nexus-agents 8.86.1 → 8.86.2

package/dist/{chunk-KIFNS4WI.js → chunk-5FXOJYDV.js}

@@ -25,10 +25,10 @@ import {
   toolSuccessStructured,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-Q7X4G7TZ.js";
+} from "./chunk-6K2JDJ7A.js";
 import {
   VERSION
-} from "./chunk-AVG6GVGP.js";
+} from "./chunk-NQKJYGND.js";
 import {
   UNRESOLVED_MODEL_ID,
   assessPanelIndependence,
@@ -9543,4 +9543,4 @@ export {
   CONSENSUS_VOTE_TOOL_SCHEMA,
   registerConsensusVoteTool
 };
-//# sourceMappingURL=chunk-KIFNS4WI.js.map
+//# sourceMappingURL=chunk-5FXOJYDV.js.map

package/dist/{chunk-Q7X4G7TZ.js → chunk-6K2JDJ7A.js}

@@ -1,6 +1,6 @@
 import {
   VERSION
-} from "./chunk-AVG6GVGP.js";
+} from "./chunk-NQKJYGND.js";
 import {
   sanitizeErrorDetails
 } from "./chunk-2NDA4DHW.js";
@@ -2342,4 +2342,4 @@ export {
   DEFAULT_CONSENSUS_CONFIG,
   ConsensusMetricsSchema
 };
-//# sourceMappingURL=chunk-Q7X4G7TZ.js.map
+//# sourceMappingURL=chunk-6K2JDJ7A.js.map

package/dist/{chunk-CK4HFCWY.js → chunk-EYBWZHGQ.js}

@@ -21,7 +21,7 @@ import {
 import {
   DEFAULT_TASK_TTL_MS,
   clampTaskTtl
-} from "./chunk-C2I4YWN5.js";
+} from "./chunk-YOQVGERU.js";
 import {
   executeExpert
 } from "./chunk-QCDYJYGB.js";
@@ -72,7 +72,7 @@ import {
   updateStage,
   withWarnings,
   writeJobCancelled
-} from "./chunk-KIFNS4WI.js";
+} from "./chunk-5FXOJYDV.js";
 import {
   allOf,
   anyOf
@@ -95,7 +95,7 @@ import {
 } from "./chunk-KXFPJOPL.js";
 import {
   withPrerequisite
-} from "./chunk-JRAIVGXS.js";
+} from "./chunk-O73BSBJ6.js";
 import {
   NOOP_NOTIFIER,
   RateLimiter,
@@ -120,7 +120,7 @@ import {
   toolSuccessStructured,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-Q7X4G7TZ.js";
+} from "./chunk-6K2JDJ7A.js";
 import {
   EventTopics,
   UNRESOLVED_MODEL_ID,
@@ -10911,8 +10911,8 @@ function chunkByDirectory(files, basePath) {
   const normalizedBase = basePath.endsWith("/") ? basePath : `${basePath}/`;
   const groups = /* @__PURE__ */ new Map();
   for (const file of files) {
-    const relative2 = file.startsWith(normalizedBase) ? file.slice(normalizedBase.length) : file;
-    const stripped = relative2.startsWith("/") ? relative2.slice(1) : relative2;
+    const relative3 = file.startsWith(normalizedBase) ? file.slice(normalizedBase.length) : file;
+    const stripped = relative3.startsWith("/") ? relative3.slice(1) : relative3;
     const topDir = stripped.split("/")[0] ?? "root";
     const existing = groups.get(topDir);
     if (existing !== void 0) {
@@ -44471,6 +44471,7 @@ var InMemoryAuditStorage = class {
 
 // src/audit/audit-storage.ts
 import * as fs5 from "node:fs";
+import * as os from "node:os";
 import * as path3 from "node:path";
 function validateLogDir(logDir, allowedRoot) {
   const resolvedRoot = path3.resolve(allowedRoot);
@@ -44499,19 +44500,27 @@ function validateLogDirBasic(logDir) {
     }
   }
   const resolved = path3.resolve(logDir);
-  const systemDirs = ["/etc", "/var", "/usr", "/bin", "/sbin", "/root", "/proc", "/sys"];
-  for (const sysDir of systemDirs) {
-    if (resolved === sysDir || resolved.startsWith(sysDir + path3.sep)) {
-      return {
-        ok: false,
-        error: new SecurityError("logDir cannot be a system directory", {
-          context: { logDir, resolved }
-        })
-      };
-    }
+  if (isRefusedSystemPath(resolved, path3.resolve(os.homedir()))) {
+    return {
+      ok: false,
+      error: new SecurityError("logDir cannot be a system directory", {
+        context: { logDir, resolved }
+      })
+    };
   }
   return { ok: true, value: resolved };
 }
+var ALWAYS_REFUSED_DIRS = ["/etc", "/usr", "/bin", "/sbin", "/proc", "/sys"];
+var REFUSED_OUTSIDE_HOME_DIRS = ["/root", "/var"];
+function isWithin(child, parent) {
+  const rel = path3.relative(parent, child);
+  return rel === "" || rel !== ".." && !rel.startsWith(".." + path3.sep) && !path3.isAbsolute(rel);
+}
+function isRefusedSystemPath(resolved, home) {
+  if (ALWAYS_REFUSED_DIRS.some((dir) => isWithin(resolved, dir))) return true;
+  const homeGrants = home !== path3.parse(home).root && isWithin(resolved, home);
+  return REFUSED_OUTSIDE_HOME_DIRS.some((dir) => isWithin(resolved, dir)) && !homeGrants;
+}
 var FileAuditStorage = class _FileAuditStorage {
   logDir;
   filePrefix;
@@ -46136,7 +46145,7 @@ function buildVotingInput(plan, config) {
 }
 async function executeSingleVote(plan, config, log) {
   try {
-    const { executeVoting } = await import("./consensus-vote-G46TEZNQ.js");
+    const { executeVoting } = await import("./consensus-vote-63FZ6VV5.js");
     const input = buildVotingInput(plan, config);
     const result = await executeVoting(input, log);
     return parseVotingResult(result);
@@ -47059,7 +47068,7 @@ function createVoteStage({ config, startStage }) {
     const strategy = config.votingStrategy ?? "higher_order";
     await postProgress(config, "Vote", `Running consensus with ${strategy} strategy...`);
     try {
-      const { executeVoting } = await import("./consensus-vote-G46TEZNQ.js");
+      const { executeVoting } = await import("./consensus-vote-63FZ6VV5.js");
       const votingResult = await executeVoting(
         {
           proposal: buildVoteProposal(plan, research),
@@ -48727,7 +48736,7 @@ function reviewedDiffWasTruncated(diff) {
 
 // src/audit/pr-review-record-store.ts
 import { appendFileSync as appendFileSync3, existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync8 } from "node:fs";
-import { dirname as dirname3, isAbsolute, join as join11, resolve as resolve12 } from "node:path";
+import { dirname as dirname3, isAbsolute as isAbsolute2, join as join11, resolve as resolve12 } from "node:path";
 
 // src/audit/pr-review-record.ts
 import * as crypto3 from "node:crypto";
@@ -49061,7 +49070,7 @@ function buildPrReviewRecord(input) {
 function resolvePrReviewRecordsPath(repoPathOverride) {
   const envPath = process.env[PR_REVIEW_RECORDS_PATH_ENV];
   if (envPath !== void 0 && envPath.trim() !== "") {
-    return isAbsolute(envPath) ? envPath : resolve12(envPath);
+    return isAbsolute2(envPath) ? envPath : resolve12(envPath);
   }
   if (repoPathOverride !== void 0 && repoPathOverride.trim() !== "") {
     const overrideRoot = findRepoRoot(repoPathOverride);
@@ -56510,4 +56519,4 @@ export {
   startPipelineEventBridge,
   shutdownPipelineEventBridge
 };
-//# sourceMappingURL=chunk-CK4HFCWY.js.map
+//# sourceMappingURL=chunk-EYBWZHGQ.js.map