nexus-agents 8.67.0 → 8.69.0

package/dist/{chunk-Z3D2LFRH.js → chunk-AMZEALD7.js}

@@ -11,7 +11,7 @@ import {
   NODE_ENGINE_RANGE,
   VERSION,
   isNodeVersionSupported
-} from "./chunk-H5WLZNF5.js";
+} from "./chunk-YDBWWICY.js";
 import {
   claimGlobalRegistry
 } from "./chunk-WQWC52E7.js";
@@ -1314,7 +1314,7 @@ async function runDoctorFix(result) {
   writeLine2("\u2500".repeat(40));
   let fixCount = 0;
   if (!result.dataDirectory.rootExists || result.dataDirectory.subdirectories.some((d) => !d.exists || !d.writable)) {
-    const { initDataDirectories: initDataDirectories2, describeDataDirFix: describeDataDirFix2 } = await import("./setup-data-dir-ZU3MRHWV.js");
+    const { initDataDirectories: initDataDirectories2, describeDataDirFix: describeDataDirFix2 } = await import("./setup-data-dir-E372AVMR.js");
     const outcome = describeDataDirFix2(initDataDirectories2());
     writeLine2(outcome.line);
     if (outcome.counted) fixCount++;
@@ -1416,4 +1416,4 @@ export {
   startStdioServer,
   closeServer
 };
-//# sourceMappingURL=chunk-Z3D2LFRH.js.map
+//# sourceMappingURL=chunk-AMZEALD7.js.map

package/dist/{chunk-2BAFNUJO.js → chunk-BO6BL2H7.js}

@@ -21,7 +21,7 @@ import {
 import {
   DEFAULT_TASK_TTL_MS,
   clampTaskTtl
-} from "./chunk-Z3D2LFRH.js";
+} from "./chunk-AMZEALD7.js";
 import {
   executeExpert
 } from "./chunk-QO6S3VMQ.js";
@@ -71,7 +71,7 @@ import {
   updateStage,
   withWarnings,
   writeJobCancelled
-} from "./chunk-Z2572SMU.js";
+} from "./chunk-OQYN33KF.js";
 import {
   allOf,
   anyOf
@@ -93,7 +93,7 @@ import {
 } from "./chunk-CNOQ7NRP.js";
 import {
   withPrerequisite
-} from "./chunk-5CCKE7VV.js";
+} from "./chunk-J3KPS6LF.js";
 import {
   NOOP_NOTIFIER,
   RateLimiter,
@@ -116,7 +116,7 @@ import {
   toolSuccessStructured,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-Y73X72N4.js";
+} from "./chunk-HLOBTLXA.js";
 import {
   EventTopics,
   UNRESOLVED_MODEL_ID,
@@ -1113,7 +1113,8 @@ var NexusEnvSchema = z11.object({
   NEXUS_VOTE_RECORDS_PATH: z11.string().optional(),
   // #3927 item 4: the SSH key `scripts/append-ratification-record.ts` signs a
   // committed vote record's hash with (`--signing-key` overrides it). A path;
-  // unset ⇒ the record is appended unsigned and the script says so.
+  // unset ⇒ the agent key at `<dataDir>/auth/vote-record-signing.key` when it
+  // exists (#6257), else the record is appended unsigned and the script says so.
   NEXUS_VOTE_SIGNING_KEY: z11.string().optional(),
   // parseIntEnv / parseInt consumers: a non-integer is discarded in favour of
   // the default, so reporting it as invalid tells the user their setting was
@@ -45844,7 +45845,7 @@ function buildVotingInput(plan, config) {
 }
 async function executeSingleVote(plan, config, log) {
   try {
-    const { executeVoting } = await import("./consensus-vote-32WOIXIO.js");
+    const { executeVoting } = await import("./consensus-vote-IZRLUOXF.js");
     const input = buildVotingInput(plan, config);
     const result = await executeVoting(input, log);
     return parseVotingResult(result);
@@ -47555,9 +47556,15 @@ function getTrendContext() {
 }
 function createAgentStages(config = {}) {
   const guard = createBudgetGuard(config.budget);
-  const trustTier = config.trustTier ?? UNMEASURED_TRUST_TIER;
+  const callerTrustTier = config.callerTrustTier ?? config.trustTier ?? UNMEASURED_TRUST_TIER;
+  const inputSanitization = config.inputSanitization ?? "unmeasured";
   const startStage = (stage) => {
-    emitStageEvent2(stage, "started", { trustTier });
+    emitStageEvent2(stage, "started", {
+      callerTrustTier,
+      trustTier: callerTrustTier,
+      inputSanitization,
+      ...inputSanitization === "modified" && config.inputSanitizationCounts !== void 0 ? { inputSanitizationCounts: config.inputSanitizationCounts } : {}
+    });
   };
   return {
     research: async (task) => {
@@ -47642,7 +47649,7 @@ ${contextBlock}`;
       const strategy = config.votingStrategy ?? "higher_order";
       await postProgress(config, "Vote", `Running consensus with ${strategy} strategy...`);
       try {
-        const { executeVoting } = await import("./consensus-vote-32WOIXIO.js");
+        const { executeVoting } = await import("./consensus-vote-IZRLUOXF.js");
         const votingResult = await executeVoting(
           {
             proposal: buildVoteProposal(plan, research),
@@ -51962,6 +51969,20 @@ function createTaskTracker(config) {
   }
 }
 
+// src/mcp/tools/pipeline-input-sanitization.ts
+function measureInputSanitization(ctx) {
+  const observation = ctx?.sanitization;
+  if (observation === void 0) return { inputSanitization: "unmeasured" };
+  const { wasModified, tagsRemoved, commentsRemoved, fieldsModified } = observation;
+  if (!wasModified && tagsRemoved === 0 && commentsRemoved === 0) {
+    return { inputSanitization: "unmodified" };
+  }
+  return {
+    inputSanitization: "modified",
+    inputSanitizationCounts: { tagsRemoved, commentsRemoved, fieldsModified }
+  };
+}
+
 // src/mcp/tools/dev-pipeline-tool.ts
 var DEV_PIPELINE_ASYNC_HINT = "A full run_dev_pipeline run can exceed the 900s synchronous MCP timeout. Retry with `dispatch: 'async'` to get a jobId immediately, then poll get_job_result({ jobId }) for the result.";
 var DEV_PIPELINE_DRY_RUN_NOTE = "This was a dry run (plan+vote), which always runs synchronously; async dispatch is ignored for dry runs, so retrying with it changes nothing.";
@@ -52057,12 +52078,13 @@ async function resolveTaskInput(input) {
   }
   throw new Error("Either task or planFile must be provided");
 }
-async function createStages(input, trustTier) {
+async function createStages(input, trustTier, inputSanitization) {
   const backendChoice = input.trackerBackend;
   const backend = backendChoice === "json" && input.repo !== void 0 ? await detectBackend() : backendChoice;
   const tracker = input.repo !== void 0 ? createTaskTracker({ backend, repo: input.repo, labels: input.labels }) : void 0;
   return createAgentStages({
-    ...trustTier !== void 0 ? { trustTier } : {},
+    ...trustTier !== void 0 ? { callerTrustTier: trustTier, trustTier } : {},
+    ...inputSanitization,
     scanTarget: input.workingDir,
     simulateVotes: input.simulateVotes,
     votingStrategy: input.votingStrategy,
@@ -52081,7 +52103,7 @@ async function runDevPipelineForGoal(goal, trustTier, dryRun) {
     task: goal,
     ...dryRun !== void 0 ? { dryRun } : {}
   });
-  const stages = await createStages(input, trustTier);
+  const stages = await createStages(input, trustTier, { inputSanitization: "unmeasured" });
   return runDevPipeline(goal, stages, {
     ...trustTier !== void 0 ? { trustTier } : {},
     // #4806 said `dryRun` is the one pipeline option `run` forwards. It parsed
@@ -52170,7 +52192,9 @@ function describeIncompleteRun(result) {
   }
   return "Pipeline did not complete";
 }
-async function runDevPipelineHandler(args, logger57, trustTier, auditLogger) {
+async function runDevPipelineHandler(args, logger57, trustTier, auditLogger, inputSanitization = {
+  inputSanitization: "unmeasured"
+}) {
   const parsed = DevPipelineInputSchema.safeParse(args);
   if (!parsed.success) {
     return toolStructuredError({
@@ -52187,7 +52211,7 @@ async function runDevPipelineHandler(args, logger57, trustTier, auditLogger) {
   }
   try {
     const taskText = await resolveTaskInput(input);
-    const stages = await createStages(input, trustTier);
+    const stages = await createStages(input, trustTier, inputSanitization);
     const pipelineOptions = buildPipelineOptions(input, trustTier, auditLogger);
     const hasOptions = Object.keys(pipelineOptions).length > 0;
     const resolvedOptions = hasOptions ? pipelineOptions : void 0;
@@ -52242,7 +52266,13 @@ function dispatchAsyncDevPipeline(input, run, logger57) {
 function registerDevPipelineTool(server, deps) {
   const logger57 = deps.logger ?? createLogger({ tool: "run_dev_pipeline" });
   const secureHandler = createSecureHandler(
-    (args, ctx) => runDevPipelineHandler(args, logger57, measuredTrustTier(ctx.requestContext), deps.auditLogger),
+    (args, ctx) => runDevPipelineHandler(
+      args,
+      logger57,
+      ctx && measuredTrustTier(ctx.requestContext),
+      deps.auditLogger,
+      measureInputSanitization(ctx)
+    ),
     { toolName: "run_dev_pipeline", rateLimiter: deps.rateLimiter, logger: logger57 }
   );
   const timeoutMs = getToolTimeout("run_dev_pipeline", deps.security);
@@ -52382,7 +52412,11 @@ function selectStageRegistry(template, task, agentStages) {
 var RUN_PIPELINE_DESCRIPTION = `Single unified entry point for all pipeline templates (${listTemplateIds().join("/")}). Auto-detects template from task content or accepts an explicit override. Supports dispatch: 'async' (non-dryRun runs) \u2014 returns a jobId immediately; poll get_job_result.`;
 async function runPipelineForGoal(goal, logger57 = createLogger({ tool: "run_pipeline" })) {
   const budget = resolveRunBudget(goal, void 0, logger57);
-  const agentStages = createAgentStages(budget !== void 0 ? { budget } : {});
+  const agentStages = createAgentStages({
+    budget,
+    // Plain-goal pipeline/research strategies have no HandlerContext.
+    inputSanitization: "unmeasured"
+  });
   const stages = selectStageRegistry(void 0, goal, agentStages);
   return runAdaptiveOrchestrator(goal, { stages });
 }
@@ -52402,7 +52436,7 @@ async function executePipelineBody(task, stages, templateId, dryRun, simulated)
   }
   return toolSuccessStructured(output2);
 }
-async function runPipelineHandler(args, logger57, trustTier) {
+async function runPipelineHandler(args, logger57, callerTrustTier, sanitization) {
   const parsed = PipelineInputSchema.safeParse(args);
   if (!parsed.success) {
     return toolStructuredError({
@@ -52423,9 +52457,9 @@ async function runPipelineHandler(args, logger57, trustTier) {
       simulateVotes: input.simulateVotes,
       votingStrategy: input.votingStrategy,
       quickMode: input.quickMode,
-      // #4694: record-only. Absent stays absent — createAgentStages stamps
-      // UNMEASURED_TRUST_TIER rather than inventing a trusted default.
-      ...trustTier !== void 0 ? { trustTier } : {},
+      callerTrustTier,
+      trustTier: callerTrustTier,
+      ...sanitization,
       budget: resolveRunBudget(task, input.template, logger57)
     });
     const stages = selectStageRegistry(input.template, task, agentStages);
@@ -52455,7 +52489,12 @@ function registerPipelineTool(server, deps) {
     // Optional chaining is deliberate, not defensive noise: a handler invoked
     // without a context has genuinely NOT measured a tier, and that flows to
     // UNMEASURED_TRUST_TIER rather than to a default. Absence stays absence.
-    (args, ctx) => runPipelineHandler(args, logger57, ctx && measuredTrustTier(ctx.requestContext)),
+    (args, ctx) => runPipelineHandler(
+      args,
+      logger57,
+      ctx && measuredTrustTier(ctx.requestContext),
+      measureInputSanitization(ctx)
+    ),
     { toolName: "run_pipeline", rateLimiter: deps.rateLimiter, logger: logger57 }
   );
   const timeoutMs = getToolTimeout("run_pipeline", deps.security);
@@ -56855,4 +56894,4 @@ export {
   startPipelineEventBridge,
   shutdownPipelineEventBridge
 };
-//# sourceMappingURL=chunk-2BAFNUJO.js.map
+//# sourceMappingURL=chunk-BO6BL2H7.js.map