nexus-agents 7.0.0 → 7.0.2

package/dist/{chunk-KLQ352NK.js → chunk-ZD4VEHEG.js}

@@ -11,7 +11,7 @@ import {
   createGetRetryConfig,
   createGetTimeout,
   createGetToolRateLimit
-} from "./chunk-UOHOHH72.js";
+} from "./chunk-Y742U2YM.js";
 
 // src/config/defaults.ts
 var CUSTOM_API_DEFAULT_MODEL = "gpt-5.5";
@@ -230,4 +230,4 @@ export {
   CUSTOM_API_DEFAULT_MODEL,
   DEFAULTS
 };
-//# sourceMappingURL=chunk-KLQ352NK.js.map
+//# sourceMappingURL=chunk-ZD4VEHEG.js.map

package/dist/{chunk-XOLGF5MK.js → chunk-ZGEDIKAM.js}

@@ -3,7 +3,7 @@ import {
   createLogger,
   err,
   ok
-} from "./chunk-UOHOHH72.js";
+} from "./chunk-Y742U2YM.js";
 
 // src/adapters/sdk/types.ts
 var PROVIDER_ENV_KEYS = {
@@ -260,4 +260,4 @@ export {
   validateCustomApiBaseUrl,
   assertCustomApiHostResolvesPublic
 };
-//# sourceMappingURL=chunk-XOLGF5MK.js.map
+//# sourceMappingURL=chunk-ZGEDIKAM.js.map

package/dist/{cli-circuit-breaker-TEW4RTM2.js → cli-circuit-breaker-5FYJDS5O.js}

@@ -3,8 +3,8 @@ import {
   createCliCircuitBreakerIntegration,
   getCliCircuitBreakerSnapshot,
   getDefaultCliCircuitBreakerRegistry
-} from "./chunk-HGL7B6WB.js";
-import "./chunk-UOHOHH72.js";
+} from "./chunk-S2Z7CME3.js";
+import "./chunk-Y742U2YM.js";
 import "./chunk-GBHJ37V3.js";
 import "./chunk-OGHEKPLD.js";
 import "./chunk-ZPWHCABL.js";
@@ -14,4 +14,4 @@ export {
   getCliCircuitBreakerSnapshot,
   getDefaultCliCircuitBreakerRegistry
 };
-//# sourceMappingURL=cli-circuit-breaker-TEW4RTM2.js.map
+//# sourceMappingURL=cli-circuit-breaker-5FYJDS5O.js.map

package/dist/cli.js

@@ -19,11 +19,11 @@ import {
   parseFindings,
   reviewPostingBlock,
   sumFindings
-} from "./chunk-5EEEPQZY.js";
-import "./chunk-QUMUVNL6.js";
+} from "./chunk-JJT7NVNY.js";
+import "./chunk-3CGUPSBW.js";
 import {
   runConfigInitSync
-} from "./chunk-OP6PH7GC.js";
+} from "./chunk-Y5GYBP52.js";
 import {
   AuthHandler,
   CustomExpertDefinitionSchema,
@@ -153,8 +153,8 @@ import {
   validateNexusEnv,
   validateWorkflow,
   wrapInMarkdownFence
-} from "./chunk-WMXHD6UA.js";
-import "./chunk-L3ZVRVHA.js";
+} from "./chunk-KUYKSKPV.js";
+import "./chunk-VYAXMVI5.js";
 import "./chunk-HFOQKCD2.js";
 import "./chunk-RSMG2DPB.js";
 import {
@@ -172,14 +172,14 @@ import {
   doctorCommand,
   initDataDirectories,
   runDoctor
-} from "./chunk-46XUGUB4.js";
+} from "./chunk-WLIXCNZ6.js";
 import {
   buildOpenAICompatAdapters,
   readOpenAICompatEnv
-} from "./chunk-CF5CXFYJ.js";
+} from "./chunk-VVXHIUFQ.js";
 import {
   shutdownExpertBridge
-} from "./chunk-ET67NYCJ.js";
+} from "./chunk-KJWD2V4K.js";
 import {
   ConsensusVoteInputSchema,
   DEFAULT_VOTE_TIMEOUT_MS,
@@ -191,29 +191,29 @@ import {
   recordAuthenticVote,
   registerConsensusVoteTool,
   toRecordDecision
-} from "./chunk-K3ZTZSLW.js";
+} from "./chunk-OHULIRP6.js";
 import {
   loadUsageEvents,
   rollupByModel
-} from "./chunk-JC4WREXA.js";
+} from "./chunk-RBF64DXJ.js";
 import {
   allOf,
   anyOf
 } from "./chunk-OQB3XC5O.js";
 import {
   synthesizeResearch
-} from "./chunk-LUPEM2NF.js";
+} from "./chunk-UVO673OY.js";
 import {
   classifyTrust,
   createFullGitHubProvider,
   evaluatePolicy,
   parsePRUrl
-} from "./chunk-T47DKINM.js";
-import "./chunk-MB2YIETU.js";
+} from "./chunk-Q6IODDEA.js";
+import "./chunk-IWTK6FDT.js";
 import {
   ReputationCache,
   sanitizeInput
-} from "./chunk-NVFYMGCC.js";
+} from "./chunk-RLBJTZHA.js";
 import {
   ImprovementReviewInputSchema,
   calculateFitnessScore,
@@ -227,20 +227,20 @@ import {
   registerImprovementReviewTool,
   runImprovementReview,
   scanForSecrets
-} from "./chunk-6SA3FIBZ.js";
+} from "./chunk-AGFXJUTS.js";
 import {
   createDefaultPolicyFirewall,
   setGlobalPolicyFirewall,
   stagePolicyFirewallForRollout
-} from "./chunk-XF6J4PCH.js";
+} from "./chunk-GAYSJGKD.js";
 import {
   VERSION
-} from "./chunk-OXJEIMLS.js";
-import "./chunk-DR7DYEFQ.js";
+} from "./chunk-37JIYDVH.js";
+import "./chunk-6Q3KSZVI.js";
 import {
   createUnifiedRegistry,
   getGlobalRegistry
-} from "./chunk-KXQNETUB.js";
+} from "./chunk-D6TL5GZV.js";
 import {
   CodebaseIndexSchema,
   PaperStatusSchema,
@@ -266,24 +266,24 @@ import {
   loadSourcesRegistry,
   rankDiscoveredItems,
   saveSourcesRegistry
-} from "./chunk-RSSLLOU6.js";
+} from "./chunk-QAHGHWC7.js";
 import {
   loadPapersRegistry,
   loadTechniquesRegistry,
   savePapersRegistry
-} from "./chunk-VNULIWRK.js";
+} from "./chunk-K2AWJGQO.js";
 import {
   resolveToken
-} from "./chunk-SZZRE2VU.js";
+} from "./chunk-XZEYSIGG.js";
 import {
   MemoryError,
   shutdownToolMemory
-} from "./chunk-DXIZQRP5.js";
+} from "./chunk-7U7HAYPB.js";
 import {
   capitalize,
   capitalizeKebab
 } from "./chunk-6T3EPABN.js";
-import "./chunk-6ZYJ46HN.js";
+import "./chunk-JNZ3D5B5.js";
 import {
   BUILT_IN_EXPERTS
 } from "./chunk-43SVUIPL.js";
@@ -296,19 +296,19 @@ import {
   isRecord,
   probeAllClis,
   readSubprocessDepth
-} from "./chunk-KYCJ47JZ.js";
-import "./chunk-UAKFLKW3.js";
+} from "./chunk-BTWKDT4F.js";
+import "./chunk-LVYRGNOC.js";
 import {
   DEFAULTS
-} from "./chunk-KLQ352NK.js";
-import "./chunk-XOLGF5MK.js";
+} from "./chunk-ZD4VEHEG.js";
+import "./chunk-ZGEDIKAM.js";
 import {
   nexusMkdtempSync
 } from "./chunk-4OW67KT2.js";
-import "./chunk-PCZJMNPT.js";
+import "./chunk-6GYTTWNM.js";
 import "./chunk-QZUG667L.js";
-import "./chunk-XOCNOKIV.js";
-import "./chunk-HGL7B6WB.js";
+import "./chunk-33FI7W3G.js";
+import "./chunk-S2Z7CME3.js";
 import {
   API_TIMEOUTS,
   AgentCapability,
@@ -385,7 +385,7 @@ import {
   validateTimeout,
   writeEmptyLine,
   writeLine
-} from "./chunk-UOHOHH72.js";
+} from "./chunk-Y742U2YM.js";
 import "./chunk-GBHJ37V3.js";
 import {
   applyPortableMode,
@@ -4438,7 +4438,7 @@ ${file.patch}
         violations: policyResult.violations
       });
     }
-    const { formatReviewComment: formatReviewComment2 } = await import("./pr-reviewer-helpers-7OKVLICU.js");
+    const { formatReviewComment: formatReviewComment2 } = await import("./pr-reviewer-helpers-KBOP72XG.js");
     const body = formatReviewComment2(result);
     const postResult = await provider.createReview(pr.prNumber, body, result.decision);
     if (!postResult.ok) {
@@ -19587,7 +19587,7 @@ function startImprovementReviewScheduler(options) {
   let running = false;
   const runOnce = async () => {
     try {
-      const { runImprovementReview: runImprovementReview2, ImprovementReviewInputSchema: ImprovementReviewInputSchema2 } = await import("./improvement-review-PUEF3WL4.js");
+      const { runImprovementReview: runImprovementReview2, ImprovementReviewInputSchema: ImprovementReviewInputSchema2 } = await import("./improvement-review-QUU5HR7Z.js");
       const input = ImprovementReviewInputSchema2.parse({ fileIssues });
       const result = await runImprovementReview2(input, { logger: logger22 });
       logger22.info("Scheduled improvement_review complete", {
@@ -21672,7 +21672,7 @@ function adaptConfigToLibrary(config) {
 }
 function createBeliefPromoter() {
   return async (event) => {
-    const { getToolMemory } = await import("./tool-memory-K3LY6VBF.js");
+    const { getToolMemory } = await import("./tool-memory-GUPG2M25.js");
     const tm = getToolMemory();
     await tm.recordBelief(
       `skill:${event.name}`,
@@ -22893,7 +22893,7 @@ async function handleResearchCommand(args) {
   }
 }
 async function handleRegistryCommand(args) {
-  const { registryCommand, isValidRegistrySubcommand, formatRegistryUsage } = await import("./registry-command-WRWJWKJV.js");
+  const { registryCommand, isValidRegistrySubcommand, formatRegistryUsage } = await import("./registry-command-ZK4NQ2MX.js");
   const subcommand = args.subcommand;
   if (!isValidRegistrySubcommand(subcommand)) {
     process.stdout.write(`${formatRegistryUsage()}
@@ -22941,12 +22941,12 @@ async function handleVerifyCommand(args) {
 async function handleDoctorCommand(args) {
   const exitCode = await doctorCommand({ fix: args.options.fix });
   if (args.options.deep) {
-    const { runDeepDiagnostics: runDeepDiagnostics2, formatDeepDiagnostics: formatDeepDiagnostics2 } = await import("./doctor-deep-6WLU2HV7.js");
+    const { runDeepDiagnostics: runDeepDiagnostics2, formatDeepDiagnostics: formatDeepDiagnostics2 } = await import("./doctor-deep-6WHVRRVQ.js");
     const diag = runDeepDiagnostics2();
     process.stdout.write(formatDeepDiagnostics2(diag) + "\n");
   }
   if (args.options.live) {
-    const { runLiveReadiness, formatLiveReadiness } = await import("./doctor-live-OLSOA44K.js");
+    const { runLiveReadiness, formatLiveReadiness } = await import("./doctor-live-J7JIZH3T.js");
     const report = await runLiveReadiness();
     process.stdout.write(formatLiveReadiness(report) + "\n");
     if (report.some((r) => r.levels.serves.status === "failed")) {
@@ -22999,7 +22999,7 @@ async function runInitPortableFlow(args) {
   return cliExit(result.success ? EXIT_CODES.SUCCESS : EXIT_CODES.SERVER_START_FAILED);
 }
 async function runInitOpencodeFlow(args) {
-  const { runInitOpencode } = await import("./init-opencode-MCS4F4MP.js");
+  const { runInitOpencode } = await import("./init-opencode-GDPE4U65.js");
   const opencodePath = args.options.opencode;
   if (opencodePath === void 0 || opencodePath === "") {
     process.stderr.write("Error: --opencode requires a path argument.\n");
@@ -23025,7 +23025,7 @@ async function runInitOpencodeFlow(args) {
   return cliExit(EXIT_CODES.SUCCESS);
 }
 async function renderOpencodeValidate(opencodePath) {
-  const { runOpencodeValidate } = await import("./init-opencode-MCS4F4MP.js");
+  const { runOpencodeValidate } = await import("./init-opencode-GDPE4U65.js");
   const result = await runOpencodeValidate(opencodePath);
   if (!result.ok) {
     process.stderr.write(`init --opencode --validate: ${result.reason ?? "failed"}
@@ -23064,7 +23064,7 @@ async function handleSetupCommandAsync(args) {
   return cliExitFromStatus(exitCode);
 }
 async function runCustomApiSetup(args) {
-  const { configureCustomApi } = await import("./setup-custom-api-WHU4TJKG.js");
+  const { configureCustomApi } = await import("./setup-custom-api-ZSBUIJID.js");
   const baseUrl = args.options.customApi;
   if (baseUrl === void 0) return EXIT_CODES.SERVER_START_FAILED;
   const input = {

package/dist/{composite-router-GEQSU4S3.js → composite-router-GE24MYPP.js}

@@ -4,7 +4,7 @@ import {
   CompositeRoutingError,
   DEFAULT_COMPOSITE_CONFIG,
   createCompositeRouter
-} from "./chunk-UOHOHH72.js";
+} from "./chunk-Y742U2YM.js";
 import "./chunk-GBHJ37V3.js";
 import "./chunk-OGHEKPLD.js";
 import "./chunk-ZPWHCABL.js";
@@ -15,4 +15,4 @@ export {
   DEFAULT_COMPOSITE_CONFIG,
   createCompositeRouter
 };
-//# sourceMappingURL=composite-router-GEQSU4S3.js.map
+//# sourceMappingURL=composite-router-GE24MYPP.js.map

package/dist/{consensus-vote-ZMEESJFP.js → consensus-vote-62FAN4ZN.js}

@@ -11,28 +11,28 @@ import {
   resetCorrelationTracker,
   runConsensusForGoal,
   unwrapVoteOrThrow
-} from "./chunk-K3ZTZSLW.js";
-import "./chunk-JC4WREXA.js";
+} from "./chunk-OHULIRP6.js";
+import "./chunk-RBF64DXJ.js";
 import "./chunk-OQB3XC5O.js";
-import "./chunk-XF6J4PCH.js";
-import "./chunk-OXJEIMLS.js";
-import "./chunk-DR7DYEFQ.js";
-import "./chunk-KXQNETUB.js";
-import "./chunk-DXIZQRP5.js";
+import "./chunk-GAYSJGKD.js";
+import "./chunk-37JIYDVH.js";
+import "./chunk-6Q3KSZVI.js";
+import "./chunk-D6TL5GZV.js";
+import "./chunk-7U7HAYPB.js";
 import "./chunk-6T3EPABN.js";
-import "./chunk-6ZYJ46HN.js";
+import "./chunk-JNZ3D5B5.js";
 import "./chunk-JEAKVUWM.js";
 import "./chunk-KSQSWEFH.js";
-import "./chunk-KYCJ47JZ.js";
-import "./chunk-UAKFLKW3.js";
-import "./chunk-KLQ352NK.js";
-import "./chunk-XOLGF5MK.js";
+import "./chunk-BTWKDT4F.js";
+import "./chunk-LVYRGNOC.js";
+import "./chunk-ZD4VEHEG.js";
+import "./chunk-ZGEDIKAM.js";
 import "./chunk-4OW67KT2.js";
-import "./chunk-PCZJMNPT.js";
+import "./chunk-6GYTTWNM.js";
 import "./chunk-QZUG667L.js";
-import "./chunk-XOCNOKIV.js";
-import "./chunk-HGL7B6WB.js";
-import "./chunk-UOHOHH72.js";
+import "./chunk-33FI7W3G.js";
+import "./chunk-S2Z7CME3.js";
+import "./chunk-Y742U2YM.js";
 import "./chunk-GBHJ37V3.js";
 import "./chunk-OGHEKPLD.js";
 import "./chunk-ZPWHCABL.js";
@@ -50,4 +50,4 @@ export {
   runConsensusForGoal,
   unwrapVoteOrThrow
 };
-//# sourceMappingURL=consensus-vote-ZMEESJFP.js.map
+//# sourceMappingURL=consensus-vote-62FAN4ZN.js.map

package/dist/{context-retriever-ECGC4EFR.js → context-retriever-3OO6N4V6.js}

@@ -6,17 +6,17 @@ import {
   inferTaskCategory,
   selectRelevantResearch,
   summarizeContextForPrompt
-} from "./chunk-RSSLLOU6.js";
-import "./chunk-VNULIWRK.js";
-import "./chunk-SZZRE2VU.js";
-import "./chunk-DXIZQRP5.js";
+} from "./chunk-QAHGHWC7.js";
+import "./chunk-K2AWJGQO.js";
+import "./chunk-XZEYSIGG.js";
+import "./chunk-7U7HAYPB.js";
 import "./chunk-6T3EPABN.js";
-import "./chunk-6ZYJ46HN.js";
+import "./chunk-JNZ3D5B5.js";
 import "./chunk-JEAKVUWM.js";
 import "./chunk-KSQSWEFH.js";
 import "./chunk-QZUG667L.js";
-import "./chunk-XOCNOKIV.js";
-import "./chunk-UOHOHH72.js";
+import "./chunk-33FI7W3G.js";
+import "./chunk-Y742U2YM.js";
 import "./chunk-GBHJ37V3.js";
 import "./chunk-OGHEKPLD.js";
 import "./chunk-ZPWHCABL.js";
@@ -29,4 +29,4 @@ export {
   selectRelevantResearch,
   summarizeContextForPrompt
 };
-//# sourceMappingURL=context-retriever-ECGC4EFR.js.map
+//# sourceMappingURL=context-retriever-3OO6N4V6.js.map

package/dist/{doctor-deep-6WLU2HV7.js → doctor-deep-6WHVRRVQ.js}

@@ -1,8 +1,8 @@
 import {
   formatDeepDiagnostics,
   runDeepDiagnostics
-} from "./chunk-QUMUVNL6.js";
-import "./chunk-UOHOHH72.js";
+} from "./chunk-3CGUPSBW.js";
+import "./chunk-Y742U2YM.js";
 import "./chunk-GBHJ37V3.js";
 import "./chunk-OGHEKPLD.js";
 import "./chunk-ZPWHCABL.js";
@@ -10,4 +10,4 @@ export {
   formatDeepDiagnostics,
   runDeepDiagnostics
 };
-//# sourceMappingURL=doctor-deep-6WLU2HV7.js.map
+//# sourceMappingURL=doctor-deep-6WHVRRVQ.js.map

package/dist/{doctor-live-OLSOA44K.js → doctor-live-J7JIZH3T.js}

@@ -4,18 +4,18 @@ import {
 import {
   createAllAdapters,
   probeAllClis
-} from "./chunk-KYCJ47JZ.js";
-import "./chunk-UAKFLKW3.js";
-import "./chunk-KLQ352NK.js";
-import "./chunk-XOLGF5MK.js";
+} from "./chunk-BTWKDT4F.js";
+import "./chunk-LVYRGNOC.js";
+import "./chunk-ZD4VEHEG.js";
+import "./chunk-ZGEDIKAM.js";
 import "./chunk-4OW67KT2.js";
-import "./chunk-PCZJMNPT.js";
+import "./chunk-6GYTTWNM.js";
 import "./chunk-QZUG667L.js";
-import "./chunk-XOCNOKIV.js";
-import "./chunk-HGL7B6WB.js";
+import "./chunk-33FI7W3G.js";
+import "./chunk-S2Z7CME3.js";
 import {
   resolveClassGuardMs
-} from "./chunk-UOHOHH72.js";
+} from "./chunk-Y742U2YM.js";
 import "./chunk-GBHJ37V3.js";
 import "./chunk-OGHEKPLD.js";
 import "./chunk-ZPWHCABL.js";
@@ -157,4 +157,4 @@ export {
   formatLiveReadiness,
   runLiveReadiness
 };
-//# sourceMappingURL=doctor-live-OLSOA44K.js.map
+//# sourceMappingURL=doctor-live-J7JIZH3T.js.map

package/dist/{expert-bridge-DWBQLHPG.js → expert-bridge-PWRVRFDG.js}

@@ -3,9 +3,9 @@ import {
   shutdownExpertBridge,
   tokenSplitFromUsage,
   totalTokensFromUsage
-} from "./chunk-ET67NYCJ.js";
-import "./chunk-PCZJMNPT.js";
-import "./chunk-UOHOHH72.js";
+} from "./chunk-KJWD2V4K.js";
+import "./chunk-6GYTTWNM.js";
+import "./chunk-Y742U2YM.js";
 import "./chunk-GBHJ37V3.js";
 import "./chunk-OGHEKPLD.js";
 import "./chunk-ZPWHCABL.js";
@@ -15,4 +15,4 @@ export {
   tokenSplitFromUsage,
   totalTokensFromUsage
 };
-//# sourceMappingURL=expert-bridge-DWBQLHPG.js.map
+//# sourceMappingURL=expert-bridge-PWRVRFDG.js.map

package/dist/{factory-Q7D2MNS2.js → factory-3BZDQQYM.js}

@@ -3,16 +3,16 @@ import {
   createCliAdapter,
   getAvailableClis,
   isCliAvailable
-} from "./chunk-KYCJ47JZ.js";
-import "./chunk-UAKFLKW3.js";
-import "./chunk-KLQ352NK.js";
-import "./chunk-XOLGF5MK.js";
+} from "./chunk-BTWKDT4F.js";
+import "./chunk-LVYRGNOC.js";
+import "./chunk-ZD4VEHEG.js";
+import "./chunk-ZGEDIKAM.js";
 import "./chunk-4OW67KT2.js";
-import "./chunk-PCZJMNPT.js";
+import "./chunk-6GYTTWNM.js";
 import "./chunk-QZUG667L.js";
-import "./chunk-XOCNOKIV.js";
-import "./chunk-HGL7B6WB.js";
-import "./chunk-UOHOHH72.js";
+import "./chunk-33FI7W3G.js";
+import "./chunk-S2Z7CME3.js";
+import "./chunk-Y742U2YM.js";
 import "./chunk-GBHJ37V3.js";
 import "./chunk-OGHEKPLD.js";
 import "./chunk-ZPWHCABL.js";
@@ -22,4 +22,4 @@ export {
   getAvailableClis,
   isCliAvailable
 };
-//# sourceMappingURL=factory-Q7D2MNS2.js.map
+//# sourceMappingURL=factory-3BZDQQYM.js.map

package/dist/{factory-OTIHI4GK.js → factory-UFKRSADE.js}

@@ -1,10 +1,10 @@
 import {
   createGitHubProvider,
   createScmProvider
-} from "./chunk-ZICPESTJ.js";
-import "./chunk-MB2YIETU.js";
-import "./chunk-SZZRE2VU.js";
-import "./chunk-UOHOHH72.js";
+} from "./chunk-XREG2HTQ.js";
+import "./chunk-IWTK6FDT.js";
+import "./chunk-XZEYSIGG.js";
+import "./chunk-Y742U2YM.js";
 import "./chunk-GBHJ37V3.js";
 import "./chunk-OGHEKPLD.js";
 import "./chunk-ZPWHCABL.js";
@@ -12,4 +12,4 @@ export {
   createGitHubProvider,
   createScmProvider
 };
-//# sourceMappingURL=factory-OTIHI4GK.js.map
+//# sourceMappingURL=factory-UFKRSADE.js.map

package/dist/{improvement-review-PUEF3WL4.js → improvement-review-QUU5HR7Z.js}

@@ -11,11 +11,11 @@ import {
   loadSelfEvalSignals,
   registerImprovementReviewTool,
   runImprovementReview
-} from "./chunk-6SA3FIBZ.js";
-import "./chunk-XF6J4PCH.js";
-import "./chunk-OXJEIMLS.js";
-import "./chunk-DR7DYEFQ.js";
-import "./chunk-UOHOHH72.js";
+} from "./chunk-AGFXJUTS.js";
+import "./chunk-GAYSJGKD.js";
+import "./chunk-37JIYDVH.js";
+import "./chunk-6Q3KSZVI.js";
+import "./chunk-Y742U2YM.js";
 import "./chunk-GBHJ37V3.js";
 import "./chunk-OGHEKPLD.js";
 import "./chunk-ZPWHCABL.js";
@@ -33,4 +33,4 @@ export {
   registerImprovementReviewTool,
   runImprovementReview
 };
-//# sourceMappingURL=improvement-review-PUEF3WL4.js.map
+//# sourceMappingURL=improvement-review-QUU5HR7Z.js.map

package/dist/index.d.ts

@@ -27419,7 +27419,23 @@ declare function aggregatePrDecisions(reviews: readonly PrReviewVote[], errorPol
 /** Builds the proposal text passed to voters. The voters are designed for
  * yes/no proposals — by framing the diff as "should this PR be merged?" we
  * get usable output without needing new system prompts (Child 3 will add
- * those). */
+ * those).
+ *
+ * **Sanitization lives HERE, not at the tool boundary (#5258 item B).** The
+ * `securityTier: 'external'` declared on the registered tool only protects the
+ * MCP path, because the middleware is constructed inside `registerPrReviewTool`.
+ * Three other callers reach the voters without it — `.github/workflows/
+ * pr-review.yml`, `scripts/pr-review-local.ts` (the documented default path)
+ * and `scripts/pr-review-eval-run.ts` — each importing this builder directly
+ * from `dist/index.js`. On those paths a hostile PR body reached five voters
+ * unfenced, next to the words "should it be merged as-is?".
+ *
+ * This function is the one chokepoint all four callers pass through, so the
+ * protection is attached to the data rather than to one entry point. The MCP
+ * tier check still runs earlier and still refuses; this is the floor beneath
+ * it, and it strips rather than refuses so the script paths degrade instead of
+ * failing shut. Double-sanitizing on the MCP path is idempotent and harmless.
+ */
 declare function buildPrReviewProposal(input: Pick<PrReviewInput, 'prTitle' | 'prDescription' | 'prDiff' | 'repoContext' | 'baseRef' | 'headRef'>): string;
 /** @category MCP */
 declare function registerPrReviewTool(server: McpServer, deps: PrReviewDeps): void;