nexus-agents 8.77.0 → 8.78.1

package/dist/{chunk-VIVM7X76.js → chunk-OZFXXGGZ.js}

@@ -1336,7 +1336,8 @@ var HostileInputFirewall = class {
       return err({
         code: "POLICY_REFUSED",
         message: `Refused by firewall policy: ${corroboration.actionType} lacks required corroboration \u2014 ${corroboration.missing.join("; ")}`,
-        stage: "corroboration"
+        stage: "corroboration",
+        missing: corroboration.missing
       });
     }
     return ok({
@@ -1344,6 +1345,7 @@ var HostileInputFirewall = class {
       satisfied: corroboration.satisfied,
       missing: corroboration.missing,
       corroboratingSources: corroboration.corroboratingSources,
+      clearedOnlyByUnverifiedSources: corroboration.clearedOnlyByUnverifiedSources,
       policyMode: this.policyMode,
       wouldRefuse: !corroboration.satisfied && this.policyMode === "audit"
     });
@@ -1565,6 +1567,7 @@ function getUntrustedInputFirewall() {
   singleton ??= new HostileInputFirewall({
     adapter: createGitHubAdapter(),
     contentDowngrade: false,
+    stages: { corroboration: true },
     ...configuredAuditLogger !== void 0 ? { auditLogger: configuredAuditLogger } : {}
   });
   return singleton;
@@ -1609,6 +1612,44 @@ function evaluateActionThroughFirewall(input, options) {
     wouldRefuse
   });
 }
+function validateActionCorroboration(action) {
+  const result = getUntrustedInputFirewall().validateAction(action);
+  if (!result.ok) {
+    const { code, stage, missing } = result.error;
+    if (code !== "POLICY_REFUSED" || stage !== "corroboration") return err(asError(result.error));
+    if (missing === void 0 || missing.length === 0) return err(asError(result.error));
+    logger4.warn("Untrusted-input firewall refused an uncorroborated action (enforce mode)", {
+      actionType: action.type,
+      stage,
+      missing
+    });
+    return ok({ refused: true, satisfied: false, stage, missing, policyMode: "enforce" });
+  }
+  const validation = result.value;
+  if (!validation.evaluated) {
+    return err(
+      new Error(
+        `Untrusted-input firewall did not evaluate corroboration for action ${action.type} (${validation.reason})`
+      )
+    );
+  }
+  if (validation.wouldRefuse) {
+    logger4.warn("Untrusted-input firewall would refuse under enforce (audit mode)", {
+      actionType: action.type,
+      stage: "corroboration",
+      missing: validation.missing
+    });
+  }
+  return ok({
+    refused: false,
+    satisfied: validation.satisfied,
+    missing: validation.missing,
+    corroboratingSources: validation.corroboratingSources,
+    clearedOnlyByUnverifiedSources: validation.clearedOnlyByUnverifiedSources,
+    policyMode: validation.policyMode,
+    wouldRefuse: validation.wouldRefuse
+  });
+}
 function processAndLog(input, options) {
   const result = getUntrustedInputFirewall().process(input, options);
   if (!result.ok) {
@@ -2038,9 +2079,17 @@ function describeAction(action) {
   }
 }
 function buildActionDetails(action, policy, corrob) {
+  const policyRules = policy.violations.map((violation) => violation.rule);
   return {
-    policyViolations: policy.violations.map((violation) => violation.rule),
-    missingCorroboration: corrob.missing,
+    ...corrob.refused ? {
+      policyViolations: [...policyRules, "INSUFFICIENT_CORROBORATION"],
+      missingCorroboration: corrob.missing,
+      refusedAtStage: corrob.stage
+    } : {
+      policyViolations: policyRules,
+      missingCorroboration: corrob.missing,
+      corroborationWouldRefuse: corrob.wouldRefuse
+    },
     ...action.type === "ClassifyIssue" && { category: action.category },
     ...action.type === "ProposeLabels" && { labels: action.labels }
   };
@@ -2051,17 +2100,29 @@ function validateActionsThroughFirewall(input, gate, actions, existingLabels) {
   for (const action of actions) {
     const decision = evaluateActionThroughFirewall(input, { ...gate, ...labels, action });
     if (!decision.ok) return decision;
-    const corrobResult = validateCorroboration(action);
+    const corroboration = validateActionCorroboration(action);
+    if (!corroboration.ok) return corroboration;
     proposed.push({
       type: action.type,
       description: describeAction(action),
-      policyApproved: decision.value.allowed,
-      corroborated: corrobResult.satisfied,
-      details: buildActionDetails(action, decision.value, corrobResult)
+      policyApproved: decision.value.allowed && !corroboration.value.refused,
+      corroborated: corroboration.value.satisfied,
+      details: buildActionDetails(action, decision.value, corroboration.value)
     });
   }
   return ok(proposed);
 }
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((v) => typeof v === "string");
+}
+function readActionRefusal(action) {
+  const { policyViolations, missingCorroboration, refusedAtStage } = action.details;
+  return {
+    policyViolations: isStringArray(policyViolations) ? policyViolations : [],
+    missingCorroboration: isStringArray(missingCorroboration) ? missingCorroboration : [],
+    ...refusedAtStage === "corroboration" ? { refusedAtStage } : {}
+  };
+}
 
 // src/dogfooding/issue-triage.ts
 var logger6 = createLogger({ component: "IssueTriage" });
@@ -2440,12 +2501,14 @@ export {
   configureUntrustedInputFirewall,
   runUntrustedInputFirewall,
   evaluateActionThroughFirewall,
+  validateActionCorroboration,
   firewallInputFor,
   parsePRUrl,
   GitHubReviewer,
   GitHubUserInfo,
   createFullGitHubProvider,
+  readActionRefusal,
   IssueTriage,
   createIssueTriage
 };
-//# sourceMappingURL=chunk-VIVM7X76.js.map
+//# sourceMappingURL=chunk-OZFXXGGZ.js.map