nexus-agents 2.92.3 → 2.92.4

package/dist/index.js

@@ -27,7 +27,6 @@ import {
   AuditQueryCriteriaSchema,
   AuditResourceSchema,
   AuditSeveritySchema,
-  AuditTrail,
   AuthorizationMethodSchema,
   BUILT_IN_RULES,
   BUILT_IN_TEMPLATES,
@@ -139,7 +138,6 @@ import {
   LoadedSkillSetSchema,
   MAX_DIFF_LENGTH,
   MAX_EXECUTION_TIME_MS,
-  MAX_STRIPPED_ELEMENTS_PER_EVENT,
   MIN_EXPERTS_FOR_PATTERN,
   MODEL_CAPABILITIES,
   MemoryQueryInputSchema,
@@ -308,7 +306,6 @@ import {
   createArchitectureExpert,
   createAttestation,
   createAuditLogger,
-  createAuditTrail,
   createCheckpoint,
   createCheckpointStore,
   createCodeExpert,
@@ -330,7 +327,6 @@ import {
   createExecutionPlan,
   createFeedbackIntegration,
   createFeedbackSubscriber,
-  createGraphAuditBridge,
   createInitializedWorkflowEngine,
   createInteractionGraph,
   createIsolatedRegistry,
@@ -372,21 +368,15 @@ import {
   customReducer,
   decomposeSpec,
   delegateInputToTaskContract,
-  emitCorroborationEvent,
   emitExecutionComplete,
-  emitGraphExecutionEvent,
   emitNodeResults,
   emitNodeStarted,
   emitPipelineStageEvent,
-  emitPolicyEvent,
-  emitReputationEvent,
-  emitSanitizationEvent,
   emitStageCompleted,
   emitStageFailed,
   emitStageStarted,
   emitStateUpdated,
   emitStepCompleted,
-  emitTrustEvent,
   estimateTokens,
   evaluatePolicy as evaluatePolicy2,
   executeDelegatePipeline,
@@ -519,7 +509,7 @@ import {
   validateWorkflow,
   validateWorkflowDependencies,
   withLogging
-} from "./chunk-7UPXKDF2.js";
+} from "./chunk-4LEUIAYB.js";
 import {
   getTokenEnvVars,
   hasToken,
@@ -632,7 +622,7 @@ import {
   validateToolInput,
   withModelNotFoundFallback,
   wrapResilientWithFallback
-} from "./chunk-UYOHV3EG.js";
+} from "./chunk-JCYCITBK.js";
 import {
   AdapterModelError,
   BaseAdapter,
@@ -663,14 +653,25 @@ import {
 import "./chunk-CGSVTROC.js";
 import {
   AgentActionSchema,
+  AuditTrail,
   GitHubReviewer,
   GitHubUserInfo,
+  MAX_STRIPPED_ELEMENTS_PER_EVENT,
   SourceCitationSchema,
   ViolationSchema,
   canInfluenceDecisions,
   canProceed,
+  checkRuleOfTwo,
   classifyTrust,
+  createAuditTrail,
   createFullGitHubProvider,
+  createGraphAuditBridge,
+  emitCorroborationEvent,
+  emitGraphExecutionEvent,
+  emitPolicyEvent,
+  emitReputationEvent,
+  emitSanitizationEvent,
+  emitTrustEvent,
   evaluatePolicy as evaluatePolicy3,
   getCorroborationRules,
   getRequiredTrustTier,
@@ -681,7 +682,7 @@ import {
   requiresCorroboration,
   validateAgentAction,
   validateCorroboration
-} from "./chunk-C6PEYEPU.js";
+} from "./chunk-IHPYT6WU.js";
 import {
   GitHubProvider,
   ScmError
@@ -740,7 +741,7 @@ import {
   getKnownNexusVarNames,
   startStdioServer,
   validateNexusEnv
-} from "./chunk-BFYOPX2E.js";
+} from "./chunk-MZFWRU6E.js";
 import {
   AvailabilityCache,
   filterAvailableModels,
@@ -4152,6 +4153,7 @@ function decodeATLValue(value) {
 }
 
 // src/security/firewall/firewall-pipeline.ts
+var logger4 = createLogger({ component: "HostileInputFirewall" });
 var HostileInputFirewall = class {
   stages;
   allowlisted;
@@ -4159,6 +4161,7 @@ var HostileInputFirewall = class {
   adapter;
   reputationCache;
   auditTrail;
+  context;
   constructor(config) {
     const validated = FirewallConfigSchema.parse({
       stages: config.stages,
@@ -4172,6 +4175,7 @@ var HostileInputFirewall = class {
     this.adapter = config.adapter;
     this.reputationCache = new ReputationCache();
     this.auditTrail = createAuditTrail();
+    this.context = validated.context;
   }
   /**
    * Processes untrusted input through the firewall pipeline.
@@ -4188,6 +4192,18 @@ var HostileInputFirewall = class {
     const reputation = this.runReputation(meta, sanitized);
     const effectiveTrustTier = reconcileTrustTier(trust.trustTier, reputation);
     const atl = this.buildATL(meta, effectiveTrustTier, sanitized, reputation);
+    const ruleOfTwoViolation = this.stages.policyEnforcement ? checkRuleOfTwo({
+      inputTrustTier: effectiveTrustTier,
+      hasWriteAccess: this.context.hasWriteAccess,
+      hasSecretAccess: this.context.hasSecretAccess
+    }) : void 0;
+    if (ruleOfTwoViolation !== void 0) {
+      logger4.warn("Firewall surfaced a Rule-of-Two violation", {
+        user: meta.username,
+        effectiveTrustTier,
+        rule: ruleOfTwoViolation.rule
+      });
+    }
     const auditEvents = this.auditTrail.query().map((e) => ({ id: e.id, type: e.type }));
     return ok({
       sanitized,
@@ -4195,6 +4211,7 @@ var HostileInputFirewall = class {
       ...reputation !== void 0 ? { reputation } : {},
       effectiveTrustTier,
       atl,
+      ...ruleOfTwoViolation !== void 0 ? { ruleOfTwoViolation } : {},
       auditEvents,
       durationMs: Date.now() - start
     });
@@ -4797,7 +4814,7 @@ var DEFAULT_BENCHMARK_CONFIG = {
 
 // src/benchmarks/benchmark-runner.ts
 import { cpus, totalmem, platform, arch } from "os";
-var logger4 = createLogger({ component: "benchmark-runner" });
+var logger5 = createLogger({ component: "benchmark-runner" });
 var LatencySampler = class {
   samples = [];
   startTimes = /* @__PURE__ */ new Map();
@@ -4893,11 +4910,11 @@ async function runOperationBenchmark(operation, datasetSize, fn, config = {}) {
   const startTime = getTimeProvider().now();
   const startMemory = process.memoryUsage().heapUsed;
   let peakMemory = startMemory;
-  logger4.debug("Running warmup", { operation, iterations: cfg.warmupIterations });
+  logger5.debug("Running warmup", { operation, iterations: cfg.warmupIterations });
   for (let i = 0; i < cfg.warmupIterations; i++) {
     await fn();
   }
-  logger4.debug("Running measurements", { operation, iterations: cfg.measurementIterations });
+  logger5.debug("Running measurements", { operation, iterations: cfg.measurementIterations });
   for (let i = 0; i < cfg.measurementIterations; i++) {
     const id = `op-${String(i)}`;
     sampler.start(id);
@@ -5022,7 +5039,7 @@ ${"=".repeat(60)}`);
 }
 
 // src/benchmarks/memory-benchmarks.ts
-var logger5 = createLogger({ component: "memory-benchmarks" });
+var logger6 = createLogger({ component: "memory-benchmarks" });
 var DEFAULT_MEMORY_BENCHMARK_CONFIG = {
   ...DEFAULT_BENCHMARK_CONFIG,
   contentSizeBytes: 1024,
@@ -5130,9 +5147,9 @@ async function benchmarkPrune(backend, data, config) {
 async function runMemoryBenchmarks(backend, name, config = {}) {
   const cfg = { ...DEFAULT_MEMORY_BENCHMARK_CONFIG, ...config };
   const operations = [];
-  logger5.info("Starting memory benchmarks", { name, sizes: cfg.datasetSizes });
+  logger6.info("Starting memory benchmarks", { name, sizes: cfg.datasetSizes });
   for (const size of cfg.datasetSizes) {
-    logger5.info("Running benchmarks for dataset size", { size });
+    logger6.info("Running benchmarks for dataset size", { size });
     const data = generateTestData(size, cfg);
     try {
       const futureDate = new Date(getTimeProvider().now() + 365 * 24 * 60 * 60 * 1e3);
@@ -5146,7 +5163,7 @@ async function runMemoryBenchmarks(backend, name, config = {}) {
   }
   const environment = getBenchmarkEnvironment();
   const summary = createBenchmarkSummary(operations, cfg);
-  logger5.info("Benchmarks complete", {
+  logger6.info("Benchmarks complete", {
     name,
     passed: summary.passed,
     avgP95: summary.avgP95Latency,
@@ -5192,7 +5209,7 @@ function compareBenchmarks(baseline, current) {
 }
 
 // src/benchmarks/token-benchmark.ts
-var logger6 = createLogger({ component: "token-benchmark" });
+var logger7 = createLogger({ component: "token-benchmark" });
 var CHARS_PER_TOKEN2 = 4;
 function estimateTokens2(text) {
   return Math.ceil(text.length / CHARS_PER_TOKEN2);
@@ -5210,7 +5227,7 @@ async function runTokenBenchmark(backend, config = {}) {
   const cfg = { ...DEFAULT_MEMORY_BENCHMARK_CONFIG, ...config };
   const results = [];
   for (const size of cfg.datasetSizes) {
-    logger6.info("Running token benchmark", { size });
+    logger7.info("Running token benchmark", { size });
     const data = generateTestData(size, cfg);
     for (const entry of data.entries) {
       await backend.store(entry.key, entry.content, {
@@ -5243,15 +5260,15 @@ async function runTokenBenchmark(backend, config = {}) {
 }
 
 // src/benchmarks/consolidation-benchmark.ts
-var logger7 = createLogger({ component: "consolidation-benchmark" });
+var logger8 = createLogger({ component: "consolidation-benchmark" });
 async function runConsolidationBenchmark(operations, config = {}) {
   const cfg = { ...DEFAULT_MEMORY_BENCHMARK_CONFIG, ...config };
   const benchmarks = [];
-  logger7.info("Starting consolidation benchmarks", {
+  logger8.info("Starting consolidation benchmarks", {
     operationCount: operations.length
   });
   for (const op of operations) {
-    logger7.info("Benchmarking consolidation operation", { name: op.name });
+    logger8.info("Benchmarking consolidation operation", { name: op.name });
     const benchmark = await runOperationBenchmark(
       op.name,
       0,
@@ -5366,7 +5383,7 @@ function formatBenchmarkReport(report) {
 }
 
 // src/benchmarks/adapter-latency-benchmark.ts
-var logger8 = createLogger({ component: "adapter-latency-benchmark" });
+var logger9 = createLogger({ component: "adapter-latency-benchmark" });
 var DEFAULT_ADAPTER_LATENCY_CONFIG = {
   warmupIterations: 3,
   measurementIterations: 10,
@@ -5416,7 +5433,7 @@ async function benchmarkScenario(adapter, scenario, config) {
   const errors = [];
   let successCount = 0;
   let failureCount = 0;
-  logger8.info("Benchmarking scenario", {
+  logger9.info("Benchmarking scenario", {
     adapter: adapter.name,
     scenario: scenario.name,
     warmup: config.warmupIterations,
@@ -5837,10 +5854,10 @@ var GateCheckResultSchema = z16.object({
 });
 
 // src/pipeline/quality-pipeline.ts
-var logger9 = createLogger({ component: "quality-pipeline" });
+var logger10 = createLogger({ component: "quality-pipeline" });
 
 // src/pipeline/research-trigger.ts
-var logger10 = createLogger({ component: "research-trigger" });
+var logger11 = createLogger({ component: "research-trigger" });
 var DEFAULT_QUALITY_THRESHOLD = 7;
 var DEFAULT_MAX_TRIGGERS = 3;
 function parseDiscoveries(text) {
@@ -5872,7 +5889,7 @@ async function checkForResearchTriggers(config = {}) {
       `Use research_discover to find recent papers and repos about "${topic}". For each result, include: title, quality score (1-10), and source URL.`
     );
     if (!result.success) {
-      logger10.debug("Research trigger: expert unavailable", { error: result.error });
+      logger11.debug("Research trigger: expert unavailable", { error: result.error });
       return [];
     }
     const discoveries = parseDiscoveries(result.text);
@@ -5888,7 +5905,7 @@ Assess this research for applicability to nexus-agents.`,
       status: "pending"
     }));
     if (tasks.length > 0) {
-      logger10.info("Research triggers created", {
+      logger11.info("Research triggers created", {
         total: discoveries.length,
         qualified: qualified.length,
         triggered: tasks.length
@@ -5896,13 +5913,13 @@ Assess this research for applicability to nexus-agents.`,
     }
     return tasks;
   } catch (error) {
-    logger10.debug("Research trigger failed gracefully", { error: String(error) });
+    logger11.debug("Research trigger failed gracefully", { error: String(error) });
     return [];
   }
 }
 
 // src/pipeline/research-pipeline.ts
-var logger11 = createLogger({ component: "research-pipeline" });
+var logger12 = createLogger({ component: "research-pipeline" });
 
 // src/pipeline/iterative-consensus.ts
 var defaultLogger = createLogger({ component: "iterative-consensus" });
@@ -5971,7 +5988,7 @@ function buildVotingInput(plan, config) {
 }
 async function executeSingleVote(plan, config, log) {
   try {
-    const { executeVoting } = await import("./consensus-vote-VSRNSZ5J.js");
+    const { executeVoting } = await import("./consensus-vote-4RIUUEZQ.js");
     const input = buildVotingInput(plan, config);
     const result = await executeVoting(input, log);
     return parseVotingResult(result);
@@ -6056,7 +6073,7 @@ function formatContent(content) {
 }
 
 // src/replay/replay-executor.ts
-var logger12 = createLogger({ component: "ReplayExecutor" });
+var logger13 = createLogger({ component: "ReplayExecutor" });
 export {
   ALLOWED_COMMANDS,
   ARTIFACT_TYPES,