nexus-agents 8.63.1 → 8.64.0

package/dist/{chunk-KM2Q6MWR.js → chunk-O4RBLWDG.js}

@@ -11,7 +11,7 @@ import {
   NODE_ENGINE_RANGE,
   VERSION,
   isNodeVersionSupported
-} from "./chunk-ZJHPBJLQ.js";
+} from "./chunk-SJGLXUWJ.js";
 import {
   claimGlobalRegistry
 } from "./chunk-TGYLZFU5.js";
@@ -1314,7 +1314,7 @@ async function runDoctorFix(result) {
   writeLine2("\u2500".repeat(40));
   let fixCount = 0;
   if (!result.dataDirectory.rootExists || result.dataDirectory.subdirectories.some((d) => !d.exists || !d.writable)) {
-    const { initDataDirectories: initDataDirectories2, describeDataDirFix: describeDataDirFix2 } = await import("./setup-data-dir-GOITZLZI.js");
+    const { initDataDirectories: initDataDirectories2, describeDataDirFix: describeDataDirFix2 } = await import("./setup-data-dir-TNH5NNCC.js");
     const outcome = describeDataDirFix2(initDataDirectories2());
     writeLine2(outcome.line);
     if (outcome.counted) fixCount++;
@@ -1416,4 +1416,4 @@ export {
   startStdioServer,
   closeServer
 };
-//# sourceMappingURL=chunk-KM2Q6MWR.js.map
+//# sourceMappingURL=chunk-O4RBLWDG.js.map

package/dist/{chunk-YHJO37S5.js → chunk-PCOVCRXL.js}

@@ -25,10 +25,10 @@ import {
   toolSuccessStructured,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-J3WA3SHX.js";
+} from "./chunk-WRC725P5.js";
 import {
   VERSION
-} from "./chunk-ZJHPBJLQ.js";
+} from "./chunk-SJGLXUWJ.js";
 import {
   UNRESOLVED_MODEL_ID,
   assessPanelIndependence,
@@ -283,8 +283,57 @@ function reportPanelModelIndependence(modelIds, roleCount, phase, logger11) {
 }
 
 // src/audit/vote-record.ts
-import * as crypto from "node:crypto";
+import * as crypto2 from "node:crypto";
 import { z as z2 } from "zod";
+
+// src/audit/reasoning-commitment.ts
+import * as crypto from "node:crypto";
+var HEX_256_PATTERN = /^[0-9a-f]{64}$/;
+function mintReasoningNonce() {
+  return crypto.randomBytes(32).toString("hex");
+}
+function computeReasoningDigest(reasoningNonce, reasoning) {
+  return crypto.createHash("sha256").update(reasoningNonce).update(reasoning).digest("hex");
+}
+var REASONING_DIGEST_TIERS = /* @__PURE__ */ new Set(["1.13"]);
+function isReasoningDigestTier(version) {
+  return REASONING_DIGEST_TIERS.has(version);
+}
+function textTierShapeDefect(v) {
+  if (v.reasoningNonce !== void 0) {
+    return { key: "reasoningNonce", message: "reasoningNonce is a 1.13 key" };
+  }
+  if (v.reasoningDigest !== void 0) {
+    return { key: "reasoningDigest", message: "reasoningDigest is a 1.13 key" };
+  }
+  return null;
+}
+function digestTierShapeDefect(v) {
+  const hasText = v.reasoning !== void 0;
+  const hasNonce = v.reasoningNonce !== void 0;
+  const hasDigest = v.reasoningDigest !== void 0;
+  if (hasText && !hasNonce) {
+    return { key: "reasoningNonce", message: "reasoning without its reasoningNonce" };
+  }
+  if (hasNonce && !hasText) {
+    return { key: "reasoning", message: "reasoningNonce without the reasoning it opens" };
+  }
+  if (hasText && !hasDigest) {
+    return { key: "reasoningDigest", message: "reasoning without its reasoningDigest" };
+  }
+  if (hasDigest && !hasText) {
+    return {
+      key: "reasoning",
+      message: "a reasoning commitment with no opening (redaction is step 2, #6264)"
+    };
+  }
+  return null;
+}
+function reasoningCommitmentShapeDefect(digestTier, v) {
+  return digestTier ? digestTierShapeDefect(v) : textTierShapeDefect(v);
+}
+
+// src/audit/vote-record.ts
 var VoteRecordDecisionSchema = z2.enum(["approved", "rejected", "no_quorum"]);
 var VoteRecordOptionCoverageSchema = z2.object({
   /** Every approving voter, selecting or not — the tally's denominator. */
@@ -429,7 +478,39 @@ var VoterSummarySchema = z2.object({
    * misclassified (#6244). Rebuilt field-by-field on the `fallback` rule; the
    * `source` vocabulary is compile-checked against the live `RetriedFrom`.
    */
-  retriedFrom: RetriedFromRecordSchema.optional()
+  retriedFrom: RetriedFromRecordSchema.optional(),
+  /**
+   * The per-entry salt of the reasoning commitment (#6263, schema 1.13;
+   * #5748 step 1, panel option A amended with a salt). 32 random bytes as
+   * lowercase hex, minted by `mintReasoningNonce` (reasoning-commitment.ts)
+   * once per entry.
+   *
+   * The nonce is the OPENING of the commitment, together with `reasoning`:
+   * on the digest tier the record hash folds ONLY `reasoningDigest`, and
+   * both text and nonce travel on the record outside the hash
+   * (`reasoningTruncated` stays hashed). The salt is the secret (#6274
+   * panel 1): hashed, it could not be dropped at redaction without
+   * breaking the hash and the #3927 signature; public, it would let
+   * `sha256(nonce ‖ guess)` confirm low-entropy reasoning once the text is
+   * gone. Outside the hash, a later step (#6264) drops text and nonce
+   * together while the original hash — and any signature over it — still
+   * verifies, and the 256-bit unknown salt keeps the digest opaque. The
+   * record-level refinement below holds the three together: on 1.13 text
+   * and nonce are present or absent TOGETHER and an entry with reasoning
+   * carries the digest; on every older tier it carries neither key (there
+   * they would be unhashed decoration).
+   */
+  reasoningNonce: z2.string().regex(HEX_256_PATTERN).optional(),
+  /**
+   * `sha256(reasoningNonce ‖ reasoning)` as lowercase hex (#6263, schema
+   * 1.13) — see `computeReasoningDigest` in reasoning-commitment.ts. The
+   * commitment to the text: {@link verifyVoteRecordSet} re-opens it
+   * whenever nonce and text are both present, so a text edited without
+   * re-committing is a `hash_mismatch` exactly as it was when the text
+   * itself was folded. A digest nobody re-opens would be a check that
+   * cannot fail.
+   */
+  reasoningDigest: z2.string().regex(HEX_256_PATTERN).optional()
 }).strict();
 function defineVoterKeys(keys) {
   return keys;
@@ -453,7 +534,25 @@ var VOTER_SUMMARY_KEYS = defineVoterKeys([
   // 1.12 (#6246): appended after `fallback`, present-only, so a 1.11 entry
   // projects byte-identically. Nested; `projectRetriedFrom` rebuilds it in
   // its own canonical order.
-  "retriedFrom"
+  "retriedFrom",
+  // 1.13 (#6263): appended after `retriedFrom`, present-only. Only
+  // `reasoningDigest` is ever folded, and only on the digest tier, where
+  // `reasoning` above is NOT (`reasoningTruncated` stays folded on every
+  // tier); `reasoningNonce` is listed because every schema key must be (the
+  // `defineVoterKeys` constraint) but projects to absent on EVERY tier — it
+  // is the opening's salt, never hash-covered. `projectVoterField` keys the
+  // swap on the record version, so a 1.12 entry still projects
+  // byte-identically.
+  "reasoningNonce",
+  "reasoningDigest"
+]);
+var REASONING_TIER_KEYS = /* @__PURE__ */ new Set([
+  "reasoningNonce",
+  "reasoningDigest"
+]);
+var REASONING_OPENING_KEYS = /* @__PURE__ */ new Set([
+  "reasoning",
+  "reasoningNonce"
 ]);
 function noUnprojectedKeys(rest) {
   return rest;
@@ -476,7 +575,8 @@ function projectRetriedFrom(r) {
     ...errorTruncated !== void 0 ? { errorTruncated } : {}
   };
 }
-function projectVoterField(v, key) {
+function projectVoterField(v, key, digestTier) {
+  if (digestTier ? REASONING_OPENING_KEYS.has(key) : REASONING_TIER_KEYS.has(key)) return void 0;
   if (key === "fallback") {
     return v.fallback === void 0 ? void 0 : projectSeatFallback(v.fallback);
   }
@@ -485,10 +585,10 @@ function projectVoterField(v, key) {
   }
   return v[key];
 }
-function projectVoterSummary(v) {
+function projectVoterSummary(v, digestTier) {
   const out = {};
   for (const key of VOTER_SUMMARY_KEYS) {
-    const value = projectVoterField(v, key);
+    const value = projectVoterField(v, key, digestTier);
     if (value !== void 0) out[key] = value;
   }
   return out;
@@ -525,7 +625,10 @@ var VoteRecordSchema = z2.object({
    * '1.2' adds the optional `ratifies` subject-binding field (#3927 item 1);
    * '1.10' adds the optional `ratifiesPr` PR-binding (#5130); '1.11' the
    * optional `errorPolicy` (#6211); '1.12' the per-voter `retriedFrom`
-   * (#6246). Every tier is accepted — a 1.1 record
+   * (#6246); '1.13' the per-voter `reasoningNonce` + `reasoningDigest`
+   * and — the one tier that changes what an EXISTING key means to the
+   * hash — folds those instead of `reasoning` (#6263; the clip marker
+   * `reasoningTruncated` stays folded). Every tier is accepted — a 1.1 record
    * (no `ratifies`) verifies unchanged because each optional is folded into
    * the self-hash ONLY when present (see {@link computeVoteRecordHash}).
    * Tiers are labels, not ordered numbers: '1.10' follows '1.9' by
@@ -543,7 +646,8 @@ var VoteRecordSchema = z2.object({
     "1.9",
     "1.10",
     "1.11",
-    "1.12"
+    "1.12",
+    "1.13"
   ]),
   /** Unique record id (also usable as a `ratificationVoteRef`). */
   id: z2.string().min(1),
@@ -678,7 +782,15 @@ var VoteRecordSchema = z2.object({
   previousHash: z2.string().length(64).optional(),
   /** SHA-256 over every field above EXCEPT `previousHash` (and except `hash`). */
   hash: z2.string().length(64)
-}).strict();
+}).strict().superRefine((record, ctx) => {
+  const digestTier = isReasoningDigestTier(record.version);
+  for (const [i, v] of record.voters.entries()) {
+    const defect = reasoningCommitmentShapeDefect(digestTier, v);
+    if (defect !== null) {
+      ctx.addIssue({ code: "custom", path: ["voters", i, defect.key], message: defect.message });
+    }
+  }
+});
 function foldOptionalFields(base, payload) {
   const withTally = payload.optionTally !== void 0 ? {
     ...base,
@@ -728,15 +840,21 @@ function computeVoteRecordHash(payload) {
     // entry ONLY when present, on the same rule as the record-level optional
     // fields: a pre-1.6 voter entry re-hashes byte-identical, so every
     // historical record still verifies, while editing or removing a stored
-    // reasoning flips the hash.
-    voters: payload.voters.map(projectVoterSummary),
+    // reasoning flips the hash. On the digest tier (#6263, schema 1.13) the
+    // entry folds `reasoningDigest` INSTEAD of the text, and the salt
+    // `reasoningNonce` stays outside the hash with the text (the clip marker
+    // stays folded); the text is bound by the digest, which
+    // `verifyVoteRecordSet` re-opens with the nonce.
+    voters: payload.voters.map(
+      (v) => projectVoterSummary(v, isReasoningDigestTier(payload.version))
+    ),
     correlationId: payload.correlationId ?? null
   };
   const canonical = JSON.stringify(foldOptionalFields(base, payload));
-  return crypto.createHash("sha256").update(canonical).digest("hex");
+  return crypto2.createHash("sha256").update(canonical).digest("hex");
 }
 function hashProposal(proposal) {
-  return crypto.createHash("sha256").update(proposal).digest("hex");
+  return crypto2.createHash("sha256").update(proposal).digest("hex");
 }
 
 // src/cli/voter-unverifiable.ts
@@ -6342,7 +6460,13 @@ function toVoterSummaries(votes) {
 }
 function reasoningFields(reasoning) {
   const { text, truncated } = clipForRecord(reasoning);
-  return { reasoning: text, ...truncated === true ? { reasoningTruncated: true } : {} };
+  const reasoningNonce = mintReasoningNonce();
+  return {
+    reasoning: text,
+    ...truncated === true ? { reasoningTruncated: true } : {},
+    reasoningNonce,
+    reasoningDigest: computeReasoningDigest(reasoningNonce, text)
+  };
 }
 function recordDecisionFor(input) {
   return input.resolvedDecision ?? outcomeToDecision(input.result, input.votes, input.errorVoided ?? false);
@@ -6357,6 +6481,7 @@ function deriveOptionFields(votes, declaredOptions) {
 }
 function recordVersion(optionTally, optionCoverage, panelCoverage, voters, recordLevel) {
   const voterTier = voterTierOf(voters);
+  if (voterTier === "1.13") return "1.13";
   if (voterTier === "1.12") return "1.12";
   if (recordLevel.errorPolicy !== void 0) return "1.11";
   if (recordLevel.ratifiesPr !== void 0) return "1.10";
@@ -6366,6 +6491,7 @@ function recordVersion(optionTally, optionCoverage, panelCoverage, voters, recor
   return optionTally !== void 0 ? "1.3" : "1.2";
 }
 function voterTierOf(voters) {
+  if (voters.some((v) => v.reasoningDigest !== void 0)) return "1.13";
   if (voters.some((v) => v.retriedFrom !== void 0)) return "1.12";
   if (voters.some((v) => v.assignedCli !== void 0 || v.fallback !== void 0)) return "1.9";
   if (voters.some((v) => v.model !== void 0 || v.unverifiable === true)) return "1.8";
@@ -6945,7 +7071,7 @@ import {
 import { z as z11 } from "zod";
 
 // src/mcp/jobs/job-idempotency.ts
-import { createHash as createHash2, randomUUID } from "node:crypto";
+import { createHash as createHash3, randomUUID } from "node:crypto";
 import { existsSync as existsSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "node:fs";
 import { z as z10 } from "zod";
 var logger7 = createLogger({ component: "job-idempotency" });
@@ -6963,7 +7089,7 @@ var IdempotencyIndexEntrySchema = z10.object({
   createdAt: z10.iso.datetime()
 });
 function sha256Hex(input) {
-  return createHash2("sha256").update(input).digest("hex");
+  return createHash3("sha256").update(input).digest("hex");
 }
 function canonicalJsonStringify(value) {
   if (value === null || typeof value !== "object") return JSON.stringify(value);
@@ -8930,4 +9056,4 @@ export {
   CONSENSUS_VOTE_TOOL_SCHEMA,
   registerConsensusVoteTool
 };
-//# sourceMappingURL=chunk-YHJO37S5.js.map
+//# sourceMappingURL=chunk-PCOVCRXL.js.map