nexus-agents 8.3.1 → 8.3.2

package/dist/cli.js

@@ -153,7 +153,7 @@ import {
   validateNexusEnv,
   validateWorkflow,
   wrapInMarkdownFence
-} from "./chunk-OFUJNXH3.js";
+} from "./chunk-ONSYYUB4.js";
 import "./chunk-ZYPEHPRM.js";
 import "./chunk-DGWT7DXX.js";
 import "./chunk-64GMIUM5.js";
@@ -172,7 +172,7 @@ import {
   doctorCommand,
   initDataDirectories,
   runDoctor
-} from "./chunk-LW6FPSPN.js";
+} from "./chunk-3RMLDTUF.js";
 import {
   buildOpenAICompatAdapters,
   readOpenAICompatEnv
@@ -191,7 +191,7 @@ import {
   recordAuthenticVote,
   registerConsensusVoteTool,
   toRecordDecision
-} from "./chunk-6SPKOLVU.js";
+} from "./chunk-44I4XVRU.js";
 import {
   loadUsageEvents,
   rollupByModel
@@ -227,15 +227,15 @@ import {
   registerImprovementReviewTool,
   runImprovementReview,
   scanForSecrets
-} from "./chunk-AQF22T74.js";
+} from "./chunk-3OU7XMEP.js";
 import {
   createDefaultPolicyFirewall,
   setGlobalPolicyFirewall,
   stagePolicyFirewallForRollout
-} from "./chunk-TSZWXRF7.js";
+} from "./chunk-VULYVX6X.js";
 import {
   VERSION
-} from "./chunk-2OS7HTUM.js";
+} from "./chunk-LZBARHPR.js";
 import "./chunk-U5YJKJK2.js";
 import {
   createUnifiedRegistry,
@@ -19586,7 +19586,7 @@ function startImprovementReviewScheduler(options) {
   let running = false;
   const runOnce = async () => {
     try {
-      const { runImprovementReview: runImprovementReview2, ImprovementReviewInputSchema: ImprovementReviewInputSchema2 } = await import("./improvement-review-P7JBYDL6.js");
+      const { runImprovementReview: runImprovementReview2, ImprovementReviewInputSchema: ImprovementReviewInputSchema2 } = await import("./improvement-review-UECHDBER.js");
       const input = ImprovementReviewInputSchema2.parse({ fileIssues });
       const result = await runImprovementReview2(input, { logger: logger22 });
       logger22.info("Scheduled improvement_review complete", {

package/dist/{consensus-vote-44WT45UN.js → consensus-vote-H67IAMI2.js}

@@ -11,11 +11,11 @@ import {
   resetCorrelationTracker,
   runConsensusForGoal,
   unwrapVoteOrThrow
-} from "./chunk-6SPKOLVU.js";
+} from "./chunk-44I4XVRU.js";
 import "./chunk-6LDUEA4I.js";
 import "./chunk-OQB3XC5O.js";
-import "./chunk-TSZWXRF7.js";
-import "./chunk-2OS7HTUM.js";
+import "./chunk-VULYVX6X.js";
+import "./chunk-LZBARHPR.js";
 import "./chunk-U5YJKJK2.js";
 import "./chunk-F4AT3BCP.js";
 import "./chunk-4U62WRPL.js";
@@ -50,4 +50,4 @@ export {
   runConsensusForGoal,
   unwrapVoteOrThrow
 };
-//# sourceMappingURL=consensus-vote-44WT45UN.js.map
+//# sourceMappingURL=consensus-vote-H67IAMI2.js.map

package/dist/{improvement-review-P7JBYDL6.js → improvement-review-UECHDBER.js}

@@ -11,9 +11,9 @@ import {
   loadSelfEvalSignals,
   registerImprovementReviewTool,
   runImprovementReview
-} from "./chunk-AQF22T74.js";
-import "./chunk-TSZWXRF7.js";
-import "./chunk-2OS7HTUM.js";
+} from "./chunk-3OU7XMEP.js";
+import "./chunk-VULYVX6X.js";
+import "./chunk-LZBARHPR.js";
 import "./chunk-U5YJKJK2.js";
 import "./chunk-3MBGQAO2.js";
 import "./chunk-ITCKXMOH.js";
@@ -33,4 +33,4 @@ export {
   registerImprovementReviewTool,
   runImprovementReview
 };
-//# sourceMappingURL=improvement-review-P7JBYDL6.js.map
+//# sourceMappingURL=improvement-review-UECHDBER.js.map

package/dist/index.d.ts

@@ -27268,6 +27268,46 @@ interface PrReviewCoverage {
     readonly strategy: 'budget';
 }
 
+/**
+ * Proposal construction for `pr_review`.
+ *
+ * Extracted from `pr-review-tool.ts` (#5385), which sat at 398 of its 400-line
+ * budget — threading the sanitization disclosure through pushed it over, and
+ * this is the cohesive piece to move, because the builder IS the sanitization
+ * concern. A pure move apart from the `removedBeforeThisCall` parameter that
+ * issue adds.
+ *
+ * `pr-review-tool.ts` re-exports the symbol, so both barrels
+ * (`mcp/index.ts`, `mcp/tools/index.ts`), the published `exports/mcp.ts`, and
+ * `scripts/pr-review-local.ts` / `scripts/pr-review-eval-run.ts` keep importing
+ * it unchanged. The `PrReviewInput` import is type-only and therefore erased,
+ * so the re-export creates no runtime cycle.
+ *
+ * @module mcp/tools/pr-review-proposal
+ */
+
+/** Builds the proposal text passed to voters. The voters are designed for
+ * yes/no proposals — by framing the diff as "should this PR be merged?" we
+ * get usable output without needing new system prompts (Child 3 will add
+ * those).
+ *
+ * **Sanitization lives HERE, not at the tool boundary (#5258 item B).** The
+ * `securityTier: 'external'` declared on the registered tool only protects the
+ * MCP path, because the middleware is constructed inside `registerPrReviewTool`.
+ * Three other callers reach the voters without it — `.github/workflows/
+ * pr-review.yml`, `scripts/pr-review-local.ts` (the documented default path)
+ * and `scripts/pr-review-eval-run.ts` — each importing this builder directly
+ * from `dist/index.js`. On those paths a hostile PR body reached five voters
+ * unfenced, next to the words "should it be merged as-is?".
+ *
+ * This function is the one chokepoint all four callers pass through, so the
+ * protection is attached to the data rather than to one entry point. The MCP
+ * tier check still runs earlier and still refuses; this is the floor beneath
+ * it, and it strips rather than refuses so the script paths degrade instead of
+ * failing shut. Double-sanitizing on the MCP path is idempotent and harmless.
+ */
+declare function buildPrReviewProposal(input: Pick<PrReviewInput, 'prTitle' | 'prDescription' | 'prDiff' | 'repoContext' | 'baseRef' | 'headRef'>, removedBeforeThisCall?: number): string;
+
 /**
  * nexus-agents/mcp - PR Review Tool (#2233 Child 1)
  *
@@ -27418,27 +27458,7 @@ declare function mapVoteDecisionToPrDecision(voteDecision: 'approve' | 'reject'
  * the baseline behavior.
  */
 declare function aggregatePrDecisions(reviews: readonly PrReviewVote[], errorPolicy?: 'standard' | 'absolute_quorum'): PrReviewAggregate;
-/** Builds the proposal text passed to voters. The voters are designed for
- * yes/no proposals — by framing the diff as "should this PR be merged?" we
- * get usable output without needing new system prompts (Child 3 will add
- * those).
- *
- * **Sanitization lives HERE, not at the tool boundary (#5258 item B).** The
- * `securityTier: 'external'` declared on the registered tool only protects the
- * MCP path, because the middleware is constructed inside `registerPrReviewTool`.
- * Three other callers reach the voters without it — `.github/workflows/
- * pr-review.yml`, `scripts/pr-review-local.ts` (the documented default path)
- * and `scripts/pr-review-eval-run.ts` — each importing this builder directly
- * from `dist/index.js`. On those paths a hostile PR body reached five voters
- * unfenced, next to the words "should it be merged as-is?".
- *
- * This function is the one chokepoint all four callers pass through, so the
- * protection is attached to the data rather than to one entry point. The MCP
- * tier check still runs earlier and still refuses; this is the floor beneath
- * it, and it strips rather than refuses so the script paths degrade instead of
- * failing shut. Double-sanitizing on the MCP path is idempotent and harmless.
- */
-declare function buildPrReviewProposal(input: Pick<PrReviewInput, 'prTitle' | 'prDescription' | 'prDiff' | 'repoContext' | 'baseRef' | 'headRef'>): string;
+
 /** @category MCP */
 declare function registerPrReviewTool(server: McpServer, deps: PrReviewDeps): void;
 

package/dist/index.js

@@ -553,7 +553,7 @@ import {
   withLogging,
   withRetry,
   withRetryWrapper
-} from "./chunk-OFUJNXH3.js";
+} from "./chunk-ONSYYUB4.js";
 import {
   FALLBACK_SCANNER_DATA,
   buildPlanFromAnalysis,
@@ -574,7 +574,7 @@ import {
   connectTransport,
   createServer,
   startStdioServer
-} from "./chunk-LW6FPSPN.js";
+} from "./chunk-3RMLDTUF.js";
 import {
   OPENAI_MODELS,
   OPENAI_MODEL_ALIASES,
@@ -632,7 +632,7 @@ import {
   generateProposalId,
   parseAgentPairKey,
   registerConsensusVoteTool
-} from "./chunk-6SPKOLVU.js";
+} from "./chunk-44I4XVRU.js";
 import "./chunk-6LDUEA4I.js";
 import {
   allOf
@@ -685,7 +685,7 @@ import {
 import {
   ImprovementReviewInputSchema,
   registerImprovementReviewTool
-} from "./chunk-AQF22T74.js";
+} from "./chunk-3OU7XMEP.js";
 import {
   AgentPerformanceSchema,
   ConsensusAlgorithmSchema,
@@ -721,10 +721,10 @@ import {
   toolSuccess,
   toolSuccessStructured,
   validateToolInput
-} from "./chunk-TSZWXRF7.js";
+} from "./chunk-VULYVX6X.js";
 import {
   VERSION
-} from "./chunk-2OS7HTUM.js";
+} from "./chunk-LZBARHPR.js";
 import {
   AuditTrail,
   MAX_STRIPPED_ELEMENTS_PER_EVENT,
@@ -4890,7 +4890,7 @@ function buildVotingInput(plan, config) {
 }
 async function executeSingleVote(plan, config, log) {
   try {
-    const { executeVoting } = await import("./consensus-vote-44WT45UN.js");
+    const { executeVoting } = await import("./consensus-vote-H67IAMI2.js");
     const input = buildVotingInput(plan, config);
     const result = await executeVoting(input, log);
     return parseVotingResult(result);

package/dist/{setup-data-dir-Y4F4R2BJ.js → setup-data-dir-HJCC6U4N.js}

@@ -2,11 +2,11 @@ import {
   NEXUS_DATA_DIR,
   describeDataDirFix,
   initDataDirectories
-} from "./chunk-LW6FPSPN.js";
+} from "./chunk-3RMLDTUF.js";
 import "./chunk-T7XKLZPC.js";
 import "./chunk-6LDUEA4I.js";
 import "./chunk-OQB3XC5O.js";
-import "./chunk-2OS7HTUM.js";
+import "./chunk-LZBARHPR.js";
 import "./chunk-6T3EPABN.js";
 import "./chunk-UZULX2DZ.js";
 import "./chunk-FFZNRJ5Q.js";
@@ -26,4 +26,4 @@ export {
   describeDataDirFix,
   initDataDirectories
 };
-//# sourceMappingURL=setup-data-dir-Y4F4R2BJ.js.map
+//# sourceMappingURL=setup-data-dir-HJCC6U4N.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexus-agents",
-  "version": "8.3.1",
+  "version": "8.3.2",
   "description": "Governance substrate for AI coding agents — adversarial PR review, drift-detected rules, tamper-evident audit, and closed-loop outcome routing for Claude, Codex, Gemini, and OpenCode",
   "mcpName": "io.github.nexus-substrate/nexus-agents",
   "license": "MIT",
@@ -114,7 +114,7 @@
     }
   },
   "scripts": {
-    "build": "tsup && npx tsx ../../scripts/check-dist-assets.ts",
+    "build": "tsup && pnpm exec tsx ../../scripts/check-dist-assets.ts",
     "dev": "tsup --watch",
     "test": "vitest run",
     "test:e2e": "vitest run --config vitest.config.e2e.ts",

package/dist/chunk-2OS7HTUM.js

@@ -1,7 +0,0 @@
-// src/version.ts
-var VERSION = true ? "8.3.1" : "dev";
-
-export {
-  VERSION
-};
-//# sourceMappingURL=chunk-2OS7HTUM.js.map