nexus-agents 3.8.9 → 3.9.0

package/dist/{chunk-WU5JH5QS.js → chunk-M5H2WS5Z.js}

@@ -52,7 +52,7 @@ import {
 } from "./chunk-OQLFRJCW.js";
 
 // src/version.ts
-var VERSION = true ? "3.8.9" : "dev";
+var VERSION = true ? "3.9.0" : "dev";
 
 // src/config/schemas-core.ts
 import { z } from "zod";
@@ -2324,7 +2324,7 @@ async function runDoctorFix(result) {
   writeLine2("\u2500".repeat(40));
   let fixCount = 0;
   if (!result.dataDirectory.rootExists || result.dataDirectory.subdirectories.some((d) => !d.exists || !d.writable)) {
-    const { runSetup } = await import("./setup-command-P4M4QAWA.js");
+    const { runSetup } = await import("./setup-command-LYPCG3O4.js");
     const setupResult = runSetup({
       skipMcp: true,
       skipRules: true,
@@ -2437,4 +2437,4 @@ export {
   startStdioServer,
   closeServer
 };
-//# sourceMappingURL=chunk-WU5JH5QS.js.map
+//# sourceMappingURL=chunk-M5H2WS5Z.js.map

package/dist/{chunk-DNFPG7PU.js → chunk-PGMF6I7D.js}

@@ -8,7 +8,7 @@ import {
   checkSqlite,
   defaultConfig,
   initDataDirectories
-} from "./chunk-WU5JH5QS.js";
+} from "./chunk-M5H2WS5Z.js";
 import {
   BUILT_IN_EXPERTS
 } from "./chunk-YPNQPT2F.js";
@@ -2001,4 +2001,4 @@ export {
   setupCommand,
   setupCommandAsync
 };
-//# sourceMappingURL=chunk-DNFPG7PU.js.map
+//# sourceMappingURL=chunk-PGMF6I7D.js.map

package/dist/{chunk-U6KYY22D.js → chunk-SDZUHQYI.js}

@@ -22,7 +22,7 @@ import {
   DEFAULT_TASK_TTL_MS,
   DEFAULT_TOOL_RATE_LIMITS,
   clampTaskTtl
-} from "./chunk-WU5JH5QS.js";
+} from "./chunk-M5H2WS5Z.js";
 import {
   executeExpert
 } from "./chunk-EGUKCGGM.js";
@@ -46634,15 +46634,34 @@ var PrReviewVoteCountsSchema = z92.object({
   error: z92.number().int().nonnegative(),
   total: z92.number().int().nonnegative()
 }).strict();
+var PrReviewDiffSourceSchema = z92.enum(["canonical-git", "caller-supplied"]);
+var PrReviewDiffProvenanceSchema = z92.object({
+  /** How the reviewed diff was obtained. */
+  source: PrReviewDiffSourceSchema,
+  /**
+   * Whether the reviewed diff carried parseable `^diff --git` FILE BOUNDARIES
+   * (sourced from the real `splitByFile` result, not a second regex). The one
+   * signal a consumer genuinely CANNOT re-derive from the other record fields:
+   * `looksLikeUnifiedDiff` deliberately accepts plain `diff -u` output, which
+   * has no `diff --git` headers, so a record can be bound to a real diff whose
+   * per-file attribution is unavailable. `false` means "a diff, but the packer
+   * saw it as one undifferentiated blob".
+   */
+  fileBoundaries: z92.boolean()
+}).strict();
 var PrReviewRecordSchema = z92.object({
   /**
-   * Schema version. '1.1' is the Option-C binding (#3831): the record binds to
+   * Schema version. '1.1' was the Option-C binding (#3831): the record binds to
    * `{prNumber, baseSha, reviewedDiffHash}` instead of the rejected `headSha`.
-   * Clean break — the committed `governance/pr-review-records.jsonl` ledger is
-   * empty on every install (no producer ever wrote a '1.0' record), so there is
-   * no '1.0' data to migrate.
+   * '1.2' (#4459) marks the boundary at which records began carrying
+   * {@link diffProvenance} — an honest pre/post marker so a reader can tell
+   * "this record predates provenance" from "this record's provenance was
+   * dropped". Clean break, as with '1.0'→'1.1': the committed
+   * `governance/pr-review-records.jsonl` ledger is EMPTY on every install (0
+   * records at the time of this bump), so there is no data to migrate and no
+   * reason to keep a tolerant version union.
    */
-  version: z92.literal("1.1"),
+  version: z92.literal("1.2"),
   /**
    * Monotonic sequence number (integer ≥ 0). Assigned as (max existing
    * sequence)+1 at write time. Sorted, the set of sequences must cover
@@ -46683,6 +46702,13 @@ var PrReviewRecordSchema = z92.object({
   summary: z92.string(),
   /** Optional correlation/decision id linking to the cost rollup / trace. */
   correlationId: z92.string().min(1).optional(),
+  /**
+   * What this record was DERIVED FROM (#4459). OPTIONAL by necessity: the
+   * schema is `.strict()`, so a required field would reject every record
+   * written before it existed. Absent ⇒ the producer did not state a
+   * provenance; a consumer must NOT read that as `canonical-git`.
+   */
+  diffProvenance: PrReviewDiffProvenanceSchema.optional(),
   /**
    * ADVISORY hash of the tip record at write time (absent for the first).
    * Retained for audit texture but NOT covered by `hash` and NOT verified —
@@ -46712,7 +46738,24 @@ function computePrReviewRecordHash(payload) {
       total: payload.voteCounts.total
     },
     summary: payload.summary,
-    correlationId: payload.correlationId ?? null
+    correlationId: payload.correlationId ?? null,
+    // #4459 provenance, INSIDE the hash. This projection is an explicit
+    // allowlist, so a schema field omitted here would sit OUTSIDE
+    // tamper-evidence — `caller-supplied` could be edited to `canonical-git`
+    // with no `hash_mismatch`.
+    //
+    // Absent ⇒ the key is OMITTED entirely (not emitted as `null`, unlike
+    // `correlationId` which has always been in the projection). `JSON.stringify`
+    // drops `undefined` values, so a record written WITHOUT provenance produces
+    // a canonical string byte-identical to the pre-#4459 one and keeps its hash.
+    // Emitting `null` here would flip every such record to `hash_mismatch`.
+    // Rebuilt in schema order for the same reason `voteCounts` is (#3962).
+    ...payload.diffProvenance !== void 0 ? {
+      diffProvenance: {
+        source: payload.diffProvenance.source,
+        fileBoundaries: payload.diffProvenance.fileBoundaries
+      }
+    } : {}
   });
   return crypto3.createHash("sha256").update(canonical).digest("hex");
 }
@@ -46724,7 +46767,7 @@ var MAX_SUMMARY_RECORD_CHARS = 500;
 function buildPrReviewRecord(input) {
   const summaryTruncated = input.summary.length > MAX_SUMMARY_RECORD_CHARS ? input.summary.slice(0, MAX_SUMMARY_RECORD_CHARS) + "..." : input.summary;
   const payload = {
-    version: "1.1",
+    version: "1.2",
     sequence: input.sequence ?? 0,
     prNumber: input.prNumber,
     baseSha: input.baseSha,
@@ -46740,6 +46783,7 @@ function buildPrReviewRecord(input) {
       total: input.voteCounts.total
     },
     summary: summaryTruncated,
+    ...input.diffProvenance !== void 0 ? { diffProvenance: input.diffProvenance } : {},
     ...input.correlationId !== void 0 ? { correlationId: input.correlationId } : {},
     ...input.previousHash !== void 0 ? { previousHash: input.previousHash } : {}
   };
@@ -46867,6 +46911,7 @@ function extractPath(fileText) {
   if (m !== null) return m[2];
   return firstLine.replace(/^diff --git\s*/, "").trim();
 }
+var UNSTRUCTURED_SEGMENT_PATH = "(unstructured)";
 function splitByFile(diff) {
   if (diff.length === 0) return [];
   const headerRe = /^diff --git .*$/gm;
@@ -46876,7 +46921,7 @@ function splitByFile(diff) {
     starts.push(m.index);
   }
   if (starts.length === 0) {
-    return [{ path: "(unstructured)", text: diff, bytes: byteLen(diff) }];
+    return [{ path: UNSTRUCTURED_SEGMENT_PATH, text: diff, bytes: byteLen(diff) }];
   }
   const files = [];
   const firstStart = starts[0];
@@ -46892,6 +46937,10 @@ function splitByFile(diff) {
   }
   return files;
 }
+function hasFileBoundaries(diff) {
+  const segments = splitByFile(diff);
+  return segments.length > 0 && segments.every((s) => s.path !== UNSTRUCTURED_SEGMENT_PATH);
+}
 function truncateWithMarker(file, budget) {
   const marker = `
 [... TRUNCATED: file ${file.path} is ${String(file.bytes)} bytes, over the ${String(budget)}-byte review budget; showing a partial prefix \u2014 this file is listed in droppedFiles as partially-seen ...]
@@ -46976,19 +47025,25 @@ function applyPartialCoverageGate(aggregate, coverage) {
 }
 
 // src/mcp/tools/pr-review-record-producer.ts
+function warnIfDiffTruncated(diff, prNumber, logger59) {
+  if (!reviewedDiffWasTruncated(diff)) return;
+  logger59.warn(
+    "Reviewed diff exceeds the hash byte cap; content past it is unbound in reviewedDiffHash",
+    { prNumber }
+  );
+}
+function diffProvenanceOf(source, diff) {
+  return { source, fileBoundaries: hasFileBoundaries(diff) };
+}
 function buildAndPersist(prNumber, baseSha, args) {
-  const { input, aggregate, counts, reviewCount, logger: logger59, coverage } = args;
+  const { input, aggregate, counts, reviewCount, logger: logger59, coverage, diffSource } = args;
   const coverageSuffix = coverage?.partial === true ? ` [partial coverage: ${String(coverage.reviewedFiles)}/${String(coverage.totalFiles)} files reviewed, dropped: ${coverage.droppedFiles.join(", ")}]` : "";
-  if (reviewedDiffWasTruncated(input.prDiff)) {
-    logger59.warn(
-      "Reviewed diff exceeds the hash byte cap; content past it is unbound in reviewedDiffHash",
-      { prNumber }
-    );
-  }
+  warnIfDiffTruncated(input.prDiff, prNumber, logger59);
   const record = persistPrReviewRecord({
     prNumber,
     baseSha,
     reviewedDiffHash: computeReviewedDiffHash(input.prDiff),
+    diffProvenance: diffProvenanceOf(diffSource, input.prDiff),
     verdict: aggregate.decision,
     verified: aggregate.verified,
     voteCounts: {
@@ -47315,6 +47370,9 @@ async function executePrReviewBody(input, logger59, gatewayAdapters) {
     });
   }
   const recordOutcome3 = persistReviewRecord({
+    // #4459: `input.prDiff` is opaque MCP input — it passed the unified-diff
+    // shape gate (#4451), but nothing here establishes it is the PR's real diff.
+    diffSource: "caller-supplied",
     input,
     aggregate,
     counts,
@@ -54348,4 +54406,4 @@ export {
   shutdownFeedbackSubscriber,
   createEventBusBridge
 };
-//# sourceMappingURL=chunk-U6KYY22D.js.map
+//# sourceMappingURL=chunk-SDZUHQYI.js.map