nexus-agents 3.0.0 → 3.1.1

package/dist/{chunk-NNYEQJGE.js → chunk-D33VCEA6.js}

@@ -1,19 +1,19 @@
 import {
   resolveToken
-} from "./chunk-KAP2ANOE.js";
+} from "./chunk-T6HI32EC.js";
 import {
   REGISTRY_PATH,
   getProjectRoot,
   loadPapersRegistry,
   loadTechniquesRegistry,
   savePapersRegistry
-} from "./chunk-6H7U2JU4.js";
+} from "./chunk-E6JME6SQ.js";
 import {
   resolveInsideRoot
 } from "./chunk-NUBSJGQZ.js";
 import {
   getToolMemory
-} from "./chunk-4QAYK6FB.js";
+} from "./chunk-GTU2GK4H.js";
 import {
   capitalizeWords,
   truncateSentence
@@ -38,7 +38,7 @@ import {
   getTimeProvider,
   ok,
   registerPersistentDistillerFactory
-} from "./chunk-UU6NLFCT.js";
+} from "./chunk-ATNHVLKJ.js";
 import {
   ensureLearningDir,
   getRulesFile
@@ -4090,4 +4090,4 @@ export {
   DEFAULT_CONTEXT_BUDGET_TOKENS,
   getContextPromptPrefix
 };
-//# sourceMappingURL=chunk-NNYEQJGE.js.map
+//# sourceMappingURL=chunk-D33VCEA6.js.map

package/dist/{chunk-2UKQZKVD.js → chunk-DITV4B6I.js}

@@ -1,6 +1,6 @@
 import {
   generateSecurityPlan
-} from "./chunk-3JH24XIY.js";
+} from "./chunk-ENZ3IWEM.js";
 import {
   analyzeGitHubRepo
 } from "./chunk-HFOQKCD2.js";
@@ -21,10 +21,10 @@ import {
   DEFAULT_TASK_TTL_MS,
   DEFAULT_TOOL_RATE_LIMITS,
   clampTaskTtl
-} from "./chunk-HEQSO64K.js";
+} from "./chunk-NSIPB65X.js";
 import {
   executeExpert
-} from "./chunk-D3SA4NDV.js";
+} from "./chunk-EL62KWUE.js";
 import {
   JobStatusSchema,
   abortJob,
@@ -45,21 +45,21 @@ import {
   simulationDeniedResult,
   toJobSummary,
   writeJobCancelled
-} from "./chunk-DYIDH4YE.js";
+} from "./chunk-5UFRDLQT.js";
 import {
   normalizeTopicToCanonical,
   synthesizeResearch
-} from "./chunk-6A33GEM2.js";
+} from "./chunk-Z2VEERCP.js";
 import {
   IssueTriage
-} from "./chunk-SVTHQ7DA.js";
+} from "./chunk-QZINUMKA.js";
 import {
   resolveEnvMode,
   sanitizeInput
-} from "./chunk-WSNUM6MS.js";
+} from "./chunk-TIQXKIIA.js";
 import {
   withPrerequisite
-} from "./chunk-HHV6DOS4.js";
+} from "./chunk-47WSUCLS.js";
 import {
   NOOP_NOTIFIER,
   RateLimiter,
@@ -82,18 +82,18 @@ import {
   withAuditTrail,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-3VRG7I7N.js";
+} from "./chunk-VV7KSMMR.js";
 import {
   createAuditTrail,
   createGraphAuditBridge,
   emitPipelinePolicyEvent
-} from "./chunk-2J4J5QKD.js";
+} from "./chunk-F47KBREM.js";
 import {
   EventTopics,
   createEvent,
   getGlobalEventBus,
   getGlobalRegistry
-} from "./chunk-4LLIXFC2.js";
+} from "./chunk-4AF6CP7P.js";
 import {
   IDENTIFIER_RE,
   LANG_VALUES,
@@ -126,15 +126,15 @@ import {
   parseRegistry,
   sourceExistsInRegistry,
   summarizeContextForPrompt
-} from "./chunk-NNYEQJGE.js";
+} from "./chunk-D33VCEA6.js";
 import {
   getTokenEnvVars,
   resolveToken
-} from "./chunk-KAP2ANOE.js";
+} from "./chunk-T6HI32EC.js";
 import {
   loadPapersRegistry,
   loadTechniquesRegistry
-} from "./chunk-6H7U2JU4.js";
+} from "./chunk-E6JME6SQ.js";
 import {
   resolveInsideRoot
 } from "./chunk-NUBSJGQZ.js";
@@ -143,14 +143,14 @@ import {
   MemoryImportance,
   calculateTextJaccardSimilarity,
   getToolMemory
-} from "./chunk-4QAYK6FB.js";
+} from "./chunk-GTU2GK4H.js";
 import {
   STOPWORDS,
   truncateWithInfo
 } from "./chunk-6T3EPABN.js";
 import {
   createSessionMemory
-} from "./chunk-V55IINXG.js";
+} from "./chunk-QRZPGTZN.js";
 import {
   BUILT_IN_EXPERTS,
   BuiltInExpertTypeSchema,
@@ -168,25 +168,25 @@ import {
   getAvailableClis,
   sleep,
   withTimeout
-} from "./chunk-NO6GYQAS.js";
+} from "./chunk-A5QBZ5EC.js";
 import {
   BaseAdapter,
   createStream,
   requireApiKey,
   validateApiKeyPresence
-} from "./chunk-MCICMFFK.js";
+} from "./chunk-HEZ6VTMO.js";
 import {
   DEFAULTS
-} from "./chunk-MHGARBUZ.js";
+} from "./chunk-NGFG5TIB.js";
 import {
   getAvailabilityCache,
   getCliForModelId,
   resolveFallback
-} from "./chunk-JHJV7CYZ.js";
+} from "./chunk-RHO52DBX.js";
 import {
   generateHyphenId,
   generateUUID
-} from "./chunk-BFDUELKY.js";
+} from "./chunk-25TDC2C4.js";
 import {
   AGENT_ROUTER_TIMEOUTS,
   API_TIMEOUTS,
@@ -283,7 +283,7 @@ import {
   selectStrategyByManifest,
   toExpertTaskAnalysisResult,
   withStep
-} from "./chunk-UU6NLFCT.js";
+} from "./chunk-ATNHVLKJ.js";
 import {
   ensureLearningDir,
   getMetaOutcomesFile,
@@ -28353,7 +28353,7 @@ function execIdFields(executionId) {
 async function populateUnifiedContextOnState(state, options) {
   const taskCandidate = state["task"];
   if (typeof taskCandidate !== "string" || taskCandidate === "") return;
-  const { getContextForTask: getContextForTask2, inferTaskCategory: inferTaskCategory2 } = await import("./context-retriever-ZVFRYEDL.js");
+  const { getContextForTask: getContextForTask2, inferTaskCategory: inferTaskCategory2 } = await import("./context-retriever-UDERFG2L.js");
   const category = inferTaskCategory2(taskCandidate);
   const executionId = options?.executionId;
   const execFields = execIdFields(executionId);
@@ -43889,7 +43889,7 @@ async function tryIssueTriage(task) {
   try {
     const issueMatch = task.match(/github\.com\/([^/]+\/[^/]+)\/issues\/(\d+)/);
     if (issueMatch === null) return null;
-    const { createIssueTriage } = await import("./issue-triage-O6Z2CTJM.js");
+    const { createIssueTriage } = await import("./issue-triage-3YWM3P2C.js");
     const triage = createIssueTriage();
     const owner = issueMatch[1] ?? "";
     const num = issueMatch[2] ?? "";
@@ -43917,7 +43917,7 @@ var VALID_TEMPLATES = /* @__PURE__ */ new Set([
 ]);
 async function classifyWithLLM(task) {
   try {
-    const { executeExpert: executeExpert2 } = await import("./expert-bridge-MMBE2ZPR.js");
+    const { executeExpert: executeExpert2 } = await import("./expert-bridge-NIYLN24L.js");
     const prompt = [
       "Classify this task into exactly one pipeline template.",
       "Templates: dev (implementation/bug fix/refactor), research (investigate/evaluate/compare),",
@@ -45558,7 +45558,7 @@ var memoryInitPromise = null;
 async function initPipelineMemory() {
   if (cachedMemory !== null) return cachedMemory;
   try {
-    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-Y7WMBRAR.js");
+    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-QISTJJOX.js");
     const { getLearningDir } = await import("./learning-persistence-EGY4VKKO.js");
     const mem = createSessionMemory2(getLearningDir());
     mem.startSession(`pipeline-${String(getTimeProvider().now())}`);
@@ -45620,7 +45620,7 @@ function recordRoutingExperience(category, success, durationMs, tokensUsed = 0,
     callRecord(routingMemoryCache);
     return;
   }
-  routingMemoryInitPromise ??= import("./routing-memory-GFCQT2FW.js").then(({ createRoutingMemory }) => {
+  routingMemoryInitPromise ??= import("./routing-memory-3XURCXXF.js").then(({ createRoutingMemory }) => {
     routingMemoryCache ??= createRoutingMemory();
     return routingMemoryCache;
   }).catch((error) => {
@@ -45654,7 +45654,7 @@ ${text}` : "";
 }
 async function getWeatherContext() {
   try {
-    const { generateWeatherReport: generateWeatherReport2 } = await import("./weather-report-3EDM3NPV.js");
+    const { generateWeatherReport: generateWeatherReport2 } = await import("./weather-report-22DR27KY.js");
     const report = generateWeatherReport2({ includeAdaptive: true });
     const mappings = "recommendedMappings" in report ? report.recommendedMappings : [];
     if (!Array.isArray(mappings) || mappings.length === 0) return "";
@@ -45672,7 +45672,7 @@ ${lines}
 }
 async function getMemoryContext(task) {
   try {
-    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-Y7WMBRAR.js");
+    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-QISTJJOX.js");
     const { getLearningDir } = await import("./learning-persistence-EGY4VKKO.js");
     const memory = createSessionMemory2(getLearningDir(), { maxLearningsInContext: 10 });
     const learnings = memory.searchLearnings(task.slice(0, 200));
@@ -45787,7 +45787,7 @@ ${contextBlock}`;
       const strategy = config.votingStrategy ?? "higher_order";
       await postProgress(config, "Vote", `Running consensus with ${strategy} strategy...`);
       try {
-        const { executeVoting } = await import("./consensus-vote-VFOLUM6M.js");
+        const { executeVoting } = await import("./consensus-vote-6GL7NIDU.js");
         const votingResult = await executeVoting(
           {
             proposal: buildVoteProposal(plan, research),
@@ -46228,7 +46228,7 @@ async function searchCodebaseForTask(task) {
 }
 async function queryResearchRegistry(task) {
   try {
-    const { synthesizeResearch: synthesizeResearch2 } = await import("./research-helpers-synthesize-O3UTWKGT.js");
+    const { synthesizeResearch: synthesizeResearch2 } = await import("./research-helpers-synthesize-EHDMCB6P.js");
     const topic = task.split(/[.!?\n]/).filter((s) => s.trim().length > 10)[0]?.trim();
     if (topic === void 0) return null;
     const result = await synthesizeResearch2(topic.slice(0, 50));
@@ -46299,7 +46299,7 @@ function createScanStageWrapper() {
       try {
         const slug = ctx.task.match(/([a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+)/)?.[1];
         if (slug !== void 0) {
-          const { generateSecurityPlan: generateSecurityPlan2 } = await import("./repo-security-plan-4BYFJZUQ.js");
+          const { generateSecurityPlan: generateSecurityPlan2 } = await import("./repo-security-plan-NUMTKVMR.js");
           const plan = await generateSecurityPlan2({ repo: slug, maxScanners: 10 });
           const recs = plan.recommendations.slice(0, 5).map((r) => `${r.priority}: ${r.displayName} (${r.category})`).join("; ");
           return output(PIPELINE_STATE_KEYS.FINDINGS, recs, getTimeProvider().now() - start, true);
@@ -46668,87 +46668,6 @@ function persistPrReviewRecord(opts) {
   }
 }
 
-// src/mcp/tools/pr-review-record-producer.ts
-function buildAndPersist(prNumber, baseSha, args) {
-  const { input, aggregate, counts, reviewCount, logger: logger58, coverage } = args;
-  const coverageSuffix = coverage?.partial === true ? ` [partial coverage: ${String(coverage.reviewedFiles)}/${String(coverage.totalFiles)} files reviewed, dropped: ${coverage.droppedFiles.join(", ")}]` : "";
-  if (reviewedDiffWasTruncated(input.prDiff)) {
-    logger58.warn(
-      "Reviewed diff exceeds the hash byte cap; content past it is unbound in reviewedDiffHash",
-      { prNumber }
-    );
-  }
-  const record = persistPrReviewRecord({
-    prNumber,
-    baseSha,
-    reviewedDiffHash: computeReviewedDiffHash(input.prDiff),
-    verdict: aggregate.decision,
-    verified: aggregate.verified,
-    voteCounts: {
-      approve: counts.approveCount,
-      request_changes: counts.requestChangesCount,
-      abstain: counts.abstainCount,
-      error: counts.errorCount,
-      total: reviewCount
-    },
-    summary: `${aggregate.decision} (${String(counts.approveCount)} approve / ${String(counts.requestChangesCount)} request_changes / ${String(counts.abstainCount)} abstain) \u2014 ${input.prTitle}${coverageSuffix}`,
-    // #4278: lets a caller (e.g. an MCP server whose cwd has no `.git`
-    // ancestor) say where the repo is, so the record isn't silently dropped.
-    ...input.repoPath !== void 0 ? { repoPathOverride: input.repoPath } : {},
-    logger: logger58
-  });
-  if (record === void 0) {
-    return {
-      persisted: false,
-      reason: "write-failed",
-      detail: "Audit record could not be written: the records path was unresolved or the append failed (see server logs for the underlying cause)."
-    };
-  }
-  return {
-    persisted: true,
-    prNumber: record.prNumber,
-    baseSha: record.baseSha,
-    reviewedDiffHash: record.reviewedDiffHash,
-    sequence: record.sequence
-  };
-}
-function persistReviewRecord(args) {
-  const { input } = args;
-  if (input.prNumber === void 0 || input.baseSha === void 0) {
-    return {
-      persisted: false,
-      reason: "binding-inputs-absent",
-      detail: "No audit record written: supply both prNumber and baseSha to persist an Option-C governor-review record bound to {prNumber, baseSha, reviewedDiffHash}."
-    };
-  }
-  if (input.simulate) {
-    return {
-      persisted: false,
-      reason: "simulated",
-      detail: "No audit record written: the review used simulated voters, and a committed governance record must not be seeded from non-live output (mirrors #2319)."
-    };
-  }
-  const { counts } = args;
-  if (counts.approveCount + counts.requestChangesCount + counts.abstainCount === 0) {
-    return {
-      persisted: false,
-      reason: "no-live-votes",
-      detail: "No audit record written: every voter errored, so the aggregate verdict reflects no live review. A committed governor-review record must not be seeded from a failed panel (the pr_review analogue of no_quorum, #4053)."
-    };
-  }
-  try {
-    return buildAndPersist(input.prNumber, input.baseSha, args);
-  } catch (error) {
-    const detail = error instanceof Error ? error.message : String(error);
-    args.logger.warn("Audit-record persistence threw (non-fatal)", { detail });
-    return {
-      persisted: false,
-      reason: "write-failed",
-      detail: `Audit record persistence raised: ${detail}`
-    };
-  }
-}
-
 // src/mcp/tools/pr-review-diff-budget.ts
 var SENSITIVE_PATH_PATTERNS = Object.freeze([
   "auth",
@@ -46811,6 +46730,16 @@ function truncateWithMarker(file, budget) {
   const prefix = Buffer.from(file.text, "utf-8").subarray(0, room).toString("utf-8");
   return prefix + marker;
 }
+var GIT_FILE_HEADER = /^diff --git /m;
+var HUNK_HEADER = /^@@ .* @@/m;
+var OLD_FILE_HEADER = /^--- /m;
+var NEW_FILE_HEADER = /^\+\+\+ /m;
+var BODY_LINE = /^[+-]/m;
+function looksLikeUnifiedDiff(text) {
+  if (GIT_FILE_HEADER.test(text)) return true;
+  if (HUNK_HEADER.test(text) && BODY_LINE.test(text)) return true;
+  return OLD_FILE_HEADER.test(text) && NEW_FILE_HEADER.test(text);
+}
 function securityFirstPack(files, budget) {
   const sensitive = files.filter((f) => isSensitivePath(f.path));
   const rest = files.filter((f) => !isSensitivePath(f.path));
@@ -46876,6 +46805,95 @@ function applyPartialCoverageGate(aggregate, coverage) {
   return aggregate;
 }
 
+// src/mcp/tools/pr-review-record-producer.ts
+function buildAndPersist(prNumber, baseSha, args) {
+  const { input, aggregate, counts, reviewCount, logger: logger58, coverage } = args;
+  const coverageSuffix = coverage?.partial === true ? ` [partial coverage: ${String(coverage.reviewedFiles)}/${String(coverage.totalFiles)} files reviewed, dropped: ${coverage.droppedFiles.join(", ")}]` : "";
+  if (reviewedDiffWasTruncated(input.prDiff)) {
+    logger58.warn(
+      "Reviewed diff exceeds the hash byte cap; content past it is unbound in reviewedDiffHash",
+      { prNumber }
+    );
+  }
+  const record = persistPrReviewRecord({
+    prNumber,
+    baseSha,
+    reviewedDiffHash: computeReviewedDiffHash(input.prDiff),
+    verdict: aggregate.decision,
+    verified: aggregate.verified,
+    voteCounts: {
+      approve: counts.approveCount,
+      request_changes: counts.requestChangesCount,
+      abstain: counts.abstainCount,
+      error: counts.errorCount,
+      total: reviewCount
+    },
+    summary: `${aggregate.decision} (${String(counts.approveCount)} approve / ${String(counts.requestChangesCount)} request_changes / ${String(counts.abstainCount)} abstain) \u2014 ${input.prTitle}${coverageSuffix}`,
+    // #4278: lets a caller (e.g. an MCP server whose cwd has no `.git`
+    // ancestor) say where the repo is, so the record isn't silently dropped.
+    ...input.repoPath !== void 0 ? { repoPathOverride: input.repoPath } : {},
+    logger: logger58
+  });
+  if (record === void 0) {
+    return {
+      persisted: false,
+      reason: "write-failed",
+      detail: "Audit record could not be written: the records path was unresolved or the append failed (see server logs for the underlying cause)."
+    };
+  }
+  return {
+    persisted: true,
+    prNumber: record.prNumber,
+    baseSha: record.baseSha,
+    reviewedDiffHash: record.reviewedDiffHash,
+    sequence: record.sequence
+  };
+}
+function refuseToPersist(args) {
+  const { input, counts } = args;
+  const refuse = (reason, detail) => ({ ok: false, outcome: { persisted: false, reason, detail } });
+  if (input.prNumber === void 0 || input.baseSha === void 0) {
+    return refuse(
+      "binding-inputs-absent",
+      "No audit record written: supply both prNumber and baseSha to persist an Option-C governor-review record bound to {prNumber, baseSha, reviewedDiffHash}."
+    );
+  }
+  if (!looksLikeUnifiedDiff(input.prDiff)) {
+    return refuse(
+      "diff-not-unified",
+      "No audit record written: prDiff is not a unified diff, so the review did not examine code and reviewedDiffHash would hash non-diff text \u2014 a record indistinguishable from a real one (#4451)."
+    );
+  }
+  if (input.simulate) {
+    return refuse(
+      "simulated",
+      "No audit record written: the review used simulated voters, and a committed governance record must not be seeded from non-live output (mirrors #2319)."
+    );
+  }
+  if (counts.approveCount + counts.requestChangesCount + counts.abstainCount === 0) {
+    return refuse(
+      "no-live-votes",
+      "No audit record written: every voter errored, so the aggregate verdict reflects no live review. A committed governor-review record must not be seeded from a failed panel (the pr_review analogue of no_quorum, #4053)."
+    );
+  }
+  return { ok: true, prNumber: input.prNumber, baseSha: input.baseSha };
+}
+function persistReviewRecord(args) {
+  const gate = refuseToPersist(args);
+  if (!gate.ok) return gate.outcome;
+  try {
+    return buildAndPersist(gate.prNumber, gate.baseSha, args);
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    args.logger.warn("Audit-record persistence threw (non-fatal)", { detail });
+    return {
+      persisted: false,
+      reason: "write-failed",
+      detail: `Audit record persistence raised: ${detail}`
+    };
+  }
+}
+
 // src/mcp/tools/pr-review-result-mapping.ts
 function resolveFindings(result) {
   const raw = result.vote.findings;
@@ -46931,8 +46949,10 @@ var PR_REVIEW_ASYNC_HINT = "A pr_review run fans out to 5 live LLM voters and ca
 var PrReviewInputSchema = z93.object({
   prTitle: z93.string().min(1).max(500).describe("PR title"),
   prDescription: z93.string().max(MAX_DESCRIPTION_LENGTH).optional().describe("PR body / description"),
-  prDiff: z93.string().min(1).max(MAX_DIFF_INPUT_LENGTH).describe(
-    `Unified diff text (max ${String(MAX_DIFF_INPUT_LENGTH)} chars). No need to truncate before calling: diffs over ${String(MAX_DIFF_LENGTH)} chars are security-prioritized and PARTIALLY reviewed (lowest-priority whole files dropped; coverage reported on the response, and a partial review can block but never verified-approve).`
+  prDiff: z93.string().min(1).max(MAX_DIFF_INPUT_LENGTH).refine(looksLikeUnifiedDiff, {
+    message: "prDiff must be a unified diff (expected a `diff --git`, `---`/`+++`, or `@@ \u2026 @@` line). Prose descriptions of a change are rejected: a review of a summary is not a review of the code, and would be recorded as though it were (#4451)."
+  }).describe(
+    `Unified diff text (max ${String(MAX_DIFF_INPUT_LENGTH)} chars). REQUIRED SHAPE (#4451): must contain a \`diff --git\` header, an \`@@ \u2026 @@\` hunk header backed by +/- lines, or a \`---\`/\`+++\` header pair \u2014 a prose summary of the change is REJECTED, because reviewing a summary is not reviewing the code and would be recorded as though it were. (Stated here because Zod refinements do not survive JSON-schema generation, so this constraint is otherwise invisible to clients.) No need to truncate before calling: diffs over ${String(MAX_DIFF_LENGTH)} chars are security-prioritized and PARTIALLY reviewed (lowest-priority whole files dropped; coverage reported on the response, and a partial review can block but never verified-approve).`
   ),
   repoContext: z93.string().max(MAX_REPO_CONTEXT_LENGTH).optional().describe(
     `Optional one-paragraph repo context (architecture, conventions; max ${String(MAX_REPO_CONTEXT_LENGTH)} chars; trim before calling)`
@@ -49284,7 +49304,7 @@ var GitHubTaskTracker = class {
   cachedProvider = null;
   async getProvider() {
     if (this.cachedProvider !== null) return this.cachedProvider;
-    const { createScmProvider } = await import("./factory-VIB7NIV2.js");
+    const { createScmProvider } = await import("./factory-2VYANO2Z.js");
     const result = await createScmProvider({ repo: this.config.repo ?? "" });
     if (!result.ok) throw new Error(`SCM provider error: ${result.error.message}`);
     this.cachedProvider = result.value;
@@ -50126,7 +50146,7 @@ async function probeSource(source, includeModelIds) {
   }
 }
 async function defaultSources(includeOpenRouter) {
-  const { createAllAdapters: createAllAdapters2 } = await import("./factory-7EMZS6OF.js");
+  const { createAllAdapters: createAllAdapters2 } = await import("./factory-KDNW4GTS.js");
   const adapters = createAllAdapters2();
   return buildDefaultModelSources(adapters, { includeOpenRouter });
 }
@@ -54146,4 +54166,4 @@ export {
   shutdownFeedbackSubscriber,
   createEventBusBridge
 };
-//# sourceMappingURL=chunk-2UKQZKVD.js.map
+//# sourceMappingURL=chunk-DITV4B6I.js.map