nexus-agents 2.92.5 → 2.94.0

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   createGitHubProvider,
   createScmProvider
-} from "./chunk-GKFFRRS4.js";
+} from "./chunk-ADRTAUJA.js";
 import {
   ALLOWED_COMMANDS,
   ARTIFACT_TYPES,
@@ -378,7 +378,7 @@ import {
   emitStateUpdated,
   emitStepCompleted,
   estimateTokens,
-  evaluatePolicy as evaluatePolicy2,
+  evaluatePipelinePolicy,
   executeDelegatePipeline,
   executeGraph,
   executeOrchestratePipeline,
@@ -509,26 +509,26 @@ import {
   validateWorkflow,
   validateWorkflowDependencies,
   withLogging
-} from "./chunk-KTJUMU2A.js";
+} from "./chunk-UC3PVIN4.js";
 import {
   getTokenEnvVars,
   hasToken,
   resolveToken
-} from "./chunk-DQEREDUW.js";
+} from "./chunk-OSSGG7KW.js";
 import "./chunk-OK6U5N5Y.js";
 import {
   OPENAI_MODELS,
   OPENAI_MODEL_ALIASES,
   OpenAIAdapter,
   createOpenAIAdapter
-} from "./chunk-TOQJ3UN5.js";
+} from "./chunk-Q3NUA7CW.js";
 import {
   CliCircuitBreakerIntegration,
   createCliCircuitBreakerIntegration
-} from "./chunk-EI2E43HI.js";
+} from "./chunk-EDPDH5YT.js";
 import {
   executeExpert
-} from "./chunk-G55LVPNH.js";
+} from "./chunk-2YMRRZRM.js";
 import {
   AgentFindingSchema,
   AgentPerformanceSchema,
@@ -622,7 +622,7 @@ import {
   validateToolInput,
   withModelNotFoundFallback,
   wrapResilientWithFallback
-} from "./chunk-NYWZI46K.js";
+} from "./chunk-TNBWHOPY.js";
 import {
   AdapterModelError,
   BaseAdapter,
@@ -646,11 +646,11 @@ import {
   transformStream,
   validateApiKeyPresence,
   withTimeout
-} from "./chunk-DSERRMPX.js";
+} from "./chunk-L7I55FAN.js";
 import {
   PROVIDER_ENV_KEYS
-} from "./chunk-SIICMKBA.js";
-import "./chunk-P646QQYW.js";
+} from "./chunk-YDXGYKZJ.js";
+import "./chunk-G5EBHQ2L.js";
 import {
   AgentActionSchema,
   AuditTrail,
@@ -672,7 +672,7 @@ import {
   emitReputationEvent,
   emitSanitizationEvent,
   emitTrustEvent,
-  evaluatePolicy as evaluatePolicy3,
+  evaluatePolicy as evaluatePolicy2,
   getCorroborationRules,
   getRequiredTrustTier,
   isMutatingAction,
@@ -682,11 +682,11 @@ import {
   requiresCorroboration,
   validateAgentAction,
   validateCorroboration
-} from "./chunk-BG4WK4UP.js";
+} from "./chunk-76535ZNP.js";
 import {
   GitHubProvider,
   ScmError
-} from "./chunk-YQAS2EGR.js";
+} from "./chunk-EJR6U67L.js";
 import {
   GitHubUserRoleSchema,
   InjectionFlagSchema,
@@ -701,7 +701,7 @@ import {
   assessReputation,
   reconcileTrustTier,
   sanitizeInput
-} from "./chunk-VBIAMMZZ.js";
+} from "./chunk-EB43BGAR.js";
 import {
   FALLBACK_SCANNER_DATA,
   buildPlanFromAnalysis,
@@ -709,7 +709,7 @@ import {
   generateSecurityPlan,
   getRegistryManifest,
   resolveScannerData
-} from "./chunk-2QJJYCPD.js";
+} from "./chunk-FUGPKYEJ.js";
 import {
   analyzeGitHubRepo,
   analyzeRepo,
@@ -719,10 +719,10 @@ import "./chunk-3ACDP4E6.js";
 import {
   PersistentStrategyDistiller,
   RulesSnapshotSchema
-} from "./chunk-VU54VB6K.js";
+} from "./chunk-OKGHHCS5.js";
 import {
   MemoryError
-} from "./chunk-FL3AXIUL.js";
+} from "./chunk-63OGXDHS.js";
 import {
   AppConfigSchema,
   ExpertConfigSchema,
@@ -741,7 +741,7 @@ import {
   getKnownNexusVarNames,
   startStdioServer,
   validateNexusEnv
-} from "./chunk-QXGLZETS.js";
+} from "./chunk-77JUKFTG.js";
 import {
   AvailabilityCache,
   filterAvailableModels,
@@ -750,15 +750,15 @@ import {
   getFallbackChain,
   resetAvailabilityCache,
   resolveFallback
-} from "./chunk-YJUHVQSG.js";
+} from "./chunk-GMZDRTVJ.js";
 import {
   AvailableModelsCache,
   getDefaultAvailableModelsCache,
   setDefaultAvailableModelsCache
-} from "./chunk-U4RLBLNO.js";
+} from "./chunk-KSJPDQSG.js";
 import {
   DEFAULTS
-} from "./chunk-PIDABDFE.js";
+} from "./chunk-43UDRX3N.js";
 import "./chunk-NUBSJGQZ.js";
 import "./chunk-6T3EPABN.js";
 import {
@@ -789,9 +789,9 @@ import {
   isCliAvailable,
   isRetryableError,
   sleep
-} from "./chunk-DNSBKQ7I.js";
-import "./chunk-MBK6P4VV.js";
-import "./chunk-ZYYU26YH.js";
+} from "./chunk-4QESFYGV.js";
+import "./chunk-24WC4XO2.js";
+import "./chunk-XBPFVWA2.js";
 import {
   BUILT_IN_EXPERTS,
   BuiltInExpertTypeSchema,
@@ -802,7 +802,7 @@ import {
   validateExpertConfig
 } from "./chunk-ZM4O442V.js";
 import "./chunk-PQHVC4BD.js";
-import "./chunk-OXLXVSN3.js";
+import "./chunk-LCLVSNST.js";
 import {
   AgentCapability,
   AgentError,
@@ -877,7 +877,7 @@ import {
   toError,
   unwrap,
   unwrapOr
-} from "./chunk-L5BXCSMP.js";
+} from "./chunk-OT6V5ROA.js";
 import "./chunk-CH7QIDHQ.js";
 import "./chunk-PR4QN5HX.js";
 
@@ -4054,6 +4054,141 @@ function getSafetyTaxonomySummary() {
   };
 }
 
+// src/security/audit-bridge.ts
+var logger4 = createLogger({ component: "SecurityAuditBridge" });
+function systemActor(id, name) {
+  return name !== void 0 ? { type: "system", id, name } : { type: "system", id };
+}
+function userActor(username) {
+  return { type: "user", id: username };
+}
+function mapTrust(e) {
+  const severity = e.wasDowngraded ? "warning" : "info";
+  return {
+    category: "authorization",
+    severity,
+    outcome: "success",
+    action: "security.trust_classification",
+    actor: userActor(e.username),
+    description: e.reason,
+    metadata: {
+      assignedTier: e.assignedTier,
+      userRole: e.userRole,
+      isAllowlisted: e.isAllowlisted,
+      wasDowngraded: e.wasDowngraded,
+      component: e.component
+    }
+  };
+}
+function mapPolicyGate(e) {
+  const outcome = e.allowed ? "success" : "denied";
+  return {
+    category: "authorization",
+    severity: e.allowed ? "info" : "warning",
+    outcome,
+    action: "security.policy_gate",
+    actor: systemActor(e.component),
+    policyName: "security.policy_gate",
+    policyDecision: e.allowed ? "allow" : "deny",
+    ...e.violationRules.length > 0 ? { violationType: e.violationRules.join(",") } : {},
+    metadata: {
+      actionType: e.actionType,
+      requiresApproval: e.requiresApproval,
+      inputTrustTier: e.inputTrustTier,
+      violationRules: e.violationRules
+    }
+  };
+}
+function mapCorroboration(e) {
+  return {
+    category: "security",
+    severity: e.satisfied ? "info" : "warning",
+    outcome: e.satisfied ? "success" : "denied",
+    action: "security.corroboration",
+    actor: systemActor(e.component),
+    metadata: {
+      actionType: e.actionType,
+      sourceCount: e.sourceCount,
+      missingRequirements: e.missingRequirements
+    }
+  };
+}
+function mapReputation(e) {
+  return {
+    category: "security",
+    severity: e.isSuspicious ? "warning" : "info",
+    outcome: "success",
+    action: "security.reputation",
+    actor: userActor(e.username),
+    metadata: {
+      reputationScore: e.reputationScore,
+      isSuspicious: e.isSuspicious,
+      effectiveTier: e.effectiveTier,
+      signalCount: e.signalCount,
+      component: e.component
+    }
+  };
+}
+function mapSanitization(e) {
+  return {
+    category: "security",
+    severity: e.injectionFlagCount > 0 ? "warning" : "info",
+    outcome: "success",
+    action: "security.sanitization",
+    actor: systemActor(e.component, e.source),
+    metadata: {
+      source: e.source,
+      wasModified: e.wasModified,
+      strippedCount: e.strippedCount,
+      injectionFlagCount: e.injectionFlagCount,
+      strippedElements: e.strippedElements
+    }
+  };
+}
+function mapGraphExecution(e) {
+  return {
+    category: "system",
+    severity: "info",
+    outcome: "success",
+    action: "security.graph_execution",
+    actor: systemActor(e.component),
+    description: e.detail,
+    metadata: {
+      graphEvent: e.graphEvent,
+      ...e.nodeId !== void 0 ? { nodeId: e.nodeId } : {},
+      stepNumber: e.stepNumber
+    }
+  };
+}
+function securityAuditEventToInput(event) {
+  switch (event.type) {
+    case "trust_classification":
+      return mapTrust(event);
+    case "policy_gate":
+      return mapPolicyGate(event);
+    case "corroboration":
+      return mapCorroboration(event);
+    case "reputation":
+      return mapReputation(event);
+    case "sanitization":
+      return mapSanitization(event);
+    case "graph_execution":
+      return mapGraphExecution(event);
+  }
+}
+function createDurableAuditSink(auditLogger) {
+  return (event) => {
+    try {
+      auditLogger.log(securityAuditEventToInput(event));
+    } catch (error) {
+      logger4.warn("Failed to mirror security event to durable audit log", {
+        type: event.type,
+        error: getErrorMessage(error)
+      });
+    }
+  };
+}
+
 // src/security/firewall/firewall-types.ts
 import { z as z6 } from "zod";
 var FirewallStagesSchema = z6.object({
@@ -4153,7 +4288,7 @@ function decodeATLValue(value) {
 }
 
 // src/security/firewall/firewall-pipeline.ts
-var logger4 = createLogger({ component: "HostileInputFirewall" });
+var logger5 = createLogger({ component: "HostileInputFirewall" });
 var HostileInputFirewall = class {
   stages;
   allowlisted;
@@ -4174,7 +4309,9 @@ var HostileInputFirewall = class {
     this.maxInputLength = validated.maxInputLength;
     this.adapter = config.adapter;
     this.reputationCache = new ReputationCache();
-    this.auditTrail = createAuditTrail();
+    this.auditTrail = createAuditTrail(
+      config.auditLogger !== void 0 ? createDurableAuditSink(config.auditLogger) : void 0
+    );
     this.context = validated.context;
   }
   /**
@@ -4198,7 +4335,7 @@ var HostileInputFirewall = class {
       hasSecretAccess: this.context.hasSecretAccess
     }) : void 0;
     if (ruleOfTwoViolation !== void 0) {
-      logger4.warn("Firewall surfaced a Rule-of-Two violation", {
+      logger5.warn("Firewall surfaced a Rule-of-Two violation", {
         user: meta.username,
         effectiveTrustTier,
         rule: ruleOfTwoViolation.rule
@@ -4814,7 +4951,7 @@ var DEFAULT_BENCHMARK_CONFIG = {
 
 // src/benchmarks/benchmark-runner.ts
 import { cpus, totalmem, platform, arch } from "os";
-var logger5 = createLogger({ component: "benchmark-runner" });
+var logger6 = createLogger({ component: "benchmark-runner" });
 var LatencySampler = class {
   samples = [];
   startTimes = /* @__PURE__ */ new Map();
@@ -4910,11 +5047,11 @@ async function runOperationBenchmark(operation, datasetSize, fn, config = {}) {
   const startTime = getTimeProvider().now();
   const startMemory = process.memoryUsage().heapUsed;
   let peakMemory = startMemory;
-  logger5.debug("Running warmup", { operation, iterations: cfg.warmupIterations });
+  logger6.debug("Running warmup", { operation, iterations: cfg.warmupIterations });
   for (let i = 0; i < cfg.warmupIterations; i++) {
     await fn();
   }
-  logger5.debug("Running measurements", { operation, iterations: cfg.measurementIterations });
+  logger6.debug("Running measurements", { operation, iterations: cfg.measurementIterations });
   for (let i = 0; i < cfg.measurementIterations; i++) {
     const id = `op-${String(i)}`;
     sampler.start(id);
@@ -5039,7 +5176,7 @@ ${"=".repeat(60)}`);
 }
 
 // src/benchmarks/memory-benchmarks.ts
-var logger6 = createLogger({ component: "memory-benchmarks" });
+var logger7 = createLogger({ component: "memory-benchmarks" });
 var DEFAULT_MEMORY_BENCHMARK_CONFIG = {
   ...DEFAULT_BENCHMARK_CONFIG,
   contentSizeBytes: 1024,
@@ -5147,9 +5284,9 @@ async function benchmarkPrune(backend, data, config) {
 async function runMemoryBenchmarks(backend, name, config = {}) {
   const cfg = { ...DEFAULT_MEMORY_BENCHMARK_CONFIG, ...config };
   const operations = [];
-  logger6.info("Starting memory benchmarks", { name, sizes: cfg.datasetSizes });
+  logger7.info("Starting memory benchmarks", { name, sizes: cfg.datasetSizes });
   for (const size of cfg.datasetSizes) {
-    logger6.info("Running benchmarks for dataset size", { size });
+    logger7.info("Running benchmarks for dataset size", { size });
     const data = generateTestData(size, cfg);
     try {
       const futureDate = new Date(getTimeProvider().now() + 365 * 24 * 60 * 60 * 1e3);
@@ -5163,7 +5300,7 @@ async function runMemoryBenchmarks(backend, name, config = {}) {
   }
   const environment = getBenchmarkEnvironment();
   const summary = createBenchmarkSummary(operations, cfg);
-  logger6.info("Benchmarks complete", {
+  logger7.info("Benchmarks complete", {
     name,
     passed: summary.passed,
     avgP95: summary.avgP95Latency,
@@ -5209,7 +5346,7 @@ function compareBenchmarks(baseline, current) {
 }
 
 // src/benchmarks/token-benchmark.ts
-var logger7 = createLogger({ component: "token-benchmark" });
+var logger8 = createLogger({ component: "token-benchmark" });
 var CHARS_PER_TOKEN2 = 4;
 function estimateTokens2(text) {
   return Math.ceil(text.length / CHARS_PER_TOKEN2);
@@ -5227,7 +5364,7 @@ async function runTokenBenchmark(backend, config = {}) {
   const cfg = { ...DEFAULT_MEMORY_BENCHMARK_CONFIG, ...config };
   const results = [];
   for (const size of cfg.datasetSizes) {
-    logger7.info("Running token benchmark", { size });
+    logger8.info("Running token benchmark", { size });
     const data = generateTestData(size, cfg);
     for (const entry of data.entries) {
       await backend.store(entry.key, entry.content, {
@@ -5260,15 +5397,15 @@ async function runTokenBenchmark(backend, config = {}) {
 }
 
 // src/benchmarks/consolidation-benchmark.ts
-var logger8 = createLogger({ component: "consolidation-benchmark" });
+var logger9 = createLogger({ component: "consolidation-benchmark" });
 async function runConsolidationBenchmark(operations, config = {}) {
   const cfg = { ...DEFAULT_MEMORY_BENCHMARK_CONFIG, ...config };
   const benchmarks = [];
-  logger8.info("Starting consolidation benchmarks", {
+  logger9.info("Starting consolidation benchmarks", {
     operationCount: operations.length
   });
   for (const op of operations) {
-    logger8.info("Benchmarking consolidation operation", { name: op.name });
+    logger9.info("Benchmarking consolidation operation", { name: op.name });
     const benchmark = await runOperationBenchmark(
       op.name,
       0,
@@ -5383,7 +5520,7 @@ function formatBenchmarkReport(report) {
 }
 
 // src/benchmarks/adapter-latency-benchmark.ts
-var logger9 = createLogger({ component: "adapter-latency-benchmark" });
+var logger10 = createLogger({ component: "adapter-latency-benchmark" });
 var DEFAULT_ADAPTER_LATENCY_CONFIG = {
   warmupIterations: 3,
   measurementIterations: 10,
@@ -5433,7 +5570,7 @@ async function benchmarkScenario(adapter, scenario, config) {
   const errors = [];
   let successCount = 0;
   let failureCount = 0;
-  logger9.info("Benchmarking scenario", {
+  logger10.info("Benchmarking scenario", {
     adapter: adapter.name,
     scenario: scenario.name,
     warmup: config.warmupIterations,
@@ -5685,7 +5822,13 @@ var PIPELINE_EVENT_TYPES = [
   "tool.invoked",
   "tool.completed",
   "wave.started",
-  "wave.completed"
+  "wave.completed",
+  // Signal events (#3147 P2 — close the loop). Push-only producers (fitness
+  // audit, swarm health, consensus) emit these; the TuneStage consumes them.
+  // Unlike the #3022 learning.* types, these ship WITH their consumer.
+  "signal.fitness_declined",
+  "signal.swarm_unhealthy",
+  "signal.vote_rejected"
 ];
 
 // src/pipeline/artifact-store.ts
@@ -5854,10 +5997,10 @@ var GateCheckResultSchema = z16.object({
 });
 
 // src/pipeline/quality-pipeline.ts
-var logger10 = createLogger({ component: "quality-pipeline" });
+var logger11 = createLogger({ component: "quality-pipeline" });
 
 // src/pipeline/research-trigger.ts
-var logger11 = createLogger({ component: "research-trigger" });
+var logger12 = createLogger({ component: "research-trigger" });
 var DEFAULT_QUALITY_THRESHOLD = 7;
 var DEFAULT_MAX_TRIGGERS = 3;
 function parseDiscoveries(text) {
@@ -5889,7 +6032,7 @@ async function checkForResearchTriggers(config = {}) {
       `Use research_discover to find recent papers and repos about "${topic}". For each result, include: title, quality score (1-10), and source URL.`
     );
     if (!result.success) {
-      logger11.debug("Research trigger: expert unavailable", { error: result.error });
+      logger12.debug("Research trigger: expert unavailable", { error: result.error });
       return [];
     }
     const discoveries = parseDiscoveries(result.text);
@@ -5905,7 +6048,7 @@ Assess this research for applicability to nexus-agents.`,
       status: "pending"
     }));
     if (tasks.length > 0) {
-      logger11.info("Research triggers created", {
+      logger12.info("Research triggers created", {
         total: discoveries.length,
         qualified: qualified.length,
         triggered: tasks.length
@@ -5913,13 +6056,13 @@ Assess this research for applicability to nexus-agents.`,
     }
     return tasks;
   } catch (error) {
-    logger11.debug("Research trigger failed gracefully", { error: String(error) });
+    logger12.debug("Research trigger failed gracefully", { error: String(error) });
     return [];
   }
 }
 
 // src/pipeline/research-pipeline.ts
-var logger12 = createLogger({ component: "research-pipeline" });
+var logger13 = createLogger({ component: "research-pipeline" });
 
 // src/pipeline/iterative-consensus.ts
 var defaultLogger = createLogger({ component: "iterative-consensus" });
@@ -5988,7 +6131,7 @@ function buildVotingInput(plan, config) {
 }
 async function executeSingleVote(plan, config, log) {
   try {
-    const { executeVoting } = await import("./consensus-vote-IDHQVKX2.js");
+    const { executeVoting } = await import("./consensus-vote-TO5575P3.js");
     const input = buildVotingInput(plan, config);
     const result = await executeVoting(input, log);
     return parseVotingResult(result);
@@ -6073,7 +6216,7 @@ function formatContent(content) {
 }
 
 // src/replay/replay-executor.ts
-var logger13 = createLogger({ component: "ReplayExecutor" });
+var logger14 = createLogger({ component: "ReplayExecutor" });
 export {
   ALLOWED_COMMANDS,
   ARTIFACT_TYPES,
@@ -6756,9 +6899,9 @@ export {
   estimateTokens2 as estimateBenchmarkTokens,
   estimateTaskComplexity,
   estimateTokens,
-  evaluatePolicy2 as evaluatePipelinePolicy,
+  evaluatePipelinePolicy,
   evaluatePolicy,
-  evaluatePolicy3 as evaluateSecurityPolicy,
+  evaluatePolicy2 as evaluateSecurityPolicy,
   executeCliRetryLoop,
   executeDelegatePipeline,
   executeExpert,