nexus-agents 8.19.0 → 8.20.0

package/dist/{chunk-3W4L63ML.js → chunk-2G2ZXAD7.js}

@@ -112,4 +112,4 @@ export {
   SEVERITY_EMOJI,
   DECISION_EMOJI
 };
-//# sourceMappingURL=chunk-3W4L63ML.js.map
+//# sourceMappingURL=chunk-2G2ZXAD7.js.map

package/dist/chunk-2G2ZXAD7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/dogfooding/pr-review-types.ts","../src/security/sarif-types.ts"],"sourcesContent":["/**\n * nexus-agents/dogfooding - PR Review Types\n *\n * Type definitions for automated pull request review using\n * multi-agent collaboration.\n *\n * @module dogfooding/pr-review-types\n * (Source: Issue #161, Alignment Roadmap Phase 3)\n */\n\nimport { z } from 'zod';\nimport type { FullCapableProvider } from '../scm/types.js';\nimport { FINDING_SEVERITY_LEVELS } from '../security/sarif-types.js';\n\n/**\n * Pull request file change information.\n */\nexport interface PRFileChange {\n  /** File path */\n  readonly filename: string;\n  /** Change status */\n  readonly status: 'added' | 'removed' | 'modified' | 'renamed' | 'copied';\n  /** Number of additions */\n  readonly additions: number;\n  /** Number of deletions */\n  readonly deletions: number;\n  /** File patch/diff content */\n  readonly patch?: string | undefined;\n  /** Previous filename if renamed */\n  readonly previousFilename?: string | undefined;\n}\n\n/**\n * Pull request metadata from GitHub API.\n */\nexport interface PRMetadata {\n  /** PR number */\n  readonly number: number;\n  /** PR title */\n  readonly title: string;\n  /** PR description/body */\n  readonly body: string;\n  /** Author username */\n  readonly author: string;\n  /** GitHub API author_association (e.g., 'OWNER', 'COLLABORATOR', 'NONE') */\n  readonly authorAssociation: string;\n  /** Base branch */\n  readonly base: string;\n  /** Head branch */\n  readonly head: string;\n  /** Repository owner */\n  readonly owner: string;\n  /** Repository name */\n  readonly repo: string;\n  /** PR URL */\n  readonly url: string;\n  /** Whether PR is draft */\n  readonly draft: boolean;\n  /** PR labels */\n  readonly labels: readonly string[];\n  /** Changed files */\n  readonly files: readonly PRFileChange[];\n  /** Total additions */\n  readonly additions: number;\n  /** Total deletions */\n  readonly deletions: number;\n  /** Commit SHA of head */\n  readonly headSha: string;\n}\n\n/**\n * Review severity levels.\n */\nexport type ReviewSeverity = (typeof FINDING_SEVERITY_LEVELS)[number];\n\n/**\n * Review category for organizing findings.\n */\nexport type ReviewCategory =\n  'security' | 'performance' | 'code_quality' | 'testing' | 'documentation' | 'architecture';\n\n/**\n * Individual review finding from an expert.\n */\nexport interface ReviewFinding {\n  /** Unique finding ID */\n  readonly id: string;\n  /** Category of finding */\n  readonly category: ReviewCategory;\n  /** Severity level */\n  readonly severity: ReviewSeverity;\n  /** Finding title */\n  readonly title: string;\n  /** Detailed description */\n  readonly description: string;\n  /** Affected file (if applicable) */\n  readonly file?: string | undefined;\n  /** Line number (if applicable) */\n  readonly line?: number | undefined;\n  /** Suggested fix */\n  readonly suggestion?: string | undefined;\n  /** Expert that found this issue */\n  readonly expertId: string;\n  /** Confidence score (0-1) */\n  readonly confidence: number;\n}\n\n/**\n * Review result from a single expert agent.\n */\nexport interface ExpertReviewResult {\n  /** Expert ID */\n  readonly expertId: string;\n  /** Expert role/type */\n  readonly expertType: string;\n  /** Overall approval */\n  readonly approved: boolean;\n  /** Review summary */\n  readonly summary: string;\n  /** Individual findings */\n  readonly findings: readonly ReviewFinding[];\n  /** Execution time in ms */\n  readonly durationMs: number;\n  /** Confidence in review (0-1) */\n  readonly confidence: number;\n  /**\n   * The expert never produced a verdict — its adapter failed or returned\n   * nothing (#5012).\n   *\n   * `approved` cannot express this. A failed expert used to be recorded as\n   * `approved: true` (\"don't block on failures\"), so a review in which every\n   * expert failed resolved to `approve` at 100% consensus and was posted to\n   * GitHub as a real APPROVE. Absence of a review is not approval — a consumer\n   * must be able to tell them apart, and `confidence: 0` was already present\n   * and already ignored.\n   */\n  readonly errored?: boolean;\n}\n\n/**\n * Aggregated review decision after multi-agent debate.\n */\nexport type ReviewDecision = 'approve' | 'request_changes' | 'comment';\n\n/**\n * Complete PR review result from multi-agent collaboration.\n */\n/**\n * Trust + reputation assessment of the PR author, surfaced for observability\n * (#3123, epic #3118 Phase 5). Mirrors `issue_triage`'s assessment.\n */\nexport interface PRTrustAssessment {\n  /** Classifier trust tier (1-4) from author association. */\n  readonly trustTier: string;\n  /** Author's GitHub role. */\n  readonly userRole: string;\n  /**\n   * Whether the author is on the maintainer allowlist — present only when an\n   * allowlist was consulted (#4992). Absent means \"no allowlist was consulted\",\n   * which is the state on every live path today; it was previously recorded\n   * as `false` without being measured.\n   */\n  readonly isAllowlisted?: boolean;\n  /**\n   * Whether a durable `AuditLogger` was configured for this process (#4992\n   * review). `configured` — the trust event was handed to it; delivery to the\n   * hash chain is subject to the logger's own severity filter (trust events\n   * are `info`), queue and fail-loud flush, and is not confirmed per call.\n   * `none` — no audit logger (audit disabled, or the CLI path).\n   */\n  readonly auditSink: 'configured' | 'none';\n  /** Reputation score (0-100) when reputation is enabled. */\n  readonly reputationScore?: number | undefined;\n  /** Suspicious signals detected (e.g. `new_account`, `injection_patterns_detected`). */\n  readonly suspiciousSignals: readonly string[];\n  /** Whether the author is flagged as suspicious. */\n  readonly isSuspicious: boolean;\n  /** Tier the policy gate ACTUALLY enforced (== trustTier under audit/off). */\n  readonly enforcedTrustTier?: string | undefined;\n  /** Tier reputation reconciliation computed — what enforce mode WOULD gate on. */\n  readonly reputationReconciledTier?: string | undefined;\n  /** Reputation-gating rollout mode applied: `off` | `audit` | `enforce`. */\n  readonly gatingMode?: string | undefined;\n}\n\n/**\n * Result of fetching PR data plus best-effort author signals (#3133).\n */\nexport interface PRFetchData {\n  readonly metadata: PRMetadata;\n  readonly provider: FullCapableProvider;\n  /** Author's real account age in days, when the lookup succeeded (#3133). */\n  readonly accountAgeDays?: number;\n}\n\nexport interface PRReviewResult {\n  /** Pull request number */\n  readonly prNumber: number;\n  /** Repository full name (owner/repo) */\n  readonly repository: string;\n  /** Overall decision */\n  readonly decision: ReviewDecision;\n  /** Executive summary */\n  readonly summary: string;\n  /** Individual expert reviews */\n  readonly expertReviews: readonly ExpertReviewResult[];\n  /** Aggregated findings by severity */\n  readonly findingsBySeverity: Readonly<Record<ReviewSeverity, number>>;\n  /** Aggregated findings by category */\n  readonly findingsByCategory: Readonly<Record<ReviewCategory, number>>;\n  /** Total execution time in ms */\n  readonly totalDurationMs: number;\n  /** Number of experts that participated */\n  readonly expertCount: number;\n  /** Total number of changed files reported by the SCM provider. */\n  readonly totalFiles: number;\n  /** Number of changed files for which the SCM provider returned a patch. */\n  readonly filesWithPatch: number;\n  /** Number of file patches supplied to at least one non-errored expert. */\n  readonly filesReviewed: number;\n  /** Whether the successful expert panel covered all, some, or no changed files. */\n  readonly reviewCoverage: 'full' | 'partial' | 'none';\n  /** Consensus score (0-1) */\n  readonly consensusScore: number;\n  /** Debate rounds completed */\n  readonly debateRounds: number;\n  /** Timestamp of review */\n  readonly timestamp: string;\n  /** Author trust + reputation assessment (#3123). */\n  readonly trustAssessment: PRTrustAssessment;\n  /**\n   * What actually happened when the review was posted to GitHub (#4354).\n   *\n   * The review previously reported success whether or not the post landed: a\n   * `createReview` rejection was logged and discarded, and a Rule-of-Two block\n   * returned early, both leaving the CLI to print \"Review posted to GitHub.\"\n   * over a review that does not exist. Callers must consult this rather than\n   * inferring a successful post from a successful review.\n   */\n  readonly postOutcome: ReviewPostOutcome;\n}\n\n/**\n * A completed review before the posting step has run (#4354).\n *\n * Everything the reviewer aggregates is known before the post is attempted; the\n * outcome is stamped on afterwards. Keeping the two apart in the types is what\n * stops `postOutcome` from being defaulted to a hopeful value.\n */\nexport type PRReviewDraft = Omit<PRReviewResult, 'postOutcome'>;\n\n/** Terminal state of the GitHub review-posting step (#4354). */\nexport type ReviewPostOutcome =\n  /** The review was created on GitHub. */\n  | { readonly status: 'posted' }\n  /** Posting was deliberately not attempted (dry-run, or a policy gate blocked it). */\n  | { readonly status: 'skipped'; readonly reason: string }\n  /** Posting was attempted and GitHub rejected it. */\n  | { readonly status: 'failed'; readonly error: string };\n\n/**\n * Configuration for PR review.\n */\nexport interface PRReviewConfig {\n  /** Experts to include in review */\n  readonly experts: readonly ReviewCategory[];\n  /** Maximum debate rounds */\n  readonly maxDebateRounds: number;\n  /** Consensus threshold (0-1) */\n  readonly consensusThreshold: number;\n  /** Minimum severity to report */\n  readonly minSeverity: ReviewSeverity;\n  /** Whether to post inline comments */\n  readonly enableInlineComments: boolean;\n  /** Whether to run in dry-run mode (no GitHub posting) */\n  readonly dryRun: boolean;\n  /** Whether to assess author reputation and gate on it (#3123). */\n  readonly enableReputation: boolean;\n  /** GitHub token for API access */\n  readonly githubToken?: string | undefined;\n  /** Model adapter configuration */\n  readonly modelConfig?: {\n    readonly temperature?: number;\n    readonly maxTokens?: number;\n  };\n}\n\n/**\n * Default PR review configuration.\n */\nexport const DEFAULT_PR_REVIEW_CONFIG: PRReviewConfig = {\n  experts: ['security', 'code_quality', 'testing'],\n  maxDebateRounds: 3,\n  consensusThreshold: 0.7,\n  minSeverity: 'low',\n  enableInlineComments: true,\n  dryRun: false,\n  enableReputation: true,\n  modelConfig: {\n    temperature: 0.3,\n    maxTokens: 8192,\n  },\n};\n\n/**\n * Zod schema for PR review configuration.\n */\nexport const PRReviewConfigSchema = z.object({\n  experts: z\n    .array(\n      z.enum([\n        'security',\n        'performance',\n        'code_quality',\n        'testing',\n        'documentation',\n        'architecture',\n      ])\n    )\n    .default(['security', 'code_quality', 'testing']),\n  maxDebateRounds: z.number().int().min(1).max(10).default(3),\n  consensusThreshold: z.number().min(0).max(1).default(0.7),\n  minSeverity: z.enum(FINDING_SEVERITY_LEVELS).default('low'),\n  enableInlineComments: z.boolean().default(true),\n  dryRun: z.boolean().default(false),\n  enableReputation: z.boolean().default(true),\n  githubToken: z.string().optional(),\n  modelConfig: z\n    .object({\n      temperature: z.number().min(0).max(2).default(0.3),\n      maxTokens: z.number().int().positive().default(8192),\n    })\n    .optional(),\n});\n\n/**\n * Severity order for comparison. INVERTED vs sarif-types' SEVERITY_ORDER by\n * design (higher = more severe here, for descending sort); only the KEY SET is\n * shared. Derived from the canonical {@link FINDING_SEVERITY_LEVELS} so the keys\n * can't drift (#3570): critical→5 … info→1.\n */\nexport const SEVERITY_ORDER: Record<ReviewSeverity, number> = Object.fromEntries(\n  FINDING_SEVERITY_LEVELS.map((level, index) => [level, FINDING_SEVERITY_LEVELS.length - index])\n) as Record<ReviewSeverity, number>;\n\n/**\n * Category display names.\n */\nexport const CATEGORY_DISPLAY_NAMES: Record<ReviewCategory, string> = {\n  security: 'Security',\n  performance: 'Performance',\n  code_quality: 'Code Quality',\n  testing: 'Testing',\n  documentation: 'Documentation',\n  architecture: 'Architecture',\n};\n\n/**\n * Severity emoji for GitHub comments.\n */\nexport const SEVERITY_EMOJI: Record<ReviewSeverity, string> = {\n  critical: ':rotating_light:',\n  high: ':warning:',\n  medium: ':yellow_circle:',\n  low: ':large_blue_circle:',\n  info: ':information_source:',\n};\n\n/**\n * Decision emoji for GitHub comments.\n */\nexport const DECISION_EMOJI: Record<ReviewDecision, string> = {\n  approve: ':white_check_mark:',\n  request_changes: ':x:',\n  comment: ':speech_balloon:',\n};\n","/**\n * SARIF Types and Security Finding Schema (#1682)\n *\n * Types for parsing SARIF (Static Analysis Results Interchange Format)\n * output from security scanners (Semgrep, CodeQL, Bandit, ESLint).\n * Normalizes findings into a unified schema for MCP tool consumption.\n *\n * @module security/sarif-types\n * (Source: Issue #1681, #1682 — Proactive Defensive Security)\n */\n\nimport { z } from 'zod';\n\n// ============================================================================\n// Unified Security Finding Schema\n// ============================================================================\n\n/**\n * Canonical 5-value finding-severity vocabulary (CVSS-aligned), most→least\n * severe. THE single source of truth — every 5-value finding-severity zod enum\n * (severity-consensus, finding-triage, agents/output-schemas, expert-types\n * VulnerabilitySeverity) and both SEVERITY_ORDER maps derive from this (#3570).\n * Tuple order is authoritative: SEVERITY_ORDER below maps it to ascending ranks.\n */\nexport const FINDING_SEVERITY_LEVELS = ['critical', 'high', 'medium', 'low', 'info'] as const;\n\n/** Severity levels aligned with CVSS and common scanner output. */\nexport const FindingSeveritySchema = z.enum(FINDING_SEVERITY_LEVELS);\nexport type FindingSeverity = z.infer<typeof FindingSeveritySchema>;\n\n/** A normalized security finding from any SARIF-compatible scanner. */\nexport const SecurityFindingSchema = z.object({\n  /** Unique finding ID (scanner-specific rule ID). */\n  id: z.string().min(1),\n  /** Scanner that produced this finding. */\n  scanner: z.string().min(1),\n  /** Rule identifier (e.g., 'javascript.lang.security.detect-eval'). */\n  rule: z.string().min(1),\n  /** Normalized severity. */\n  severity: FindingSeveritySchema,\n  /** Human-readable description of the finding. */\n  message: z.string().min(1).max(2000),\n  /** File path where the finding was detected. */\n  file: z.string().min(1),\n  /** Start line number (1-based). */\n  startLine: z.number().int().min(1),\n  /** End line number (1-based, optional). */\n  endLine: z.number().int().min(1).optional(),\n  /** CWE identifiers (e.g., ['CWE-79', 'CWE-89']). */\n  cweIds: z.array(z.string()).default([]),\n  /** Scanner confidence (0-1). */\n  confidence: z.number().min(0).max(1).default(0.5),\n  /** Code snippet around the finding (optional). */\n  snippet: z.string().max(500).optional(),\n  /** Help URL for remediation guidance. */\n  helpUrl: z.string().optional(),\n});\n\nexport type SecurityFinding = z.infer<typeof SecurityFindingSchema>;\n\n/** Result of parsing a SARIF file. */\nexport interface SarifParseResult {\n  /** Scanner name extracted from SARIF. */\n  readonly scanner: string;\n  /** Total findings parsed. */\n  readonly totalFindings: number;\n  /** Findings sorted by severity (critical first). */\n  readonly findings: readonly SecurityFinding[];\n  /** Parsing errors (non-fatal). */\n  readonly errors: readonly string[];\n}\n\n// ============================================================================\n// SARIF Input Types (subset of the SARIF 2.1.0 spec we need)\n// ============================================================================\n\n/** SARIF result level → our severity mapping. */\nexport const SARIF_LEVEL_MAP: Readonly<Record<string, FindingSeverity>> = {\n  error: 'high',\n  warning: 'medium',\n  note: 'low',\n  none: 'info',\n};\n\n/**\n * Severity order for sorting (lower = more severe). Derived from the canonical\n * tuple so it can never drift from {@link FINDING_SEVERITY_LEVELS} (#3570).\n */\nexport const SEVERITY_ORDER: Readonly<Record<FindingSeverity, number>> = Object.fromEntries(\n  FINDING_SEVERITY_LEVELS.map((level, index) => [level, index])\n) as Record<FindingSeverity, number>;\n"],"mappings":";AAUA,SAAS,KAAAA,UAAS;;;ACClB,SAAS,SAAS;AAaX,IAAM,0BAA0B,CAAC,YAAY,QAAQ,UAAU,OAAO,MAAM;AAG5E,IAAM,wBAAwB,EAAE,KAAK,uBAAuB;AAI5D,IAAM,wBAAwB,EAAE,OAAO;AAAA;AAAA,EAE5C,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEpB,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEzB,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEtB,UAAU;AAAA;AAAA,EAEV,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI;AAAA;AAAA,EAEnC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEtB,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAAA;AAAA,EAEjC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA,EAE1C,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA;AAAA,EAEtC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,QAAQ,GAAG;AAAA;AAAA,EAEhD,SAAS,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA,EAEtC,SAAS,EAAE,OAAO,EAAE,SAAS;AAC/B,CAAC;AAqBM,IAAM,kBAA6D;AAAA,EACxE,OAAO;AAAA,EACP,SAAS;AAAA,EACT,MAAM;AAAA,EACN,MAAM;AACR;AAMO,IAAM,iBAA4D,OAAO;AAAA,EAC9E,wBAAwB,IAAI,CAAC,OAAO,UAAU,CAAC,OAAO,KAAK,CAAC;AAC9D;;;ADwMO,IAAM,2BAA2C;AAAA,EACtD,SAAS,CAAC,YAAY,gBAAgB,SAAS;AAAA,EAC/C,iBAAiB;AAAA,EACjB,oBAAoB;AAAA,EACpB,aAAa;AAAA,EACb,sBAAsB;AAAA,EACtB,QAAQ;AAAA,EACR,kBAAkB;AAAA,EAClB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,WAAW;AAAA,EACb;AACF;AAKO,IAAM,uBAAuBC,GAAE,OAAO;AAAA,EAC3C,SAASA,GACN;AAAA,IACCA,GAAE,KAAK;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,EACC,QAAQ,CAAC,YAAY,gBAAgB,SAAS,CAAC;AAAA,EAClD,iBAAiBA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC;AAAA,EAC1D,oBAAoBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,QAAQ,GAAG;AAAA,EACxD,aAAaA,GAAE,KAAK,uBAAuB,EAAE,QAAQ,KAAK;AAAA,EAC1D,sBAAsBA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA,EAC9C,QAAQA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACjC,kBAAkBA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA,EAC1C,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,aAAaA,GACV,OAAO;AAAA,IACN,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,QAAQ,GAAG;AAAA,IACjD,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACrD,CAAC,EACA,SAAS;AACd,CAAC;AAQM,IAAMC,kBAAiD,OAAO;AAAA,EACnE,wBAAwB,IAAI,CAAC,OAAO,UAAU,CAAC,OAAO,wBAAwB,SAAS,KAAK,CAAC;AAC/F;AAKO,IAAM,yBAAyD;AAAA,EACpE,UAAU;AAAA,EACV,aAAa;AAAA,EACb,cAAc;AAAA,EACd,SAAS;AAAA,EACT,eAAe;AAAA,EACf,cAAc;AAChB;AAKO,IAAM,iBAAiD;AAAA,EAC5D,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,KAAK;AAAA,EACL,MAAM;AACR;AAKO,IAAM,iBAAiD;AAAA,EAC5D,SAAS;AAAA,EACT,iBAAiB;AAAA,EACjB,SAAS;AACX;","names":["z","z","SEVERITY_ORDER"]}

package/dist/{chunk-LB7DDJOG.js → chunk-ASUB4LSV.js}

@@ -23,10 +23,10 @@ import {
   toolSuccessStructured,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-ZTB4Z23O.js";
+} from "./chunk-FZXMMOBQ.js";
 import {
   VERSION
-} from "./chunk-XFDT265H.js";
+} from "./chunk-AWFW6FD4.js";
 import {
   assessPanelIndependence,
   countDistinctModels,
@@ -7205,4 +7205,4 @@ export {
   CONSENSUS_VOTE_TOOL_SCHEMA,
   registerConsensusVoteTool
 };
-//# sourceMappingURL=chunk-LB7DDJOG.js.map
+//# sourceMappingURL=chunk-ASUB4LSV.js.map

package/dist/chunk-AWFW6FD4.js

@@ -0,0 +1,7 @@
+// src/version.ts
+var VERSION = true ? "8.20.0" : "dev";
+
+export {
+  VERSION
+};
+//# sourceMappingURL=chunk-AWFW6FD4.js.map

package/dist/{chunk-ZTB4Z23O.js → chunk-FZXMMOBQ.js}

@@ -1,6 +1,6 @@
 import {
   VERSION
-} from "./chunk-XFDT265H.js";
+} from "./chunk-AWFW6FD4.js";
 import {
   emitClawGuardViolation
 } from "./chunk-TCTKOFNL.js";
@@ -2246,4 +2246,4 @@ export {
   VOTING_THRESHOLDS,
   ConsensusMetricsSchema
 };
-//# sourceMappingURL=chunk-ZTB4Z23O.js.map
+//# sourceMappingURL=chunk-FZXMMOBQ.js.map

package/dist/{chunk-5LAPFTNG.js → chunk-PIWFHJSU.js}

@@ -17,11 +17,11 @@ import {
   FINDING_SEVERITY_LEVELS,
   SARIF_LEVEL_MAP,
   SEVERITY_ORDER
-} from "./chunk-3W4L63ML.js";
+} from "./chunk-2G2ZXAD7.js";
 import {
   DEFAULT_TASK_TTL_MS,
   clampTaskTtl
-} from "./chunk-2WAF3ZFK.js";
+} from "./chunk-XSRCJ7FA.js";
 import {
   executeExpert
 } from "./chunk-C7CSLODO.js";
@@ -48,7 +48,7 @@ import {
   simulationDeniedResult,
   toJobSummary,
   writeJobCancelled
-} from "./chunk-LB7DDJOG.js";
+} from "./chunk-ASUB4LSV.js";
 import {
   allOf
 } from "./chunk-OQB3XC5O.js";
@@ -67,7 +67,7 @@ import {
 } from "./chunk-ZUK5BG3Q.js";
 import {
   withPrerequisite
-} from "./chunk-6B7E372N.js";
+} from "./chunk-W5M6VFDH.js";
 import {
   NOOP_NOTIFIER,
   RateLimiter,
@@ -92,7 +92,7 @@ import {
   withAuditTrail,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-ZTB4Z23O.js";
+} from "./chunk-FZXMMOBQ.js";
 import {
   createAuditTrail,
   createGraphAuditBridge,
@@ -45808,6 +45808,149 @@ function checkpointToResult(state) {
   return result;
 }
 
+// src/pipeline/iterative-consensus.ts
+var defaultLogger3 = createLogger({ component: "iterative-consensus" });
+var DEFAULT_MAX_ITERATIONS = 3;
+var DEFAULT_MAX_NO_QUORUM_RETRIES = 2;
+var DEFAULT_MAX_PROPOSAL_LENGTH = 4e3;
+var DEFAULT_STRATEGY = "higher_order";
+var DEFAULT_PREFIX = "pipeline";
+async function voteWithQuorumRecovery(state) {
+  const outcome = await retryNoQuorumVote(
+    () => executeSingleVote(state.plan, state.config, state.log),
+    state.maxNoQuorumRetries,
+    (attempt, vote) => {
+      state.log.warn("Vote reached no_quorum \u2014 re-running the missing voice (bounded)", {
+        attempt,
+        maxNoQuorumRetries: state.maxNoQuorumRetries,
+        reason: vote.reason
+      });
+      emitPipelineStageEvent(state.prefix, "vote", "started");
+    }
+  );
+  return outcome.vote;
+}
+async function retryNoQuorumVote(executeVote, maxRetries = DEFAULT_MAX_NO_QUORUM_RETRIES, onRetry) {
+  let vote = await executeVote();
+  let retries = 0;
+  while (vote.kind === "no_quorum" && retries < maxRetries) {
+    retries++;
+    onRetry?.(retries, vote);
+    vote = await executeVote();
+  }
+  return { vote, retries };
+}
+async function runOneIteration(state, iteration) {
+  state.log.info("Consensus iteration", { iteration });
+  emitPipelineStageEvent(state.prefix, "vote", "started");
+  state.lastVote = await voteWithQuorumRecovery(state);
+  const iterMs = getTimeProvider().now() - state.globalStart;
+  const accepted = isVoteAccepted(state.lastVote);
+  emitPipelineStageEvent(state.prefix, "vote", accepted ? "completed" : "failed", {
+    durationMs: iterMs
+  });
+  if (accepted) {
+    return { result: { vote: state.lastVote, iterations: iteration, durationMs: iterMs } };
+  }
+  if (state.lastVote.kind === "no_quorum") {
+    const terminalVote = {
+      kind: "no_quorum",
+      reason: `vote could not reach quorum after ${String(state.maxNoQuorumRetries)} re-run(s): ${state.lastVote.reason}`,
+      approvalPercentage: state.lastVote.approvalPercentage
+    };
+    return { terminal: { vote: terminalVote, iterations: iteration, durationMs: iterMs } };
+  }
+  return {};
+}
+async function runIterativeConsensus(initialPlan, revisePlan, config) {
+  const maxIter = config?.maxIterations ?? DEFAULT_MAX_ITERATIONS;
+  const state = {
+    plan: initialPlan,
+    lastVote: void 0,
+    config,
+    log: config?.logger ?? defaultLogger3,
+    prefix: config?.pipelinePrefix ?? DEFAULT_PREFIX,
+    globalStart: getTimeProvider().now(),
+    maxNoQuorumRetries: config?.maxNoQuorumRetries ?? DEFAULT_MAX_NO_QUORUM_RETRIES
+  };
+  return runConsensusLoop(state, maxIter, revisePlan);
+}
+async function runConsensusLoop(state, maxIter, revisePlan) {
+  for (let i = 0; i < maxIter; i++) {
+    const outcome = await runOneIteration(state, i + 1);
+    const done = outcome.result ?? outcome.terminal;
+    if (done !== void 0) return done;
+    await maybeRevise(state, i, maxIter, revisePlan);
+  }
+  return buildExhaustedResult(state, maxIter);
+}
+function isVoteAccepted(vote) {
+  return vote.kind === "approved" || vote.kind === "conditional_go";
+}
+function extractFeedback2(vote) {
+  if (vote === void 0) return "";
+  return vote.kind === "rejected" ? vote.feedback : "";
+}
+async function maybeRevise(state, iteration, maxIter, revisePlan) {
+  if (iteration >= maxIter - 1) return;
+  state.log.info("Vote rejected, revising plan", { iteration: iteration + 1 });
+  state.plan = await revisePlan(state.plan, extractFeedback2(state.lastVote));
+}
+function buildExhaustedResult(state, maxIter) {
+  const totalMs = getTimeProvider().now() - state.globalStart;
+  const fallback = {
+    kind: "rejected",
+    feedback: "No votes executed",
+    approvalPercentage: 0
+  };
+  return { vote: state.lastVote ?? fallback, iterations: maxIter, durationMs: totalMs };
+}
+function buildVotingInput(plan, config) {
+  const c = config ?? {};
+  const maxLen = c.maxProposalLength ?? DEFAULT_MAX_PROPOSAL_LENGTH;
+  return {
+    proposal: plan.slice(0, maxLen),
+    strategy: c.strategy ?? DEFAULT_STRATEGY,
+    simulateVotes: c.simulateVotes ?? false,
+    quickMode: c.quickMode ?? false,
+    // #4138: this reusable helper opts into absolute_quorum by default.
+    errorPolicy: c.errorPolicy ?? "absolute_quorum"
+  };
+}
+async function executeSingleVote(plan, config, log) {
+  try {
+    const { executeVoting } = await import("./consensus-vote-X4XXWGDD.js");
+    const input = buildVotingInput(plan, config);
+    const result = await executeVoting(input, log);
+    return parseVotingResult(result);
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : String(error);
+    log.warn("Vote execution failed, treating as rejected", { error: msg });
+    return {
+      kind: "rejected",
+      feedback: `Vote infrastructure failed \u2014 no consensus produced: ${msg}`,
+      approvalPercentage: 0
+    };
+  }
+}
+function parseVotingResult(result) {
+  const total = Math.max(1, result.result.voteCounts.approve + result.result.voteCounts.reject);
+  const pct = result.result.voteCounts.approve / total * 100;
+  const decision = result.decision ?? (result.result.outcome === "approved" ? "approved" : "rejected");
+  if (decision === "approved") {
+    return { kind: "approved", approvalPercentage: pct };
+  }
+  if (decision === "no_quorum") {
+    return {
+      kind: "no_quorum",
+      reason: "vote could not reach quorum (a voice was missing)",
+      approvalPercentage: pct
+    };
+  }
+  const feedback = result.votes.filter((v) => v.vote.decision !== "approve").map((v) => v.vote.reasoning).join("\n");
+  return { kind: "rejected", feedback, approvalPercentage: pct };
+}
+
 // src/orchestration/qa-loop.ts
 var logger40 = createLogger({ component: "qa-loop" });
 var DEFAULT_MAX_QA_ITERATIONS = 3;
@@ -45882,6 +46025,11 @@ async function runDevPipelineInner(task, stages, options, sid, prior) {
     logger41.info("Dry run \u2014 stopping after plan+vote");
     return buildDryRunResult(planResult);
   }
+  if (planResult.planStatus !== void 0) {
+    const result2 = buildPlanFailureResult(planResult);
+    applyPipelineHindsight(bm, task, sid, result2);
+    return result2;
+  }
   enforceConsensusExecutePolicy(sid, trustTier, auditLogger);
   const tasks = await runOrResumeDecompose(prior, planResult.plan, stages, {
     conditional: planResult.conditional,
@@ -46083,7 +46231,25 @@ function buildDryRunResult(planResult) {
     // "the security gate rejected this"; `securityRan: false` says it never ran.
     securityPassed: false,
     securityRan: false,
-    ...planResult.plan.trim() === "" ? { planStatus: "empty" } : {}
+    ...planResult.planStatus !== void 0 ? { planStatus: planResult.planStatus } : {},
+    ...planResult.planVoteReason !== void 0 ? { planVoteReason: planResult.planVoteReason } : {},
+    ...planResult.planVoteApprovalPercentage !== void 0 ? { planVoteApprovalPercentage: planResult.planVoteApprovalPercentage } : {},
+    ...planResult.planVoteFeedback !== void 0 ? { planVoteFeedback: planResult.planVoteFeedback } : {}
+  };
+}
+function buildPlanFailureResult(planResult) {
+  return {
+    completed: false,
+    plan: planResult.plan,
+    tasks: [],
+    voteIterations: planResult.iterations,
+    qaIterations: 0,
+    securityPassed: false,
+    securityRan: false,
+    planStatus: planResult.planStatus ?? "unapproved",
+    ...planResult.planVoteReason !== void 0 ? { planVoteReason: planResult.planVoteReason } : {},
+    ...planResult.planVoteApprovalPercentage !== void 0 ? { planVoteApprovalPercentage: planResult.planVoteApprovalPercentage } : {},
+    ...planResult.planVoteFeedback !== void 0 ? { planVoteFeedback: planResult.planVoteFeedback } : {}
   };
 }
 async function resolveResearch(prior, task, stages, options) {
@@ -46115,7 +46281,7 @@ async function runPlanningPhase(task, stages, prior, options) {
     sid,
     limits: resolveIterationLimits(options)
   });
-  if (sid !== void 0) {
+  if (sid !== void 0 && planResult.planStatus === void 0) {
     saveStageCheckpoint(sid, "plan", {
       type: "plan",
       text: planResult.plan,
@@ -46123,7 +46289,7 @@ async function runPlanningPhase(task, stages, prior, options) {
     });
     saveStageCheckpoint(sid, "vote", {
       type: "vote",
-      approved: planResult.conditional || planResult.iterations > 0,
+      approved: true,
       conditional: planResult.conditional,
       conditions: planResult.conditions,
       caveats: planResult.caveats,
@@ -46239,6 +46405,7 @@ function extractConditionalMeta(vote) {
 async function planVoteLoop(task, research, stages, sessionId, limits) {
   let feedback;
   let plan = "";
+  let lastRejected;
   for (let i = 1; i <= limits.vote; i++) {
     plan = await withStep(
       { name: `plan (i=${String(i)})`, attrs: { iteration: i } },
@@ -46246,37 +46413,100 @@ async function planVoteLoop(task, research, stages, sessionId, limits) {
     );
     if (plan.trim() === "") {
       logger41.warn("Planner returned no plan \u2014 stopping before vote", { iteration: i, sessionId });
-      return { plan: "", iterations: i, conditional: false, conditions: [], caveats: [] };
-    }
-    const vote = await withStep(
-      { name: `vote (i=${String(i)})`, attrs: { iteration: i } },
-      async (ctx) => {
-        const r = await stages.vote(plan, research);
-        ctx.setSummary(
-          `${String(Math.round(r.approvalPercentage))}% ${isApproved(r) ? "approved" : "rejected"}`
-        );
-        return r;
+      return {
+        plan: "",
+        iterations: i,
+        conditional: false,
+        conditions: [],
+        caveats: [],
+        planStatus: "empty"
+      };
+    }
+    const voteOutcome = await retryNoQuorumVote(
+      () => runPlanVote(plan, research, stages, i),
+      DEFAULT_MAX_NO_QUORUM_RETRIES,
+      (attempt, vote2) => {
+        logQuorumRetry(attempt, vote2, sessionId);
       }
     );
-    if (isApproved(vote)) {
-      const meta = extractConditionalMeta(vote);
-      logger41.info("Plan approved", {
-        iteration: i,
-        approval: vote.approvalPercentage,
-        sessionId,
-        ...meta
-      });
-      return { plan, iterations: i, ...meta };
+    const vote = voteOutcome.vote;
+    if (vote.kind === "approved" || vote.kind === "conditional_go") {
+      return buildApprovedPlanResult(plan, i, vote, sessionId);
+    }
+    if (vote.kind === "no_quorum") {
+      return buildNoQuorumPlanResult(plan, i, vote, voteOutcome.retries);
     }
-    feedback = getVoteFeedback(vote);
+    lastRejected = vote;
+    feedback = vote.feedback;
     logger41.warn("Plan rejected, iterating", {
       iteration: i,
       feedback: feedback.slice(0, 200),
       sessionId
     });
   }
-  logger41.warn("Max vote iterations reached, proceeding with last plan", { sessionId });
-  return { plan, iterations: limits.vote, conditional: false, conditions: [], caveats: [] };
+  return buildUnapprovedPlanResult(plan, limits.vote, lastRejected, sessionId);
+}
+function buildApprovedPlanResult(plan, iterations, vote, sessionId) {
+  const meta = extractConditionalMeta(vote);
+  logger41.info("Plan approved", {
+    iteration: iterations,
+    approval: vote.approvalPercentage,
+    sessionId,
+    ...meta
+  });
+  return { plan, iterations, ...meta };
+}
+async function runPlanVote(plan, research, stages, iteration) {
+  return withStep({ name: `vote (i=${String(iteration)})`, attrs: { iteration } }, async (ctx) => {
+    const result = await stages.vote(plan, research);
+    const label = result.kind === "no_quorum" ? "no_quorum" : isApproved(result) ? "approved" : "rejected";
+    ctx.setSummary(`${String(Math.round(result.approvalPercentage))}% ${label}`);
+    return result;
+  });
+}
+function logQuorumRetry(attempt, vote, sessionId) {
+  logger41.warn("Plan vote reached no_quorum \u2014 re-running the same plan", {
+    attempt,
+    maxNoQuorumRetries: DEFAULT_MAX_NO_QUORUM_RETRIES,
+    reason: vote.reason,
+    sessionId
+  });
+}
+function buildNoQuorumPlanResult(plan, iterations, vote, retries) {
+  logger41.warn("Plan vote could not reach quorum \u2014 stopping", {
+    retries,
+    reason: vote.reason
+  });
+  return {
+    plan,
+    iterations,
+    conditional: false,
+    conditions: [],
+    caveats: [],
+    planStatus: "no_quorum",
+    planVoteReason: vote.reason,
+    planVoteApprovalPercentage: vote.approvalPercentage
+  };
+}
+function buildUnapprovedPlanResult(plan, iterations, vote, sessionId) {
+  const feedback = vote?.feedback ?? "No plan vote was run";
+  const approvalPercentage = vote?.approvalPercentage ?? 0;
+  logger41.warn("Max vote iterations reached without plan approval \u2014 stopping", {
+    sessionId,
+    iterations,
+    approvalPercentage,
+    feedback: feedback.slice(0, 200)
+  });
+  return {
+    plan,
+    iterations,
+    conditional: false,
+    conditions: [],
+    caveats: [],
+    planStatus: "unapproved",
+    planVoteApprovalPercentage: approvalPercentage,
+    planVoteFeedback: feedback
+  };
 }
 async function implementSingleTask(task, stages, limits) {
   let currentTask = { ...task, status: "in_progress" };
@@ -47461,13 +47691,15 @@ ${contextBlock}`;
       const strategy = config.votingStrategy ?? "higher_order";
       await postProgress(config, "Vote", `Running consensus with ${strategy} strategy...`);
       try {
-        const { executeVoting } = await import("./consensus-vote-QS72DIWI.js");
+        const { executeVoting } = await import("./consensus-vote-X4XXWGDD.js");
         const votingResult = await executeVoting(
           {
             proposal: buildVoteProposal(plan, research),
             strategy,
             simulateVotes: config.simulateVotes ?? false,
-            quickMode: config.quickMode ?? false
+            quickMode: config.quickMode ?? false,
+            // #5506: plan approval requires the requested panel, not only survivors.
+            errorPolicy: "absolute_quorum"
           },
           logger45
         );
@@ -50439,6 +50671,37 @@ function classifyDispatchError(err2) {
   return err2 instanceof MetaDispatchError && err2.code === "no_executor" ? "business" : "internal";
 }
 
+// src/mcp/tools/run-tool-incomplete.ts
+var FAILURE_PREFIX = "Engine reported failure:";
+function describePlanFailure(record) {
+  if (record["planStatus"] === "empty") {
+    return `${FAILURE_PREFIX} the planner returned no plan, so nothing was built`;
+  }
+  if (record["planStatus"] === "unapproved") {
+    const iterations = typeof record["voteIterations"] === "number" ? String(record["voteIterations"]) : "an unknown number of";
+    return `${FAILURE_PREFIX} the panel did not approve the plan after ${iterations} iterations`;
+  }
+  if (record["planStatus"] === "no_quorum") {
+    const reason = typeof record["planVoteReason"] === "string" ? record["planVoteReason"] : "no reason was recorded";
+    return `${FAILURE_PREFIX} the plan vote could not reach quorum: ${reason}`;
+  }
+  return void 0;
+}
+function describeIncompletePipeline(record) {
+  const planFailure = describePlanFailure(record);
+  if (planFailure !== void 0) return planFailure;
+  if (record["securityRan"] === true) {
+    return `${FAILURE_PREFIX} the security gate rejected the change`;
+  }
+  if (record["securityRan"] === false) {
+    if (typeof record["securityNote"] === "string") {
+      return `${FAILURE_PREFIX} the security scan did not run (${record["securityNote"]}); the change is blocked until it does`;
+    }
+    return `${FAILURE_PREFIX} the run stopped before the security gate, which never ran`;
+  }
+  return `${FAILURE_PREFIX} the dev pipeline did not complete`;
+}
+
 // src/orchestration/meta-orchestrator.ts
 import { randomUUID as randomUUID14 } from "node:crypto";
 
@@ -51395,6 +51658,9 @@ function buildStructuredOutput(result, simulated) {
     // here, so they never reached the MCP surface.
     ...result.securityRan !== void 0 ? { securityRan: result.securityRan } : {},
     ...result.planStatus !== void 0 ? { planStatus: result.planStatus } : {},
+    ...result.planVoteReason !== void 0 ? { planVoteReason: result.planVoteReason } : {},
+    ...result.planVoteApprovalPercentage !== void 0 ? { planVoteApprovalPercentage: result.planVoteApprovalPercentage } : {},
+    ...result.planVoteFeedback !== void 0 ? { planVoteFeedback: result.planVoteFeedback } : {},
     // #4993 added `dryRun` to DevPipelineResult for exactly the reason above —
     // it says `completed: false` was the request, not a fault — and then did
     // not list it here either. Same omission, same function, under the comment
@@ -51895,27 +52161,11 @@ function detectEngineFailure(result) {
     return { message: `Engine reported failure: ${detail}` };
   }
   if (record["completed"] === false) {
-    if (record["dryRun"] === true && record["planStatus"] !== "empty") return null;
+    if (record["dryRun"] === true && record["planStatus"] === void 0) return null;
     return { message: describeIncompletePipeline(record), detail: record };
   }
   return null;
 }
-function describeIncompletePipeline(record) {
-  const prefix = "Engine reported failure:";
-  if (record["planStatus"] === "empty") {
-    return `${prefix} the planner returned no plan, so nothing was built`;
-  }
-  if (record["securityRan"] === true) {
-    return `${prefix} the security gate rejected the change`;
-  }
-  if (record["securityRan"] === false) {
-    if (typeof record["securityNote"] === "string") {
-      return `${prefix} the security scan did not run (${record["securityNote"]}); the change is blocked until it does`;
-    }
-    return `${prefix} the run stopped before the security gate, which never ran`;
-  }
-  return `${prefix} the dev pipeline did not complete`;
-}
 async function executeRunBody(input, logger57, trustTier, gatewayAdapters) {
   try {
     const exec2 = await executeGoal(input, {
@@ -56074,6 +56324,7 @@ export {
   loadCheckpointState,
   cleanupCheckpoint2 as cleanupCheckpoint,
   checkpointToResult,
+  runIterativeConsensus,
   runDevPipeline,
   flushPipelineMemory,
   createAgentStages,
@@ -56125,4 +56376,4 @@ export {
   shutdownFeedbackSubscriber,
   createEventBusBridge
 };
-//# sourceMappingURL=chunk-5LAPFTNG.js.map
+//# sourceMappingURL=chunk-PIWFHJSU.js.map