nexus-agents 8.48.2 → 8.48.3

package/dist/{chunk-DTUJCA6M.js → chunk-HWPDTJ25.js}

@@ -23,10 +23,10 @@ import {
   toolSuccessStructured,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-5IB64MNO.js";
+} from "./chunk-JZ4GXMVX.js";
 import {
   VERSION
-} from "./chunk-2EH4T5I6.js";
+} from "./chunk-OTCLEHE2.js";
 import {
   assessPanelIndependence,
   countDistinctModels,
@@ -77,6 +77,7 @@ import {
   getOutcomesFile
 } from "./chunk-MTYJPPIG.js";
 import {
+  findRepoRoot,
   getNexusDataDir,
   nexusDataPath,
   nexusDataPathEnsure
@@ -1126,9 +1127,9 @@ function createKeyedSerializer() {
 }
 function raceWithDeadline(p, role, deadlineMs) {
   let timer;
-  const timeoutP = new Promise((resolve3) => {
+  const timeoutP = new Promise((resolve4) => {
     timer = setTimeout(() => {
-      resolve3(createErrorVoteResult(role, DEADLINE_MESSAGE, deadlineMs));
+      resolve4(createErrorVoteResult(role, DEADLINE_MESSAGE, deadlineMs));
     }, deadlineMs);
   });
   return Promise.race([p, timeoutP]).finally(() => {
@@ -5154,7 +5155,7 @@ function applyErrorPolicy(votes, policy) {
 
 // src/audit/vote-record-store.ts
 import { appendFileSync as appendFileSync2, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2 } from "node:fs";
-import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
+import { dirname, isAbsolute, relative, resolve as resolve2, sep } from "node:path";
 
 // src/audit/ledger-append.ts
 var UNREADABLE_RECORD_PREFIX = "refusing to persist an unreadable";
@@ -5175,6 +5176,21 @@ function serializeValidatedRecord(schema, record, ledgerName) {
   return line + "\n";
 }
 
+// src/audit/source-checkout-guard.ts
+import { join, resolve } from "node:path";
+function isUnderTestRunner() {
+  return process.env["VITEST"] !== void 0 || process.env["NODE_ENV"] === "test";
+}
+function assertNotSourceCheckoutWrite(filePath, trackedRelPath, overrideEnvVar) {
+  if (!isUnderTestRunner()) return;
+  const here = findRepoRoot(process.cwd());
+  if (here === null) return;
+  if (resolve(filePath) !== resolve(join(here, trackedRelPath))) return;
+  throw new Error(
+    `Refusing to write ${filePath} from a test run (#4415): this is the source checkout's tracked, hash-chained audit file, and a fabricated record that chains cleanly is indistinguishable from a real verdict. Pass repoPath to a throwaway repo, or set ${overrideEnvVar}.`
+  );
+}
+
 // src/audit/vote-record.ts
 import * as crypto from "node:crypto";
 import { z as z7 } from "zod";
@@ -5440,6 +5456,7 @@ function hashProposal(proposal) {
 }
 
 // src/audit/vote-record-store.ts
+var VOTE_RECORDS_REL_PATH = "governance/vote-records.jsonl";
 var VOTE_RECORDS_DATA_CATEGORY = "governance";
 var VOTE_RECORDS_FILENAME = "vote-records.jsonl";
 var VOTE_RECORDS_PATH_ENV = "NEXUS_VOTE_RECORDS_PATH";
@@ -5581,8 +5598,8 @@ function readLedgerTip(filePath, logger11) {
   }
 }
 function isWithin(root, target) {
-  const resolvedRoot = resolve(root);
-  const resolvedTarget = resolve(target);
+  const resolvedRoot = resolve2(root);
+  const resolvedTarget = resolve2(target);
   if (resolvedTarget === resolvedRoot) return true;
   const rel = relative(resolvedRoot, resolvedTarget);
   return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
@@ -5590,7 +5607,7 @@ function isWithin(root, target) {
 function resolveVoteRecordsPath() {
   const envPath = process.env[VOTE_RECORDS_PATH_ENV];
   if (envPath !== void 0 && envPath.trim() !== "") {
-    const resolved2 = isAbsolute(envPath) ? envPath : resolve(envPath);
+    const resolved2 = isAbsolute(envPath) ? envPath : resolve2(envPath);
     if (!isAbsolute(envPath) && !isWithin(process.cwd(), resolved2)) {
       return void 0;
     }
@@ -5614,6 +5631,7 @@ function persistVoteRecord(opts) {
     logger11.warn(voteRecordWriteFailedMessage("<unresolved>"), { id: opts.id });
     return void 0;
   }
+  assertNotSourceCheckoutWrite(filePath, VOTE_RECORDS_REL_PATH, VOTE_RECORDS_PATH_ENV);
   try {
     mkdirSync2(dirname(filePath), { recursive: true });
     const { maxSequence, lastHash } = readLedgerTip(filePath, logger11);
@@ -7924,6 +7942,7 @@ export {
   toRecordDecision,
   mapOutcomeToDecision,
   serializeValidatedRecord,
+  assertNotSourceCheckoutWrite,
   recordAuthenticVote,
   recordDecisionCost,
   checkSimulationAllowed,
@@ -7939,4 +7958,4 @@ export {
   CONSENSUS_VOTE_TOOL_SCHEMA,
   registerConsensusVoteTool
 };
-//# sourceMappingURL=chunk-DTUJCA6M.js.map
+//# sourceMappingURL=chunk-HWPDTJ25.js.map