nexus-agents 10.1.0 → 10.2.0

package/dist/{chunk-M4IJ3H6M.js → chunk-PXYSAG5B.js}

@@ -1,6 +1,6 @@
 import {
   getErrorMessage
-} from "./chunk-WI73OZAU.js";
+} from "./chunk-WKFPKPEM.js";
 
 // src/cli/setup-config.ts
 import { copyFileSync, existsSync, mkdirSync, writeFileSync } from "node:fs";
@@ -77,4 +77,4 @@ function ensureBackup(outputPath) {
 export {
   runConfigInitSync
 };
-//# sourceMappingURL=chunk-M4IJ3H6M.js.map
+//# sourceMappingURL=chunk-PXYSAG5B.js.map

package/dist/{chunk-52Q72CPP.js → chunk-QG3VDSWD.js}

@@ -4,7 +4,7 @@ import {
 import {
   assessReputation,
   sanitizeInput
-} from "./chunk-MYM2TPNL.js";
+} from "./chunk-V26YQQK4.js";
 import {
   allOf
 } from "./chunk-EZNIYU5T.js";
@@ -13,7 +13,7 @@ import {
   err,
   getTimeProvider,
   ok
-} from "./chunk-WI73OZAU.js";
+} from "./chunk-WKFPKPEM.js";
 
 // src/dogfooding/pr-reviewer-helpers.ts
 import { randomUUID } from "node:crypto";
@@ -477,4 +477,4 @@ export {
   createFailedReview,
   reviewPostingBlock
 };
-//# sourceMappingURL=chunk-52Q72CPP.js.map
+//# sourceMappingURL=chunk-QG3VDSWD.js.map

package/dist/{chunk-IRFKJ2KR.js → chunk-QM5W3T3O.js}

@@ -1,6 +1,6 @@
 import {
   redactCredentialShapes
-} from "./chunk-WI73OZAU.js";
+} from "./chunk-WKFPKPEM.js";
 
 // src/security/output-sanitizer.ts
 var REDACTED_KEY_PLACEHOLDER = "[REDACTED_KEY]";
@@ -54,4 +54,4 @@ export {
   sanitizeErrorDetails,
   sanitizeStringLeaves
 };
-//# sourceMappingURL=chunk-IRFKJ2KR.js.map
+//# sourceMappingURL=chunk-QM5W3T3O.js.map

package/dist/{chunk-O3VPGING.js → chunk-QRC3QLUQ.js}

@@ -2,7 +2,7 @@ import {
   ensureGatewayDiscovered,
   gatewayDiscoveryStatus,
   getAvailabilityCache
-} from "./chunk-QPU7QKPT.js";
+} from "./chunk-LXYT2P2Y.js";
 import {
   extractSystemPrompt
 } from "./chunk-QZUG667L.js";
@@ -15,23 +15,23 @@ import {
 import {
   AdapterModelError,
   BaseAdapter,
+  createOpenAICompatClient,
   createStream,
-  gatewayAiSdkOptions,
   planOptionalParams,
   readGatewayTransport,
+  readOpenAICompatEnv,
   requireApiKey,
   validateApiKeyPresence,
+  validateOpenAICompatBaseUrl,
   withGatewayUsageRecording
-} from "./chunk-K6M2ZWX5.js";
+} from "./chunk-KLSNDPU6.js";
 import {
-  assertCustomApiHostResolvesPublic,
   hostnameOf,
   readCustomApiSurface,
   readDirectOpenAiSurface,
   readGatewayEnv,
-  redactApiKey,
-  validateCustomApiBaseUrl
-} from "./chunk-BK6Q3VQK.js";
+  redactApiKey
+} from "./chunk-KASBBKAQ.js";
 import {
   probeCli
 } from "./chunk-TW6PJYTP.js";
@@ -46,13 +46,13 @@ import {
   getTimeoutForTask,
   listModelsForCli,
   spawnCwd
-} from "./chunk-NUXSGWDS.js";
+} from "./chunk-23QA6GQD.js";
 import {
   getCliCircuitBreakerSnapshot
-} from "./chunk-VHOOJ4FG.js";
+} from "./chunk-SX2XWCGA.js";
 import {
   sanitizeOutput
-} from "./chunk-IRFKJ2KR.js";
+} from "./chunk-QM5W3T3O.js";
 import {
   CliCircuitBreaker,
   DEFAULT_CIRCUIT_BREAKER_CONFIG,
@@ -106,7 +106,7 @@ import {
   unenforcedAccessModeRefusal,
   warnIfGatewayCostUndeclared,
   withEnforcedAccessMode
-} from "./chunk-WI73OZAU.js";
+} from "./chunk-WKFPKPEM.js";
 import {
   CLI_NAMES,
   CLI_SUBPROCESS_TIMEOUTS,
@@ -761,7 +761,6 @@ function modelOnSurface(provider, surface, modelId) {
   return build(modelId);
 }
 function apiSurfaceFor(providerId) {
-  if (providerId === "custom-openai") return readCustomApiSurface();
   if (providerId === "openai") return readDirectOpenAiSurface();
   return void 0;
 }
@@ -813,12 +812,19 @@ function resolveApiKey(providerId, configKey) {
   if (providerId === "custom-openai") return readGatewayEnv().apiKey;
   return process.env[PROVIDER_ENV_KEYS[providerId]];
 }
-function resolveAndValidateCustomBaseUrl(config) {
+function gatewayConfigFor(config, apiKey, logger5) {
   if (config.providerId !== "custom-openai") return void 0;
-  const raw = config.baseUrl ?? readGatewayEnv().baseUrl;
-  const validated = validateCustomApiBaseUrl(raw);
-  if (!validated.ok) throw validated.error;
-  return validated.value.toString();
+  const baseUrl = validateOpenAICompatBaseUrl(config.baseUrl ?? readGatewayEnv().baseUrl);
+  return {
+    baseUrl,
+    apiKey: apiKey ?? "",
+    logger: logger5,
+    omitDefaultTokenCap: true,
+    ...readGatewayTransport(baseUrl, process.env, logger5),
+    apiSurface: readCustomApiSurface(),
+    ...config.timeout !== void 0 && { timeout: config.timeout },
+    ...config.maxRetries !== void 0 && { maxRetries: config.maxRetries }
+  };
 }
 function mapFinishReason(reason) {
   switch (reason) {
@@ -885,22 +891,16 @@ var SdkAdapter = class extends BaseAdapter {
   model;
   sdkFunctions;
   sdkConfig;
-  /** Validated base URL for custom-openai provider; undefined for built-ins. */
-  customBaseUrl;
+  /** Compatibility-only custom provider delegates to the canonical gateway client. */
+  gatewayConfig;
+  gatewayAdapter;
   /**
-   * OpenAI API surface: always set for custom-openai (#6645); for the direct
-   * `openai` provider only when `OPENAI_BASE_URL` names a non-OpenAI host
+   * OpenAI API surface: for the direct `openai` provider only when `OPENAI_BASE_URL` names a non-OpenAI host
    * (#6654). `undefined` keeps the provider's default surface.
    */
   apiSurface;
   /** Inflight init promise for coalescing concurrent calls (Issue #1438). */
   initPromise;
-  /**
-   * Cached result of the DNS-resolve-time SSRF check for custom-openai
-   * (#3426). Resolved once on first init so we don't re-resolve the gateway
-   * hostname on every request. `undefined` until the check has run.
-   */
-  resolveSsrfChecked = false;
   constructor(config, logger5) {
     const apiKey = resolveApiKey(config.providerId, config.apiKey);
     super({
@@ -914,9 +914,22 @@ var SdkAdapter = class extends BaseAdapter {
     });
     this.sdkProviderId = config.providerId;
     this.sdkConfig = config;
-    this.customBaseUrl = resolveAndValidateCustomBaseUrl(config);
+    this.gatewayConfig = gatewayConfigFor(config, apiKey, this.logger);
     this.apiSurface = apiSurfaceFor(config.providerId);
   }
+  /** Lazily acquire the B client, preserving missing-key failure at first use. */
+  resolveGatewayAdapter() {
+    if (this.gatewayConfig === void 0) return void 0;
+    if (this.gatewayAdapter !== void 0) return this.gatewayAdapter;
+    const apiKey = resolveApiKey(this.sdkConfig.providerId, this.sdkConfig.apiKey);
+    if (apiKey === void 0) {
+      throw new AdapterModelError(`No API key for ${this.sdkConfig.providerId}`, {
+        code: ErrorCode.CONFIG_INVALID
+      });
+    }
+    this.gatewayAdapter = createOpenAICompatClient(this.modelId, { ...this.gatewayConfig, apiKey });
+    return this.gatewayAdapter;
+  }
   /**
    * Lazily initialize the AI SDK model and functions.
    * This allows the adapter to be created without the AI SDK installed,
@@ -936,38 +949,17 @@ var SdkAdapter = class extends BaseAdapter {
     }
   }
   async doInitialize() {
-    const apiKey = resolveApiKey(this.sdkProviderId, this.sdkConfig.apiKey);
+    const apiKey = resolveApiKey(this.sdkConfig.providerId, this.sdkConfig.apiKey);
     if (apiKey === void 0) {
       throw new AdapterModelError(`No API key for ${this.sdkProviderId}`, {
         code: ErrorCode.CONFIG_INVALID
       });
     }
-    await this.ensureCustomHostResolvesPublic();
     const providerModule = await this.loadProvider(apiKey);
     this.model = providerModule.model;
     const aiModule = await import("ai");
     this.sdkFunctions = extractAiSdkFunctions(aiModule);
   }
-  /**
-   * For custom-openai only: run the DNS-resolve-time SSRF check exactly once
-   * and throw if the gateway hostname resolves to a private address (#3426).
-   * Cached via `resolveSsrfChecked` so the hostname is not re-resolved on
-   * every request. No-op for non-custom providers (built-in endpoints are
-   * trusted) and when no custom base URL is configured.
-   */
-  async ensureCustomHostResolvesPublic() {
-    if (this.resolveSsrfChecked) return;
-    if (this.sdkProviderId !== "custom-openai" || this.customBaseUrl === void 0) {
-      this.resolveSsrfChecked = true;
-      return;
-    }
-    const hostname = new URL(this.customBaseUrl).hostname;
-    const result = await assertCustomApiHostResolvesPublic(hostname);
-    if (!result.ok) {
-      throw result.error;
-    }
-    this.resolveSsrfChecked = true;
-  }
   /**
    * Loads the provider-specific AI SDK module.
    *
@@ -977,6 +969,10 @@ var SdkAdapter = class extends BaseAdapter {
    */
   async loadProvider(apiKey) {
     switch (this.sdkProviderId) {
+      case "custom-openai":
+        throw new AdapterModelError("custom-openai must use the gateway HTTP adapter", {
+          code: ErrorCode.CONFIG_INVALID
+        });
       case "anthropic": {
         const mod = await import("@ai-sdk/anthropic");
         const factory = extractProviderFactory(mod, "createAnthropic");
@@ -996,20 +992,6 @@ var SdkAdapter = class extends BaseAdapter {
         const provider = factory({ apiKey });
         return { model: provider(this.modelId) };
       }
-      case "custom-openai": {
-        const mod = await import("@ai-sdk/openai");
-        const factory = extractProviderFactory(mod, "createOpenAI");
-        const opts = { apiKey };
-        if (this.customBaseUrl !== void 0) {
-          opts["baseURL"] = this.customBaseUrl;
-          const transport = readGatewayTransport(this.customBaseUrl, process.env, this.logger);
-          Object.assign(opts, gatewayAiSdkOptions({ ...transport, apiKey }));
-        }
-        const provider = factory(opts);
-        return {
-          model: modelOnSurface(provider, this.apiSurface ?? "chat", this.modelId)
-        };
-      }
     }
   }
   /**
@@ -1093,6 +1075,8 @@ var SdkAdapter = class extends BaseAdapter {
   }
   async complete(request) {
     try {
+      const gateway = this.resolveGatewayAdapter();
+      if (gateway !== void 0) return await gateway.complete(request);
       await this.ensureInitialized();
       this.logRequest(request);
       const sdk = this.sdkFunctions;
@@ -1113,6 +1097,11 @@ var SdkAdapter = class extends BaseAdapter {
     }
   }
   async *stream(request) {
+    const gateway = this.resolveGatewayAdapter();
+    if (gateway !== void 0) {
+      yield* gateway.stream(request);
+      return;
+    }
     await this.ensureInitialized();
     this.logRequest(request);
     const sdk = this.sdkFunctions;
@@ -1153,19 +1142,22 @@ var SdkAdapter = class extends BaseAdapter {
    */
   toErrorResult(error, code) {
     if (error instanceof ModelError) {
-      this.logger.error(`SDK adapter error (${this.sdkProviderId})`, error);
+      this.logger.error(`SDK adapter error (${this.sdkConfig.providerId})`, error);
       return { ok: false, error };
     }
-    const apiKey = resolveApiKey(this.sdkProviderId, this.sdkConfig.apiKey);
+    const apiKey = resolveApiKey(this.sdkConfig.providerId, this.sdkConfig.apiKey);
     const safeMessage = sanitizeOutput(redactApiKey(getErrorMessage(error), apiKey));
     const errorObj = new Error(safeMessage);
     if (error instanceof Error) errorObj.name = error.name;
-    this.logger.error(`SDK adapter error (${this.sdkProviderId})`, errorObj);
+    this.logger.error(`SDK adapter error (${this.sdkConfig.providerId})`, errorObj);
     const retryAfterMs = code === ErrorCode.MODEL_RATE_LIMITED ? resolveRetryAfterMs(error, safeMessage) : void 0;
-    const modelError = new AdapterModelError(`${this.sdkProviderId} SDK error: ${safeMessage}`, {
-      code,
-      ...retryAfterMs !== void 0 ? { context: { [RETRY_AFTER_CONTEXT_KEY]: retryAfterMs } } : {}
-    });
+    const modelError = new AdapterModelError(
+      `${this.sdkConfig.providerId} SDK error: ${safeMessage}`,
+      {
+        code,
+        ...retryAfterMs !== void 0 ? { context: { [RETRY_AFTER_CONTEXT_KEY]: retryAfterMs } } : {}
+      }
+    );
     return { ok: false, error: modelError };
   }
 };
@@ -1309,25 +1301,22 @@ function tryCustomOpenAiAdapter(logger5) {
   if (customKey === void 0 || customBaseUrl === void 0) return null;
   const choice = customModelChoice(logger5);
   if (choice === null) return null;
-  const { modelId: customModelId, note } = choice;
+  const { adapter, note } = choice;
+  const customModelId = adapter.modelId;
   const modelVerified = choice.modelVerified;
   const host = hostnameOf(customBaseUrl);
-  logger5.info("Using custom-openai SDK adapter", { model: customModelId, host });
-  const adapter = new SdkAdapter(
-    {
-      providerId: "custom-openai",
-      modelId: customModelId,
-      apiKey: customKey,
-      baseUrl: customBaseUrl
-    },
-    logger5
-  );
+  logger5.info("Using custom-openai gateway alias", { model: customModelId, host });
   return {
     // Snapshot the selection on the call's adapter, rather than reading the
     // resilient proxy's mutable health after a refresh/failover (#6862).
     // Always wrapped, so pricing never depends on whether discovery measured
     // the choice: every custom-openai call is priced by the gateway declaration.
-    adapter: withGatewayUsageRecording(adapter, "api:custom-openai", modelVerified),
+    adapter: withGatewayUsageRecording(
+      adapter,
+      "api:custom-openai",
+      modelVerified,
+      "sdk-custom-openai"
+    ),
     source: "api",
     name: "custom-openai",
     reason: `Using custom OpenAI-compatible gateway at ${host} (model: ${customModelId}${note})`,
@@ -1336,23 +1325,31 @@ function tryCustomOpenAiAdapter(logger5) {
 }
 function customModelChoice(logger5) {
   const d = resolveGatewayDefault(process.env, logger5);
-  if (d.kind === "inactive") {
-    const modelId = process.env["NEXUS_CUSTOM_MODEL"] ?? CUSTOM_API_DEFAULT_MODEL;
-    if (gatewayDiscoveryStatus() !== "failed") return { modelId, note: "" };
-    logger5.warn(
-      `Gateway discovery failed, so the custom-openai model '${modelId}' is sent unverified; set NEXUS_CUSTOM_MODEL to a model the gateway serves, or run \`nexus-agents doctor --gateway\``,
-      { model: modelId }
-    );
-    return { modelId, note: "; unverified: gateway discovery failed", modelVerified: false };
+  if (d.kind === "unavailable") {
+    logger5.warn("Gateway catalogue has no chat model; the custom-openai default is unavailable");
+    return null;
   }
+  const config = readOpenAICompatEnv();
+  if (config === null) return null;
+  const modelId = d.kind === "resolved" ? d.adapter.modelId : process.env["NEXUS_CUSTOM_MODEL"] ?? CUSTOM_API_DEFAULT_MODEL;
+  const adapter = createOpenAICompatClient(modelId, {
+    ...config,
+    logger: logger5,
+    apiSurface: readCustomApiSurface(),
+    omitDefaultTokenCap: true
+  });
   if (d.kind === "resolved")
     return {
-      modelId: d.adapter.modelId,
+      adapter,
       note: `; gateway default by ${d.via}`,
       modelVerified: true
     };
-  logger5.warn("Gateway catalogue has no chat model; the custom-openai default is unavailable");
-  return null;
+  if (gatewayDiscoveryStatus() !== "failed") return { adapter, note: "" };
+  logger5.warn(
+    `Gateway discovery failed, so the custom-openai model '${modelId}' is sent unverified; set NEXUS_CUSTOM_MODEL to a model the gateway serves, or run \`nexus-agents doctor --gateway\``,
+    { model: modelId }
+  );
+  return { adapter, note: "; unverified: gateway discovery failed", modelVerified: false };
 }
 
 // src/adapters/auto-adapter.ts
@@ -4127,4 +4124,4 @@ export {
   SdkAdapter,
   createAutoAdapter
 };
-//# sourceMappingURL=chunk-O3VPGING.js.map
+//# sourceMappingURL=chunk-QRC3QLUQ.js.map