MAAI,mBAAmB,UAAa,iBAAiB,sBAAsB,gBAAgB;AACzF,YAAQ,KAAK,aAAa;AAAA,EAC5B;AACA,MACE,uBAAuB,UACvB,qBAAqB,sBAAsB,kBAC3C;AACA,YAAQ,KAAK,wBAAwB;AAAA,EACvC;AACA,MAAI,oBAAoB,SAAS,cAAc,EAAG,SAAQ,KAAK,6BAA6B;AAC5F,MAAI,kBAAkB,QAAQ,EAAG,SAAQ,KAAK,gBAAgB;AAC9D,MAAI,sBAAsB,QAAQ,EAAG,SAAQ,KAAK,4BAA4B;AAE9E,SAAO;AACT;AAGA,SAAS,yBACP,UACA,SACA,UACQ;AACR,MAAI,QAAQ;AAGZ,QAAM,YAA4C;AAAA,IAChD,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,SAAS;AAAA,EACX;AACA,WAAS,UAAU,QAAQ;AAI3B,MAAI,SAAS,mBAAmB,QAAW;AACzC,aAAS,KAAK,IAAI,SAAS,iBAAiB,sBAAsB,EAAE;AAAA,EACtE;AAGA,MAAI,SAAS,uBAAuB,QAAW;AAC7C,aAAS,KAAK,IAAI,SAAS,oBAAoB,EAAE;AAAA,EACnD;AAGA,QAAM,gBAAkD;AAAA,IACtD,aAAa;AAAA,IACb,wBAAwB;AAAA,IACxB,6BAA6B;AAAA,IAC7B,gBAAgB;AAAA,IAChB,4BAA4B;AAAA,EAC9B;AACA,aAAW,UAAU,SAAS;AAC5B,aAAS,cAAc,MAAM;AAAA,EAC/B;AAEA,SAAO,KAAK,IAAI,GAAG,KAAK,IAAI,KAAK,KAAK,MAAM,KAAK,CAAC,CAAC;AACrD;AAGA,SAAS,QAAQ,aAAqC;AACpD,UAAQ,YAAY,YAAY,GAAG;AAAA,IACjC,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAGA,SAAS,uBACP,UACA,SACW;AACX,QAAM,WAAW,mBAAmB,QAAQ;AAG5C,QAAM,iBAAqC;AAAA,IACzC;AAAA,IACA;AAAA,EACF;AACA,MAAI,QAAQ,KAAK,CAAC,MAAM,eAAe,SAAS,CAAC,CAAC,EAAG,QAAO;AAG5D,MAAI,QAAQ,UAAU,GAAG;AACvB,UAAM,cAAc,mBAAmB,QAAQ;AAC/C,UAAM,aAAa,KAAK,IAAI,cAAc,GAAG,CAAC;AAC9C,WAAO,OAAO,UAAU;AAAA,EAC1B;AAEA,SAAO;AACT;AAaO,SAAS,iBACd,UACA,OACsB;AAEtB,QAAM,SAAS,OAAO,IAAI,SAAS,QAAQ;AAC3C,MAAI,WAAW,OAAW,QAAO;AAEjC,QAAM,WAAW,QAAQ,SAAS,iBAAiB;AACnD,QAAM,UAAU,wBAAwB,QAAQ;AAChD,QAAM,QAAQ,yBAAyB,UAAU,SAAS,QAAQ;AAClE,QAAM,gBAAgB,uBAAuB,UAAU,OAAO;AAE9D,QAAM,aAAmC;AAAA,IACvC,UAAU,SAAS;AAAA,IACnB;AAAA,IACA,mBAAmB;AAAA,IACnB,cAAc,QAAQ,SAAS;AAAA,IAC/B,oBAAoB;AAAA,IACpB,iBAAiB;AAAA,IACjB,QAAQ,YAAY,UAAU,SAAS,aAAa;AAAA,IACpD,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,EACrC;AAEA,SAAO,IAAI,SAAS,UAAU,UAAU;AACxC,SAAO;AACT;AAgBO,SAAS,mBACd,gBACA,YACW;AACX,MAAI,mBAAmB,IAAK,QAAO;AACnC,QAAM,UAAU,YAAY;AAC5B,MAAI,YAAY,OAAW,QAAO;AAClC,SAAO,mBAAmB,OAAO,IAAI,mBAAmB,cAAc,IAClE,UACA;AACN;AAaO,IAAM,6BAA6BA,GAAE,KAAK,CAAC,OAAO,SAAS,SAAS,CAAC;AAIrE,IAAM,iCAAuD;AAO7D,SAAS,4BACd,MAAyB,QAAQ,KACX;AACtB,SAAO;AAAA,IACL,IAAI,yBAAyB;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAoBO,SAAS,mBACd,gBACA,YACA,MACwB;AACxB,QAAM,iBACJ,SAAS,QAAQ,iBAAiB,mBAAmB,gBAAgB,UAAU;AACjF,QAAM,eAAe,SAAS,YAAY,iBAAiB;AAC3D,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,oBAAoB,SAAS,aAAa,mBAAmB;AAAA,IAC7D;AAAA,EACF;AACF;AAGA,SAAS,YACP,MACA,SACA,MACQ;AACR,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAO,QAAQ,IAAI,gBAAW,IAAI;AAAA,EACpC;AACA,QAAM,aAAa,QAAQ,KAAK,IAAI;AACpC,SAAO,QAAQ,IAAI,gBAAW,IAAI,cAAc,UAAU;AAC5D;","names":["z","z"]}

package/dist/{chunk-F47QKVPH.js → chunk-4LEUIAYB.js}

@@ -42,7 +42,7 @@ import {
   writeJobComplete,
   writeJobFailed,
   writeJobPending
-} from "./chunk-UYOHV3EG.js";
+} from "./chunk-JCYCITBK.js";
 import {
   REGISTRY_PATH,
   getProjectRoot,
@@ -53,11 +53,14 @@ import {
   synthesizeResearch
 } from "./chunk-CGSVTROC.js";
 import {
-  IssueTriage
-} from "./chunk-L6JZCAFH.js";
+  IssueTriage,
+  createAuditTrail,
+  createGraphAuditBridge
+} from "./chunk-IHPYT6WU.js";
 import {
+  resolveEnvMode,
   sanitizeInput
-} from "./chunk-NR4NSTJH.js";
+} from "./chunk-27CNQPQ4.js";
 import {
   generateSecurityPlan
 } from "./chunk-57HMLBYN.js";
@@ -84,7 +87,7 @@ import {
   DEFAULT_TASK_TTL_MS,
   DEFAULT_TOOL_RATE_LIMITS,
   clampTaskTtl
-} from "./chunk-3HVSXLPL.js";
+} from "./chunk-MZFWRU6E.js";
 import {
   getAvailabilityCache,
   resolveFallback
@@ -32544,10 +32547,12 @@ var TaskAccessPolicySchema = z53.object({
 // src/security/access-constraint-deriver/config.ts
 var DEFAULT_ACCESS_POLICY_MODE = "audit";
 function resolveAccessPolicyMode(env = process.env) {
-  const raw = env["NEXUS_ACCESS_POLICY_MODE"];
-  if (typeof raw !== "string" || raw.length === 0) return DEFAULT_ACCESS_POLICY_MODE;
-  const parsed = AccessPolicyModeSchema.safeParse(raw.toLowerCase());
-  return parsed.success ? parsed.data : DEFAULT_ACCESS_POLICY_MODE;
+  return resolveEnvMode(
+    env["NEXUS_ACCESS_POLICY_MODE"],
+    AccessPolicyModeSchema,
+    DEFAULT_ACCESS_POLICY_MODE,
+    "NEXUS_ACCESS_POLICY_MODE"
+  );
 }
 
 // src/security/access-constraint-deriver/deriver.ts
@@ -39231,149 +39236,6 @@ function recordTriageOutcome(success, durationMs, errorMsg) {
   }
 }
 
-// src/security/audit-trail.ts
-var MAX_EVENTS = 1e4;
-var MAX_STRIPPED_ELEMENTS_PER_EVENT = 20;
-var AuditTrail = class {
-  events = [];
-  nextId = 1;
-  /** Appends an event to the trail. Returns the assigned event ID. */
-  append(event) {
-    const id = `audit-${String(this.nextId++)}`;
-    const fullEvent = {
-      ...event,
-      id,
-      timestamp: getTimeProvider().nowIso()
-    };
-    this.events.push(fullEvent);
-    this.enforceLimit();
-    return id;
-  }
-  /** Queries events matching the given filter. */
-  query(filter = {}) {
-    let results = this.events;
-    if (filter.type !== void 0) {
-      results = results.filter((e) => e.type === filter.type);
-    }
-    if (filter.since !== void 0) {
-      results = filterSince(results, filter.since);
-    }
-    if (filter.until !== void 0) {
-      results = filterUntil(results, filter.until);
-    }
-    if (filter.trustTier !== void 0) {
-      results = filterByTrustTier(results, filter.trustTier);
-    }
-    const limit = filter.limit ?? results.length;
-    return results.slice(-limit);
-  }
-  /** Returns the total number of events. */
-  get size() {
-    return this.events.length;
-  }
-  /** Clears all events. */
-  clear() {
-    this.events = [];
-  }
-  /** Enforces MAX_EVENTS bound. */
-  enforceLimit() {
-    if (this.events.length > MAX_EVENTS) {
-      this.events = this.events.slice(-MAX_EVENTS);
-    }
-  }
-};
-function filterSince(events, since) {
-  const sinceTime = new Date(since).getTime();
-  return events.filter((e) => new Date(e.timestamp).getTime() >= sinceTime);
-}
-function filterUntil(events, until) {
-  const untilTime = new Date(until).getTime();
-  return events.filter((e) => new Date(e.timestamp).getTime() <= untilTime);
-}
-function filterByTrustTier(events, tier) {
-  return events.filter((e) => {
-    if (e.type === "trust_classification") return e.assignedTier === tier;
-    if (e.type === "policy_gate") return e.inputTrustTier === tier;
-    if (e.type === "reputation") return e.effectiveTier === tier;
-    return true;
-  });
-}
-function emitTrustEvent(trail, data) {
-  return trail.append({
-    type: "trust_classification",
-    component: "trust-classifier",
-    ...data
-  });
-}
-function emitPolicyEvent(trail, data) {
-  return trail.append({
-    type: "policy_gate",
-    component: "policy-gate",
-    ...data
-  });
-}
-function emitCorroborationEvent(trail, data) {
-  return trail.append({
-    type: "corroboration",
-    component: "corroboration-validator",
-    ...data
-  });
-}
-function emitReputationEvent(trail, data) {
-  return trail.append({
-    type: "reputation",
-    component: "reputation-model",
-    ...data
-  });
-}
-function emitSanitizationEvent(trail, data) {
-  return trail.append({
-    type: "sanitization",
-    component: "input-sanitizer",
-    ...data
-  });
-}
-function emitGraphExecutionEvent(trail, data) {
-  return trail.append({
-    type: "graph_execution",
-    component: "graph-executor",
-    ...data
-  });
-}
-function createGraphAuditBridge(trail) {
-  return (event) => {
-    const nodeId = typeof event["nodeId"] === "string" ? event["nodeId"] : void 0;
-    const stepNumber = typeof event["stepNumber"] === "number" ? event["stepNumber"] : 0;
-    emitGraphExecutionEvent(trail, {
-      graphEvent: event.type,
-      ...nodeId !== void 0 ? { nodeId } : {},
-      stepNumber,
-      detail: formatGraphEventDetail(event)
-    });
-  };
-}
-function formatGraphEventDetail(event) {
-  switch (event.type) {
-    case "node_started":
-      return `Node ${String(event["nodeId"])} starting`;
-    case "node_completed":
-      return `Node ${String(event["nodeId"])} completed in ${String(event["durationMs"])}ms`;
-    case "node_error":
-      return `Node ${String(event["nodeId"])} failed: ${String(event["error"])}`;
-    case "state_updated":
-      return `State updated: ${String(event["updatedKeys"])}`;
-    case "step_completed":
-      return `Step ${String(event["stepNumber"])}: ${String(event["nodesExecuted"])} nodes`;
-    case "execution_complete":
-      return `Complete: ${String(event["totalSteps"])} steps, ${String(event["durationMs"])}ms`;
-    default:
-      return event.type;
-  }
-}
-function createAuditTrail() {
-  return new AuditTrail();
-}
-
 // src/mcp/tools/run-graph-workflow.ts
 import { z as z70 } from "zod";
 var RunGraphWorkflowInputSchema = z70.object({
@@ -42523,7 +42385,7 @@ async function tryIssueTriage(task) {
   try {
     const issueMatch = task.match(/github\.com\/([^/]+\/[^/]+)\/issues\/(\d+)/);
     if (issueMatch === null) return null;
-    const { createIssueTriage } = await import("./issue-triage-FVZOVIRX.js");
+    const { createIssueTriage } = await import("./issue-triage-VB5CVE43.js");
     const triage = createIssueTriage();
     const owner = issueMatch[1] ?? "";
     const num = issueMatch[2] ?? "";
@@ -43548,7 +43410,7 @@ ${contextBlock}`;
       const strategy = config.votingStrategy ?? "higher_order";
       await postProgress(config, "Vote", `Running consensus with ${strategy} strategy...`);
       try {
-        const { executeVoting } = await import("./consensus-vote-VSRNSZ5J.js");
+        const { executeVoting } = await import("./consensus-vote-4RIUUEZQ.js");
         const votingResult = await executeVoting(
           {
             proposal: plan.slice(0, 4e3),
@@ -44324,7 +44186,7 @@ ${codeContext}`;
         const result = await stages.research(enrichedTask);
         return output(PIPELINE_STATE_KEYS.RESEARCH, result, getTimeProvider().now() - start, true);
       } catch (e) {
-        return failOutput(PIPELINE_STATE_KEYS.RESEARCH, String(e), getTimeProvider().now() - start);
+        return failOutput(PIPELINE_STATE_KEYS.RESEARCH, getErrorMessage(e), getTimeProvider().now() - start);
       }
     }
   };
@@ -44346,7 +44208,7 @@ ${priorArt}` : research;
         const result = await stages.plan(ctx.task, enrichedResearch, feedback);
         return output(PIPELINE_STATE_KEYS.PLAN, result, getTimeProvider().now() - start, true);
       } catch (e) {
-        return failOutput(PIPELINE_STATE_KEYS.PLAN, String(e), getTimeProvider().now() - start);
+        return failOutput(PIPELINE_STATE_KEYS.PLAN, getErrorMessage(e), getTimeProvider().now() - start);
       }
     }
   };
@@ -44369,7 +44231,7 @@ function createVoteStageWrapper(stages) {
           success: isApproved(vote)
         };
       } catch (e) {
-        return failOutput(PIPELINE_STATE_KEYS.VOTE_RESULT, String(e), getTimeProvider().now() - start);
+        return failOutput(PIPELINE_STATE_KEYS.VOTE_RESULT, getErrorMessage(e), getTimeProvider().now() - start);
       }
     }
   };
@@ -44385,7 +44247,7 @@ function createDecomposeStageWrapper(stages) {
         const tasks = await stages.decompose(plan);
         return output(PIPELINE_STATE_KEYS.TASKS, tasks, getTimeProvider().now() - start, true);
       } catch (e) {
-        return failOutput(PIPELINE_STATE_KEYS.TASKS, String(e), getTimeProvider().now() - start);
+        return failOutput(PIPELINE_STATE_KEYS.TASKS, getErrorMessage(e), getTimeProvider().now() - start);
       }
     }
   };
@@ -44401,7 +44263,7 @@ function createImplementStageWrapper(stages) {
         const results = await Promise.all(tasks.map((t) => stages.implement(t)));
         return output(PIPELINE_STATE_KEYS.IMPLEMENTATIONS, results, getTimeProvider().now() - start, true);
       } catch (e) {
-        return failOutput(PIPELINE_STATE_KEYS.IMPLEMENTATIONS, String(e), getTimeProvider().now() - start);
+        return failOutput(PIPELINE_STATE_KEYS.IMPLEMENTATIONS, getErrorMessage(e), getTimeProvider().now() - start);
       }
     }
   };
@@ -44419,7 +44281,7 @@ function createQaStageWrapper(stages) {
         const allPass = reviews.every((r) => r.verdict === "pass");
         return output(PIPELINE_STATE_KEYS.QA_ITERATIONS, reviews, getTimeProvider().now() - start, allPass);
       } catch (e) {
-        return failOutput(PIPELINE_STATE_KEYS.QA_ITERATIONS, String(e), getTimeProvider().now() - start);
+        return failOutput(PIPELINE_STATE_KEYS.QA_ITERATIONS, getErrorMessage(e), getTimeProvider().now() - start);
       }
     }
   };
@@ -44439,7 +44301,7 @@ function createSecurityStageWrapper(stages) {
           result.passed
         );
       } catch (e) {
-        return failOutput(PIPELINE_STATE_KEYS.SECURITY_PASSED, String(e), getTimeProvider().now() - start);
+        return failOutput(PIPELINE_STATE_KEYS.SECURITY_PASSED, getErrorMessage(e), getTimeProvider().now() - start);
       }
     }
   };
@@ -44532,7 +44394,7 @@ function createAnalyzeStageWrapper() {
         const summary = `Language: ${String(analysis.language)}, Framework: ${String(analysis.framework)}, CI: ${String(analysis.ciProvider)}, Security: ${analysis.securityTooling.join(", ") || "none"}`;
         return output(PIPELINE_STATE_KEYS.RESEARCH, summary, getTimeProvider().now() - start, true);
       } catch (e) {
-        return failOutput(PIPELINE_STATE_KEYS.RESEARCH, String(e), getTimeProvider().now() - start);
+        return failOutput(PIPELINE_STATE_KEYS.RESEARCH, getErrorMessage(e), getTimeProvider().now() - start);
       }
     }
   };
@@ -44553,7 +44415,7 @@ function createScanStageWrapper() {
         }
         return output(PIPELINE_STATE_KEYS.FINDINGS, "No repository to scan", getTimeProvider().now() - start, true);
       } catch (e) {
-        return failOutput(PIPELINE_STATE_KEYS.FINDINGS, String(e), getTimeProvider().now() - start);
+        return failOutput(PIPELINE_STATE_KEYS.FINDINGS, getErrorMessage(e), getTimeProvider().now() - start);
       }
     }
   };
@@ -51743,16 +51605,6 @@ export {
   registerResearchSynthesizeTool,
   IssueTriageInputSchema,
   registerIssueTriageTool,
-  MAX_STRIPPED_ELEMENTS_PER_EVENT,
-  AuditTrail,
-  emitTrustEvent,
-  emitPolicyEvent,
-  emitCorroborationEvent,
-  emitReputationEvent,
-  emitSanitizationEvent,
-  emitGraphExecutionEvent,
-  createGraphAuditBridge,
-  createAuditTrail,
   RunGraphWorkflowInputSchema,
   registerRunGraphWorkflowTool,
   parseSpec,
@@ -51876,4 +51728,4 @@ export {
   detectBackend,
   createTaskTracker
 };
-//# sourceMappingURL=chunk-F47QKVPH.js.map
+//# sourceMappingURL=chunk-4LEUIAYB.js.map