nexus-agents 8.23.4 → 8.24.0

package/dist/{chunk-2G2ZXAD7.js → chunk-3KDQKVCJ.js}

@@ -112,4 +112,4 @@ export {
   SEVERITY_EMOJI,
   DECISION_EMOJI
 };
-//# sourceMappingURL=chunk-2G2ZXAD7.js.map
+//# sourceMappingURL=chunk-3KDQKVCJ.js.map

package/dist/chunk-3KDQKVCJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/dogfooding/pr-review-types.ts","../src/security/sarif-types.ts"],"sourcesContent":["/**\n * nexus-agents/dogfooding - PR Review Types\n *\n * Type definitions for automated pull request review using\n * multi-agent collaboration.\n *\n * @module dogfooding/pr-review-types\n * (Source: Issue #161, Alignment Roadmap Phase 3)\n */\n\nimport { z } from 'zod';\nimport type { FullCapableProvider, ScmFileChange } from '../scm/types.js';\nimport { FINDING_SEVERITY_LEVELS } from '../security/sarif-types.js';\n\n/**\n * Pull request file change information.\n */\nexport interface PRFileChange {\n  /** File path */\n  readonly filename: string;\n  /** Change status */\n  readonly status: ScmFileChange['status'];\n  /** Number of additions */\n  readonly additions: number;\n  /** Number of deletions */\n  readonly deletions: number;\n  /** File patch/diff content */\n  readonly patch?: string | undefined;\n  /** Previous filename if renamed */\n  readonly previousFilename?: string | undefined;\n}\n\n/**\n * Pull request metadata from GitHub API.\n */\nexport interface PRMetadata {\n  /** PR number */\n  readonly number: number;\n  /** PR title */\n  readonly title: string;\n  /** PR description/body */\n  readonly body: string;\n  /** Author username */\n  readonly author: string;\n  /** GitHub API author_association (e.g., 'OWNER', 'COLLABORATOR', 'NONE') */\n  readonly authorAssociation: string;\n  /** Base branch */\n  readonly base: string;\n  /** Head branch */\n  readonly head: string;\n  /** Repository owner */\n  readonly owner: string;\n  /** Repository name */\n  readonly repo: string;\n  /** PR URL */\n  readonly url: string;\n  /** Whether PR is draft */\n  readonly draft: boolean;\n  /** PR labels */\n  readonly labels: readonly string[];\n  /** Changed files */\n  readonly files: readonly PRFileChange[];\n  /** Total additions */\n  readonly additions: number;\n  /** Total deletions */\n  readonly deletions: number;\n  /** Commit SHA of head */\n  readonly headSha: string;\n}\n\n/**\n * Review severity levels.\n */\nexport type ReviewSeverity = (typeof FINDING_SEVERITY_LEVELS)[number];\n\n/**\n * Review category for organizing findings.\n */\nexport type ReviewCategory =\n  'security' | 'performance' | 'code_quality' | 'testing' | 'documentation' | 'architecture';\n\n/**\n * Individual review finding from an expert.\n */\nexport interface ReviewFinding {\n  /** Unique finding ID */\n  readonly id: string;\n  /** Category of finding */\n  readonly category: ReviewCategory;\n  /** Severity level */\n  readonly severity: ReviewSeverity;\n  /** Finding title */\n  readonly title: string;\n  /** Detailed description */\n  readonly description: string;\n  /** Affected file (if applicable) */\n  readonly file?: string | undefined;\n  /** Line number (if applicable) */\n  readonly line?: number | undefined;\n  /** Suggested fix */\n  readonly suggestion?: string | undefined;\n  /** Expert that found this issue */\n  readonly expertId: string;\n  /** Confidence score (0-1) */\n  readonly confidence: number;\n}\n\n/**\n * Review result from a single expert agent.\n */\nexport interface ExpertReviewResult {\n  /** Expert ID */\n  readonly expertId: string;\n  /** Expert role/type */\n  readonly expertType: string;\n  /** Overall approval */\n  readonly approved: boolean;\n  /** Review summary */\n  readonly summary: string;\n  /** Individual findings */\n  readonly findings: readonly ReviewFinding[];\n  /** Execution time in ms */\n  readonly durationMs: number;\n  /** Confidence in review (0-1) */\n  readonly confidence: number;\n  /**\n   * The expert never produced a verdict — its adapter failed or returned\n   * nothing (#5012).\n   *\n   * `approved` cannot express this. A failed expert used to be recorded as\n   * `approved: true` (\"don't block on failures\"), so a review in which every\n   * expert failed resolved to `approve` at 100% consensus and was posted to\n   * GitHub as a real APPROVE. Absence of a review is not approval — a consumer\n   * must be able to tell them apart, and `confidence: 0` was already present\n   * and already ignored.\n   */\n  readonly errored?: boolean;\n}\n\n/**\n * Aggregated review decision after multi-agent debate.\n */\nexport type ReviewDecision = 'approve' | 'request_changes' | 'comment';\n\n/**\n * Complete PR review result from multi-agent collaboration.\n */\n/**\n * Trust + reputation assessment of the PR author, surfaced for observability\n * (#3123, epic #3118 Phase 5). Mirrors `issue_triage`'s assessment.\n */\nexport interface PRTrustAssessment {\n  /** Classifier trust tier (1-4) from author association. */\n  readonly trustTier: string;\n  /** Author's GitHub role. */\n  readonly userRole: string;\n  /**\n   * Whether the author is on the maintainer allowlist — present only when an\n   * allowlist was consulted (#4992). Absent means \"no allowlist was consulted\",\n   * which is the state on every live path today; it was previously recorded\n   * as `false` without being measured.\n   */\n  readonly isAllowlisted?: boolean;\n  /**\n   * Whether a durable `AuditLogger` was configured for this process (#4992\n   * review). `configured` — the trust event was handed to it; delivery to the\n   * hash chain is subject to the logger's own severity filter (trust events\n   * are `info`), queue and fail-loud flush, and is not confirmed per call.\n   * `none` — no audit logger (audit disabled, or the CLI path).\n   */\n  readonly auditSink: 'configured' | 'none';\n  /** Reputation score (0-100) when reputation is enabled. */\n  readonly reputationScore?: number | undefined;\n  /** Suspicious signals detected (e.g. `new_account`, `injection_patterns_detected`). */\n  readonly suspiciousSignals: readonly string[];\n  /** Whether the author is flagged as suspicious. */\n  readonly isSuspicious: boolean;\n  /** Tier the policy gate ACTUALLY enforced (== trustTier under audit/off). */\n  readonly enforcedTrustTier?: string | undefined;\n  /** Tier reputation reconciliation computed — what enforce mode WOULD gate on. */\n  readonly reputationReconciledTier?: string | undefined;\n  /** Reputation-gating rollout mode applied: `off` | `audit` | `enforce`. */\n  readonly gatingMode?: string | undefined;\n}\n\n/**\n * Result of fetching PR data plus best-effort author signals (#3133).\n */\nexport interface PRFetchData {\n  readonly metadata: PRMetadata;\n  readonly provider: FullCapableProvider;\n  /** Author's real account age in days, when the lookup succeeded (#3133). */\n  readonly accountAgeDays?: number;\n}\n\nexport interface PRReviewResult {\n  /** Pull request number */\n  readonly prNumber: number;\n  /** Repository full name (owner/repo) */\n  readonly repository: string;\n  /** Overall decision */\n  readonly decision: ReviewDecision;\n  /** Executive summary */\n  readonly summary: string;\n  /** Individual expert reviews */\n  readonly expertReviews: readonly ExpertReviewResult[];\n  /** Aggregated findings by severity */\n  readonly findingsBySeverity: Readonly<Record<ReviewSeverity, number>>;\n  /** Aggregated findings by category */\n  readonly findingsByCategory: Readonly<Record<ReviewCategory, number>>;\n  /** Total execution time in ms */\n  readonly totalDurationMs: number;\n  /** Number of experts that participated */\n  readonly expertCount: number;\n  /** Total number of changed files reported by the SCM provider. */\n  readonly totalFiles: number;\n  /** Number of changed files for which the SCM provider returned a patch. */\n  readonly filesWithPatch: number;\n  /** Number of file patches supplied to at least one non-errored expert. */\n  readonly filesReviewed: number;\n  /** Whether the successful expert panel covered all, some, or no changed files. */\n  readonly reviewCoverage: 'full' | 'partial' | 'none';\n  /** Consensus score (0-1) */\n  readonly consensusScore: number;\n  /** Debate rounds completed */\n  readonly debateRounds: number;\n  /** Timestamp of review */\n  readonly timestamp: string;\n  /** Author trust + reputation assessment (#3123). */\n  readonly trustAssessment: PRTrustAssessment;\n  /**\n   * What actually happened when the review was posted to GitHub (#4354).\n   *\n   * The review previously reported success whether or not the post landed: a\n   * `createReview` rejection was logged and discarded, and a Rule-of-Two block\n   * returned early, both leaving the CLI to print \"Review posted to GitHub.\"\n   * over a review that does not exist. Callers must consult this rather than\n   * inferring a successful post from a successful review.\n   */\n  readonly postOutcome: ReviewPostOutcome;\n}\n\n/**\n * A completed review before the posting step has run (#4354).\n *\n * Everything the reviewer aggregates is known before the post is attempted; the\n * outcome is stamped on afterwards. Keeping the two apart in the types is what\n * stops `postOutcome` from being defaulted to a hopeful value.\n */\nexport type PRReviewDraft = Omit<PRReviewResult, 'postOutcome'>;\n\n/** Terminal state of the GitHub review-posting step (#4354). */\nexport type ReviewPostOutcome =\n  /** The review was created on GitHub. */\n  | { readonly status: 'posted' }\n  /** Posting was deliberately not attempted (dry-run, or a policy gate blocked it). */\n  | { readonly status: 'skipped'; readonly reason: string }\n  /** Posting was attempted and GitHub rejected it. */\n  | { readonly status: 'failed'; readonly error: string };\n\n/**\n * Configuration for PR review.\n */\nexport interface PRReviewConfig {\n  /** Experts to include in review */\n  readonly experts: readonly ReviewCategory[];\n  /** Maximum debate rounds */\n  readonly maxDebateRounds: number;\n  /** Consensus threshold (0-1) */\n  readonly consensusThreshold: number;\n  /** Minimum severity to report */\n  readonly minSeverity: ReviewSeverity;\n  /** Whether to post inline comments */\n  readonly enableInlineComments: boolean;\n  /** Whether to run in dry-run mode (no GitHub posting) */\n  readonly dryRun: boolean;\n  /** Whether to assess author reputation and gate on it (#3123). */\n  readonly enableReputation: boolean;\n  /** GitHub token for API access */\n  readonly githubToken?: string | undefined;\n  /** Model adapter configuration */\n  readonly modelConfig?: {\n    readonly temperature?: number;\n    readonly maxTokens?: number;\n  };\n}\n\n/**\n * Default PR review configuration.\n */\nexport const DEFAULT_PR_REVIEW_CONFIG: PRReviewConfig = {\n  experts: ['security', 'code_quality', 'testing'],\n  maxDebateRounds: 3,\n  consensusThreshold: 0.7,\n  minSeverity: 'low',\n  enableInlineComments: true,\n  dryRun: false,\n  enableReputation: true,\n  modelConfig: {\n    temperature: 0.3,\n    maxTokens: 8192,\n  },\n};\n\n/**\n * Zod schema for PR review configuration.\n */\nexport const PRReviewConfigSchema = z.object({\n  experts: z\n    .array(\n      z.enum([\n        'security',\n        'performance',\n        'code_quality',\n        'testing',\n        'documentation',\n        'architecture',\n      ])\n    )\n    .default(['security', 'code_quality', 'testing']),\n  maxDebateRounds: z.number().int().min(1).max(10).default(3),\n  consensusThreshold: z.number().min(0).max(1).default(0.7),\n  minSeverity: z.enum(FINDING_SEVERITY_LEVELS).default('low'),\n  enableInlineComments: z.boolean().default(true),\n  dryRun: z.boolean().default(false),\n  enableReputation: z.boolean().default(true),\n  githubToken: z.string().optional(),\n  modelConfig: z\n    .object({\n      temperature: z.number().min(0).max(2).default(0.3),\n      maxTokens: z.number().int().positive().default(8192),\n    })\n    .optional(),\n});\n\n/**\n * Severity order for comparison. INVERTED vs sarif-types' SEVERITY_ORDER by\n * design (higher = more severe here, for descending sort); only the KEY SET is\n * shared. Derived from the canonical {@link FINDING_SEVERITY_LEVELS} so the keys\n * can't drift (#3570): critical→5 … info→1.\n */\nexport const SEVERITY_ORDER: Record<ReviewSeverity, number> = Object.fromEntries(\n  FINDING_SEVERITY_LEVELS.map((level, index) => [level, FINDING_SEVERITY_LEVELS.length - index])\n) as Record<ReviewSeverity, number>;\n\n/**\n * Category display names.\n */\nexport const CATEGORY_DISPLAY_NAMES: Record<ReviewCategory, string> = {\n  security: 'Security',\n  performance: 'Performance',\n  code_quality: 'Code Quality',\n  testing: 'Testing',\n  documentation: 'Documentation',\n  architecture: 'Architecture',\n};\n\n/**\n * Severity emoji for GitHub comments.\n */\nexport const SEVERITY_EMOJI: Record<ReviewSeverity, string> = {\n  critical: ':rotating_light:',\n  high: ':warning:',\n  medium: ':yellow_circle:',\n  low: ':large_blue_circle:',\n  info: ':information_source:',\n};\n\n/**\n * Decision emoji for GitHub comments.\n */\nexport const DECISION_EMOJI: Record<ReviewDecision, string> = {\n  approve: ':white_check_mark:',\n  request_changes: ':x:',\n  comment: ':speech_balloon:',\n};\n","/**\n * SARIF Types and Security Finding Schema (#1682)\n *\n * Types for parsing SARIF (Static Analysis Results Interchange Format)\n * output from security scanners (Semgrep, CodeQL, Bandit, ESLint).\n * Normalizes findings into a unified schema for MCP tool consumption.\n *\n * @module security/sarif-types\n * (Source: Issue #1681, #1682 — Proactive Defensive Security)\n */\n\nimport { z } from 'zod';\n\n// ============================================================================\n// Unified Security Finding Schema\n// ============================================================================\n\n/**\n * Canonical 5-value finding-severity vocabulary (CVSS-aligned), most→least\n * severe. THE single source of truth — every 5-value finding-severity zod enum\n * (severity-consensus, finding-triage, agents/output-schemas, expert-types\n * VulnerabilitySeverity) and both SEVERITY_ORDER maps derive from this (#3570).\n * Tuple order is authoritative: SEVERITY_ORDER below maps it to ascending ranks.\n */\nexport const FINDING_SEVERITY_LEVELS = ['critical', 'high', 'medium', 'low', 'info'] as const;\n\n/** Severity levels aligned with CVSS and common scanner output. */\nexport const FindingSeveritySchema = z.enum(FINDING_SEVERITY_LEVELS);\nexport type FindingSeverity = z.infer<typeof FindingSeveritySchema>;\n\n/** A normalized security finding from any SARIF-compatible scanner. */\nexport const SecurityFindingSchema = z.object({\n  /** Unique finding ID (scanner-specific rule ID). */\n  id: z.string().min(1),\n  /** Scanner that produced this finding. */\n  scanner: z.string().min(1),\n  /** Rule identifier (e.g., 'javascript.lang.security.detect-eval'). */\n  rule: z.string().min(1),\n  /** Normalized severity. */\n  severity: FindingSeveritySchema,\n  /** Human-readable description of the finding. */\n  message: z.string().min(1).max(2000),\n  /** File path where the finding was detected. */\n  file: z.string().min(1),\n  /** Start line number (1-based). */\n  startLine: z.number().int().min(1),\n  /** End line number (1-based, optional). */\n  endLine: z.number().int().min(1).optional(),\n  /** CWE identifiers (e.g., ['CWE-79', 'CWE-89']). */\n  cweIds: z.array(z.string()).default([]),\n  /** Scanner confidence (0-1). */\n  confidence: z.number().min(0).max(1).default(0.5),\n  /** Code snippet around the finding (optional). */\n  snippet: z.string().max(500).optional(),\n  /** Help URL for remediation guidance. */\n  helpUrl: z.string().optional(),\n});\n\nexport type SecurityFinding = z.infer<typeof SecurityFindingSchema>;\n\n/** Result of parsing a SARIF file. */\nexport interface SarifParseResult {\n  /** Scanner name extracted from SARIF. */\n  readonly scanner: string;\n  /** Total findings parsed. */\n  readonly totalFindings: number;\n  /** Findings sorted by severity (critical first). */\n  readonly findings: readonly SecurityFinding[];\n  /** Parsing errors (non-fatal). */\n  readonly errors: readonly string[];\n}\n\n// ============================================================================\n// SARIF Input Types (subset of the SARIF 2.1.0 spec we need)\n// ============================================================================\n\n/** SARIF result level → our severity mapping. */\nexport const SARIF_LEVEL_MAP: Readonly<Record<string, FindingSeverity>> = {\n  error: 'high',\n  warning: 'medium',\n  note: 'low',\n  none: 'info',\n};\n\n/**\n * Severity order for sorting (lower = more severe). Derived from the canonical\n * tuple so it can never drift from {@link FINDING_SEVERITY_LEVELS} (#3570).\n */\nexport const SEVERITY_ORDER: Readonly<Record<FindingSeverity, number>> = Object.fromEntries(\n  FINDING_SEVERITY_LEVELS.map((level, index) => [level, index])\n) as Record<FindingSeverity, number>;\n"],"mappings":";AAUA,SAAS,KAAAA,UAAS;;;ACClB,SAAS,SAAS;AAaX,IAAM,0BAA0B,CAAC,YAAY,QAAQ,UAAU,OAAO,MAAM;AAG5E,IAAM,wBAAwB,EAAE,KAAK,uBAAuB;AAI5D,IAAM,wBAAwB,EAAE,OAAO;AAAA;AAAA,EAE5C,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEpB,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEzB,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEtB,UAAU;AAAA;AAAA,EAEV,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI;AAAA;AAAA,EAEnC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEtB,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAAA;AAAA,EAEjC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA,EAE1C,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA;AAAA,EAEtC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,QAAQ,GAAG;AAAA;AAAA,EAEhD,SAAS,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA,EAEtC,SAAS,EAAE,OAAO,EAAE,SAAS;AAC/B,CAAC;AAqBM,IAAM,kBAA6D;AAAA,EACxE,OAAO;AAAA,EACP,SAAS;AAAA,EACT,MAAM;AAAA,EACN,MAAM;AACR;AAMO,IAAM,iBAA4D,OAAO;AAAA,EAC9E,wBAAwB,IAAI,CAAC,OAAO,UAAU,CAAC,OAAO,KAAK,CAAC;AAC9D;;;ADwMO,IAAM,2BAA2C;AAAA,EACtD,SAAS,CAAC,YAAY,gBAAgB,SAAS;AAAA,EAC/C,iBAAiB;AAAA,EACjB,oBAAoB;AAAA,EACpB,aAAa;AAAA,EACb,sBAAsB;AAAA,EACtB,QAAQ;AAAA,EACR,kBAAkB;AAAA,EAClB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,WAAW;AAAA,EACb;AACF;AAKO,IAAM,uBAAuBC,GAAE,OAAO;AAAA,EAC3C,SAASA,GACN;AAAA,IACCA,GAAE,KAAK;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,EACC,QAAQ,CAAC,YAAY,gBAAgB,SAAS,CAAC;AAAA,EAClD,iBAAiBA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC;AAAA,EAC1D,oBAAoBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,QAAQ,GAAG;AAAA,EACxD,aAAaA,GAAE,KAAK,uBAAuB,EAAE,QAAQ,KAAK;AAAA,EAC1D,sBAAsBA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA,EAC9C,QAAQA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACjC,kBAAkBA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA,EAC1C,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,aAAaA,GACV,OAAO;AAAA,IACN,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,QAAQ,GAAG;AAAA,IACjD,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACrD,CAAC,EACA,SAAS;AACd,CAAC;AAQM,IAAMC,kBAAiD,OAAO;AAAA,EACnE,wBAAwB,IAAI,CAAC,OAAO,UAAU,CAAC,OAAO,wBAAwB,SAAS,KAAK,CAAC;AAC/F;AAKO,IAAM,yBAAyD;AAAA,EACpE,UAAU;AAAA,EACV,aAAa;AAAA,EACb,cAAc;AAAA,EACd,SAAS;AAAA,EACT,eAAe;AAAA,EACf,cAAc;AAChB;AAKO,IAAM,iBAAiD;AAAA,EAC5D,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,KAAK;AAAA,EACL,MAAM;AACR;AAKO,IAAM,iBAAiD;AAAA,EAC5D,SAAS;AAAA,EACT,iBAAiB;AAAA,EACjB,SAAS;AACX;","names":["z","z","SEVERITY_ORDER"]}

package/dist/{chunk-TJFF2CHD.js → chunk-6QTD3PCO.js}

@@ -17,11 +17,11 @@ import {
   FINDING_SEVERITY_LEVELS,
   SARIF_LEVEL_MAP,
   SEVERITY_ORDER
-} from "./chunk-2G2ZXAD7.js";
+} from "./chunk-3KDQKVCJ.js";
 import {
   DEFAULT_TASK_TTL_MS,
   clampTaskTtl
-} from "./chunk-WCCU6D5G.js";
+} from "./chunk-SVYDHGAN.js";
 import {
   executeExpert
 } from "./chunk-CN3VAMQD.js";
@@ -55,7 +55,7 @@ import {
   toJobSummary,
   updateStage,
   writeJobCancelled
-} from "./chunk-DEVL62JD.js";
+} from "./chunk-ZDHM2JUU.js";
 import {
   allOf
 } from "./chunk-OQB3XC5O.js";
@@ -67,14 +67,14 @@ import {
   IssueTriage,
   createDurableAuditSink,
   createDurableAuditTrail
-} from "./chunk-V52KBX67.js";
+} from "./chunk-UHPPNVK6.js";
 import {
   resolveEnvMode,
   sanitizeInput
 } from "./chunk-OYTRYITB.js";
 import {
   withPrerequisite
-} from "./chunk-MQW3SXKC.js";
+} from "./chunk-MKE44UET.js";
 import {
   NOOP_NOTIFIER,
   RateLimiter,
@@ -99,7 +99,7 @@ import {
   withAuditTrail,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-NUYJ4VW5.js";
+} from "./chunk-JZAXNFMO.js";
 import {
   createAuditTrail,
   createGraphAuditBridge,
@@ -476,9 +476,16 @@ var SecurityConfigSchema = z3.object({
   timeout: TimeoutConfigSchema.optional(),
   /** Tool allowlist — when set, only listed tools are registered (Issue #740) */
   toolAllowlist: z3.array(z3.string()).optional(),
-  /** Audit logging configuration (Issue #740 Phase 2) */
+  /**
+   * Audit logging configuration (Issue #740 Phase 2).
+   *
+   * The block is optional and the inner defaults only apply when it is present:
+   * a config with no `audit:` block is audit-OFF (`initializeAuditLogger`
+   * returns null and startup warns). `config init` writes the block explicitly
+   * so a generated config is on by default (#5632).
+   */
   audit: z3.object({
-    /** Enable audit logging (default: true) */
+    /** Enable audit logging (default when the block is present: true) */
     enabled: z3.boolean().default(true),
     /** Log directory (default: ~/.nexus-agents/audit) */
     logDir: z3.string().optional(),
@@ -45262,7 +45269,7 @@ async function tryIssueTriage(task) {
   try {
     const issueMatch = task.match(/github\.com\/([^/]+\/[^/]+)\/issues\/(\d+)/);
     if (issueMatch === null) return null;
-    const { createIssueTriage } = await import("./issue-triage-FCFX56WQ.js");
+    const { createIssueTriage } = await import("./issue-triage-CAHM52S5.js");
     const triage = createIssueTriage();
     const owner = issueMatch[1] ?? "";
     const num = issueMatch[2] ?? "";
@@ -45664,7 +45671,7 @@ function buildVotingInput(plan, config) {
 }
 async function executeSingleVote(plan, config, log) {
   try {
-    const { executeVoting } = await import("./consensus-vote-SSTSB3ET.js");
+    const { executeVoting } = await import("./consensus-vote-FSXAI445.js");
     const input = buildVotingInput(plan, config);
     const result = await executeVoting(input, log);
     return parseVotingResult(result);
@@ -47436,7 +47443,7 @@ ${contextBlock}`;
       const strategy = config.votingStrategy ?? "higher_order";
       await postProgress(config, "Vote", `Running consensus with ${strategy} strategy...`);
       try {
-        const { executeVoting } = await import("./consensus-vote-SSTSB3ET.js");
+        const { executeVoting } = await import("./consensus-vote-FSXAI445.js");
         const votingResult = await executeVoting(
           {
             proposal: buildVoteProposal(plan, research),
@@ -51140,7 +51147,7 @@ var GitHubTaskTracker = class {
   cachedProvider = null;
   async getProvider() {
     if (this.cachedProvider !== null) return this.cachedProvider;
-    const { createScmProvider } = await import("./factory-NR2H2QR4.js");
+    const { createScmProvider } = await import("./factory-LY7TCXMK.js");
     const result = await createScmProvider({ repo: this.config.repo ?? "" });
     if (!result.ok) throw new Error(`SCM provider error: ${result.error.message}`);
     this.cachedProvider = result.value;
@@ -56121,4 +56128,4 @@ export {
   shutdownFeedbackSubscriber,
   createEventBusBridge
 };
-//# sourceMappingURL=chunk-TJFF2CHD.js.map
+//# sourceMappingURL=chunk-6QTD3PCO.js.map