nexus-agents 8.126.9 → 8.126.11

package/dist/{chunk-VVGM24B2.js → chunk-3MPOWY7G.js}

@@ -7,7 +7,7 @@ import {
   toolStructuredError,
   toolSuccessStructured,
   wrapToolWithTimeout
-} from "./chunk-6JXE4CXO.js";
+} from "./chunk-EVSKQI4B.js";
 import {
   JsonlStore,
   SECURITY_KEYWORDS,
@@ -2428,4 +2428,4 @@ export {
   runImprovementReview,
   registerImprovementReviewTool
 };
-//# sourceMappingURL=chunk-VVGM24B2.js.map
+//# sourceMappingURL=chunk-3MPOWY7G.js.map

package/dist/{chunk-KCB2YLPC.js → chunk-4XEOJW4R.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-UVQIYBDK.js";
 import {
   withPrerequisite
-} from "./chunk-VVGM24B2.js";
+} from "./chunk-3MPOWY7G.js";
 import {
   generateSecurityPlan
 } from "./chunk-MBQ7YDWZ.js";
@@ -41,7 +41,7 @@ import {
 import {
   DEFAULT_TASK_TTL_MS,
   clampTaskTtl
-} from "./chunk-RDOZK54J.js";
+} from "./chunk-EHFQLQYS.js";
 import {
   executeExpert
 } from "./chunk-SRLSTOJL.js";
@@ -96,7 +96,7 @@ import {
   withFileLock,
   withWarnings,
   writeJobCancelled
-} from "./chunk-I3XUIBUI.js";
+} from "./chunk-N4GU3UQA.js";
 import {
   NOOP_NOTIFIER,
   RateLimiter,
@@ -122,12 +122,12 @@ import {
   toolSuccessStructured,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-6JXE4CXO.js";
+} from "./chunk-EVSKQI4B.js";
 import {
   VERSION,
   createRequestContext,
   measuredTrustTier
-} from "./chunk-T2DGOM7R.js";
+} from "./chunk-OTQKPLRU.js";
 import {
   allOf,
   anyOf
@@ -47060,7 +47060,7 @@ function buildVotingInput(plan, config) {
 }
 async function executeSingleVote(plan, config, log) {
   try {
-    const { executeVoting } = await import("./consensus-vote-JBJDDO4W.js");
+    const { executeVoting } = await import("./consensus-vote-HE44XQ7I.js");
     const input = buildVotingInput(plan, config);
     const result = await executeVoting(input, log);
     return parseVotingResult(result);
@@ -48207,7 +48207,7 @@ function createVoteStage({ config, startStage }) {
     const strategy = config.votingStrategy ?? "higher_order";
     await postProgress(config, "Vote", `Running consensus with ${strategy} strategy...`);
     try {
-      const { executeVoting } = await import("./consensus-vote-JBJDDO4W.js");
+      const { executeVoting } = await import("./consensus-vote-HE44XQ7I.js");
       const proposal = buildVoteProposal(plan, research);
       const votingResult = await executeVoting(
         {
@@ -49867,6 +49867,18 @@ function createAuditStageRegistry() {
 // src/mcp/tools/pr-review-findings.ts
 import { posix } from "node:path";
 import { parse as parseYaml3 } from "yaml";
+var FINDING_SEVERITY_ORDER = {
+  info: 0,
+  low: 1,
+  medium: 2,
+  high: 3,
+  critical: 4
+};
+var BLOCKING_SEVERITY_FLOOR = "medium";
+function isBlockingSeverity(severity, role) {
+  if (role === "security") return true;
+  return FINDING_SEVERITY_ORDER[coerceSeverity(severity)] >= FINDING_SEVERITY_ORDER[BLOCKING_SEVERITY_FLOOR];
+}
 function findingsAgree(left, right, leftRole, rightRole, repoPath) {
   if (leftRole === rightRole || !left.verified || !right.verified) return false;
   const a = normalizeFindingLocation(left.location, repoPath);
@@ -49904,11 +49916,17 @@ function isFindingVerified(gate) {
   if (/^(passed|ok|yes|done|verified)$/i.test(gate.named_assertion.trim())) return false;
   return true;
 }
-var FINDINGS_BLOCK_RE = /```yaml findings\n([\s\S]*?)\n```/;
+var FINDINGS_OPEN = "```yaml findings\n";
+var FINDINGS_CLOSE = "\n```";
+function extractFindingsBlock(reasoning) {
+  const open2 = reasoning.indexOf(FINDINGS_OPEN);
+  if (open2 === -1) return void 0;
+  const start = open2 + FINDINGS_OPEN.length;
+  const close = reasoning.indexOf(FINDINGS_CLOSE, start);
+  return close === -1 ? void 0 : reasoning.slice(start, close);
+}
 function parseFindings(reasoning) {
-  const match = FINDINGS_BLOCK_RE.exec(reasoning);
-  if (match === null) return [];
-  const yamlBody = match[1];
+  const yamlBody = extractFindingsBlock(reasoning);
   if (yamlBody === void 0 || yamlBody.trim() === "") return [];
   let parsed;
   try {
@@ -49955,7 +49973,8 @@ function coerceGateCheck(raw) {
   return "skipped";
 }
 function coerceSeverity(raw) {
-  if (raw === "critical" || raw === "high" || raw === "medium" || raw === "low") return raw;
+  if (raw === "critical" || raw === "high" || raw === "medium" || raw === "low" || raw === "info")
+    return raw;
   return "medium";
 }
 var FINDINGS_FORMAT_INSTRUCTIONS = `If you have one or more findings (claims that justify request_changes), emit them in a fenced YAML block at the END of your reasoning, exactly as below. If you're approving, OMIT the block entirely.
@@ -49963,7 +49982,7 @@ var FINDINGS_FORMAT_INSTRUCTIONS = `If you have one or more findings (claims tha
 \`\`\`yaml findings
 - summary: 'One-line summary of the issue'
   location: path/file.ext:LINE
-  severity: critical | high | medium | low
+  severity: critical | high | medium | low | info
   gate:
     reread_cited_line: passed
     traced_call_path: passed
@@ -49972,7 +49991,7 @@ var FINDINGS_FORMAT_INSTRUCTIONS = `If you have one or more findings (claims tha
   claim: 'What is wrong and why it justifies blocking the merge.'
 \`\`\`
 
-A finding only triggers request_changes if ALL FOUR gate checks are 'passed' AND named_assertion is substantive (>10 chars, naming a concrete failure). Findings missing any of those surface as informational only \u2014 they do not block the merge. This is the #2225 verification gate; the 2026-04-25 audit found a 100% false-positive rate when this gate was not enforced.`;
+A finding only triggers the verified-finding tier if its severity is ${BLOCKING_SEVERITY_FLOOR} or higher, ALL FOUR gate checks are 'passed' AND named_assertion is substantive (>10 chars, naming a concrete failure). Non-security low/info findings are reported but do not corroborate a verified blocker. Security-role findings are treated as at least medium. Request_changes votes still count toward soft blocking regardless of severity. Missing/unknown severity in legacy YAML defaults to medium (fail closed); structured JSON rejects unknown severity. Findings missing any gate checks surface as informational only \u2014 they do not verify a blocker on their own. This is the #2225 verification gate; the 2026-04-25 audit found a 100% false-positive rate when this gate was not enforced.`;
 
 // src/mcp/tools/pr-review-proposal.ts
 function sanitizationNote(sanitizeResult, removedBefore) {
@@ -50681,33 +50700,34 @@ function mapVoteDecisionToPrDecision(voteDecision) {
 var SOFT_BLOCK_REQUEST_CHANGES_THRESHOLD = 3;
 function aggregatePrDecisions(reviews, errorPolicy = "standard", repoPath) {
   const valid = reviews.filter((r) => !isAbsentSeat(r));
-  const complete = () => valid.length === reviews.length;
-  const incompleteReason = `incomplete panel: ${String(valid.length)} of ${String(reviews.length)} voters responded`;
-  const panelVerdict = (decision) => complete() ? { decision, verified: true } : { decision, verified: false, reason: incompleteReason };
+  const panelVerdict = (decision) => aggregatePanelVerdict(reviews, valid, decision);
   if (valid.length === 0) return panelVerdict("abstain");
   const findingBlocker = aggregateBlockingFindings(valid, repoPath);
-  if (findingBlocker !== void 0) return findingBlocker;
+  if (findingBlocker !== void 0) return discloseSeverityFloor(findingBlocker, valid);
   const requestChangesVoters = valid.filter((r) => r.decision === "request_changes").length;
   if (requestChangesVoters >= SOFT_BLOCK_REQUEST_CHANGES_THRESHOLD) {
-    return { decision: "request_changes", verified: false };
+    return discloseSeverityFloor({ decision: "request_changes", verified: false }, valid);
   }
   if (valid.every((r) => r.decision === "approve")) {
     if (errorPolicy === "absolute_quorum") {
-      return absoluteQuorumApprove(reviews, valid);
+      return discloseSeverityFloor(absoluteQuorumApprove(reviews, valid), valid);
     }
     if (valid.length < 2)
-      return {
-        decision: "abstain",
-        verified: false,
-        reason: "insufficient reviewers: 1 reviewer; needs second reviewer"
-      };
+      return discloseSeverityFloor(
+        {
+          decision: "abstain",
+          verified: false,
+          reason: "insufficient reviewers: 1 reviewer; needs second reviewer"
+        },
+        valid
+      );
     return panelVerdict("approve");
   }
   return panelVerdict("abstain");
 }
 function resolveAggregate(reviews, input, absent, coverage, logger58) {
   const preGate = aggregatePrDecisions(reviews, input.errorPolicy, input.repoPath);
-  if (preGate.reason !== void 0) {
+  if (!preGate.verified && preGate.reason !== void 0) {
     logger58.warn("pr_review aggregate is unverified", {
       reason: preGate.reason,
       absentCount: absent.errorCount + absent.unverifiableCount,
@@ -50722,7 +50742,10 @@ function resolveAggregate(reviews, input, absent, coverage, logger58) {
       { reason: aggregate.reason }
     );
   }
-  return aggregate;
+  return aggregate === preGate ? aggregate : discloseSeverityFloor(
+    aggregate,
+    reviews.filter((r) => !isAbsentSeat(r))
+  );
 }
 function rollUpDecisionCost(voteResults, logger58, jobId) {
   try {
@@ -50937,7 +50960,7 @@ function describeUnconfirmedFindings(reviewers) {
 }
 function aggregateBlockingFindings(valid, repoPath) {
   const blockers = valid.filter((r) => r.decision === "request_changes").flatMap(
-    (r) => r.findings.filter((f) => f.verified).map((finding) => ({ role: r.role, finding }))
+    (r) => r.findings.filter((f) => f.verified && isBlockingSeverity(f.severity, r.role)).map((finding) => ({ role: r.role, finding }))
   );
   const first = blockers[0];
   if (first === void 0) return void 0;
@@ -50958,6 +50981,29 @@ function aggregateBlockingFindings(valid, repoPath) {
     reason: describeUnconfirmedFindings([...reviewers.values()])
   };
 }
+function discloseSeverityFloor(aggregate, valid) {
+  const findings = valid.filter((r) => r.decision === "request_changes").flatMap((r) => r.findings.filter((f) => !isBlockingSeverity(f.severity, r.role)));
+  const count = findings.length;
+  if (count === 0) return aggregate;
+  const verifiedCount = findings.filter((f) => f.verified).length;
+  const unverifiedCount = count - verifiedCount;
+  const disclosure = `${String(count)} low/info ${count === 1 ? "finding" : "findings"} from request_changes voters below the blocking floor (${BLOCKING_SEVERITY_FLOOR}): ${String(verifiedCount)} verified, ${String(unverifiedCount)} unverified`;
+  return {
+    ...aggregate,
+    reason: aggregate.reason === void 0 ? disclosure : `${aggregate.reason}; ${disclosure}`
+  };
+}
+function aggregatePanelVerdict(reviews, valid, decision) {
+  const complete = valid.length === reviews.length;
+  return discloseSeverityFloor(
+    complete ? { decision, verified: true } : {
+      decision,
+      verified: false,
+      reason: `incomplete panel: ${String(valid.length)} of ${String(reviews.length)} voters responded`
+    },
+    valid
+  );
+}
 function absoluteQuorumApprove(reviews, valid) {
   const errorCount = reviews.length - valid.length;
   const erroredRoles = reviews.filter(isAbsentSeat).map((r) => r.role);
@@ -57845,4 +57891,4 @@ export {
   initializeSandbox,
   getSandboxMode
 };
-//# sourceMappingURL=chunk-KCB2YLPC.js.map
+//# sourceMappingURL=chunk-4XEOJW4R.js.map