nexus-agents 4.3.2 → 4.3.3

package/dist/{chunk-Z3QSRADW.js → chunk-TXAWKJWL.js}

@@ -52,7 +52,7 @@ import {
 } from "./chunk-OQLFRJCW.js";
 
 // src/version.ts
-var VERSION = true ? "4.3.2" : "dev";
+var VERSION = true ? "4.3.3" : "dev";
 
 // src/config/schemas-core.ts
 import { z } from "zod";
@@ -2339,7 +2339,7 @@ async function runDoctorFix(result) {
   writeLine2("\u2500".repeat(40));
   let fixCount = 0;
   if (!result.dataDirectory.rootExists || result.dataDirectory.subdirectories.some((d) => !d.exists || !d.writable)) {
-    const { runSetup } = await import("./setup-command-GVDJEHTI.js");
+    const { runSetup } = await import("./setup-command-R6LRVQ7P.js");
     const setupResult = runSetup({
       skipMcp: true,
       skipRules: true,
@@ -2452,4 +2452,4 @@ export {
   startStdioServer,
   closeServer
 };
-//# sourceMappingURL=chunk-Z3QSRADW.js.map
+//# sourceMappingURL=chunk-TXAWKJWL.js.map

package/dist/cli.js

@@ -18,7 +18,7 @@ import "./chunk-JV5HRP3S.js";
 import {
   setupCommandAsync,
   verifyCommand
-} from "./chunk-U6NDB43U.js";
+} from "./chunk-BG7IE3V5.js";
 import "./chunk-73U6W5ZU.js";
 import {
   AuthHandler,
@@ -139,7 +139,7 @@ import {
   validateCommand,
   validateWorkflow,
   wrapInMarkdownFence
-} from "./chunk-5HHTFAHY.js";
+} from "./chunk-GWL7WO64.js";
 import "./chunk-FHXDRCIW.js";
 import "./chunk-HFOQKCD2.js";
 import "./chunk-RSMG2DPB.js";
@@ -166,7 +166,7 @@ import {
   loadConfig,
   runDoctor,
   validateNexusEnv
-} from "./chunk-Z3QSRADW.js";
+} from "./chunk-TXAWKJWL.js";
 import {
   buildOpenAICompatAdapters,
   readOpenAICompatEnv

package/dist/index.d.ts

@@ -33549,8 +33549,18 @@ interface PipelineStateSnapshot {
      * include `trust-classifier`, `input-sanitizer`, `firewall-pipeline`, and
      * `mcp/middleware/request-context`; threading the value into
      * `TaskContract.metadata.trustTier` is owner-scoped follow-up work — see
-     * the corresponding issue. When absent, `trustTierRule` allows (the
-     * existing fail-open default for unknown trust).
+     * the corresponding issue.
+     *
+     * ABSENT MEANS UNTRUSTED, NOT ALLOWED (#4821). An absent or non-numeric
+     * value is coerced to `4` and DENIES — see `trustTierRule` below. This doc
+     * previously claimed the opposite ("fail-open default for unknown trust"),
+     * describing a pre-hardening behaviour the code no longer has.
+     *
+     * That is the correct default and should stay: fail-closed on unknown
+     * provenance is what `.rules/untrusted-input.md` requires. Do not "fix" the
+     * rule to match the old comment. The practical consequence, worth knowing
+     * before planning enforcement work, is that an UNWIRED producer is the DENY
+     * case rather than the safe one.
      */
     readonly trustTier?: string;
 }

package/dist/index.js

@@ -541,7 +541,7 @@ import {
   withLogging,
   withRetry,
   withRetryWrapper
-} from "./chunk-5HHTFAHY.js";
+} from "./chunk-GWL7WO64.js";
 import {
   FALLBACK_SCANNER_DATA,
   buildPlanFromAnalysis,
@@ -575,7 +575,7 @@ import {
   getKnownNexusVarNames,
   startStdioServer,
   validateNexusEnv
-} from "./chunk-Z3QSRADW.js";
+} from "./chunk-TXAWKJWL.js";
 import {
   OPENAI_MODELS,
   OPENAI_MODEL_ALIASES,

package/dist/{setup-command-GVDJEHTI.js → setup-command-R6LRVQ7P.js}

@@ -8,9 +8,9 @@ import {
   runWizard,
   setupCommand,
   setupCommandAsync
-} from "./chunk-U6NDB43U.js";
+} from "./chunk-BG7IE3V5.js";
 import "./chunk-73U6W5ZU.js";
-import "./chunk-Z3QSRADW.js";
+import "./chunk-TXAWKJWL.js";
 import "./chunk-ROAVF3S5.js";
 import "./chunk-3P6N3XZF.js";
 import "./chunk-OQB3XC5O.js";
@@ -41,4 +41,4 @@ export {
   setupCommand,
   setupCommandAsync
 };
-//# sourceMappingURL=setup-command-GVDJEHTI.js.map
+//# sourceMappingURL=setup-command-R6LRVQ7P.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexus-agents",
-  "version": "4.3.2",
+  "version": "4.3.3",
   "description": "Governance substrate for AI coding agents — adversarial PR review, drift-detected rules, tamper-evident audit, and closed-loop outcome routing for Claude, Codex, Gemini, and OpenCode",
   "mcpName": "io.github.nexus-substrate/nexus-agents",
   "license": "MIT",