nexus-agents 8.77.0 → 8.78.0

package/dist/{chunk-LZGSWYDX.js → chunk-5EXZHBAQ.js}

@@ -1,6 +1,6 @@
 import {
   VERSION
-} from "./chunk-QBZ6DBJL.js";
+} from "./chunk-MYF73MI3.js";
 import {
   CACHE_TIMEOUTS,
   MCP_TIMEOUTS,
@@ -2186,4 +2186,4 @@ export {
   DEFAULT_CONSENSUS_CONFIG,
   ConsensusMetricsSchema
 };
-//# sourceMappingURL=chunk-LZGSWYDX.js.map
+//# sourceMappingURL=chunk-5EXZHBAQ.js.map

package/dist/{chunk-GS5OJHJJ.js → chunk-7ZMNE7U2.js}

@@ -12,7 +12,7 @@ import {
   NODE_ENGINE_RANGE,
   VERSION,
   isNodeVersionSupported
-} from "./chunk-QBZ6DBJL.js";
+} from "./chunk-MYF73MI3.js";
 import {
   claimGlobalRegistry
 } from "./chunk-PSCY6MSD.js";
@@ -1372,7 +1372,7 @@ async function runDoctorFix(result) {
   writeLine2("\u2500".repeat(40));
   let fixCount = 0;
   if (!result.dataDirectory.rootExists || result.dataDirectory.subdirectories.some((d) => !d.exists || !d.writable)) {
-    const { initDataDirectories: initDataDirectories2, describeDataDirFix: describeDataDirFix2 } = await import("./setup-data-dir-VCSQTZ6L.js");
+    const { initDataDirectories: initDataDirectories2, describeDataDirFix: describeDataDirFix2 } = await import("./setup-data-dir-NQITBZYA.js");
     const outcome = describeDataDirFix2(initDataDirectories2());
     writeLine2(outcome.line);
     if (outcome.counted) fixCount++;
@@ -1474,4 +1474,4 @@ export {
   startStdioServer,
   closeServer
 };
-//# sourceMappingURL=chunk-GS5OJHJJ.js.map
+//# sourceMappingURL=chunk-7ZMNE7U2.js.map

package/dist/{chunk-I2MSRFXZ.js → chunk-ER76ZRBU.js}

@@ -24,10 +24,10 @@ import {
   toolSuccessStructured,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-LZGSWYDX.js";
+} from "./chunk-5EXZHBAQ.js";
 import {
   VERSION
-} from "./chunk-QBZ6DBJL.js";
+} from "./chunk-MYF73MI3.js";
 import {
   UNRESOLVED_MODEL_ID,
   assessPanelIndependence,
@@ -9188,4 +9188,4 @@ export {
   CONSENSUS_VOTE_TOOL_SCHEMA,
   registerConsensusVoteTool
 };
-//# sourceMappingURL=chunk-I2MSRFXZ.js.map
+//# sourceMappingURL=chunk-ER76ZRBU.js.map

package/dist/{chunk-QBZ6DBJL.js → chunk-MYF73MI3.js}

@@ -1,6 +1,6 @@
 // src/version.ts
 import semver from "semver";
-var VERSION = true ? "8.77.0" : "dev";
+var VERSION = true ? "8.78.0" : "dev";
 var NODE_ENGINE_RANGE = ">=22.5.0";
 function isNodeVersionSupported(version) {
   return semver.satisfies(version, NODE_ENGINE_RANGE);
@@ -11,4 +11,4 @@ export {
   NODE_ENGINE_RANGE,
   isNodeVersionSupported
 };
-//# sourceMappingURL=chunk-QBZ6DBJL.js.map
+//# sourceMappingURL=chunk-MYF73MI3.js.map

package/dist/{chunk-6IUAMO5M.js → chunk-NW5MCYOE.js}

@@ -7,7 +7,7 @@ import {
   toolStructuredError,
   toolSuccessStructured,
   wrapToolWithTimeout
-} from "./chunk-LZGSWYDX.js";
+} from "./chunk-5EXZHBAQ.js";
 import {
   JsonlStore,
   SECURITY_KEYWORDS,
@@ -2282,4 +2282,4 @@ export {
   runImprovementReview,
   registerImprovementReviewTool
 };
-//# sourceMappingURL=chunk-6IUAMO5M.js.map
+//# sourceMappingURL=chunk-NW5MCYOE.js.map

package/dist/{chunk-VIVM7X76.js → chunk-OZFXXGGZ.js}

@@ -1336,7 +1336,8 @@ var HostileInputFirewall = class {
       return err({
         code: "POLICY_REFUSED",
         message: `Refused by firewall policy: ${corroboration.actionType} lacks required corroboration \u2014 ${corroboration.missing.join("; ")}`,
-        stage: "corroboration"
+        stage: "corroboration",
+        missing: corroboration.missing
       });
     }
     return ok({
@@ -1344,6 +1345,7 @@ var HostileInputFirewall = class {
       satisfied: corroboration.satisfied,
       missing: corroboration.missing,
       corroboratingSources: corroboration.corroboratingSources,
+      clearedOnlyByUnverifiedSources: corroboration.clearedOnlyByUnverifiedSources,
       policyMode: this.policyMode,
       wouldRefuse: !corroboration.satisfied && this.policyMode === "audit"
     });
@@ -1565,6 +1567,7 @@ function getUntrustedInputFirewall() {
   singleton ??= new HostileInputFirewall({
     adapter: createGitHubAdapter(),
     contentDowngrade: false,
+    stages: { corroboration: true },
     ...configuredAuditLogger !== void 0 ? { auditLogger: configuredAuditLogger } : {}
   });
   return singleton;
@@ -1609,6 +1612,44 @@ function evaluateActionThroughFirewall(input, options) {
     wouldRefuse
   });
 }
+function validateActionCorroboration(action) {
+  const result = getUntrustedInputFirewall().validateAction(action);
+  if (!result.ok) {
+    const { code, stage, missing } = result.error;
+    if (code !== "POLICY_REFUSED" || stage !== "corroboration") return err(asError(result.error));
+    if (missing === void 0 || missing.length === 0) return err(asError(result.error));
+    logger4.warn("Untrusted-input firewall refused an uncorroborated action (enforce mode)", {
+      actionType: action.type,
+      stage,
+      missing
+    });
+    return ok({ refused: true, satisfied: false, stage, missing, policyMode: "enforce" });
+  }
+  const validation = result.value;
+  if (!validation.evaluated) {
+    return err(
+      new Error(
+        `Untrusted-input firewall did not evaluate corroboration for action ${action.type} (${validation.reason})`
+      )
+    );
+  }
+  if (validation.wouldRefuse) {
+    logger4.warn("Untrusted-input firewall would refuse under enforce (audit mode)", {
+      actionType: action.type,
+      stage: "corroboration",
+      missing: validation.missing
+    });
+  }
+  return ok({
+    refused: false,
+    satisfied: validation.satisfied,
+    missing: validation.missing,
+    corroboratingSources: validation.corroboratingSources,
+    clearedOnlyByUnverifiedSources: validation.clearedOnlyByUnverifiedSources,
+    policyMode: validation.policyMode,
+    wouldRefuse: validation.wouldRefuse
+  });
+}
 function processAndLog(input, options) {
   const result = getUntrustedInputFirewall().process(input, options);
   if (!result.ok) {
@@ -2038,9 +2079,17 @@ function describeAction(action) {
   }
 }
 function buildActionDetails(action, policy, corrob) {
+  const policyRules = policy.violations.map((violation) => violation.rule);
   return {
-    policyViolations: policy.violations.map((violation) => violation.rule),
-    missingCorroboration: corrob.missing,
+    ...corrob.refused ? {
+      policyViolations: [...policyRules, "INSUFFICIENT_CORROBORATION"],
+      missingCorroboration: corrob.missing,
+      refusedAtStage: corrob.stage
+    } : {
+      policyViolations: policyRules,
+      missingCorroboration: corrob.missing,
+      corroborationWouldRefuse: corrob.wouldRefuse
+    },
     ...action.type === "ClassifyIssue" && { category: action.category },
     ...action.type === "ProposeLabels" && { labels: action.labels }
   };
@@ -2051,17 +2100,29 @@ function validateActionsThroughFirewall(input, gate, actions, existingLabels) {
   for (const action of actions) {
     const decision = evaluateActionThroughFirewall(input, { ...gate, ...labels, action });
     if (!decision.ok) return decision;
-    const corrobResult = validateCorroboration(action);
+    const corroboration = validateActionCorroboration(action);
+    if (!corroboration.ok) return corroboration;
     proposed.push({
       type: action.type,
       description: describeAction(action),
-      policyApproved: decision.value.allowed,
-      corroborated: corrobResult.satisfied,
-      details: buildActionDetails(action, decision.value, corrobResult)
+      policyApproved: decision.value.allowed && !corroboration.value.refused,
+      corroborated: corroboration.value.satisfied,
+      details: buildActionDetails(action, decision.value, corroboration.value)
     });
   }
   return ok(proposed);
 }
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((v) => typeof v === "string");
+}
+function readActionRefusal(action) {
+  const { policyViolations, missingCorroboration, refusedAtStage } = action.details;
+  return {
+    policyViolations: isStringArray(policyViolations) ? policyViolations : [],
+    missingCorroboration: isStringArray(missingCorroboration) ? missingCorroboration : [],
+    ...refusedAtStage === "corroboration" ? { refusedAtStage } : {}
+  };
+}
 
 // src/dogfooding/issue-triage.ts
 var logger6 = createLogger({ component: "IssueTriage" });
@@ -2440,12 +2501,14 @@ export {
   configureUntrustedInputFirewall,
   runUntrustedInputFirewall,
   evaluateActionThroughFirewall,
+  validateActionCorroboration,
   firewallInputFor,
   parsePRUrl,
   GitHubReviewer,
   GitHubUserInfo,
   createFullGitHubProvider,
+  readActionRefusal,
   IssueTriage,
   createIssueTriage
 };
-//# sourceMappingURL=chunk-VIVM7X76.js.map
+//# sourceMappingURL=chunk-OZFXXGGZ.js.map