nexus-agents 2.105.0 → 2.107.1

package/dist/{chunk-VIHUOFIT.js → chunk-2MPLNCGG.js}

@@ -1,24 +1,43 @@
+import {
+  AdapterModelError,
+  BaseAdapter,
+  createStream,
+  requireApiKey,
+  validateApiKeyPresence
+} from "./chunk-H6Q3EPQG.js";
+import {
+  CUSTOM_API_BASE_URL_ENV,
+  CUSTOM_API_DEFAULT_MODEL,
+  PROVIDER_ENV_KEYS,
+  validateCustomApiBaseUrl
+} from "./chunk-ZFDG2CDY.js";
 import {
   CliCircuitBreaker,
   DEFAULT_CIRCUIT_BREAKER_CONFIG
-} from "./chunk-ETGNZ6H2.js";
+} from "./chunk-K3UILZ5X.js";
 import {
   getAvailabilityCache
-} from "./chunk-RZ4A2RRN.js";
+} from "./chunk-RMTFEDQV.js";
 import {
   generateHyphenId
-} from "./chunk-A5UJBVCQ.js";
+} from "./chunk-IJZGHD7O.js";
 import {
   CLI_SUBPROCESS_TIMEOUTS,
   CLI_TIMEOUTS,
   CLI_VERSION_REQUIREMENTS,
   CODEX_MCP_TIMEOUTS,
   DEFAULT_CAPABILITIES,
+  ErrorCode,
+  ModelCapability,
+  ModelError,
+  apiArmId,
+  buildCliCapabilityProfiles,
   buildModelInfo,
   clampPercent,
   createLogger,
   detectTaskCategory,
   err,
+  estimateTokens,
   extractJsonObject,
   findInTreeByCli,
   getCliModelName,
@@ -28,11 +47,1386 @@ import {
   getOutcomeStore,
   getRandomProvider,
   getTimeProvider,
+  getTokenEstimator,
   isDynamicModelsEnabled,
+  isRateLimitLikeError,
   isRateLimitText,
   loadModelsDevSnapshot,
-  ok
-} from "./chunk-WDVUKSIQ.js";
+  ok,
+  resolveCliAlias
+} from "./chunk-VO7FEIXD.js";
+
+// src/cli-adapters/cli-to-model-adapter.ts
+var CliToModelAdapter = class {
+  providerId;
+  modelId;
+  capabilities;
+  cliAdapter;
+  defaultTimeoutMs;
+  /**
+   * Creates a bridge from CLI adapter to model adapter.
+   *
+   * @param cliAdapter - The CLI adapter to wrap
+   * @param config - Optional configuration (e.g. timeout override)
+   */
+  constructor(cliAdapter, config) {
+    this.cliAdapter = cliAdapter;
+    this.defaultTimeoutMs = config?.defaultTimeoutMs;
+    this.providerId = `cli-${cliAdapter.name}`;
+    this.modelId = cliAdapter.getModelInfo().id;
+    this.capabilities = this.deriveCapabilities();
+  }
+  /**
+   * Derives ModelCapability from CLI capabilities.
+   */
+  deriveCapabilities() {
+    const caps = [ModelCapability.COMPLETION, ModelCapability.TOOL_USE];
+    if (this.cliAdapter.name === "claude") {
+      caps.push(ModelCapability.EXTENDED_THINKING);
+    }
+    return caps;
+  }
+  /**
+   * Converts CompletionRequest to CliTask.
+   */
+  toCliTask(request) {
+    const content = request.messages.map((msg) => {
+      const text = typeof msg.content === "string" ? msg.content : msg.content.filter((b) => b.type === "text").map((b) => b.text).join("\n");
+      return `[${msg.role}]: ${text}`;
+    }).join("\n\n");
+    const task = { content };
+    if (request.systemPrompt !== void 0) {
+      task.systemPrompt = request.systemPrompt;
+    }
+    if (request.maxTokens !== void 0) {
+      task.maxTokens = request.maxTokens;
+    }
+    return task;
+  }
+  /**
+   * Converts CliResponse to CompletionResponse.
+   */
+  toCompletionResponse(response) {
+    return {
+      content: [{ type: "text", text: response.text }],
+      usage: {
+        inputTokens: response.usage?.inputTokens ?? 0,
+        outputTokens: response.usage?.outputTokens ?? 0,
+        totalTokens: response.usage?.totalTokens ?? 0
+      },
+      stopReason: "end_turn",
+      model: response.model ?? this.modelId
+    };
+  }
+  /**
+   * Converts CliError to ModelError.
+   */
+  toModelError(cliError) {
+    const options = cliError.cause !== void 0 ? { cause: cliError.cause } : {};
+    return new ModelError(cliError.message, options);
+  }
+  /**
+   * Send a completion request via CLI.
+   */
+  async complete(request) {
+    const task = this.toCliTask(request);
+    const effectiveTimeoutMs = request.timeoutMs ?? this.defaultTimeoutMs;
+    const opts = effectiveTimeoutMs !== void 0 ? { timeoutMs: effectiveTimeoutMs } : void 0;
+    const result = await this.cliAdapter.execute(task, opts);
+    if (!result.ok) {
+      return err(this.toModelError(result.error));
+    }
+    return ok(this.toCompletionResponse(result.value));
+  }
+  /**
+   * Streaming is not supported via CLI adapters.
+   * Falls back to non-streaming and yields single chunk.
+   */
+  async *stream(request) {
+    const result = await this.complete(request);
+    if (!result.ok) {
+      throw result.error;
+    }
+    const response = result.value;
+    yield { type: "message_start", message: { model: response.model } };
+    yield {
+      type: "content_block_start",
+      index: 0,
+      contentBlock: response.content[0] ?? { type: "text", text: "" }
+    };
+    const firstBlock = response.content[0];
+    const text = firstBlock?.type === "text" ? firstBlock.text : "";
+    yield { type: "content_block_delta", index: 0, delta: { type: "text_delta", text } };
+    yield { type: "content_block_stop", index: 0 };
+    yield {
+      type: "message_delta",
+      delta: { stop_reason: response.stopReason },
+      usage: response.usage
+    };
+    yield { type: "message_stop" };
+  }
+  /**
+   * Token count via canonical estimator (DRY consolidation Issue #1596).
+   */
+  countTokens(text) {
+    return Promise.resolve(estimateTokens(text));
+  }
+  /**
+   * Validate configuration by running health check.
+   */
+  validateConfig() {
+    return ok(void 0);
+  }
+  /**
+   * Initialize the underlying CLI adapter.
+   */
+  async initialize() {
+    await this.cliAdapter.initialize();
+  }
+  /**
+   * Dispose the underlying CLI adapter.
+   */
+  async dispose() {
+    await this.cliAdapter.dispose();
+  }
+};
+function createCliToModelAdapter(cliAdapter, config) {
+  return new CliToModelAdapter(cliAdapter, config);
+}
+
+// src/cli-adapters/model-to-cli-adapter.ts
+var DEFAULT_CONTEXT_WINDOW = 2e5;
+var NEUTRAL_CAPABILITIES = {
+  reasoning: 7,
+  contextWindow: DEFAULT_CONTEXT_WINDOW,
+  codeGeneration: 7,
+  speed: 7,
+  cost: 5
+};
+var API_TRANSPORT = "subprocess";
+var ModelToCliAdapter = class {
+  name;
+  transport = API_TRANSPORT;
+  capabilities;
+  modelAdapter;
+  constructor(modelAdapter, config) {
+    this.modelAdapter = modelAdapter;
+    this.name = config.name;
+    this.capabilities = config.capabilities ?? NEUTRAL_CAPABILITIES;
+  }
+  /** Build a single-turn CompletionRequest from a CliTask. */
+  toCompletionRequest(task, options) {
+    const request = {
+      messages: [{ role: "user", content: task.content }]
+    };
+    if (task.systemPrompt !== void 0) {
+      request.systemPrompt = task.systemPrompt;
+    }
+    if (task.maxTokens !== void 0) {
+      request.maxTokens = task.maxTokens;
+    }
+    if (options?.timeoutMs !== void 0) {
+      request.timeoutMs = options.timeoutMs;
+    }
+    return request;
+  }
+  /** Flatten a CompletionResponse's content blocks to plain text. */
+  toText(response) {
+    return response.content.filter((b) => b.type === "text").map((b) => b.text).join("\n");
+  }
+  /** Convert a CompletionResponse to a CliResponse. */
+  toCliResponse(response) {
+    return {
+      text: this.toText(response),
+      usage: {
+        inputTokens: response.usage.inputTokens,
+        outputTokens: response.usage.outputTokens,
+        totalTokens: response.usage.totalTokens
+      },
+      model: response.model
+    };
+  }
+  /**
+   * Convert a ModelError to a CliError. Rate-limit text → RATE_LIMITED
+   * (retryable); everything else → EXECUTION_ERROR (non-retryable) so the
+   * routing/circuit layers see a real, typed failure.
+   */
+  toCliError(error) {
+    const rateLimited = isRateLimitText(error.message);
+    const code = rateLimited ? "RATE_LIMITED" : "EXECUTION_ERROR";
+    const base = {
+      code,
+      message: error.message,
+      cli: this.name,
+      retryable: rateLimited
+    };
+    return error.cause instanceof Error ? { ...base, cause: error.cause } : base;
+  }
+  async execute(task, options) {
+    const result = await this.modelAdapter.complete(this.toCompletionRequest(task, options));
+    if (!result.ok) {
+      return err(this.toCliError(result.error));
+    }
+    return ok(this.toCliResponse(result.value));
+  }
+  /** Health is derived from the model adapter's config validation. */
+  async healthCheck() {
+    const valid = this.modelAdapter.validateConfig();
+    return Promise.resolve({
+      healthy: valid.ok,
+      version: "api",
+      versionStatus: "supported",
+      lastChecked: /* @__PURE__ */ new Date(0),
+      ...valid.ok ? {} : { message: valid.error.message }
+    });
+  }
+  /**
+   * API adapters don't expose subprocess-style rate windows; report
+   * non-exhausted capacity. Real rate-limit signals surface via execute()'s
+   * RATE_LIMITED error, which the resilience layer acts on.
+   */
+  getCapacity() {
+    return Promise.resolve({
+      remainingTokens: Number.POSITIVE_INFINITY,
+      remainingRequests: Number.POSITIVE_INFINITY,
+      resetTime: /* @__PURE__ */ new Date(0),
+      utilizationPercent: 0,
+      exhausted: false
+    });
+  }
+  getVersion() {
+    return Promise.resolve("api");
+  }
+  getModelInfo() {
+    return {
+      id: this.modelAdapter.modelId,
+      name: this.modelAdapter.modelId,
+      contextWindow: DEFAULT_CONTEXT_WINDOW
+    };
+  }
+  /** Delegate to the model adapter's listModels surface when present (#2529). */
+  async listModels() {
+    if (this.modelAdapter.listModels === void 0) return [];
+    const models = await this.modelAdapter.listModels();
+    return models.map((m) => ({
+      id: m.id,
+      ...m.ownedBy !== void 0 ? { provider: m.ownedBy } : {}
+    }));
+  }
+  initialize() {
+    return Promise.resolve();
+  }
+  dispose() {
+    return Promise.resolve();
+  }
+};
+function createModelToCliAdapter(modelAdapter, config) {
+  return new ModelToCliAdapter(modelAdapter, config);
+}
+
+// src/adapters/claude-adapter.ts
+import Anthropic3 from "@anthropic-ai/sdk";
+
+// src/adapters/claude-adapter-types.ts
+var CLAUDE_MODELS = {
+  OPUS_4: getCliModelName("claude-opus"),
+  SONNET_4: getCliModelName("claude-sonnet"),
+  HAIKU_4: getCliModelName("claude-haiku")
+};
+var CLAUDE_MODEL_ALIASES = {
+  "claude-opus-4": CLAUDE_MODELS.OPUS_4,
+  "claude-sonnet-4": CLAUDE_MODELS.SONNET_4,
+  "claude-haiku-4": CLAUDE_MODELS.HAIKU_4,
+  // Legacy alias — pre-4.x users routed to the current haiku.
+  "claude-haiku-3": CLAUDE_MODELS.HAIKU_4
+};
+var DEFAULT_MAX_TOKENS = 4096;
+
+// src/adapters/claude-adapter-helpers.ts
+import "@anthropic-ai/sdk";
+function mapStopReason(anthropicReason) {
+  switch (anthropicReason) {
+    case "end_turn":
+      return "end_turn";
+    case "max_tokens":
+      return "max_tokens";
+    case "stop_sequence":
+      return "stop_sequence";
+    case "tool_use":
+      return "tool_use";
+    default:
+      return "end_turn";
+  }
+}
+function mapContentBlock(block) {
+  if (block.type === "text") {
+    return { type: "text", text: block.text };
+  }
+  if (block.type === "tool_use") {
+    const toolBlock = block;
+    return {
+      type: "tool_use",
+      id: toolBlock.id,
+      name: toolBlock.name,
+      input: toolBlock.input
+    };
+  }
+  return { type: "text", text: "" };
+}
+function mapMessage(message) {
+  const role = message.role === "user" ? "user" : "assistant";
+  if (typeof message.content === "string") {
+    return { role, content: message.content };
+  }
+  const content = message.content.map((block) => {
+    if (block.type === "text") {
+      return { type: "text", text: block.text };
+    }
+    if (block.type === "tool_use") {
+      return {
+        type: "tool_use",
+        id: block.id,
+        name: block.name,
+        input: block.input
+      };
+    }
+    if (block.type === "tool_result") {
+      const toolResult = {
+        type: "tool_result",
+        tool_use_id: block.tool_use_id,
+        content: block.content
+      };
+      if (block.is_error !== void 0) {
+        toolResult.is_error = block.is_error;
+      }
+      return toolResult;
+    }
+    return {
+      type: "image",
+      source: block.source
+    };
+  });
+  return { role, content };
+}
+function mapTool(tool) {
+  return {
+    name: tool.name,
+    description: tool.description,
+    input_schema: tool.inputSchema
+  };
+}
+function resolveModelId(modelId) {
+  const registryId = resolveCliAlias(modelId);
+  if (registryId !== void 0) return getCliModelName(registryId);
+  return modelId;
+}
+function getModelCapabilities(modelId) {
+  const capabilities = [
+    ModelCapability.COMPLETION,
+    ModelCapability.STREAMING,
+    ModelCapability.TOOL_USE,
+    ModelCapability.VISION
+  ];
+  const resolvedId = resolveModelId(modelId);
+  if (resolvedId.includes("opus") || resolvedId.includes("sonnet-4")) {
+    capabilities.push(ModelCapability.EXTENDED_THINKING);
+  }
+  return capabilities;
+}
+
+// src/context/token-counter-helpers.ts
+import "@anthropic-ai/sdk";
+function generateCacheKey(content, provider, model) {
+  const contentStr = typeof content === "string" ? content : JSON.stringify(content);
+  return `${provider}:${model ?? "default"}:${contentStr}`;
+}
+function messagesToAnthropicFormat(messages) {
+  return messages.filter((m) => m.role !== "system").map((m) => {
+    const role = m.role === "user" ? "user" : "assistant";
+    if (typeof m.content === "string") {
+      return { role, content: m.content };
+    }
+    const content = m.content.map((block) => {
+      if (block.type === "text") {
+        return { type: "text", text: block.text };
+      }
+      if (block.type === "tool_use") {
+        return {
+          type: "tool_use",
+          id: block.id,
+          name: block.name,
+          input: block.input
+        };
+      }
+      if (block.type === "tool_result") {
+        return {
+          type: "tool_result",
+          tool_use_id: block.tool_use_id,
+          content: block.content
+        };
+      }
+      return {
+        type: "image",
+        source: block.source
+      };
+    });
+    return { role, content };
+  });
+}
+function extractSystemPrompt(messages) {
+  const systemMsg = messages.find((m) => m.role === "system");
+  if (systemMsg === void 0) {
+    return void 0;
+  }
+  if (typeof systemMsg.content === "string") {
+    return systemMsg.content;
+  }
+  return systemMsg.content.filter((b) => b.type === "text").map((b) => b.text).join("\n");
+}
+
+// src/adapters/prompt-utils.ts
+function extractRequestSystemPrompt(request) {
+  if (request.systemPrompt !== void 0 && request.systemPrompt !== "") {
+    return request.systemPrompt;
+  }
+  return extractSystemPrompt(request.messages);
+}
+
+// src/adapters/claude-adapter.ts
+var ClaudeAdapter = class extends BaseAdapter {
+  client;
+  resolvedModelId;
+  /**
+   * Creates a new ClaudeAdapter instance.
+   *
+   * @param config - Claude adapter configuration
+   * @throws {ConfigError} If API key is missing
+   */
+  constructor(config) {
+    const resolvedModelId = resolveModelId(config.modelId);
+    const baseConfig = {
+      providerId: "anthropic",
+      modelId: resolvedModelId,
+      capabilities: getModelCapabilities(config.modelId),
+      apiKey: config.apiKey
+    };
+    if (config.baseUrl !== void 0) {
+      baseConfig.baseUrl = config.baseUrl;
+    }
+    if (config.timeout !== void 0) {
+      baseConfig.timeout = config.timeout;
+    }
+    if (config.maxRetries !== void 0) {
+      baseConfig.maxRetries = config.maxRetries;
+    }
+    super(baseConfig);
+    this.resolvedModelId = resolvedModelId;
+    requireApiKey(config.apiKey, "Anthropic", config.modelId);
+    this.client = new Anthropic3({
+      apiKey: config.apiKey,
+      baseURL: config.baseUrl,
+      timeout: config.timeout,
+      maxRetries: config.maxRetries ?? 2
+    });
+  }
+  /**
+   * Validates adapter configuration.
+   * Extends base validation with Claude-specific checks.
+   */
+  validateConfig() {
+    const baseResult = super.validateConfig();
+    if (!baseResult.ok) {
+      return baseResult;
+    }
+    const keyResult = validateApiKeyPresence(this.config.apiKey, this.providerId, this.modelId);
+    if (!keyResult.ok) return keyResult;
+    return ok(void 0);
+  }
+  /**
+   * Send a completion request to Claude.
+   *
+   * @param request - The completion request
+   * @returns Result with response or ModelError
+   */
+  async complete(request) {
+    this.logRequest(request);
+    try {
+      const response = await this.executeCompletion(request);
+      this.logResponse(response);
+      return ok(response);
+    } catch (error) {
+      return err(this.transformError(error));
+    }
+  }
+  /**
+   * Stream a completion request from Claude.
+   *
+   * @param request - The completion request
+   * @yields StreamChunk objects as they arrive
+   */
+  async *stream(request) {
+    this.logRequest(request);
+    const [controller, iterable] = createStream();
+    this.executeStream(request, controller).catch((error) => {
+      const modelError = this.transformError(error);
+      controller.error(modelError);
+    });
+    yield* iterable;
+  }
+  /**
+   * Count tokens in text using Claude-specific estimation.
+   *
+   * Claude uses a custom tokenizer. This provides a more accurate estimate
+   * than the base adapter's generic calculation.
+   *
+   * @param text - Text to count tokens for
+   * @returns Approximate token count
+   */
+  countTokens(text) {
+    return Promise.resolve(getTokenEstimator().estimateText(text, "claude"));
+  }
+  /**
+   * Executes the completion request against the Anthropic API.
+   */
+  async executeCompletion(request) {
+    const params = this.buildRequestParams(request);
+    const response = request.signal !== void 0 ? await this.client.messages.create(params, { signal: request.signal }) : await this.client.messages.create(params);
+    return this.mapResponse(response);
+  }
+  /**
+   * Executes streaming completion and pushes chunks to the controller.
+   */
+  async executeStream(request, controller) {
+    try {
+      const params = this.buildRequestParams(request);
+      const stream = this.client.messages.stream(params);
+      for await (const event of stream) {
+        const chunk = this.mapStreamEvent(event);
+        if (chunk) {
+          controller.push(chunk);
+        }
+      }
+      controller.complete();
+    } catch (error) {
+      const modelError = this.transformError(error);
+      controller.error(modelError);
+    }
+  }
+  /**
+   * Builds Anthropic API request parameters from our CompletionRequest.
+   */
+  buildRequestParams(request) {
+    const messages = request.messages.filter((m) => m.role !== "system").map(mapMessage);
+    const params = {
+      model: this.resolvedModelId,
+      messages,
+      max_tokens: request.maxTokens ?? DEFAULT_MAX_TOKENS
+    };
+    const systemPrompt = extractRequestSystemPrompt(request);
+    if (systemPrompt !== void 0) {
+      params.system = systemPrompt;
+    }
+    this.applyOptionalParams(params, request);
+    return params;
+  }
+  /**
+   * Applies optional parameters to the request params.
+   */
+  applyOptionalParams(params, request) {
+    if (request.temperature !== void 0) {
+      params.temperature = request.temperature;
+    }
+    if (request.stop !== void 0 && request.stop.length > 0) {
+      params.stop_sequences = request.stop;
+    }
+    if (request.tools !== void 0 && request.tools.length > 0) {
+      params.tools = request.tools.map(mapTool);
+    }
+    if (request.responseFormat !== void 0 && request.responseFormat.type !== "text") {
+      this.logger.warn("responseFormat is not supported by Claude adapter", {
+        requestedFormat: request.responseFormat.type,
+        suggestion: "Use tool use or prompt engineering for structured output"
+      });
+    }
+  }
+  /**
+   * Maps Anthropic API response to our CompletionResponse format.
+   */
+  mapResponse(response) {
+    const content = response.content.map(mapContentBlock);
+    const usage = {
+      inputTokens: response.usage.input_tokens,
+      outputTokens: response.usage.output_tokens,
+      totalTokens: response.usage.input_tokens + response.usage.output_tokens
+    };
+    return {
+      content,
+      usage,
+      stopReason: mapStopReason(response.stop_reason),
+      model: response.model
+    };
+  }
+  /**
+   * Maps Anthropic stream events to our StreamChunk format.
+   */
+  mapStreamEvent(event) {
+    switch (event.type) {
+      case "message_start":
+        return {
+          type: "message_start",
+          message: { model: event.message.model }
+        };
+      case "content_block_start":
+        return {
+          type: "content_block_start",
+          index: event.index,
+          contentBlock: mapContentBlock(event.content_block)
+        };
+      case "content_block_delta":
+        if (event.delta.type === "text_delta") {
+          return {
+            type: "content_block_delta",
+            index: event.index,
+            delta: { type: "text_delta", text: event.delta.text }
+          };
+        }
+        return null;
+      case "content_block_stop":
+        return {
+          type: "content_block_stop",
+          index: event.index
+        };
+      case "message_delta":
+        return {
+          type: "message_delta",
+          delta: { stop_reason: mapStopReason(event.delta.stop_reason ?? null) },
+          usage: {
+            inputTokens: 0,
+            // Not available in delta
+            outputTokens: event.usage.output_tokens,
+            totalTokens: event.usage.output_tokens
+          }
+        };
+      case "message_stop":
+        return { type: "message_stop" };
+      default:
+        return null;
+    }
+  }
+  /**
+   * (#2540) List models the Anthropic API currently exposes.
+   * Wraps `client.models.list()`. Cached for 5 min, in-flight promise
+   * shared across concurrent callers, throws on non-2xx so the
+   * harness-side identity resolver knows to fall back.
+   */
+  async listModels() {
+    const now = Date.now();
+    if (this.modelsCache !== null && now - this.modelsCache.fetchedAt < CLAUDE_LIST_MODELS_TTL_MS) {
+      return this.modelsCache.value;
+    }
+    if (this.modelsInFlight !== null) return this.modelsInFlight;
+    const inFlight = this.fetchModels();
+    this.modelsInFlight = inFlight;
+    try {
+      const value = await inFlight;
+      this.modelsCache = { value, fetchedAt: Date.now() };
+      return value;
+    } finally {
+      this.modelsInFlight = null;
+    }
+  }
+  modelsCache = null;
+  modelsInFlight = null;
+  async fetchModels() {
+    const list = await this.client.models.list();
+    const out = [];
+    for (const m of list.data) {
+      const entry = { id: m.id };
+      if (typeof m.created_at === "string") {
+        const ts = Date.parse(m.created_at);
+        if (!Number.isNaN(ts)) {
+          out.push({ ...entry, ownedBy: "anthropic", createdAt: Math.floor(ts / 1e3) });
+          continue;
+        }
+      }
+      out.push({ ...entry, ownedBy: "anthropic" });
+    }
+    return out;
+  }
+};
+var CLAUDE_LIST_MODELS_TTL_MS = 5 * 60 * 1e3;
+function createClaudeAdapter(config) {
+  return new ClaudeAdapter(config);
+}
+
+// src/security/output-sanitizer.ts
+var REDACTED_KEY_PLACEHOLDER = "[REDACTED_KEY]";
+var KEY_PATTERNS = [
+  // Anthropic: sk-ant-api03-... (at least 20 chars after prefix)
+  /sk-ant-[A-Za-z0-9_-]{20,}/g,
+  // OpenAI project: sk-proj-... (at least 20 chars after prefix)
+  /sk-proj-[A-Za-z0-9_-]{20,}/g,
+  // Generic OpenAI: sk-... (at least 20 chars after prefix)
+  /sk-[A-Za-z0-9_-]{20,}/g,
+  // Google AI / Gemini: AIzaSy... (at least 30 chars total)
+  /AIzaSy[A-Za-z0-9_-]{24,}/g,
+  // GitHub PAT: ghp_...
+  /ghp_[A-Za-z0-9]{20,}/g,
+  // GitHub OAuth: gho_...
+  /gho_[A-Za-z0-9]{20,}/g,
+  // GitLab PAT: glpat-...
+  /glpat-[A-Za-z0-9_-]{10,}/g,
+  // npm token: npm_...
+  /npm_[A-Za-z0-9]{20,}/g,
+  // PyPI token: pypi-...
+  /pypi-[A-Za-z0-9_-]{20,}/g
+];
+function sanitizeOutput(text) {
+  if (text === "") return text;
+  let result = text;
+  for (const pattern of KEY_PATTERNS) {
+    pattern.lastIndex = 0;
+    result = result.replace(pattern, REDACTED_KEY_PLACEHOLDER);
+  }
+  return result;
+}
+
+// src/adapters/sdk/sdk-adapter.ts
+function extractProviderFactory(mod, factoryName) {
+  const factory = mod[factoryName];
+  if (typeof factory !== "function") {
+    throw new Error(`AI SDK module missing expected export: ${factoryName}`);
+  }
+  return factory;
+}
+function extractAiSdkFunctions(mod) {
+  const generateText = mod["generateText"];
+  const streamText = mod["streamText"];
+  if (typeof generateText !== "function") {
+    throw new Error("AI SDK module missing expected export: 'generateText'");
+  }
+  if (typeof streamText !== "function") {
+    throw new Error("AI SDK module missing expected export: 'streamText'");
+  }
+  return {
+    generateText,
+    streamText
+  };
+}
+function resolveApiKey(providerId, configKey) {
+  if (configKey !== void 0) return configKey;
+  const envVar = PROVIDER_ENV_KEYS[providerId];
+  return process.env[envVar];
+}
+function resolveAndValidateCustomBaseUrl(config) {
+  if (config.providerId !== "custom-openai") return void 0;
+  const raw = config.baseUrl ?? process.env[CUSTOM_API_BASE_URL_ENV];
+  const validated = validateCustomApiBaseUrl(raw);
+  if (!validated.ok) throw validated.error;
+  return validated.value.toString();
+}
+function mapFinishReason(reason) {
+  switch (reason) {
+    case "stop":
+    case "end-turn":
+      return "end_turn";
+    case "length":
+      return "max_tokens";
+    case "tool-calls":
+      return "tool_use";
+    default:
+      return "end_turn";
+  }
+}
+function categorizeError(error) {
+  if (isRateLimitLikeError(error)) {
+    return ErrorCode.MODEL_RATE_LIMITED;
+  }
+  const message = getErrorMessage(error).toLowerCase();
+  if (message.includes("timeout") || message.includes("timed out")) {
+    return ErrorCode.MODEL_TIMEOUT;
+  }
+  if (message.includes("401") || message.includes("unauthorized") || message.includes("api key")) {
+    return ErrorCode.CONFIG_INVALID;
+  }
+  return ErrorCode.MODEL_ERROR;
+}
+var SdkAdapter = class extends BaseAdapter {
+  sdkProviderId;
+  model;
+  sdkFunctions;
+  sdkConfig;
+  /** Validated base URL for custom-openai provider; undefined for built-ins. */
+  customBaseUrl;
+  /** Inflight init promise for coalescing concurrent calls (Issue #1438). */
+  initPromise;
+  constructor(config, logger6) {
+    const apiKey = resolveApiKey(config.providerId, config.apiKey);
+    super({
+      providerId: `sdk-${config.providerId}`,
+      modelId: config.modelId,
+      capabilities: [ModelCapability.COMPLETION, ModelCapability.STREAMING],
+      logger: logger6 ?? createLogger({ adapter: `sdk-${config.providerId}` }),
+      ...apiKey !== void 0 ? { apiKey } : {},
+      ...config.timeout !== void 0 ? { timeout: config.timeout } : {},
+      ...config.maxRetries !== void 0 ? { maxRetries: config.maxRetries } : {}
+    });
+    this.sdkProviderId = config.providerId;
+    this.sdkConfig = config;
+    this.customBaseUrl = resolveAndValidateCustomBaseUrl(config);
+  }
+  /**
+   * Lazily initialize the AI SDK model and functions.
+   * This allows the adapter to be created without the AI SDK installed,
+   * failing only when actually used.
+   */
+  async ensureInitialized() {
+    if (this.model !== void 0) return;
+    if (this.initPromise !== void 0) {
+      await this.initPromise;
+      return;
+    }
+    this.initPromise = this.doInitialize();
+    try {
+      await this.initPromise;
+    } finally {
+      this.initPromise = void 0;
+    }
+  }
+  async doInitialize() {
+    const apiKey = resolveApiKey(this.sdkProviderId, this.sdkConfig.apiKey);
+    if (apiKey === void 0) {
+      throw new AdapterModelError(`No API key for ${this.sdkProviderId}`, {
+        code: ErrorCode.CONFIG_INVALID
+      });
+    }
+    const providerModule = await this.loadProvider(apiKey);
+    this.model = providerModule.model;
+    const aiModule = await import("ai");
+    this.sdkFunctions = extractAiSdkFunctions(aiModule);
+  }
+  /**
+   * Loads the provider-specific AI SDK module.
+   *
+   * Each @ai-sdk/* package exports a factory function (e.g., createAnthropic)
+   * that returns a callable provider instance. We use extractProviderFactory()
+   * to validate the export exists at runtime, since these are optional peer deps.
+   */
+  async loadProvider(apiKey) {
+    switch (this.sdkProviderId) {
+      case "anthropic": {
+        const mod = await import("@ai-sdk/anthropic");
+        const factory = extractProviderFactory(mod, "createAnthropic");
+        const provider = factory({ apiKey });
+        return { model: provider(this.modelId) };
+      }
+      case "openai": {
+        const mod = await import("@ai-sdk/openai");
+        const factory = extractProviderFactory(mod, "createOpenAI");
+        const provider = factory({ apiKey });
+        return { model: provider(this.modelId) };
+      }
+      case "google": {
+        const mod = await import("@ai-sdk/google");
+        const factory = extractProviderFactory(mod, "createGoogleGenerativeAI");
+        const provider = factory({ apiKey });
+        return { model: provider(this.modelId) };
+      }
+      case "custom-openai": {
+        const mod = await import("@ai-sdk/openai");
+        const factory = extractProviderFactory(mod, "createOpenAI");
+        const opts = { apiKey };
+        if (this.customBaseUrl !== void 0) opts["baseURL"] = this.customBaseUrl;
+        const provider = factory(opts);
+        return { model: provider(this.modelId) };
+      }
+    }
+  }
+  /**
+   * Maps our CompletionRequest to AI SDK generateText options.
+   */
+  buildSdkOptions(request) {
+    const options = {
+      model: this.model,
+      messages: request.messages.map((m) => ({
+        role: m.role === "system" ? "system" : m.role,
+        content: typeof m.content === "string" ? m.content : m.content.map((c) => {
+          if (c.type === "text") return { type: "text", text: c.text };
+          return c;
+        })
+      }))
+    };
+    if (request.systemPrompt !== void 0) {
+      options["system"] = request.systemPrompt;
+    }
+    if (request.temperature !== void 0) {
+      options["temperature"] = request.temperature;
+    }
+    if (request.maxTokens !== void 0) {
+      options["maxTokens"] = request.maxTokens;
+    }
+    if (request.stop !== void 0) {
+      options["stopSequences"] = request.stop;
+    }
+    return options;
+  }
+  async complete(request) {
+    try {
+      await this.ensureInitialized();
+      this.logRequest(request);
+      const sdk = this.sdkFunctions;
+      if (sdk === void 0) {
+        throw new Error(
+          `SDK not initialized for model '${this.sdkConfig.modelId}' (provider: ${this.sdkProviderId}). Ensure ensureInitialized() completes before calling complete().`
+        );
+      }
+      const options = this.buildSdkOptions(request);
+      const result = await sdk.generateText(options);
+      const response = {
+        content: [{ type: "text", text: result.text }],
+        usage: {
+          inputTokens: result.usage.inputTokens ?? 0,
+          outputTokens: result.usage.outputTokens ?? 0,
+          totalTokens: result.usage.totalTokens ?? 0
+        },
+        stopReason: mapFinishReason(result.finishReason),
+        model: result.response.modelId
+      };
+      this.logResponse(response);
+      return ok(response);
+    } catch (error) {
+      const code = categorizeError(error);
+      return this.toErrorResult(error, code);
+    }
+  }
+  async *stream(request) {
+    await this.ensureInitialized();
+    this.logRequest(request);
+    const sdk = this.sdkFunctions;
+    if (sdk === void 0) {
+      throw new AdapterModelError("SDK not initialized after ensureInitialized()", {
+        code: ErrorCode.CONFIG_INVALID
+      });
+    }
+    const options = this.buildSdkOptions(request);
+    yield { type: "message_start", message: { model: this.modelId } };
+    const result = sdk.streamText(options);
+    let index = 0;
+    yield { type: "content_block_start", index, contentBlock: { type: "text", text: "" } };
+    for await (const text of result.textStream) {
+      if (text === "") continue;
+      yield {
+        type: "content_block_delta",
+        index,
+        delta: { type: "text_delta", text }
+      };
+    }
+    yield { type: "content_block_stop", index };
+    index++;
+    yield {
+      type: "message_delta",
+      delta: { stop_reason: "end_turn" },
+      usage: { inputTokens: 0, outputTokens: 0, totalTokens: 0 }
+    };
+    yield { type: "message_stop" };
+  }
+  /**
+   * Converts a caught error into a Result error with categorized ErrorCode.
+   */
+  toErrorResult(error, code) {
+    const message = getErrorMessage(error);
+    const safeMessage = sanitizeOutput(message);
+    const errorObj = error instanceof Error ? error : new Error(safeMessage);
+    this.logger.error(`SDK adapter error (${this.sdkProviderId})`, errorObj);
+    const modelError = new AdapterModelError(`${this.sdkProviderId} SDK error: ${safeMessage}`, {
+      code
+    });
+    return { ok: false, error: modelError };
+  }
+};
+
+// src/cli-adapters/cli-detection-cache.ts
+import { z } from "zod";
+var CliDetectionCacheConfigSchema = z.object({
+  ttlMs: z.number().min(1e3).max(36e5).default(3e5)
+});
+var DEFAULT_CACHE_CONFIG = {
+  ttlMs: 3e5,
+  // 5 minutes
+  adaptiveTtl: true
+};
+var ADAPTIVE_MULTIPLIER_HEALTHY = 2;
+var ADAPTIVE_MULTIPLIER_UNHEALTHY = 0.25;
+var ADAPTIVE_STREAK_THRESHOLD = 2;
+var CliDetectionCache = class {
+  config;
+  logger;
+  cache = /* @__PURE__ */ new Map();
+  /** Consecutive same-health-status count per CLI (for adaptive TTL). */
+  streaks = /* @__PURE__ */ new Map();
+  hits = 0;
+  misses = 0;
+  lastReset = new Date(getTimeProvider().now());
+  constructor(config) {
+    const validated = CliDetectionCacheConfigSchema.parse({
+      ttlMs: config?.ttlMs ?? DEFAULT_CACHE_CONFIG.ttlMs
+    });
+    this.config = {
+      ...validated,
+      adaptiveTtl: config?.adaptiveTtl ?? DEFAULT_CACHE_CONFIG.adaptiveTtl,
+      logger: config?.logger
+    };
+    this.logger = config?.logger ?? createLogger({ component: "CliDetectionCache" });
+    this.logger.debug("CliDetectionCache initialized", { ttlMs: this.config.ttlMs });
+  }
+  get(cli) {
+    const result = this.cache.get(cli);
+    if (result === void 0) {
+      this.misses++;
+      this.logger.debug("Cache miss", { cli });
+      return void 0;
+    }
+    if (this.isStale(cli)) {
+      this.misses++;
+      this.logger.debug("Cache stale", { cli, checkedAt: result.checkedAt });
+      return void 0;
+    }
+    this.hits++;
+    this.logger.debug("Cache hit", { cli, healthy: result.healthy });
+    return result;
+  }
+  set(cli, result) {
+    this.cache.set(cli, result);
+    this.updateStreak(cli, result.healthy);
+    this.logger.debug("Cache updated", {
+      cli,
+      healthy: result.healthy,
+      version: result.version
+    });
+  }
+  isStale(cli) {
+    const result = this.cache.get(cli);
+    if (result === void 0) return true;
+    const age = getTimeProvider().now() - result.checkedAt.getTime();
+    return age > this.getEffectiveTtl(cli);
+  }
+  /** Returns the effective TTL for a CLI, applying adaptive multiplier if enabled. */
+  getEffectiveTtl(cli) {
+    if (this.config.adaptiveTtl === false) return this.config.ttlMs;
+    const streak = this.streaks.get(cli);
+    if (streak === void 0 || streak.count < ADAPTIVE_STREAK_THRESHOLD) {
+      return this.config.ttlMs;
+    }
+    const multiplier = streak.healthy ? ADAPTIVE_MULTIPLIER_HEALTHY : ADAPTIVE_MULTIPLIER_UNHEALTHY;
+    return this.config.ttlMs * multiplier;
+  }
+  updateStreak(cli, healthy) {
+    const prev = this.streaks.get(cli);
+    if (prev?.healthy === healthy) {
+      this.streaks.set(cli, { healthy, count: prev.count + 1 });
+    } else {
+      this.streaks.set(cli, { healthy, count: 1 });
+    }
+  }
+  invalidate(cli) {
+    if (cli !== void 0) {
+      this.cache.delete(cli);
+      this.streaks.delete(cli);
+      this.logger.info("Cache invalidated", { cli });
+    } else {
+      this.cache.clear();
+      this.streaks.clear();
+      this.logger.info("Cache cleared");
+    }
+  }
+  getAll() {
+    return this.cache;
+  }
+  getStats() {
+    const total = this.hits + this.misses;
+    return {
+      size: this.cache.size,
+      hits: this.hits,
+      misses: this.misses,
+      hitRate: total > 0 ? this.hits / total : 0,
+      lastReset: this.lastReset
+    };
+  }
+  /**
+   * Resets cache statistics.
+   */
+  resetStats() {
+    this.hits = 0;
+    this.misses = 0;
+    this.lastReset = new Date(getTimeProvider().now());
+    this.logger.debug("Cache stats reset");
+  }
+  /**
+   * Converts HealthStatus to CliHealthResult for caching.
+   */
+  static fromHealthStatus(status) {
+    return {
+      healthy: status.healthy,
+      version: status.version,
+      versionStatus: status.versionStatus,
+      checkedAt: status.lastChecked,
+      message: status.message
+    };
+  }
+};
+function createCliDetectionCache(config) {
+  return new CliDetectionCache(config);
+}
+
+// src/adapters/auto-adapter.ts
+var defaultLogger = createLogger({ component: "auto-adapter" });
+function resolveCache(config, logger6) {
+  if (config.cache !== void 0) {
+    return config.cache;
+  }
+  const enableCache = config.enableCache ?? true;
+  return enableCache ? createCliDetectionCache({ logger: logger6 }) : void 0;
+}
+async function tryCliAdapter(config, logger6, cache) {
+  const preferredCli = config.preferredCli;
+  const bridgeConfig = config.defaultCliTimeoutMs !== void 0 ? { defaultTimeoutMs: config.defaultCliTimeoutMs } : void 0;
+  if (preferredCli !== void 0 && await isCliAvailable(preferredCli, cache)) {
+    logger6.info("Using preferred CLI", { cli: preferredCli });
+    const cliAdapter2 = createCliAdapter({ cli: preferredCli, logger: logger6 });
+    await cliAdapter2.initialize();
+    return {
+      adapter: createCliToModelAdapter(cliAdapter2, bridgeConfig),
+      source: "cli",
+      name: preferredCli,
+      reason: `Preferred CLI '${preferredCli}' is available (model selection handled by CLI)`,
+      cache
+    };
+  }
+  const availableClis = await getAvailableClis(cache);
+  if (availableClis.length === 0) {
+    logger6.info("No CLI adapters available");
+    return null;
+  }
+  const selectedCli = availableClis[0];
+  if (selectedCli === void 0) {
+    return null;
+  }
+  logger6.info("Auto-selected CLI", { cli: selectedCli, available: availableClis });
+  const cliAdapter = createCliAdapter({ cli: selectedCli, logger: logger6 });
+  await cliAdapter.initialize();
+  return {
+    adapter: createCliToModelAdapter(cliAdapter, bridgeConfig),
+    source: "cli",
+    name: selectedCli,
+    reason: `Using '${selectedCli}' CLI (model selection handled by CLI)`,
+    cache
+  };
+}
+function resolveApiKeyFromEnv(configKey, envVar) {
+  const key = configKey ?? process.env[envVar];
+  return key !== void 0 && key.length > 0 ? key : void 0;
+}
+function tryApiAdapter(config, logger6) {
+  const claudeModelId = getCliModelName(getDefaultModelForCli("claude"));
+  const codexModelId = getCliModelName(getDefaultModelForCli("codex"));
+  const geminiModelId = getCliModelName(getDefaultModelForCli("gemini"));
+  const anthropicKey = resolveApiKeyFromEnv(config.anthropicApiKey, "ANTHROPIC_API_KEY");
+  if (anthropicKey !== void 0) {
+    logger6.info("Using Anthropic API adapter", { model: claudeModelId });
+    return {
+      adapter: createClaudeAdapter({ modelId: claudeModelId, apiKey: anthropicKey }),
+      source: "api",
+      name: "anthropic",
+      reason: `Using Anthropic API (native adapter, model: ${claudeModelId})`
+    };
+  }
+  const openaiKey = resolveApiKeyFromEnv(config.openaiApiKey, "OPENAI_API_KEY");
+  if (openaiKey !== void 0) {
+    logger6.info("Using OpenAI API adapter (AI SDK)", { model: codexModelId });
+    return {
+      adapter: new SdkAdapter({ providerId: "openai", modelId: codexModelId, apiKey: openaiKey }),
+      source: "api",
+      name: "openai",
+      reason: `Using OpenAI API via AI SDK (model: ${codexModelId})`
+    };
+  }
+  const googleKey = resolveApiKeyFromEnv(config.googleApiKey, "GOOGLE_AI_API_KEY");
+  if (googleKey !== void 0) {
+    logger6.info("Using Google AI API adapter (AI SDK)", { model: geminiModelId });
+    return {
+      adapter: new SdkAdapter({
+        providerId: "google",
+        modelId: geminiModelId,
+        apiKey: googleKey
+      }),
+      source: "api",
+      name: "google",
+      reason: `Using Google AI API via AI SDK (model: ${geminiModelId})`
+    };
+  }
+  const custom = tryCustomOpenAiAdapter(logger6);
+  if (custom !== null) return custom;
+  logger6.info("No API keys available for any provider");
+  return null;
+}
+function tryCustomOpenAiAdapter(logger6) {
+  const customKey = resolveApiKeyFromEnv(void 0, "NEXUS_CUSTOM_API_KEY");
+  const customBaseUrl = process.env["NEXUS_CUSTOM_API_BASE_URL"];
+  if (customKey === void 0 || customBaseUrl === void 0 || customBaseUrl === "") {
+    return null;
+  }
+  const customModelId = process.env["NEXUS_CUSTOM_MODEL"] ?? CUSTOM_API_DEFAULT_MODEL;
+  logger6.info("Using custom-openai SDK adapter", {
+    model: customModelId,
+    baseUrl: customBaseUrl
+  });
+  return {
+    adapter: new SdkAdapter({
+      providerId: "custom-openai",
+      modelId: customModelId,
+      apiKey: customKey,
+      baseUrl: customBaseUrl
+    }),
+    source: "api",
+    name: "custom-openai",
+    reason: `Using custom OpenAI-compatible gateway at ${customBaseUrl} (model: ${customModelId})`
+  };
+}
+function resolveApiVendor(name) {
+  switch (name) {
+    case "anthropic":
+      return { vendor: "anthropic", slot: "claude" };
+    case "openai":
+      return { vendor: "openai", slot: "codex" };
+    case "google":
+      return { vendor: "google", slot: "gemini" };
+    case "custom-openai":
+      return { vendor: "custom-openai", slot: "opencode" };
+    default:
+      return void 0;
+  }
+}
+function wrapApiSelectionForRouter(selection) {
+  if (selection.source !== "api") return null;
+  const resolved = resolveApiVendor(selection.name);
+  if (resolved === void 0) return null;
+  const adapter = createModelToCliAdapter(selection.adapter, {
+    name: resolved.slot,
+    capabilities: buildCliCapabilityProfiles()[resolved.slot]
+  });
+  return { armId: apiArmId(resolved.vendor), adapter };
+}
+function buildApiSelectionForVendor(vendor, logger6) {
+  switch (vendor) {
+    case "anthropic": {
+      const key = resolveApiKeyFromEnv(void 0, "ANTHROPIC_API_KEY");
+      if (key === void 0) return null;
+      const modelId = getCliModelName(getDefaultModelForCli("claude"));
+      return {
+        adapter: createClaudeAdapter({ modelId, apiKey: key }),
+        source: "api",
+        name: "anthropic",
+        reason: `Using Anthropic API (native adapter, model: ${modelId})`
+      };
+    }
+    case "openai": {
+      const key = resolveApiKeyFromEnv(void 0, "OPENAI_API_KEY");
+      if (key === void 0) return null;
+      const modelId = getCliModelName(getDefaultModelForCli("codex"));
+      return {
+        adapter: new SdkAdapter({ providerId: "openai", modelId, apiKey: key }),
+        source: "api",
+        name: "openai",
+        reason: `Using OpenAI API via AI SDK (model: ${modelId})`
+      };
+    }
+    case "google": {
+      const key = resolveApiKeyFromEnv(void 0, "GOOGLE_AI_API_KEY");
+      if (key === void 0) return null;
+      const modelId = getCliModelName(getDefaultModelForCli("gemini"));
+      return {
+        adapter: new SdkAdapter({ providerId: "google", modelId, apiKey: key }),
+        source: "api",
+        name: "google",
+        reason: `Using Google AI API via AI SDK (model: ${modelId})`
+      };
+    }
+    case "custom-openai":
+      return tryCustomOpenAiAdapter(logger6);
+    default: {
+      const exhaustive = vendor;
+      throw new Error(`Unknown API vendor: ${String(exhaustive)}`);
+    }
+  }
+}
+var API_ROUTING_VENDORS = [
+  "anthropic",
+  "openai",
+  "google",
+  "custom-openai"
+];
+function collectApiRoutingArms(logger6 = defaultLogger) {
+  const arms = [];
+  for (const vendor of API_ROUTING_VENDORS) {
+    const selection = buildApiSelectionForVendor(vendor, logger6);
+    if (selection === null) continue;
+    const wrapped = wrapApiSelectionForRouter(selection);
+    if (wrapped !== null) arms.push(wrapped);
+  }
+  return arms;
+}
+async function selectCliFirst(config, logger6, cache) {
+  const cliResult = await tryCliAdapter(config, logger6, cache);
+  if (cliResult !== null) return cliResult;
+  const apiResult = tryApiAdapter(config, logger6);
+  if (apiResult !== null) return apiResult;
+  throw new Error(
+    "No adapters available. Install a CLI (claude/gemini/codex) or set ANTHROPIC_API_KEY, OPENAI_API_KEY, or GOOGLE_AI_API_KEY."
+  );
+}
+async function selectApiFirst(config, logger6, cache) {
+  const apiResult = tryApiAdapter(config, logger6);
+  if (apiResult !== null) return apiResult;
+  const cliResult = await tryCliAdapter(config, logger6, cache);
+  if (cliResult !== null) return cliResult;
+  throw new Error(
+    "No adapters available. Set ANTHROPIC_API_KEY/OPENAI_API_KEY/GOOGLE_AI_API_KEY or install a CLI (claude/gemini/codex)."
+  );
+}
+async function selectCliOnly(config, logger6, cache) {
+  const cliResult = await tryCliAdapter(config, logger6, cache);
+  if (cliResult !== null) return cliResult;
+  throw new Error(
+    "No CLI adapters available. Install and authenticate claude, gemini, or codex CLI."
+  );
+}
+function selectApiOnly(config, logger6) {
+  const apiResult = tryApiAdapter(config, logger6);
+  if (apiResult !== null) return apiResult;
+  throw new Error(
+    "No API key available. Set ANTHROPIC_API_KEY, OPENAI_API_KEY, or GOOGLE_AI_API_KEY."
+  );
+}
+async function createAutoAdapter(config = {}) {
+  const logger6 = config.logger ?? defaultLogger;
+  const priority = config.priority ?? "cli-first";
+  const cache = resolveCache(config, logger6);
+  logger6.info("Auto-selecting adapter", { priority, cacheEnabled: cache !== void 0 });
+  switch (priority) {
+    case "cli-first":
+      return selectCliFirst(config, logger6, cache);
+    case "api-first":
+      return selectApiFirst(config, logger6, cache);
+    case "cli-only":
+      return selectCliOnly(config, logger6, cache);
+    case "api-only":
+      return selectApiOnly(config, logger6);
+    default: {
+      const exhaustive = priority;
+      throw new Error(`Unknown priority: ${String(exhaustive)}`);
+    }
+  }
+}
 
 // src/cli-adapters/subprocess-adapter.ts
 import { spawn } from "child_process";
@@ -315,7 +1709,7 @@ function calculateBackoffDelay(attempt, baseDelayMs, maxDelayMs) {
 function isRetryableError(code) {
   return RETRYABLE_ERROR_CODES.has(code);
 }
-function categorizeError(error) {
+function categorizeError2(error) {
   switch (error.code) {
     case "TIMEOUT":
       return "timeout";
@@ -339,7 +1733,7 @@ async function executeCliRetryLoop(executeFn, config) {
     }
     lastError = result.error;
     if (config.circuitBreaker !== void 0 && config.circuitBreaker !== null) {
-      config.circuitBreaker.recordFailure(categorizeError(lastError));
+      config.circuitBreaker.recordFailure(categorizeError2(lastError));
     }
     if (!shouldRetry(lastError, attempt, maxAttempts, config.circuitBreaker)) {
       return err(lastError);
@@ -691,38 +2085,6 @@ function buildChildEnv(cliName) {
   return childEnv;
 }
 
-// src/security/output-sanitizer.ts
-var REDACTED_KEY_PLACEHOLDER = "[REDACTED_KEY]";
-var KEY_PATTERNS = [
-  // Anthropic: sk-ant-api03-... (at least 20 chars after prefix)
-  /sk-ant-[A-Za-z0-9_-]{20,}/g,
-  // OpenAI project: sk-proj-... (at least 20 chars after prefix)
-  /sk-proj-[A-Za-z0-9_-]{20,}/g,
-  // Generic OpenAI: sk-... (at least 20 chars after prefix)
-  /sk-[A-Za-z0-9_-]{20,}/g,
-  // Google AI / Gemini: AIzaSy... (at least 30 chars total)
-  /AIzaSy[A-Za-z0-9_-]{24,}/g,
-  // GitHub PAT: ghp_...
-  /ghp_[A-Za-z0-9]{20,}/g,
-  // GitHub OAuth: gho_...
-  /gho_[A-Za-z0-9]{20,}/g,
-  // GitLab PAT: glpat-...
-  /glpat-[A-Za-z0-9_-]{10,}/g,
-  // npm token: npm_...
-  /npm_[A-Za-z0-9]{20,}/g,
-  // PyPI token: pypi-...
-  /pypi-[A-Za-z0-9_-]{20,}/g
-];
-function sanitizeOutput(text) {
-  if (text === "") return text;
-  let result = text;
-  for (const pattern of KEY_PATTERNS) {
-    pattern.lastIndex = 0;
-    result = result.replace(pattern, REDACTED_KEY_PLACEHOLDER);
-  }
-  return result;
-}
-
 // src/cli-adapters/cli-error-envelope.ts
 function isClaudeErrorEnvelope(v) {
   if (typeof v !== "object" || v === null) return false;
@@ -3000,139 +4362,6 @@ ${task.content}` : task.content;
   }
 };
 
-// src/cli-adapters/cli-detection-cache.ts
-import { z } from "zod";
-var CliDetectionCacheConfigSchema = z.object({
-  ttlMs: z.number().min(1e3).max(36e5).default(3e5)
-});
-var DEFAULT_CACHE_CONFIG = {
-  ttlMs: 3e5,
-  // 5 minutes
-  adaptiveTtl: true
-};
-var ADAPTIVE_MULTIPLIER_HEALTHY = 2;
-var ADAPTIVE_MULTIPLIER_UNHEALTHY = 0.25;
-var ADAPTIVE_STREAK_THRESHOLD = 2;
-var CliDetectionCache = class {
-  config;
-  logger;
-  cache = /* @__PURE__ */ new Map();
-  /** Consecutive same-health-status count per CLI (for adaptive TTL). */
-  streaks = /* @__PURE__ */ new Map();
-  hits = 0;
-  misses = 0;
-  lastReset = new Date(getTimeProvider().now());
-  constructor(config) {
-    const validated = CliDetectionCacheConfigSchema.parse({
-      ttlMs: config?.ttlMs ?? DEFAULT_CACHE_CONFIG.ttlMs
-    });
-    this.config = {
-      ...validated,
-      adaptiveTtl: config?.adaptiveTtl ?? DEFAULT_CACHE_CONFIG.adaptiveTtl,
-      logger: config?.logger
-    };
-    this.logger = config?.logger ?? createLogger({ component: "CliDetectionCache" });
-    this.logger.debug("CliDetectionCache initialized", { ttlMs: this.config.ttlMs });
-  }
-  get(cli) {
-    const result = this.cache.get(cli);
-    if (result === void 0) {
-      this.misses++;
-      this.logger.debug("Cache miss", { cli });
-      return void 0;
-    }
-    if (this.isStale(cli)) {
-      this.misses++;
-      this.logger.debug("Cache stale", { cli, checkedAt: result.checkedAt });
-      return void 0;
-    }
-    this.hits++;
-    this.logger.debug("Cache hit", { cli, healthy: result.healthy });
-    return result;
-  }
-  set(cli, result) {
-    this.cache.set(cli, result);
-    this.updateStreak(cli, result.healthy);
-    this.logger.debug("Cache updated", {
-      cli,
-      healthy: result.healthy,
-      version: result.version
-    });
-  }
-  isStale(cli) {
-    const result = this.cache.get(cli);
-    if (result === void 0) return true;
-    const age = getTimeProvider().now() - result.checkedAt.getTime();
-    return age > this.getEffectiveTtl(cli);
-  }
-  /** Returns the effective TTL for a CLI, applying adaptive multiplier if enabled. */
-  getEffectiveTtl(cli) {
-    if (this.config.adaptiveTtl === false) return this.config.ttlMs;
-    const streak = this.streaks.get(cli);
-    if (streak === void 0 || streak.count < ADAPTIVE_STREAK_THRESHOLD) {
-      return this.config.ttlMs;
-    }
-    const multiplier = streak.healthy ? ADAPTIVE_MULTIPLIER_HEALTHY : ADAPTIVE_MULTIPLIER_UNHEALTHY;
-    return this.config.ttlMs * multiplier;
-  }
-  updateStreak(cli, healthy) {
-    const prev = this.streaks.get(cli);
-    if (prev?.healthy === healthy) {
-      this.streaks.set(cli, { healthy, count: prev.count + 1 });
-    } else {
-      this.streaks.set(cli, { healthy, count: 1 });
-    }
-  }
-  invalidate(cli) {
-    if (cli !== void 0) {
-      this.cache.delete(cli);
-      this.streaks.delete(cli);
-      this.logger.info("Cache invalidated", { cli });
-    } else {
-      this.cache.clear();
-      this.streaks.clear();
-      this.logger.info("Cache cleared");
-    }
-  }
-  getAll() {
-    return this.cache;
-  }
-  getStats() {
-    const total = this.hits + this.misses;
-    return {
-      size: this.cache.size,
-      hits: this.hits,
-      misses: this.misses,
-      hitRate: total > 0 ? this.hits / total : 0,
-      lastReset: this.lastReset
-    };
-  }
-  /**
-   * Resets cache statistics.
-   */
-  resetStats() {
-    this.hits = 0;
-    this.misses = 0;
-    this.lastReset = new Date(getTimeProvider().now());
-    this.logger.debug("Cache stats reset");
-  }
-  /**
-   * Converts HealthStatus to CliHealthResult for caching.
-   */
-  static fromHealthStatus(status) {
-    return {
-      healthy: status.healthy,
-      version: status.version,
-      versionStatus: status.versionStatus,
-      checkedAt: status.lastChecked,
-      message: status.message
-    };
-  }
-};
-function createCliDetectionCache(config) {
-  return new CliDetectionCache(config);
-}
-
 // src/cli/cli-auth-probe.ts
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
@@ -3354,6 +4583,11 @@ function createAllAdapters(logger6, codexTransport = "mcp") {
   adapters.set("gemini", new GeminiCliAdapter(options));
   adapters.set("codex", createCodexAdapter(codexTransport, options ?? {}));
   adapters.set("opencode", new OpenCodeCliAdapter(options));
+  if (process.env["NEXUS_BILLING_MODE"] === "api") {
+    for (const { armId, adapter } of collectApiRoutingArms(logger6)) {
+      adapters.set(armId, adapter);
+    }
+  }
   return adapters;
 }
 async function isCliAvailable(cli, cache) {
@@ -3408,9 +4642,17 @@ async function getAvailableClis(cache) {
 }
 
 export {
+  generateCacheKey,
+  messagesToAnthropicFormat,
+  extractSystemPrompt,
+  extractRequestSystemPrompt,
   sleep,
   delay,
   withTimeout,
+  CLAUDE_MODELS,
+  CLAUDE_MODEL_ALIASES,
+  ClaudeAdapter,
+  createClaudeAdapter,
   CLI_TIMEOUT_PROFILES,
   DEFAULT_TIMEOUT_PROFILE,
   getTimeoutForTask,
@@ -3418,10 +4660,9 @@ export {
   getTimeoutForTaskAuto,
   calculateBackoffDelay,
   isRetryableError,
-  categorizeError,
+  categorizeError2 as categorizeError,
   executeCliRetryLoop,
   BaseCliAdapter,
-  sanitizeOutput,
   authRemediation,
   SubprocessCliAdapter,
   asRecord,
@@ -3443,6 +4684,8 @@ export {
   createCliAdapter,
   createAllAdapters,
   isCliAvailable,
-  getAvailableClis
+  getAvailableClis,
+  SdkAdapter,
+  createAutoAdapter
 };
-//# sourceMappingURL=chunk-VIHUOFIT.js.map
+//# sourceMappingURL=chunk-2MPLNCGG.js.map