nexus-agents 11.5.5 → 11.5.7

package/dist/{ast-rule-runner-CVDVRVAS.js → ast-rule-runner-TY2DZJBQ.js}

@@ -9,11 +9,11 @@ import {
   getBuiltInAstRulesPath,
   loadRules,
   runAstQaRules
-} from "./chunk-GW35PEDO.js";
-import "./chunk-6V4ERXGA.js";
+} from "./chunk-BIJRNGI4.js";
+import "./chunk-3DTEV3ZW.js";
 import "./chunk-XBEKMUTO.js";
-import "./chunk-3VH6RBVJ.js";
-import "./chunk-TNZSALI4.js";
+import "./chunk-XT4BDCNW.js";
+import "./chunk-53J7YO4O.js";
 import "./chunk-CBN5IKTG.js";
 import "./chunk-UFAK5UGH.js";
 import "./chunk-GR6WCJWY.js";
@@ -34,4 +34,4 @@ export {
   loadRules,
   runAstQaRules
 };
-//# sourceMappingURL=ast-rule-runner-CVDVRVAS.js.map
+//# sourceMappingURL=ast-rule-runner-TY2DZJBQ.js.map

package/dist/{child-mcp-config-H5G3DK7S.js → child-mcp-config-YKGYKLE4.js}

@@ -1,10 +1,10 @@
 import {
   nexusMkdtempSync
 } from "./chunk-CBDUTJJC.js";
-import "./chunk-6V4ERXGA.js";
+import "./chunk-3DTEV3ZW.js";
 import "./chunk-XBEKMUTO.js";
-import "./chunk-3VH6RBVJ.js";
-import "./chunk-TNZSALI4.js";
+import "./chunk-XT4BDCNW.js";
+import "./chunk-53J7YO4O.js";
 import "./chunk-CBN5IKTG.js";
 import "./chunk-UFAK5UGH.js";
 import {
@@ -81,4 +81,4 @@ async function generateMcpConfig(options) {
 export {
   generateMcpConfig
 };
-//# sourceMappingURL=child-mcp-config-H5G3DK7S.js.map
+//# sourceMappingURL=child-mcp-config-YKGYKLE4.js.map

package/dist/{chunk-PY6GUS22.js → chunk-2GXAL4WV.js}

@@ -5,7 +5,7 @@ import {
   err,
   getErrorMessage,
   ok
-} from "./chunk-6V4ERXGA.js";
+} from "./chunk-3DTEV3ZW.js";
 import {
   createLogger,
   getTimeProvider
@@ -376,4 +376,4 @@ export {
   SessionMemory,
   createSessionMemory
 };
-//# sourceMappingURL=chunk-PY6GUS22.js.map
+//# sourceMappingURL=chunk-2GXAL4WV.js.map

package/dist/chunk-3665PYSK.js

@@ -0,0 +1,118 @@
+import {
+  redactCredentialShapes
+} from "./chunk-GR6WCJWY.js";
+
+// src/security/output-sanitizer.ts
+var REDACTED_KEY_PLACEHOLDER = "[REDACTED_KEY]";
+function sanitizeOutput(text, placeholder = REDACTED_KEY_PLACEHOLDER) {
+  if (text === "") return text;
+  return redactCredentialShapes(text, placeholder);
+}
+function isJsonDocument(text) {
+  if (!/^\s*[[{"]/.test(text)) return false;
+  try {
+    JSON.parse(text);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function contextValueEnd(text, start, query, json) {
+  let end = start;
+  while (end < text.length) {
+    const char = text[end] ?? "";
+    if (/\s/.test(char) || query && char === "&") break;
+    if (json && char === '"') break;
+    if (json && char === "\\") end++;
+    end++;
+  }
+  return Math.min(end, text.length);
+}
+var SEMGREP_FINDING_LOCATION = /^[\w./@+-]+:\d+(?![\w.])/;
+function isSemgrepRuleId(text, start, valueStart) {
+  const scannerStart = text.lastIndexOf("semgrep:", start);
+  if (scannerStart < 0) return false;
+  const rule = text.slice(scannerStart, start);
+  if (!/^semgrep:(?:[\w.-]*[._-])?generic-$/i.test(rule)) return false;
+  return SEMGREP_FINDING_LOCATION.test(text.slice(valueStart, valueStart + 4096));
+}
+function redactContextValues(text, rule, placeholder, json) {
+  let result = "";
+  let copiedUntil = 0;
+  for (const match of text.matchAll(rule.prefixes)) {
+    if (match.index < copiedUntil) continue;
+    const quote = match.groups?.["q"] ?? "";
+    const keyEnd = match.index + match[0].length - quote.length;
+    if (match[0].toLowerCase() === "secret:" && isSemgrepRuleId(text, match.index, keyEnd)) {
+      continue;
+    }
+    const start = json && quote !== '"' ? keyEnd + quote.length : keyEnd;
+    const end = contextValueEnd(text, start, rule.query === true, json);
+    if (end - start < rule.minimumLength) continue;
+    result += text.slice(copiedUntil, start) + placeholder;
+    copiedUntil = end;
+  }
+  return result + text.slice(copiedUntil);
+}
+var BEARER_HEADER_RULE = {
+  prefixes: /authorization:\s*bearer\s+(?<q>\\?["'])?/gi,
+  minimumLength: 1
+};
+var BASIC_HEADER_RULE = {
+  prefixes: /authorization:\s*basic\s+(?<q>\\?["'])?/gi,
+  minimumLength: 1
+};
+var ASSIGNMENT_RULE = {
+  prefixes: /\b(?:password|passwd|secret)\s*[=:]\s*(?<q>\\?["'])?/gi,
+  minimumLength: 4
+};
+var QUERY_RULE = {
+  prefixes: /[?&](?:api[_-]?key|token|access[_-]?token|secret|password|prompt|system_prompt|user_prompt)=/gi,
+  minimumLength: 1,
+  query: true
+};
+function sanitizeErrorDetails(text, apiKey, placeholder = REDACTED_KEY_PLACEHOLDER) {
+  if (text === "") return "";
+  let result = text;
+  if (apiKey !== void 0 && apiKey.trim() !== "") {
+    result = result.replaceAll(apiKey.trim(), placeholder);
+  }
+  result = sanitizeOutput(result, placeholder);
+  const json = isJsonDocument(result);
+  result = redactContextValues(result, BEARER_HEADER_RULE, placeholder, json);
+  result = redactContextValues(result, BASIC_HEADER_RULE, placeholder, json);
+  result = result.replace(/(bearer\s+)[A-Za-z0-9._~+/-]+=*/gi, `$1${placeholder}`);
+  result = redactContextValues(result, ASSIGNMENT_RULE, placeholder, json);
+  result = redactContextValues(result, QUERY_RULE, placeholder, json);
+  result = result.replace(
+    /"(api[_-]?key|access[_-]?token|token|secret|password|prompt|system_prompt|user_prompt)"\s*:\s*"(?:[^"\\]|\\.)*"/gi,
+    `"$1": "${placeholder}"`
+  );
+  return result;
+}
+function serializedForm(value) {
+  if (typeof value !== "object" || value === null) return value;
+  const toJSON = value.toJSON;
+  return typeof toJSON === "function" ? toJSON.call(value) : value;
+}
+function sanitizeStringLeaves(input, sanitize) {
+  const value = serializedForm(input);
+  if (typeof value === "string") return sanitize(value);
+  if (Array.isArray(value)) return value.map((item) => sanitizeStringLeaves(item, sanitize));
+  if (typeof value === "object" && value !== null) {
+    const copy = {};
+    for (const [key, entry] of Object.entries(value)) {
+      copy[key] = sanitizeStringLeaves(entry, sanitize);
+    }
+    return copy;
+  }
+  return value;
+}
+
+export {
+  REDACTED_KEY_PLACEHOLDER,
+  sanitizeOutput,
+  sanitizeErrorDetails,
+  sanitizeStringLeaves
+};
+//# sourceMappingURL=chunk-3665PYSK.js.map

package/dist/chunk-3665PYSK.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/security/output-sanitizer.ts"],"sourcesContent":["/**\n * nexus-agents/security - Output Sanitizer\n *\n * Redacts API keys and tokens from CLI subprocess stdout/stderr\n * before the output is returned, logged, or traced.\n *\n * @module security/output-sanitizer\n * (Source: Issue #1597 — subprocess output scrubbing gap)\n */\n\nimport { redactCredentialShapes } from '../core/credential-patterns.js';\n\n/** Placeholder text that replaces redacted keys. */\nexport const REDACTED_KEY_PLACEHOLDER = '[REDACTED_KEY]';\n\n/**\n * Redacts known API key patterns from a string: the shared credential-shape\n * set (`core/credential-patterns`, #6753) and URL userinfo. Context rules\n * (Authorization headers, `password=`, query and JSON fields) are NOT applied\n * here — subprocess output is prose, where they misfire (`bearer\\s+` takes\n * \"the bearer of\"); they are the local\n * extension {@link sanitizeErrorDetails} adds for upstream error bodies.\n *\n * Designed to be called on subprocess stdout/stderr before the output\n * is returned to callers, written to logs, or included in trace data.\n *\n * @param text - Raw subprocess output\n * @param placeholder - Replacement placeholder (default: [REDACTED_KEY])\n * @returns The same text with API keys replaced by placeholder\n */\nexport function sanitizeOutput(\n  text: string,\n  placeholder: string = REDACTED_KEY_PLACEHOLDER\n): string {\n  if (text === '') return text;\n\n  return redactCredentialShapes(text, placeholder);\n}\n\n/**\n * Whether `text` is one JSON document. Every context-rule prefix starts with a\n * letter, and in a JSON document letters occur only inside string literals, so\n * this one test places every match inside a JSON string.\n */\nfunction isJsonDocument(text: string): boolean {\n  if (!/^\\s*[[{\"]/.test(text)) return false;\n  try {\n    JSON.parse(text);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * End of a context value. Plain text keeps the pre-#7296 extent: the whole\n * non-whitespace run (`&`-bounded for a query value). Inside a JSON string the\n * value also ends at the unescaped `\"` that closes the string, and an escape is\n * consumed as an indivisible pair, so the redaction never splits one (#7296).\n */\nfunction contextValueEnd(text: string, start: number, query: boolean, json: boolean): number {\n  let end = start;\n  while (end < text.length) {\n    const char = text[end] ?? '';\n    if (/\\s/.test(char) || (query && char === '&')) break;\n    if (json && char === '\"') break;\n    if (json && char === '\\\\') end++;\n    end++;\n  }\n  return Math.min(end, text.length);\n}\n\n/** `file:line` straight after a rule id's `secret:`, as `sarif-parser` builds finding ids. */\nconst SEMGREP_FINDING_LOCATION = /^[\\w./@+-]+:\\d+(?![\\w.])/;\n\n/**\n * A semgrep finding id (`semgrep:<rule>generic-secret:<file>:<line>`) rather than a\n * `generic-secret:` assignment. `start` indexes the `secret` keyword; `valueStart`\n * the character after its colon. The rule must be dotted/dashed identifier text and\n * the colon must be followed, without whitespace, by a `file:line` location.\n */\nfunction isSemgrepRuleId(text: string, start: number, valueStart: number): boolean {\n  const scannerStart = text.lastIndexOf('semgrep:', start);\n  if (scannerStart < 0) return false;\n  const rule = text.slice(scannerStart, start);\n  if (!/^semgrep:(?:[\\w.-]*[._-])?generic-$/i.test(rule)) return false;\n  return SEMGREP_FINDING_LOCATION.test(text.slice(valueStart, valueStart + 4096));\n}\n\ninterface ContextRule {\n  /** Matches the key and separator; named group `q` is an optional opening quote. */\n  readonly prefixes: RegExp;\n  readonly minimumLength: number;\n  readonly query?: boolean;\n}\n\n/** Redact only value spans; scanning avoids regex stack growth on large outputs. */\nfunction redactContextValues(\n  text: string,\n  rule: ContextRule,\n  placeholder: string,\n  json: boolean\n): string {\n  let result = '';\n  let copiedUntil = 0;\n  for (const match of text.matchAll(rule.prefixes)) {\n    if (match.index < copiedUntil) continue;\n    const quote = match.groups?.['q'] ?? '';\n    const keyEnd = match.index + match[0].length - quote.length;\n    if (match[0].toLowerCase() === 'secret:' && isSemgrepRuleId(text, match.index, keyEnd)) {\n      continue;\n    }\n    // Plain text: the quote is part of the value, as before #7296. JSON: an escaped\n    // or single quote opens the value; a bare `\"` closes the string and is never taken.\n    const start = json && quote !== '\"' ? keyEnd + quote.length : keyEnd;\n    const end = contextValueEnd(text, start, rule.query === true, json);\n    if (end - start < rule.minimumLength) continue;\n    result += text.slice(copiedUntil, start) + placeholder;\n    copiedUntil = end;\n  }\n  return result + text.slice(copiedUntil);\n}\n\n// Bearer and Basic stay separate passes, as before #7296: a value one consumes can hold the other.\nconst BEARER_HEADER_RULE: ContextRule = {\n  prefixes: /authorization:\\s*bearer\\s+(?<q>\\\\?[\"'])?/gi,\n  minimumLength: 1,\n};\nconst BASIC_HEADER_RULE: ContextRule = {\n  prefixes: /authorization:\\s*basic\\s+(?<q>\\\\?[\"'])?/gi,\n  minimumLength: 1,\n};\nconst ASSIGNMENT_RULE: ContextRule = {\n  prefixes: /\\b(?:password|passwd|secret)\\s*[=:]\\s*(?<q>\\\\?[\"'])?/gi,\n  minimumLength: 4,\n};\nconst QUERY_RULE: ContextRule = {\n  prefixes:\n    /[?&](?:api[_-]?key|token|access[_-]?token|secret|password|prompt|system_prompt|user_prompt)=/gi,\n  minimumLength: 1,\n  query: true,\n};\n\n/**\n * Redacts credentials (API keys, authorization headers, Bearer tokens, URL credentials,\n * and sensitive JSON fields) from error messages and response bodies.\n *\n * Designed to be called on upstream API error representations before they are\n * attached to error envelopes, logged, or returned to callers.\n *\n * @param text - Raw error message or serialized error body\n * @param apiKey - Optional configured API key to redact by exact match\n * @returns The sanitized text with credentials redacted\n */\nexport function sanitizeErrorDetails(\n  text: string,\n  apiKey?: string,\n  placeholder: string = REDACTED_KEY_PLACEHOLDER\n): string {\n  if (text === '') return '';\n\n  let result = text;\n  if (apiKey !== undefined && apiKey.trim() !== '') {\n    result = result.replaceAll(apiKey.trim(), placeholder);\n  }\n\n  // Redact known key patterns and URL credentials (user:pass@ / token@)\n  result = sanitizeOutput(result, placeholder);\n\n  // Plain text keeps the pre-#7296 extents; inside a JSON document a value also\n  // stops at its string's closing quote, so the output still parses (#7296).\n  const json = isJsonDocument(result);\n  result = redactContextValues(result, BEARER_HEADER_RULE, placeholder, json);\n  result = redactContextValues(result, BASIC_HEADER_RULE, placeholder, json);\n  // The token class excludes quotes and backslashes, and `\\s` cannot leave a JSON string.\n  result = result.replace(/(bearer\\s+)[A-Za-z0-9._~+/-]+=*/gi, `$1${placeholder}`);\n\n  // Redact plain text assignments like password=... or secret: ...\n  result = redactContextValues(result, ASSIGNMENT_RULE, placeholder, json);\n\n  // Redact sensitive query parameters in URLs or logs (?api_key=..., &token=..., &prompt=...)\n  result = redactContextValues(result, QUERY_RULE, placeholder, json);\n\n  // Redact sensitive JSON keys: \"api_key\": \"...\", \"token\": \"...\", \"prompt\": \"...\", etc.\n  result = result.replace(\n    /\"(api[_-]?key|access[_-]?token|token|secret|password|prompt|system_prompt|user_prompt)\"\\s*:\\s*\"(?:[^\"\\\\]|\\\\.)*\"/gi,\n    `\"$1\": \"${placeholder}\"`\n  );\n\n  return result;\n}\n\n/** `value.toJSON()` when it has one (a `Date`), as `JSON.stringify` would; else `value`. */\nfunction serializedForm(value: unknown): unknown {\n  if (typeof value !== 'object' || value === null) return value;\n  const toJSON: unknown = (value as { toJSON?: unknown }).toJSON;\n  return typeof toJSON === 'function' ? (toJSON as () => unknown).call(value) : value;\n}\n\n/**\n * `value` with `sanitize` applied to every string LEAF. A `toJSON` object (a\n * `Date`) is taken in its serialized form first, as `JSON.stringify` would;\n * arrays are mapped and objects copied from their own enumerable entries.\n * Keys, numbers, booleans and `null` are untouched, so the structure a JSON\n * reader sees survives. Returns a copy — the input is not mutated.\n */\nexport function sanitizeStringLeaves(input: unknown, sanitize: (text: string) => string): unknown {\n  const value = serializedForm(input);\n  if (typeof value === 'string') return sanitize(value);\n  if (Array.isArray(value)) return value.map((item) => sanitizeStringLeaves(item, sanitize));\n  if (typeof value === 'object' && value !== null) {\n    const copy: Record<string, unknown> = {};\n    for (const [key, entry] of Object.entries(value)) {\n      copy[key] = sanitizeStringLeaves(entry, sanitize);\n    }\n    return copy;\n  }\n  return value;\n}\n"],"mappings":";;;;;AAaO,IAAM,2BAA2B;AAiBjC,SAAS,eACd,MACA,cAAsB,0BACd;AACR,MAAI,SAAS,GAAI,QAAO;AAExB,SAAO,uBAAuB,MAAM,WAAW;AACjD;AAOA,SAAS,eAAe,MAAuB;AAC7C,MAAI,CAAC,YAAY,KAAK,IAAI,EAAG,QAAO;AACpC,MAAI;AACF,SAAK,MAAM,IAAI;AACf,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAQA,SAAS,gBAAgB,MAAc,OAAe,OAAgB,MAAuB;AAC3F,MAAI,MAAM;AACV,SAAO,MAAM,KAAK,QAAQ;AACxB,UAAM,OAAO,KAAK,GAAG,KAAK;AAC1B,QAAI,KAAK,KAAK,IAAI,KAAM,SAAS,SAAS,IAAM;AAChD,QAAI,QAAQ,SAAS,IAAK;AAC1B,QAAI,QAAQ,SAAS,KAAM;AAC3B;AAAA,EACF;AACA,SAAO,KAAK,IAAI,KAAK,KAAK,MAAM;AAClC;AAGA,IAAM,2BAA2B;AAQjC,SAAS,gBAAgB,MAAc,OAAe,YAA6B;AACjF,QAAM,eAAe,KAAK,YAAY,YAAY,KAAK;AACvD,MAAI,eAAe,EAAG,QAAO;AAC7B,QAAM,OAAO,KAAK,MAAM,cAAc,KAAK;AAC3C,MAAI,CAAC,uCAAuC,KAAK,IAAI,EAAG,QAAO;AAC/D,SAAO,yBAAyB,KAAK,KAAK,MAAM,YAAY,aAAa,IAAI,CAAC;AAChF;AAUA,SAAS,oBACP,MACA,MACA,aACA,MACQ;AACR,MAAI,SAAS;AACb,MAAI,cAAc;AAClB,aAAW,SAAS,KAAK,SAAS,KAAK,QAAQ,GAAG;AAChD,QAAI,MAAM,QAAQ,YAAa;AAC/B,UAAM,QAAQ,MAAM,SAAS,GAAG,KAAK;AACrC,UAAM,SAAS,MAAM,QAAQ,MAAM,CAAC,EAAE,SAAS,MAAM;AACrD,QAAI,MAAM,CAAC,EAAE,YAAY,MAAM,aAAa,gBAAgB,MAAM,MAAM,OAAO,MAAM,GAAG;AACtF;AAAA,IACF;AAGA,UAAM,QAAQ,QAAQ,UAAU,MAAM,SAAS,MAAM,SAAS;AAC9D,UAAM,MAAM,gBAAgB,MAAM,OAAO,KAAK,UAAU,MAAM,IAAI;AAClE,QAAI,MAAM,QAAQ,KAAK,cAAe;AACtC,cAAU,KAAK,MAAM,aAAa,KAAK,IAAI;AAC3C,kBAAc;AAAA,EAChB;AACA,SAAO,SAAS,KAAK,MAAM,WAAW;AACxC;AAGA,IAAM,qBAAkC;AAAA,EACtC,UAAU;AAAA,EACV,eAAe;AACjB;AACA,IAAM,oBAAiC;AAAA,EACrC,UAAU;AAAA,EACV,eAAe;AACjB;AACA,IAAM,kBAA+B;AAAA,EACnC,UAAU;AAAA,EACV,eAAe;AACjB;AACA,IAAM,aAA0B;AAAA,EAC9B,UACE;AAAA,EACF,eAAe;AAAA,EACf,OAAO;AACT;AAaO,SAAS,qBACd,MACA,QACA,cAAsB,0BACd;AACR,MAAI,SAAS,GAAI,QAAO;AAExB,MAAI,SAAS;AACb,MAAI,WAAW,UAAa,OAAO,KAAK,MAAM,IAAI;AAChD,aAAS,OAAO,WAAW,OAAO,KAAK,GAAG,WAAW;AAAA,EACvD;AAGA,WAAS,eAAe,QAAQ,WAAW;AAI3C,QAAM,OAAO,eAAe,MAAM;AAClC,WAAS,oBAAoB,QAAQ,oBAAoB,aAAa,IAAI;AAC1E,WAAS,oBAAoB,QAAQ,mBAAmB,aAAa,IAAI;AAEzE,WAAS,OAAO,QAAQ,qCAAqC,KAAK,WAAW,EAAE;AAG/E,WAAS,oBAAoB,QAAQ,iBAAiB,aAAa,IAAI;AAGvE,WAAS,oBAAoB,QAAQ,YAAY,aAAa,IAAI;AAGlE,WAAS,OAAO;AAAA,IACd;AAAA,IACA,UAAU,WAAW;AAAA,EACvB;AAEA,SAAO;AACT;AAGA,SAAS,eAAe,OAAyB;AAC/C,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,SAAmB,MAA+B;AACxD,SAAO,OAAO,WAAW,aAAc,OAAyB,KAAK,KAAK,IAAI;AAChF;AASO,SAAS,qBAAqB,OAAgB,UAA6C;AAChG,QAAM,QAAQ,eAAe,KAAK;AAClC,MAAI,OAAO,UAAU,SAAU,QAAO,SAAS,KAAK;AACpD,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,CAAC,SAAS,qBAAqB,MAAM,QAAQ,CAAC;AACzF,MAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C,UAAM,OAAgC,CAAC;AACvC,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,WAAK,GAAG,IAAI,qBAAqB,OAAO,QAAQ;AAAA,IAClD;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-6V4ERXGA.js → chunk-3DTEV3ZW.js}

@@ -11,7 +11,7 @@ import {
   getModelPricing,
   resolveCliCostPer1M,
   resolveCliModelName
-} from "./chunk-3VH6RBVJ.js";
+} from "./chunk-XT4BDCNW.js";
 import {
   DEFAULT_MODEL_PER_CLI,
   buildInTreeEntries,
@@ -21,7 +21,7 @@ import {
   pricingSourceOf,
   resolveModelIdentitySync,
   unpricedCliCostPer1M
-} from "./chunk-TNZSALI4.js";
+} from "./chunk-53J7YO4O.js";
 import {
   ensureLearningDir,
   getDecisionCostFile,
@@ -4717,7 +4717,7 @@ function adapterReadiness(adapter, options) {
   const ceiling = resolveClassGuardMs("interactive");
   const requested = options.timeoutMs ?? ceiling;
   const timeoutMs = Number.isFinite(requested) && requested > 0 ? Math.min(requested, ceiling) : ceiling;
-  const flight = import("./cli-readiness-6WFM5N4I.js").then(({ probeServes }) => probeServes(adapter, timeoutMs)).finally(() => readinessFlights.delete(adapter));
+  const flight = import("./cli-readiness-7JCRT2EI.js").then(({ probeServes }) => probeServes(adapter, timeoutMs)).finally(() => readinessFlights.delete(adapter));
   readinessFlights.set(adapter, flight);
   return flight;
 }
@@ -4727,7 +4727,7 @@ async function servesListedModel(adapter, modelId, cli) {
     const models = await adapter.listModels();
     if (models.length === 0) return "unknown";
     const requestedKey = canonicalModelKey(modelId);
-    const findCanonicalModel = cli === "codex" ? (await import("./model-config-helpers-PSOLGUS4.js")).findCanonicalModel : void 0;
+    const findCanonicalModel = cli === "codex" ? (await import("./model-config-helpers-7ZDR3P4Y.js")).findCanonicalModel : void 0;
     const requestedEntry = requestedKey === null ? findCanonicalModel?.("codex", modelId) : void 0;
     const listed = models.some((model) => {
       const listedEntry = findCanonicalModel?.("codex", model.id);
@@ -6402,7 +6402,7 @@ var ModelToCliAdapter = class {
   }
   async execute(task, options) {
     const gatewayArm = this.gatewayArmField().gatewayArm;
-    const breaker = gatewayArm !== void 0 && this.modelAdapter.providerId === `cli-${this.name}` ? (await import("./cli-circuit-breaker-7QJ4SIGM.js")).getDefaultCliCircuitBreakerRegistry().getArmBreaker(breakerKeys.forArm({ name: this.name, gatewayArm })) : void 0;
+    const breaker = gatewayArm !== void 0 && this.modelAdapter.providerId === `cli-${this.name}` ? (await import("./cli-circuit-breaker-JVZ5PU4B.js")).getDefaultCliCircuitBreakerRegistry().getArmBreaker(breakerKeys.forArm({ name: this.name, gatewayArm })) : void 0;
     const result = await this.modelAdapter.complete(this.toCompletionRequest(task, options));
     if (!result.ok) {
       const cliError = this.toCliError(result.error);
@@ -17618,7 +17618,7 @@ var CompositeRouter = class _CompositeRouter {
    */
   async consultUnifiedContext(task) {
     try {
-      const { getContextForTask, inferTaskCategory } = await import("./context-retriever-HTBOLH5P.js");
+      const { getContextForTask, inferTaskCategory } = await import("./context-retriever-R73UHFWI.js");
       const ctx = await getContextForTask({
         task: task.content,
         category: inferTaskCategory(task.content),
@@ -19295,4 +19295,4 @@ export {
   AgentCapability,
   OrchestratorError
 };
-//# sourceMappingURL=chunk-6V4ERXGA.js.map
+//# sourceMappingURL=chunk-3DTEV3ZW.js.map

package/dist/{chunk-EBMDEUH7.js → chunk-442TR7T5.js}

@@ -4,10 +4,10 @@ import {
   loadPapersRegistry,
   loadTechniquesRegistry,
   savePapersRegistry
-} from "./chunk-Q7FEF3YH.js";
+} from "./chunk-4UNCRRJP.js";
 import {
   resolveToken
-} from "./chunk-AUO7FSZX.js";
+} from "./chunk-OWRB3X7N.js";
 import {
   getTsMorph
 } from "./chunk-W654ME6B.js";
@@ -18,7 +18,7 @@ import {
   rankedItemTrustTier,
   trustTierLabel,
   withoutUntrustedMemory
-} from "./chunk-5EYCAD6W.js";
+} from "./chunk-P7UYXTBL.js";
 import {
   extractSystemPrompt,
   generateCacheKey,
@@ -41,7 +41,7 @@ import {
   sigmoidConfidence,
   tokenizeFiltered,
   truncateSentence
-} from "./chunk-6V4ERXGA.js";
+} from "./chunk-3DTEV3ZW.js";
 import {
   ensureLearningDir,
   getRulesFile
@@ -4296,4 +4296,4 @@ export {
   DEFAULT_CONTEXT_BUDGET_TOKENS,
   getContextPromptPrefix
 };
-//# sourceMappingURL=chunk-EBMDEUH7.js.map
+//# sourceMappingURL=chunk-442TR7T5.js.map

package/dist/{chunk-FOKNFLXF.js → chunk-4S7H76GJ.js}

@@ -1,6 +1,6 @@
 import {
   getErrorMessage
-} from "./chunk-6V4ERXGA.js";
+} from "./chunk-3DTEV3ZW.js";
 
 // src/cli/setup-config.ts
 import { copyFileSync, existsSync, mkdirSync, writeFileSync } from "node:fs";
@@ -82,4 +82,4 @@ function ensureBackup(outputPath) {
 export {
   runConfigInitSync
 };
-//# sourceMappingURL=chunk-FOKNFLXF.js.map
+//# sourceMappingURL=chunk-4S7H76GJ.js.map

package/dist/{chunk-6YWQAEAN.js → chunk-4TIN5SKQ.js}

@@ -2,7 +2,7 @@ import {
   err,
   getErrorMessage,
   ok
-} from "./chunk-6V4ERXGA.js";
+} from "./chunk-3DTEV3ZW.js";
 import {
   createLogger
 } from "./chunk-GR6WCJWY.js";
@@ -285,4 +285,4 @@ export {
   ScmError,
   GitHubProvider
 };
-//# sourceMappingURL=chunk-6YWQAEAN.js.map
+//# sourceMappingURL=chunk-4TIN5SKQ.js.map

package/dist/{chunk-Q7FEF3YH.js → chunk-4UNCRRJP.js}

@@ -5,7 +5,7 @@ import {
   getErrorMessage,
   ok,
   resolveInsideRoot
-} from "./chunk-6V4ERXGA.js";
+} from "./chunk-3DTEV3ZW.js";
 import {
   createLogger
 } from "./chunk-GR6WCJWY.js";
@@ -213,4 +213,4 @@ export {
   loadPapersRegistry,
   savePapersRegistry
 };
-//# sourceMappingURL=chunk-Q7FEF3YH.js.map
+//# sourceMappingURL=chunk-4UNCRRJP.js.map

package/dist/{chunk-TNZSALI4.js → chunk-53J7YO4O.js}

@@ -1645,7 +1645,7 @@ function setDefaultRegistry(registry) {
 }
 async function reloadDefaultRegistry() {
   globalRegistry = buildDefaultRegistry();
-  const { resetGlobalRegistry } = await import("./unified-registry-KHXB62QQ.js");
+  const { resetGlobalRegistry } = await import("./unified-registry-TLEJ4EIA.js");
   resetGlobalRegistry();
   return globalRegistry;
 }
@@ -1674,4 +1674,4 @@ export {
   setDefaultRegistry,
   reloadDefaultRegistry
 };
-//# sourceMappingURL=chunk-TNZSALI4.js.map
+//# sourceMappingURL=chunk-53J7YO4O.js.map

package/dist/{chunk-4JCRCOOV.js → chunk-A3XTSBSA.js}

@@ -1,14 +1,14 @@
 import {
   GitHubProvider,
   ScmError
-} from "./chunk-6YWQAEAN.js";
+} from "./chunk-4TIN5SKQ.js";
 import {
   resolveToken
-} from "./chunk-AUO7FSZX.js";
+} from "./chunk-OWRB3X7N.js";
 import {
   err,
   ok
-} from "./chunk-6V4ERXGA.js";
+} from "./chunk-3DTEV3ZW.js";
 
 // src/scm/factory.ts
 async function createScmProvider(config) {
@@ -41,4 +41,4 @@ export {
   createScmProvider,
   createGitHubProvider
 };
-//# sourceMappingURL=chunk-4JCRCOOV.js.map
+//# sourceMappingURL=chunk-A3XTSBSA.js.map