nexus-agents 2.109.1 → 2.109.3

package/dist/{chunk-RCN76RFJ.js → chunk-XJTVIYD7.js}

@@ -19,7 +19,7 @@ import {
   delay,
   getAvailableClis,
   withTimeout
-} from "./chunk-N5I4PC3P.js";
+} from "./chunk-RRIATGO4.js";
 import {
   mapModelErrorToCategory
 } from "./chunk-K3UILZ5X.js";
@@ -6127,7 +6127,7 @@ async function processVotesWithCascade(engineVotes, opts) {
 var CONTRARIAN_ESCALATION_THRESHOLD = 0.8;
 async function runContrarianCheck(proposal, log) {
   try {
-    const { executeExpert } = await import("./expert-bridge-N7PLXYBV.js");
+    const { executeExpert } = await import("./expert-bridge-K5TTFOSI.js");
     const prompt = [
       "You are a contrarian analyst. Your job is to find reasons this proposal should be REJECTED.",
       "Look for: YAGNI (not needed), MISALIGNED (wrong tech/architecture), SECURITY_RISK, SCOPE_CREEP.",
@@ -6611,4 +6611,4 @@ export {
   CONSENSUS_VOTE_OUTPUT_SCHEMA,
   registerConsensusVoteTool
 };
-//# sourceMappingURL=chunk-RCN76RFJ.js.map
+//# sourceMappingURL=chunk-XJTVIYD7.js.map

package/dist/cli.js

@@ -24,7 +24,7 @@ import {
 import {
   setupCommandAsync,
   verifyCommand
-} from "./chunk-IUDSDQIF.js";
+} from "./chunk-DYZIT5UH.js";
 import "./chunk-V5UOHHOD.js";
 import {
   AuthHandler,
@@ -166,7 +166,7 @@ import {
   validateCommand,
   validateWorkflow,
   wrapInMarkdownFence
-} from "./chunk-O737ZOZ6.js";
+} from "./chunk-CWT7BYHU.js";
 import "./chunk-3ACDP4E6.js";
 import {
   resolveToken
@@ -179,7 +179,7 @@ import "./chunk-LLM3HY54.js";
 import "./chunk-H47QJVMR.js";
 import {
   shutdownExpertBridge
-} from "./chunk-HBPDYYIT.js";
+} from "./chunk-H7K2CWCL.js";
 import {
   DEFAULT_VOTE_TIMEOUT_MS,
   ErrorPolicySchema,
@@ -189,7 +189,7 @@ import {
   executeVoting,
   registerConsensusVoteTool,
   warnIfSimulatedOutsideTests
-} from "./chunk-RCN76RFJ.js";
+} from "./chunk-XJTVIYD7.js";
 import {
   loadPapersRegistry,
   loadTechniquesRegistry,
@@ -249,7 +249,7 @@ import {
   loadConfig,
   runDoctor,
   validateNexusEnv
-} from "./chunk-SAR5IO7V.js";
+} from "./chunk-LGLMWGRY.js";
 import "./chunk-NUBSJGQZ.js";
 import {
   capitalize,
@@ -261,11 +261,11 @@ import {
   getAvailableClis,
   isRecord,
   probeAllClis
-} from "./chunk-N5I4PC3P.js";
+} from "./chunk-RRIATGO4.js";
 import "./chunk-H6Q3EPQG.js";
 import {
   DEFAULTS
-} from "./chunk-ZFDG2CDY.js";
+} from "./chunk-4C6M5YOH.js";
 import "./chunk-K3UILZ5X.js";
 import "./chunk-RMTFEDQV.js";
 import "./chunk-IJZGHD7O.js";
@@ -20594,7 +20594,7 @@ async function handleSetupCommandAsync(args) {
   process.exit(exitCode === 0 ? EXIT_CODES.SUCCESS : EXIT_CODES.SERVER_START_FAILED);
 }
 async function runCustomApiSetup(args) {
-  const { configureCustomApi } = await import("./setup-custom-api-SMLJ27IY.js");
+  const { configureCustomApi } = await import("./setup-custom-api-UTROX3FM.js");
   const baseUrl = args.options.customApi;
   if (baseUrl === void 0) return EXIT_CODES.SERVER_START_FAILED;
   const input = {

package/dist/{consensus-vote-HK5G3DYU.js → consensus-vote-NILXRDWC.js}

@@ -6,13 +6,13 @@ import {
   executeVoting,
   registerConsensusVoteTool,
   resetCorrelationTracker
-} from "./chunk-RCN76RFJ.js";
+} from "./chunk-XJTVIYD7.js";
 import "./chunk-4QH4IHCY.js";
 import "./chunk-5H3YYSMY.js";
 import "./chunk-6T3EPABN.js";
-import "./chunk-N5I4PC3P.js";
+import "./chunk-RRIATGO4.js";
 import "./chunk-H6Q3EPQG.js";
-import "./chunk-ZFDG2CDY.js";
+import "./chunk-4C6M5YOH.js";
 import "./chunk-K3UILZ5X.js";
 import "./chunk-RMTFEDQV.js";
 import "./chunk-IJZGHD7O.js";
@@ -30,4 +30,4 @@ export {
   registerConsensusVoteTool,
   resetCorrelationTracker
 };
-//# sourceMappingURL=consensus-vote-HK5G3DYU.js.map
+//# sourceMappingURL=consensus-vote-NILXRDWC.js.map

package/dist/{expert-bridge-N7PLXYBV.js → expert-bridge-K5TTFOSI.js}

@@ -3,7 +3,7 @@ import {
   shutdownExpertBridge,
   tokenSplitFromUsage,
   totalTokensFromUsage
-} from "./chunk-HBPDYYIT.js";
+} from "./chunk-H7K2CWCL.js";
 import "./chunk-RMTFEDQV.js";
 import "./chunk-VO7FEIXD.js";
 import "./chunk-CH7QIDHQ.js";
@@ -14,4 +14,4 @@ export {
   tokenSplitFromUsage,
   totalTokensFromUsage
 };
-//# sourceMappingURL=expert-bridge-N7PLXYBV.js.map
+//# sourceMappingURL=expert-bridge-K5TTFOSI.js.map

package/dist/{factory-UVXXFLOI.js → factory-KAYVCFRV.js}

@@ -3,9 +3,9 @@ import {
   createCliAdapter,
   getAvailableClis,
   isCliAvailable
-} from "./chunk-N5I4PC3P.js";
+} from "./chunk-RRIATGO4.js";
 import "./chunk-H6Q3EPQG.js";
-import "./chunk-ZFDG2CDY.js";
+import "./chunk-4C6M5YOH.js";
 import "./chunk-K3UILZ5X.js";
 import "./chunk-RMTFEDQV.js";
 import "./chunk-IJZGHD7O.js";
@@ -18,4 +18,4 @@ export {
   getAvailableClis,
   isCliAvailable
 };
-//# sourceMappingURL=factory-UVXXFLOI.js.map
+//# sourceMappingURL=factory-KAYVCFRV.js.map

package/dist/index.d.ts

@@ -7288,6 +7288,12 @@ declare class SdkAdapter extends BaseAdapter {
     private readonly customBaseUrl;
     /** Inflight init promise for coalescing concurrent calls (Issue #1438). */
     private initPromise;
+    /**
+     * Cached result of the DNS-resolve-time SSRF check for custom-openai
+     * (#3426). Resolved once on first init so we don't re-resolve the gateway
+     * hostname on every request. `undefined` until the check has run.
+     */
+    private resolveSsrfChecked;
     constructor(config: SdkAdapterConfig, logger?: ILogger);
     /**
      * Lazily initialize the AI SDK model and functions.
@@ -7296,6 +7302,14 @@ declare class SdkAdapter extends BaseAdapter {
      */
     private ensureInitialized;
     private doInitialize;
+    /**
+     * For custom-openai only: run the DNS-resolve-time SSRF check exactly once
+     * and throw if the gateway hostname resolves to a private address (#3426).
+     * Cached via `resolveSsrfChecked` so the hostname is not re-resolved on
+     * every request. No-op for non-custom providers (built-in endpoints are
+     * trusted) and when no custom base URL is configured.
+     */
+    private ensureCustomHostResolvesPublic;
     /**
      * Loads the provider-specific AI SDK module.
      *

package/dist/index.js

@@ -517,7 +517,7 @@ import {
   validateWorkflow,
   validateWorkflowDependencies,
   withLogging
-} from "./chunk-O737ZOZ6.js";
+} from "./chunk-CWT7BYHU.js";
 import "./chunk-3ACDP4E6.js";
 import {
   getTokenEnvVars,
@@ -537,7 +537,7 @@ import {
 } from "./chunk-H47QJVMR.js";
 import {
   executeExpert
-} from "./chunk-HBPDYYIT.js";
+} from "./chunk-H7K2CWCL.js";
 import {
   AgentFindingSchema,
   AgentPerformanceSchema,
@@ -604,7 +604,7 @@ import {
   resetGlobalRegistry,
   withModelNotFoundFallback,
   wrapResilientWithFallback
-} from "./chunk-RCN76RFJ.js";
+} from "./chunk-XJTVIYD7.js";
 import "./chunk-UIFDDBIG.js";
 import {
   AgentActionSchema,
@@ -723,7 +723,7 @@ import {
   getKnownNexusVarNames,
   startStdioServer,
   validateNexusEnv
-} from "./chunk-SAR5IO7V.js";
+} from "./chunk-LGLMWGRY.js";
 import "./chunk-NUBSJGQZ.js";
 import "./chunk-6T3EPABN.js";
 import {
@@ -763,7 +763,7 @@ import {
   isRetryableError,
   messagesToAnthropicFormat,
   sleep
-} from "./chunk-N5I4PC3P.js";
+} from "./chunk-RRIATGO4.js";
 import {
   AdapterModelError,
   BaseAdapter,
@@ -791,7 +791,7 @@ import {
 import {
   DEFAULTS,
   PROVIDER_ENV_KEYS
-} from "./chunk-ZFDG2CDY.js";
+} from "./chunk-4C6M5YOH.js";
 import "./chunk-K3UILZ5X.js";
 import {
   AvailabilityCache,
@@ -6082,7 +6082,7 @@ function buildVotingInput(plan, config) {
 }
 async function executeSingleVote(plan, config, log) {
   try {
-    const { executeVoting } = await import("./consensus-vote-HK5G3DYU.js");
+    const { executeVoting } = await import("./consensus-vote-NILXRDWC.js");
     const input = buildVotingInput(plan, config);
     const result = await executeVoting(input, log);
     return parseVotingResult(result);

package/dist/{setup-command-O4BGMJIC.js → setup-command-ZTIRFLFV.js}

@@ -8,14 +8,14 @@ import {
   runWizard,
   setupCommand,
   setupCommandAsync
-} from "./chunk-IUDSDQIF.js";
+} from "./chunk-DYZIT5UH.js";
 import "./chunk-V5UOHHOD.js";
-import "./chunk-SAR5IO7V.js";
+import "./chunk-LGLMWGRY.js";
 import "./chunk-NUBSJGQZ.js";
 import "./chunk-6T3EPABN.js";
-import "./chunk-N5I4PC3P.js";
+import "./chunk-RRIATGO4.js";
 import "./chunk-H6Q3EPQG.js";
-import "./chunk-ZFDG2CDY.js";
+import "./chunk-4C6M5YOH.js";
 import "./chunk-K3UILZ5X.js";
 import "./chunk-RMTFEDQV.js";
 import "./chunk-IJZGHD7O.js";
@@ -34,4 +34,4 @@ export {
   setupCommand,
   setupCommandAsync
 };
-//# sourceMappingURL=setup-command-O4BGMJIC.js.map
+//# sourceMappingURL=setup-command-ZTIRFLFV.js.map

package/dist/{setup-custom-api-SMLJ27IY.js → setup-custom-api-UTROX3FM.js}

@@ -3,7 +3,7 @@ import {
   CUSTOM_API_BASE_URL_ENV,
   CUSTOM_API_DEFAULT_MODEL,
   validateCustomApiBaseUrl
-} from "./chunk-ZFDG2CDY.js";
+} from "./chunk-4C6M5YOH.js";
 import {
   err,
   ok
@@ -104,4 +104,4 @@ function buildShellFragment(params) {
 export {
   configureCustomApi
 };
-//# sourceMappingURL=setup-custom-api-SMLJ27IY.js.map
+//# sourceMappingURL=setup-custom-api-UTROX3FM.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexus-agents",
-  "version": "2.109.1",
+  "version": "2.109.3",
   "description": "Governance substrate for AI coding agents — adversarial PR review, drift-detected rules, immutable audit, and closed-loop outcome routing for Claude, Codex, Gemini, and OpenCode",
   "mcpName": "io.github.nexus-substrate/nexus-agents",
   "license": "MIT",