nexus-agents 8.59.1 → 8.60.1

package/dist/{ast-rule-runner-AGCWR6GP.js → ast-rule-runner-PEV2AVO5.js}

@@ -9,8 +9,8 @@ import {
   getBuiltInAstRulesPath,
   loadRules,
   runAstQaRules
-} from "./chunk-FZKP5NBV.js";
-import "./chunk-PLCJRWLF.js";
+} from "./chunk-KWRAT327.js";
+import "./chunk-BBJ4VKDI.js";
 import "./chunk-MTYJPPIG.js";
 import "./chunk-BTYRPZON.js";
 import "./chunk-ZPWHCABL.js";
@@ -26,4 +26,4 @@ export {
   loadRules,
   runAstQaRules
 };
-//# sourceMappingURL=ast-rule-runner-AGCWR6GP.js.map
+//# sourceMappingURL=ast-rule-runner-PEV2AVO5.js.map

package/dist/{child-mcp-config-DX6SMLBF.js → child-mcp-config-MTOYKXU5.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-T46RV7Y7.js";
 import {
   createLogger
-} from "./chunk-PLCJRWLF.js";
+} from "./chunk-BBJ4VKDI.js";
 import "./chunk-MTYJPPIG.js";
 import "./chunk-BTYRPZON.js";
 import "./chunk-ZPWHCABL.js";
@@ -60,4 +60,4 @@ export {
   generateMcpConfig,
   getDefaultAllowedTools
 };
-//# sourceMappingURL=child-mcp-config-DX6SMLBF.js.map
+//# sourceMappingURL=child-mcp-config-MTOYKXU5.js.map

package/dist/{chunk-HQQTTJL5.js → chunk-3BBRLDAA.js}

@@ -1,14 +1,14 @@
 import {
   GitHubProvider,
   ScmError
-} from "./chunk-IEYL7WMY.js";
+} from "./chunk-7MPCTKXP.js";
 import {
   resolveToken
-} from "./chunk-YQVIROWH.js";
+} from "./chunk-TZN2E2WI.js";
 import {
   err,
   ok
-} from "./chunk-PLCJRWLF.js";
+} from "./chunk-BBJ4VKDI.js";
 
 // src/scm/factory.ts
 async function createScmProvider(config) {
@@ -41,4 +41,4 @@ export {
   createScmProvider,
   createGitHubProvider
 };
-//# sourceMappingURL=chunk-HQQTTJL5.js.map
+//# sourceMappingURL=chunk-3BBRLDAA.js.map

package/dist/{chunk-VTY6MN7E.js → chunk-5B3VEC52.js}

@@ -5,7 +5,7 @@ import {
   MCP_TIMEOUTS,
   TEST_TIMEOUTS,
   WORKFLOW_TIMEOUTS
-} from "./chunk-PLCJRWLF.js";
+} from "./chunk-BBJ4VKDI.js";
 import {
   createGetEnvVarDocumentation,
   createGetTimeout,
@@ -224,4 +224,4 @@ export {
   CUSTOM_API_DEFAULT_MODEL,
   DEFAULTS
 };
-//# sourceMappingURL=chunk-VTY6MN7E.js.map
+//# sourceMappingURL=chunk-5B3VEC52.js.map

package/dist/{chunk-NRIH6GVC.js → chunk-5ZVGPKNO.js}

@@ -1,7 +1,7 @@
 import {
   GitHubProvider,
   ScmError
-} from "./chunk-IEYL7WMY.js";
+} from "./chunk-7MPCTKXP.js";
 import {
   ROLE_DEFAULT_TRUST,
   ReputationCache,
@@ -12,18 +12,10 @@ import {
   resolveEnvMode,
   resolveReputationGatingMode,
   sanitizeInput
-} from "./chunk-UX2SOSH3.js";
-import {
-  MAX_STRIPPED_ELEMENTS_PER_EVENT,
-  createAuditTrail,
-  emitPolicyEvent,
-  emitReputationEvent,
-  emitSanitizationEvent,
-  emitTrustEvent
-} from "./chunk-5QROFHTG.js";
+} from "./chunk-DIV6TBCN.js";
 import {
   hasToken
-} from "./chunk-YQVIROWH.js";
+} from "./chunk-TZN2E2WI.js";
 import {
   CLI_SUBPROCESS_TIMEOUTS,
   createLogger,
@@ -31,7 +23,7 @@ import {
   getErrorMessage,
   getTimeProvider,
   ok
-} from "./chunk-PLCJRWLF.js";
+} from "./chunk-BBJ4VKDI.js";
 
 // src/security/firewall/firewall-policy-mode.ts
 import { z } from "zod";
@@ -59,6 +51,197 @@ function resolveFirewallPolicyMode(env = process.env, logger7) {
   );
 }
 
+// src/security/audit-trail.ts
+var MAX_EVENTS = 1e4;
+var MAX_STRIPPED_ELEMENTS_PER_EVENT = 20;
+var AuditTrail = class {
+  constructor(durableSink) {
+    this.durableSink = durableSink;
+  }
+  durableSink;
+  events = [];
+  nextId = 1;
+  /** Appends an event to the trail. Returns the assigned event ID. */
+  append(event) {
+    const id = `audit-${String(this.nextId++)}`;
+    const fullEvent = {
+      ...event,
+      id,
+      timestamp: getTimeProvider().nowIso()
+    };
+    this.events.push(fullEvent);
+    this.enforceLimit();
+    if (this.durableSink !== void 0) {
+      try {
+        this.durableSink(fullEvent);
+      } catch {
+      }
+    }
+    return id;
+  }
+  /** Queries events matching the given filter. */
+  query(filter = {}) {
+    let results = this.events;
+    if (filter.type !== void 0) {
+      results = results.filter((e) => e.type === filter.type);
+    }
+    if (filter.since !== void 0) {
+      results = filterSince(results, filter.since);
+    }
+    if (filter.until !== void 0) {
+      results = filterUntil(results, filter.until);
+    }
+    if (filter.trustTier !== void 0) {
+      results = filterByTrustTier(results, filter.trustTier);
+    }
+    if (filter.actionType !== void 0) {
+      results = filterByActionType(results, filter.actionType);
+    }
+    if (filter.actor !== void 0) {
+      results = filterByActor(results, filter.actor);
+    }
+    if (filter.violationRule !== void 0) {
+      results = filterByViolationRule(results, filter.violationRule);
+    }
+    const limit = filter.limit ?? results.length;
+    return results.slice(-limit);
+  }
+  /** Returns the total number of events. */
+  get size() {
+    return this.events.length;
+  }
+  /** Clears all events. */
+  clear() {
+    this.events = [];
+  }
+  /** Enforces MAX_EVENTS bound. */
+  enforceLimit() {
+    if (this.events.length > MAX_EVENTS) {
+      this.events = this.events.slice(-MAX_EVENTS);
+    }
+  }
+};
+function filterSince(events, since) {
+  const sinceTime = new Date(since).getTime();
+  return events.filter((e) => new Date(e.timestamp).getTime() >= sinceTime);
+}
+function filterUntil(events, until) {
+  const untilTime = new Date(until).getTime();
+  return events.filter((e) => new Date(e.timestamp).getTime() <= untilTime);
+}
+function filterByTrustTier(events, tier) {
+  return events.filter((e) => {
+    if (e.type === "trust_classification") return e.assignedTier === tier;
+    if (e.type === "policy_gate") return e.inputTrustTier === tier;
+    if (e.type === "reputation") return e.effectiveTier === tier;
+    return true;
+  });
+}
+function filterByActionType(events, actionType) {
+  return events.filter(
+    (e) => (e.type === "policy_gate" || e.type === "corroboration") && e.actionType === actionType
+  );
+}
+function filterByActor(events, actor) {
+  return events.filter(
+    (e) => (e.type === "trust_classification" || e.type === "reputation") && e.username === actor
+  );
+}
+function filterByViolationRule(events, rule) {
+  return events.filter((e) => e.type === "policy_gate" && e.violationRules.includes(rule));
+}
+function emitTrustEvent(trail, data) {
+  return trail.append({
+    type: "trust_classification",
+    component: "trust-classifier",
+    ...data
+  });
+}
+function emitPolicyEvent(trail, data) {
+  return trail.append({
+    type: "policy_gate",
+    component: "policy-gate",
+    ...data
+  });
+}
+function emitPipelinePolicyEvent(trail, data) {
+  return trail.append({
+    type: "policy_gate",
+    component: "pipeline-policy-evaluator",
+    ...data
+  });
+}
+function emitCorroborationEvent(trail, data) {
+  return trail.append({
+    type: "corroboration",
+    component: "corroboration-validator",
+    ...data
+  });
+}
+function emitReputationEvent(trail, data) {
+  return trail.append({
+    type: "reputation",
+    component: "reputation-model",
+    ...data
+  });
+}
+function emitSanitizationEvent(trail, data) {
+  return trail.append({
+    type: "sanitization",
+    component: "input-sanitizer",
+    ...data
+  });
+}
+function emitGraphExecutionEvent(trail, data) {
+  return trail.append({
+    type: "graph_execution",
+    component: "graph-executor",
+    ...data
+  });
+}
+function createGraphAuditBridge(trail) {
+  return (event) => {
+    const nodeId = typeof event["nodeId"] === "string" ? event["nodeId"] : void 0;
+    const stepNumber = typeof event["stepNumber"] === "number" ? event["stepNumber"] : 0;
+    emitGraphExecutionEvent(trail, {
+      graphEvent: event.type,
+      ...nodeId !== void 0 ? { nodeId } : {},
+      stepNumber,
+      detail: formatGraphEventDetail(event)
+    });
+  };
+}
+function formatNotCompleted(event) {
+  const detail = event["detail"];
+  const suffix = typeof detail === "string" && detail !== "" ? `: ${detail}` : "";
+  return `Node ${String(event["nodeId"])} ${String(event["reason"])} (did not complete)${suffix}`;
+}
+function formatCompletion(event) {
+  return event["halted"] === true ? `HALTED awaiting input after ${String(event["totalSteps"])} steps, ${String(event["durationMs"])}ms \u2014 NOT complete` : `Complete: ${String(event["totalSteps"])} steps, ${String(event["durationMs"])}ms`;
+}
+function formatGraphEventDetail(event) {
+  if (event.type === "node_not_completed") return formatNotCompleted(event);
+  switch (event.type) {
+    case "node_started":
+      return `Node ${String(event["nodeId"])} starting`;
+    case "node_completed":
+      return `Node ${String(event["nodeId"])} completed in ${String(event["durationMs"])}ms`;
+    case "node_error":
+      return `Node ${String(event["nodeId"])} failed: ${String(event["error"])}`;
+    case "state_updated":
+      return `State updated: ${String(event["updatedKeys"])}`;
+    case "step_completed":
+      return `Step ${String(event["stepNumber"])}: ${String(event["nodesExecuted"])} nodes`;
+    case "execution_complete":
+      return formatCompletion(event);
+    default:
+      return event.type;
+  }
+}
+function createAuditTrail(durableSink) {
+  return new AuditTrail(durableSink);
+}
+
 // src/security/audit-bridge.ts
 var logger = createLogger({ component: "SecurityAuditBridge" });
 function systemActor(id, name) {
@@ -2163,6 +2346,16 @@ function createIssueTriage(config) {
 }
 
 export {
+  AuditTrail,
+  emitTrustEvent,
+  emitPolicyEvent,
+  emitPipelinePolicyEvent,
+  emitCorroborationEvent,
+  emitReputationEvent,
+  emitSanitizationEvent,
+  emitGraphExecutionEvent,
+  createGraphAuditBridge,
+  createAuditTrail,
   createDurableAuditSink,
   createDurableAuditTrail,
   FirewallPolicyModeSchema,
@@ -2200,4 +2393,4 @@ export {
   IssueTriage,
   createIssueTriage
 };
-//# sourceMappingURL=chunk-NRIH6GVC.js.map
+//# sourceMappingURL=chunk-5ZVGPKNO.js.map