nexus-agents 8.3.0 → 8.3.2

package/dist/{chunk-R5F7Y5UY.js → chunk-3OU7XMEP.js}

@@ -7,7 +7,7 @@ import {
   toolStructuredError,
   toolSuccessStructured,
   wrapToolWithTimeout
-} from "./chunk-L2BM3TGM.js";
+} from "./chunk-VULYVX6X.js";
 import {
   JsonlStore,
   SECURITY_KEYWORDS,
@@ -2159,4 +2159,4 @@ export {
   runImprovementReview,
   registerImprovementReviewTool
 };
-//# sourceMappingURL=chunk-R5F7Y5UY.js.map
+//# sourceMappingURL=chunk-3OU7XMEP.js.map

package/dist/{chunk-K5GYF2LP.js → chunk-3RMLDTUF.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-OQB3XC5O.js";
 import {
   VERSION
-} from "./chunk-7IDMD4IN.js";
+} from "./chunk-LZBARHPR.js";
 import {
   capitalize
 } from "./chunk-6T3EPABN.js";
@@ -1201,7 +1201,7 @@ async function runDoctorFix(result) {
   writeLine2("\u2500".repeat(40));
   let fixCount = 0;
   if (!result.dataDirectory.rootExists || result.dataDirectory.subdirectories.some((d) => !d.exists || !d.writable)) {
-    const { initDataDirectories: initDataDirectories2, describeDataDirFix: describeDataDirFix2 } = await import("./setup-data-dir-GQ4QQKHZ.js");
+    const { initDataDirectories: initDataDirectories2, describeDataDirFix: describeDataDirFix2 } = await import("./setup-data-dir-HJCC6U4N.js");
     const outcome = describeDataDirFix2(initDataDirectories2());
     writeLine2(outcome.line);
     if (outcome.counted) fixCount++;
@@ -1303,4 +1303,4 @@ export {
   startStdioServer,
   closeServer
 };
-//# sourceMappingURL=chunk-K5GYF2LP.js.map
+//# sourceMappingURL=chunk-3RMLDTUF.js.map

package/dist/{chunk-LY2FJKYX.js → chunk-44I4XVRU.js}

@@ -23,7 +23,7 @@ import {
   toolSuccessStructured,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-L2BM3TGM.js";
+} from "./chunk-VULYVX6X.js";
 import {
   assessPanelIndependence,
   countDistinctModels,
@@ -6892,4 +6892,4 @@ export {
   CONSENSUS_VOTE_TOOL_SCHEMA,
   registerConsensusVoteTool
 };
-//# sourceMappingURL=chunk-LY2FJKYX.js.map
+//# sourceMappingURL=chunk-44I4XVRU.js.map

package/dist/{chunk-PDROJ5FZ.js → chunk-JGBXLELL.js}

@@ -11,7 +11,7 @@ import {
   gateWithReputation,
   resolveReputationGatingMode,
   sanitizeInput
-} from "./chunk-ULQFMQE7.js";
+} from "./chunk-PGUZPMT4.js";
 import {
   emitPolicyEvent
 } from "./chunk-U5YJKJK2.js";
@@ -1247,4 +1247,4 @@ export {
   IssueTriage,
   createIssueTriage
 };
-//# sourceMappingURL=chunk-PDROJ5FZ.js.map
+//# sourceMappingURL=chunk-JGBXLELL.js.map

package/dist/chunk-LZBARHPR.js

@@ -0,0 +1,7 @@
+// src/version.ts
+var VERSION = true ? "8.3.2" : "dev";
+
+export {
+  VERSION
+};
+//# sourceMappingURL=chunk-LZBARHPR.js.map

package/dist/{chunk-S7UZUGS7.js → chunk-ONSYYUB4.js}

@@ -21,7 +21,7 @@ import {
 import {
   DEFAULT_TASK_TTL_MS,
   clampTaskTtl
-} from "./chunk-K5GYF2LP.js";
+} from "./chunk-3RMLDTUF.js";
 import {
   executeExpert
 } from "./chunk-CCRTVIXF.js";
@@ -47,7 +47,7 @@ import {
   simulationDeniedResult,
   toJobSummary,
   writeJobCancelled
-} from "./chunk-LY2FJKYX.js";
+} from "./chunk-44I4XVRU.js";
 import {
   allOf
 } from "./chunk-OQB3XC5O.js";
@@ -57,14 +57,14 @@ import {
 } from "./chunk-2XXKUAQS.js";
 import {
   IssueTriage
-} from "./chunk-PDROJ5FZ.js";
+} from "./chunk-JGBXLELL.js";
 import {
   resolveEnvMode,
   sanitizeInput
-} from "./chunk-ULQFMQE7.js";
+} from "./chunk-PGUZPMT4.js";
 import {
   withPrerequisite
-} from "./chunk-R5F7Y5UY.js";
+} from "./chunk-3OU7XMEP.js";
 import {
   NOOP_NOTIFIER,
   RateLimiter,
@@ -89,7 +89,7 @@ import {
   withAuditTrail,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-L2BM3TGM.js";
+} from "./chunk-VULYVX6X.js";
 import {
   createAuditTrail,
   createGraphAuditBridge,
@@ -45577,7 +45577,7 @@ async function tryIssueTriage(task) {
   try {
     const issueMatch = task.match(/github\.com\/([^/]+\/[^/]+)\/issues\/(\d+)/);
     if (issueMatch === null) return null;
-    const { createIssueTriage } = await import("./issue-triage-MGYUQ7WN.js");
+    const { createIssueTriage } = await import("./issue-triage-6W5G6LC6.js");
     const triage = createIssueTriage();
     const owner = issueMatch[1] ?? "";
     const num = issueMatch[2] ?? "";
@@ -47529,7 +47529,7 @@ ${contextBlock}`;
       const strategy = config.votingStrategy ?? "higher_order";
       await postProgress(config, "Vote", `Running consensus with ${strategy} strategy...`);
       try {
-        const { executeVoting } = await import("./consensus-vote-ZDBL2EA4.js");
+        const { executeVoting } = await import("./consensus-vote-H67IAMI2.js");
         const votingResult = await executeVoting(
           {
             proposal: buildVoteProposal(plan, research),
@@ -48068,10 +48068,6 @@ function createAuditStageRegistry() {
   ]);
 }
 
-// src/mcp/tools/pr-review-tool.ts
-import { z as z102 } from "zod";
-import { randomUUID as randomUUID13 } from "node:crypto";
-
 // src/mcp/tools/pr-review-findings.ts
 import { parse as parseYaml3 } from "yaml";
 function isFindingVerified(gate) {
@@ -48152,6 +48148,73 @@ var FINDINGS_FORMAT_INSTRUCTIONS = `If you have one or more findings (claims tha
 
 A finding only triggers request_changes if ALL FOUR gate checks are 'passed' AND named_assertion is substantive (>10 chars, naming a concrete failure). Findings missing any of those surface as informational only \u2014 they do not block the merge. This is the #2225 verification gate; the 2026-04-25 audit found a 100% false-positive rate when this gate was not enforced.`;
 
+// src/mcp/tools/pr-review-proposal.ts
+function buildPrReviewProposal(input, removedBeforeThisCall = 0) {
+  const sanitizeResult = sanitizeToolInput({
+    prTitle: input.prTitle,
+    prDescription: input.prDescription,
+    prDiff: input.prDiff,
+    repoContext: input.repoContext
+  });
+  const safe = sanitizeResult.sanitized;
+  const parts = [];
+  parts.push(`# Pull Request Review
+`);
+  const totalRemoved = sanitizeResult.commentsRemoved + removedBeforeThisCall;
+  if (totalRemoved > 0) {
+    parts.push(
+      `> **Note:** ${String(totalRemoved)} HTML comment(s) were removed from the untrusted fields below before you saw them (#5258). Comments are invisible in rendered markdown, so they are stripped rather than trusted. This is routine \u2014 GitHub's default PR template contains one \u2014 and is not by itself evidence of an attack.
+`
+    );
+  }
+  parts.push(`**Title:** ${safe.prTitle}
+`);
+  if (input.baseRef !== void 0 && input.headRef !== void 0) {
+    parts.push(`**Branches:** ${input.headRef} \u2192 ${input.baseRef}
+`);
+  }
+  if (safe.repoContext !== void 0 && safe.repoContext !== "") {
+    parts.push(`
+**Repo context:**
+${safe.repoContext}
+`);
+  }
+  if (safe.prDescription !== void 0 && safe.prDescription !== "") {
+    parts.push(`
+**Description:**
+${safe.prDescription}
+`);
+  }
+  parts.push(`
+## Diff
+
+\`\`\`diff
+${safe.prDiff}
+\`\`\`
+`);
+  parts.push(`
+## Your task
+`);
+  parts.push(`Review this PR from your role's perspective. Decide: should it be merged as-is?
+`);
+  parts.push(`- **APPROVE** if the diff is correct, complete, and aligned with your role.
+`);
+  parts.push(
+    `- **REJECT** (= "request changes") if there is at least one concrete defect, missing requirement, or violation that justifies blocking the merge.
+`
+  );
+  parts.push(`- **ABSTAIN** if the diff is outside your role's concerns.
+`);
+  parts.push(`
+${FINDINGS_FORMAT_INSTRUCTIONS}
+`);
+  return parts.join("");
+}
+
+// src/mcp/tools/pr-review-tool.ts
+import { z as z102 } from "zod";
+import { randomUUID as randomUUID13 } from "node:crypto";
+
 // src/audit/reviewed-diff-hash.ts
 import * as crypto2 from "node:crypto";
 var MAX_REVIEWED_DIFF_BYTES = 5e4;
@@ -48833,66 +48896,6 @@ function absoluteQuorumApprove(reviews, valid) {
   }
   return { decision: "approve", verified: true };
 }
-function buildPrReviewProposal(input) {
-  const sanitizeResult = sanitizeToolInput({
-    prTitle: input.prTitle,
-    prDescription: input.prDescription,
-    prDiff: input.prDiff,
-    repoContext: input.repoContext
-  });
-  const safe = sanitizeResult.sanitized;
-  const parts = [];
-  parts.push(`# Pull Request Review
-`);
-  if (sanitizeResult.commentsRemoved > 0) {
-    parts.push(
-      `> **Note:** ${String(sanitizeResult.commentsRemoved)} HTML comment(s) were removed from the untrusted fields below before you saw them (#5258). Comments are invisible in rendered markdown, so they are stripped rather than trusted. This is routine \u2014 GitHub's default PR template contains one \u2014 and is not by itself evidence of an attack.
-`
-    );
-  }
-  parts.push(`**Title:** ${safe.prTitle}
-`);
-  if (input.baseRef !== void 0 && input.headRef !== void 0) {
-    parts.push(`**Branches:** ${input.headRef} \u2192 ${input.baseRef}
-`);
-  }
-  if (safe.repoContext !== void 0 && safe.repoContext !== "") {
-    parts.push(`
-**Repo context:**
-${safe.repoContext}
-`);
-  }
-  if (safe.prDescription !== void 0 && safe.prDescription !== "") {
-    parts.push(`
-**Description:**
-${safe.prDescription}
-`);
-  }
-  parts.push(`
-## Diff
-
-\`\`\`diff
-${safe.prDiff}
-\`\`\`
-`);
-  parts.push(`
-## Your task
-`);
-  parts.push(`Review this PR from your role's perspective. Decide: should it be merged as-is?
-`);
-  parts.push(`- **APPROVE** if the diff is correct, complete, and aligned with your role.
-`);
-  parts.push(
-    `- **REJECT** (= "request changes") if there is at least one concrete defect, missing requirement, or violation that justifies blocking the merge.
-`
-  );
-  parts.push(`- **ABSTAIN** if the diff is outside your role's concerns.
-`);
-  parts.push(`
-${FINDINGS_FORMAT_INSTRUCTIONS}
-`);
-  return parts.join("");
-}
 function resolveAggregate(reviews, input, errorCount, coverage, logger58) {
   const preGate = aggregatePrDecisions(reviews, input.errorPolicy);
   if (preGate.reason !== void 0) {
@@ -48910,7 +48913,7 @@ function resolveAggregate(reviews, input, errorCount, coverage, logger58) {
   }
   return aggregate;
 }
-function preparePanelProposal(input, logger58) {
+function preparePanelProposal(input, logger58, removedBeforeThisCall = 0) {
   const { coverage, packedDiff, note } = packDiffForReview(input.prDiff, MAX_DIFF_LENGTH);
   const body = coverage === void 0 ? input : { ...input, prDiff: packedDiff };
   if (coverage?.partial === true) {
@@ -48918,24 +48921,11 @@ function preparePanelProposal(input, logger58) {
       `pr_review diff over budget \u2014 reviewed ${String(coverage.reviewedFiles)} of ${String(coverage.totalFiles)} files, dropped ${String(coverage.droppedFiles.length)}`
     );
   }
-  return { proposal: note + buildPrReviewProposal(body), coverage };
+  return { proposal: note + buildPrReviewProposal(body, removedBeforeThisCall), coverage };
 }
-async function executePrReviewBody(input, logger58, gatewayAdapters) {
-  const start = Date.now();
-  const { proposal, coverage } = preparePanelProposal(input, logger58);
-  const voteResults = await collectRealVotes({
-    roles: PR_REVIEW_ROLES,
-    proposal,
-    simulate: input.simulate,
-    logger: logger58,
-    ...gatewayAdapters !== void 0 && { gatewayAdapters }
-  });
-  const reviews = voteResults.map(toPrReviewVote);
-  const counts = summarizeReviews(reviews);
-  const aggregate = resolveAggregate(reviews, input, counts.errorCount, coverage, logger58);
-  let costSummary;
+function rollUpDecisionCost(voteResults, logger58) {
   try {
-    costSummary = recordDecisionCost({
+    return recordDecisionCost({
       decisionId: `pr-${randomUUID13().slice(0, 8)}`,
       gate: "pr_review",
       votes: voteResults
@@ -48944,7 +48934,24 @@ async function executePrReviewBody(input, logger58, gatewayAdapters) {
     logger58.warn("Per-decision cost rollup failed (non-fatal)", {
       error: getErrorMessage(costError)
     });
+    return void 0;
   }
+}
+async function executePrReviewBody(input, logger58, opts = {}) {
+  const start = Date.now();
+  const { gatewayAdapters: adapters, removedBeforeThisCall: removed = 0 } = opts;
+  const { proposal, coverage } = preparePanelProposal(input, logger58, removed);
+  const voteResults = await collectRealVotes({
+    roles: PR_REVIEW_ROLES,
+    proposal,
+    simulate: input.simulate,
+    logger: logger58,
+    ...adapters !== void 0 && { gatewayAdapters: adapters }
+  });
+  const reviews = voteResults.map(toPrReviewVote);
+  const counts = summarizeReviews(reviews);
+  const aggregate = resolveAggregate(reviews, input, counts.errorCount, coverage, logger58);
+  const costSummary = rollUpDecisionCost(voteResults, logger58);
   const recordOutcome3 = persistReviewRecord({
     // #4459: `input.prDiff` is opaque MCP input — it passed the unified-diff
     // shape gate (#4451), but nothing here establishes it is the PR's real diff.
@@ -48969,6 +48976,7 @@ async function executePrReviewBody(input, logger58, gatewayAdapters) {
   return toolSuccess(JSON.stringify(response, null, 2));
 }
 function makePrReviewHandler(gatewayAdapters) {
+  const adapterOpt = gatewayAdapters !== void 0 ? { gatewayAdapters } : {};
   return async function prReviewHandler(args, ctx) {
     const parsed = PrReviewInputSchema.safeParse(args);
     if (!parsed.success) {
@@ -48988,11 +48996,17 @@ function makePrReviewHandler(gatewayAdapters) {
           toolName: "pr_review",
           input,
           freshJobId: () => `pr-${randomUUID13()}`,
-          run: () => executePrReviewBody(input, ctx.logger, gatewayAdapters),
+          run: () => executePrReviewBody(input, ctx.logger, {
+            ...adapterOpt,
+            removedBeforeThisCall: ctx.sanitization.commentsRemoved
+          }),
           logger: ctx.logger
         });
       }
-      return await executePrReviewBody(input, ctx.logger, gatewayAdapters);
+      return await executePrReviewBody(input, ctx.logger, {
+        ...adapterOpt,
+        removedBeforeThisCall: ctx.sanitization.commentsRemoved
+      });
     } catch (error) {
       return toolStructuredError({
         errorCategory: "internal",
@@ -56129,12 +56143,12 @@ export {
   registerPipelineTool,
   registerRunTool,
   registerListAvailableModelsTool,
+  buildPrReviewProposal,
   PR_REVIEW_ROLES,
   MAX_DIFF_LENGTH,
   PrReviewInputSchema,
   mapVoteDecisionToPrDecision,
   aggregatePrDecisions,
-  buildPrReviewProposal,
   registerPrReviewTool,
   registerSupplyChainTradeoffPanelTool,
   createAnnotationsProxy,
@@ -56172,4 +56186,4 @@ export {
   shutdownFeedbackSubscriber,
   createEventBusBridge
 };
-//# sourceMappingURL=chunk-S7UZUGS7.js.map
+//# sourceMappingURL=chunk-ONSYYUB4.js.map