nexus-agents 7.0.1 → 7.0.2

package/dist/{chunk-SS5FADQN.js → chunk-OHULIRP6.js}

@@ -23,7 +23,7 @@ import {
   toolSuccessStructured,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-PDMWQ2NK.js";
+} from "./chunk-GAYSJGKD.js";
 import {
   assessPanelIndependence,
   countDistinctModels,
@@ -6892,4 +6892,4 @@ export {
   CONSENSUS_VOTE_TOOL_SCHEMA,
   registerConsensusVoteTool
 };
-//# sourceMappingURL=chunk-SS5FADQN.js.map
+//# sourceMappingURL=chunk-OHULIRP6.js.map

package/dist/{chunk-UJPVBDYG.js → chunk-WLIXCNZ6.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-OQB3XC5O.js";
 import {
   VERSION
-} from "./chunk-MNG6VKJP.js";
+} from "./chunk-37JIYDVH.js";
 import {
   capitalize
 } from "./chunk-6T3EPABN.js";
@@ -1201,7 +1201,7 @@ async function runDoctorFix(result) {
   writeLine2("\u2500".repeat(40));
   let fixCount = 0;
   if (!result.dataDirectory.rootExists || result.dataDirectory.subdirectories.some((d) => !d.exists || !d.writable)) {
-    const { initDataDirectories: initDataDirectories2, describeDataDirFix: describeDataDirFix2 } = await import("./setup-data-dir-O2EABCPO.js");
+    const { initDataDirectories: initDataDirectories2, describeDataDirFix: describeDataDirFix2 } = await import("./setup-data-dir-ZEH7TFA6.js");
     const outcome = describeDataDirFix2(initDataDirectories2());
     writeLine2(outcome.line);
     if (outcome.counted) fixCount++;
@@ -1303,4 +1303,4 @@ export {
   startStdioServer,
   closeServer
 };
-//# sourceMappingURL=chunk-UJPVBDYG.js.map
+//# sourceMappingURL=chunk-WLIXCNZ6.js.map

package/dist/cli.js

@@ -153,7 +153,7 @@ import {
   validateNexusEnv,
   validateWorkflow,
   wrapInMarkdownFence
-} from "./chunk-HA2MM4C2.js";
+} from "./chunk-KUYKSKPV.js";
 import "./chunk-VYAXMVI5.js";
 import "./chunk-HFOQKCD2.js";
 import "./chunk-RSMG2DPB.js";
@@ -172,7 +172,7 @@ import {
   doctorCommand,
   initDataDirectories,
   runDoctor
-} from "./chunk-UJPVBDYG.js";
+} from "./chunk-WLIXCNZ6.js";
 import {
   buildOpenAICompatAdapters,
   readOpenAICompatEnv
@@ -191,7 +191,7 @@ import {
   recordAuthenticVote,
   registerConsensusVoteTool,
   toRecordDecision
-} from "./chunk-SS5FADQN.js";
+} from "./chunk-OHULIRP6.js";
 import {
   loadUsageEvents,
   rollupByModel
@@ -227,15 +227,15 @@ import {
   registerImprovementReviewTool,
   runImprovementReview,
   scanForSecrets
-} from "./chunk-6E2M3P5A.js";
+} from "./chunk-AGFXJUTS.js";
 import {
   createDefaultPolicyFirewall,
   setGlobalPolicyFirewall,
   stagePolicyFirewallForRollout
-} from "./chunk-PDMWQ2NK.js";
+} from "./chunk-GAYSJGKD.js";
 import {
   VERSION
-} from "./chunk-MNG6VKJP.js";
+} from "./chunk-37JIYDVH.js";
 import "./chunk-6Q3KSZVI.js";
 import {
   createUnifiedRegistry,
@@ -19587,7 +19587,7 @@ function startImprovementReviewScheduler(options) {
   let running = false;
   const runOnce = async () => {
     try {
-      const { runImprovementReview: runImprovementReview2, ImprovementReviewInputSchema: ImprovementReviewInputSchema2 } = await import("./improvement-review-PO4LS6GO.js");
+      const { runImprovementReview: runImprovementReview2, ImprovementReviewInputSchema: ImprovementReviewInputSchema2 } = await import("./improvement-review-QUU5HR7Z.js");
       const input = ImprovementReviewInputSchema2.parse({ fileIssues });
       const result = await runImprovementReview2(input, { logger: logger22 });
       logger22.info("Scheduled improvement_review complete", {

package/dist/{consensus-vote-355WNDBN.js → consensus-vote-62FAN4ZN.js}

@@ -11,11 +11,11 @@ import {
   resetCorrelationTracker,
   runConsensusForGoal,
   unwrapVoteOrThrow
-} from "./chunk-SS5FADQN.js";
+} from "./chunk-OHULIRP6.js";
 import "./chunk-RBF64DXJ.js";
 import "./chunk-OQB3XC5O.js";
-import "./chunk-PDMWQ2NK.js";
-import "./chunk-MNG6VKJP.js";
+import "./chunk-GAYSJGKD.js";
+import "./chunk-37JIYDVH.js";
 import "./chunk-6Q3KSZVI.js";
 import "./chunk-D6TL5GZV.js";
 import "./chunk-7U7HAYPB.js";
@@ -50,4 +50,4 @@ export {
   runConsensusForGoal,
   unwrapVoteOrThrow
 };
-//# sourceMappingURL=consensus-vote-355WNDBN.js.map
+//# sourceMappingURL=consensus-vote-62FAN4ZN.js.map

package/dist/{improvement-review-PO4LS6GO.js → improvement-review-QUU5HR7Z.js}

@@ -11,9 +11,9 @@ import {
   loadSelfEvalSignals,
   registerImprovementReviewTool,
   runImprovementReview
-} from "./chunk-6E2M3P5A.js";
-import "./chunk-PDMWQ2NK.js";
-import "./chunk-MNG6VKJP.js";
+} from "./chunk-AGFXJUTS.js";
+import "./chunk-GAYSJGKD.js";
+import "./chunk-37JIYDVH.js";
 import "./chunk-6Q3KSZVI.js";
 import "./chunk-Y742U2YM.js";
 import "./chunk-GBHJ37V3.js";
@@ -33,4 +33,4 @@ export {
   registerImprovementReviewTool,
   runImprovementReview
 };
-//# sourceMappingURL=improvement-review-PO4LS6GO.js.map
+//# sourceMappingURL=improvement-review-QUU5HR7Z.js.map

package/dist/index.d.ts

@@ -27419,7 +27419,23 @@ declare function aggregatePrDecisions(reviews: readonly PrReviewVote[], errorPol
 /** Builds the proposal text passed to voters. The voters are designed for
  * yes/no proposals — by framing the diff as "should this PR be merged?" we
  * get usable output without needing new system prompts (Child 3 will add
- * those). */
+ * those).
+ *
+ * **Sanitization lives HERE, not at the tool boundary (#5258 item B).** The
+ * `securityTier: 'external'` declared on the registered tool only protects the
+ * MCP path, because the middleware is constructed inside `registerPrReviewTool`.
+ * Three other callers reach the voters without it — `.github/workflows/
+ * pr-review.yml`, `scripts/pr-review-local.ts` (the documented default path)
+ * and `scripts/pr-review-eval-run.ts` — each importing this builder directly
+ * from `dist/index.js`. On those paths a hostile PR body reached five voters
+ * unfenced, next to the words "should it be merged as-is?".
+ *
+ * This function is the one chokepoint all four callers pass through, so the
+ * protection is attached to the data rather than to one entry point. The MCP
+ * tier check still runs earlier and still refuses; this is the floor beneath
+ * it, and it strips rather than refuses so the script paths degrade instead of
+ * failing shut. Double-sanitizing on the MCP path is idempotent and harmless.
+ */
 declare function buildPrReviewProposal(input: Pick<PrReviewInput, 'prTitle' | 'prDescription' | 'prDiff' | 'repoContext' | 'baseRef' | 'headRef'>): string;
 /** @category MCP */
 declare function registerPrReviewTool(server: McpServer, deps: PrReviewDeps): void;

package/dist/index.js

@@ -553,7 +553,7 @@ import {
   withLogging,
   withRetry,
   withRetryWrapper
-} from "./chunk-HA2MM4C2.js";
+} from "./chunk-KUYKSKPV.js";
 import {
   FALLBACK_SCANNER_DATA,
   buildPlanFromAnalysis,
@@ -574,7 +574,7 @@ import {
   connectTransport,
   createServer,
   startStdioServer
-} from "./chunk-UJPVBDYG.js";
+} from "./chunk-WLIXCNZ6.js";
 import {
   OPENAI_MODELS,
   OPENAI_MODEL_ALIASES,
@@ -632,7 +632,7 @@ import {
   generateProposalId,
   parseAgentPairKey,
   registerConsensusVoteTool
-} from "./chunk-SS5FADQN.js";
+} from "./chunk-OHULIRP6.js";
 import "./chunk-RBF64DXJ.js";
 import {
   allOf
@@ -683,7 +683,7 @@ import {
 import {
   ImprovementReviewInputSchema,
   registerImprovementReviewTool
-} from "./chunk-6E2M3P5A.js";
+} from "./chunk-AGFXJUTS.js";
 import {
   AgentPerformanceSchema,
   ConsensusAlgorithmSchema,
@@ -719,10 +719,10 @@ import {
   toolSuccess,
   toolSuccessStructured,
   validateToolInput
-} from "./chunk-PDMWQ2NK.js";
+} from "./chunk-GAYSJGKD.js";
 import {
   VERSION
-} from "./chunk-MNG6VKJP.js";
+} from "./chunk-37JIYDVH.js";
 import {
   AuditTrail,
   MAX_STRIPPED_ELEMENTS_PER_EVENT,
@@ -4755,7 +4755,7 @@ function buildVotingInput(plan, config) {
 }
 async function executeSingleVote(plan, config, log) {
   try {
-    const { executeVoting } = await import("./consensus-vote-355WNDBN.js");
+    const { executeVoting } = await import("./consensus-vote-62FAN4ZN.js");
     const input = buildVotingInput(plan, config);
     const result = await executeVoting(input, log);
     return parseVotingResult(result);

package/dist/{setup-data-dir-O2EABCPO.js → setup-data-dir-ZEH7TFA6.js}

@@ -2,11 +2,11 @@ import {
   NEXUS_DATA_DIR,
   describeDataDirFix,
   initDataDirectories
-} from "./chunk-UJPVBDYG.js";
+} from "./chunk-WLIXCNZ6.js";
 import "./chunk-VVXHIUFQ.js";
 import "./chunk-RBF64DXJ.js";
 import "./chunk-OQB3XC5O.js";
-import "./chunk-MNG6VKJP.js";
+import "./chunk-37JIYDVH.js";
 import "./chunk-6T3EPABN.js";
 import "./chunk-BTWKDT4F.js";
 import "./chunk-LVYRGNOC.js";
@@ -26,4 +26,4 @@ export {
   describeDataDirFix,
   initDataDirectories
 };
-//# sourceMappingURL=setup-data-dir-O2EABCPO.js.map
+//# sourceMappingURL=setup-data-dir-ZEH7TFA6.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexus-agents",
-  "version": "7.0.1",
+  "version": "7.0.2",
   "description": "Governance substrate for AI coding agents — adversarial PR review, drift-detected rules, tamper-evident audit, and closed-loop outcome routing for Claude, Codex, Gemini, and OpenCode",
   "mcpName": "io.github.nexus-substrate/nexus-agents",
   "license": "MIT",

package/dist/chunk-MNG6VKJP.js

@@ -1,7 +0,0 @@
-// src/version.ts
-var VERSION = true ? "7.0.1" : "dev";
-
-export {
-  VERSION
-};
-//# sourceMappingURL=chunk-MNG6VKJP.js.map